From nobody Wed Jan 3 10:57:52 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6334E126FB3 for ; Wed, 3 Jan 2018 10:57:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xddAix1g-hQ7 for ; Wed, 3 Jan 2018 10:57:48 -0800 (PST) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D32A1126DEE for ; Wed, 3 Jan 2018 10:57:46 -0800 (PST) X-AuditID: c1b4fb2d-b4dff70000007932-99-5a4d27a80d26 Received: from ESESSHC007.ericsson.se (Unknown_Domain [153.88.183.39]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id 5D.94.31026.8A72D4A5; Wed, 3 Jan 2018 19:57:45 +0100 (CET) Received: from ESESSMB109.ericsson.se ([169.254.9.206]) by ESESSHC007.ericsson.se ([153.88.183.39]) with mapi id 14.03.0352.000; Wed, 3 Jan 2018 19:57:44 +0100 From: Christer Holmberg To: IETF STIR Mail List Thread-Topic: draft-ietf-stir-rfc4474bis-16: Syntax question Thread-Index: AdOEw5NeB+uYQibOTjeCuIYC3y7mnw== Date: Wed, 3 Jan 2018 18:57:44 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B6C0E903C@ESESSMB109.ericsson.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.149] Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B6C0E903CESESSMB109erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrCLMWRmVeSWpSXmKPExsUyM2K7uu5Kdd8og/PTmS2Wr93G5MDosWTJ T6YAxigum5TUnMyy1CJ9uwSujJYNkxkLLhlUNL69zNzAeFuri5GTQ0LARKL7Sy97FyMXh5DA YUaJ87NPsoAkhAQWM0r8a9DpYuTgYBOwkOj+pw0SFhFQl2ht62MGsYUFzCVaTm1ihYjbSNz8 vIwdwtaTeLZtEVicRUBFovXYIWaQMbwCvhIPGqNBwowCYhLfT61hArGZBcQlbj2ZzwRxjoDE kj3nmSFsUYmXj/+xQthKEmsPb2eBqM+XeDX9G9gqXgFBiZMzn7BMYBSchWTULCRls5CUQcR1 JBbs/sQGYWtLLFv4mhnGPnPgMROy+AJG9lWMosWpxcW56UbGeqlFmcnFxfl5enmpJZsYgWF/ cMtv3R2Mq187HmIU4GBU4uG9LeMbJcSaWFZcmXuIUYKDWUmE1y3LJ0qINyWxsiq1KD++qDQn tfgQozQHi5I470lP3ighgfTEktTs1NSC1CKYLBMHp1QDo8X8nZ4Lj/PqlRTItx88b8g5MXmf bJZGUcTpBq+F21nf/Gn4cSWu+O08SRF2j079uLYEpzizeWEnTuQtWn351ocVJzeoiZx4YKvW r7O/66PSZKEr63NkC21b/z6s9F318vkHXsk0uU0i+cvmHeDYr6z4M92Py4cl/23aPNGzf37k zr+/QFCiSYmlOCPRUIu5qDgRAD+FoU93AgAA Archived-At: Subject: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Jan 2018 18:57:50 -0000 --_000_7594FB04B1934943A5C02806D1A2204B6C0E903CESESSMB109erics_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, Section 4 says: "Note that unlike the prior specification in RFC4474, the Identity header field is now allowed to appear more than one time in a SIP request. The revised grammar for the Identity header field builds on the ABNF [RFC5234] in RFC 3261 [RFC3261] Section 25. It is as follows: Identity =3D "Identity" HCOLON signed-identity-digest SEMI ident-info *( SEMI ident-info-params ) ..." However, that syntax does NOT allow multiple Identity header fields, accord= ing to the rules in RFC 3261: "Multiple header field rows with the same field-name MAY be present in a message if and only if the entire field-value for that header field is defined as a comma-separated list" It should be something like: Identity =3D "Identity" HCOLON signed-identity * (COMMA signed-identit= y) signed-identity =3D signed-identity-digest SEMI identi-info * (SEMI id= ent-info-params) ..." Or, misunderstood I have? Regards, Christer --_000_7594FB04B1934943A5C02806D1A2204B6C0E903CESESSMB109erics_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi,

 

Section 4 says:

 

   “Note that unlike the prior speci= fication

   in RFC4474, the Identity header field i= s now allowed to appear more

   than one time in a SIP request.  T= he revised grammar for the Identity

   header field builds on the ABNF [RFC523= 4] in RFC 3261 [RFC3261]

   Section 25.  It is as follows:

 

      Identity =3D "Id= entity" HCOLON signed-identity-digest SEMI

      ident-info *( SEMI id= ent-info-params )

      …”

 

However, that syntax does NOT allow multiple Identit= y header fields, according to the rules in RFC 3261:

 

   “Multiple header field rows with = the same field-name MAY be present in

   a message if and only if the entire fie= ld-value for that header field

   is defined as a comma-separated list= 221;

 

It should be something like:

 

     Identity =3D "Identity" HCOLON signed= -identity * (COMMA signed-identity)

 &nb= sp;   signed-identity =3D signed-identity-digest SEMI identi-info= * (SEMI ident-info-params)

 &nb= sp;   …”

&nbs= p;

Or, misun= derstood I have?

&nbs= p;

Regards,<= o:p>

&nbs= p;

Christer<= o:p>

 

--_000_7594FB04B1934943A5C02806D1A2204B6C0E903CESESSMB109erics_-- From nobody Wed Jan 3 12:43:08 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E978F126C83 for ; Wed, 3 Jan 2018 12:43:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6SNgxCaNaZ56 for ; Wed, 3 Jan 2018 12:43:05 -0800 (PST) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B58521201FA for ; Wed, 3 Jan 2018 12:43:05 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 1E5073009FC for ; Wed, 3 Jan 2018 15:43:05 -0500 (EST) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id hIFc0sm9flHt for ; Wed, 3 Jan 2018 15:43:04 -0500 (EST) Received: from a860b60074bd.home (pool-108-45-101-150.washdc.fios.verizon.net [108.45.101.150]) by mail.smeinc.net (Postfix) with ESMTPSA id 4900E3004AA for ; Wed, 3 Jan 2018 15:43:04 -0500 (EST) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Wed, 3 Jan 2018 15:43:03 -0500 References: To: IETF STIR Mail List In-Reply-To: Message-Id: X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [stir] Should the STIR WG Adopt draft-wendt-stir-passport-shaken? X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Jan 2018 20:43:07 -0000 There was support for adoption of this document in Singapore, and no one = has spoken against adoption on the mail list. So, there is consensus to = adopt this document. Authors, please post an updated Internet-Draft with a file name of = draft-ietf-stir-passport-shaken-00. For the STIR WG Chairs, Russ > On Dec 20, 2017, at 2:35 PM, Russ Housley = wrote: >=20 > draft-wendt-stir-passport-shaken was discussed in the recent meeting = in Singapore. Please indicate whether or not you believe the STIR WG = should adopt this document. Please respond no later than 3 January = 2018. >=20 > For the STIR WG Chairs, > Russ From nobody Wed Jan 3 17:58:38 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70A2112D7F0 for ; Wed, 3 Jan 2018 17:58:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ovkd8ak3xzrC for ; Wed, 3 Jan 2018 17:58:34 -0800 (PST) Received: from qproxy2.mail.unifiedlayer.com (qproxy2-pub.mail.unifiedlayer.com [69.89.16.161]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 415CC1271FD for ; Wed, 3 Jan 2018 17:58:34 -0800 (PST) Received: from cmgw2 (unknown [10.0.90.83]) by qproxy2.mail.unifiedlayer.com (Postfix) with ESMTP id 07EA4357DA for ; Wed, 3 Jan 2018 18:58:33 -0700 (MST) Received: from box462.bluehost.com ([74.220.219.62]) by cmgw2 with id u1yV1w0011MNPNq011yY9U; Wed, 03 Jan 2018 18:58:33 -0700 X-Authority-Analysis: v=2.2 cv=doKrMxo4 c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=IkcTkHD0fZMA:10 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=RgaUWeydRksA:10 a=jqBRFv0mrdUA:10 a=ZZnuYtJkoWoA:10 a=ll-iCDY8AAAA:8 a=M0OflfRGAAAA:8 a=48vgC7mUAAAA:8 a=tGX7uwomAAAA:8 a=NNimq0MuBj6Nvf6rsGgA:9 a=RFTgx6fl8LBsT6Z0:21 a=T1nwGm0K3kAyjzgO:21 a=QEXdDO2ut3YA:10 a=ivbTfD_dPm4A:10 a=VpyrLIdO_Ztbr3SWPBuH:22 a=6yl0mh0s51TKORVA8GqK:22 a=w1C3t2QeGrPiZgrLijVG:22 a=ZFOOzkjxzLGrPE5HuMia:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:In-Reply-To :References:Message-ID:To:From:Subject:Date:Sender:Reply-To:Cc:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=525Ed5cZzlvxxn5q85D5yezdREex/H3AY8e8rNvx83E=; b=Lym7eBxZfe0OkigtT6A5F8K9Dv 39xIHPWf8E6ULsfgrKkT1Ine783bygK0TP/FGQy7LqbGLFxpXeRfXKtvieTdcXODudu4l2zWqsZ+D B+Rdj8Q2clM+QjZTmDhb0w05O; Received: from pool-100-36-44-145.washdc.fios.verizon.net ([100.36.44.145]:60688 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.89) (envelope-from ) id 1eWunc-001kR6-Nk; Wed, 03 Jan 2018 18:58:28 -0700 User-Agent: Microsoft-MacOutlook/f.29.0.171205 Date: Wed, 03 Jan 2018 20:58:27 -0500 From: Richard Shockey To: Russ Housley , IETF STIR Mail List Message-ID: <4D0FC7F6-6FA3-4F47-B844-AF526230356C@shockey.us> Thread-Topic: [stir] Should the STIR WG Adopt draft-wendt-stir-passport-shaken? References: In-Reply-To: Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-BWhitelist: no X-Source-IP: 100.36.44.145 X-Exim-ID: 1eWunc-001kR6-Nk X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-44-145.washdc.fios.verizon.net ([192.168.1.152]) [100.36.44.145]:60688 X-Source-Auth: richard+shockey.us X-Email-Count: 1 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== X-Local-Domain: yes Archived-At: Subject: Re: [stir] Should the STIR WG Adopt draft-wendt-stir-passport-shaken? X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Jan 2018 01:58:36 -0000 +1 yes please.=20 =E2=80=94=20 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook =E2=80=93Twitter rshockey101 PSTN +1 703-593-2683 =20 On 1/3/18, 3:43 PM, "stir on behalf of Russ Housley" wrote: There was support for adoption of this document in Singapore, and no on= e has spoken against adoption on the mail list. So, there is consensus to a= dopt this document. =20 Authors, please post an updated Internet-Draft with a file name of draf= t-ietf-stir-passport-shaken-00. =20 For the STIR WG Chairs, Russ =20 =20 =20 > On Dec 20, 2017, at 2:35 PM, Russ Housley wrot= e: >=20 > draft-wendt-stir-passport-shaken was discussed in the recent meeting = in Singapore. Please indicate whether or not you believe the STIR WG should= adopt this document. Please respond no later than 3 January 2018. >=20 > For the STIR WG Chairs, > Russ =20 _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir =20 From nobody Thu Jan 4 02:10:37 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB280126C89 for ; Thu, 4 Jan 2018 02:10:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UwUaNwnk-jsG for ; Thu, 4 Jan 2018 02:10:33 -0800 (PST) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 65A131205F0 for ; Thu, 4 Jan 2018 02:10:33 -0800 (PST) X-AuditID: c1b4fb2d-f179c9c000007932-48-5a4dfd972f0e Received: from ESESSHC023.ericsson.se (Unknown_Domain [153.88.183.87]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id 88.CE.31026.79DFD4A5; Thu, 4 Jan 2018 11:10:31 +0100 (CET) Received: from ESESSMB109.ericsson.se ([169.254.9.206]) by ESESSHC023.ericsson.se ([153.88.183.87]) with mapi id 14.03.0352.000; Thu, 4 Jan 2018 11:10:08 +0100 From: Christer Holmberg To: IETF STIR Mail List Thread-Topic: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question Thread-Index: AQHThUQyZyoy+/XlrUiMFiAHHHW6kw== Date: Thu, 4 Jan 2018 10:10:08 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.7.170905 x-originating-ip: [153.88.183.17] Content-Type: multipart/alternative; boundary="_000_D673CC58284BAchristerholmbergericssoncom_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrNLMWRmVeSWpSXmKPExsUyM2J7uO70v75RBpNWilosX7uNyYHRY8mS n0wBjFFcNimpOZllqUX6dglcGdN+HWcrmGVf8WJKA1sD4w7zLkZODgkBE4ljbcfZuxi5OIQE DjNKHH55hREkISSwmFFizaXKLkYODjYBC4nuf9ogYREBdYnWtj5mEFtYwEni4dkjzBBxZ4nf TV/YIWw9iSe3jrOC2CwCKhLvPuxgAhnDK2AtMWeSJEiYUUBM4vupNUwgNrOAuMStJ/OZIM4R kFiy5zwzhC0q8fLxP7AxokAjN5y4zQ4yRkJAUWJ5vxxEa4LE5A9fwFp5BQQlTs58wjKBUWgW kqmzkJTNQlIGETeQeH9uPjOErS2xbOFrKFtfYuOXs4wQtrXExx/PGZHVLGDkWMUoWpxaXJyb bmSsl1qUmVxcnJ+nl5dasokRGCUHt/zW3cG4+rXjIUYBDkYlHt5rb32jhFgTy4orcw8xSnAw K4nw+rwGCvGmJFZWpRblxxeV5qQWH2KU5mBREuc96ckbJSSQnliSmp2aWpBaBJNl4uCUamDs Tb3ELrbrjrtcz+MaRm6OsyzbhJZPdFi1LHv2ouU7hd2lyy2F62UDFSYFylkZvfs+ce6KR8Fm zIxmiy+deMD2jen1Xa7DU38avy06/WfSZoHU+5of3zn6C92c0PrquG2o/3T9ndf1Y5Qz7K/1 r2ZOimA9z9ogZbVOWUfkWfcOpS8Ntr+SekqUWIozEg21mIuKEwHzQNrzjgIAAA== Archived-At: Subject: Re: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Jan 2018 10:10:36 -0000 --_000_D673CC58284BAchristerholmbergericssoncom_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Is it still possible to fix this in the document, or do we file an errata o= nce the RFC has been published? Regards, Christer From: stir > on behalf = of Christer Holmberg > Date: Wednesday 3 January 2018 at 20:57 To: IETF STIR Mail List > Subject: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question Hi, Section 4 says: =93Note that unlike the prior specification in RFC4474, the Identity header field is now allowed to appear more than one time in a SIP request. The revised grammar for the Identity header field builds on the ABNF [RFC5234] in RFC 3261 [RFC3261] Section 25. It is as follows: Identity =3D "Identity" HCOLON signed-identity-digest SEMI ident-info *( SEMI ident-info-params ) =85=94 However, that syntax does NOT allow multiple Identity header fields, accord= ing to the rules in RFC 3261: =93Multiple header field rows with the same field-name MAY be present in a message if and only if the entire field-value for that header field is defined as a comma-separated list=94 It should be something like: Identity =3D "Identity" HCOLON signed-identity * (COMMA signed-identit= y) signed-identity =3D signed-identity-digest SEMI identi-info * (SEMI id= ent-info-params) =85=94 Or, misunderstood I have? Regards, Christer --_000_D673CC58284BAchristerholmbergericssoncom_ Content-Type: text/html; charset="Windows-1252" Content-ID: <62E42679238EC544B79F7DB805D16A27@ericsson.com> Content-Transfer-Encoding: quoted-printable
Is it still possible to fix this in the document, or do we file an err= ata once the RFC has been published?

Regards,

Christer

From: stir <stir-bounces@ietf.org> on behalf of Christer Ho= lmberg <christer.holmb= erg@ericsson.com>
Date: Wednesday 3 January 2018 at 2= 0:57
To: IETF STIR Mail List <stir@ietf.org>
Subject: [stir] draft-ietf-stir-rfc= 4474bis-16: Syntax question

Hi,

 

Section 4 says:

 

   =93Note that unlike the prior specifica= tion

   in RFC4474, the Identity header field i= s now allowed to appear more

   than one time in a SIP request.  T= he revised grammar for the Identity

   header field builds on the ABNF [RFC523= 4] in RFC 3261 [RFC3261]

   Section 25.  It is as follows:

 

      Identity =3D "Id= entity" HCOLON signed-identity-digest SEMI

      ident-info *( SEMI id= ent-info-params )

      =85=94

 

However, that syntax does NOT allow multiple Identit= y header fields, according to the rules in RFC 3261:

 

   =93Multiple header field rows with the = same field-name MAY be present in

   a message if and only if the entire fie= ld-value for that header field

   is defined as a comma-separated list=94=

 

It should be something like:

 

     Identity =3D "Identity" HCOLON signed= -identity * (COMMA signed-identity)

 &nb= sp;   signed-identity =3D signed-identity-digest SEMI identi-info= * (SEMI ident-info-params)

 &nb= sp;   =85=94

&nbs= p;

Or, misun= derstood I have?

&nbs= p;

Regards,<= o:p>

&nbs= p;

Christer<= o:p>

 

 --_000_D673CC58284BAchristerholmbergericssoncom_-- From nobody Thu Jan 4 07:52:44 2018 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 67412126BFD; Thu, 4 Jan 2018 07:52:42 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: stir@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.68.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <151508116237.23682.6929661898382784558@ietfa.amsl.com> Date: Thu, 04 Jan 2018 07:52:42 -0800 Archived-At: Subject: [stir] I-D Action: draft-ietf-stir-rph-02.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Jan 2018 15:52:42 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Telephone Identity Revisited WG of the IETF. Title : PASSporT Extension for Resource-Priority Authorization Authors : Ray P. Singh Martin Dolly Subir Das An Nguyen Filename : draft-ietf-stir-rph-02.txt Pages : 9 Date : 2018-01-04 Abstract: This document extends the STIR PASSporT specification to allow the inclusion of cryptographically-signed assertions of authorization for the values populated in the SIP 'Resource-Priority' header field, which is used for communications resource prioritization. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-rph/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-stir-rph-02 https://datatracker.ietf.org/doc/html/draft-ietf-stir-rph-02 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-rph-02 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Jan 4 10:30:19 2018 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4363C126E64; Thu, 4 Jan 2018 10:30:18 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Russ Housley To: X-Test-IDTracker: no X-IETF-IDTracker: 6.68.2 Auto-Submitted: auto-generated Precedence: bulk Cc: stir@ietf.org, rhousley@vigilsec.com, iesg-secretary@ietf.org, stir-chairs@ietf.org, Russ Housley Message-ID: <151509061827.23714.5314235460913824588.idtracker@ietfa.amsl.com> Date: Thu, 04 Jan 2018 10:30:18 -0800 Archived-At: Subject: [stir] Publication has been requested for draft-ietf-stir-rph-02 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Jan 2018 18:30:18 -0000 Russ Housley has requested publication of draft-ietf-stir-rph-02 as Proposed Standard on behalf of the STIR working group. Please verify the document's state at https://datatracker.ietf.org/doc/draft-ietf-stir-rph/ From nobody Mon Jan 8 07:23:52 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 887A712D574 for ; Mon, 8 Jan 2018 07:23:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rL_jkeW8rFxD for ; Mon, 8 Jan 2018 07:23:39 -0800 (PST) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C78C3127137 for ; Mon, 8 Jan 2018 07:23:38 -0800 (PST) X-AuditID: c1b4fb30-11d5e9c000006bc7-42-5a538cf859ab Received: from ESESSHC018.ericsson.se (Unknown_Domain [153.88.183.72]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id ED.56.27591.8FC835A5; Mon, 8 Jan 2018 16:23:36 +0100 (CET) Received: from ESESSMB109.ericsson.se ([169.254.9.206]) by ESESSHC018.ericsson.se ([153.88.183.72]) with mapi id 14.03.0352.000; Mon, 8 Jan 2018 16:23:35 +0100 From: Christer Holmberg To: IETF STIR Mail List Thread-Topic: draft-ietf-stir-passport-divert: two Identity header fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question] Thread-Index: AQHTiJSmfTFRlLNLiUGvsT+nvKtlHw== Date: Mon, 8 Jan 2018 15:23:35 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.7.170905 x-originating-ip: [153.88.183.19] Content-Type: multipart/alternative; boundary="_000_D6795B4D2873Achristerholmbergericssoncom_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrPLMWRmVeSWpSXmKPExsUyM2K7h+6PnuAog9WXLC2Wr93G5MDosWTJ T6YAxigum5TUnMyy1CJ9uwSujEn7lzIV9PlXdH3czdrAuNa1i5GTQ0LAROLFuw/sXYxcHEIC hxkl7qw9ywjhLGaUeN79lqmLkYODTcBCovufNkiDiIC6RGtbHzOILSxQI9E29RsrSL2IQCOj xN21V1ghivQkWjYvZwGxWQRUJJ5sWAJm8wpYS9x6sIQNxGYUEJP4fmoNE4jNLCAucevJfCaI iwQkluw5zwxhi0q8fPwPbKYo0MwNJ26zQ8QVJdqfNjBC9CZIvFq5C2q+oMTJmU9YJjAKzUIy dhaSsllIyiDiBhLvz81nhrC1JZYtfA1l60ts/HKWEcK2lmg5/4oRWc0CRo5VjKLFqcVJuelG RnqpRZnJxcX5eXp5qSWbGIHRcnDLb4MdjC+fOx5iFOBgVOLhjawNjhJiTSwrrsw9xCjBwawk wisUDRTiTUmsrEotyo8vKs1JLT7EKM3BoiTOe9KTN0pIID2xJDU7NbUgtQgmy8TBKdXAGP12 rkdETEi28cLA75alUhXsq12dDQ4VvTfbEB+oMHXv5HAJO5+j6zdNqXPKv6ad+v9r0TLN0K39 liln3HPWyWU1Ol0Tnt0/0frwk4db5h/TL2Gdz/IjUffivdvcZT0THwYFR8/9KfAzrWfVoyO6 H64zm+yz9eDVffdzomeb1sH51T8ST/z7qsRSnJFoqMVcVJwIAJCfGVKSAgAA Archived-At: Subject: [stir] draft-ietf-stir-passport-divert: two Identity header fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question] X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jan 2018 15:23:41 -0000 --_000_D6795B4D2873Achristerholmbergericssoncom_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hi, Related to my issue below, I think it would be good to show a complete exam= ple with two Identity header fields in section 4.1 of draft-ietf-stir-passp= ort-divert-01. Regards, Christer From: stir > on behalf = of Christer Holmberg > Date: Thursday 4 January 2018 at 12:10 To: IETF STIR Mail List > Subject: Re: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question Is it still possible to fix this in the document, or do we file an errata o= nce the RFC has been published? Regards, Christer From: stir > on behalf = of Christer Holmberg > Date: Wednesday 3 January 2018 at 20:57 To: IETF STIR Mail List > Subject: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question Hi, Section 4 says: =93Note that unlike the prior specification in RFC4474, the Identity header field is now allowed to appear more than one time in a SIP request. The revised grammar for the Identity header field builds on the ABNF [RFC5234] in RFC 3261 [RFC3261] Section 25. It is as follows: Identity =3D "Identity" HCOLON signed-identity-digest SEMI ident-info *( SEMI ident-info-params ) =85=94 However, that syntax does NOT allow multiple Identity header fields, accord= ing to the rules in RFC 3261: =93Multiple header field rows with the same field-name MAY be present in a message if and only if the entire field-value for that header field is defined as a comma-separated list=94 It should be something like: Identity =3D "Identity" HCOLON signed-identity * (COMMA signed-identit= y) signed-identity =3D signed-identity-digest SEMI identi-info * (SEMI id= ent-info-params) =85=94 Or, misunderstood I have? Regards, Christer --_000_D6795B4D2873Achristerholmbergericssoncom_ Content-Type: text/html; charset="Windows-1252" Content-ID: <5F6D4F28BAC3D948B9B6BED7BF0E9D0F@ericsson.com> Content-Transfer-Encoding: quoted-printable
Hi,

Related to my issue below, I think it would be good to show a complete= example with two Identity header fields in section 4.1 of draft-ietf-= stir-passport-divert-01. 

Regards,

Christer

From: stir <stir-bounces@ietf.org> on behalf of Christer Ho= lmberg <christer.holmb= erg@ericsson.com>
Date: Thursday 4 January 2018 at 12= :10
To: IETF STIR Mail List <stir@ietf.org>
Subject: Re: [stir] draft-ietf-stir= -rfc4474bis-16: Syntax question

Is it still possible to fix this in the document, or do we file an err= ata once the RFC has been published?

Regards,

Christer

From: stir <stir-bounces@ietf.org> on behalf of Christer Ho= lmberg <christer.holmb= erg@ericsson.com>
Date: Wednesday 3 January 2018 at 2= 0:57
To: IETF STIR Mail List <stir@ietf.org>
Subject: [stir] draft-ietf-stir-rfc= 4474bis-16: Syntax question

Hi,

 

Section 4 says:

 

   =93Note that unlike the prior specifica= tion

   in RFC4474, the Identity header field i= s now allowed to appear more

   than one time in a SIP request.  T= he revised grammar for the Identity

   header field builds on the ABNF [RFC523= 4] in RFC 3261 [RFC3261]

   Section 25.  It is as follows:

 

      Identity =3D "Id= entity" HCOLON signed-identity-digest SEMI

      ident-info *( SEMI id= ent-info-params )

      =85=94

 

However, that syntax does NOT allow multiple Identit= y header fields, according to the rules in RFC 3261:

 

   =93Multiple header field rows with the = same field-name MAY be present in

   a message if and only if the entire fie= ld-value for that header field

   is defined as a comma-separated list=94=

 

It should be something like:

 

     Identity =3D "Identity" HCOLON signed= -identity * (COMMA signed-identity)

 &nb= sp;   signed-identity =3D signed-identity-digest SEMI identi-info= * (SEMI ident-info-params)

 &nb= sp;   =85=94

&nbs= p;

Or, misun= derstood I have?

&nbs= p;

Regards,<= o:p>

&nbs= p;

Christer<= o:p>

 

 --_000_D6795B4D2873Achristerholmbergericssoncom_-- From nobody Mon Jan 8 14:05:42 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6D77129C59 for ; Mon, 8 Jan 2018 14:05:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.889 X-Spam-Level: X-Spam-Status: No, score=-1.889 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, T_RP_MATCHES_RCVD=-0.01, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bMvd7XCL__0i for ; Mon, 8 Jan 2018 14:05:37 -0800 (PST) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D76A8120726 for ; Mon, 8 Jan 2018 14:05:37 -0800 (PST) Received: from Orochi.local (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id w08M5WPk048273 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Mon, 8 Jan 2018 16:05:33 -0600 (CST) (envelope-from adam@nostrum.com) X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be Orochi.local To: Christer Holmberg , IETF STIR Mail List References: From: Adam Roach Message-ID: <6418489c-996c-3f73-c111-c82437e80356@nostrum.com> Date: Mon, 8 Jan 2018 16:05:27 -0600 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------B2DDF923E0C748D8498AF3DE" Content-Language: en-US Archived-At: Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity header fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question] X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jan 2018 22:05:40 -0000 This is a multi-part message in MIME format. --------------B2DDF923E0C748D8498AF3DE Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit [as responsible AD] Christer -- Thanks for looking closely at 4474bis and offering up your comments. Based on the current state of things, I don't think changes are warranted at this time. This document is in AUTH48 with sign-offs from all but one author. While discovery of a catastrophic error would be enough to warrant additional working-group crafting on the document, I don't see anything here that is catastrophic. The multiple-header issue you describe is a bit confusing, but that appears to be a flaw in RFC3261 more than this document. Importantly, the section of 3261 you cite is followed by: > The exceptions > to this rule are the WWW-Authenticate, Authorization, Proxy- > Authenticate, and Proxy-Authorization header fields. Multiple header > field rows with these names MAY be present in a message, but since > their grammar does not follow the general form listed inSection 7.3 , > they MUST NOT be combined into a single header field row. This, combined with the fact that the syntax of "Identity" *also* doesn't follow the general form listed in RFC 3261 section 7.3, means that the "...MAY... if and only if..." construct you cite also doesn't apply to it. It might have been cleaner to indicate that "Identity" is added to the list of exceptions in section 7.3.1 of RFC 3261, but this seems to be a lack of tidiness rather than a critical flaw in the document. I will note that the decision not to allow comma separation appears to have been intentional [1], and was mentioned as recently as last June on the mailing list [2]. In that light, I believe that your request would functionally be asking to reverse prior working group consensus rather than fixing an error. We are well past the point of revisiting past working group decisions on this document. /a ____ [1] Although I can't find the corresponding minutes or email, I have a vague recollection of discussions about which syntax would be more likely to be compatible with exiting RFC4474 implementations, with the current syntax reflecting the outcome of those discussions. [2] https://mailarchive.ietf.org/arch/msg/stir/tAhE7jD6OWTlGHO-MLQavpODm1s On 1/8/18 09:23, Christer Holmberg wrote: > Hi, > > Related to my issue below, I think it would be good to show a complete > example with two Identity header fields in section 4.1 > of draft-ietf-stir-passport-divert-01. > > Regards, > > Christer > > From: stir > on > behalf of Christer Holmberg > > Date: Thursday 4 January 2018 at 12:10 > To: IETF STIR Mail List > > Subject: Re: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question > > Is it still possible to fix this in the document, or do we file an > errata once the RFC has been published? > > Regards, > > Christer > > From: stir > on > behalf of Christer Holmberg > > Date: Wednesday 3 January 2018 at 20:57 > To: IETF STIR Mail List > > Subject: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question > > Hi, > > Section 4 says: > >    “Note that unlike the prior specification > >    in RFC4474, the Identity header field is now allowed to appear more > >    than one time in a SIP request.  The revised grammar for the Identity > >    header field builds on the ABNF [RFC5234] in RFC 3261 [RFC3261] > >    Section 25.  It is as follows: > >       Identity = "Identity" HCOLON signed-identity-digest SEMI > >       ident-info *( SEMI ident-info-params ) > >       …” > > However, that syntax does NOT allow multiple Identity header fields, > according to the rules in RFC 3261: > >    “Multiple header field rows with the same field-name MAY be present in > >    a message if and only if the entire field-value for that header field > >    is defined as a comma-separated list” > > It should be something like: > > Identity = "Identity" HCOLON signed-identity * (COMMA signed-identity) > > signed-identity = signed-identity-digest SEMI identi-info * (SEMI > ident-info-params) > >      …” > > Or, misunderstood I have? > > Regards, > > Christer > > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir --------------B2DDF923E0C748D8498AF3DE Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
[as responsible AD]

Christer --

Thanks for looking closely at 4474bis and offering up your comments. Based on the current state of things, I don't think changes are warranted at this time.

This document is in AUTH48 with sign-offs from all but one author. While discovery of a catastrophic error would be enough to warrant additional working-group crafting on the document, I don't see anything here that is catastrophic. The multiple-header issue you describe is a bit confusing, but that appears to be a flaw in RFC3261 more than this document. Importantly, the section of 3261 you cite is followed by:

   The exceptions
   to this rule are the WWW-Authenticate, Authorization, Proxy-
   Authenticate, and Proxy-Authorization header fields.  Multiple header
   field rows with these names MAY be present in a message, but since
   their grammar does not follow the general form listed in Section 7.3,
   they MUST NOT be combined into a single header field row.

This, combined with the fact that the syntax of "Identity" *also* doesn't follow the general form listed in RFC 3261 section 7.3, means that the "...MAY... if and only if..." construct you cite also doesn't apply to it. It might have been cleaner to indicate that "Identity" is added to the list of exceptions in section 7.3.1 of RFC 3261, but this seems to be a lack of tidiness rather than a critical flaw in the document.

I will note that the decision not to allow comma separation appears to have been intentional [1], and was mentioned as recently as last June on the mailing list [2]. In that light, I believe that your request would functionally be asking to reverse prior working group consensus rather than fixing an error. We are well past the point of revisiting past working group decisions on this document.

/a

____
[1] Although I can't find the corresponding minutes or email, I have a vague recollection of discussions about which syntax would be more likely to be compatible with exiting RFC4474 implementations, with the current syntax reflecting the outcome of those discussions.

[2] https://mailarchive.ietf.org/arch/msg/stir/tAhE7jD6OWTlGHO-MLQavpODm1s


On 1/8/18 09:23, Christer Holmberg wrote:
Hi,

Related to my issue below, I think it would be good to show a complete example with two Identity header fields in section 4.1 of draft-ietf-stir-passport-divert-01. 

Regards,

Christer

From: stir <stir-bounces@ietf.org> on behalf of Christer Holmberg <christer.holmberg@ericsson.com>
Date: Thursday 4 January 2018 at 12:10
To: IETF STIR Mail List <stir@ietf.org>
Subject: Re: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question

Is it still possible to fix this in the document, or do we file an errata once the RFC has been published?

Regards,

Christer

From: stir <stir-bounces@ietf.org> on behalf of Christer Holmberg <christer.holmberg@ericsson.com>
Date: Wednesday 3 January 2018 at 20:57
To: IETF STIR Mail List <stir@ietf.org>
Subject: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question

Hi,

 

Section 4 says:

 

   “Note that unlike the prior specification

   in RFC4474, the Identity header field is now allowed to appear more

   than one time in a SIP request.  The revised grammar for the Identity

   header field builds on the ABNF [RFC5234] in RFC 3261 [RFC3261]

   Section 25.  It is as follows:

 

      Identity = "Identity" HCOLON signed-identity-digest SEMI

      ident-info *( SEMI ident-info-params )

      …”

 

However, that syntax does NOT allow multiple Identity header fields, according to the rules in RFC 3261:

 

   “Multiple header field rows with the same field-name MAY be present in

   a message if and only if the entire field-value for that header field

   is defined as a comma-separated list”

 

It should be something like:

 

     Identity = "Identity" HCOLON signed-identity * (COMMA signed-identity)

     signed-identity = signed-identity-digest SEMI identi-info * (SEMI ident-info-params)

     …”

 

Or, misunderstood I have?

 

Regards,

 

Christer

 

 

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir


--------------B2DDF923E0C748D8498AF3DE-- From nobody Mon Jan 8 14:25:34 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB877124BFA for ; Mon, 8 Jan 2018 14:25:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zp6ixKvE_lBI for ; Mon, 8 Jan 2018 14:25:29 -0800 (PST) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 08ECF1200F1 for ; Mon, 8 Jan 2018 14:25:28 -0800 (PST) X-AuditID: c1b4fb30-d49ff70000006bc7-0d-5a53efd63d8d Received: from ESESSHC007.ericsson.se (Unknown_Domain [153.88.183.39]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id ED.56.27591.6DFE35A5; Mon, 8 Jan 2018 23:25:27 +0100 (CET) Received: from ESESSMB109.ericsson.se ([169.254.9.206]) by ESESSHC007.ericsson.se ([153.88.183.39]) with mapi id 14.03.0352.000; Mon, 8 Jan 2018 23:25:26 +0100 From: Christer Holmberg To: Adam Roach , IETF STIR Mail List Thread-Topic: [stir] draft-ietf-stir-passport-divert: two Identity header fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question] Thread-Index: AQHTiJSmfTFRlLNLiUGvsT+nvKtlH6Nqd6eAgAAVFrA= Date: Mon, 8 Jan 2018 22:25:25 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B6C0F1BD5@ESESSMB109.ericsson.se> References: <6418489c-996c-3f73-c111-c82437e80356@nostrum.com> In-Reply-To: <6418489c-996c-3f73-c111-c82437e80356@nostrum.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.148] Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B6C0F1BD5ESESSMB109erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupmkeLIzCtJLcpLzFFi42KZGbFdXff6++Aog642Dos9fxexWyxfu43J gcljyZKfTB6zdj5hCWCK4rJJSc3JLEst0rdL4Mo4ev8rS8GDE4wVR5YcYW1g3HGYsYuRk0NC wERi9sNlbF2MXBxCAocZJSYv/8kO4SxmlNiyvheoioODTcBCovufNkiDiICbRMOGv4wgNcIC 7YwSU/fuYgJxRAQ6GCUOfdzPBlFlJTF/1SKwFSwCKhI7Jr0Gi/MK+Ep8nfaWHcQWEiiQWPb6 MpjNKWAvMWHJHjCbUUBM4vupNUwgNrOAuMStJ/OZIE4VkFiy5zwzhC0q8fLxP1YIW0micckT Voj6fIn+bxOZIXYJSpyc+YRlAqPwLCSjZiEpm4WkbBbQn8wCmhLrd+lDlChKTOl+yA5ha0i0 zpnLjiy+gJF9FaNocWpxUm66kZFealFmcnFxfp5eXmrJJkZgFB3c8ttgB+PL546HGAU4GJV4 eOWfB0cJsSaWFVfmHmKU4GBWEuH1nQ8U4k1JrKxKLcqPLyrNSS0+xCjNwaIkznvSkzdKSCA9 sSQ1OzW1ILUIJsvEwSnVwKgU/yFgnb9MZnpEv4ttQmdMxYmsnZZP/zpmi33pyHEoEPLxbTqV bzu1LmtZW9bS2SFh+uyfrl1btqjZY1HkNm22LXo756Yo8OgITfCKVfhzK3jGvNflDhOYpThE Vs8Ia3pg/qXJsin8JX+eVkLXwi97Gcoeeyr/tfiW8/jUfttKx3sWJgG+SizFGYmGWsxFxYkA /v2Qr54CAAA= Archived-At: Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity header fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question] X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jan 2018 22:25:32 -0000 --_000_7594FB04B1934943A5C02806D1A2204B6C0F1BD5ESESSMB109erics_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGksDQoNCkkgZG9u4oCZdCB3YW50IHRvIGNoYW5nZSBhbnkgcHJpb3IgZGVjaXNpb25zIGF0IHRo aXMgcG9pbnQsIHNvIEkgYW0gZmluZSB3aXRoIG5vdCBhbGxvd2luZyBjb21tYSBzZXBhcmF0aW9u LiBJIGp1c3QgaG9wZSBpbXBsZW1lbnRlcnMgd2lsbCByZWFsaXplIHRoZXkgaGF2ZSB0byB1c2Ug dGhlIDMyNjEg4oCcZXhjZXB0aW9uIHJ1bGVz4oCdLg0KDQpJIGd1ZXNzIHdlIGNvdWxkIGNsYXJp ZnkgaXQgaW4gZHJhZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LWRpdmVydCwgdGhvdWdoLCB3aGljaCBk ZWZpbmVzIHVzYWdlIG9mIHR3byBoZWFkZXIgZmllbGRzLg0KDQpSZWdhcmRzLA0KDQpDaHJpc3Rl cg0KDQpGcm9tOiBBZGFtIFJvYWNoIFttYWlsdG86YWRhbUBub3N0cnVtLmNvbV0NClNlbnQ6IDA5 IEphbnVhcnkgMjAxOCAwMDowNQ0KVG86IENocmlzdGVyIEhvbG1iZXJnIDxjaHJpc3Rlci5ob2xt YmVyZ0Blcmljc3Nvbi5jb20+OyBJRVRGIFNUSVIgTWFpbCBMaXN0IDxzdGlyQGlldGYub3JnPg0K U3ViamVjdDogUmU6IFtzdGlyXSBkcmFmdC1pZXRmLXN0aXItcGFzc3BvcnQtZGl2ZXJ0OiB0d28g SWRlbnRpdHkgaGVhZGVyIGZpZWxkcyBbd2FzOiBkcmFmdC1pZXRmLXN0aXItcmZjNDQ3NGJpcy0x NjogU3ludGF4IHF1ZXN0aW9uXQ0KDQpbYXMgcmVzcG9uc2libGUgQURdDQoNCkNocmlzdGVyIC0t DQoNClRoYW5rcyBmb3IgbG9va2luZyBjbG9zZWx5IGF0IDQ0NzRiaXMgYW5kIG9mZmVyaW5nIHVw IHlvdXIgY29tbWVudHMuIEJhc2VkIG9uIHRoZSBjdXJyZW50IHN0YXRlIG9mIHRoaW5ncywgSSBk b24ndCB0aGluayBjaGFuZ2VzIGFyZSB3YXJyYW50ZWQgYXQgdGhpcyB0aW1lLg0KDQpUaGlzIGRv Y3VtZW50IGlzIGluIEFVVEg0OCB3aXRoIHNpZ24tb2ZmcyBmcm9tIGFsbCBidXQgb25lIGF1dGhv ci4gV2hpbGUgZGlzY292ZXJ5IG9mIGEgY2F0YXN0cm9waGljIGVycm9yIHdvdWxkIGJlIGVub3Vn aCB0byB3YXJyYW50IGFkZGl0aW9uYWwgd29ya2luZy1ncm91cCBjcmFmdGluZyBvbiB0aGUgZG9j dW1lbnQsIEkgZG9uJ3Qgc2VlIGFueXRoaW5nIGhlcmUgdGhhdCBpcyBjYXRhc3Ryb3BoaWMuIFRo ZSBtdWx0aXBsZS1oZWFkZXIgaXNzdWUgeW91IGRlc2NyaWJlIGlzIGEgYml0IGNvbmZ1c2luZywg YnV0IHRoYXQgYXBwZWFycyB0byBiZSBhIGZsYXcgaW4gUkZDMzI2MSBtb3JlIHRoYW4gdGhpcyBk b2N1bWVudC4gSW1wb3J0YW50bHksIHRoZSBzZWN0aW9uIG9mIDMyNjEgeW91IGNpdGUgaXMgZm9s bG93ZWQgYnk6DQoNCg0KDQogICBUaGUgZXhjZXB0aW9ucw0KDQogICB0byB0aGlzIHJ1bGUgYXJl IHRoZSBXV1ctQXV0aGVudGljYXRlLCBBdXRob3JpemF0aW9uLCBQcm94eS0NCg0KICAgQXV0aGVu dGljYXRlLCBhbmQgUHJveHktQXV0aG9yaXphdGlvbiBoZWFkZXIgZmllbGRzLiAgTXVsdGlwbGUg aGVhZGVyDQoNCiAgIGZpZWxkIHJvd3Mgd2l0aCB0aGVzZSBuYW1lcyBNQVkgYmUgcHJlc2VudCBp biBhIG1lc3NhZ2UsIGJ1dCBzaW5jZQ0KDQogICB0aGVpciBncmFtbWFyIGRvZXMgbm90IGZvbGxv dyB0aGUgZ2VuZXJhbCBmb3JtIGxpc3RlZCBpbiBTZWN0aW9uIDcuMzxodHRwczovL3Rvb2xzLmll dGYub3JnL2h0bWwvcmZjMzI2MSNzZWN0aW9uLTcuMz4sDQoNCiAgIHRoZXkgTVVTVCBOT1QgYmUg Y29tYmluZWQgaW50byBhIHNpbmdsZSBoZWFkZXIgZmllbGQgcm93Lg0KDQpUaGlzLCBjb21iaW5l ZCB3aXRoIHRoZSBmYWN0IHRoYXQgdGhlIHN5bnRheCBvZiAiSWRlbnRpdHkiICphbHNvKiBkb2Vz bid0IGZvbGxvdyB0aGUgZ2VuZXJhbCBmb3JtIGxpc3RlZCBpbiBSRkMgMzI2MSBzZWN0aW9uIDcu MywgbWVhbnMgdGhhdCB0aGUgIi4uLk1BWS4uLiBpZiBhbmQgb25seSBpZi4uLiIgY29uc3RydWN0 IHlvdSBjaXRlIGFsc28gZG9lc24ndCBhcHBseSB0byBpdC4gSXQgbWlnaHQgaGF2ZSBiZWVuIGNs ZWFuZXIgdG8gaW5kaWNhdGUgdGhhdCAiSWRlbnRpdHkiIGlzIGFkZGVkIHRvIHRoZSBsaXN0IG9m IGV4Y2VwdGlvbnMgaW4gc2VjdGlvbiA3LjMuMSBvZiBSRkMgMzI2MSwgYnV0IHRoaXMgc2VlbXMg dG8gYmUgYSBsYWNrIG9mIHRpZGluZXNzIHJhdGhlciB0aGFuIGEgY3JpdGljYWwgZmxhdyBpbiB0 aGUgZG9jdW1lbnQuDQoNCkkgd2lsbCBub3RlIHRoYXQgdGhlIGRlY2lzaW9uIG5vdCB0byBhbGxv dyBjb21tYSBzZXBhcmF0aW9uIGFwcGVhcnMgdG8gaGF2ZSBiZWVuIGludGVudGlvbmFsIFsxXSwg YW5kIHdhcyBtZW50aW9uZWQgYXMgcmVjZW50bHkgYXMgbGFzdCBKdW5lIG9uIHRoZSBtYWlsaW5n IGxpc3QgWzJdLiBJbiB0aGF0IGxpZ2h0LCBJIGJlbGlldmUgdGhhdCB5b3VyIHJlcXVlc3Qgd291 bGQgZnVuY3Rpb25hbGx5IGJlIGFza2luZyB0byByZXZlcnNlIHByaW9yIHdvcmtpbmcgZ3JvdXAg Y29uc2Vuc3VzIHJhdGhlciB0aGFuIGZpeGluZyBhbiBlcnJvci4gV2UgYXJlIHdlbGwgcGFzdCB0 aGUgcG9pbnQgb2YgcmV2aXNpdGluZyBwYXN0IHdvcmtpbmcgZ3JvdXAgZGVjaXNpb25zIG9uIHRo aXMgZG9jdW1lbnQuDQoNCi9hDQoNCl9fX18NClsxXSBBbHRob3VnaCBJIGNhbid0IGZpbmQgdGhl IGNvcnJlc3BvbmRpbmcgbWludXRlcyBvciBlbWFpbCwgSSBoYXZlIGEgdmFndWUgcmVjb2xsZWN0 aW9uIG9mIGRpc2N1c3Npb25zIGFib3V0IHdoaWNoIHN5bnRheCB3b3VsZCBiZSBtb3JlIGxpa2Vs eSB0byBiZSBjb21wYXRpYmxlIHdpdGggZXhpdGluZyBSRkM0NDc0IGltcGxlbWVudGF0aW9ucywg d2l0aCB0aGUgY3VycmVudCBzeW50YXggcmVmbGVjdGluZyB0aGUgb3V0Y29tZSBvZiB0aG9zZSBk aXNjdXNzaW9ucy4NCg0KWzJdIGh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cv c3Rpci90QWhFN2pENk9XVGxHSE8tTUxRYXZwT0RtMXMNCg0KDQpPbiAxLzgvMTggMDk6MjMsIENo cmlzdGVyIEhvbG1iZXJnIHdyb3RlOg0KSGksDQoNClJlbGF0ZWQgdG8gbXkgaXNzdWUgYmVsb3cs IEkgdGhpbmsgaXQgd291bGQgYmUgZ29vZCB0byBzaG93IGEgY29tcGxldGUgZXhhbXBsZSB3aXRo IHR3byBJZGVudGl0eSBoZWFkZXIgZmllbGRzIGluIHNlY3Rpb24gNC4xIG9mIGRyYWZ0LWlldGYt c3Rpci1wYXNzcG9ydC1kaXZlcnQtMDEuDQoNClJlZ2FyZHMsDQoNCkNocmlzdGVyDQoNCkZyb206 IHN0aXIgPHN0aXItYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86c3Rpci1ib3VuY2VzQGlldGYub3Jn Pj4gb24gYmVoYWxmIG9mIENocmlzdGVyIEhvbG1iZXJnIDxjaHJpc3Rlci5ob2xtYmVyZ0Blcmlj c3Nvbi5jb208bWFpbHRvOmNocmlzdGVyLmhvbG1iZXJnQGVyaWNzc29uLmNvbT4+DQpEYXRlOiBU aHVyc2RheSA0IEphbnVhcnkgMjAxOCBhdCAxMjoxMA0KVG86IElFVEYgU1RJUiBNYWlsIExpc3Qg PHN0aXJAaWV0Zi5vcmc8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+Pg0KU3ViamVjdDogUmU6IFtzdGly XSBkcmFmdC1pZXRmLXN0aXItcmZjNDQ3NGJpcy0xNjogU3ludGF4IHF1ZXN0aW9uDQoNCklzIGl0 IHN0aWxsIHBvc3NpYmxlIHRvIGZpeCB0aGlzIGluIHRoZSBkb2N1bWVudCwgb3IgZG8gd2UgZmls ZSBhbiBlcnJhdGEgb25jZSB0aGUgUkZDIGhhcyBiZWVuIHB1Ymxpc2hlZD8NCg0KUmVnYXJkcywN Cg0KQ2hyaXN0ZXINCg0KRnJvbTogc3RpciA8c3Rpci1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpz dGlyLWJvdW5jZXNAaWV0Zi5vcmc+PiBvbiBiZWhhbGYgb2YgQ2hyaXN0ZXIgSG9sbWJlcmcgPGNo cmlzdGVyLmhvbG1iZXJnQGVyaWNzc29uLmNvbTxtYWlsdG86Y2hyaXN0ZXIuaG9sbWJlcmdAZXJp Y3Nzb24uY29tPj4NCkRhdGU6IFdlZG5lc2RheSAzIEphbnVhcnkgMjAxOCBhdCAyMDo1Nw0KVG86 IElFVEYgU1RJUiBNYWlsIExpc3QgPHN0aXJAaWV0Zi5vcmc8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+ Pg0KU3ViamVjdDogW3N0aXJdIGRyYWZ0LWlldGYtc3Rpci1yZmM0NDc0YmlzLTE2OiBTeW50YXgg cXVlc3Rpb24NCg0KSGksDQoNClNlY3Rpb24gNCBzYXlzOg0KDQogICDigJxOb3RlIHRoYXQgdW5s aWtlIHRoZSBwcmlvciBzcGVjaWZpY2F0aW9uDQogICBpbiBSRkM0NDc0LCB0aGUgSWRlbnRpdHkg aGVhZGVyIGZpZWxkIGlzIG5vdyBhbGxvd2VkIHRvIGFwcGVhciBtb3JlDQogICB0aGFuIG9uZSB0 aW1lIGluIGEgU0lQIHJlcXVlc3QuICBUaGUgcmV2aXNlZCBncmFtbWFyIGZvciB0aGUgSWRlbnRp dHkNCiAgIGhlYWRlciBmaWVsZCBidWlsZHMgb24gdGhlIEFCTkYgW1JGQzUyMzRdIGluIFJGQyAz MjYxIFtSRkMzMjYxXQ0KICAgU2VjdGlvbiAyNS4gIEl0IGlzIGFzIGZvbGxvd3M6DQoNCiAgICAg IElkZW50aXR5ID0gIklkZW50aXR5IiBIQ09MT04gc2lnbmVkLWlkZW50aXR5LWRpZ2VzdCBTRU1J DQogICAgICBpZGVudC1pbmZvICooIFNFTUkgaWRlbnQtaW5mby1wYXJhbXMgKQ0KICAgICAg4oCm 4oCdDQoNCkhvd2V2ZXIsIHRoYXQgc3ludGF4IGRvZXMgTk9UIGFsbG93IG11bHRpcGxlIElkZW50 aXR5IGhlYWRlciBmaWVsZHMsIGFjY29yZGluZyB0byB0aGUgcnVsZXMgaW4gUkZDIDMyNjE6DQoN CiAgIOKAnE11bHRpcGxlIGhlYWRlciBmaWVsZCByb3dzIHdpdGggdGhlIHNhbWUgZmllbGQtbmFt ZSBNQVkgYmUgcHJlc2VudCBpbg0KICAgYSBtZXNzYWdlIGlmIGFuZCBvbmx5IGlmIHRoZSBlbnRp cmUgZmllbGQtdmFsdWUgZm9yIHRoYXQgaGVhZGVyIGZpZWxkDQogICBpcyBkZWZpbmVkIGFzIGEg Y29tbWEtc2VwYXJhdGVkIGxpc3TigJ0NCg0KSXQgc2hvdWxkIGJlIHNvbWV0aGluZyBsaWtlOg0K DQogICAgIElkZW50aXR5ID0gIklkZW50aXR5IiBIQ09MT04gc2lnbmVkLWlkZW50aXR5ICogKENP TU1BIHNpZ25lZC1pZGVudGl0eSkNCiAgICAgc2lnbmVkLWlkZW50aXR5ID0gc2lnbmVkLWlkZW50 aXR5LWRpZ2VzdCBTRU1JIGlkZW50aS1pbmZvICogKFNFTUkgaWRlbnQtaW5mby1wYXJhbXMpDQog ICAgIOKApuKAnQ0KDQpPciwgbWlzdW5kZXJzdG9vZCBJIGhhdmU/DQoNClJlZ2FyZHMsDQoNCkNo cmlzdGVyDQoNCg0KDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18NCg0Kc3RpciBtYWlsaW5nIGxpc3QNCg0Kc3RpckBpZXRmLm9yZzxtYWlsdG86c3Rp ckBpZXRmLm9yZz4NCg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdGly DQoNCg0K --_000_7594FB04B1934943A5C02806D1A2204B6C0F1BD5ESESSMB109erics_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmOw0KCWNvbG9yOmJsYWNrOw0KCW1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTO30N CmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNv bG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNw YW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9y OiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNt Ow0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250 LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmOw0KCWNv bG9yOmJsYWNrO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxp bms6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowY207DQoJbWFyZ2luLWJvdHRv bTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3 IjsNCgljb2xvcjpibGFjazt9DQpzcGFuLkhUTUxQcmVmb3JtYXR0ZWRDaGFyDQoJe21zby1zdHls ZS1uYW1lOiJIVE1MIFByZWZvcm1hdHRlZCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7 DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVkIjsNCglmb250LWZhbWlseTpDb25z b2xhczsNCgljb2xvcjpibGFjazt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5bGUtdHlw ZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3 aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTIxDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFs LXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5 N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9u dC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4w cHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rp b24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDld Pjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0K PC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91 dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpz aGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGJnY29sb3I9Indo aXRlIiBsYW5nPSJFTi1HQiIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBj bGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJj b2xvcjojMUY0OTdEIj5IaSw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPkkg ZG9u4oCZdCB3YW50IHRvIGNoYW5nZSBhbnkgcHJpb3IgZGVjaXNpb25zIGF0IHRoaXMgcG9pbnQs IHNvIEkgYW0gZmluZSB3aXRoIG5vdCBhbGxvd2luZyBjb21tYSBzZXBhcmF0aW9uLiBJIGp1c3Qg aG9wZSBpbXBsZW1lbnRlcnMgd2lsbCByZWFsaXplIHRoZXkgaGF2ZSB0byB1c2UgdGhlIDMyNjEg 4oCcZXhjZXB0aW9uIHJ1bGVz4oCdLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3 RCI+SSBndWVzcyB3ZSBjb3VsZCBjbGFyaWZ5IGl0IGluIGRyYWZ0LWlldGYtc3Rpci1wYXNzcG9y dC1kaXZlcnQsIHRob3VnaCwgd2hpY2ggZGVmaW5lcyB1c2FnZSBvZiB0d28gaGVhZGVyIGZpZWxk cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iY29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPlJlZ2FyZHMsPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMx RjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5DaHJpc3RlcjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIG5hbWU9Il9NYWlsRW5kQ29tcG9zZSI+PHNwYW4g c3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvYT48L3A+DQo8 ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEu MHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+ PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O21zby1mYXJlYXN0LWxh bmd1YWdlOkVOLUdCIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJj b2xvcjp3aW5kb3d0ZXh0O21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLUdCIj4gQWRhbSBSb2FjaCBb bWFpbHRvOmFkYW1Abm9zdHJ1bS5jb21dDQo8YnI+DQo8Yj5TZW50OjwvYj4gMDkgSmFudWFyeSAy MDE4IDAwOjA1PGJyPg0KPGI+VG86PC9iPiBDaHJpc3RlciBIb2xtYmVyZyAmbHQ7Y2hyaXN0ZXIu aG9sbWJlcmdAZXJpY3Nzb24uY29tJmd0OzsgSUVURiBTVElSIE1haWwgTGlzdCAmbHQ7c3RpckBp ZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtzdGlyXSBkcmFmdC1pZXRmLXN0 aXItcGFzc3BvcnQtZGl2ZXJ0OiB0d28gSWRlbnRpdHkgaGVhZGVyIGZpZWxkcyBbd2FzOiBkcmFm dC1pZXRmLXN0aXItcmZjNDQ3NGJpcy0xNjogU3ludGF4IHF1ZXN0aW9uXTxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5bYXMgcmVzcG9uc2libGUg QURdPGJyPg0KPGJyPg0KQ2hyaXN0ZXIgLS08YnI+DQo8YnI+DQpUaGFua3MgZm9yIGxvb2tpbmcg Y2xvc2VseSBhdCA0NDc0YmlzIGFuZCBvZmZlcmluZyB1cCB5b3VyIGNvbW1lbnRzLiBCYXNlZCBv biB0aGUgY3VycmVudCBzdGF0ZSBvZiB0aGluZ3MsIEkgZG9uJ3QgdGhpbmsgY2hhbmdlcyBhcmUg d2FycmFudGVkIGF0IHRoaXMgdGltZS48YnI+DQo8YnI+DQpUaGlzIGRvY3VtZW50IGlzIGluIEFV VEg0OCB3aXRoIHNpZ24tb2ZmcyBmcm9tIGFsbCBidXQgb25lIGF1dGhvci4gV2hpbGUgZGlzY292 ZXJ5IG9mIGEgY2F0YXN0cm9waGljIGVycm9yIHdvdWxkIGJlIGVub3VnaCB0byB3YXJyYW50IGFk ZGl0aW9uYWwgd29ya2luZy1ncm91cCBjcmFmdGluZyBvbiB0aGUgZG9jdW1lbnQsIEkgZG9uJ3Qg c2VlIGFueXRoaW5nIGhlcmUgdGhhdCBpcyBjYXRhc3Ryb3BoaWMuIFRoZSBtdWx0aXBsZS1oZWFk ZXIgaXNzdWUNCiB5b3UgZGVzY3JpYmUgaXMgYSBiaXQgY29uZnVzaW5nLCBidXQgdGhhdCBhcHBl YXJzIHRvIGJlIGEgZmxhdyBpbiBSRkMzMjYxIG1vcmUgdGhhbiB0aGlzIGRvY3VtZW50LiBJbXBv cnRhbnRseSwgdGhlIHNlY3Rpb24gb2YgMzI2MSB5b3UgY2l0ZSBpcyBmb2xsb3dlZCBieTo8YnI+ DQo8YnI+DQo8YnI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDttc28tZmFyZWFzdC1s YW5ndWFnZTpFTi1HQiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9 Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cHJlPiZuYnNwOyZuYnNw OyBUaGUgZXhjZXB0aW9uczxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPiZuYnNwOyZuYnNwOyB0byB0 aGlzIHJ1bGUgYXJlIHRoZSBXV1ctQXV0aGVudGljYXRlLCBBdXRob3JpemF0aW9uLCBQcm94eS08 bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgQXV0aGVudGljYXRlLCBhbmQgUHJv eHktQXV0aG9yaXphdGlvbiBoZWFkZXIgZmllbGRzLiZuYnNwOyBNdWx0aXBsZSBoZWFkZXI8bzpw PjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgZmllbGQgcm93cyB3aXRoIHRoZXNlIG5h bWVzIE1BWSBiZSBwcmVzZW50IGluIGEgbWVzc2FnZSwgYnV0IHNpbmNlPG86cD48L286cD48L3By ZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IHRoZWlyIGdyYW1tYXIgZG9lcyBub3QgZm9sbG93IHRoZSBn ZW5lcmFsIGZvcm0gbGlzdGVkIGluIDxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRt bC9yZmMzMjYxI3NlY3Rpb24tNy4zIj5TZWN0aW9uIDcuMzwvYT4sPG86cD48L286cD48L3ByZT4N CjxwcmU+Jm5ic3A7Jm5ic3A7IHRoZXkgTVVTVCBOT1QgYmUgY29tYmluZWQgaW50byBhIHNpbmds ZSBoZWFkZXIgZmllbGQgcm93LjxvOnA+PC9vOnA+PC9wcmU+DQo8L2Jsb2NrcXVvdGU+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48YnI+DQpUaGlzLCBjb21iaW5lZCB3aXRoIHRoZSBmYWN0IHRoYXQg dGhlIHN5bnRheCBvZiAmcXVvdDtJZGVudGl0eSZxdW90OyAqYWxzbyogZG9lc24ndCBmb2xsb3cg dGhlIGdlbmVyYWwgZm9ybSBsaXN0ZWQgaW4gUkZDIDMyNjEgc2VjdGlvbiA3LjMsIG1lYW5zIHRo YXQgdGhlICZxdW90Oy4uLk1BWS4uLiBpZiBhbmQgb25seSBpZi4uLiZxdW90OyBjb25zdHJ1Y3Qg eW91IGNpdGUgYWxzbyBkb2Vzbid0IGFwcGx5IHRvIGl0LiBJdCBtaWdodCBoYXZlIGJlZW4gY2xl YW5lciB0byBpbmRpY2F0ZQ0KIHRoYXQgJnF1b3Q7SWRlbnRpdHkmcXVvdDsgaXMgYWRkZWQgdG8g dGhlIGxpc3Qgb2YgZXhjZXB0aW9ucyBpbiBzZWN0aW9uIDcuMy4xIG9mIFJGQyAzMjYxLCBidXQg dGhpcyBzZWVtcyB0byBiZSBhIGxhY2sgb2YgdGlkaW5lc3MgcmF0aGVyIHRoYW4gYSBjcml0aWNh bCBmbGF3IGluIHRoZSBkb2N1bWVudC48YnI+DQo8YnI+DQpJIHdpbGwgbm90ZSB0aGF0IHRoZSBk ZWNpc2lvbiBub3QgdG8gYWxsb3cgY29tbWEgc2VwYXJhdGlvbiBhcHBlYXJzIHRvIGhhdmUgYmVl biBpbnRlbnRpb25hbCBbMV0sIGFuZCB3YXMgbWVudGlvbmVkIGFzIHJlY2VudGx5IGFzIGxhc3Qg SnVuZSBvbiB0aGUgbWFpbGluZyBsaXN0IFsyXS4gSW4gdGhhdCBsaWdodCwgSSBiZWxpZXZlIHRo YXQgeW91ciByZXF1ZXN0IHdvdWxkIGZ1bmN0aW9uYWxseSBiZSBhc2tpbmcgdG8gcmV2ZXJzZSBw cmlvciB3b3JraW5nDQogZ3JvdXAgY29uc2Vuc3VzIHJhdGhlciB0aGFuIGZpeGluZyBhbiBlcnJv ci4gV2UgYXJlIHdlbGwgcGFzdCB0aGUgcG9pbnQgb2YgcmV2aXNpdGluZyBwYXN0IHdvcmtpbmcg Z3JvdXAgZGVjaXNpb25zIG9uIHRoaXMgZG9jdW1lbnQuPGJyPg0KPGJyPg0KL2E8YnI+DQo8YnI+ DQpfX19fPGJyPg0KWzFdIEFsdGhvdWdoIEkgY2FuJ3QgZmluZCB0aGUgY29ycmVzcG9uZGluZyBt aW51dGVzIG9yIGVtYWlsLCBJIGhhdmUgYSB2YWd1ZSByZWNvbGxlY3Rpb24gb2YgZGlzY3Vzc2lv bnMgYWJvdXQgd2hpY2ggc3ludGF4IHdvdWxkIGJlIG1vcmUgbGlrZWx5IHRvIGJlIGNvbXBhdGli bGUgd2l0aCBleGl0aW5nIFJGQzQ0NzQgaW1wbGVtZW50YXRpb25zLCB3aXRoIHRoZSBjdXJyZW50 IHN5bnRheCByZWZsZWN0aW5nIHRoZSBvdXRjb21lIG9mIHRob3NlIGRpc2N1c3Npb25zLjxicj4N Cjxicj4NClsyXSA8YSBocmVmPSJodHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNn L3N0aXIvdEFoRTdqRDZPV1RsR0hPLU1MUWF2cE9EbTFzIj4NCmh0dHBzOi8vbWFpbGFyY2hpdmUu aWV0Zi5vcmcvYXJjaC9tc2cvc3Rpci90QWhFN2pENk9XVGxHSE8tTUxRYXZwT0RtMXM8L2E+PGJy Pg0KPGJyPg0KPGJyPg0KT24gMS84LzE4IDA5OjIzLCBDaHJpc3RlciBIb2xtYmVyZyB3cm90ZTo8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGks PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlJl bGF0ZWQgdG8gbXkgaXNzdWUgYmVsb3csIEkgdGhpbmsgaXQgd291bGQgYmUgZ29vZCB0byBzaG93 IGEgY29tcGxldGUgZXhhbXBsZSB3aXRoIHR3byBJZGVudGl0eSBoZWFkZXIgZmllbGRzIGluIHNl Y3Rpb24gNC4xIG9mJm5ic3A7ZHJhZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LWRpdmVydC0wMS4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ UmVnYXJkcyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Q2hyaXN0ZXI8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20g MGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOiA8L2I+c3RpciAmbHQ7PGEg aHJlZj0ibWFpbHRvOnN0aXItYm91bmNlc0BpZXRmLm9yZyI+c3Rpci1ib3VuY2VzQGlldGYub3Jn PC9hPiZndDsgb24gYmVoYWxmIG9mIENocmlzdGVyIEhvbG1iZXJnICZsdDs8YSBocmVmPSJtYWls dG86Y2hyaXN0ZXIuaG9sbWJlcmdAZXJpY3Nzb24uY29tIj5jaHJpc3Rlci5ob2xtYmVyZ0Blcmlj c3Nvbi5jb208L2E+Jmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5UaHVyc2RheSA0IEphbnVhcnkgMjAx OCBhdCAxMjoxMDxicj4NCjxiPlRvOiA8L2I+SUVURiBTVElSIE1haWwgTGlzdCAmbHQ7PGEgaHJl Zj0ibWFpbHRvOnN0aXJAaWV0Zi5vcmciPnN0aXJAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1 YmplY3Q6IDwvYj5SZTogW3N0aXJdIGRyYWZ0LWlldGYtc3Rpci1yZmM0NDc0YmlzLTE2OiBTeW50 YXggcXVlc3Rpb248bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Rp bWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEwLjVwdCI+SXMgaXQgc3RpbGwgcG9zc2libGUgdG8gZml4IHRoaXMg aW4gdGhlIGRvY3VtZW50LCBvciBkbyB3ZSBmaWxlIGFuIGVycmF0YSBvbmNlIHRoZSBSRkMgaGFz IGJlZW4gcHVibGlzaGVkPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0Ij48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdCI+UmVnYXJkcyw8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEwLjVwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQi PkNocmlzdGVyPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRv cDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGI+RnJvbTogPC9iPnN0aXIgJmx0OzxhIGhyZWY9Im1haWx0bzpzdGly LWJvdW5jZXNAaWV0Zi5vcmciPnN0aXItYm91bmNlc0BpZXRmLm9yZzwvYT4mZ3Q7IG9uIGJlaGFs ZiBvZiBDaHJpc3RlciBIb2xtYmVyZyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmNocmlzdGVyLmhvbG1i ZXJnQGVyaWNzc29uLmNvbSI+Y2hyaXN0ZXIuaG9sbWJlcmdAZXJpY3Nzb24uY29tPC9hPiZndDs8 YnI+DQo8Yj5EYXRlOiA8L2I+V2VkbmVzZGF5IDMgSmFudWFyeSAyMDE4IGF0IDIwOjU3PGJyPg0K PGI+VG86IDwvYj5JRVRGIFNUSVIgTWFpbCBMaXN0ICZsdDs8YSBocmVmPSJtYWlsdG86c3RpckBp ZXRmLm9yZyI+c3RpckBpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPltzdGly XSBkcmFmdC1pZXRmLXN0aXItcmZjNDQ3NGJpcy0xNjogU3ludGF4IHF1ZXN0aW9uPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEwLjVwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpLDxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5TZWN0aW9uIDQgc2F5czo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7Jm5ic3A7 IOKAnE5vdGUgdGhhdCB1bmxpa2UgdGhlIHByaW9yIHNwZWNpZmljYXRpb248bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyZuYnNwOyBpbiBSRkM0NDc0LCB0aGUgSWRl bnRpdHkgaGVhZGVyIGZpZWxkIGlzIG5vdyBhbGxvd2VkIHRvIGFwcGVhciBtb3JlPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsgdGhhbiBvbmUgdGltZSBp biBhIFNJUCByZXF1ZXN0LiZuYnNwOyBUaGUgcmV2aXNlZCBncmFtbWFyIGZvciB0aGUgSWRlbnRp dHk8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyZuYnNwOyBoZWFk ZXIgZmllbGQgYnVpbGRzIG9uIHRoZSBBQk5GIFtSRkM1MjM0XSBpbiBSRkMgMzI2MSBbUkZDMzI2 MV08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyZuYnNwOyBTZWN0 aW9uIDI1LiZuYnNwOyBJdCBpcyBhcyBmb2xsb3dzOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgSWRlbnRpdHkgPSAmcXVvdDtJZGVudGl0eSZx dW90OyBIQ09MT04gc2lnbmVkLWlkZW50aXR5LWRpZ2VzdCBTRU1JPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgaWRlbnQt aW5mbyAqKCBTRU1JIGlkZW50LWluZm8tcGFyYW1zICk8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyDigKbigJ08bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+SG93ZXZlciwgdGhhdCBzeW50YXggZG9lcyBOT1QgYWxsb3cgbXVs dGlwbGUgSWRlbnRpdHkgaGVhZGVyIGZpZWxkcywgYWNjb3JkaW5nIHRvIHRoZSBydWxlcyBpbiBS RkMgMzI2MTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7Jm5ic3A7IOKAnE11bHRpcGxl IGhlYWRlciBmaWVsZCByb3dzIHdpdGggdGhlIHNhbWUgZmllbGQtbmFtZSBNQVkgYmUgcHJlc2Vu dCBpbjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7Jm5ic3A7IGEg bWVzc2FnZSBpZiBhbmQgb25seSBpZiB0aGUgZW50aXJlIGZpZWxkLXZhbHVlIGZvciB0aGF0IGhl YWRlciBmaWVsZDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7Jm5i c3A7IGlzIGRlZmluZWQgYXMgYSBjb21tYS1zZXBhcmF0ZWQgbGlzdOKAnTxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5JdCBzaG91bGQgYmUgc29tZXRoaW5nIGxpa2U6PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IlNWIiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tR0Ii PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBJZGVudGl0eSA9ICZxdW90O0lkZW50aXR5JnF1b3Q7 IEhDT0xPTiBzaWduZWQtaWRlbnRpdHkgKiAoQ09NTUEgc2lnbmVkLWlkZW50aXR5KTwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFy ZWFzdC1sYW5ndWFnZTpFTi1HQiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHNpZ25lZC1pZGVu dGl0eSA9IHNpZ25lZC1pZGVudGl0eS1kaWdlc3QgU0VNSSBpZGVudGktaW5mbyAqIChTRU1JIGlk ZW50LWluZm8tcGFyYW1zKTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1HQiI+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IOKApuKAnTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1HQiI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1z by1mYXJlYXN0LWxhbmd1YWdlOkVOLUdCIj5PciwgbWlzdW5kZXJzdG9vZCBJIGhhdmU/PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1m YXJlYXN0LWxhbmd1YWdlOkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tR0Ii PlJlZ2FyZHMsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3Qt bGFuZ3VhZ2U6RU4tR0IiPkNocmlzdGVyPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZjttc28tZmFy ZWFzdC1sYW5ndWFnZTpFTi1HQiI+PGJyPg0KPGJyPg0KPGJyPg0KPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHByZT5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f XzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPnN0aXIgbWFpbGluZyBsaXN0PG86cD48L286cD48L3By ZT4NCjxwcmU+PGEgaHJlZj0ibWFpbHRvOnN0aXJAaWV0Zi5vcmciPnN0aXJAaWV0Zi5vcmc8L2E+ PG86cD48L286cD48L3ByZT4NCjxwcmU+PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby9zdGlyIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L3N0aXI8L2E+PG86cD48L286cD48L3ByZT4NCjwvYmxvY2txdW90ZT4NCjxwPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_7594FB04B1934943A5C02806D1A2204B6C0F1BD5ESESSMB109erics_-- From nobody Thu Jan 11 08:35:18 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 77A5712D832 for ; Thu, 11 Jan 2018 08:35:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.01 X-Spam-Level: X-Spam-Status: No, score=0.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=team.neustar Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5jpJewbyqMYX for ; Thu, 11 Jan 2018 08:35:13 -0800 (PST) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50EDB1242F5 for ; Thu, 11 Jan 2018 08:35:13 -0800 (PST) Received: from pps.filterd (m0078668.ppops.net [127.0.0.1]) by mx0b-0018ba01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w0BGX2pp028128; Thu, 11 Jan 2018 11:35:10 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=team.neustar; h=from : to : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=selector1; bh=+2eh7Y6CQN2NDKlMFmkfDJZcUGTxk9Wg3ppdDVO2D+Q=; b=phRvhv1kgjIbURFWJabtEmoPySoc1BSh40f44wwQzrdzvh7VP/GzKUjiqRcnP8bW/Uz4 2aZ+uL3LFBCSmJ3KzAoyNTV5YmWp0CeB6AyDG7D0XYitKauGNjlEwGOy9Yl12qvUeo8L 2wFD5O8cqIMcaDeFReZ06pyjxzYst+NbZ7x+AF1vaD+zTQNC/H6nNavFJq7O+r+quemN 58IAlD70Wb/PBZ9JSjwTCPhk+70Mrd0igtNL1pl6J1LCv96LwrHMCzPrR3Bdn80j415s BRyj+i2IQdU3+AFB3gHuicvgqxipvxB4SopjDuYu53LJEicwanLC0K1Qgeyg3fGjnoVP 6Q== Received: from stntexhc11.cis.neustar.com ([156.154.17.216]) by mx0b-0018ba01.pphosted.com with ESMTP id 2fdabhjwf7-1 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT); Thu, 11 Jan 2018 11:35:09 -0500 Received: from STNTEXMB11.cis.neustar.com ([169.254.1.47]) by stntexhc11.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Thu, 11 Jan 2018 11:35:08 -0500 From: "Peterson, Jon" To: Christer Holmberg , Adam Roach , IETF STIR Mail List Thread-Topic: Re: [stir] draft-ietf-stir-passport-divert: two Identity header fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question] Thread-Index: AQHTiM+eBxelLqiofU6tMXbdm8RIbaNusFoA Date: Thu, 11 Jan 2018 16:35:08 +0000 Message-ID: References: <6418489c-996c-3f73-c111-c82437e80356@nostrum.com> <7594FB04B1934943A5C02806D1A2204B6C0F1BD5@ESESSMB109.ericsson.se> In-Reply-To: <7594FB04B1934943A5C02806D1A2204B6C0F1BD5@ESESSMB109.ericsson.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.12.106] Content-Type: multipart/alternative; boundary="_000_D67CD0E71F515Ejonpetersonneustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2018-01-11_06:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1801110228 Archived-At: Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity header fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question] X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Jan 2018 16:35:16 -0000 --_000_D67CD0E71F515Ejonpetersonneustarbiz_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable The discussion at the STIR meeting in Singapore actually decided on using n= esting for divert rather multiple separate PASSporTs (and hence separate Id= entity headers) - largely motivated by the needs of out-of-band, but follow= ing that, as I recall, it was also decided we should have one way to do it = between in-band and out-of-band. So my marching orders coming out of that w= ere to providing nesting-only for the next revision of divert, so it would = no longer say anything about multiple Identity headers. Broadly, I'd prefer to keep the multiple Identity header language in 4474bi= s for forward-compatibility reasons anyway. Jon Peterson Neustar, Inc. From: stir > on behalf = of Christer Holmberg > Date: Monday, January 8, 2018 at 2:25 PM To: Adam Roach >, IETF STIR Mail = List > Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity header fi= elds [was: draft-ietf-stir-rfc4474bis-16: Syntax question] Hi, I don=92t want to change any prior decisions at this point, so I am fine wi= th not allowing comma separation. I just hope implementers will realize the= y have to use the 3261 =93exception rules=94. I guess we could clarify it in draft-ietf-stir-passport-divert, though, whi= ch defines usage of two header fields. Regards, Christer From: Adam Roach [mailto:adam@nostrum.com] Sent: 09 January 2018 00:05 To: Christer Holmberg >; IETF STIR Mail List > Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity header fi= elds [was: draft-ietf-stir-rfc4474bis-16: Syntax question] [as responsible AD] Christer -- Thanks for looking closely at 4474bis and offering up your comments. Based = on the current state of things, I don't think changes are warranted at this= time. This document is in AUTH48 with sign-offs from all but one author. While di= scovery of a catastrophic error would be enough to warrant additional worki= ng-group crafting on the document, I don't see anything here that is catast= rophic. The multiple-header issue you describe is a bit confusing, but that= appears to be a flaw in RFC3261 more than this document. Importantly, the = section of 3261 you cite is followed by: The exceptions to this rule are the WWW-Authenticate, Authorization, Proxy- Authenticate, and Proxy-Authorization header fields. Multiple header field rows with these names MAY be present in a message, but since their grammar does not follow the general form listed in Section 7.3, they MUST NOT be combined into a single header field row. This, combined with the fact that the syntax of "Identity" *also* doesn't f= ollow the general form listed in RFC 3261 section 7.3, means that the "...M= AY... if and only if..." construct you cite also doesn't apply to it. It mi= ght have been cleaner to indicate that "Identity" is added to the list of e= xceptions in section 7.3.1 of RFC 3261, but this seems to be a lack of tidi= ness rather than a critical flaw in the document. I will note that the decision not to allow comma separation appears to have= been intentional [1], and was mentioned as recently as last June on the ma= iling list [2]. In that light, I believe that your request would functional= ly be asking to reverse prior working group consensus rather than fixing an= error. We are well past the point of revisiting past working group decisio= ns on this document. /a ____ [1] Although I can't find the corresponding minutes or email, I have a vagu= e recollection of discussions about which syntax would be more likely to be= compatible with exiting RFC4474 implementations, with the current syntax r= eflecting the outcome of those discussions. [2] https://mailarchive.ietf.org/arch/msg/stir/tAhE7jD6OWTlGHO-MLQavpODm1s<= https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__mailarchive.ietf.org= _arch_msg_stir_tAhE7jD6OWTlGHO-2DMLQavpODm1s&d=3DDwMGaQ&c=3DMOptNlVtIETeDAL= C_lULrw&r=3DdQ51tLfoGuuFjanmfeKC0weXHNMl9xZnnsIiwRd6IgY&m=3D0tfOd9VwMoAvl0J= KO2y6wP_mUQxKNpMG7nzhdSG5zik&s=3DvBmyKD1D8ZvSrGhPungiuGhQuBvV-kvtev4wekjtZH= k&e=3D> On 1/8/18 09:23, Christer Holmberg wrote: Hi, Related to my issue below, I think it would be good to show a complete exam= ple with two Identity header fields in section 4.1 of draft-ietf-stir-passp= ort-divert-01. Regards, Christer From: stir > on behalf = of Christer Holmberg > Date: Thursday 4 January 2018 at 12:10 To: IETF STIR Mail List > Subject: Re: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question Is it still possible to fix this in the document, or do we file an errata o= nce the RFC has been published? Regards, Christer From: stir > on behalf = of Christer Holmberg > Date: Wednesday 3 January 2018 at 20:57 To: IETF STIR Mail List > Subject: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question Hi, Section 4 says: =93Note that unlike the prior specification in RFC4474, the Identity header field is now allowed to appear more than one time in a SIP request. The revised grammar for the Identity header field builds on the ABNF [RFC5234] in RFC 3261 [RFC3261] Section 25. It is as follows: Identity =3D "Identity" HCOLON signed-identity-digest SEMI ident-info *( SEMI ident-info-params ) =85=94 However, that syntax does NOT allow multiple Identity header fields, accord= ing to the rules in RFC 3261: =93Multiple header field rows with the same field-name MAY be present in a message if and only if the entire field-value for that header field is defined as a comma-separated list=94 It should be something like: Identity =3D "Identity" HCOLON signed-identity * (COMMA signed-identit= y) signed-identity =3D signed-identity-digest SEMI identi-info * (SEMI id= ent-info-params) =85=94 Or, misunderstood I have? Regards, Christer _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir --_000_D67CD0E71F515Ejonpetersonneustarbiz_ Content-Type: text/html; charset="Windows-1252" Content-ID: <29E7CE0A572E1A42AE2E98F947605935@neustar.biz> Content-Transfer-Encoding: quoted-printable

The discussion at the STIR meeting in Singapore actually decided on us= ing nesting for divert rather multiple separate PASSporTs (and hence separa= te Identity headers) - largely motivated by the needs of out-of-band, but f= ollowing that, as I recall, it was also decided we should have one way to do it between in-band and out-of-ba= nd. So my marching orders coming out of that were to providing nesting-only= for the next revision of divert, so it would no longer say anything about = multiple Identity headers.

Broadly, I'd prefer to keep the multiple Identity header language in 4= 474bis for forward-compatibility reasons anyway.

Jon Peterson
Neustar, Inc.

From: stir <stir-bounces@ietf.org> on behalf of Christer Ho= lmberg <christer.holmb= erg@ericsson.com>
Date: Monday, January 8, 2018 at 2:= 25 PM
To: Adam Roach <adam@nostrum.com>, IETF STIR Mail List <stir@ietf.org>
Subject: Re: [stir] draft-ietf-stir= -passport-divert: two Identity header fields [was: draft-ietf-stir-rfc4474b= is-16: Syntax question]

Hi,<= /p>

 

I don=92t want to chan= ge any prior decisions at this point, so I am fine with not allowing comma = separation. I just hope implementers will realize they have to use the 3261= =93exception rules=94.

 

I guess we could clari= fy it in draft-ietf-stir-passport-divert, though, which defines usage of tw= o header fields.

 

Regards,

 

Christer

 

From: Adam Roach [mailto:adam@nostrum.com]
Sent: 09 January 2018 00:05
To: Christer Holmberg <christer.holmberg@ericsson.com>; IETF STIR Mail List <stir@ietf.org>
Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity he= ader fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question]

 

[as responsible AD]

Christer --

Thanks for looking closely at 4474bis and offering up your comments. Based = on the current state of things, I don't think changes are warranted at this= time.

This document is in AUTH48 with sign-offs from all but one author. While di= scovery of a catastrophic error would be enough to warrant additional worki= ng-group crafting on the document, I don't see anything here that is catast= rophic. The multiple-header issue you describe is a bit confusing, but that appears to be a flaw in RFC3261 = more than this document. Importantly, the section of 3261 you cite is follo= wed by:


   The exceptions
   to this rule are the WWW-Authenticate, Authorization, Pro=
xy-
   Authenticate, and Proxy-Authorization header fields. =
; Multiple header
   field rows with these names MAY be present in a message, =
but since
   their grammar does not follow the general form listed in =
Section 7.3,
   they MUST NOT be combined into a single header field row.=


This, combined with the fact that the syntax of "Identity" *also*= doesn't follow the general form listed in RFC 3261 section 7.3, means that= the "...MAY... if and only if..." construct you cite also doesn'= t apply to it. It might have been cleaner to indicate that "Identity" is added to the list of exceptions in section 7.= 3.1 of RFC 3261, but this seems to be a lack of tidiness rather than a crit= ical flaw in the document.

I will note that the decision not to allow comma separation appears to have= been intentional [1], and was mentioned as recently as last June on the ma= iling list [2]. In that light, I believe that your request would functional= ly be asking to reverse prior working group consensus rather than fixing an error. We are well past the point of= revisiting past working group decisions on this document.

/a

____
[1] Although I can't find the corresponding minutes or email, I have a vagu= e recollection of discussions about which syntax would be more likely to be= compatible with exiting RFC4474 implementations, with the current syntax r= eflecting the outcome of those discussions.

[2] https://mailarchive.ietf.org/arch/msg/stir/tAhE7jD6OWTlGHO-MLQavpODm1s<= br>

On 1/8/18 09:23, Christer Holmberg wrote:

Hi,

 

Related to my issue below, I think it would be good = to show a complete example with two Identity header fields in section 4.1 o= f draft-ietf-stir-passport-divert-01. 

 

Regards,

 

Christer

 

From: stir <stir-bounces@ietf.org> on behalf of Christer Holmberg <= ;christer.holmberg@ericss= on.com>
Date: Thursday 4 January 2018 at 12:10
To: IETF STIR Mail List <stir@ie= tf.org>
Subject: Re: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question

 

Is it still possibl= e to fix this in the document, or do we file an errata once the RFC has bee= n published?

 

Regards,=

 

Christer=

 

From: stir <stir-bounces@ietf.org> on behalf of Christer Holmberg <= ;christer.holmberg@ericss= on.com>
Date: Wednesday 3 January 2018 at 20:57
To: IETF STIR Mail List <stir@ie= tf.org>
Subject: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question<= /o:p>

 

Hi,

 

Section 4 says:

 

   =93Note that unlike the prior specifica= tion

   in RFC4474, the Identity header field i= s now allowed to appear more

   than one time in a SIP request.  T= he revised grammar for the Identity

   header field builds on the ABNF [RFC523= 4] in RFC 3261 [RFC3261]

   Section 25.  It is as follows:

 

      Identity =3D "Id= entity" HCOLON signed-identity-digest SEMI

      ident-info *( SEMI id= ent-info-params )

      =85=94

 

However, that syntax does NOT allow multiple Identit= y header fields, according to the rules in RFC 3261:

 

   =93Multiple header field rows with the = same field-name MAY be present in

   a message if and only if the entire fie= ld-value for that header field

   is defined as a comma-separated list=94=

 

It should be something like:

 

     Identity =3D "Identity" HCOLON signed= -identity * (COMMA signed-identity)

 &nb= sp;   signed-identity =3D signed-identity-digest SEMI identi-info= * (SEMI ident-info-params)

 &nb= sp;   =85=94

 

Or, misun= derstood I have?

 

Regards,<= /span>

 

Christer<= /span>

 




_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir=

 

 --_000_D67CD0E71F515Ejonpetersonneustarbiz_-- From nobody Fri Jan 12 02:26:34 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA8BA12E042 for ; Fri, 12 Jan 2018 02:26:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.211 X-Spam-Level: X-Spam-Status: No, score=-2.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X_d4R3PkK-mh for ; Fri, 12 Jan 2018 02:26:29 -0800 (PST) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D0A54124E15 for ; Fri, 12 Jan 2018 02:26:28 -0800 (PST) X-AuditID: c1b4fb30-11d5e9c000006bc7-72-5a588d52dbfc Received: from ESESSHC002.ericsson.se (Unknown_Domain [153.88.183.24]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id 43.CA.27591.25D885A5; Fri, 12 Jan 2018 11:26:27 +0100 (CET) Received: from EUR01-HE1-obe.outbound.protection.outlook.com (153.88.183.145) by oa.msg.ericsson.com (153.88.183.24) with Microsoft SMTP Server (TLS) id 14.3.352.0; Fri, 12 Jan 2018 11:26:02 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.onmicrosoft.com; s=selector1-ericsson-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=ln7/ddSB0ZX5h4LGS4S47QioJRao+q4Sw1HWgCfPwO0=; b=NZEbG0eevOHL/uhsG/GfiUrgAPGUuA4F8Ax5v7+s8fWHBVjhQd+bdWA7MoNuZ9JONwwnl0pyJOiaN9xLF6fR21pBSDJSDPgj4VzX3r+kKI98JEqK4TEcyJ6d1y9CRAyIPsEaHsy0gGc6LAoLCJb912jVikxuY288p6TtJqla+ko= Received: from VI1PR0701MB2304.eurprd07.prod.outlook.com (10.168.137.135) by VI1PR0701MB2014.eurprd07.prod.outlook.com (10.167.209.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.407.1; Fri, 12 Jan 2018 10:26:01 +0000 Received: from VI1PR0701MB2304.eurprd07.prod.outlook.com ([fe80::c5a8:750e:f55f:c623]) by VI1PR0701MB2304.eurprd07.prod.outlook.com ([fe80::c5a8:750e:f55f:c623%17]) with mapi id 15.20.0407.005; Fri, 12 Jan 2018 10:26:01 +0000 From: Julio Martinez-Minguito To: "Peterson, Jon" , Christer Holmberg , Adam Roach , "IETF STIR Mail List" Thread-Topic: [stir] draft-ietf-stir-passport-divert: two Identity header fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question] Thread-Index: AQHTixbYQ6TQpPJPQ0aZ9e6OcTbqbaNv/tIg Date: Fri, 12 Jan 2018 10:26:01 +0000 Message-ID: References: <6418489c-996c-3f73-c111-c82437e80356@nostrum.com> <7594FB04B1934943A5C02806D1A2204B6C0F1BD5@ESESSMB109.ericsson.se> In-Reply-To: Accept-Language: sv-SE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=julio.martinez-minguito@ericsson.com; x-originating-ip: [192.176.1.93] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; VI1PR0701MB2014; 7:oj3dTeuXgwBE9RmVMBESpxtifuZqVJKpJ1oTShp+ADbc7hCRmdvvQG7hTMzn1Ycvkk8QkBhyVTPeax92PSl0bcqoobAZ+TRphS3xR5isrgGhLb9vmeaQp2pdcBpuzxpAcVfn50Kia//BgjOqqI8OfsL5/7n2YomA4iP+vlhHzcJjSOIGK1eXPjEpweXn5cV4wSsDgAuzi/Q+pthzzv3J/r1eqRmkNBU/F7dD9hCho6PgAmKBVyqkln3uC86HtSYs x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 0fe4a7b4-1d52-473e-8042-08d559a6e0e7 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020080)(4652020)(4534110)(4602075)(4627206)(201703031133081)(201702281549075)(5600026)(4604075)(3008032)(2017052603307)(7153060)(7193020); SRVR:VI1PR0701MB2014; x-ms-traffictypediagnostic: VI1PR0701MB2014: x-ld-processed: 92e84ceb-fbfd-47ab-be52-080c6b87953f,ExtAddr x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(37575265505322)(28532068793085)(10436049006162)(120809045254105)(100405760836317)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040470)(2401047)(8121501046)(5005006)(10201501046)(93006095)(93001095)(3231023)(944501142)(3002001)(6041268)(20161123564045)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(20161123562045)(6072148)(201708071742011); SRVR:VI1PR0701MB2014; BCL:0; PCL:0; RULEID:(100000803101)(100110400095); SRVR:VI1PR0701MB2014; x-forefront-prvs: 0550778858 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(979002)(39860400002)(376002)(346002)(396003)(366004)(39380400002)(199004)(189003)(24454002)(6246003)(33656002)(99286004)(25786009)(97736004)(74316002)(6436002)(3846002)(790700001)(6116002)(606006)(93886005)(236005)(6306002)(54896002)(9686003)(7736002)(66066001)(2906002)(55016002)(53936002)(316002)(110136005)(105586002)(7696005)(106356001)(229853002)(2900100001)(6506007)(53546011)(81156014)(478600001)(8676002)(2950100002)(102836004)(81166006)(86362001)(5250100002)(230783001)(59450400001)(14454004)(8936002)(68736007)(76176011)(966005)(5660300001)(3280700002)(3660700001)(9326002)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR0701MB2014; H:VI1PR0701MB2304.eurprd07.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: nYdku7wUjrVS9LJ5j5qx7GkWQGLo7MUkVo8HYWrmAw5XZ60HztcjhOu9dkgvqTlu8bhvE0TcwGTXXJxKygq6Cw== spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_VI1PR0701MB2304215A3B37F81E117D5C95C7170VI1PR0701MB2304_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 0fe4a7b4-1d52-473e-8042-08d559a6e0e7 X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Jan 2018 10:26:01.5191 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0701MB2014 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA02Sa0hTYRjHec85247TwXHNfNCEGvWhmsskadDoAhETiqQgbF906kGHuq0z k+yGFuEtS9OomTkVy1uizLsulitB85aakmbO2LyMIV0+NDK03M4Cv/2e////vO/7PLwkLuzh hJBqTQbNaFRpYi6fMMR2QfjFolhlxPo3f5l5o4Yna1t+hcnqmjuxk7iitvY3pijvcRAKV2sF LwZX8uVJdJo6k2YOHY/np8x3V3N0rg10bbq4Bc9Gj2yoAPmRQB0B0/dP3ALEJ4XUWwRL3VaC LQYR5C9UcjwFQRXhUNRrwVinEoO13GYOW6wg2PiVR3gO41KnYW7wi/dgEdWMYKIFeUI7qFwE j1/3ettFVB4C6w8Ll01FwuzD9zwPE9Q++NA1wPGwgIqHYdOM7yVfEeT0T3kNP+oo3Ftt8jYg Kgxs7gXv1TgVDHMOI8bOREGteRxnOQic9k0Om08G992xLSa39N1gm1WykTCYNBZ6XwpUJwbL 07O+3Uiho2TNx+fA3lFMsKEpBGZDH4c1JDBvmSBYlsPTwie+i7UwONvh0+8jKHh3g21uwcG9 VMdljV3wvLOMV4yk5duGYFkLD9o/o3LvNgJhyOAgWF0CVX0/uSwfhJfVLvw/j7yxY9v1KsRr REF6Wp+QnhwZKaUZdaJer9VINXSGCW19qP72PxHdyLlyyoooEokDBDl3YpVCjipTn5VuRUDi YpGAYLYkQZIq6zrNaOOYq2m03opCSUIcLBiKFiiFVLIqg06laR3N/Hcx0i8kG0U13HLY812m Y3Emh6hPWBPyIjx3AEtoXbxQuh440xOlNBtT5asV/tFnywbOt0vcYZjOuWcxdDxwklGXTjb2 V18J18mDMtdODNOKQPHlvaO222fGVB+59U1/ZcaG/qX6ANHyqC1GWxLUpt45Yth0XqrrTZxu kiw84+os/vtvigl9iurwAZzRq/4BZV3Mb0wDAAA= Archived-At: Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity header fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question] X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Jan 2018 10:26:34 -0000 --_000_VI1PR0701MB2304215A3B37F81E117D5C95C7170VI1PR0701MB2304_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, About the slides from the STIR Singapore meeting: https://datatracker.ietf.org/meeting/100/materials/slides-100-stir-passport= -divert/ If we have user A served by Operator A (originating party), user B served b= y Operator B (original destination/diverting party) and user C served by Op= erator C (final destination/diverted party) It's not good that B's operator signs A's identity. B's operator is not aut= horitative for A. In a diversion case, I'd rather keep different Identities= to enable accountability and separate responsibilities. The Identity added= by Operator A includes the signature from A so even Operator C can validat= e that the original call comes from Operator A. Removing the Identity added= by A by the diverting party B removes useful information. It makes that A = authority is somewhat delegated to B. Note also that by removing the original Identity header from Operator A, If= the PASSporT is a SHAKEN object with, eventual SHAKEN attest and orig in t= he PASSporT from the original party will be lost towards the new target C. /Julio From: Peterson, Jon [mailto:jon.peterson@team.neustar] Sent: den 11 januari 2018 17:35 To: Christer Holmberg ; Adam Roach ; IETF STIR Mail List Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity header fi= elds [was: draft-ietf-stir-rfc4474bis-16: Syntax question] The discussion at the STIR meeting in Singapore actually decided on using n= esting for divert rather multiple separate PASSporTs (and hence separate Id= entity headers) - largely motivated by the needs of out-of-band, but follow= ing that, as I recall, it was also decided we should have one way to do it = between in-band and out-of-band. So my marching orders coming out of that w= ere to providing nesting-only for the next revision of divert, so it would = no longer say anything about multiple Identity headers. Broadly, I'd prefer to keep the multiple Identity header language in 4474bi= s for forward-compatibility reasons anyway. Jon Peterson Neustar, Inc. From: stir > on behalf = of Christer Holmberg > Date: Monday, January 8, 2018 at 2:25 PM To: Adam Roach >, IETF STIR Mail = List > Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity header fi= elds [was: draft-ietf-stir-rfc4474bis-16: Syntax question] Hi, I don't want to change any prior decisions at this point, so I am fine with= not allowing comma separation. I just hope implementers will realize they = have to use the 3261 "exception rules". I guess we could clarify it in draft-ietf-stir-passport-divert, though, whi= ch defines usage of two header fields. Regards, Christer From: Adam Roach [mailto:adam@nostrum.com] Sent: 09 January 2018 00:05 To: Christer Holmberg >; IETF STIR Mail List > Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity header fi= elds [was: draft-ietf-stir-rfc4474bis-16: Syntax question] [as responsible AD] Christer -- Thanks for looking closely at 4474bis and offering up your comments. Based = on the current state of things, I don't think changes are warranted at this= time. This document is in AUTH48 with sign-offs from all but one author. While di= scovery of a catastrophic error would be enough to warrant additional worki= ng-group crafting on the document, I don't see anything here that is catast= rophic. The multiple-header issue you describe is a bit confusing, but that= appears to be a flaw in RFC3261 more than this document. Importantly, the = section of 3261 you cite is followed by: The exceptions to this rule are the WWW-Authenticate, Authorization, Proxy- Authenticate, and Proxy-Authorization header fields. Multiple header field rows with these names MAY be present in a message, but since their grammar does not follow the general form listed in Section 7.3, they MUST NOT be combined into a single header field row. This, combined with the fact that the syntax of "Identity" *also* doesn't f= ollow the general form listed in RFC 3261 section 7.3, means that the "...M= AY... if and only if..." construct you cite also doesn't apply to it. It mi= ght have been cleaner to indicate that "Identity" is added to the list of e= xceptions in section 7.3.1 of RFC 3261, but this seems to be a lack of tidi= ness rather than a critical flaw in the document. I will note that the decision not to allow comma separation appears to have= been intentional [1], and was mentioned as recently as last June on the ma= iling list [2]. In that light, I believe that your request would functional= ly be asking to reverse prior working group consensus rather than fixing an= error. We are well past the point of revisiting past working group decisio= ns on this document. /a ____ [1] Although I can't find the corresponding minutes or email, I have a vagu= e recollection of discussions about which syntax would be more likely to be= compatible with exiting RFC4474 implementations, with the current syntax r= eflecting the outcome of those discussions. [2] https://mailarchive.ietf.org/arch/msg/stir/tAhE7jD6OWTlGHO-MLQavpODm1s<= https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__mailarchive.ietf.org= _arch_msg_stir_tAhE7jD6OWTlGHO-2DMLQavpODm1s&d=3DDwMGaQ&c=3DMOptNlVtIETeDAL= C_lULrw&r=3DdQ51tLfoGuuFjanmfeKC0weXHNMl9xZnnsIiwRd6IgY&m=3D0tfOd9VwMoAvl0J= KO2y6wP_mUQxKNpMG7nzhdSG5zik&s=3DvBmyKD1D8ZvSrGhPungiuGhQuBvV-kvtev4wekjtZH= k&e=3D> On 1/8/18 09:23, Christer Holmberg wrote: Hi, Related to my issue below, I think it would be good to show a complete exam= ple with two Identity header fields in section 4.1 of draft-ietf-stir-passp= ort-divert-01. Regards, Christer From: stir > on behalf = of Christer Holmberg > Date: Thursday 4 January 2018 at 12:10 To: IETF STIR Mail List > Subject: Re: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question Is it still possible to fix this in the document, or do we file an errata o= nce the RFC has been published? Regards, Christer From: stir > on behalf = of Christer Holmberg > Date: Wednesday 3 January 2018 at 20:57 To: IETF STIR Mail List > Subject: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question Hi, Section 4 says: "Note that unlike the prior specification in RFC4474, the Identity header field is now allowed to appear more than one time in a SIP request. The revised grammar for the Identity header field builds on the ABNF [RFC5234] in RFC 3261 [RFC3261] Section 25. It is as follows: Identity =3D "Identity" HCOLON signed-identity-digest SEMI ident-info *( SEMI ident-info-params ) ..." However, that syntax does NOT allow multiple Identity header fields, accord= ing to the rules in RFC 3261: "Multiple header field rows with the same field-name MAY be present in a message if and only if the entire field-value for that header field is defined as a comma-separated list" It should be something like: Identity =3D "Identity" HCOLON signed-identity * (COMMA signed-identit= y) signed-identity =3D signed-identity-digest SEMI identi-info * (SEMI id= ent-info-params) ..." Or, misunderstood I have? Regards, Christer _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir --_000_VI1PR0701MB2304215A3B37F81E117D5C95C7170VI1PR0701MB2304_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi,

 

About the slides fr= om the STIR Singapore meeting:

https://datatracker.ietf.org/meeting/100/materials/slides-100-stir-passpo= rt-divert/

 

If we have user A s= erved by Operator A (originating party), user B served by Operator B (origi= nal destination/diverting party) and user C served by Operator C (final des= tination/diverted party)

It’s not good= that B’s operator signs A’s identity. B’s operator is no= t authoritative for A. In a diversion case, I’d rather keep different= Identities to enable accountability and separate responsibilities. The Identity added by Operator A includes the signature from A so even Ope= rator C can validate that the original call comes from Operator A. Removing= the Identity added by A by the diverting party B removes useful informatio= n. It makes that A authority is somewhat delegated to B.

 

Note also that by r= emoving the original Identity header from Operator A, If the PASSporT is a = SHAKEN object with, eventual SHAKEN attest and orig in the PASSporT from th= e original party will be lost towards the new target C.

 

/Julio

 

From:= Peterson, Jon [mailto:jon.peterson@team.n= eustar]
Sent: den 11 januari 2018 17:35
To: Christer Holmberg <christer.holmberg@ericsson.com>; Adam R= oach <adam@nostrum.com>; IETF STIR Mail List <stir@ietf.org> Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity he= ader fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question]

 

 

The discussion at t= he STIR meeting in Singapore actually decided on using nesting for divert r= ather multiple separate PASSporTs (and hence separate Identity headers) - l= argely motivated by the needs of out-of-band, but following that, as I recall, it was also decided we should have one wa= y to do it between in-band and out-of-band. So my marching orders coming ou= t of that were to providing nesting-only for the next revision of divert, s= o it would no longer say anything about multiple Identity headers.

 

Broadly, I'd prefer= to keep the multiple Identity header language in 4474bis for forward-compa= tibility reasons anyway.

 

Jon Peterson

Neustar, Inc.<= /o:p>

 

From: stir <stir-bounces@ietf.org> on behalf of Christer Holmberg <= ;christer.holmberg@ericss= on.com>
Date: Monday, January 8, 2018 at 2:25 PM
To: Adam Roach <adam@nostrum.= com>, IETF STIR Mail List <stir@= ietf.org>
Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity he= ader fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question]

 

Hi,

 <= /span>

I don&#= 8217;t want to change any prior decisions at this point, so I am fine with = not allowing comma separation. I just hope implementers will realize they h= ave to use the 3261 “exception rules”.

 <= /span>

I guess= we could clarify it in draft-ietf-stir-passport-divert, though, which defi= nes usage of two header fields.

 <= /span>

Regards= ,

 <= /span>

Christe= r

 

From: Adam Roach [mailto:adam@no= strum.com]
Sent: 09 January 2018 00:05
To: Christer Holmberg <christer.holmberg@ericsson.com>; IETF STIR Mail List <stir@ietf.org>
Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity he= ader fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question]

 

[as responsible AD]

Christer --

Thanks for looking closely at 4474bis and offering up your comments. Based = on the current state of things, I don't think changes are warranted at this= time.

This document is in AUTH48 with sign-offs from all but one author. While di= scovery of a catastrophic error would be enough to warrant additional worki= ng-group crafting on the document, I don't see anything here that is catast= rophic. The multiple-header issue you describe is a bit confusing, but that appears to be a flaw in RFC3261 = more than this document. Importantly, the section of 3261 you cite is follo= wed by:



   The exceptions

   to this rule are the WWW-Authenticat=
e, Authorization, Proxy-


   Authenticate, and Proxy-Authorizatio=
n header fields.  Multiple header


   field rows with these names MAY be p=
resent in a message, but since


   their grammar does not follow the ge=
neral form listed in Section 7.3,


   they MUST NOT be combined into a sin=
gle header field row.


This, combined with the fact that the syntax of "Identity" *also*= doesn't follow the general form listed in RFC 3261 section 7.3, means that= the "...MAY... if and only if..." construct you cite also doesn'= t apply to it. It might have been cleaner to indicate that "Identity" is added to the list of exceptions in section 7.= 3.1 of RFC 3261, but this seems to be a lack of tidiness rather than a crit= ical flaw in the document.

I will note that the decision not to allow comma separation appears to have= been intentional [1], and was mentioned as recently as last June on the ma= iling list [2]. In that light, I believe that your request would functional= ly be asking to reverse prior working group consensus rather than fixing an error. We are well past the point of= revisiting past working group decisions on this document.

/a

____
[1] Although I can't find the corresponding minutes or email, I have a vagu= e recollection of discussions about which syntax would be more likely to be= compatible with exiting RFC4474 implementations, with the current syntax r= eflecting the outcome of those discussions.

[2] https://mailarchive.ietf.org/arch/msg/stir/tAhE7jD6OWTlGHO-MLQavpODm1s<= br>

On 1/8/18 09:23, Christer Holmberg wrote:

Hi,

 

Related to my issue below, I th= ink it would be good to show a complete example with two Identity header fi= elds in section 4.1 of draft-ietf-stir-passport-divert-01. <= /o:p>

 

Regards,

 

Christer

 

From: stir <stir-bounces@i= etf.org> on behalf of Christer Holmberg <christer.holmberg@ericsson.com>
Date: Thursday 4 January 2018 at 12:10
To: IETF STIR Mail List <stir@ie= tf.org>
Subject: Re: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question

 

Is i= t still possible to fix this in the document, or do we file an errata once = the RFC has been published?

&nbs= p;

Rega= rds,

&nbs= p;

Chri= ster

&nbs= p;

From: stir <stir-bounces@i= etf.org> on behalf of Christer Holmberg <christer.holmberg@ericsson.com>
Date: Wednesday 3 January 2018 at 20:57
To: IETF STIR Mail List <stir@ie= tf.org>
Subject: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question<= /o:p>

&nbs= p;

Hi,

 

Section 4 says:

 

   “Note that u= nlike the prior specification

   in RFC4474, the Id= entity header field is now allowed to appear more

   than one time in a= SIP request.  The revised grammar for the Identity<= /p>

   header field build= s on the ABNF [RFC5234] in RFC 3261 [RFC3261]

   Section 25.  = It is as follows:

 

      = Identity =3D "Identity" HCOLON signed-identity-digest SEMI

      = ident-info *( SEMI ident-info-params )

      = …”

 

However, that syntax does NOT a= llow multiple Identity header fields, according to the rules in RFC 3261:

 

   “Multiple he= ader field rows with the same field-name MAY be present in

   a message if and o= nly if the entire field-value for that header field

   is defined as a co= mma-separated list”

 

It should be something like:

 

     Identity =3D "Identity" HCOLON signed= -identity * (COMMA signed-identity)<= /span>

     signed-identity =3D signed-identity-digest S= EMI identi-info * (SEMI ident-info-params)=

     …”

 

Or, misunderstood I have?

 

Regards,

 

Christer

 





_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinf=
o/stir

 

--_000_VI1PR0701MB2304215A3B37F81E117D5C95C7170VI1PR0701MB2304_-- From nobody Sat Jan 13 01:30:28 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 273991289B0 for ; Sat, 13 Jan 2018 01:30:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uGPwub9xEoUc for ; Sat, 13 Jan 2018 01:30:24 -0800 (PST) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8FAC0124239 for ; Sat, 13 Jan 2018 01:30:22 -0800 (PST) X-AuditID: c1b4fb2d-b35ff70000007932-27-5a59d1ac5ddd Received: from ESESSHC005.ericsson.se (Unknown_Domain [153.88.183.33]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id 21.27.31026.CA1D95A5; Sat, 13 Jan 2018 10:30:20 +0100 (CET) Received: from ESESSMB109.ericsson.se ([169.254.9.195]) by ESESSHC005.ericsson.se ([153.88.183.33]) with mapi id 14.03.0352.000; Sat, 13 Jan 2018 10:30:20 +0100 From: Christer Holmberg To: Adam Roach , IETF STIR Mail List Thread-Topic: [stir] draft-ietf-stir-passport-divert: two Identity header fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question] Thread-Index: AQHTiJSmfTFRlLNLiUGvsT+nvKtlH6Nqd6eAgAcWI+A= Date: Sat, 13 Jan 2018 09:30:19 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B6C10AD58@ESESSMB109.ericsson.se> References: <6418489c-996c-3f73-c111-c82437e80356@nostrum.com> In-Reply-To: <6418489c-996c-3f73-c111-c82437e80356@nostrum.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.154] Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B6C10AD58ESESSMB109erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupikeLIzCtJLcpLzFFi42KZGbFdUXfNxcgog2lrzC32/F3EbrF87TYm ByaPJUt+MnnM2vmEJYApissmJTUnsyy1SN8ugStj8vZetoJXXxkrJjzoYWtg3PCesYuRk0NC wERi6ebF7F2MXBxCAocZJb79+sUK4SxhlNi6eA2Qw8HBJmAh0f1PG6RBRMBNomHDX0aQGmGB dkaJqXt3MYE4IgIdjBKHPu5ng6iykmhZdBZsBYuAqsSV0xeYQQbxCvhK7PsSARIWEiiQWPb6 MjuIzSlgLzFhyR4wm1FATOL7qTVMIDazgLjErSfzmSAuFZBYsuc8M4QtKvHy8T9WCFtJYtHt z1D1+RJ3Vt4Bi/MKCEqcnPmEZQKj8Cwko2YhKZuFpGwW0HXMApoS63fpQ5QoSkzpfsgOYWtI tM6Zy44svoCRfRWjaHFqcXFuupGxXmpRZnJxcX6eXl5qySZGYAwd3PJbdwfj6teOhxgFOBiV eHg3HImMEmJNLCuuzD3EKMHBrCTCG3Y6IkqINyWxsiq1KD++qDQntfgQozQHi5I470lP3igh gfTEktTs1NSC1CKYLBMHp1QDY1fhwxsJhbIxKZwpDjUvVT/+FGfiPO/Xs/Ro7Ssl1hMvc/0f 2Efvq8wr41q5Jajg6wZrhmmZJftDJ/2pcMqs/b43dsObQwZneXpKVthpPHC9uuO9ZO3Oz3XL pWSfyU9Rfbpqr+DCr7tiLY68bNyV5Pa5evnuaut/N7+75c1yz+h1mHtZzVLCQImlOCPRUIu5 qDgRABMUPfedAgAA Archived-At: Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity header fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question] X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 Jan 2018 09:30:27 -0000 --_000_7594FB04B1934943A5C02806D1A2204B6C10AD58ESESSMB109erics_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGksDQoNCk9uZSBtb3JlIGNvbW1lbnQgb24gdGhpcy4NCg0KTm8gbWF0dGVyIGlmIG9uZSB1c2Vz IGNvbW1hIHNlcGFyYXRpb24gd2l0aGluIGEgc2luZ2xlIElkZW50aXR5IGhlYWRlciBmaWVsZCwg b3IgbXVsdGlwbGUgSWRlbnRpdHkgaGVhZGVyIGZpZWxkcywgdGhlIHNwZWMgZG9lc27igJl0IHNh eSBhbnl0aGluZyBhYm91dCB0aGUgc2VtYW50aWNzIG9mIHRoZSBvcmRlciBvZiB0aGUgaGVhZGVy IGZpZWxkcy4NCg0KRm9yIGV4YW1wbGUsIGluIFNJUCB0aGUgb3JkZXIgb2YgUmVjb3JkLVJvdXRl LCBSb3V0ZSwgVmlhIGV0YyBtYXR0ZXJzLCBiZWNhdXNlIGl0IGltcGFjdHMgaG93IGEgU0lQIG1l c3NhZ2UgaXMgcm91dGVkLg0KDQpNeSBmaXJzdCB0aG91Z2h0IHdhcyB0aGF0IGl0IGRvZXNu4oCZ dCByZWFsbHkgbWF0dGVyIGluIHdoaWNoIG9yZGVyIElkZW50aXR5IGhlYWRlciBmaWVsZHMgYXJl IGxpc3RlZCBpbiBhIFNJUCBtZXNzYWdlLCBzbyB3ZSBkb27igJl0IG5lZWQgdG8gc2F5IGFueXRo aW5nIChpbiBhZGRpdGlvbiB0byB0aGUgZmFjdCB0aGF0IG11bHRpcGxlIGhlYWRlciBmaWVsZHMg YXJlIGFsbG93ZWQpLg0KDQpCdXQsIHdoZW4gSSByZWFkIHRoZSBkaXZlcnQgZXh0ZW5zaW9uIHNs aWRlcyBmcm9tIFNpbmdhcG9yZSwgaXQgc2F5cyB0aGUgZm9sbG93aW5nOg0KDQogICAgIOKAnEFu IElkZW50aXR5IGhlYWRlciB3aXRoIOKAnGRpduKAnSBhbHdheXMgcG9pbnRzIHRvIHNvbWUgcHJp b3IgSWRlbnRpdHkgaGVhZGVy4oCdDQoNClRoZSB3b3JkICpwcmlvciogc2VlbSB0byBpbmRpY2F0 ZSB0aGF0IHRoZSBvcmRlciBvZiBoZWFkZXIgZmllbGRzIERPRVMgbWF0dGVyIChhcyB0aGUgSWRl bnRpdHkgaGVhZGVyIGZpZWxkIGRvZXMgbm90IGNvbnRhaW4gYW55IOKAnHNlcXVlbmNlIG51bWJl cizigJ0gb3Igc2ltaWxhciBtZWNoYW5pc20gZm9yIG9yZGVyaW5nIHRoZW0pLg0KDQpTbywgZXZl biBpZiBkaXZlcnQgd291bGQgdXNlIGEgc2luZ2xlIElkZW50aXR5IGhlYWRlciBmaWVsZCwgc2hv dWxkbuKAmXQgNDQ3NGJpcyBzcGVjaWZ5IGhvdyBJZGVudGl0eSBoZWFkZXJzIGFyZSBhZGRlZCB0 byBhIFNJUCBtZXNzYWdlPw0KDQpPdGhlcndpc2Ugd2UgY291bGQgZW5kIHVwIHdpdGggYSBzaXR1 YXRpb24gd2l0aCB2ZW5kb3IgQSBzZW5kaW5nOg0KDQpJZGVudGl0eTogQQ0KSWRlbnRpdHk6IEIN Cg0K4oCmYW5kIHZlbmRvciBCIHNlbmRpbmc6DQoNCklkZW50aXR5OiBCDQpJZGVudGl0eTogQQ0K DQpJbiBzb21lIGNhc2UgdGhlIG9yZGVyIG1heSBub3QgbWF0dGVyLCBpbiBzb21lIGNhc2VzIGl0 IG1heS4NCg0KT3I/DQoNClJlZ2FyZHMsDQoNCkNocmlzdGVyDQoNCg0KRnJvbTogQWRhbSBSb2Fj aCBbbWFpbHRvOmFkYW1Abm9zdHJ1bS5jb21dDQpTZW50OiAwOSBKYW51YXJ5IDIwMTggMDA6MDUN ClRvOiBDaHJpc3RlciBIb2xtYmVyZyA8Y2hyaXN0ZXIuaG9sbWJlcmdAZXJpY3Nzb24uY29tPjsg SUVURiBTVElSIE1haWwgTGlzdCA8c3RpckBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbc3Rpcl0g ZHJhZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LWRpdmVydDogdHdvIElkZW50aXR5IGhlYWRlciBmaWVs ZHMgW3dhczogZHJhZnQtaWV0Zi1zdGlyLXJmYzQ0NzRiaXMtMTY6IFN5bnRheCBxdWVzdGlvbl0N Cg0KW2FzIHJlc3BvbnNpYmxlIEFEXQ0KDQpDaHJpc3RlciAtLQ0KDQpUaGFua3MgZm9yIGxvb2tp bmcgY2xvc2VseSBhdCA0NDc0YmlzIGFuZCBvZmZlcmluZyB1cCB5b3VyIGNvbW1lbnRzLiBCYXNl ZCBvbiB0aGUgY3VycmVudCBzdGF0ZSBvZiB0aGluZ3MsIEkgZG9uJ3QgdGhpbmsgY2hhbmdlcyBh cmUgd2FycmFudGVkIGF0IHRoaXMgdGltZS4NCg0KVGhpcyBkb2N1bWVudCBpcyBpbiBBVVRINDgg d2l0aCBzaWduLW9mZnMgZnJvbSBhbGwgYnV0IG9uZSBhdXRob3IuIFdoaWxlIGRpc2NvdmVyeSBv ZiBhIGNhdGFzdHJvcGhpYyBlcnJvciB3b3VsZCBiZSBlbm91Z2ggdG8gd2FycmFudCBhZGRpdGlv bmFsIHdvcmtpbmctZ3JvdXAgY3JhZnRpbmcgb24gdGhlIGRvY3VtZW50LCBJIGRvbid0IHNlZSBh bnl0aGluZyBoZXJlIHRoYXQgaXMgY2F0YXN0cm9waGljLiBUaGUgbXVsdGlwbGUtaGVhZGVyIGlz c3VlIHlvdSBkZXNjcmliZSBpcyBhIGJpdCBjb25mdXNpbmcsIGJ1dCB0aGF0IGFwcGVhcnMgdG8g YmUgYSBmbGF3IGluIFJGQzMyNjEgbW9yZSB0aGFuIHRoaXMgZG9jdW1lbnQuIEltcG9ydGFudGx5 LCB0aGUgc2VjdGlvbiBvZiAzMjYxIHlvdSBjaXRlIGlzIGZvbGxvd2VkIGJ5Og0KDQoNCg0KICAg VGhlIGV4Y2VwdGlvbnMNCg0KICAgdG8gdGhpcyBydWxlIGFyZSB0aGUgV1dXLUF1dGhlbnRpY2F0 ZSwgQXV0aG9yaXphdGlvbiwgUHJveHktDQoNCiAgIEF1dGhlbnRpY2F0ZSwgYW5kIFByb3h5LUF1 dGhvcml6YXRpb24gaGVhZGVyIGZpZWxkcy4gIE11bHRpcGxlIGhlYWRlcg0KDQogICBmaWVsZCBy b3dzIHdpdGggdGhlc2UgbmFtZXMgTUFZIGJlIHByZXNlbnQgaW4gYSBtZXNzYWdlLCBidXQgc2lu Y2UNCg0KICAgdGhlaXIgZ3JhbW1hciBkb2VzIG5vdCBmb2xsb3cgdGhlIGdlbmVyYWwgZm9ybSBs aXN0ZWQgaW4gU2VjdGlvbiA3LjM8aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzMyNjEj c2VjdGlvbi03LjM+LA0KDQogICB0aGV5IE1VU1QgTk9UIGJlIGNvbWJpbmVkIGludG8gYSBzaW5n bGUgaGVhZGVyIGZpZWxkIHJvdy4NCg0KVGhpcywgY29tYmluZWQgd2l0aCB0aGUgZmFjdCB0aGF0 IHRoZSBzeW50YXggb2YgIklkZW50aXR5IiAqYWxzbyogZG9lc24ndCBmb2xsb3cgdGhlIGdlbmVy YWwgZm9ybSBsaXN0ZWQgaW4gUkZDIDMyNjEgc2VjdGlvbiA3LjMsIG1lYW5zIHRoYXQgdGhlICIu Li5NQVkuLi4gaWYgYW5kIG9ubHkgaWYuLi4iIGNvbnN0cnVjdCB5b3UgY2l0ZSBhbHNvIGRvZXNu J3QgYXBwbHkgdG8gaXQuIEl0IG1pZ2h0IGhhdmUgYmVlbiBjbGVhbmVyIHRvIGluZGljYXRlIHRo YXQgIklkZW50aXR5IiBpcyBhZGRlZCB0byB0aGUgbGlzdCBvZiBleGNlcHRpb25zIGluIHNlY3Rp b24gNy4zLjEgb2YgUkZDIDMyNjEsIGJ1dCB0aGlzIHNlZW1zIHRvIGJlIGEgbGFjayBvZiB0aWRp bmVzcyByYXRoZXIgdGhhbiBhIGNyaXRpY2FsIGZsYXcgaW4gdGhlIGRvY3VtZW50Lg0KDQpJIHdp bGwgbm90ZSB0aGF0IHRoZSBkZWNpc2lvbiBub3QgdG8gYWxsb3cgY29tbWEgc2VwYXJhdGlvbiBh cHBlYXJzIHRvIGhhdmUgYmVlbiBpbnRlbnRpb25hbCBbMV0sIGFuZCB3YXMgbWVudGlvbmVkIGFz IHJlY2VudGx5IGFzIGxhc3QgSnVuZSBvbiB0aGUgbWFpbGluZyBsaXN0IFsyXS4gSW4gdGhhdCBs aWdodCwgSSBiZWxpZXZlIHRoYXQgeW91ciByZXF1ZXN0IHdvdWxkIGZ1bmN0aW9uYWxseSBiZSBh c2tpbmcgdG8gcmV2ZXJzZSBwcmlvciB3b3JraW5nIGdyb3VwIGNvbnNlbnN1cyByYXRoZXIgdGhh biBmaXhpbmcgYW4gZXJyb3IuIFdlIGFyZSB3ZWxsIHBhc3QgdGhlIHBvaW50IG9mIHJldmlzaXRp bmcgcGFzdCB3b3JraW5nIGdyb3VwIGRlY2lzaW9ucyBvbiB0aGlzIGRvY3VtZW50Lg0KDQovYQ0K DQpfX19fDQpbMV0gQWx0aG91Z2ggSSBjYW4ndCBmaW5kIHRoZSBjb3JyZXNwb25kaW5nIG1pbnV0 ZXMgb3IgZW1haWwsIEkgaGF2ZSBhIHZhZ3VlIHJlY29sbGVjdGlvbiBvZiBkaXNjdXNzaW9ucyBh Ym91dCB3aGljaCBzeW50YXggd291bGQgYmUgbW9yZSBsaWtlbHkgdG8gYmUgY29tcGF0aWJsZSB3 aXRoIGV4aXRpbmcgUkZDNDQ3NCBpbXBsZW1lbnRhdGlvbnMsIHdpdGggdGhlIGN1cnJlbnQgc3lu dGF4IHJlZmxlY3RpbmcgdGhlIG91dGNvbWUgb2YgdGhvc2UgZGlzY3Vzc2lvbnMuDQoNClsyXSBo dHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL3N0aXIvdEFoRTdqRDZPV1RsR0hP LU1MUWF2cE9EbTFzDQoNCg0KT24gMS84LzE4IDA5OjIzLCBDaHJpc3RlciBIb2xtYmVyZyB3cm90 ZToNCkhpLA0KDQpSZWxhdGVkIHRvIG15IGlzc3VlIGJlbG93LCBJIHRoaW5rIGl0IHdvdWxkIGJl IGdvb2QgdG8gc2hvdyBhIGNvbXBsZXRlIGV4YW1wbGUgd2l0aCB0d28gSWRlbnRpdHkgaGVhZGVy IGZpZWxkcyBpbiBzZWN0aW9uIDQuMSBvZiBkcmFmdC1pZXRmLXN0aXItcGFzc3BvcnQtZGl2ZXJ0 LTAxLg0KDQpSZWdhcmRzLA0KDQpDaHJpc3Rlcg0KDQpGcm9tOiBzdGlyIDxzdGlyLWJvdW5jZXNA aWV0Zi5vcmc8bWFpbHRvOnN0aXItYm91bmNlc0BpZXRmLm9yZz4+IG9uIGJlaGFsZiBvZiBDaHJp c3RlciBIb2xtYmVyZyA8Y2hyaXN0ZXIuaG9sbWJlcmdAZXJpY3Nzb24uY29tPG1haWx0bzpjaHJp c3Rlci5ob2xtYmVyZ0Blcmljc3Nvbi5jb20+Pg0KRGF0ZTogVGh1cnNkYXkgNCBKYW51YXJ5IDIw MTggYXQgMTI6MTANClRvOiBJRVRGIFNUSVIgTWFpbCBMaXN0IDxzdGlyQGlldGYub3JnPG1haWx0 bzpzdGlyQGlldGYub3JnPj4NClN1YmplY3Q6IFJlOiBbc3Rpcl0gZHJhZnQtaWV0Zi1zdGlyLXJm YzQ0NzRiaXMtMTY6IFN5bnRheCBxdWVzdGlvbg0KDQpJcyBpdCBzdGlsbCBwb3NzaWJsZSB0byBm aXggdGhpcyBpbiB0aGUgZG9jdW1lbnQsIG9yIGRvIHdlIGZpbGUgYW4gZXJyYXRhIG9uY2UgdGhl IFJGQyBoYXMgYmVlbiBwdWJsaXNoZWQ/DQoNClJlZ2FyZHMsDQoNCkNocmlzdGVyDQoNCkZyb206 IHN0aXIgPHN0aXItYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86c3Rpci1ib3VuY2VzQGlldGYub3Jn Pj4gb24gYmVoYWxmIG9mIENocmlzdGVyIEhvbG1iZXJnIDxjaHJpc3Rlci5ob2xtYmVyZ0Blcmlj c3Nvbi5jb208bWFpbHRvOmNocmlzdGVyLmhvbG1iZXJnQGVyaWNzc29uLmNvbT4+DQpEYXRlOiBX ZWRuZXNkYXkgMyBKYW51YXJ5IDIwMTggYXQgMjA6NTcNClRvOiBJRVRGIFNUSVIgTWFpbCBMaXN0 IDxzdGlyQGlldGYub3JnPG1haWx0bzpzdGlyQGlldGYub3JnPj4NClN1YmplY3Q6IFtzdGlyXSBk cmFmdC1pZXRmLXN0aXItcmZjNDQ3NGJpcy0xNjogU3ludGF4IHF1ZXN0aW9uDQoNCkhpLA0KDQpT ZWN0aW9uIDQgc2F5czoNCg0KICAg4oCcTm90ZSB0aGF0IHVubGlrZSB0aGUgcHJpb3Igc3BlY2lm aWNhdGlvbg0KICAgaW4gUkZDNDQ3NCwgdGhlIElkZW50aXR5IGhlYWRlciBmaWVsZCBpcyBub3cg YWxsb3dlZCB0byBhcHBlYXIgbW9yZQ0KICAgdGhhbiBvbmUgdGltZSBpbiBhIFNJUCByZXF1ZXN0 LiAgVGhlIHJldmlzZWQgZ3JhbW1hciBmb3IgdGhlIElkZW50aXR5DQogICBoZWFkZXIgZmllbGQg YnVpbGRzIG9uIHRoZSBBQk5GIFtSRkM1MjM0XSBpbiBSRkMgMzI2MSBbUkZDMzI2MV0NCiAgIFNl Y3Rpb24gMjUuICBJdCBpcyBhcyBmb2xsb3dzOg0KDQogICAgICBJZGVudGl0eSA9ICJJZGVudGl0 eSIgSENPTE9OIHNpZ25lZC1pZGVudGl0eS1kaWdlc3QgU0VNSQ0KICAgICAgaWRlbnQtaW5mbyAq KCBTRU1JIGlkZW50LWluZm8tcGFyYW1zICkNCiAgICAgIOKApuKAnQ0KDQpIb3dldmVyLCB0aGF0 IHN5bnRheCBkb2VzIE5PVCBhbGxvdyBtdWx0aXBsZSBJZGVudGl0eSBoZWFkZXIgZmllbGRzLCBh Y2NvcmRpbmcgdG8gdGhlIHJ1bGVzIGluIFJGQyAzMjYxOg0KDQogICDigJxNdWx0aXBsZSBoZWFk ZXIgZmllbGQgcm93cyB3aXRoIHRoZSBzYW1lIGZpZWxkLW5hbWUgTUFZIGJlIHByZXNlbnQgaW4N CiAgIGEgbWVzc2FnZSBpZiBhbmQgb25seSBpZiB0aGUgZW50aXJlIGZpZWxkLXZhbHVlIGZvciB0 aGF0IGhlYWRlciBmaWVsZA0KICAgaXMgZGVmaW5lZCBhcyBhIGNvbW1hLXNlcGFyYXRlZCBsaXN0 4oCdDQoNCkl0IHNob3VsZCBiZSBzb21ldGhpbmcgbGlrZToNCg0KICAgICBJZGVudGl0eSA9ICJJ ZGVudGl0eSIgSENPTE9OIHNpZ25lZC1pZGVudGl0eSAqIChDT01NQSBzaWduZWQtaWRlbnRpdHkp DQogICAgIHNpZ25lZC1pZGVudGl0eSA9IHNpZ25lZC1pZGVudGl0eS1kaWdlc3QgU0VNSSBpZGVu dGktaW5mbyAqIChTRU1JIGlkZW50LWluZm8tcGFyYW1zKQ0KICAgICDigKbigJ0NCg0KT3IsIG1p c3VuZGVyc3Rvb2QgSSBoYXZlPw0KDQpSZWdhcmRzLA0KDQpDaHJpc3Rlcg0KDQoNCg0KDQoNCl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQoNCnN0aXIgbWFp bGluZyBsaXN0DQoNCnN0aXJAaWV0Zi5vcmc8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+DQoNCmh0dHBz Oi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc3Rpcg0KDQoNCg== --_000_7594FB04B1934943A5C02806D1A2204B6C10AD58ESESSMB109erics_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmOw0KCWNvbG9yOmJsYWNrOw0KCW1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTO30N CmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNv bG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNw YW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9y OiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwDQoJe21zby1zdHlsZS1w cmlvcml0eTo5OTsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNt Ow0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250 LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmOw0KCWNv bG9yOmJsYWNrO30NCnByZQ0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxp bms6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0KCW1hcmdpbjowY207DQoJbWFyZ2luLWJvdHRv bTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3 IjsNCgljb2xvcjpibGFjazt9DQpzcGFuLkhUTUxQcmVmb3JtYXR0ZWRDaGFyDQoJe21zby1zdHls ZS1uYW1lOiJIVE1MIFByZWZvcm1hdHRlZCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7 DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVkIjsNCglmb250LWZhbWlseTpDb25z b2xhczsNCgljb2xvcjpibGFjazt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlw ZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3 aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTIxDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFs Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0K c3Bhbi5FbWFpbFN0eWxlMjINCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtY29tcG9zZTsNCglm b250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5N c29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZTox MC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1h cmdpbjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtw YWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwh W2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9 ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlv dXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFu Zz0iRU4tR0IiIGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9Ildv cmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFG NDk3RCI+SGksPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5PbmUgbW9yZSBj b21tZW50IG9uIHRoaXMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5ObyBt YXR0ZXIgaWYgb25lIHVzZXMgY29tbWEgc2VwYXJhdGlvbiB3aXRoaW4gYSBzaW5nbGUgSWRlbnRp dHkgaGVhZGVyIGZpZWxkLCBvciBtdWx0aXBsZSBJZGVudGl0eSBoZWFkZXIgZmllbGRzLCB0aGUg c3BlYyBkb2VzbuKAmXQgc2F5IGFueXRoaW5nIGFib3V0IHRoZSBzZW1hbnRpY3Mgb2YgdGhlIG9y ZGVyIG9mIHRoZSBoZWFkZXIgZmllbGRzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFG NDk3RCI+Rm9yIGV4YW1wbGUsIGluIFNJUCB0aGUgb3JkZXIgb2YgUmVjb3JkLVJvdXRlLCBSb3V0 ZSwgVmlhIGV0YyBtYXR0ZXJzLCBiZWNhdXNlIGl0IGltcGFjdHMgaG93IGEgU0lQIG1lc3NhZ2Ug aXMgcm91dGVkLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+TXkgZmlyc3Qg dGhvdWdodCB3YXMgdGhhdCBpdCBkb2VzbuKAmXQgcmVhbGx5IG1hdHRlciBpbiB3aGljaCBvcmRl ciBJZGVudGl0eSBoZWFkZXIgZmllbGRzIGFyZSBsaXN0ZWQgaW4gYSBTSVAgbWVzc2FnZSwgc28g d2UgZG9u4oCZdCBuZWVkIHRvIHNheSBhbnl0aGluZyAoaW4gYWRkaXRpb24gdG8gdGhlIGZhY3Qg dGhhdCBtdWx0aXBsZSBoZWFkZXIgZmllbGRzIGFyZQ0KIGFsbG93ZWQpLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdE Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iY29sb3I6IzFGNDk3RCI+QnV0LCB3aGVuIEkgcmVhZCB0aGUgZGl2ZXJ0IGV4dGVu c2lvbiBzbGlkZXMgZnJvbSBTaW5nYXBvcmUsIGl0IHNheXMgdGhlIGZvbGxvd2luZzo8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyDi gJxBbiBJZGVudGl0eSBoZWFkZXIgd2l0aCDigJxkaXbigJ0gYWx3YXlzIHBvaW50cyB0byBzb21l IHByaW9yIElkZW50aXR5IGhlYWRlcuKAnTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFG NDk3RCI+VGhlIHdvcmQgKjxiPnByaW9yPC9iPiogc2VlbSB0byBpbmRpY2F0ZSB0aGF0IHRoZSBv cmRlciBvZiBoZWFkZXIgZmllbGRzIERPRVMgbWF0dGVyIChhcyB0aGUgSWRlbnRpdHkgaGVhZGVy IGZpZWxkIGRvZXMgbm90IGNvbnRhaW4gYW55IOKAnHNlcXVlbmNlIG51bWJlcizigJ0gb3Igc2lt aWxhciBtZWNoYW5pc20gZm9yIG9yZGVyaW5nIHRoZW0pLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Y29sb3I6IzFGNDk3RCI+U28sIGV2ZW4gaWYgZGl2ZXJ0IHdvdWxkIHVzZSBhIHNpbmdsZSBJZGVu dGl0eSBoZWFkZXIgZmllbGQsIHNob3VsZG7igJl0IDQ0NzRiaXMgc3BlY2lmeSBob3cgSWRlbnRp dHkgaGVhZGVycyBhcmUgYWRkZWQgdG8gYSBTSVAgbWVzc2FnZT88bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImNvbG9yOiMxRjQ5N0QiPk90aGVyd2lzZSB3ZSBjb3VsZCBlbmQgdXAgd2l0aCBhIHNpdHVh dGlvbiB3aXRoIHZlbmRvciBBIHNlbmRpbmc6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjoj MUY0OTdEIj5JZGVudGl0eTogQTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5JZGVudGl0eTogQjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0 OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+4oCmYW5kIHZlbmRvciBCIHNlbmRpbmc6PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9y OiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5JZGVudGl0eTogQjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdE Ij5JZGVudGl0eTogQTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+SW4gc29t ZSBjYXNlIHRoZSBvcmRlciBtYXkgbm90IG1hdHRlciwgaW4gc29tZSBjYXNlcyBpdCBtYXkuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNv bG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5Pcj88bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImNvbG9yOiMxRjQ5N0QiPlJlZ2FyZHMsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjoj MUY0OTdEIj5DaHJpc3RlcjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+Jm5ic3A7IDxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIG5hbWU9Il9NYWls RW5kQ29tcG9zZSI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvYT48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRv cDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjp3aW5kb3d0 ZXh0O21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLUdCIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gbGFu Zz0iRU4tVVMiIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O21zby1mYXJlYXN0LWxhbmd1YWdlOkVO LUdCIj4gQWRhbSBSb2FjaCBbbWFpbHRvOmFkYW1Abm9zdHJ1bS5jb21dDQo8YnI+DQo8Yj5TZW50 OjwvYj4gMDkgSmFudWFyeSAyMDE4IDAwOjA1PGJyPg0KPGI+VG86PC9iPiBDaHJpc3RlciBIb2xt YmVyZyAmbHQ7Y2hyaXN0ZXIuaG9sbWJlcmdAZXJpY3Nzb24uY29tJmd0OzsgSUVURiBTVElSIE1h aWwgTGlzdCAmbHQ7c3RpckBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtz dGlyXSBkcmFmdC1pZXRmLXN0aXItcGFzc3BvcnQtZGl2ZXJ0OiB0d28gSWRlbnRpdHkgaGVhZGVy IGZpZWxkcyBbd2FzOiBkcmFmdC1pZXRmLXN0aXItcmZjNDQ3NGJpcy0xNjogU3ludGF4IHF1ZXN0 aW9uXTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5bYXMgcmVzcG9uc2libGUgQURdPGJyPg0KPGJyPg0KQ2hyaXN0ZXIgLS08YnI+DQo8YnI+DQpU aGFua3MgZm9yIGxvb2tpbmcgY2xvc2VseSBhdCA0NDc0YmlzIGFuZCBvZmZlcmluZyB1cCB5b3Vy IGNvbW1lbnRzLiBCYXNlZCBvbiB0aGUgY3VycmVudCBzdGF0ZSBvZiB0aGluZ3MsIEkgZG9uJ3Qg dGhpbmsgY2hhbmdlcyBhcmUgd2FycmFudGVkIGF0IHRoaXMgdGltZS48YnI+DQo8YnI+DQpUaGlz IGRvY3VtZW50IGlzIGluIEFVVEg0OCB3aXRoIHNpZ24tb2ZmcyBmcm9tIGFsbCBidXQgb25lIGF1 dGhvci4gV2hpbGUgZGlzY292ZXJ5IG9mIGEgY2F0YXN0cm9waGljIGVycm9yIHdvdWxkIGJlIGVu b3VnaCB0byB3YXJyYW50IGFkZGl0aW9uYWwgd29ya2luZy1ncm91cCBjcmFmdGluZyBvbiB0aGUg ZG9jdW1lbnQsIEkgZG9uJ3Qgc2VlIGFueXRoaW5nIGhlcmUgdGhhdCBpcyBjYXRhc3Ryb3BoaWMu IFRoZSBtdWx0aXBsZS1oZWFkZXIgaXNzdWUNCiB5b3UgZGVzY3JpYmUgaXMgYSBiaXQgY29uZnVz aW5nLCBidXQgdGhhdCBhcHBlYXJzIHRvIGJlIGEgZmxhdyBpbiBSRkMzMjYxIG1vcmUgdGhhbiB0 aGlzIGRvY3VtZW50LiBJbXBvcnRhbnRseSwgdGhlIHNlY3Rpb24gb2YgMzI2MSB5b3UgY2l0ZSBp cyBmb2xsb3dlZCBieTo8YnI+DQo8YnI+DQo8YnI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEy LjBwdDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1HQiI+PG86cD48L286cD48L3NwYW4+PC9wPg0K PGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+ DQo8cHJlPiZuYnNwOyZuYnNwOyBUaGUgZXhjZXB0aW9uczxvOnA+PC9vOnA+PC9wcmU+DQo8cHJl PiZuYnNwOyZuYnNwOyB0byB0aGlzIHJ1bGUgYXJlIHRoZSBXV1ctQXV0aGVudGljYXRlLCBBdXRo b3JpemF0aW9uLCBQcm94eS08bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgQXV0 aGVudGljYXRlLCBhbmQgUHJveHktQXV0aG9yaXphdGlvbiBoZWFkZXIgZmllbGRzLiZuYnNwOyBN dWx0aXBsZSBoZWFkZXI8bzpwPjwvbzpwPjwvcHJlPg0KPHByZT4mbmJzcDsmbmJzcDsgZmllbGQg cm93cyB3aXRoIHRoZXNlIG5hbWVzIE1BWSBiZSBwcmVzZW50IGluIGEgbWVzc2FnZSwgYnV0IHNp bmNlPG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IHRoZWlyIGdyYW1tYXIgZG9l cyBub3QgZm9sbG93IHRoZSBnZW5lcmFsIGZvcm0gbGlzdGVkIGluIDxhIGhyZWY9Imh0dHBzOi8v dG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmMzMjYxI3NlY3Rpb24tNy4zIj5TZWN0aW9uIDcuMzwvYT4s PG86cD48L286cD48L3ByZT4NCjxwcmU+Jm5ic3A7Jm5ic3A7IHRoZXkgTVVTVCBOT1QgYmUgY29t YmluZWQgaW50byBhIHNpbmdsZSBoZWFkZXIgZmllbGQgcm93LjxvOnA+PC9vOnA+PC9wcmU+DQo8 L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQpUaGlzLCBjb21iaW5lZCB3 aXRoIHRoZSBmYWN0IHRoYXQgdGhlIHN5bnRheCBvZiAmcXVvdDtJZGVudGl0eSZxdW90OyAqYWxz byogZG9lc24ndCBmb2xsb3cgdGhlIGdlbmVyYWwgZm9ybSBsaXN0ZWQgaW4gUkZDIDMyNjEgc2Vj dGlvbiA3LjMsIG1lYW5zIHRoYXQgdGhlICZxdW90Oy4uLk1BWS4uLiBpZiBhbmQgb25seSBpZi4u LiZxdW90OyBjb25zdHJ1Y3QgeW91IGNpdGUgYWxzbyBkb2Vzbid0IGFwcGx5IHRvIGl0LiBJdCBt aWdodCBoYXZlIGJlZW4gY2xlYW5lciB0byBpbmRpY2F0ZQ0KIHRoYXQgJnF1b3Q7SWRlbnRpdHkm cXVvdDsgaXMgYWRkZWQgdG8gdGhlIGxpc3Qgb2YgZXhjZXB0aW9ucyBpbiBzZWN0aW9uIDcuMy4x IG9mIFJGQyAzMjYxLCBidXQgdGhpcyBzZWVtcyB0byBiZSBhIGxhY2sgb2YgdGlkaW5lc3MgcmF0 aGVyIHRoYW4gYSBjcml0aWNhbCBmbGF3IGluIHRoZSBkb2N1bWVudC48YnI+DQo8YnI+DQpJIHdp bGwgbm90ZSB0aGF0IHRoZSBkZWNpc2lvbiBub3QgdG8gYWxsb3cgY29tbWEgc2VwYXJhdGlvbiBh cHBlYXJzIHRvIGhhdmUgYmVlbiBpbnRlbnRpb25hbCBbMV0sIGFuZCB3YXMgbWVudGlvbmVkIGFz IHJlY2VudGx5IGFzIGxhc3QgSnVuZSBvbiB0aGUgbWFpbGluZyBsaXN0IFsyXS4gSW4gdGhhdCBs aWdodCwgSSBiZWxpZXZlIHRoYXQgeW91ciByZXF1ZXN0IHdvdWxkIGZ1bmN0aW9uYWxseSBiZSBh c2tpbmcgdG8gcmV2ZXJzZSBwcmlvciB3b3JraW5nDQogZ3JvdXAgY29uc2Vuc3VzIHJhdGhlciB0 aGFuIGZpeGluZyBhbiBlcnJvci4gV2UgYXJlIHdlbGwgcGFzdCB0aGUgcG9pbnQgb2YgcmV2aXNp dGluZyBwYXN0IHdvcmtpbmcgZ3JvdXAgZGVjaXNpb25zIG9uIHRoaXMgZG9jdW1lbnQuPGJyPg0K PGJyPg0KL2E8YnI+DQo8YnI+DQpfX19fPGJyPg0KWzFdIEFsdGhvdWdoIEkgY2FuJ3QgZmluZCB0 aGUgY29ycmVzcG9uZGluZyBtaW51dGVzIG9yIGVtYWlsLCBJIGhhdmUgYSB2YWd1ZSByZWNvbGxl Y3Rpb24gb2YgZGlzY3Vzc2lvbnMgYWJvdXQgd2hpY2ggc3ludGF4IHdvdWxkIGJlIG1vcmUgbGlr ZWx5IHRvIGJlIGNvbXBhdGlibGUgd2l0aCBleGl0aW5nIFJGQzQ0NzQgaW1wbGVtZW50YXRpb25z LCB3aXRoIHRoZSBjdXJyZW50IHN5bnRheCByZWZsZWN0aW5nIHRoZSBvdXRjb21lIG9mIHRob3Nl IGRpc2N1c3Npb25zLjxicj4NCjxicj4NClsyXSA8YSBocmVmPSJodHRwczovL21haWxhcmNoaXZl LmlldGYub3JnL2FyY2gvbXNnL3N0aXIvdEFoRTdqRDZPV1RsR0hPLU1MUWF2cE9EbTFzIj4NCmh0 dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvc3Rpci90QWhFN2pENk9XVGxHSE8t TUxRYXZwT0RtMXM8L2E+PGJyPg0KPGJyPg0KPGJyPg0KT24gMS84LzE4IDA5OjIzLCBDaHJpc3Rl ciBIb2xtYmVyZyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5 bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+SGksPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlJlbGF0ZWQgdG8gbXkgaXNzdWUgYmVsb3csIEkgdGhpbmsgaXQgd291 bGQgYmUgZ29vZCB0byBzaG93IGEgY29tcGxldGUgZXhhbXBsZSB3aXRoIHR3byBJZGVudGl0eSBo ZWFkZXIgZmllbGRzIGluIHNlY3Rpb24gNC4xIG9mJm5ic3A7ZHJhZnQtaWV0Zi1zdGlyLXBhc3Nw b3J0LWRpdmVydC0wMS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+UmVnYXJkcyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Q2hyaXN0ZXI8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7 cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9t OiA8L2I+c3RpciAmbHQ7PGEgaHJlZj0ibWFpbHRvOnN0aXItYm91bmNlc0BpZXRmLm9yZyI+c3Rp ci1ib3VuY2VzQGlldGYub3JnPC9hPiZndDsgb24gYmVoYWxmIG9mIENocmlzdGVyIEhvbG1iZXJn ICZsdDs8YSBocmVmPSJtYWlsdG86Y2hyaXN0ZXIuaG9sbWJlcmdAZXJpY3Nzb24uY29tIj5jaHJp c3Rlci5ob2xtYmVyZ0Blcmljc3Nvbi5jb208L2E+Jmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5UaHVy c2RheSA0IEphbnVhcnkgMjAxOCBhdCAxMjoxMDxicj4NCjxiPlRvOiA8L2I+SUVURiBTVElSIE1h aWwgTGlzdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOnN0aXJAaWV0Zi5vcmciPnN0aXJAaWV0Zi5vcmc8 L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5SZTogW3N0aXJdIGRyYWZ0LWlldGYtc3Rpci1y ZmM0NDc0YmlzLTE2OiBTeW50YXggcXVlc3Rpb248bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdCI+SXMgaXQgc3RpbGwgcG9z c2libGUgdG8gZml4IHRoaXMgaW4gdGhlIGRvY3VtZW50LCBvciBkbyB3ZSBmaWxlIGFuIGVycmF0 YSBvbmNlIHRoZSBSRkMgaGFzIGJlZW4gcHVibGlzaGVkPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuNXB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdCI+UmVnYXJk cyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC41cHQiPkNocmlzdGVyPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41 cHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNt IDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+RnJvbTogPC9iPnN0aXIgJmx0Ozxh IGhyZWY9Im1haWx0bzpzdGlyLWJvdW5jZXNAaWV0Zi5vcmciPnN0aXItYm91bmNlc0BpZXRmLm9y ZzwvYT4mZ3Q7IG9uIGJlaGFsZiBvZiBDaHJpc3RlciBIb2xtYmVyZyAmbHQ7PGEgaHJlZj0ibWFp bHRvOmNocmlzdGVyLmhvbG1iZXJnQGVyaWNzc29uLmNvbSI+Y2hyaXN0ZXIuaG9sbWJlcmdAZXJp Y3Nzb24uY29tPC9hPiZndDs8YnI+DQo8Yj5EYXRlOiA8L2I+V2VkbmVzZGF5IDMgSmFudWFyeSAy MDE4IGF0IDIwOjU3PGJyPg0KPGI+VG86IDwvYj5JRVRGIFNUSVIgTWFpbCBMaXN0ICZsdDs8YSBo cmVmPSJtYWlsdG86c3RpckBpZXRmLm9yZyI+c3RpckBpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+ U3ViamVjdDogPC9iPltzdGlyXSBkcmFmdC1pZXRmLXN0aXItcmZjNDQ3NGJpcy0xNjogU3ludGF4 IHF1ZXN0aW9uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpLDxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TZWN0aW9uIDQgc2F5czo8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7Jm5ic3A7IOKAnE5vdGUgdGhhdCB1bmxpa2UgdGhlIHByaW9yIHNwZWNpZmlj YXRpb248bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyZuYnNwOyBp biBSRkM0NDc0LCB0aGUgSWRlbnRpdHkgaGVhZGVyIGZpZWxkIGlzIG5vdyBhbGxvd2VkIHRvIGFw cGVhciBtb3JlPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJz cDsgdGhhbiBvbmUgdGltZSBpbiBhIFNJUCByZXF1ZXN0LiZuYnNwOyBUaGUgcmV2aXNlZCBncmFt bWFyIGZvciB0aGUgSWRlbnRpdHk8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOyZuYnNwOyBoZWFkZXIgZmllbGQgYnVpbGRzIG9uIHRoZSBBQk5GIFtSRkM1MjM0XSBp biBSRkMgMzI2MSBbUkZDMzI2MV08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOyZuYnNwOyBTZWN0aW9uIDI1LiZuYnNwOyBJdCBpcyBhcyBmb2xsb3dzOjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgSWRlbnRpdHkg PSAmcXVvdDtJZGVudGl0eSZxdW90OyBIQ09MT04gc2lnbmVkLWlkZW50aXR5LWRpZ2VzdCBTRU1J PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsgaWRlbnQtaW5mbyAqKCBTRU1JIGlkZW50LWluZm8tcGFyYW1zICk8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyDigKbigJ08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SG93ZXZlciwgdGhhdCBzeW50YXgg ZG9lcyBOT1QgYWxsb3cgbXVsdGlwbGUgSWRlbnRpdHkgaGVhZGVyIGZpZWxkcywgYWNjb3JkaW5n IHRvIHRoZSBydWxlcyBpbiBSRkMgMzI2MTo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 Jm5ic3A7IOKAnE11bHRpcGxlIGhlYWRlciBmaWVsZCByb3dzIHdpdGggdGhlIHNhbWUgZmllbGQt bmFtZSBNQVkgYmUgcHJlc2VudCBpbjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7Jm5ic3A7IGEgbWVzc2FnZSBpZiBhbmQgb25seSBpZiB0aGUgZW50aXJlIGZpZWxk LXZhbHVlIGZvciB0aGF0IGhlYWRlciBmaWVsZDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7Jm5ic3A7IGlzIGRlZmluZWQgYXMgYSBjb21tYS1zZXBhcmF0ZWQgbGlz dOKAnTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JdCBzaG91bGQgYmUgc29tZXRoaW5nIGxpa2U6 PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IlNWIiBzdHlsZT0ibXNvLWZhcmVh c3QtbGFuZ3VhZ2U6RU4tR0IiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBJZGVudGl0eSA9ICZx dW90O0lkZW50aXR5JnF1b3Q7IEhDT0xPTiBzaWduZWQtaWRlbnRpdHkgKiAoQ09NTUEgc2lnbmVk LWlkZW50aXR5KTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1HQiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IHNpZ25lZC1pZGVudGl0eSA9IHNpZ25lZC1pZGVudGl0eS1kaWdlc3QgU0VNSSBpZGVu dGktaW5mbyAqIChTRU1JIGlkZW50LWluZm8tcGFyYW1zKTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpF Ti1HQiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IOKApuKAnTwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFn ZTpFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLUdCIj5PciwgbWlzdW5kZXJz dG9vZCBJIGhhdmU/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVh c3QtbGFuZ3VhZ2U6RU4tR0IiPlJlZ2FyZHMsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLUdCIj4m bmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tR0IiPkNocmlzdGVyPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZx dW90OyxzZXJpZjttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1HQiI+PGJyPg0KPGJyPg0KPGJyPg0K PG86cD48L286cD48L3NwYW4+PC9wPg0KPHByZT5fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXzxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPnN0aXIgbWFpbGluZyBs aXN0PG86cD48L286cD48L3ByZT4NCjxwcmU+PGEgaHJlZj0ibWFpbHRvOnN0aXJAaWV0Zi5vcmci PnN0aXJAaWV0Zi5vcmc8L2E+PG86cD48L286cD48L3ByZT4NCjxwcmU+PGEgaHJlZj0iaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9zdGlyIj5odHRwczovL3d3dy5pZXRmLm9y Zy9tYWlsbWFuL2xpc3RpbmZvL3N0aXI8L2E+PG86cD48L286cD48L3ByZT4NCjwvYmxvY2txdW90 ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_7594FB04B1934943A5C02806D1A2204B6C10AD58ESESSMB109erics_-- From nobody Mon Jan 15 15:31:38 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C695C12ECC2 for ; Mon, 15 Jan 2018 15:31:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nPnMbRnWBhMJ for ; Mon, 15 Jan 2018 15:31:32 -0800 (PST) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 34C4212ECB9 for ; Mon, 15 Jan 2018 15:31:19 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 5D5753005D6 for ; Mon, 15 Jan 2018 18:31:18 -0500 (EST) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id ZuVoy85gj7Gd for ; Mon, 15 Jan 2018 18:31:17 -0500 (EST) Received: from a860b60074bd.home (pool-108-45-101-150.washdc.fios.verizon.net [108.45.101.150]) by mail.smeinc.net (Postfix) with ESMTPSA id 1BC57300250; Mon, 15 Jan 2018 18:31:17 -0500 (EST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Russ Housley X-Priority: 3 (Normal) In-Reply-To: <01000160fbd56982-62133f2a-8aea-4378-95a7-9d2ee5492984-000000@email.amazonses.com> Date: Mon, 15 Jan 2018 18:31:20 -0500 Cc: IETF STIR Mail List Content-Transfer-Encoding: quoted-printable Message-Id: <38034401-7286-4F00-820C-EA914E171706@vigilsec.com> References: <01000160fbd56982-62133f2a-8aea-4378-95a7-9d2ee5492984-000000@email.amazonses.com> To: Di-Shi Sun X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [stir] Should the STIR WG Adopt draft-wendt-stir-passport-shaken? X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jan 2018 23:31:36 -0000 The STIR WG has agreed to adopt it. The next step is for the authors to = post draft-ietf-stir-passport-shaken-00. Russ > On Jan 15, 2018, at 4:59 PM, Di-Shi Sun = wrote: >=20 > I saw Chris asked to review the draft, and support for working group = adoption several day after this email. I am a little confused, then what = is the status of the draft? >=20 > Thanks, >=20 > Di-Shi Sun. >=20 > -----Original Message----- > From: stir [mailto:stir-bounces@ietf.org] On Behalf Of Russ Housley > Sent: Wednesday, January 3, 2018 3:43 PM > To: IETF STIR Mail List > Subject: Re: [stir] Should the STIR WG Adopt = draft-wendt-stir-passport-shaken? >=20 > There was support for adoption of this document in Singapore, and no = one has spoken against adoption on the mail list. So, there is = consensus to adopt this document. >=20 > Authors, please post an updated Internet-Draft with a file name of = draft-ietf-stir-passport-shaken-00. >=20 > For the STIR WG Chairs, > Russ >=20 >=20 >=20 >> On Dec 20, 2017, at 2:35 PM, Russ Housley = wrote: >>=20 >> draft-wendt-stir-passport-shaken was discussed in the recent meeting = in Singapore. Please indicate whether or not you believe the STIR WG = should adopt this document. Please respond no later than 3 January = 2018. >>=20 >> For the STIR WG Chairs, >> Russ From nobody Thu Jan 18 07:50:18 2018 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 30E5512711D; Thu, 18 Jan 2018 07:50:11 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: stir@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.69.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <151629061116.20546.6456497580543692603@ietfa.amsl.com> Date: Thu, 18 Jan 2018 07:50:11 -0800 Archived-At: Subject: [stir] I-D Action: draft-ietf-stir-passport-shaken-00.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jan 2018 15:50:11 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Telephone Identity Revisited WG of the IETF. Title : PASSporT SHAKEN Extension (SHAKEN) Authors : Chris Wendt Mary Barnes Filename : draft-ietf-stir-passport-shaken-00.txt Pages : 7 Date : 2018-01-17 Abstract: This document extends PASSporT, which is a token object that conveys cryptographically-signed information about the participants involved in communications, to include information defined as part of the SHAKEN specification from ATIS (Alliance for Telecommunications Industry Solutions) and the SIP Forum IP-NNI Joint Task Force. These extensions provide a level of confidence in the correctness of the originating identity for a telephone network that has communications coming from both STIR participating originating communications as well as communications that does not include STIR information. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-passport-shaken/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-stir-passport-shaken-00 https://datatracker.ietf.org/doc/html/draft-ietf-stir-passport-shaken-00 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Jan 18 09:24:27 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD00212711D for ; Thu, 18 Jan 2018 09:24:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=chriswendt-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4mQbKNEjJNGi for ; Thu, 18 Jan 2018 09:24:22 -0800 (PST) Received: from mail-qt0-x22a.google.com (mail-qt0-x22a.google.com [IPv6:2607:f8b0:400d:c0d::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BA3D5126CC4 for ; Thu, 18 Jan 2018 09:24:22 -0800 (PST) Received: by mail-qt0-x22a.google.com with SMTP id c2so32092112qtn.9 for ; Thu, 18 Jan 2018 09:24:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chriswendt-net.20150623.gappssmtp.com; s=20150623; h=from:content-transfer-encoding:mime-version:subject:date:references :to:in-reply-to:message-id; bh=Km9EGia5fmG3ouIQCrkW9TcYmOcSvZ2GXeYTdb/dL04=; b=1U9Dkd87a/g3pVqvTigVjjFDPv0LN4TYwFwHdsTxdD0IR3PsMspNnSOoqdSjIaw6ah GKwtejsiVp1p+ebFvVMuYJoQFA7TZYwL35JEkT60uqvblot5X5uL1+GcfU/v837BiS16 L+6XdMsfWtyN1tIK962ch5ovT5k91k6FCbMLJWMVVSd56kCt88qF8a9AW/tvGIMa4rk9 hmHJK5Fc77SgTvz2ZFdhvCmqikWUvCI1TD5tVUMVsoSxKIxKzaCD5RgyGs6CrW7oM17f AYAX5jXEz2fPJkpaOBkdt9DyTzuPAoC43NHLXdAeHw5JyF+xL7B5YfsnAHmZt8IMMMgd gCgw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:date:references:to:in-reply-to:message-id; bh=Km9EGia5fmG3ouIQCrkW9TcYmOcSvZ2GXeYTdb/dL04=; b=PsYnjZSnSE7SqlowzBZA2DXYf+ZvDGFXLyqH1TaxJaKDXlW/rurwS9jDTAa/sPnoI9 p6gySNGVRs57JMlELY7U6QzaX9qv2kfTTWRZrUdr2pqIO55/4cSyufFuabrNRJQMREUj CM/fMilxDsUjVCo71ZLIbSVjwgA3lo92g7+4dRvSDf6gZgjA9tNU0i6O0UrlbH99O9aU mhVxZuODlKSym90ArX07ui3zR/wJtWJQd9vhUXPaW1mW8h1mX+nXlbbhWjzHpmyu/yDN zSLAuqgL8QB8AaQtyYgrknuScE2HwdGVYwq/26yM7cDHC+BRb7WhboiJ+jXkPTQmTWGV wXeg== X-Gm-Message-State: AKwxyteyXuplqpwZjLbztD6rQr6yNRkHSlV1Xl/oRoOnxRUvqA/fjext SuGWyIj6HWbO8smk0WsxXFzCC/K/SQo= X-Google-Smtp-Source: ACJfBosMHncKV+eEjJNIGSIPUteitVs12FOS5YiEgHg8TOCz5SZPgc/cJmf5G+PLLoGhqAYYKYt4ZQ== X-Received: by 10.237.52.101 with SMTP id w92mr22890325qtd.204.1516296261626; Thu, 18 Jan 2018 09:24:21 -0800 (PST) Received: from ?IPv6:2601:a40:100:49:c8e5:9906:f326:bb78? ([2601:a40:100:49:c8e5:9906:f326:bb78]) by smtp.gmail.com with ESMTPSA id f9sm5149331qta.86.2018.01.18.09.24.19 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 18 Jan 2018 09:24:20 -0800 (PST) From: Chris Wendt Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\)) Date: Thu, 18 Jan 2018 12:24:18 -0500 References: <151629061116.20546.6456497580543692603@ietfa.amsl.com> To: IETF STIR Mail List In-Reply-To: <151629061116.20546.6456497580543692603@ietfa.amsl.com> Message-Id: <6542BD85-401C-48E1-8130-4167710DC584@chriswendt.net> X-Mailer: Apple Mail (2.3445.5.20) Archived-At: Subject: Re: [stir] I-D Action: draft-ietf-stir-passport-shaken-00.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jan 2018 17:24:26 -0000 Hi All, In addition to updating to WG document I=E2=80=99ve also included a few = minor editorial updates to the text that have been sent to me directly.=20= Thanks! -Chris > On Jan 18, 2018, at 10:50 AM, internet-drafts@ietf.org wrote: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > This draft is a work item of the Secure Telephone Identity Revisited = WG of the IETF. >=20 > Title : PASSporT SHAKEN Extension (SHAKEN) > Authors : Chris Wendt > Mary Barnes > Filename : draft-ietf-stir-passport-shaken-00.txt > Pages : 7 > Date : 2018-01-17 >=20 > Abstract: > This document extends PASSporT, which is a token object that conveys > cryptographically-signed information about the participants involved > in communications, to include information defined as part of the > SHAKEN specification from ATIS (Alliance for Telecommunications > Industry Solutions) and the SIP Forum IP-NNI Joint Task Force. = These > extensions provide a level of confidence in the correctness of the > originating identity for a telephone network that has communications > coming from both STIR participating originating communications as > well as communications that does not include STIR information. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-stir-passport-shaken/ >=20 > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-stir-passport-shaken-00 > = https://datatracker.ietf.org/doc/html/draft-ietf-stir-passport-shaken-00 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Fri Jan 19 00:15:06 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B303126C26 for ; Fri, 19 Jan 2018 00:15:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9XDvc2ttlBiX for ; Fri, 19 Jan 2018 00:15:01 -0800 (PST) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3BDCB1201F2 for ; Fri, 19 Jan 2018 00:15:00 -0800 (PST) X-AuditID: c1b4fb2d-b4dff70000007932-90-5a61a9026354 Received: from ESESSHC016.ericsson.se (Unknown_Domain [153.88.183.66]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id CF.28.31026.209A16A5; Fri, 19 Jan 2018 09:14:58 +0100 (CET) Received: from ESESSMB109.ericsson.se ([169.254.9.195]) by ESESSHC016.ericsson.se ([153.88.183.66]) with mapi id 14.03.0352.000; Fri, 19 Jan 2018 09:14:58 +0100 From: Christer Holmberg To: Christer Holmberg , Adam Roach , IETF STIR Mail List Thread-Topic: [stir] draft-ietf-stir-passport-divert: two Identity header fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question] Thread-Index: AQHTiJSmfTFRlLNLiUGvsT+nvKtlH6Nqd6eAgAcWI+CACXASgA== Date: Fri, 19 Jan 2018 08:14:56 +0000 Message-ID: References: <6418489c-996c-3f73-c111-c82437e80356@nostrum.com> <7594FB04B1934943A5C02806D1A2204B6C10AD58@ESESSMB109.ericsson.se> In-Reply-To: <7594FB04B1934943A5C02806D1A2204B6C10AD58@ESESSMB109.ericsson.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.7.170905 x-originating-ip: [153.88.183.146] Content-Type: multipart/alternative; boundary="_000_D6877710296AAchristerholmbergericssoncom_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrIIsWRmVeSWpSXmKPExsUyM2K7ky7TysQog38LpCz2/F3EbrF87TYm ByaPJUt+MnnM2vmEJYApissmJTUnsyy1SN8ugSvjZuMSpoLXVxgrdi5bztzAeHwHYxcjJ4eE gInE0wXdLF2MXBxCAocZJWb8mMkCkhASWMIo8f2zehcjBwebgIVE9z9tkLCIQI3Eox2XmUBs YYF2RomTX5VAekUEOhglDn3czwZR5CTxcFkTK4jNIqAqseNTCzuIzStgLXFk/wSoZVsYJTqu vGUGSXAK+En8av0EtphRQEzi+6k1YBuYBcQlbj2ZzwRxqYDEkj3nmSFsUYmXj/+BLRAV0JPY cOI2O0RcSeLHhkssIEczCyRItK61gdgrKHFy5hOWCYwis5BMnYVQNQtJFUSJgcT7c/OZIWxt iWULX0PZ+hIbv5xlhLCtJU6dv8eErGYBI8cqRtHi1OLi3HQjY73Uoszk4uL8PL281JJNjMCI O7jlt+4OxtWvHQ8xCnAwKvHwXp+UGCXEmlhWXJl7iFGCg1lJhPedd0KUEG9KYmVValF+fFFp TmrxIUZpDhYlcd6TnrxRQgLpiSWp2ampBalFMFkmDk6pBsYpO/bZlzcWCdecF9EOe8U/8csv IwXmCb5+vp03zwdzXejt84l6qKz/X/bo08A/deq6LJ77DPcKrdkZ+/eBeOntW57Li9jS5yxm nlbfeP7xodNek5j+8ZhfquvNWMjJzDkj+rzPm+0b//2a/txzX/Uv3paUxjXT71lppU0VT7ax aeJkec30YbYSS3FGoqEWc1FxIgD8QYQUtAIAAA== Archived-At: Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity header fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question] X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jan 2018 08:15:04 -0000 --_000_D6877710296AAchristerholmbergericssoncom_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hi, Any comment on this? RFC 3261 does say: "The relative order of header field rows with the same field name is import= ant." However, I can=92t find any generic rule how header field rows with the sa= me name are added to a SIP message. Record-Route, Route etc all have header= field specific rules (which often are the identical). Regards, Christer From: stir > on behalf = of Christer Holmberg > Date: Saturday 13 January 2018 at 11:30 To: "adam@nostrum.com" >, IETF STIR Mail List > Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity header fi= elds [was: draft-ietf-stir-rfc4474bis-16: Syntax question] Hi, One more comment on this. No matter if one uses comma separation within a single Identity header fiel= d, or multiple Identity header fields, the spec doesn=92t say anything abou= t the semantics of the order of the header fields. For example, in SIP the order of Record-Route, Route, Via etc matters, beca= use it impacts how a SIP message is routed. My first thought was that it doesn=92t really matter in which order Identit= y header fields are listed in a SIP message, so we don=92t need to say anyt= hing (in addition to the fact that multiple header fields are allowed). But, when I read the divert extension slides from Singapore, it says the fo= llowing: =93An Identity header with =93div=94 always points to some prior Ident= ity header=94 The word *prior* seem to indicate that the order of header fields DOES matt= er (as the Identity header field does not contain any =93sequence number,= =94 or similar mechanism for ordering them). So, even if divert would use a single Identity header field, shouldn=92t 44= 74bis specify how Identity headers are added to a SIP message? Otherwise we could end up with a situation with vendor A sending: Identity: A Identity: B =85and vendor B sending: Identity: B Identity: A In some case the order may not matter, in some cases it may. Or? Regards, Christer From: Adam Roach [mailto:adam@nostrum.com] Sent: 09 January 2018 00:05 To: Christer Holmberg >; IETF STIR Mail List > Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity header fi= elds [was: draft-ietf-stir-rfc4474bis-16: Syntax question] [as responsible AD] Christer -- Thanks for looking closely at 4474bis and offering up your comments. Based = on the current state of things, I don't think changes are warranted at this= time. This document is in AUTH48 with sign-offs from all but one author. While di= scovery of a catastrophic error would be enough to warrant additional worki= ng-group crafting on the document, I don't see anything here that is catast= rophic. The multiple-header issue you describe is a bit confusing, but that= appears to be a flaw in RFC3261 more than this document. Importantly, the = section of 3261 you cite is followed by: The exceptions to this rule are the WWW-Authenticate, Authorization, Proxy- Authenticate, and Proxy-Authorization header fields. Multiple header field rows with these names MAY be present in a message, but since their grammar does not follow the general form listed in Section 7.3, they MUST NOT be combined into a single header field row. This, combined with the fact that the syntax of "Identity" *also* doesn't f= ollow the general form listed in RFC 3261 section 7.3, means that the "...M= AY... if and only if..." construct you cite also doesn't apply to it. It mi= ght have been cleaner to indicate that "Identity" is added to the list of e= xceptions in section 7.3.1 of RFC 3261, but this seems to be a lack of tidi= ness rather than a critical flaw in the document. I will note that the decision not to allow comma separation appears to have= been intentional [1], and was mentioned as recently as last June on the ma= iling list [2]. In that light, I believe that your request would functional= ly be asking to reverse prior working group consensus rather than fixing an= error. We are well past the point of revisiting past working group decisio= ns on this document. /a ____ [1] Although I can't find the corresponding minutes or email, I have a vagu= e recollection of discussions about which syntax would be more likely to be= compatible with exiting RFC4474 implementations, with the current syntax r= eflecting the outcome of those discussions. [2] https://mailarchive.ietf.org/arch/msg/stir/tAhE7jD6OWTlGHO-MLQavpODm1s On 1/8/18 09:23, Christer Holmberg wrote: Hi, Related to my issue below, I think it would be good to show a complete exam= ple with two Identity header fields in section 4.1 of draft-ietf-stir-passp= ort-divert-01. Regards, Christer From: stir > on behalf = of Christer Holmberg > Date: Thursday 4 January 2018 at 12:10 To: IETF STIR Mail List > Subject: Re: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question Is it still possible to fix this in the document, or do we file an errata o= nce the RFC has been published? Regards, Christer From: stir > on behalf = of Christer Holmberg > Date: Wednesday 3 January 2018 at 20:57 To: IETF STIR Mail List > Subject: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question Hi, Section 4 says: =93Note that unlike the prior specification in RFC4474, the Identity header field is now allowed to appear more than one time in a SIP request. The revised grammar for the Identity header field builds on the ABNF [RFC5234] in RFC 3261 [RFC3261] Section 25. It is as follows: Identity =3D "Identity" HCOLON signed-identity-digest SEMI ident-info *( SEMI ident-info-params ) =85=94 However, that syntax does NOT allow multiple Identity header fields, accord= ing to the rules in RFC 3261: =93Multiple header field rows with the same field-name MAY be present in a message if and only if the entire field-value for that header field is defined as a comma-separated list=94 It should be something like: Identity =3D "Identity" HCOLON signed-identity * (COMMA signed-identit= y) signed-identity =3D signed-identity-digest SEMI identi-info * (SEMI id= ent-info-params) =85=94 Or, misunderstood I have? Regards, Christer _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir --_000_D6877710296AAchristerholmbergericssoncom_ Content-Type: text/html; charset="Windows-1252" Content-ID: Content-Transfer-Encoding: quoted-printable
Hi,

Any comment on this?

RFC 3261 does say:

"The relative order of header=
 field rows with the same field name is important."

However, I can=92t find any generic rule how  header field rows w= ith the same name are added to a SIP message. Record-Route, Route etc all h= ave header field specific rules (which often are the identical).

Regards,

Christer

From: stir <stir-bounces@ietf.org> on behalf of Christer Ho= lmberg <christer.holmb= erg@ericsson.com>
Date: Saturday 13 January 2018 at 1= 1:30
To: "adam@nostrum.com" <adam@nostrum.com>, IETF STIR Mail List <stir@ietf.org>
Subject: Re: [stir] draft-ietf-stir= -passport-divert: two Identity header fields [was: draft-ietf-stir-rfc4474b= is-16: Syntax question]

Hi,<= /p>

 

One more comment on th= is.

 

No matter if one uses = comma separation within a single Identity header field, or multiple Identit= y header fields, the spec doesn=92t say anything about the semantics of the= order of the header fields.

 

For example, in SIP th= e order of Record-Route, Route, Via etc matters, because it impacts how a S= IP message is routed.

 

My first thought was t= hat it doesn=92t really matter in which order Identity header fields are li= sted in a SIP message, so we don=92t need to say anything (in addition to t= he fact that multiple header fields are allowed).

 

But, when I read the d= ivert extension slides from Singapore, it says the following:

 

   &nbs= p; =93An Identity header with =93div=94 always points to some prior Identit= y header=94

 

The word *prior= * seem to indicate that the order of header fields DOES matter (as the Iden= tity header field does not contain any =93sequence number,=94 or similar me= chanism for ordering them).

 

So, even if divert wou= ld use a single Identity header field, shouldn=92t 4474bis specify how Iden= tity headers are added to a SIP message?

 

Otherwise we could end= up with a situation with vendor A sending:

 

Identity: A=

Identity: B=

 

=85and vendor B sendin= g:

 

Identity: B=

Identity: A=

 

In some case the order= may not matter, in some cases it may.

 

Or?<= /p>

 

Regards,

 

Christer

 

 

From: Adam Roach [mailto:adam@nostrum.com]
Sent: 09 January 2018 00:05
To: Christer Holmberg <christer.holmberg@ericsson.com>; IETF STIR Mail List <stir@ietf.org>
Subject: Re: [stir] draft-ietf-stir-passport-divert: two Identity he= ader fields [was: draft-ietf-stir-rfc4474bis-16: Syntax question]

 

[as responsible AD]

Christer --

Thanks for looking closely at 4474bis and offering up your comments. Based = on the current state of things, I don't think changes are warranted at this= time.

This document is in AUTH48 with sign-offs from all but one author. While di= scovery of a catastrophic error would be enough to warrant additional worki= ng-group crafting on the document, I don't see anything here that is catast= rophic. The multiple-header issue you describe is a bit confusing, but that appears to be a flaw in RFC3261 = more than this document. Importantly, the section of 3261 you cite is follo= wed by:


   The exceptions
   to this rule are the WWW-Authenticate, Authorization, Pro=
xy-
   Authenticate, and Proxy-Authorization header fields. =
; Multiple header
   field rows with these names MAY be present in a message, =
but since
   their grammar does not follow the general form listed in =
Section 7.3=
,
   they MUST NOT be combined into a single header field row.=


This, combined with the fact that the syntax of "Identity" *also*= doesn't follow the general form listed in RFC 3261 section 7.3, means that= the "...MAY... if and only if..." construct you cite also doesn'= t apply to it. It might have been cleaner to indicate that "Identity" is added to the list of exceptions in section 7.= 3.1 of RFC 3261, but this seems to be a lack of tidiness rather than a crit= ical flaw in the document.

I will note that the decision not to allow comma separation appears to have= been intentional [1], and was mentioned as recently as last June on the ma= iling list [2]. In that light, I believe that your request would functional= ly be asking to reverse prior working group consensus rather than fixing an error. We are well past the point of= revisiting past working group decisions on this document.

/a

____
[1] Although I can't find the corresponding minutes or email, I have a vagu= e recollection of discussions about which syntax would be more likely to be= compatible with exiting RFC4474 implementations, with the current syntax r= eflecting the outcome of those discussions.

[2] https://mailarchive.ietf.org/arch/msg/stir/tAhE7jD6OWTlGHO-MLQavpODm1s<= br>

On 1/8/18 09:23, Christer Holmberg wrote:

Hi,

 

Related to my issue below, I think it would be good = to show a complete example with two Identity header fields in section 4.1 o= f draft-ietf-stir-passport-divert-01. 

 

Regards,

 

Christer

 

From: stir <stir-bounces@ietf.org> on behalf of Christer Holmberg <= ;christer.holmberg@ericss= on.com>
Date: Thursday 4 January 2018 at 12:10
To: IETF STIR Mail List <stir@ie= tf.org>
Subject: Re: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question

 

Is it still possibl= e to fix this in the document, or do we file an errata once the RFC has bee= n published?

 

Regards,=

 

Christer=

 

From: stir <stir-bounces@ietf.org> on behalf of Christer Holmberg <= ;christer.holmberg@ericss= on.com>
Date: Wednesday 3 January 2018 at 20:57
To: IETF STIR Mail List <stir@ie= tf.org>
Subject: [stir] draft-ietf-stir-rfc4474bis-16: Syntax question<= /o:p>

 

Hi,

 

Section 4 says:

 

   =93Note that unlike the prior specifica= tion

   in RFC4474, the Identity header field i= s now allowed to appear more

   than one time in a SIP request.  T= he revised grammar for the Identity

   header field builds on the ABNF [RFC523= 4] in RFC 3261 [RFC3261]

   Section 25.  It is as follows:

 

      Identity =3D "Id= entity" HCOLON signed-identity-digest SEMI

      ident-info *( SEMI id= ent-info-params )

      =85=94

 

However, that syntax does NOT allow multiple Identit= y header fields, according to the rules in RFC 3261:

 

   =93Multiple header field rows with the = same field-name MAY be present in

   a message if and only if the entire fie= ld-value for that header field

   is defined as a comma-separated list=94=

 

It should be something like:

 

     Identity =3D "Identity" HCOLON signed= -identity * (COMMA signed-identity)

 &nb= sp;   signed-identity =3D signed-identity-digest SEMI identi-info= * (SEMI ident-info-params)

 &nb= sp;   =85=94

 

Or, misun= derstood I have?

 

Regards,<= /span>

 

Christer<= /span>

 




_______________________________________________
stir mailing list
stir@ietf.org
https://www.iet=
f.org/mailman/listinfo/stir

 

 --_000_D6877710296AAchristerholmbergericssoncom_-- From nobody Fri Jan 19 14:15:17 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E21B512E04F; Fri, 19 Jan 2018 14:15:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.888 X-Spam-Level: X-Spam-Status: No, score=-1.888 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, T_RP_MATCHES_RCVD=-0.01, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z4mCRx-c2OC2; Fri, 19 Jan 2018 14:15:11 -0800 (PST) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D063212D86A; Fri, 19 Jan 2018 14:15:09 -0800 (PST) Received: from Svantevit.local (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id w0JMF8Nw029437 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Fri, 19 Jan 2018 16:15:09 -0600 (CST) (envelope-from adam@nostrum.com) X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be Svantevit.local From: Adam Roach To: STIR Chairs , stir@ietf.org, draft-ietf-stir-rph.all@tools.ietf.org Message-ID: Date: Fri, 19 Jan 2018 16:15:03 -0600 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="------------4601838E3FDD6FF25229288D" Content-Language: en-US Archived-At: Subject: [stir] AD Review: draft-ietf-stir-rph-02 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jan 2018 22:15:16 -0000 This is a multi-part message in MIME format. --------------4601838E3FDD6FF25229288D Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit I'm doing my AD review of draft-ietf-stir-rph-02. Thanks to everyone who has worked on this document, and the authors and chairs in particular. The technical content here looks generally good to me. I'd like to see a few issues addressed before IETF LC. In short sumary: * The validation section needs to add a discussion of how to treat calls when the priority values in "rph" passports and SIP "Resource-Priority" header fields aren't 100% identical. * The examples need some adjustment. * There is a minor point of ambiguity in the Security Section, but this should be easy to fix, as long as the WG knows what was intended. * The IANA actions need a little bit of adjustment. * There are a number of minor editorial issues to be cleaned up. Detailed comments on these points are inline in the document below. I've removed some portions of the document on which I have no comments. > > Abstract > >    This document extends the STIR PASSporT specification to allow the "...the Secure Telephone Identity Revisited (STIR) Personal Assertion Token (PASSporT) specification defined in RFC 8122..." (See for guidance on abbreviations) >    inclusion of cryptographically-signed assertions of authorization for >    the values populated in the SIP 'Resource-Priority' header field, >    which is used for communications resource prioritization. > > ... > > 1.  Introduction > >    PASSporT [I-D.ietf-stir-passport] is a token format based on JWT >    [RFC7519] for conveying cryptographically-signed information about >    the identities involved in personal communications; it is used with >    STIR [I-D.ietf-stir-rfc4474bis] to convey a signed assertion of the >    identity of the participants in real-time communications established >    via a protocol like SIP.  This specification extends PASSporT to "...like SIP [RFC3261]..." (We want to cite SIP the first time it is mentioned) >    allow cryptographic-signing of the SIP 'Resource-Priority' header >    field defined in [RFC4412]. > >    [RFC4412] defines the SIP 'Resource-Priority' header field for >    communications Resource Priority.  As specified in [RFC4412], the >    'Resource-Priority' header field may be used by SIP user agents >    [RFC3261], including, Public Switched Telephone Network (PSTN) "...including Public Switched..." (remove the comma) >    gateways and terminals, and SIP proxy servers to influence "...and by SIP proxy servers, to influence..." (add "by" and comma) >    prioritization afforded to communication sessions,including PSTN "...sessions, including..." (space after comma) >    calls.  However, the SIP 'Resource-Priority' header field could be >    spoofed and abused by unauthorized entities. > >    The STIR architecture [RFC7340]assumes that an authority on the "...STIR architecture [RFC7340] assumes..." (space before "assumes") >    originating side of a call provides a cryptographic assurance of the >    validity of the calling party number in order to prevent >    impersonation attacks.  The STIR architecture allows extension that "...allows extensions..." >    can be utilized by authorities supporting real-time communication >    services using the 'Resource-Priority' header field to >    cryptographically sign the SIP 'Resource-Priority' header field and >    convey assertion of the authorization for 'Resource-Priority'.  For >    example, the authority on the originating side verifying the >    authorization of a particular communication for Resource-Priority can Single quotes around 'Resource-Priority'. >    use a PASSPorT claim to cryptographically-sign the SIP 'Resource- "...cryptographically sign..." >    Priority' header field and convey an assertion of the authorization >    for 'Resource-Priority'.  This will allow a receiving entity >    (including entities located in different network domains/boundaries) >    to verify the validity of assertions authorizing Resource-Priority. Single quotes around 'Resource-Priority'. >    Cryptographically-signed SIP 'Resource-Priority' headers will allow a "...cryptographically signed SIP 'Resource-Priority' header fields..." (remove hyphen, and replace "headers" with "header fields") >    receiving entity to verify and act on the information with confidence >    that the information have not been spoofed or compromised. "...has not been spoofed or compromised." > >    This specification documents an optional extension to PASSporT and >    the associated STIR mechanisms to provide a function to sign the SIP >    'Resource-Priority' header field.  This PASSporT object is used to >    provide attestation of a calling user authorization for priority >    communications.  This is necessary in addition to the PASSporT object >    that is used for calling user telephone number attestation.  How the >    optional extension to PASSporT is used for real-time communications >    supported using SIP 'Resource-Priority' header field is defined in >    other documents and is outside the scope of this document. I assume these other documents are under development? If so, they should be cited here. > > 2.  Terminology > >    The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", >    "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this >    document are to be interpreted as described in RFC 2119 [RFC2119]. This document has several non-normative uses of "must", "should," and "may," and so it needs to use the RFC8174 boilerplate instead of the RFC2119 boilerplate. > > 3.  PASSporT 'rph' Claim > >    This specification defines a new JSON Web Token claim for "rph", >    which provides an assertion for information in SIP 'Resource- >    Priority'header. "...Priority' header field." (space after closing quotation mark, "header field" instead of "header") > >    The creator of a PASSporT object adds a "ppt" value of "rph" to the >    header of a PASSporT object, in which case the PASSporT claims MUST >    contain a "rph" claim, and any entities verifying the PASSporT object >    will be required to understand the "ppt" extension in order to >    process the PASSporT in question.  A PASSPorT header with the "ppt" >    included will look as follows: > >    {  "typ":"passport", >      "ppt":"rph", >      "alg":"ES256", >      "x5u":"https://www.example.org/cert.cer"} Ideally, this would be either pretty-printed or canonicalized. Since it's too long to fit on a line in canonical form, I propose: {   "typ":"passport",   "ppt":"rph",   "alg":"ES256",   "x5u":"https://www.example.org/cert.cer" } > >    The "rph" claim will provide an assertion of authorization,"auth", "...authorization, "auth", ..." (space between comma and opening quotation mark) >    for information in the SIP "Resource-Priority" header field (i.e., >    Resource-Priority: namespace "." r-priority) based on [RFC4412]. The use of the string 'namespace "." r-priority' here and elsewhere in the document has a detrimental impact on readability. I strongly suggest replacing it with "r-value" (the name of this production in RFC4412) everywhere. >    Specifically, the "rph" claim includes assertion of the priority- >    level of the user to be used for a given communication session.  The >    value of the "rph" claim is an array containing one or more of JSON >    objects for the content of the SIP 'Resource-Priority' header that is >    being asserted of which one of the "rph" object, is mandatory. This last sentence is very hard to parse; and (based on the example) the value is intended to be a JSON Object (curly braces) rather than a JSON Array (square braces). I suggest: 'The value of the "rph" claim is an Object with one or more keys. Each key is associated with a JSON Array. These arrays contain Strings that correspond to the r-values indicated in the SIP "Resource-Priority" header field.' (note: "header field", not "header") > >    The following is an example "rph" claim for a SIP "Resource-Priority" >    header field with a "namespace "." r-priority" value of "ets.0" and >    with a "namespace "." r-priority" value of "wps.0". > >     { "orig":{"tn":"12155551212"} >      "dest":{["tn":"12125551213"]}, >      "iat":1443208345, >      "rph":{"auth":["ets.0","wps.0"]} As above, I recommend pretty-printing this. It's also missing a comma after the "orig" value, and the top-level structure is missing a closing brace. The value for "iat" needs to be enclosed in quotes. The NANPA has allocated NPA55501xx for example use, not NPA555xxxx, much of which remains assignable (cf ). Putting all this together, I believe what you want is: {   "orig":{"tn":"12155550112"},   "dest":{["tn":"12125550113"]},   "iat":"1443208345",   "rph":{"auth":["ets.0","wps.0"]} } > >    After the header and claims PASSporT objects have been constructed, >    their signature is generated normally per the guidance in >    [I-D.ietf-stir-passport] using the full form of PASSPorT.  The >    credentials (e.g., authority responsible for authorizing Resource- >    Priority) used to create the signature must have authority over the >    "rph" claim and there is only one authority per claim.  The authority >    MUST use its credentials (i.e., CERT) associated with the specific >    service supported by the SIP namespace in the claim. > > 4.  'rph' in SIP > >    This section specifies SIP-specific usage for the "rph" claim in >    PASSporT. > > 4.1.  Authentication Service Behavior > >    The Authentication Service will create the "rph" claim using the >    values discussed in section 3 based on [RFC4412]. The construction >    of "rph" claim follows the steps described in Section 4 of >    [I-D.ietf-stir-rfc4474bis]. > >    The resulting Identity header for "rph" might look as follows: "...header field..." > > "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJleUowZVhBaU9pSnd > ZWE56Y0c5eWRDSXNEUW9pY0hCMElqb2ljbkJvSWl3TkNpSmhiR2NpT2lKRlV6STFO > aUlzRFFvaWVEVjFJanBvZEhSd2N6b3ZMM2QzZHk1bGVHRnRjR3hsTG1OdmJTOWpaW > EowTG1ObGNuME5DZzBLIHx84oCZLuKAmXx8IGV5QWliM0pwWnlJNmV5SjBiaUk2SW > pFeU1UVTFOVFV4TWpFeUluME5DaUprWlhOMElqcDdXeUowYmlJNklqRXlNVEkxTlR > VeE1qRXpJbDE5TEEwS0ltbGhkQ0k2TVRRME16SXdPRE0wTlN3TkNpSnljR2dpT25z > aVlYVjBhQ0k2V3lKbGRITXVNQ0lzSW5kd2N5NHdJbDE5RFFvPSJ9.s37S6VC8HM6D > l6YzJeQDsrZcwJ0lizxhUrA7f_98oWBHvo-cl-n8MIhoCr18vYYFy3blXvs3fslM_ >    oos2P2Dyw"; info= "https://www.example.org/cert.cer";alg=ES256; >    ppt="rph" This example has a number of issues: * In the Identity header field, the signed-identity-digest shouldn't be quoted. * In the Identity header field, info is enclosed in <> rather than "". * In the Identity header field, ppt is a token rather than a quoted string. * The signed-identity-digest header needs to indicate a "typ" of "passport" rather than JWT, and it needs to include both a "ppt" and "x5u" field. * The signed-identity-digest body should contain only the passport claim rather than a JSON object that itself contains a base64-encoded JWS header concatenated with a claim. * I believe that, even when the body is included, values in the header and body need to be be canonicalized (i.e., all on one line, no spaces, in alphabetical order, etc.) I would also recommend following the convention of indicating that line-wraps are only for readability, and including the header field name in the example. Putting all this together, I believe what you want is:    For example, a Identity header field for "rph" might look    as follows (backslashes shown for line folding only):    Identity: eyJhbGciOiJFUzI1NiIsInBwdCI6InJwaCIsInR5cCI6InBhc3Nwb3J0I \ iwieDV1IjoiaHR0cHM6Ly93d3cuZXhhbXBsZS5jb20vY2VydC5jZXIifQo.eyJkZXN0 \ Ijp7WyJ0biI6IjEyMTI1NTUwMTEzIl19LCJpYXQiOiIxNDQzMjA4MzQ1Iiwib3JpZyI \ 6eyJ0biI6IjEyMTU1NTUwMTEyIn0sInJwaCI6eyJhdXRoIjpbImV0cy4wIiwid3BzLj \ AiXX19Cg.s37S6VC8HM6Dl6YzJeQDsrZcwJ0lizxhUrA7f_98oWBHvo-cl-n8MIhoCr \ 18vYYFy3blXvs3fslM_oos2P2Dyw;info=;alg=ES256;ppt=rph (Note: this example assumes the calling and called party numbers in the previous example are changed to 12155550112 and 12155550113, respectively) > >    A SIP authentication service typically will derive the value of "rph" >    from the 'Resource-Priority' header field based on policy associated >    with service specific use of the "namespace "." r-priority" values >    based on [RFC4412].  The authentication service derives the value of >    the PASSPorT claim by verifying the authorization for Resource- >    Priority (i.e., verifying a calling user privilege for Resource- >    Priority based on its identity) which might be derived from customer >    profile data or from access to external services. > >    [RFC4412] allows multiple "namespace "." r-priority" pairs, either in >    a single SIP Resource-Priority header or across multiple SIP Single quotes around 'Resource-Priority'. "...header field..." >    Resource-Priority headers. However, it is not necessary to sign all Single quotes around 'Resource-Priority'. "...header fields..." >    content of a SIP Resource-Priority header or all SIP Resource- Single quotes around 'Resource-Priority'. "...header field..." >    Priority headers in a given SIP message.  An authority is only Single quotes around 'Resource-Priority'. "...header fields..." >    responsible for signing the content of a SIP Resource-Priority header Single quotes around 'Resource-Priority'. "...header field..." >    for which it has authority (e.g., a specific "namespace "." >    r-priority"). > > 4.2.  Verification Service Behavior > >    [I-D.ietf-stir-rfc4474bis] Section 6.2 Step 5 requires that >    specifications defining "ppt" values describe any additional verifier >    behavior.  The behavior specified for the "ppt" values of "rph" is as >    follows: > >    The verification service MUST extract the value associated with the >    "auth" key in a full form PASSPorT with a "ppt" value of "rph".  If >    the signature validates, then the verification service can use the >    value of the "rph" claim as validation that the calling party is >    authorized for Resource-Priority, which would in turn be used for Single quotes around 'Resource-Priority'. This text is ambiguous about whether the validation indicates that the calling party is authorized to use the priorities indicated in the passport object, or the values in the SIP 'Resource-Priority' header field; and (taken on its face) implies the latter, when the intention here should clearly be the former. "...authorized for 'Resource-Priority' indicated in the claim. This value would in turn be used for..." The text also needs to say something about comparing values in the claim to values in the 'Resource-Priority' header field, and what a mismatch might mean. The document says elsewhere that the signature might only cover some of the r-values, which makes it entirely possible that the 'Resource-Priority' field might contain more values than are signed. On the other hand, intermediaries might reasonably remove r-values as the call is processed. This probably means that those removed priorities should not be used, even if they are present in the passport. It seems reasonable to say that *typical* processing by a receiving party would be to take the *union* of all RPH passports that they trust, and *intersect* that with the priorities in 'Resource-Priority' header fields to get the actual priority or priorities to be applied to the call (subject to local policy). >    priority treatment in accordance with local policy for the associated >    communication service. > >    In addition, [I-D.ietf-stir-rfc4474bis] Section 6.2 Step 4 requires >    "iat" value in "rph" claim to be verified. > >    The behavior of a SIP UAs upon receiving an INVITE containing a "...of a SIP UA upon..." or "...of SIP UAs upon..." >    PASSporT object with a "rph" claim will largely remain a matter of >    implementation policy for the specific communication service.  In >    most cases,implementations would act based on confidence in the "...cases, implementations..." (space after comma) >    veracity of this information.  The use of the compact form of Paragraph break before "The". >    PASSporT is not specified in this document. > > 5.  Further Information Associated with Resource-Priority Single quotes around 'Resource-Priority'. > >    There may be additional information about the calling party or the >    call that could be relevant to authorization for Resource-Priority. Single quotes around 'Resource-Priority'. >    This may include information related to the device subscription of >    the caller, or to any institutions that the caller or device is >    associated with, or even categories of institutions.  All of these >    data elements would benefit from the secure attestations provided by >    the STIR and PASSporT frameworks.  The specification of the "rph" >    claim could entail the optional presence of one or more such >    additional information fields. > >    A new IANA registry has been defined to hold potential values of the >    "rph" array; see Section 6.2.  The definition of the "rph" claim may >    have one or more such additional information field(s).  Details of >    such "rph" claim to encompass other data elements are left for future >    version of this specification. > > 6.  IANA Considerations > > 6.1.  JSON Web Token Claims Registration I think there's some confusion here. You're registering a PASSporT ppt value, not a new JWT claim. That is to say, you're adding an entry to this table: https://www.iana.org/assignments/passport/passport.xhtml Not to this table: https://www.iana.org/assignments/jwt/jwt.xhtml You would only use the second table if you had a new key to add to the PASSporT header -- this specification does not do that. This section also needs some introductory text to let the IANA know exactly what to do; e.g. "This document registers a new value for the "Personal Assertion Token (PASSporT) Extensions" table. > >    o  ppt value: "rph" > >    o  Specification Document(s): Section 3 of [RFCThis] > > 6.2.  PASSporT 'rph' Types > >    This document requests that the IANA add a new entry to the PASSporT >    Types registry for the type "rph" which is specified in [RFCThis]. There isn't an IANA table called "PASSporT Types." I presume this is the registration we just discussed in section 6.1, and so the above two lines can be removed. >    This specification also requests that the IANA create a new registry >    for PASSporT "rph" types.  Registration of new PASSporT "rph" types >    shall be under the specification required policy. This registry is >    to be initially populated with a single value for "auth" which is >    specified in [RFCThis]. This needs to be very clear about the fields to be included in this new registry (e.g., "Registry entries must contain two fields: the name of the 'rph' type and the specification in which the type is described"). > > 7.  Security Considerations > >    The security considerations discussed in [I-D.ietf-stir-rfc4474bis] >    in Section 10 are applicable here. > > 7.1.  Avoidance of replay and cut and paste attacks > >    The PASSporT extension with a "ppt" value of "rph" MUST only be sent >    with SIP INVITE when 'Resource-Priority' header is used to convey the "...header field..." >    priority of the communication as defined in [RFC4412].  To avoid the >    replay, and cut and paste attacks, the procedures described in >    Section 10.1 of [I-D.ietf-stir-rfc4474bis] MUST be followed. > > 7.2.  Solution Considerations > >    The use of extension to PASSporT tokens with "ppt" value "rph" based >    on the validation of the digital signature and the associated >    certificate requires consideration of the authentication and >    authority or reputation of the signer to attest to the identity being >    asserted.  The following considerations should be recognized when >    using PASSporT extension with "ppt" value of "rph": > >    o  An authority (signer) is only allowed to sign the content of a SIP >       'Resource-Priority' header for which it has the right authority. "...header field..." >       The authority that signs the token MUST have a secure method for >       authentication of the end user or the device. > >    o  The verification of the signature MUST include means of verifying >       that the signer is authoritative for the signed content of the SIP It's not clear what authority is being claimed here. Is this supposed to mean something like "...verifying that the signer is authoritative for the originating tn in the PASSporT..."? Or "...authoritative for the resource priority namespace in the PASSporT?" Whatever the server is purportedly authoritative for needs to be clearly spelled out. >       'Resource-Priority' header. "...header field." /a --------------4601838E3FDD6FF25229288D Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

I'm doing my AD review of draft-ietf-stir-rph-02. Thanks to everyone who has worked on this document, and the authors and chairs in particular.

The technical content here looks generally good to me. I'd like to see a few issues addressed before IETF LC. In short sumary:

  • The validation section needs to add a discussion of how to treat calls when the priority values in "rph" passports and SIP "Resource-Priority" header fields aren't 100% identical.
  • The examples need some adjustment.
  • There is a minor point of ambiguity in the Security Section, but this should be easy to fix, as long as the WG knows what was intended.
  • The IANA actions need a little bit of adjustment.
  • There are a number of minor editorial issues to be cleaned up.

Detailed comments on these points are inline in the document below. I've removed some portions of the document on which I have no comments.


Abstract

   This document extends the STIR PASSporT specification to allow the


"...the Secure Telephone Identity Revisited (STIR) Personal Assertion Token (PASSporT) specification defined in RFC 8122..."

(See <https://www.rfc-editor.org/materials/abbrev.expansion.txt> for guidance on abbreviations)

   inclusion of cryptographically-signed assertions of authorization for
   the values populated in the SIP 'Resource-Priority' header field,
   which is used for communications resource prioritization.

...

1.  Introduction

   PASSporT [I-D.ietf-stir-passport] is a token format based on JWT
   [RFC7519] for conveying cryptographically-signed information about
   the identities involved in personal communications; it is used with
   STIR [I-D.ietf-stir-rfc4474bis] to convey a signed assertion of the
   identity of the participants in real-time communications established
   via a protocol like SIP.  This specification extends PASSporT to


"...like SIP [RFC3261]..."

(We want to cite SIP the first time it is mentioned)

   allow cryptographic-signing of the SIP 'Resource-Priority' header
   field defined in [RFC4412].

   [RFC4412] defines the SIP 'Resource-Priority' header field for
   communications Resource Priority.  As specified in [RFC4412], the
   'Resource-Priority' header field may be used by SIP user agents
   [RFC3261], including, Public Switched Telephone Network (PSTN)


"...including Public Switched..."

(remove the comma)

   gateways and terminals, and SIP proxy servers to influence


"...and by SIP proxy servers, to influence..."

(add "by" and comma)

   prioritization afforded to communication sessions,including PSTN

"...sessions, including..."

(space after comma)


   calls.  However, the SIP 'Resource-Priority' header field could be
   spoofed and abused by unauthorized entities.

   The STIR architecture [RFC7340]assumes that an authority on the


"...STIR architecture [RFC7340] assumes..."

(space before "assumes")


   originating side of a call provides a cryptographic assurance of the
   validity of the calling party number in order to prevent
   impersonation attacks.  The STIR architecture allows extension that


"...allows extensions..."


   can be utilized by authorities supporting real-time communication
   services using the 'Resource-Priority' header field to
   cryptographically sign the SIP 'Resource-Priority' header field and
   convey assertion of the authorization for 'Resource-Priority'.  For
   example, the authority on the originating side verifying the
   authorization of a particular communication for Resource-Priority can


Single quotes around 'Resource-Priority'.


   use a PASSPorT claim to cryptographically-sign the SIP 'Resource-


"...cryptographically sign..."


   Priority' header field and convey an assertion of the authorization
   for 'Resource-Priority'.  This will allow a receiving entity
   (including entities located in different network domains/boundaries)
   to verify the validity of assertions authorizing Resource-Priority.


Single quotes around 'Resource-Priority'.


   Cryptographically-signed SIP 'Resource-Priority' headers will allow a


"...cryptographically signed SIP 'Resource-Priority' header fields..."

(remove hyphen, and replace "headers" with "header fields")


   receiving entity to verify and act on the information with confidence
   that the information have not been spoofed or compromised.


"...has not been spoofed or compromised."



   This specification documents an optional extension to PASSporT and
   the associated STIR mechanisms to provide a function to sign the SIP
   'Resource-Priority' header field.  This PASSporT object is used to
   provide attestation of a calling user authorization for priority
   communications.  This is necessary in addition to the PASSporT object
   that is used for calling user telephone number attestation.  How the
   optional extension to PASSporT is used for real-time communications
   supported using SIP 'Resource-Priority' header field is defined in
   other documents and is outside the scope of this document.


I assume these other documents are under development? If so, they should be cited here.



2.  Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in RFC 2119 [RFC2119].


This document has several non-normative uses of "must", "should," and "may," and so it needs to use the RFC8174 boilerplate instead of the RFC2119 boilerplate.



3.  PASSporT 'rph' Claim

   This specification defines a new JSON Web Token claim for "rph",
   which provides an assertion for information in SIP 'Resource-
   Priority'header.


"...Priority' header field."

(space after closing quotation mark, "header field" instead of "header")



   The creator of a PASSporT object adds a "ppt" value of "rph" to the
   header of a PASSporT object, in which case the PASSporT claims MUST
   contain a "rph" claim, and any entities verifying the PASSporT object
   will be required to understand the "ppt" extension in order to
   process the PASSporT in question.  A PASSPorT header with the "ppt"
   included will look as follows:

   {  "typ":"passport",
     "ppt":"rph",
     "alg":"ES256",
     "x5u":"https://www.example.org/cert.cer"}


Ideally, this would be either pretty-printed or canonicalized. Since it's too long to fit on a line in canonical form, I propose:

{
  "typ":"passport",
  "ppt":"rph",
  "alg":"ES256",
  "x5u":"https://www.example.org/cert.cer"
}



   The "rph" claim will provide an assertion of authorization,"auth",


"...authorization, "auth", ..."

(space between comma and opening quotation mark)


   for information in the SIP "Resource-Priority" header field (i.e.,
   Resource-Priority: namespace "." r-priority) based on [RFC4412].


The use of the string 'namespace "." r-priority' here and elsewhere in the document has a detrimental impact on readability. I strongly suggest replacing it with "r-value" (the name of this production in RFC4412) everywhere.


   Specifically, the "rph" claim includes assertion of the priority-
   level of the user to be used for a given communication session.  The
   value of the "rph" claim is an array containing one or more of JSON
   objects for the content of the SIP 'Resource-Priority' header that is
   being asserted of which one of the "rph" object, is mandatory.


This last sentence is very hard to parse; and (based on the example) the value is intended to be a JSON Object (curly braces) rather than a JSON Array (square braces). I suggest: 'The value of the "rph" claim is an Object with one or more keys. Each key is associated with a JSON Array. These arrays contain Strings that correspond to the r-values indicated in the SIP "Resource-Priority" header field.' (note: "header field", not "header")



   The following is an example "rph" claim for a SIP "Resource-Priority"
   header field with a "namespace "." r-priority" value of "ets.0" and
   with a "namespace "." r-priority" value of "wps.0".

    { "orig":{"tn":"12155551212"}
     "dest":{["tn":"12125551213"]},
     "iat":1443208345,
     "rph":{"auth":["ets.0","wps.0"]}


As above, I recommend pretty-printing this. It's also missing a comma after the "orig" value, and the top-level structure is missing a closing brace. The value for "iat" needs to be enclosed in quotes.

The NANPA has allocated NPA55501xx for example use, not NPA555xxxx, much of which remains assignable (cf <https://www.nationalnanpa.com/pdf/NRUF/ATIS-0300115.pdf>).

Putting all this together, I believe what you want is:

{
  "orig":{"tn":"12155550112"},
  "dest":{["tn":"12125550113"]},
  "iat":"1443208345",
  "rph":{"auth":["ets.0","wps.0"]}
}



   After the header and claims PASSporT objects have been constructed,
   their signature is generated normally per the guidance in
   [I-D.ietf-stir-passport] using the full form of PASSPorT.  The
   credentials (e.g., authority responsible for authorizing Resource-
   Priority) used to create the signature must have authority over the
   "rph" claim and there is only one authority per claim.  The authority
   MUST use its credentials (i.e., CERT) associated with the specific
   service supported by the SIP namespace in the claim.

4.  'rph' in SIP

   This section specifies SIP-specific usage for the "rph" claim in
   PASSporT.

4.1.  Authentication Service Behavior

   The Authentication Service will create the "rph" claim using the
   values discussed in section 3 based on [RFC4412].  The construction
   of "rph" claim follows the steps described in Section 4 of
   [I-D.ietf-stir-rfc4474bis].

   The resulting Identity header for "rph" might look as follows:


"...header field..."



   "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJleUowZVhBaU9pSnd
   ZWE56Y0c5eWRDSXNEUW9pY0hCMElqb2ljbkJvSWl3TkNpSmhiR2NpT2lKRlV6STFO
   aUlzRFFvaWVEVjFJanBvZEhSd2N6b3ZMM2QzZHk1bGVHRnRjR3hsTG1OdmJTOWpaW
   EowTG1ObGNuME5DZzBLIHx84oCZLuKAmXx8IGV5QWliM0pwWnlJNmV5SjBiaUk2SW
   pFeU1UVTFOVFV4TWpFeUluME5DaUprWlhOMElqcDdXeUowYmlJNklqRXlNVEkxTlR
   VeE1qRXpJbDE5TEEwS0ltbGhkQ0k2TVRRME16SXdPRE0wTlN3TkNpSnljR2dpT25z
   aVlYVjBhQ0k2V3lKbGRITXVNQ0lzSW5kd2N5NHdJbDE5RFFvPSJ9.s37S6VC8HM6D
   l6YzJeQDsrZcwJ0lizxhUrA7f_98oWBHvo-cl-n8MIhoCr18vYYFy3blXvs3fslM_
   oos2P2Dyw"; info= "https://www.example.org/cert.cer";alg=ES256;
   ppt="rph"


This example has a number of issues:

  • In the Identity header field, the signed-identity-digest shouldn't be quoted.
  • In the Identity header field, info is enclosed in <> rather than "".
  • In the Identity header field, ppt is a token rather than a quoted string.
  • The signed-identity-digest header needs to indicate a "typ" of "passport" rather than JWT, and it needs to include both a "ppt" and "x5u" field.
  • The signed-identity-digest body should contain only the passport claim rather than a JSON object that itself contains a base64-encoded JWS header concatenated with a claim.
  • I believe that, even when the body is included, values in the header and body need to be be canonicalized (i.e., all on one line, no spaces, in alphabetical order, etc.)

I would also recommend following the convention of indicating that line-wraps are only for readability, and including the header field name in the example. Putting all this together, I believe what you want is:

   For example, a Identity header field for "rph" might look
   as follows (backslashes shown for line folding only):

   Identity: eyJhbGciOiJFUzI1NiIsInBwdCI6InJwaCIsInR5cCI6InBhc3Nwb3J0I \
   iwieDV1IjoiaHR0cHM6Ly93d3cuZXhhbXBsZS5jb20vY2VydC5jZXIifQo.eyJkZXN0 \
   Ijp7WyJ0biI6IjEyMTI1NTUwMTEzIl19LCJpYXQiOiIxNDQzMjA4MzQ1Iiwib3JpZyI \
   6eyJ0biI6IjEyMTU1NTUwMTEyIn0sInJwaCI6eyJhdXRoIjpbImV0cy4wIiwid3BzLj \
   AiXX19Cg.s37S6VC8HM6Dl6YzJeQDsrZcwJ0lizxhUrA7f_98oWBHvo-cl-n8MIhoCr \
   18vYYFy3blXvs3fslM_oos2P2Dyw;info=<https://www.example.org/cert.cer \
   >;alg=ES256;ppt=rph

(Note: this example assumes the calling and called party numbers in the previous example are changed to 12155550112 and 12155550113, respectively)



   A SIP authentication service typically will derive the value of "rph"
   from the 'Resource-Priority' header field based on policy associated
   with service specific use of the "namespace "." r-priority" values
   based on [RFC4412].  The authentication service derives the value of
   the PASSPorT claim by verifying the authorization for Resource-
   Priority (i.e., verifying a calling user privilege for Resource-
   Priority based on its identity) which might be derived from customer
   profile data or from access to external services.

   [RFC4412] allows multiple "namespace "." r-priority" pairs, either in
   a single SIP Resource-Priority header or across multiple SIP


Single quotes around 'Resource-Priority'.

"...header field..."


   Resource-Priority headers.  However, it is not necessary to sign all


Single quotes around 'Resource-Priority'.

"...header fields..."


   content of a SIP Resource-Priority header or all SIP Resource-


Single quotes around 'Resource-Priority'.

"...header field..."


   Priority headers in a given SIP message.  An authority is only


Single quotes around 'Resource-Priority'.

"...header fields..."


   responsible for signing the content of a SIP Resource-Priority header


Single quotes around 'Resource-Priority'.

"...header field..."


   for which it has authority (e.g., a specific "namespace "."
   r-priority").

4.2.  Verification Service Behavior

   [I-D.ietf-stir-rfc4474bis] Section 6.2 Step 5 requires that
   specifications defining "ppt" values describe any additional verifier
   behavior.  The behavior specified for the "ppt" values of "rph" is as
   follows:

   The verification service MUST extract the value associated with the
   "auth" key in a full form PASSPorT with a "ppt" value of "rph".  If
   the signature validates, then the verification service can use the
   value of the "rph" claim as validation that the calling party is
   authorized for Resource-Priority, which would in turn be used for

Single quotes around 'Resource-Priority'.

This text is ambiguous about whether the validation indicates that the calling party is authorized to use the priorities indicated in the passport object, or the values in the SIP 'Resource-Priority' header field; and (taken on its face) implies the latter, when the intention here should clearly be the former.

"...authorized for 'Resource-Priority' indicated in the claim. This value would in turn be used for..."

The text also needs to say something about comparing values in the claim to values in the 'Resource-Priority' header field, and what a mismatch might mean. The document says elsewhere that the signature might only cover some of the r-values, which makes it entirely possible that the 'Resource-Priority' field might contain more values than are signed. On the other hand, intermediaries might reasonably remove r-values as the call is processed. This probably means that those removed priorities should not be used, even if they are present in the passport. It seems reasonable to say that *typical* processing by a receiving party would be to take the *union* of all RPH passports that they trust, and *intersect* that with the priorities in 'Resource-Priority' header fields to get the actual priority or priorities to be applied to the call (subject to local policy).


   priority treatment in accordance with local policy for the associated
   communication service.

   In addition, [I-D.ietf-stir-rfc4474bis] Section 6.2 Step 4 requires
   "iat" value in "rph" claim to be verified.

   The behavior of a SIP UAs upon receiving an INVITE containing a


"...of a SIP UA upon..."

or

"...of SIP UAs upon..."


   PASSporT object with a "rph" claim will largely remain a matter of
   implementation policy for the specific communication service.  In
   most cases,implementations would act based on confidence in the


"...cases, implementations..."

(space after comma)


   veracity of this information.  The use of the compact form of


Paragraph break before "The".


   PASSporT is not specified in this document.

5.  Further Information Associated with Resource-Priority


Single quotes around 'Resource-Priority'.



   There may be additional information about the calling party or the
   call that could be relevant to authorization for Resource-Priority.


Single quotes around 'Resource-Priority'.


   This may include information related to the device subscription of
   the caller, or to any institutions that the caller or device is
   associated with, or even categories of institutions.  All of these
   data elements would benefit from the secure attestations provided by
   the STIR and PASSporT frameworks.  The specification of the "rph"
   claim could entail the optional presence of one or more such
   additional information fields.

   A new IANA registry has been defined to hold potential values of the
   "rph" array; see Section 6.2.  The definition of the "rph" claim may
   have one or more such additional information field(s).  Details of
   such "rph" claim to encompass other data elements are left for future
   version of this specification.

6.  IANA Considerations

6.1.  JSON Web Token Claims Registration


I think there's some confusion here. You're registering a PASSporT ppt value, not a new JWT claim. That is to say, you're adding an entry to this table:

https://www.iana.org/assignments/passport/passport.xhtml

Not to this table:

https://www.iana.org/assignments/jwt/jwt.xhtml

You would only use the second table if you had a new key to add to the PASSporT header -- this specification does not do that.

This section also needs some introductory text to let the IANA know exactly what to do; e.g. "This document registers a new value for the "Personal Assertion Token (PASSporT) Extensions" table.


   o  ppt value: "rph"

   o  Specification Document(s): Section 3 of [RFCThis]

6.2.  PASSporT 'rph' Types

   This document requests that the IANA add a new entry to the PASSporT
   Types registry for the type "rph" which is specified in [RFCThis].


There isn't an IANA table called "PASSporT Types." I presume this is the registration we just discussed in section 6.1, and so the above two lines can be removed.


   This specification also requests that the IANA create a new registry
   for PASSporT "rph" types.  Registration of new PASSporT "rph" types
   shall be under the specification required policy.  This registry is
   to be initially populated with a single value for "auth" which is
   specified in [RFCThis].


This needs to be very clear about the fields to be included in this new registry (e.g., "Registry entries must contain two fields: the name of the 'rph' type and the specification in which the type is described").



7.  Security Considerations

   The security considerations discussed in [I-D.ietf-stir-rfc4474bis]
   in Section 10 are applicable here.

7.1.  Avoidance of replay and cut and paste attacks

   The PASSporT extension with a "ppt" value of "rph" MUST only be sent
   with SIP INVITE when 'Resource-Priority' header is used to convey the


"...header field..."


   priority of the communication as defined in [RFC4412].  To avoid the
   replay, and cut and paste attacks, the procedures described in
   Section 10.1 of [I-D.ietf-stir-rfc4474bis] MUST be followed.

7.2.  Solution Considerations

   The use of extension to PASSporT tokens with "ppt" value "rph" based
   on the validation of the digital signature and the associated
   certificate requires consideration of the authentication and
   authority or reputation of the signer to attest to the identity being
   asserted.  The following considerations should be recognized when
   using PASSporT extension with "ppt" value of "rph":

   o  An authority (signer) is only allowed to sign the content of a SIP
      'Resource-Priority' header for which it has the right authority.


"...header field..."


      The authority that signs the token MUST have a secure method for
      authentication of the end user or the device.

   o  The verification of the signature MUST include means of verifying
      that the signer is authoritative for the signed content of the SIP


It's not clear what authority is being claimed here. Is this supposed to mean something like "...verifying that the signer is authoritative for the originating tn in the PASSporT..."? Or "...authoritative for the resource priority namespace in the PASSporT?" Whatever the server is purportedly authoritative for needs to be clearly spelled out.


      'Resource-Priority' header.


"...header field."


/a --------------4601838E3FDD6FF25229288D-- From nobody Sat Jan 20 15:34:13 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F1F81201F2; Sat, 20 Jan 2018 15:34:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fjeXxBDajojX; Sat, 20 Jan 2018 15:34:07 -0800 (PST) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A783E1200C1; Sat, 20 Jan 2018 15:34:06 -0800 (PST) X-AuditID: c1b4fb3a-335ff700000037f2-c9-5a63d1ecade2 Received: from ESESSHC013.ericsson.se (Unknown_Domain [153.88.183.57]) by sessmg22.ericsson.net (Symantec Mail Security) with SMTP id 59.6A.14322.CE1D36A5; Sun, 21 Jan 2018 00:34:04 +0100 (CET) Received: from ESESSMB109.ericsson.se ([169.254.9.195]) by ESESSHC013.ericsson.se ([153.88.183.57]) with mapi id 14.03.0352.000; Sun, 21 Jan 2018 00:34:04 +0100 From: Christer Holmberg To: Adam Roach CC: STIR Chairs , "stir@ietf.org" , "draft-ietf-stir-rph.all@tools.ietf.org" Thread-Topic: [stir] AD Review: draft-ietf-stir-rph-02 Thread-Index: AQHTkXL/9PfnEwzuiEC0gXYu7h5lh6N9a2h7 Date: Sat, 20 Jan 2018 23:34:03 +0000 Message-ID: <8632F2B7-931B-47D8-B892-3DFF9AD02F0D@ericsson.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: multipart/alternative; boundary="_000_8632F2B7931B47D8B8923DFF9AD02F0Dericssoncom_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprJIsWRmVeSWpSXmKPExsUyM2K7pe6bi8lRBk0ftCz2/F3EbrH6+Dkm i2c71rNaLF+7jcmBxWPJkp9MHrN2PmHx+HL5M1sAcxSXTUpqTmZZapG+XQJXxo1jDWwFh84x V6zvPM7WwLisnbmLkZNDQsBEYvqZgyxdjFwcQgKHGSWuT+pjg3CWMEoseP4IKMPBwSZgIdH9 TxukQURAUaLt8E1mkBpmgXmMEvf/L2ECSQgLmErMe/2bCaLITOL+qgYo20hi2uG3rCA2i4Cq RHtnAyOIzStgL3F/zgswW0jATuLA8X5WkF2cQPFpTzlBwowCYhLfT60BG8MsIC5x68l8Joij BSSW7DkP9YCoxMvH/1ghapIlNjV2MUGMF5Q4OfMJywRG4VlI2mchKZuFpAwiriOxYPcnNghb W2LZwtfMMPaZA4+ZkMUXMLKvYhQtTi0uzk03MtJLLcpMLi7Oz9PLSy3ZxAiMsINbflvtYDz4 3PEQowAHoxIPr9KF5Cgh1sSy4srcQ4wSHMxKIrxzm4FCvCmJlVWpRfnxRaU5qcWHGKU5WJTE eZ3SLKKEBNITS1KzU1MLUotgskwcnFINjCqaPhHct4sPcmgXHH7/WVfevJ//jsvaU2YVdxlu vil5Ii19meEAQ3DBrjhHgRdHNT7dM190808v95c7UX1b76Utfyjqq7w55+WzlXMLXZ6e1T+x YNXNjAURZ060rXPf4W+gWLXv3AbdwskWSbqCS/4rFUz3eWzxYJPQkdIMfunDfTPuhFUw5Sqx FGckGmoxFxUnAgCO5xSbrAIAAA== Archived-At: Subject: Re: [stir] AD Review: draft-ietf-stir-rph-02 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Jan 2018 23:34:11 -0000 --_000_8632F2B7931B47D8B8923DFF9AD02F0Dericssoncom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, Do the nesting discussions affect this extension? I assume one could use th= is with other passports. Regards, Christer Sent from my iPhone On 20 Jan 2018, at 0.15, Adam Roach > wrote: I'm doing my AD review of draft-ietf-stir-rph-02. Thanks to everyone who ha= s worked on this document, and the authors and chairs in particular. The technical content here looks generally good to me. I'd like to see a fe= w issues addressed before IETF LC. In short sumary: * The validation section needs to add a discussion of how to treat call= s when the priority values in "rph" passports and SIP "Resource-Priority" h= eader fields aren't 100% identical. * The examples need some adjustment. * There is a minor point of ambiguity in the Security Section, but this= should be easy to fix, as long as the WG knows what was intended. * The IANA actions need a little bit of adjustment. * There are a number of minor editorial issues to be cleaned up. Detailed comments on these points are inline in the document below. I've re= moved some portions of the document on which I have no comments. Abstract This document extends the STIR PASSporT specification to allow the "...the Secure Telephone Identity Revisited (STIR) Personal Assertion Token= (PASSporT) specification defined in RFC 8122..." (See for guidance on abbreviati= ons) inclusion of cryptographically-signed assertions of authorization for the values populated in the SIP 'Resource-Priority' header field, which is used for communications resource prioritization. ... 1. Introduction PASSporT [I-D.ietf-stir-passport] is a token format based on JWT [RFC7519] for conveying cryptographically-signed information about the identities involved in personal communications; it is used with STIR [I-D.ietf-stir-rfc4474bis] to convey a signed assertion of the identity of the participants in real-time communications established via a protocol like SIP. This specification extends PASSporT to "...like SIP [RFC3261]..." (We want to cite SIP the first time it is mentioned) allow cryptographic-signing of the SIP 'Resource-Priority' header field defined in [RFC4412]. [RFC4412] defines the SIP 'Resource-Priority' header field for communications Resource Priority. As specified in [RFC4412], the 'Resource-Priority' header field may be used by SIP user agents [RFC3261], including, Public Switched Telephone Network (PSTN) "...including Public Switched..." (remove the comma) gateways and terminals, and SIP proxy servers to influence "...and by SIP proxy servers, to influence..." (add "by" and comma) prioritization afforded to communication sessions,including PSTN "...sessions, including..." (space after comma) calls. However, the SIP 'Resource-Priority' header field could be spoofed and abused by unauthorized entities. The STIR architecture [RFC7340]assumes that an authority on the "...STIR architecture [RFC7340] assumes..." (space before "assumes") originating side of a call provides a cryptographic assurance of the validity of the calling party number in order to prevent impersonation attacks. The STIR architecture allows extension that "...allows extensions..." can be utilized by authorities supporting real-time communication services using the 'Resource-Priority' header field to cryptographically sign the SIP 'Resource-Priority' header field and convey assertion of the authorization for 'Resource-Priority'. For example, the authority on the originating side verifying the authorization of a particular communication for Resource-Priority can Single quotes around 'Resource-Priority'. use a PASSPorT claim to cryptographically-sign the SIP 'Resource- "...cryptographically sign..." Priority' header field and convey an assertion of the authorization for 'Resource-Priority'. This will allow a receiving entity (including entities located in different network domains/boundaries) to verify the validity of assertions authorizing Resource-Priority. Single quotes around 'Resource-Priority'. Cryptographically-signed SIP 'Resource-Priority' headers will allow a "...cryptographically signed SIP 'Resource-Priority' header fields..." (remove hyphen, and replace "headers" with "header fields") receiving entity to verify and act on the information with confidence that the information have not been spoofed or compromised. "...has not been spoofed or compromised." This specification documents an optional extension to PASSporT and the associated STIR mechanisms to provide a function to sign the SIP 'Resource-Priority' header field. This PASSporT object is used to provide attestation of a calling user authorization for priority communications. This is necessary in addition to the PASSporT object that is used for calling user telephone number attestation. How the optional extension to PASSporT is used for real-time communications supported using SIP 'Resource-Priority' header field is defined in other documents and is outside the scope of this document. I assume these other documents are under development? If so, they should be= cited here. 2. Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. This document has several non-normative uses of "must", "should," and "may,= " and so it needs to use the RFC8174 boilerplate instead of the RFC2119 boi= lerplate. 3. PASSporT 'rph' Claim This specification defines a new JSON Web Token claim for "rph", which provides an assertion for information in SIP 'Resource- Priority'header. "...Priority' header field." (space after closing quotation mark, "header field" instead of "header") The creator of a PASSporT object adds a "ppt" value of "rph" to the header of a PASSporT object, in which case the PASSporT claims MUST contain a "rph" claim, and any entities verifying the PASSporT object will be required to understand the "ppt" extension in order to process the PASSporT in question. A PASSPorT header with the "ppt" included will look as follows: { "typ":"passport", "ppt":"rph", "alg":"ES256", "x5u":"https://www.example.org/cert.cer"} Ideally, this would be either pretty-printed or canonicalized. Since it's t= oo long to fit on a line in canonical form, I propose: { "typ":"passport", "ppt":"rph", "alg":"ES256", "x5u":"https://www.example.org/cert.cer" } The "rph" claim will provide an assertion of authorization,"auth", "...authorization, "auth", ..." (space between comma and opening quotation mark) for information in the SIP "Resource-Priority" header field (i.e., Resource-Priority: namespace "." r-priority) based on [RFC4412]. The use of the string 'namespace "." r-priority' here and elsewhere in the = document has a detrimental impact on readability. I strongly suggest replac= ing it with "r-value" (the name of this production in RFC4412) everywhere. Specifically, the "rph" claim includes assertion of the priority- level of the user to be used for a given communication session. The value of the "rph" claim is an array containing one or more of JSON objects for the content of the SIP 'Resource-Priority' header that is being asserted of which one of the "rph" object, is mandatory. This last sentence is very hard to parse; and (based on the example) the va= lue is intended to be a JSON Object (curly braces) rather than a JSON Array= (square braces). I suggest: 'The value of the "rph" claim is an Object wit= h one or more keys. Each key is associated with a JSON Array. These arrays = contain Strings that correspond to the r-values indicated in the SIP "Resou= rce-Priority" header field.' (note: "header field", not "header") The following is an example "rph" claim for a SIP "Resource-Priority" header field with a "namespace "." r-priority" value of "ets.0" and with a "namespace "." r-priority" value of "wps.0". { "orig":{"tn":"12155551212"} "dest":{["tn":"12125551213"]}, "iat":1443208345, "rph":{"auth":["ets.0","wps.0"]} As above, I recommend pretty-printing this. It's also missing a comma after= the "orig" value, and the top-level structure is missing a closing brace. = The value for "iat" needs to be enclosed in quotes. The NANPA has allocated NPA55501xx for example use, not NPA555xxxx, much of= which remains assignable (cf ). Putting all this together, I believe what you want is: { "orig":{"tn":"12155550112"}, "dest":{["tn":"12125550113"]}, "iat":"1443208345", "rph":{"auth":["ets.0","wps.0"]} } After the header and claims PASSporT objects have been constructed, their signature is generated normally per the guidance in [I-D.ietf-stir-passport] using the full form of PASSPorT. The credentials (e.g., authority responsible for authorizing Resource- Priority) used to create the signature must have authority over the "rph" claim and there is only one authority per claim. The authority MUST use its credentials (i.e., CERT) associated with the specific service supported by the SIP namespace in the claim. 4. 'rph' in SIP This section specifies SIP-specific usage for the "rph" claim in PASSporT. 4.1. Authentication Service Behavior The Authentication Service will create the "rph" claim using the values discussed in section 3 based on [RFC4412]. The construction of "rph" claim follows the steps described in Section 4 of [I-D.ietf-stir-rfc4474bis]. The resulting Identity header for "rph" might look as follows: "...header field..." "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJleUowZVhBaU9pSnd ZWE56Y0c5eWRDSXNEUW9pY0hCMElqb2ljbkJvSWl3TkNpSmhiR2NpT2lKRlV6STFO aUlzRFFvaWVEVjFJanBvZEhSd2N6b3ZMM2QzZHk1bGVHRnRjR3hsTG1OdmJTOWpaW EowTG1ObGNuME5DZzBLIHx84oCZLuKAmXx8IGV5QWliM0pwWnlJNmV5SjBiaUk2SW pFeU1UVTFOVFV4TWpFeUluME5DaUprWlhOMElqcDdXeUowYmlJNklqRXlNVEkxTlR VeE1qRXpJbDE5TEEwS0ltbGhkQ0k2TVRRME16SXdPRE0wTlN3TkNpSnljR2dpT25z aVlYVjBhQ0k2V3lKbGRITXVNQ0lzSW5kd2N5NHdJbDE5RFFvPSJ9.s37S6VC8HM6D l6YzJeQDsrZcwJ0lizxhUrA7f_98oWBHvo-cl-n8MIhoCr18vYYFy3blXvs3fslM_ oos2P2Dyw"; info=3D "https://www.example.org/cert.cer";alg=3DES256; ppt=3D"rph" This example has a number of issues: * In the Identity header field, the signed-identity-digest shouldn't be= quoted. * In the Identity header field, info is enclosed in <> rather than "". * In the Identity header field, ppt is a token rather than a quoted str= ing. * The signed-identity-digest header needs to indicate a "typ" of "passp= ort" rather than JWT, and it needs to include both a "ppt" and "x5u" field. * The signed-identity-digest body should contain only the passport clai= m rather than a JSON object that itself contains a base64-encoded JWS heade= r concatenated with a claim. * I believe that, even when the body is included, values in the header = and body need to be be canonicalized (i.e., all on one line, no spaces, in = alphabetical order, etc.) I would also recommend following the convention of indicating that line-wra= ps are only for readability, and including the header field name in the exa= mple. Putting all this together, I believe what you want is: For example, a Identity header field for "rph" might look as follows (backslashes shown for line folding only): Identity: eyJhbGciOiJFUzI1NiIsInBwdCI6InJwaCIsInR5cCI6InBhc3Nwb3J0I \ iwieDV1IjoiaHR0cHM6Ly93d3cuZXhhbXBsZS5jb20vY2VydC5jZXIifQo.eyJkZXN0 \ Ijp7WyJ0biI6IjEyMTI1NTUwMTEzIl19LCJpYXQiOiIxNDQzMjA4MzQ1Iiwib3JpZyI \ 6eyJ0biI6IjEyMTU1NTUwMTEyIn0sInJwaCI6eyJhdXRoIjpbImV0cy4wIiwid3BzLj \ AiXX19Cg.s37S6VC8HM6Dl6YzJeQDsrZcwJ0lizxhUrA7f_98oWBHvo-cl-n8MIhoCr \ 18vYYFy3blXvs3fslM_oos2P2Dyw;info=3D;alg=3DES256;ppt=3Drph (Note: this example assumes the calling and called party numbers in the pre= vious example are changed to 12155550112 and 12155550113, respectively) A SIP authentication service typically will derive the value of "rph" from the 'Resource-Priority' header field based on policy associated with service specific use of the "namespace "." r-priority" values based on [RFC4412]. The authentication service derives the value of the PASSPorT claim by verifying the authorization for Resource- Priority (i.e., verifying a calling user privilege for Resource- Priority based on its identity) which might be derived from customer profile data or from access to external services. [RFC4412] allows multiple "namespace "." r-priority" pairs, either in a single SIP Resource-Priority header or across multiple SIP Single quotes around 'Resource-Priority'. "...header field..." Resource-Priority headers. However, it is not necessary to sign all Single quotes around 'Resource-Priority'. "...header fields..." content of a SIP Resource-Priority header or all SIP Resource- Single quotes around 'Resource-Priority'. "...header field..." Priority headers in a given SIP message. An authority is only Single quotes around 'Resource-Priority'. "...header fields..." responsible for signing the content of a SIP Resource-Priority header Single quotes around 'Resource-Priority'. "...header field..." for which it has authority (e.g., a specific "namespace "." r-priority"). 4.2. Verification Service Behavior [I-D.ietf-stir-rfc4474bis] Section 6.2 Step 5 requires that specifications defining "ppt" values describe any additional verifier behavior. The behavior specified for the "ppt" values of "rph" is as follows: The verification service MUST extract the value associated with the "auth" key in a full form PASSPorT with a "ppt" value of "rph". If the signature validates, then the verification service can use the value of the "rph" claim as validation that the calling party is authorized for Resource-Priority, which would in turn be used for Single quotes around 'Resource-Priority'. This text is ambiguous about whether the validation indicates that the call= ing party is authorized to use the priorities indicated in the passport obj= ect, or the values in the SIP 'Resource-Priority' header field; and (taken = on its face) implies the latter, when the intention here should clearly be = the former. "...authorized for 'Resource-Priority' indicated in the claim. This value w= ould in turn be used for..." The text also needs to say something about comparing values in the claim to= values in the 'Resource-Priority' header field, and what a mismatch might = mean. The document says elsewhere that the signature might only cover some = of the r-values, which makes it entirely possible that the 'Resource-Priori= ty' field might contain more values than are signed. On the other hand, int= ermediaries might reasonably remove r-values as the call is processed. This= probably means that those removed priorities should not be used, even if t= hey are present in the passport. It seems reasonable to say that *typical* = processing by a receiving party would be to take the *union* of all RPH pas= sports that they trust, and *intersect* that with the priorities in 'Resour= ce-Priority' header fields to get the actual priority or priorities to be a= pplied to the call (subject to local policy). priority treatment in accordance with local policy for the associated communication service. In addition, [I-D.ietf-stir-rfc4474bis] Section 6.2 Step 4 requires "iat" value in "rph" claim to be verified. The behavior of a SIP UAs upon receiving an INVITE containing a "...of a SIP UA upon..." or "...of SIP UAs upon..." PASSporT object with a "rph" claim will largely remain a matter of implementation policy for the specific communication service. In most cases,implementations would act based on confidence in the "...cases, implementations..." (space after comma) veracity of this information. The use of the compact form of Paragraph break before "The". PASSporT is not specified in this document. 5. Further Information Associated with Resource-Priority Single quotes around 'Resource-Priority'. There may be additional information about the calling party or the call that could be relevant to authorization for Resource-Priority. Single quotes around 'Resource-Priority'. This may include information related to the device subscription of the caller, or to any institutions that the caller or device is associated with, or even categories of institutions. All of these data elements would benefit from the secure attestations provided by the STIR and PASSporT frameworks. The specification of the "rph" claim could entail the optional presence of one or more such additional information fields. A new IANA registry has been defined to hold potential values of the "rph" array; see Section 6.2. The definition of the "rph" claim may have one or more such additional information field(s). Details of such "rph" claim to encompass other data elements are left for future version of this specification. 6. IANA Considerations 6.1. JSON Web Token Claims Registration I think there's some confusion here. You're registering a PASSporT ppt valu= e, not a new JWT claim. That is to say, you're adding an entry to this tabl= e: https://www.iana.org/assignments/passport/passport.xhtml Not to this table: https://www.iana.org/assignments/jwt/jwt.xhtml You would only use the second table if you had a new key to add to the PASS= porT header -- this specification does not do that. This section also needs some introductory text to let the IANA know exactly= what to do; e.g. "This document registers a new value for the "Personal As= sertion Token (PASSporT) Extensions" table. o ppt value: "rph" o Specification Document(s): Section 3 of [RFCThis] 6.2. PASSporT 'rph' Types This document requests that the IANA add a new entry to the PASSporT Types registry for the type "rph" which is specified in [RFCThis]. There isn't an IANA table called "PASSporT Types." I presume this is the re= gistration we just discussed in section 6.1, and so the above two lines can= be removed. This specification also requests that the IANA create a new registry for PASSporT "rph" types. Registration of new PASSporT "rph" types shall be under the specification required policy. This registry is to be initially populated with a single value for "auth" which is specified in [RFCThis]. This needs to be very clear about the fields to be included in this new reg= istry (e.g., "Registry entries must contain two fields: the name of the 'rp= h' type and the specification in which the type is described"). 7. Security Considerations The security considerations discussed in [I-D.ietf-stir-rfc4474bis] in Section 10 are applicable here. 7.1. Avoidance of replay and cut and paste attacks The PASSporT extension with a "ppt" value of "rph" MUST only be sent with SIP INVITE when 'Resource-Priority' header is used to convey the "...header field..." priority of the communication as defined in [RFC4412]. To avoid the replay, and cut and paste attacks, the procedures described in Section 10.1 of [I-D.ietf-stir-rfc4474bis] MUST be followed. 7.2. Solution Considerations The use of extension to PASSporT tokens with "ppt" value "rph" based on the validation of the digital signature and the associated certificate requires consideration of the authentication and authority or reputation of the signer to attest to the identity being asserted. The following considerations should be recognized when using PASSporT extension with "ppt" value of "rph": o An authority (signer) is only allowed to sign the content of a SIP 'Resource-Priority' header for which it has the right authority. "...header field..." The authority that signs the token MUST have a secure method for authentication of the end user or the device. o The verification of the signature MUST include means of verifying that the signer is authoritative for the signed content of the SIP It's not clear what authority is being claimed here. Is this supposed to me= an something like "...verifying that the signer is authoritative for the or= iginating tn in the PASSporT..."? Or "...authoritative for the resource pri= ority namespace in the PASSporT?" Whatever the server is purportedly author= itative for needs to be clearly spelled out. 'Resource-Priority' header. "...header field." /a _______________________________________________ stir mailing list stir@ietf.org https://www.ietf.org/mailman/listinfo/stir --_000_8632F2B7931B47D8B8923DFF9AD02F0Dericssoncom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi,

Do the nesting discussions affect this extension? I assume one could u= se this with other passports.

Regards,

Christer 

Sent from my iPhone

On 20 Jan 2018, at 0.15, Adam Roach <adam@nostrum.com> wrote:

I'm doing my AD review of draft-ietf-stir-rph-02. Thanks to everyone who= has worked on this document, and the authors and chairs in particular.

The technical content here looks generally good to me. I'd like to see a= few issues addressed before IETF LC. In short sumary:

  • The validation section needs to add a discussion of how to treat calls = when the priority values in "rph" passports and SIP "Resourc= e-Priority" header fields aren't 100% identical.
  • The examples need some adjustment.
  • There is a minor point= of ambiguity in the Security Section, but this should be easy to fix, as l= ong as the WG knows what was intended.
  • The IANA actions need a little bit of adjustment.
  • There a= re a number of minor editorial issues to be cleaned up.

Detailed comments on these points are inline in the document below. I've= removed some portions of the document on which I have no comments.



Abstract

   This document extends the STIR PASSporT specification= to allow the


"...the Secure Telephone Identity Revisited (STIR) Personal Asserti= on Token (PASSporT) specification defined in RFC 8122..."

(See <https://www.rfc-editor.org/materials/abbrev.expansion.txt> for g= uidance on abbreviations)


   inclusion of cryptographically-s= igned assertions of authorization for
   the values populated in the SIP 'Resource-Priority' h= eader field,
   which is used for communications resource prioritizat= ion.

...

1.  Introduction

   PASSporT [I-D.ietf-stir-passport] is a token format b= ased on JWT
   [RFC7519] for conveying cryptographically-signed info= rmation about
   the identities involved in personal communications; i= t is used with
   STIR [I-D.ietf-stir-rfc4474bis] to convey a signed as= sertion of the
   identity of the participants in real-time communicati= ons established
   via a protocol like SIP.  This specification ext= ends PASSporT to


"...like SIP [RFC3261]..."

(We want to cite SIP the first time it is mentioned)


   allow cryptographic-signing of t= he SIP 'Resource-Priority' header
   field defined in [RFC4412].

   [RFC4412] defines the SIP 'Resource-Priority' header = field for
   communications Resource Priority.  As specified = in [RFC4412], the
   'Resource-Priority' header field may be used by SIP u= ser agents
   [RFC3261], including, Public Switched Telephone Netwo= rk (PSTN)


"...including Public Switched..."

(remove the comma)


   gateways and terminals, and SIP = proxy servers to influence


"...and by SIP proxy servers, to influence..."

(add "by" and comma)


   prioritization afforded to commu= nication sessions,including PSTN

"...sessions, including..."

(space after comma)


   calls.  However, the SIP 'R= esource-Priority' header field could be
   spoofed and abused by unauthorized entities.=

   The STIR architecture [RFC7340]assumes that an author= ity on the


"...STIR architecture [RFC7340] assumes..."

(space before "assumes")


   originating side of a call provi= des a cryptographic assurance of the
   validity of the calling party number in order to prev= ent
   impersonation attacks.  The STIR architecture al= lows extension that


"...allows extensions..."


   can be utilized by authorities s= upporting real-time communication
   services using the 'Resource-Priority' header field t= o
   cryptographically sign the SIP 'Resource-Priority' he= ader field and
   convey assertion of the authorization for 'Resource-P= riority'.  For
   example, the authority on the originating side verify= ing the
   authorization of a particular communication for Resou= rce-Priority can


Single quotes around 'Resource-Priority'.


   use a PASSPorT claim to cryptogr= aphically-sign the SIP 'Resource-


"...cryptographically sign..."


   Priority' header field and conve= y an assertion of the authorization
   for 'Resource-Priority'.  This will allow a rece= iving entity
   (including entities located in different network doma= ins/boundaries)
   to verify the validity of assertions authorizing Reso= urce-Priority.


Single quotes around 'Resource-Priority'.


   Cryptographically-signed SIP 'Re= source-Priority' headers will allow a


"...cryptographically signed SIP 'Resource-Priority' header fields.= .."

(remove hyphen, and replace "headers" with "header fields= ")


   receiving entity to verify and a= ct on the information with confidence
   that the information have not been spoofed or comprom= ised.


"...has not been spoofed or compromised."



   This specification documents an optional extension to= PASSporT and
   the associated STIR mechanisms to provide a function = to sign the SIP
   'Resource-Priority' header field.  This PASSporT= object is used to
   provide attestation of a calling user authorization f= or priority
   communications.  This is necessary in addition t= o the PASSporT object
   that is used for calling user telephone number attest= ation.  How the
   optional extension to PASSporT is used for real-time = communications
   supported using SIP 'Resource-Priority' header field = is defined in
   other documents and is outside the scope of this docu= ment.


I assume these other documents are under development? If so, they should= be cited here.



2.  Terminology

   The key words "MUST", "MUST NOT",= "REQUIRED", "SHALL", "SHALL NOT",    "SHOULD", "SHOULD NOT", "REC= OMMENDED", "MAY", and "OPTIONAL" in this<= br>    document are to be interpreted as described in RFC 21= 19 [RFC2119].


This document has several non-normative uses of "must", "= should," and "may," and so it needs to use the RFC8174 boile= rplate instead of the RFC2119 boilerplate.



3.  PASSporT 'rph' Claim

   This specification defines a new JSON Web Token claim= for "rph",
   which provides an assertion for information in SIP 'R= esource-
   Priority'header.


"...Priority' header field."

(space after closing quotation mark, "header field" instead of= "header")



   The creator of a PASSporT object adds a "ppt&quo= t; value of "rph" to the
   header of a PASSporT object, in which case the PASSpo= rT claims MUST
   contain a "rph" claim, and any entities ver= ifying the PASSporT object
   will be required to understand the "ppt" ex= tension in order to
   process the PASSporT in question.  A PASSPorT he= ader with the "ppt"
   included will look as follows:

   {  "typ":"passport",
     "ppt":"rph",=
     "alg":"ES256",
     "x5u":"https://www.examp= le.org/cert.cer"}


Ideally, this would be either pretty-printed or canonicalized. Since it'= s too long to fit on a line in canonical form, I propose:

{
  "typ":"passport",
  "ppt":"rph",
  "alg":"ES256",
  "x5u":"https://www.example.org/cert.cer&qu= ot;
}



   The "rph" claim will provide an assertion o= f authorization,"auth",


"...authorization, "auth", ..."

(space between comma and opening quotation mark)


   for information in the SIP "= ;Resource-Priority" header field (i.e.,
   Resource-Priority: namespace "." r-priority= ) based on [RFC4412].


The use of the string 'namespace "." r-priority' here and else= where in the document has a detrimental impact on readability. I strongly s= uggest replacing it with "r-value" (the name of this production i= n RFC4412) everywhere.


   Specifically, the "rph"= ; claim includes assertion of the priority-
   level of the user to be used for a given communicatio= n session.  The
   value of the "rph" claim is an array contai= ning one or more of JSON
   objects for the content of the SIP 'Resource-Priority= ' header that is
   being asserted of which one of the "rph" ob= ject, is mandatory.


This last sentence is very hard to parse; and (based on the example) the= value is intended to be a JSON Object (curly braces) rather than a JSON Ar= ray (square braces). I suggest: 'The value of the "rph" claim is = an Object with one or more keys. Each key is associated with a JSON Array. These arrays contain Strings that corresp= ond to the r-values indicated in the SIP "Resource-Priority" head= er field.' (note: "header field", not "header")



   The following is an example "rph" claim for= a SIP "Resource-Priority"
   header field with a "namespace "." r-p= riority" value of "ets.0" and
   with a "namespace "." r-priority"= value of "wps.0".

    { "orig":{"tn":"121555= 51212"}
     "dest":{["tn":"1= 2125551213"]},
     "iat":1443208345,
     "rph":{"auth":["= ets.0","wps.0"]}


As above, I recommend pretty-printing this. It's also missing a comma af= ter the "orig" value, and the top-level structure is missing a cl= osing brace. The value for "iat" needs to be enclosed in quotes.<= /p>

The NANPA has allocated NPA55501xx for example use, not NPA555xxxx, much= of which remains assignable (cf <https://www.nationalnanpa.com/pdf/NRUF/ATIS-0300115.pdf>).

Putting all this together, I believe what you want is:

{
  "orig":{"tn":"12155550112"},<= br>   "dest":{["tn":"12125550113"]}= ,
  "iat":"1443208345",
  "rph":{"auth":["ets.0","= wps.0"]}
}



   After the header and claims PASSporT objects have bee= n constructed,
   their signature is generated normally per the guidanc= e in
   [I-D.ietf-stir-passport] using the full form of PASSP= orT.  The
   credentials (e.g., authority responsible for authoriz= ing Resource-
   Priority) used to create the signature must have auth= ority over the
   "rph" claim and there is only one authority= per claim.  The authority
   MUST use its credentials (i.e., CERT) associated with= the specific
   service supported by the SIP namespace in the claim.<= /tt>

4.  'rph' in SIP

   This section specifies SIP-specific usage for the &qu= ot;rph" claim in
   PASSporT.

4.1.  Authentication Service Behavior

   The Authentication Service will create the "rph&= quot; claim using the
   values discussed in section 3 based on [RFC4412].&nbs= p; The construction
   of "rph" claim follows the steps described = in Section 4 of
   [I-D.ietf-stir-rfc4474bis].

   The resulting Identity header for "rph" mig= ht look as follows:


"...header field..."



   "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOi= JleUowZVhBaU9pSnd
   ZWE56Y0c5eWRDSXNEUW9pY0hCMElqb2ljbkJvSWl3TkNpSmhiR2Np= T2lKRlV6STFO
   aUlzRFFvaWVEVjFJanBvZEhSd2N6b3ZMM2QzZHk1bGVHRnRjR3hsT= G1OdmJTOWpaW
   EowTG1ObGNuME5DZzBLIHx84oCZLuKAmXx8IGV5QWliM0pwWnlJNm= V5SjBiaUk2SW
   pFeU1UVTFOVFV4TWpFeUluME5DaUprWlhOMElqcDdXeUowYmlJNkl= qRXlNVEkxTlR
   VeE1qRXpJbDE5TEEwS0ltbGhkQ0k2TVRRME16SXdPRE0wTlN3TkNp= SnljR2dpT25z
   aVlYVjBhQ0k2V3lKbGRITXVNQ0lzSW5kd2N5NHdJbDE5RFFvPSJ9.= s37S6VC8HM6D
   l6YzJeQDsrZcwJ0lizxhUrA7f_98oWBHvo-cl-n8MIhoCr18vYYFy= 3blXvs3fslM_
   oos2P2Dyw"; info=3D "https://www.example.org/cert.cer";alg=3DES256;
   ppt=3D"rph"


This example has a number of issues:

  • In the Identity header field, the signed-identity-digest shouldn't be q= uoted.
  • In the Identity header field, info is enclosed in <> rather = than "".
  • In the Identity header field, ppt is a token ra= ther than a quoted string.
  • The signed-identity-digest header needs= to indicate a "typ" of "passport" rather than JWT, and= it needs to include both a "ppt" and "x5u" field.
  • The signed-identity-digest body should contain only the passport c= laim rather than a JSON object that itself contains a base64-encoded JWS he= ader concatenated with a claim.
  • I believe that, even when the body is included, values in the head= er and body need to be be canonicalized (i.e., all on one line, no spaces, = in alphabetical order, etc.)

I would also recommend following the convention of indicating that line-= wraps are only for readability, and including the header field name in the = example. Putting all this together, I believe what you want is:

   For example, a Identity header field for "rph"= ; might look
   as follows (backslashes shown for line folding only):=

   Identity: eyJhbGciOiJFUzI1NiIsInBwdCI6InJwaCIsInR5cCI6I= nBhc3Nwb3J0I \
   iwieDV1IjoiaHR0cHM6Ly93d3cuZXhhbXBsZS5jb20vY2VydC5jZX= IifQo.eyJkZXN0 \
   Ijp7WyJ0biI6IjEyMTI1NTUwMTEzIl19LCJpYXQiOiIxNDQzMjA4M= zQ1Iiwib3JpZyI \
   6eyJ0biI6IjEyMTU1NTUwMTEyIn0sInJwaCI6eyJhdXRoIjpbImV0= cy4wIiwid3BzLj \
   AiXX19Cg.s37S6VC8HM6Dl6YzJeQDsrZcwJ0lizxhUrA7f_98oWBH= vo-cl-n8MIhoCr \
   18vYYFy3blXvs3fslM_oos2P2Dyw;info=3D<https://www= .example.org/cert.cer \
   >;alg=3DES256;ppt=3Drph

(Note: this example assumes the calling and called party numbers in the pre= vious example are changed to 12155550112 and 12155550113, respectively)



   A SIP authentication service typically will derive th= e value of "rph"
   from the 'Resource-Priority' header field based on po= licy associated
   with service specific use of the "namespace &quo= t;." r-priority" values
   based on [RFC4412].  The authentication service = derives the value of
   the PASSPorT claim by verifying the authorization for= Resource-
   Priority (i.e., verifying a calling user privilege fo= r Resource-
   Priority based on its identity) which might be derive= d from customer
   profile data or from access to external services.

   [RFC4412] allows multiple "namespace ".&quo= t; r-priority" pairs, either in
   a single SIP Resource-Priority header or across multi= ple SIP


Single quotes around 'Resource-Priority'.

"...header field..."


   Resource-Priority headers. = However, it is not necessary to sign all


Single quotes around 'Resource-Priority'.

"...header fields..."


   content of a SIP Resource-Priori= ty header or all SIP Resource-


Single quotes around 'Resource-Priority'.

"...header field..."


   Priority headers in a given SIP = message.  An authority is only


Single quotes around 'Resource-Priority'.

"...header fields..."


   responsible for signing the cont= ent of a SIP Resource-Priority header


Single quotes around 'Resource-Priority'.

"...header field..."


   for which it has authority (e.g.= , a specific "namespace "."
   r-priority").

4.2.  Verification Service Behavior

   [I-D.ietf-stir-rfc4474bis] Section 6.2 Step 5 require= s that
   specifications defining "ppt" values descri= be any additional verifier
   behavior.  The behavior specified for the "= ppt" values of "rph" is as
   follows:

   The verification service MUST extract the value assoc= iated with the
   "auth" key in a full form PASSPorT with a &= quot;ppt" value of "rph".  If
   the signature validates, then the verification servic= e can use the
   value of the "rph" claim as validation that= the calling party is
   authorized for Resource-Priority, which would in turn= be used for

Single quotes around 'Resource-Priority'.

This text is ambiguous about whether the validation indicates that the c= alling party is authorized to use the priorities indicated in the passport = object, or the values in the SIP 'Resource-Priority' header field; and (tak= en on its face) implies the latter, when the intention here should clearly be the former.

"...authorized for 'Resource-Priority' indicated in the claim. This= value would in turn be used for..."

The text also needs to say something about comparing values in the claim= to values in the 'Resource-Priority' header field, and what a mismatch mig= ht mean. The document says elsewhere that the signature might only cover so= me of the r-values, which makes it entirely possible that the 'Resource-Priority' field might contain more= values than are signed. On the other hand, intermediaries might reasonably= remove r-values as the call is processed. This probably means that those r= emoved priorities should not be used, even if they are present in the passport. It seems reasonable to say= that *typical* processing by a receiving party would be to take the *union= * of all RPH passports that they trust, and *intersect* that with the prior= ities in 'Resource-Priority' header fields to get the actual priority or priorities to be applied to the call = (subject to local policy).


   priority treatment in accordance= with local policy for the associated
   communication service.

   In addition, [I-D.ietf-stir-rfc4474bis] Section 6.2 S= tep 4 requires
   "iat" value in "rph" claim to be = verified.

   The behavior of a SIP UAs upon receiving an INVITE co= ntaining a


"...of a SIP UA upon..."

or

"...of SIP UAs upon..."


   PASSporT object with a "rph= " claim will largely remain a matter of
   implementation policy for the specific communication = service.  In
   most cases,implementations would act based on confide= nce in the


"...cases, implementations..."

(space after comma)


   veracity of this information.&nb= sp; The use of the compact form of


Paragraph break before "The".


   PASSporT is not specified in thi= s document.

5.  Further Information Associated with Resource-Priority


Single quotes around 'Resource-Priority'.



   There may be additional information about the calling= party or the
   call that could be relevant to authorization for Reso= urce-Priority.


Single quotes around 'Resource-Priority'.


   This may include information rel= ated to the device subscription of
   the caller, or to any institutions that the caller or= device is
   associated with, or even categories of institutions.&= nbsp; All of these
   data elements would benefit from the secure attestati= ons provided by
   the STIR and PASSporT frameworks.  The specifica= tion of the "rph"
   claim could entail the optional presence of one or mo= re such
   additional information fields.

   A new IANA registry has been defined to hold potentia= l values of the
   "rph" array; see Section 6.2.  The def= inition of the "rph" claim may
   have one or more such additional information field(s)= .  Details of
   such "rph" claim to encompass other data el= ements are left for future
   version of this specification.

6.  IANA Considerations

6.1.  JSON Web Token Claims Registration


I think there's some confusion here. You're registering a PASSporT ppt v= alue, not a new JWT claim. That is to say, you're adding an entry to this t= able:

https://www.iana.org/assignments/passport/pass= port.xhtml

Not to this table:

https://www.iana.org/assignments/jwt/jwt.xhtml

You would only use the second table if you had a new key to add to the P= ASSporT header -- this specification does not do that.

This section also needs some introductory text to let the IANA know exac= tly what to do; e.g. "This document registers a new value for the &quo= t;Personal Assertion Token (PASSporT) Extensions" table.


   o  ppt value: "rph"

   o  Specification Document(s): Section 3 of [RFCT= his]

6.2.  PASSporT 'rph' Types

   This document requests that the IANA add a new entry = to the PASSporT
   Types registry for the type "rph" which is = specified in [RFCThis].


There isn't an IANA table called "PASSporT Types." I presume t= his is the registration we just discussed in section 6.1, and so the above = two lines can be removed.


   This specification also requests= that the IANA create a new registry
   for PASSporT "rph" types.  Registratio= n of new PASSporT "rph" types
   shall be under the specification required policy.&nbs= p; This registry is
   to be initially populated with a single value for &qu= ot;auth" which is
   specified in [RFCThis].


This needs to be very clear about the fields to be included in this new = registry (e.g., "Registry entries must contain two fields: the name of= the 'rph' type and the specification in which the type is described")= .



7.  Security Considerations

   The security considerations discussed in [I-D.ietf-st= ir-rfc4474bis]
   in Section 10 are applicable here.

7.1.  Avoidance of replay and cut and paste attacks<= br>
   The PASSporT extension with a "ppt" value o= f "rph" MUST only be sent
   with SIP INVITE when 'Resource-Priority' header is us= ed to convey the


"...header field..."


   priority of the communication as= defined in [RFC4412].  To avoid the
   replay, and cut and paste attacks, the procedures des= cribed in
   Section 10.1 of [I-D.ietf-stir-rfc4474bis] MUST be fo= llowed.

7.2.  Solution Considerations

   The use of extension to PASSporT tokens with "pp= t" value "rph" based
   on the validation of the digital signature and the as= sociated
   certificate requires consideration of the authenticat= ion and
   authority or reputation of the signer to attest to th= e identity being
   asserted.  The following considerations should b= e recognized when
   using PASSporT extension with "ppt" value o= f "rph":

   o  An authority (signer) is only allowed to sign= the content of a SIP
      'Resource-Priority' header for whic= h it has the right authority.


"...header field..."


      The authority = that signs the token MUST have a secure method for
      authentication of the end user or t= he device.

   o  The verification of the signature MUST includ= e means of verifying
      that the signer is authoritative fo= r the signed content of the SIP


It's not clear what authority is being claimed here. Is this supposed to= mean something like "...verifying that the signer is authoritative fo= r the originating tn in the PASSporT..."? Or "...authoritative fo= r the resource priority namespace in the PASSporT?" Whatever the server is purportedly authoritative for needs to be clearly s= pelled out.


      'Resource-Prio= rity' header.


"...header field."


/a
_______________________________________________
stir mailing list
stir@ietf.org
https://www.ie= tf.org/mailman/listinfo/stir
--_000_8632F2B7931B47D8B8923DFF9AD02F0Dericssoncom_-- From nobody Mon Jan 22 08:31:04 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A0C9F127078; Mon, 22 Jan 2018 08:31:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.889 X-Spam-Level: X-Spam-Status: No, score=-1.889 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, T_RP_MATCHES_RCVD=-0.01, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4R6S0n6ROuKH; Mon, 22 Jan 2018 08:30:59 -0800 (PST) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E505F126DEE; Mon, 22 Jan 2018 08:30:58 -0800 (PST) Received: from Svantevit.local (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id w0MGUqjV070032 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Mon, 22 Jan 2018 10:30:53 -0600 (CST) (envelope-from adam@nostrum.com) X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be Svantevit.local To: Christer Holmberg Cc: STIR Chairs , "stir@ietf.org" , "draft-ietf-stir-rph.all@tools.ietf.org" References: <8632F2B7-931B-47D8-B892-3DFF9AD02F0D@ericsson.com> From: Adam Roach Message-ID: Date: Mon, 22 Jan 2018 10:30:47 -0600 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 In-Reply-To: <8632F2B7-931B-47D8-B892-3DFF9AD02F0D@ericsson.com> Content-Type: multipart/alternative; boundary="------------62830854E7F9021A25F4898C" Content-Language: en-US Archived-At: Subject: Re: [stir] AD Review: draft-ietf-stir-rph-02 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jan 2018 16:31:03 -0000 This is a multi-part message in MIME format. --------------62830854E7F9021A25F4898C Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit The -divert- document needs to co-exist with "ppt" extensions in general, and I would be very sad if its design required additional considerations in each such extension. What kind of impact are you envisioning? /a On 1/20/18 5:34 PM, Christer Holmberg wrote: > Hi, > > Do the nesting discussions affect this extension? I assume one could > use this with other passports. > > Regards, > > Christer > > Sent from my iPhone > > On 20 Jan 2018, at 0.15, Adam Roach > wrote: > >> I'm doing my AD review of draft-ietf-stir-rph-02. Thanks to everyone >> who has worked on this document, and the authors and chairs in >> particular. >> >> The technical content here looks generally good to me. I'd like to >> see a few issues addressed before IETF LC. In short sumary: >> >> * The validation section needs to add a discussion of how to treat >> calls when the priority values in "rph" passports and SIP >> "Resource-Priority" header fields aren't 100% identical. >> * The examples need some adjustment. >> * There is a minor point of ambiguity in the Security Section, but >> this should be easy to fix, as long as the WG knows what was >> intended. >> * The IANA actions need a little bit of adjustment. >> * There are a number of minor editorial issues to be cleaned up. >> >> Detailed comments on these points are inline in the document below. >> I've removed some portions of the document on which I have no comments. >> >> >>> >>> Abstract >>> >>>    This document extends the STIR PASSporT specification to allow the >> >> >> "...the Secure Telephone Identity Revisited (STIR) Personal Assertion >> Token (PASSporT) specification defined in RFC 8122..." >> >> (See for >> guidance on abbreviations) >> >> >>>    inclusion of cryptographically-signed assertions of authorization for >>>    the values populated in the SIP 'Resource-Priority' header field, >>>    which is used for communications resource prioritization. >>> >>> ... >>> >>> 1.  Introduction >>> >>>    PASSporT [I-D.ietf-stir-passport] is a token format based on JWT >>>    [RFC7519] for conveying cryptographically-signed information about >>>    the identities involved in personal communications; it is used with >>>    STIR [I-D.ietf-stir-rfc4474bis] to convey a signed assertion of the >>>    identity of the participants in real-time communications established >>>    via a protocol like SIP.  This specification extends PASSporT to >> >> >> "...like SIP [RFC3261]..." >> >> (We want to cite SIP the first time it is mentioned) >> >> >>>    allow cryptographic-signing of the SIP 'Resource-Priority' header >>>    field defined in [RFC4412]. >>> >>>    [RFC4412] defines the SIP 'Resource-Priority' header field for >>>    communications Resource Priority.  As specified in [RFC4412], the >>>    'Resource-Priority' header field may be used by SIP user agents >>>    [RFC3261], including, Public Switched Telephone Network (PSTN) >> >> >> "...including Public Switched..." >> >> (remove the comma) >> >> >>>    gateways and terminals, and SIP proxy servers to influence >> >> >> "...and by SIP proxy servers, to influence..." >> >> (add "by" and comma) >> >> >>>    prioritization afforded to communication sessions,including PSTN >> >> "...sessions, including..." >> >> (space after comma) >> >> >>>    calls.  However, the SIP 'Resource-Priority' header field could be >>>    spoofed and abused by unauthorized entities. >>> >>>    The STIR architecture [RFC7340]assumes that an authority on the >> >> >> "...STIR architecture [RFC7340] assumes..." >> >> (space before "assumes") >> >> >>>    originating side of a call provides a cryptographic assurance of the >>>    validity of the calling party number in order to prevent >>>    impersonation attacks.  The STIR architecture allows extension that >> >> >> "...allows extensions..." >> >> >>>    can be utilized by authorities supporting real-time communication >>>    services using the 'Resource-Priority' header field to >>>    cryptographically sign the SIP 'Resource-Priority' header field and >>>    convey assertion of the authorization for 'Resource-Priority'.  For >>>    example, the authority on the originating side verifying the >>>    authorization of a particular communication for Resource-Priority can >> >> >> Single quotes around 'Resource-Priority'. >> >> >>>    use a PASSPorT claim to cryptographically-sign the SIP 'Resource- >> >> >> "...cryptographically sign..." >> >> >>>    Priority' header field and convey an assertion of the authorization >>>    for 'Resource-Priority'.  This will allow a receiving entity >>>    (including entities located in different network domains/boundaries) >>>    to verify the validity of assertions authorizing Resource-Priority. >> >> >> Single quotes around 'Resource-Priority'. >> >> >>>    Cryptographically-signed SIP 'Resource-Priority' headers will allow a >> >> >> "...cryptographically signed SIP 'Resource-Priority' header fields..." >> >> (remove hyphen, and replace "headers" with "header fields") >> >> >>>    receiving entity to verify and act on the information with confidence >>>    that the information have not been spoofed or compromised. >> >> >> "...has not been spoofed or compromised." >> >> >>> >>>    This specification documents an optional extension to PASSporT and >>>    the associated STIR mechanisms to provide a function to sign the SIP >>>    'Resource-Priority' header field.  This PASSporT object is used to >>>    provide attestation of a calling user authorization for priority >>>    communications.  This is necessary in addition to the PASSporT object >>>    that is used for calling user telephone number attestation.  How the >>>    optional extension to PASSporT is used for real-time communications >>>    supported using SIP 'Resource-Priority' header field is defined in >>>    other documents and is outside the scope of this document. >> >> >> I assume these other documents are under development? If so, they >> should be cited here. >> >> >>> >>> 2.  Terminology >>> >>>    The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", >>>    "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this >>>    document are to be interpreted as described in RFC 2119 [RFC2119]. >> >> >> This document has several non-normative uses of "must", "should," and >> "may," and so it needs to use the RFC8174 boilerplate instead of the >> RFC2119 boilerplate. >> >> >>> >>> 3.  PASSporT 'rph' Claim >>> >>>    This specification defines a new JSON Web Token claim for "rph", >>>    which provides an assertion for information in SIP 'Resource- >>>    Priority'header. >> >> >> "...Priority' header field." >> >> (space after closing quotation mark, "header field" instead of "header") >> >> >>> >>>    The creator of a PASSporT object adds a "ppt" value of "rph" to the >>>    header of a PASSporT object, in which case the PASSporT claims MUST >>>    contain a "rph" claim, and any entities verifying the PASSporT object >>>    will be required to understand the "ppt" extension in order to >>>    process the PASSporT in question.  A PASSPorT header with the "ppt" >>>    included will look as follows: >>> >>>    {  "typ":"passport", >>>      "ppt":"rph", >>>      "alg":"ES256", >>>      "x5u":"https://www.example.org/cert.cer"} >> >> >> Ideally, this would be either pretty-printed or canonicalized. Since >> it's too long to fit on a line in canonical form, I propose: >> >> { >>   "typ":"passport", >>   "ppt":"rph", >>   "alg":"ES256", >>   "x5u":"https://www.example.org/cert.cer" >> } >> >> >>> >>>    The "rph" claim will provide an assertion of authorization,"auth", >> >> >> "...authorization, "auth", ..." >> >> (space between comma and opening quotation mark) >> >> >>>    for information in the SIP "Resource-Priority" header field (i.e., >>>    Resource-Priority: namespace "." r-priority) based on [RFC4412]. >> >> >> The use of the string 'namespace "." r-priority' here and elsewhere >> in the document has a detrimental impact on readability. I strongly >> suggest replacing it with "r-value" (the name of this production in >> RFC4412) everywhere. >> >> >>>    Specifically, the "rph" claim includes assertion of the priority- >>>    level of the user to be used for a given communication session.  The >>>    value of the "rph" claim is an array containing one or more of JSON >>>    objects for the content of the SIP 'Resource-Priority' header that is >>>    being asserted of which one of the "rph" object, is mandatory. >> >> >> This last sentence is very hard to parse; and (based on the example) >> the value is intended to be a JSON Object (curly braces) rather than >> a JSON Array (square braces). I suggest: 'The value of the "rph" >> claim is an Object with one or more keys. Each key is associated with >> a JSON Array. These arrays contain Strings that correspond to the >> r-values indicated in the SIP "Resource-Priority" header field.' >> (note: "header field", not "header") >> >> >>> >>>    The following is an example "rph" claim for a SIP "Resource-Priority" >>>    header field with a "namespace "." r-priority" value of "ets.0" and >>>    with a "namespace "." r-priority" value of "wps.0". >>> >>>     { "orig":{"tn":"12155551212"} >>>      "dest":{["tn":"12125551213"]}, >>>      "iat":1443208345, >>>      "rph":{"auth":["ets.0","wps.0"]} >> >> >> As above, I recommend pretty-printing this. It's also missing a comma >> after the "orig" value, and the top-level structure is missing a >> closing brace. The value for "iat" needs to be enclosed in quotes. >> >> The NANPA has allocated NPA55501xx for example use, not NPA555xxxx, >> much of which remains assignable (cf >> ). >> >> Putting all this together, I believe what you want is: >> >> { >>   "orig":{"tn":"12155550112"}, >>   "dest":{["tn":"12125550113"]}, >>   "iat":"1443208345", >>   "rph":{"auth":["ets.0","wps.0"]} >> } >> >> >>> >>>    After the header and claims PASSporT objects have been constructed, >>>    their signature is generated normally per the guidance in >>>    [I-D.ietf-stir-passport] using the full form of PASSPorT.  The >>>    credentials (e.g., authority responsible for authorizing Resource- >>>    Priority) used to create the signature must have authority over the >>>    "rph" claim and there is only one authority per claim.  The authority >>>    MUST use its credentials (i.e., CERT) associated with the specific >>>    service supported by the SIP namespace in the claim. >>> >>> 4.  'rph' in SIP >>> >>>    This section specifies SIP-specific usage for the "rph" claim in >>>    PASSporT. >>> >>> 4.1.  Authentication Service Behavior >>> >>>    The Authentication Service will create the "rph" claim using the >>>    values discussed in section 3 based on [RFC4412].  The construction >>>    of "rph" claim follows the steps described in Section 4 of >>>    [I-D.ietf-stir-rfc4474bis]. >>> >>>    The resulting Identity header for "rph" might look as follows: >> >> >> "...header field..." >> >> >>> >>> "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJleUowZVhBaU9pSnd >>> ZWE56Y0c5eWRDSXNEUW9pY0hCMElqb2ljbkJvSWl3TkNpSmhiR2NpT2lKRlV6STFO >>> aUlzRFFvaWVEVjFJanBvZEhSd2N6b3ZMM2QzZHk1bGVHRnRjR3hsTG1OdmJTOWpaW >>> EowTG1ObGNuME5DZzBLIHx84oCZLuKAmXx8IGV5QWliM0pwWnlJNmV5SjBiaUk2SW >>> pFeU1UVTFOVFV4TWpFeUluME5DaUprWlhOMElqcDdXeUowYmlJNklqRXlNVEkxTlR >>> VeE1qRXpJbDE5TEEwS0ltbGhkQ0k2TVRRME16SXdPRE0wTlN3TkNpSnljR2dpT25z >>> aVlYVjBhQ0k2V3lKbGRITXVNQ0lzSW5kd2N5NHdJbDE5RFFvPSJ9.s37S6VC8HM6D >>> l6YzJeQDsrZcwJ0lizxhUrA7f_98oWBHvo-cl-n8MIhoCr18vYYFy3blXvs3fslM_ >>>    oos2P2Dyw"; info= "https://www.example.org/cert.cer";alg=ES256; >>>    ppt="rph" >> >> >> This example has a number of issues: >> >> * In the Identity header field, the signed-identity-digest >> shouldn't be quoted. >> * In the Identity header field, info is enclosed in <> rather than "". >> * In the Identity header field, ppt is a token rather than a quoted >> string. >> * The signed-identity-digest header needs to indicate a "typ" of >> "passport" rather than JWT, and it needs to include both a "ppt" >> and "x5u" field. >> * The signed-identity-digest body should contain only the passport >> claim rather than a JSON object that itself contains a >> base64-encoded JWS header concatenated with a claim. >> * I believe that, even when the body is included, values in the >> header and body need to be be canonicalized (i.e., all on one >> line, no spaces, in alphabetical order, etc.) >> >> I would also recommend following the convention of indicating that >> line-wraps are only for readability, and including the header field >> name in the example. Putting all this together, I believe what you >> want is: >> >>    For example, a Identity header field for "rph" might look >>    as follows (backslashes shown for line folding only): >> >>    Identity: eyJhbGciOiJFUzI1NiIsInBwdCI6InJwaCIsInR5cCI6InBhc3Nwb3J0I \ >> iwieDV1IjoiaHR0cHM6Ly93d3cuZXhhbXBsZS5jb20vY2VydC5jZXIifQo.eyJkZXN0 \ >> Ijp7WyJ0biI6IjEyMTI1NTUwMTEzIl19LCJpYXQiOiIxNDQzMjA4MzQ1Iiwib3JpZyI \ >> 6eyJ0biI6IjEyMTU1NTUwMTEyIn0sInJwaCI6eyJhdXRoIjpbImV0cy4wIiwid3BzLj \ >> AiXX19Cg.s37S6VC8HM6Dl6YzJeQDsrZcwJ0lizxhUrA7f_98oWBHvo-cl-n8MIhoCr \ >>    18vYYFy3blXvs3fslM_oos2P2Dyw;info=>    >;alg=ES256;ppt=rph >> >> (Note: this example assumes the calling and called party numbers in >> the previous example are changed to 12155550112 and 12155550113, >> respectively) >> >> >>> >>>    A SIP authentication service typically will derive the value of "rph" >>>    from the 'Resource-Priority' header field based on policy associated >>>    with service specific use of the "namespace "." r-priority" values >>>    based on [RFC4412].  The authentication service derives the value of >>>    the PASSPorT claim by verifying the authorization for Resource- >>>    Priority (i.e., verifying a calling user privilege for Resource- >>>    Priority based on its identity) which might be derived from customer >>>    profile data or from access to external services. >>> >>>    [RFC4412] allows multiple "namespace "." r-priority" pairs, either in >>>    a single SIP Resource-Priority header or across multiple SIP >> >> >> Single quotes around 'Resource-Priority'. >> >> "...header field..." >> >> >>>    Resource-Priority headers. However, it is not necessary to sign all >> >> >> Single quotes around 'Resource-Priority'. >> >> "...header fields..." >> >> >>>    content of a SIP Resource-Priority header or all SIP Resource- >> >> >> Single quotes around 'Resource-Priority'. >> >> "...header field..." >> >> >>>    Priority headers in a given SIP message.  An authority is only >> >> >> Single quotes around 'Resource-Priority'. >> >> "...header fields..." >> >> >>>    responsible for signing the content of a SIP Resource-Priority header >> >> >> Single quotes around 'Resource-Priority'. >> >> "...header field..." >> >> >>>    for which it has authority (e.g., a specific "namespace "." >>>    r-priority"). >>> >>> 4.2.  Verification Service Behavior >>> >>>    [I-D.ietf-stir-rfc4474bis] Section 6.2 Step 5 requires that >>>    specifications defining "ppt" values describe any additional verifier >>>    behavior.  The behavior specified for the "ppt" values of "rph" is as >>>    follows: >>> >>>    The verification service MUST extract the value associated with the >>>    "auth" key in a full form PASSPorT with a "ppt" value of "rph".  If >>>    the signature validates, then the verification service can use the >>>    value of the "rph" claim as validation that the calling party is >>>    authorized for Resource-Priority, which would in turn be used for >> >> Single quotes around 'Resource-Priority'. >> >> This text is ambiguous about whether the validation indicates that >> the calling party is authorized to use the priorities indicated in >> the passport object, or the values in the SIP 'Resource-Priority' >> header field; and (taken on its face) implies the latter, when the >> intention here should clearly be the former. >> >> "...authorized for 'Resource-Priority' indicated in the claim. This >> value would in turn be used for..." >> >> The text also needs to say something about comparing values in the >> claim to values in the 'Resource-Priority' header field, and what a >> mismatch might mean. The document says elsewhere that the signature >> might only cover some of the r-values, which makes it entirely >> possible that the 'Resource-Priority' field might contain more values >> than are signed. On the other hand, intermediaries might reasonably >> remove r-values as the call is processed. This probably means that >> those removed priorities should not be used, even if they are present >> in the passport. It seems reasonable to say that *typical* processing >> by a receiving party would be to take the *union* of all RPH >> passports that they trust, and *intersect* that with the priorities >> in 'Resource-Priority' header fields to get the actual priority or >> priorities to be applied to the call (subject to local policy). >> >> >>>    priority treatment in accordance with local policy for the associated >>>    communication service. >>> >>>    In addition, [I-D.ietf-stir-rfc4474bis] Section 6.2 Step 4 requires >>>    "iat" value in "rph" claim to be verified. >>> >>>    The behavior of a SIP UAs upon receiving an INVITE containing a >> >> >> "...of a SIP UA upon..." >> >> or >> >> "...of SIP UAs upon..." >> >> >>>    PASSporT object with a "rph" claim will largely remain a matter of >>>    implementation policy for the specific communication service.  In >>>    most cases,implementations would act based on confidence in the >> >> >> "...cases, implementations..." >> >> (space after comma) >> >> >>>    veracity of this information.  The use of the compact form of >> >> >> Paragraph break before "The". >> >> >>>    PASSporT is not specified in this document. >>> >>> 5.  Further Information Associated with Resource-Priority >> >> >> Single quotes around 'Resource-Priority'. >> >> >>> >>>    There may be additional information about the calling party or the >>>    call that could be relevant to authorization for Resource-Priority. >> >> >> Single quotes around 'Resource-Priority'. >> >> >>>    This may include information related to the device subscription of >>>    the caller, or to any institutions that the caller or device is >>>    associated with, or even categories of institutions.  All of these >>>    data elements would benefit from the secure attestations provided by >>>    the STIR and PASSporT frameworks.  The specification of the "rph" >>>    claim could entail the optional presence of one or more such >>>    additional information fields. >>> >>>    A new IANA registry has been defined to hold potential values of the >>>    "rph" array; see Section 6.2.  The definition of the "rph" claim may >>>    have one or more such additional information field(s).  Details of >>>    such "rph" claim to encompass other data elements are left for future >>>    version of this specification. >>> >>> 6.  IANA Considerations >>> >>> 6.1.  JSON Web Token Claims Registration >> >> >> I think there's some confusion here. You're registering a PASSporT >> ppt value, not a new JWT claim. That is to say, you're adding an >> entry to this table: >> >> https://www.iana.org/assignments/passport/passport.xhtml >> >> Not to this table: >> >> https://www.iana.org/assignments/jwt/jwt.xhtml >> >> You would only use the second table if you had a new key to add to >> the PASSporT header -- this specification does not do that. >> >> This section also needs some introductory text to let the IANA know >> exactly what to do; e.g. "This document registers a new value for the >> "Personal Assertion Token (PASSporT) Extensions" table. >> >>> >>>    o  ppt value: "rph" >>> >>>    o  Specification Document(s): Section 3 of [RFCThis] >>> >>> 6.2.  PASSporT 'rph' Types >>> >>>    This document requests that the IANA add a new entry to the PASSporT >>>    Types registry for the type "rph" which is specified in [RFCThis]. >> >> >> There isn't an IANA table called "PASSporT Types." I presume this is >> the registration we just discussed in section 6.1, and so the above >> two lines can be removed. >> >> >>>    This specification also requests that the IANA create a new registry >>>    for PASSporT "rph" types.  Registration of new PASSporT "rph" types >>>    shall be under the specification required policy.  This registry is >>>    to be initially populated with a single value for "auth" which is >>>    specified in [RFCThis]. >> >> >> This needs to be very clear about the fields to be included in this >> new registry (e.g., "Registry entries must contain two fields: the >> name of the 'rph' type and the specification in which the type is >> described"). >> >> >>> >>> 7.  Security Considerations >>> >>>    The security considerations discussed in [I-D.ietf-stir-rfc4474bis] >>>    in Section 10 are applicable here. >>> >>> 7.1.  Avoidance of replay and cut and paste attacks >>> >>>    The PASSporT extension with a "ppt" value of "rph" MUST only be sent >>>    with SIP INVITE when 'Resource-Priority' header is used to convey the >> >> >> "...header field..." >> >> >>>    priority of the communication as defined in [RFC4412].  To avoid the >>>    replay, and cut and paste attacks, the procedures described in >>>    Section 10.1 of [I-D.ietf-stir-rfc4474bis] MUST be followed. >>> >>> 7.2.  Solution Considerations >>> >>>    The use of extension to PASSporT tokens with "ppt" value "rph" based >>>    on the validation of the digital signature and the associated >>>    certificate requires consideration of the authentication and >>>    authority or reputation of the signer to attest to the identity being >>>    asserted.  The following considerations should be recognized when >>>    using PASSporT extension with "ppt" value of "rph": >>> >>>    o  An authority (signer) is only allowed to sign the content of a SIP >>>       'Resource-Priority' header for which it has the right authority. >> >> >> "...header field..." >> >> >>>       The authority that signs the token MUST have a secure method for >>>       authentication of the end user or the device. >>> >>>    o  The verification of the signature MUST include means of verifying >>>       that the signer is authoritative for the signed content of the SIP >> >> >> It's not clear what authority is being claimed here. Is this supposed >> to mean something like "...verifying that the signer is authoritative >> for the originating tn in the PASSporT..."? Or "...authoritative for >> the resource priority namespace in the PASSporT?" Whatever the server >> is purportedly authoritative for needs to be clearly spelled out. >> >> >>>       'Resource-Priority' header. >> >> >> "...header field." >> >> >> /a >> _______________________________________________ >> stir mailing list >> stir@ietf.org >> https://www.ietf.org/mailman/listinfo/stir --------------62830854E7F9021A25F4898C Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
The -divert- document needs to co-exist with "ppt" extensions in general, and I would be very sad if its design required additional considerations in each such extension. What kind of impact are you envisioning?

/a

On 1/20/18 5:34 PM, Christer Holmberg wrote:
Hi,

Do the nesting discussions affect this extension? I assume one could use this with other passports.

Regards,

Christer 

Sent from my iPhone

On 20 Jan 2018, at 0.15, Adam Roach <adam@nostrum.com> wrote:

I'm doing my AD review of draft-ietf-stir-rph-02. Thanks to everyone who has worked on this document, and the authors and chairs in particular.

The technical content here looks generally good to me. I'd like to see a few issues addressed before IETF LC. In short sumary:

  • The validation section needs to add a discussion of how to treat calls when the priority values in "rph" passports and SIP "Resource-Priority" header fields aren't 100% identical.
  • The examples need some adjustment.
  • There is a minor point of ambiguity in the Security Section, but this should be easy to fix, as long as the WG knows what was intended.
  • The IANA actions need a little bit of adjustment.
  • There are a number of minor editorial issues to be cleaned up.

Detailed comments on these points are inline in the document below. I've removed some portions of the document on which I have no comments.



Abstract

   This document extends the STIR PASSporT specification to allow the


"...the Secure Telephone Identity Revisited (STIR) Personal Assertion Token (PASSporT) specification defined in RFC 8122..."

(See <https://www.rfc-editor.org/materials/abbrev.expansion.txt> for guidance on abbreviations)


   inclusion of cryptographically-signed assertions of authorization for
   the values populated in the SIP 'Resource-Priority' header field,
   which is used for communications resource prioritization.

...

1.  Introduction

   PASSporT [I-D.ietf-stir-passport] is a token format based on JWT
   [RFC7519] for conveying cryptographically-signed information about
   the identities involved in personal communications; it is used with
   STIR [I-D.ietf-stir-rfc4474bis] to convey a signed assertion of the
   identity of the participants in real-time communications established
   via a protocol like SIP.  This specification extends PASSporT to


"...like SIP [RFC3261]..."

(We want to cite SIP the first time it is mentioned)


   allow cryptographic-signing of the SIP 'Resource-Priority' header
   field defined in [RFC4412].

   [RFC4412] defines the SIP 'Resource-Priority' header field for
   communications Resource Priority.  As specified in [RFC4412], the
   'Resource-Priority' header field may be used by SIP user agents
   [RFC3261], including, Public Switched Telephone Network (PSTN)


"...including Public Switched..."

(remove the comma)


   gateways and terminals, and SIP proxy servers to influence


"...and by SIP proxy servers, to influence..."

(add "by" and comma)


   prioritization afforded to communication sessions,including PSTN

"...sessions, including..."

(space after comma)


   calls.  However, the SIP 'Resource-Priority' header field could be
   spoofed and abused by unauthorized entities.

   The STIR architecture [RFC7340]assumes that an authority on the


"...STIR architecture [RFC7340] assumes..."

(space before "assumes")


   originating side of a call provides a cryptographic assurance of the
   validity of the calling party number in order to prevent
   impersonation attacks.  The STIR architecture allows extension that


"...allows extensions..."


   can be utilized by authorities supporting real-time communication
   services using the 'Resource-Priority' header field to
   cryptographically sign the SIP 'Resource-Priority' header field and
   convey assertion of the authorization for 'Resource-Priority'.  For
   example, the authority on the originating side verifying the
   authorization of a particular communication for Resource-Priority can


Single quotes around 'Resource-Priority'.


   use a PASSPorT claim to cryptographically-sign the SIP 'Resource-


"...cryptographically sign..."


   Priority' header field and convey an assertion of the authorization
   for 'Resource-Priority'.  This will allow a receiving entity
   (including entities located in different network domains/boundaries)
   to verify the validity of assertions authorizing Resource-Priority.


Single quotes around 'Resource-Priority'.


   Cryptographically-signed SIP 'Resource-Priority' headers will allow a


"...cryptographically signed SIP 'Resource-Priority' header fields..."

(remove hyphen, and replace "headers" with "header fields")


   receiving entity to verify and act on the information with confidence
   that the information have not been spoofed or compromised.


"...has not been spoofed or compromised."



   This specification documents an optional extension to PASSporT and
   the associated STIR mechanisms to provide a function to sign the SIP
   'Resource-Priority' header field.  This PASSporT object is used to
   provide attestation of a calling user authorization for priority
   communications.  This is necessary in addition to the PASSporT object
   that is used for calling user telephone number attestation.  How the
   optional extension to PASSporT is used for real-time communications
   supported using SIP 'Resource-Priority' header field is defined in
   other documents and is outside the scope of this document.


I assume these other documents are under development? If so, they should be cited here.



2.  Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in RFC 2119 [RFC2119].


This document has several non-normative uses of "must", "should," and "may," and so it needs to use the RFC8174 boilerplate instead of the RFC2119 boilerplate.



3.  PASSporT 'rph' Claim

   This specification defines a new JSON Web Token claim for "rph",
   which provides an assertion for information in SIP 'Resource-
   Priority'header.


"...Priority' header field."

(space after closing quotation mark, "header field" instead of "header")



   The creator of a PASSporT object adds a "ppt" value of "rph" to the
   header of a PASSporT object, in which case the PASSporT claims MUST
   contain a "rph" claim, and any entities verifying the PASSporT object
   will be required to understand the "ppt" extension in order to
   process the PASSporT in question.  A PASSPorT header with the "ppt"
   included will look as follows:

   {  "typ":"passport",
     "ppt":"rph",
     "alg":"ES256",
     "x5u":"https://www.example.org/cert.cer"}


Ideally, this would be either pretty-printed or canonicalized. Since it's too long to fit on a line in canonical form, I propose:

{
  "typ":"passport",
  "ppt":"rph",
  "alg":"ES256",
  "x5u":"https://www.example.org/cert.cer"
}



   The "rph" claim will provide an assertion of authorization,"auth",


"...authorization, "auth", ..."

(space between comma and opening quotation mark)


   for information in the SIP "Resource-Priority" header field (i.e.,
   Resource-Priority: namespace "." r-priority) based on [RFC4412].


The use of the string 'namespace "." r-priority' here and elsewhere in the document has a detrimental impact on readability. I strongly suggest replacing it with "r-value" (the name of this production in RFC4412) everywhere.


   Specifically, the "rph" claim includes assertion of the priority-
   level of the user to be used for a given communication session.  The
   value of the "rph" claim is an array containing one or more of JSON
   objects for the content of the SIP 'Resource-Priority' header that is
   being asserted of which one of the "rph" object, is mandatory.


This last sentence is very hard to parse; and (based on the example) the value is intended to be a JSON Object (curly braces) rather than a JSON Array (square braces). I suggest: 'The value of the "rph" claim is an Object with one or more keys. Each key is associated with a JSON Array. These arrays contain Strings that correspond to the r-values indicated in the SIP "Resource-Priority" header field.' (note: "header field", not "header")



   The following is an example "rph" claim for a SIP "Resource-Priority"
   header field with a "namespace "." r-priority" value of "ets.0" and
   with a "namespace "." r-priority" value of "wps.0".

    { "orig":{"tn":"12155551212"}
     "dest":{["tn":"12125551213"]},
     "iat":1443208345,
     "rph":{"auth":["ets.0","wps.0"]}


As above, I recommend pretty-printing this. It's also missing a comma after the "orig" value, and the top-level structure is missing a closing brace. The value for "iat" needs to be enclosed in quotes.

The NANPA has allocated NPA55501xx for example use, not NPA555xxxx, much of which remains assignable (cf <https://www.nationalnanpa.com/pdf/NRUF/ATIS-0300115.pdf>).

Putting all this together, I believe what you want is:

{
  "orig":{"tn":"12155550112"},
  "dest":{["tn":"12125550113"]},
  "iat":"1443208345",
  "rph":{"auth":["ets.0","wps.0"]}
}



   After the header and claims PASSporT objects have been constructed,
   their signature is generated normally per the guidance in
   [I-D.ietf-stir-passport] using the full form of PASSPorT.  The
   credentials (e.g., authority responsible for authorizing Resource-
   Priority) used to create the signature must have authority over the
   "rph" claim and there is only one authority per claim.  The authority
   MUST use its credentials (i.e., CERT) associated with the specific
   service supported by the SIP namespace in the claim.

4.  'rph' in SIP

   This section specifies SIP-specific usage for the "rph" claim in
   PASSporT.

4.1.  Authentication Service Behavior

   The Authentication Service will create the "rph" claim using the
   values discussed in section 3 based on [RFC4412].  The construction
   of "rph" claim follows the steps described in Section 4 of
   [I-D.ietf-stir-rfc4474bis].

   The resulting Identity header for "rph" might look as follows:


"...header field..."



   "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJleUowZVhBaU9pSnd
   ZWE56Y0c5eWRDSXNEUW9pY0hCMElqb2ljbkJvSWl3TkNpSmhiR2NpT2lKRlV6STFO
   aUlzRFFvaWVEVjFJanBvZEhSd2N6b3ZMM2QzZHk1bGVHRnRjR3hsTG1OdmJTOWpaW
   EowTG1ObGNuME5DZzBLIHx84oCZLuKAmXx8IGV5QWliM0pwWnlJNmV5SjBiaUk2SW
   pFeU1UVTFOVFV4TWpFeUluME5DaUprWlhOMElqcDdXeUowYmlJNklqRXlNVEkxTlR
   VeE1qRXpJbDE5TEEwS0ltbGhkQ0k2TVRRME16SXdPRE0wTlN3TkNpSnljR2dpT25z
   aVlYVjBhQ0k2V3lKbGRITXVNQ0lzSW5kd2N5NHdJbDE5RFFvPSJ9.s37S6VC8HM6D
   l6YzJeQDsrZcwJ0lizxhUrA7f_98oWBHvo-cl-n8MIhoCr18vYYFy3blXvs3fslM_
   oos2P2Dyw"; info= "https://www.example.org/cert.cer";alg=ES256;
   ppt="rph"


This example has a number of issues:

  • In the Identity header field, the signed-identity-digest shouldn't be quoted.
  • In the Identity header field, info is enclosed in <> rather than "".
  • In the Identity header field, ppt is a token rather than a quoted string.
  • The signed-identity-digest header needs to indicate a "typ" of "passport" rather than JWT, and it needs to include both a "ppt" and "x5u" field.
  • The signed-identity-digest body should contain only the passport claim rather than a JSON object that itself contains a base64-encoded JWS header concatenated with a claim.
  • I believe that, even when the body is included, values in the header and body need to be be canonicalized (i.e., all on one line, no spaces, in alphabetical order, etc.)

I would also recommend following the convention of indicating that line-wraps are only for readability, and including the header field name in the example. Putting all this together, I believe what you want is:

   For example, a Identity header field for "rph" might look
   as follows (backslashes shown for line folding only):

   Identity: eyJhbGciOiJFUzI1NiIsInBwdCI6InJwaCIsInR5cCI6InBhc3Nwb3J0I \
   iwieDV1IjoiaHR0cHM6Ly93d3cuZXhhbXBsZS5jb20vY2VydC5jZXIifQo.eyJkZXN0 \
   Ijp7WyJ0biI6IjEyMTI1NTUwMTEzIl19LCJpYXQiOiIxNDQzMjA4MzQ1Iiwib3JpZyI \
   6eyJ0biI6IjEyMTU1NTUwMTEyIn0sInJwaCI6eyJhdXRoIjpbImV0cy4wIiwid3BzLj \
   AiXX19Cg.s37S6VC8HM6Dl6YzJeQDsrZcwJ0lizxhUrA7f_98oWBHvo-cl-n8MIhoCr \
   18vYYFy3blXvs3fslM_oos2P2Dyw;info=<https://www.example.org/cert.cer \
   >;alg=ES256;ppt=rph

(Note: this example assumes the calling and called party numbers in the previous example are changed to 12155550112 and 12155550113, respectively)



   A SIP authentication service typically will derive the value of "rph"
   from the 'Resource-Priority' header field based on policy associated
   with service specific use of the "namespace "." r-priority" values
   based on [RFC4412].  The authentication service derives the value of
   the PASSPorT claim by verifying the authorization for Resource-
   Priority (i.e., verifying a calling user privilege for Resource-
   Priority based on its identity) which might be derived from customer
   profile data or from access to external services.

   [RFC4412] allows multiple "namespace "." r-priority" pairs, either in
   a single SIP Resource-Priority header or across multiple SIP


Single quotes around 'Resource-Priority'.

"...header field..."


   Resource-Priority headers.  However, it is not necessary to sign all


Single quotes around 'Resource-Priority'.

"...header fields..."


   content of a SIP Resource-Priority header or all SIP Resource-


Single quotes around 'Resource-Priority'.

"...header field..."


   Priority headers in a given SIP message.  An authority is only


Single quotes around 'Resource-Priority'.

"...header fields..."


   responsible for signing the content of a SIP Resource-Priority header


Single quotes around 'Resource-Priority'.

"...header field..."


   for which it has authority (e.g., a specific "namespace "."
   r-priority").

4.2.  Verification Service Behavior

   [I-D.ietf-stir-rfc4474bis] Section 6.2 Step 5 requires that
   specifications defining "ppt" values describe any additional verifier
   behavior.  The behavior specified for the "ppt" values of "rph" is as
   follows:

   The verification service MUST extract the value associated with the
   "auth" key in a full form PASSPorT with a "ppt" value of "rph".  If
   the signature validates, then the verification service can use the
   value of the "rph" claim as validation that the calling party is
   authorized for Resource-Priority, which would in turn be used for

Single quotes around 'Resource-Priority'.

This text is ambiguous about whether the validation indicates that the calling party is authorized to use the priorities indicated in the passport object, or the values in the SIP 'Resource-Priority' header field; and (taken on its face) implies the latter, when the intention here should clearly be the former.

"...authorized for 'Resource-Priority' indicated in the claim. This value would in turn be used for..."

The text also needs to say something about comparing values in the claim to values in the 'Resource-Priority' header field, and what a mismatch might mean. The document says elsewhere that the signature might only cover some of the r-values, which makes it entirely possible that the 'Resource-Priority' field might contain more values than are signed. On the other hand, intermediaries might reasonably remove r-values as the call is processed. This probably means that those removed priorities should not be used, even if they are present in the passport. It seems reasonable to say that *typical* processing by a receiving party would be to take the *union* of all RPH passports that they trust, and *intersect* that with the priorities in 'Resource-Priority' header fields to get the actual priority or priorities to be applied to the call (subject to local policy).


   priority treatment in accordance with local policy for the associated
   communication service.

   In addition, [I-D.ietf-stir-rfc4474bis] Section 6.2 Step 4 requires
   "iat" value in "rph" claim to be verified.

   The behavior of a SIP UAs upon receiving an INVITE containing a


"...of a SIP UA upon..."

or

"...of SIP UAs upon..."


   PASSporT object with a "rph" claim will largely remain a matter of
   implementation policy for the specific communication service.  In
   most cases,implementations would act based on confidence in the


"...cases, implementations..."

(space after comma)


   veracity of this information.  The use of the compact form of


Paragraph break before "The".


   PASSporT is not specified in this document.

5.  Further Information Associated with Resource-Priority


Single quotes around 'Resource-Priority'.



   There may be additional information about the calling party or the
   call that could be relevant to authorization for Resource-Priority.


Single quotes around 'Resource-Priority'.


   This may include information related to the device subscription of
   the caller, or to any institutions that the caller or device is
   associated with, or even categories of institutions.  All of these
   data elements would benefit from the secure attestations provided by
   the STIR and PASSporT frameworks.  The specification of the "rph"
   claim could entail the optional presence of one or more such
   additional information fields.

   A new IANA registry has been defined to hold potential values of the
   "rph" array; see Section 6.2.  The definition of the "rph" claim may
   have one or more such additional information field(s).  Details of
   such "rph" claim to encompass other data elements are left for future
   version of this specification.

6.  IANA Considerations

6.1.  JSON Web Token Claims Registration


I think there's some confusion here. You're registering a PASSporT ppt value, not a new JWT claim. That is to say, you're adding an entry to this table:

https://www.iana.org/assignments/passport/passport.xhtml

Not to this table:

https://www.iana.org/assignments/jwt/jwt.xhtml

You would only use the second table if you had a new key to add to the PASSporT header -- this specification does not do that.

This section also needs some introductory text to let the IANA know exactly what to do; e.g. "This document registers a new value for the "Personal Assertion Token (PASSporT) Extensions" table.


   o  ppt value: "rph"

   o  Specification Document(s): Section 3 of [RFCThis]

6.2.  PASSporT 'rph' Types

   This document requests that the IANA add a new entry to the PASSporT
   Types registry for the type "rph" which is specified in [RFCThis].


There isn't an IANA table called "PASSporT Types." I presume this is the registration we just discussed in section 6.1, and so the above two lines can be removed.


   This specification also requests that the IANA create a new registry
   for PASSporT "rph" types.  Registration of new PASSporT "rph" types
   shall be under the specification required policy.  This registry is
   to be initially populated with a single value for "auth" which is
   specified in [RFCThis].


This needs to be very clear about the fields to be included in this new registry (e.g., "Registry entries must contain two fields: the name of the 'rph' type and the specification in which the type is described").



7.  Security Considerations

   The security considerations discussed in [I-D.ietf-stir-rfc4474bis]
   in Section 10 are applicable here.

7.1.  Avoidance of replay and cut and paste attacks

   The PASSporT extension with a "ppt" value of "rph" MUST only be sent
   with SIP INVITE when 'Resource-Priority' header is used to convey the


"...header field..."


   priority of the communication as defined in [RFC4412].  To avoid the
   replay, and cut and paste attacks, the procedures described in
   Section 10.1 of [I-D.ietf-stir-rfc4474bis] MUST be followed.

7.2.  Solution Considerations

   The use of extension to PASSporT tokens with "ppt" value "rph" based
   on the validation of the digital signature and the associated
   certificate requires consideration of the authentication and
   authority or reputation of the signer to attest to the identity being
   asserted.  The following considerations should be recognized when
   using PASSporT extension with "ppt" value of "rph":

   o  An authority (signer) is only allowed to sign the content of a SIP
      'Resource-Priority' header for which it has the right authority.


"...header field..."


      The authority that signs the token MUST have a secure method for
      authentication of the end user or the device.

   o  The verification of the signature MUST include means of verifying
      that the signer is authoritative for the signed content of the SIP


It's not clear what authority is being claimed here. Is this supposed to mean something like "...verifying that the signer is authoritative for the originating tn in the PASSporT..."? Or "...authoritative for the resource priority namespace in the PASSporT?" Whatever the server is purportedly authoritative for needs to be clearly spelled out.


      'Resource-Priority' header.


"...header field."


/a
_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir


--------------62830854E7F9021A25F4898C-- From nobody Mon Jan 22 10:47:56 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D87E412D77A; Mon, 22 Jan 2018 10:47:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5UMiEYaSzM7Z; Mon, 22 Jan 2018 10:47:44 -0800 (PST) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ACCC812AF84; Mon, 22 Jan 2018 10:47:42 -0800 (PST) X-AuditID: c1b4fb2d-f179c9c000007932-6d-5a6631cc539a Received: from ESESSHC023.ericsson.se (Unknown_Domain [153.88.183.87]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id C7.BB.31026.CC1366A5; Mon, 22 Jan 2018 19:47:41 +0100 (CET) Received: from ESESSMB109.ericsson.se ([169.254.9.195]) by ESESSHC023.ericsson.se ([153.88.183.87]) with mapi id 14.03.0352.000; Mon, 22 Jan 2018 19:46:46 +0100 From: Christer Holmberg To: Adam Roach CC: STIR Chairs , "stir@ietf.org" , "draft-ietf-stir-rph.all@tools.ietf.org" Thread-Topic: [stir] AD Review: draft-ietf-stir-rph-02 Thread-Index: AQHTkXL/9PfnEwzuiEC0gXYu7h5lh6N9a2h7gAKdpYCAADQToA== Date: Mon, 22 Jan 2018 18:46:46 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B6C134AE5@ESESSMB109.ericsson.se> References: <8632F2B7-931B-47D8-B892-3DFF9AD02F0D@ericsson.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.154] Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B6C134AE5ESESSMB109erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrCIsWRmVeSWpSXmKPExsUyM2J7uO5Zw7Qog7cnGS32/F3EbrH6+Dkm i2c71rNaLF+7jcmBxWPJkp9MHrN2PmHx+HL5M1sAcxSXTUpqTmZZapG+XQJXxuNPHAWrprNV PDyS3cD4oYmti5GTQ0LARGLThg1MXYxcHEIChxklVp17xw7hLGGUuPj4AnMXIwcHm4CFRPc/ bZAGEQFFibbDN5lBapgF5jFK3P+/hAkkISxgKrFl4nlGiCIzifurGpggbCeJlx+/g21jEVCV OPduBzuIzSvgK7GjZycLxLKVjBK/Tq9lBUlwCthLzF5xnwXEZhQQk/h+ag3YIGYBcYlbT+Yz QZwtILFkz3lmCFtU4uXjf6wQtpLEotufoerzJbafW88MsUxQ4uTMJywTGEVmIRk1C0nZLCRl s4B+ZhbQlFi/Sx+iRFFiSvdDdghbQ6J1zlx2ZPEFjOyrGEWLU4uLc9ONjPVSizKTi4vz8/Ty Uks2MQLj7uCW37o7GFe/djzEKMDBqMTDO0s4LUqINbGsuDL3EKMEB7OSCG/aitQoId6UxMqq 1KL8+KLSnNTiQ4zSHCxK4rwnPXmjhATSE0tSs1NTC1KLYLJMHJxSDYysDUpezEf69Xknp62T E/VmsfK0cjZ4Pifk7uecwPZkDXWfLTrX3A7+ZCpgrd07abfapRULU4P3GV6tbNohGPjva56p 4+OJKwRaTp9jN2M4nqAj6JMntHGKPrvHUVvjpCVVP+NEFTewyf2c8KHpzB5Lkadnnq1982Ti VbNAjqLZl1I1ClY9ua7EUpyRaKjFXFScCABBEk1OtwIAAA== Archived-At: Subject: Re: [stir] AD Review: draft-ietf-stir-rph-02 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jan 2018 18:47:53 -0000 --_000_7594FB04B1934943A5C02806D1A2204B6C134AE5ESESSMB109erics_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGksDQoNCj5UaGUgLWRpdmVydC0gZG9jdW1lbnQgbmVlZHMgdG8gY28tZXhpc3Qgd2l0aCAicHB0 IiBleHRlbnNpb25zIGluIGdlbmVyYWwsIGFuZCBJIHdvdWxkIGJlIHZlcnkNCj4gc2FkIGlmIGl0 cyBkZXNpZ24gcmVxdWlyZWQgYWRkaXRpb25hbCBjb25zaWRlcmF0aW9ucyBpbiBlYWNoIHN1Y2gg ZXh0ZW5zaW9uLiBXaGF0IGtpbmQgb2YgaW1wYWN0IGFyZSB5b3UgZW52aXNpb25pbmc/DQoNCkkg d29uZGVyIGlmIHRoZSBwcm9ibGVtKHMpIHdpdGggdXNpbmcgbXVsdGlwbGUgSWRlbnRpdHkgaGVh ZGVyIGZpZWxkcyBhcmUgZGl2ZXJ0LXNwZWNpZmljLCBvciBpZiB0aGV5IGFsc28gYXBwbHkgdG8g b3RoZXIgcGFzc3BvcnQgZXh0ZW5zaW9ucy4NCg0KKFRoZXJlIGFyZSBnZW5lcmljIGlzc3VlcyB3 aXRoIHRoZSBzdWdnZXN0ZWQgbmVzdGluZyBtZWNoYW5pc20sIG1vc3Qgb2Ygd2hpY2ggd2VyZSBy YWlzZWQgYnkgbXkgY29sbGVhZ3VlIEp1bGlvLCBidXQgdGhhdOKAmXMgYSBzZXBhcmF0ZSB0aHJl YWQpDQoNClJlZ2FyZHMsDQoNCkNocmlzdGVyDQoNCg0KDQpPbiAxLzIwLzE4IDU6MzQgUE0sIENo cmlzdGVyIEhvbG1iZXJnIHdyb3RlOg0KSGksDQoNCkRvIHRoZSBuZXN0aW5nIGRpc2N1c3Npb25z IGFmZmVjdCB0aGlzIGV4dGVuc2lvbj8gSSBhc3N1bWUgb25lIGNvdWxkIHVzZSB0aGlzIHdpdGgg b3RoZXIgcGFzc3BvcnRzLg0KDQpSZWdhcmRzLA0KDQpDaHJpc3Rlcg0KU2VudCBmcm9tIG15IGlQ aG9uZQ0KDQpPbiAyMCBKYW4gMjAxOCwgYXQgMC4xNSwgQWRhbSBSb2FjaCA8YWRhbUBub3N0cnVt LmNvbTxtYWlsdG86YWRhbUBub3N0cnVtLmNvbT4+IHdyb3RlOg0KDQpJJ20gZG9pbmcgbXkgQUQg cmV2aWV3IG9mIGRyYWZ0LWlldGYtc3Rpci1ycGgtMDIuIFRoYW5rcyB0byBldmVyeW9uZSB3aG8g aGFzIHdvcmtlZCBvbiB0aGlzIGRvY3VtZW50LCBhbmQgdGhlIGF1dGhvcnMgYW5kIGNoYWlycyBp biBwYXJ0aWN1bGFyLg0KDQpUaGUgdGVjaG5pY2FsIGNvbnRlbnQgaGVyZSBsb29rcyBnZW5lcmFs bHkgZ29vZCB0byBtZS4gSSdkIGxpa2UgdG8gc2VlIGEgZmV3IGlzc3VlcyBhZGRyZXNzZWQgYmVm b3JlIElFVEYgTEMuIEluIHNob3J0IHN1bWFyeToNCg0KICAqICAgVGhlIHZhbGlkYXRpb24gc2Vj dGlvbiBuZWVkcyB0byBhZGQgYSBkaXNjdXNzaW9uIG9mIGhvdyB0byB0cmVhdCBjYWxscyB3aGVu IHRoZSBwcmlvcml0eSB2YWx1ZXMgaW4gInJwaCIgcGFzc3BvcnRzIGFuZCBTSVAgIlJlc291cmNl LVByaW9yaXR5IiBoZWFkZXIgZmllbGRzIGFyZW4ndCAxMDAlIGlkZW50aWNhbC4NCiAgKiAgIFRo ZSBleGFtcGxlcyBuZWVkIHNvbWUgYWRqdXN0bWVudC4NCiAgKiAgIFRoZXJlIGlzIGEgbWlub3Ig cG9pbnQgb2YgYW1iaWd1aXR5IGluIHRoZSBTZWN1cml0eSBTZWN0aW9uLCBidXQgdGhpcyBzaG91 bGQgYmUgZWFzeSB0byBmaXgsIGFzIGxvbmcgYXMgdGhlIFdHIGtub3dzIHdoYXQgd2FzIGludGVu ZGVkLg0KICAqICAgVGhlIElBTkEgYWN0aW9ucyBuZWVkIGEgbGl0dGxlIGJpdCBvZiBhZGp1c3Rt ZW50Lg0KICAqICAgVGhlcmUgYXJlIGEgbnVtYmVyIG9mIG1pbm9yIGVkaXRvcmlhbCBpc3N1ZXMg dG8gYmUgY2xlYW5lZCB1cC4NCg0KRGV0YWlsZWQgY29tbWVudHMgb24gdGhlc2UgcG9pbnRzIGFy ZSBpbmxpbmUgaW4gdGhlIGRvY3VtZW50IGJlbG93LiBJJ3ZlIHJlbW92ZWQgc29tZSBwb3J0aW9u cyBvZiB0aGUgZG9jdW1lbnQgb24gd2hpY2ggSSBoYXZlIG5vIGNvbW1lbnRzLg0KDQoNCg0KQWJz dHJhY3QNCg0KICAgVGhpcyBkb2N1bWVudCBleHRlbmRzIHRoZSBTVElSIFBBU1Nwb3JUIHNwZWNp ZmljYXRpb24gdG8gYWxsb3cgdGhlDQoNCg0KDQoiLi4udGhlIFNlY3VyZSBUZWxlcGhvbmUgSWRl bnRpdHkgUmV2aXNpdGVkIChTVElSKSBQZXJzb25hbCBBc3NlcnRpb24gVG9rZW4gKFBBU1Nwb3JU KSBzcGVjaWZpY2F0aW9uIGRlZmluZWQgaW4gUkZDIDgxMjIuLi4iDQoNCihTZWUgPGh0dHBzOi8v d3d3LnJmYy1lZGl0b3Iub3JnL21hdGVyaWFscy9hYmJyZXYuZXhwYW5zaW9uLnR4dD48aHR0cHM6 Ly93d3cucmZjLWVkaXRvci5vcmcvbWF0ZXJpYWxzL2FiYnJldi5leHBhbnNpb24udHh0PiBmb3Ig Z3VpZGFuY2Ugb24gYWJicmV2aWF0aW9ucykNCg0KDQogICBpbmNsdXNpb24gb2YgY3J5cHRvZ3Jh cGhpY2FsbHktc2lnbmVkIGFzc2VydGlvbnMgb2YgYXV0aG9yaXphdGlvbiBmb3INCiAgIHRoZSB2 YWx1ZXMgcG9wdWxhdGVkIGluIHRoZSBTSVAgJ1Jlc291cmNlLVByaW9yaXR5JyBoZWFkZXIgZmll bGQsDQogICB3aGljaCBpcyB1c2VkIGZvciBjb21tdW5pY2F0aW9ucyByZXNvdXJjZSBwcmlvcml0 aXphdGlvbi4NCg0KLi4uDQoNCjEuICBJbnRyb2R1Y3Rpb24NCg0KICAgUEFTU3BvclQgW0ktRC5p ZXRmLXN0aXItcGFzc3BvcnRdIGlzIGEgdG9rZW4gZm9ybWF0IGJhc2VkIG9uIEpXVA0KICAgW1JG Qzc1MTldIGZvciBjb252ZXlpbmcgY3J5cHRvZ3JhcGhpY2FsbHktc2lnbmVkIGluZm9ybWF0aW9u IGFib3V0DQogICB0aGUgaWRlbnRpdGllcyBpbnZvbHZlZCBpbiBwZXJzb25hbCBjb21tdW5pY2F0 aW9uczsgaXQgaXMgdXNlZCB3aXRoDQogICBTVElSIFtJLUQuaWV0Zi1zdGlyLXJmYzQ0NzRiaXNd IHRvIGNvbnZleSBhIHNpZ25lZCBhc3NlcnRpb24gb2YgdGhlDQogICBpZGVudGl0eSBvZiB0aGUg cGFydGljaXBhbnRzIGluIHJlYWwtdGltZSBjb21tdW5pY2F0aW9ucyBlc3RhYmxpc2hlZA0KICAg dmlhIGEgcHJvdG9jb2wgbGlrZSBTSVAuICBUaGlzIHNwZWNpZmljYXRpb24gZXh0ZW5kcyBQQVNT cG9yVCB0bw0KDQoNCg0KIi4uLmxpa2UgU0lQIFtSRkMzMjYxXS4uLiINCg0KKFdlIHdhbnQgdG8g Y2l0ZSBTSVAgdGhlIGZpcnN0IHRpbWUgaXQgaXMgbWVudGlvbmVkKQ0KDQoNCiAgIGFsbG93IGNy eXB0b2dyYXBoaWMtc2lnbmluZyBvZiB0aGUgU0lQICdSZXNvdXJjZS1Qcmlvcml0eScgaGVhZGVy DQogICBmaWVsZCBkZWZpbmVkIGluIFtSRkM0NDEyXS4NCg0KICAgW1JGQzQ0MTJdIGRlZmluZXMg dGhlIFNJUCAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlciBmaWVsZCBmb3INCiAgIGNvbW11bmlj YXRpb25zIFJlc291cmNlIFByaW9yaXR5LiAgQXMgc3BlY2lmaWVkIGluIFtSRkM0NDEyXSwgdGhl DQogICAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlciBmaWVsZCBtYXkgYmUgdXNlZCBieSBTSVAg dXNlciBhZ2VudHMNCiAgIFtSRkMzMjYxXSwgaW5jbHVkaW5nLCBQdWJsaWMgU3dpdGNoZWQgVGVs ZXBob25lIE5ldHdvcmsgKFBTVE4pDQoNCg0KDQoiLi4uaW5jbHVkaW5nIFB1YmxpYyBTd2l0Y2hl ZC4uLiINCg0KKHJlbW92ZSB0aGUgY29tbWEpDQoNCg0KICAgZ2F0ZXdheXMgYW5kIHRlcm1pbmFs cywgYW5kIFNJUCBwcm94eSBzZXJ2ZXJzIHRvIGluZmx1ZW5jZQ0KDQoNCg0KIi4uLmFuZCBieSBT SVAgcHJveHkgc2VydmVycywgdG8gaW5mbHVlbmNlLi4uIg0KDQooYWRkICJieSIgYW5kIGNvbW1h KQ0KDQoNCiAgIHByaW9yaXRpemF0aW9uIGFmZm9yZGVkIHRvIGNvbW11bmljYXRpb24gc2Vzc2lv bnMsaW5jbHVkaW5nIFBTVE4NCg0KDQoiLi4uc2Vzc2lvbnMsIGluY2x1ZGluZy4uLiINCg0KKHNw YWNlIGFmdGVyIGNvbW1hKQ0KDQoNCiAgIGNhbGxzLiAgSG93ZXZlciwgdGhlIFNJUCAnUmVzb3Vy Y2UtUHJpb3JpdHknIGhlYWRlciBmaWVsZCBjb3VsZCBiZQ0KICAgc3Bvb2ZlZCBhbmQgYWJ1c2Vk IGJ5IHVuYXV0aG9yaXplZCBlbnRpdGllcy4NCg0KICAgVGhlIFNUSVIgYXJjaGl0ZWN0dXJlIFtS RkM3MzQwXWFzc3VtZXMgdGhhdCBhbiBhdXRob3JpdHkgb24gdGhlDQoNCg0KDQoiLi4uU1RJUiBh cmNoaXRlY3R1cmUgW1JGQzczNDBdIGFzc3VtZXMuLi4iDQoNCihzcGFjZSBiZWZvcmUgImFzc3Vt ZXMiKQ0KDQoNCiAgIG9yaWdpbmF0aW5nIHNpZGUgb2YgYSBjYWxsIHByb3ZpZGVzIGEgY3J5cHRv Z3JhcGhpYyBhc3N1cmFuY2Ugb2YgdGhlDQogICB2YWxpZGl0eSBvZiB0aGUgY2FsbGluZyBwYXJ0 eSBudW1iZXIgaW4gb3JkZXIgdG8gcHJldmVudA0KICAgaW1wZXJzb25hdGlvbiBhdHRhY2tzLiAg VGhlIFNUSVIgYXJjaGl0ZWN0dXJlIGFsbG93cyBleHRlbnNpb24gdGhhdA0KDQoNCg0KIi4uLmFs bG93cyBleHRlbnNpb25zLi4uIg0KDQoNCiAgIGNhbiBiZSB1dGlsaXplZCBieSBhdXRob3JpdGll cyBzdXBwb3J0aW5nIHJlYWwtdGltZSBjb21tdW5pY2F0aW9uDQogICBzZXJ2aWNlcyB1c2luZyB0 aGUgJ1Jlc291cmNlLVByaW9yaXR5JyBoZWFkZXIgZmllbGQgdG8NCiAgIGNyeXB0b2dyYXBoaWNh bGx5IHNpZ24gdGhlIFNJUCAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlciBmaWVsZCBhbmQNCiAg IGNvbnZleSBhc3NlcnRpb24gb2YgdGhlIGF1dGhvcml6YXRpb24gZm9yICdSZXNvdXJjZS1Qcmlv cml0eScuICBGb3INCiAgIGV4YW1wbGUsIHRoZSBhdXRob3JpdHkgb24gdGhlIG9yaWdpbmF0aW5n IHNpZGUgdmVyaWZ5aW5nIHRoZQ0KICAgYXV0aG9yaXphdGlvbiBvZiBhIHBhcnRpY3VsYXIgY29t bXVuaWNhdGlvbiBmb3IgUmVzb3VyY2UtUHJpb3JpdHkgY2FuDQoNCg0KDQpTaW5nbGUgcXVvdGVz IGFyb3VuZCAnUmVzb3VyY2UtUHJpb3JpdHknLg0KDQoNCiAgIHVzZSBhIFBBU1NQb3JUIGNsYWlt IHRvIGNyeXB0b2dyYXBoaWNhbGx5LXNpZ24gdGhlIFNJUCAnUmVzb3VyY2UtDQoNCg0KDQoiLi4u Y3J5cHRvZ3JhcGhpY2FsbHkgc2lnbi4uLiINCg0KDQogICBQcmlvcml0eScgaGVhZGVyIGZpZWxk IGFuZCBjb252ZXkgYW4gYXNzZXJ0aW9uIG9mIHRoZSBhdXRob3JpemF0aW9uDQogICBmb3IgJ1Jl c291cmNlLVByaW9yaXR5Jy4gIFRoaXMgd2lsbCBhbGxvdyBhIHJlY2VpdmluZyBlbnRpdHkNCiAg IChpbmNsdWRpbmcgZW50aXRpZXMgbG9jYXRlZCBpbiBkaWZmZXJlbnQgbmV0d29yayBkb21haW5z L2JvdW5kYXJpZXMpDQogICB0byB2ZXJpZnkgdGhlIHZhbGlkaXR5IG9mIGFzc2VydGlvbnMgYXV0 aG9yaXppbmcgUmVzb3VyY2UtUHJpb3JpdHkuDQoNCg0KDQpTaW5nbGUgcXVvdGVzIGFyb3VuZCAn UmVzb3VyY2UtUHJpb3JpdHknLg0KDQoNCiAgIENyeXB0b2dyYXBoaWNhbGx5LXNpZ25lZCBTSVAg J1Jlc291cmNlLVByaW9yaXR5JyBoZWFkZXJzIHdpbGwgYWxsb3cgYQ0KDQoNCg0KIi4uLmNyeXB0 b2dyYXBoaWNhbGx5IHNpZ25lZCBTSVAgJ1Jlc291cmNlLVByaW9yaXR5JyBoZWFkZXIgZmllbGRz Li4uIg0KDQoocmVtb3ZlIGh5cGhlbiwgYW5kIHJlcGxhY2UgImhlYWRlcnMiIHdpdGggImhlYWRl ciBmaWVsZHMiKQ0KDQoNCiAgIHJlY2VpdmluZyBlbnRpdHkgdG8gdmVyaWZ5IGFuZCBhY3Qgb24g dGhlIGluZm9ybWF0aW9uIHdpdGggY29uZmlkZW5jZQ0KICAgdGhhdCB0aGUgaW5mb3JtYXRpb24g aGF2ZSBub3QgYmVlbiBzcG9vZmVkIG9yIGNvbXByb21pc2VkLg0KDQoNCg0KIi4uLmhhcyBub3Qg YmVlbiBzcG9vZmVkIG9yIGNvbXByb21pc2VkLiINCg0KDQoNCiAgIFRoaXMgc3BlY2lmaWNhdGlv biBkb2N1bWVudHMgYW4gb3B0aW9uYWwgZXh0ZW5zaW9uIHRvIFBBU1Nwb3JUIGFuZA0KICAgdGhl IGFzc29jaWF0ZWQgU1RJUiBtZWNoYW5pc21zIHRvIHByb3ZpZGUgYSBmdW5jdGlvbiB0byBzaWdu IHRoZSBTSVANCiAgICdSZXNvdXJjZS1Qcmlvcml0eScgaGVhZGVyIGZpZWxkLiAgVGhpcyBQQVNT cG9yVCBvYmplY3QgaXMgdXNlZCB0bw0KICAgcHJvdmlkZSBhdHRlc3RhdGlvbiBvZiBhIGNhbGxp bmcgdXNlciBhdXRob3JpemF0aW9uIGZvciBwcmlvcml0eQ0KICAgY29tbXVuaWNhdGlvbnMuICBU aGlzIGlzIG5lY2Vzc2FyeSBpbiBhZGRpdGlvbiB0byB0aGUgUEFTU3BvclQgb2JqZWN0DQogICB0 aGF0IGlzIHVzZWQgZm9yIGNhbGxpbmcgdXNlciB0ZWxlcGhvbmUgbnVtYmVyIGF0dGVzdGF0aW9u LiAgSG93IHRoZQ0KICAgb3B0aW9uYWwgZXh0ZW5zaW9uIHRvIFBBU1Nwb3JUIGlzIHVzZWQgZm9y IHJlYWwtdGltZSBjb21tdW5pY2F0aW9ucw0KICAgc3VwcG9ydGVkIHVzaW5nIFNJUCAnUmVzb3Vy Y2UtUHJpb3JpdHknIGhlYWRlciBmaWVsZCBpcyBkZWZpbmVkIGluDQogICBvdGhlciBkb2N1bWVu dHMgYW5kIGlzIG91dHNpZGUgdGhlIHNjb3BlIG9mIHRoaXMgZG9jdW1lbnQuDQoNCg0KDQpJIGFz c3VtZSB0aGVzZSBvdGhlciBkb2N1bWVudHMgYXJlIHVuZGVyIGRldmVsb3BtZW50PyBJZiBzbywg dGhleSBzaG91bGQgYmUgY2l0ZWQgaGVyZS4NCg0KDQoNCjIuICBUZXJtaW5vbG9neQ0KDQogICBU aGUga2V5IHdvcmRzICJNVVNUIiwgIk1VU1QgTk9UIiwgIlJFUVVJUkVEIiwgIlNIQUxMIiwgIlNI QUxMIE5PVCIsDQogICAiU0hPVUxEIiwgIlNIT1VMRCBOT1QiLCAiUkVDT01NRU5ERUQiLCAiTUFZ IiwgYW5kICJPUFRJT05BTCIgaW4gdGhpcw0KICAgZG9jdW1lbnQgYXJlIHRvIGJlIGludGVycHJl dGVkIGFzIGRlc2NyaWJlZCBpbiBSRkMgMjExOSBbUkZDMjExOV0uDQoNCg0KDQpUaGlzIGRvY3Vt ZW50IGhhcyBzZXZlcmFsIG5vbi1ub3JtYXRpdmUgdXNlcyBvZiAibXVzdCIsICJzaG91bGQsIiBh bmQgIm1heSwiIGFuZCBzbyBpdCBuZWVkcyB0byB1c2UgdGhlIFJGQzgxNzQgYm9pbGVycGxhdGUg aW5zdGVhZCBvZiB0aGUgUkZDMjExOSBib2lsZXJwbGF0ZS4NCg0KDQoNCjMuICBQQVNTcG9yVCAn cnBoJyBDbGFpbQ0KDQogICBUaGlzIHNwZWNpZmljYXRpb24gZGVmaW5lcyBhIG5ldyBKU09OIFdl YiBUb2tlbiBjbGFpbSBmb3IgInJwaCIsDQogICB3aGljaCBwcm92aWRlcyBhbiBhc3NlcnRpb24g Zm9yIGluZm9ybWF0aW9uIGluIFNJUCAnUmVzb3VyY2UtDQogICBQcmlvcml0eSdoZWFkZXIuDQoN Cg0KDQoiLi4uUHJpb3JpdHknIGhlYWRlciBmaWVsZC4iDQoNCihzcGFjZSBhZnRlciBjbG9zaW5n IHF1b3RhdGlvbiBtYXJrLCAiaGVhZGVyIGZpZWxkIiBpbnN0ZWFkIG9mICJoZWFkZXIiKQ0KDQoN Cg0KICAgVGhlIGNyZWF0b3Igb2YgYSBQQVNTcG9yVCBvYmplY3QgYWRkcyBhICJwcHQiIHZhbHVl IG9mICJycGgiIHRvIHRoZQ0KICAgaGVhZGVyIG9mIGEgUEFTU3BvclQgb2JqZWN0LCBpbiB3aGlj aCBjYXNlIHRoZSBQQVNTcG9yVCBjbGFpbXMgTVVTVA0KICAgY29udGFpbiBhICJycGgiIGNsYWlt LCBhbmQgYW55IGVudGl0aWVzIHZlcmlmeWluZyB0aGUgUEFTU3BvclQgb2JqZWN0DQogICB3aWxs IGJlIHJlcXVpcmVkIHRvIHVuZGVyc3RhbmQgdGhlICJwcHQiIGV4dGVuc2lvbiBpbiBvcmRlciB0 bw0KICAgcHJvY2VzcyB0aGUgUEFTU3BvclQgaW4gcXVlc3Rpb24uICBBIFBBU1NQb3JUIGhlYWRl ciB3aXRoIHRoZSAicHB0Ig0KICAgaW5jbHVkZWQgd2lsbCBsb29rIGFzIGZvbGxvd3M6DQoNCiAg IHsgICJ0eXAiOiJwYXNzcG9ydCIsDQogICAgICJwcHQiOiJycGgiLA0KICAgICAiYWxnIjoiRVMy NTYiLA0KICAgICAieDV1IjoiaHR0cHM6Ly93d3cuZXhhbXBsZS5vcmcvY2VydC5jZXIiPGh0dHBz Oi8vd3d3LmV4YW1wbGUub3JnL2NlcnQuY2VyPn0NCg0KDQoNCklkZWFsbHksIHRoaXMgd291bGQg YmUgZWl0aGVyIHByZXR0eS1wcmludGVkIG9yIGNhbm9uaWNhbGl6ZWQuIFNpbmNlIGl0J3MgdG9v IGxvbmcgdG8gZml0IG9uIGEgbGluZSBpbiBjYW5vbmljYWwgZm9ybSwgSSBwcm9wb3NlOg0KDQp7 DQogICJ0eXAiOiJwYXNzcG9ydCIsDQogICJwcHQiOiJycGgiLA0KICAiYWxnIjoiRVMyNTYiLA0K ICAieDV1IjoiaHR0cHM6Ly93d3cuZXhhbXBsZS5vcmcvY2VydC5jZXIiPGh0dHBzOi8vd3d3LmV4 YW1wbGUub3JnL2NlcnQuY2VyPg0KfQ0KDQoNCg0KICAgVGhlICJycGgiIGNsYWltIHdpbGwgcHJv dmlkZSBhbiBhc3NlcnRpb24gb2YgYXV0aG9yaXphdGlvbiwiYXV0aCIsDQoNCg0KDQoiLi4uYXV0 aG9yaXphdGlvbiwgImF1dGgiLCAuLi4iDQoNCihzcGFjZSBiZXR3ZWVuIGNvbW1hIGFuZCBvcGVu aW5nIHF1b3RhdGlvbiBtYXJrKQ0KDQoNCiAgIGZvciBpbmZvcm1hdGlvbiBpbiB0aGUgU0lQICJS ZXNvdXJjZS1Qcmlvcml0eSIgaGVhZGVyIGZpZWxkIChpLmUuLA0KICAgUmVzb3VyY2UtUHJpb3Jp dHk6IG5hbWVzcGFjZSAiLiIgci1wcmlvcml0eSkgYmFzZWQgb24gW1JGQzQ0MTJdLg0KDQoNCg0K VGhlIHVzZSBvZiB0aGUgc3RyaW5nICduYW1lc3BhY2UgIi4iIHItcHJpb3JpdHknIGhlcmUgYW5k IGVsc2V3aGVyZSBpbiB0aGUgZG9jdW1lbnQgaGFzIGEgZGV0cmltZW50YWwgaW1wYWN0IG9uIHJl YWRhYmlsaXR5LiBJIHN0cm9uZ2x5IHN1Z2dlc3QgcmVwbGFjaW5nIGl0IHdpdGggInItdmFsdWUi ICh0aGUgbmFtZSBvZiB0aGlzIHByb2R1Y3Rpb24gaW4gUkZDNDQxMikgZXZlcnl3aGVyZS4NCg0K DQogICBTcGVjaWZpY2FsbHksIHRoZSAicnBoIiBjbGFpbSBpbmNsdWRlcyBhc3NlcnRpb24gb2Yg dGhlIHByaW9yaXR5LQ0KICAgbGV2ZWwgb2YgdGhlIHVzZXIgdG8gYmUgdXNlZCBmb3IgYSBnaXZl biBjb21tdW5pY2F0aW9uIHNlc3Npb24uICBUaGUNCiAgIHZhbHVlIG9mIHRoZSAicnBoIiBjbGFp bSBpcyBhbiBhcnJheSBjb250YWluaW5nIG9uZSBvciBtb3JlIG9mIEpTT04NCiAgIG9iamVjdHMg Zm9yIHRoZSBjb250ZW50IG9mIHRoZSBTSVAgJ1Jlc291cmNlLVByaW9yaXR5JyBoZWFkZXIgdGhh dCBpcw0KICAgYmVpbmcgYXNzZXJ0ZWQgb2Ygd2hpY2ggb25lIG9mIHRoZSAicnBoIiBvYmplY3Qs IGlzIG1hbmRhdG9yeS4NCg0KDQoNClRoaXMgbGFzdCBzZW50ZW5jZSBpcyB2ZXJ5IGhhcmQgdG8g cGFyc2U7IGFuZCAoYmFzZWQgb24gdGhlIGV4YW1wbGUpIHRoZSB2YWx1ZSBpcyBpbnRlbmRlZCB0 byBiZSBhIEpTT04gT2JqZWN0IChjdXJseSBicmFjZXMpIHJhdGhlciB0aGFuIGEgSlNPTiBBcnJh eSAoc3F1YXJlIGJyYWNlcykuIEkgc3VnZ2VzdDogJ1RoZSB2YWx1ZSBvZiB0aGUgInJwaCIgY2xh aW0gaXMgYW4gT2JqZWN0IHdpdGggb25lIG9yIG1vcmUga2V5cy4gRWFjaCBrZXkgaXMgYXNzb2Np YXRlZCB3aXRoIGEgSlNPTiBBcnJheS4gVGhlc2UgYXJyYXlzIGNvbnRhaW4gU3RyaW5ncyB0aGF0 IGNvcnJlc3BvbmQgdG8gdGhlIHItdmFsdWVzIGluZGljYXRlZCBpbiB0aGUgU0lQICJSZXNvdXJj ZS1Qcmlvcml0eSIgaGVhZGVyIGZpZWxkLicgKG5vdGU6ICJoZWFkZXIgZmllbGQiLCBub3QgImhl YWRlciIpDQoNCg0KDQogICBUaGUgZm9sbG93aW5nIGlzIGFuIGV4YW1wbGUgInJwaCIgY2xhaW0g Zm9yIGEgU0lQICJSZXNvdXJjZS1Qcmlvcml0eSINCiAgIGhlYWRlciBmaWVsZCB3aXRoIGEgIm5h bWVzcGFjZSAiLiIgci1wcmlvcml0eSIgdmFsdWUgb2YgImV0cy4wIiBhbmQNCiAgIHdpdGggYSAi bmFtZXNwYWNlICIuIiByLXByaW9yaXR5IiB2YWx1ZSBvZiAid3BzLjAiLg0KDQogICAgeyAib3Jp ZyI6eyJ0biI6IjEyMTU1NTUxMjEyIn0NCiAgICAgImRlc3QiOntbInRuIjoiMTIxMjU1NTEyMTMi XX0sDQogICAgICJpYXQiOjE0NDMyMDgzNDUsDQogICAgICJycGgiOnsiYXV0aCI6WyJldHMuMCIs Indwcy4wIl19DQoNCg0KDQpBcyBhYm92ZSwgSSByZWNvbW1lbmQgcHJldHR5LXByaW50aW5nIHRo aXMuIEl0J3MgYWxzbyBtaXNzaW5nIGEgY29tbWEgYWZ0ZXIgdGhlICJvcmlnIiB2YWx1ZSwgYW5k IHRoZSB0b3AtbGV2ZWwgc3RydWN0dXJlIGlzIG1pc3NpbmcgYSBjbG9zaW5nIGJyYWNlLiBUaGUg dmFsdWUgZm9yICJpYXQiIG5lZWRzIHRvIGJlIGVuY2xvc2VkIGluIHF1b3Rlcy4NCg0KVGhlIE5B TlBBIGhhcyBhbGxvY2F0ZWQgTlBBNTU1MDF4eCBmb3IgZXhhbXBsZSB1c2UsIG5vdCBOUEE1NTV4 eHh4LCBtdWNoIG9mIHdoaWNoIHJlbWFpbnMgYXNzaWduYWJsZSAoY2YgPGh0dHBzOi8vd3d3Lm5h dGlvbmFsbmFucGEuY29tL3BkZi9OUlVGL0FUSVMtMDMwMDExNS5wZGY+PGh0dHBzOi8vd3d3Lm5h dGlvbmFsbmFucGEuY29tL3BkZi9OUlVGL0FUSVMtMDMwMDExNS5wZGY+KS4NCg0KUHV0dGluZyBh bGwgdGhpcyB0b2dldGhlciwgSSBiZWxpZXZlIHdoYXQgeW91IHdhbnQgaXM6DQoNCnsNCiAgIm9y aWciOnsidG4iOiIxMjE1NTU1MDExMiJ9LA0KICAiZGVzdCI6e1sidG4iOiIxMjEyNTU1MDExMyJd fSwNCiAgImlhdCI6IjE0NDMyMDgzNDUiLA0KICAicnBoIjp7ImF1dGgiOlsiZXRzLjAiLCJ3cHMu MCJdfQ0KfQ0KDQoNCg0KICAgQWZ0ZXIgdGhlIGhlYWRlciBhbmQgY2xhaW1zIFBBU1Nwb3JUIG9i amVjdHMgaGF2ZSBiZWVuIGNvbnN0cnVjdGVkLA0KICAgdGhlaXIgc2lnbmF0dXJlIGlzIGdlbmVy YXRlZCBub3JtYWxseSBwZXIgdGhlIGd1aWRhbmNlIGluDQogICBbSS1ELmlldGYtc3Rpci1wYXNz cG9ydF0gdXNpbmcgdGhlIGZ1bGwgZm9ybSBvZiBQQVNTUG9yVC4gIFRoZQ0KICAgY3JlZGVudGlh bHMgKGUuZy4sIGF1dGhvcml0eSByZXNwb25zaWJsZSBmb3IgYXV0aG9yaXppbmcgUmVzb3VyY2Ut DQogICBQcmlvcml0eSkgdXNlZCB0byBjcmVhdGUgdGhlIHNpZ25hdHVyZSBtdXN0IGhhdmUgYXV0 aG9yaXR5IG92ZXIgdGhlDQogICAicnBoIiBjbGFpbSBhbmQgdGhlcmUgaXMgb25seSBvbmUgYXV0 aG9yaXR5IHBlciBjbGFpbS4gIFRoZSBhdXRob3JpdHkNCiAgIE1VU1QgdXNlIGl0cyBjcmVkZW50 aWFscyAoaS5lLiwgQ0VSVCkgYXNzb2NpYXRlZCB3aXRoIHRoZSBzcGVjaWZpYw0KICAgc2Vydmlj ZSBzdXBwb3J0ZWQgYnkgdGhlIFNJUCBuYW1lc3BhY2UgaW4gdGhlIGNsYWltLg0KDQo0LiAgJ3Jw aCcgaW4gU0lQDQoNCiAgIFRoaXMgc2VjdGlvbiBzcGVjaWZpZXMgU0lQLXNwZWNpZmljIHVzYWdl IGZvciB0aGUgInJwaCIgY2xhaW0gaW4NCiAgIFBBU1Nwb3JULg0KDQo0LjEuICBBdXRoZW50aWNh dGlvbiBTZXJ2aWNlIEJlaGF2aW9yDQoNCiAgIFRoZSBBdXRoZW50aWNhdGlvbiBTZXJ2aWNlIHdp bGwgY3JlYXRlIHRoZSAicnBoIiBjbGFpbSB1c2luZyB0aGUNCiAgIHZhbHVlcyBkaXNjdXNzZWQg aW4gc2VjdGlvbiAzIGJhc2VkIG9uIFtSRkM0NDEyXS4gIFRoZSBjb25zdHJ1Y3Rpb24NCiAgIG9m ICJycGgiIGNsYWltIGZvbGxvd3MgdGhlIHN0ZXBzIGRlc2NyaWJlZCBpbiBTZWN0aW9uIDQgb2YN CiAgIFtJLUQuaWV0Zi1zdGlyLXJmYzQ0NzRiaXNdLg0KDQogICBUaGUgcmVzdWx0aW5nIElkZW50 aXR5IGhlYWRlciBmb3IgInJwaCIgbWlnaHQgbG9vayBhcyBmb2xsb3dzOg0KDQoNCg0KIi4uLmhl YWRlciBmaWVsZC4uLiINCg0KDQoNCiAgICJleUpoYkdjaU9pSkZVekkxTmlJc0luUjVjQ0k2SWtw WFZDSjkuZXlKcGMzTWlPaUpsZVVvd1pWaEJhVTlwU25kDQogICBaV0U1NlkwYzVlV1JEU1hORVVX OXBZMGhDTUVscWIybGpia0p2U1dsM1RrTnBTbWhpUjJOcFQybEtSbFY2U1RGTw0KICAgYVVselJG RnZhV1ZFVmpGSmFuQnZaRWhTZDJONmIzWk1NMlF6WkhrMWJHVkhSblJqUjNoc1RHMU9kbUpUT1dw YVcNCiAgIEVvd1RHMU9iR051TUU1RFp6QkxJSHg4NG9DWkx1S0FtWHg4SUdWNVFXbGlNMHB3V25s Sk5tVjVTakJpYVVrMlNXDQogICBwRmVVMVVWVEZPVkZWNFRXcEZlVWx1TUU1RGFVcHJXbGhPTUVs cWNEZFhlVW93WW1sSk5rbHFSWGxOVkVreFRsUg0KICAgVmVFMXFSWHBKYkRFNVRFRXdTMGx0Ykdo a1EwazJUVlJSTUUxNlNYZFBSRTB3VGxOM1RrTnBTbmxqUjJkcFQyNXoNCiAgIGFWbFlWakJoUTBr MlYzbEtiR1JJVFhWTlEwbHpTVzVrZDJONU5IZEpiREU1UkZGdlBTSjkuczM3UzZWQzhITTZEDQog ICBsNll6SmVRRHNyWmN3SjBsaXp4aFVyQTdmXzk4b1dCSHZvLWNsLW44TUlob0NyMTh2WVlGeTNi bFh2czNmc2xNXw0KICAgb29zMlAyRHl3IjsgaW5mbz0gImh0dHBzOi8vd3d3LmV4YW1wbGUub3Jn L2NlcnQuY2VyIjxodHRwczovL3d3dy5leGFtcGxlLm9yZy9jZXJ0LmNlcj47YWxnPUVTMjU2Ow0K ICAgcHB0PSJycGgiDQoNCg0KDQpUaGlzIGV4YW1wbGUgaGFzIGEgbnVtYmVyIG9mIGlzc3VlczoN Cg0KICAqICAgSW4gdGhlIElkZW50aXR5IGhlYWRlciBmaWVsZCwgdGhlIHNpZ25lZC1pZGVudGl0 eS1kaWdlc3Qgc2hvdWxkbid0IGJlIHF1b3RlZC4NCiAgKiAgIEluIHRoZSBJZGVudGl0eSBoZWFk ZXIgZmllbGQsIGluZm8gaXMgZW5jbG9zZWQgaW4gPD4gcmF0aGVyIHRoYW4gIiIuDQogICogICBJ biB0aGUgSWRlbnRpdHkgaGVhZGVyIGZpZWxkLCBwcHQgaXMgYSB0b2tlbiByYXRoZXIgdGhhbiBh IHF1b3RlZCBzdHJpbmcuDQogICogICBUaGUgc2lnbmVkLWlkZW50aXR5LWRpZ2VzdCBoZWFkZXIg bmVlZHMgdG8gaW5kaWNhdGUgYSAidHlwIiBvZiAicGFzc3BvcnQiIHJhdGhlciB0aGFuIEpXVCwg YW5kIGl0IG5lZWRzIHRvIGluY2x1ZGUgYm90aCBhICJwcHQiIGFuZCAieDV1IiBmaWVsZC4NCiAg KiAgIFRoZSBzaWduZWQtaWRlbnRpdHktZGlnZXN0IGJvZHkgc2hvdWxkIGNvbnRhaW4gb25seSB0 aGUgcGFzc3BvcnQgY2xhaW0gcmF0aGVyIHRoYW4gYSBKU09OIG9iamVjdCB0aGF0IGl0c2VsZiBj b250YWlucyBhIGJhc2U2NC1lbmNvZGVkIEpXUyBoZWFkZXIgY29uY2F0ZW5hdGVkIHdpdGggYSBj bGFpbS4NCiAgKiAgIEkgYmVsaWV2ZSB0aGF0LCBldmVuIHdoZW4gdGhlIGJvZHkgaXMgaW5jbHVk ZWQsIHZhbHVlcyBpbiB0aGUgaGVhZGVyIGFuZCBib2R5IG5lZWQgdG8gYmUgYmUgY2Fub25pY2Fs aXplZCAoaS5lLiwgYWxsIG9uIG9uZSBsaW5lLCBubyBzcGFjZXMsIGluIGFscGhhYmV0aWNhbCBv cmRlciwgZXRjLikNCg0KSSB3b3VsZCBhbHNvIHJlY29tbWVuZCBmb2xsb3dpbmcgdGhlIGNvbnZl bnRpb24gb2YgaW5kaWNhdGluZyB0aGF0IGxpbmUtd3JhcHMgYXJlIG9ubHkgZm9yIHJlYWRhYmls aXR5LCBhbmQgaW5jbHVkaW5nIHRoZSBoZWFkZXIgZmllbGQgbmFtZSBpbiB0aGUgZXhhbXBsZS4g UHV0dGluZyBhbGwgdGhpcyB0b2dldGhlciwgSSBiZWxpZXZlIHdoYXQgeW91IHdhbnQgaXM6DQoN CiAgIEZvciBleGFtcGxlLCBhIElkZW50aXR5IGhlYWRlciBmaWVsZCBmb3IgInJwaCIgbWlnaHQg bG9vaw0KICAgYXMgZm9sbG93cyAoYmFja3NsYXNoZXMgc2hvd24gZm9yIGxpbmUgZm9sZGluZyBv bmx5KToNCg0KICAgSWRlbnRpdHk6IGV5SmhiR2NpT2lKRlV6STFOaUlzSW5Cd2RDSTZJbkp3YUNJ c0luUjVjQ0k2SW5CaGMzTndiM0owSSBcDQogICBpd2llRFYxSWpvaWFIUjBjSE02THk5M2QzY3Va WGhoYlhCc1pTNWpiMjB2WTJWeWRDNWpaWElpZlFvLmV5SmtaWE4wIFwNCiAgIElqcDdXeUowYmlJ NklqRXlNVEkxTlRVd01URXpJbDE5TENKcFlYUWlPaUl4TkRRek1qQTRNelExSWl3aWIzSnBaeUkg XA0KICAgNmV5SjBiaUk2SWpFeU1UVTFOVFV3TVRFeUluMHNJbkp3YUNJNmV5SmhkWFJvSWpwYklt VjBjeTR3SWl3aWQzQnpMaiBcDQogICBBaVhYMTlDZy5zMzdTNlZDOEhNNkRsNll6SmVRRHNyWmN3 SjBsaXp4aFVyQTdmXzk4b1dCSHZvLWNsLW44TUlob0NyIFwNCiAgIDE4dllZRnkzYmxYdnMzZnNs TV9vb3MyUDJEeXc7aW5mbz08aHR0cHM6Ly93d3cuZXhhbXBsZS5vcmcvY2VydC5jZXIgXA0KICAg PjthbGc9RVMyNTY7cHB0PXJwaA0KDQooTm90ZTogdGhpcyBleGFtcGxlIGFzc3VtZXMgdGhlIGNh bGxpbmcgYW5kIGNhbGxlZCBwYXJ0eSBudW1iZXJzIGluIHRoZSBwcmV2aW91cyBleGFtcGxlIGFy ZSBjaGFuZ2VkIHRvIDEyMTU1NTUwMTEyIGFuZCAxMjE1NTU1MDExMywgcmVzcGVjdGl2ZWx5KQ0K DQoNCg0KICAgQSBTSVAgYXV0aGVudGljYXRpb24gc2VydmljZSB0eXBpY2FsbHkgd2lsbCBkZXJp dmUgdGhlIHZhbHVlIG9mICJycGgiDQogICBmcm9tIHRoZSAnUmVzb3VyY2UtUHJpb3JpdHknIGhl YWRlciBmaWVsZCBiYXNlZCBvbiBwb2xpY3kgYXNzb2NpYXRlZA0KICAgd2l0aCBzZXJ2aWNlIHNw ZWNpZmljIHVzZSBvZiB0aGUgIm5hbWVzcGFjZSAiLiIgci1wcmlvcml0eSIgdmFsdWVzDQogICBi YXNlZCBvbiBbUkZDNDQxMl0uICBUaGUgYXV0aGVudGljYXRpb24gc2VydmljZSBkZXJpdmVzIHRo ZSB2YWx1ZSBvZg0KICAgdGhlIFBBU1NQb3JUIGNsYWltIGJ5IHZlcmlmeWluZyB0aGUgYXV0aG9y aXphdGlvbiBmb3IgUmVzb3VyY2UtDQogICBQcmlvcml0eSAoaS5lLiwgdmVyaWZ5aW5nIGEgY2Fs bGluZyB1c2VyIHByaXZpbGVnZSBmb3IgUmVzb3VyY2UtDQogICBQcmlvcml0eSBiYXNlZCBvbiBp dHMgaWRlbnRpdHkpIHdoaWNoIG1pZ2h0IGJlIGRlcml2ZWQgZnJvbSBjdXN0b21lcg0KICAgcHJv ZmlsZSBkYXRhIG9yIGZyb20gYWNjZXNzIHRvIGV4dGVybmFsIHNlcnZpY2VzLg0KDQogICBbUkZD NDQxMl0gYWxsb3dzIG11bHRpcGxlICJuYW1lc3BhY2UgIi4iIHItcHJpb3JpdHkiIHBhaXJzLCBl aXRoZXIgaW4NCiAgIGEgc2luZ2xlIFNJUCBSZXNvdXJjZS1Qcmlvcml0eSBoZWFkZXIgb3IgYWNy b3NzIG11bHRpcGxlIFNJUA0KDQoNCg0KU2luZ2xlIHF1b3RlcyBhcm91bmQgJ1Jlc291cmNlLVBy aW9yaXR5Jy4NCg0KIi4uLmhlYWRlciBmaWVsZC4uLiINCg0KDQogICBSZXNvdXJjZS1Qcmlvcml0 eSBoZWFkZXJzLiAgSG93ZXZlciwgaXQgaXMgbm90IG5lY2Vzc2FyeSB0byBzaWduIGFsbA0KDQoN Cg0KU2luZ2xlIHF1b3RlcyBhcm91bmQgJ1Jlc291cmNlLVByaW9yaXR5Jy4NCg0KIi4uLmhlYWRl ciBmaWVsZHMuLi4iDQoNCg0KICAgY29udGVudCBvZiBhIFNJUCBSZXNvdXJjZS1Qcmlvcml0eSBo ZWFkZXIgb3IgYWxsIFNJUCBSZXNvdXJjZS0NCg0KDQoNClNpbmdsZSBxdW90ZXMgYXJvdW5kICdS ZXNvdXJjZS1Qcmlvcml0eScuDQoNCiIuLi5oZWFkZXIgZmllbGQuLi4iDQoNCg0KICAgUHJpb3Jp dHkgaGVhZGVycyBpbiBhIGdpdmVuIFNJUCBtZXNzYWdlLiAgQW4gYXV0aG9yaXR5IGlzIG9ubHkN Cg0KDQoNClNpbmdsZSBxdW90ZXMgYXJvdW5kICdSZXNvdXJjZS1Qcmlvcml0eScuDQoNCiIuLi5o ZWFkZXIgZmllbGRzLi4uIg0KDQoNCiAgIHJlc3BvbnNpYmxlIGZvciBzaWduaW5nIHRoZSBjb250 ZW50IG9mIGEgU0lQIFJlc291cmNlLVByaW9yaXR5IGhlYWRlcg0KDQoNCg0KU2luZ2xlIHF1b3Rl cyBhcm91bmQgJ1Jlc291cmNlLVByaW9yaXR5Jy4NCg0KIi4uLmhlYWRlciBmaWVsZC4uLiINCg0K DQogICBmb3Igd2hpY2ggaXQgaGFzIGF1dGhvcml0eSAoZS5nLiwgYSBzcGVjaWZpYyAibmFtZXNw YWNlICIuIg0KICAgci1wcmlvcml0eSIpLg0KDQo0LjIuICBWZXJpZmljYXRpb24gU2VydmljZSBC ZWhhdmlvcg0KDQogICBbSS1ELmlldGYtc3Rpci1yZmM0NDc0YmlzXSBTZWN0aW9uIDYuMiBTdGVw IDUgcmVxdWlyZXMgdGhhdA0KICAgc3BlY2lmaWNhdGlvbnMgZGVmaW5pbmcgInBwdCIgdmFsdWVz IGRlc2NyaWJlIGFueSBhZGRpdGlvbmFsIHZlcmlmaWVyDQogICBiZWhhdmlvci4gIFRoZSBiZWhh dmlvciBzcGVjaWZpZWQgZm9yIHRoZSAicHB0IiB2YWx1ZXMgb2YgInJwaCIgaXMgYXMNCiAgIGZv bGxvd3M6DQoNCiAgIFRoZSB2ZXJpZmljYXRpb24gc2VydmljZSBNVVNUIGV4dHJhY3QgdGhlIHZh bHVlIGFzc29jaWF0ZWQgd2l0aCB0aGUNCiAgICJhdXRoIiBrZXkgaW4gYSBmdWxsIGZvcm0gUEFT U1BvclQgd2l0aCBhICJwcHQiIHZhbHVlIG9mICJycGgiLiAgSWYNCiAgIHRoZSBzaWduYXR1cmUg dmFsaWRhdGVzLCB0aGVuIHRoZSB2ZXJpZmljYXRpb24gc2VydmljZSBjYW4gdXNlIHRoZQ0KICAg dmFsdWUgb2YgdGhlICJycGgiIGNsYWltIGFzIHZhbGlkYXRpb24gdGhhdCB0aGUgY2FsbGluZyBw YXJ0eSBpcw0KICAgYXV0aG9yaXplZCBmb3IgUmVzb3VyY2UtUHJpb3JpdHksIHdoaWNoIHdvdWxk IGluIHR1cm4gYmUgdXNlZCBmb3INCg0KDQpTaW5nbGUgcXVvdGVzIGFyb3VuZCAnUmVzb3VyY2Ut UHJpb3JpdHknLg0KDQpUaGlzIHRleHQgaXMgYW1iaWd1b3VzIGFib3V0IHdoZXRoZXIgdGhlIHZh bGlkYXRpb24gaW5kaWNhdGVzIHRoYXQgdGhlIGNhbGxpbmcgcGFydHkgaXMgYXV0aG9yaXplZCB0 byB1c2UgdGhlIHByaW9yaXRpZXMgaW5kaWNhdGVkIGluIHRoZSBwYXNzcG9ydCBvYmplY3QsIG9y IHRoZSB2YWx1ZXMgaW4gdGhlIFNJUCAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlciBmaWVsZDsg YW5kICh0YWtlbiBvbiBpdHMgZmFjZSkgaW1wbGllcyB0aGUgbGF0dGVyLCB3aGVuIHRoZSBpbnRl bnRpb24gaGVyZSBzaG91bGQgY2xlYXJseSBiZSB0aGUgZm9ybWVyLg0KDQoiLi4uYXV0aG9yaXpl ZCBmb3IgJ1Jlc291cmNlLVByaW9yaXR5JyBpbmRpY2F0ZWQgaW4gdGhlIGNsYWltLiBUaGlzIHZh bHVlIHdvdWxkIGluIHR1cm4gYmUgdXNlZCBmb3IuLi4iDQoNClRoZSB0ZXh0IGFsc28gbmVlZHMg dG8gc2F5IHNvbWV0aGluZyBhYm91dCBjb21wYXJpbmcgdmFsdWVzIGluIHRoZSBjbGFpbSB0byB2 YWx1ZXMgaW4gdGhlICdSZXNvdXJjZS1Qcmlvcml0eScgaGVhZGVyIGZpZWxkLCBhbmQgd2hhdCBh IG1pc21hdGNoIG1pZ2h0IG1lYW4uIFRoZSBkb2N1bWVudCBzYXlzIGVsc2V3aGVyZSB0aGF0IHRo ZSBzaWduYXR1cmUgbWlnaHQgb25seSBjb3ZlciBzb21lIG9mIHRoZSByLXZhbHVlcywgd2hpY2gg bWFrZXMgaXQgZW50aXJlbHkgcG9zc2libGUgdGhhdCB0aGUgJ1Jlc291cmNlLVByaW9yaXR5JyBm aWVsZCBtaWdodCBjb250YWluIG1vcmUgdmFsdWVzIHRoYW4gYXJlIHNpZ25lZC4gT24gdGhlIG90 aGVyIGhhbmQsIGludGVybWVkaWFyaWVzIG1pZ2h0IHJlYXNvbmFibHkgcmVtb3ZlIHItdmFsdWVz IGFzIHRoZSBjYWxsIGlzIHByb2Nlc3NlZC4gVGhpcyBwcm9iYWJseSBtZWFucyB0aGF0IHRob3Nl IHJlbW92ZWQgcHJpb3JpdGllcyBzaG91bGQgbm90IGJlIHVzZWQsIGV2ZW4gaWYgdGhleSBhcmUg cHJlc2VudCBpbiB0aGUgcGFzc3BvcnQuIEl0IHNlZW1zIHJlYXNvbmFibGUgdG8gc2F5IHRoYXQg KnR5cGljYWwqIHByb2Nlc3NpbmcgYnkgYSByZWNlaXZpbmcgcGFydHkgd291bGQgYmUgdG8gdGFr ZSB0aGUgKnVuaW9uKiBvZiBhbGwgUlBIIHBhc3Nwb3J0cyB0aGF0IHRoZXkgdHJ1c3QsIGFuZCAq aW50ZXJzZWN0KiB0aGF0IHdpdGggdGhlIHByaW9yaXRpZXMgaW4gJ1Jlc291cmNlLVByaW9yaXR5 JyBoZWFkZXIgZmllbGRzIHRvIGdldCB0aGUgYWN0dWFsIHByaW9yaXR5IG9yIHByaW9yaXRpZXMg dG8gYmUgYXBwbGllZCB0byB0aGUgY2FsbCAoc3ViamVjdCB0byBsb2NhbCBwb2xpY3kpLg0KDQoN CiAgIHByaW9yaXR5IHRyZWF0bWVudCBpbiBhY2NvcmRhbmNlIHdpdGggbG9jYWwgcG9saWN5IGZv ciB0aGUgYXNzb2NpYXRlZA0KICAgY29tbXVuaWNhdGlvbiBzZXJ2aWNlLg0KDQogICBJbiBhZGRp dGlvbiwgW0ktRC5pZXRmLXN0aXItcmZjNDQ3NGJpc10gU2VjdGlvbiA2LjIgU3RlcCA0IHJlcXVp cmVzDQogICAiaWF0IiB2YWx1ZSBpbiAicnBoIiBjbGFpbSB0byBiZSB2ZXJpZmllZC4NCg0KICAg VGhlIGJlaGF2aW9yIG9mIGEgU0lQIFVBcyB1cG9uIHJlY2VpdmluZyBhbiBJTlZJVEUgY29udGFp bmluZyBhDQoNCg0KDQoiLi4ub2YgYSBTSVAgVUEgdXBvbi4uLiINCg0Kb3INCg0KIi4uLm9mIFNJ UCBVQXMgdXBvbi4uLiINCg0KDQogICBQQVNTcG9yVCBvYmplY3Qgd2l0aCBhICJycGgiIGNsYWlt IHdpbGwgbGFyZ2VseSByZW1haW4gYSBtYXR0ZXIgb2YNCiAgIGltcGxlbWVudGF0aW9uIHBvbGlj eSBmb3IgdGhlIHNwZWNpZmljIGNvbW11bmljYXRpb24gc2VydmljZS4gIEluDQogICBtb3N0IGNh c2VzLGltcGxlbWVudGF0aW9ucyB3b3VsZCBhY3QgYmFzZWQgb24gY29uZmlkZW5jZSBpbiB0aGUN Cg0KDQoNCiIuLi5jYXNlcywgaW1wbGVtZW50YXRpb25zLi4uIg0KDQooc3BhY2UgYWZ0ZXIgY29t bWEpDQoNCg0KICAgdmVyYWNpdHkgb2YgdGhpcyBpbmZvcm1hdGlvbi4gIFRoZSB1c2Ugb2YgdGhl IGNvbXBhY3QgZm9ybSBvZg0KDQoNCg0KUGFyYWdyYXBoIGJyZWFrIGJlZm9yZSAiVGhlIi4NCg0K DQogICBQQVNTcG9yVCBpcyBub3Qgc3BlY2lmaWVkIGluIHRoaXMgZG9jdW1lbnQuDQoNCjUuICBG dXJ0aGVyIEluZm9ybWF0aW9uIEFzc29jaWF0ZWQgd2l0aCBSZXNvdXJjZS1Qcmlvcml0eQ0KDQoN Cg0KU2luZ2xlIHF1b3RlcyBhcm91bmQgJ1Jlc291cmNlLVByaW9yaXR5Jy4NCg0KDQoNCiAgIFRo ZXJlIG1heSBiZSBhZGRpdGlvbmFsIGluZm9ybWF0aW9uIGFib3V0IHRoZSBjYWxsaW5nIHBhcnR5 IG9yIHRoZQ0KICAgY2FsbCB0aGF0IGNvdWxkIGJlIHJlbGV2YW50IHRvIGF1dGhvcml6YXRpb24g Zm9yIFJlc291cmNlLVByaW9yaXR5Lg0KDQoNCg0KU2luZ2xlIHF1b3RlcyBhcm91bmQgJ1Jlc291 cmNlLVByaW9yaXR5Jy4NCg0KDQogICBUaGlzIG1heSBpbmNsdWRlIGluZm9ybWF0aW9uIHJlbGF0 ZWQgdG8gdGhlIGRldmljZSBzdWJzY3JpcHRpb24gb2YNCiAgIHRoZSBjYWxsZXIsIG9yIHRvIGFu eSBpbnN0aXR1dGlvbnMgdGhhdCB0aGUgY2FsbGVyIG9yIGRldmljZSBpcw0KICAgYXNzb2NpYXRl ZCB3aXRoLCBvciBldmVuIGNhdGVnb3JpZXMgb2YgaW5zdGl0dXRpb25zLiAgQWxsIG9mIHRoZXNl DQogICBkYXRhIGVsZW1lbnRzIHdvdWxkIGJlbmVmaXQgZnJvbSB0aGUgc2VjdXJlIGF0dGVzdGF0 aW9ucyBwcm92aWRlZCBieQ0KICAgdGhlIFNUSVIgYW5kIFBBU1Nwb3JUIGZyYW1ld29ya3MuICBU aGUgc3BlY2lmaWNhdGlvbiBvZiB0aGUgInJwaCINCiAgIGNsYWltIGNvdWxkIGVudGFpbCB0aGUg b3B0aW9uYWwgcHJlc2VuY2Ugb2Ygb25lIG9yIG1vcmUgc3VjaA0KICAgYWRkaXRpb25hbCBpbmZv cm1hdGlvbiBmaWVsZHMuDQoNCiAgIEEgbmV3IElBTkEgcmVnaXN0cnkgaGFzIGJlZW4gZGVmaW5l ZCB0byBob2xkIHBvdGVudGlhbCB2YWx1ZXMgb2YgdGhlDQogICAicnBoIiBhcnJheTsgc2VlIFNl Y3Rpb24gNi4yLiAgVGhlIGRlZmluaXRpb24gb2YgdGhlICJycGgiIGNsYWltIG1heQ0KICAgaGF2 ZSBvbmUgb3IgbW9yZSBzdWNoIGFkZGl0aW9uYWwgaW5mb3JtYXRpb24gZmllbGQocykuICBEZXRh aWxzIG9mDQogICBzdWNoICJycGgiIGNsYWltIHRvIGVuY29tcGFzcyBvdGhlciBkYXRhIGVsZW1l bnRzIGFyZSBsZWZ0IGZvciBmdXR1cmUNCiAgIHZlcnNpb24gb2YgdGhpcyBzcGVjaWZpY2F0aW9u Lg0KDQo2LiAgSUFOQSBDb25zaWRlcmF0aW9ucw0KDQo2LjEuICBKU09OIFdlYiBUb2tlbiBDbGFp bXMgUmVnaXN0cmF0aW9uDQoNCg0KDQpJIHRoaW5rIHRoZXJlJ3Mgc29tZSBjb25mdXNpb24gaGVy ZS4gWW91J3JlIHJlZ2lzdGVyaW5nIGEgUEFTU3BvclQgcHB0IHZhbHVlLCBub3QgYSBuZXcgSldU IGNsYWltLiBUaGF0IGlzIHRvIHNheSwgeW91J3JlIGFkZGluZyBhbiBlbnRyeSB0byB0aGlzIHRh YmxlOg0KDQpodHRwczovL3d3dy5pYW5hLm9yZy9hc3NpZ25tZW50cy9wYXNzcG9ydC9wYXNzcG9y dC54aHRtbA0KDQpOb3QgdG8gdGhpcyB0YWJsZToNCg0KaHR0cHM6Ly93d3cuaWFuYS5vcmcvYXNz aWdubWVudHMvand0L2p3dC54aHRtbA0KDQpZb3Ugd291bGQgb25seSB1c2UgdGhlIHNlY29uZCB0 YWJsZSBpZiB5b3UgaGFkIGEgbmV3IGtleSB0byBhZGQgdG8gdGhlIFBBU1Nwb3JUIGhlYWRlciAt LSB0aGlzIHNwZWNpZmljYXRpb24gZG9lcyBub3QgZG8gdGhhdC4NCg0KVGhpcyBzZWN0aW9uIGFs c28gbmVlZHMgc29tZSBpbnRyb2R1Y3RvcnkgdGV4dCB0byBsZXQgdGhlIElBTkEga25vdyBleGFj dGx5IHdoYXQgdG8gZG87IGUuZy4gIlRoaXMgZG9jdW1lbnQgcmVnaXN0ZXJzIGEgbmV3IHZhbHVl IGZvciB0aGUgIlBlcnNvbmFsIEFzc2VydGlvbiBUb2tlbiAoUEFTU3BvclQpIEV4dGVuc2lvbnMi IHRhYmxlLg0KDQogICBvICBwcHQgdmFsdWU6ICJycGgiDQoNCiAgIG8gIFNwZWNpZmljYXRpb24g RG9jdW1lbnQocyk6IFNlY3Rpb24gMyBvZiBbUkZDVGhpc10NCg0KNi4yLiAgUEFTU3BvclQgJ3Jw aCcgVHlwZXMNCg0KICAgVGhpcyBkb2N1bWVudCByZXF1ZXN0cyB0aGF0IHRoZSBJQU5BIGFkZCBh IG5ldyBlbnRyeSB0byB0aGUgUEFTU3BvclQNCiAgIFR5cGVzIHJlZ2lzdHJ5IGZvciB0aGUgdHlw ZSAicnBoIiB3aGljaCBpcyBzcGVjaWZpZWQgaW4gW1JGQ1RoaXNdLg0KDQoNCg0KVGhlcmUgaXNu J3QgYW4gSUFOQSB0YWJsZSBjYWxsZWQgIlBBU1Nwb3JUIFR5cGVzLiIgSSBwcmVzdW1lIHRoaXMg aXMgdGhlIHJlZ2lzdHJhdGlvbiB3ZSBqdXN0IGRpc2N1c3NlZCBpbiBzZWN0aW9uIDYuMSwgYW5k IHNvIHRoZSBhYm92ZSB0d28gbGluZXMgY2FuIGJlIHJlbW92ZWQuDQoNCg0KICAgVGhpcyBzcGVj aWZpY2F0aW9uIGFsc28gcmVxdWVzdHMgdGhhdCB0aGUgSUFOQSBjcmVhdGUgYSBuZXcgcmVnaXN0 cnkNCiAgIGZvciBQQVNTcG9yVCAicnBoIiB0eXBlcy4gIFJlZ2lzdHJhdGlvbiBvZiBuZXcgUEFT U3BvclQgInJwaCIgdHlwZXMNCiAgIHNoYWxsIGJlIHVuZGVyIHRoZSBzcGVjaWZpY2F0aW9uIHJl cXVpcmVkIHBvbGljeS4gIFRoaXMgcmVnaXN0cnkgaXMNCiAgIHRvIGJlIGluaXRpYWxseSBwb3B1 bGF0ZWQgd2l0aCBhIHNpbmdsZSB2YWx1ZSBmb3IgImF1dGgiIHdoaWNoIGlzDQogICBzcGVjaWZp ZWQgaW4gW1JGQ1RoaXNdLg0KDQoNCg0KVGhpcyBuZWVkcyB0byBiZSB2ZXJ5IGNsZWFyIGFib3V0 IHRoZSBmaWVsZHMgdG8gYmUgaW5jbHVkZWQgaW4gdGhpcyBuZXcgcmVnaXN0cnkgKGUuZy4sICJS ZWdpc3RyeSBlbnRyaWVzIG11c3QgY29udGFpbiB0d28gZmllbGRzOiB0aGUgbmFtZSBvZiB0aGUg J3JwaCcgdHlwZSBhbmQgdGhlIHNwZWNpZmljYXRpb24gaW4gd2hpY2ggdGhlIHR5cGUgaXMgZGVz Y3JpYmVkIikuDQoNCg0KDQo3LiAgU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMNCg0KICAgVGhlIHNl Y3VyaXR5IGNvbnNpZGVyYXRpb25zIGRpc2N1c3NlZCBpbiBbSS1ELmlldGYtc3Rpci1yZmM0NDc0 YmlzXQ0KICAgaW4gU2VjdGlvbiAxMCBhcmUgYXBwbGljYWJsZSBoZXJlLg0KDQo3LjEuICBBdm9p ZGFuY2Ugb2YgcmVwbGF5IGFuZCBjdXQgYW5kIHBhc3RlIGF0dGFja3MNCg0KICAgVGhlIFBBU1Nw b3JUIGV4dGVuc2lvbiB3aXRoIGEgInBwdCIgdmFsdWUgb2YgInJwaCIgTVVTVCBvbmx5IGJlIHNl bnQNCiAgIHdpdGggU0lQIElOVklURSB3aGVuICdSZXNvdXJjZS1Qcmlvcml0eScgaGVhZGVyIGlz IHVzZWQgdG8gY29udmV5IHRoZQ0KDQoNCg0KIi4uLmhlYWRlciBmaWVsZC4uLiINCg0KDQogICBw cmlvcml0eSBvZiB0aGUgY29tbXVuaWNhdGlvbiBhcyBkZWZpbmVkIGluIFtSRkM0NDEyXS4gIFRv IGF2b2lkIHRoZQ0KICAgcmVwbGF5LCBhbmQgY3V0IGFuZCBwYXN0ZSBhdHRhY2tzLCB0aGUgcHJv Y2VkdXJlcyBkZXNjcmliZWQgaW4NCiAgIFNlY3Rpb24gMTAuMSBvZiBbSS1ELmlldGYtc3Rpci1y ZmM0NDc0YmlzXSBNVVNUIGJlIGZvbGxvd2VkLg0KDQo3LjIuICBTb2x1dGlvbiBDb25zaWRlcmF0 aW9ucw0KDQogICBUaGUgdXNlIG9mIGV4dGVuc2lvbiB0byBQQVNTcG9yVCB0b2tlbnMgd2l0aCAi cHB0IiB2YWx1ZSAicnBoIiBiYXNlZA0KICAgb24gdGhlIHZhbGlkYXRpb24gb2YgdGhlIGRpZ2l0 YWwgc2lnbmF0dXJlIGFuZCB0aGUgYXNzb2NpYXRlZA0KICAgY2VydGlmaWNhdGUgcmVxdWlyZXMg Y29uc2lkZXJhdGlvbiBvZiB0aGUgYXV0aGVudGljYXRpb24gYW5kDQogICBhdXRob3JpdHkgb3Ig cmVwdXRhdGlvbiBvZiB0aGUgc2lnbmVyIHRvIGF0dGVzdCB0byB0aGUgaWRlbnRpdHkgYmVpbmcN CiAgIGFzc2VydGVkLiAgVGhlIGZvbGxvd2luZyBjb25zaWRlcmF0aW9ucyBzaG91bGQgYmUgcmVj b2duaXplZCB3aGVuDQogICB1c2luZyBQQVNTcG9yVCBleHRlbnNpb24gd2l0aCAicHB0IiB2YWx1 ZSBvZiAicnBoIjoNCg0KICAgbyAgQW4gYXV0aG9yaXR5IChzaWduZXIpIGlzIG9ubHkgYWxsb3dl ZCB0byBzaWduIHRoZSBjb250ZW50IG9mIGEgU0lQDQogICAgICAnUmVzb3VyY2UtUHJpb3JpdHkn IGhlYWRlciBmb3Igd2hpY2ggaXQgaGFzIHRoZSByaWdodCBhdXRob3JpdHkuDQoNCg0KDQoiLi4u aGVhZGVyIGZpZWxkLi4uIg0KDQoNCiAgICAgIFRoZSBhdXRob3JpdHkgdGhhdCBzaWducyB0aGUg dG9rZW4gTVVTVCBoYXZlIGEgc2VjdXJlIG1ldGhvZCBmb3INCiAgICAgIGF1dGhlbnRpY2F0aW9u IG9mIHRoZSBlbmQgdXNlciBvciB0aGUgZGV2aWNlLg0KDQogICBvICBUaGUgdmVyaWZpY2F0aW9u IG9mIHRoZSBzaWduYXR1cmUgTVVTVCBpbmNsdWRlIG1lYW5zIG9mIHZlcmlmeWluZw0KICAgICAg dGhhdCB0aGUgc2lnbmVyIGlzIGF1dGhvcml0YXRpdmUgZm9yIHRoZSBzaWduZWQgY29udGVudCBv ZiB0aGUgU0lQDQoNCg0KDQpJdCdzIG5vdCBjbGVhciB3aGF0IGF1dGhvcml0eSBpcyBiZWluZyBj bGFpbWVkIGhlcmUuIElzIHRoaXMgc3VwcG9zZWQgdG8gbWVhbiBzb21ldGhpbmcgbGlrZSAiLi4u dmVyaWZ5aW5nIHRoYXQgdGhlIHNpZ25lciBpcyBhdXRob3JpdGF0aXZlIGZvciB0aGUgb3JpZ2lu YXRpbmcgdG4gaW4gdGhlIFBBU1Nwb3JULi4uIj8gT3IgIi4uLmF1dGhvcml0YXRpdmUgZm9yIHRo ZSByZXNvdXJjZSBwcmlvcml0eSBuYW1lc3BhY2UgaW4gdGhlIFBBU1Nwb3JUPyIgV2hhdGV2ZXIg dGhlIHNlcnZlciBpcyBwdXJwb3J0ZWRseSBhdXRob3JpdGF0aXZlIGZvciBuZWVkcyB0byBiZSBj bGVhcmx5IHNwZWxsZWQgb3V0Lg0KDQoNCiAgICAgICdSZXNvdXJjZS1Qcmlvcml0eScgaGVhZGVy Lg0KDQoNCg0KIi4uLmhlYWRlciBmaWVsZC4iDQoNCg0KL2ENCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fDQpzdGlyIG1haWxpbmcgbGlzdA0Kc3RpckBpZXRm Lm9yZzxtYWlsdG86c3RpckBpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vc3Rpcg0KDQoNCg== --_000_7594FB04B1934943A5C02806D1A2204B6C134AE5ESESSMB109erics_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmOw0KCWNvbG9yOmJsYWNrO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCnANCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1tYXJnaW4tdG9wLWFs dDphdXRvOw0KCW1hcmdpbi1yaWdodDowY207DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 DQoJbWFyZ2luLWxlZnQ6MGNtOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRp bWVzIE5ldyBSb21hbiIsc2VyaWY7DQoJY29sb3I6YmxhY2s7fQ0KdHQNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0Kc3Bhbi5FbWFpbFN0eWxl MTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNh bnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5 bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5 cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjEN Cgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcy LjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3Qg RGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjM1Mjc3Njg1Ow0KCW1zby1s aXN0LXRlbXBsYXRlLWlkczoxNjk3NjM3Mjg7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOjM2LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFt aWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOjcyLjBwdDsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsN Cgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7 DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxpc3QgbDA6bGV2 ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv gqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEwOC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOjE0NC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250 LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9w OjE4MC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5n ZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIxNi4wcHQ7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJ bXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxp c3QgbDA6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2 ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjI1Mi4wcHQ7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9u dC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw4 DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOjI4OC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBw dDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOjMyNC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZh bWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDENCgl7bXNvLWxpc3QtaWQ6MTI1MjczOTQyMjsNCglt c28tbGlzdC10ZW1wbGF0ZS1pZHM6LTE2MDQ3OTgzMjA7fQ0KQGxpc3QgbDE6bGV2ZWwxDQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOjM2LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZv bnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOjcy LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4 LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVy IE5ldyI7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KQGxpc3Qg bDE6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEwOC4wcHQ7DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1z aXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE6bGV2ZWw0DQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJ bXNvLWxldmVsLXRhYi1zdG9wOjE0NC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsN Cglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOjE4MC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWls eTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIxNi4w cHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4w cHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7 fQ0KQGxpc3QgbDE6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjI1Mi4wcHQ7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFu c2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE6 bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjI4OC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXpl OjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDE6bGV2ZWw5DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOjMyNC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglm b250LWZhbWlseTpXaW5nZGluZ3M7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowY207fQ0KdWwNCgl7 bWFyZ2luLWJvdHRvbTowY207fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4N CjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48 IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0 PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5 b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgYmdjb2xvcj0id2hpdGUiIGxh bmc9IkVOLUdCIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRT ZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+SGksPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQiPiZndDs8L3Nw YW4+VGhlIC1kaXZlcnQtIGRvY3VtZW50IG5lZWRzIHRvIGNvLWV4aXN0IHdpdGggJnF1b3Q7cHB0 JnF1b3Q7IGV4dGVuc2lvbnMgaW4gZ2VuZXJhbCwgYW5kIEkgd291bGQgYmUgdmVyeTxzcGFuIHN0 eWxlPSJjb2xvcjp3aW5kb3d0ZXh0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2luZG93dGV4dCI+Jmd0Ow0KPC9zcGFu PnNhZCBpZiBpdHMgZGVzaWduIHJlcXVpcmVkIGFkZGl0aW9uYWwgY29uc2lkZXJhdGlvbnMgaW4g ZWFjaCBzdWNoIGV4dGVuc2lvbi4gV2hhdCBraW5kIG9mIGltcGFjdCBhcmUgeW91IGVudmlzaW9u aW5nPzxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2luZG93dGV4dCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOndpbmRvd3RleHQiPkkgd29uZGVyIGlmIHRoZSBwcm9ibGVtKHMpIHdp dGggdXNpbmcgbXVsdGlwbGUgSWRlbnRpdHkgaGVhZGVyIGZpZWxkcyBhcmUgZGl2ZXJ0LXNwZWNp ZmljLCBvciBpZiB0aGV5IGFsc28gYXBwbHkgdG8gb3RoZXIgcGFzc3BvcnQgZXh0ZW5zaW9ucy48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6d2luZG93dGV4dCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOndpbmRvd3RleHQiPihUaGVyZSBh cmUgZ2VuZXJpYyBpc3N1ZXMgd2l0aCB0aGUgc3VnZ2VzdGVkIG5lc3RpbmcgbWVjaGFuaXNtLCBt b3N0IG9mIHdoaWNoIHdlcmUgcmFpc2VkIGJ5IG15IGNvbGxlYWd1ZSBKdWxpbywgYnV0IHRoYXTi gJlzIGEgc2VwYXJhdGUgdGhyZWFkKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjp3aW5kb3d0ZXh0Ij48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29s b3I6d2luZG93dGV4dCI+UmVnYXJkcyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6d2luZG93dGV4dCI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOndpbmRvd3RleHQiPkNocmlzdGVyPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOndpbmRvd3RleHQiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCjxicj4NCk9uIDEv MjAvMTggNTozNCBQTSwgQ2hyaXN0ZXIgSG9sbWJlcmcgd3JvdGU6PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOndpbmRvd3RleHQiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVv dGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5IaSwgPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5EbyB0aGUgbmVzdGluZyBkaXNjdXNzaW9ucyBhZmZlY3QgdGhpcyBleHRlbnNpb24/ IEkgYXNzdW1lIG9uZSBjb3VsZCB1c2UgdGhpcyB3aXRoIG90aGVyIHBhc3Nwb3J0cy48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UmVnYXJkcyw8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij5DaHJpc3RlciZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PGRpdiBpZD0iQXBwbGVNYWlsU2lnbmF0dXJlIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNlbnQg ZnJvbSBteSBpUGhvbmU8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PGJyPg0KT24gMjAgSmFuIDIw MTgsIGF0IDAuMTUsIEFkYW0gUm9hY2ggJmx0OzxhIGhyZWY9Im1haWx0bzphZGFtQG5vc3RydW0u Y29tIj5hZGFtQG5vc3RydW0uY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4w cHQiPg0KPGRpdj4NCjxwPkknbSBkb2luZyBteSBBRCByZXZpZXcgb2YgZHJhZnQtaWV0Zi1zdGly LXJwaC0wMi4gVGhhbmtzIHRvIGV2ZXJ5b25lIHdobyBoYXMgd29ya2VkIG9uIHRoaXMgZG9jdW1l bnQsIGFuZCB0aGUgYXV0aG9ycyBhbmQgY2hhaXJzIGluIHBhcnRpY3VsYXIuPG86cD48L286cD48 L3A+DQo8cD5UaGUgdGVjaG5pY2FsIGNvbnRlbnQgaGVyZSBsb29rcyBnZW5lcmFsbHkgZ29vZCB0 byBtZS4gSSdkIGxpa2UgdG8gc2VlIGEgZmV3IGlzc3VlcyBhZGRyZXNzZWQgYmVmb3JlIElFVEYg TEMuIEluIHNob3J0IHN1bWFyeTo8bzpwPjwvbzpwPjwvcD4NCjx1bCB0eXBlPSJkaXNjIj4NCjxs aSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzEiPg0KVGhlIHZhbGlk YXRpb24gc2VjdGlvbiBuZWVkcyB0byBhZGQgYSBkaXNjdXNzaW9uIG9mIGhvdyB0byB0cmVhdCBj YWxscyB3aGVuIHRoZSBwcmlvcml0eSB2YWx1ZXMgaW4gJnF1b3Q7cnBoJnF1b3Q7IHBhc3Nwb3J0 cyBhbmQgU0lQICZxdW90O1Jlc291cmNlLVByaW9yaXR5JnF1b3Q7IGhlYWRlciBmaWVsZHMgYXJl bid0IDEwMCUgaWRlbnRpY2FsLg0KPG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzEiPg0KVGhlIGV4YW1wbGVzIG5lZWQgc29tZSBhZGp1 c3RtZW50LiA8bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDps MSBsZXZlbDEgbGZvMSI+DQpUaGVyZSBpcyBhIG1pbm9yIHBvaW50IG9mIGFtYmlndWl0eSBpbiB0 aGUgU2VjdXJpdHkgU2VjdGlvbiwgYnV0IHRoaXMgc2hvdWxkIGJlIGVhc3kgdG8gZml4LCBhcyBs b25nIGFzIHRoZSBXRyBrbm93cyB3aGF0IHdhcyBpbnRlbmRlZC4NCjxvOnA+PC9vOnA+PC9saT48 bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwxIGxldmVsMSBsZm8xIj4NClRoZSBJQU5B IGFjdGlvbnMgbmVlZCBhIGxpdHRsZSBiaXQgb2YgYWRqdXN0bWVudC4gPG86cD48L286cD48L2xp PjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzEiPg0KVGhlcmUg YXJlIGEgbnVtYmVyIG9mIG1pbm9yIGVkaXRvcmlhbCBpc3N1ZXMgdG8gYmUgY2xlYW5lZCB1cC48 bzpwPjwvbzpwPjwvbGk+PC91bD4NCjxwPkRldGFpbGVkIGNvbW1lbnRzIG9uIHRoZXNlIHBvaW50 cyBhcmUgaW5saW5lIGluIHRoZSBkb2N1bWVudCBiZWxvdy4gSSd2ZSByZW1vdmVkIHNvbWUgcG9y dGlvbnMgb2YgdGhlIGRvY3VtZW50IG9uIHdoaWNoIEkgaGF2ZSBubyBjb21tZW50cy48bzpwPjwv bzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1h cmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90OyI+PGJyPg0KPHR0PkFic3RyYWN0PC90dD48YnI+DQo8YnI+DQo8dHQ+Jm5ic3A7 Jm5ic3A7IFRoaXMgZG9jdW1lbnQgZXh0ZW5kcyB0aGUgU1RJUiBQQVNTcG9yVCBzcGVjaWZpY2F0 aW9uIHRvIGFsbG93IHRoZTwvdHQ+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3Rl Pg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD4mcXVvdDsuLi50aGUgU2VjdXJlIFRlbGVw aG9uZSBJZGVudGl0eSBSZXZpc2l0ZWQgKFNUSVIpIFBlcnNvbmFsIEFzc2VydGlvbiBUb2tlbiAo UEFTU3BvclQpIHNwZWNpZmljYXRpb24gZGVmaW5lZCBpbiBSRkMgODEyMi4uLiZxdW90OzxvOnA+ PC9vOnA+PC9wPg0KPHA+KFNlZSA8YSBocmVmPSJodHRwczovL3d3dy5yZmMtZWRpdG9yLm9yZy9t YXRlcmlhbHMvYWJicmV2LmV4cGFuc2lvbi50eHQiPiZsdDtodHRwczovL3d3dy5yZmMtZWRpdG9y Lm9yZy9tYXRlcmlhbHMvYWJicmV2LmV4cGFuc2lvbi50eHQmZ3Q7PC9hPiBmb3IgZ3VpZGFuY2Ug b24gYWJicmV2aWF0aW9ucyk8bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4w cHQiPiZuYnNwOyZuYnNwOyBpbmNsdXNpb24gb2YgY3J5cHRvZ3JhcGhpY2FsbHktc2lnbmVkIGFz c2VydGlvbnMgb2YgYXV0aG9yaXphdGlvbiBmb3I8L3NwYW4+PC90dD48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PGJyPg0K PHR0PiZuYnNwOyZuYnNwOyB0aGUgdmFsdWVzIHBvcHVsYXRlZCBpbiB0aGUgU0lQICdSZXNvdXJj ZS1Qcmlvcml0eScgaGVhZGVyIGZpZWxkLDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyB3aGlj aCBpcyB1c2VkIGZvciBjb21tdW5pY2F0aW9ucyByZXNvdXJjZSBwcmlvcml0aXphdGlvbi48L3R0 Pjxicj4NCjxicj4NCjx0dD4uLi48L3R0Pjxicj4NCjxicj4NCjx0dD4xLiZuYnNwOyBJbnRyb2R1 Y3Rpb248L3R0Pjxicj4NCjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgUEFTU3BvclQgW0ktRC5pZXRm LXN0aXItcGFzc3BvcnRdIGlzIGEgdG9rZW4gZm9ybWF0IGJhc2VkIG9uIEpXVDwvdHQ+PGJyPg0K PHR0PiZuYnNwOyZuYnNwOyBbUkZDNzUxOV0gZm9yIGNvbnZleWluZyBjcnlwdG9ncmFwaGljYWxs eS1zaWduZWQgaW5mb3JtYXRpb24gYWJvdXQ8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgdGhl IGlkZW50aXRpZXMgaW52b2x2ZWQgaW4gcGVyc29uYWwgY29tbXVuaWNhdGlvbnM7IGl0IGlzIHVz ZWQgd2l0aDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBTVElSIFtJLUQuaWV0Zi1zdGlyLXJm YzQ0NzRiaXNdIHRvIGNvbnZleSBhIHNpZ25lZCBhc3NlcnRpb24gb2YgdGhlPC90dD48YnI+DQo8 dHQ+Jm5ic3A7Jm5ic3A7IGlkZW50aXR5IG9mIHRoZSBwYXJ0aWNpcGFudHMgaW4gcmVhbC10aW1l IGNvbW11bmljYXRpb25zIGVzdGFibGlzaGVkPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IHZp YSBhIHByb3RvY29sIGxpa2UgU0lQLiZuYnNwOyBUaGlzIHNwZWNpZmljYXRpb24gZXh0ZW5kcyBQ QVNTcG9yVCB0bzwvdHQ+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD4mcXVvdDsuLi5saWtlIFNJUCBbUkZDMzI2MV0uLi4m cXVvdDs8bzpwPjwvbzpwPjwvcD4NCjxwPihXZSB3YW50IHRvIGNpdGUgU0lQIHRoZSBmaXJzdCB0 aW1lIGl0IGlzIG1lbnRpb25lZCk8bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1 LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MC4wcHQiPiZuYnNwOyZuYnNwOyBhbGxvdyBjcnlwdG9ncmFwaGljLXNpZ25pbmcgb2YgdGhlIFNJ UCAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlcjwvc3Bhbj48L3R0PjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8 dHQ+Jm5ic3A7Jm5ic3A7IGZpZWxkIGRlZmluZWQgaW4gW1JGQzQ0MTJdLjwvdHQ+PGJyPg0KPGJy Pg0KPHR0PiZuYnNwOyZuYnNwOyBbUkZDNDQxMl0gZGVmaW5lcyB0aGUgU0lQICdSZXNvdXJjZS1Q cmlvcml0eScgaGVhZGVyIGZpZWxkIGZvcjwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBjb21t dW5pY2F0aW9ucyBSZXNvdXJjZSBQcmlvcml0eS4mbmJzcDsgQXMgc3BlY2lmaWVkIGluIFtSRkM0 NDEyXSwgdGhlPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7ICdSZXNvdXJjZS1Qcmlvcml0eScg aGVhZGVyIGZpZWxkIG1heSBiZSB1c2VkIGJ5IFNJUCB1c2VyIGFnZW50czwvdHQ+PGJyPg0KPHR0 PiZuYnNwOyZuYnNwOyBbUkZDMzI2MV0sIGluY2x1ZGluZywgUHVibGljIFN3aXRjaGVkIFRlbGVw aG9uZSBOZXR3b3JrIChQU1ROKTwvdHQ+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1 b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD4mcXVvdDsuLi5pbmNsdWRpbmcgUHVi bGljIFN3aXRjaGVkLi4uJnF1b3Q7PG86cD48L286cD48L3A+DQo8cD4ocmVtb3ZlIHRoZSBjb21t YSk8bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUg c3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48dHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPiZuYnNwOyZuYnNw OyBnYXRld2F5cyBhbmQgdGVybWluYWxzLCBhbmQgU0lQIHByb3h5IHNlcnZlcnMgdG8gaW5mbHVl bmNlPC9zcGFuPjwvdHQ+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwPiZxdW90Oy4uLmFuZCBieSBTSVAgcHJveHkgc2VydmVycywgdG8g aW5mbHVlbmNlLi4uJnF1b3Q7PG86cD48L286cD48L3A+DQo8cD4oYWRkICZxdW90O2J5JnF1b3Q7 IGFuZCBjb21tYSk8bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJs b2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48dHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPiZu YnNwOyZuYnNwOyBwcmlvcml0aXphdGlvbiBhZmZvcmRlZCB0byBjb21tdW5pY2F0aW9uIHNlc3Np b25zLGluY2x1ZGluZyBQU1ROPC9zcGFuPjwvdHQ+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVv dGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwPiZxdW90 Oy4uLnNlc3Npb25zLCBpbmNsdWRpbmcuLi4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjxwPihzcGFj ZSBhZnRlciBjb21tYSk8bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQi PiZuYnNwOyZuYnNwOyBjYWxscy4mbmJzcDsgSG93ZXZlciwgdGhlIFNJUCAnUmVzb3VyY2UtUHJp b3JpdHknIGhlYWRlciBmaWVsZCBjb3VsZCBiZTwvc3Bhbj48L3R0PjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8 dHQ+Jm5ic3A7Jm5ic3A7IHNwb29mZWQgYW5kIGFidXNlZCBieSB1bmF1dGhvcml6ZWQgZW50aXRp ZXMuPC90dD48YnI+DQo8YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IFRoZSBTVElSIGFyY2hpdGVjdHVy ZSBbUkZDNzM0MF1hc3N1bWVzIHRoYXQgYW4gYXV0aG9yaXR5IG9uIHRoZTwvdHQ+PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 cD4mcXVvdDsuLi5TVElSIGFyY2hpdGVjdHVyZSBbUkZDNzM0MF0gYXNzdW1lcy4uLiZxdW90Ozxv OnA+PC9vOnA+PC9wPg0KPHA+KHNwYWNlIGJlZm9yZSAmcXVvdDthc3N1bWVzJnF1b3Q7KTxvOnA+ PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0i bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjx0dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+Jm5ic3A7Jm5ic3A7IG9yaWdp bmF0aW5nIHNpZGUgb2YgYSBjYWxsIHByb3ZpZGVzIGEgY3J5cHRvZ3JhcGhpYyBhc3N1cmFuY2Ug b2YgdGhlPC9zcGFuPjwvdHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgdmFsaWRp dHkgb2YgdGhlIGNhbGxpbmcgcGFydHkgbnVtYmVyIGluIG9yZGVyIHRvIHByZXZlbnQ8L3R0Pjxi cj4NCjx0dD4mbmJzcDsmbmJzcDsgaW1wZXJzb25hdGlvbiBhdHRhY2tzLiZuYnNwOyBUaGUgU1RJ UiBhcmNoaXRlY3R1cmUgYWxsb3dzIGV4dGVuc2lvbiB0aGF0PC90dD48L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwPiZxdW90 Oy4uLmFsbG93cyBleHRlbnNpb25zLi4uJnF1b3Q7PG86cD48L286cD48L3A+DQo8cD48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdp bi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHR0PjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0Ij4mbmJzcDsmbmJzcDsgY2FuIGJlIHV0aWxpemVkIGJ5IGF1dGhvcml0 aWVzIHN1cHBvcnRpbmcgcmVhbC10aW1lIGNvbW11bmljYXRpb248L3NwYW4+PC90dD48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 OyI+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBzZXJ2aWNlcyB1c2luZyB0aGUgJ1Jlc291cmNlLVBy aW9yaXR5JyBoZWFkZXIgZmllbGQgdG88L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgY3J5cHRv Z3JhcGhpY2FsbHkgc2lnbiB0aGUgU0lQICdSZXNvdXJjZS1Qcmlvcml0eScgaGVhZGVyIGZpZWxk IGFuZDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBjb252ZXkgYXNzZXJ0aW9uIG9mIHRoZSBh dXRob3JpemF0aW9uIGZvciAnUmVzb3VyY2UtUHJpb3JpdHknLiZuYnNwOyBGb3I8L3R0Pjxicj4N Cjx0dD4mbmJzcDsmbmJzcDsgZXhhbXBsZSwgdGhlIGF1dGhvcml0eSBvbiB0aGUgb3JpZ2luYXRp bmcgc2lkZSB2ZXJpZnlpbmcgdGhlPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGF1dGhvcml6 YXRpb24gb2YgYSBwYXJ0aWN1bGFyIGNvbW11bmljYXRpb24gZm9yIFJlc291cmNlLVByaW9yaXR5 IGNhbjwvdHQ+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4m bmJzcDs8L286cD48L3A+DQo8cD5TaW5nbGUgcXVvdGVzIGFyb3VuZCAnUmVzb3VyY2UtUHJpb3Jp dHknLjxvOnA+PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90 ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjx0dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+Jm5ic3A7Jm5i c3A7IHVzZSBhIFBBU1NQb3JUIGNsYWltIHRvIGNyeXB0b2dyYXBoaWNhbGx5LXNpZ24gdGhlIFNJ UCAnUmVzb3VyY2UtPC9zcGFuPjwvdHQ+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8 cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwPiZxdW90Oy4uLmNyeXB0b2dyYXBoaWNhbGx5IHNp Z24uLi4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJs b2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48dHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPiZu YnNwOyZuYnNwOyBQcmlvcml0eScgaGVhZGVyIGZpZWxkIGFuZCBjb252ZXkgYW4gYXNzZXJ0aW9u IG9mIHRoZSBhdXRob3JpemF0aW9uPC9zcGFuPjwvdHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxicj4NCjx0dD4mbmJz cDsmbmJzcDsgZm9yICdSZXNvdXJjZS1Qcmlvcml0eScuJm5ic3A7IFRoaXMgd2lsbCBhbGxvdyBh IHJlY2VpdmluZyBlbnRpdHk8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgKGluY2x1ZGluZyBl bnRpdGllcyBsb2NhdGVkIGluIGRpZmZlcmVudCBuZXR3b3JrIGRvbWFpbnMvYm91bmRhcmllcyk8 L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgdG8gdmVyaWZ5IHRoZSB2YWxpZGl0eSBvZiBhc3Nl cnRpb25zIGF1dGhvcml6aW5nIFJlc291cmNlLVByaW9yaXR5LjwvdHQ+PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5TaW5n bGUgcXVvdGVzIGFyb3VuZCAnUmVzb3VyY2UtUHJpb3JpdHknLjxvOnA+PC9vOnA+PC9wPg0KPHA+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBw dDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx0dD48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEwLjBwdCI+Jm5ic3A7Jm5ic3A7IENyeXB0b2dyYXBoaWNhbGx5LXNp Z25lZCBTSVAgJ1Jlc291cmNlLVByaW9yaXR5JyBoZWFkZXJzIHdpbGwgYWxsb3cgYTwvc3Bhbj48 L3R0PjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8cD4mcXVvdDsuLi5jcnlwdG9ncmFwaGljYWxseSBzaWduZWQgU0lQICdSZXNvdXJjZS1Q cmlvcml0eScgaGVhZGVyIGZpZWxkcy4uLiZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPHA+KHJlbW92 ZSBoeXBoZW4sIGFuZCByZXBsYWNlICZxdW90O2hlYWRlcnMmcXVvdDsgd2l0aCAmcXVvdDtoZWFk ZXIgZmllbGRzJnF1b3Q7KTxvOnA+PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0 Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx0dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBw dCI+Jm5ic3A7Jm5ic3A7IHJlY2VpdmluZyBlbnRpdHkgdG8gdmVyaWZ5IGFuZCBhY3Qgb24gdGhl IGluZm9ybWF0aW9uIHdpdGggY29uZmlkZW5jZTwvc3Bhbj48L3R0PjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8 dHQ+Jm5ic3A7Jm5ic3A7IHRoYXQgdGhlIGluZm9ybWF0aW9uIGhhdmUgbm90IGJlZW4gc3Bvb2Zl ZCBvciBjb21wcm9taXNlZC48L3R0Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90 ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+JnF1b3Q7Li4uaGFzIG5vdCBiZWVuIHNw b29mZWQgb3IgY29tcHJvbWlzZWQuJnF1b3Q7PG86cD48L286cD48L3A+DQo8cD48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1i b3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxicj4NCjx0dD4m bmJzcDsmbmJzcDsgVGhpcyBzcGVjaWZpY2F0aW9uIGRvY3VtZW50cyBhbiBvcHRpb25hbCBleHRl bnNpb24gdG8gUEFTU3BvclQgYW5kPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IHRoZSBhc3Nv Y2lhdGVkIFNUSVIgbWVjaGFuaXNtcyB0byBwcm92aWRlIGEgZnVuY3Rpb24gdG8gc2lnbiB0aGUg U0lQPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7ICdSZXNvdXJjZS1Qcmlvcml0eScgaGVhZGVy IGZpZWxkLiZuYnNwOyBUaGlzIFBBU1Nwb3JUIG9iamVjdCBpcyB1c2VkIHRvPC90dD48YnI+DQo8 dHQ+Jm5ic3A7Jm5ic3A7IHByb3ZpZGUgYXR0ZXN0YXRpb24gb2YgYSBjYWxsaW5nIHVzZXIgYXV0 aG9yaXphdGlvbiBmb3IgcHJpb3JpdHk8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgY29tbXVu aWNhdGlvbnMuJm5ic3A7IFRoaXMgaXMgbmVjZXNzYXJ5IGluIGFkZGl0aW9uIHRvIHRoZSBQQVNT cG9yVCBvYmplY3Q8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgdGhhdCBpcyB1c2VkIGZvciBj YWxsaW5nIHVzZXIgdGVsZXBob25lIG51bWJlciBhdHRlc3RhdGlvbi4mbmJzcDsgSG93IHRoZTwv dHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBvcHRpb25hbCBleHRlbnNpb24gdG8gUEFTU3BvclQg aXMgdXNlZCBmb3IgcmVhbC10aW1lIGNvbW11bmljYXRpb25zPC90dD48YnI+DQo8dHQ+Jm5ic3A7 Jm5ic3A7IHN1cHBvcnRlZCB1c2luZyBTSVAgJ1Jlc291cmNlLVByaW9yaXR5JyBoZWFkZXIgZmll bGQgaXMgZGVmaW5lZCBpbjwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBvdGhlciBkb2N1bWVu dHMgYW5kIGlzIG91dHNpZGUgdGhlIHNjb3BlIG9mIHRoaXMgZG9jdW1lbnQuPC90dD48L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwPkkgYXNzdW1lIHRoZXNlIG90aGVyIGRvY3VtZW50cyBhcmUgdW5kZXIgZGV2ZWxvcG1lbnQ/ IElmIHNvLCB0aGV5IHNob3VsZCBiZSBjaXRlZCBoZXJlLjxvOnA+PC9vOnA+PC9wPg0KPHA+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDtt YXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+ DQo8dHQ+Mi4mbmJzcDsgVGVybWlub2xvZ3k8L3R0Pjxicj4NCjxicj4NCjx0dD4mbmJzcDsmbmJz cDsgVGhlIGtleSB3b3JkcyAmcXVvdDtNVVNUJnF1b3Q7LCAmcXVvdDtNVVNUIE5PVCZxdW90Oywg JnF1b3Q7UkVRVUlSRUQmcXVvdDssICZxdW90O1NIQUxMJnF1b3Q7LCAmcXVvdDtTSEFMTCBOT1Qm cXVvdDssPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7ICZxdW90O1NIT1VMRCZxdW90OywgJnF1 b3Q7U0hPVUxEIE5PVCZxdW90OywgJnF1b3Q7UkVDT01NRU5ERUQmcXVvdDssICZxdW90O01BWSZx dW90OywgYW5kICZxdW90O09QVElPTkFMJnF1b3Q7IGluIHRoaXM8L3R0Pjxicj4NCjx0dD4mbmJz cDsmbmJzcDsgZG9jdW1lbnQgYXJlIHRvIGJlIGludGVycHJldGVkIGFzIGRlc2NyaWJlZCBpbiBS RkMgMjExOSBbUkZDMjExOV0uPC90dD48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVv dGU+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwPlRoaXMgZG9jdW1lbnQgaGFzIHNldmVy YWwgbm9uLW5vcm1hdGl2ZSB1c2VzIG9mICZxdW90O211c3QmcXVvdDssICZxdW90O3Nob3VsZCwm cXVvdDsgYW5kICZxdW90O21heSwmcXVvdDsgYW5kIHNvIGl0IG5lZWRzIHRvIHVzZSB0aGUgUkZD ODE3NCBib2lsZXJwbGF0ZSBpbnN0ZWFkIG9mIHRoZSBSRkMyMTE5IGJvaWxlcnBsYXRlLjxvOnA+ PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0i bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+My4mbmJzcDsgUEFTU3BvclQgJ3JwaCcgQ2xhaW08L3R0 Pjxicj4NCjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgVGhpcyBzcGVjaWZpY2F0aW9uIGRlZmluZXMg YSBuZXcgSlNPTiBXZWIgVG9rZW4gY2xhaW0gZm9yICZxdW90O3JwaCZxdW90Oyw8L3R0Pjxicj4N Cjx0dD4mbmJzcDsmbmJzcDsgd2hpY2ggcHJvdmlkZXMgYW4gYXNzZXJ0aW9uIGZvciBpbmZvcm1h dGlvbiBpbiBTSVAgJ1Jlc291cmNlLTwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBQcmlvcml0 eSdoZWFkZXIuPC90dD48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cD48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwPiZxdW90Oy4uLlByaW9yaXR5JyBoZWFkZXIgZmllbGQu JnF1b3Q7PG86cD48L286cD48L3A+DQo8cD4oc3BhY2UgYWZ0ZXIgY2xvc2luZyBxdW90YXRpb24g bWFyaywgJnF1b3Q7aGVhZGVyIGZpZWxkJnF1b3Q7IGluc3RlYWQgb2YgJnF1b3Q7aGVhZGVyJnF1 b3Q7KTxvOnA+PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90 ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IFRoZSBjcmVhdG9y IG9mIGEgUEFTU3BvclQgb2JqZWN0IGFkZHMgYSAmcXVvdDtwcHQmcXVvdDsgdmFsdWUgb2YgJnF1 b3Q7cnBoJnF1b3Q7IHRvIHRoZTwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBoZWFkZXIgb2Yg YSBQQVNTcG9yVCBvYmplY3QsIGluIHdoaWNoIGNhc2UgdGhlIFBBU1Nwb3JUIGNsYWltcyBNVVNU PC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGNvbnRhaW4gYSAmcXVvdDtycGgmcXVvdDsgY2xh aW0sIGFuZCBhbnkgZW50aXRpZXMgdmVyaWZ5aW5nIHRoZSBQQVNTcG9yVCBvYmplY3Q8L3R0Pjxi cj4NCjx0dD4mbmJzcDsmbmJzcDsgd2lsbCBiZSByZXF1aXJlZCB0byB1bmRlcnN0YW5kIHRoZSAm cXVvdDtwcHQmcXVvdDsgZXh0ZW5zaW9uIGluIG9yZGVyIHRvPC90dD48YnI+DQo8dHQ+Jm5ic3A7 Jm5ic3A7IHByb2Nlc3MgdGhlIFBBU1Nwb3JUIGluIHF1ZXN0aW9uLiZuYnNwOyBBIFBBU1NQb3JU IGhlYWRlciB3aXRoIHRoZSAmcXVvdDtwcHQmcXVvdDs8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJz cDsgaW5jbHVkZWQgd2lsbCBsb29rIGFzIGZvbGxvd3M6PC90dD48YnI+DQo8YnI+DQo8dHQ+Jm5i c3A7Jm5ic3A7IHsmbmJzcDsgJnF1b3Q7dHlwJnF1b3Q7OiZxdW90O3Bhc3Nwb3J0JnF1b3Q7LDwv dHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtwcHQmcXVvdDs6JnF1 b3Q7cnBoJnF1b3Q7LDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVv dDthbGcmcXVvdDs6JnF1b3Q7RVMyNTYmcXVvdDssPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7ICZxdW90O3g1dSZxdW90Ozo8YSBocmVmPSJodHRwczovL3d3dy5leGFtcGxl Lm9yZy9jZXJ0LmNlciI+JnF1b3Q7aHR0cHM6Ly93d3cuZXhhbXBsZS5vcmcvY2VydC5jZXImcXVv dDs8L2E+fTwvdHQ+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8cD5JZGVhbGx5LCB0aGlzIHdvdWxkIGJlIGVpdGhlciBwcmV0 dHktcHJpbnRlZCBvciBjYW5vbmljYWxpemVkLiBTaW5jZSBpdCdzIHRvbyBsb25nIHRvIGZpdCBv biBhIGxpbmUgaW4gY2Fub25pY2FsIGZvcm0sIEkgcHJvcG9zZTo8bzpwPjwvbzpwPjwvcD4NCjxw Pjx0dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+ezwvc3Bhbj48L3R0PjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 Ij48YnI+DQo8dHQ+Jm5ic3A7ICZxdW90O3R5cCZxdW90OzomcXVvdDtwYXNzcG9ydCZxdW90Oyw8 L3R0Pjxicj4NCjx0dD4mbmJzcDsgJnF1b3Q7cHB0JnF1b3Q7OiZxdW90O3JwaCZxdW90Oyw8L3R0 Pjxicj4NCjx0dD4mbmJzcDsgJnF1b3Q7YWxnJnF1b3Q7OiZxdW90O0VTMjU2JnF1b3Q7LDwvdHQ+ PGJyPg0KPHR0PiZuYnNwOyAmcXVvdDt4NXUmcXVvdDs6PGEgaHJlZj0iaHR0cHM6Ly93d3cuZXhh bXBsZS5vcmcvY2VydC5jZXIiPiZxdW90O2h0dHBzOi8vd3d3LmV4YW1wbGUub3JnL2NlcnQuY2Vy JnF1b3Q7PC9hPjwvdHQ+PGJyPg0KPHR0Pn08L3R0Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBUaGUgJnF1b3Q7cnBoJnF1b3Q7IGNsYWltIHdpbGwgcHJv dmlkZSBhbiBhc3NlcnRpb24gb2YgYXV0aG9yaXphdGlvbiwmcXVvdDthdXRoJnF1b3Q7LDwvdHQ+ PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cD4mcXVvdDsuLi5hdXRob3JpemF0aW9uLCAmcXVvdDthdXRoJnF1b3Q7LCAuLi4m cXVvdDs8bzpwPjwvbzpwPjwvcD4NCjxwPihzcGFjZSBiZXR3ZWVuIGNvbW1hIGFuZCBvcGVuaW5n IHF1b3RhdGlvbiBtYXJrKTxvOnA+PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0 Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx0dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBw dCI+Jm5ic3A7Jm5ic3A7IGZvciBpbmZvcm1hdGlvbiBpbiB0aGUgU0lQICZxdW90O1Jlc291cmNl LVByaW9yaXR5JnF1b3Q7IGhlYWRlciBmaWVsZCAoaS5lLiw8L3NwYW4+PC90dD48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBSZXNvdXJjZS1Qcmlvcml0eTogbmFtZXNwYWNlICZxdW90 Oy4mcXVvdDsgci1wcmlvcml0eSkgYmFzZWQgb24gW1JGQzQ0MTJdLjwvdHQ+PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5U aGUgdXNlIG9mIHRoZSBzdHJpbmcgJ25hbWVzcGFjZSAmcXVvdDsuJnF1b3Q7IHItcHJpb3JpdHkn IGhlcmUgYW5kIGVsc2V3aGVyZSBpbiB0aGUgZG9jdW1lbnQgaGFzIGEgZGV0cmltZW50YWwgaW1w YWN0IG9uIHJlYWRhYmlsaXR5LiBJIHN0cm9uZ2x5IHN1Z2dlc3QgcmVwbGFjaW5nIGl0IHdpdGgg JnF1b3Q7ci12YWx1ZSZxdW90OyAodGhlIG5hbWUgb2YgdGhpcyBwcm9kdWN0aW9uIGluIFJGQzQ0 MTIpIGV2ZXJ5d2hlcmUuPG86cD48L286cD48L3A+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQi Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHR0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0 Ij4mbmJzcDsmbmJzcDsgU3BlY2lmaWNhbGx5LCB0aGUgJnF1b3Q7cnBoJnF1b3Q7IGNsYWltIGlu Y2x1ZGVzIGFzc2VydGlvbiBvZiB0aGUgcHJpb3JpdHktPC9zcGFuPjwvdHQ+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxi cj4NCjx0dD4mbmJzcDsmbmJzcDsgbGV2ZWwgb2YgdGhlIHVzZXIgdG8gYmUgdXNlZCBmb3IgYSBn aXZlbiBjb21tdW5pY2F0aW9uIHNlc3Npb24uJm5ic3A7IFRoZTwvdHQ+PGJyPg0KPHR0PiZuYnNw OyZuYnNwOyB2YWx1ZSBvZiB0aGUgJnF1b3Q7cnBoJnF1b3Q7IGNsYWltIGlzIGFuIGFycmF5IGNv bnRhaW5pbmcgb25lIG9yIG1vcmUgb2YgSlNPTjwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBv YmplY3RzIGZvciB0aGUgY29udGVudCBvZiB0aGUgU0lQICdSZXNvdXJjZS1Qcmlvcml0eScgaGVh ZGVyIHRoYXQgaXM8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgYmVpbmcgYXNzZXJ0ZWQgb2Yg d2hpY2ggb25lIG9mIHRoZSAmcXVvdDtycGgmcXVvdDsgb2JqZWN0LCBpcyBtYW5kYXRvcnkuPC90 dD48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxwPlRoaXMgbGFzdCBzZW50ZW5jZSBpcyB2ZXJ5IGhhcmQgdG8gcGFyc2U7IGFu ZCAoYmFzZWQgb24gdGhlIGV4YW1wbGUpIHRoZSB2YWx1ZSBpcyBpbnRlbmRlZCB0byBiZSBhIEpT T04gT2JqZWN0IChjdXJseSBicmFjZXMpIHJhdGhlciB0aGFuIGEgSlNPTiBBcnJheSAoc3F1YXJl IGJyYWNlcykuIEkgc3VnZ2VzdDogJ1RoZSB2YWx1ZSBvZiB0aGUgJnF1b3Q7cnBoJnF1b3Q7IGNs YWltIGlzIGFuIE9iamVjdCB3aXRoIG9uZSBvciBtb3JlIGtleXMuIEVhY2gga2V5DQogaXMgYXNz b2NpYXRlZCB3aXRoIGEgSlNPTiBBcnJheS4gVGhlc2UgYXJyYXlzIGNvbnRhaW4gU3RyaW5ncyB0 aGF0IGNvcnJlc3BvbmQgdG8gdGhlIHItdmFsdWVzIGluZGljYXRlZCBpbiB0aGUgU0lQICZxdW90 O1Jlc291cmNlLVByaW9yaXR5JnF1b3Q7IGhlYWRlciBmaWVsZC4nIChub3RlOiAmcXVvdDtoZWFk ZXIgZmllbGQmcXVvdDssIG5vdCAmcXVvdDtoZWFkZXImcXVvdDspPG86cD48L286cD48L3A+DQo8 cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUu MHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsi Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgVGhlIGZvbGxvd2luZyBpcyBhbiBleGFtcGxlICZxdW90 O3JwaCZxdW90OyBjbGFpbSBmb3IgYSBTSVAgJnF1b3Q7UmVzb3VyY2UtUHJpb3JpdHkmcXVvdDs8 L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgaGVhZGVyIGZpZWxkIHdpdGggYSAmcXVvdDtuYW1l c3BhY2UgJnF1b3Q7LiZxdW90OyByLXByaW9yaXR5JnF1b3Q7IHZhbHVlIG9mICZxdW90O2V0cy4w JnF1b3Q7IGFuZDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyB3aXRoIGEgJnF1b3Q7bmFtZXNw YWNlICZxdW90Oy4mcXVvdDsgci1wcmlvcml0eSZxdW90OyB2YWx1ZSBvZiAmcXVvdDt3cHMuMCZx dW90Oy48L3R0Pjxicj4NCjxicj4NCjx0dD4mbmJzcDsmbmJzcDsmbmJzcDsgeyAmcXVvdDtvcmln JnF1b3Q7OnsmcXVvdDt0biZxdW90OzomcXVvdDsxMjE1NTU1MTIxMiZxdW90O308L3R0Pjxicj4N Cjx0dD4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7ZGVzdCZxdW90Ozp7WyZxdW90O3Ru JnF1b3Q7OiZxdW90OzEyMTI1NTUxMjEzJnF1b3Q7XX0sPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2lhdCZxdW90OzoxNDQzMjA4MzQ1LDwvdHQ+PGJyPg0KPHR0 PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtycGgmcXVvdDs6eyZxdW90O2F1dGgmcXVv dDs6WyZxdW90O2V0cy4wJnF1b3Q7LCZxdW90O3dwcy4wJnF1b3Q7XX08L3R0Pjwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+ QXMgYWJvdmUsIEkgcmVjb21tZW5kIHByZXR0eS1wcmludGluZyB0aGlzLiBJdCdzIGFsc28gbWlz c2luZyBhIGNvbW1hIGFmdGVyIHRoZSAmcXVvdDtvcmlnJnF1b3Q7IHZhbHVlLCBhbmQgdGhlIHRv cC1sZXZlbCBzdHJ1Y3R1cmUgaXMgbWlzc2luZyBhIGNsb3NpbmcgYnJhY2UuIFRoZSB2YWx1ZSBm b3IgJnF1b3Q7aWF0JnF1b3Q7IG5lZWRzIHRvIGJlIGVuY2xvc2VkIGluIHF1b3Rlcy48bzpwPjwv bzpwPjwvcD4NCjxwPlRoZSBOQU5QQSBoYXMgYWxsb2NhdGVkIE5QQTU1NTAxeHggZm9yIGV4YW1w bGUgdXNlLCBub3QgTlBBNTU1eHh4eCwgbXVjaCBvZiB3aGljaCByZW1haW5zIGFzc2lnbmFibGUg KGNmDQo8YSBocmVmPSJodHRwczovL3d3dy5uYXRpb25hbG5hbnBhLmNvbS9wZGYvTlJVRi9BVElT LTAzMDAxMTUucGRmIj4mbHQ7aHR0cHM6Ly93d3cubmF0aW9uYWxuYW5wYS5jb20vcGRmL05SVUYv QVRJUy0wMzAwMTE1LnBkZiZndDs8L2E+KS48bzpwPjwvbzpwPjwvcD4NCjxwPlB1dHRpbmcgYWxs IHRoaXMgdG9nZXRoZXIsIEkgYmVsaWV2ZSB3aGF0IHlvdSB3YW50IGlzOjxvOnA+PC9vOnA+PC9w Pg0KPHA+PHR0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij57PC9zcGFuPjwvdHQ+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcm cXVvdDsiPjxicj4NCjx0dD4mbmJzcDsgJnF1b3Q7b3JpZyZxdW90Ozp7JnF1b3Q7dG4mcXVvdDs6 JnF1b3Q7MTIxNTU1NTAxMTImcXVvdDt9LDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyAmcXVvdDtkZXN0 JnF1b3Q7OntbJnF1b3Q7dG4mcXVvdDs6JnF1b3Q7MTIxMjU1NTAxMTMmcXVvdDtdfSw8L3R0Pjxi cj4NCjx0dD4mbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiZxdW90OzE0NDMyMDgzNDUmcXVvdDssPC90 dD48YnI+DQo8dHQ+Jm5ic3A7ICZxdW90O3JwaCZxdW90Ozp7JnF1b3Q7YXV0aCZxdW90OzpbJnF1 b3Q7ZXRzLjAmcXVvdDssJnF1b3Q7d3BzLjAmcXVvdDtdfTwvdHQ+PGJyPg0KPHR0Pn08L3R0Pjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVv dGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBBZnRlciB0aGUg aGVhZGVyIGFuZCBjbGFpbXMgUEFTU3BvclQgb2JqZWN0cyBoYXZlIGJlZW4gY29uc3RydWN0ZWQs PC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IHRoZWlyIHNpZ25hdHVyZSBpcyBnZW5lcmF0ZWQg bm9ybWFsbHkgcGVyIHRoZSBndWlkYW5jZSBpbjwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBb SS1ELmlldGYtc3Rpci1wYXNzcG9ydF0gdXNpbmcgdGhlIGZ1bGwgZm9ybSBvZiBQQVNTUG9yVC4m bmJzcDsgVGhlPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGNyZWRlbnRpYWxzIChlLmcuLCBh dXRob3JpdHkgcmVzcG9uc2libGUgZm9yIGF1dGhvcml6aW5nIFJlc291cmNlLTwvdHQ+PGJyPg0K PHR0PiZuYnNwOyZuYnNwOyBQcmlvcml0eSkgdXNlZCB0byBjcmVhdGUgdGhlIHNpZ25hdHVyZSBt dXN0IGhhdmUgYXV0aG9yaXR5IG92ZXIgdGhlPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7ICZx dW90O3JwaCZxdW90OyBjbGFpbSBhbmQgdGhlcmUgaXMgb25seSBvbmUgYXV0aG9yaXR5IHBlciBj bGFpbS4mbmJzcDsgVGhlIGF1dGhvcml0eTwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBNVVNU IHVzZSBpdHMgY3JlZGVudGlhbHMgKGkuZS4sIENFUlQpIGFzc29jaWF0ZWQgd2l0aCB0aGUgc3Bl Y2lmaWM8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgc2VydmljZSBzdXBwb3J0ZWQgYnkgdGhl IFNJUCBuYW1lc3BhY2UgaW4gdGhlIGNsYWltLjwvdHQ+PGJyPg0KPGJyPg0KPHR0PjQuJm5ic3A7 ICdycGgnIGluIFNJUDwvdHQ+PGJyPg0KPGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBUaGlzIHNlY3Rp b24gc3BlY2lmaWVzIFNJUC1zcGVjaWZpYyB1c2FnZSBmb3IgdGhlICZxdW90O3JwaCZxdW90OyBj bGFpbSBpbjwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBQQVNTcG9yVC48L3R0Pjxicj4NCjxi cj4NCjx0dD40LjEuJm5ic3A7IEF1dGhlbnRpY2F0aW9uIFNlcnZpY2UgQmVoYXZpb3I8L3R0Pjxi cj4NCjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgVGhlIEF1dGhlbnRpY2F0aW9uIFNlcnZpY2Ugd2ls bCBjcmVhdGUgdGhlICZxdW90O3JwaCZxdW90OyBjbGFpbSB1c2luZyB0aGU8L3R0Pjxicj4NCjx0 dD4mbmJzcDsmbmJzcDsgdmFsdWVzIGRpc2N1c3NlZCBpbiBzZWN0aW9uIDMgYmFzZWQgb24gW1JG QzQ0MTJdLiZuYnNwOyBUaGUgY29uc3RydWN0aW9uPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7 IG9mICZxdW90O3JwaCZxdW90OyBjbGFpbSBmb2xsb3dzIHRoZSBzdGVwcyBkZXNjcmliZWQgaW4g U2VjdGlvbiA0IG9mPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IFtJLUQuaWV0Zi1zdGlyLXJm YzQ0NzRiaXNdLjwvdHQ+PGJyPg0KPGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBUaGUgcmVzdWx0aW5n IElkZW50aXR5IGhlYWRlciBmb3IgJnF1b3Q7cnBoJnF1b3Q7IG1pZ2h0IGxvb2sgYXMgZm9sbG93 czo8L3R0Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxwPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHA+JnF1b3Q7Li4uaGVhZGVyIGZpZWxkLi4uJnF1b3Q7PG86cD48L286 cD48L3A+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJn aW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBO ZXcmcXVvdDsiPjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgJnF1b3Q7ZXlKaGJHY2lPaUpGVXpJMU5p SXNJblI1Y0NJNklrcFhWQ0o5LmV5SnBjM01pT2lKbGVVb3daVmhCYVU5cFNuZDwvdHQ+PGJyPg0K PHR0PiZuYnNwOyZuYnNwOyBaV0U1NlkwYzVlV1JEU1hORVVXOXBZMGhDTUVscWIybGpia0p2U1ds M1RrTnBTbWhpUjJOcFQybEtSbFY2U1RGTzwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBhVWx6 UkZGdmFXVkVWakZKYW5CdlpFaFNkMk42YjNaTU0yUXpaSGsxYkdWSFJuUmpSM2hzVEcxT2RtSlRP V3BhVzwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBFb3dURzFPYkdOdU1FNURaekJMSUh4ODRv Q1pMdUtBbVh4OElHVjVRV2xpTTBwd1dubEpObVY1U2pCaWFVazJTVzwvdHQ+PGJyPg0KPHR0PiZu YnNwOyZuYnNwOyBwRmVVMVVWVEZPVkZWNFRXcEZlVWx1TUU1RGFVcHJXbGhPTUVscWNEZFhlVW93 WW1sSk5rbHFSWGxOVkVreFRsUjwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBWZUUxcVJYcEpi REU1VEVFd1MwbHRiR2hrUTBrMlRWUlJNRTE2U1hkUFJFMHdUbE4zVGtOcFNubGpSMmRwVDI1ejwv dHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBhVmxZVmpCaFEwazJWM2xLYkdSSVRYVk5RMGx6U1c1 a2QyTjVOSGRKYkRFNVJGRnZQU0o5LnMzN1M2VkM4SE02RDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZu YnNwOyBsNll6SmVRRHNyWmN3SjBsaXp4aFVyQTdmXzk4b1dCSHZvLWNsLW44TUlob0NyMTh2WVlG eTNibFh2czNmc2xNXzwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBvb3MyUDJEeXcmcXVvdDs7 IGluZm89IDxhIGhyZWY9Imh0dHBzOi8vd3d3LmV4YW1wbGUub3JnL2NlcnQuY2VyIj4mcXVvdDto dHRwczovL3d3dy5leGFtcGxlLm9yZy9jZXJ0LmNlciZxdW90OzwvYT47YWxnPUVTMjU2OzwvdHQ+ PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBwcHQ9JnF1b3Q7cnBoJnF1b3Q7PC90dD48L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw PlRoaXMgZXhhbXBsZSBoYXMgYSBudW1iZXIgb2YgaXNzdWVzOjxvOnA+PC9vOnA+PC9wPg0KPHVs IHR5cGU9ImRpc2MiPg0KPGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMCBsZXZlbDEg bGZvMiI+DQpJbiB0aGUgSWRlbnRpdHkgaGVhZGVyIGZpZWxkLCB0aGUgc2lnbmVkLWlkZW50aXR5 LWRpZ2VzdCBzaG91bGRuJ3QgYmUgcXVvdGVkLiA8bzpwPg0KPC9vOnA+PC9saT48bGkgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21zby1saXN0OmwwIGxldmVsMSBsZm8yIj4NCkluIHRoZSBJZGVudGl0eSBo ZWFkZXIgZmllbGQsIGluZm8gaXMgZW5jbG9zZWQgaW4gJmx0OyZndDsgcmF0aGVyIHRoYW4gJnF1 b3Q7JnF1b3Q7LiA8bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlz dDpsMCBsZXZlbDEgbGZvMiI+DQpJbiB0aGUgSWRlbnRpdHkgaGVhZGVyIGZpZWxkLCBwcHQgaXMg YSB0b2tlbiByYXRoZXIgdGhhbiBhIHF1b3RlZCBzdHJpbmcuIDxvOnA+PC9vOnA+PC9saT48bGkg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwwIGxldmVsMSBsZm8yIj4NClRoZSBzaWduZWQt aWRlbnRpdHktZGlnZXN0IGhlYWRlciBuZWVkcyB0byBpbmRpY2F0ZSBhICZxdW90O3R5cCZxdW90 OyBvZiAmcXVvdDtwYXNzcG9ydCZxdW90OyByYXRoZXIgdGhhbiBKV1QsIGFuZCBpdCBuZWVkcyB0 byBpbmNsdWRlIGJvdGggYSAmcXVvdDtwcHQmcXVvdDsgYW5kICZxdW90O3g1dSZxdW90OyBmaWVs ZC4NCjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwwIGxl dmVsMSBsZm8yIj4NClRoZSBzaWduZWQtaWRlbnRpdHktZGlnZXN0IGJvZHkgc2hvdWxkIGNvbnRh aW4gb25seSB0aGUgcGFzc3BvcnQgY2xhaW0gcmF0aGVyIHRoYW4gYSBKU09OIG9iamVjdCB0aGF0 IGl0c2VsZiBjb250YWlucyBhIGJhc2U2NC1lbmNvZGVkIEpXUyBoZWFkZXIgY29uY2F0ZW5hdGVk IHdpdGggYSBjbGFpbS4NCjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21z by1saXN0OmwwIGxldmVsMSBsZm8yIj4NCkkgYmVsaWV2ZSB0aGF0LCBldmVuIHdoZW4gdGhlIGJv ZHkgaXMgaW5jbHVkZWQsIHZhbHVlcyBpbiB0aGUgaGVhZGVyIGFuZCBib2R5IG5lZWQgdG8gYmUg YmUgY2Fub25pY2FsaXplZCAoaS5lLiwgYWxsIG9uIG9uZSBsaW5lLCBubyBzcGFjZXMsIGluIGFs cGhhYmV0aWNhbCBvcmRlciwgZXRjLikNCjxvOnA+PC9vOnA+PC9saT48L3VsPg0KPHA+SSB3b3Vs ZCBhbHNvIHJlY29tbWVuZCBmb2xsb3dpbmcgdGhlIGNvbnZlbnRpb24gb2YgaW5kaWNhdGluZyB0 aGF0IGxpbmUtd3JhcHMgYXJlIG9ubHkgZm9yIHJlYWRhYmlsaXR5LCBhbmQgaW5jbHVkaW5nIHRo ZSBoZWFkZXIgZmllbGQgbmFtZSBpbiB0aGUgZXhhbXBsZS4gUHV0dGluZyBhbGwgdGhpcyB0b2dl dGhlciwgSSBiZWxpZXZlIHdoYXQgeW91IHdhbnQgaXM6PG86cD48L286cD48L3A+DQo8cD48dHQ+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPiZuYnNwOyZuYnNwOyBGb3IgZXhhbXBsZSwg YSBJZGVudGl0eSBoZWFkZXIgZmllbGQgZm9yICZxdW90O3JwaCZxdW90OyBtaWdodCBsb29rPC9z cGFuPjwvdHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDsiPjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgYXMgZm9sbG93cyAoYmFj a3NsYXNoZXMgc2hvd24gZm9yIGxpbmUgZm9sZGluZyBvbmx5KTo8L3R0Pjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwPjx0dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+Jm5ic3A7Jm5i c3A7IElkZW50aXR5OiBleUpoYkdjaU9pSkZVekkxTmlJc0luQndkQ0k2SW5Kd2FDSXNJblI1Y0NJ NkluQmhjM053YjNKMEkgXDwvc3Bhbj48L3R0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+Jm5ic3A7Jm5i c3A7IGl3aWVEVjFJam9pYUhSMGNITTZMeTkzZDNjdVpYaGhiWEJzWlM1amIyMHZZMlZ5ZEM1alpY SWlmUW8uZXlKa1pYTjAgXDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBJanA3V3lKMGJpSTZJ akV5TVRJMU5UVXdNVEV6SWwxOUxDSnBZWFFpT2lJeE5EUXpNakE0TXpRMUlpd2liM0pwWnlJIFw8 L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgNmV5SjBiaUk2SWpFeU1UVTFOVFV3TVRFeUluMHNJ bkp3YUNJNmV5SmhkWFJvSWpwYkltVjBjeTR3SWl3aWQzQnpMaiBcPC90dD48YnI+DQo8dHQ+Jm5i c3A7Jm5ic3A7IEFpWFgxOUNnLnMzN1M2VkM4SE02RGw2WXpKZVFEc3JaY3dKMGxpenhoVXJBN2Zf OThvV0JIdm8tY2wtbjhNSWhvQ3IgXDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyAxOHZZWUZ5 M2JsWHZzM2ZzbE1fb29zMlAyRHl3O2luZm89Jmx0OzxhIGhyZWY9Imh0dHBzOi8vd3d3LmV4YW1w bGUub3JnL2NlcnQuY2VyIj5odHRwczovL3d3dy5leGFtcGxlLm9yZy9jZXJ0LmNlcjwvYT4gXDwv dHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyAmZ3Q7O2FsZz1FUzI1NjtwcHQ9cnBoPC90dD48YnI+ DQo8L3NwYW4+PGJyPg0KKE5vdGU6IHRoaXMgZXhhbXBsZSBhc3N1bWVzIHRoZSBjYWxsaW5nIGFu ZCBjYWxsZWQgcGFydHkgbnVtYmVycyBpbiB0aGUgcHJldmlvdXMgZXhhbXBsZSBhcmUgY2hhbmdl ZCB0byAxMjE1NTU1MDExMiBhbmQgMTIxNTU1NTAxMTMsIHJlc3BlY3RpdmVseSk8bzpwPjwvbzpw PjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5l dyZxdW90OyI+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBBIFNJUCBhdXRoZW50aWNhdGlvbiBzZXJ2 aWNlIHR5cGljYWxseSB3aWxsIGRlcml2ZSB0aGUgdmFsdWUgb2YgJnF1b3Q7cnBoJnF1b3Q7PC90 dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGZyb20gdGhlICdSZXNvdXJjZS1Qcmlvcml0eScgaGVh ZGVyIGZpZWxkIGJhc2VkIG9uIHBvbGljeSBhc3NvY2lhdGVkPC90dD48YnI+DQo8dHQ+Jm5ic3A7 Jm5ic3A7IHdpdGggc2VydmljZSBzcGVjaWZpYyB1c2Ugb2YgdGhlICZxdW90O25hbWVzcGFjZSAm cXVvdDsuJnF1b3Q7IHItcHJpb3JpdHkmcXVvdDsgdmFsdWVzPC90dD48YnI+DQo8dHQ+Jm5ic3A7 Jm5ic3A7IGJhc2VkIG9uIFtSRkM0NDEyXS4mbmJzcDsgVGhlIGF1dGhlbnRpY2F0aW9uIHNlcnZp Y2UgZGVyaXZlcyB0aGUgdmFsdWUgb2Y8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgdGhlIFBB U1NQb3JUIGNsYWltIGJ5IHZlcmlmeWluZyB0aGUgYXV0aG9yaXphdGlvbiBmb3IgUmVzb3VyY2Ut PC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IFByaW9yaXR5IChpLmUuLCB2ZXJpZnlpbmcgYSBj YWxsaW5nIHVzZXIgcHJpdmlsZWdlIGZvciBSZXNvdXJjZS08L3R0Pjxicj4NCjx0dD4mbmJzcDsm bmJzcDsgUHJpb3JpdHkgYmFzZWQgb24gaXRzIGlkZW50aXR5KSB3aGljaCBtaWdodCBiZSBkZXJp dmVkIGZyb20gY3VzdG9tZXI8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgcHJvZmlsZSBkYXRh IG9yIGZyb20gYWNjZXNzIHRvIGV4dGVybmFsIHNlcnZpY2VzLjwvdHQ+PGJyPg0KPGJyPg0KPHR0 PiZuYnNwOyZuYnNwOyBbUkZDNDQxMl0gYWxsb3dzIG11bHRpcGxlICZxdW90O25hbWVzcGFjZSAm cXVvdDsuJnF1b3Q7IHItcHJpb3JpdHkmcXVvdDsgcGFpcnMsIGVpdGhlciBpbjwvdHQ+PGJyPg0K PHR0PiZuYnNwOyZuYnNwOyBhIHNpbmdsZSBTSVAgUmVzb3VyY2UtUHJpb3JpdHkgaGVhZGVyIG9y IGFjcm9zcyBtdWx0aXBsZSBTSVA8L3R0Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2tx dW90ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+U2luZ2xlIHF1b3RlcyBhcm91bmQg J1Jlc291cmNlLVByaW9yaXR5Jy48bzpwPjwvbzpwPjwvcD4NCjxwPiZxdW90Oy4uLmhlYWRlciBm aWVsZC4uLiZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx0dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+ Jm5ic3A7Jm5ic3A7IFJlc291cmNlLVByaW9yaXR5IGhlYWRlcnMuJm5ic3A7IEhvd2V2ZXIsIGl0 IGlzIG5vdCBuZWNlc3NhcnkgdG8gc2lnbiBhbGw8L3NwYW4+PC90dD48bzpwPjwvbzpwPjwvcD4N CjwvYmxvY2txdW90ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+U2luZ2xlIHF1b3Rl cyBhcm91bmQgJ1Jlc291cmNlLVByaW9yaXR5Jy48bzpwPjwvbzpwPjwvcD4NCjxwPiZxdW90Oy4u LmhlYWRlciBmaWVsZHMuLi4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRv bTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMC4wcHQiPiZuYnNwOyZuYnNwOyBjb250ZW50IG9mIGEgU0lQIFJlc291cmNlLVByaW9yaXR5 IGhlYWRlciBvciBhbGwgU0lQIFJlc291cmNlLTwvc3Bhbj48L3R0PjxvOnA+PC9vOnA+PC9wPg0K PC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5TaW5nbGUgcXVvdGVz IGFyb3VuZCAnUmVzb3VyY2UtUHJpb3JpdHknLjxvOnA+PC9vOnA+PC9wPg0KPHA+JnF1b3Q7Li4u aGVhZGVyIGZpZWxkLi4uJnF1b3Q7PG86cD48L286cD48L3A+DQo8cD48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206 NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHR0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTAuMHB0Ij4mbmJzcDsmbmJzcDsgUHJpb3JpdHkgaGVhZGVycyBpbiBhIGdpdmVuIFNJUCBtZXNz YWdlLiZuYnNwOyBBbiBhdXRob3JpdHkgaXMgb25seTwvc3Bhbj48L3R0PjxvOnA+PC9vOnA+PC9w Pg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5TaW5nbGUgcXVv dGVzIGFyb3VuZCAnUmVzb3VyY2UtUHJpb3JpdHknLjxvOnA+PC9vOnA+PC9wPg0KPHA+JnF1b3Q7 Li4uaGVhZGVyIGZpZWxkcy4uLiZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90 dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx0dD48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEwLjBwdCI+Jm5ic3A7Jm5ic3A7IHJlc3BvbnNpYmxlIGZvciBzaWduaW5nIHRoZSBjb250 ZW50IG9mIGEgU0lQIFJlc291cmNlLVByaW9yaXR5IGhlYWRlcjwvc3Bhbj48L3R0PjxvOnA+PC9v OnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5TaW5n bGUgcXVvdGVzIGFyb3VuZCAnUmVzb3VyY2UtUHJpb3JpdHknLjxvOnA+PC9vOnA+PC9wPg0KPHA+ JnF1b3Q7Li4uaGVhZGVyIGZpZWxkLi4uJnF1b3Q7PG86cD48L286cD48L3A+DQo8cD48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdp bi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHR0PjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0Ij4mbmJzcDsmbmJzcDsgZm9yIHdoaWNoIGl0IGhhcyBhdXRob3JpdHkg KGUuZy4sIGEgc3BlY2lmaWMgJnF1b3Q7bmFtZXNwYWNlICZxdW90Oy4mcXVvdDs8L3NwYW4+PC90 dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90OyI+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyByLXByaW9yaXR5JnF1b3Q7KS48L3R0 Pjxicj4NCjxicj4NCjx0dD40LjIuJm5ic3A7IFZlcmlmaWNhdGlvbiBTZXJ2aWNlIEJlaGF2aW9y PC90dD48YnI+DQo8YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IFtJLUQuaWV0Zi1zdGlyLXJmYzQ0NzRi aXNdIFNlY3Rpb24gNi4yIFN0ZXAgNSByZXF1aXJlcyB0aGF0PC90dD48YnI+DQo8dHQ+Jm5ic3A7 Jm5ic3A7IHNwZWNpZmljYXRpb25zIGRlZmluaW5nICZxdW90O3BwdCZxdW90OyB2YWx1ZXMgZGVz Y3JpYmUgYW55IGFkZGl0aW9uYWwgdmVyaWZpZXI8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsg YmVoYXZpb3IuJm5ic3A7IFRoZSBiZWhhdmlvciBzcGVjaWZpZWQgZm9yIHRoZSAmcXVvdDtwcHQm cXVvdDsgdmFsdWVzIG9mICZxdW90O3JwaCZxdW90OyBpcyBhczwvdHQ+PGJyPg0KPHR0PiZuYnNw OyZuYnNwOyBmb2xsb3dzOjwvdHQ+PGJyPg0KPGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBUaGUgdmVy aWZpY2F0aW9uIHNlcnZpY2UgTVVTVCBleHRyYWN0IHRoZSB2YWx1ZSBhc3NvY2lhdGVkIHdpdGgg dGhlPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7ICZxdW90O2F1dGgmcXVvdDsga2V5IGluIGEg ZnVsbCBmb3JtIFBBU1NQb3JUIHdpdGggYSAmcXVvdDtwcHQmcXVvdDsgdmFsdWUgb2YgJnF1b3Q7 cnBoJnF1b3Q7LiZuYnNwOyBJZjwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyB0aGUgc2lnbmF0 dXJlIHZhbGlkYXRlcywgdGhlbiB0aGUgdmVyaWZpY2F0aW9uIHNlcnZpY2UgY2FuIHVzZSB0aGU8 L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgdmFsdWUgb2YgdGhlICZxdW90O3JwaCZxdW90OyBj bGFpbSBhcyB2YWxpZGF0aW9uIHRoYXQgdGhlIGNhbGxpbmcgcGFydHkgaXM8L3R0Pjxicj4NCjx0 dD4mbmJzcDsmbmJzcDsgYXV0aG9yaXplZCBmb3IgUmVzb3VyY2UtUHJpb3JpdHksIHdoaWNoIHdv dWxkIGluIHR1cm4gYmUgdXNlZCBmb3I8L3R0Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvYmxv Y2txdW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+ U2luZ2xlIHF1b3RlcyBhcm91bmQgJ1Jlc291cmNlLVByaW9yaXR5Jy48bzpwPjwvbzpwPjwvcD4N CjxwPlRoaXMgdGV4dCBpcyBhbWJpZ3VvdXMgYWJvdXQgd2hldGhlciB0aGUgdmFsaWRhdGlvbiBp bmRpY2F0ZXMgdGhhdCB0aGUgY2FsbGluZyBwYXJ0eSBpcyBhdXRob3JpemVkIHRvIHVzZSB0aGUg cHJpb3JpdGllcyBpbmRpY2F0ZWQgaW4gdGhlIHBhc3Nwb3J0IG9iamVjdCwgb3IgdGhlIHZhbHVl cyBpbiB0aGUgU0lQICdSZXNvdXJjZS1Qcmlvcml0eScgaGVhZGVyIGZpZWxkOyBhbmQgKHRha2Vu IG9uIGl0cyBmYWNlKSBpbXBsaWVzIHRoZSBsYXR0ZXIsDQogd2hlbiB0aGUgaW50ZW50aW9uIGhl cmUgc2hvdWxkIGNsZWFybHkgYmUgdGhlIGZvcm1lci48bzpwPjwvbzpwPjwvcD4NCjxwPiZxdW90 Oy4uLmF1dGhvcml6ZWQgZm9yICdSZXNvdXJjZS1Qcmlvcml0eScgaW5kaWNhdGVkIGluIHRoZSBj bGFpbS4gVGhpcyB2YWx1ZSB3b3VsZCBpbiB0dXJuIGJlIHVzZWQgZm9yLi4uJnF1b3Q7PG86cD48 L286cD48L3A+DQo8cD5UaGUgdGV4dCBhbHNvIG5lZWRzIHRvIHNheSBzb21ldGhpbmcgYWJvdXQg Y29tcGFyaW5nIHZhbHVlcyBpbiB0aGUgY2xhaW0gdG8gdmFsdWVzIGluIHRoZSAnUmVzb3VyY2Ut UHJpb3JpdHknIGhlYWRlciBmaWVsZCwgYW5kIHdoYXQgYSBtaXNtYXRjaCBtaWdodCBtZWFuLiBU aGUgZG9jdW1lbnQgc2F5cyBlbHNld2hlcmUgdGhhdCB0aGUgc2lnbmF0dXJlIG1pZ2h0IG9ubHkg Y292ZXIgc29tZSBvZiB0aGUgci12YWx1ZXMsIHdoaWNoIG1ha2VzDQogaXQgZW50aXJlbHkgcG9z c2libGUgdGhhdCB0aGUgJ1Jlc291cmNlLVByaW9yaXR5JyBmaWVsZCBtaWdodCBjb250YWluIG1v cmUgdmFsdWVzIHRoYW4gYXJlIHNpZ25lZC4gT24gdGhlIG90aGVyIGhhbmQsIGludGVybWVkaWFy aWVzIG1pZ2h0IHJlYXNvbmFibHkgcmVtb3ZlIHItdmFsdWVzIGFzIHRoZSBjYWxsIGlzIHByb2Nl c3NlZC4gVGhpcyBwcm9iYWJseSBtZWFucyB0aGF0IHRob3NlIHJlbW92ZWQgcHJpb3JpdGllcyBz aG91bGQgbm90IGJlDQogdXNlZCwgZXZlbiBpZiB0aGV5IGFyZSBwcmVzZW50IGluIHRoZSBwYXNz cG9ydC4gSXQgc2VlbXMgcmVhc29uYWJsZSB0byBzYXkgdGhhdCAqdHlwaWNhbCogcHJvY2Vzc2lu ZyBieSBhIHJlY2VpdmluZyBwYXJ0eSB3b3VsZCBiZSB0byB0YWtlIHRoZSAqdW5pb24qIG9mIGFs bCBSUEggcGFzc3BvcnRzIHRoYXQgdGhleSB0cnVzdCwgYW5kICppbnRlcnNlY3QqIHRoYXQgd2l0 aCB0aGUgcHJpb3JpdGllcyBpbiAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlcg0KIGZpZWxkcyB0 byBnZXQgdGhlIGFjdHVhbCBwcmlvcml0eSBvciBwcmlvcml0aWVzIHRvIGJlIGFwcGxpZWQgdG8g dGhlIGNhbGwgKHN1YmplY3QgdG8gbG9jYWwgcG9saWN5KS48bzpwPjwvbzpwPjwvcD4NCjxwPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7 bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dHQ+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMC4wcHQiPiZuYnNwOyZuYnNwOyBwcmlvcml0eSB0cmVhdG1lbnQgaW4g YWNjb3JkYW5jZSB3aXRoIGxvY2FsIHBvbGljeSBmb3IgdGhlIGFzc29jaWF0ZWQ8L3NwYW4+PC90 dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVy IE5ldyZxdW90OyI+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBjb21tdW5pY2F0aW9uIHNlcnZpY2Uu PC90dD48YnI+DQo8YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IEluIGFkZGl0aW9uLCBbSS1ELmlldGYt c3Rpci1yZmM0NDc0YmlzXSBTZWN0aW9uIDYuMiBTdGVwIDQgcmVxdWlyZXM8L3R0Pjxicj4NCjx0 dD4mbmJzcDsmbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7IHZhbHVlIGluICZxdW90O3JwaCZxdW90OyBj bGFpbSB0byBiZSB2ZXJpZmllZC48L3R0Pjxicj4NCjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgVGhl IGJlaGF2aW9yIG9mIGEgU0lQIFVBcyB1cG9uIHJlY2VpdmluZyBhbiBJTlZJVEUgY29udGFpbmlu ZyBhPC90dD48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwPiZxdW90Oy4uLm9mIGEgU0lQIFVBIHVwb24uLi4mcXVvdDs8bzpw PjwvbzpwPjwvcD4NCjxwPm9yPG86cD48L286cD48L3A+DQo8cD4mcXVvdDsuLi5vZiBTSVAgVUFz IHVwb24uLi4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQi PiZuYnNwOyZuYnNwOyBQQVNTcG9yVCBvYmplY3Qgd2l0aCBhICZxdW90O3JwaCZxdW90OyBjbGFp bSB3aWxsIGxhcmdlbHkgcmVtYWluIGEgbWF0dGVyIG9mPC9zcGFuPjwvdHQ+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxi cj4NCjx0dD4mbmJzcDsmbmJzcDsgaW1wbGVtZW50YXRpb24gcG9saWN5IGZvciB0aGUgc3BlY2lm aWMgY29tbXVuaWNhdGlvbiBzZXJ2aWNlLiZuYnNwOyBJbjwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZu YnNwOyBtb3N0IGNhc2VzLGltcGxlbWVudGF0aW9ucyB3b3VsZCBhY3QgYmFzZWQgb24gY29uZmlk ZW5jZSBpbiB0aGU8L3R0Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxw PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+JnF1b3Q7Li4uY2FzZXMsIGltcGxlbWVudGF0aW9u cy4uLiZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPHA+KHNwYWNlIGFmdGVyIGNvbW1hKTxvOnA+PC9v OnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFy Z2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pjx0dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+Jm5ic3A7Jm5ic3A7IHZlcmFjaXR5 IG9mIHRoaXMgaW5mb3JtYXRpb24uJm5ic3A7IFRoZSB1c2Ugb2YgdGhlIGNvbXBhY3QgZm9ybSBv Zjwvc3Bhbj48L3R0PjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJz cDs8L286cD48L3A+DQo8cD5QYXJhZ3JhcGggYnJlYWsgYmVmb3JlICZxdW90O1RoZSZxdW90Oy48 bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5 bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48dHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPiZuYnNwOyZuYnNwOyBQ QVNTcG9yVCBpcyBub3Qgc3BlY2lmaWVkIGluIHRoaXMgZG9jdW1lbnQuPC9zcGFuPjwvdHQ+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcm cXVvdDsiPjxicj4NCjxicj4NCjx0dD41LiZuYnNwOyBGdXJ0aGVyIEluZm9ybWF0aW9uIEFzc29j aWF0ZWQgd2l0aCBSZXNvdXJjZS1Qcmlvcml0eTwvdHQ+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5TaW5nbGUgcXVvdGVz IGFyb3VuZCAnUmVzb3VyY2UtUHJpb3JpdHknLjxvOnA+PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJz cDs8L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4t Ym90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+ Jm5ic3A7Jm5ic3A7IFRoZXJlIG1heSBiZSBhZGRpdGlvbmFsIGluZm9ybWF0aW9uIGFib3V0IHRo ZSBjYWxsaW5nIHBhcnR5IG9yIHRoZTwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBjYWxsIHRo YXQgY291bGQgYmUgcmVsZXZhbnQgdG8gYXV0aG9yaXphdGlvbiBmb3IgUmVzb3VyY2UtUHJpb3Jp dHkuPC90dD48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwPlNpbmdsZSBxdW90ZXMgYXJvdW5kICdSZXNvdXJjZS1Qcmlvcml0 eScuPG86cD48L286cD48L3A+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3Rl IHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHR0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij4mbmJzcDsmbmJz cDsgVGhpcyBtYXkgaW5jbHVkZSBpbmZvcm1hdGlvbiByZWxhdGVkIHRvIHRoZSBkZXZpY2Ugc3Vi c2NyaXB0aW9uIG9mPC9zcGFuPjwvdHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxicj4NCjx0dD4mbmJzcDsmbmJzcDsg dGhlIGNhbGxlciwgb3IgdG8gYW55IGluc3RpdHV0aW9ucyB0aGF0IHRoZSBjYWxsZXIgb3IgZGV2 aWNlIGlzPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGFzc29jaWF0ZWQgd2l0aCwgb3IgZXZl biBjYXRlZ29yaWVzIG9mIGluc3RpdHV0aW9ucy4mbmJzcDsgQWxsIG9mIHRoZXNlPC90dD48YnI+ DQo8dHQ+Jm5ic3A7Jm5ic3A7IGRhdGEgZWxlbWVudHMgd291bGQgYmVuZWZpdCBmcm9tIHRoZSBz ZWN1cmUgYXR0ZXN0YXRpb25zIHByb3ZpZGVkIGJ5PC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7 IHRoZSBTVElSIGFuZCBQQVNTcG9yVCBmcmFtZXdvcmtzLiZuYnNwOyBUaGUgc3BlY2lmaWNhdGlv biBvZiB0aGUgJnF1b3Q7cnBoJnF1b3Q7PC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGNsYWlt IGNvdWxkIGVudGFpbCB0aGUgb3B0aW9uYWwgcHJlc2VuY2Ugb2Ygb25lIG9yIG1vcmUgc3VjaDwv dHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBhZGRpdGlvbmFsIGluZm9ybWF0aW9uIGZpZWxkcy48 L3R0Pjxicj4NCjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgQSBuZXcgSUFOQSByZWdpc3RyeSBoYXMg YmVlbiBkZWZpbmVkIHRvIGhvbGQgcG90ZW50aWFsIHZhbHVlcyBvZiB0aGU8L3R0Pjxicj4NCjx0 dD4mbmJzcDsmbmJzcDsgJnF1b3Q7cnBoJnF1b3Q7IGFycmF5OyBzZWUgU2VjdGlvbiA2LjIuJm5i c3A7IFRoZSBkZWZpbml0aW9uIG9mIHRoZSAmcXVvdDtycGgmcXVvdDsgY2xhaW0gbWF5PC90dD48 YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGhhdmUgb25lIG9yIG1vcmUgc3VjaCBhZGRpdGlvbmFsIGlu Zm9ybWF0aW9uIGZpZWxkKHMpLiZuYnNwOyBEZXRhaWxzIG9mPC90dD48YnI+DQo8dHQ+Jm5ic3A7 Jm5ic3A7IHN1Y2ggJnF1b3Q7cnBoJnF1b3Q7IGNsYWltIHRvIGVuY29tcGFzcyBvdGhlciBkYXRh IGVsZW1lbnRzIGFyZSBsZWZ0IGZvciBmdXR1cmU8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsg dmVyc2lvbiBvZiB0aGlzIHNwZWNpZmljYXRpb24uPC90dD48YnI+DQo8YnI+DQo8dHQ+Ni4mbmJz cDsgSUFOQSBDb25zaWRlcmF0aW9uczwvdHQ+PGJyPg0KPGJyPg0KPHR0PjYuMS4mbmJzcDsgSlNP TiBXZWIgVG9rZW4gQ2xhaW1zIFJlZ2lzdHJhdGlvbjwvdHQ+PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5JIHRoaW5rIHRo ZXJlJ3Mgc29tZSBjb25mdXNpb24gaGVyZS4gWW91J3JlIHJlZ2lzdGVyaW5nIGEgUEFTU3BvclQg cHB0IHZhbHVlLCBub3QgYSBuZXcgSldUIGNsYWltLiBUaGF0IGlzIHRvIHNheSwgeW91J3JlIGFk ZGluZyBhbiBlbnRyeSB0byB0aGlzIHRhYmxlOjxvOnA+PC9vOnA+PC9wPg0KPHA+PGEgaHJlZj0i aHR0cHM6Ly93d3cuaWFuYS5vcmcvYXNzaWdubWVudHMvcGFzc3BvcnQvcGFzc3BvcnQueGh0bWwi Pmh0dHBzOi8vd3d3LmlhbmEub3JnL2Fzc2lnbm1lbnRzL3Bhc3Nwb3J0L3Bhc3Nwb3J0LnhodG1s PC9hPjxvOnA+PC9vOnA+PC9wPg0KPHA+Tm90IHRvIHRoaXMgdGFibGU6PG86cD48L286cD48L3A+ DQo8cD48YSBocmVmPSJodHRwczovL3d3dy5pYW5hLm9yZy9hc3NpZ25tZW50cy9qd3Qvand0Lnho dG1sIj5odHRwczovL3d3dy5pYW5hLm9yZy9hc3NpZ25tZW50cy9qd3Qvand0LnhodG1sPC9hPjxv OnA+PC9vOnA+PC9wPg0KPHA+WW91IHdvdWxkIG9ubHkgdXNlIHRoZSBzZWNvbmQgdGFibGUgaWYg eW91IGhhZCBhIG5ldyBrZXkgdG8gYWRkIHRvIHRoZSBQQVNTcG9yVCBoZWFkZXIgLS0gdGhpcyBz cGVjaWZpY2F0aW9uIGRvZXMgbm90IGRvIHRoYXQuPG86cD48L286cD48L3A+DQo8cD5UaGlzIHNl Y3Rpb24gYWxzbyBuZWVkcyBzb21lIGludHJvZHVjdG9yeSB0ZXh0IHRvIGxldCB0aGUgSUFOQSBr bm93IGV4YWN0bHkgd2hhdCB0byBkbzsgZS5nLiAmcXVvdDtUaGlzIGRvY3VtZW50IHJlZ2lzdGVy cyBhIG5ldyB2YWx1ZSBmb3IgdGhlICZxdW90O1BlcnNvbmFsIEFzc2VydGlvbiBUb2tlbiAoUEFT U3BvclQpIEV4dGVuc2lvbnMmcXVvdDsgdGFibGUuPG86cD48L286cD48L3A+DQo8YmxvY2txdW90 ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IG8mbmJzcDsgcHB0 IHZhbHVlOiAmcXVvdDtycGgmcXVvdDs8L3R0Pjxicj4NCjxicj4NCjx0dD4mbmJzcDsmbmJzcDsg byZuYnNwOyBTcGVjaWZpY2F0aW9uIERvY3VtZW50KHMpOiBTZWN0aW9uIDMgb2YgW1JGQ1RoaXNd PC90dD48YnI+DQo8YnI+DQo8dHQ+Ni4yLiZuYnNwOyBQQVNTcG9yVCAncnBoJyBUeXBlczwvdHQ+ PGJyPg0KPGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBUaGlzIGRvY3VtZW50IHJlcXVlc3RzIHRoYXQg dGhlIElBTkEgYWRkIGEgbmV3IGVudHJ5IHRvIHRoZSBQQVNTcG9yVDwvdHQ+PGJyPg0KPHR0PiZu YnNwOyZuYnNwOyBUeXBlcyByZWdpc3RyeSBmb3IgdGhlIHR5cGUgJnF1b3Q7cnBoJnF1b3Q7IHdo aWNoIGlzIHNwZWNpZmllZCBpbiBbUkZDVGhpc10uPC90dD48L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwPlRoZXJlIGlzbid0 IGFuIElBTkEgdGFibGUgY2FsbGVkICZxdW90O1BBU1Nwb3JUIFR5cGVzLiZxdW90OyBJIHByZXN1 bWUgdGhpcyBpcyB0aGUgcmVnaXN0cmF0aW9uIHdlIGp1c3QgZGlzY3Vzc2VkIGluIHNlY3Rpb24g Ni4xLCBhbmQgc28gdGhlIGFib3ZlIHR3byBsaW5lcyBjYW4gYmUgcmVtb3ZlZC48bzpwPjwvbzpw PjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 dHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPiZuYnNwOyZuYnNwOyBUaGlzIHNwZWNp ZmljYXRpb24gYWxzbyByZXF1ZXN0cyB0aGF0IHRoZSBJQU5BIGNyZWF0ZSBhIG5ldyByZWdpc3Ry eTwvc3Bhbj48L3R0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGZvciBQQVNTcG9y VCAmcXVvdDtycGgmcXVvdDsgdHlwZXMuJm5ic3A7IFJlZ2lzdHJhdGlvbiBvZiBuZXcgUEFTU3Bv clQgJnF1b3Q7cnBoJnF1b3Q7IHR5cGVzPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IHNoYWxs IGJlIHVuZGVyIHRoZSBzcGVjaWZpY2F0aW9uIHJlcXVpcmVkIHBvbGljeS4mbmJzcDsgVGhpcyBy ZWdpc3RyeSBpczwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyB0byBiZSBpbml0aWFsbHkgcG9w dWxhdGVkIHdpdGggYSBzaW5nbGUgdmFsdWUgZm9yICZxdW90O2F1dGgmcXVvdDsgd2hpY2ggaXM8 L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgc3BlY2lmaWVkIGluIFtSRkNUaGlzXS48L3R0Pjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHA+VGhpcyBuZWVkcyB0byBiZSB2ZXJ5IGNsZWFyIGFib3V0IHRoZSBmaWVsZHMgdG8g YmUgaW5jbHVkZWQgaW4gdGhpcyBuZXcgcmVnaXN0cnkgKGUuZy4sICZxdW90O1JlZ2lzdHJ5IGVu dHJpZXMgbXVzdCBjb250YWluIHR3byBmaWVsZHM6IHRoZSBuYW1lIG9mIHRoZSAncnBoJyB0eXBl IGFuZCB0aGUgc3BlY2lmaWNhdGlvbiBpbiB3aGljaCB0aGUgdHlwZSBpcyBkZXNjcmliZWQmcXVv dDspLjxvOnA+PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90 ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+Ny4mbmJzcDsgU2VjdXJpdHkgQ29uc2lk ZXJhdGlvbnM8L3R0Pjxicj4NCjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgVGhlIHNlY3VyaXR5IGNv bnNpZGVyYXRpb25zIGRpc2N1c3NlZCBpbiBbSS1ELmlldGYtc3Rpci1yZmM0NDc0YmlzXTwvdHQ+ PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBpbiBTZWN0aW9uIDEwIGFyZSBhcHBsaWNhYmxlIGhlcmUu PC90dD48YnI+DQo8YnI+DQo8dHQ+Ny4xLiZuYnNwOyBBdm9pZGFuY2Ugb2YgcmVwbGF5IGFuZCBj dXQgYW5kIHBhc3RlIGF0dGFja3M8L3R0Pjxicj4NCjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgVGhl IFBBU1Nwb3JUIGV4dGVuc2lvbiB3aXRoIGEgJnF1b3Q7cHB0JnF1b3Q7IHZhbHVlIG9mICZxdW90 O3JwaCZxdW90OyBNVVNUIG9ubHkgYmUgc2VudDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyB3 aXRoIFNJUCBJTlZJVEUgd2hlbiAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlciBpcyB1c2VkIHRv IGNvbnZleSB0aGU8L3R0Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxw PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+JnF1b3Q7Li4uaGVhZGVyIGZpZWxkLi4uJnF1b3Q7 PG86cD48L286cD48L3A+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0 eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHR0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij4mbmJzcDsmbmJzcDsg cHJpb3JpdHkgb2YgdGhlIGNvbW11bmljYXRpb24gYXMgZGVmaW5lZCBpbiBbUkZDNDQxMl0uJm5i c3A7IFRvIGF2b2lkIHRoZTwvc3Bhbj48L3R0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+Jm5ic3A7Jm5i c3A7IHJlcGxheSwgYW5kIGN1dCBhbmQgcGFzdGUgYXR0YWNrcywgdGhlIHByb2NlZHVyZXMgZGVz Y3JpYmVkIGluPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IFNlY3Rpb24gMTAuMSBvZiBbSS1E LmlldGYtc3Rpci1yZmM0NDc0YmlzXSBNVVNUIGJlIGZvbGxvd2VkLjwvdHQ+PGJyPg0KPGJyPg0K PHR0PjcuMi4mbmJzcDsgU29sdXRpb24gQ29uc2lkZXJhdGlvbnM8L3R0Pjxicj4NCjxicj4NCjx0 dD4mbmJzcDsmbmJzcDsgVGhlIHVzZSBvZiBleHRlbnNpb24gdG8gUEFTU3BvclQgdG9rZW5zIHdp dGggJnF1b3Q7cHB0JnF1b3Q7IHZhbHVlICZxdW90O3JwaCZxdW90OyBiYXNlZDwvdHQ+PGJyPg0K PHR0PiZuYnNwOyZuYnNwOyBvbiB0aGUgdmFsaWRhdGlvbiBvZiB0aGUgZGlnaXRhbCBzaWduYXR1 cmUgYW5kIHRoZSBhc3NvY2lhdGVkPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGNlcnRpZmlj YXRlIHJlcXVpcmVzIGNvbnNpZGVyYXRpb24gb2YgdGhlIGF1dGhlbnRpY2F0aW9uIGFuZDwvdHQ+ PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBhdXRob3JpdHkgb3IgcmVwdXRhdGlvbiBvZiB0aGUgc2ln bmVyIHRvIGF0dGVzdCB0byB0aGUgaWRlbnRpdHkgYmVpbmc8L3R0Pjxicj4NCjx0dD4mbmJzcDsm bmJzcDsgYXNzZXJ0ZWQuJm5ic3A7IFRoZSBmb2xsb3dpbmcgY29uc2lkZXJhdGlvbnMgc2hvdWxk IGJlIHJlY29nbml6ZWQgd2hlbjwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyB1c2luZyBQQVNT cG9yVCBleHRlbnNpb24gd2l0aCAmcXVvdDtwcHQmcXVvdDsgdmFsdWUgb2YgJnF1b3Q7cnBoJnF1 b3Q7OjwvdHQ+PGJyPg0KPGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBvJm5ic3A7IEFuIGF1dGhvcml0 eSAoc2lnbmVyKSBpcyBvbmx5IGFsbG93ZWQgdG8gc2lnbiB0aGUgY29udGVudCBvZiBhIFNJUDwv dHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAnUmVzb3VyY2UtUHJp b3JpdHknIGhlYWRlciBmb3Igd2hpY2ggaXQgaGFzIHRoZSByaWdodCBhdXRob3JpdHkuPC90dD48 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxwPiZxdW90Oy4uLmhlYWRlciBmaWVsZC4uLiZxdW90OzxvOnA+PC9vOnA+PC9wPg0K PHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1 LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx0dD48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IFRoZSBhdXRob3JpdHkgdGhhdCBzaWducyB0aGUgdG9rZW4gTVVTVCBoYXZlIGEgc2VjdXJlIG1l dGhvZCBmb3I8L3NwYW4+PC90dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyBhdXRoZW50aWNhdGlvbiBvZiB0aGUgZW5kIHVzZXIgb3IgdGhlIGRldmlj ZS48L3R0Pjxicj4NCjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgbyZuYnNwOyBUaGUgdmVyaWZpY2F0 aW9uIG9mIHRoZSBzaWduYXR1cmUgTVVTVCBpbmNsdWRlIG1lYW5zIG9mIHZlcmlmeWluZzwvdHQ+ PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB0aGF0IHRoZSBzaWduZXIg aXMgYXV0aG9yaXRhdGl2ZSBmb3IgdGhlIHNpZ25lZCBjb250ZW50IG9mIHRoZSBTSVA8L3R0Pjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPHA+SXQncyBub3QgY2xlYXIgd2hhdCBhdXRob3JpdHkgaXMgYmVpbmcgY2xhaW1lZCBo ZXJlLiBJcyB0aGlzIHN1cHBvc2VkIHRvIG1lYW4gc29tZXRoaW5nIGxpa2UgJnF1b3Q7Li4udmVy aWZ5aW5nIHRoYXQgdGhlIHNpZ25lciBpcyBhdXRob3JpdGF0aXZlIGZvciB0aGUgb3JpZ2luYXRp bmcgdG4gaW4gdGhlIFBBU1Nwb3JULi4uJnF1b3Q7PyBPciAmcXVvdDsuLi5hdXRob3JpdGF0aXZl IGZvciB0aGUgcmVzb3VyY2UgcHJpb3JpdHkgbmFtZXNwYWNlIGluIHRoZSBQQVNTcG9yVD8mcXVv dDsNCiBXaGF0ZXZlciB0aGUgc2VydmVyIGlzIHB1cnBvcnRlZGx5IGF1dGhvcml0YXRpdmUgZm9y IG5lZWRzIHRvIGJlIGNsZWFybHkgc3BlbGxlZCBvdXQuPG86cD48L286cD48L3A+DQo8cD48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21h cmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHR0PjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTAuMHB0Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJ1Jlc291 cmNlLVByaW9yaXR5JyBoZWFkZXIuPC9zcGFuPjwvdHQ+PG86cD48L286cD48L3A+DQo8L2Jsb2Nr cXVvdGU+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwPiZxdW90Oy4uLmhlYWRlciBmaWVs ZC4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+L2EgPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4N CjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQi Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fPGJyPg0Kc3RpciBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVm PSJtYWlsdG86c3RpckBpZXRmLm9yZyI+c3RpckBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJo dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXIiPmh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vc3RpcjwvYT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_7594FB04B1934943A5C02806D1A2204B6C134AE5ESESSMB109erics_-- From nobody Mon Jan 22 10:52:39 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6662B1289B0; Mon, 22 Jan 2018 10:52:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.879 X-Spam-Level: X-Spam-Status: No, score=-1.879 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, T_KAM_HTML_FONT_INVALID=0.01, T_RP_MATCHES_RCVD=-0.01, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XJ12GAOS8kZK; Mon, 22 Jan 2018 10:52:36 -0800 (PST) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4BF7A12700F; Mon, 22 Jan 2018 10:52:36 -0800 (PST) Received: from Svantevit.local (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id w0MIqVrU085830 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Mon, 22 Jan 2018 12:52:32 -0600 (CST) (envelope-from adam@nostrum.com) X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be Svantevit.local To: Christer Holmberg Cc: STIR Chairs , "stir@ietf.org" , "draft-ietf-stir-rph.all@tools.ietf.org" References: <8632F2B7-931B-47D8-B892-3DFF9AD02F0D@ericsson.com> <7594FB04B1934943A5C02806D1A2204B6C134AE5@ESESSMB109.ericsson.se> From: Adam Roach Message-ID: <49f4d7c2-934c-94d2-e71f-1574e04762b6@nostrum.com> Date: Mon, 22 Jan 2018 12:52:26 -0600 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 In-Reply-To: <7594FB04B1934943A5C02806D1A2204B6C134AE5@ESESSMB109.ericsson.se> Content-Type: multipart/alternative; boundary="------------794E3503D0EBF92EF7F21B10" Content-Language: en-US Archived-At: Subject: Re: [stir] AD Review: draft-ietf-stir-rph-02 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jan 2018 18:52:37 -0000 This is a multi-part message in MIME format. --------------794E3503D0EBF92EF7F21B10 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit On 1/22/18 12:46 PM, Christer Holmberg wrote: > > I wonder if the problem(s) with using multiple Identity header fields > are divert-specific, or if they also apply to other passport extensions. > The issue with -divert- is that you have a semantic stack of destinations, rather than a variety of PASSporTs that can assert different things about the call. Nesting is specific to the -divert- use case. /a --------------794E3503D0EBF92EF7F21B10 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit
On 1/22/18 12:46 PM, Christer Holmberg wrote:

I wonder if the problem(s) with using multiple Identity header fields are divert-specific, or if they also apply to other passport extensions.


The issue with -divert- is that you have a semantic stack of destinations, rather than a variety of PASSporTs that can assert different things about the call. Nesting is specific to the -divert- use case.

/a

--------------794E3503D0EBF92EF7F21B10-- From nobody Mon Jan 22 11:45:51 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86B5C12AF83; Mon, 22 Jan 2018 11:45:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tcPueGUbim_G; Mon, 22 Jan 2018 11:45:31 -0800 (PST) Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB4AE12AAB6; Mon, 22 Jan 2018 11:45:28 -0800 (PST) X-AuditID: c1b4fb3a-335ff700000037f2-33-5a663f56f608 Received: from ESESSHC023.ericsson.se (Unknown_Domain [153.88.183.87]) by sessmg22.ericsson.net (Symantec Mail Security) with SMTP id 64.6C.14322.65F366A5; Mon, 22 Jan 2018 20:45:26 +0100 (CET) Received: from ESESSMB109.ericsson.se ([169.254.9.195]) by ESESSHC023.ericsson.se ([153.88.183.87]) with mapi id 14.03.0352.000; Mon, 22 Jan 2018 20:45:21 +0100 From: Christer Holmberg To: Adam Roach CC: STIR Chairs , "stir@ietf.org" , "draft-ietf-stir-rph.all@tools.ietf.org" Thread-Topic: [stir] AD Review: draft-ietf-stir-rph-02 Thread-Index: AQHTkXL/9PfnEwzuiEC0gXYu7h5lh6N9a2h7gAKdpYCAADQToP//84AAgAAbS9A= Date: Mon, 22 Jan 2018 19:45:21 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B6C135E57@ESESSMB109.ericsson.se> References: <8632F2B7-931B-47D8-B892-3DFF9AD02F0D@ericsson.com> <7594FB04B1934943A5C02806D1A2204B6C134AE5@ESESSMB109.ericsson.se> <49f4d7c2-934c-94d2-e71f-1574e04762b6@nostrum.com> In-Reply-To: <49f4d7c2-934c-94d2-e71f-1574e04762b6@nostrum.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.150] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFupgkeLIzCtJLcpLzFFi42KZGbE9XDfMPi3K4HWPucWev4vYLVYfP8dk 8WzHelaL5Wu3MTmweCxZ8pPJY9bOJyweXy5/ZgtgjuKySUnNySxLLdK3S+DKeDHjD1vBCvaK V3PnMTYwTmDvYuTkkBAwkdjz8TaYLSRwmFHiwvnKLkYuIHsJo8TiLZ/Zuhg5ONgELCS6/2mD 1IgIKEq0Hb7JDFLDLDCPUeL+/yVMIAlhAVOJLRPPM0IUmUncX9XABNIrIuAncWWeG0iYRUBV Ym7TQ2YQm1fAV2LlzlNsELsWMUm87WpnB6nnFLCXuPWVE6SGUUBM4vupNWDjmQXEJW49mc8E cbOAxJI955khbFGJl4//sULYShIrtl9iBBnDLKApsX6XPkSrosSU7ofsEGsFJU7OfMIygVF0 FpKpsxA6ZiHpmIWkYwEjyypG0eLU4uLcdCMjvdSizOTi4vw8vbzUkk2MwPg5uOW31Q7Gg88d DzEKcDAq8fAeF0yLEmJNLCuuzD3EKMHBrCTCm7YiNUqINyWxsiq1KD++qDQntfgQozQHi5I4 r1OaRZSQQHpiSWp2ampBahFMlomDU6qBManL+El1z6oinucbc4zuft9pzlJTLFJisbz6gd4m fSGT2Qec31rlVKvm/mLobPLl45oyqeDzO7kJ29b6/u7J2Vz11SdFg9nz1zbGa1IVU+Kad20R m2fpxWr/UN1aiUXpjbz9WsnT0/Yfzr1lIDuzw+uV0eyHAvHusv+DvV1fqjtfFDPq/cSoxFKc kWioxVxUnAgA6UykEZsCAAA= Archived-At: Subject: Re: [stir] AD Review: draft-ietf-stir-rph-02 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jan 2018 19:45:49 -0000 Pj4gSSB3b25kZXIgaWYgdGhlIHByb2JsZW0ocykgd2l0aCB1c2luZyBtdWx0aXBsZSBJZGVudGl0 eSBoZWFkZXIgZmllbGRzIGFyZSBkaXZlcnQtc3BlY2lmaWMsIG9yIGlmIHRoZXkgYWxzbyBhcHBs eSB0byBvdGhlciBwYXNzcG9ydCBleHRlbnNpb25zLg0KPg0KPiBUaGUgaXNzdWUgd2l0aCAtZGl2 ZXJ0LSBpcyB0aGF0IHlvdSBoYXZlIGEgc2VtYW50aWMgc3RhY2sgb2YgZGVzdGluYXRpb25zLCBy YXRoZXIgdGhhbiBhIHZhcmlldHkgb2YgUEFTU3BvclRzIHRoYXQgY2FuIGFzc2VydCANCj4gZGlm ZmVyZW50IHRoaW5ncyBhYm91dCB0aGUgY2FsbC4gTmVzdGluZyBpcyBzcGVjaWZpYyB0byB0aGUg LWRpdmVydC0gdXNlIGNhc2UuDQoNCk9rLiBTbywgaWYgYSBub2RlIHJlY2VpdmVzIGFuIElkZW50 aXR5IGhlYWRlciBmaWVsZCAoIzEpLCBhbmQgd2FudHMgdG8gYWRkIFJQSCwgaXQgd2lsbCBhZGQg dGhlICJycGgiIGNsYWltIGluIGEgc2VwYXJhdGUgUEFTU1BvclQsIGNhcnJpZWQgaW4gYSBzZXBh cmF0ZSBJZGVudGl0eSBoZWFkZXIgZmllbGQgKCMyKT8gSXQgd2lsbCBub3QgYWRkIHRoZSAicnBo IiBjbGFpbSB0byB0aGUgZXhpc3RpbmcgUEFTU1BvclQgY2FycmllZCBpbiAjMSwgYW5kIGl0IHdp bGwgbm90IHBlcmZvcm0gYW55IG5lc3RpbmcuDQoNClJlZ2FyZHMsDQoNCkNocmlzdGVyDQoNCg== From nobody Mon Jan 22 12:27:59 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D060712D777; Mon, 22 Jan 2018 12:27:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HRgaH_QW1R73; Mon, 22 Jan 2018 12:27:52 -0800 (PST) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0465A12D7E2; Mon, 22 Jan 2018 12:27:31 -0800 (PST) X-AuditID: c1b4fb30-d49ff70000006bc7-af-5a6649317a5d Received: from ESESSHC001.ericsson.se (Unknown_Domain [153.88.183.21]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id 99.4D.27591.139466A5; Mon, 22 Jan 2018 21:27:30 +0100 (CET) Received: from ESESSMB109.ericsson.se ([169.254.9.195]) by ESESSHC001.ericsson.se ([153.88.183.21]) with mapi id 14.03.0352.000; Mon, 22 Jan 2018 21:27:29 +0100 From: Christer Holmberg To: Adam Roach , STIR Chairs , "stir@ietf.org" , "draft-ietf-stir-rph.all@tools.ietf.org" Thread-Topic: [stir] AD Review: draft-ietf-stir-rph-02 - authority to assert the callers identity assumed? Thread-Index: AdOTv2oSY/dEf4YfRra4GseuGeXVLA== Date: Mon, 22 Jan 2018 20:27:29 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B6C135F8E@ESESSMB109.ericsson.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.150] Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B6C135F8EESESSMB109erics_" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrHLMWRmVeSWpSXmKPExsUyM2K7qK6RZ1qUwe52Nos9fxexW6w+fo7J 4tmO9awWy9duY3Jg8Viy5CeTx6ydT1g8vlz+zBbAHMVlk5Kak1mWWqRvl8CVMfvGUcaCa+vY Ks41VDUwXpjJ1sXIySEhYCJxZ8oVli5GLg4hgcOMEvtnn4dyljBK3Fh0GaiKg4NNwEKi+582 SIOIwF5Gic1v5EFsYYFsiWdbfrNAxHMkTv76ywhSLiKgJ7HqojpImEVAVWLigfVgJbwCvhJT Gi8zgtiMAmIS30+tYQKxmQXEJW49mc8EcY+AxJI955khbFGJl4//sULYShIrtl9ihKjPl/hz +A0TxExBiZMzn7BMYBSchWTULCRls5CUzQK6jllAU2L9Ln2IEkWJKd0P2SFsDYnWOXPZkcUX MLKvYhQtTi1Oyk03MtJLLcpMLi7Oz9PLSy3ZxAiMlYNbfhvsYHz53PEQowAHoxIPb6FgWpQQ a2JZcWXuIUYJDmYlEd60FalRQrwpiZVVqUX58UWlOanFhxilOViUxHlPevJGCQmkJ5akZqem FqQWwWSZODilGhgZXhW/3tDwoODgGYNzAZ9m1HxY/vjvbZ1P/+1UOze7x3/SVi7fmb5lF6NO Zdr3O7GO+eFP5zD8PSb5re1NfNCTaWnPu6e9Ti2f/Cj7hdPWuX9ML5Q7Wd985P83NjHHmWXa mZvBCwxtA/zWzRF+xX3xrO/Te6H/O2c6lZctUT+496k8o8rJTpHXSizFGYmGWsxFxYkAQrGP sZECAAA= Archived-At: Subject: Re: [stir] AD Review: draft-ietf-stir-rph-02 - authority to assert the callers identity assumed? X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jan 2018 20:27:57 -0000 --_000_7594FB04B1934943A5C02806D1A2204B6C135F8EESESSMB109erics_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGksDQoNCkFub3RoZXIgcXVlc3Rpb24gZm9yIGNsYXJpZmljYXRpb24uDQoNClNlY3Rpb24gMyBj b250YWlucyB0aGUgZm9sbG93aW5nIGV4YW1wbGU6DQoNCiAgICB7ICJvcmlnIjp7InRuIjoiMTIx NTU1NTEyMTIifQ0KICAgICAiZGVzdCI6e1sidG4iOiIxMjEyNTU1MTIxMyJdfSwNCiAgICAgImlh dCI6MTQ0MzIwODM0NSwNCiAgICAgInJwaCI6eyJhdXRoIjpbImV0cy4wIiwid3BzLjAiXX0NCg0K 4oCmYW5kIHRoZSBmb2xsb3dpbmcgdGV4dDoNCg0KICAg4oCcVGhlIGNyZWRlbnRpYWxzIChlLmcu LCBhdXRob3JpdHkgcmVzcG9uc2libGUgZm9yIGF1dGhvcml6aW5nIFJlc291cmNlLQ0KICAgUHJp b3JpdHkpIHVzZWQgdG8gY3JlYXRlIHRoZSBzaWduYXR1cmUgbXVzdCBoYXZlIGF1dGhvcml0eSBv dmVyIHRoZQ0KICAgInJwaCIgY2xhaW3igKbigJ0NCg0KU2luY2UgdGhlIGNsYWltIGFsc28gY29u dGFpbnMg4oCcb3JpZ+KAnSwgaXMgdGhlIGFzc3VtcHRpb24gdGhhdCB0aGUgc2lnbmluZyBlbnRp dHkgYWx3YXlzIGFsc28gaGFzIGF1dGhvcml0eSB0byBhc3NlcnQgdGhlIGNhbGxlcnMgaWRlbnRp dHk/IEkgdGhpbmsgaXQgd291bGQgYmUgZ29vZCB0byBleHBsaWNpdGx5IG1lbnRpb24gaXQuDQoN ClJlZ2FyZHMsDQoNCkNocmlzdGVyDQoNCg0KDQoNCg0KDQpGcm9tOiBzdGlyIFttYWlsdG86c3Rp ci1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YgQWRhbSBSb2FjaA0KU2VudDogMjAgSmFu dWFyeSAyMDE4IDAwOjE1DQpUbzogU1RJUiBDaGFpcnMgPHN0aXItY2hhaXJzQGlldGYub3JnPjsg c3RpckBpZXRmLm9yZzsgZHJhZnQtaWV0Zi1zdGlyLXJwaC5hbGxAdG9vbHMuaWV0Zi5vcmcNClN1 YmplY3Q6IFtzdGlyXSBBRCBSZXZpZXc6IGRyYWZ0LWlldGYtc3Rpci1ycGgtMDINCg0KDQpJJ20g ZG9pbmcgbXkgQUQgcmV2aWV3IG9mIGRyYWZ0LWlldGYtc3Rpci1ycGgtMDIuIFRoYW5rcyB0byBl dmVyeW9uZSB3aG8gaGFzIHdvcmtlZCBvbiB0aGlzIGRvY3VtZW50LCBhbmQgdGhlIGF1dGhvcnMg YW5kIGNoYWlycyBpbiBwYXJ0aWN1bGFyLg0KDQpUaGUgdGVjaG5pY2FsIGNvbnRlbnQgaGVyZSBs b29rcyBnZW5lcmFsbHkgZ29vZCB0byBtZS4gSSdkIGxpa2UgdG8gc2VlIGEgZmV3IGlzc3VlcyBh ZGRyZXNzZWQgYmVmb3JlIElFVEYgTEMuIEluIHNob3J0IHN1bWFyeToNCg0KICAqICAgVGhlIHZh bGlkYXRpb24gc2VjdGlvbiBuZWVkcyB0byBhZGQgYSBkaXNjdXNzaW9uIG9mIGhvdyB0byB0cmVh dCBjYWxscyB3aGVuIHRoZSBwcmlvcml0eSB2YWx1ZXMgaW4gInJwaCIgcGFzc3BvcnRzIGFuZCBT SVAgIlJlc291cmNlLVByaW9yaXR5IiBoZWFkZXIgZmllbGRzIGFyZW4ndCAxMDAlIGlkZW50aWNh bC4NCiAgKiAgIFRoZSBleGFtcGxlcyBuZWVkIHNvbWUgYWRqdXN0bWVudC4NCiAgKiAgIFRoZXJl IGlzIGEgbWlub3IgcG9pbnQgb2YgYW1iaWd1aXR5IGluIHRoZSBTZWN1cml0eSBTZWN0aW9uLCBi dXQgdGhpcyBzaG91bGQgYmUgZWFzeSB0byBmaXgsIGFzIGxvbmcgYXMgdGhlIFdHIGtub3dzIHdo YXQgd2FzIGludGVuZGVkLg0KICAqICAgVGhlIElBTkEgYWN0aW9ucyBuZWVkIGEgbGl0dGxlIGJp dCBvZiBhZGp1c3RtZW50Lg0KICAqICAgVGhlcmUgYXJlIGEgbnVtYmVyIG9mIG1pbm9yIGVkaXRv cmlhbCBpc3N1ZXMgdG8gYmUgY2xlYW5lZCB1cC4NCg0KRGV0YWlsZWQgY29tbWVudHMgb24gdGhl c2UgcG9pbnRzIGFyZSBpbmxpbmUgaW4gdGhlIGRvY3VtZW50IGJlbG93LiBJJ3ZlIHJlbW92ZWQg c29tZSBwb3J0aW9ucyBvZiB0aGUgZG9jdW1lbnQgb24gd2hpY2ggSSBoYXZlIG5vIGNvbW1lbnRz Lg0KDQoNCg0KQWJzdHJhY3QNCg0KICAgVGhpcyBkb2N1bWVudCBleHRlbmRzIHRoZSBTVElSIFBB U1Nwb3JUIHNwZWNpZmljYXRpb24gdG8gYWxsb3cgdGhlDQoNCg0KDQoiLi4udGhlIFNlY3VyZSBU ZWxlcGhvbmUgSWRlbnRpdHkgUmV2aXNpdGVkIChTVElSKSBQZXJzb25hbCBBc3NlcnRpb24gVG9r ZW4gKFBBU1Nwb3JUKSBzcGVjaWZpY2F0aW9uIGRlZmluZWQgaW4gUkZDIDgxMjIuLi4iDQoNCihT ZWUgPGh0dHBzOi8vd3d3LnJmYy1lZGl0b3Iub3JnL21hdGVyaWFscy9hYmJyZXYuZXhwYW5zaW9u LnR4dD48aHR0cHM6Ly93d3cucmZjLWVkaXRvci5vcmcvbWF0ZXJpYWxzL2FiYnJldi5leHBhbnNp b24udHh0PiBmb3IgZ3VpZGFuY2Ugb24gYWJicmV2aWF0aW9ucykNCg0KDQogICBpbmNsdXNpb24g b2YgY3J5cHRvZ3JhcGhpY2FsbHktc2lnbmVkIGFzc2VydGlvbnMgb2YgYXV0aG9yaXphdGlvbiBm b3INCiAgIHRoZSB2YWx1ZXMgcG9wdWxhdGVkIGluIHRoZSBTSVAgJ1Jlc291cmNlLVByaW9yaXR5 JyBoZWFkZXIgZmllbGQsDQogICB3aGljaCBpcyB1c2VkIGZvciBjb21tdW5pY2F0aW9ucyByZXNv dXJjZSBwcmlvcml0aXphdGlvbi4NCg0KLi4uDQoNCjEuICBJbnRyb2R1Y3Rpb24NCg0KICAgUEFT U3BvclQgW0ktRC5pZXRmLXN0aXItcGFzc3BvcnRdIGlzIGEgdG9rZW4gZm9ybWF0IGJhc2VkIG9u IEpXVA0KICAgW1JGQzc1MTldIGZvciBjb252ZXlpbmcgY3J5cHRvZ3JhcGhpY2FsbHktc2lnbmVk IGluZm9ybWF0aW9uIGFib3V0DQogICB0aGUgaWRlbnRpdGllcyBpbnZvbHZlZCBpbiBwZXJzb25h bCBjb21tdW5pY2F0aW9uczsgaXQgaXMgdXNlZCB3aXRoDQogICBTVElSIFtJLUQuaWV0Zi1zdGly LXJmYzQ0NzRiaXNdIHRvIGNvbnZleSBhIHNpZ25lZCBhc3NlcnRpb24gb2YgdGhlDQogICBpZGVu dGl0eSBvZiB0aGUgcGFydGljaXBhbnRzIGluIHJlYWwtdGltZSBjb21tdW5pY2F0aW9ucyBlc3Rh Ymxpc2hlZA0KICAgdmlhIGEgcHJvdG9jb2wgbGlrZSBTSVAuICBUaGlzIHNwZWNpZmljYXRpb24g ZXh0ZW5kcyBQQVNTcG9yVCB0bw0KDQoNCg0KIi4uLmxpa2UgU0lQIFtSRkMzMjYxXS4uLiINCg0K KFdlIHdhbnQgdG8gY2l0ZSBTSVAgdGhlIGZpcnN0IHRpbWUgaXQgaXMgbWVudGlvbmVkKQ0KDQoN CiAgIGFsbG93IGNyeXB0b2dyYXBoaWMtc2lnbmluZyBvZiB0aGUgU0lQICdSZXNvdXJjZS1Qcmlv cml0eScgaGVhZGVyDQogICBmaWVsZCBkZWZpbmVkIGluIFtSRkM0NDEyXS4NCg0KICAgW1JGQzQ0 MTJdIGRlZmluZXMgdGhlIFNJUCAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlciBmaWVsZCBmb3IN CiAgIGNvbW11bmljYXRpb25zIFJlc291cmNlIFByaW9yaXR5LiAgQXMgc3BlY2lmaWVkIGluIFtS RkM0NDEyXSwgdGhlDQogICAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlciBmaWVsZCBtYXkgYmUg dXNlZCBieSBTSVAgdXNlciBhZ2VudHMNCiAgIFtSRkMzMjYxXSwgaW5jbHVkaW5nLCBQdWJsaWMg U3dpdGNoZWQgVGVsZXBob25lIE5ldHdvcmsgKFBTVE4pDQoNCg0KDQoiLi4uaW5jbHVkaW5nIFB1 YmxpYyBTd2l0Y2hlZC4uLiINCg0KKHJlbW92ZSB0aGUgY29tbWEpDQoNCg0KICAgZ2F0ZXdheXMg YW5kIHRlcm1pbmFscywgYW5kIFNJUCBwcm94eSBzZXJ2ZXJzIHRvIGluZmx1ZW5jZQ0KDQoNCg0K Ii4uLmFuZCBieSBTSVAgcHJveHkgc2VydmVycywgdG8gaW5mbHVlbmNlLi4uIg0KDQooYWRkICJi eSIgYW5kIGNvbW1hKQ0KDQoNCiAgIHByaW9yaXRpemF0aW9uIGFmZm9yZGVkIHRvIGNvbW11bmlj YXRpb24gc2Vzc2lvbnMsaW5jbHVkaW5nIFBTVE4NCg0KDQoiLi4uc2Vzc2lvbnMsIGluY2x1ZGlu Zy4uLiINCg0KKHNwYWNlIGFmdGVyIGNvbW1hKQ0KDQoNCiAgIGNhbGxzLiAgSG93ZXZlciwgdGhl IFNJUCAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlciBmaWVsZCBjb3VsZCBiZQ0KICAgc3Bvb2Zl ZCBhbmQgYWJ1c2VkIGJ5IHVuYXV0aG9yaXplZCBlbnRpdGllcy4NCg0KICAgVGhlIFNUSVIgYXJj aGl0ZWN0dXJlIFtSRkM3MzQwXWFzc3VtZXMgdGhhdCBhbiBhdXRob3JpdHkgb24gdGhlDQoNCg0K DQoiLi4uU1RJUiBhcmNoaXRlY3R1cmUgW1JGQzczNDBdIGFzc3VtZXMuLi4iDQoNCihzcGFjZSBi ZWZvcmUgImFzc3VtZXMiKQ0KDQoNCiAgIG9yaWdpbmF0aW5nIHNpZGUgb2YgYSBjYWxsIHByb3Zp ZGVzIGEgY3J5cHRvZ3JhcGhpYyBhc3N1cmFuY2Ugb2YgdGhlDQogICB2YWxpZGl0eSBvZiB0aGUg Y2FsbGluZyBwYXJ0eSBudW1iZXIgaW4gb3JkZXIgdG8gcHJldmVudA0KICAgaW1wZXJzb25hdGlv biBhdHRhY2tzLiAgVGhlIFNUSVIgYXJjaGl0ZWN0dXJlIGFsbG93cyBleHRlbnNpb24gdGhhdA0K DQoNCg0KIi4uLmFsbG93cyBleHRlbnNpb25zLi4uIg0KDQoNCiAgIGNhbiBiZSB1dGlsaXplZCBi eSBhdXRob3JpdGllcyBzdXBwb3J0aW5nIHJlYWwtdGltZSBjb21tdW5pY2F0aW9uDQogICBzZXJ2 aWNlcyB1c2luZyB0aGUgJ1Jlc291cmNlLVByaW9yaXR5JyBoZWFkZXIgZmllbGQgdG8NCiAgIGNy eXB0b2dyYXBoaWNhbGx5IHNpZ24gdGhlIFNJUCAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlciBm aWVsZCBhbmQNCiAgIGNvbnZleSBhc3NlcnRpb24gb2YgdGhlIGF1dGhvcml6YXRpb24gZm9yICdS ZXNvdXJjZS1Qcmlvcml0eScuICBGb3INCiAgIGV4YW1wbGUsIHRoZSBhdXRob3JpdHkgb24gdGhl IG9yaWdpbmF0aW5nIHNpZGUgdmVyaWZ5aW5nIHRoZQ0KICAgYXV0aG9yaXphdGlvbiBvZiBhIHBh cnRpY3VsYXIgY29tbXVuaWNhdGlvbiBmb3IgUmVzb3VyY2UtUHJpb3JpdHkgY2FuDQoNCg0KDQpT aW5nbGUgcXVvdGVzIGFyb3VuZCAnUmVzb3VyY2UtUHJpb3JpdHknLg0KDQoNCiAgIHVzZSBhIFBB U1NQb3JUIGNsYWltIHRvIGNyeXB0b2dyYXBoaWNhbGx5LXNpZ24gdGhlIFNJUCAnUmVzb3VyY2Ut DQoNCg0KDQoiLi4uY3J5cHRvZ3JhcGhpY2FsbHkgc2lnbi4uLiINCg0KDQogICBQcmlvcml0eScg aGVhZGVyIGZpZWxkIGFuZCBjb252ZXkgYW4gYXNzZXJ0aW9uIG9mIHRoZSBhdXRob3JpemF0aW9u DQogICBmb3IgJ1Jlc291cmNlLVByaW9yaXR5Jy4gIFRoaXMgd2lsbCBhbGxvdyBhIHJlY2Vpdmlu ZyBlbnRpdHkNCiAgIChpbmNsdWRpbmcgZW50aXRpZXMgbG9jYXRlZCBpbiBkaWZmZXJlbnQgbmV0 d29yayBkb21haW5zL2JvdW5kYXJpZXMpDQogICB0byB2ZXJpZnkgdGhlIHZhbGlkaXR5IG9mIGFz c2VydGlvbnMgYXV0aG9yaXppbmcgUmVzb3VyY2UtUHJpb3JpdHkuDQoNCg0KDQpTaW5nbGUgcXVv dGVzIGFyb3VuZCAnUmVzb3VyY2UtUHJpb3JpdHknLg0KDQoNCiAgIENyeXB0b2dyYXBoaWNhbGx5 LXNpZ25lZCBTSVAgJ1Jlc291cmNlLVByaW9yaXR5JyBoZWFkZXJzIHdpbGwgYWxsb3cgYQ0KDQoN Cg0KIi4uLmNyeXB0b2dyYXBoaWNhbGx5IHNpZ25lZCBTSVAgJ1Jlc291cmNlLVByaW9yaXR5JyBo ZWFkZXIgZmllbGRzLi4uIg0KDQoocmVtb3ZlIGh5cGhlbiwgYW5kIHJlcGxhY2UgImhlYWRlcnMi IHdpdGggImhlYWRlciBmaWVsZHMiKQ0KDQoNCiAgIHJlY2VpdmluZyBlbnRpdHkgdG8gdmVyaWZ5 IGFuZCBhY3Qgb24gdGhlIGluZm9ybWF0aW9uIHdpdGggY29uZmlkZW5jZQ0KICAgdGhhdCB0aGUg aW5mb3JtYXRpb24gaGF2ZSBub3QgYmVlbiBzcG9vZmVkIG9yIGNvbXByb21pc2VkLg0KDQoNCg0K Ii4uLmhhcyBub3QgYmVlbiBzcG9vZmVkIG9yIGNvbXByb21pc2VkLiINCg0KDQoNCiAgIFRoaXMg c3BlY2lmaWNhdGlvbiBkb2N1bWVudHMgYW4gb3B0aW9uYWwgZXh0ZW5zaW9uIHRvIFBBU1Nwb3JU IGFuZA0KICAgdGhlIGFzc29jaWF0ZWQgU1RJUiBtZWNoYW5pc21zIHRvIHByb3ZpZGUgYSBmdW5j dGlvbiB0byBzaWduIHRoZSBTSVANCiAgICdSZXNvdXJjZS1Qcmlvcml0eScgaGVhZGVyIGZpZWxk LiAgVGhpcyBQQVNTcG9yVCBvYmplY3QgaXMgdXNlZCB0bw0KICAgcHJvdmlkZSBhdHRlc3RhdGlv biBvZiBhIGNhbGxpbmcgdXNlciBhdXRob3JpemF0aW9uIGZvciBwcmlvcml0eQ0KICAgY29tbXVu aWNhdGlvbnMuICBUaGlzIGlzIG5lY2Vzc2FyeSBpbiBhZGRpdGlvbiB0byB0aGUgUEFTU3BvclQg b2JqZWN0DQogICB0aGF0IGlzIHVzZWQgZm9yIGNhbGxpbmcgdXNlciB0ZWxlcGhvbmUgbnVtYmVy IGF0dGVzdGF0aW9uLiAgSG93IHRoZQ0KICAgb3B0aW9uYWwgZXh0ZW5zaW9uIHRvIFBBU1Nwb3JU IGlzIHVzZWQgZm9yIHJlYWwtdGltZSBjb21tdW5pY2F0aW9ucw0KICAgc3VwcG9ydGVkIHVzaW5n IFNJUCAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlciBmaWVsZCBpcyBkZWZpbmVkIGluDQogICBv dGhlciBkb2N1bWVudHMgYW5kIGlzIG91dHNpZGUgdGhlIHNjb3BlIG9mIHRoaXMgZG9jdW1lbnQu DQoNCg0KDQpJIGFzc3VtZSB0aGVzZSBvdGhlciBkb2N1bWVudHMgYXJlIHVuZGVyIGRldmVsb3Bt ZW50PyBJZiBzbywgdGhleSBzaG91bGQgYmUgY2l0ZWQgaGVyZS4NCg0KDQoNCjIuICBUZXJtaW5v bG9neQ0KDQogICBUaGUga2V5IHdvcmRzICJNVVNUIiwgIk1VU1QgTk9UIiwgIlJFUVVJUkVEIiwg IlNIQUxMIiwgIlNIQUxMIE5PVCIsDQogICAiU0hPVUxEIiwgIlNIT1VMRCBOT1QiLCAiUkVDT01N RU5ERUQiLCAiTUFZIiwgYW5kICJPUFRJT05BTCIgaW4gdGhpcw0KICAgZG9jdW1lbnQgYXJlIHRv IGJlIGludGVycHJldGVkIGFzIGRlc2NyaWJlZCBpbiBSRkMgMjExOSBbUkZDMjExOV0uDQoNCg0K DQpUaGlzIGRvY3VtZW50IGhhcyBzZXZlcmFsIG5vbi1ub3JtYXRpdmUgdXNlcyBvZiAibXVzdCIs ICJzaG91bGQsIiBhbmQgIm1heSwiIGFuZCBzbyBpdCBuZWVkcyB0byB1c2UgdGhlIFJGQzgxNzQg Ym9pbGVycGxhdGUgaW5zdGVhZCBvZiB0aGUgUkZDMjExOSBib2lsZXJwbGF0ZS4NCg0KDQoNCjMu ICBQQVNTcG9yVCAncnBoJyBDbGFpbQ0KDQogICBUaGlzIHNwZWNpZmljYXRpb24gZGVmaW5lcyBh IG5ldyBKU09OIFdlYiBUb2tlbiBjbGFpbSBmb3IgInJwaCIsDQogICB3aGljaCBwcm92aWRlcyBh biBhc3NlcnRpb24gZm9yIGluZm9ybWF0aW9uIGluIFNJUCAnUmVzb3VyY2UtDQogICBQcmlvcml0 eSdoZWFkZXIuDQoNCg0KDQoiLi4uUHJpb3JpdHknIGhlYWRlciBmaWVsZC4iDQoNCihzcGFjZSBh ZnRlciBjbG9zaW5nIHF1b3RhdGlvbiBtYXJrLCAiaGVhZGVyIGZpZWxkIiBpbnN0ZWFkIG9mICJo ZWFkZXIiKQ0KDQoNCg0KICAgVGhlIGNyZWF0b3Igb2YgYSBQQVNTcG9yVCBvYmplY3QgYWRkcyBh ICJwcHQiIHZhbHVlIG9mICJycGgiIHRvIHRoZQ0KICAgaGVhZGVyIG9mIGEgUEFTU3BvclQgb2Jq ZWN0LCBpbiB3aGljaCBjYXNlIHRoZSBQQVNTcG9yVCBjbGFpbXMgTVVTVA0KICAgY29udGFpbiBh ICJycGgiIGNsYWltLCBhbmQgYW55IGVudGl0aWVzIHZlcmlmeWluZyB0aGUgUEFTU3BvclQgb2Jq ZWN0DQogICB3aWxsIGJlIHJlcXVpcmVkIHRvIHVuZGVyc3RhbmQgdGhlICJwcHQiIGV4dGVuc2lv biBpbiBvcmRlciB0bw0KICAgcHJvY2VzcyB0aGUgUEFTU3BvclQgaW4gcXVlc3Rpb24uICBBIFBB U1NQb3JUIGhlYWRlciB3aXRoIHRoZSAicHB0Ig0KICAgaW5jbHVkZWQgd2lsbCBsb29rIGFzIGZv bGxvd3M6DQoNCiAgIHsgICJ0eXAiOiJwYXNzcG9ydCIsDQogICAgICJwcHQiOiJycGgiLA0KICAg ICAiYWxnIjoiRVMyNTYiLA0KICAgICAieDV1IjoiaHR0cHM6Ly93d3cuZXhhbXBsZS5vcmcvY2Vy dC5jZXIiPGh0dHBzOi8vd3d3LmV4YW1wbGUub3JnL2NlcnQuY2VyPn0NCg0KDQoNCklkZWFsbHks IHRoaXMgd291bGQgYmUgZWl0aGVyIHByZXR0eS1wcmludGVkIG9yIGNhbm9uaWNhbGl6ZWQuIFNp bmNlIGl0J3MgdG9vIGxvbmcgdG8gZml0IG9uIGEgbGluZSBpbiBjYW5vbmljYWwgZm9ybSwgSSBw cm9wb3NlOg0KDQp7DQogICJ0eXAiOiJwYXNzcG9ydCIsDQogICJwcHQiOiJycGgiLA0KICAiYWxn IjoiRVMyNTYiLA0KICAieDV1IjoiaHR0cHM6Ly93d3cuZXhhbXBsZS5vcmcvY2VydC5jZXIiPGh0 dHBzOi8vd3d3LmV4YW1wbGUub3JnL2NlcnQuY2VyPg0KfQ0KDQoNCg0KICAgVGhlICJycGgiIGNs YWltIHdpbGwgcHJvdmlkZSBhbiBhc3NlcnRpb24gb2YgYXV0aG9yaXphdGlvbiwiYXV0aCIsDQoN Cg0KDQoiLi4uYXV0aG9yaXphdGlvbiwgImF1dGgiLCAuLi4iDQoNCihzcGFjZSBiZXR3ZWVuIGNv bW1hIGFuZCBvcGVuaW5nIHF1b3RhdGlvbiBtYXJrKQ0KDQoNCiAgIGZvciBpbmZvcm1hdGlvbiBp biB0aGUgU0lQICJSZXNvdXJjZS1Qcmlvcml0eSIgaGVhZGVyIGZpZWxkIChpLmUuLA0KICAgUmVz b3VyY2UtUHJpb3JpdHk6IG5hbWVzcGFjZSAiLiIgci1wcmlvcml0eSkgYmFzZWQgb24gW1JGQzQ0 MTJdLg0KDQoNCg0KVGhlIHVzZSBvZiB0aGUgc3RyaW5nICduYW1lc3BhY2UgIi4iIHItcHJpb3Jp dHknIGhlcmUgYW5kIGVsc2V3aGVyZSBpbiB0aGUgZG9jdW1lbnQgaGFzIGEgZGV0cmltZW50YWwg aW1wYWN0IG9uIHJlYWRhYmlsaXR5LiBJIHN0cm9uZ2x5IHN1Z2dlc3QgcmVwbGFjaW5nIGl0IHdp dGggInItdmFsdWUiICh0aGUgbmFtZSBvZiB0aGlzIHByb2R1Y3Rpb24gaW4gUkZDNDQxMikgZXZl cnl3aGVyZS4NCg0KDQogICBTcGVjaWZpY2FsbHksIHRoZSAicnBoIiBjbGFpbSBpbmNsdWRlcyBh c3NlcnRpb24gb2YgdGhlIHByaW9yaXR5LQ0KICAgbGV2ZWwgb2YgdGhlIHVzZXIgdG8gYmUgdXNl ZCBmb3IgYSBnaXZlbiBjb21tdW5pY2F0aW9uIHNlc3Npb24uICBUaGUNCiAgIHZhbHVlIG9mIHRo ZSAicnBoIiBjbGFpbSBpcyBhbiBhcnJheSBjb250YWluaW5nIG9uZSBvciBtb3JlIG9mIEpTT04N CiAgIG9iamVjdHMgZm9yIHRoZSBjb250ZW50IG9mIHRoZSBTSVAgJ1Jlc291cmNlLVByaW9yaXR5 JyBoZWFkZXIgdGhhdCBpcw0KICAgYmVpbmcgYXNzZXJ0ZWQgb2Ygd2hpY2ggb25lIG9mIHRoZSAi cnBoIiBvYmplY3QsIGlzIG1hbmRhdG9yeS4NCg0KDQoNClRoaXMgbGFzdCBzZW50ZW5jZSBpcyB2 ZXJ5IGhhcmQgdG8gcGFyc2U7IGFuZCAoYmFzZWQgb24gdGhlIGV4YW1wbGUpIHRoZSB2YWx1ZSBp cyBpbnRlbmRlZCB0byBiZSBhIEpTT04gT2JqZWN0IChjdXJseSBicmFjZXMpIHJhdGhlciB0aGFu IGEgSlNPTiBBcnJheSAoc3F1YXJlIGJyYWNlcykuIEkgc3VnZ2VzdDogJ1RoZSB2YWx1ZSBvZiB0 aGUgInJwaCIgY2xhaW0gaXMgYW4gT2JqZWN0IHdpdGggb25lIG9yIG1vcmUga2V5cy4gRWFjaCBr ZXkgaXMgYXNzb2NpYXRlZCB3aXRoIGEgSlNPTiBBcnJheS4gVGhlc2UgYXJyYXlzIGNvbnRhaW4g U3RyaW5ncyB0aGF0IGNvcnJlc3BvbmQgdG8gdGhlIHItdmFsdWVzIGluZGljYXRlZCBpbiB0aGUg U0lQICJSZXNvdXJjZS1Qcmlvcml0eSIgaGVhZGVyIGZpZWxkLicgKG5vdGU6ICJoZWFkZXIgZmll bGQiLCBub3QgImhlYWRlciIpDQoNCg0KDQogICBUaGUgZm9sbG93aW5nIGlzIGFuIGV4YW1wbGUg InJwaCIgY2xhaW0gZm9yIGEgU0lQICJSZXNvdXJjZS1Qcmlvcml0eSINCiAgIGhlYWRlciBmaWVs ZCB3aXRoIGEgIm5hbWVzcGFjZSAiLiIgci1wcmlvcml0eSIgdmFsdWUgb2YgImV0cy4wIiBhbmQN CiAgIHdpdGggYSAibmFtZXNwYWNlICIuIiByLXByaW9yaXR5IiB2YWx1ZSBvZiAid3BzLjAiLg0K DQogICAgeyAib3JpZyI6eyJ0biI6IjEyMTU1NTUxMjEyIn0NCiAgICAgImRlc3QiOntbInRuIjoi MTIxMjU1NTEyMTMiXX0sDQogICAgICJpYXQiOjE0NDMyMDgzNDUsDQogICAgICJycGgiOnsiYXV0 aCI6WyJldHMuMCIsIndwcy4wIl19DQoNCg0KDQpBcyBhYm92ZSwgSSByZWNvbW1lbmQgcHJldHR5 LXByaW50aW5nIHRoaXMuIEl0J3MgYWxzbyBtaXNzaW5nIGEgY29tbWEgYWZ0ZXIgdGhlICJvcmln IiB2YWx1ZSwgYW5kIHRoZSB0b3AtbGV2ZWwgc3RydWN0dXJlIGlzIG1pc3NpbmcgYSBjbG9zaW5n IGJyYWNlLiBUaGUgdmFsdWUgZm9yICJpYXQiIG5lZWRzIHRvIGJlIGVuY2xvc2VkIGluIHF1b3Rl cy4NCg0KVGhlIE5BTlBBIGhhcyBhbGxvY2F0ZWQgTlBBNTU1MDF4eCBmb3IgZXhhbXBsZSB1c2Us IG5vdCBOUEE1NTV4eHh4LCBtdWNoIG9mIHdoaWNoIHJlbWFpbnMgYXNzaWduYWJsZSAoY2YgPGh0 dHBzOi8vd3d3Lm5hdGlvbmFsbmFucGEuY29tL3BkZi9OUlVGL0FUSVMtMDMwMDExNS5wZGY+PGh0 dHBzOi8vd3d3Lm5hdGlvbmFsbmFucGEuY29tL3BkZi9OUlVGL0FUSVMtMDMwMDExNS5wZGY+KS4N Cg0KUHV0dGluZyBhbGwgdGhpcyB0b2dldGhlciwgSSBiZWxpZXZlIHdoYXQgeW91IHdhbnQgaXM6 DQoNCnsNCiAgIm9yaWciOnsidG4iOiIxMjE1NTU1MDExMiJ9LA0KICAiZGVzdCI6e1sidG4iOiIx MjEyNTU1MDExMyJdfSwNCiAgImlhdCI6IjE0NDMyMDgzNDUiLA0KICAicnBoIjp7ImF1dGgiOlsi ZXRzLjAiLCJ3cHMuMCJdfQ0KfQ0KDQoNCg0KICAgQWZ0ZXIgdGhlIGhlYWRlciBhbmQgY2xhaW1z IFBBU1Nwb3JUIG9iamVjdHMgaGF2ZSBiZWVuIGNvbnN0cnVjdGVkLA0KICAgdGhlaXIgc2lnbmF0 dXJlIGlzIGdlbmVyYXRlZCBub3JtYWxseSBwZXIgdGhlIGd1aWRhbmNlIGluDQogICBbSS1ELmll dGYtc3Rpci1wYXNzcG9ydF0gdXNpbmcgdGhlIGZ1bGwgZm9ybSBvZiBQQVNTUG9yVC4gIFRoZQ0K ICAgY3JlZGVudGlhbHMgKGUuZy4sIGF1dGhvcml0eSByZXNwb25zaWJsZSBmb3IgYXV0aG9yaXpp bmcgUmVzb3VyY2UtDQogICBQcmlvcml0eSkgdXNlZCB0byBjcmVhdGUgdGhlIHNpZ25hdHVyZSBt dXN0IGhhdmUgYXV0aG9yaXR5IG92ZXIgdGhlDQogICAicnBoIiBjbGFpbSBhbmQgdGhlcmUgaXMg b25seSBvbmUgYXV0aG9yaXR5IHBlciBjbGFpbS4gIFRoZSBhdXRob3JpdHkNCiAgIE1VU1QgdXNl IGl0cyBjcmVkZW50aWFscyAoaS5lLiwgQ0VSVCkgYXNzb2NpYXRlZCB3aXRoIHRoZSBzcGVjaWZp Yw0KICAgc2VydmljZSBzdXBwb3J0ZWQgYnkgdGhlIFNJUCBuYW1lc3BhY2UgaW4gdGhlIGNsYWlt Lg0KDQo0LiAgJ3JwaCcgaW4gU0lQDQoNCiAgIFRoaXMgc2VjdGlvbiBzcGVjaWZpZXMgU0lQLXNw ZWNpZmljIHVzYWdlIGZvciB0aGUgInJwaCIgY2xhaW0gaW4NCiAgIFBBU1Nwb3JULg0KDQo0LjEu ICBBdXRoZW50aWNhdGlvbiBTZXJ2aWNlIEJlaGF2aW9yDQoNCiAgIFRoZSBBdXRoZW50aWNhdGlv biBTZXJ2aWNlIHdpbGwgY3JlYXRlIHRoZSAicnBoIiBjbGFpbSB1c2luZyB0aGUNCiAgIHZhbHVl cyBkaXNjdXNzZWQgaW4gc2VjdGlvbiAzIGJhc2VkIG9uIFtSRkM0NDEyXS4gIFRoZSBjb25zdHJ1 Y3Rpb24NCiAgIG9mICJycGgiIGNsYWltIGZvbGxvd3MgdGhlIHN0ZXBzIGRlc2NyaWJlZCBpbiBT ZWN0aW9uIDQgb2YNCiAgIFtJLUQuaWV0Zi1zdGlyLXJmYzQ0NzRiaXNdLg0KDQogICBUaGUgcmVz dWx0aW5nIElkZW50aXR5IGhlYWRlciBmb3IgInJwaCIgbWlnaHQgbG9vayBhcyBmb2xsb3dzOg0K DQoNCg0KIi4uLmhlYWRlciBmaWVsZC4uLiINCg0KDQoNCiAgICJleUpoYkdjaU9pSkZVekkxTmlJ c0luUjVjQ0k2SWtwWFZDSjkuZXlKcGMzTWlPaUpsZVVvd1pWaEJhVTlwU25kDQogICBaV0U1Nlkw YzVlV1JEU1hORVVXOXBZMGhDTUVscWIybGpia0p2U1dsM1RrTnBTbWhpUjJOcFQybEtSbFY2U1RG Tw0KICAgYVVselJGRnZhV1ZFVmpGSmFuQnZaRWhTZDJONmIzWk1NMlF6WkhrMWJHVkhSblJqUjNo c1RHMU9kbUpUT1dwYVcNCiAgIEVvd1RHMU9iR051TUU1RFp6QkxJSHg4NG9DWkx1S0FtWHg4SUdW NVFXbGlNMHB3V25sSk5tVjVTakJpYVVrMlNXDQogICBwRmVVMVVWVEZPVkZWNFRXcEZlVWx1TUU1 RGFVcHJXbGhPTUVscWNEZFhlVW93WW1sSk5rbHFSWGxOVkVreFRsUg0KICAgVmVFMXFSWHBKYkRF NVRFRXdTMGx0Ykdoa1EwazJUVlJSTUUxNlNYZFBSRTB3VGxOM1RrTnBTbmxqUjJkcFQyNXoNCiAg IGFWbFlWakJoUTBrMlYzbEtiR1JJVFhWTlEwbHpTVzVrZDJONU5IZEpiREU1UkZGdlBTSjkuczM3 UzZWQzhITTZEDQogICBsNll6SmVRRHNyWmN3SjBsaXp4aFVyQTdmXzk4b1dCSHZvLWNsLW44TUlo b0NyMTh2WVlGeTNibFh2czNmc2xNXw0KICAgb29zMlAyRHl3IjsgaW5mbz0gImh0dHBzOi8vd3d3 LmV4YW1wbGUub3JnL2NlcnQuY2VyIjxodHRwczovL3d3dy5leGFtcGxlLm9yZy9jZXJ0LmNlcj47 YWxnPUVTMjU2Ow0KICAgcHB0PSJycGgiDQoNCg0KDQpUaGlzIGV4YW1wbGUgaGFzIGEgbnVtYmVy IG9mIGlzc3VlczoNCg0KICAqICAgSW4gdGhlIElkZW50aXR5IGhlYWRlciBmaWVsZCwgdGhlIHNp Z25lZC1pZGVudGl0eS1kaWdlc3Qgc2hvdWxkbid0IGJlIHF1b3RlZC4NCiAgKiAgIEluIHRoZSBJ ZGVudGl0eSBoZWFkZXIgZmllbGQsIGluZm8gaXMgZW5jbG9zZWQgaW4gPD4gcmF0aGVyIHRoYW4g IiIuDQogICogICBJbiB0aGUgSWRlbnRpdHkgaGVhZGVyIGZpZWxkLCBwcHQgaXMgYSB0b2tlbiBy YXRoZXIgdGhhbiBhIHF1b3RlZCBzdHJpbmcuDQogICogICBUaGUgc2lnbmVkLWlkZW50aXR5LWRp Z2VzdCBoZWFkZXIgbmVlZHMgdG8gaW5kaWNhdGUgYSAidHlwIiBvZiAicGFzc3BvcnQiIHJhdGhl ciB0aGFuIEpXVCwgYW5kIGl0IG5lZWRzIHRvIGluY2x1ZGUgYm90aCBhICJwcHQiIGFuZCAieDV1 IiBmaWVsZC4NCiAgKiAgIFRoZSBzaWduZWQtaWRlbnRpdHktZGlnZXN0IGJvZHkgc2hvdWxkIGNv bnRhaW4gb25seSB0aGUgcGFzc3BvcnQgY2xhaW0gcmF0aGVyIHRoYW4gYSBKU09OIG9iamVjdCB0 aGF0IGl0c2VsZiBjb250YWlucyBhIGJhc2U2NC1lbmNvZGVkIEpXUyBoZWFkZXIgY29uY2F0ZW5h dGVkIHdpdGggYSBjbGFpbS4NCiAgKiAgIEkgYmVsaWV2ZSB0aGF0LCBldmVuIHdoZW4gdGhlIGJv ZHkgaXMgaW5jbHVkZWQsIHZhbHVlcyBpbiB0aGUgaGVhZGVyIGFuZCBib2R5IG5lZWQgdG8gYmUg YmUgY2Fub25pY2FsaXplZCAoaS5lLiwgYWxsIG9uIG9uZSBsaW5lLCBubyBzcGFjZXMsIGluIGFs cGhhYmV0aWNhbCBvcmRlciwgZXRjLikNCg0KSSB3b3VsZCBhbHNvIHJlY29tbWVuZCBmb2xsb3dp bmcgdGhlIGNvbnZlbnRpb24gb2YgaW5kaWNhdGluZyB0aGF0IGxpbmUtd3JhcHMgYXJlIG9ubHkg Zm9yIHJlYWRhYmlsaXR5LCBhbmQgaW5jbHVkaW5nIHRoZSBoZWFkZXIgZmllbGQgbmFtZSBpbiB0 aGUgZXhhbXBsZS4gUHV0dGluZyBhbGwgdGhpcyB0b2dldGhlciwgSSBiZWxpZXZlIHdoYXQgeW91 IHdhbnQgaXM6DQoNCiAgIEZvciBleGFtcGxlLCBhIElkZW50aXR5IGhlYWRlciBmaWVsZCBmb3Ig InJwaCIgbWlnaHQgbG9vaw0KICAgYXMgZm9sbG93cyAoYmFja3NsYXNoZXMgc2hvd24gZm9yIGxp bmUgZm9sZGluZyBvbmx5KToNCg0KICAgSWRlbnRpdHk6IGV5SmhiR2NpT2lKRlV6STFOaUlzSW5C d2RDSTZJbkp3YUNJc0luUjVjQ0k2SW5CaGMzTndiM0owSSBcDQogICBpd2llRFYxSWpvaWFIUjBj SE02THk5M2QzY3VaWGhoYlhCc1pTNWpiMjB2WTJWeWRDNWpaWElpZlFvLmV5SmtaWE4wIFwNCiAg IElqcDdXeUowYmlJNklqRXlNVEkxTlRVd01URXpJbDE5TENKcFlYUWlPaUl4TkRRek1qQTRNelEx SWl3aWIzSnBaeUkgXA0KICAgNmV5SjBiaUk2SWpFeU1UVTFOVFV3TVRFeUluMHNJbkp3YUNJNmV5 SmhkWFJvSWpwYkltVjBjeTR3SWl3aWQzQnpMaiBcDQogICBBaVhYMTlDZy5zMzdTNlZDOEhNNkRs Nll6SmVRRHNyWmN3SjBsaXp4aFVyQTdmXzk4b1dCSHZvLWNsLW44TUlob0NyIFwNCiAgIDE4dllZ RnkzYmxYdnMzZnNsTV9vb3MyUDJEeXc7aW5mbz08aHR0cHM6Ly93d3cuZXhhbXBsZS5vcmcvY2Vy dC5jZXIgXA0KICAgPjthbGc9RVMyNTY7cHB0PXJwaA0KDQooTm90ZTogdGhpcyBleGFtcGxlIGFz c3VtZXMgdGhlIGNhbGxpbmcgYW5kIGNhbGxlZCBwYXJ0eSBudW1iZXJzIGluIHRoZSBwcmV2aW91 cyBleGFtcGxlIGFyZSBjaGFuZ2VkIHRvIDEyMTU1NTUwMTEyIGFuZCAxMjE1NTU1MDExMywgcmVz cGVjdGl2ZWx5KQ0KDQoNCg0KICAgQSBTSVAgYXV0aGVudGljYXRpb24gc2VydmljZSB0eXBpY2Fs bHkgd2lsbCBkZXJpdmUgdGhlIHZhbHVlIG9mICJycGgiDQogICBmcm9tIHRoZSAnUmVzb3VyY2Ut UHJpb3JpdHknIGhlYWRlciBmaWVsZCBiYXNlZCBvbiBwb2xpY3kgYXNzb2NpYXRlZA0KICAgd2l0 aCBzZXJ2aWNlIHNwZWNpZmljIHVzZSBvZiB0aGUgIm5hbWVzcGFjZSAiLiIgci1wcmlvcml0eSIg dmFsdWVzDQogICBiYXNlZCBvbiBbUkZDNDQxMl0uICBUaGUgYXV0aGVudGljYXRpb24gc2Vydmlj ZSBkZXJpdmVzIHRoZSB2YWx1ZSBvZg0KICAgdGhlIFBBU1NQb3JUIGNsYWltIGJ5IHZlcmlmeWlu ZyB0aGUgYXV0aG9yaXphdGlvbiBmb3IgUmVzb3VyY2UtDQogICBQcmlvcml0eSAoaS5lLiwgdmVy aWZ5aW5nIGEgY2FsbGluZyB1c2VyIHByaXZpbGVnZSBmb3IgUmVzb3VyY2UtDQogICBQcmlvcml0 eSBiYXNlZCBvbiBpdHMgaWRlbnRpdHkpIHdoaWNoIG1pZ2h0IGJlIGRlcml2ZWQgZnJvbSBjdXN0 b21lcg0KICAgcHJvZmlsZSBkYXRhIG9yIGZyb20gYWNjZXNzIHRvIGV4dGVybmFsIHNlcnZpY2Vz Lg0KDQogICBbUkZDNDQxMl0gYWxsb3dzIG11bHRpcGxlICJuYW1lc3BhY2UgIi4iIHItcHJpb3Jp dHkiIHBhaXJzLCBlaXRoZXIgaW4NCiAgIGEgc2luZ2xlIFNJUCBSZXNvdXJjZS1Qcmlvcml0eSBo ZWFkZXIgb3IgYWNyb3NzIG11bHRpcGxlIFNJUA0KDQoNCg0KU2luZ2xlIHF1b3RlcyBhcm91bmQg J1Jlc291cmNlLVByaW9yaXR5Jy4NCg0KIi4uLmhlYWRlciBmaWVsZC4uLiINCg0KDQogICBSZXNv dXJjZS1Qcmlvcml0eSBoZWFkZXJzLiAgSG93ZXZlciwgaXQgaXMgbm90IG5lY2Vzc2FyeSB0byBz aWduIGFsbA0KDQoNCg0KU2luZ2xlIHF1b3RlcyBhcm91bmQgJ1Jlc291cmNlLVByaW9yaXR5Jy4N Cg0KIi4uLmhlYWRlciBmaWVsZHMuLi4iDQoNCg0KICAgY29udGVudCBvZiBhIFNJUCBSZXNvdXJj ZS1Qcmlvcml0eSBoZWFkZXIgb3IgYWxsIFNJUCBSZXNvdXJjZS0NCg0KDQoNClNpbmdsZSBxdW90 ZXMgYXJvdW5kICdSZXNvdXJjZS1Qcmlvcml0eScuDQoNCiIuLi5oZWFkZXIgZmllbGQuLi4iDQoN Cg0KICAgUHJpb3JpdHkgaGVhZGVycyBpbiBhIGdpdmVuIFNJUCBtZXNzYWdlLiAgQW4gYXV0aG9y aXR5IGlzIG9ubHkNCg0KDQoNClNpbmdsZSBxdW90ZXMgYXJvdW5kICdSZXNvdXJjZS1Qcmlvcml0 eScuDQoNCiIuLi5oZWFkZXIgZmllbGRzLi4uIg0KDQoNCiAgIHJlc3BvbnNpYmxlIGZvciBzaWdu aW5nIHRoZSBjb250ZW50IG9mIGEgU0lQIFJlc291cmNlLVByaW9yaXR5IGhlYWRlcg0KDQoNCg0K U2luZ2xlIHF1b3RlcyBhcm91bmQgJ1Jlc291cmNlLVByaW9yaXR5Jy4NCg0KIi4uLmhlYWRlciBm aWVsZC4uLiINCg0KDQogICBmb3Igd2hpY2ggaXQgaGFzIGF1dGhvcml0eSAoZS5nLiwgYSBzcGVj aWZpYyAibmFtZXNwYWNlICIuIg0KICAgci1wcmlvcml0eSIpLg0KDQo0LjIuICBWZXJpZmljYXRp b24gU2VydmljZSBCZWhhdmlvcg0KDQogICBbSS1ELmlldGYtc3Rpci1yZmM0NDc0YmlzXSBTZWN0 aW9uIDYuMiBTdGVwIDUgcmVxdWlyZXMgdGhhdA0KICAgc3BlY2lmaWNhdGlvbnMgZGVmaW5pbmcg InBwdCIgdmFsdWVzIGRlc2NyaWJlIGFueSBhZGRpdGlvbmFsIHZlcmlmaWVyDQogICBiZWhhdmlv ci4gIFRoZSBiZWhhdmlvciBzcGVjaWZpZWQgZm9yIHRoZSAicHB0IiB2YWx1ZXMgb2YgInJwaCIg aXMgYXMNCiAgIGZvbGxvd3M6DQoNCiAgIFRoZSB2ZXJpZmljYXRpb24gc2VydmljZSBNVVNUIGV4 dHJhY3QgdGhlIHZhbHVlIGFzc29jaWF0ZWQgd2l0aCB0aGUNCiAgICJhdXRoIiBrZXkgaW4gYSBm dWxsIGZvcm0gUEFTU1BvclQgd2l0aCBhICJwcHQiIHZhbHVlIG9mICJycGgiLiAgSWYNCiAgIHRo ZSBzaWduYXR1cmUgdmFsaWRhdGVzLCB0aGVuIHRoZSB2ZXJpZmljYXRpb24gc2VydmljZSBjYW4g dXNlIHRoZQ0KICAgdmFsdWUgb2YgdGhlICJycGgiIGNsYWltIGFzIHZhbGlkYXRpb24gdGhhdCB0 aGUgY2FsbGluZyBwYXJ0eSBpcw0KICAgYXV0aG9yaXplZCBmb3IgUmVzb3VyY2UtUHJpb3JpdHks IHdoaWNoIHdvdWxkIGluIHR1cm4gYmUgdXNlZCBmb3INCg0KDQpTaW5nbGUgcXVvdGVzIGFyb3Vu ZCAnUmVzb3VyY2UtUHJpb3JpdHknLg0KDQpUaGlzIHRleHQgaXMgYW1iaWd1b3VzIGFib3V0IHdo ZXRoZXIgdGhlIHZhbGlkYXRpb24gaW5kaWNhdGVzIHRoYXQgdGhlIGNhbGxpbmcgcGFydHkgaXMg YXV0aG9yaXplZCB0byB1c2UgdGhlIHByaW9yaXRpZXMgaW5kaWNhdGVkIGluIHRoZSBwYXNzcG9y dCBvYmplY3QsIG9yIHRoZSB2YWx1ZXMgaW4gdGhlIFNJUCAnUmVzb3VyY2UtUHJpb3JpdHknIGhl YWRlciBmaWVsZDsgYW5kICh0YWtlbiBvbiBpdHMgZmFjZSkgaW1wbGllcyB0aGUgbGF0dGVyLCB3 aGVuIHRoZSBpbnRlbnRpb24gaGVyZSBzaG91bGQgY2xlYXJseSBiZSB0aGUgZm9ybWVyLg0KDQoi Li4uYXV0aG9yaXplZCBmb3IgJ1Jlc291cmNlLVByaW9yaXR5JyBpbmRpY2F0ZWQgaW4gdGhlIGNs YWltLiBUaGlzIHZhbHVlIHdvdWxkIGluIHR1cm4gYmUgdXNlZCBmb3IuLi4iDQoNClRoZSB0ZXh0 IGFsc28gbmVlZHMgdG8gc2F5IHNvbWV0aGluZyBhYm91dCBjb21wYXJpbmcgdmFsdWVzIGluIHRo ZSBjbGFpbSB0byB2YWx1ZXMgaW4gdGhlICdSZXNvdXJjZS1Qcmlvcml0eScgaGVhZGVyIGZpZWxk LCBhbmQgd2hhdCBhIG1pc21hdGNoIG1pZ2h0IG1lYW4uIFRoZSBkb2N1bWVudCBzYXlzIGVsc2V3 aGVyZSB0aGF0IHRoZSBzaWduYXR1cmUgbWlnaHQgb25seSBjb3ZlciBzb21lIG9mIHRoZSByLXZh bHVlcywgd2hpY2ggbWFrZXMgaXQgZW50aXJlbHkgcG9zc2libGUgdGhhdCB0aGUgJ1Jlc291cmNl LVByaW9yaXR5JyBmaWVsZCBtaWdodCBjb250YWluIG1vcmUgdmFsdWVzIHRoYW4gYXJlIHNpZ25l ZC4gT24gdGhlIG90aGVyIGhhbmQsIGludGVybWVkaWFyaWVzIG1pZ2h0IHJlYXNvbmFibHkgcmVt b3ZlIHItdmFsdWVzIGFzIHRoZSBjYWxsIGlzIHByb2Nlc3NlZC4gVGhpcyBwcm9iYWJseSBtZWFu cyB0aGF0IHRob3NlIHJlbW92ZWQgcHJpb3JpdGllcyBzaG91bGQgbm90IGJlIHVzZWQsIGV2ZW4g aWYgdGhleSBhcmUgcHJlc2VudCBpbiB0aGUgcGFzc3BvcnQuIEl0IHNlZW1zIHJlYXNvbmFibGUg dG8gc2F5IHRoYXQgKnR5cGljYWwqIHByb2Nlc3NpbmcgYnkgYSByZWNlaXZpbmcgcGFydHkgd291 bGQgYmUgdG8gdGFrZSB0aGUgKnVuaW9uKiBvZiBhbGwgUlBIIHBhc3Nwb3J0cyB0aGF0IHRoZXkg dHJ1c3QsIGFuZCAqaW50ZXJzZWN0KiB0aGF0IHdpdGggdGhlIHByaW9yaXRpZXMgaW4gJ1Jlc291 cmNlLVByaW9yaXR5JyBoZWFkZXIgZmllbGRzIHRvIGdldCB0aGUgYWN0dWFsIHByaW9yaXR5IG9y IHByaW9yaXRpZXMgdG8gYmUgYXBwbGllZCB0byB0aGUgY2FsbCAoc3ViamVjdCB0byBsb2NhbCBw b2xpY3kpLg0KDQoNCiAgIHByaW9yaXR5IHRyZWF0bWVudCBpbiBhY2NvcmRhbmNlIHdpdGggbG9j YWwgcG9saWN5IGZvciB0aGUgYXNzb2NpYXRlZA0KICAgY29tbXVuaWNhdGlvbiBzZXJ2aWNlLg0K DQogICBJbiBhZGRpdGlvbiwgW0ktRC5pZXRmLXN0aXItcmZjNDQ3NGJpc10gU2VjdGlvbiA2LjIg U3RlcCA0IHJlcXVpcmVzDQogICAiaWF0IiB2YWx1ZSBpbiAicnBoIiBjbGFpbSB0byBiZSB2ZXJp ZmllZC4NCg0KICAgVGhlIGJlaGF2aW9yIG9mIGEgU0lQIFVBcyB1cG9uIHJlY2VpdmluZyBhbiBJ TlZJVEUgY29udGFpbmluZyBhDQoNCg0KDQoiLi4ub2YgYSBTSVAgVUEgdXBvbi4uLiINCg0Kb3IN Cg0KIi4uLm9mIFNJUCBVQXMgdXBvbi4uLiINCg0KDQogICBQQVNTcG9yVCBvYmplY3Qgd2l0aCBh ICJycGgiIGNsYWltIHdpbGwgbGFyZ2VseSByZW1haW4gYSBtYXR0ZXIgb2YNCiAgIGltcGxlbWVu dGF0aW9uIHBvbGljeSBmb3IgdGhlIHNwZWNpZmljIGNvbW11bmljYXRpb24gc2VydmljZS4gIElu DQogICBtb3N0IGNhc2VzLGltcGxlbWVudGF0aW9ucyB3b3VsZCBhY3QgYmFzZWQgb24gY29uZmlk ZW5jZSBpbiB0aGUNCg0KDQoNCiIuLi5jYXNlcywgaW1wbGVtZW50YXRpb25zLi4uIg0KDQooc3Bh Y2UgYWZ0ZXIgY29tbWEpDQoNCg0KICAgdmVyYWNpdHkgb2YgdGhpcyBpbmZvcm1hdGlvbi4gIFRo ZSB1c2Ugb2YgdGhlIGNvbXBhY3QgZm9ybSBvZg0KDQoNCg0KUGFyYWdyYXBoIGJyZWFrIGJlZm9y ZSAiVGhlIi4NCg0KDQogICBQQVNTcG9yVCBpcyBub3Qgc3BlY2lmaWVkIGluIHRoaXMgZG9jdW1l bnQuDQoNCjUuICBGdXJ0aGVyIEluZm9ybWF0aW9uIEFzc29jaWF0ZWQgd2l0aCBSZXNvdXJjZS1Q cmlvcml0eQ0KDQoNCg0KU2luZ2xlIHF1b3RlcyBhcm91bmQgJ1Jlc291cmNlLVByaW9yaXR5Jy4N Cg0KDQoNCiAgIFRoZXJlIG1heSBiZSBhZGRpdGlvbmFsIGluZm9ybWF0aW9uIGFib3V0IHRoZSBj YWxsaW5nIHBhcnR5IG9yIHRoZQ0KICAgY2FsbCB0aGF0IGNvdWxkIGJlIHJlbGV2YW50IHRvIGF1 dGhvcml6YXRpb24gZm9yIFJlc291cmNlLVByaW9yaXR5Lg0KDQoNCg0KU2luZ2xlIHF1b3RlcyBh cm91bmQgJ1Jlc291cmNlLVByaW9yaXR5Jy4NCg0KDQogICBUaGlzIG1heSBpbmNsdWRlIGluZm9y bWF0aW9uIHJlbGF0ZWQgdG8gdGhlIGRldmljZSBzdWJzY3JpcHRpb24gb2YNCiAgIHRoZSBjYWxs ZXIsIG9yIHRvIGFueSBpbnN0aXR1dGlvbnMgdGhhdCB0aGUgY2FsbGVyIG9yIGRldmljZSBpcw0K ICAgYXNzb2NpYXRlZCB3aXRoLCBvciBldmVuIGNhdGVnb3JpZXMgb2YgaW5zdGl0dXRpb25zLiAg QWxsIG9mIHRoZXNlDQogICBkYXRhIGVsZW1lbnRzIHdvdWxkIGJlbmVmaXQgZnJvbSB0aGUgc2Vj dXJlIGF0dGVzdGF0aW9ucyBwcm92aWRlZCBieQ0KICAgdGhlIFNUSVIgYW5kIFBBU1Nwb3JUIGZy YW1ld29ya3MuICBUaGUgc3BlY2lmaWNhdGlvbiBvZiB0aGUgInJwaCINCiAgIGNsYWltIGNvdWxk IGVudGFpbCB0aGUgb3B0aW9uYWwgcHJlc2VuY2Ugb2Ygb25lIG9yIG1vcmUgc3VjaA0KICAgYWRk aXRpb25hbCBpbmZvcm1hdGlvbiBmaWVsZHMuDQoNCiAgIEEgbmV3IElBTkEgcmVnaXN0cnkgaGFz IGJlZW4gZGVmaW5lZCB0byBob2xkIHBvdGVudGlhbCB2YWx1ZXMgb2YgdGhlDQogICAicnBoIiBh cnJheTsgc2VlIFNlY3Rpb24gNi4yLiAgVGhlIGRlZmluaXRpb24gb2YgdGhlICJycGgiIGNsYWlt IG1heQ0KICAgaGF2ZSBvbmUgb3IgbW9yZSBzdWNoIGFkZGl0aW9uYWwgaW5mb3JtYXRpb24gZmll bGQocykuICBEZXRhaWxzIG9mDQogICBzdWNoICJycGgiIGNsYWltIHRvIGVuY29tcGFzcyBvdGhl ciBkYXRhIGVsZW1lbnRzIGFyZSBsZWZ0IGZvciBmdXR1cmUNCiAgIHZlcnNpb24gb2YgdGhpcyBz cGVjaWZpY2F0aW9uLg0KDQo2LiAgSUFOQSBDb25zaWRlcmF0aW9ucw0KDQo2LjEuICBKU09OIFdl YiBUb2tlbiBDbGFpbXMgUmVnaXN0cmF0aW9uDQoNCg0KDQpJIHRoaW5rIHRoZXJlJ3Mgc29tZSBj b25mdXNpb24gaGVyZS4gWW91J3JlIHJlZ2lzdGVyaW5nIGEgUEFTU3BvclQgcHB0IHZhbHVlLCBu b3QgYSBuZXcgSldUIGNsYWltLiBUaGF0IGlzIHRvIHNheSwgeW91J3JlIGFkZGluZyBhbiBlbnRy eSB0byB0aGlzIHRhYmxlOg0KDQpodHRwczovL3d3dy5pYW5hLm9yZy9hc3NpZ25tZW50cy9wYXNz cG9ydC9wYXNzcG9ydC54aHRtbA0KDQpOb3QgdG8gdGhpcyB0YWJsZToNCg0KaHR0cHM6Ly93d3cu aWFuYS5vcmcvYXNzaWdubWVudHMvand0L2p3dC54aHRtbA0KDQpZb3Ugd291bGQgb25seSB1c2Ug dGhlIHNlY29uZCB0YWJsZSBpZiB5b3UgaGFkIGEgbmV3IGtleSB0byBhZGQgdG8gdGhlIFBBU1Nw b3JUIGhlYWRlciAtLSB0aGlzIHNwZWNpZmljYXRpb24gZG9lcyBub3QgZG8gdGhhdC4NCg0KVGhp cyBzZWN0aW9uIGFsc28gbmVlZHMgc29tZSBpbnRyb2R1Y3RvcnkgdGV4dCB0byBsZXQgdGhlIElB TkEga25vdyBleGFjdGx5IHdoYXQgdG8gZG87IGUuZy4gIlRoaXMgZG9jdW1lbnQgcmVnaXN0ZXJz IGEgbmV3IHZhbHVlIGZvciB0aGUgIlBlcnNvbmFsIEFzc2VydGlvbiBUb2tlbiAoUEFTU3BvclQp IEV4dGVuc2lvbnMiIHRhYmxlLg0KDQogICBvICBwcHQgdmFsdWU6ICJycGgiDQoNCiAgIG8gIFNw ZWNpZmljYXRpb24gRG9jdW1lbnQocyk6IFNlY3Rpb24gMyBvZiBbUkZDVGhpc10NCg0KNi4yLiAg UEFTU3BvclQgJ3JwaCcgVHlwZXMNCg0KICAgVGhpcyBkb2N1bWVudCByZXF1ZXN0cyB0aGF0IHRo ZSBJQU5BIGFkZCBhIG5ldyBlbnRyeSB0byB0aGUgUEFTU3BvclQNCiAgIFR5cGVzIHJlZ2lzdHJ5 IGZvciB0aGUgdHlwZSAicnBoIiB3aGljaCBpcyBzcGVjaWZpZWQgaW4gW1JGQ1RoaXNdLg0KDQoN Cg0KVGhlcmUgaXNuJ3QgYW4gSUFOQSB0YWJsZSBjYWxsZWQgIlBBU1Nwb3JUIFR5cGVzLiIgSSBw cmVzdW1lIHRoaXMgaXMgdGhlIHJlZ2lzdHJhdGlvbiB3ZSBqdXN0IGRpc2N1c3NlZCBpbiBzZWN0 aW9uIDYuMSwgYW5kIHNvIHRoZSBhYm92ZSB0d28gbGluZXMgY2FuIGJlIHJlbW92ZWQuDQoNCg0K ICAgVGhpcyBzcGVjaWZpY2F0aW9uIGFsc28gcmVxdWVzdHMgdGhhdCB0aGUgSUFOQSBjcmVhdGUg YSBuZXcgcmVnaXN0cnkNCiAgIGZvciBQQVNTcG9yVCAicnBoIiB0eXBlcy4gIFJlZ2lzdHJhdGlv biBvZiBuZXcgUEFTU3BvclQgInJwaCIgdHlwZXMNCiAgIHNoYWxsIGJlIHVuZGVyIHRoZSBzcGVj aWZpY2F0aW9uIHJlcXVpcmVkIHBvbGljeS4gIFRoaXMgcmVnaXN0cnkgaXMNCiAgIHRvIGJlIGlu aXRpYWxseSBwb3B1bGF0ZWQgd2l0aCBhIHNpbmdsZSB2YWx1ZSBmb3IgImF1dGgiIHdoaWNoIGlz DQogICBzcGVjaWZpZWQgaW4gW1JGQ1RoaXNdLg0KDQoNCg0KVGhpcyBuZWVkcyB0byBiZSB2ZXJ5 IGNsZWFyIGFib3V0IHRoZSBmaWVsZHMgdG8gYmUgaW5jbHVkZWQgaW4gdGhpcyBuZXcgcmVnaXN0 cnkgKGUuZy4sICJSZWdpc3RyeSBlbnRyaWVzIG11c3QgY29udGFpbiB0d28gZmllbGRzOiB0aGUg bmFtZSBvZiB0aGUgJ3JwaCcgdHlwZSBhbmQgdGhlIHNwZWNpZmljYXRpb24gaW4gd2hpY2ggdGhl IHR5cGUgaXMgZGVzY3JpYmVkIikuDQoNCg0KDQo3LiAgU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMN Cg0KICAgVGhlIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIGRpc2N1c3NlZCBpbiBbSS1ELmlldGYt c3Rpci1yZmM0NDc0YmlzXQ0KICAgaW4gU2VjdGlvbiAxMCBhcmUgYXBwbGljYWJsZSBoZXJlLg0K DQo3LjEuICBBdm9pZGFuY2Ugb2YgcmVwbGF5IGFuZCBjdXQgYW5kIHBhc3RlIGF0dGFja3MNCg0K ICAgVGhlIFBBU1Nwb3JUIGV4dGVuc2lvbiB3aXRoIGEgInBwdCIgdmFsdWUgb2YgInJwaCIgTVVT VCBvbmx5IGJlIHNlbnQNCiAgIHdpdGggU0lQIElOVklURSB3aGVuICdSZXNvdXJjZS1Qcmlvcml0 eScgaGVhZGVyIGlzIHVzZWQgdG8gY29udmV5IHRoZQ0KDQoNCg0KIi4uLmhlYWRlciBmaWVsZC4u LiINCg0KDQogICBwcmlvcml0eSBvZiB0aGUgY29tbXVuaWNhdGlvbiBhcyBkZWZpbmVkIGluIFtS RkM0NDEyXS4gIFRvIGF2b2lkIHRoZQ0KICAgcmVwbGF5LCBhbmQgY3V0IGFuZCBwYXN0ZSBhdHRh Y2tzLCB0aGUgcHJvY2VkdXJlcyBkZXNjcmliZWQgaW4NCiAgIFNlY3Rpb24gMTAuMSBvZiBbSS1E LmlldGYtc3Rpci1yZmM0NDc0YmlzXSBNVVNUIGJlIGZvbGxvd2VkLg0KDQo3LjIuICBTb2x1dGlv biBDb25zaWRlcmF0aW9ucw0KDQogICBUaGUgdXNlIG9mIGV4dGVuc2lvbiB0byBQQVNTcG9yVCB0 b2tlbnMgd2l0aCAicHB0IiB2YWx1ZSAicnBoIiBiYXNlZA0KICAgb24gdGhlIHZhbGlkYXRpb24g b2YgdGhlIGRpZ2l0YWwgc2lnbmF0dXJlIGFuZCB0aGUgYXNzb2NpYXRlZA0KICAgY2VydGlmaWNh dGUgcmVxdWlyZXMgY29uc2lkZXJhdGlvbiBvZiB0aGUgYXV0aGVudGljYXRpb24gYW5kDQogICBh dXRob3JpdHkgb3IgcmVwdXRhdGlvbiBvZiB0aGUgc2lnbmVyIHRvIGF0dGVzdCB0byB0aGUgaWRl bnRpdHkgYmVpbmcNCiAgIGFzc2VydGVkLiAgVGhlIGZvbGxvd2luZyBjb25zaWRlcmF0aW9ucyBz aG91bGQgYmUgcmVjb2duaXplZCB3aGVuDQogICB1c2luZyBQQVNTcG9yVCBleHRlbnNpb24gd2l0 aCAicHB0IiB2YWx1ZSBvZiAicnBoIjoNCg0KICAgbyAgQW4gYXV0aG9yaXR5IChzaWduZXIpIGlz IG9ubHkgYWxsb3dlZCB0byBzaWduIHRoZSBjb250ZW50IG9mIGEgU0lQDQogICAgICAnUmVzb3Vy Y2UtUHJpb3JpdHknIGhlYWRlciBmb3Igd2hpY2ggaXQgaGFzIHRoZSByaWdodCBhdXRob3JpdHku DQoNCg0KDQoiLi4uaGVhZGVyIGZpZWxkLi4uIg0KDQoNCiAgICAgIFRoZSBhdXRob3JpdHkgdGhh dCBzaWducyB0aGUgdG9rZW4gTVVTVCBoYXZlIGEgc2VjdXJlIG1ldGhvZCBmb3INCiAgICAgIGF1 dGhlbnRpY2F0aW9uIG9mIHRoZSBlbmQgdXNlciBvciB0aGUgZGV2aWNlLg0KDQogICBvICBUaGUg dmVyaWZpY2F0aW9uIG9mIHRoZSBzaWduYXR1cmUgTVVTVCBpbmNsdWRlIG1lYW5zIG9mIHZlcmlm eWluZw0KICAgICAgdGhhdCB0aGUgc2lnbmVyIGlzIGF1dGhvcml0YXRpdmUgZm9yIHRoZSBzaWdu ZWQgY29udGVudCBvZiB0aGUgU0lQDQoNCg0KDQpJdCdzIG5vdCBjbGVhciB3aGF0IGF1dGhvcml0 eSBpcyBiZWluZyBjbGFpbWVkIGhlcmUuIElzIHRoaXMgc3VwcG9zZWQgdG8gbWVhbiBzb21ldGhp bmcgbGlrZSAiLi4udmVyaWZ5aW5nIHRoYXQgdGhlIHNpZ25lciBpcyBhdXRob3JpdGF0aXZlIGZv ciB0aGUgb3JpZ2luYXRpbmcgdG4gaW4gdGhlIFBBU1Nwb3JULi4uIj8gT3IgIi4uLmF1dGhvcml0 YXRpdmUgZm9yIHRoZSByZXNvdXJjZSBwcmlvcml0eSBuYW1lc3BhY2UgaW4gdGhlIFBBU1Nwb3JU PyIgV2hhdGV2ZXIgdGhlIHNlcnZlciBpcyBwdXJwb3J0ZWRseSBhdXRob3JpdGF0aXZlIGZvciBu ZWVkcyB0byBiZSBjbGVhcmx5IHNwZWxsZWQgb3V0Lg0KDQoNCiAgICAgICdSZXNvdXJjZS1Qcmlv cml0eScgaGVhZGVyLg0KDQoNCg0KIi4uLmhlYWRlciBmaWVsZC4iDQoNCg0KL2ENCg== --_000_7594FB04B1934943A5C02806D1A2204B6C135F8EESESSMB109erics_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmOw0KCWNvbG9yOmJsYWNrO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCnANCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1tYXJnaW4tdG9wLWFs dDphdXRvOw0KCW1hcmdpbi1yaWdodDowY207DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 DQoJbWFyZ2luLWxlZnQ6MGNtOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRp bWVzIE5ldyBSb21hbiIsc2VyaWY7DQoJY29sb3I6YmxhY2s7fQ0KdHQNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0Kc3Bhbi5FbWFpbFN0eWxl MTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNh bnMtc2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5 bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5 cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjEN Cgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcy LjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3Qg RGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjExNjIzNTQ4NjM7DQoJbXNv LWxpc3QtdGVtcGxhdGUtaWRzOjMxMzkzMjkxODt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6MzYuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1m YW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NzIuMHB0 Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0 Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3 IjsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMDps ZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MTA4LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6 MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6MTQ0LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZv bnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6MTgwLjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5Oldp bmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MjE2LjBwdDsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsN Cgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpA bGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MjUyLjBwdDsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1m b250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZl bDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+C pzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mjg4LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAu MHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6MzI0LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQt ZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMQ0KCXttc28tbGlzdC1pZDoxODE1MTA0NzgxOw0K CW1zby1saXN0LXRlbXBsYXRlLWlkczoxMzU1MDczMTIyO30NCkBsaXN0IGwxOmxldmVsMQ0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1z by1sZXZlbC10YWItc3RvcDozNi4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglm b250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDo3 Mi4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0x OC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseToiQ291cmll ciBOZXciOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0 IGwxOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoxMDguMHB0Ow0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxOmxldmVsNA0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0K CW1zby1sZXZlbC10YWItc3RvcDoxNDQuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7 DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxOmxldmVsNQ0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10 YWItc3RvcDoxODAuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1p bHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyMTYu MHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTgu MHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rpbmdz O30NCkBsaXN0IGwxOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyNTIuMHB0Ow0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1h bnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwx OmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDoyODguMHB0Ow0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxOmxldmVsOQ0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1z by1sZXZlbC10YWItc3RvcDozMjQuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJ Zm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGNtO30NCnVsDQoJ e21hcmdpbi1ib3R0b206MGNtO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+ DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+ PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4 dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxh eW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGJnY29sb3I9IndoaXRlIiBs YW5nPSJFTi1HQiIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3Jk U2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPkhpLDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEO21z by1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RDttc28tZmFy ZWFzdC1sYW5ndWFnZTpFTi1VUyI+QW5vdGhlciBxdWVzdGlvbiBmb3IgY2xhcmlmaWNhdGlvbi48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPlNlY3Rpb24gMyBjb250YWlu cyB0aGUgZm9sbG93aW5nIGV4YW1wbGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFu Z3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdl OkVOLVVTIj4mbmJzcDsmbmJzcDsmbmJzcDsgeyAmcXVvdDtvcmlnJnF1b3Q7OnsmcXVvdDt0biZx dW90OzomcXVvdDsxMjE1NTU1MTIxMiZxdW90O308bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RDttc28tZmFyZWFz dC1sYW5ndWFnZTpFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZxdW90O2Rlc3QmcXVv dDs6e1smcXVvdDt0biZxdW90OzomcXVvdDsxMjEyNTU1MTIxMyZxdW90O119LDxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsgJnF1b3Q7aWF0JnF1b3Q7OjE0NDMyMDgzNDUsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVh c3QtbGFuZ3VhZ2U6RU4tVVMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtycGgmcXVv dDs6eyZxdW90O2F1dGgmcXVvdDs6WyZxdW90O2V0cy4wJnF1b3Q7LCZxdW90O3dwcy4wJnF1b3Q7 XX08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPuKApmFuZCB0aGUgZm9s bG93aW5nIHRleHQ6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj4mbmJz cDsmbmJzcDsg4oCcVGhlIGNyZWRlbnRpYWxzIChlLmcuLCBhdXRob3JpdHkgcmVzcG9uc2libGUg Zm9yIGF1dGhvcml6aW5nIFJlc291cmNlLTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxh bmd1YWdlOkVOLVVTIj4mbmJzcDsmbmJzcDsgUHJpb3JpdHkpIHVzZWQgdG8gY3JlYXRlIHRoZSBz aWduYXR1cmUgbXVzdCBoYXZlIGF1dGhvcml0eSBvdmVyIHRoZTxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEO21z by1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj4mbmJzcDsmbmJzcDsgJnF1b3Q7cnBoJnF1b3Q7IGNs YWlt4oCm4oCdDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 YSBuYW1lPSJfTWFpbEVuZENvbXBvc2UiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEO21z by1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L2E+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7bXNv LWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPlNpbmNlIHRoZSBjbGFpbSBhbHNvIGNvbnRhaW5zIOKA nG9yaWfigJ0sIGlzIHRoZSBhc3N1bXB0aW9uIHRoYXQgdGhlIHNpZ25pbmcgZW50aXR5IGFsd2F5 cyBhbHNvIGhhcyBhdXRob3JpdHkgdG8gYXNzZXJ0IHRoZSBjYWxsZXJzIGlkZW50aXR5Pw0KIEkg dGhpbmsgaXQgd291bGQgYmUgZ29vZCB0byBleHBsaWNpdGx5IG1lbnRpb24gaXQuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5SZWdhcmRzLDxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE O21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RDttc28t ZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+Q2hyaXN0ZXI8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RDttc28tZmFy ZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3Qt bGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1 YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpF Ti1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20i Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjp3aW5kb3d0ZXh0Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjp3aW5kb3d0ZXh0Ij4gc3RpciBbbWFpbHRvOnN0aXItYm91bmNlc0BpZXRmLm9y Z10NCjxiPk9uIEJlaGFsZiBPZiA8L2I+QWRhbSBSb2FjaDxicj4NCjxiPlNlbnQ6PC9iPiAyMCBK YW51YXJ5IDIwMTggMDA6MTU8YnI+DQo8Yj5Ubzo8L2I+IFNUSVIgQ2hhaXJzICZsdDtzdGlyLWNo YWlyc0BpZXRmLm9yZyZndDs7IHN0aXJAaWV0Zi5vcmc7IGRyYWZ0LWlldGYtc3Rpci1ycGguYWxs QHRvb2xzLmlldGYub3JnPGJyPg0KPGI+U3ViamVjdDo8L2I+IFtzdGlyXSBBRCBSZXZpZXc6IGRy YWZ0LWlldGYtc3Rpci1ycGgtMDI8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5JJ20gZG9p bmcgbXkgQUQgcmV2aWV3IG9mIGRyYWZ0LWlldGYtc3Rpci1ycGgtMDIuIFRoYW5rcyB0byBldmVy eW9uZSB3aG8gaGFzIHdvcmtlZCBvbiB0aGlzIGRvY3VtZW50LCBhbmQgdGhlIGF1dGhvcnMgYW5k IGNoYWlycyBpbiBwYXJ0aWN1bGFyLjxvOnA+PC9vOnA+PC9wPg0KPHA+VGhlIHRlY2huaWNhbCBj b250ZW50IGhlcmUgbG9va3MgZ2VuZXJhbGx5IGdvb2QgdG8gbWUuIEknZCBsaWtlIHRvIHNlZSBh IGZldyBpc3N1ZXMgYWRkcmVzc2VkIGJlZm9yZSBJRVRGIExDLiBJbiBzaG9ydCBzdW1hcnk6PG86 cD48L286cD48L3A+DQo8dWwgdHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21z by1saXN0OmwxIGxldmVsMSBsZm8xIj4NClRoZSB2YWxpZGF0aW9uIHNlY3Rpb24gbmVlZHMgdG8g YWRkIGEgZGlzY3Vzc2lvbiBvZiBob3cgdG8gdHJlYXQgY2FsbHMgd2hlbiB0aGUgcHJpb3JpdHkg dmFsdWVzIGluICZxdW90O3JwaCZxdW90OyBwYXNzcG9ydHMgYW5kIFNJUCAmcXVvdDtSZXNvdXJj ZS1Qcmlvcml0eSZxdW90OyBoZWFkZXIgZmllbGRzIGFyZW4ndCAxMDAlIGlkZW50aWNhbC48bzpw PjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMSBsZXZlbDEgbGZv MSI+DQpUaGUgZXhhbXBsZXMgbmVlZCBzb21lIGFkanVzdG1lbnQuPG86cD48L286cD48L2xpPjxs aSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzEiPg0KVGhlcmUgaXMg YSBtaW5vciBwb2ludCBvZiBhbWJpZ3VpdHkgaW4gdGhlIFNlY3VyaXR5IFNlY3Rpb24sIGJ1dCB0 aGlzIHNob3VsZCBiZSBlYXN5IHRvIGZpeCwgYXMgbG9uZyBhcyB0aGUgV0cga25vd3Mgd2hhdCB3 YXMgaW50ZW5kZWQuPG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxp c3Q6bDEgbGV2ZWwxIGxmbzEiPg0KVGhlIElBTkEgYWN0aW9ucyBuZWVkIGEgbGl0dGxlIGJpdCBv ZiBhZGp1c3RtZW50LjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1s aXN0OmwxIGxldmVsMSBsZm8xIj4NClRoZXJlIGFyZSBhIG51bWJlciBvZiBtaW5vciBlZGl0b3Jp YWwgaXNzdWVzIHRvIGJlIGNsZWFuZWQgdXAuPG86cD48L286cD48L2xpPjwvdWw+DQo8cD5EZXRh aWxlZCBjb21tZW50cyBvbiB0aGVzZSBwb2ludHMgYXJlIGlubGluZSBpbiB0aGUgZG9jdW1lbnQg YmVsb3cuIEkndmUgcmVtb3ZlZCBzb21lIHBvcnRpb25zIG9mIHRoZSBkb2N1bWVudCBvbiB3aGlj aCBJIGhhdmUgbm8gY29tbWVudHMuPG86cD48L286cD48L3A+DQo8cD48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206 NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxicj4NCjx0dD5BYnN0cmFj dDwvdHQ+PGJyPg0KPGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBUaGlzIGRvY3VtZW50IGV4dGVuZHMg dGhlIFNUSVIgUEFTU3BvclQgc3BlY2lmaWNhdGlvbiB0byBhbGxvdyB0aGU8L3R0Pjwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PHA+JnF1b3Q7Li4udGhlIFNlY3VyZSBUZWxlcGhvbmUgSWRlbnRpdHkgUmV2aXNpdGVkIChTVElS KSBQZXJzb25hbCBBc3NlcnRpb24gVG9rZW4gKFBBU1Nwb3JUKSBzcGVjaWZpY2F0aW9uIGRlZmlu ZWQgaW4gUkZDIDgxMjIuLi4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjxwPihTZWUgPGEgaHJlZj0i aHR0cHM6Ly93d3cucmZjLWVkaXRvci5vcmcvbWF0ZXJpYWxzL2FiYnJldi5leHBhbnNpb24udHh0 Ij4mbHQ7aHR0cHM6Ly93d3cucmZjLWVkaXRvci5vcmcvbWF0ZXJpYWxzL2FiYnJldi5leHBhbnNp b24udHh0Jmd0OzwvYT4gZm9yIGd1aWRhbmNlIG9uIGFiYnJldmlhdGlvbnMpPG86cD48L286cD48 L3A+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4t dG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHR0 PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij4mbmJzcDsmbmJzcDsgaW5jbHVzaW9uIG9m IGNyeXB0b2dyYXBoaWNhbGx5LXNpZ25lZCBhc3NlcnRpb25zIG9mIGF1dGhvcml6YXRpb24gZm9y PC9zcGFuPjwvdHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q291cmllciBOZXcmcXVvdDsiPjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgdGhlIHZhbHVlcyBw b3B1bGF0ZWQgaW4gdGhlIFNJUCAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlciBmaWVsZCw8L3R0 Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgd2hpY2ggaXMgdXNlZCBmb3IgY29tbXVuaWNhdGlvbnMg cmVzb3VyY2UgcHJpb3JpdGl6YXRpb24uPC90dD48YnI+DQo8YnI+DQo8dHQ+Li4uPC90dD48YnI+ DQo8YnI+DQo8dHQ+MS4mbmJzcDsgSW50cm9kdWN0aW9uPC90dD48YnI+DQo8YnI+DQo8dHQ+Jm5i c3A7Jm5ic3A7IFBBU1Nwb3JUIFtJLUQuaWV0Zi1zdGlyLXBhc3Nwb3J0XSBpcyBhIHRva2VuIGZv cm1hdCBiYXNlZCBvbiBKV1Q8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgW1JGQzc1MTldIGZv ciBjb252ZXlpbmcgY3J5cHRvZ3JhcGhpY2FsbHktc2lnbmVkIGluZm9ybWF0aW9uIGFib3V0PC90 dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IHRoZSBpZGVudGl0aWVzIGludm9sdmVkIGluIHBlcnNv bmFsIGNvbW11bmljYXRpb25zOyBpdCBpcyB1c2VkIHdpdGg8L3R0Pjxicj4NCjx0dD4mbmJzcDsm bmJzcDsgU1RJUiBbSS1ELmlldGYtc3Rpci1yZmM0NDc0YmlzXSB0byBjb252ZXkgYSBzaWduZWQg YXNzZXJ0aW9uIG9mIHRoZTwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBpZGVudGl0eSBvZiB0 aGUgcGFydGljaXBhbnRzIGluIHJlYWwtdGltZSBjb21tdW5pY2F0aW9ucyBlc3RhYmxpc2hlZDwv dHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyB2aWEgYSBwcm90b2NvbCBsaWtlIFNJUC4mbmJzcDsg VGhpcyBzcGVjaWZpY2F0aW9uIGV4dGVuZHMgUEFTU3BvclQgdG88L3R0Pjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+JnF1 b3Q7Li4ubGlrZSBTSVAgW1JGQzMyNjFdLi4uJnF1b3Q7PG86cD48L286cD48L3A+DQo8cD4oV2Ug d2FudCB0byBjaXRlIFNJUCB0aGUgZmlyc3QgdGltZSBpdCBpcyBtZW50aW9uZWQpPG86cD48L286 cD48L3A+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJn aW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHR0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij4mbmJzcDsmbmJzcDsgYWxsb3cgY3J5 cHRvZ3JhcGhpYy1zaWduaW5nIG9mIHRoZSBTSVAgJ1Jlc291cmNlLVByaW9yaXR5JyBoZWFkZXI8 L3NwYW4+PC90dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90OyI+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBmaWVsZCBkZWZpbmVk IGluIFtSRkM0NDEyXS48L3R0Pjxicj4NCjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgW1JGQzQ0MTJd IGRlZmluZXMgdGhlIFNJUCAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlciBmaWVsZCBmb3I8L3R0 Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgY29tbXVuaWNhdGlvbnMgUmVzb3VyY2UgUHJpb3JpdHku Jm5ic3A7IEFzIHNwZWNpZmllZCBpbiBbUkZDNDQxMl0sIHRoZTwvdHQ+PGJyPg0KPHR0PiZuYnNw OyZuYnNwOyAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlciBmaWVsZCBtYXkgYmUgdXNlZCBieSBT SVAgdXNlciBhZ2VudHM8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgW1JGQzMyNjFdLCBpbmNs dWRpbmcsIFB1YmxpYyBTd2l0Y2hlZCBUZWxlcGhvbmUgTmV0d29yayAoUFNUTik8L3R0Pjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPHA+JnF1b3Q7Li4uaW5jbHVkaW5nIFB1YmxpYyBTd2l0Y2hlZC4uLiZxdW90OzxvOnA+PC9v OnA+PC9wPg0KPHA+KHJlbW92ZSB0aGUgY29tbWEpPG86cD48L286cD48L3A+DQo8cD48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdp bi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHR0PjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0Ij4mbmJzcDsmbmJzcDsgZ2F0ZXdheXMgYW5kIHRlcm1pbmFscywgYW5k IFNJUCBwcm94eSBzZXJ2ZXJzIHRvIGluZmx1ZW5jZTwvc3Bhbj48L3R0PjxvOnA+PC9vOnA+PC9w Pg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD4mcXVvdDsuLi5h bmQgYnkgU0lQIHByb3h5IHNlcnZlcnMsIHRvIGluZmx1ZW5jZS4uLiZxdW90OzxvOnA+PC9vOnA+ PC9wPg0KPHA+KGFkZCAmcXVvdDtieSZxdW90OyBhbmQgY29tbWEpPG86cD48L286cD48L3A+DQo8 cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUu MHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHR0PjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij4mbmJzcDsmbmJzcDsgcHJpb3JpdGl6YXRpb24gYWZm b3JkZWQgdG8gY29tbXVuaWNhdGlvbiBzZXNzaW9ucyxpbmNsdWRpbmcgUFNUTjwvc3Bhbj48L3R0 PjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8cD4mcXVvdDsuLi5zZXNzaW9ucywgaW5jbHVkaW5nLi4uJnF1 b3Q7PG86cD48L286cD48L3A+DQo8cD4oc3BhY2UgYWZ0ZXIgY29tbWEpPG86cD48L286cD48L3A+ DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9w OjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHR0Pjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij4mbmJzcDsmbmJzcDsgY2FsbHMuJm5ic3A7IEhv d2V2ZXIsIHRoZSBTSVAgJ1Jlc291cmNlLVByaW9yaXR5JyBoZWFkZXIgZmllbGQgY291bGQgYmU8 L3NwYW4+PC90dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90OyI+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBzcG9vZmVkIGFuZCBh YnVzZWQgYnkgdW5hdXRob3JpemVkIGVudGl0aWVzLjwvdHQ+PGJyPg0KPGJyPg0KPHR0PiZuYnNw OyZuYnNwOyBUaGUgU1RJUiBhcmNoaXRlY3R1cmUgW1JGQzczNDBdYXNzdW1lcyB0aGF0IGFuIGF1 dGhvcml0eSBvbiB0aGU8L3R0Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4N CjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+JnF1b3Q7Li4uU1RJUiBhcmNoaXRlY3R1cmUg W1JGQzczNDBdIGFzc3VtZXMuLi4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjxwPihzcGFjZSBiZWZv cmUgJnF1b3Q7YXNzdW1lcyZxdW90Oyk8bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRv bTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMC4wcHQiPiZuYnNwOyZuYnNwOyBvcmlnaW5hdGluZyBzaWRlIG9mIGEgY2FsbCBwcm92aWRl cyBhIGNyeXB0b2dyYXBoaWMgYXNzdXJhbmNlIG9mIHRoZTwvc3Bhbj48L3R0PjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48 YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IHZhbGlkaXR5IG9mIHRoZSBjYWxsaW5nIHBhcnR5IG51bWJl ciBpbiBvcmRlciB0byBwcmV2ZW50PC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGltcGVyc29u YXRpb24gYXR0YWNrcy4mbmJzcDsgVGhlIFNUSVIgYXJjaGl0ZWN0dXJlIGFsbG93cyBleHRlbnNp b24gdGhhdDwvdHQ+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8cD4mcXVvdDsuLi5hbGxvd3MgZXh0ZW5zaW9ucy4uLiZxdW90 OzxvOnA+PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90ZSBz dHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjx0dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+Jm5ic3A7Jm5ic3A7 IGNhbiBiZSB1dGlsaXplZCBieSBhdXRob3JpdGllcyBzdXBwb3J0aW5nIHJlYWwtdGltZSBjb21t dW5pY2F0aW9uPC9zcGFuPjwvdHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgc2Vy dmljZXMgdXNpbmcgdGhlICdSZXNvdXJjZS1Qcmlvcml0eScgaGVhZGVyIGZpZWxkIHRvPC90dD48 YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGNyeXB0b2dyYXBoaWNhbGx5IHNpZ24gdGhlIFNJUCAnUmVz b3VyY2UtUHJpb3JpdHknIGhlYWRlciBmaWVsZCBhbmQ8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJz cDsgY29udmV5IGFzc2VydGlvbiBvZiB0aGUgYXV0aG9yaXphdGlvbiBmb3IgJ1Jlc291cmNlLVBy aW9yaXR5Jy4mbmJzcDsgRm9yPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGV4YW1wbGUsIHRo ZSBhdXRob3JpdHkgb24gdGhlIG9yaWdpbmF0aW5nIHNpZGUgdmVyaWZ5aW5nIHRoZTwvdHQ+PGJy Pg0KPHR0PiZuYnNwOyZuYnNwOyBhdXRob3JpemF0aW9uIG9mIGEgcGFydGljdWxhciBjb21tdW5p Y2F0aW9uIGZvciBSZXNvdXJjZS1Qcmlvcml0eSBjYW48L3R0Pjwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvYmxvY2txdW90ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+U2luZ2xlIHF1 b3RlcyBhcm91bmQgJ1Jlc291cmNlLVByaW9yaXR5Jy48bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dHQ+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC4wcHQiPiZuYnNwOyZuYnNwOyB1c2UgYSBQQVNTUG9yVCBjbGFpbSB0byBj cnlwdG9ncmFwaGljYWxseS1zaWduIHRoZSBTSVAgJ1Jlc291cmNlLTwvc3Bhbj48L3R0PjxvOnA+ PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD4m cXVvdDsuLi5jcnlwdG9ncmFwaGljYWxseSBzaWduLi4uJnF1b3Q7PG86cD48L286cD48L3A+DQo8 cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUu MHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHR0PjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij4mbmJzcDsmbmJzcDsgUHJpb3JpdHknIGhlYWRlciBm aWVsZCBhbmQgY29udmV5IGFuIGFzc2VydGlvbiBvZiB0aGUgYXV0aG9yaXphdGlvbjwvc3Bhbj48 L3R0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGZvciAnUmVzb3VyY2UtUHJpb3Jp dHknLiZuYnNwOyBUaGlzIHdpbGwgYWxsb3cgYSByZWNlaXZpbmcgZW50aXR5PC90dD48YnI+DQo8 dHQ+Jm5ic3A7Jm5ic3A7IChpbmNsdWRpbmcgZW50aXRpZXMgbG9jYXRlZCBpbiBkaWZmZXJlbnQg bmV0d29yayBkb21haW5zL2JvdW5kYXJpZXMpPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IHRv IHZlcmlmeSB0aGUgdmFsaWRpdHkgb2YgYXNzZXJ0aW9ucyBhdXRob3JpemluZyBSZXNvdXJjZS1Q cmlvcml0eS48L3R0Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxwPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+U2luZ2xlIHF1b3RlcyBhcm91bmQgJ1Jlc291cmNlLVBy aW9yaXR5Jy48bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2Nr cXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48dHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPiZuYnNw OyZuYnNwOyBDcnlwdG9ncmFwaGljYWxseS1zaWduZWQgU0lQICdSZXNvdXJjZS1Qcmlvcml0eScg aGVhZGVycyB3aWxsIGFsbG93IGE8L3NwYW4+PC90dD48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2tx dW90ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+JnF1b3Q7Li4uY3J5cHRvZ3JhcGhp Y2FsbHkgc2lnbmVkIFNJUCAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlciBmaWVsZHMuLi4mcXVv dDs8bzpwPjwvbzpwPjwvcD4NCjxwPihyZW1vdmUgaHlwaGVuLCBhbmQgcmVwbGFjZSAmcXVvdDto ZWFkZXJzJnF1b3Q7IHdpdGggJnF1b3Q7aGVhZGVyIGZpZWxkcyZxdW90Oyk8bzpwPjwvbzpwPjwv cD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10 b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dHQ+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPiZuYnNwOyZuYnNwOyByZWNlaXZpbmcgZW50 aXR5IHRvIHZlcmlmeSBhbmQgYWN0IG9uIHRoZSBpbmZvcm1hdGlvbiB3aXRoIGNvbmZpZGVuY2U8 L3NwYW4+PC90dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90OyI+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyB0aGF0IHRoZSBpbmZv cm1hdGlvbiBoYXZlIG5vdCBiZWVuIHNwb29mZWQgb3IgY29tcHJvbWlzZWQuPC90dD48L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwPiZxdW90Oy4uLmhhcyBub3QgYmVlbiBzcG9vZmVkIG9yIGNvbXByb21pc2VkLiZxdW90Ozxv OnA+PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHls ZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IFRoaXMgc3BlY2lmaWNhdGlv biBkb2N1bWVudHMgYW4gb3B0aW9uYWwgZXh0ZW5zaW9uIHRvIFBBU1Nwb3JUIGFuZDwvdHQ+PGJy Pg0KPHR0PiZuYnNwOyZuYnNwOyB0aGUgYXNzb2NpYXRlZCBTVElSIG1lY2hhbmlzbXMgdG8gcHJv dmlkZSBhIGZ1bmN0aW9uIHRvIHNpZ24gdGhlIFNJUDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNw OyAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlciBmaWVsZC4mbmJzcDsgVGhpcyBQQVNTcG9yVCBv YmplY3QgaXMgdXNlZCB0bzwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBwcm92aWRlIGF0dGVz dGF0aW9uIG9mIGEgY2FsbGluZyB1c2VyIGF1dGhvcml6YXRpb24gZm9yIHByaW9yaXR5PC90dD48 YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGNvbW11bmljYXRpb25zLiZuYnNwOyBUaGlzIGlzIG5lY2Vz c2FyeSBpbiBhZGRpdGlvbiB0byB0aGUgUEFTU3BvclQgb2JqZWN0PC90dD48YnI+DQo8dHQ+Jm5i c3A7Jm5ic3A7IHRoYXQgaXMgdXNlZCBmb3IgY2FsbGluZyB1c2VyIHRlbGVwaG9uZSBudW1iZXIg YXR0ZXN0YXRpb24uJm5ic3A7IEhvdyB0aGU8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgb3B0 aW9uYWwgZXh0ZW5zaW9uIHRvIFBBU1Nwb3JUIGlzIHVzZWQgZm9yIHJlYWwtdGltZSBjb21tdW5p Y2F0aW9uczwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBzdXBwb3J0ZWQgdXNpbmcgU0lQICdS ZXNvdXJjZS1Qcmlvcml0eScgaGVhZGVyIGZpZWxkIGlzIGRlZmluZWQgaW48L3R0Pjxicj4NCjx0 dD4mbmJzcDsmbmJzcDsgb3RoZXIgZG9jdW1lbnRzIGFuZCBpcyBvdXRzaWRlIHRoZSBzY29wZSBv ZiB0aGlzIGRvY3VtZW50LjwvdHQ+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3Rl Pg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5JIGFzc3VtZSB0aGVzZSBvdGhlciBkb2N1 bWVudHMgYXJlIHVuZGVyIGRldmVsb3BtZW50PyBJZiBzbywgdGhleSBzaG91bGQgYmUgY2l0ZWQg aGVyZS48bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVv dGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PGJyPg0KPHR0PjIuJm5ic3A7IFRlcm1pbm9sb2d5PC90 dD48YnI+DQo8YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IFRoZSBrZXkgd29yZHMgJnF1b3Q7TVVTVCZx dW90OywgJnF1b3Q7TVVTVCBOT1QmcXVvdDssICZxdW90O1JFUVVJUkVEJnF1b3Q7LCAmcXVvdDtT SEFMTCZxdW90OywgJnF1b3Q7U0hBTEwgTk9UJnF1b3Q7LDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZu YnNwOyAmcXVvdDtTSE9VTEQmcXVvdDssICZxdW90O1NIT1VMRCBOT1QmcXVvdDssICZxdW90O1JF Q09NTUVOREVEJnF1b3Q7LCAmcXVvdDtNQVkmcXVvdDssIGFuZCAmcXVvdDtPUFRJT05BTCZxdW90 OyBpbiB0aGlzPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGRvY3VtZW50IGFyZSB0byBiZSBp bnRlcnByZXRlZCBhcyBkZXNjcmliZWQgaW4gUkZDIDIxMTkgW1JGQzIxMTldLjwvdHQ+PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8cD5UaGlzIGRvY3VtZW50IGhhcyBzZXZlcmFsIG5vbi1ub3JtYXRpdmUgdXNlcyBvZiAmcXVv dDttdXN0JnF1b3Q7LCAmcXVvdDtzaG91bGQsJnF1b3Q7IGFuZCAmcXVvdDttYXksJnF1b3Q7IGFu ZCBzbyBpdCBuZWVkcyB0byB1c2UgdGhlIFJGQzgxNzQgYm9pbGVycGxhdGUgaW5zdGVhZCBvZiB0 aGUgUkZDMjExOSBib2lsZXJwbGF0ZS48bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRv bTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PGJyPg0KPHR0PjMuJm5i c3A7IFBBU1Nwb3JUICdycGgnIENsYWltPC90dD48YnI+DQo8YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7 IFRoaXMgc3BlY2lmaWNhdGlvbiBkZWZpbmVzIGEgbmV3IEpTT04gV2ViIFRva2VuIGNsYWltIGZv ciAmcXVvdDtycGgmcXVvdDssPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IHdoaWNoIHByb3Zp ZGVzIGFuIGFzc2VydGlvbiBmb3IgaW5mb3JtYXRpb24gaW4gU0lQICdSZXNvdXJjZS08L3R0Pjxi cj4NCjx0dD4mbmJzcDsmbmJzcDsgUHJpb3JpdHknaGVhZGVyLjwvdHQ+PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD4mcXVv dDsuLi5Qcmlvcml0eScgaGVhZGVyIGZpZWxkLiZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPHA+KHNw YWNlIGFmdGVyIGNsb3NpbmcgcXVvdGF0aW9uIG1hcmssICZxdW90O2hlYWRlciBmaWVsZCZxdW90 OyBpbnN0ZWFkIG9mICZxdW90O2hlYWRlciZxdW90Oyk8bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PGJyPg0K PHR0PiZuYnNwOyZuYnNwOyBUaGUgY3JlYXRvciBvZiBhIFBBU1Nwb3JUIG9iamVjdCBhZGRzIGEg JnF1b3Q7cHB0JnF1b3Q7IHZhbHVlIG9mICZxdW90O3JwaCZxdW90OyB0byB0aGU8L3R0Pjxicj4N Cjx0dD4mbmJzcDsmbmJzcDsgaGVhZGVyIG9mIGEgUEFTU3BvclQgb2JqZWN0LCBpbiB3aGljaCBj YXNlIHRoZSBQQVNTcG9yVCBjbGFpbXMgTVVTVDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBj b250YWluIGEgJnF1b3Q7cnBoJnF1b3Q7IGNsYWltLCBhbmQgYW55IGVudGl0aWVzIHZlcmlmeWlu ZyB0aGUgUEFTU3BvclQgb2JqZWN0PC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IHdpbGwgYmUg cmVxdWlyZWQgdG8gdW5kZXJzdGFuZCB0aGUgJnF1b3Q7cHB0JnF1b3Q7IGV4dGVuc2lvbiBpbiBv cmRlciB0bzwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBwcm9jZXNzIHRoZSBQQVNTcG9yVCBp biBxdWVzdGlvbi4mbmJzcDsgQSBQQVNTUG9yVCBoZWFkZXIgd2l0aCB0aGUgJnF1b3Q7cHB0JnF1 b3Q7PC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGluY2x1ZGVkIHdpbGwgbG9vayBhcyBmb2xs b3dzOjwvdHQ+PGJyPg0KPGJyPg0KPHR0PiZuYnNwOyZuYnNwOyB7Jm5ic3A7ICZxdW90O3R5cCZx dW90OzomcXVvdDtwYXNzcG9ydCZxdW90Oyw8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsgJnF1b3Q7cHB0JnF1b3Q7OiZxdW90O3JwaCZxdW90Oyw8L3R0Pjxicj4NCjx0dD4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1b3Q7YWxnJnF1b3Q7OiZxdW90O0VTMjU2JnF1b3Q7 LDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDt4NXUmcXVvdDs6 PGEgaHJlZj0iaHR0cHM6Ly93d3cuZXhhbXBsZS5vcmcvY2VydC5jZXIiPiZxdW90O2h0dHBzOi8v d3d3LmV4YW1wbGUub3JnL2NlcnQuY2VyJnF1b3Q7PC9hPn08L3R0Pjwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvYmxvY2txdW90ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+SWRlYWxs eSwgdGhpcyB3b3VsZCBiZSBlaXRoZXIgcHJldHR5LXByaW50ZWQgb3IgY2Fub25pY2FsaXplZC4g U2luY2UgaXQncyB0b28gbG9uZyB0byBmaXQgb24gYSBsaW5lIGluIGNhbm9uaWNhbCBmb3JtLCBJ IHByb3Bvc2U6PG86cD48L286cD48L3A+DQo8cD48dHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MC4wcHQiPns8L3NwYW4+PC90dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PGJyPg0KPHR0PiZuYnNwOyAmcXVvdDt0eXAm cXVvdDs6JnF1b3Q7cGFzc3BvcnQmcXVvdDssPC90dD48YnI+DQo8dHQ+Jm5ic3A7ICZxdW90O3Bw dCZxdW90OzomcXVvdDtycGgmcXVvdDssPC90dD48YnI+DQo8dHQ+Jm5ic3A7ICZxdW90O2FsZyZx dW90OzomcXVvdDtFUzI1NiZxdW90Oyw8L3R0Pjxicj4NCjx0dD4mbmJzcDsgJnF1b3Q7eDV1JnF1 b3Q7OjxhIGhyZWY9Imh0dHBzOi8vd3d3LmV4YW1wbGUub3JnL2NlcnQuY2VyIj4mcXVvdDtodHRw czovL3d3dy5leGFtcGxlLm9yZy9jZXJ0LmNlciZxdW90OzwvYT48L3R0Pjxicj4NCjx0dD59PC90 dD48L3NwYW4+PG86cD48L286cD48L3A+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxibG9j a3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgVGhlICZx dW90O3JwaCZxdW90OyBjbGFpbSB3aWxsIHByb3ZpZGUgYW4gYXNzZXJ0aW9uIG9mIGF1dGhvcml6 YXRpb24sJnF1b3Q7YXV0aCZxdW90Oyw8L3R0Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvYmxv Y2txdW90ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+JnF1b3Q7Li4uYXV0aG9yaXph dGlvbiwgJnF1b3Q7YXV0aCZxdW90OywgLi4uJnF1b3Q7PG86cD48L286cD48L3A+DQo8cD4oc3Bh Y2UgYmV0d2VlbiBjb21tYSBhbmQgb3BlbmluZyBxdW90YXRpb24gbWFyayk8bzpwPjwvbzpwPjwv cD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10 b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dHQ+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPiZuYnNwOyZuYnNwOyBmb3IgaW5mb3JtYXRp b24gaW4gdGhlIFNJUCAmcXVvdDtSZXNvdXJjZS1Qcmlvcml0eSZxdW90OyBoZWFkZXIgZmllbGQg KGkuZS4sPC9zcGFuPjwvdHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgUmVzb3Vy Y2UtUHJpb3JpdHk6IG5hbWVzcGFjZSAmcXVvdDsuJnF1b3Q7IHItcHJpb3JpdHkpIGJhc2VkIG9u IFtSRkM0NDEyXS48L3R0Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxw PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+VGhlIHVzZSBvZiB0aGUgc3RyaW5nICduYW1lc3Bh Y2UgJnF1b3Q7LiZxdW90OyByLXByaW9yaXR5JyBoZXJlIGFuZCBlbHNld2hlcmUgaW4gdGhlIGRv Y3VtZW50IGhhcyBhIGRldHJpbWVudGFsIGltcGFjdCBvbiByZWFkYWJpbGl0eS4gSSBzdHJvbmds eSBzdWdnZXN0IHJlcGxhY2luZyBpdCB3aXRoICZxdW90O3ItdmFsdWUmcXVvdDsgKHRoZSBuYW1l IG9mIHRoaXMgcHJvZHVjdGlvbiBpbiBSRkM0NDEyKSBldmVyeXdoZXJlLjxvOnA+PC9vOnA+PC9w Pg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRv cDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx0dD48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+Jm5ic3A7Jm5ic3A7IFNwZWNpZmljYWxseSwg dGhlICZxdW90O3JwaCZxdW90OyBjbGFpbSBpbmNsdWRlcyBhc3NlcnRpb24gb2YgdGhlIHByaW9y aXR5LTwvc3Bhbj48L3R0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGxldmVsIG9m IHRoZSB1c2VyIHRvIGJlIHVzZWQgZm9yIGEgZ2l2ZW4gY29tbXVuaWNhdGlvbiBzZXNzaW9uLiZu YnNwOyBUaGU8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgdmFsdWUgb2YgdGhlICZxdW90O3Jw aCZxdW90OyBjbGFpbSBpcyBhbiBhcnJheSBjb250YWluaW5nIG9uZSBvciBtb3JlIG9mIEpTT048 L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgb2JqZWN0cyBmb3IgdGhlIGNvbnRlbnQgb2YgdGhl IFNJUCAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlciB0aGF0IGlzPC90dD48YnI+DQo8dHQ+Jm5i c3A7Jm5ic3A7IGJlaW5nIGFzc2VydGVkIG9mIHdoaWNoIG9uZSBvZiB0aGUgJnF1b3Q7cnBoJnF1 b3Q7IG9iamVjdCwgaXMgbWFuZGF0b3J5LjwvdHQ+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9i bG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5UaGlzIGxhc3Qgc2VudGVu Y2UgaXMgdmVyeSBoYXJkIHRvIHBhcnNlOyBhbmQgKGJhc2VkIG9uIHRoZSBleGFtcGxlKSB0aGUg dmFsdWUgaXMgaW50ZW5kZWQgdG8gYmUgYSBKU09OIE9iamVjdCAoY3VybHkgYnJhY2VzKSByYXRo ZXIgdGhhbiBhIEpTT04gQXJyYXkgKHNxdWFyZSBicmFjZXMpLiBJIHN1Z2dlc3Q6ICdUaGUgdmFs dWUgb2YgdGhlICZxdW90O3JwaCZxdW90OyBjbGFpbSBpcyBhbiBPYmplY3Qgd2l0aCBvbmUgb3Ig bW9yZSBrZXlzLiBFYWNoIGtleQ0KIGlzIGFzc29jaWF0ZWQgd2l0aCBhIEpTT04gQXJyYXkuIFRo ZXNlIGFycmF5cyBjb250YWluIFN0cmluZ3MgdGhhdCBjb3JyZXNwb25kIHRvIHRoZSByLXZhbHVl cyBpbmRpY2F0ZWQgaW4gdGhlIFNJUCAmcXVvdDtSZXNvdXJjZS1Qcmlvcml0eSZxdW90OyBoZWFk ZXIgZmllbGQuJyAobm90ZTogJnF1b3Q7aGVhZGVyIGZpZWxkJnF1b3Q7LCBub3QgJnF1b3Q7aGVh ZGVyJnF1b3Q7KTxvOnA+PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8Ymxv Y2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IFRoZSBm b2xsb3dpbmcgaXMgYW4gZXhhbXBsZSAmcXVvdDtycGgmcXVvdDsgY2xhaW0gZm9yIGEgU0lQICZx dW90O1Jlc291cmNlLVByaW9yaXR5JnF1b3Q7PC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGhl YWRlciBmaWVsZCB3aXRoIGEgJnF1b3Q7bmFtZXNwYWNlICZxdW90Oy4mcXVvdDsgci1wcmlvcml0 eSZxdW90OyB2YWx1ZSBvZiAmcXVvdDtldHMuMCZxdW90OyBhbmQ8L3R0Pjxicj4NCjx0dD4mbmJz cDsmbmJzcDsgd2l0aCBhICZxdW90O25hbWVzcGFjZSAmcXVvdDsuJnF1b3Q7IHItcHJpb3JpdHkm cXVvdDsgdmFsdWUgb2YgJnF1b3Q7d3BzLjAmcXVvdDsuPC90dD48YnI+DQo8YnI+DQo8dHQ+Jm5i c3A7Jm5ic3A7Jm5ic3A7IHsgJnF1b3Q7b3JpZyZxdW90Ozp7JnF1b3Q7dG4mcXVvdDs6JnF1b3Q7 MTIxNTU1NTEyMTImcXVvdDt9PC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 ICZxdW90O2Rlc3QmcXVvdDs6e1smcXVvdDt0biZxdW90OzomcXVvdDsxMjEyNTU1MTIxMyZxdW90 O119LDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmcXVvdDtpYXQmcXVv dDs6MTQ0MzIwODM0NSw8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJnF1 b3Q7cnBoJnF1b3Q7OnsmcXVvdDthdXRoJnF1b3Q7OlsmcXVvdDtldHMuMCZxdW90OywmcXVvdDt3 cHMuMCZxdW90O119PC90dD48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8 cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwPkFzIGFib3ZlLCBJIHJlY29tbWVuZCBwcmV0dHkt cHJpbnRpbmcgdGhpcy4gSXQncyBhbHNvIG1pc3NpbmcgYSBjb21tYSBhZnRlciB0aGUgJnF1b3Q7 b3JpZyZxdW90OyB2YWx1ZSwgYW5kIHRoZSB0b3AtbGV2ZWwgc3RydWN0dXJlIGlzIG1pc3Npbmcg YSBjbG9zaW5nIGJyYWNlLiBUaGUgdmFsdWUgZm9yICZxdW90O2lhdCZxdW90OyBuZWVkcyB0byBi ZSBlbmNsb3NlZCBpbiBxdW90ZXMuPG86cD48L286cD48L3A+DQo8cD5UaGUgTkFOUEEgaGFzIGFs bG9jYXRlZCBOUEE1NTUwMXh4IGZvciBleGFtcGxlIHVzZSwgbm90IE5QQTU1NXh4eHgsIG11Y2gg b2Ygd2hpY2ggcmVtYWlucyBhc3NpZ25hYmxlIChjZg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cubmF0 aW9uYWxuYW5wYS5jb20vcGRmL05SVUYvQVRJUy0wMzAwMTE1LnBkZiI+Jmx0O2h0dHBzOi8vd3d3 Lm5hdGlvbmFsbmFucGEuY29tL3BkZi9OUlVGL0FUSVMtMDMwMDExNS5wZGYmZ3Q7PC9hPikuPG86 cD48L286cD48L3A+DQo8cD5QdXR0aW5nIGFsbCB0aGlzIHRvZ2V0aGVyLCBJIGJlbGlldmUgd2hh dCB5b3Ugd2FudCBpczo8bzpwPjwvbzpwPjwvcD4NCjxwPjx0dD48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEwLjBwdCI+ezwvc3Bhbj48L3R0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+Jm5ic3A7ICZxdW90 O29yaWcmcXVvdDs6eyZxdW90O3RuJnF1b3Q7OiZxdW90OzEyMTU1NTUwMTEyJnF1b3Q7fSw8L3R0 Pjxicj4NCjx0dD4mbmJzcDsgJnF1b3Q7ZGVzdCZxdW90Ozp7WyZxdW90O3RuJnF1b3Q7OiZxdW90 OzEyMTI1NTUwMTEzJnF1b3Q7XX0sPC90dD48YnI+DQo8dHQ+Jm5ic3A7ICZxdW90O2lhdCZxdW90 OzomcXVvdDsxNDQzMjA4MzQ1JnF1b3Q7LDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyAmcXVvdDtycGgm cXVvdDs6eyZxdW90O2F1dGgmcXVvdDs6WyZxdW90O2V0cy4wJnF1b3Q7LCZxdW90O3dwcy4wJnF1 b3Q7XX08L3R0Pjxicj4NCjx0dD59PC90dD48L3NwYW4+PG86cD48L286cD48L3A+DQo8cD48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21h cmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxicj4N Cjx0dD4mbmJzcDsmbmJzcDsgQWZ0ZXIgdGhlIGhlYWRlciBhbmQgY2xhaW1zIFBBU1Nwb3JUIG9i amVjdHMgaGF2ZSBiZWVuIGNvbnN0cnVjdGVkLDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyB0 aGVpciBzaWduYXR1cmUgaXMgZ2VuZXJhdGVkIG5vcm1hbGx5IHBlciB0aGUgZ3VpZGFuY2UgaW48 L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgW0ktRC5pZXRmLXN0aXItcGFzc3BvcnRdIHVzaW5n IHRoZSBmdWxsIGZvcm0gb2YgUEFTU1BvclQuJm5ic3A7IFRoZTwvdHQ+PGJyPg0KPHR0PiZuYnNw OyZuYnNwOyBjcmVkZW50aWFscyAoZS5nLiwgYXV0aG9yaXR5IHJlc3BvbnNpYmxlIGZvciBhdXRo b3JpemluZyBSZXNvdXJjZS08L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgUHJpb3JpdHkpIHVz ZWQgdG8gY3JlYXRlIHRoZSBzaWduYXR1cmUgbXVzdCBoYXZlIGF1dGhvcml0eSBvdmVyIHRoZTwv dHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyAmcXVvdDtycGgmcXVvdDsgY2xhaW0gYW5kIHRoZXJl IGlzIG9ubHkgb25lIGF1dGhvcml0eSBwZXIgY2xhaW0uJm5ic3A7IFRoZSBhdXRob3JpdHk8L3R0 Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgTVVTVCB1c2UgaXRzIGNyZWRlbnRpYWxzIChpLmUuLCBD RVJUKSBhc3NvY2lhdGVkIHdpdGggdGhlIHNwZWNpZmljPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5i c3A7IHNlcnZpY2Ugc3VwcG9ydGVkIGJ5IHRoZSBTSVAgbmFtZXNwYWNlIGluIHRoZSBjbGFpbS48 L3R0Pjxicj4NCjxicj4NCjx0dD40LiZuYnNwOyAncnBoJyBpbiBTSVA8L3R0Pjxicj4NCjxicj4N Cjx0dD4mbmJzcDsmbmJzcDsgVGhpcyBzZWN0aW9uIHNwZWNpZmllcyBTSVAtc3BlY2lmaWMgdXNh Z2UgZm9yIHRoZSAmcXVvdDtycGgmcXVvdDsgY2xhaW0gaW48L3R0Pjxicj4NCjx0dD4mbmJzcDsm bmJzcDsgUEFTU3BvclQuPC90dD48YnI+DQo8YnI+DQo8dHQ+NC4xLiZuYnNwOyBBdXRoZW50aWNh dGlvbiBTZXJ2aWNlIEJlaGF2aW9yPC90dD48YnI+DQo8YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IFRo ZSBBdXRoZW50aWNhdGlvbiBTZXJ2aWNlIHdpbGwgY3JlYXRlIHRoZSAmcXVvdDtycGgmcXVvdDsg Y2xhaW0gdXNpbmcgdGhlPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IHZhbHVlcyBkaXNjdXNz ZWQgaW4gc2VjdGlvbiAzIGJhc2VkIG9uIFtSRkM0NDEyXS4mbmJzcDsgVGhlIGNvbnN0cnVjdGlv bjwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBvZiAmcXVvdDtycGgmcXVvdDsgY2xhaW0gZm9s bG93cyB0aGUgc3RlcHMgZGVzY3JpYmVkIGluIFNlY3Rpb24gNCBvZjwvdHQ+PGJyPg0KPHR0PiZu YnNwOyZuYnNwOyBbSS1ELmlldGYtc3Rpci1yZmM0NDc0YmlzXS48L3R0Pjxicj4NCjxicj4NCjx0 dD4mbmJzcDsmbmJzcDsgVGhlIHJlc3VsdGluZyBJZGVudGl0eSBoZWFkZXIgZm9yICZxdW90O3Jw aCZxdW90OyBtaWdodCBsb29rIGFzIGZvbGxvd3M6PC90dD48L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwPiZxdW90Oy4uLmhl YWRlciBmaWVsZC4uLiZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUu MHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+Jm5ic3A7Jm5i c3A7ICZxdW90O2V5SmhiR2NpT2lKRlV6STFOaUlzSW5SNWNDSTZJa3BYVkNKOS5leUpwYzNNaU9p SmxlVW93WlZoQmFVOXBTbmQ8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgWldFNTZZMGM1ZVdS RFNYTkVVVzlwWTBoQ01FbHFiMmxqYmtKdlNXbDNUa05wU21oaVIyTnBUMmxLUmxWNlNURk88L3R0 Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgYVVselJGRnZhV1ZFVmpGSmFuQnZaRWhTZDJONmIzWk1N MlF6WkhrMWJHVkhSblJqUjNoc1RHMU9kbUpUT1dwYVc8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJz cDsgRW93VEcxT2JHTnVNRTVEWnpCTElIeDg0b0NaTHVLQW1YeDhJR1Y1UVdsaU0wcHdXbmxKTm1W NVNqQmlhVWsyU1c8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgcEZlVTFVVlRGT1ZGVjRUV3BG ZVVsdU1FNURhVXByV2xoT01FbHFjRGRYZVVvd1ltbEpOa2xxUlhsTlZFa3hUbFI8L3R0Pjxicj4N Cjx0dD4mbmJzcDsmbmJzcDsgVmVFMXFSWHBKYkRFNVRFRXdTMGx0Ykdoa1EwazJUVlJSTUUxNlNY ZFBSRTB3VGxOM1RrTnBTbmxqUjJkcFQyNXo8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgYVZs WVZqQmhRMGsyVjNsS2JHUklUWFZOUTBselNXNWtkMk41TkhkSmJERTVSRkZ2UFNKOS5zMzdTNlZD OEhNNkQ8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgbDZZekplUURzclpjd0owbGl6eGhVckE3 Zl85OG9XQkh2by1jbC1uOE1JaG9DcjE4dllZRnkzYmxYdnMzZnNsTV88L3R0Pjxicj4NCjx0dD4m bmJzcDsmbmJzcDsgb29zMlAyRHl3JnF1b3Q7OyBpbmZvPSA8YSBocmVmPSJodHRwczovL3d3dy5l eGFtcGxlLm9yZy9jZXJ0LmNlciI+JnF1b3Q7aHR0cHM6Ly93d3cuZXhhbXBsZS5vcmcvY2VydC5j ZXImcXVvdDs8L2E+O2FsZz1FUzI1Njs8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgcHB0PSZx dW90O3JwaCZxdW90OzwvdHQ+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0K PHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5UaGlzIGV4YW1wbGUgaGFzIGEgbnVtYmVyIG9m IGlzc3Vlczo8bzpwPjwvbzpwPjwvcD4NCjx1bCB0eXBlPSJkaXNjIj4NCjxsaSBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzIiPg0KSW4gdGhlIElkZW50aXR5IGhlYWRl ciBmaWVsZCwgdGhlIHNpZ25lZC1pZGVudGl0eS1kaWdlc3Qgc2hvdWxkbid0IGJlIHF1b3RlZC48 bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMCBsZXZlbDEg bGZvMiI+DQpJbiB0aGUgSWRlbnRpdHkgaGVhZGVyIGZpZWxkLCBpbmZvIGlzIGVuY2xvc2VkIGlu ICZsdDsmZ3Q7IHJhdGhlciB0aGFuICZxdW90OyZxdW90Oy48bzpwPjwvbzpwPjwvbGk+PGxpIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMCBsZXZlbDEgbGZvMiI+DQpJbiB0aGUgSWRlbnRp dHkgaGVhZGVyIGZpZWxkLCBwcHQgaXMgYSB0b2tlbiByYXRoZXIgdGhhbiBhIHF1b3RlZCBzdHJp bmcuPG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDAgbGV2 ZWwxIGxmbzIiPg0KVGhlIHNpZ25lZC1pZGVudGl0eS1kaWdlc3QgaGVhZGVyIG5lZWRzIHRvIGlu ZGljYXRlIGEgJnF1b3Q7dHlwJnF1b3Q7IG9mICZxdW90O3Bhc3Nwb3J0JnF1b3Q7IHJhdGhlciB0 aGFuIEpXVCwgYW5kIGl0IG5lZWRzIHRvIGluY2x1ZGUgYm90aCBhICZxdW90O3BwdCZxdW90OyBh bmQgJnF1b3Q7eDV1JnF1b3Q7IGZpZWxkLjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21zby1saXN0OmwwIGxldmVsMSBsZm8yIj4NClRoZSBzaWduZWQtaWRlbnRpdHktZGln ZXN0IGJvZHkgc2hvdWxkIGNvbnRhaW4gb25seSB0aGUgcGFzc3BvcnQgY2xhaW0gcmF0aGVyIHRo YW4gYSBKU09OIG9iamVjdCB0aGF0IGl0c2VsZiBjb250YWlucyBhIGJhc2U2NC1lbmNvZGVkIEpX UyBoZWFkZXIgY29uY2F0ZW5hdGVkIHdpdGggYSBjbGFpbS48bzpwPjwvbzpwPjwvbGk+PGxpIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMCBsZXZlbDEgbGZvMiI+DQpJIGJlbGlldmUgdGhh dCwgZXZlbiB3aGVuIHRoZSBib2R5IGlzIGluY2x1ZGVkLCB2YWx1ZXMgaW4gdGhlIGhlYWRlciBh bmQgYm9keSBuZWVkIHRvIGJlIGJlIGNhbm9uaWNhbGl6ZWQgKGkuZS4sIGFsbCBvbiBvbmUgbGlu ZSwgbm8gc3BhY2VzLCBpbiBhbHBoYWJldGljYWwgb3JkZXIsIGV0Yy4pPG86cD48L286cD48L2xp PjwvdWw+DQo8cD5JIHdvdWxkIGFsc28gcmVjb21tZW5kIGZvbGxvd2luZyB0aGUgY29udmVudGlv biBvZiBpbmRpY2F0aW5nIHRoYXQgbGluZS13cmFwcyBhcmUgb25seSBmb3IgcmVhZGFiaWxpdHks IGFuZCBpbmNsdWRpbmcgdGhlIGhlYWRlciBmaWVsZCBuYW1lIGluIHRoZSBleGFtcGxlLiBQdXR0 aW5nIGFsbCB0aGlzIHRvZ2V0aGVyLCBJIGJlbGlldmUgd2hhdCB5b3Ugd2FudCBpczo8bzpwPjwv bzpwPjwvcD4NCjxwPjx0dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+Jm5ic3A7Jm5i c3A7IEZvciBleGFtcGxlLCBhIElkZW50aXR5IGhlYWRlciBmaWVsZCBmb3IgJnF1b3Q7cnBoJnF1 b3Q7IG1pZ2h0IGxvb2s8L3NwYW4+PC90dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PGJyPg0KPHR0PiZuYnNwOyZuYnNw OyBhcyBmb2xsb3dzIChiYWNrc2xhc2hlcyBzaG93biBmb3IgbGluZSBmb2xkaW5nIG9ubHkpOjwv dHQ+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHA+PHR0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTAuMHB0Ij4mbmJzcDsmbmJzcDsgSWRlbnRpdHk6IGV5SmhiR2NpT2lKRlV6STFOaUlzSW5Cd2RD STZJbkp3YUNJc0luUjVjQ0k2SW5CaGMzTndiM0owSSBcPC9zcGFuPjwvdHQ+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxi cj4NCjx0dD4mbmJzcDsmbmJzcDsgaXdpZURWMUlqb2lhSFIwY0hNNkx5OTNkM2N1WlhoaGJYQnNa UzVqYjIwdlkyVnlkQzVqWlhJaWZRby5leUprWlhOMCBcPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5i c3A7IElqcDdXeUowYmlJNklqRXlNVEkxTlRVd01URXpJbDE5TENKcFlYUWlPaUl4TkRRek1qQTRN elExSWl3aWIzSnBaeUkgXDwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyA2ZXlKMGJpSTZJakV5 TVRVMU5UVXdNVEV5SW4wc0luSndhQ0k2ZXlKaGRYUm9JanBiSW1WMGN5NHdJaXdpZDNCekxqIFw8 L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgQWlYWDE5Q2cuczM3UzZWQzhITTZEbDZZekplUURz clpjd0owbGl6eGhVckE3Zl85OG9XQkh2by1jbC1uOE1JaG9DciBcPC90dD48YnI+DQo8dHQ+Jm5i c3A7Jm5ic3A7IDE4dllZRnkzYmxYdnMzZnNsTV9vb3MyUDJEeXc7aW5mbz0mbHQ7PGEgaHJlZj0i aHR0cHM6Ly93d3cuZXhhbXBsZS5vcmcvY2VydC5jZXIiPmh0dHBzOi8vd3d3LmV4YW1wbGUub3Jn L2NlcnQuY2VyPC9hPiBcPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7ICZndDs7YWxnPUVTMjU2 O3BwdD1ycGg8L3R0Pjxicj4NCjwvc3Bhbj48YnI+DQooTm90ZTogdGhpcyBleGFtcGxlIGFzc3Vt ZXMgdGhlIGNhbGxpbmcgYW5kIGNhbGxlZCBwYXJ0eSBudW1iZXJzIGluIHRoZSBwcmV2aW91cyBl eGFtcGxlIGFyZSBjaGFuZ2VkIHRvIDEyMTU1NTUwMTEyIGFuZCAxMjE1NTU1MDExMywgcmVzcGVj dGl2ZWx5KTxvOnA+PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2tx dW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IEEgU0lQIGF1 dGhlbnRpY2F0aW9uIHNlcnZpY2UgdHlwaWNhbGx5IHdpbGwgZGVyaXZlIHRoZSB2YWx1ZSBvZiAm cXVvdDtycGgmcXVvdDs8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgZnJvbSB0aGUgJ1Jlc291 cmNlLVByaW9yaXR5JyBoZWFkZXIgZmllbGQgYmFzZWQgb24gcG9saWN5IGFzc29jaWF0ZWQ8L3R0 Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgd2l0aCBzZXJ2aWNlIHNwZWNpZmljIHVzZSBvZiB0aGUg JnF1b3Q7bmFtZXNwYWNlICZxdW90Oy4mcXVvdDsgci1wcmlvcml0eSZxdW90OyB2YWx1ZXM8L3R0 Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgYmFzZWQgb24gW1JGQzQ0MTJdLiZuYnNwOyBUaGUgYXV0 aGVudGljYXRpb24gc2VydmljZSBkZXJpdmVzIHRoZSB2YWx1ZSBvZjwvdHQ+PGJyPg0KPHR0PiZu YnNwOyZuYnNwOyB0aGUgUEFTU1BvclQgY2xhaW0gYnkgdmVyaWZ5aW5nIHRoZSBhdXRob3JpemF0 aW9uIGZvciBSZXNvdXJjZS08L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgUHJpb3JpdHkgKGku ZS4sIHZlcmlmeWluZyBhIGNhbGxpbmcgdXNlciBwcml2aWxlZ2UgZm9yIFJlc291cmNlLTwvdHQ+ PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBQcmlvcml0eSBiYXNlZCBvbiBpdHMgaWRlbnRpdHkpIHdo aWNoIG1pZ2h0IGJlIGRlcml2ZWQgZnJvbSBjdXN0b21lcjwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZu YnNwOyBwcm9maWxlIGRhdGEgb3IgZnJvbSBhY2Nlc3MgdG8gZXh0ZXJuYWwgc2VydmljZXMuPC90 dD48YnI+DQo8YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IFtSRkM0NDEyXSBhbGxvd3MgbXVsdGlwbGUg JnF1b3Q7bmFtZXNwYWNlICZxdW90Oy4mcXVvdDsgci1wcmlvcml0eSZxdW90OyBwYWlycywgZWl0 aGVyIGluPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGEgc2luZ2xlIFNJUCBSZXNvdXJjZS1Q cmlvcml0eSBoZWFkZXIgb3IgYWNyb3NzIG11bHRpcGxlIFNJUDwvdHQ+PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5TaW5n bGUgcXVvdGVzIGFyb3VuZCAnUmVzb3VyY2UtUHJpb3JpdHknLjxvOnA+PC9vOnA+PC9wPg0KPHA+ JnF1b3Q7Li4uaGVhZGVyIGZpZWxkLi4uJnF1b3Q7PG86cD48L286cD48L3A+DQo8cD48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdp bi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHR0PjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0Ij4mbmJzcDsmbmJzcDsgUmVzb3VyY2UtUHJpb3JpdHkgaGVhZGVycy4m bmJzcDsgSG93ZXZlciwgaXQgaXMgbm90IG5lY2Vzc2FyeSB0byBzaWduIGFsbDwvc3Bhbj48L3R0 PjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8cD5TaW5nbGUgcXVvdGVzIGFyb3VuZCAnUmVzb3VyY2UtUHJpb3JpdHknLjxvOnA+PC9vOnA+ PC9wPg0KPHA+JnF1b3Q7Li4uaGVhZGVyIGZpZWxkcy4uLiZxdW90OzxvOnA+PC9vOnA+PC9wPg0K PHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1 LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx0dD48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+Jm5ic3A7Jm5ic3A7IGNvbnRlbnQgb2YgYSBTSVAg UmVzb3VyY2UtUHJpb3JpdHkgaGVhZGVyIG9yIGFsbCBTSVAgUmVzb3VyY2UtPC9zcGFuPjwvdHQ+ PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwPlNpbmdsZSBxdW90ZXMgYXJvdW5kICdSZXNvdXJjZS1Qcmlvcml0eScuPG86cD48L286cD48 L3A+DQo8cD4mcXVvdDsuLi5oZWFkZXIgZmllbGQuLi4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjxw PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dHQ+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPiZuYnNwOyZuYnNwOyBQcmlvcml0eSBoZWFkZXJzIGlu IGEgZ2l2ZW4gU0lQIG1lc3NhZ2UuJm5ic3A7IEFuIGF1dGhvcml0eSBpcyBvbmx5PC9zcGFuPjwv dHQ+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwPlNpbmdsZSBxdW90ZXMgYXJvdW5kICdSZXNvdXJjZS1Qcmlvcml0eScuPG86cD48L286 cD48L3A+DQo8cD4mcXVvdDsuLi5oZWFkZXIgZmllbGRzLi4uJnF1b3Q7PG86cD48L286cD48L3A+ DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9w OjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHR0Pjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij4mbmJzcDsmbmJzcDsgcmVzcG9uc2libGUgZm9y IHNpZ25pbmcgdGhlIGNvbnRlbnQgb2YgYSBTSVAgUmVzb3VyY2UtUHJpb3JpdHkgaGVhZGVyPC9z cGFuPjwvdHQ+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxwPlNpbmdsZSBxdW90ZXMgYXJvdW5kICdSZXNvdXJjZS1Qcmlvcml0eScuPG86 cD48L286cD48L3A+DQo8cD4mcXVvdDsuLi5oZWFkZXIgZmllbGQuLi4mcXVvdDs8bzpwPjwvbzpw PjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 dHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPiZuYnNwOyZuYnNwOyBmb3Igd2hpY2gg aXQgaGFzIGF1dGhvcml0eSAoZS5nLiwgYSBzcGVjaWZpYyAmcXVvdDtuYW1lc3BhY2UgJnF1b3Q7 LiZxdW90Ozwvc3Bhbj48L3R0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IHItcHJp b3JpdHkmcXVvdDspLjwvdHQ+PGJyPg0KPGJyPg0KPHR0PjQuMi4mbmJzcDsgVmVyaWZpY2F0aW9u IFNlcnZpY2UgQmVoYXZpb3I8L3R0Pjxicj4NCjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgW0ktRC5p ZXRmLXN0aXItcmZjNDQ3NGJpc10gU2VjdGlvbiA2LjIgU3RlcCA1IHJlcXVpcmVzIHRoYXQ8L3R0 Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgc3BlY2lmaWNhdGlvbnMgZGVmaW5pbmcgJnF1b3Q7cHB0 JnF1b3Q7IHZhbHVlcyBkZXNjcmliZSBhbnkgYWRkaXRpb25hbCB2ZXJpZmllcjwvdHQ+PGJyPg0K PHR0PiZuYnNwOyZuYnNwOyBiZWhhdmlvci4mbmJzcDsgVGhlIGJlaGF2aW9yIHNwZWNpZmllZCBm b3IgdGhlICZxdW90O3BwdCZxdW90OyB2YWx1ZXMgb2YgJnF1b3Q7cnBoJnF1b3Q7IGlzIGFzPC90 dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGZvbGxvd3M6PC90dD48YnI+DQo8YnI+DQo8dHQ+Jm5i c3A7Jm5ic3A7IFRoZSB2ZXJpZmljYXRpb24gc2VydmljZSBNVVNUIGV4dHJhY3QgdGhlIHZhbHVl IGFzc29jaWF0ZWQgd2l0aCB0aGU8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgJnF1b3Q7YXV0 aCZxdW90OyBrZXkgaW4gYSBmdWxsIGZvcm0gUEFTU1BvclQgd2l0aCBhICZxdW90O3BwdCZxdW90 OyB2YWx1ZSBvZiAmcXVvdDtycGgmcXVvdDsuJm5ic3A7IElmPC90dD48YnI+DQo8dHQ+Jm5ic3A7 Jm5ic3A7IHRoZSBzaWduYXR1cmUgdmFsaWRhdGVzLCB0aGVuIHRoZSB2ZXJpZmljYXRpb24gc2Vy dmljZSBjYW4gdXNlIHRoZTwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyB2YWx1ZSBvZiB0aGUg JnF1b3Q7cnBoJnF1b3Q7IGNsYWltIGFzIHZhbGlkYXRpb24gdGhhdCB0aGUgY2FsbGluZyBwYXJ0 eSBpczwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBhdXRob3JpemVkIGZvciBSZXNvdXJjZS1Q cmlvcml0eSwgd2hpY2ggd291bGQgaW4gdHVybiBiZSB1c2VkIGZvcjwvdHQ+PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8cD5TaW5nbGUgcXVvdGVzIGFyb3VuZCAnUmVzb3VyY2UtUHJpb3JpdHkn LjxvOnA+PC9vOnA+PC9wPg0KPHA+VGhpcyB0ZXh0IGlzIGFtYmlndW91cyBhYm91dCB3aGV0aGVy IHRoZSB2YWxpZGF0aW9uIGluZGljYXRlcyB0aGF0IHRoZSBjYWxsaW5nIHBhcnR5IGlzIGF1dGhv cml6ZWQgdG8gdXNlIHRoZSBwcmlvcml0aWVzIGluZGljYXRlZCBpbiB0aGUgcGFzc3BvcnQgb2Jq ZWN0LCBvciB0aGUgdmFsdWVzIGluIHRoZSBTSVAgJ1Jlc291cmNlLVByaW9yaXR5JyBoZWFkZXIg ZmllbGQ7IGFuZCAodGFrZW4gb24gaXRzIGZhY2UpIGltcGxpZXMgdGhlIGxhdHRlciwNCiB3aGVu IHRoZSBpbnRlbnRpb24gaGVyZSBzaG91bGQgY2xlYXJseSBiZSB0aGUgZm9ybWVyLjxvOnA+PC9v OnA+PC9wPg0KPHA+JnF1b3Q7Li4uYXV0aG9yaXplZCBmb3IgJ1Jlc291cmNlLVByaW9yaXR5JyBp bmRpY2F0ZWQgaW4gdGhlIGNsYWltLiBUaGlzIHZhbHVlIHdvdWxkIGluIHR1cm4gYmUgdXNlZCBm b3IuLi4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjxwPlRoZSB0ZXh0IGFsc28gbmVlZHMgdG8gc2F5 IHNvbWV0aGluZyBhYm91dCBjb21wYXJpbmcgdmFsdWVzIGluIHRoZSBjbGFpbSB0byB2YWx1ZXMg aW4gdGhlICdSZXNvdXJjZS1Qcmlvcml0eScgaGVhZGVyIGZpZWxkLCBhbmQgd2hhdCBhIG1pc21h dGNoIG1pZ2h0IG1lYW4uIFRoZSBkb2N1bWVudCBzYXlzIGVsc2V3aGVyZSB0aGF0IHRoZSBzaWdu YXR1cmUgbWlnaHQgb25seSBjb3ZlciBzb21lIG9mIHRoZSByLXZhbHVlcywgd2hpY2ggbWFrZXMN CiBpdCBlbnRpcmVseSBwb3NzaWJsZSB0aGF0IHRoZSAnUmVzb3VyY2UtUHJpb3JpdHknIGZpZWxk IG1pZ2h0IGNvbnRhaW4gbW9yZSB2YWx1ZXMgdGhhbiBhcmUgc2lnbmVkLiBPbiB0aGUgb3RoZXIg aGFuZCwgaW50ZXJtZWRpYXJpZXMgbWlnaHQgcmVhc29uYWJseSByZW1vdmUgci12YWx1ZXMgYXMg dGhlIGNhbGwgaXMgcHJvY2Vzc2VkLiBUaGlzIHByb2JhYmx5IG1lYW5zIHRoYXQgdGhvc2UgcmVt b3ZlZCBwcmlvcml0aWVzIHNob3VsZCBub3QgYmUNCiB1c2VkLCBldmVuIGlmIHRoZXkgYXJlIHBy ZXNlbnQgaW4gdGhlIHBhc3Nwb3J0LiBJdCBzZWVtcyByZWFzb25hYmxlIHRvIHNheSB0aGF0ICp0 eXBpY2FsKiBwcm9jZXNzaW5nIGJ5IGEgcmVjZWl2aW5nIHBhcnR5IHdvdWxkIGJlIHRvIHRha2Ug dGhlICp1bmlvbiogb2YgYWxsIFJQSCBwYXNzcG9ydHMgdGhhdCB0aGV5IHRydXN0LCBhbmQgKmlu dGVyc2VjdCogdGhhdCB3aXRoIHRoZSBwcmlvcml0aWVzIGluICdSZXNvdXJjZS1Qcmlvcml0eScg aGVhZGVyDQogZmllbGRzIHRvIGdldCB0aGUgYWN0dWFsIHByaW9yaXR5IG9yIHByaW9yaXRpZXMg dG8gYmUgYXBwbGllZCB0byB0aGUgY2FsbCAoc3ViamVjdCB0byBsb2NhbCBwb2xpY3kpLjxvOnA+ PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0i bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjx0dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+Jm5ic3A7Jm5ic3A7IHByaW9y aXR5IHRyZWF0bWVudCBpbiBhY2NvcmRhbmNlIHdpdGggbG9jYWwgcG9saWN5IGZvciB0aGUgYXNz b2NpYXRlZDwvc3Bhbj48L3R0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGNvbW11 bmljYXRpb24gc2VydmljZS48L3R0Pjxicj4NCjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgSW4gYWRk aXRpb24sIFtJLUQuaWV0Zi1zdGlyLXJmYzQ0NzRiaXNdIFNlY3Rpb24gNi4yIFN0ZXAgNCByZXF1 aXJlczwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyAmcXVvdDtpYXQmcXVvdDsgdmFsdWUgaW4g JnF1b3Q7cnBoJnF1b3Q7IGNsYWltIHRvIGJlIHZlcmlmaWVkLjwvdHQ+PGJyPg0KPGJyPg0KPHR0 PiZuYnNwOyZuYnNwOyBUaGUgYmVoYXZpb3Igb2YgYSBTSVAgVUFzIHVwb24gcmVjZWl2aW5nIGFu IElOVklURSBjb250YWluaW5nIGE8L3R0Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2tx dW90ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+JnF1b3Q7Li4ub2YgYSBTSVAgVUEg dXBvbi4uLiZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPHA+b3I8bzpwPjwvbzpwPjwvcD4NCjxwPiZx dW90Oy4uLm9mIFNJUCBVQXMgdXBvbi4uLiZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPHA+PG86cD4m bmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJn aW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx0dD48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEwLjBwdCI+Jm5ic3A7Jm5ic3A7IFBBU1Nwb3JUIG9iamVjdCB3aXRoIGEgJnF1 b3Q7cnBoJnF1b3Q7IGNsYWltIHdpbGwgbGFyZ2VseSByZW1haW4gYSBtYXR0ZXIgb2Y8L3NwYW4+ PC90dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3Vy aWVyIE5ldyZxdW90OyI+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBpbXBsZW1lbnRhdGlvbiBwb2xp Y3kgZm9yIHRoZSBzcGVjaWZpYyBjb21tdW5pY2F0aW9uIHNlcnZpY2UuJm5ic3A7IEluPC90dD48 YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IG1vc3QgY2FzZXMsaW1wbGVtZW50YXRpb25zIHdvdWxkIGFj dCBiYXNlZCBvbiBjb25maWRlbmNlIGluIHRoZTwvdHQ+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD4mcXVvdDsuLi5jYXNl cywgaW1wbGVtZW50YXRpb25zLi4uJnF1b3Q7PG86cD48L286cD48L3A+DQo8cD4oc3BhY2UgYWZ0 ZXIgY29tbWEpPG86cD48L286cD48L3A+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxibG9j a3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHR0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij4mbmJz cDsmbmJzcDsgdmVyYWNpdHkgb2YgdGhpcyBpbmZvcm1hdGlvbi4mbmJzcDsgVGhlIHVzZSBvZiB0 aGUgY29tcGFjdCBmb3JtIG9mPC9zcGFuPjwvdHQ+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVv dGU+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwPlBhcmFncmFwaCBicmVhayBiZWZvcmUg JnF1b3Q7VGhlJnF1b3Q7LjxvOnA+PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0 Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjx0dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBw dCI+Jm5ic3A7Jm5ic3A7IFBBU1Nwb3JUIGlzIG5vdCBzcGVjaWZpZWQgaW4gdGhpcyBkb2N1bWVu dC48L3NwYW4+PC90dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTom cXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PGJyPg0KPGJyPg0KPHR0PjUuJm5ic3A7IEZ1cnRoZXIg SW5mb3JtYXRpb24gQXNzb2NpYXRlZCB3aXRoIFJlc291cmNlLVByaW9yaXR5PC90dD48L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwPlNpbmdsZSBxdW90ZXMgYXJvdW5kICdSZXNvdXJjZS1Qcmlvcml0eScuPG86cD48L286cD48 L3A+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4t dG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcm cXVvdDsiPjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgVGhlcmUgbWF5IGJlIGFkZGl0aW9uYWwgaW5m b3JtYXRpb24gYWJvdXQgdGhlIGNhbGxpbmcgcGFydHkgb3IgdGhlPC90dD48YnI+DQo8dHQ+Jm5i c3A7Jm5ic3A7IGNhbGwgdGhhdCBjb3VsZCBiZSByZWxldmFudCB0byBhdXRob3JpemF0aW9uIGZv ciBSZXNvdXJjZS1Qcmlvcml0eS48L3R0Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2tx dW90ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+U2luZ2xlIHF1b3RlcyBhcm91bmQg J1Jlc291cmNlLVByaW9yaXR5Jy48bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1 LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MC4wcHQiPiZuYnNwOyZuYnNwOyBUaGlzIG1heSBpbmNsdWRlIGluZm9ybWF0aW9uIHJlbGF0ZWQg dG8gdGhlIGRldmljZSBzdWJzY3JpcHRpb24gb2Y8L3NwYW4+PC90dD48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+PGJyPg0K PHR0PiZuYnNwOyZuYnNwOyB0aGUgY2FsbGVyLCBvciB0byBhbnkgaW5zdGl0dXRpb25zIHRoYXQg dGhlIGNhbGxlciBvciBkZXZpY2UgaXM8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgYXNzb2Np YXRlZCB3aXRoLCBvciBldmVuIGNhdGVnb3JpZXMgb2YgaW5zdGl0dXRpb25zLiZuYnNwOyBBbGwg b2YgdGhlc2U8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgZGF0YSBlbGVtZW50cyB3b3VsZCBi ZW5lZml0IGZyb20gdGhlIHNlY3VyZSBhdHRlc3RhdGlvbnMgcHJvdmlkZWQgYnk8L3R0Pjxicj4N Cjx0dD4mbmJzcDsmbmJzcDsgdGhlIFNUSVIgYW5kIFBBU1Nwb3JUIGZyYW1ld29ya3MuJm5ic3A7 IFRoZSBzcGVjaWZpY2F0aW9uIG9mIHRoZSAmcXVvdDtycGgmcXVvdDs8L3R0Pjxicj4NCjx0dD4m bmJzcDsmbmJzcDsgY2xhaW0gY291bGQgZW50YWlsIHRoZSBvcHRpb25hbCBwcmVzZW5jZSBvZiBv bmUgb3IgbW9yZSBzdWNoPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGFkZGl0aW9uYWwgaW5m b3JtYXRpb24gZmllbGRzLjwvdHQ+PGJyPg0KPGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBBIG5ldyBJ QU5BIHJlZ2lzdHJ5IGhhcyBiZWVuIGRlZmluZWQgdG8gaG9sZCBwb3RlbnRpYWwgdmFsdWVzIG9m IHRoZTwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyAmcXVvdDtycGgmcXVvdDsgYXJyYXk7IHNl ZSBTZWN0aW9uIDYuMi4mbmJzcDsgVGhlIGRlZmluaXRpb24gb2YgdGhlICZxdW90O3JwaCZxdW90 OyBjbGFpbSBtYXk8L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgaGF2ZSBvbmUgb3IgbW9yZSBz dWNoIGFkZGl0aW9uYWwgaW5mb3JtYXRpb24gZmllbGQocykuJm5ic3A7IERldGFpbHMgb2Y8L3R0 Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgc3VjaCAmcXVvdDtycGgmcXVvdDsgY2xhaW0gdG8gZW5j b21wYXNzIG90aGVyIGRhdGEgZWxlbWVudHMgYXJlIGxlZnQgZm9yIGZ1dHVyZTwvdHQ+PGJyPg0K PHR0PiZuYnNwOyZuYnNwOyB2ZXJzaW9uIG9mIHRoaXMgc3BlY2lmaWNhdGlvbi48L3R0Pjxicj4N Cjxicj4NCjx0dD42LiZuYnNwOyBJQU5BIENvbnNpZGVyYXRpb25zPC90dD48YnI+DQo8YnI+DQo8 dHQ+Ni4xLiZuYnNwOyBKU09OIFdlYiBUb2tlbiBDbGFpbXMgUmVnaXN0cmF0aW9uPC90dD48L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwPkkgdGhpbmsgdGhlcmUncyBzb21lIGNvbmZ1c2lvbiBoZXJlLiBZb3UncmUgcmVnaXN0 ZXJpbmcgYSBQQVNTcG9yVCBwcHQgdmFsdWUsIG5vdCBhIG5ldyBKV1QgY2xhaW0uIFRoYXQgaXMg dG8gc2F5LCB5b3UncmUgYWRkaW5nIGFuIGVudHJ5IHRvIHRoaXMgdGFibGU6PG86cD48L286cD48 L3A+DQo8cD48YSBocmVmPSJodHRwczovL3d3dy5pYW5hLm9yZy9hc3NpZ25tZW50cy9wYXNzcG9y dC9wYXNzcG9ydC54aHRtbCI+aHR0cHM6Ly93d3cuaWFuYS5vcmcvYXNzaWdubWVudHMvcGFzc3Bv cnQvcGFzc3BvcnQueGh0bWw8L2E+PG86cD48L286cD48L3A+DQo8cD5Ob3QgdG8gdGhpcyB0YWJs ZTo8bzpwPjwvbzpwPjwvcD4NCjxwPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlhbmEub3JnL2Fzc2ln bm1lbnRzL2p3dC9qd3QueGh0bWwiPmh0dHBzOi8vd3d3LmlhbmEub3JnL2Fzc2lnbm1lbnRzL2p3 dC9qd3QueGh0bWw8L2E+PG86cD48L286cD48L3A+DQo8cD5Zb3Ugd291bGQgb25seSB1c2UgdGhl IHNlY29uZCB0YWJsZSBpZiB5b3UgaGFkIGEgbmV3IGtleSB0byBhZGQgdG8gdGhlIFBBU1Nwb3JU IGhlYWRlciAtLSB0aGlzIHNwZWNpZmljYXRpb24gZG9lcyBub3QgZG8gdGhhdC48bzpwPjwvbzpw PjwvcD4NCjxwPlRoaXMgc2VjdGlvbiBhbHNvIG5lZWRzIHNvbWUgaW50cm9kdWN0b3J5IHRleHQg dG8gbGV0IHRoZSBJQU5BIGtub3cgZXhhY3RseSB3aGF0IHRvIGRvOyBlLmcuICZxdW90O1RoaXMg ZG9jdW1lbnQgcmVnaXN0ZXJzIGEgbmV3IHZhbHVlIGZvciB0aGUgJnF1b3Q7UGVyc29uYWwgQXNz ZXJ0aW9uIFRva2VuIChQQVNTcG9yVCkgRXh0ZW5zaW9ucyZxdW90OyB0YWJsZS48bzpwPjwvbzpw PjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206 NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxicj4NCjx0dD4mbmJzcDsm bmJzcDsgbyZuYnNwOyBwcHQgdmFsdWU6ICZxdW90O3JwaCZxdW90OzwvdHQ+PGJyPg0KPGJyPg0K PHR0PiZuYnNwOyZuYnNwOyBvJm5ic3A7IFNwZWNpZmljYXRpb24gRG9jdW1lbnQocyk6IFNlY3Rp b24gMyBvZiBbUkZDVGhpc108L3R0Pjxicj4NCjxicj4NCjx0dD42LjIuJm5ic3A7IFBBU1Nwb3JU ICdycGgnIFR5cGVzPC90dD48YnI+DQo8YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IFRoaXMgZG9jdW1l bnQgcmVxdWVzdHMgdGhhdCB0aGUgSUFOQSBhZGQgYSBuZXcgZW50cnkgdG8gdGhlIFBBU1Nwb3JU PC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IFR5cGVzIHJlZ2lzdHJ5IGZvciB0aGUgdHlwZSAm cXVvdDtycGgmcXVvdDsgd2hpY2ggaXMgc3BlY2lmaWVkIGluIFtSRkNUaGlzXS48L3R0Pjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPHA+VGhlcmUgaXNuJ3QgYW4gSUFOQSB0YWJsZSBjYWxsZWQgJnF1b3Q7UEFTU3BvclQgVHlw ZXMuJnF1b3Q7IEkgcHJlc3VtZSB0aGlzIGlzIHRoZSByZWdpc3RyYXRpb24gd2UganVzdCBkaXNj dXNzZWQgaW4gc2VjdGlvbiA2LjEsIGFuZCBzbyB0aGUgYWJvdmUgdHdvIGxpbmVzIGNhbiBiZSBy ZW1vdmVkLjxvOnA+PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2tx dW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjx0dD48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdCI+Jm5ic3A7 Jm5ic3A7IFRoaXMgc3BlY2lmaWNhdGlvbiBhbHNvIHJlcXVlc3RzIHRoYXQgdGhlIElBTkEgY3Jl YXRlIGEgbmV3IHJlZ2lzdHJ5PC9zcGFuPjwvdHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxicj4NCjx0dD4mbmJzcDsm bmJzcDsgZm9yIFBBU1Nwb3JUICZxdW90O3JwaCZxdW90OyB0eXBlcy4mbmJzcDsgUmVnaXN0cmF0 aW9uIG9mIG5ldyBQQVNTcG9yVCAmcXVvdDtycGgmcXVvdDsgdHlwZXM8L3R0Pjxicj4NCjx0dD4m bmJzcDsmbmJzcDsgc2hhbGwgYmUgdW5kZXIgdGhlIHNwZWNpZmljYXRpb24gcmVxdWlyZWQgcG9s aWN5LiZuYnNwOyBUaGlzIHJlZ2lzdHJ5IGlzPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IHRv IGJlIGluaXRpYWxseSBwb3B1bGF0ZWQgd2l0aCBhIHNpbmdsZSB2YWx1ZSBmb3IgJnF1b3Q7YXV0 aCZxdW90OyB3aGljaCBpczwvdHQ+PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBzcGVjaWZpZWQgaW4g W1JGQ1RoaXNdLjwvdHQ+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5UaGlzIG5lZWRzIHRvIGJlIHZlcnkgY2xlYXIgYWJv dXQgdGhlIGZpZWxkcyB0byBiZSBpbmNsdWRlZCBpbiB0aGlzIG5ldyByZWdpc3RyeSAoZS5nLiwg JnF1b3Q7UmVnaXN0cnkgZW50cmllcyBtdXN0IGNvbnRhaW4gdHdvIGZpZWxkczogdGhlIG5hbWUg b2YgdGhlICdycGgnIHR5cGUgYW5kIHRoZSBzcGVjaWZpY2F0aW9uIGluIHdoaWNoIHRoZSB0eXBl IGlzIGRlc2NyaWJlZCZxdW90OykuPG86cD48L286cD48L3A+DQo8cD48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206 NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxicj4NCjx0dD43LiZuYnNw OyBTZWN1cml0eSBDb25zaWRlcmF0aW9uczwvdHQ+PGJyPg0KPGJyPg0KPHR0PiZuYnNwOyZuYnNw OyBUaGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgZGlzY3Vzc2VkIGluIFtJLUQuaWV0Zi1zdGly LXJmYzQ0NzRiaXNdPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGluIFNlY3Rpb24gMTAgYXJl IGFwcGxpY2FibGUgaGVyZS48L3R0Pjxicj4NCjxicj4NCjx0dD43LjEuJm5ic3A7IEF2b2lkYW5j ZSBvZiByZXBsYXkgYW5kIGN1dCBhbmQgcGFzdGUgYXR0YWNrczwvdHQ+PGJyPg0KPGJyPg0KPHR0 PiZuYnNwOyZuYnNwOyBUaGUgUEFTU3BvclQgZXh0ZW5zaW9uIHdpdGggYSAmcXVvdDtwcHQmcXVv dDsgdmFsdWUgb2YgJnF1b3Q7cnBoJnF1b3Q7IE1VU1Qgb25seSBiZSBzZW50PC90dD48YnI+DQo8 dHQ+Jm5ic3A7Jm5ic3A7IHdpdGggU0lQIElOVklURSB3aGVuICdSZXNvdXJjZS1Qcmlvcml0eScg aGVhZGVyIGlzIHVzZWQgdG8gY29udmV5IHRoZTwvdHQ+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD4mcXVvdDsuLi5oZWFk ZXIgZmllbGQuLi4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48dHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4w cHQiPiZuYnNwOyZuYnNwOyBwcmlvcml0eSBvZiB0aGUgY29tbXVuaWNhdGlvbiBhcyBkZWZpbmVk IGluIFtSRkM0NDEyXS4mbmJzcDsgVG8gYXZvaWQgdGhlPC9zcGFuPjwvdHQ+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPjxi cj4NCjx0dD4mbmJzcDsmbmJzcDsgcmVwbGF5LCBhbmQgY3V0IGFuZCBwYXN0ZSBhdHRhY2tzLCB0 aGUgcHJvY2VkdXJlcyBkZXNjcmliZWQgaW48L3R0Pjxicj4NCjx0dD4mbmJzcDsmbmJzcDsgU2Vj dGlvbiAxMC4xIG9mIFtJLUQuaWV0Zi1zdGlyLXJmYzQ0NzRiaXNdIE1VU1QgYmUgZm9sbG93ZWQu PC90dD48YnI+DQo8YnI+DQo8dHQ+Ny4yLiZuYnNwOyBTb2x1dGlvbiBDb25zaWRlcmF0aW9uczwv dHQ+PGJyPg0KPGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBUaGUgdXNlIG9mIGV4dGVuc2lvbiB0byBQ QVNTcG9yVCB0b2tlbnMgd2l0aCAmcXVvdDtwcHQmcXVvdDsgdmFsdWUgJnF1b3Q7cnBoJnF1b3Q7 IGJhc2VkPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IG9uIHRoZSB2YWxpZGF0aW9uIG9mIHRo ZSBkaWdpdGFsIHNpZ25hdHVyZSBhbmQgdGhlIGFzc29jaWF0ZWQ8L3R0Pjxicj4NCjx0dD4mbmJz cDsmbmJzcDsgY2VydGlmaWNhdGUgcmVxdWlyZXMgY29uc2lkZXJhdGlvbiBvZiB0aGUgYXV0aGVu dGljYXRpb24gYW5kPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IGF1dGhvcml0eSBvciByZXB1 dGF0aW9uIG9mIHRoZSBzaWduZXIgdG8gYXR0ZXN0IHRvIHRoZSBpZGVudGl0eSBiZWluZzwvdHQ+ PGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBhc3NlcnRlZC4mbmJzcDsgVGhlIGZvbGxvd2luZyBjb25z aWRlcmF0aW9ucyBzaG91bGQgYmUgcmVjb2duaXplZCB3aGVuPC90dD48YnI+DQo8dHQ+Jm5ic3A7 Jm5ic3A7IHVzaW5nIFBBU1Nwb3JUIGV4dGVuc2lvbiB3aXRoICZxdW90O3BwdCZxdW90OyB2YWx1 ZSBvZiAmcXVvdDtycGgmcXVvdDs6PC90dD48YnI+DQo8YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7IG8m bmJzcDsgQW4gYXV0aG9yaXR5IChzaWduZXIpIGlzIG9ubHkgYWxsb3dlZCB0byBzaWduIHRoZSBj b250ZW50IG9mIGEgU0lQPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7ICdSZXNvdXJjZS1Qcmlvcml0eScgaGVhZGVyIGZvciB3aGljaCBpdCBoYXMgdGhlIHJpZ2h0 IGF1dGhvcml0eS48L3R0Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxw PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+JnF1b3Q7Li4uaGVhZGVyIGZpZWxkLi4uJnF1b3Q7 PG86cD48L286cD48L3A+DQo8cD48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0 eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHR0PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0Ij4mbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsgVGhlIGF1dGhvcml0eSB0aGF0IHNpZ25zIHRoZSB0b2tlbiBNVVNU IGhhdmUgYSBzZWN1cmUgbWV0aG9kIGZvcjwvc3Bhbj48L3R0PjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij48YnI+DQo8dHQ+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IGF1dGhlbnRpY2F0aW9uIG9mIHRoZSBlbmQg dXNlciBvciB0aGUgZGV2aWNlLjwvdHQ+PGJyPg0KPGJyPg0KPHR0PiZuYnNwOyZuYnNwOyBvJm5i c3A7IFRoZSB2ZXJpZmljYXRpb24gb2YgdGhlIHNpZ25hdHVyZSBNVVNUIGluY2x1ZGUgbWVhbnMg b2YgdmVyaWZ5aW5nPC90dD48YnI+DQo8dHQ+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IHRoYXQgdGhlIHNpZ25lciBpcyBhdXRob3JpdGF0aXZlIGZvciB0aGUgc2lnbmVkIGNvbnRlbnQg b2YgdGhlIFNJUDwvdHQ+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHA+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5JdCdzIG5vdCBjbGVhciB3aGF0IGF1dGhvcml0eSBp cyBiZWluZyBjbGFpbWVkIGhlcmUuIElzIHRoaXMgc3VwcG9zZWQgdG8gbWVhbiBzb21ldGhpbmcg bGlrZSAmcXVvdDsuLi52ZXJpZnlpbmcgdGhhdCB0aGUgc2lnbmVyIGlzIGF1dGhvcml0YXRpdmUg Zm9yIHRoZSBvcmlnaW5hdGluZyB0biBpbiB0aGUgUEFTU3BvclQuLi4mcXVvdDs/IE9yICZxdW90 Oy4uLmF1dGhvcml0YXRpdmUgZm9yIHRoZSByZXNvdXJjZSBwcmlvcml0eSBuYW1lc3BhY2UgaW4g dGhlIFBBU1Nwb3JUPyZxdW90Ow0KIFdoYXRldmVyIHRoZSBzZXJ2ZXIgaXMgcHVycG9ydGVkbHkg YXV0aG9yaXRhdGl2ZSBmb3IgbmVlZHMgdG8gYmUgY2xlYXJseSBzcGVsbGVkIG91dC48bzpwPjwv bzpwPjwvcD4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1h cmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48dHQ+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQiPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyAnUmVzb3VyY2UtUHJpb3JpdHknIGhlYWRlci48L3NwYW4+PC90dD48bzpwPjwv bzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxwPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHA+JnF1 b3Q7Li4uaGVhZGVyIGZpZWxkLiZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPHA+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4vYSA8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_7594FB04B1934943A5C02806D1A2204B6C135F8EESESSMB109erics_-- From nobody Mon Jan 22 22:04:10 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C41AC12D967 for ; Mon, 22 Jan 2018 22:04:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 34S_Or_gHn5P for ; Mon, 22 Jan 2018 22:04:00 -0800 (PST) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 723FB12D9FF for ; Mon, 22 Jan 2018 22:03:48 -0800 (PST) X-AuditID: c1b4fb30-11d5e9c000006bc7-bf-5a66d042d6dc Received: from ESESSHC016.ericsson.se (Unknown_Domain [153.88.183.66]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id 66.BA.27591.240D66A5; Tue, 23 Jan 2018 07:03:46 +0100 (CET) Received: from ESESSMB109.ericsson.se ([169.254.9.195]) by ESESSHC016.ericsson.se ([153.88.183.66]) with mapi id 14.03.0352.000; Tue, 23 Jan 2018 07:03:46 +0100 From: Christer Holmberg To: "stir@ietf.org" Thread-Topic: PASSPorT: "orig" and "dest" mandatory in all PASSPorTs? Thread-Index: AdOUD2Hs8xoe1g8QQdeomV5MKsy8iw== Date: Tue, 23 Jan 2018 06:03:45 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B6C13837A@ESESSMB109.ericsson.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.148] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrHLMWRmVeSWpSXmKPExsUyM2K7k67ThbQog8aF+hbL125jcmD0WLLk J1MAYxSXTUpqTmZZapG+XQJXxoKbJ1gLtrBUTL18mbGBsZ+5i5GTQ0LARGJT1y7WLkYuDiGB w4wSFx9+Y4FwljBK3H+/AijDwcEmYCHR/U8bpEFEQFliy7o77CC2sICDxLqJm1gh4q4SN84f YIew9SS+bDrCBGKzCKhKrPu/F8zmFfCVePLrIVgNo4CYxPdTa8DizALiEreezGeCOEhAYsme 81DHiUq8fPyPFcJWkmhc8oQVol5HYsHuT2wQtrbEsoWvmSHmC0qcnPmEZQKj0CwkY2chaZmF pGUWkpYFjCyrGEWLU4uTctONjPRSizKTi4vz8/TyUks2MQJD+eCW3wY7GF8+dzzEKMDBqMTD q3A2LUqINbGsuDL3EKMEB7OSCG9GG1CINyWxsiq1KD++qDQntfgQozQHi5I470lP3ighgfTE ktTs1NSC1CKYLBMHp1QDo9e8tG28f1at64+SP6xS+uxDxdnvjC8fzfRX+RIisWnl+Y3WAoUB 2Zz1XvPP/rQp26nx25q5+sa6T211hjviuAqWF3GW7r7yNC47OY7VrsJv5qLTdS1zNOvahfhn HN9xKW2hXsyPQw8F17te/ib18dCExlsHD61udvNx/Pgu2//UxGmlW64mKiixFGckGmoxFxUn AgAkd+H2YQIAAA== Archived-At: Subject: [stir] PASSPorT: "orig" and "dest" mandatory in all PASSPorTs? X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jan 2018 06:04:09 -0000 Hi, Question for clarification: Section 5.2.1 of draft-passport says: "There MUST be exactly one "orig" claim with exactly one identity cl= aim object in a PASSporT object." Q1: Does the text above mean that=20 a) a passport must always contain one, one only one, "orig" claim; o= r=20 b) that if a passport contains an "orig" claim, if can only contains= one? Q2: If a), does it apply to passport extensions too? Q3: Does Q1/Q2 apply to "dest" too? Regards, Christer =20 =20 =20 =20 From nobody Tue Jan 23 12:52:18 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E19A912D779 for ; Tue, 23 Jan 2018 12:52:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=chriswendt-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x1VwAzgGSQMv for ; Tue, 23 Jan 2018 12:52:15 -0800 (PST) Received: from mail-io0-x235.google.com (mail-io0-x235.google.com [IPv6:2607:f8b0:4001:c06::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E945C12D7EC for ; Tue, 23 Jan 2018 12:52:14 -0800 (PST) Received: by mail-io0-x235.google.com with SMTP id z6so2384516iob.11 for ; Tue, 23 Jan 2018 12:52:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chriswendt-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=OGBOhme2KYbr1UCMwxMlyzP7K0M/LMvKOIheAYHO9Jk=; b=sQcAF5xToInvBHaLndllmOPRV5Q63Ng3yI/vfeTP4ZmLt+ohTjWaHoDW0zseFZjabd ErdR2vu7QKYZlrC7Ji6irdIG8N2uiad7P1HzpdBLFXO2bqXgnvfP/3KCzXAlWENCFS75 At5iQ9eU2j072DfUsJoqLww8KvkZU7/OrIWCZmW/FHo7G4rwV7HXqCz9+5a6WVZ3/U6v jiaBLySBjUe+ZUPFn7hdvRHCh3qob2Im3aE9jDIj+dI8sv4CjjcB8xDj/vjsyHeDfgWu PMbi8l+X51J355vsFE3DnmhoP+3Wz+Bovc1KEez5/+ifUBvk3H95qH5qZ62EqM7aGQRq sX+g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=OGBOhme2KYbr1UCMwxMlyzP7K0M/LMvKOIheAYHO9Jk=; b=hoAH7q+mWrlf6+rpmMh+/cpDcInL6+RmBZ/qgSEyJZ+yTtEJxaxGz4KVQgj+EVTzYB vmbcBxfSkrQHT7FRRfYLeYzCni6b50AFwHFQVCZ9BXCW0Px9J4SjIjzZEsvhUdHT2f1X y0/ywQ1gA3gWrdvip9eKmap0fbqgowR+9LzkkvL4oyJxEXtK0WUn4Q7JXZHF2naYfMnT +B4UEBrUoNrpZ1MAGCn+NA66xOywomZQU9Qz1oB4qAObkL6mMvwidJJYUI9eDqmXEzxF 2MncUG9ZxClDvpmSGc2Xtv9jx5AqVIEya+o0z/lp6cbO6hE37CPfh+4j7qPejNIGtNCc LYtg== X-Gm-Message-State: AKwxytfDkWsiitlo3CiLm4+Tt5IITynCFRMR/zKlasojHIRjUrCxILEe OzaXMv2gSPRNFnBgXiRu+9RBEQ== X-Google-Smtp-Source: AH8x227h9z9X/MDfOFbVXa1JwQM+Vhi5xfPNVvJguaN4p2WfiUkORp+QrrrEP4VeuhqO41MRdhiHLw== X-Received: by 10.107.167.69 with SMTP id q66mr5337328ioe.130.1516740734292; Tue, 23 Jan 2018 12:52:14 -0800 (PST) Received: from [172.30.40.187] ([67.133.97.98]) by smtp.gmail.com with ESMTPSA id v11sm5710616itf.6.2018.01.23.12.52.13 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 23 Jan 2018 12:52:13 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\)) From: Chris Wendt In-Reply-To: <7594FB04B1934943A5C02806D1A2204B6C13837A@ESESSMB109.ericsson.se> Date: Tue, 23 Jan 2018 13:52:11 -0700 Cc: "stir@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <41C6125A-C90A-4187-9B6E-267DAE44DF8B@chriswendt.net> References: <7594FB04B1934943A5C02806D1A2204B6C13837A@ESESSMB109.ericsson.se> To: Christer Holmberg X-Mailer: Apple Mail (2.3445.5.20) Archived-At: Subject: Re: [stir] PASSPorT: "orig" and "dest" mandatory in all PASSPorTs? X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jan 2018 20:52:17 -0000 answers inline > On Jan 22, 2018, at 11:03 PM, Christer Holmberg = wrote: >=20 > Hi, >=20 > Question for clarification: >=20 > Section 5.2.1 of draft-passport says: >=20 > "There MUST be exactly one "orig" claim with exactly one = identity claim object in a PASSporT object." >=20 > Q1: Does the text above mean that=20 >=20 > a) a passport must always contain one, one only one, "orig" = claim; or=20 > b) that if a passport contains an "orig" claim, if can only = contains one? It can only contain one key value pair with the key =E2=80=9Corig=E2=80=9D= and the claim value can only be one identity. In other words you cannot claim to originate multiple identities with a = single passport object. >=20 > Q2: If a), does it apply to passport extensions too? All extensions must include the base passport claims and follow all = rules of the claims, so yes. >=20 > Q3: Does Q1/Q2 apply to "dest" too? For =E2=80=9Cdest" the only difference is we allow an array of = identities to accommodate future use of passport with multiple party = calling or messaging where you send a call or message to multiple = destination parties. >=20 > Regards, >=20 > Christer =20 >=20 >=20 >=20 >=20 > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir From nobody Tue Jan 23 13:19:49 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8BE0E12D811 for ; Tue, 23 Jan 2018 13:19:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T56Og20hzdE2 for ; Tue, 23 Jan 2018 13:19:46 -0800 (PST) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D6DC212D7FC for ; Tue, 23 Jan 2018 13:19:45 -0800 (PST) X-AuditID: c1b4fb30-d49ff70000006bc7-55-5a67a6efbfde Received: from ESESSHC016.ericsson.se (Unknown_Domain [153.88.183.66]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id 14.50.27591.FE6A76A5; Tue, 23 Jan 2018 22:19:43 +0100 (CET) Received: from ESESSMB109.ericsson.se ([169.254.9.195]) by ESESSHC016.ericsson.se ([153.88.183.66]) with mapi id 14.03.0352.000; Tue, 23 Jan 2018 22:19:43 +0100 From: Christer Holmberg To: Chris Wendt CC: "stir@ietf.org" Thread-Topic: [stir] PASSPorT: "orig" and "dest" mandatory in all PASSPorTs? Thread-Index: AdOUD2Hs8xoe1g8QQdeomV5MKsy8iwAdEZuAAAJpSWA= Date: Tue, 23 Jan 2018 21:19:42 +0000 Message-ID: <7594FB04B1934943A5C02806D1A2204B6C13B5EB@ESESSMB109.ericsson.se> References: <7594FB04B1934943A5C02806D1A2204B6C13837A@ESESSMB109.ericsson.se> <41C6125A-C90A-4187-9B6E-267DAE44DF8B@chriswendt.net> In-Reply-To: <41C6125A-C90A-4187-9B6E-267DAE44DF8B@chriswendt.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [153.88.183.150] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrOLMWRmVeSWpSXmKPExsUyM2K7k+77ZelRBkevGVtM/7Sb2WL52m1M DkweE/rWsHosWfKTKYApissmJTUnsyy1SN8ugSvj3Z/jbAULhCo+PV/N3MD4RLCLkZNDQsBE Yv7kVhYQW0jgMKNE/wPDLkYuIHsJo8T+e8+AEhwcbAIWEt3/tEFqRAS0JQ6faWAECTMLKEv8 220PEhYW8JbYt+oXC0SJj8SE73+YIWwriVXLVrGBlLMIqEr0fFQBCfMK+Eq8XLOXHWJTK6PE tnur2EFqOAWcJLZMlQGpYRQQk/h+ag0TiM0sIC5x68l8JoiLBSSW7DnPDGGLSrx8/I8VwlaS WLH9EtRlmhLrd+lDtCpKTOl+yA6xVlDi5MwnLBMYRWchmToLoWMWko5ZSDoWMLKsYhQtTi1O yk03MtJLLcpMLi7Oz9PLSy3ZxAiMjoNbfhvsYHz53PEQowAHoxIPb/aC9Cgh1sSy4srcQ4wS HMxKIrx5rEAh3pTEyqrUovz4otKc1OJDjNIcLErivCc9eaOEBNITS1KzU1MLUotgskwcnFIN jLafJW8/snCLbQp8oFt1ZGfPL8U784/fMa57KF6msPzcswWMXYk8mw4s3HC7bkXCPEFRlV9n N09nvcJuvZH90TVdQfWlAhIOFhnXVVnuaL1gV5kofO/5VPOAl0W17RNyt2jPOfWT8R1z4p+r 1TOP7Ukp3doka/my23LDvvPKhTyH6rtPvHqcPVuJpTgj0VCLuag4EQBCdRBuigIAAA== Archived-At: Subject: Re: [stir] PASSPorT: "orig" and "dest" mandatory in all PASSPorTs? X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jan 2018 21:19:47 -0000 SGkgQ2hyaXMsDQoNCj4+IFF1ZXN0aW9uIGZvciBjbGFyaWZpY2F0aW9uOg0KPj4gDQo+PiBTZWN0 aW9uIDUuMi4xIG9mIGRyYWZ0LXBhc3Nwb3J0IHNheXM6DQo+PiANCj4+ICAgICAgICJUaGVyZSBN VVNUIGJlIGV4YWN0bHkgb25lICJvcmlnIiBjbGFpbSB3aXRoIGV4YWN0bHkgb25lIGlkZW50aXR5 IGNsYWltIG9iamVjdCBpbiBhIFBBU1Nwb3JUIG9iamVjdC4iDQo+PiANCj4+IFExOiBEb2VzIHRo ZSB0ZXh0IGFib3ZlIG1lYW4gdGhhdCANCj4+IA0KPj4gICAgICAgYSkgYSBwYXNzcG9ydCBtdXN0 IGFsd2F5cyBjb250YWluIG9uZSwgb25lIG9ubHkgb25lLCAib3JpZyIgY2xhaW07IG9yIA0KPj4g ICAgICAgYikgdGhhdCBpZiBhIHBhc3Nwb3J0IGNvbnRhaW5zIGFuICJvcmlnIiBjbGFpbSwgaWYg Y2FuIG9ubHkgY29udGFpbnMgb25lPw0KPg0KPiBJdCBjYW4gb25seSBjb250YWluIG9uZSBrZXkg dmFsdWUgcGFpciB3aXRoIHRoZSBrZXkg4oCcb3JpZ+KAnSBhbmQgdGhlIGNsYWltIHZhbHVlIGNh biBvbmx5IGJlIG9uZSBpZGVudGl0eS4NCj4NCj4gSW4gb3RoZXIgd29yZHMgeW91IGNhbm5vdCBj bGFpbSB0byBvcmlnaW5hdGUgbXVsdGlwbGUgaWRlbnRpdGllcyB3aXRoIGEgc2luZ2xlIHBhc3Nw b3J0IG9iamVjdC4NCg0KQ29ycmVjdC4gVGhlIHF1ZXN0aW9uIGlzIHdoZXRoZXIgIm9yaWciIGlz IG1hbmRhdG9yeSAoYWx0ZXJuYXRpdmUgYSkgb3Igbm90IChhbHRlcm5hdGl2ZSBiKS4gQnV0LCBi YXNlZCBvbiB5b3VyIHJlcGx5IHRvIFEyIGJlbG93LCBJIGFzc3VtZSB0aGUgYW5zd2VyIGlzIGFs dGVybmF0aXZlIGEpLg0KDQpJIHRoaW5rIGl0IHdvdWxkIGJlIGdvb2QgdG8gbWFrZSB0aGF0IG1v cmUgY2xlYXIuIA0KDQo+PiBRMjogSWYgYSksIGRvZXMgaXQgYXBwbHkgdG8gcGFzc3BvcnQgZXh0 ZW5zaW9ucyB0b28/DQo+DQo+IEFsbCBleHRlbnNpb25zIG11c3QgaW5jbHVkZSB0aGUgYmFzZSBw YXNzcG9ydCBjbGFpbXMgYW5kIGZvbGxvdyBhbGwgcnVsZXMgb2YgdGhlIGNsYWltcywgc28geWVz Lg0KDQpJIHRoaW5rIGl0IHNob3VsZCBiZSBtb3JlIGNsZWFyIHdoZXRoZXIgYSBub2RlIGNhbiBt b2RpZnkgY2xhaW1zIG9yIG5vdCB3aGVuIGFkZGluZyBhbiBleHRlbnNpb24sIG9yIHdoZXRoZXIg YW4gZXh0ZW5zaW9uIG5lZWRzIHRvIGV4cGxpY2l0bHkgYWxsb3cgaXQuIEN1cnJlbnRseSB0aGUg dGV4dCBvbmx5IHNheXMgKEFGQUlLKSB0aGF0IGNsYWltcyBjYW5ub3QgYmUgcmVtb3ZlZC4NCg0K Rm9yIGV4YW1wbGUsIGlmIEkgaGF2ZSBhIGJhc2UgcGFzc3BvcnQsIGFuZCBhZGQgYW4gUlBIIHBh c3Nwb3J0LCBJIGFzc3VtZSBJIGNhbm5vdCBjaGFuZ2UgdGhlIHZhbHVlIG9mIHRoZSAiZGVzdCIg Y2xhaW0uIEkgd291bGQgbmVlZCB0byB1c2UgYSBkaXZlcnQgY2xhaW0gZm9yIHRoYXQuDQoNCkFs c28sIGFzIHRoZSBwYXNzcG9ydHMgbWF5IGJlIGFkZGVkIGFuZCBzaWduZWQgYnkgZGlmZmVyZW50 IGF1dGhvcml0aWVzLCBhbmQgYXMgZWFjaCBwYXNzcG9ydCB3aWxsIGNvbnRhaW4gdGhlIGJhc2Ug Y2xhaW1zLCBpdCBtZWFucyB0aGF0IHRoZSBiYXNlIGNsYWltcyB3aWxsIGJlIHNpZ25lZCBtdWx0 aXBsZSB0aW1lcywgYW5kIHRoZXkgbWF5IGJlIHNpZ25lZCBieSBkaWZmZXJlbnQgYXV0aG9yaXRp ZXMuIEkgYXNzdW1lIHRoYXQgaXMgb2suDQoNClJlZ2FyZHMsDQoNCkNocmlzdGVyDQoNCg== From nobody Wed Jan 24 05:44:46 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B579412422F for ; Wed, 24 Jan 2018 05:44:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=chriswendt-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 10015jVU4oAP for ; Wed, 24 Jan 2018 05:44:44 -0800 (PST) Received: from mail-qt0-x22f.google.com (mail-qt0-x22f.google.com [IPv6:2607:f8b0:400d:c0d::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D77C91241F8 for ; Wed, 24 Jan 2018 05:44:43 -0800 (PST) Received: by mail-qt0-x22f.google.com with SMTP id l20so10308724qtj.11 for ; Wed, 24 Jan 2018 05:44:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chriswendt-net.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=L5EqWHfkBT/hKA7nlWs9meEgqGLhsHSkUD9qLrKhSF0=; b=LOmt4HdZPXUgkZZE5QDk8ZPu8DNCHTtSTQb/ofelkL6w29nyMiSnh18Gma8ltZdIIH ZAN+pNwQU+YWcj9N7ZYv5KzGL98J+F8EsFKx39kT/PSbDkDIkEQDaxR7esxDXGJGAoZU WuIa4qFgm4CRKgfjCiY8vVoT+erRz7ZWtTMQROaWymUzd+hiFyhu2ZHnu3dVnbEjErPN 96H1F2WQgLPDO5Tc2Xm1SUnd5/XCTMWIYGvhKujFaA+SpbOrTpP1A+X1qLvdQKt+IodD 83hMnkpqcvPukVBJPuSgFGFJH077BZ9Gch9sozGunisV33hnjpIsNg6yh53eIiWDX87b gtUA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=L5EqWHfkBT/hKA7nlWs9meEgqGLhsHSkUD9qLrKhSF0=; b=cCmESF5+EaTB+wcrYnBRwGTtEI4B6R/EQFCbYdfBbEUcpGtSurfIv8tmxgD6ML2ewX MCMznOCj9QKnm0UgoVG54CUJ4tLFfEX0GZkzqAF5bWncw1HIILM0KBvh7ANDVGg4kLnU ZTxuZD+qVBfiA0oc7Ymh5A47D5MFC6xgTmG2umzg3irPn2bbg51YAyJ1esrOZshquADS oFuIqYRj8N/LGQtr6jkK8CmZHuFmDclZB+MSRGoId+xNnYsd/VO/FJQLEV1xbiY4t00U QH/p5r4rGLzSwpa7EUBxuTN6EtIAheuazdJ7LZp4Xr1s+OhElO9PbYsFGuQviZjbsiQ5 O4rQ== X-Gm-Message-State: AKwxytf25qUhXeQMdt2moQMP1CMFq0aOv+wk7kpXv7oa2V+rXi4642zm 8gh2qMdjOTSDWCo5jqT4waA5K644oWU= X-Google-Smtp-Source: AH8x226nOC0ILiyLNKZZ0Srd4UxrMu7HOwmh42ah9+Vhj8op9udUAkECFwucBYTD/7BHlqg1zTsRDQ== X-Received: by 10.55.209.137 with SMTP id o9mr9235931qkl.234.1516801482992; Wed, 24 Jan 2018 05:44:42 -0800 (PST) Received: from [10.8.0.6] (c-73-13-103-172.hsd1.pa.comcast.net. [73.13.103.172]) by smtp.gmail.com with ESMTPSA id 15sm2100302qtz.76.2018.01.24.05.44.41 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 24 Jan 2018 05:44:41 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\)) From: Chris Wendt In-Reply-To: <7594FB04B1934943A5C02806D1A2204B6C13B5EB@ESESSMB109.ericsson.se> Date: Wed, 24 Jan 2018 06:44:39 -0700 Cc: "stir@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <26D4A77C-8860-41A0-8608-2FCE10FE9942@chriswendt.net> References: <7594FB04B1934943A5C02806D1A2204B6C13837A@ESESSMB109.ericsson.se> <41C6125A-C90A-4187-9B6E-267DAE44DF8B@chriswendt.net> <7594FB04B1934943A5C02806D1A2204B6C13B5EB@ESESSMB109.ericsson.se> To: Christer Holmberg X-Mailer: Apple Mail (2.3445.5.20) Archived-At: Subject: Re: [stir] PASSPorT: "orig" and "dest" mandatory in all PASSPorTs? X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jan 2018 13:44:46 -0000 Hi Christer, I guess i=E2=80=99m not following what=E2=80=99s not clear, if you MUST = only have one orig claim and one identity in that claim, that seems to = be pretty clear to me that you cannot either not have an orig claim or = have more than one. I guess maybe i=E2=80=99m missing something subtle = in your point. For extensions, and in general with any PASSporT, once the PASSporT is = signed, that=E2=80=99s it, you cannot modify claims or "re-sign". If = you want new PASSporT claim information that you want to sign, you must = have a new PASSporT or new identity header. Currently for divert, the approach is to embed a PASSporT inside a new = PASSporT, which is a valid technique also and result in a new identity = header also (but you should remove the old identity header in this = case). -Chris > On Jan 23, 2018, at 2:19 PM, Christer Holmberg = wrote: >=20 > Hi Chris, >=20 >>> Question for clarification: >>>=20 >>> Section 5.2.1 of draft-passport says: >>>=20 >>> "There MUST be exactly one "orig" claim with exactly one = identity claim object in a PASSporT object." >>>=20 >>> Q1: Does the text above mean that=20 >>>=20 >>> a) a passport must always contain one, one only one, "orig" = claim; or=20 >>> b) that if a passport contains an "orig" claim, if can only = contains one? >>=20 >> It can only contain one key value pair with the key =E2=80=9Corig=E2=80= =9D and the claim value can only be one identity. >>=20 >> In other words you cannot claim to originate multiple identities with = a single passport object. >=20 > Correct. The question is whether "orig" is mandatory (alternative a) = or not (alternative b). But, based on your reply to Q2 below, I assume = the answer is alternative a). >=20 > I think it would be good to make that more clear.=20 >=20 >>> Q2: If a), does it apply to passport extensions too? >>=20 >> All extensions must include the base passport claims and follow all = rules of the claims, so yes. >=20 > I think it should be more clear whether a node can modify claims or = not when adding an extension, or whether an extension needs to = explicitly allow it. Currently the text only says (AFAIK) that claims = cannot be removed. >=20 > For example, if I have a base passport, and add an RPH passport, I = assume I cannot change the value of the "dest" claim. I would need to = use a divert claim for that. >=20 > Also, as the passports may be added and signed by different = authorities, and as each passport will contain the base claims, it means = that the base claims will be signed multiple times, and they may be = signed by different authorities. I assume that is ok. >=20 > Regards, >=20 > Christer >=20 From nobody Wed Jan 24 06:05:39 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F9FF1242F7 for ; Wed, 24 Jan 2018 06:05:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kFHMdS-EdaT7 for ; Wed, 24 Jan 2018 06:05:36 -0800 (PST) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 21B481242EA for ; Wed, 24 Jan 2018 06:05:35 -0800 (PST) X-AuditID: c1b4fb30-11d5e9c000006bc7-2c-5a6892ae3da9 Received: from ESESSHC023.ericsson.se (Unknown_Domain [153.88.183.87]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id B0.E0.27591.EA2986A5; Wed, 24 Jan 2018 15:05:34 +0100 (CET) Received: from ESESSMB109.ericsson.se ([169.254.9.195]) by ESESSHC023.ericsson.se ([153.88.183.87]) with mapi id 14.03.0352.000; Wed, 24 Jan 2018 15:05:33 +0100 From: Christer Holmberg To: Chris Wendt CC: "stir@ietf.org" Thread-Topic: [stir] PASSPorT: "orig" and "dest" mandatory in all PASSPorTs? Thread-Index: AdOUD2Hs8xoe1g8QQdeomV5MKsy8iwAdEZuAAAJpSWAAIPLfgAAFUHqA Date: Wed, 24 Jan 2018 14:05:33 +0000 Message-ID: References: <7594FB04B1934943A5C02806D1A2204B6C13837A@ESESSMB109.ericsson.se> <41C6125A-C90A-4187-9B6E-267DAE44DF8B@chriswendt.net> <7594FB04B1934943A5C02806D1A2204B6C13B5EB@ESESSMB109.ericsson.se> <26D4A77C-8860-41A0-8608-2FCE10FE9942@chriswendt.net> In-Reply-To: <26D4A77C-8860-41A0-8608-2FCE10FE9942@chriswendt.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.7.170905 x-originating-ip: [153.88.183.146] Content-Type: text/plain; charset="iso-8859-1" Content-ID: <87D6231F2801604A9A9B726F7BC21005@ericsson.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprLIsWRmVeSWpSXmKPExsUyM2J7uO66SRlRButuy1tM/7Sb2WL52m1M DkweE/rWsHosWfKTKYApissmJTUnsyy1SN8ugSvj65UtbAXrpCver2xka2C8LtrFyMEhIWAi cXx9ahcjJ4eQwGFGiRvTAiHsJYwSP1bUgJSwCVhIdP/TBgmLCGhLHD7TwAgSZhZQlvi32x4k LCzgLfHkxQ5WiBIfiQnf/zBD2G4S2/83MoHYLAKqEg9OfWMDsXkFrCWWT3kMFOcC2tTIJLGj qRWsgVPASeLE0ydgDYwCYhLfT60Bs5kFxCVuPZkPZksICEgs2XOeGcIWlXj5+B/YYlEBPYkN J26zQ8SVJH5suMQC0asncWPqFDYI21qid94rqJnaEssWvmaGOEhQ4uTMJywTGMVnIVk3C0n7 LCTts5C0z0LSvoCRdRWjaHFqcVJuupGRXmpRZnJxcX6eXl5qySZGYKQd3PLbYAfjy+eOhxgF OBiVeHjv9GZECbEmlhVX5h5ilOBgVhLhvdwOFOJNSaysSi3Kjy8qzUktPsQozcGiJM570pM3 SkggPbEkNTs1tSC1CCbLxMEp1cBYz7fwfW3jo4zVHHe3z9mndWubx0K/L2IWRe9sAsXTPp9h +L6rb9Jdtxfz+Uziv51cb84bU/2sSkX5lpClwKcPbRfKwiL57U+36TA3XbjHyx0SzHTDuWJ+ psAjy43r3214s4n3553Lp/i9Jmk823J8p/6rnmi1kHebGQX02Q6tOfNrnktif8ITJZbijERD Leai4kQAh30BTrACAAA= Archived-At: Subject: Re: [stir] PASSPorT: "orig" and "dest" mandatory in all PASSPorTs? X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 24 Jan 2018 14:05:38 -0000 Hi, >I guess i=B9m not following what=B9s not clear, if you MUST only have one >orig claim and one identity in that claim, that seems to be pretty clear >to me that you cannot either not have an orig claim or have more than >one. I guess maybe i=B9m missing something subtle in your point. It is clear that you cannot have more than one claim, but I think it could be made more clear that you always must have a claim to begin with :) >For extensions, and in general with any PASSporT, once the PASSporT is >signed, that=B9s it, you cannot modify claims or "re-sign". If you want >new PASSporT claim information that you want to sign, you must have a new >PASSporT or new identity header. Correct, I should have made that clear. So, if you have two (or more) Identity header fields, do they all have to contain the same =B3orig=B2 value? Or, is one allowed to change it? Does the same apply for =B3dest=B2? And, if you want to change the =B3dest= =B2 you need to use the divert extension? You can=B9t just add a new passport with = a new =B3dest=B2 value. Or? >Currently for divert, the approach is to embed a PASSporT inside a new >PASSporT, which is a valid technique also and result in a new identity >header also (but you should remove the old identity header in this case). My colleague Julio sent some questions and issues regarding the =B3embedding=B2/=B3nesting=B2 approach. I would be happy if you look at tho= se :) Regards, Christer > >-Chris > >> On Jan 23, 2018, at 2:19 PM, Christer Holmberg >> wrote: >>=20 >> Hi Chris, >>=20 >>>> Question for clarification: >>>>=20 >>>> Section 5.2.1 of draft-passport says: >>>>=20 >>>> "There MUST be exactly one "orig" claim with exactly one >>>>identity claim object in a PASSporT object." >>>>=20 >>>> Q1: Does the text above mean that >>>>=20 >>>> a) a passport must always contain one, one only one, "orig" >>>>claim; or=20 >>>> b) that if a passport contains an "orig" claim, if can only >>>>contains one? >>>=20 >>> It can only contain one key value pair with the key =B3orig=B2 and the >>>claim value can only be one identity. >>>=20 >>> In other words you cannot claim to originate multiple identities with >>>a single passport object. >>=20 >> Correct. The question is whether "orig" is mandatory (alternative a) or >>not (alternative b). But, based on your reply to Q2 below, I assume the >>answer is alternative a). >>=20 >> I think it would be good to make that more clear. >>=20 >>>> Q2: If a), does it apply to passport extensions too? >>>=20 >>> All extensions must include the base passport claims and follow all >>>rules of the claims, so yes. >>=20 >> I think it should be more clear whether a node can modify claims or not >>when adding an extension, or whether an extension needs to explicitly >>allow it. Currently the text only says (AFAIK) that claims cannot be >>removed. >>=20 >> For example, if I have a base passport, and add an RPH passport, I >>assume I cannot change the value of the "dest" claim. I would need to >>use a divert claim for that. >>=20 >> Also, as the passports may be added and signed by different >>authorities, and as each passport will contain the base claims, it means >>that the base claims will be signed multiple times, and they may be >>signed by different authorities. I assume that is ok. >>=20 >> Regards, >>=20 >> Christer >>=20 > From nobody Thu Jan 25 14:50:50 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6D4E12EAD5 for ; Thu, 25 Jan 2018 14:50:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.002 X-Spam-Level: X-Spam-Status: No, score=-0.002 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (768-bit key) header.d=shockey.us Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DudUQ41NIznb for ; Thu, 25 Jan 2018 14:50:47 -0800 (PST) Received: from qproxy3-pub.mail.unifiedlayer.com (qproxy3-pub.mail.unifiedlayer.com [67.222.38.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 747D512EAD2 for ; Thu, 25 Jan 2018 14:50:47 -0800 (PST) Received: from cmgw3 (unknown [10.0.90.84]) by qproxy3.mail.unifiedlayer.com (Postfix) with ESMTP id 0E1FED59AC for ; Thu, 25 Jan 2018 15:50:47 -0700 (MST) Received: from box462.bluehost.com ([74.220.219.62]) by cmgw3 with id 2mqk1x0051MNPNq01mqnaA; Thu, 25 Jan 2018 15:50:47 -0700 X-Authority-Analysis: v=2.2 cv=XM9AcUpE c=1 sm=1 tr=0 a=jTEj1adHphCQ5SwrTAOQMg==:117 a=jTEj1adHphCQ5SwrTAOQMg==:17 a=IkcTkHD0fZMA:10 a=MKtGQD3n3ToA:10 a=1oJP67jkp3AA:10 a=RgaUWeydRksA:10 a=jqBRFv0mrdUA:10 a=ZZnuYtJkoWoA:10 a=NvC-MaXgAAAA:8 a=ll-iCDY8AAAA:8 a=M0OflfRGAAAA:8 a=z7KIGqk6Z9nAQhl380MA:9 a=QEXdDO2ut3YA:10 a=ivbTfD_dPm4A:10 a=lCKLaNiBY0u9urARF_50:22 a=VpyrLIdO_Ztbr3SWPBuH:22 a=6yl0mh0s51TKORVA8GqK:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=shockey.us; s=default; h=Content-transfer-encoding:Content-type:Mime-version:Message-ID: To:From:Subject:Date:Sender:Reply-To:Cc:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=gCY0/2TdNEN2ixM/Q28lJI3MgUT6yusR6EFTZR25WyM=; b=MIRwEwP+hXYmUUcIh1Vpog6FEV WJk0WsQaLouDSRWTKor2tf4NdUXBoHAXqVKo99fdB4c03KCmiaLNBTCQ4YHztOYcBKONBmctkP4R+ jAf3kwV4vVm+MvjkAkEedqp/h; Received: from pool-100-36-44-145.washdc.fios.verizon.net ([100.36.44.145]:56043 helo=[192.168.1.152]) by box462.bluehost.com with esmtpa (Exim 4.89_1) (envelope-from ) id 1eeqLz-000mYB-O3 for stir@ietf.org; Thu, 25 Jan 2018 15:50:43 -0700 User-Agent: Microsoft-MacOutlook/10.9.0.180116 Date: Thu, 25 Jan 2018 17:50:42 -0500 From: Richard Shockey To: IETF STIR Mail List Message-ID: <2319C3A3-5491-4E3D-9828-1B7290EBFDFE@shockey.us> Thread-Topic: TA DA News from Canada... Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - box462.bluehost.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - shockey.us X-BWhitelist: no X-Source-IP: 100.36.44.145 X-Exim-ID: 1eeqLz-000mYB-O3 X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: pool-100-36-44-145.washdc.fios.verizon.net ([192.168.1.152]) [100.36.44.145]:56043 X-Source-Auth: richard+shockey.us X-Email-Count: 3 X-Source-Cap: c2hvY2tleXU7c2hvY2tleXU7Ym94NDYyLmJsdWVob3N0LmNvbQ== X-Local-Domain: yes Archived-At: Subject: [stir] TA DA News from Canada... X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jan 2018 22:50:49 -0000 Its going to deploy...=20 http://www.crtc.gc.ca/eng/archive/2018/2018-32.pdf =E2=80=94=20 Richard Shockey Shockey Consulting LLC Chairman of the Board SIP Forum www.shockey.us www.sipforum.org richardshockey.us Skype-Linkedin-Facebook =E2=80=93Twitter rshockey101 PSTN +1 703-593-2683 =20 From nobody Fri Jan 26 09:28:17 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF017126C23 for ; Fri, 26 Jan 2018 09:28:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.321 X-Spam-Level: X-Spam-Status: No, score=-4.321 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h5SCvwiQ49zF for ; Fri, 26 Jan 2018 09:28:13 -0800 (PST) Received: from sesbmg22.ericsson.net (sesbmg22.ericsson.net [193.180.251.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 74400126C19 for ; Fri, 26 Jan 2018 09:28:13 -0800 (PST) X-AuditID: c1b4fb30-11d5e9c000006bc7-03-5a6b652b6e04 Received: from ESESSHC019.ericsson.se (Unknown_Domain [153.88.183.75]) by sesbmg22.ericsson.net (Symantec Mail Security) with SMTP id 0A.78.27591.B256B6A5; Fri, 26 Jan 2018 18:28:11 +0100 (CET) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (153.88.183.145) by oa.msg.ericsson.com (153.88.183.75) with Microsoft SMTP Server (TLS) id 14.3.352.0; Fri, 26 Jan 2018 18:27:32 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=kUjK4E2gyfxIIz+eAc34091r6nnZjQs2Dj/bAfOLseo=; b=k/3KuqKxK2rZBeNqk+lTuYPLOio1MK3pqsR31LoeKk+Sd/JrovCnIhhSJ0GONyomOVzWNWLak46v/DftSCKuBfQKiacMgAxkRBFqhpGDkniY5UnTw5+y1sOnBpnyXfRd0SWp06QvOt1EIWRBB1X9YGIocFdKp+ZK/58mVCmEP10= Received: from HE1PR0701MB2298.eurprd07.prod.outlook.com (10.168.127.21) by HE1PR0701MB2107.eurprd07.prod.outlook.com (10.168.35.154) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.464.6; Fri, 26 Jan 2018 17:27:31 +0000 Received: from HE1PR0701MB2298.eurprd07.prod.outlook.com ([fe80::8da1:3cf3:9492:1102]) by HE1PR0701MB2298.eurprd07.prod.outlook.com ([fe80::8da1:3cf3:9492:1102%17]) with mapi id 15.20.0444.016; Fri, 26 Jan 2018 17:27:30 +0000 From: Julio Martinez-Minguito To: Christer Holmberg , Chris Wendt CC: "stir@ietf.org" Thread-Topic: [stir] PASSPorT: "orig" and "dest" mandatory in all PASSPorTs? Thread-Index: AQHTlU39MZeu8zQEQ0iuJP091fWPp6OGZ5tQ Date: Fri, 26 Jan 2018 17:27:30 +0000 Message-ID: References: <7594FB04B1934943A5C02806D1A2204B6C13837A@ESESSMB109.ericsson.se> <41C6125A-C90A-4187-9B6E-267DAE44DF8B@chriswendt.net> <7594FB04B1934943A5C02806D1A2204B6C13B5EB@ESESSMB109.ericsson.se> <26D4A77C-8860-41A0-8608-2FCE10FE9942@chriswendt.net> In-Reply-To: Accept-Language: sv-SE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=julio.martinez-minguito@ericsson.com; x-originating-ip: [192.176.1.87] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1; HE1PR0701MB2107; 7:Ho0uxFi+A366u6cDF3MMsgrf02C81jtgd1/XmpYEDlEt+8orZknsJRtQr+6wZz44Tc75FOI4cPLF1cokhqL+IAPvu1lzpgspItmvasUX/5eu70u3Rka6OXBK/DAakuOLSiNCfMfq2b93UmbI5EF+3TCIB21CMI0J7n7hM7FvQmzEPDkmqVyfwFOk4SQ4EGmNwGiqyLBdu63UdoevrRc264dKfg3S5Mk/Ga5g5bjKEwZXNpZGY/NH0RDNHIEbQ1mD x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: 0045f131-e846-4664-e650-08d564e2145a x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4604075)(3008032)(2017052603307)(7153060)(7193020); SRVR:HE1PR0701MB2107; x-ms-traffictypediagnostic: HE1PR0701MB2107: x-ld-processed: 92e84ceb-fbfd-47ab-be52-080c6b87953f,ExtAddr x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(37575265505322)(17755550239193); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040501)(2401047)(8121501046)(5005006)(10201501046)(3231023)(2400081)(944501161)(93006095)(93001095)(3002001)(6041288)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(20161123560045)(20161123562045)(20161123564045)(6072148)(201708071742011); SRVR:HE1PR0701MB2107; BCL:0; PCL:0; RULEID:; SRVR:HE1PR0701MB2107; x-forefront-prvs: 05641FD966 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(396003)(346002)(39380400002)(39860400002)(366004)(13464003)(189003)(199004)(110136005)(6506007)(6116002)(105586002)(97736004)(7736002)(2906002)(93886005)(33656002)(26005)(14454004)(3846002)(55016002)(6436002)(478600001)(229853002)(99286004)(2950100002)(81166006)(5250100002)(66066001)(3660700001)(9686003)(8676002)(68736007)(81156014)(7696005)(3280700002)(74316002)(102836004)(59450400001)(53936002)(8936002)(6246003)(5660300001)(76176011)(53546011)(106356001)(86362001)(25786009)(305945005)(2900100001)(316002)(4326008); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0701MB2107; H:HE1PR0701MB2298.eurprd07.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-microsoft-antispam-message-info: lxy2kGpvWFDWcmqJIaJZEv22/4vEfCTfIN4ESFF6oRsoZ3JDMivuan476AWwUEzYgPiz+ljP79FlEsADkh4/Yg== spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 0045f131-e846-4664-e650-08d564e2145a X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Jan 2018 17:27:30.7806 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2107 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA02SbUhTURzGOfdl3kmT05r5byLJxMLMNSVCSNSiwnwBJQLbh3LqZS51rl0T Xz603r4o2IYv06mosRQlLVPnQklnELMPakaikgYl2koJpdCsNO+uQd9+z/N/+D/nHA5DSu/Q ckanL2SNek2eQuRL1acPJEWEs7lq1UxbSLR1fZCMbu9yEPFEgrnyMZ1gt/8kUgm1b0w2m6cr Yo0nYjN8c/oqK0nD86PFzncW2oRuHy5HDAP4JLhWgsuRLyPFLxH0rPSJBOFGYJtponlB4XUC PndbCWFiI6Bj6g0piGUEzfNVu0LMiPA5mHPPI55lWAMjPR0+fAeJQ2B7MI63D+AkeNG5RQmR ZDBv/Cb5iAxHwZdX0bxN4VDo/OikeZbgDDDXmSihqpeAqvZZb5UYx0DPwBLBM8JB8GFjwbuT xAEwt9js9QFjsA9NkAL7g+fTNi3ktbBxd5wWrh8M9j+HhEgQTDVXIL4LsIMAS1MzJQyU0G9Z RQKngLNhbW9nLYLuR9kCH4f71d9EAsdAXYV1L1MAjnkTLXAirDSu7nEjCV0dt8xIZfvv2AIr YaamWiRwOLS1fiVt3rfYD2P1i1QLojqRP8dymfnaqCgla9RlcVyBXqlnC5+h3Z/h6vulciLP 8plRhBmk2CdJvJyrltKaIq4kfxQBQypkklPiXUuSrSkpZY0F14w381huFAUylCJAMnZRopZi raaQzWVZA2v8NyUYsdyEAid9Lrlr530wlfJg1mHLSu1NpdIeyqYfiVq4056whQBL5kj3JnhU 0nvjsa01ydf9Dt5YjX3dFr+pPtswIp84Erf4ffnJhVC33fV+x3IluWzyx5rcZbjqFxHXv5OY 8VTXXx5ZvbSFi6e11rK3hoywYYNhaPB8WulkGhM/nL6loLgcTeQx0shp/gI4PBAjFQMAAA== Archived-At: Subject: Re: [stir] PASSPorT: "orig" and "dest" mandatory in all PASSPorTs? X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jan 2018 17:28:16 -0000 Hi, I see in the nested divert that the new PASSporT has a claim "opt" which in= cludes the PASSporT of the originating network, including the signature.=20 The PASSporT added by the diverting network includes a claim "orig", which = is copied from the 'original' PASSporT. In this case , for a PASSporT ppt:div, the diverting network mays not have = authority over the claim "orig", but only over the claim 'div'. A verifier = will have to check the embedded PASSporT, verify the signature and check th= at the orig in the different PASSporT matches.=20 Though in another cases, if the originating number and the diverting are se= rved by the same operator, the operator has authority over both orig and di= v claims. A nested PASSporT would not be needed in this case.=20 The end result is quite similar as if we have multiple Identity headers. In= the end there are multiple PASSporT objects, the difference is how they ar= e conveyed in the signaling.=20 I assume the main reason for the embedding is because of the oob solution, = or? Regards, Julio > -----Original Message----- > From: Christer Holmberg [mailto:christer.holmberg@ericsson.com] > Sent: den 24 januari 2018 15:06 > To: Chris Wendt > Cc: stir@ietf.org > Subject: Re: [stir] PASSPorT: "orig" and "dest" mandatory in all PASSPorT= s? >=20 > Hi, >=20 > >I guess i=B9m not following what=B9s not clear, if you MUST only have on= e > >orig claim and one identity in that claim, that seems to be pretty > >clear to me that you cannot either not have an orig claim or have more > >than one. I guess maybe i=B9m missing something subtle in your point. >=20 > It is clear that you cannot have more than one claim, but I think it coul= d be > made more clear that you always must have a claim to begin with :) >=20 > >For extensions, and in general with any PASSporT, once the PASSporT is > >signed, that=B9s it, you cannot modify claims or "re-sign". If you want > >new PASSporT claim information that you want to sign, you must have a > >new PASSporT or new identity header. >=20 > Correct, I should have made that clear. >=20 > So, if you have two (or more) Identity header fields, do they all have to > contain the same =B3orig=B2 value? Or, is one allowed to change it? >=20 > Does the same apply for =B3dest=B2? And, if you want to change the =B3des= t=B2 you > need to use the divert extension? You can=B9t just add a new passport wit= h a > new =B3dest=B2 value. Or? >=20 > >Currently for divert, the approach is to embed a PASSporT inside a new > >PASSporT, which is a valid technique also and result in a new identity > >header also (but you should remove the old identity header in this case)= . >=20 > My colleague Julio sent some questions and issues regarding the > =B3embedding=B2/=B3nesting=B2 approach. I would be happy if you look at t= hose :) >=20 > Regards, >=20 > Christer >=20 >=20 > > > >-Chris > > > >> On Jan 23, 2018, at 2:19 PM, Christer Holmberg > >> wrote: > >> > >> Hi Chris, > >> > >>>> Question for clarification: > >>>> > >>>> Section 5.2.1 of draft-passport says: > >>>> > >>>> "There MUST be exactly one "orig" claim with exactly one > >>>>identity claim object in a PASSporT object." > >>>> > >>>> Q1: Does the text above mean that > >>>> > >>>> a) a passport must always contain one, one only one, "orig" > >>>>claim; or > >>>> b) that if a passport contains an "orig" claim, if can only > >>>>contains one? > >>> > >>> It can only contain one key value pair with the key =B3orig=B2 and th= e > >>>claim value can only be one identity. > >>> > >>> In other words you cannot claim to originate multiple identities > >>>with a single passport object. > >> > >> Correct. The question is whether "orig" is mandatory (alternative a) > >>or not (alternative b). But, based on your reply to Q2 below, I assume > >>the answer is alternative a). > >> > >> I think it would be good to make that more clear. > >> > >>>> Q2: If a), does it apply to passport extensions too? > >>> > >>> All extensions must include the base passport claims and follow all > >>>rules of the claims, so yes. > >> > >> I think it should be more clear whether a node can modify claims or > >>not when adding an extension, or whether an extension needs to > >>explicitly allow it. Currently the text only says (AFAIK) that claims > >>cannot be removed. > >> > >> For example, if I have a base passport, and add an RPH passport, I > >>assume I cannot change the value of the "dest" claim. I would need to > >>use a divert claim for that. > >> > >> Also, as the passports may be added and signed by different > >>authorities, and as each passport will contain the base claims, it > >>means that the base claims will be signed multiple times, and they may > >>be signed by different authorities. I assume that is ok. > >> > >> Regards, > >> > >> Christer > >> > > >=20 From nobody Tue Jan 30 14:19:01 2018 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B51212EB44 for ; Tue, 30 Jan 2018 14:19:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=team.neustar Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o6aVKy9c-Uz2 for ; Tue, 30 Jan 2018 14:18:58 -0800 (PST) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F210A12F4E2 for ; Tue, 30 Jan 2018 14:18:57 -0800 (PST) Received: from pps.filterd (m0078664.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w0UMDjm1002159; Tue, 30 Jan 2018 17:18:53 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=team.neustar; h=from : to : cc : subject : date : message-id : content-type : content-id : content-transfer-encoding : mime-version; s=selector1; bh=foHJt7Bz1bnFux1ApQ1XaRQEOiXbiaf3I0gODyS6hUI=; b=HqSDtjaQGEVsewT/vbWLvTO0z/7iwqfM2T5cuugNx5gxlczFGA2srgFmnSahwAg9i2CC 5bGlom6NvFOS/zuWFGVFD/PkMqWRKkCkc8McJBtZ1uOFBAZisjclnPV2MhjexPx2ZqTs ydRn0EJXfHNM6EVsNgBrNLs7iAmpqb1L2eBJGZYQWXKEHxVDIHBruOl750ElOnsx67S9 RCTSDPqT5gPpXWEM2Mm/R+P3cub3YS5IkdXnN+YQ86P+FO/3N6jOidZ01BIqIK00kYfM 27WjEUTvOyyicwpb3CwxYd0RL8+jWIZ9MynWWdf8e4I318WLRHRUELexGnlQldclZuB/ Pw== Received: from stntexhc12.cis.neustar.com ([156.154.17.216]) by mx0a-0018ba01.pphosted.com with ESMTP id 2frmy0xydy-1 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 30 Jan 2018 17:18:52 -0500 Received: from STNTEXMB11.cis.neustar.com ([169.254.1.47]) by stntexhc12.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Tue, 30 Jan 2018 17:18:51 -0500 From: "Peterson, Jon" To: Julio Martinez-Minguito , "Christer Holmberg" , Chris Wendt CC: "stir@ietf.org" Thread-Topic: [EXTERNAL] Re: [stir] PASSPorT: "orig" and "dest" mandatory in all PASSPorTs? Thread-Index: AQHTmhhNxwncwLCIhkCTLcv50WoH5A== Date: Tue, 30 Jan 2018 22:18:50 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.6.3.160329 x-originating-ip: [10.96.13.206] Content-Type: text/plain; charset="euc-kr" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2018-01-30_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1711220000 definitions=main-1801300271 Archived-At: Subject: Re: [stir] [EXTERNAL] Re: PASSPorT: "orig" and "dest" mandatory in all PASSPorTs? X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jan 2018 22:19:00 -0000 DQpJIGNlcnRhaW5seSBob3BlIHRoYXQgdGhlIHNlbWFudGljcyBhcmUgYmFzaWNhbGx5IHRoZSBz YW1lLCB5ZXMsIHRoYXQgdGhlDQpvbmx5IHJlYWwgZGlmZmVyZW5jZSBpcyBpbiBob3cgbmVzdGVk ICJkaXYiIGlzIGNhcnJpZWQgaW4gdGhlIHNpZ25hbGluZy4NClRoZSBtYWluIHJlYXNvbiBmb3Ig ZW1iZWRkaW5nIHJpZ2h0IG5vdyBpcyBmb3J3YXJkIGNvbXBhdGliaWxpdHkgd2l0aCBPT0IsDQpj b3JyZWN0LiBJZiB3ZSBldmVyIGRlY2lkZWQgd2Ugd2FudGVkIHRvIGJlIGFibGUgdG8gZW5jcnlw dCBQQVNTcG9yVHMNCmNhcnJpZWQgaW4tYmFuZCwgdGhpcyB3b3VsZCBhbHNvIGJlIHZlcnkgaGFu ZHkuIEluIGdlbmVyYWwgaXQgc2VlbXMgbGlrZQ0Ka2luZCBvZiBhIG51aXNhbmNlIHRvIGhhbmQg YSB2ZXJpZmljYXRpb24gc2VydmljZSBhIHBpbGUgb2YgSWRlbnRpdHkNCmhlYWRlcnMgYW5kIHNh eSAieW91IGZpZ3VyZSBvdXQgd2hhdCBnb2VzIHdpdGggd2hhdCIgLSB3aGVuIEkgc3RhcnRlZA0K cG9uZGVyaW5nIGNhc2VzIHdpdGggc3BpcmFscyBpbiBzaWduYWxpbmcsIGZvciBleGFtcGxlLCBJ IGdvdCBhIGxpdHRsZQ0Kd29ycmllZC4NCg0KVGhlIG5leHQgcmV2aXNpb24gdG8gdGhlIGRvY3Vt ZW50IGlzIGdvaW5nIHRvIHRhbGsgYSBiaXQgYWJvdXQgYW4gaXNzdWUNCnRoYXQgaGFzIGFyaXNl biBpbiBpbXBsZW1lbnRhdGlvbiAoYWxyZWFkeSkgd2l0aCB0aGUgRGl2ZXJzaW9uIGhlYWRlciBh bmQNCjN4eCByZXNwb25zZXMuIFRoZXJlIHByb2JhYmx5IHNob3VsZCBiZSBhIG1lYW5zIGZvciBh IDN4eCB0byBjYXJyeSBhDQpuZXN0ZWQgUEFTU3BvclQgaW4gdGhlIHJlc3BvbnNlIHRoYXQgY291 bGQgYmUgdHVja2VkIGludG8gYW4gSWRlbnRpdHkNCmhlYWRlciBieSBhbnkgZW50aXR5IHNlbmRp bmcgbmV3IElOVklURXMgYmFzZWQgb24gdGhlIENvbnRhY3RzIGluIHRoZSAzeHgNCi0gYnV0IHRo ZXJlIGFyZSBhIGZldyBwb3RlbnRpYWwgcGl0ZmFsbHMgdGhlcmUgd2UgbmVlZCB0byBhdm9pZCwg b3IgYXQNCmxlYXN0IGNhcmVmdWxseSBtYXJrLg0KDQpKb24gUGV0ZXJzb24NCk5ldXN0YXIsIElu Yy4NCg0KT24gMS8yNi8xOCwgOToyNyBBTSwgInN0aXIgb24gYmVoYWxmIG9mIEp1bGlvIE1hcnRp bmV6LU1pbmd1aXRvIg0KPHN0aXItYm91bmNlc0BpZXRmLm9yZyBvbiBiZWhhbGYgb2YganVsaW8u bWFydGluZXotbWluZ3VpdG9AZXJpY3Nzb24uY29tPg0Kd3JvdGU6DQoNCj5IaSwNCj4NCj5JIHNl ZSBpbiB0aGUgbmVzdGVkIGRpdmVydCB0aGF0IHRoZSBuZXcgUEFTU3BvclQgaGFzIGEgY2xhaW0g Im9wdCIgd2hpY2gNCj5pbmNsdWRlcyB0aGUgUEFTU3BvclQgb2YgdGhlIG9yaWdpbmF0aW5nIG5l dHdvcmssIGluY2x1ZGluZyB0aGUNCj5zaWduYXR1cmUuIA0KPlRoZSBQQVNTcG9yVCBhZGRlZCBi eSB0aGUgZGl2ZXJ0aW5nIG5ldHdvcmsgaW5jbHVkZXMgYSBjbGFpbSAib3JpZyIsDQo+d2hpY2gg aXMgY29waWVkIGZyb20gdGhlICdvcmlnaW5hbCcgUEFTU3BvclQuDQo+SW4gdGhpcyBjYXNlICwg Zm9yIGEgUEFTU3BvclQgcHB0OmRpdiwgdGhlIGRpdmVydGluZyBuZXR3b3JrIG1heXMgbm90DQo+ aGF2ZSBhdXRob3JpdHkgb3ZlciB0aGUgY2xhaW0gIm9yaWciLCBidXQgb25seSBvdmVyIHRoZSBj bGFpbSAnZGl2Jy4gQQ0KPnZlcmlmaWVyIHdpbGwgaGF2ZSB0byBjaGVjayB0aGUgZW1iZWRkZWQg UEFTU3BvclQsIHZlcmlmeSB0aGUgc2lnbmF0dXJlDQo+YW5kIGNoZWNrIHRoYXQgdGhlIG9yaWcg aW4gdGhlIGRpZmZlcmVudCBQQVNTcG9yVCBtYXRjaGVzLg0KPg0KPlRob3VnaCBpbiBhbm90aGVy IGNhc2VzLCBpZiB0aGUgb3JpZ2luYXRpbmcgbnVtYmVyIGFuZCB0aGUgZGl2ZXJ0aW5nIGFyZQ0K PnNlcnZlZCBieSB0aGUgc2FtZSBvcGVyYXRvciwgdGhlIG9wZXJhdG9yIGhhcyBhdXRob3JpdHkg b3ZlciBib3RoIG9yaWcNCj5hbmQgZGl2IGNsYWltcy4gQSBuZXN0ZWQgUEFTU3BvclQgd291bGQg bm90IGJlIG5lZWRlZCBpbiB0aGlzIGNhc2UuDQo+DQo+VGhlIGVuZCByZXN1bHQgaXMgcXVpdGUg c2ltaWxhciBhcyBpZiB3ZSBoYXZlIG11bHRpcGxlIElkZW50aXR5IGhlYWRlcnMuDQo+SW4gdGhl IGVuZCB0aGVyZSBhcmUgbXVsdGlwbGUgUEFTU3BvclQgb2JqZWN0cywgdGhlIGRpZmZlcmVuY2Ug aXMgaG93DQo+dGhleSBhcmUgY29udmV5ZWQgaW4gdGhlIHNpZ25hbGluZy4NCj4NCj5JIGFzc3Vt ZSB0aGUgbWFpbiByZWFzb24gZm9yIHRoZSBlbWJlZGRpbmcgaXMgYmVjYXVzZSBvZiB0aGUgb29i DQo+c29sdXRpb24sIG9yPw0KPg0KPlJlZ2FyZHMsIEp1bGlvDQo+DQo+PiAtLS0tLU9yaWdpbmFs IE1lc3NhZ2UtLS0tLQ0KPj4gRnJvbTogQ2hyaXN0ZXIgSG9sbWJlcmcgW21haWx0bzpjaHJpc3Rl ci5ob2xtYmVyZ0Blcmljc3Nvbi5jb21dDQo+PiBTZW50OiBkZW4gMjQgamFudWFyaSAyMDE4IDE1 OjA2DQo+PiBUbzogQ2hyaXMgV2VuZHQgPGNocmlzLWlldGZAY2hyaXN3ZW5kdC5uZXQ+DQo+PiBD Yzogc3RpckBpZXRmLm9yZw0KPj4gU3ViamVjdDogUmU6IFtzdGlyXSBQQVNTUG9yVDogIm9yaWci IGFuZCAiZGVzdCIgbWFuZGF0b3J5IGluIGFsbA0KPj5QQVNTUG9yVHM/DQo+PiANCj4+IEhpLA0K Pj4gDQo+PiA+SSBndWVzcyBpqfZtIG5vdCBmb2xsb3dpbmcgd2hhdKn2cyBub3QgY2xlYXIsIGlm IHlvdSBNVVNUIG9ubHkgaGF2ZSBvbmUNCj4+ID5vcmlnIGNsYWltIGFuZCBvbmUgaWRlbnRpdHkg aW4gdGhhdCBjbGFpbSwgdGhhdCBzZWVtcyB0byBiZSBwcmV0dHkNCj4+ID5jbGVhciB0byBtZSB0 aGF0IHlvdSBjYW5ub3QgZWl0aGVyIG5vdCBoYXZlIGFuIG9yaWcgY2xhaW0gb3IgaGF2ZSBtb3Jl DQo+PiA+dGhhbiBvbmUuICBJIGd1ZXNzIG1heWJlIGmp9m0gbWlzc2luZyBzb21ldGhpbmcgc3Vi dGxlIGluIHlvdXIgcG9pbnQuDQo+PiANCj4+IEl0IGlzIGNsZWFyIHRoYXQgeW91IGNhbm5vdCBo YXZlIG1vcmUgdGhhbiBvbmUgY2xhaW0sIGJ1dCBJIHRoaW5rIGl0DQo+PmNvdWxkIGJlDQo+PiBt YWRlIG1vcmUgY2xlYXIgdGhhdCB5b3UgYWx3YXlzIG11c3QgaGF2ZSBhIGNsYWltIHRvIGJlZ2lu IHdpdGggOikNCj4+IA0KPj4gPkZvciBleHRlbnNpb25zLCBhbmQgaW4gZ2VuZXJhbCB3aXRoIGFu eSBQQVNTcG9yVCwgb25jZSB0aGUgUEFTU3BvclQgaXMNCj4+ID5zaWduZWQsIHRoYXSp9nMgaXQs IHlvdSBjYW5ub3QgbW9kaWZ5IGNsYWltcyBvciAicmUtc2lnbiIuICBJZiB5b3Ugd2FudA0KPj4g Pm5ldyBQQVNTcG9yVCBjbGFpbSBpbmZvcm1hdGlvbiB0aGF0IHlvdSB3YW50IHRvIHNpZ24sIHlv dSBtdXN0IGhhdmUgYQ0KPj4gPm5ldyBQQVNTcG9yVCBvciBuZXcgaWRlbnRpdHkgaGVhZGVyLg0K Pj4gDQo+PiBDb3JyZWN0LCBJIHNob3VsZCBoYXZlIG1hZGUgdGhhdCBjbGVhci4NCj4+IA0KPj4g U28sIGlmIHlvdSBoYXZlIHR3byAob3IgbW9yZSkgSWRlbnRpdHkgaGVhZGVyIGZpZWxkcywgZG8g dGhleSBhbGwgaGF2ZQ0KPj50bw0KPj4gY29udGFpbiB0aGUgc2FtZSCp+G9yaWep9yB2YWx1ZT8g T3IsIGlzIG9uZSBhbGxvd2VkIHRvIGNoYW5nZSBpdD8NCj4+IA0KPj4gRG9lcyB0aGUgc2FtZSBh cHBseSBmb3IgqfhkZXN0qfc/IEFuZCwgaWYgeW91IHdhbnQgdG8gY2hhbmdlIHRoZSCp+GRlc3Sp 9w0KPj55b3UNCj4+IG5lZWQgdG8gdXNlIHRoZSBkaXZlcnQgZXh0ZW5zaW9uPyBZb3UgY2FuqfZ0 IGp1c3QgYWRkIGEgbmV3IHBhc3Nwb3J0DQo+PndpdGggYQ0KPj4gbmV3IKn4ZGVzdKn3IHZhbHVl LiBPcj8NCj4+IA0KPj4gPkN1cnJlbnRseSBmb3IgZGl2ZXJ0LCB0aGUgYXBwcm9hY2ggaXMgdG8g ZW1iZWQgYSBQQVNTcG9yVCBpbnNpZGUgYSBuZXcNCj4+ID5QQVNTcG9yVCwgd2hpY2ggaXMgYSB2 YWxpZCB0ZWNobmlxdWUgYWxzbyBhbmQgcmVzdWx0IGluIGEgbmV3IGlkZW50aXR5DQo+PiA+aGVh ZGVyIGFsc28gKGJ1dCB5b3Ugc2hvdWxkIHJlbW92ZSB0aGUgb2xkIGlkZW50aXR5IGhlYWRlciBp biB0aGlzDQo+PmNhc2UpLg0KPj4gDQo+PiBNeSBjb2xsZWFndWUgSnVsaW8gc2VudCBzb21lIHF1 ZXN0aW9ucyBhbmQgaXNzdWVzIHJlZ2FyZGluZyB0aGUNCj4+IKn4ZW1iZWRkaW5nqfcvqfhuZXN0 aW5nqfcgYXBwcm9hY2guIEkgd291bGQgYmUgaGFwcHkgaWYgeW91IGxvb2sgYXQgdGhvc2UgOikN Cj4+IA0KPj4gUmVnYXJkcywNCj4+IA0KPj4gQ2hyaXN0ZXINCj4+IA0KPj4gDQo+PiA+DQo+PiA+ LUNocmlzDQo+PiA+DQo+PiA+PiBPbiBKYW4gMjMsIDIwMTgsIGF0IDI6MTkgUE0sIENocmlzdGVy IEhvbG1iZXJnDQo+PiA+PjxjaHJpc3Rlci5ob2xtYmVyZ0Blcmljc3Nvbi5jb20+IHdyb3RlOg0K Pj4gPj4NCj4+ID4+IEhpIENocmlzLA0KPj4gPj4NCj4+ID4+Pj4gUXVlc3Rpb24gZm9yIGNsYXJp ZmljYXRpb246DQo+PiA+Pj4+DQo+PiA+Pj4+IFNlY3Rpb24gNS4yLjEgb2YgZHJhZnQtcGFzc3Bv cnQgc2F5czoNCj4+ID4+Pj4NCj4+ID4+Pj4gICAgICAiVGhlcmUgTVVTVCBiZSBleGFjdGx5IG9u ZSAib3JpZyIgY2xhaW0gd2l0aCBleGFjdGx5IG9uZQ0KPj4gPj4+PmlkZW50aXR5IGNsYWltIG9i amVjdCBpbiBhIFBBU1Nwb3JUIG9iamVjdC4iDQo+PiA+Pj4+DQo+PiA+Pj4+IFExOiBEb2VzIHRo ZSB0ZXh0IGFib3ZlIG1lYW4gdGhhdA0KPj4gPj4+Pg0KPj4gPj4+PiAgICAgIGEpIGEgcGFzc3Bv cnQgbXVzdCBhbHdheXMgY29udGFpbiBvbmUsIG9uZSBvbmx5IG9uZSwgIm9yaWciDQo+PiA+Pj4+ Y2xhaW07IG9yDQo+PiA+Pj4+ICAgICAgYikgdGhhdCBpZiBhIHBhc3Nwb3J0IGNvbnRhaW5zIGFu ICJvcmlnIiBjbGFpbSwgaWYgY2FuIG9ubHkNCj4+ID4+Pj5jb250YWlucyBvbmU/DQo+PiA+Pj4N Cj4+ID4+PiBJdCBjYW4gb25seSBjb250YWluIG9uZSBrZXkgdmFsdWUgcGFpciB3aXRoIHRoZSBr ZXkgqfhvcmlnqfcgYW5kIHRoZQ0KPj4gPj4+Y2xhaW0gdmFsdWUgY2FuIG9ubHkgYmUgb25lIGlk ZW50aXR5Lg0KPj4gPj4+DQo+PiA+Pj4gSW4gb3RoZXIgd29yZHMgeW91IGNhbm5vdCBjbGFpbSB0 byBvcmlnaW5hdGUgbXVsdGlwbGUgaWRlbnRpdGllcw0KPj4gPj4+d2l0aCBhIHNpbmdsZSBwYXNz cG9ydCBvYmplY3QuDQo+PiA+Pg0KPj4gPj4gQ29ycmVjdC4gVGhlIHF1ZXN0aW9uIGlzIHdoZXRo ZXIgIm9yaWciIGlzIG1hbmRhdG9yeSAoYWx0ZXJuYXRpdmUgYSkNCj4+ID4+b3Igbm90IChhbHRl cm5hdGl2ZSBiKS4gQnV0LCBiYXNlZCBvbiB5b3VyIHJlcGx5IHRvIFEyIGJlbG93LCBJIGFzc3Vt ZQ0KPj4gPj50aGUgYW5zd2VyIGlzIGFsdGVybmF0aXZlIGEpLg0KPj4gPj4NCj4+ID4+IEkgdGhp bmsgaXQgd291bGQgYmUgZ29vZCB0byBtYWtlIHRoYXQgbW9yZSBjbGVhci4NCj4+ID4+DQo+PiA+ Pj4+IFEyOiBJZiBhKSwgZG9lcyBpdCBhcHBseSB0byBwYXNzcG9ydCBleHRlbnNpb25zIHRvbz8N Cj4+ID4+Pg0KPj4gPj4+IEFsbCBleHRlbnNpb25zIG11c3QgaW5jbHVkZSB0aGUgYmFzZSBwYXNz cG9ydCBjbGFpbXMgYW5kIGZvbGxvdyBhbGwNCj4+ID4+PnJ1bGVzIG9mIHRoZSBjbGFpbXMsIHNv IHllcy4NCj4+ID4+DQo+PiA+PiBJIHRoaW5rIGl0IHNob3VsZCBiZSBtb3JlIGNsZWFyIHdoZXRo ZXIgYSBub2RlIGNhbiBtb2RpZnkgY2xhaW1zIG9yDQo+PiA+Pm5vdCB3aGVuIGFkZGluZyBhbiBl eHRlbnNpb24sIG9yIHdoZXRoZXIgYW4gZXh0ZW5zaW9uIG5lZWRzIHRvDQo+PiA+PmV4cGxpY2l0 bHkgYWxsb3cgaXQuIEN1cnJlbnRseSB0aGUgdGV4dCBvbmx5IHNheXMgKEFGQUlLKSB0aGF0IGNs YWltcw0KPj4gPj5jYW5ub3QgYmUgcmVtb3ZlZC4NCj4+ID4+DQo+PiA+PiBGb3IgZXhhbXBsZSwg aWYgSSBoYXZlIGEgYmFzZSBwYXNzcG9ydCwgYW5kIGFkZCBhbiBSUEggcGFzc3BvcnQsIEkNCj4+ ID4+YXNzdW1lIEkgY2Fubm90IGNoYW5nZSB0aGUgdmFsdWUgb2YgdGhlICJkZXN0IiBjbGFpbS4g SSB3b3VsZCBuZWVkIHRvDQo+PiA+PnVzZSBhIGRpdmVydCBjbGFpbSBmb3IgdGhhdC4NCj4+ID4+ DQo+PiA+PiBBbHNvLCBhcyB0aGUgcGFzc3BvcnRzIG1heSBiZSBhZGRlZCBhbmQgc2lnbmVkIGJ5 IGRpZmZlcmVudA0KPj4gPj5hdXRob3JpdGllcywgYW5kIGFzIGVhY2ggcGFzc3BvcnQgd2lsbCBj b250YWluIHRoZSBiYXNlIGNsYWltcywgaXQNCj4+ID4+bWVhbnMgdGhhdCB0aGUgYmFzZSBjbGFp bXMgd2lsbCBiZSBzaWduZWQgbXVsdGlwbGUgdGltZXMsIGFuZCB0aGV5IG1heQ0KPj4gPj5iZSBz aWduZWQgYnkgZGlmZmVyZW50IGF1dGhvcml0aWVzLiBJIGFzc3VtZSB0aGF0IGlzIG9rLg0KPj4g Pj4NCj4+ID4+IFJlZ2FyZHMsDQo+PiA+Pg0KPj4gPj4gQ2hyaXN0ZXINCj4+ID4+DQo+PiA+DQo+ PiANCj4NCj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0K PnN0aXIgbWFpbGluZyBsaXN0DQo+c3RpckBpZXRmLm9yZw0KPmh0dHBzOi8vdXJsZGVmZW5zZS5w cm9vZnBvaW50LmNvbS92Mi91cmw/dT1odHRwcy0zQV9fd3d3LmlldGYub3JnX21haWxtYW5fDQo+ bGlzdGluZm9fc3RpciZkPUR3SUZBdyZjPU1PcHRObFZ0SUVUZURBTENfbFVMcncmcj1kUTUxdExm b0d1dUZqYW5tZmVLQzB3ZVgNCj5ITk1sOXhabm5zSWl3UmQ2SWdZJm09Q1lFS1FldHhvWUpGV2tD WWxUalVMSTRjdVhZdHN3Yy1rc2dBTkhXT0R6MCZzPW44bjVYbg0KPkxvSEgxTjlxVlROZFdDbjVW TlVjUUlRTWFqTjIxcVRpdmJuRDgmZT0NCg0K