From nobody Wed Jul 8 09:12:38 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 994793A0F02 for ; Wed, 8 Jul 2020 09:12:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tpg5UfBFYeh9 for ; Wed, 8 Jul 2020 09:12:35 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1D6183A0EFE for ; Wed, 8 Jul 2020 09:12:35 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 8E305300B10 for ; Wed, 8 Jul 2020 12:12:32 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id eqV0dfSErVg5 for ; Wed, 8 Jul 2020 12:12:31 -0400 (EDT) Received: from a860b60074bd.fios-router.home (pool-72-66-113-56.washdc.fios.verizon.net [72.66.113.56]) by mail.smeinc.net (Postfix) with ESMTPSA id A9C4F300AA6 for ; Wed, 8 Jul 2020 12:12:31 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.14\)) Message-Id: Date: Wed, 8 Jul 2020 12:12:33 -0400 To: IETF STIR Mail List X-Mailer: Apple Mail (2.3445.104.14) Archived-At: Subject: [stir] DRAFT Agenda for STIR at IETF 108 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Jul 2020 16:12:37 -0000 Please review and comment. Russ = = = = = = STIR WG Agenda for Virtual IETF 108 0) Minute Taker, Jabber Scribe, Bluesheets 1) Agenda Bash 2) Active WG documents -- draft-ietf-stir-passport-rcd (Chris) -- draft-ietf-stir-rph-emergency-services (Martin) 3) Updates on document in WG LC -- draft-ietf-stir-cert-delegation (Jon) 4) Updates on post-WG LC documents -- draft-ietf-stir-oob (EKR and Jon) -- draft-ietf-stir-passport-divert (Jon) 5) Any Other Business (if time allows) -- draft-rosen-stir-emergency-calls (Brian) -- draft-peterson-stir-servprovider-oob (Jon) -- draft-burger-stir-iana-cert (Eric) 6) Wrap Up From nobody Mon Jul 13 07:37:30 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7732A3A125E; Mon, 13 Jul 2020 07:37:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=team.neustar header.b=ehJ7ZZ2B; dkim=pass (1024-bit key) header.d=neustar.onmicrosoft.com header.b=rdWPYMjs Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6YCHL_P1pp25; Mon, 13 Jul 2020 07:37:20 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 092133A1265; Mon, 13 Jul 2020 07:37:16 -0700 (PDT) Received: from pps.filterd (m0078664.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06DEZjPd026007; Mon, 13 Jul 2020 10:37:07 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=team.neustar; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=team-neustar; bh=Re3cJWpnrNTjYzEj2yrTN6FqeMlfIEOhxKFqV7noxxA=; b=ehJ7ZZ2BI9pteqZ3Y0LypljneN7LUnkDCWMscV1jYIY85MBJpULsKxmkxQkwkqw4fU3Q 2t+r1wCwxSZ1VKgHIlTMPCbz1XDxOebEihxuCT3ArHBaZVKthUlRyIjFGnNF7kRY75/n KR6WU+I9tjO3tKVqDfYVXQOudXFufw2i3cAmM/ly+/Fq8FyU1403bGR7c/rcN3pertxQ Ak1dAroOcoMg2n5PmM9fRLrBJ5MNPQS6Tw1YjTglEZn+N/967KixAM8smRwHklrkAoqv tVqtPKutKTDu3rdKpWNiCubprM6TOR2SLNcWlsa13nbi8ICmNEwzvJQzfUcSMK3WqW3j bw== Received: from nam10-bn7-obe.outbound.protection.outlook.com (mail-bn7nam10lp2105.outbound.protection.outlook.com [104.47.70.105]) by mx0a-0018ba01.pphosted.com with ESMTP id 32782y077b-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 13 Jul 2020 10:37:06 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=XFBhdkQqPLfPTJK+U3asXINm2ayg/ykm/elLCydiL2xWntL/PGVeeI0YtL9FF3/jw8GkbecKA6N2oQTpyiqASEwhUVUxDl+IcISoKW9pM0eAytq0/mgFNLA9hZOwr6A8UgUgLzMZDDpdKUdN0qB+EQim0WKEgGh0s6oqMw/urWREw5oBNup6/TerjjPpGVI0KX14SSPQ55KmBSOuw9vkyyYeB72mpRfHyjz4Br8G/yZWWiXJ2EWL3LgmKkBj5z8EGJ3IWKrdwgXq2gxTGL12DcAJm6FL/64rpgHeTJQVi94YuncBHK2X4Rx2w9XdymaxBciAZlByCdvEOm+9fwUgIQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Re3cJWpnrNTjYzEj2yrTN6FqeMlfIEOhxKFqV7noxxA=; b=aouAy3538ms5YvfKkBhC2lbpttAhNrYlOohhrJpg2qsPFRNJPux//FSrW/rPPRm70tu9z5XpNfT4xstAcBQTpW9a92PE6urTd/Iu2Ouf4CgyuRZaDaZAqeo1uGRFhEnEveezZRSNwCRjYTsCRrnvPDgpalx1ulAKYrJEXnB7nCC79yArYeGGwszfOWHOm4X+tku/Ii32VMd8BG6+7q0Il4mmXUaO8jz7C6bA+3+zCd7tfmupBdyZkCu2N37u73joDZqJHKIL7BDT8h0xxWK0anZDtkzHd2YW7uZ7FwCz/2BWAu66STJlSPywhGqdIci6Q8aVRaD6f4yFKzCfKlvuhg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=team.neustar; dmarc=pass action=none header.from=team.neustar; dkim=pass header.d=team.neustar; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=neustar.onmicrosoft.com; s=selector1-neustar-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Re3cJWpnrNTjYzEj2yrTN6FqeMlfIEOhxKFqV7noxxA=; b=rdWPYMjsD7gepo4Fl6lNgUU8FXoJkNOQHEOy2OpJMDO2paSIccleNS5oO/QeMs0hU0aUTiHMFg5dcCHKIPpFPTqAcAj/aYhMpfRMWn0QxCGGaEeBLmv+zQXZSOnJBxeq6862YK9NTiuzfZl0Xi286FVL/GqLh29b6adUBk7G6t0= Received: from BY5PR17MB3569.namprd17.prod.outlook.com (2603:10b6:a03:1b9::20) by BY5PR17MB3729.namprd17.prod.outlook.com (2603:10b6:a03:238::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3174.21; Mon, 13 Jul 2020 14:37:01 +0000 Received: from BY5PR17MB3569.namprd17.prod.outlook.com ([fe80::503b:2ce0:8d8b:6b15]) by BY5PR17MB3569.namprd17.prod.outlook.com ([fe80::503b:2ce0:8d8b:6b15%5]) with mapi id 15.20.3174.025; Mon, 13 Jul 2020 14:36:59 +0000 From: "Peterson, Jon" To: Pete Resnick , "gen-art@ietf.org" CC: "draft-ietf-stir-passport-divert.all@ietf.org" , "last-call@ietf.org" , "stir@ietf.org" Thread-Topic: Genart last call review of draft-ietf-stir-passport-divert-07 Thread-Index: AQHVx3m0mcGRmKiQJEu0tGGHmpn9vKkGQdMA Date: Mon, 13 Jul 2020 14:36:59 +0000 Message-ID: References: <157863541224.17236.16527868532167283650@ietfa.amsl.com> In-Reply-To: <157863541224.17236.16527868532167283650@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.17.200615 authentication-results: episteme.net; dkim=none (message not signed) header.d=none;episteme.net; dmarc=none action=none header.from=team.neustar; x-originating-ip: [2600:1700:2ec0:8108::a] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 228fa5f5-4472-4e18-ea59-08d8273a3355 x-ms-traffictypediagnostic: BY5PR17MB3729: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: frH91FJmXg/d2zKGP7Jw0T9/hfRDZmMjuw94heq5waNteQKqfjuirENU2vjv5Craykt61/NOPFQ5ri4jmf0D6nml5Npl/bRcTva6mXrbUK35d1omM/prPqOtSNlBUj2l7Rd/jLwT5JWEK9UA8DkKV7QZUZagrCiZMa//CrKe8kyIVHN/P/IUDj4AY6RbBmBEh6uEhg+1DuGlCkIhpOGRsC2qwahIpOhGe7P5GMW2eLiisbYSCebFXF+6QgzpKdL2E8mjxIXO/uprgS+0IL50CCIpigQfIl3KbE7kuT1WvbZO8DZ1vKIqdeBB3FaxGDKOjOmM4RnsG/MVp5Af9XYVPwFzmFKLIWN56yjocziRLv/Wu9nNpM/Zfng0xubyvSas x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY5PR17MB3569.namprd17.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(346002)(396003)(376002)(136003)(366004)(39860400002)(4326008)(8936002)(66946007)(64756008)(66446008)(66476007)(66556008)(110136005)(86362001)(5660300002)(54906003)(2906002)(2616005)(33656002)(71200400001)(6506007)(186003)(316002)(6486002)(6512007)(8676002)(76116006)(478600001)(46492007); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: a7JX8cA7nww9CZPfkfvrFXgG4UUPF2qwiWY92bulnIN28ACBqrm4dKlagt1scho7dgYm/gDVwaIgGNfJMBJdCnIeAHJYohiFExJ2cM6yLPfrMZiVIcbu/5Il2fRcB1HFMtLxc+S1iktHst0D6fwjryBfR2epIN2w1kg9gH2a5WT+GUDDBQ2ntwTvz0DnrCCsG+yeVHiisZyz1Cs5AMjb49G2JUM70MLUVEwD+hUvNvqYo44kqxeqeAIcjX8Mzu/HBdPG7l5lF5do/PVw/8caIfZTrtCVgzyrIo+A7y+uOra4qJTF0CCqjvAYXPGgtlQm3U8nSEnJHdIT+znMzl43TIw9mnTRsAfSrvOFeVlDGrkcJYVJ7tCB6eJdSwmIQSho16ysZ6V12Z9gdiJNaV8rE0TesRTtb1Zd3LyA9wiJfFDd9zGRmShxcwUklhHa61EK+S3M+gQhjhExMnxUmhzNiyn41QtERFj/cJgnulO7vOjzWTh5yz3rrsoF+l/tj+8fzXugHAqRK2lTV5vk4HeaWw== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: <6A460503ECFC9E48AEB76A65FFA9EF23@namprd17.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: team.neustar X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY5PR17MB3569.namprd17.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 228fa5f5-4472-4e18-ea59-08d8273a3355 X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Jul 2020 14:36:59.4580 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 73a2bbc1-f307-47c4-8f94-5f379c68bc30 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: GrKjqURWAv+v6h/YkrvY1XYSrJV1Yj2T7pCgxTr0VWqT+9MkqAWWpIvQoEFvh1dyDEycDKD9bT67oF1/hBcfADkeNe/k3Kp73hjOpmt10bk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR17MB3729 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-13_14:2020-07-13, 2020-07-13 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 malwarescore=0 bulkscore=0 adultscore=0 phishscore=0 suspectscore=0 priorityscore=1501 clxscore=1011 mlxlogscore=999 spamscore=0 lowpriorityscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007130110 Archived-At: Subject: Re: [stir] Genart last call review of draft-ietf-stir-passport-divert-07 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 14:37:22 -0000 DQpUaGFua3MgZm9yIHRoZXNlIG5vdGVzLCBQZXRlLiBJIGluY29ycG9yYXRlZCB0aGVzZSBmaXhl cyBpbnRvIHRoZSAtMDggKGJ1dCBhcHBhcmVudGx5IG5lZ2xlY3RlZCB0byB3cml0ZSBhbmQgc2F5 IHNvIGF0IHRoZSB0aW1lKS4NCg0KSm9uIFBldGVyc29uDQpOZXVzdGFyLCBJbmMuDQoNCiAgICBE b2N1bWVudDogZHJhZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LWRpdmVydC0wNw0KICAgIFJldmlld2Vy OiBQZXRlIFJlc25pY2sNCiAgICBSZXZpZXcgRGF0ZTogMjAyMC0wMS0wOQ0KICAgIElFVEYgTEMg RW5kIERhdGU6IDIwMTktMTItMDINCiAgICBJRVNHIFRlbGVjaGF0IGRhdGU6IE5vdCBzY2hlZHVs ZWQgZm9yIGEgdGVsZWNoYXQNCiAgICANCiAgICBTdW1tYXJ5OiBSZWFkeSB3aXRoIE5pdHMNCiAg ICANCiAgICBXaGlsZSBJIGZvdW5kIHRoZSBkb2N1bWVudCAoYW5kIHBhcnRpY3VsYXJseSBzZWN0 aW9uIDQpIHZlcnkgdGVjaG5pY2FsbHkgZGVuc2UsDQogICAgSSB0aGluayB0aGUgZGV0YWlsIHdp bGwgaGVscCBpbXBsZW1lbnRlcnMgdHJlbWVuZG91c2x5LiBOb3RoaW5nIG90aGVyIHRoYW4gYQ0K ICAgIGZldyBlZGl0b3JpYWwgaXNzdWVzLg0KICAgIA0KICAgIE1ham9yIGlzc3VlczogTm9uZQ0K ICAgIA0KICAgIE1pbm9yIGlzc3VlczogTm9uZQ0KICAgIA0KICAgIE5pdHMvZWRpdG9yaWFsIGNv bW1lbnRzOg0KICAgIA0KICAgIFNlY3Rpb24gMywgcGFyYWdyYXBoIDE6DQogICAgDQogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgTm90ZSB0aGF0DQogICAgICAgYSBuZXcgUEFTU3BvclQgaXMgb25seSBuZWNlc3Nhcnkgd2hl biB0aGUgY2Fub25pY2FsIGZvcm0gb2YgdGhlDQogICAgICAgImRlc3QiIGlkZW50aWZpZXIgKHBl ciB0aGUgY2Fub25pY2FsaXphdGlvbiBwcm9jZWR1cmVzIGluIFtSRkM4MjI0XQ0KICAgICAgIFNl Y3Rpb24gOCkgY2hhbmdlcyBkdWUgdG8gdGhpcyByZXRhcmdldGluZy4gIElmIHRoZSBjYW5vbmlj YWwgZm9ybSBvZg0KICAgICAgIHRoZSAiZGVzdCIgaWRlbnRpZmlpZXIgaXMgbm90IGNoYW5nZWQg ZHVyaW5nIHJldGFyZ2V0aW5nLCB0aGVuIGEgbmV3DQogICAgICAgUEFTU3BvclQgd2l0aCBhICJk aXYiIGNsYWltIE1VU1QgTk9UIGJlIHByb2R1Y2VkLg0KICAgIA0KICAgIFNlZW1zIHRvIG1lIHRo YXQgdGhlc2UgdHdvIHNlbnRlbmNlcyBzaG91bGQgYmUgaW4gdGhlaXIgb3duIHBhcmFncmFwaC4g SXQgdG9vaw0KICAgIG1lIGEgc2Vjb25kIHRvIGZpZ3VyZSBvdXQgdGhhdCB0aGUgZm9sbG93aW5n IHNlbnRlbmNlIHdhcyBub3QgcmVsYXRlZCB0byB0aGVzZS4NCiAgICANCiAgICBTZWN0aW9uIDQ6 DQogICAgDQogICAgICAgLi4uT3RoZXIgdXNpbmcgcHJvdG9jb2xzIG9mIFBBU1Nwb3JUDQogICAg DQogICAgRG9uJ3QgeW91IG1lYW4gIk90aGVyIHByb3RvY29scyB1c2luZyBQQVNTcG9yVCI/DQog ICAgDQogICAgU2VjdGlvbiA0LjIsIHBhcmFncmFwaCAyOg0KICAgIA0KICAgIEkgdGhpbmsgeW91 IG1lYW4gIm5lY2Vzc2FyaWx5Iiwgbm90ICJuZWNlc3NhcnkiDQogICAgDQogICAgDQogICAgDQoN Cg== From nobody Mon Jul 13 07:42:09 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 813F93A126A; Mon, 13 Jul 2020 07:42:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=team.neustar header.b=GKkrOnh4; dkim=pass (1024-bit key) header.d=neustar.onmicrosoft.com header.b=astdnJPb Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3PARnIE-UdHJ; Mon, 13 Jul 2020 07:42:02 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F01083A125E; Mon, 13 Jul 2020 07:42:01 -0700 (PDT) Received: from pps.filterd (m0078668.ppops.net [127.0.0.1]) by mx0b-0018ba01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06DEWUMP008845; Mon, 13 Jul 2020 10:41:58 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=team.neustar; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=team-neustar; bh=2XEwmWEyOl/qYanQc3U7VXCxSiRqmLc20r9BYt3UAT8=; b=GKkrOnh4GVt9eD/yXe49eQNe/AtVEGXGKqaj+d0yhnlaC1pCNfHpkSJlMH/CjaCrZjmh 8qxC0xFrieMagqbhNZpKOQVtgiMzjq+YcHprv1VLzWnyWlMmdQ1FQEw76ZDH8DfWcnJ5 K/G6GIBa2uOqTl4ld+6SKrN06LJjJ4RAs7KCA7YgVNMtGt1XdkOnJ3ywPUNeFZdjrHe4 6RiUC4cRUUjGdyDw8GCX4O8DpJtnNGtZ/amYNilCBmM5JLB2m8tIBRx8FNmW0oaBUaJK rGjSpKP0atjzwak805DlA5UGxYNWeq1kocjDyJrFPp506m73D+W8go8NTBiXit2bWWOg 7g== Received: from nam04-bn3-obe.outbound.protection.outlook.com (mail-bn3nam04lp2052.outbound.protection.outlook.com [104.47.46.52]) by mx0b-0018ba01.pphosted.com with ESMTP id 327yu7csxy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 13 Jul 2020 10:41:58 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=UdR/eW94Std6N9qa7ez0Gv5LUzaUBkMFCeh6DYYIJgLIxWsYX6YkvOfLI/IetIHxDJOc4pluD9h4YoTYb2XJzOLvw+G3nrO8UPT0BE/so1m6rmNBrt/pxf/kthEd5/DhxnhAkJaGkx4ctyp6ANmzOjWDtzEX+AC0N/z9sjTMbzXOnBqitbPazILEEoGgCa+Bq1GubpbEzFoudCsXPRyrkd4Qq3VdwpFXJcxEjkPoIhrrw7HKAJWzgU7R+oznaSx2NFDP1jzQAxV0DkgIM9LpzNhHjtUoJHJiLzzc0unrjkiOg5gV/UBjmQYTVBD5NJkCjvNdc1hRIaMWgo0aFqAViQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2XEwmWEyOl/qYanQc3U7VXCxSiRqmLc20r9BYt3UAT8=; b=lWcgvpfUgjDXhTBCsMg1fYyiGhvZMEY7tfuuXQdlNREU6gjG0YfMk5suMd4H73xxVyjYcRsM2W90dVOFl5exk3lBu2izjXbcllGRh2P2vG+LK5DklOWXwmD9b16HT4u8+2s1AVFKh1GJxSTcYX1Vae6/u/JgHzRncrMFP5jrpt/mn5kS/yVbJ+wkVuPilEcF1LhmGNrH6UBdo5qm8/sbA4fL264SKW5D3q3r8xRFvuT2H8mMy7o02piKcVvO1kWLm4Tp9+pSPaoO4kGIGZcyYf3cPQGal6Lj8DMUcyqvH524wwd8FUPBD+eOuDkHcjwzkKwwfwEFfktjwjpjy3+BQQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=team.neustar; dmarc=pass action=none header.from=team.neustar; dkim=pass header.d=team.neustar; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=neustar.onmicrosoft.com; s=selector1-neustar-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2XEwmWEyOl/qYanQc3U7VXCxSiRqmLc20r9BYt3UAT8=; b=astdnJPbvXf8PGI0uB8gd20hQ3vyUk5DpUIyxfdtsBU8i3oonKL+iu0ScsioG5gs4QuxqpKCEuKWsYPhkVTSTCgeLsLl4eEQfzOpFf39KM8eMKjLNkznfAPPhYUXhRy9PXiaqmBaERStIs4kMGmJjo0yB5eJvK9IzCiDnTwEso0= Received: from BY5PR17MB3569.namprd17.prod.outlook.com (2603:10b6:a03:1b9::20) by BYAPR17MB2936.namprd17.prod.outlook.com (2603:10b6:a03:f1::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3174.24; Mon, 13 Jul 2020 14:41:57 +0000 Received: from BY5PR17MB3569.namprd17.prod.outlook.com ([fe80::503b:2ce0:8d8b:6b15]) by BY5PR17MB3569.namprd17.prod.outlook.com ([fe80::503b:2ce0:8d8b:6b15%5]) with mapi id 15.20.3174.025; Mon, 13 Jul 2020 14:41:57 +0000 From: "Peterson, Jon" To: Roman Danyliw , The IESG CC: "draft-ietf-stir-passport-divert@ietf.org" , "stir-chairs@ietf.org" , "stir@ietf.org" , Russ Housley Thread-Topic: Roman Danyliw's Discuss on draft-ietf-stir-passport-divert-08: (with DISCUSS and COMMENT) Thread-Index: AQHWDROzQ4rLFGadBUmiB+nphvW6J6iBpTSA Date: Mon, 13 Jul 2020 14:41:56 +0000 Message-ID: <905688A3-7259-4AE3-8AF5-22102A1FF1B6@team.neustar> References: <158628812675.31223.5976532284560812662@ietfa.amsl.com> In-Reply-To: <158628812675.31223.5976532284560812662@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.17.200615 authentication-results: cert.org; dkim=none (message not signed) header.d=none;cert.org; dmarc=none action=none header.from=team.neustar; x-originating-ip: [2600:1700:2ec0:8108::a] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: cd5dc680-4788-405f-2dca-08d8273ae4b6 x-ms-traffictypediagnostic: BYAPR17MB2936: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: OFoacjr3o26sGnxWqFXRVf7D7Y3hEy2kd88d549tvFRc6Xv4zZ03rVhIPwInOEuSCovrooHz0n9z8/9l5fTeKhM+0Ust0kbBcH9pGC8YCVXBsST7GvM6A/LinONsJ8W3pp/P076fPVEPpYYJoxTrAhl8EKjMDcHMjnp7fQAMbkXKFwhAUPfo1F3lS2f8rsB8bn7CjaeoomsrGbJiTjNmdgBzANEY3MqTa1L8ubHkhOW5yRACnxPFBH/Q2NghSr6Ie4YxxSclKI+nziOMYxGOjOmOXurJw9+ZxlwwFT1a7DOxpmgeDy/RjdM+IFDYK25C+QLPo+hAx8+bkW9gC3SOQYysXdr8MugIheJQwowryZywNjFszYZbRygezc7RRCw2 x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY5PR17MB3569.namprd17.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(366004)(396003)(39860400002)(376002)(136003)(346002)(33656002)(66446008)(64756008)(66556008)(66476007)(66946007)(76116006)(6512007)(186003)(71200400001)(6506007)(2906002)(86362001)(8936002)(6486002)(316002)(110136005)(54906003)(478600001)(5660300002)(83380400001)(4326008)(2616005)(8676002)(46492007); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: DB6K5xDhWukHi8Lyg/GKc+OuRCrKckG9sYvQb74c4ybzRqhO5IpkWVG+25tnjscTmpHAjPqNdnfm+RVGJ5W6c1cQzyEpOVWdmyH0gfXgs9WQpDL4FnDoCUWDd9KhP4jHk4k+coqmAqFYzjA/nRh/KWJUMO5ttnNQGZoLc5MBxAt6WBGyHI8v5SIjO3QgllB42Dm4E3i/ZDojPv1wGUNExVgKmXq62mROIkLEjk/0EjRBZj7plsemv/MnwW2VUqYTQcTH+ZMwbpsa4AW1hGkyW/HKZspHUNJdXy7MD/ObcpOEnbendWXmdpxH2vKCxCm8RXoug8T8Ts/pB7DeX4ww4xFgNY4KEDejVKi3M7HNh1XOQWTwtAAyek9NnEwMPhsfByoc6WSsdvaTeiYjeb00uz1W3N1j9SWbN/87Vuwa34vq8WFqYYMel61IZzOhEIPE29geOPfmL5XnV4uHurzDvCdrXc/qpQr8YpcX5YDvp9P5ElQNA0JqwwyDS8QKLHhzvpTyJtcSOBIwYvY9/qGjeQ== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: team.neustar X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY5PR17MB3569.namprd17.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: cd5dc680-4788-405f-2dca-08d8273ae4b6 X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Jul 2020 14:41:57.0746 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 73a2bbc1-f307-47c4-8f94-5f379c68bc30 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: OQjk8hKCt1NJyfrwA+YtYknLlJLdMj1NotSsnvmg4TKUoKwCRTx0nzVkkRK3+uWK1R/VLcCp2AM2s88kOM9XcfIibUk+8NPf9v2TTBxHO88= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR17MB2936 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-13_14:2020-07-13, 2020-07-13 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 clxscore=1011 priorityscore=1501 suspectscore=0 mlxlogscore=773 phishscore=0 bulkscore=0 impostorscore=0 lowpriorityscore=0 adultscore=0 mlxscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007130109 Archived-At: Subject: Re: [stir] Roman Danyliw's Discuss on draft-ietf-stir-passport-divert-08: (with DISCUSS and COMMENT) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 14:42:04 -0000 DQpIaSBSb21hbiwNCg0KVGhhbmtzIGZvciB0aGUgbm90ZXMgb24gdGhpczsgc29ycnkgZm9yIHRh a2luZyBhIHdoaWxlIHRvIGdldCBhcm91bmQgdG8gdGhlbS4NCg0KICAgIFJvbWFuIERhbnlsaXcg aGFzIGVudGVyZWQgdGhlIGZvbGxvd2luZyBiYWxsb3QgcG9zaXRpb24gZm9yDQogICAgZHJhZnQt aWV0Zi1zdGlyLXBhc3Nwb3J0LWRpdmVydC0wODogRGlzY3Vzcw0KICAgIA0KICAgIC0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0NCiAgICBESVNDVVNTOg0KICAgIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiAgICANCiAgICBTZWN0aW9u IDUuICBUaGUgdGV4dCBub3RlcyB0aGF0IHByb2NlZHVyZXMgZm9yIHRoZSBhdXRoZW50aWNhdGlv biBhbmQNCiAgICB2ZXJpZmljYXRpb24gc2VydmljZSBmb3IgdGhlIOKAnGRpdi1v4oCdIGNsYWlt IHdpbGwgYmUg4oCcbGVmdCB0byBmdXR1cmUgd29ya+KAnS4gIENhbg0KICAgIHRoZSByYXRpb25h bCBmb3IgdGhpcyBkZWZlcnJhbCBiZSBleHBsYWluZWQuICBDcmVhdGluZyBhbiBpbnRlcm9wZXJh YmxlDQogICAgc29sdXRpb24gd2l0aG91dCB0aGlzIGd1aWRhbmNlIHNlZW0gY2hhbGxlbmdpbmcg YXMgaXQgd291bGQgYmUgY3J1Y2lhbCBndWlkYW5jZQ0KICAgIG9uIHByb2Nlc3NpbmcgdGhpcyBu ZXdseSBpbnRyb2R1Y2VkIGNsYWltLg0KDQpUaGlzIC0wOCB0ZXh0IG1vc3RseSByZXN1bHRlZCBm cm9tIGEgcHJvY2VzcyBtYXR0ZXIuIFRvIGdldCBpbnRvIHRoZSBkb2N1bWVudCBoaXN0b3J5IGEg Yml0LCB3aGVuIHdlIG1vdmVkIHN0aXItb29iIG9mZiB0aGUgU3RhbmRhcmRzIFRyYWNrIHRvIGFu IEluZm9ybWF0aW9uYWwgaW4gdGhlIGxhdGUgc3RhZ2VzIG9mIGl0cyBkZXZlbG9wbWVudCwgd2Ug c3RpbGwgd2FudGVkICJkaXYiIHRvIGJlIGZ1dHVyZS1wcm9vZiB3aGVuL2lmIHN0YW5kYXJkcy10 cmFjayB3b3JrIGJhc2VkIG9uIHRoZSBPT0IgZnJhbWV3b3JrIHJvbGxlZCBhcm91bmQgKGxpa2Ug Zm9yIGV4YW1wbGUgdGhlIG5ldyBPT0Igc2VydnByb3ZpZGVyIGRyYWZ0IGluIFNUSVIpLiBPdXIg c29sdXRpb24gd2FzIHRvIHVwbGV2ZWw6IHRvIHNwZWNpZnkgImRpdi1vIiBhcyBzb21ldGhpbmcg bm90IHNwZWNpZmljYWxseSBjb3VwbGVkIHRvIE9PQiwgYnV0IGluc3RlYWQgYXMgYSBnZW5lcmFs IG1lY2hhbmlzbSB0aGF0IGNvdWxkIGJlIHVzZWQgYnkgT09CIG9yIG90aGVyIHByb3RvY29scyB0 aGF0IG1pZ2h0IHByZWZlciB0byB1c2UgbmVzdGVkICJkaXYtbyIgc3R5bGUgUEFTU3BvclRzLiBU aGF0IGlzbid0IGFuIGVudGlyZWx5IGN5bmljYWwgbW92ZSwgYXMgd2UgYW50aWNpcGF0ZSB0aGF0 IHByb3RvY29scyBvdGhlciB0aGFuIFNJUCB3aWxsIHVzZSB0aGUgUEFTU3BvclQgbWVjaGFuaXNt LCBhbmQgbWlnaHQgd2FudCB0byB1c2UgdGhlIG5lc3RlZCBhcHByb2FjaCBvZiAiZGl2LW8iLg0K DQpJIHRoaW5rIHdpdGhpbiB0aG9zZSBjb25zdHJhaW50cywgSSBjYW4gdGhyZWFkIHRoZSBuZWVk bGUgd2l0aCBzb21lIHVzZWZ1bCB0ZXh0IGFib3V0IHRoZSBub24tU0lQIEFTL1ZTIGJlaGF2aW9y IGFzc29jaWF0ZWQgd2l0aCB0aGUgY3JlYXRpb24gb2YgImRpdi1vIiBQQVNTcG9yVHMgaW4gYSB3 YXkgdGhhdCBtYWtlcyBubyBleHBsaWNpdCByZWZlcmVuY2UgdG8gT09CIGFzIHN1Y2gsIGJ1dCB3 b3VsZCBhcHBseSBlcXVhbGx5IGlmIHNheSBYTVBQIG9yIFJUQ1dlYiBvciBzb21lIHNpbWlsYXIg bWVjaGFuaXNtIHdhbnRlZCB0byBtYWtlIHVzZSBvZiBQQVNTcG9yVCBhbmQgbmVzdGVkICJkaXYi LiBJJ3ZlIGFkZGVkIHNvbWUgdGV4dCB0byB0aGlzIGVmZmVjdCwgd2hpY2ggSSBob3BlIGlzIHN1 ZmZpY2llbnQgLSBsZXQgbWUga25vdyBpZiBpdCBpc24ndC4NCiAgICANCiAgICAtLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tDQogICAgQ09NTUVOVDoNCiAgICAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQogICAgDQogICAgUGxlYXNlIHJl c3BvbmQgdG8gUGhpbGxpcCBIYWxsYW0tQmFrZXIgU0VDRElSIHJldmlldyAodGhhbmtzIFBoaWxs aXAhKQ0KDQpEb25lLg0KICAgIA0KICAgICoqIFNlY3Rpb24gNC4xLiAgUGVyIOKAnFByb3ZpZGVk IHRoYXQgdGhlc2UgUEFTU3BvclRzIHNoYXJlIHRoZSBzYW1lICJvcmlnIiBhbmQNCiAgICAiZGVz dCIgdmFsdWVzLCB0aGUgcmV0YXJnZXRpbmcgZW50aXR5J3MgYXV0aGVudGljYXRpb24gc2Vydmlj ZSBTSE9VTEQgZ2VuZXJhdGUNCiAgICBvbmx5IG9uZSAiZGl2IiBQQVNTcG9yVOKAnSwgd2h5IG5v dCAgTVVTVCBoZXJlPyAgV2hhdOKAmXMgdGhlIGNvcm5lciBjYXNlPw0KDQpPbmUgY29ybmVyIGNh c2UgSSBjYW4gaW1hZ2luZSBpcyB3aGVyZSBkaXZlcnRzIGZyb20gc3BlY2lhbC11c2UgUEFTU3Bv clRzIG5lZWQgdG8gYmUgc2lnbmVkIHdpdGggYSBjZXJ0aWZpY2F0ZSBpc3N1ZWQgYnkgYSBvbmUt b2ZmIHRydXN0IGFuY2hvci4gU2F5LCBkdWUgdG8gdGhlIGdvdmVybm1lbnQgcG9saWN5IGNvbnN0 cmFpbnRzIG9mIHRoZSAicnBoIiBoZWFkZXIgb3Igc29tZXRoaW5nIHNpbWlsYXIsIHlvdSBuZWVk IHRvIHNpZ24gYSAiZGl2IiBmb3IgaXRzIFBBU1Nwb3JUIHdpdGggYSBkaWZmZXJlbnQgY3JlZGVu dGlhbCB0aGFuIHlvdSB3b3VsZCB1c2UgdG8gc2lnbiBhICJkaXYiIGZvciBvcmRpbmFyeSBjYXJy aWVyIGNhbGxzLiBOb3QgYSBjb21tb24gY2FzZSwgYnV0LCBJIGRvbid0IHdhbnQgdG8gY2xvc2Ug dGhlIGRvb3Igb24gaXQuDQogICAgDQogICAgKiogU2VjdGlvbiA0LjIuICBQZXIg4oCcSG93ZXZl ciwgbm90ZSB0aGF0IGluIHNvbWUgdXNlIGNhc2VzLCBpbmNsdWRpbmcgIGNlcnRhaW4NCiAgICB3 YXlzIHRoYXQgYmxpbmQgdHJhbnNmZXIgaXMgaW1wbGVtZW50ZWQsIGl0IGlzIHBvc3NpYmxlIHRo YXQgYW4gZXN0YWJsaXNoZWQNCiAgICBjYWxsIHdpbGwgYmUgcmV0YXJnZXRlZCBsb25nIGFmdGVy IGl0IGhhcyBvcmlnaW5hbGx5IGJlZW4gcGxhY2VkLCBhbmQNCiAgICB2ZXJpZmljYXRpb24gc2Vy dmljZXMgbWF5IHdhbnQgdG8gYWxsb3cgYSBsb25nZXIgd2luZG93IGZvciB0aGUgZnJlc2huZXNz IG9mDQogICAgdGhlIGlubmVybW9zdCBQQVNTcG9yVCBpZiB0aGUgY2FsbCBpcyB0cmFuc2ZlcnJl ZCBmcm9tIGEgdHJ1c3RlZCBwYXJ0eS7igJ0sIGFyZQ0KICAgIHRoZXJlIGFueSByZWNvbW1lbmRh dGlvbnMgb3IgYm91bmRzIHRoYXQgY2FuIGJlIHBsYWNlZCBvbiB0aGUgZHVyYXRpb24gb2YgdGhp cw0KICAgIOKAnGxvbmdlciB3aW5kb3cgb2YgZnJlc2huZXNz4oCdPw0KDQpVbmZvcnR1bmF0ZWx5 LCBub3Qgb25lcyB0aGF0IGFyZSBpbW1lbnNlbHkgdXNlZnVsIC0gbWF5YmUgbGlrZSAzIGhvdXJz PyBBdHRlbmRlZCB0cmFuc2ZlciBzZXJ2aWNlcyBjYW4gYmUgdHJpZ2dlcmVkIGFueSB0aW1lIGlu dG8gYSBjYWxsIC0gaWYgeW91J3ZlIGV2ZXIgZ29uZSB0aHJvdWdoIGVzY2FsYXRpb24gd2l0aCBh IGJhbmsgY29tcGFueSBjdXN0b21lciBzZXJ2aWNlIGxpbmUsIHlvdSd2ZSBwcm9iYWJseSBleHBl cmllbmNlZCBtdWx0aXBsZSBzdWNoIHRyYW5zZmVycyBkdXJpbmcgYSBzaW5nbGUgY2FsbCB3aGlj aCBiZWdpbnMgd2l0aCB5b3UgYmVpbmcgb24gaG9sZCBmb3IgNDUgbWludXRlcywgYW5kIHlvdSBj YW4gZWFzaWx5IHNwZW5kIHRlbiBtaW51dGVzIHRhbGtpbmcgdG8gb25lIGFnZW50IGJlZm9yZSB5 b3UgZW5kIHVwIG9uIHRoZSBsaW5lIHdpdGggYW5vdGhlci4gSSB0aGluayB0aGUgInRydXN0ZWQg cGFydHkiIHBvcnRpb24gaGVyZSBpcyB0aGUgc2lnbmlmaWNhbnQgYml0IC0gdGhhdCByZWx5aW5n IHBhcnRpZXMgc2hvdWxkIG9ubHkgYWNjZXB0IHRoZXNlIGtpbmRzIG9mIHN0YWxlIFBBU1Nwb3JU cyB3aXRoaW4gYSBjbG9zZWQgY2lyY2xlIG9mIHRydXN0LiBTdGlsbCwgY2FsbHMgZG9uJ3QgbGFz dCBmb3IgbGlrZSBhIHdlZWssIHNvIHRoZXJlIG11c3QgYmUgc29tZSB1cHBlciBib3VuZCBoZXJl LiBJIGNhbiBwdXQgaW4gMyBob3VycyBhcyBhIHNvZnQgcmVjb21tZW5kYXRpb24sIEkgZ3Vlc3Ms IGlmIGl0IGhlbHBzLi4uDQogICAgDQogICAgKiogRWRpdG9yaWFsIE5pdDoNCiAgICANCiAgICAt LSBTZWN0aW9uIDMuIFR5cG8uIHMvaWRlbnRpZmlpZXIvaWRlbnRpZmllci8NCiAgICANCkZpeGVk LiBUaGFua3MhDQoNCkpvbiBQZXRlcnNvbg0KTmV1c3RhciwgSW5jLg0KICAgIA0KICAgIA0KICAg IA0KDQoNCg== From nobody Mon Jul 13 07:42:21 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4EC203A125E; Mon, 13 Jul 2020 07:42:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=team.neustar header.b=r3g38XB/; dkim=pass (1024-bit key) header.d=neustar.onmicrosoft.com header.b=Y4Dy5In5 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fT4dx3Ndf3l4; Mon, 13 Jul 2020 07:42:12 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 140253A1312; Mon, 13 Jul 2020 07:42:11 -0700 (PDT) Received: from pps.filterd (m0078668.ppops.net [127.0.0.1]) by mx0b-0018ba01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06DEWUqp008832; Mon, 13 Jul 2020 10:42:10 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=team.neustar; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=team-neustar; bh=qx+HbSiSeyVe3nnGBOeF18QZa8wRqqbrp0UJQlv1f/U=; b=r3g38XB/kPqr0T75bgcpaWEeKs8bfNPQqGsPCUh4o1PksJ0RoIGgq8WAmuuuVqaLThzc QzIi8ndcbTdv5cS+Y2xJP9yPgh+Hv8zbPHEOI1jdJesaiPvlM1HnE90xAr5YRr5sRGh5 +mpfIX56ufW2DCw723We9ZIRiCM3d//fT9Lgtj8Ad3i8+u0ePqc0FXZLWLpCOQJMzNfd HSIqQXdcNoTd7Qsn+cqaslSmLTZ+k7++vzrH9UodvQsOtw9tIcbyaOuPwbNvlUzsveSG JwfFINR+cCyClEpGx88PIATuF5v/wfvvrXXtjStD9Jy/2jl8T1IfdelFhHskbdXZ3E8e zw== Received: from nam04-bn3-obe.outbound.protection.outlook.com (mail-bn3nam04lp2057.outbound.protection.outlook.com [104.47.46.57]) by mx0b-0018ba01.pphosted.com with ESMTP id 327yu7csye-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 13 Jul 2020 10:42:09 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=BFeN/cIfDdn5WtCSWM+ykBNiJNbmSjzaw0qtqJuVYwpUKHn6cZJtRaowxpIy/w2I6vucQhAsucIUjJ0wz2DIEjSjmDEyYQq8TveobdVkVviXGznR49l9f//DZFdIQORmm4AZaxvc0zModcq60Aa/UJlpYCGqEFNaz5thzi/bHtMEQa3QTqF57PQ7hZ/KQ+4tH4TTElBmAJd08HrgS/oWBu8E8J7gAHIj9/xeFBYZQKUQdUDAafTS1del8C6spO13n29jK+5Mh4GT0kF2BkQ5DgcsBB8s+la9/diRgpxEtDbRCt3OKmzxkv+35jNi6QUhHFM+QGta8nW16VQeG4sn0w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qx+HbSiSeyVe3nnGBOeF18QZa8wRqqbrp0UJQlv1f/U=; b=Qvwpi09PgTgq4/PvZpqKInEeGqLE1VnJq3U/Q4o1/VnRXotG2HigQ2Q354eUpX8u4+Nl3y45lT7KnbP5Qo3+SSiCvCzqmv8so8AfHfX2GoSJJBdu5Sryux3C2+TM6e/wOqsoXgT1FRxv8mZ2LH4+l3B09t1CDmubALHYmevIRfynptdhAIrl4+ThFU6uEyy2e0gp2XaNksrz741TTz8uQBHuZUTHWKoWxIQS10hFAZ+sO50/FkF0wYeZvRQeQj7AakRXx19aC+djW4z7SudYB5OhDuKfPzKEP6ljfrAQzQ1GuAhXHgreFBCBWR4uRh4cuzICCVzU0/zI8CBe1j7Yfg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=team.neustar; dmarc=pass action=none header.from=team.neustar; dkim=pass header.d=team.neustar; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=neustar.onmicrosoft.com; s=selector1-neustar-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qx+HbSiSeyVe3nnGBOeF18QZa8wRqqbrp0UJQlv1f/U=; b=Y4Dy5In5bGJ714rMb0jeh879E6wVj7y7ocqSxWhCcn0nRBCswsjJX2/cOFuIQbJmvQ1TJ3yZ6X83oZpcXHZO5tI5+aZl/LFV3fRS2Gu9k2XooPJC4AiBGWIiJlrMy2eGdGGYN3KJDN4r4XNSkm8HJ5u4D8GQkBCOl4oBMcQa7l8= Received: from BY5PR17MB3569.namprd17.prod.outlook.com (2603:10b6:a03:1b9::20) by BYAPR17MB2936.namprd17.prod.outlook.com (2603:10b6:a03:f1::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3174.24; Mon, 13 Jul 2020 14:42:08 +0000 Received: from BY5PR17MB3569.namprd17.prod.outlook.com ([fe80::503b:2ce0:8d8b:6b15]) by BY5PR17MB3569.namprd17.prod.outlook.com ([fe80::503b:2ce0:8d8b:6b15%5]) with mapi id 15.20.3174.025; Mon, 13 Jul 2020 14:42:08 +0000 From: "Peterson, Jon" To: Phillip Hallam-Baker , "secdir@ietf.org" CC: "draft-ietf-stir-passport-divert.all@ietf.org" , "last-call@ietf.org" , "stir@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-stir-passport-divert-07 Thread-Index: AQHVp+v5WPXkxkGne0msFPVEb41+CaiCb34A Date: Mon, 13 Jul 2020 14:42:08 +0000 Message-ID: <564C75D1-43C3-4B09-922A-55994C96B686@team.neustar> References: <157516602555.14564.17709496168683829956@ietfa.amsl.com> In-Reply-To: <157516602555.14564.17709496168683829956@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.17.200615 authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=team.neustar; x-originating-ip: [2600:1700:2ec0:8108::a] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 9e3c50fb-4d78-4217-94cc-08d8273aebac x-ms-traffictypediagnostic: BYAPR17MB2936: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: hnCM+5Yd4RywtjB+UFqj0iCR3ac9EhD0SQwjtr7L+rXMtokICxERA/ZsbOQP08MbzwLaEP8QHY5vKMgIUf3kRRhP4IunXZL1OS54o1LfvaLWlfW+B01CdUJonl3mujQAxkqz6uIY5dbsRUV7nf2WQaGfQqBHxOxdswdCCY60HVU/P7hVMELKJ9jHTmFKad524iBgNV28jqBAe2z8jOEGRrIHiUZRQLvBXyfhiS5fxo5/ua/05ZGyLu3g9CAQnEl8QcQjSCcVUYVKTX7wWhShjKiYkwWppMJVdEwxT2EI0f7UIHMQEtRjWk9aVaCJUDPtq7UNp+BKETZDXXOPr+ZJ99O/AzitIFTC6IkUQdlRh/ZhzmwGISJrPIBTIAU6IRxY x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY5PR17MB3569.namprd17.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(366004)(396003)(39860400002)(376002)(136003)(346002)(33656002)(66446008)(64756008)(66556008)(66476007)(66946007)(76116006)(6512007)(186003)(71200400001)(6506007)(2906002)(53546011)(86362001)(8936002)(6486002)(316002)(110136005)(54906003)(478600001)(5660300002)(83380400001)(4326008)(2616005)(8676002)(46492007); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: u0SQFVG1558cWJr//t6AoHt78rJ3lJ4QI0RfApKj9+iHVz/THf4inANCX/OdPFR77WU7T8Oxj0Rd/EW9cdkw3AzD4Y6JPClqk1ze4/o7n1CRJdjpPaMcqa7LHei1r/yzAkhiwp1GGgyYVNmkcy25cwloIHFKpaSNYPUZDI98dwIMb5HtzqBHJth6iaHj1ysb00uEv0LTM/5HQYZaALDmb8IZuBE8zT/18Rp0NJ8cLLlCoAFl3+D2rFi5FiT3NP25t5+aU01/cuG6iIuenwGHX0YjWin7e3EtVaPax0DKh1UUCzjIw9hOT7Fg2MHlH3hey/HLbSeubVvEGYMuqVhazIzcL3ntt7alcGdaExMz9d0ii+QPzoKh+esIzA5jcxppQdiy8NGhgvy2I8Bree7y1wWiCt3Cemln6Tx0qHKcds/sr/5t8eCeb4yA630q7cRv625jxpJVHHW6wPr9awro6EogymfSON+OGwTdOBYMBQo3rwX/R3i/ltuLatDA1xPid+pPeLPFhxM4weBd9wdyNw== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: team.neustar X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY5PR17MB3569.namprd17.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9e3c50fb-4d78-4217-94cc-08d8273aebac X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Jul 2020 14:42:08.6948 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 73a2bbc1-f307-47c4-8f94-5f379c68bc30 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 6SaYo3Rfx1jwZdYFKsBD7ZkstWobmZWyeSczJbduNkR/rPvLWfrn2jwYrLoemaCQ71J8aR1+GgIhJKZiRZ9V4yd3Lwf3sH6C8XPIrIF1nwk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR17MB2936 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-13_14:2020-07-13, 2020-07-13 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 clxscore=1011 priorityscore=1501 suspectscore=0 mlxlogscore=999 phishscore=0 bulkscore=0 impostorscore=0 lowpriorityscore=0 adultscore=0 mlxscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007130109 Archived-At: Subject: Re: [stir] Secdir last call review of draft-ietf-stir-passport-divert-07 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 14:42:13 -0000 DQpUaGFua3MgZm9yIHRoZXNlIG5vdGVzIFBoaWxsaXAuIEkgYWRkZWQgc29tZSB0ZXh0IHRvIGFk ZHJlc3MgeW91ciBzZWNvbmQgcG9pbnQgdG8gdGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIHRl eHQuIEFzIHRvIHRoZSBmaXJzdCwgcmVnYXJkaW5nIEFsaWNlIGFuZCBCb2IsIEkgYmVsaWV2ZSB0 aGUgdXNhZ2UgaGVyZSBpcyBjb25zaXN0ZW50IHdpdGggSUVURiBwcmFjdGljZSwgYXMgbWlzZ3Vp ZGVkIGFzIHRoYXQgbWF5IGJlLCBhbmQgSSBkb24ndCB0aGluayBhbWVuZGluZyBpdCB3b3VsZCBj bGFyaWZ5IGFueXRoaW5nLg0KIA0KSm9uIFBldGVyc29uDQpOZXVzdGFyLCBJbmMuDQoNCk9uIDEx LzMwLzE5LCA2OjA2IFBNLCAiUGhpbGxpcCBIYWxsYW0tQmFrZXIgdmlhIERhdGF0cmFja2VyIiA8 bm9yZXBseUBpZXRmLm9yZz4gd3JvdGU6DQoNCiAgICBSZXZpZXdlcjogUGhpbGxpcCBIYWxsYW0t QmFrZXINCiAgICBSZXZpZXcgcmVzdWx0OiBIYXMgSXNzdWVzDQogICAgDQogICAgU2VjdGlvbiAx OiBJbnRyb2R1Y3Rpb24NCiAgICANCiAgICAiSWYgQWxpY2UgY2FsbHMgQm9iLCBmb3IgZXhhbXBs ZSwgQm9iIG1pZ2h0IGF0dGVtcHQgdG8gLi4uIg0KICAgIA0KICAgIEFsaWNlLCBCb2IgYW5kIENh cm9sIGFyZSBwZW9wbGUuIFBlb3BsZSBkbyBub3QgZW1pdCBKU09OIHN0cmluZ3MsIGNyZWF0ZQ0K ICAgIHNpZ25hdHVyZXMgb3IgZG8gYW55IG9mIHRoZSB0aGluZ3MgdGhleSBhcmUgZGVzY3JpYmVk IGFzIGJlaW5nIGVuZ2FnZWQgaW4uIE9ubHkNCiAgICB0aGUgbWFjaGluZXMgdGhlIHBlb3BsZSBt aWdodCBwb3NzZXNzIGNhbiBkbyBzdWNoIHRoaW5ncy4gQW50aHJvcG9tb3JwaGlzaW5nDQogICAg VHVyaW5nIG1hY2hpbmVzIHJlc3VsdHMgaW4gbGFuZ3VhZ2UgdGhhdCBpcyBoYXJkIHRvIGZvbGxv dyBhdCBiZXN0IGFuZCByZW5kZXJzDQogICAgYW55IGF0dGVtcHQgdG8gY29uc2lkZXIgVUkgaXNz dWVzIGltcG9zc2libGUuDQogICAgDQogICAgU2VjdGlvbiAxMjogU2VjdXJpdHkgQ29uc2lkZXJh dGlvbnMNCiAgICANCiAgICBJcyB0aGlzIGdvaW5nIHRvIGNyZWF0ZSBuZXcgbWVhbnMgb2YgaW5q ZWN0aW5nIHNwYW0/IEl0IGxvb2tzIGxpa2UgaXQgbWlnaHQuDQogICAgQ29uc2lkZXIgdGhlIGNh c2UgaW4gd2hpY2ggU3VlIHRoZSBzcGFtbWVyIHNldHMgdXAgYSBzaW5nbGUgZ2VudWluZSBjYWxs DQogICAgYmV0d2VlbiBYIGFuZCBZLCB0aGVuIGNyZWF0ZXMgZm9yd2FyZGluZyBhc3NvY2lhdGlv bnMgZm9yIDEwLDAwMCBlbmRwb2ludHMNCiAgICBaMC05OTk5LiBBbHNvIGNvbnNpZGVyIHJlZmxl Y3Rpb24gdHlwZSBhdHRhY2tzIGluIHdoaWNoIGNhbGxlcnMgcmVzcG9uZGluZyB0bw0KICAgIHNw YW0gaGF2ZSB0aGVpciBudW1iZXJzIGhhcnZlc3RlZCBmb3Igc3Bvb2Ygc291cmNlIGFkZHJlc3Nl cyBmb3IgZnVydGhlciBzcGFtLg0KICAgIA0KICAgIA0KDQoNCg== From nobody Mon Jul 13 07:46:12 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4718C3A0B3B; Mon, 13 Jul 2020 07:46:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=team.neustar header.b=xvb6IJwC; dkim=pass (1024-bit key) header.d=neustar.onmicrosoft.com header.b=kKDYF9Qx Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T6rW4tEaBTMQ; Mon, 13 Jul 2020 07:46:08 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 816253A12C1; Mon, 13 Jul 2020 07:45:48 -0700 (PDT) Received: from pps.filterd (m0078664.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06DEZjR6026007; Mon, 13 Jul 2020 10:45:48 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=team.neustar; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=team-neustar; bh=YFwnZye5udrY12y1Q3+ozVNLSNa5/FatDLFe5pd1cNI=; b=xvb6IJwCXa9AMqSCiHy6Za7U3zMOUNduTdkQXiv9p1Otf0MBtrIeJ/scui7UD5NkDn6J elU9f9lLiZ6Sa/72mc6h4QzTkNDPdVD865nMXHvdc0eKPJGx7YovsPtKVqG7NX85f0se Ysqz4/cJh20WRDNA1QDje9gqDGDQhW626D1HtDWTuh9gWEYWFT0kjUzG27Orud60BTQq BiBmdYJmc8VdJSkyKxWzLkIwjVPPZv8aaCxR59bTMQMY8pGTsfzC9870kkwJs/lBH6VD VXLvElUcHHEqHxwLHahOl+XB9Kentof892pdv611akNN1WaMh8AsU47EJyPHbGjzyiCA Rw== Received: from nam12-mw2-obe.outbound.protection.outlook.com (mail-mw2nam12lp2041.outbound.protection.outlook.com [104.47.66.41]) by mx0a-0018ba01.pphosted.com with ESMTP id 32782y0889-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 13 Jul 2020 10:45:47 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ZPyxZ19NiXPhUquuGlIsEDv3IfSfklWrKK5hxOwbpnOKI8jP+/ui33bY7LbO7xf0tJNb9TPamr/51C37GoNcNWTI3TCWuog/yqz4wMitatfkx7pMFPy+kAFHLR1MC1XQe3KyE/ItTwwTckq3AR3RVk4LJAVdG86Rdq8IsUeVQhfWsAOunfElVJQ3uI1qnYiUxI25IYgowThE/NfVXjBwXAl64j04SWzRuTvvoDvbZVN4B4yYFn9Ee9OCE+myb/RcoFSCt9FdTxudXwSJU8F15IOUfIV8TFZoNhEgyKSiPL2V4+VaC1oYNqd7m0GTo5WTLiYbxHarHBvu/MBVK6pmAA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YFwnZye5udrY12y1Q3+ozVNLSNa5/FatDLFe5pd1cNI=; b=MXeqmliequ3r0ZNownp14AkKLXR79GPMGk9HXATQc2FkWtcYciWEZhuUa96a4CRbR97/wrdBw/6oGeVi2P31qeEn5ZvIPagYGJpF0jQ6erm0VyLSSkAEqVrk2mP3Ud2kczhnDTbrEcdaKAGY8/ePjoPdsUfXsH/zcKj6XDmjaznODFZlmoQRjEwK7IcYdR0vLJGmV+Ic26K5EA5m+kBnYYskpgTuNmq8z7rXIBsznoagLjEdFgQV4xhXUuCDFCtvOb9bsbEjgZaBiABj2fwLcnFB1e76GzhhU/nGxE9731YEtPoiuwHon0UNqQZC9TgvJZHNjvPkUW/UyvXQjHZnBg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=team.neustar; dmarc=pass action=none header.from=team.neustar; dkim=pass header.d=team.neustar; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=neustar.onmicrosoft.com; s=selector1-neustar-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YFwnZye5udrY12y1Q3+ozVNLSNa5/FatDLFe5pd1cNI=; b=kKDYF9QxF+Xed8aPODDCxZEGO3DsmwgD3t8Bw2yAx1Wkzw4bunlHnBU2dXSCZsSLLqFkSXQLXp/c4oP1/8j4VsxurWBfPcBLJVeZy2bvFn/2f2jH5Eh+MHnFZA+GulNwP2JX0nfRs27bHDKbQr0kFVEH47Fr7MXbzgqLphGt0jc= Received: from BY5PR17MB3569.namprd17.prod.outlook.com (2603:10b6:a03:1b9::20) by BYAPR17MB2936.namprd17.prod.outlook.com (2603:10b6:a03:f1::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3174.24; Mon, 13 Jul 2020 14:45:45 +0000 Received: from BY5PR17MB3569.namprd17.prod.outlook.com ([fe80::503b:2ce0:8d8b:6b15]) by BY5PR17MB3569.namprd17.prod.outlook.com ([fe80::503b:2ce0:8d8b:6b15%5]) with mapi id 15.20.3174.025; Mon, 13 Jul 2020 14:45:45 +0000 From: "Peterson, Jon" To: Benjamin Kaduk , The IESG CC: "draft-ietf-stir-passport-divert@ietf.org" , "stir-chairs@ietf.org" , "stir@ietf.org" , Russ Housley Thread-Topic: Benjamin Kaduk's Discuss on draft-ietf-stir-passport-divert-08: (with DISCUSS and COMMENT) Thread-Index: AQHWDR6y9VQMiGMDt0WwEGQLqYAuEKkFuPwA Date: Mon, 13 Jul 2020 14:45:45 +0000 Message-ID: <8F32C3AA-F3D7-4A46-8B7B-77BEE8CE857F@team.neustar> References: <158629284778.13900.16643796031182034257@ietfa.amsl.com> In-Reply-To: <158629284778.13900.16643796031182034257@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.17.200615 authentication-results: mit.edu; dkim=none (message not signed) header.d=none;mit.edu; dmarc=none action=none header.from=team.neustar; x-originating-ip: [2600:1700:2ec0:8108::a] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 65ddd9b0-718b-4ec9-743f-08d8273b6cd9 x-ms-traffictypediagnostic: BYAPR17MB2936: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: IZ2xBPen85W1lS1nVoPP8KomQa+S/2UKGUmrPBwS6BJp3eo3do+zkmsWB7LxNlgKajwINxXhMANyHQsIyadXQCCEzNxnAs6K87ufYDvv9/oFEkH+RxBsDFxP9fc8xxt0xx3aBZPLrSX46kLJzNdbOZsFNQm25oF0KXwjx5ECTEAN4LaAvNOwi45F3qr8x9rMowpTxOBG2rUNbgmPN1dnh5BGh8UYoPh5D6orqxwqtg4z7VAYUGzwkMaQHINbRL0nF4sJAXiU8r5t7ndE/KNcrg7ENd1S/Ruip+fCcq31DlD7gLUDd313rmvXun3I5AeCsCAv8iTOno7DrVrO3kocCJJrlGXPJzRMgazuOP2jrw+LNMxyPa++U6IjaoAZtSJE x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY5PR17MB3569.namprd17.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(366004)(396003)(39860400002)(376002)(136003)(346002)(33656002)(66446008)(64756008)(66556008)(66476007)(66946007)(76116006)(6512007)(186003)(71200400001)(6506007)(2906002)(86362001)(8936002)(6486002)(316002)(110136005)(54906003)(478600001)(5660300002)(83380400001)(4326008)(30864003)(2616005)(8676002)(46492007); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: mSygE5SD8ly/wOse8wvCIShHIsMVJvMqePsryVkIWOBVbeiO2JolxY3BeluiGoJC0clt0O6lk0f8xZxu+nx2BfKJG0j45AtfZow61D2PQAk9YtWEQZBySBSZ6jvPvdIXAL/nhtqRxtHpa/kEwCk4P5ZG3YZT1V6XHmHp24lqPPLlgrPRPL4m5IkRn/7UzW2ff8swliiJp5RRpTDq3wWrZpXec0zZttSdKijCqZXTxm5SL84J16LnzcZEYawh19rbYQjb80KB4YUv2Q2GxfYEibpZQV6XQR5g8sDwDgqmLbbg+4GZlEuxe5H9M1TeRVGRou6W8eFy8txC/aGBbyrcjXmv8mcdpmyR8Nod2ZNadMhoYKxRqahLQrnDB1f4bDQpdq6S0YYNJTLw5vFyhfZ/wuD9OMX7lxU8NP7ks7IjchPaPlqN5FLcsJsACa9gtHGVq/fJGlnv7ru6qa/sbTKH3DK5+qP2QJKUHSULSoD1M14Ph2xK3KPFB0MM3lvtFo+s1z0PGj7KLqeuXQanpPkBSw== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: team.neustar X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY5PR17MB3569.namprd17.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 65ddd9b0-718b-4ec9-743f-08d8273b6cd9 X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Jul 2020 14:45:45.4889 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 73a2bbc1-f307-47c4-8f94-5f379c68bc30 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: mWgTLBgBtVE8uDgC6HujL1P3cXaAzwqRN8/qMX3vwKMBmmZusNRe7eHrdyiWHinMuwak6gq7dS1LK7uIAVj4XQ1CGK/tFxg5dzYDs9LpryE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR17MB2936 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-13_14:2020-07-13, 2020-07-13 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 malwarescore=0 bulkscore=0 adultscore=0 phishscore=0 suspectscore=0 priorityscore=1501 clxscore=1011 mlxlogscore=999 spamscore=0 lowpriorityscore=0 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007130110 Archived-At: Subject: Re: [stir] Benjamin Kaduk's Discuss on draft-ietf-stir-passport-divert-08: (with DISCUSS and COMMENT) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 14:46:10 -0000 DQpIaSBCZW5qYW1pbiwNCg0KVGhhbmtzIGZvciB0aGUgdGhvcm91Z2ggcmV2aWV3IG9mIGRpdmVy dC0wOCAoYW5kIGFwb2xvZ2llcyBmb3IgdGhlIGxvbmcgUlRUKToNCg0K77u/T24gNC83LzIwLCAx OjU0IFBNLCAiQmVuamFtaW4gS2FkdWsgdmlhIERhdGF0cmFja2VyIiA8bm9yZXBseUBpZXRmLm9y Zz4gd3JvdGU6ICAgIA0KICAgIA0KICAgIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiAgICBESVNDVVNTOg0KICAg IC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0NCiAgICANCiAgICBJIHN1cHBvcnQgUm9tYW4ncyBEaXNjdXNzLiAgSXNu J3QgdGhlcmUgYSBzdHJhaWdodGZvcndhcmQgdHJhbnNsYXRpb24gb2YNCiAgICB0aGUgImRpdiIg cHJvY2VkdXJlcyB0byB0aGUgbmVzdGVkICJkaXYtbyIgY2hhaW4/ICBXaHkgd291bGQgdGhhdCBu b3QgYmUNCiAgICBhcHBsaWNhYmxlPw0KDQpTZWUgbXkgcmVzcG9uc2UgdG8gUm9tYW4sIGJ1dCB5 ZXMsIEkgYWdyZWUgaXQncyBkZXNpZ25lZCB0byBiZSBhIHJlbGF0aXZlbHkgc3RyYWlnaHRmb3J3 YXJkIHRyYW5zbGF0aW9uLCBhbmQgSSd2ZSBmbGVzaGVkIHRoYXQgb3V0IGEgYml0Lg0KICAgIA0K ICAgIEkgaGFkIHR3byBvdGhlciBwb2ludHMgZm9yIGRpc2N1c3Npb246DQogICAgDQogICAgKDEp IElBTkEgc2VlbXMgdW5oYXBweSAodGhlIGV4cGVydCByZXZpZXcgaWRlbnRpZmllZCBpc3N1ZXMp LiAgV2hhdCdzIHRoZQ0KICAgIHBsYW4gdG8gYWRkcmVzcyB0aGVtPw0KICAgIA0KV2UndmUgZm9s bG93ZWQgdXAgd2l0aCB0aGVtLCB0aGUgY2hhbmdlcyB0aGV5IHByb3Bvc2VkIGFyZSBmaW5lLCBh bmQgYXJlIGluIHRoZSBuZXcgdmVyc2lvbiBvZiB0aGUgZG9jdW1lbnQuDQoNCiAgICAoMikgVGhl IGZvbGxvd2luZyB0ZXh0IGZyb20gdGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIHNlZW1zIGlu Y29uc2lzdGVudA0KICAgIHRvIG1lOg0KICAgIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBIb3dldmVyLA0KICAgICAgIGluY2x1 ZGluZyB0aGlzIGluZm9ybWF0aW9uIGFib3V0IGZvcndhcmRpbmcgaXMgYXQgdGhlIGRpc2NyZXRp b24gb2YNCiAgICAgICB0aGUgcmV0YXJnZXRpbmcgZW50aXR5LCBzbyBpZiB0aGVyZSBpcyBhIHJl cXVpcmVtZW50IHRvIGtlZXAgdGhlDQogICAgICAgb3JpZ2luYWwgY2FsbGVkIG51bWJlciBjb25m aWRlbnRpYWwsIG5vIFBBU1Nwb3JUIHNob3VsZCBiZSBjcmVhdGVkDQogICAgICAgZm9yIHRoYXQg cmV0YXJnZXRpbmcgLSB0aGUgb25seSBjb25zZXF1ZW5jZSB3aWxsIGJlIHRoYXQgZG93bnN0cmVh bQ0KICAgICAgIGVudGl0aWVzIHdpbGwgYmUgdW5hYmxlIHRvIGNvcnJlbGF0ZSBhbiBpbmNvbWlu ZyBjYWxsIHdpdGggdGhlDQogICAgICAgb3JpZ2luYWwgUEFTU3BvclQgd2l0aG91dCBhY2Nlc3Mg dG8gc29tZSBwcmlvciBrbm93bGVkZ2Ugb2YgdGhlDQogICAgICAgcG9saWNpZXMgdGhhdCBjb3Vs ZCBoYXZlIGNhdXNlZCB0aGUgcmV0YXJnZXRpbmcuDQogICAgDQogICAgSSBkb24ndCB1bmRlcnN0 YW5kIHRoaXMgLS0gaWYgdGhlIGlkZWEgaXMgdG8ga2VlcCB0aGUgb3JpZ2luYWwgY2FsbGVkDQog ICAgbnVtYmVyIGNvbmZpZGVudGlhbCwgd291bGRuJ3QgdGhpcyBuZWNlc3NpdGF0ZSAqbm90IGdp dmluZyB0aGUgb3JpZ2luYWwNCiAgICBQQVNTcG9yVCB0byB0aGUgY2FsbGVkIGVudGl0eSosIHNp bmNlIHRoZSBvcmlnaW5hbCBQQVNTcG9yVCBpbmNsdWRlcyB0aGUNCiAgICBvcmlnaW5hbCBjYWxs IGRlc3RpbmF0aW9uPyAgV2l0aG91dCB0aGUgb3JpZ2luYWwgUEFTU3BvclQgYXQgYWxsLCBvZg0K ICAgIGNvdXJzZSBpdCBjYW4ndCBiZSBjb3JyZWxhdGVkIHRvIGFuIGluY29taW5nIGNhbGwuLi4g IChFdmVuIGluIHRoZSBPT0INCiAgICBjYXNlLCB3b3VsZCB0aGUgcG9zdC1yZXRhcmdldGluZyBj YWxsZWQgZW50aXR5IGV2ZW4gYmUgYWJsZSB0bw0KICAgIHJldHJpZXZlL2RlY3J5cHQgdGhlIG9y aWdpbmFsIFBBU1Nwb3JUPykgIElzIHRoaXMgaW50ZW5kZWQgdG8gb25seSBhcHBseQ0KICAgIHRv IHNvbWUgbm9uLVNJUCBjYXNlPw0KDQpUaGlzIHBhcmFncmFwaCBpcyB0cnlpbmcgdG8gcmVmZXIg YXQgYSBoaWdoIGxldmVsIHRvIGNhc2VzIHdoZXJlIGNvbXBsaWNhdGVkIHRoaW5ncyBhcmUgZ29p bmcgb24gd2l0aCB0aGUgY2FsbGVkIG51bWJlciwgbGlrZSBzYXksIHN1YnN0aXR1dGluZyBpdCBm b3IgYW4gTVNSTiBpbiByb2FtaW5nIG1vYmlsZSB0ZWxlcGhvbmUgY2FzZXMsIHdoZXJlIHNvbWUg aW50ZXJtZWRpYXRlIGlkZW50aWZpZXIgaXMsIGZyb20gdGhlIHBlcnNwZWN0aXZlIG9mIHRoZSBk aXZlcnRpbmcgYXV0aGVudGljYXRpb24gc2VydmljZSwgdGhlICJvcmlnaW5hbCIgY2FsbGVkIG51 bWJlci4gU29tZSB3YXlzIHRoYXQgbnVtYmVyIHBvcnRhYmlsaXR5IHdvcmtzIHdvdWxkIGJlIGNv bXBhcmFibGUgZm9yIGxhbmRsaW5lIGNhbGwgcm91dGluZy4gSSB0aGluayB0aGUgcHJvYmxlbSB0 aGVyZSBpcyB0aGUgd29yZCAib3JpZ2luYWwiIC0gd2hhdCBJIG1lYW4gaXMgdGhlIGNhbGxlZCBu dW1iZXIgdGhhdCB0aGUgZGl2ZXJ0aW5nIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2Ugc2Vlcywgbm90 IHRoZSBjb250ZW50cyBvZiB0aGUgIm9yaWciIGluIHRoZSBvcmlnaW5hbCBQQVNTcG9yVC4gSSds bCByZXBsYWNlICJvcmlnaW5hbCIgd2l0aCAiYW4gaW50ZXJtZWRpYXRlIi4NCiAgICANCiAgICAt LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tDQogICAgQ09NTUVOVDoNCiAgICAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQogICAgDQogICAg V2hpbGUgaXQgbG9va3MgbGlrZSB0aGUgbWFpbiBjaGFuZ2UgaW4gdGhlIC0wOCBpcyBpbnRlbmRl ZCB0byBhZGRyZXNzDQogICAgdGhlIHNlY2RpciByZXZpZXdlcidzIGNvbW1lbnQsIGl0IHdvdWxk IGJlIG5pY2UgdG8gcmVzcG9uZCB0byB0aGUgcmV2aWV3DQogICAgYW5kIG1lbnRpb24gdGhlIG5l dyB0ZXh0Lg0KDQpXaWxsIGRvLg0KICAgIA0KICAgIERvIHdlIG5lZWQgdG8gc2F5IHNvbWV0aGlu ZyBhYm91dCB3aGl0ZXNwYWNlIGJlaW5nIGFkZGVkIHRvIGV4YW1wbGVzIGZvcg0KICAgIHJlYWRh YmlsaXR5Pw0KICAgIA0KV2UncmUgZGVhbGluZyBoZXJlIHdpdGggSlNPTiBvYmplY3RzIGFuZCBo ZWFkZXIgZmllbGQgdmFsdWVzIHRoYXQgYXJlIGdlbmVyYWxseSByZW5kZXJlZCB0byBodW1hbnMg d2l0aCBzb21lIHdoaXRlc3BhY2UgaW4gdGhlbSwgSSBkb24ndCB0aGluayBvdXIgdHJlYXRtZW50 IGlzIHVudXN1YWwuDQoNCiAgICBTZWN0aW9uIDENCiAgICANCiAgICBJcyB0aGVyZSBhbiBpbnRl bmRlZCBtbmVtb25pYyBmb3IgdGhlICJvcHQiIGVsZW1lbnQ/ICAoIk9yaWdpbmFsDQogICAgcGFz c3BvcnQiPykNCg0KWWVzLCBhZGRlZCBleGFjdGx5IHRoYXQuDQogICAgDQogICAgRG8gImRpdi1v IiBQQVNTcG9yVHMgbmVjZXNzYXJpbHkgY2FycnkgYm90aCAiZGl2IiBhbmQgIm9wdCIsIG9yIGlz ICJvcHQiDQogICAgaW50ZW5kZWQgdG8gYmUgYWJsZSB0byBzdGFuZCBhbG9uZSBpbiBhICJkaXYt byIgUEFTU3BvclQ/DQoNCkkgYmVsaWV2ZSB3ZSBjbGFyaWZ5IHRoYXQgd2hlbiB3ZSBkaXNjdXNz ICJkaXYtbyIsIGJ1dCAiZGl2LW8iIFBBU1Nwb3JUcyBjb250YWluIGJvdGggYSAiZGl2IiBhbmQg YW4gIm9wdCIuDQogICAgDQogICAgU2VjdGlvbiAzDQogICAgDQogICAgICAgY2Fub25pY2FsIGZv cm0gb2YgdGhlICJkZXN0IiBpZGVudGlmaWllciBpcyBub3QgY2hhbmdlZCBkdXJpbmcNCiAgICAN CiAgICBuaXQ6IHMvaWRlbnRpZmlpZXIvaWRlbnRpZmllci8NCg0KRml4ZWQuDQogICAgDQogICAg ICAgQSAiZGl2IiBQQVNTcG9yVCBjbGFpbXMgc2V0IGlzIHBvcHVsYXRlZCB3aXRoIGVsZW1lbnRz IGRyYXduIGZyb20gdGhlDQogICAgICAgUEFTU3BvclQocykgcmVjZWl2ZWQgZm9yIGEgY2FsbCBi eSB0aGUgcmV0YXJnZXRpbmcgZW50aXR5OiBhdCBhIGhpZ2gNCiAgICANCiAgICBXaGVuIHdvdWxk IHRoZXJlIGJlIG11bHRpcGxlIHJlY2VpdmVkIFBBU1Nwb3JUcyB0aGF0IGFsbCBhcmUgaW5wdXQg dG8NCiAgICB0aGUgc2FtZSAiZGl2IiBQQVNTcG9yVD8NCg0KVGhlcmUgY2FuIGJlIG11bHRpcGxl IFBBU1Nwb3JUcyBjb250YWluZWQgaW4gdGhlIHNhbWUgU0lQIHJlcXVlc3QsIGZvciBleGFtcGxl IGluIGNhc2VzIHdoZXJlIHRoZXJlIGlzIG9uZSBzaWduZWQgYnkgdGhlIG9yaWdpbmF0aW5nIGNh cnJpZXIgYW5kIGFub3RoZXIgc2lnbmVkIHdpdGggYSBzcGVjaWFsIGdvdmVybm1lbnQgInJwaCIg ZmllbGQgKHdoaWNoIGhhcyBhbiBpbmRlcGVuZGVudCB0cnVzdCBhbmNob3IpLCBldmVuIHRob3Vn aCB0aGUgdHdvIFBBU1Nwb3JUcyBzaGFyZSB0aGUgc2FtZSAiZGVzdCIgYW5kICJvcmlnIiwgYXMg aXMgZGlzY3Vzc2VkIGluIFNlY3Rpb24gNC4xLg0KDQogICAgQWxzbywgdGhlIGxhdGVyIGRpc2N1 c3Npb24gdGhhdCBpbmRpY2F0ZXMgb25seSBhIHNtYWxsIG51bWJlciBvZg0KICAgIGNsYWltcy9l eHRlbnNpb25zIGFyZSBjb3BpZWQgZnJvbSB0aGUgb3JpZ2luYWwgUEFTU3BvclQgKGFuZCB0aGF0 ICJpYXQiDQogICAgbWlnaHQgY2hhbmdlISkgc3VnZ2VzdHMgdGhhdCBwZXJoYXBzIHRoZSAiaXMg cG9wdWxhdGVkIHdpdGgiIGxhbmd1YWdlDQogICAgY291bGQgYmUgdHdlYWtlZC4NCg0KSSB0aGlu ayAiYXQgYSBoaWdoIGxldmVsIiBpbmRpY2F0ZXMgdGhhdCB3ZSBhcmUgaGVyZSBqdXN0IHRyeWlu ZyB0byBjb252ZXkgdGhlIGJhc2ljIGdpc3QuDQogICAgDQogICAgICAgbGV2ZWwsIHRoZSBvcmln aW5hbCBpZGVudGlmaWVyIGZvciB0aGUgY2FsbGVkIHBhcnR5IGluIHRoZSAiZGVzdCINCiAgICAg ICBvYmplY3Qgd2lsbCBiZWNvbWUgdGhlICJkaXYiIGNsYWltIGluIHRoZSBuZXcgUEFTU3BvclQu ICBJZiB0aGUNCiAgICANCiAgICBUaGlzICJ3aWxsIGJlY29tZSIgbGFuZ3VhZ2Ugc2VlbXMgYSBi aXQgcHJvYmxlbWF0aWMgd2hlbiBjb21iaW5lZCB3aXRoDQogICAgdGhlIGRlZmluaXRpb24gaW4g U2VjdGlvbiA4IG9mIGFuICJoaSIgZWxlbWVudCB3aXRoaW4gdGhlICJkaXYiIGNsYWltLA0KICAg IHdoaWNoIGlzIG5vdCBwYXJ0IG9mIHRoZSAib3JpZ2luYWwgaWRlbnRpZmllciBmb3IgdGhlIGNh bGxlZCBwYXJ0eSIuDQoNClNhbWUgY29tbWVudC0gImF0IGEgaGlnaCBsZXZlbCIsIHRoZSAiZGVz dCIgcG9wdWxhdGVzIHRoZSAiZGl2Ii4gSSBkbyBub3QgdGhpbmsgaXQgd291bGQgaGVscCB0aGUg cmVhZGVyJ3MgdW5kZXJzdGFuZGluZyB0byBlbmN1bWJlciB0aGlzIGludHJvZHVjdG9yeSBzZW50 ZW5jZSB3aXRoIGNvcm5lciBjYXNlcyBhbmQgZXhjZXB0aW9ucy4NCiAgICANCiAgICAgICBUaGUg Y29tYmluZWQgZnVsbCBmb3JtIFBBU1Nwb3JUICh3aXRoIGEgc2lnbmF0dXJlIGNvdmVyZWQgYnkg dGhlDQogICAgICAgRVMyNTYga2V5cyBnaXZlbiBpbiBBcHBlbmRpeCBBKSB3b3VsZCBsb29rIGFz IGZvbGxvd3M6DQogICAgDQogICAgICAgIGV5SmhiR2NpT2lKRlV6STFOaUlzSW5Cd2RDSTZJbVJw ZGlJc0luUjVjQ0k2SW5CaGMzTndiM0owSWl3aWVEVjFJaiBcDQogICAgICAgIG9pYUhSMGNITTZM eTkzZDNjdVpYaGhiWEJzWlM1amIyMHZZMlZ5ZEM1alpYSWlmUS5leUprWlhOMElqcDdJblJ1SSBc DQogICAgICAgIGpwYklqRXlNVFUxTlRVeE1qRTBJbDE5TENKa2FYWWlPbnNpZEc0aU9pSXhNakUx TlRVMU5URXlNVE1pZlN3aWFXRiBcDQogICAgICAgIDBJam94TkRRek1qQTRNelExTENKdmNtbG5J anA3SW5SdUlqb2lNVEl4TlRVMU5URXlNVElpZlgwLnhCSFdpcERFRSBcDQogICAgICAgIEo4YTZU c2RYNnhVWEFuYmxzRmlHVWlBeHdMaXYwSExDOUlJQ2o2ZUc5alFkNld6ZVNTakhSQnd4bUNoSGhW SWlNVCBcDQogICAgICAgIFNxSWxrM3lDTmtnDQogICAgDQogICAgKFRoZSBkZWNvZGVkIGNsYWlt cyBzZXQgaXMgc29ydGVkLCB0aG91Z2ggdGhlIHByZXZpb3VzIGRpc3BsYXktZm9ybQ0KICAgIGV4 YW1wbGUgd2FzIGluIGEgZGlmZmVyZW50IG9yZGVyLikNCg0KSSdsbCBmaXggdGhhdC4NCiAgICAN CiAgICBTZWN0aW9uIDQNCiAgICANCiAgICAgICBUaGlzIHNlY3Rpb24gc3BlY2lmaWVzIFNJUC1z cGVjaWZpYyB1c2FnZSBmb3IgdGhlICJkaXYiIFBBU1Nwb3JUIHR5cGUNCiAgICAgICBhbmQgaXRz IGhhbmRsaW5nIGluIHRoZSBTSVAgSWRlbnRpdHkgaGVhZGVyIGZpZWxkICJwcHQiIHBhcmFtZXRl cg0KICAgICAgIHZhbHVlLiAgT3RoZXIgcHJvdG9jb2xzIHVzaW5nIFBBU1Nwb3JUIG1heSBkZWZp bmUgYmVoYXZpb3Igc3BlY2lmaWMNCiAgICAgICB0byB0aGVpciB1c2Ugb2YgdGhlICJkaXYiIGNs YWltLg0KICAgIA0KICAgIElzIHRoZSBsYXN0IGxpbmUgc3VwcG9zZWQgdG8gYmUgImNsYWltIiBv ciAiUEFTU3BvclQgdHlwZSI/DQoNCkkgZG9uJ3QgdGhpbmsgdGhlIGRpc3RpbmN0aW9uIHBhcnRp Y3VsYXJseSBtYXR0ZXJzIGZvciB0aGUgcHVycG9zZXMgb2YgdGhpcyBzdGF0ZW1lbnQuICJkaXYi IGNsYWltcyBhcmUgbm90IHVzZWQgb3V0c2lkZSBvZiAiZGl2IiAob3IgImRpdi1vIikgUEFTU3Bv clRzLiBJIGd1ZXNzIHRoZSBleGlzdGVuY2Ugb2YgImRpdi1vIiBpcyBhIGRlY2VudCByZWFzb24g dG8gZ28gd2l0aCBjbGFpbSByYXRoZXIgdGhhbiBQQVNTcG9yVCB0eXBlIGhlcmUuDQogICAgDQog ICAgU2VjdGlvbiA0LjENCiAgICANCiAgICAgICBUaGUgcmV0YXJnZXRpbmcgZW50aXR5IFNIT1VM RCBhY3QgYXMgYSB2ZXJpZmljYXRpb24gc2VydmljZSBhbmQNCiAgICAgICB2YWxpZGF0ZSB0aGUg ZXhpc3RpbmcgSWRlbnRpdHkgaGVhZGVyIGZpZWxkIHZhbHVlKHMpIGluIHRoZSByZXF1ZXN0DQog ICAgICAgYmVmb3JlIHByb2NlZWRpbmc7IGluIHNvbWUgaGlnaC12b2x1bWUgZW52aXJvbm1lbnRz LCBpdCBtYXkgaW5zdGVhZA0KICAgICAgIHB1dCB0aGF0IGJ1cmRlbiBvZiB2YWxpZGF0aW5nIHRo ZSBjaGFpbiBlbnRpcmVseSBvbiB0aGUgdGVybWluYXRpbmcNCiAgICAgICB2ZXJpZmljYXRpb24g c2VydmljZS4gIEFzIHRoZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIHdpbGwgYmUgYWRkaW5nIGEN CiAgICANCiAgICBJcyB0aGlzIGludGVuZGVkIHRvIGJlIHRoZSBvbmx5IGFsbG93ZWQgZXhjZXB0 aW9uIHRvIHRoZSBTSE9VTEQ/ICAoQ2FuDQogICAgd2UgcGhyYXNlIGl0IGFzIGEgTVVTVCBpbnN0 ZWFkLCBlLmcuLCAiZXhjZXB0IHdoZW4gaXQgaXMga25vdyB0aGF0IHRoZQ0KICAgIHRlcm1pbmF0 aW5nIHZlcmlmaWNhdGlvbiBzZXJ2aWNlIHdpbGwgZG8gc28sIHRoZSByZXRhcmdldGluZyBlbnRp dHkgTVVTVA0KICAgIGFjdCBhcyBhIHZlcmlmaWNhdGlvbiBzZXJ2aWNlIj8pDQoNClRoaXMgaXMg bm90IG1lYW50IHRvIGJlIGFuIGV4Y2VwdGlvbiBzb2xlbHkgZm9yIHRoYXQgY2FzZSwgbm8sIHRo YXQncyBqdXN0IGFuIGV4YW1wbGUuIEkgdGhpbmsgdGhlIGtleSBwb2ludCBpcyB0aGF0IHRoZSBz ZWN1cml0eSBvZiB0aGUgc3lzdGVtIGlzIG5vdCB3ZWFrZW5lZCBieSB0aGUgcmV0YXJnZXRpbmcg ZW50aXR5IGZhaWxpbmcgdG8gYWN0IGFzIGEgdmVyaWZpY2F0aW9uIHNlcnZpY2UgLSB0aGUgdGVy bWluYXRpbmcgZW50aXR5IGhhcyB0bywgc28gaXQgaXMgcmVhbGx5IGp1c3QgcmVkdW5kYW50IHdv cmsgYmVpbmcgZG9uZSBieSB0aGUgcmVkaXJlY3RpbmcgZW50aXR5LiBOaWNlIHRvIGRvLCBzbyB0 aGUgbmV0d29yayBpc24ndCBjbG9nZ2VkIGJ5ICJkaXYiIGNoYWlucyB0aGF0IHdvbid0IHBhc3Mg dmFsaWRhdGlvbiwgYnV0IG5vdCBzb21ldGhpbmcgSSB3YW50IHRvIE1VU1QuIA0KICAgIA0KICAg ICAgIFBBU1Nwb3JULiAgTm90ZSB0aGF0IHRoaXMgZWZmZWN0aXZlbHkgY3JlYXRlcyBtdWx0aXBs ZSBjaGFpbnMgb2YNCiAgICAgICAiZGl2IiBQQVNTcG9yVHMgaW4gYSBzaW5nbGUgcmVxdWVzdCwg d2hpY2ggY29tcGxpY2F0ZXMgdGhlIHByb2NlZHVyZXMNCiAgICAgICB0aGF0IG5lZWQgdG8gYmUg cGVyZm9ybWVkIGF0IHZlcmlmaWNhdGlvbiBzZXJ2aWNlcy4NCiAgICANCiAgICBbcG9uZGVycyB3 aGV0aGVyIHRoZXJlIHNob3VsZCBiZSBtb3JlIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIGFib3V0 DQogICAgdGhlc2UgYWRkZWQgY29tcGxpY2F0aW9uc10NCg0KSSdtIG5vdCBzdXJlIHRoZXJlIGFy ZSBzZWN1cml0eSBpbXBsaWNhdGlvbnMgdGhhdCBhcmUgbm90IGVudW1lcmF0ZWQgaW4gNC4yLCB3 aGVuIHdlIHRhbGsgYWJvdXQgaG93IHRvIHJlc29sdmUgZWFjaCBjaGFpbi4NCiAgICANCiAgICAg ICBub3QgZm9yICJkaXYiIFBBU1Nwb3JUcyB3aXRoIGVhcmxpZXIgdGFyZ2V0cy4gIE9yZGluYXJp bHksIHRoZQ0KICAgICAgIGN1cnJlbnQgdGFyZ2V0IHdpbGwgYmUgcmVhZGlseSBpZGVudGlmaWFi bGUsIGFzIGl0IHdpbGwgYmUgaW4gdGhlDQogICAgICAgbGFzdCAiZGl2IiBQQVNTcG9yVCBpbiBl YWNoIGNoYWluLCBhbmQgaW4gU0lQIGNhc2VzIGl0IHdpbGwNCiAgICAgICBjb3JyZXNwb25kIHRv IHRoZSBSZXF1ZXN0LVVSSSByZWNlaXZlZCBieSB0aGUgcmV0YXJnZXRpbmcgZW50aXR5Lg0KICAg ICAgIE1vcmVvdmVyLCB0aGUgY3VycmVudCB0YXJnZXQgd2lsbCBiZSBhbiBpZGVudGlmaWVyIHRo YXQgdGhlDQogICAgICAgcmV0YXJnZXRpbmcgZW50aXR5IHBvc3Nlc3MgYSBjcmVkZW50aWFsIHRv IHNpZ24gZm9yLCB3aGljaCBtYXkgbm90IGJlDQogICAgICAgdHJ1ZSBmb3IgZWFybGllciB0YXJn ZXRzLiAgVWx0aW1hdGVseSwgb24gZWFjaCByZXRhcmdldGluZywgdGhlDQogICAgICAgbnVtYmVy IG9mIFBBU1Nwb3JUcyBhZGRlZCB0byBhIHJlcXVlc3Qgd2lsbCBiZSBlcXVhbCB0byB0aGUgbnVt YmVyIG9mDQogICAgICAgbm9uLSJkaXYiIFBBU1Nwb3JUcyB0aGF0IGRvIG5vdCBzaGFyZSB0aGUg c2FtZSAib3JpZyIgYW5kICJkZXN0Ig0KICAgICAgIG9iamVjdCB2YWx1ZXMuDQogICAgDQogICAg V2Ugc2VlbSB0byBiZSBwcm92aWRpbmcgdHdvIG9yIHRocmVlIGRlc2NyaXB0aW9ucyBvZiB0aGUg bnVtYmVyIG9mIG5ldw0KICAgICJkaXYiIFBBU1Nwb3JUcyB0byBiZSBjcmVhdGVkLCBhbmQgaXQn cyBoYXJkIHRvIGhhdmUgZnVsbCBjb25maWRlbmNlDQogICAgdGhhdCBhbGwgYXJlIGd1YXJhbnRl ZWQgdG8gcHJvZHVjZSBpZGVudGljYWwgcmVzdWx0cy4gIElzIGl0IHBvc3NpYmxlIHRvDQogICAg Y2xhcmlmeSBhIHNpbmdsZSBkZWZpbml0aXZlIHByb2NlZHVyZT8NCg0KVGhpcyBwYXJhZ3JhcGgg KHdoaWNoIGlmIEkgcmVjYWxsIHdhcyBzdWdnZXN0ZWQgYnkgYW4gZWFybGllciByZXZpZXdlcikg ZXhlbXBsaWZpZXMgdGhlIGJlaGF2aW9yIG9mIGEgc2Vjb25kIHJlZGlyZWN0aW5nIGVudGl0eSBp biBhIGNoYWluLCBhcyB0aGUgc25pcHBlZCBwYXJ0IG9mIHRoZSBmaXJzdCBzZW50ZW5jZSBvZiB0 aGUgcGFyYWdyYXBoIHN0YXRlcy4gSXQgaXMgZ2l2aW5nIGRpZmZlcmVudCBndWlkYW5jZSB0aGFu IHRoZSBwYXJhZ3JhcGggYWJvdmUgaXQsIHdoaWNoIGZvY3VzZXMgb24gaG93IHRoZSBmaXJzdCBy ZWRpcmVjdGluZyBlbnRpdHkgdG8gaGFuZGxlIGEgcmVxdWVzdCBkZWFscyB3aXRoIG11bHRpcGxl IFBBU1Nwb3JUcy4gDQogICAgDQogICAgU2VjdGlvbiA0LjINCiAgICANCiAgICAgICBJbiBvcmRl ciB0byB2YWxpZGF0ZSBhIFNJUCByZXF1ZXN0IHVzaW5nIHRoZSAiZGl2IiBQQVNTcG9yVCB0eXBl LCBhDQogICAgICAgdmVyaWZpY2F0aW9uIHNlcnZpY2UgbmVlZHMgdG8gaW5zcGVjdCBhbGwgb2Yg dGhlIHZhbGlkIElkZW50aXR5DQogICAgICAgaGVhZGVyIGZpZWxkIHZhbHVlcyBhc3NvY2lhdGVk IHdpdGggYSByZXF1ZXN0LCBhcyBhbiBJZGVudGl0eSBoZWFkZXINCiAgICAgICBmaWVsZCB2YWx1 ZSBjb250YWluaW5nICJkaXYiIG5lY2Vzc2FyaWx5IHJlZmVycyB0byBhbiBlYXJsaWVyDQogICAg ICAgUEFTU3BvclQgYWxyZWFkeSBpbiB0aGUgbWVzc2FnZS4gIFsuLi5dDQogICAgDQogICAgKHJl ZmVycyB0byBvbmUgb3IgbW9yZSBlYXJsaWVyIFBBU1Nwb3JULCBubz8pDQoNCkkgc2VlIHRoZSBh bWJpZ3VpdHkgeW91IG1lYW4gLSBlYWNoICJkaXYiIFBBU1Nwb3JUIHJlZmVycyB0byBhbiBlYXJs aWVyICJvcmlnIi8iZGVzdCIgY291cGxldCB0aGF0IGFwcGVhcnMgaW4gYXQgbGVhc3Qgb25lLCBi dXQgcG9zc2libHkgbW9yZSwgUEFTU3BvclRzIGluIHRoZSByZXF1ZXN0LiBOb25ldGhlbGVzcywg SSB0aGluayB0aGUgd29yZGluZyBvZiB0aGUgbmV4dCBzZW50ZW5jZSBjbGFyaWZpZXMgd2hhdCB5 b3UgZG8gc3VmZmljaWVudGx5IHRoYXQgSSdtIG5vdCBjb25jZXJuZWQgd2l0aCBpbXBsZW1lbnRl cnMgbWlzdW5kZXJzdGFuZGluZyB0aGUgaW50ZW50aW9uLCBhbmQgSSB0aGluayBhZGRpbmcgbXkg dmVyeSB3b3JkeSBjYXZlYXQgd291bGQgbm90IHJlYWxseSBhZGQgYW55IGNsYXJpdHkuDQogICAg DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IERlcGxveW1lbnRzIHRoYXQNCiAgICAgICBjaGFuZ2UgdGhlIG9yaWdpbmFsIFRvIGhlYWRlciBm aWVsZCB2YWx1ZSB0byBjb25jZWFsIHRoZSBvcmlnaW5hbA0KICAgICAgIGRlc3RpbmF0aW9uIG9m IHRoZSBjYWxsIGZyb20gdGhlIHVsdGltYXRlIHJlY2lwaWVudCBzaG91bGQgbm90ZSB0aGF0DQog ICAgICAgdGhlIG9yaWdpbmFsIGRlc3RpbmF0aW9uIG9mIGEgY2FsbCBtYXkgYmUgcHJlc2VydmVk IGluIHRoZSBpbm5lcm1vc3QNCiAgICAgICBQQVNTcG9yVC4gIFsuLi5dDQogICAgDQogICAgU2hv dWxkIHRoaXMgYWxzbyBiZSBub3RlZCBpbiB0aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnM/DQoN CkkgdGhpbmsgdGhhdCBpcyBzdWZmaWNpZW50bHkgY2FwdHVyZWQgaW4gdGhlIFNlY3VyaXR5IENv bnNpZGVyYXRpb25zIHRleHQgeW91IGhpZ2hsaWdodGVkIGluIHlvdXIgZGlzY3VzcyAoYW5kIGlu IHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBvZiBSRkM4MjI0KS4gQWN0dWFsbHkgSSdsbCBh ZGQgYSBwb2ludGVyIHRvIFJGQzgyMjQsIHRoYXQgbWlnaHQgaGVscC4NCiAgICANCiAgICBTZWN0 aW9uIDUNCiAgICANCiAgICAgICBUaGlzIHNwZWNpZmljYXRpb24gZGVmaW5lcyBhICJkaXYtbyIg UEFTU3BvclQgdHlwZSB0aGF0IHVzZXMgdGhlDQogICAgICAgImRpdiIgY2xhaW0gZWxlbWVudCBp biBjb25qdW5jdGlvbiB3aXRoIHRoZSBvcHQgKFNlY3Rpb24gNikgUEFTU3BvclQNCiAgICAgICBj bGFpbSBlbGVtZW50LiAgQXMgaXMgdGhlIGNhc2Ugd2l0aCAiZGl2IiBQQVNTcG9yVCB0eXBlLCBh ICJkaXYtbyINCiAgICANCiAgICBuaXQ6IGFueSByZWFzb24gd2h5IHdlIHJlZmVyIHRvICJkaXYi IGFzIGEgImNsYWltIGVsZW1lbnQiIGJ1dCAib3B0Ig0KICAgICh3aXRoIG5vIHF1b3RlcyEpIGFz IGEgIlBBU1Nwb3JUIGNsYWltIGVsZW1lbnQiPw0KDQpEZWZpbml0ZWx5ICJvcHQiIHNob3VsZCBo YXZlIHF1b3RlcyB0aGVyZS4gQnV0IG5vLCBubyBkaXN0aW5jdGlvbiBpcyBpbnRlbmRlZCBiZXR3 ZWVuIGEgImNsYWltIGVsZW1lbnQiIGFuZCBhICJQQVNTcG9yVCBjbGFpbSBlbGVtZW50IiwgSSBj YW4gZml4IHRoYXQuDQogICAgDQogICAgU2VjdGlvbiA2DQogICAgDQogICAgICAgVGhlIHByZXNl bmNlIG9mIGFuIG9yaWdpbmFsIFBBU1Nwb3JUIGNsYWltcyBzZXQgZWxlbWVudCwgZGVzaWduYXRl ZA0KICAgICAgIGFzICJvcHQiLCBzaWduaWZpZXMgdGhhdCBhIFBBU1Nwb3JUIGVuY2Fwc3VsYXRl cyBhbm90aGVyIGVudGlyZQ0KICAgICAgIFBBU1Nwb3JUIHdpdGhpbiBpdCwgdHlwaWNhbGx5IGEg UEFTU3BvclQgdGhhdCB3YXMgdHJhbnNmb3JtZWQgaW4gc29tZQ0KICAgICAgIHdheSB0byBjcmVh dGUgdGhlIGN1cnJlbnQgUEFTU3BvclQuICBSZWx5aW5nIHBhcnRpZXMgbWF5IG5lZWQgdG8NCiAg ICAgICBjb25zdWx0IHRoZSBlbmNhcHN1bGF0ZWQgUEFTU3BvclQgaW4gb3JkZXIgdG8gdmFsaWRh dGUgdGhlIGlkZW50aXR5DQogICAgICAgb2YgYSBjYWxsZXIuICJvcHQiIGFzIGRlZmluZWQgaW4g dGhpcyBzcGVjaWZpY2F0aW9uIG1heSBiZSB1c2VkIGJ5DQogICAgICAgZnV0dXJlIFBBU1Nwb3JU IGV4dGVuc2lvbnMgYXMgd2VsbCBhcyBpbiBjb25qdW5jdGlvbiB3aXRoICJkaXYtbyIuDQogICAg DQogICAgQWxsIHRoZSBtb3JlIHJlYXNvbiBmb3IgdGhpcyBkb2N1bWVudCB0byBzcGVjaWZ5IHRo ZSAiZGl2LW8iIHVzYWdlJ3MNCiAgICB2YWxpZGF0aW9uIHByb2NlZHVyZXMhDQoNCkknbSBub3Qg c3VyZSBJIGZvbGxvdyB5b3UsIGJ1dCB3ZSdyZSBhZGRpbmcgc29tZSB0ZXh0IGFib3V0ICJkaXYt byIgdmFsaWRhdGlvbi4gRnV0dXJlIFBBU1Nwb3JUIGV4dGVuc2lvbnMgdGhhdCBsZXZlcmFnZSAi b3B0IiB3b3VsZCBoYXZlIHRvIHNwZWNpZnkgdGhlaXIgb3duIHNlbWFudGljcyBmb3IgdmFsaWRh dGluZyBpdCBpbiB3aGF0ZXZlciBjb250ZXh0IHRoYXQgbWlnaHQgYmUgKEkgY291bGQgaW1hZ2lu ZSBpdCBiZWluZyB2ZXJ5IGRpZmZlcmVudCBmcm9tIGhvdyBkaXYtbyB3b3JrcykuDQogICAgDQog ICAgU2VjdGlvbiA3DQogICAgDQogICAgICAgYW4gaW1wcmFjdGljYWwgbnVtYmVyIG9mIGNvbWJp bmF0aW9ucy4gIEJ1dCBpbiB2ZXJ5IGNvbXBsZXggY2FsbA0KICAgICAgIHJvdXRpbmcgc2NlbmFy aW9zLCBhdHRlc3RhdGlvbiBvZiBzb3VyY2UgaWRlbnRpdHkgd291bGQgb25seSBhZGQNCiAgICAg ICBsaW1pdGVkIHZhbHVlIGFueXdheS4NCiAgICANCiAgICBJJ20gbm90IHN1cmUgd2hhdCBwb2lu dCB0aGlzIGxhc3Qgc2VudGVuY2UgaXMgdHJ5aW5nIHRvIG1ha2UuICAiWWVzIHRoaXMNCiAgICBp cyBjb21wbGljYXRlZCwgYnV0IG5vIG9uZSB3b3VsZCBkbyBpdCBhbnl3YXkiPyAgVGhhdCBkb2Vz bid0IHJlYWxseQ0KICAgIHN1cHBvcnQgdGhlIGNhc2UgZm9yIHJldGFyZ2V0aW5nIG92ZXIgcmVk aXJlY3RpbmcuLi4NCg0KSSdtIGp1c3QgdHJ5aW5nIG5vdCB0byBzd2VlcCB0aGUgY29tcGxleGl0 eSBvZiByZWRpcmVjdGluZyB1bmRlciB0aGUgcnVnLiBGb3IgYSBudW1iZXIgb2YgcmVhc29ucywg SSB0aGluayBpbiBnZW5lcmFsIHJlZGlyZWN0aW9uIGhhcyBiZXR0ZXIgc2VjdXJpdHkgcHJvcGVy dGllcyB0aGFuIHJldGFyZ2V0aW5nLiBJdCBpcyBvbmx5IHdpdGggcmVncmV0IHRoYXQgSSBoZWF2 aWx5IGNhdmVhdCBpdCBoZXJlLiANCiAgICANCiAgICAgICBTVElSLWF3YXJlIFNJUCBpbnRlcm1l ZGlhcmllcyB0aGF0IHJlZGlyZWN0IHJlcXVlc3RzIE1BWSB0aGVyZWZvcmUNCiAgICAgICBjb252 ZXkgb25lIG9yIG1vcmUgUEFTU3BvclRzIGluIHRoZSBiYWNrd2FyZHMgZGlyZWN0aW9uIHdpdGhp bg0KICAgICAgIElkZW50aXR5IGhlYWRlciBmaWVsZHMuICBUaGVzZSByZWRpcmVjdGluZyBlbnRp dGllcyB3aWxsIGFjdCBhcw0KICAgICAgIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2VzIGZvciAiZGl2 IiBhcyBkZXNjcmliZWQgaW4gU2VjdGlvbiA0LjEuICBUaGlzDQogICAgICAgZG9jdW1lbnQgY29u c2VxdWVudGx5IHVwZGF0ZXMgW1JGQzgyMjRdIHRvIHBlcm1pdCBjYXJyeWluZyBJZGVudGl0eQ0K ICAgICAgIGhlYWRlciBmaWVsZHMgaW4gU0lQIDMwMC1jbGFzcyByZXNwb25zZXMuICBJdCBpcyBs ZWZ0IHRvIHRoZQ0KICAgICAgIG9yaWdpbmF0aW5nIHVzZXIgYWdlbnQgdG8gZGV0ZXJtaW5lIHdo aWNoIElkZW50aXR5IGhlYWRlciBmaWVsZHMNCiAgICAgICBzaG91bGQgYmUgY29waWVkIGZyb20g dGhlIDN4eCBpbnRvIGFueSBuZXcgcmVxdWVzdHMgcmVzdWx0aW5nIGZyb20NCiAgICAgICB0aGUg cmVkaXJlY3Rpb24sIGlmIGFueTogdXNlIG9mIHRoZXNlIElkZW50aXR5IGhlYWRlciBmaWVsZHMg YnkNCiAgICAgICBlbnRpdGllcyByZWNlaXZpbmcgYSAzeHggcmVzcG9uc2UgaXMgT1BUSU9OQUwu DQogICAgDQogICAgSXMgdGhlIGlkZWEgdGhhdCBtYWtpbmcgdGhpcyB1c2Ugb3B0aW9uYWwgb2J2 aWF0ZXMgYW55IG5lZWQgZm9yIGENCiAgICBuZWdvdGlhdGlvbiBtZWNoYW5pc20gd2hlcmUgdGhl IG9yaWdpbmF0aW5nIHVzZXIgYWdlbnQgaW5kaWNhdGVzIHN1cHBvcnQNCiAgICBmb3IgcmVjZWl2 aW5nIFBBU1Nwb3JUcyBpbiB0aGUgMzAwLWNsYXNzIHJlc3BvbnNlPw0KDQpJdCBzZXJ2ZXMgbW9y ZSBvZiBhIHB1cnBvc2UgdGhhbiB0aGF0LiBBbiBlbnRpdHkgcmVjZWl2aW5nIGEgM3h4IGNvdWxk IGp1c3QgY2hvb3NlIHRvIHNlbmQgYSBuZXcgSU5WSVRFIHdpdGggYSBmcmVzaCBQQVNTcG9yVCBm cm9tIGl0cyAib3JpZyIgdG8gdGhlIG5ldyAiZGVzdCIgaW1wYXJ0ZWQgYnkgdGhlIENvbnRhY3Qg aGVhZGVyIG9mIHRoZSAzeHgsIGlnbm9yaW5nIHRoZSAiZGl2IiBQQVNTcG9yVCBpbiB0aGUgM3h4 IGFuZCBpbiBmYWN0IGhpZGluZyB0aGF0IGEgcmVkaXJlY3Rpb24gaGFwcGVuZWQgYXQgYWxsICh0 aGUgb3JpZ2luYWwgY2FsbGVkIG51bWJlciBtaWdodCBuZXZlciBhcHBlYXIgaW4gdGhlIG5ldyBJ TlZJVEUpLiBJbiBzb21lIHJlc3BlY3RzLCB0aGF04oCZcyBhIGNsZWFuZXIgc3RvcnkgdGhhbiB1 c2luZyB0aGUgcmVjZWl2ZWQgImRpdiIgUEFTU3BvclQuIFdoZXJlICJkaXYiIGlzIHBvdGVudGlh bGx5IHJlbGV2YW50IGluIDN4eCByZXNwb25zZXMgaXMgZm9yIGEgbmFycm93IGJ1dCBjb21tb24g c2V0IG9mIHVzZSBjYXNlcyBsaWtlIGZyZWVwaG9uZSByb3V0aW5nLCB3aGVyZSBhbiA4MDAgbnVt YmVyIChpbiB0aGUgVVNBKSBpcyB0dXJuZWQgaW50byBhIGdlb2dyYXBoaWMgbnVtYmVyIGJ5IHNv bWUgc29ydCBvZiBkYXRhYmFzZSBxdWVyeSwgd2hlcmUgeW91IHN0aWxsIHdhbnQgdG8gY29udmV5 IHRoZSBvcmlnaW5hbCA4MDAgbnVtYmVyIGFuZCBzaG93IHRoYXQgdGhlIHJpZ2h0IGF1dGhvcml0 eSB0cmFuc2xhdGVkIHRoZSBmcmVlcGhvbmUgbnVtYmVyIGludG8gdGhlIGdlb2dyYXBoaWNhbCBu dW1iZXIgLSB0aGF0J3Mgd2hhdCB0aGUgImRpdiIgdGhlcmUgY291bGQgZG8uDQogICAgDQogICAg U2VjdGlvbiAxMC4xLjINCiAgICANCiAgICAgICBDbGFpbSBEZXNjcmlwdGlvbjogRW5jYXBzdWxh dGVkIEpTT04gdG9rZW4NCiAgICANCiAgICBJcyBpdCBhbiBlbmNhcHN1bGF0ZWQgIkpTT04gdG9r ZW4iIG9yICJQQVNTcG9yVCBbSlNPTiBXZWIgVG9rZW5dIj8NCg0KVGhpcyBpcyBwYXJ0IG9mIHdo YXQgd2UncmUgZml4aW5nIHdpdGggdGhlIElBTkEgZXhwZXJ0IHJldmlldywgc2hvdWxkIGJlIGJl dHRlciBub3cuDQogICAgDQogICAgU2VjdGlvbiAxMQ0KICAgIA0KICAgICAgIEhvd2V2ZXIsIGFz IHRoZXJlIG1heSBiZSB1bmZvcmVzZWVuIGNpcmN1bXN0YW5jZXMgd2hlcmUgdGhlDQogICAgICAg cmV2ZWxhdGlvbiBvZiBzZXJ2aWNlIGxvZ2ljIHRvIHRoZSBjYWxsZWQgcGFydHkgcG9zZXMgYSBw cml2YWN5IHJpc2ssDQogICAgICAgaW1wbGVtZW50ZXJzIGFuZCB1c2VycyBvZiB0aGlzIG9yIHNp bWlsYXIgZGl2ZXJzaW9uLXRyYWNraW5nDQogICAgICAgdGVjaG5pcXVlcyBzaG91bGQgdW5kZXJz dGFuZCB0aGUgdHJhZGUtb2ZmLg0KICAgIA0KICAgIERvbid0IHRoZSAzMDAtY2xhc3MgcmVkaXJl Y3Rpb25zIGFsc28gaW52b2x2ZSBzb21lIHJldmVsYXRpb24gb2YNCiAgICBpbmZvcm1hdGlvbiB0 byB0aGUgY2FsbGluZyBwYXJ0eT8gIEkgdGhpbmsgdGhhdCBjb3VsZCBiZSB3b3J0aA0KICAgIG1l bnRpb25pbmcgKHRob3VnaCBpdCdzIG5vdCBzcGVjaWZpYyB0byB0aGUgUEFTU3BvclQgY2FzZSku DQoNCkkgY2FuIG1lbnRpb24gdGhhdCwgdGhvdWdoIHNpbmNlIHRoZSBjaG9pY2UgdG8gc2VuZCBh IDN4eCBpcyBiYXNpY2FsbHkgY2hvb3NpbmcgdG8gcmV2ZWFsIHRoYXQgdG8gdGhlIGNhbGxpbmcg cGFydHksIEknbSBub3Qgc3VyZSBpdCdzIGEgcG90ZW50aWFsIGxlYWsgYXMgc3VjaCAtIGlmIHlv dSBkb24ndCB3YW50IHRoZSBjYWxsaW5nIHBhcnR5IHRvIHNlZSB0aGUgQ29udGFjdCBjaG9pY2Vz LCB5b3UgcmV0YXJnZXQgaW5zdGVhZCBvZiByZWRpcmVjdGluZy4gDQogICAgDQogICAgICAgRnVy dGhlcm1vcmUsIGl0IGlzIGEgZ2VuZXJhbCBwcml2YWN5IHJpc2sgb2YgaWRlbnRpdHkgbWVjaGFu aXNtcw0KICAgICAgIG92ZXJhbGwgdGhhdCB0aGV5IGRvIG5vdCBpbnRlcmZhY2Ugd2VsbCB3aXRo IGFub255bWl6YXRpb24gc2VydmljZXM7DQogICAgICAgdGhlIGludGVyYWN0aW9uIG9mIFNUSVIg d2l0aCBhbm9ueW1pemF0aW9uIHNlcnZpY2VzIGlzIGRldGFpbGVkIGluDQogICAgICAgW1JGQzgy MjRdIFNlY3Rpb24gMTEuICBBbnkgZm9yd2FyZGluZyBzZXJ2aWNlcyB0aGF0IGFjdHMgYXMgYW4N CiAgICAgICBhbm9ueW1pemluZyBwcm94eSBtYXkgbm90IGJlIGFibGUgdG8gcHJvdmlkZSBhIHNl Y3VyZSBjaGFpbiBvZg0KICAgICAgIHJldGFyZ2V0aW5nIGR1ZSB0byB0aGUgb2JmdXNjYXRpb24g b2YgdGhlIG9yaWdpbmF0aW5nIGlkZW50aXR5Lg0KICAgIA0KICAgIElzbid0IHRoZXJlIGFsc28g YSByaXNrIHRoYXQgYW4gYW5vbnltaXppbmcgcHJveHkgbWlnaHQgbm90IGtub3cgdG8NCiAgICBy ZW1vdmUgYWxsIHRoZSAoaW5mb3JtYXRpb24gY29udGFpbmVkIGluIHRoZSkgUEFTU3BvclRzLCB0 aHVzDQogICAgaW5hZHZlcnRlbnRseSBsZWFraW5nIGlkZW50aXR5IGluZm9ybWF0aW9uPw0KDQpJ ZiBzbywgSSBkb24ndCB0aGluayB0aGlzIHNwZWMgaXMgdGhlIHJpZ2h0IHBsYWNlIHRvIGFkZHJl c3MgaXQsIHRoYXQgd291bGQgYmUgYSBnZW5lcmFsIGlzc3VlIHdpdGggUEFTU3BvclQuIEJ1dCBt b3N0IGxpa2VseSB0aGV5IHdvdWxkbid0LiBBbm9ueW1pemF0aW9uIHNlcnZpY2UgaW1wbGVtZW50 YXRpb25zIGFjdCBhcyBCMkJVQXMgYW5kIGRlc3Ryb3kgdGhlIG9yaWdpbmF0aW5nIFNJUCByZXF1 ZXN0IGFuZCBjcmVhdGUgYSBuZXcgb25lLCBvciBhdCBsZWFzdCB0aGV5IHdvdWxkLCBpZiB0aGV5 IGV4aXN0ZWQgaW4gdGhlIGZpZWxkIG91dHNpZGUgb2YgdGhlIGltYWdpbmF0aW9uIG9mIHRoZSBh dXRob3Igb2YgUkZDMzMyMy4NCiAgICANCiAgICBTZWN0aW9uIDEyDQogICAgDQogICAgICAgcmlz ayBhcmlzZXMgYXQgdGhlIGRpc2NyZXRpb24gb2YgdGhlIHJldGFyZ2V0aW5nIGRvbWFpbjogc2lt cGx5IHVzaW5nDQogICAgICAgM3h4IHJlc3BvbnNlIHJlZGlyZWN0aW9ucyByYXRoZXIgdGhhbiBy ZXRhcmdldGluZyAod2l0aCBzdXBwbHkgYQ0KICAgICAgICJkaXYiIHBlciBTZWN0aW9uIDcpIG1p dGlnYXRlcyB0aGUgcG90ZW50aWFsIGltcGFjdC4gIFVuZGVyIHVudXN1YWwNCiAgICANCiAgICBu aXQ6IGdyYW1tYXIgaXMgd2VpcmQgYXJvdW5kICJ3aXRoIHN1cHBseSBhICdkaXYnIg0KDQpGaXhl ZCENCiAgICANCiAgICBBcHBlbmRpeCBBDQogICAgDQogICAgVGhhbmtzIGZvciBpbmNsdWRpbmcg dGhlIGtleXMgbmVlZGVkIHRvIHZhbGlkYXRlIHRoZSBleGFtcGxlcyENCiAgICAoQWxhcywgSSBk b24ndCBoYXZlIGEgSldUIG9yIEpPU0UgbGlicmFyeSBoYW5keSwgc28gSSBkaWRuJ3QgZG8gc28u Li4pDQoNCk5QLCB0aGFua3MgYWdhaW4gZm9yIHRoZSB0aG9yb3VnaCByZWFkLg0KDQpKb24gUGV0 ZXJzb24NCk5ldXN0YXIsIEluYy4NCiAgICANCiAgICANCiAgICANCiAgICANCg0K From nobody Mon Jul 13 07:48:46 2020 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id AA00F3A0AA7; Mon, 13 Jul 2020 07:48:40 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: stir@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.8.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: stir@ietf.org Message-ID: <159465172058.29760.12199060562808217038@ietfa.amsl.com> Date: Mon, 13 Jul 2020 07:48:40 -0700 Archived-At: Subject: [stir] I-D Action: draft-ietf-stir-passport-divert-09.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 14:48:41 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Telephone Identity Revisited WG of the IETF. Title : PASSporT Extension for Diverted Calls Author : Jon Peterson Filename : draft-ietf-stir-passport-divert-09.txt Pages : 19 Date : 2020-07-13 Abstract: PASSporT is specified in RFC 8225 to convey cryptographically-signed information about the people involved in personal communications. This document extends PASSporT to include an indication that a call has been diverted from its original destination to a new one. This information can greatly improve the decisions made by verification services in call forwarding scenarios. Also specified here is an encapsulation mechanism for nesting a PASSporT within another PASSporT that assists relying parties in some diversion scenarios. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-passport-divert/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-stir-passport-divert-09 https://datatracker.ietf.org/doc/html/draft-ietf-stir-passport-divert-09 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-passport-divert-09 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Jul 13 08:01:23 2020 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B48923A09E8; Mon, 13 Jul 2020 08:01:21 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: stir@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.8.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: stir@ietf.org Message-ID: <159465248162.29720.3669071783137852446@ietfa.amsl.com> Date: Mon, 13 Jul 2020 08:01:21 -0700 Archived-At: Subject: [stir] I-D Action: draft-ietf-stir-cert-delegation-03.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 15:01:22 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Telephone Identity Revisited WG of the IETF. Title : STIR Certificate Delegation Author : Jon Peterson Filename : draft-ietf-stir-cert-delegation-03.txt Pages : 13 Date : 2020-07-13 Abstract: The Secure Telephone Identity Revisited (STIR) certificate profile provides a way to attest authority over telephone numbers and related identifiers for the purpose of preventing telephone number spoofing. This specification details how that authority can be delegated from a parent certificate to a subordinate certificate. This supports a number of use cases, including those where service providers grant credentials to enterprises or other customers capable of signing calls with STIR. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-cert-delegation/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-stir-cert-delegation-03 https://datatracker.ietf.org/doc/html/draft-ietf-stir-cert-delegation-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-cert-delegation-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Jul 13 13:26:11 2020 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 796813A086F; Mon, 13 Jul 2020 13:26:06 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: stir@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.8.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: stir@ietf.org Message-ID: <159467196640.715.1292377769555922682@ietfa.amsl.com> Date: Mon, 13 Jul 2020 13:26:06 -0700 Archived-At: Subject: [stir] I-D Action: draft-ietf-stir-rph-emergency-services-02.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2020 20:26:07 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Telephone Identity Revisited WG of the IETF. Title : Assertion Values for a Resource Priority Header Claim and a SIP Priority Header Claim in Support of Emergency Services Networks Authors : Martin Dolly Chris Wendt Filename : draft-ietf-stir-rph-emergency-services-02.txt Pages : 8 Date : 2020-07-13 Abstract: This document adds new assertion values for a Resource Priority Header ("rph") claim and a new SIP Priority Header claim ("sph") for protection of the "psap-callback" value as part of the "rph" PASSporT extension, in support of the security of Emergency Services Networks for emergency call origination and callback. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-rph-emergency-services/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-stir-rph-emergency-services-02 https://datatracker.ietf.org/doc/html/draft-ietf-stir-rph-emergency-services-02 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-rph-emergency-services-02 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Jul 16 12:26:57 2020 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id A29A33A0BF3; Thu, 16 Jul 2020 12:26:19 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , Cc: stir@ietf.org, superuser@gmail.com X-Test-IDTracker: no X-IETF-IDTracker: 7.8.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159492757964.14301.10859249267809881278@ietfa.amsl.com> Date: Thu, 16 Jul 2020 12:26:19 -0700 Archived-At: Subject: [stir] stir - Requested session has been scheduled for IETF 108 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Jul 2020 19:26:23 -0000 Dear Russ Housley, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. stir Session 1 (1:40 requested) Friday, 31 July 2020, Session III 1410-1550 Room Name: Room 2 size: 2 --------------------------------------------- iCalendar: https://datatracker.ietf.org/meeting/108/sessions/stir.ics Request Information: --------------------------------------------------------- Working Group Name: Secure Telephone Identity Revisited Area Name: Applications and Real-Time Area Session Requester: Russ Housley Number of Sessions: 1 Length of Session(s): 100 Minutes Number of Attendees: 60 Conflicts to Avoid: Chair Conflict: ipwave lamps suit Technology Overlap: sipcore ecrit Key Participant Conflict: dispatch secdispatch saag sipbrandy tls mls teep oauth acme perc cfrg mmusic avtcore emu People who must be present: Russ Housley Sean Turner Robert Sparks Eric Burger Jon Peterson Martin Dolly Murray Kucherawy Brian Rosen Chris Wendt Resources Requested: Special Requests: --------------------------------------------------------- From nobody Fri Jul 17 18:12:45 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C70D3A0883; Fri, 17 Jul 2020 18:12:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.919 X-Spam-Level: X-Spam-Status: No, score=-1.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5k7uCjND7fWS; Fri, 17 Jul 2020 18:12:37 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CCECF3A0881; Fri, 17 Jul 2020 18:12:36 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 06I1CVnf027305 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 17 Jul 2020 21:12:34 -0400 Date: Fri, 17 Jul 2020 18:12:30 -0700 From: Benjamin Kaduk To: "Peterson, Jon" Cc: The IESG , "draft-ietf-stir-passport-divert@ietf.org" , "stir-chairs@ietf.org" , "stir@ietf.org" , Russ Housley Message-ID: <20200718011230.GI41010@kduck.mit.edu> References: <158629284778.13900.16643796031182034257@ietfa.amsl.com> <8F32C3AA-F3D7-4A46-8B7B-77BEE8CE857F@team.neustar> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <8F32C3AA-F3D7-4A46-8B7B-77BEE8CE857F@team.neustar> User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [stir] Benjamin Kaduk's Discuss on draft-ietf-stir-passport-divert-08: (with DISCUSS and COMMENT) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Jul 2020 01:12:39 -0000 Hi Jon, On Mon, Jul 13, 2020 at 02:45:45PM +0000, Peterson, Jon wrote: > > Hi Benjamin, > > Thanks for the thorough review of divert-08 (and apologies for the long RTT): I think I managed to swap back in enough context to remember what's going on... > On 4/7/20, 1:54 PM, "Benjamin Kaduk via Datatracker" wrote: > > ---------------------------------------------------------------------- > DISCUSS: > ---------------------------------------------------------------------- > > I support Roman's Discuss. Isn't there a straightforward translation of > the "div" procedures to the nested "div-o" chain? Why would that not be > applicable? > > See my response to Roman, but yes, I agree it's designed to be a relatively straightforward translation, and I've fleshed that out a bit. More than a bit :) It seems okay to me. > I had two other points for discussion: > > (1) IANA seems unhappy (the expert review identified issues). What's the > plan to address them? > > We've followed up with them, the changes they proposed are fine, and are in the new version of the document. Interestingly, I don't see a resolution of the thread in the jwt-reg-review archives, though the datatracker status shows a clear "IANA OK" that showed up a couple days after your message here, so I'm going to assume they know what they're doing. > (2) The following text from the Security Considerations seems inconsistent > to me: > > However, > including this information about forwarding is at the discretion of > the retargeting entity, so if there is a requirement to keep the > original called number confidential, no PASSporT should be created > for that retargeting - the only consequence will be that downstream > entities will be unable to correlate an incoming call with the > original PASSporT without access to some prior knowledge of the > policies that could have caused the retargeting. > > I don't understand this -- if the idea is to keep the original called > number confidential, wouldn't this necessitate *not giving the original > PASSporT to the called entity*, since the original PASSporT includes the > original call destination? Without the original PASSporT at all, of > course it can't be correlated to an incoming call... (Even in the OOB > case, would the post-retargeting called entity even be able to > retrieve/decrypt the original PASSporT?) Is this intended to only apply > to some non-SIP case? > > This paragraph is trying to refer at a high level to cases where complicated things are going on with the called number, like say, substituting it for an MSRN in roaming mobile telephone cases, where some intermediate identifier is, from the perspective of the diverting authentication service, the "original" called number. Some ways that number portability works would be comparable for landline call routing. I think the problem there is the word "original" - what I mean is the called number that the diverting authentication service sees, not the contents of the "orig" in the original PASSporT. I'll replace "original" with "an intermediate". Oh, that makes much more sense! Thanks, that minor change really helps me understand what's going on. I did read through the responses to my comments (much appreciated!), but your explanations all make sense and I don't have anything further to say. I see what you did with "the imagination of the author of RFC 3323", though :) Anyway, I'll go clear my Discuss now. Thanks again, Ben > ---------------------------------------------------------------------- > COMMENT: > ---------------------------------------------------------------------- > > While it looks like the main change in the -08 is intended to address > the secdir reviewer's comment, it would be nice to respond to the review > and mention the new text. > > Will do. > > Do we need to say something about whitespace being added to examples for > readability? > > We're dealing here with JSON objects and header field values that are generally rendered to humans with some whitespace in them, I don't think our treatment is unusual. > > Section 1 > > Is there an intended mnemonic for the "opt" element? ("Original > passport"?) > > Yes, added exactly that. > > Do "div-o" PASSporTs necessarily carry both "div" and "opt", or is "opt" > intended to be able to stand alone in a "div-o" PASSporT? > > I believe we clarify that when we discuss "div-o", but "div-o" PASSporTs contain both a "div" and an "opt". > > Section 3 > > canonical form of the "dest" identifiier is not changed during > > nit: s/identifiier/identifier/ > > Fixed. > > A "div" PASSporT claims set is populated with elements drawn from the > PASSporT(s) received for a call by the retargeting entity: at a high > > When would there be multiple received PASSporTs that all are input to > the same "div" PASSporT? > > There can be multiple PASSporTs contained in the same SIP request, for example in cases where there is one signed by the originating carrier and another signed with a special government "rph" field (which has an independent trust anchor), even though the two PASSporTs share the same "dest" and "orig", as is discussed in Section 4.1. > > Also, the later discussion that indicates only a small number of > claims/extensions are copied from the original PASSporT (and that "iat" > might change!) suggests that perhaps the "is populated with" language > could be tweaked. > > I think "at a high level" indicates that we are here just trying to convey the basic gist. > > level, the original identifier for the called party in the "dest" > object will become the "div" claim in the new PASSporT. If the > > This "will become" language seems a bit problematic when combined with > the definition in Section 8 of an "hi" element within the "div" claim, > which is not part of the "original identifier for the called party". > > Same comment- "at a high level", the "dest" populates the "div". I do not think it would help the reader's understanding to encumber this introductory sentence with corner cases and exceptions. > > The combined full form PASSporT (with a signature covered by the > ES256 keys given in Appendix A) would look as follows: > > eyJhbGciOiJFUzI1NiIsInBwdCI6ImRpdiIsInR5cCI6InBhc3Nwb3J0IiwieDV1Ij \ > oiaHR0cHM6Ly93d3cuZXhhbXBsZS5jb20vY2VydC5jZXIifQ.eyJkZXN0Ijp7InRuI \ > jpbIjEyMTU1NTUxMjE0Il19LCJkaXYiOnsidG4iOiIxMjE1NTU1NTEyMTMifSwiaWF \ > 0IjoxNDQzMjA4MzQ1LCJvcmlnIjp7InRuIjoiMTIxNTU1NTEyMTIifX0.xBHWipDEE \ > J8a6TsdX6xUXAnblsFiGUiAxwLiv0HLC9IICj6eG9jQd6WzeSSjHRBwxmChHhVIiMT \ > SqIlk3yCNkg > > (The decoded claims set is sorted, though the previous display-form > example was in a different order.) > > I'll fix that. > > Section 4 > > This section specifies SIP-specific usage for the "div" PASSporT type > and its handling in the SIP Identity header field "ppt" parameter > value. Other protocols using PASSporT may define behavior specific > to their use of the "div" claim. > > Is the last line supposed to be "claim" or "PASSporT type"? > > I don't think the distinction particularly matters for the purposes of this statement. "div" claims are not used outside of "div" (or "div-o") PASSporTs. I guess the existence of "div-o" is a decent reason to go with claim rather than PASSporT type here. > > Section 4.1 > > The retargeting entity SHOULD act as a verification service and > validate the existing Identity header field value(s) in the request > before proceeding; in some high-volume environments, it may instead > put that burden of validating the chain entirely on the terminating > verification service. As the authentication service will be adding a > > Is this intended to be the only allowed exception to the SHOULD? (Can > we phrase it as a MUST instead, e.g., "except when it is know that the > terminating verification service will do so, the retargeting entity MUST > act as a verification service"?) > > This is not meant to be an exception solely for that case, no, that's just an example. I think the key point is that the security of the system is not weakened by the retargeting entity failing to act as a verification service - the terminating entity has to, so it is really just redundant work being done by the redirecting entity. Nice to do, so the network isn't clogged by "div" chains that won't pass validation, but not something I want to MUST. > > PASSporT. Note that this effectively creates multiple chains of > "div" PASSporTs in a single request, which complicates the procedures > that need to be performed at verification services. > > [ponders whether there should be more security considerations about > these added complications] > > I'm not sure there are security implications that are not enumerated in 4.2, when we talk about how to resolve each chain. > > not for "div" PASSporTs with earlier targets. Ordinarily, the > current target will be readily identifiable, as it will be in the > last "div" PASSporT in each chain, and in SIP cases it will > correspond to the Request-URI received by the retargeting entity. > Moreover, the current target will be an identifier that the > retargeting entity possess a credential to sign for, which may not be > true for earlier targets. Ultimately, on each retargeting, the > number of PASSporTs added to a request will be equal to the number of > non-"div" PASSporTs that do not share the same "orig" and "dest" > object values. > > We seem to be providing two or three descriptions of the number of new > "div" PASSporTs to be created, and it's hard to have full confidence > that all are guaranteed to produce identical results. Is it possible to > clarify a single definitive procedure? > > This paragraph (which if I recall was suggested by an earlier reviewer) exemplifies the behavior of a second redirecting entity in a chain, as the snipped part of the first sentence of the paragraph states. It is giving different guidance than the paragraph above it, which focuses on how the first redirecting entity to handle a request deals with multiple PASSporTs. > > Section 4.2 > > In order to validate a SIP request using the "div" PASSporT type, a > verification service needs to inspect all of the valid Identity > header field values associated with a request, as an Identity header > field value containing "div" necessarily refers to an earlier > PASSporT already in the message. [...] > > (refers to one or more earlier PASSporT, no?) > > I see the ambiguity you mean - each "div" PASSporT refers to an earlier "orig"/"dest" couplet that appears in at least one, but possibly more, PASSporTs in the request. Nonetheless, I think the wording of the next sentence clarifies what you do sufficiently that I'm not concerned with implementers misunderstanding the intention, and I think adding my very wordy caveat would not really add any clarity. > > Deployments that > change the original To header field value to conceal the original > destination of the call from the ultimate recipient should note that > the original destination of a call may be preserved in the innermost > PASSporT. [...] > > Should this also be noted in the security considerations? > > I think that is sufficiently captured in the Security Considerations text you highlighted in your discuss (and in the security considerations of RFC8224). Actually I'll add a pointer to RFC8224, that might help. > > Section 5 > > This specification defines a "div-o" PASSporT type that uses the > "div" claim element in conjunction with the opt (Section 6) PASSporT > claim element. As is the case with "div" PASSporT type, a "div-o" > > nit: any reason why we refer to "div" as a "claim element" but "opt" > (with no quotes!) as a "PASSporT claim element"? > > Definitely "opt" should have quotes there. But no, no distinction is intended between a "claim element" and a "PASSporT claim element", I can fix that. > > Section 6 > > The presence of an original PASSporT claims set element, designated > as "opt", signifies that a PASSporT encapsulates another entire > PASSporT within it, typically a PASSporT that was transformed in some > way to create the current PASSporT. Relying parties may need to > consult the encapsulated PASSporT in order to validate the identity > of a caller. "opt" as defined in this specification may be used by > future PASSporT extensions as well as in conjunction with "div-o". > > All the more reason for this document to specify the "div-o" usage's > validation procedures! > > I'm not sure I follow you, but we're adding some text about "div-o" validation. Future PASSporT extensions that leverage "opt" would have to specify their own semantics for validating it in whatever context that might be (I could imagine it being very different from how div-o works). > > Section 7 > > an impractical number of combinations. But in very complex call > routing scenarios, attestation of source identity would only add > limited value anyway. > > I'm not sure what point this last sentence is trying to make. "Yes this > is complicated, but no one would do it anyway"? That doesn't really > support the case for retargeting over redirecting... > > I'm just trying not to sweep the complexity of redirecting under the rug. For a number of reasons, I think in general redirection has better security properties than retargeting. It is only with regret that I heavily caveat it here. > > STIR-aware SIP intermediaries that redirect requests MAY therefore > convey one or more PASSporTs in the backwards direction within > Identity header fields. These redirecting entities will act as > authentication services for "div" as described in Section 4.1. This > document consequently updates [RFC8224] to permit carrying Identity > header fields in SIP 300-class responses. It is left to the > originating user agent to determine which Identity header fields > should be copied from the 3xx into any new requests resulting from > the redirection, if any: use of these Identity header fields by > entities receiving a 3xx response is OPTIONAL. > > Is the idea that making this use optional obviates any need for a > negotiation mechanism where the originating user agent indicates support > for receiving PASSporTs in the 300-class response? > > It serves more of a purpose than that. An entity receiving a 3xx could just choose to send a new INVITE with a fresh PASSporT from its "orig" to the new "dest" imparted by the Contact header of the 3xx, ignoring the "div" PASSporT in the 3xx and in fact hiding that a redirection happened at all (the original called number might never appear in the new INVITE). In some respects, that’s a cleaner story than using the received "div" PASSporT. Where "div" is potentially relevant in 3xx responses is for a narrow but common set of use cases like freephone routing, where an 800 number (in the USA) is turned into a geographic number by some sort of database query, where you still want to convey the original 800 number and show that the right authority translated the freephone number into the geographical number - that's what the "div" there could do. > > Section 10.1.2 > > Claim Description: Encapsulated JSON token > > Is it an encapsulated "JSON token" or "PASSporT [JSON Web Token]"? > > This is part of what we're fixing with the IANA expert review, should be better now. > > Section 11 > > However, as there may be unforeseen circumstances where the > revelation of service logic to the called party poses a privacy risk, > implementers and users of this or similar diversion-tracking > techniques should understand the trade-off. > > Don't the 300-class redirections also involve some revelation of > information to the calling party? I think that could be worth > mentioning (though it's not specific to the PASSporT case). > > I can mention that, though since the choice to send a 3xx is basically choosing to reveal that to the calling party, I'm not sure it's a potential leak as such - if you don't want the calling party to see the Contact choices, you retarget instead of redirecting. > > Furthermore, it is a general privacy risk of identity mechanisms > overall that they do not interface well with anonymization services; > the interaction of STIR with anonymization services is detailed in > [RFC8224] Section 11. Any forwarding services that acts as an > anonymizing proxy may not be able to provide a secure chain of > retargeting due to the obfuscation of the originating identity. > > Isn't there also a risk that an anonymizing proxy might not know to > remove all the (information contained in the) PASSporTs, thus > inadvertently leaking identity information? > > If so, I don't think this spec is the right place to address it, that would be a general issue with PASSporT. But most likely they wouldn't. Anonymization service implementations act as B2BUAs and destroy the originating SIP request and create a new one, or at least they would, if they existed in the field outside of the imagination of the author of RFC3323. > > Section 12 > > risk arises at the discretion of the retargeting domain: simply using > 3xx response redirections rather than retargeting (with supply a > "div" per Section 7) mitigates the potential impact. Under unusual > > nit: grammar is weird around "with supply a 'div'" > > Fixed! > > Appendix A > > Thanks for including the keys needed to validate the examples! > (Alas, I don't have a JWT or JOSE library handy, so I didn't do so...) > > NP, thanks again for the thorough read. > > Jon Peterson > Neustar, Inc. > > > > > From nobody Wed Jul 22 09:47:34 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 348663A0AFD; Wed, 22 Jul 2020 09:47:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=metaswitch.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uHx4KUlhJP83; Wed, 22 Jul 2020 09:47:31 -0700 (PDT) Received: from NAM10-MW2-obe.outbound.protection.outlook.com (mail-mw2nam10on2123.outbound.protection.outlook.com [40.107.94.123]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A47F3A0AF8; Wed, 22 Jul 2020 09:47:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Od3ny0us13GDw+IQol9k5Of0xQRFicT5YX0ty68f0CLirlpx7JDX4wNkjxV+OJ7oEIw3dr2mmnOet2PsrMgyKbhGlL2SSCeqq01tMjJt9B+fE3nal7rMo/5kN0yFzbCvz4i7zLnElSw8LhHd3HODiAFnem5egKhPNJm5uJiscwio2QMMG4gBWGiss5/VNcSuSwIeBXOo0WaE6oomk0r1oWfjEAbrI3NklD3LyabhFm2ajtVO9/wRVDcX2Bhxd0nRAn2xgN2cyjkeoaAcgQj9LLUw8a9dF5VE4wwSw0M2BHOQY3oof95Au8sb1GZDVzSAwflpSx6z5kHr0HUkbzAhhg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/flyUbqqqz48pFYmNys2R1QKT/I40+0jqqQbxjwXbnA=; b=HMe0hmGiOrGJgkhXaEx9bR2LMyiT+fSO15wM4zX3xefsOhtB13O1fNV0dr88SZSa89xNiA9MJFUzWiB+npfUoUnxzV2IpY/VREKaRaJN44dlNCY5fX+T5k8Ni1FRz7Du6+HqtskePOIlXZjeFG+s0WdE9ta/sRqTej74/GfhszdOT3Xb74cL0yOZqhm7nXeMNTphaymGX5CPAuNkcNxyVf2OM6lHBBg9lPBeFviVUofC+Pvvjqr6LrkUomKU8D3TY/QdnsZNDAI8CUGMrZFhQVIp1TzEDxSu/DsjE5MPeGfJecqlSd50DA8+DQ7tKLSSnhkZ6Qh6Ql/FJwhXfI/BWw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=metaswitch.com; dmarc=pass action=none header.from=metaswitch.com; dkim=pass header.d=metaswitch.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=metaswitch.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/flyUbqqqz48pFYmNys2R1QKT/I40+0jqqQbxjwXbnA=; b=rxN0m72gm73VrHtVw88E4GJg31VVg0nvTBwheCz5FuLGQMVRgT8o8OU2QiQHn7WwCKWJEC6AHxfH1DJYdsAyjuS+ylBvJu+RMuzCPagS+Bw/H9TLuaxmDMET59+jUkCzMJodC22D8CXYZ+LR7fFDNmTIOSwMubHDHN5C5OK6Zxo= Received: from BYAPR02MB5189.namprd02.prod.outlook.com (2603:10b6:a03:62::29) by BYAPR02MB4711.namprd02.prod.outlook.com (2603:10b6:a03:49::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.17; Wed, 22 Jul 2020 16:47:29 +0000 Received: from BYAPR02MB5189.namprd02.prod.outlook.com ([fe80::85af:617:4f9f:b2c3]) by BYAPR02MB5189.namprd02.prod.outlook.com ([fe80::85af:617:4f9f:b2c3%7]) with mapi id 15.20.3195.026; Wed, 22 Jul 2020 16:47:29 +0000 From: Jack Rickard To: "stir@ietf.org" , "draft-ietf-stir-passport-divert@ietf.org" , "Peterson, Jon" Thread-Topic: Potential security vulnerability in STIR/DIV Thread-Index: AdZgO7RfMuiVRPd/TYi0mhEaKJnUqQ== Date: Wed, 22 Jul 2020 16:47:28 +0000 Message-ID: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=metaswitch.com; x-originating-ip: [84.92.33.46] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: d2a3a2f0-66a1-43c9-75ca-08d82e5eebcd x-ms-traffictypediagnostic: BYAPR02MB4711: x-ld-processed: 9d9e56eb-f613-4ddb-b27b-bfcdf14b2cdb,ExtAddr x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: H+yCI4uwHOJkvPHLwOmSCK70FckcrzZldNGKu24WeqhK+duJi9mZwUgu5kbclIlccmEp0Db//LKCcYn+ds6Qk60+4n+PucekLdaS2ikt54loHV1oj/6MPAv9Ka+Dh1N8dLEXFqVL1qD8djxf/CE7AfocJKkx4NAepCYx6uvnD67oUEq1Hv4JyG+zg+zTmYa9w9Acv7Wxj7B0a9mxCByL60oDp5KLCELQg5b7ny6PhSUHWdhnBQIrEw87vjfUt2vrMF5sE+gxHUYr6LJ2c8g8htcsoZEMT2jv2ScjjzCrP5fz0uSzdVzmrO+LO9AhNTSO26/IjHh/MZmAB0Y7XDHU/Q== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR02MB5189.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(136003)(346002)(39850400004)(366004)(396003)(376002)(186003)(52536014)(45080400002)(55016002)(5660300002)(9686003)(478600001)(316002)(33656002)(71200400001)(86362001)(66446008)(66946007)(76116006)(64756008)(26005)(9326002)(2906002)(8936002)(15650500001)(7696005)(6506007)(83380400001)(8676002)(110136005)(66476007)(66556008); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: X8pXeYsS5HCbioTDaoF/YhLjhePqqmIS50heImiHrHGMtqDxc1TZm9NFCr/7w7PEzBvsKrfCMh6PGkXgk+gNbytSiJ7E/QZWRchlP9anEbVwxXn3CVhlcmjUIIPfDPfIhSnnuCPGLoYAcjRKMN9GkLE+8tH/AZ/B0w7jUbTAUZfLeowWPfEogReIXCnfVm8OfMJ1LjJngsulxCGCPyu0JmkTkwyaOHGLXMfCFZINuF2TKgXzX9tNs4wxeO1JoILYz028d77PsymiBLACcItRw3g0Eq9SH0Ce9wifsoXuHymzloWNTorGntySLCfhWDUAtfSFORsDBCEu1Q30tzhu3hT0Wfus3P4+o12575UTlW8mIbXL2C+4fC++528E6Zfa/F6BPjKq2OtGDj76FsqysDaS1UwjdoszFyNeIEkSlWc0B6c9Dr9cxVhlqedVZEuylHjrOEj+bqiz+RWVHnohePXO8xKi2ciaQM831kiZDks= Content-Type: multipart/alternative; boundary="_000_BYAPR02MB5189FF21A49BA034796C44F1F3790BYAPR02MB5189namp_" MIME-Version: 1.0 X-OriginatorOrg: metaswitch.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BYAPR02MB5189.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: d2a3a2f0-66a1-43c9-75ca-08d82e5eebcd X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2020 16:47:28.9620 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9d9e56eb-f613-4ddb-b27b-bfcdf14b2cdb X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: wal16np95XlAruZX8iNOxCOQ/h3Dt4AUxkzBrzfve5+Obyb1j56SxW1hMHVcmorYCaw6tIPsjkvjfiUtk7B0kA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR02MB4711 Archived-At: Subject: [stir] Potential security vulnerability in STIR/DIV X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 16:47:33 -0000 --_000_BYAPR02MB5189FF21A49BA034796C44F1F3790BYAPR02MB5189namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hello, I believe I've come across a security vulnerability in the STIR system that= is made exploitable by the introduction of DIV passports, that I haven't s= een discussed here in any detail (sorry if it has been). There are currentl= y mitigations for it in the passport spec, however I don't believe they go = far enough to prevent this attack. The high level summary is that an attacker can impersonate an entity that c= alled them by pretending they redirected that call to the recipient. An example: Trusted: A party trusted by Subject, which Attacker wishes to impersonate Attacker: The party wishing to impersonate Trusted Subject: The intended target of Attacker, who will see a verified call comi= ng from Trusted 1. Attacker gets Trusted to call them. This is a reasonable operation, and is actually quite a common feature of s= upport companies so you don't have to sit on hold. 1. Attacker answers/rejects the call and saves off the SHAKEN passport f= or Trusted -> Attacker. 2. Attacker sets up a redirect from them to their intended Subject. 3. Attacker constructs a call (claiming to be) from Trusted to Attacker = with the previously saved SHAKEN passport. 4. The call will be verified, then redirected to Subject with a DIV pass= port for Attacker -> Subject. This does rely on the certificate signing the DIV to belong to a trusted en= tity, this seems possible, as the redirect could be carried out by Attacker= 's service provider. Attacker's SP may refuse to redirect after some time due to IaT timeouts, b= ut this is not required by the spec and I believe this can be worked around= by, for example, repeatedly bouncing new calls off an accomplice. 1. Subject receives a call claiming to be from Trusted (albeit redirecte= d from Attacker) with a valid passport chain of Trusted -> Attacker -> Subj= ect. Both passports will be signed by trusted entities: Trusted's SP and Attacke= r's SP. IaT doesn't provide much protection here as, in the presence of DIV passpor= ts, the valid time range must be set reasonably high to allow for the possi= bility of ring-arounds. The origid and attest will be associated with Trusted, eroding any automate= d databases of robocalls based on the origid. The "mky" claim seems to be the solution that is currently built into passp= orts, however, it is currently optional, and as far as I am aware using cer= tificates to authenticate the ends of a media stream is very rare in practi= ce. Unfortunately, I'm not able to come up with a solution and I am hoping that= is where you will be able to step in. I believe to avoid this, there needs= to be more validation of the media stream that is created, either in the f= orm of more data being signed or enforcing that the media participants are = authenticated. Thank you, Jack Rickard | Software Engineer | Metaswitch The Faster Way Forward Office +44 20 8196 9801 Metaswitch is a Microsoft company --_000_BYAPR02MB5189FF21A49BA034796C44F1F3790BYAPR02MB5189namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hello,

 

I believe I've come across a security vulnerability = in the STIR system that is made exploitable by the introduction of DIV pass= ports, that I haven't seen discussed here in any detail (sorry if it has be= en). There are currently mitigations for it in the passport spec, however I don't believe they go far enough to= prevent this attack.

 

The high level summary is that an attacker can imper= sonate an entity that called them by pretending they redirected that call t= o the recipient.

 

An example:

 

Trusted: A party trusted by Subject, which Attacker = wishes to impersonate

Attacker: The party wishing to impersonate Trusted

Subject: The intended target of Attacker, who will s= ee a verified call coming from Trusted

 

  1. Attacker gets Trusted to call them.

This is a reasonable operation, and is actual= ly quite a common feature of support companies so you don't have to sit on = hold.

  1. Attacker answers/rejects the call and saves off the SHAKEN passport f= or Trusted -> Attacker.
  2. Attacker sets up a redirect= from them to their intended Subject.
  3. Attacker constru= cts a call (claiming to be) from Trusted to Attacker with the previously sa= ved SHAKEN passport.
  4. The call will be verified, then r= edirected to Subject with a DIV passport for Attacker -> Subject.

This does rely on the certificate signing the= DIV to belong to a trusted entity, this seems possible, as the redirect co= uld be carried out by Attacker's service provider.
Attacker's SP may refuse to redirect after some time due to IaT timeouts, b= ut this is not required by the spec and I believe this can be worked around= by, for example, repeatedly bouncing new calls off an accomplice.

  1. Subject receives a call claiming to be from Trusted (albeit redirecte= d from Attacker) with a valid passport chain of Trusted -> Attacker ->= ; Subject.

Both passports will be signed by trusted enti= ties: Trusted's SP and Attacker's SP.

IaT doesn't provide muc= h protection here as, in the presence of DIV passports, the valid time rang= e must be set reasonably high to allow for the possibility of ring-arounds.=

The origid and attest w= ill be associated with Trusted, eroding any automated databases of robocall= s based on the origid.

 

 

 

The "mky" claim seems to be the solution t= hat is currently built into passports, however, it is currently optional, a= nd as far as I am aware using certificates to authenticate the ends of a me= dia stream is very rare in practice.

 

Unfortunately, I'm not able to come up with a soluti= on and I am hoping that is where you will be able to step in. I believe to = avoid this, there needs to be more validation of the media stream that is c= reated, either in the form of more data being signed or enforcing that the media participants are authenticat= ed.

 

Thank you,

Jack R= ickard | Software Engineer | Metaswitch
The Faster Way Forward
Office +44 20 8196 9801

Metaswitc= h is a Microsoft company

 

--_000_BYAPR02MB5189FF21A49BA034796C44F1F3790BYAPR02MB5189namp_-- From nobody Wed Jul 22 15:52:44 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1EC3C3A08BA; Wed, 22 Jul 2020 15:52:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=team.neustar header.b=WJUCW6DO; dkim=pass (1024-bit key) header.d=neustar.onmicrosoft.com header.b=hOVy+WHk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HLJSJYWwC8bJ; Wed, 22 Jul 2020 15:52:39 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0a-0018ba01.pphosted.com [67.231.149.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 67EB73A08B2; Wed, 22 Jul 2020 15:52:39 -0700 (PDT) Received: from pps.filterd (m0078664.ppops.net [127.0.0.1]) by mx0a-0018ba01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06MMiq4G029651; Wed, 22 Jul 2020 18:52:39 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=team.neustar; h=from : to : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=team-neustar; bh=/3+hosbhKf8DBevcjoqzZgYE9rlURibt9H3w5KRDVMY=; b=WJUCW6DOaiM+Kf0phl0mLkB8JLMYfEhmVEJDWuU3p/bwvcFSCmOXz+PzNsFks39ZXN5L pyirJYw22Hw25nacQYwYTn7IKeMhpbuYEYfwSKonbukA7b6a+Lx65Olvkz1Un+p17ERB HyRRO7Tvi3zesFewtHpp+e45jOpRmSftYz9h568ct4lE1wUFAvjBOjBkmYU6gThkxCbu qc9DaT12GHYuyUD3BZKNKeDnC/p6LowUHaMCFa5VLmicA5LgSuBS5kvu2SjeT/tOtPzT mu3WDscvgrW02iExKyWG1spWrx5jkyVai/kTCVZgmqvyBJed8HUaXrKMF9X5jCP9OwiT xg== Received: from nam11-co1-obe.outbound.protection.outlook.com (mail-co1nam11lp2168.outbound.protection.outlook.com [104.47.56.168]) by mx0a-0018ba01.pphosted.com with ESMTP id 32buqx9eca-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 22 Jul 2020 18:52:38 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=M8Mz9zEs07lfTeQjrxwzH+4Qr8f70wiF7X3LIfs2K0x8Tuvl2vAsg6LRmNh5je2NNE9NNKTUA5b5FRU5AGSWulr3s66eN28othyBaGdT42etMIUoCtVhEPcUWE/saeFgAdSPD316eDP+oRn6DKinOf9GnFPC3o5buXfB2sS+/bvlzrZuaRbFFXr85hnbVP4/HWpHNeuwOXl9ibL9JSrpEwLiaxF3oHXHVH4vUuJV06fxfvLSvd7OnTz8cwcvrHDXo7jQhae53L2W594Uo48vnALuelcrLC/MxIw1l54PLXMwHOjjosEUHj778XXuixPfYLO/nfkhAxyxEPvgKQADSw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/3+hosbhKf8DBevcjoqzZgYE9rlURibt9H3w5KRDVMY=; b=jG4VPFiQfNnoHl2vhhCp1j5HiDwmPQQ6k9xmkhl9LLFoZZE/JAU5Y3Gea5/c7sTXs6nXGwXNUp9X8Wr7YQpzh8m7M2TlSXxfpbfpiYhn8LJ3P/iavD3z+oWv5WrWNEAJzO3YyLTqfzr4igjCzwu8muV2mip7uxkO/pOD1B+0QE0y0Y81njX4WEvahXXEgbvb2sUSgNVvB4VvFsh/i3LaHT7tzdRgr1Lc9DWVN1HA24skl1GQ9HjR/LAKypcikEFIjL0TZIsKV6QmCHRXNELUL13Dwh14mXZokC/ALMhswMSBIVH0SIIYRVuc9Y7ce69Xy54N19O7tw4qSlbeCT0abg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=team.neustar; dmarc=pass action=none header.from=team.neustar; dkim=pass header.d=team.neustar; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=neustar.onmicrosoft.com; s=selector1-neustar-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/3+hosbhKf8DBevcjoqzZgYE9rlURibt9H3w5KRDVMY=; b=hOVy+WHk9ur5G80wrvGG0GeFlQs8IXT228LcVDc6ymsY0sFDaD7IdtOIXfYj+iQGT6sQEMGugga/bwdIGrZwTJjNPps8glJPCjlHCqI9vWphtrPXnnxmowc7ImWckboi8jp0rviX6PVCGCPqgoxmX0XvkvrSuupfas7XUKATXrE= Received: from BY5PR17MB3569.namprd17.prod.outlook.com (2603:10b6:a03:1b9::20) by BYAPR17MB2487.namprd17.prod.outlook.com (2603:10b6:a03:85::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.25; Wed, 22 Jul 2020 22:52:35 +0000 Received: from BY5PR17MB3569.namprd17.prod.outlook.com ([fe80::503b:2ce0:8d8b:6b15]) by BY5PR17MB3569.namprd17.prod.outlook.com ([fe80::503b:2ce0:8d8b:6b15%5]) with mapi id 15.20.3216.023; Wed, 22 Jul 2020 22:52:35 +0000 From: "Peterson, Jon" To: Jack Rickard , "stir@ietf.org" , "draft-ietf-stir-passport-divert@ietf.org" Thread-Topic: Potential security vulnerability in STIR/DIV Thread-Index: AdZgO7RfMuiVRPd/TYi0mhEaKJnUqQABGmKA Date: Wed, 22 Jul 2020 22:52:35 +0000 Message-ID: <89AC11DC-7E1A-4D1E-9CB8-96C98E790EF5@team.neustar> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.17.200615 authentication-results: metaswitch.com; dkim=none (message not signed) header.d=none;metaswitch.com; dmarc=none action=none header.from=team.neustar; x-originating-ip: [2600:1700:2ec0:8108::4] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 0c8514ea-21dd-48d3-99be-08d82e91ed40 x-ms-traffictypediagnostic: BYAPR17MB2487: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: rMFXG7gQUZP3d0cRw1bEW2BYEyuporK5Zg57glsvTPHUD6nkqIQpHj5YxnOTjhPUYIA7/NjtzCoOoLHdyWoOyy1UmwCi0k8Jg3H4Sq119quxq8WBBfSGEHgPw2pJskVLzinssizF2EaJvsPnkzckK2OT5NODqLraAyeMsj8M5QGJDmqBKRmXhbIIZt6XIW32/3Mx2ETm17cacdqeTZYtZOvw2dzFDhlHbNwgp+lI0EEwViy8HT2e7W6SB+6Bt+t07GXtv/InXWXrsbTk/J9M9cXd8pGHB14emTWKTeA53YFy8xnCuqvhYpTeKztJy1gqQJsHpbH32DGbyYh94P3KeVaQcCwAEDst6vPB9l1esQotw8aZ4yi/962zoJ1P+u6m x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY5PR17MB3569.namprd17.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(376002)(346002)(39860400002)(396003)(136003)(366004)(6486002)(15650500001)(5660300002)(66446008)(2906002)(33656002)(86362001)(76116006)(53546011)(66946007)(66476007)(66556008)(64756008)(45080400002)(8676002)(6506007)(8936002)(316002)(186003)(2616005)(71200400001)(478600001)(6512007)(110136005)(83380400001)(46492007); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: ME9CHoG8kNv7h8c8LXONKHgyalCz0e5iawMBMNFdk2oY9aL4I3862C3/uuw1EaG9iu3R6JOgTn6LuHyqQsZIMeXbHA+a9k83TthNJc8QRdLtEk347BdIayYelw7I7+qHVi7iMP0jbAPk1N1W7eMPsYIpXfj6IpzcI4wFoLYqHe2OcodIBFpR5MgGLjdEFTdsDquSjL1SJh8645u2athJmUSqv6yS1nmN5aKmlctC+oc5eNzYoy3J3MHTomib8E4RyFwdrRLHzs3z08BRjkpqCHEHwvnI0HMaanvYWMoAirlK3OsQ1FPEGSBKEB2K90yyVJJFKxFMoCQKkHkSjgX2AR8md/fSkBxW2QuSppsjUtQ6OMVKtdBqzWaeAdrYzv/2tMTfHk1RfzMu5gZH3Un3ZDxDRYXcUs9M8VilgsC8P6edGv/3KyM1t29YBFmKJwGhu/Opx59kpT3FHsr7HCfDmrZ3juCq0QInvvQcJfajHubjGuOVddH/maAmQqPtVA7ut8kEroVko9DkFdw+uR9D1A== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_89AC11DC7E1A4D1E9CB896C98E790EF5teamneustar_" MIME-Version: 1.0 X-OriginatorOrg: team.neustar X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY5PR17MB3569.namprd17.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0c8514ea-21dd-48d3-99be-08d82e91ed40 X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2020 22:52:35.7205 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 73a2bbc1-f307-47c4-8f94-5f379c68bc30 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Mt9cY7exgpVKYqjYyVVax9MgAGvGAP2h4JBPuE7UOeH34Mmta8C7XvHj6CSaJvXPtI3Du0otfUc7O3mYXMlt63EqIBvSdJymsZAwX2UhsdU= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR17MB2487 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-22_16:2020-07-22, 2020-07-22 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 spamscore=0 impostorscore=0 priorityscore=1501 malwarescore=0 mlxlogscore=999 phishscore=0 suspectscore=0 mlxscore=0 bulkscore=0 lowpriorityscore=0 clxscore=1011 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2006250000 definitions=main-2007220142 Archived-At: Subject: Re: [stir] Potential security vulnerability in STIR/DIV X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2020 22:52:42 -0000 --_000_89AC11DC7E1A4D1E9CB896C98E790EF5teamneustar_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQpQb3RlbnRpYWwg4oCcYmFpdGluZ+KAnSBhdHRhY2tzIG9mIHRoaXMgZm9ybSBlbWVyZ2Ugd2hl biB5b3UgY29tYmluZSBiYXNlbGluZSBTVElSIHdpdGggY2FsbCBmb3J3YXJkaW5nLCBhbmQgYXJl IHRoZSBtYWluIHRocmVhdCBhcnRpY3VsYXRlZCBpbiB0aGUgSUVURiDigJxkaXbigJ0gZHJhZnQu IFRoZSBpbnRyb2R1Y3Rpb24gZGVzY3JpYmVzIHRoZW0gYXMgZm9sbG93czoNCg0KICAgSWYgQWxp Y2UgY2FsbHMgQm9iLCBmb3IgZXhhbXBsZSwgQm9iIG1pZ2h0DQogICBhdHRlbXB0IHRvIGN1dC1h bmQtcGFzdGUgdGhlIElkZW50aXR5IGhlYWRlciBmaWVsZCBpbiBBbGljZSdzIElOVklURQ0KICAg aW50byBhIG5ldyBJTlZJVEUgdGhhdCBCb2Igc2VuZHMgdG8gQ2Fyb2wsIGFuZCB0aHVzIGJlIGFi bGUgdG8gZm9vbA0KICAgQ2Fyb2wgaW50byB0aGlua2luZyB0aGUgY2FsbCBjYW1lIGZyb20gQWxp Y2UgYW5kIG5vdCBCb2IuIFdpdGggdGhlDQogICBzaWduYXR1cmUgb3ZlciB0aGUgVG8gaGVhZGVy IGZpZWxkIHZhbHVlLCB0aGUgSU5WSVRFIENhcm9sIHNlZXMgd2lsbA0KICAgY2xlYXJseSBoYXZl IGJlZW4gZGVzdGluZWQgb3JpZ2luYWxseSBmb3IgQm9iLCBhbmQgdGh1cyBDYXJvbCBjYW4NCiAg IHZpZXcgdGhlIElOVklURSBhcyBzdXNwZWN0Lg0KDQpUaGF0IGRlc2NyaWJlcyB0aGUgc2l0dWF0 aW9uIGluIGEgd29ybGQgd2l0aG91dCDigJxkaXbigJ0sIHNvIHRoZSBxdWVzdGlvbiBpcywgZG9l cyDigJxkaXbigJ0gbWFrZSB0aGVzZSBzb3J0cyBvZiBhdHRhY2tzIGVhc2llciB0byBoYXJkZXIg dG8gbW91bnQ/DQoNCldpdGhvdXQg4oCcZGl24oCdLCBpbiB0aGUgZXhhbXBsZSBhYm92ZSwgQ2Fy b2wgd2lsbCBzZWUgdGhhdCB0aGUgb3JpZ2luYWwgY2FsbGVkIG51bWJlciBkb2VzIG5vdCBtYXRj aCBoZXJzLCBhbmQgY2FuIGRlY2lkZSBvbiB0aG9zZSBncm91bmRzIHRvIHJlamVjdCB0aGUgY2Fs bC4gQnV0IGJlYXIgaW4gbWluZCB0aGlzIGlzIGFsc28gd2hhdCBDYXJvbCB3b3VsZCBzZWUgaW4g bGVnaXRpbWF0ZSBmb3J3YXJkaW5nIGNhc2VzLCBzbyBhIG1vcmUgbnVhbmNlZCBsb2dpYyB3b3Vs ZCBwcm9iYWJseSBiZSB1c2VkLiBTaGUgY291bGQgZGVjaWRlIHRoYXQgaWYgdGhlIG9yaWdpbmFs IGNhbGxlZCBudW1iZXIgaXMgYSBudW1iZXIgdGhhdCBzaG91bGQgYmUgZm9yd2FyZGluZyBjYWxs cyB0byBoZXIgKHNheSwgaWYgaXQgd2FzIGhlciBvZmZpY2UpLCB0aGF0IHNoZSBzaG91bGQgYWNj ZXB0IHRoZSBjYWxsIGFueXdheS4gWW91IGNvdWxkIGV2ZW4gaW1hZ2luZSBhcHBsaWNhdGlvbiBi ZWhhdmlvciB0aGF0IHdvdWxkIGVuZm9yY2UgcG9saWNpZXMgYWxvbmcgdGhvc2UgbGluZXMgb24g aGVyIGJlaGFsZi4gSG93ZXZlciwgQ2Fyb2wgaGFzIG5vIGFzc3VyYW5jZSB0aGF0IGl0IHdhcyBy ZWFsbHkgaGVyIG9mZmljZSB0aGF0IGZvcndhcmRlZCB0aGlzIGNhbGwsIHJhdGhlciB0aGFuIHNv bWUgZWF2ZXNkcm9wcGVyIHdobyBzb21laG93IGNhcHR1cmVkIHRoZSBQQVNTcG9yVCwgbm9yIGhv dyBtYW55IHRpbWVzIGl0IG1pZ2h0IGhhdmUgYmVlbiByZWRpcmVjdGVkIGJlZm9yZSByZWFjaGlu ZyBoZXIsIG9yIGFueXRoaW5nIGFsb25nIHRob3NlIGxpbmVzLg0KDQpUaG9zZSBhcmUgdGhlIGdh cHMgdGhhdCDigJxkaXbigJ0gaXMgbWVhbnQgdG8gZmlsbC4gSXQgaXMgbm90IGEgc3Vic3RpdHV0 ZSBmb3IgdGhlIHJlc3Qgb2YgdGhlIGxvZ2ljIGFuZCBwb2xpY3kgZGVzY3JpYmVkIGFib3ZlLCBi dXQgaXQgZ2l2ZXMgQ2Fyb2wgbW9yZSBpbmZvcm1hdGlvbiB0byBoZWxwIGZpZ3VyZSBvdXQgaWYg dGhlIGNhbGwgaXMgc3VzcGVjdCBhbmQgd2hhdCB0byBkbyBhYm91dCBpdC4gV2l0aCDigJxkaXbi gJ0sIHdoYXQgQ2Fyb2wgc2VlcyBpcyBhIHNlY29uZCBQQVNTcG9yVCBjcmVhdGVkIGFuZCBzaWdu ZWQgYnkgQm9iLCB3aGljaCBhY3R1YWxseSBnaXZlcyBDYXJvbCB0aGUgYXNzdXJhbmNlIG9mIHdo ZXRoZXIgdGhlIGludGVuZGVkIGNhbGxlZCBwYXJ0eSBpcyBvbmUgd2hvIHJldGFyZ2V0ZWQgdGhl IGNhbGwsIHdoaWNoIHlvdSBkb27igJl0IGdldCBpbiB0aGUgYWJzZW5jZSBvZiDigJxkaXbigJ0u IElmIEJvYiBpcyBkb2luZyB0aGlzIG1hbGljaW91c2x5LCB0aGUg4oCcZGl24oCdIGhlIHByb3Zp ZGVkIGhhcyBnaXZlbiBDYXJvbCB0aGUgbWVhbnMgdG8gaHVudCBoaW0gZG93biBmb3IgcmVkcmVz cywgd2hpY2ggaXMgbm90IGV4YWN0bHkgYSBzdHJvbmcgaW5jZW50aXZlIGZvciBoaW0gdG8gdXNl IOKAnGRpduKAnS4gQnV0IGF0IHRoZSBlbmQgb2YgdGhlIGRheSwgaXQgaXMgQ2Fyb2wgd2hvIG5l ZWRzIHRvIGRlY2lkZSBpZiBhIGZvcndhcmRlZCBjYWxsIGZyb20gQm9iIHNob3VsZCBiZSB0cnVz dGVkIG9yIG5vdCDigJMg4oCcZGl24oCdIGlzIGNlcnRhaW5seSBub3Qgc3VnZ2VzdGluZyB0aGF0 IHRydXN0IGlzIGF1dG9tYXRpYywgbm9yIHRoYXQgdGhlIHByZXNlbmNlIG9mIGEg4oCcZGl24oCd IHRoYXQgY29ycmVjdGx5IGNoYWlucyB0byB0aGUgb3JpZ2luYWwgUEFTU3BvclQgaXMgYSBzdWJz dGl0dXRlIGZvciB0aGUgcG9saWN5IGFuZCB0cnVzdCBkZWNpc2lvbiBtYWRlIG9uIHRoZSB0ZXJt aW5hdGluZyBzaWRlIG9mIGEgY2FsbC4gQXMgd2l0aCBiYXNlbGluZSBTVElSLCBqdXN0IGJlY2F1 c2Ugc29tZXRoaW5nIHZhbGlkYXRlcyBhdCBhIHByb3RvY29sIGxldmVsIGRvZXNu4oCZdCBtZWFu IHlvdSBzaG91bGQgdHJ1c3QgaXQsIG5vciB0aGF0IGxvY2FsIHBvbGljeSBkb2VzIG5vdCBkZXRl cm1pbmUgaG93IHlvdSB0cmVhdCBjYWxscy4NCg0KQnV0IGFsbCB0aGF0IHNhaWQsIGlmIHlvdeKA mXJlIHNlcmlvdXMgYWJvdXQgc2VjdXJpdHksIHRoZW4geWVzLCB1c2luZyBEVExTLVNSVFAgd2l0 aCDigJxta2V54oCdIGlzIGdvaW5nIHRvIHByb3ZpZGUgeW91IHdpdGggYSBiZXR0ZXIgYXNzdXJh bmNlLg0KDQpKb24gUGV0ZXJzb24NCk5ldXN0YXIsIEluYy4NCg0KRnJvbTogSmFjayBSaWNrYXJk IDxKYWNrLlJpY2thcmRAbWV0YXN3aXRjaC5jb20+DQpEYXRlOiBXZWRuZXNkYXksIEp1bHkgMjIs IDIwMjAgYXQgOTo0NyBBTQ0KVG86ICJzdGlyQGlldGYub3JnIiA8c3RpckBpZXRmLm9yZz4sICJk cmFmdC1pZXRmLXN0aXItcGFzc3BvcnQtZGl2ZXJ0QGlldGYub3JnIiA8ZHJhZnQtaWV0Zi1zdGly LXBhc3Nwb3J0LWRpdmVydEBpZXRmLm9yZz4sICJQZXRlcnNvbiwgSm9uIiA8am9uLnBldGVyc29u QHRlYW0ubmV1c3Rhcj4NClN1YmplY3Q6IFBvdGVudGlhbCBzZWN1cml0eSB2dWxuZXJhYmlsaXR5 IGluIFNUSVIvRElWDQpSZXNlbnQtRnJvbTogPGFsaWFzLWJvdW5jZXNAaWV0Zi5vcmc+DQpSZXNl bnQtVG86IDxqb24ucGV0ZXJzb25AdGVhbS5uZXVzdGFyPg0KUmVzZW50LURhdGU6IFdlZG5lc2Rh eSwgSnVseSAyMiwgMjAyMCBhdCA5OjQ3IEFNDQoNCkhlbGxvLA0KDQpJIGJlbGlldmUgSSd2ZSBj b21lIGFjcm9zcyBhIHNlY3VyaXR5IHZ1bG5lcmFiaWxpdHkgaW4gdGhlIFNUSVIgc3lzdGVtIHRo YXQgaXMgbWFkZSBleHBsb2l0YWJsZSBieSB0aGUgaW50cm9kdWN0aW9uIG9mIERJViBwYXNzcG9y dHMsIHRoYXQgSSBoYXZlbid0IHNlZW4gZGlzY3Vzc2VkIGhlcmUgaW4gYW55IGRldGFpbCAoc29y cnkgaWYgaXQgaGFzIGJlZW4pLiBUaGVyZSBhcmUgY3VycmVudGx5IG1pdGlnYXRpb25zIGZvciBp dCBpbiB0aGUgcGFzc3BvcnQgc3BlYywgaG93ZXZlciBJIGRvbid0IGJlbGlldmUgdGhleSBnbyBm YXIgZW5vdWdoIHRvIHByZXZlbnQgdGhpcyBhdHRhY2suDQoNClRoZSBoaWdoIGxldmVsIHN1bW1h cnkgaXMgdGhhdCBhbiBhdHRhY2tlciBjYW4gaW1wZXJzb25hdGUgYW4gZW50aXR5IHRoYXQgY2Fs bGVkIHRoZW0gYnkgcHJldGVuZGluZyB0aGV5IHJlZGlyZWN0ZWQgdGhhdCBjYWxsIHRvIHRoZSBy ZWNpcGllbnQuDQoNCkFuIGV4YW1wbGU6DQoNClRydXN0ZWQ6IEEgcGFydHkgdHJ1c3RlZCBieSBT dWJqZWN0LCB3aGljaCBBdHRhY2tlciB3aXNoZXMgdG8gaW1wZXJzb25hdGUNCkF0dGFja2VyOiBU aGUgcGFydHkgd2lzaGluZyB0byBpbXBlcnNvbmF0ZSBUcnVzdGVkDQpTdWJqZWN0OiBUaGUgaW50 ZW5kZWQgdGFyZ2V0IG9mIEF0dGFja2VyLCB3aG8gd2lsbCBzZWUgYSB2ZXJpZmllZCBjYWxsIGNv bWluZyBmcm9tIFRydXN0ZWQNCg0KDQoxLiAgICAgICBBdHRhY2tlciBnZXRzIFRydXN0ZWQgdG8g Y2FsbCB0aGVtLg0KDQpUaGlzIGlzIGEgcmVhc29uYWJsZSBvcGVyYXRpb24sIGFuZCBpcyBhY3R1 YWxseSBxdWl0ZSBhIGNvbW1vbiBmZWF0dXJlIG9mIHN1cHBvcnQgY29tcGFuaWVzIHNvIHlvdSBk b24ndCBoYXZlIHRvIHNpdCBvbiBob2xkLg0KDQoyLiAgICAgICBBdHRhY2tlciBhbnN3ZXJzL3Jl amVjdHMgdGhlIGNhbGwgYW5kIHNhdmVzIG9mZiB0aGUgU0hBS0VOIHBhc3Nwb3J0IGZvciBUcnVz dGVkIC0+IEF0dGFja2VyLg0KDQozLiAgICAgICBBdHRhY2tlciBzZXRzIHVwIGEgcmVkaXJlY3Qg ZnJvbSB0aGVtIHRvIHRoZWlyIGludGVuZGVkIFN1YmplY3QuDQoNCjQuICAgICAgIEF0dGFja2Vy IGNvbnN0cnVjdHMgYSBjYWxsIChjbGFpbWluZyB0byBiZSkgZnJvbSBUcnVzdGVkIHRvIEF0dGFj a2VyIHdpdGggdGhlIHByZXZpb3VzbHkgc2F2ZWQgU0hBS0VOIHBhc3Nwb3J0Lg0KDQo1LiAgICAg ICBUaGUgY2FsbCB3aWxsIGJlIHZlcmlmaWVkLCB0aGVuIHJlZGlyZWN0ZWQgdG8gU3ViamVjdCB3 aXRoIGEgRElWIHBhc3Nwb3J0IGZvciBBdHRhY2tlciAtPiBTdWJqZWN0Lg0KDQpUaGlzIGRvZXMg cmVseSBvbiB0aGUgY2VydGlmaWNhdGUgc2lnbmluZyB0aGUgRElWIHRvIGJlbG9uZyB0byBhIHRy dXN0ZWQgZW50aXR5LCB0aGlzIHNlZW1zIHBvc3NpYmxlLCBhcyB0aGUgcmVkaXJlY3QgY291bGQg YmUgY2FycmllZCBvdXQgYnkgQXR0YWNrZXIncyBzZXJ2aWNlIHByb3ZpZGVyLg0KQXR0YWNrZXIn cyBTUCBtYXkgcmVmdXNlIHRvIHJlZGlyZWN0IGFmdGVyIHNvbWUgdGltZSBkdWUgdG8gSWFUIHRp bWVvdXRzLCBidXQgdGhpcyBpcyBub3QgcmVxdWlyZWQgYnkgdGhlIHNwZWMgYW5kIEkgYmVsaWV2 ZSB0aGlzIGNhbiBiZSB3b3JrZWQgYXJvdW5kIGJ5LCBmb3IgZXhhbXBsZSwgcmVwZWF0ZWRseSBi b3VuY2luZyBuZXcgY2FsbHMgb2ZmIGFuIGFjY29tcGxpY2UuDQoNCjYuICAgICAgIFN1YmplY3Qg cmVjZWl2ZXMgYSBjYWxsIGNsYWltaW5nIHRvIGJlIGZyb20gVHJ1c3RlZCAoYWxiZWl0IHJlZGly ZWN0ZWQgZnJvbSBBdHRhY2tlcikgd2l0aCBhIHZhbGlkIHBhc3Nwb3J0IGNoYWluIG9mIFRydXN0 ZWQgLT4gQXR0YWNrZXIgLT4gU3ViamVjdC4NCg0KQm90aCBwYXNzcG9ydHMgd2lsbCBiZSBzaWdu ZWQgYnkgdHJ1c3RlZCBlbnRpdGllczogVHJ1c3RlZCdzIFNQIGFuZCBBdHRhY2tlcidzIFNQLg0K SWFUIGRvZXNuJ3QgcHJvdmlkZSBtdWNoIHByb3RlY3Rpb24gaGVyZSBhcywgaW4gdGhlIHByZXNl bmNlIG9mIERJViBwYXNzcG9ydHMsIHRoZSB2YWxpZCB0aW1lIHJhbmdlIG11c3QgYmUgc2V0IHJl YXNvbmFibHkgaGlnaCB0byBhbGxvdyBmb3IgdGhlIHBvc3NpYmlsaXR5IG9mIHJpbmctYXJvdW5k cy4NClRoZSBvcmlnaWQgYW5kIGF0dGVzdCB3aWxsIGJlIGFzc29jaWF0ZWQgd2l0aCBUcnVzdGVk LCBlcm9kaW5nIGFueSBhdXRvbWF0ZWQgZGF0YWJhc2VzIG9mIHJvYm9jYWxscyBiYXNlZCBvbiB0 aGUgb3JpZ2lkLg0KDQoNCg0KVGhlICJta3kiIGNsYWltIHNlZW1zIHRvIGJlIHRoZSBzb2x1dGlv biB0aGF0IGlzIGN1cnJlbnRseSBidWlsdCBpbnRvIHBhc3Nwb3J0cywgaG93ZXZlciwgaXQgaXMg Y3VycmVudGx5IG9wdGlvbmFsLCBhbmQgYXMgZmFyIGFzIEkgYW0gYXdhcmUgdXNpbmcgY2VydGlm aWNhdGVzIHRvIGF1dGhlbnRpY2F0ZSB0aGUgZW5kcyBvZiBhIG1lZGlhIHN0cmVhbSBpcyB2ZXJ5 IHJhcmUgaW4gcHJhY3RpY2UuDQoNClVuZm9ydHVuYXRlbHksIEknbSBub3QgYWJsZSB0byBjb21l IHVwIHdpdGggYSBzb2x1dGlvbiBhbmQgSSBhbSBob3BpbmcgdGhhdCBpcyB3aGVyZSB5b3Ugd2ls bCBiZSBhYmxlIHRvIHN0ZXAgaW4uIEkgYmVsaWV2ZSB0byBhdm9pZCB0aGlzLCB0aGVyZSBuZWVk cyB0byBiZSBtb3JlIHZhbGlkYXRpb24gb2YgdGhlIG1lZGlhIHN0cmVhbSB0aGF0IGlzIGNyZWF0 ZWQsIGVpdGhlciBpbiB0aGUgZm9ybSBvZiBtb3JlIGRhdGEgYmVpbmcgc2lnbmVkIG9yIGVuZm9y Y2luZyB0aGF0IHRoZSBtZWRpYSBwYXJ0aWNpcGFudHMgYXJlIGF1dGhlbnRpY2F0ZWQuDQoNClRo YW5rIHlvdSwNCkphY2sgUmlja2FyZCB8IFNvZnR3YXJlIEVuZ2luZWVyIHwgTWV0YXN3aXRjaA0K VGhlIEZhc3RlciBXYXkgRm9yd2FyZA0KT2ZmaWNlICs0NCAyMCA4MTk2IDk4MDENCk1ldGFzd2l0 Y2ggaXMgYSBNaWNyb3NvZnQgY29tcGFueQ0KDQo= --_000_89AC11DC7E1A4D1E9CB896C98E790EF5teamneustar_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpw cmUNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZv cm1hdHRlZCBDaGFyIjsNCgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglm b250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KcC5Nc29MaXN0 UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdyYXBoLCBkaXYuTXNvTGlzdFBhcmFncmFwaA0KCXtt c28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFyZ2luLXRvcDowaW47DQoJbWFyZ2luLXJpZ2h0OjBp bjsNCgltYXJnaW4tYm90dG9tOjBpbjsNCgltYXJnaW4tbGVmdDouNWluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDAN Cgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0K CW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2lu LWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNh bnMtc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTcNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7 DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9 DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglm b250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNw YW4uSFRNTFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0 dGVkIENoYXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRN TCBQcmVmb3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KLk1zb0NocERl ZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9 DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGlu IDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlv bjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6OTk1 NjczOTg7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi0xNTExNDk2NDMwO30NCkBsaXN0IGwwOmxl dmVsMQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6NjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6LjVpbjsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30N CkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjc2MDU2NjcyOTsNCgltc28tbGlzdC10eXBlOmh5YnJp ZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MjkxNjUyOTgyIDEzNDgwNzU2NyAxMzQ4MDc1Nzcg MTM0ODA3NTc5IDEzNDgwNzU2NyAxMzQ4MDc1NzcgMTM0ODA3NTc5IDEzNDgwNzU2NyAxMzQ4MDc1 NzcgMTM0ODA3NTc5O30NCkBsaXN0IGwxOmxldmVsMQ0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu O30NCkBsaXN0IGwxOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dl cjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwxOmxldmVsMw0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9 DQpAbGlzdCBsMTpsZXZlbDQNCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTps ZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMTpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3QgbDE6bGV2 ZWw3DQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDE6bGV2ZWw4DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25l Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 fQ0KQGxpc3QgbDE6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2Vy Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwyDQoJe21zby1saXN0LWlkOjE0 NjAxMDYxNzg7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjEzMzY3MjgwNTI7fQ0KQGxpc3QgbDI6 bGV2ZWwxDQoJe21zby1sZXZlbC1zdGFydC1hdDoyOw0KCW1zby1sZXZlbC10YWItc3RvcDouNWlu Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 fQ0KQGxpc3QgbDMNCgl7bXNvLWxpc3QtaWQ6MTU1MDI2NjQ1NjsNCgltc28tbGlzdC10ZW1wbGF0 ZS1pZHM6LTc2Mjk2MjAwMDt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJn aW4tYm90dG9tOjBpbjt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMi IGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9u MSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPlBvdGVudGlhbCDigJxiYWl0aW5n4oCdIGF0dGFja3Mgb2YgdGhpcyBmb3Jt IGVtZXJnZSB3aGVuIHlvdSBjb21iaW5lIGJhc2VsaW5lIFNUSVIgd2l0aCBjYWxsIGZvcndhcmRp bmcsIGFuZCBhcmUgdGhlIG1haW4gdGhyZWF0IGFydGljdWxhdGVkIGluIHRoZSBJRVRGIOKAnGRp duKAnSBkcmFmdC4gVGhlIGludHJvZHVjdGlvbiBkZXNjcmliZXMgdGhlbSBhcyBmb2xsb3dzOjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250 LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7 IElmIEFsaWNlIGNhbGxzIEJvYiwgZm9yIGV4YW1wbGUsIEJvYiBtaWdodDxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj4mbmJz cDsmbmJzcDsgYXR0ZW1wdCB0byBjdXQtYW5kLXBhc3RlIHRoZSBJZGVudGl0eSBoZWFkZXIgZmll bGQgaW4gQWxpY2UncyBJTlZJVEU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtD b3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7IGludG8gYSBuZXcgSU5W SVRFIHRoYXQgQm9iIHNlbmRzIHRvIENhcm9sLCBhbmQgdGh1cyBiZSBhYmxlIHRvIGZvb2w8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpi bGFjayI+Jm5ic3A7Jm5ic3A7IENhcm9sIGludG8gdGhpbmtpbmcgdGhlIGNhbGwgY2FtZSBmcm9t IEFsaWNlIGFuZCBub3QgQm9iLiBXaXRoIHRoZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsgc2lnbmF0 dXJlIG92ZXIgdGhlIFRvIGhlYWRlciBmaWVsZCB2YWx1ZSwgdGhlIElOVklURSBDYXJvbCBzZWVz IHdpbGw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 Oztjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7IGNsZWFybHkgaGF2ZSBiZWVuIGRlc3RpbmVkIG9y aWdpbmFsbHkgZm9yIEJvYiwgYW5kIHRodXMgQ2Fyb2wgY2FuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNw OyB2aWV3IHRoZSBJTlZJVEUgYXMgc3VzcGVjdC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPlRoYXQgZGVzY3JpYmVzIHRoZSBzaXR1YXRpb24gaW4gYSB3b3JsZCB3aXRob3V0IOKAnGRp duKAnSwgc28gdGhlIHF1ZXN0aW9uIGlzLCBkb2VzIOKAnGRpduKAnSBtYWtlIHRoZXNlIHNvcnRz IG9mIGF0dGFja3MgZWFzaWVyIHRvIGhhcmRlciB0byBtb3VudD88bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+V2l0aG91dCDigJxkaXbigJ0sIGluIHRoZSBleGFtcGxlIGFib3ZlLCBDYXJvbCB3aWxs IHNlZSB0aGF0IHRoZSBvcmlnaW5hbCBjYWxsZWQgbnVtYmVyIGRvZXMgbm90IG1hdGNoIGhlcnMs IGFuZCBjYW4gZGVjaWRlIG9uIHRob3NlIGdyb3VuZHMgdG8gcmVqZWN0IHRoZSBjYWxsLiBCdXQg YmVhciBpbiBtaW5kIHRoaXMgaXMgYWxzbyB3aGF0IENhcm9sIHdvdWxkIHNlZSBpbiBsZWdpdGlt YXRlIGZvcndhcmRpbmcgY2FzZXMsDQogc28gYSBtb3JlIG51YW5jZWQgbG9naWMgd291bGQgcHJv YmFibHkgYmUgdXNlZC4gU2hlIGNvdWxkIGRlY2lkZSB0aGF0IGlmIHRoZSBvcmlnaW5hbCBjYWxs ZWQgbnVtYmVyIGlzIGEgbnVtYmVyIHRoYXQgc2hvdWxkIGJlIGZvcndhcmRpbmcgY2FsbHMgdG8g aGVyIChzYXksIGlmIGl0IHdhcyBoZXIgb2ZmaWNlKSwgdGhhdCBzaGUgc2hvdWxkIGFjY2VwdCB0 aGUgY2FsbCBhbnl3YXkuIFlvdSBjb3VsZCBldmVuIGltYWdpbmUgYXBwbGljYXRpb24gYmVoYXZp b3INCiB0aGF0IHdvdWxkIGVuZm9yY2UgcG9saWNpZXMgYWxvbmcgdGhvc2UgbGluZXMgb24gaGVy IGJlaGFsZi4gSG93ZXZlciwgQ2Fyb2wgaGFzIG5vIGFzc3VyYW5jZSB0aGF0IGl0IHdhcyByZWFs bHkgaGVyIG9mZmljZSB0aGF0IGZvcndhcmRlZCB0aGlzIGNhbGwsIHJhdGhlciB0aGFuIHNvbWUg ZWF2ZXNkcm9wcGVyIHdobyBzb21laG93IGNhcHR1cmVkIHRoZSBQQVNTcG9yVCwgbm9yIGhvdyBt YW55IHRpbWVzIGl0IG1pZ2h0IGhhdmUgYmVlbiByZWRpcmVjdGVkDQogYmVmb3JlIHJlYWNoaW5n IGhlciwgb3IgYW55dGhpbmcgYWxvbmcgdGhvc2UgbGluZXMuPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPlRob3NlIGFyZSB0aGUgZ2FwcyB0aGF0IOKAnGRpduKAnSBpcyBtZWFudCB0byBmaWxsLiBJ dCBpcyBub3QgYSBzdWJzdGl0dXRlIGZvciB0aGUgcmVzdCBvZiB0aGUgbG9naWMgYW5kIHBvbGlj eSBkZXNjcmliZWQgYWJvdmUsIGJ1dCBpdCBnaXZlcyBDYXJvbCBtb3JlIGluZm9ybWF0aW9uIHRv IGhlbHAgZmlndXJlIG91dCBpZiB0aGUgY2FsbCBpcyBzdXNwZWN0IGFuZCB3aGF0IHRvIGRvIGFi b3V0IGl0LiBXaXRoIOKAnGRpduKAnSwNCiB3aGF0IENhcm9sIHNlZXMgaXMgYSBzZWNvbmQgUEFT U3BvclQgY3JlYXRlZCBhbmQgc2lnbmVkIGJ5IEJvYiwgd2hpY2ggYWN0dWFsbHkgZ2l2ZXMgQ2Fy b2wgdGhlIGFzc3VyYW5jZSBvZiB3aGV0aGVyIHRoZSBpbnRlbmRlZCBjYWxsZWQgcGFydHkgaXMg b25lIHdobyByZXRhcmdldGVkIHRoZSBjYWxsLCB3aGljaCB5b3UgZG9u4oCZdCBnZXQgaW4gdGhl IGFic2VuY2Ugb2Yg4oCcZGl24oCdLiBJZiBCb2IgaXMgZG9pbmcgdGhpcyBtYWxpY2lvdXNseSwg dGhlDQog4oCcZGl24oCdIGhlIHByb3ZpZGVkIGhhcyBnaXZlbiBDYXJvbCB0aGUgbWVhbnMgdG8g aHVudCBoaW0gZG93biBmb3IgcmVkcmVzcywgd2hpY2ggaXMgbm90IGV4YWN0bHkgYSBzdHJvbmcg aW5jZW50aXZlIGZvciBoaW0gdG8gdXNlIOKAnGRpduKAnS4gQnV0IGF0IHRoZSBlbmQgb2YgdGhl IGRheSwgaXQgaXMgQ2Fyb2wgd2hvIG5lZWRzIHRvIGRlY2lkZSBpZiBhIGZvcndhcmRlZCBjYWxs IGZyb20gQm9iIHNob3VsZCBiZSB0cnVzdGVkIG9yIG5vdCDigJMg4oCcZGl24oCdDQogaXMgY2Vy dGFpbmx5IG5vdCBzdWdnZXN0aW5nIHRoYXQgdHJ1c3QgaXMgYXV0b21hdGljLCBub3IgdGhhdCB0 aGUgcHJlc2VuY2Ugb2YgYSDigJxkaXbigJ0gdGhhdCBjb3JyZWN0bHkgY2hhaW5zIHRvIHRoZSBv cmlnaW5hbCBQQVNTcG9yVCBpcyBhIHN1YnN0aXR1dGUgZm9yIHRoZSBwb2xpY3kgYW5kIHRydXN0 IGRlY2lzaW9uIG1hZGUgb24gdGhlIHRlcm1pbmF0aW5nIHNpZGUgb2YgYSBjYWxsLiBBcyB3aXRo IGJhc2VsaW5lIFNUSVIsIGp1c3QgYmVjYXVzZQ0KIHNvbWV0aGluZyB2YWxpZGF0ZXMgYXQgYSBw cm90b2NvbCBsZXZlbCBkb2VzbuKAmXQgbWVhbiB5b3Ugc2hvdWxkIHRydXN0IGl0LCBub3IgdGhh dCBsb2NhbCBwb2xpY3kgZG9lcyBub3QgZGV0ZXJtaW5lIGhvdyB5b3UgdHJlYXQgY2FsbHMuPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkJ1dCBhbGwgdGhhdCBzYWlkLCBpZiB5b3XigJlyZSBzZXJp b3VzIGFib3V0IHNlY3VyaXR5LCB0aGVuIHllcywgdXNpbmcgRFRMUy1TUlRQIHdpdGgg4oCcbWtl eeKAnSBpcyBnb2luZyB0byBwcm92aWRlIHlvdSB3aXRoIGEgYmV0dGVyIGFzc3VyYW5jZS4NCjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Kb24gUGV0ZXJzb248bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPk5ldXN0YXIsIEluYy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4i Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOg0KPC9zcGFuPjwvYj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+SmFjayBSaWNrYXJkICZs dDtKYWNrLlJpY2thcmRAbWV0YXN3aXRjaC5jb20mZ3Q7PGJyPg0KPGI+RGF0ZTogPC9iPldlZG5l c2RheSwgSnVseSAyMiwgMjAyMCBhdCA5OjQ3IEFNPGJyPg0KPGI+VG86IDwvYj4mcXVvdDtzdGly QGlldGYub3JnJnF1b3Q7ICZsdDtzdGlyQGlldGYub3JnJmd0OywgJnF1b3Q7ZHJhZnQtaWV0Zi1z dGlyLXBhc3Nwb3J0LWRpdmVydEBpZXRmLm9yZyZxdW90OyAmbHQ7ZHJhZnQtaWV0Zi1zdGlyLXBh c3Nwb3J0LWRpdmVydEBpZXRmLm9yZyZndDssICZxdW90O1BldGVyc29uLCBKb24mcXVvdDsgJmx0 O2pvbi5wZXRlcnNvbkB0ZWFtLm5ldXN0YXImZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlBvdGVu dGlhbCBzZWN1cml0eSB2dWxuZXJhYmlsaXR5IGluIFNUSVIvRElWPGJyPg0KPGI+UmVzZW50LUZy b206IDwvYj4mbHQ7YWxpYXMtYm91bmNlc0BpZXRmLm9yZyZndDs8YnI+DQo8Yj5SZXNlbnQtVG86 IDwvYj4mbHQ7am9uLnBldGVyc29uQHRlYW0ubmV1c3RhciZndDs8YnI+DQo8Yj5SZXNlbnQtRGF0 ZTogPC9iPldlZG5lc2RheSwgSnVseSAyMiwgMjAyMCBhdCA5OjQ3IEFNPG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+SGVsbG8sPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ SSBiZWxpZXZlIEkndmUgY29tZSBhY3Jvc3MgYSBzZWN1cml0eSB2dWxuZXJhYmlsaXR5IGluIHRo ZSBTVElSIHN5c3RlbSB0aGF0IGlzIG1hZGUgZXhwbG9pdGFibGUgYnkgdGhlIGludHJvZHVjdGlv biBvZiBESVYgcGFzc3BvcnRzLCB0aGF0IEkgaGF2ZW4ndCBzZWVuIGRpc2N1c3NlZCBoZXJlIGlu IGFueSBkZXRhaWwgKHNvcnJ5IGlmIGl0IGhhcyBiZWVuKS4gVGhlcmUNCiBhcmUgY3VycmVudGx5 IG1pdGlnYXRpb25zIGZvciBpdCBpbiB0aGUgcGFzc3BvcnQgc3BlYywgaG93ZXZlciBJIGRvbid0 IGJlbGlldmUgdGhleSBnbyBmYXIgZW5vdWdoIHRvIHByZXZlbnQgdGhpcyBhdHRhY2suPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+VGhlIGhpZ2ggbGV2ZWwgc3VtbWFyeSBpcyB0aGF0IGFuIGF0dGFja2VyIGNh biBpbXBlcnNvbmF0ZSBhbiBlbnRpdHkgdGhhdCBjYWxsZWQgdGhlbSBieSBwcmV0ZW5kaW5nIHRo ZXkgcmVkaXJlY3RlZCB0aGF0IGNhbGwgdG8gdGhlIHJlY2lwaWVudC48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDs8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij5BbiBleGFtcGxlOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPlRydXN0ZWQ6IEEgcGFydHkgdHJ1c3RlZCBi eSBTdWJqZWN0LCB3aGljaCBBdHRhY2tlciB3aXNoZXMgdG8gaW1wZXJzb25hdGU8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5BdHRh Y2tlcjogVGhlIHBhcnR5IHdpc2hpbmcgdG8gaW1wZXJzb25hdGUgVHJ1c3RlZDxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPlN1Ympl Y3Q6IFRoZSBpbnRlbmRlZCB0YXJnZXQgb2YgQXR0YWNrZXIsIHdobyB3aWxsIHNlZSBhIHZlcmlm aWVkIGNhbGwgY29taW5nIGZyb20gVHJ1c3RlZDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjt0ZXh0 LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPg0KPCFbaWYgIXN1cHBvcnRM aXN0c10+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+MS48c3BhbiBzdHlsZT0iZm9udDo3 LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+QXR0YWNrZXIgZ2V0cyBUcnVz dGVkIHRvIGNhbGwgdGhlbS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdy YXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW4iPlRoaXMgaXMgYSByZWFzb25hYmxlIG9wZXJh dGlvbiwgYW5kIGlzIGFjdHVhbGx5IHF1aXRlIGEgY29tbW9uIGZlYXR1cmUgb2Ygc3VwcG9ydCBj b21wYW5pZXMgc28geW91IGRvbid0IGhhdmUgdG8gc2l0IG9uIGhvbGQuPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO3Rl eHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMSBsZXZlbDEgbGZvMyI+DQo8IVtpZiAhc3VwcG9y dExpc3RzXT48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj4yLjxzcGFuIHN0eWxlPSJmb250 OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5BdHRhY2tlciBhbnN3ZXJz L3JlamVjdHMgdGhlIGNhbGwgYW5kIHNhdmVzIG9mZiB0aGUgU0hBS0VOIHBhc3Nwb3J0IGZvciBU cnVzdGVkIC0mZ3Q7IEF0dGFja2VyLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQ YXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjt0ZXh0LWluZGVudDotLjI1aW47bXNv LWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPg0KPCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9 Im1zby1saXN0Oklnbm9yZSI+My48c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBO ZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9z cGFuPjwvc3Bhbj48IVtlbmRpZl0+QXR0YWNrZXIgc2V0cyB1cCBhIHJlZGlyZWN0IGZyb20gdGhl bSB0byB0aGVpciBpbnRlbmRlZCBTdWJqZWN0LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjt0ZXh0LWluZGVudDotLjI1 aW47bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPg0KPCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4g c3R5bGU9Im1zby1saXN0Oklnbm9yZSI+NC48c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtU aW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw Ow0KPC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+QXR0YWNrZXIgY29uc3RydWN0cyBhIGNhbGwgKGNs YWltaW5nIHRvIGJlKSBmcm9tIFRydXN0ZWQgdG8gQXR0YWNrZXIgd2l0aCB0aGUgcHJldmlvdXNs eSBzYXZlZCBTSEFLRU4gcGFzc3BvcnQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlz dFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuMGluO3RleHQtaW5kZW50Oi0uMjVpbjtt c28tbGlzdDpsMSBsZXZlbDEgbGZvMyI+DQo8IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHls ZT0ibXNvLWxpc3Q6SWdub3JlIj41LjxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVz IE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8 L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5UaGUgY2FsbCB3aWxsIGJlIHZlcmlmaWVkLCB0aGVuIHJl ZGlyZWN0ZWQgdG8gU3ViamVjdCB3aXRoIGEgRElWIHBhc3Nwb3J0IGZvciBBdHRhY2tlciAtJmd0 OyBTdWJqZWN0LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0 eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+VGhpcyBkb2VzIHJlbHkgb24gdGhlIGNlcnRpZmljYXRl IHNpZ25pbmcgdGhlIERJViB0byBiZWxvbmcgdG8gYSB0cnVzdGVkIGVudGl0eSwgdGhpcyBzZWVt cyBwb3NzaWJsZSwgYXMgdGhlIHJlZGlyZWN0IGNvdWxkIGJlIGNhcnJpZWQgb3V0IGJ5IEF0dGFj a2VyJ3Mgc2VydmljZSBwcm92aWRlci48YnI+DQpBdHRhY2tlcidzIFNQIG1heSByZWZ1c2UgdG8g cmVkaXJlY3QgYWZ0ZXIgc29tZSB0aW1lIGR1ZSB0byBJYVQgdGltZW91dHMsIGJ1dCB0aGlzIGlz IG5vdCByZXF1aXJlZCBieSB0aGUgc3BlYyBhbmQgSSBiZWxpZXZlIHRoaXMgY2FuIGJlIHdvcmtl ZCBhcm91bmQgYnksIGZvciBleGFtcGxlLCByZXBlYXRlZGx5IGJvdW5jaW5nIG5ldyBjYWxscyBv ZmYgYW4gYWNjb21wbGljZS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdy YXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0 OmwxIGxldmVsMSBsZm8zIj4NCjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJtc28t bGlzdDpJZ25vcmUiPjYuPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJv bWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48 L3NwYW4+PCFbZW5kaWZdPlN1YmplY3QgcmVjZWl2ZXMgYSBjYWxsIGNsYWltaW5nIHRvIGJlIGZy b20gVHJ1c3RlZCAoYWxiZWl0IHJlZGlyZWN0ZWQgZnJvbSBBdHRhY2tlcikgd2l0aCBhIHZhbGlk IHBhc3Nwb3J0IGNoYWluIG9mIFRydXN0ZWQgLSZndDsgQXR0YWNrZXIgLSZndDsgU3ViamVjdC48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MS4waW4iPkJvdGggcGFzc3BvcnRzIHdpbGwgYmUgc2lnbmVkIGJ5IHRydXN0ZWQgZW50 aXRpZXM6IFRydXN0ZWQncyBTUCBhbmQgQXR0YWNrZXIncyBTUC48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+SWFUIGRvZXNuJ3Qg cHJvdmlkZSBtdWNoIHByb3RlY3Rpb24gaGVyZSBhcywgaW4gdGhlIHByZXNlbmNlIG9mIERJViBw YXNzcG9ydHMsIHRoZSB2YWxpZCB0aW1lIHJhbmdlIG11c3QgYmUgc2V0IHJlYXNvbmFibHkgaGln aCB0byBhbGxvdyBmb3IgdGhlIHBvc3NpYmlsaXR5IG9mIHJpbmctYXJvdW5kcy48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbiI+VGhl IG9yaWdpZCBhbmQgYXR0ZXN0IHdpbGwgYmUgYXNzb2NpYXRlZCB3aXRoIFRydXN0ZWQsIGVyb2Rp bmcgYW55IGF1dG9tYXRlZCBkYXRhYmFzZXMgb2Ygcm9ib2NhbGxzIGJhc2VkIG9uIHRoZSBvcmln aWQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+VGhlICZxdW90O21r eSZxdW90OyBjbGFpbSBzZWVtcyB0byBiZSB0aGUgc29sdXRpb24gdGhhdCBpcyBjdXJyZW50bHkg YnVpbHQgaW50byBwYXNzcG9ydHMsIGhvd2V2ZXIsIGl0IGlzIGN1cnJlbnRseSBvcHRpb25hbCwg YW5kIGFzIGZhciBhcyBJIGFtIGF3YXJlIHVzaW5nIGNlcnRpZmljYXRlcyB0byBhdXRoZW50aWNh dGUgdGhlIGVuZHMgb2YgYSBtZWRpYSBzdHJlYW0gaXMgdmVyeQ0KIHJhcmUgaW4gcHJhY3RpY2Uu PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+VW5mb3J0dW5hdGVseSwgSSdtIG5vdCBhYmxlIHRvIGNvbWUgdXAg d2l0aCBhIHNvbHV0aW9uIGFuZCBJIGFtIGhvcGluZyB0aGF0IGlzIHdoZXJlIHlvdSB3aWxsIGJl IGFibGUgdG8gc3RlcCBpbi4gSSBiZWxpZXZlIHRvIGF2b2lkIHRoaXMsIHRoZXJlIG5lZWRzIHRv IGJlIG1vcmUgdmFsaWRhdGlvbiBvZiB0aGUgbWVkaWEgc3RyZWFtIHRoYXQgaXMgY3JlYXRlZCwg ZWl0aGVyDQogaW4gdGhlIGZvcm0gb2YgbW9yZSBkYXRhIGJlaW5nIHNpZ25lZCBvciBlbmZvcmNp bmcgdGhhdCB0aGUgbWVkaWEgcGFydGljaXBhbnRzIGFyZSBhdXRoZW50aWNhdGVkLjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPlRoYW5rIHlvdSw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48Yj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFu Z3VhZ2U6RU4tR0IiPkphY2sgUmlja2FyZCB8IFNvZnR3YXJlIEVuZ2luZWVyIHwgTWV0YXN3aXRj aDwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLUdCIj4NCjxi cj4NClRoZSBGYXN0ZXIgV2F5IEZvcndhcmQ8YnI+DQpPZmZpY2UgJiM0Mzs0NCAyMCA4MTk2IDk4 MDE8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLUdCIj5N ZXRhc3dpdGNoIGlzIGEgTWljcm9zb2Z0IGNvbXBhbnk8L3NwYW4+PG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_89AC11DC7E1A4D1E9CB896C98E790EF5teamneustar_-- From nobody Thu Jul 23 06:22:37 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A26873A0AC6; Thu, 23 Jul 2020 06:22:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=metaswitch.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dxifbskQNNVU; Thu, 23 Jul 2020 06:22:33 -0700 (PDT) Received: from NAM12-BN8-obe.outbound.protection.outlook.com (mail-bn8nam12on2102.outbound.protection.outlook.com [40.107.237.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C18583A0AC7; Thu, 23 Jul 2020 06:22:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=LJgBIr2srraiVXdiL/jOxij+R3OYdUPZgyL1uxbrIR/T+m8NXGIKPDHcJopO8xXloJYqYLdLx0nlwuQsAqP57JXJXR2YsEaXTG0bovjYAU7O/txYgNmvAG29rlb2tY062fg1TSBNF0+5VZs6hgD3Y37zSNevex4/IPGSxqHm0f6VzUlo4rRS4DLUsOClglu9D37VtvvP2RwjZDKCK68sQmU1bYdQYCz9awHGFSkJ3Q6vueFdRiVvzOB0t2l4K9Bryr3h4aHtLVd4y00/O/27YmhC3nwkUEW4mnV3PA+LFGJyuUuIe3WU+vU1yygr+sCU5Uz29yLXoP+BhZci2m+zKg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LFlm06ZL1DJBH0613PGrCL0rzgDKhgO+r/DiLR2Vj5w=; b=mL3bqWj2LUwh4Ch4wdx+ADm48hqT6DR6xZC5GvvZ+QnPLBHlOAP9I6wWpCcmjGvNl6qg8CNL9V2xhtZmMEHVXWQHr9gFm9uHBL2ZfAlFl/GEWQN/2KwCwN1l0F4ujSXF1SGp7Bu4XOasXM3LSM3Y0Q33pTw32dObIA/WddBzS2DCATy16T00x+PLSis6f9flmj5AAQ70enG/S10StPGB3pI0jSPuBnDDZbnKjVePopDhdqCbBKRwE8yNxVQUHw+U1cFYlDuWst6mAq/aj3x1LkltXF1CPypV5GyqnKBSoSO9xEZK46cj6HOlOKgIyMLZgtyrB82vb2UBHjNoxNOcrg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=metaswitch.com; dmarc=pass action=none header.from=metaswitch.com; dkim=pass header.d=metaswitch.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=metaswitch.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LFlm06ZL1DJBH0613PGrCL0rzgDKhgO+r/DiLR2Vj5w=; b=spju9YCTtBRD2SQWx3SeRCJp1ziSHlMjyBcgGeTwdPkCokJ838Gw7Ba/3EhhCQ0b7nCkPPvUDUPpHU7GmGvZYmGvg9pwEKmGfdRioVcY/B1aKHO/Ob7Go46gy+dQi7+NRWvcwIcyPe6NiRrQvBXorImdnMg1y3+guQdPh//UyAk= Received: from BYAPR02MB5189.namprd02.prod.outlook.com (2603:10b6:a03:62::29) by BYAPR02MB5560.namprd02.prod.outlook.com (2603:10b6:a03:9f::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.20; Thu, 23 Jul 2020 13:22:27 +0000 Received: from BYAPR02MB5189.namprd02.prod.outlook.com ([fe80::85af:617:4f9f:b2c3]) by BYAPR02MB5189.namprd02.prod.outlook.com ([fe80::85af:617:4f9f:b2c3%7]) with mapi id 15.20.3216.020; Thu, 23 Jul 2020 13:22:27 +0000 From: Jack Rickard To: "Peterson, Jon" , "stir@ietf.org" , "draft-ietf-stir-passport-divert@ietf.org" Thread-Topic: Potential security vulnerability in STIR/DIV Thread-Index: AdZgO7RfMuiVRPd/TYi0mhEaKJnUqQABGmKAACQy9XA= Date: Thu, 23 Jul 2020 13:22:27 +0000 Message-ID: References: <89AC11DC-7E1A-4D1E-9CB8-96C98E790EF5@team.neustar> In-Reply-To: <89AC11DC-7E1A-4D1E-9CB8-96C98E790EF5@team.neustar> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: team.neustar; dkim=none (message not signed) header.d=none;team.neustar; dmarc=none action=none header.from=metaswitch.com; x-originating-ip: [84.92.33.46] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 3c73d888-ee34-4c5b-2648-08d82f0b71ec x-ms-traffictypediagnostic: BYAPR02MB5560: x-ld-processed: 9d9e56eb-f613-4ddb-b27b-bfcdf14b2cdb,ExtAddr x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: jpIDKZdW4g4uzuX7zv/R8E8Yo8OSU/2hI1hVdCkCtvmDaJN42R4GHX7K9sFyl0T5ANKzmWnlk9NbTv7/kDDy5pEbmJu09rBZjdR1lBC7KpryrNH0bL10m30uDPbK8DPb8FLs2CTz4AmbhBRX+nrsVD6jCF8fEKC/YFkLEbR9T+SGCt7eXx+ep4JPRJ2TXOuPdTydUg1vAqoweQJAQHwjCpSv5rUv+gB5gIpBNprE7O4TqJd9wSPZ1UfnuPPnmIurydud5DnOS5Ezh623bw/TBdRnls/FIeH64lPXIMShynuFqBZYsGtPdsEgrHjNz5uElymLuvUPU0Bvu7VoBgZsVQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR02MB5189.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(396003)(346002)(136003)(39850400004)(366004)(376002)(8936002)(2906002)(45080400002)(86362001)(186003)(83380400001)(9686003)(7696005)(26005)(8676002)(478600001)(15650500001)(71200400001)(55016002)(53546011)(33656002)(6506007)(76116006)(64756008)(66946007)(66476007)(66556008)(66446008)(110136005)(5660300002)(316002)(52536014); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: EMjeaqE/jg/UgTa390wMTbs185oIIKcM+024mliVRDOZtO+xszFzYdAKc0TIep5ljFfNTmQ0zKDyVUuvHdatgJihEd70PLGXCvq++UXQbhAaoVIvU2NaHQ7OaYC/HItDuCU9iqdZqJ9fLhlYaFrOSuKh44SqQLt22cwHgKpXBte9MAx0xBSgtFABBUdNx3PDChCO7a8hzMOPujasMHfMJRTb8HPv0v3xAJZeHe/L2D9/TML0ZOsQLzGSwgs7is4OziKqkvfTjt8i/vwzxt3KNxnw3fqVrrxRvAlbw6YHhWOmKPF3O9C7ThixVdOzyDI9u+2JQCsNoujcDckdzCDXf5kmDKODUR0fpgQBvqwdTVo5Yf8yeiacPaDivuWp+ueCMtgjJ+zHpPg4co1K9VkURzJJV9Pc/tIKxz3nikWJgm+ee4lE98oPFQONfqMj7wL7TkOA7QvigDIGTa6tM12eE1DDsYCblyHMBf/dzzA60Kc= Content-Type: multipart/alternative; boundary="_000_BYAPR02MB5189A165DCE3CDE106FEDD6EF3760BYAPR02MB5189namp_" MIME-Version: 1.0 X-OriginatorOrg: metaswitch.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BYAPR02MB5189.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 3c73d888-ee34-4c5b-2648-08d82f0b71ec X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Jul 2020 13:22:27.4762 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9d9e56eb-f613-4ddb-b27b-bfcdf14b2cdb X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: oKiZZArnsUiLgkd6wAU057bwpRNsDhM47iFoI92bcMASWoIcR7ZeamZEPolzyhsfqwOahGeE1MLew9sn/ETxoA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR02MB5560 Archived-At: Subject: Re: [stir] Potential security vulnerability in STIR/DIV X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 13:22:36 -0000 --_000_BYAPR02MB5189A165DCE3CDE106FEDD6EF3760BYAPR02MB5189namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBhZ3JlZSB0aGF0IGRpdiBkb2VzIG1ha2UgdGhpcyBraW5kIG9mIGF0dGFjayBtb3JlIGRpZmZp Y3VsdCwgYW5kIHJlcXVpcmluZyB0aGF0IHRoZXJlIGlzIHNvbWUgdHJ1c3Qgb2YgZXZlcnkgcmV0 YXJnZXRpbmcgZW50aXR5IGRvZXMgbWFrZSBzZW5zZS4gTXkgYXNzdW1wdGlvbiB3YXMgdGhhdCBi eSBvbmx5IHRydXN0aW5nIHRoZSBzaWduZXJzIG9mIHRoZSBwYXNzcG9ydHMgSSBjYW4gdHJ1c3Qg dGhlIG9yaWcgaXMgdGhlIGVudGl0eSBjYWxsaW5nIG1lLCBJIG5vdyBzZWUgeW91IGhhdmUgdG8g dHJ1c3QgdGhlIHNpZ25lcnMgYW5kIHRoZSBkaXZlcnRpbmcgcGFydGllcy4gVG8gY2xhcmlmeSB0 aGlzIEkgcHJvcG9zZSB0aGF0IHNvbWV0aGluZyBsaWtlIHlvdXIgZXhwbGFuYXRpb24gaXMgYWRk ZWQgdG8gdGhlIHNwZWMsIGkuZS4NCg0KSXQgaXMgQ2Fyb2wgd2hvIG5lZWRzIHRvIGRlY2lkZSBp ZiBhIGZvcndhcmRlZCBjYWxsIGZyb20gQm9iIHNob3VsZCBiZSB0cnVzdGVkIG9yIG5vdCDigJMg 4oCcZGl24oCdIGlzIGNlcnRhaW5seSBub3Qgc3VnZ2VzdGluZyB0aGF0IHRydXN0IGlzIGF1dG9t YXRpYywgbm9yIHRoYXQgdGhlIHByZXNlbmNlIG9mIGEg4oCcZGl24oCdIHRoYXQgY29ycmVjdGx5 IGNoYWlucyB0byB0aGUgb3JpZ2luYWwgUEFTU3BvclQgaXMgYSBzdWJzdGl0dXRlIGZvciB0aGUg cG9saWN5IGFuZCB0cnVzdCBkZWNpc2lvbiBtYWRlIG9uIHRoZSB0ZXJtaW5hdGluZyBzaWRlIG9m IGEgY2FsbC4gQXMgd2l0aCBiYXNlbGluZSBTVElSLCBqdXN0IGJlY2F1c2Ugc29tZXRoaW5nIHZh bGlkYXRlcyBhdCBhIHByb3RvY29sIGxldmVsIGRvZXNu4oCZdCBtZWFuIHlvdSBzaG91bGQgdHJ1 c3QgaXQsIG5vciB0aGF0IGxvY2FsIHBvbGljeSBkb2VzIG5vdCBkZXRlcm1pbmUgaG93IHlvdSB0 cmVhdCBjYWxscy4NCg0KDQpUbyBiZSBjbGVhciwgbXkgb3JpZ2luYWwgZW1haWwgd2FzIGJhc2Vk IG9uIHRoZSBiZWxpZWYgdGhhdCBkaXYgcGFzc3BvcnRzIHdvdWxkIHByb3ZpZGUgYSAiY2hhaW4t b2YtdHJ1c3QiLCBhbGxvd2luZyB5b3UgdG8gZXNzZW50aWFsbHkgaWdub3JlIHRoYXQgZGl2ZXJz aW9ucyBoYWQgb2NjdXJyZWQgb25jZSB5b3UgaGFkIGVzdGFibGlzaGVkIHRoZXJlIHdhcyBhIHZh bGlkIGNoYWluIG9mIGRpdiBwYXNzcG9ydHMgZnJvbSB0aGUgb3JpZ2luYXRvciB0byB0aGUgZmlu YWwgZGVzdGluYXRpb24uIEFsdGhvdWdoLCBhZnRlciByZWFkaW5nIHlvdXIgcmVzcG9uc2UgSSBy ZWFsaXNlIHRoYXQncyBub3QgdGhlIGNhc2UuDQoNCk15IHdvcnJ5IGlzIHRoYXQgdGhpcyBtb2Rl bCBtYWtlcyBkaXYgZGlmZmljdWx0IHRvIHVzZSBhbmQgcG9saWNlIGluIHByYWN0aWNlLCBzcGVj aWZpY2FsbHk6DQoNCiAgKiAgIFRoaXMgbW9kZWwgbWFrZXMgaW1wbGVtZW50YXRpb25zIG1vcmUg Y29tcGxpY2F0ZWQgYXMgeW91IGNhbid0IHNlcGFyYXRlIHZlcmlmaWNhdGlvbiBmcm9tIHBvbGlj eSBkZWNpc2lvbnMuIFlvdSBoYXZlIHRvIGZpbHRlciBvdXQgdW50cnVzdGVkIHBhcnRpZXMgYmVm b3JlIGRvaW5nIHRoZSBjaGFpbiBmaW5kaW5nIHN0ZXAgb2YgdmVyaWZpY2F0aW9uLCBhcyBvdGhl cndpc2UgeW91IG1pZ2h0IGRlY2lkZSB1cG9uIGEgY2hhaW4gY29udGFpbmluZyBhbiB1bnRydXN0 ZWQgcGFydHkgd2hlbiB0aGVyZSBkb2VzIGV4aXN0IGEgdmFsaWQgY2hhaW4gY29udGFpbmluZyBv bmx5IHRydXN0ZWQgcGFydGllcyAoZ3JhbnRlZCB0aGlzIHNpdHVhdGlvbiBpcyB1bmxpa2VseSku DQogICogICBUaGlzIG1vZGVsIGludHJvZHVjZXMgY29tcGxleGl0eSBpbiB3aGF0IHNob3VsZCBi ZSBkaXNwbGF5ZWQgdG8gYSB1c2VyLCB0aGUgc2ltcGxlIHZlcmlmaWVkL25vdCB2ZXJpZmllZCBj YW4ndCBiZSB1c2VkIHVubGVzcyB5b3UgcmVxdWlyZSBjb21wbGV0ZSB0cnVzdCBvZiBhbGwgZGl2 ZXJ0aW5nIHBhcnRpZXMsIGFuZCB0aGF0IGNvdWxkIGNhdXNlIGZhbHNlIG5lZ2F0aXZlcy4NCiAg KiAgIElmIGEgZGl2ZXJ0ZWQgY2FsbCBkb2VzIGdldCByZXBvcnRlZCBhcyBhIHJvYm9jYWxsLCBp dCdzIG5vdCBjbGVhciB3aG9zZSByZXB1dGF0aW9uIHNob3VsZCBiZSB0YXJuaXNoZWQuIEl0IG1h eSBoYXZlIGJlZW4gdGhhdCB0aGUgb3JpZ2luYWwgY2FsbGVyIHdhcyBhIHJvYm9jYWxsZXIgYW5k IHRoZSBjYWxsIGdvdCBsZWdpdGltYXRlbHkgZGl2ZXJ0ZWQgdG8geW91LCBvciBpdCB3YXMgdGhl IGJlbG93IGF0dGFjayB3aGVyZSB0aGUgY2FsbGVyIGlzIHRydXN0d29ydGh5IGJ1dCB0aGUgZGl2 ZXJ0ZXIgd2FzIHRoZSByb2JvY2FsbGVyLg0KDQpUaGFua3MsDQpKYWNrDQoNCkZyb206IFBldGVy c29uLCBKb24gPGpvbi5wZXRlcnNvbkB0ZWFtLm5ldXN0YXI+DQpTZW50OiAyMiBKdWx5IDIwMjAg MjM6NTMNClRvOiBKYWNrIFJpY2thcmQgPEphY2suUmlja2FyZEBtZXRhc3dpdGNoLmNvbT47IHN0 aXJAaWV0Zi5vcmc7IGRyYWZ0LWlldGYtc3Rpci1wYXNzcG9ydC1kaXZlcnRAaWV0Zi5vcmcNClN1 YmplY3Q6IFJlOiBQb3RlbnRpYWwgc2VjdXJpdHkgdnVsbmVyYWJpbGl0eSBpbiBTVElSL0RJVg0K DQpOT1RFOiBNZXNzYWdlIGlzIGZyb20gYW4gZXh0ZXJuYWwgc2VuZGVyDQoNClBvdGVudGlhbCDi gJxiYWl0aW5n4oCdIGF0dGFja3Mgb2YgdGhpcyBmb3JtIGVtZXJnZSB3aGVuIHlvdSBjb21iaW5l IGJhc2VsaW5lIFNUSVIgd2l0aCBjYWxsIGZvcndhcmRpbmcsIGFuZCBhcmUgdGhlIG1haW4gdGhy ZWF0IGFydGljdWxhdGVkIGluIHRoZSBJRVRGIOKAnGRpduKAnSBkcmFmdC4gVGhlIGludHJvZHVj dGlvbiBkZXNjcmliZXMgdGhlbSBhcyBmb2xsb3dzOg0KDQogICBJZiBBbGljZSBjYWxscyBCb2Is IGZvciBleGFtcGxlLCBCb2IgbWlnaHQNCiAgIGF0dGVtcHQgdG8gY3V0LWFuZC1wYXN0ZSB0aGUg SWRlbnRpdHkgaGVhZGVyIGZpZWxkIGluIEFsaWNlJ3MgSU5WSVRFDQogICBpbnRvIGEgbmV3IElO VklURSB0aGF0IEJvYiBzZW5kcyB0byBDYXJvbCwgYW5kIHRodXMgYmUgYWJsZSB0byBmb29sDQog ICBDYXJvbCBpbnRvIHRoaW5raW5nIHRoZSBjYWxsIGNhbWUgZnJvbSBBbGljZSBhbmQgbm90IEJv Yi4gV2l0aCB0aGUNCiAgIHNpZ25hdHVyZSBvdmVyIHRoZSBUbyBoZWFkZXIgZmllbGQgdmFsdWUs IHRoZSBJTlZJVEUgQ2Fyb2wgc2VlcyB3aWxsDQogICBjbGVhcmx5IGhhdmUgYmVlbiBkZXN0aW5l ZCBvcmlnaW5hbGx5IGZvciBCb2IsIGFuZCB0aHVzIENhcm9sIGNhbg0KICAgdmlldyB0aGUgSU5W SVRFIGFzIHN1c3BlY3QuDQoNClRoYXQgZGVzY3JpYmVzIHRoZSBzaXR1YXRpb24gaW4gYSB3b3Js ZCB3aXRob3V0IOKAnGRpduKAnSwgc28gdGhlIHF1ZXN0aW9uIGlzLCBkb2VzIOKAnGRpduKAnSBt YWtlIHRoZXNlIHNvcnRzIG9mIGF0dGFja3MgZWFzaWVyIHRvIGhhcmRlciB0byBtb3VudD8NCg0K V2l0aG91dCDigJxkaXbigJ0sIGluIHRoZSBleGFtcGxlIGFib3ZlLCBDYXJvbCB3aWxsIHNlZSB0 aGF0IHRoZSBvcmlnaW5hbCBjYWxsZWQgbnVtYmVyIGRvZXMgbm90IG1hdGNoIGhlcnMsIGFuZCBj YW4gZGVjaWRlIG9uIHRob3NlIGdyb3VuZHMgdG8gcmVqZWN0IHRoZSBjYWxsLiBCdXQgYmVhciBp biBtaW5kIHRoaXMgaXMgYWxzbyB3aGF0IENhcm9sIHdvdWxkIHNlZSBpbiBsZWdpdGltYXRlIGZv cndhcmRpbmcgY2FzZXMsIHNvIGEgbW9yZSBudWFuY2VkIGxvZ2ljIHdvdWxkIHByb2JhYmx5IGJl IHVzZWQuIFNoZSBjb3VsZCBkZWNpZGUgdGhhdCBpZiB0aGUgb3JpZ2luYWwgY2FsbGVkIG51bWJl ciBpcyBhIG51bWJlciB0aGF0IHNob3VsZCBiZSBmb3J3YXJkaW5nIGNhbGxzIHRvIGhlciAoc2F5 LCBpZiBpdCB3YXMgaGVyIG9mZmljZSksIHRoYXQgc2hlIHNob3VsZCBhY2NlcHQgdGhlIGNhbGwg YW55d2F5LiBZb3UgY291bGQgZXZlbiBpbWFnaW5lIGFwcGxpY2F0aW9uIGJlaGF2aW9yIHRoYXQg d291bGQgZW5mb3JjZSBwb2xpY2llcyBhbG9uZyB0aG9zZSBsaW5lcyBvbiBoZXIgYmVoYWxmLiBI b3dldmVyLCBDYXJvbCBoYXMgbm8gYXNzdXJhbmNlIHRoYXQgaXQgd2FzIHJlYWxseSBoZXIgb2Zm aWNlIHRoYXQgZm9yd2FyZGVkIHRoaXMgY2FsbCwgcmF0aGVyIHRoYW4gc29tZSBlYXZlc2Ryb3Bw ZXIgd2hvIHNvbWVob3cgY2FwdHVyZWQgdGhlIFBBU1Nwb3JULCBub3IgaG93IG1hbnkgdGltZXMg aXQgbWlnaHQgaGF2ZSBiZWVuIHJlZGlyZWN0ZWQgYmVmb3JlIHJlYWNoaW5nIGhlciwgb3IgYW55 dGhpbmcgYWxvbmcgdGhvc2UgbGluZXMuDQoNClRob3NlIGFyZSB0aGUgZ2FwcyB0aGF0IOKAnGRp duKAnSBpcyBtZWFudCB0byBmaWxsLiBJdCBpcyBub3QgYSBzdWJzdGl0dXRlIGZvciB0aGUgcmVz dCBvZiB0aGUgbG9naWMgYW5kIHBvbGljeSBkZXNjcmliZWQgYWJvdmUsIGJ1dCBpdCBnaXZlcyBD YXJvbCBtb3JlIGluZm9ybWF0aW9uIHRvIGhlbHAgZmlndXJlIG91dCBpZiB0aGUgY2FsbCBpcyBz dXNwZWN0IGFuZCB3aGF0IHRvIGRvIGFib3V0IGl0LiBXaXRoIOKAnGRpduKAnSwgd2hhdCBDYXJv bCBzZWVzIGlzIGEgc2Vjb25kIFBBU1Nwb3JUIGNyZWF0ZWQgYW5kIHNpZ25lZCBieSBCb2IsIHdo aWNoIGFjdHVhbGx5IGdpdmVzIENhcm9sIHRoZSBhc3N1cmFuY2Ugb2Ygd2hldGhlciB0aGUgaW50 ZW5kZWQgY2FsbGVkIHBhcnR5IGlzIG9uZSB3aG8gcmV0YXJnZXRlZCB0aGUgY2FsbCwgd2hpY2gg eW91IGRvbuKAmXQgZ2V0IGluIHRoZSBhYnNlbmNlIG9mIOKAnGRpduKAnS4gSWYgQm9iIGlzIGRv aW5nIHRoaXMgbWFsaWNpb3VzbHksIHRoZSDigJxkaXbigJ0gaGUgcHJvdmlkZWQgaGFzIGdpdmVu IENhcm9sIHRoZSBtZWFucyB0byBodW50IGhpbSBkb3duIGZvciByZWRyZXNzLCB3aGljaCBpcyBu b3QgZXhhY3RseSBhIHN0cm9uZyBpbmNlbnRpdmUgZm9yIGhpbSB0byB1c2Ug4oCcZGl24oCdLiBC dXQgYXQgdGhlIGVuZCBvZiB0aGUgZGF5LCBpdCBpcyBDYXJvbCB3aG8gbmVlZHMgdG8gZGVjaWRl IGlmIGEgZm9yd2FyZGVkIGNhbGwgZnJvbSBCb2Igc2hvdWxkIGJlIHRydXN0ZWQgb3Igbm90IOKA kyDigJxkaXbigJ0gaXMgY2VydGFpbmx5IG5vdCBzdWdnZXN0aW5nIHRoYXQgdHJ1c3QgaXMgYXV0 b21hdGljLCBub3IgdGhhdCB0aGUgcHJlc2VuY2Ugb2YgYSDigJxkaXbigJ0gdGhhdCBjb3JyZWN0 bHkgY2hhaW5zIHRvIHRoZSBvcmlnaW5hbCBQQVNTcG9yVCBpcyBhIHN1YnN0aXR1dGUgZm9yIHRo ZSBwb2xpY3kgYW5kIHRydXN0IGRlY2lzaW9uIG1hZGUgb24gdGhlIHRlcm1pbmF0aW5nIHNpZGUg b2YgYSBjYWxsLiBBcyB3aXRoIGJhc2VsaW5lIFNUSVIsIGp1c3QgYmVjYXVzZSBzb21ldGhpbmcg dmFsaWRhdGVzIGF0IGEgcHJvdG9jb2wgbGV2ZWwgZG9lc27igJl0IG1lYW4geW91IHNob3VsZCB0 cnVzdCBpdCwgbm9yIHRoYXQgbG9jYWwgcG9saWN5IGRvZXMgbm90IGRldGVybWluZSBob3cgeW91 IHRyZWF0IGNhbGxzLg0KDQpCdXQgYWxsIHRoYXQgc2FpZCwgaWYgeW914oCZcmUgc2VyaW91cyBh Ym91dCBzZWN1cml0eSwgdGhlbiB5ZXMsIHVzaW5nIERUTFMtU1JUUCB3aXRoIOKAnG1rZXnigJ0g aXMgZ29pbmcgdG8gcHJvdmlkZSB5b3Ugd2l0aCBhIGJldHRlciBhc3N1cmFuY2UuDQoNCkpvbiBQ ZXRlcnNvbg0KTmV1c3RhciwgSW5jLg0KDQpGcm9tOiBKYWNrIFJpY2thcmQgPEphY2suUmlja2Fy ZEBtZXRhc3dpdGNoLmNvbTxtYWlsdG86SmFjay5SaWNrYXJkQG1ldGFzd2l0Y2guY29tPj4NCkRh dGU6IFdlZG5lc2RheSwgSnVseSAyMiwgMjAyMCBhdCA5OjQ3IEFNDQpUbzogInN0aXJAaWV0Zi5v cmc8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+IiA8c3RpckBpZXRmLm9yZzxtYWlsdG86c3RpckBpZXRm Lm9yZz4+LCAiZHJhZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LWRpdmVydEBpZXRmLm9yZzxtYWlsdG86 ZHJhZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LWRpdmVydEBpZXRmLm9yZz4iIDxkcmFmdC1pZXRmLXN0 aXItcGFzc3BvcnQtZGl2ZXJ0QGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLXN0aXItcGFzc3Bv cnQtZGl2ZXJ0QGlldGYub3JnPj4sICJQZXRlcnNvbiwgSm9uIiA8am9uLnBldGVyc29uQHRlYW0u bmV1c3RhcjxtYWlsdG86am9uLnBldGVyc29uQHRlYW0ubmV1c3Rhcj4+DQpTdWJqZWN0OiBQb3Rl bnRpYWwgc2VjdXJpdHkgdnVsbmVyYWJpbGl0eSBpbiBTVElSL0RJVg0KUmVzZW50LUZyb206IDxh bGlhcy1ib3VuY2VzQGlldGYub3JnPG1haWx0bzphbGlhcy1ib3VuY2VzQGlldGYub3JnPj4NClJl c2VudC1UbzogPGpvbi5wZXRlcnNvbkB0ZWFtLm5ldXN0YXI8bWFpbHRvOmpvbi5wZXRlcnNvbkB0 ZWFtLm5ldXN0YXI+Pg0KUmVzZW50LURhdGU6IFdlZG5lc2RheSwgSnVseSAyMiwgMjAyMCBhdCA5 OjQ3IEFNDQoNCkhlbGxvLA0KDQpJIGJlbGlldmUgSSd2ZSBjb21lIGFjcm9zcyBhIHNlY3VyaXR5 IHZ1bG5lcmFiaWxpdHkgaW4gdGhlIFNUSVIgc3lzdGVtIHRoYXQgaXMgbWFkZSBleHBsb2l0YWJs ZSBieSB0aGUgaW50cm9kdWN0aW9uIG9mIERJViBwYXNzcG9ydHMsIHRoYXQgSSBoYXZlbid0IHNl ZW4gZGlzY3Vzc2VkIGhlcmUgaW4gYW55IGRldGFpbCAoc29ycnkgaWYgaXQgaGFzIGJlZW4pLiBU aGVyZSBhcmUgY3VycmVudGx5IG1pdGlnYXRpb25zIGZvciBpdCBpbiB0aGUgcGFzc3BvcnQgc3Bl YywgaG93ZXZlciBJIGRvbid0IGJlbGlldmUgdGhleSBnbyBmYXIgZW5vdWdoIHRvIHByZXZlbnQg dGhpcyBhdHRhY2suDQoNClRoZSBoaWdoIGxldmVsIHN1bW1hcnkgaXMgdGhhdCBhbiBhdHRhY2tl ciBjYW4gaW1wZXJzb25hdGUgYW4gZW50aXR5IHRoYXQgY2FsbGVkIHRoZW0gYnkgcHJldGVuZGlu ZyB0aGV5IHJlZGlyZWN0ZWQgdGhhdCBjYWxsIHRvIHRoZSByZWNpcGllbnQuDQoNCkFuIGV4YW1w bGU6DQoNClRydXN0ZWQ6IEEgcGFydHkgdHJ1c3RlZCBieSBTdWJqZWN0LCB3aGljaCBBdHRhY2tl ciB3aXNoZXMgdG8gaW1wZXJzb25hdGUNCkF0dGFja2VyOiBUaGUgcGFydHkgd2lzaGluZyB0byBp bXBlcnNvbmF0ZSBUcnVzdGVkDQpTdWJqZWN0OiBUaGUgaW50ZW5kZWQgdGFyZ2V0IG9mIEF0dGFj a2VyLCB3aG8gd2lsbCBzZWUgYSB2ZXJpZmllZCBjYWxsIGNvbWluZyBmcm9tIFRydXN0ZWQNCg0K DQoxLiAgICAgICBBdHRhY2tlciBnZXRzIFRydXN0ZWQgdG8gY2FsbCB0aGVtLg0KDQpUaGlzIGlz IGEgcmVhc29uYWJsZSBvcGVyYXRpb24sIGFuZCBpcyBhY3R1YWxseSBxdWl0ZSBhIGNvbW1vbiBm ZWF0dXJlIG9mIHN1cHBvcnQgY29tcGFuaWVzIHNvIHlvdSBkb24ndCBoYXZlIHRvIHNpdCBvbiBo b2xkLg0KDQoyLiAgICAgICBBdHRhY2tlciBhbnN3ZXJzL3JlamVjdHMgdGhlIGNhbGwgYW5kIHNh dmVzIG9mZiB0aGUgU0hBS0VOIHBhc3Nwb3J0IGZvciBUcnVzdGVkIC0+IEF0dGFja2VyLg0KDQoz LiAgICAgICBBdHRhY2tlciBzZXRzIHVwIGEgcmVkaXJlY3QgZnJvbSB0aGVtIHRvIHRoZWlyIGlu dGVuZGVkIFN1YmplY3QuDQoNCjQuICAgICAgIEF0dGFja2VyIGNvbnN0cnVjdHMgYSBjYWxsIChj bGFpbWluZyB0byBiZSkgZnJvbSBUcnVzdGVkIHRvIEF0dGFja2VyIHdpdGggdGhlIHByZXZpb3Vz bHkgc2F2ZWQgU0hBS0VOIHBhc3Nwb3J0Lg0KDQo1LiAgICAgICBUaGUgY2FsbCB3aWxsIGJlIHZl cmlmaWVkLCB0aGVuIHJlZGlyZWN0ZWQgdG8gU3ViamVjdCB3aXRoIGEgRElWIHBhc3Nwb3J0IGZv ciBBdHRhY2tlciAtPiBTdWJqZWN0Lg0KDQpUaGlzIGRvZXMgcmVseSBvbiB0aGUgY2VydGlmaWNh dGUgc2lnbmluZyB0aGUgRElWIHRvIGJlbG9uZyB0byBhIHRydXN0ZWQgZW50aXR5LCB0aGlzIHNl ZW1zIHBvc3NpYmxlLCBhcyB0aGUgcmVkaXJlY3QgY291bGQgYmUgY2FycmllZCBvdXQgYnkgQXR0 YWNrZXIncyBzZXJ2aWNlIHByb3ZpZGVyLg0KQXR0YWNrZXIncyBTUCBtYXkgcmVmdXNlIHRvIHJl ZGlyZWN0IGFmdGVyIHNvbWUgdGltZSBkdWUgdG8gSWFUIHRpbWVvdXRzLCBidXQgdGhpcyBpcyBu b3QgcmVxdWlyZWQgYnkgdGhlIHNwZWMgYW5kIEkgYmVsaWV2ZSB0aGlzIGNhbiBiZSB3b3JrZWQg YXJvdW5kIGJ5LCBmb3IgZXhhbXBsZSwgcmVwZWF0ZWRseSBib3VuY2luZyBuZXcgY2FsbHMgb2Zm IGFuIGFjY29tcGxpY2UuDQoNCjYuICAgICAgIFN1YmplY3QgcmVjZWl2ZXMgYSBjYWxsIGNsYWlt aW5nIHRvIGJlIGZyb20gVHJ1c3RlZCAoYWxiZWl0IHJlZGlyZWN0ZWQgZnJvbSBBdHRhY2tlcikg d2l0aCBhIHZhbGlkIHBhc3Nwb3J0IGNoYWluIG9mIFRydXN0ZWQgLT4gQXR0YWNrZXIgLT4gU3Vi amVjdC4NCg0KQm90aCBwYXNzcG9ydHMgd2lsbCBiZSBzaWduZWQgYnkgdHJ1c3RlZCBlbnRpdGll czogVHJ1c3RlZCdzIFNQIGFuZCBBdHRhY2tlcidzIFNQLg0KSWFUIGRvZXNuJ3QgcHJvdmlkZSBt dWNoIHByb3RlY3Rpb24gaGVyZSBhcywgaW4gdGhlIHByZXNlbmNlIG9mIERJViBwYXNzcG9ydHMs IHRoZSB2YWxpZCB0aW1lIHJhbmdlIG11c3QgYmUgc2V0IHJlYXNvbmFibHkgaGlnaCB0byBhbGxv dyBmb3IgdGhlIHBvc3NpYmlsaXR5IG9mIHJpbmctYXJvdW5kcy4NClRoZSBvcmlnaWQgYW5kIGF0 dGVzdCB3aWxsIGJlIGFzc29jaWF0ZWQgd2l0aCBUcnVzdGVkLCBlcm9kaW5nIGFueSBhdXRvbWF0 ZWQgZGF0YWJhc2VzIG9mIHJvYm9jYWxscyBiYXNlZCBvbiB0aGUgb3JpZ2lkLg0KDQoNCg0KVGhl ICJta3kiIGNsYWltIHNlZW1zIHRvIGJlIHRoZSBzb2x1dGlvbiB0aGF0IGlzIGN1cnJlbnRseSBi dWlsdCBpbnRvIHBhc3Nwb3J0cywgaG93ZXZlciwgaXQgaXMgY3VycmVudGx5IG9wdGlvbmFsLCBh bmQgYXMgZmFyIGFzIEkgYW0gYXdhcmUgdXNpbmcgY2VydGlmaWNhdGVzIHRvIGF1dGhlbnRpY2F0 ZSB0aGUgZW5kcyBvZiBhIG1lZGlhIHN0cmVhbSBpcyB2ZXJ5IHJhcmUgaW4gcHJhY3RpY2UuDQoN ClVuZm9ydHVuYXRlbHksIEknbSBub3QgYWJsZSB0byBjb21lIHVwIHdpdGggYSBzb2x1dGlvbiBh bmQgSSBhbSBob3BpbmcgdGhhdCBpcyB3aGVyZSB5b3Ugd2lsbCBiZSBhYmxlIHRvIHN0ZXAgaW4u IEkgYmVsaWV2ZSB0byBhdm9pZCB0aGlzLCB0aGVyZSBuZWVkcyB0byBiZSBtb3JlIHZhbGlkYXRp b24gb2YgdGhlIG1lZGlhIHN0cmVhbSB0aGF0IGlzIGNyZWF0ZWQsIGVpdGhlciBpbiB0aGUgZm9y bSBvZiBtb3JlIGRhdGEgYmVpbmcgc2lnbmVkIG9yIGVuZm9yY2luZyB0aGF0IHRoZSBtZWRpYSBw YXJ0aWNpcGFudHMgYXJlIGF1dGhlbnRpY2F0ZWQuDQoNClRoYW5rIHlvdSwNCkphY2sgUmlja2Fy ZCB8IFNvZnR3YXJlIEVuZ2luZWVyIHwgTWV0YXN3aXRjaA0KVGhlIEZhc3RlciBXYXkgRm9yd2Fy ZA0KT2ZmaWNlICs0NCAyMCA4MTk2IDk4MDENCk1ldGFzd2l0Y2ggaXMgYSBNaWNyb3NvZnQgY29t cGFueQ0KDQo= --_000_BYAPR02MB5189A165DCE3CDE106FEDD6EF3760BYAPR02MB5189namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJTZWdvZSBVSSI7 DQoJcGFub3NlLTE6MiAxMSA1IDIgNCAyIDQgMiAyIDM7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMg Ki8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBj bTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJ e21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlv bjp1bmRlcmxpbmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdyYXBoLCBk aXYuTXNvTGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFyZ2luLXRv cDowY207DQoJbWFyZ2luLXJpZ2h0OjBjbTsNCgltYXJnaW4tYm90dG9tOjBjbTsNCgltYXJnaW4t bGVmdDozNi4wcHQ7DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7 DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjQN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtY29tcG9zZTsNCglmb250LWZhbWlseToiQ2FsaWJy aSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21z by1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29y ZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIuMHB0 IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9 DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDo3NjA1NjY3 Mjk7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjI5MTY1 Mjk4MiAxMzQ4MDc1NjcgMTM0ODA3NTc3IDEzNDgwNzU3OSAxMzQ4MDc1NjcgMTM0ODA3NTc3IDEz NDgwNzU3OSAxMzQ4MDc1NjcgMTM0ODA3NTc3IDEzNDgwNzU3OTt9DQpAbGlzdCBsMDpsZXZlbDEN Cgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30N CkBsaXN0IGwwOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJp Z2h0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwwOmxl dmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQt aW5kZW50Oi05LjBwdDt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5v bmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4w cHQ7fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxv d2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwwOmxldmVsOQ0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05LjBw dDt9DQpAbGlzdCBsMQ0KCXttc28tbGlzdC1pZDoxNTMyMTg0NDk0Ow0KCW1zby1saXN0LXR5cGU6 aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczoxMzIyMTYwNDQ4IDEzNDgwNzU1MyAxMzQ4 MDc1NTUgMTM0ODA3NTU3IDEzNDgwNzU1MyAxMzQ4MDc1NTUgMTM0ODA3NTU3IDEzNDgwNzU1MyAx MzQ4MDc1NTUgMTM0ODA3NTU3O30NCkBsaXN0IGwxOmxldmVsMQ0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot MTguMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDINCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMTps ZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7 fQ0KQGxpc3QgbDE6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1p bHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglm b250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwxOmxldmVsNg0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTpsZXZlbDcN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3Qg bDE6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVy IE5ldyI7fQ0KQGxpc3QgbDE6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9u dC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwyDQoJe21zby1saXN0LWlkOjE5MzEwMzgyMDM7 DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi0xODMyMTk5MjQ2O30NCkBsaXN0IGwyOmxldmVsMQ0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0K CW1zby1sZXZlbC10YWItc3RvcDozNi4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsN Cglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDI6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOjcyLjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5 bWJvbDt9DQpAbGlzdCBsMjpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MTA4LjBwdDsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglt c28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBs MjpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MTQ0LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNp emU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMjpsZXZlbDUNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6MTgwLjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZv bnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMjpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 MjE2LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJv bDt9DQpAbGlzdCBsMjpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MjUyLjBwdDsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28t YW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMjps ZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mjg4LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6 MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMjpsZXZlbDkNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6MzI0LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQt ZmFtaWx5OlN5bWJvbDt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBjbTt9DQp1bA0KCXttYXJnaW4t Ym90dG9tOjBjbTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hh cGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlm XS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQi Pg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94 bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1HQiIgbGluaz0iIzA1NjND MSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+SSBh Z3JlZSB0aGF0IGRpdiBkb2VzIG1ha2UgdGhpcyBraW5kIG9mIGF0dGFjayBtb3JlIGRpZmZpY3Vs dCwgYW5kIHJlcXVpcmluZyB0aGF0IHRoZXJlIGlzIHNvbWUgdHJ1c3Qgb2YgZXZlcnkgcmV0YXJn ZXRpbmcgZW50aXR5IGRvZXMgbWFrZSBzZW5zZS4gTXkgYXNzdW1wdGlvbiB3YXMgdGhhdCBieSBv bmx5IHRydXN0aW5nIHRoZSBzaWduZXJzDQogb2YgdGhlIHBhc3Nwb3J0cyBJIGNhbiB0cnVzdCB0 aGUgb3JpZyBpcyB0aGUgZW50aXR5IGNhbGxpbmcgbWUsIEkgbm93IHNlZSB5b3UgaGF2ZSB0byB0 cnVzdCB0aGUgc2lnbmVycyBhbmQgdGhlIGRpdmVydGluZyBwYXJ0aWVzLiBUbyBjbGFyaWZ5IHRo aXMgSSBwcm9wb3NlIHRoYXQgc29tZXRoaW5nIGxpa2UgeW91ciBleHBsYW5hdGlvbiBpcyBhZGRl ZCB0byB0aGUgc3BlYywgaS5lLjxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1V UyI+SXQgaXMgQ2Fyb2wgd2hvIG5lZWRzIHRvIGRlY2lkZSBpZiBhIGZvcndhcmRlZCBjYWxsIGZy b20gQm9iIHNob3VsZCBiZSB0cnVzdGVkIG9yIG5vdCDigJMg4oCcZGl24oCdIGlzIGNlcnRhaW5s eSBub3Qgc3VnZ2VzdGluZyB0aGF0IHRydXN0IGlzIGF1dG9tYXRpYywgbm9yIHRoYXQgdGhlIHBy ZXNlbmNlIG9mIGEg4oCcZGl24oCdIHRoYXQgY29ycmVjdGx5DQogY2hhaW5zIHRvIHRoZSBvcmln aW5hbCBQQVNTcG9yVCBpcyBhIHN1YnN0aXR1dGUgZm9yIHRoZSBwb2xpY3kgYW5kIHRydXN0IGRl Y2lzaW9uIG1hZGUgb24gdGhlIHRlcm1pbmF0aW5nIHNpZGUgb2YgYSBjYWxsLiBBcyB3aXRoIGJh c2VsaW5lIFNUSVIsIGp1c3QgYmVjYXVzZSBzb21ldGhpbmcgdmFsaWRhdGVzIGF0IGEgcHJvdG9j b2wgbGV2ZWwgZG9lc27igJl0IG1lYW4geW91IHNob3VsZCB0cnVzdCBpdCwgbm9yIHRoYXQgbG9j YWwgcG9saWN5IGRvZXMNCiBub3QgZGV0ZXJtaW5lIGhvdyB5b3UgdHJlYXQgY2FsbHMuPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1m YXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+VG8gYmUgY2xlYXIsIG15IG9yaWdp bmFsIGVtYWlsIHdhcyBiYXNlZCBvbiB0aGUgYmVsaWVmIHRoYXQgZGl2IHBhc3Nwb3J0cyB3b3Vs ZCBwcm92aWRlIGEgJnF1b3Q7Y2hhaW4tb2YtdHJ1c3QmcXVvdDssIGFsbG93aW5nIHlvdSB0byBl c3NlbnRpYWxseSBpZ25vcmUgdGhhdCBkaXZlcnNpb25zIGhhZCBvY2N1cnJlZCBvbmNlIHlvdSBo YWQgZXN0YWJsaXNoZWQNCiB0aGVyZSB3YXMgYSB2YWxpZCBjaGFpbiBvZiBkaXYgcGFzc3BvcnRz IGZyb20gdGhlIG9yaWdpbmF0b3IgdG8gdGhlIGZpbmFsIGRlc3RpbmF0aW9uLiBBbHRob3VnaCwg YWZ0ZXIgcmVhZGluZyB5b3VyIHJlc3BvbnNlIEkgcmVhbGlzZSB0aGF0J3Mgbm90IHRoZSBjYXNl LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdl OkVOLVVTIj5NeSB3b3JyeSBpcyB0aGF0IHRoaXMgbW9kZWwgbWFrZXMgZGl2IGRpZmZpY3VsdCB0 byB1c2UgYW5kIHBvbGljZSBpbiBwcmFjdGljZSwgc3BlY2lmaWNhbGx5OjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjx1bCBzdHlsZT0ibWFyZ2luLXRvcDowY20iIHR5cGU9ImRpc2MiPg0KPGxpIGNs YXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGNtO21zby1saXN0Omwx IGxldmVsMSBsZm8zIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPlRo aXMgbW9kZWwgbWFrZXMgaW1wbGVtZW50YXRpb25zIG1vcmUgY29tcGxpY2F0ZWQgYXMgeW91IGNh bid0IHNlcGFyYXRlIHZlcmlmaWNhdGlvbiBmcm9tIHBvbGljeSBkZWNpc2lvbnMuIFlvdSBoYXZl IHRvIGZpbHRlciBvdXQgdW50cnVzdGVkDQogcGFydGllcyBiZWZvcmUgZG9pbmcgdGhlIGNoYWlu IGZpbmRpbmcgc3RlcCBvZiB2ZXJpZmljYXRpb24sIGFzIG90aGVyd2lzZSB5b3UgbWlnaHQgZGVj aWRlIHVwb24gYSBjaGFpbiBjb250YWluaW5nIGFuIHVudHJ1c3RlZCBwYXJ0eSB3aGVuIHRoZXJl IGRvZXMgZXhpc3QgYSB2YWxpZCBjaGFpbiBjb250YWluaW5nIG9ubHkgdHJ1c3RlZCBwYXJ0aWVz IChncmFudGVkIHRoaXMgc2l0dWF0aW9uIGlzIHVubGlrZWx5KS48bzpwPjwvbzpwPjwvc3Bhbj48 L2xpPjxsaSBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBjbTtt c28tbGlzdDpsMSBsZXZlbDEgbGZvMyI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdl OkVOLVVTIj5UaGlzIG1vZGVsIGludHJvZHVjZXMgY29tcGxleGl0eSBpbiB3aGF0IHNob3VsZCBi ZSBkaXNwbGF5ZWQgdG8gYSB1c2VyLCB0aGUgc2ltcGxlIHZlcmlmaWVkL25vdCB2ZXJpZmllZCBj YW4ndCBiZSB1c2VkIHVubGVzcyB5b3UgcmVxdWlyZSBjb21wbGV0ZQ0KIHRydXN0IG9mIGFsbCBk aXZlcnRpbmcgcGFydGllcywgYW5kIHRoYXQgY291bGQgY2F1c2UgZmFsc2UgbmVnYXRpdmVzLjxv OnA+PC9vOnA+PC9zcGFuPjwvbGk+PGxpIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0i bWFyZ2luLWxlZnQ6MGNtO21zby1saXN0OmwxIGxldmVsMSBsZm8zIj48c3BhbiBzdHlsZT0ibXNv LWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPklmIGEgZGl2ZXJ0ZWQgY2FsbCBkb2VzIGdldCByZXBv cnRlZCBhcyBhIHJvYm9jYWxsLCBpdCdzIG5vdCBjbGVhciB3aG9zZSByZXB1dGF0aW9uIHNob3Vs ZCBiZSB0YXJuaXNoZWQuIEl0IG1heSBoYXZlIGJlZW4gdGhhdCB0aGUgb3JpZ2luYWwNCiBjYWxs ZXIgd2FzIGEgcm9ib2NhbGxlciBhbmQgdGhlIGNhbGwgZ290IGxlZ2l0aW1hdGVseSBkaXZlcnRl ZCB0byB5b3UsIG9yIGl0IHdhcyB0aGUgYmVsb3cgYXR0YWNrIHdoZXJlIHRoZSBjYWxsZXIgaXMg dHJ1c3R3b3J0aHkgYnV0IHRoZSBkaXZlcnRlciB3YXMgdGhlIHJvYm9jYWxsZXIuPG86cD48L286 cD48L3NwYW4+PC9saT48L3VsPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1z by1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4t VVMiPlRoYW5rcyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPkphY2s8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3Qt bGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2 IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGlu ZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5n PSJFTi1VUyI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLVVTIj4gUGV0ZXJzb24sIEpv biAmbHQ7am9uLnBldGVyc29uQHRlYW0ubmV1c3RhciZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiAy MiBKdWx5IDIwMjAgMjM6NTM8YnI+DQo8Yj5Ubzo8L2I+IEphY2sgUmlja2FyZCAmbHQ7SmFjay5S aWNrYXJkQG1ldGFzd2l0Y2guY29tJmd0Ozsgc3RpckBpZXRmLm9yZzsgZHJhZnQtaWV0Zi1zdGly LXBhc3Nwb3J0LWRpdmVydEBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogUG90ZW50 aWFsIHNlY3VyaXR5IHZ1bG5lcmFiaWxpdHkgaW4gU1RJUi9ESVY8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8dGFibGUgY2xhc3M9Ik1zb05vcm1hbFRhYmxlIiBib3JkZXI9IjAiIGNlbGxzcGFj aW5nPSIwIiBjZWxscGFkZGluZz0iMCIgYWxpZ249ImxlZnQiIHdpZHRoPSIxMDAlIiBzdHlsZT0i d2lkdGg6MTAwLjAlO2JvcmRlci1jb2xsYXBzZTpjb2xsYXBzZSI+DQo8dGJvZHk+DQo8dHI+DQo8 dGQgc3R5bGU9ImJhY2tncm91bmQ6IzkxMEExOTtwYWRkaW5nOjMuMHB0IDEuNXB0IDMuMHB0IDEu NXB0Ij48L3RkPg0KPHRkIHdpZHRoPSIxMDAlIiBzdHlsZT0id2lkdGg6MTAwLjAlO2JhY2tncm91 bmQ6I0ZERjJGNDtwYWRkaW5nOjMuMHB0IDMuNzVwdCAzLjBwdCAxMS4yNXB0O3dvcmQtd3JhcDpi cmVhay13b3JkIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tZWxlbWVudDpmcmFt ZTttc28tZWxlbWVudC1mcmFtZS1oc3BhY2U6Mi4yNXB0O21zby1lbGVtZW50LXdyYXA6YXJvdW5k O21zby1lbGVtZW50LWFuY2hvci12ZXJ0aWNhbDpwYXJhZ3JhcGg7bXNvLWVsZW1lbnQtYW5jaG9y LWhvcml6b250YWw6Y29sdW1uO21zby1oZWlnaHQtcnVsZTpleGFjdGx5Ij4NCjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7U2Vnb2UgVUkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMjEyMTIxIj5OT1RFOiBNZXNzYWdlIGlzIGZyb20gYW4gZXh0ZXJuYWwgc2Vu ZGVyPG86cD48L286cD48L3NwYW4+PC9wPg0KPC90ZD4NCjwvdHI+DQo8L3Rib2R5Pg0KPC90YWJs ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0i RU4tVVMiPlBvdGVudGlhbCDigJxiYWl0aW5n4oCdIGF0dGFja3Mgb2YgdGhpcyBmb3JtIGVtZXJn ZSB3aGVuIHlvdSBjb21iaW5lIGJhc2VsaW5lIFNUSVIgd2l0aCBjYWxsIGZvcndhcmRpbmcsIGFu ZCBhcmUgdGhlIG1haW4gdGhyZWF0IGFydGljdWxhdGVkIGluIHRoZSBJRVRGIOKAnGRpduKAnSBk cmFmdC4gVGhlIGludHJvZHVjdGlvbiBkZXNjcmliZXMgdGhlbSBhcyBmb2xsb3dzOjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291 cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyBJZiBBbGljZSBjYWxscyBC b2IsIGZvciBleGFtcGxlLCBCb2IgbWlnaHQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPiZuYnNwOyZu YnNwOyBhdHRlbXB0IHRvIGN1dC1hbmQtcGFzdGUgdGhlIElkZW50aXR5IGhlYWRlciBmaWVsZCBp biBBbGljZSdzIElOVklURTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7IGludG8g YSBuZXcgSU5WSVRFIHRoYXQgQm9iIHNlbmRzIHRvIENhcm9sLCBhbmQgdGh1cyBiZSBhYmxlIHRv IGZvb2w8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291 cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyBDYXJvbCBpbnRvIHRoaW5r aW5nIHRoZSBjYWxsIGNhbWUgZnJvbSBBbGljZSBhbmQgbm90IEJvYi4gV2l0aCB0aGU8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIg c3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVv dDs7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyBzaWduYXR1cmUgb3ZlciB0aGUgVG8gaGVhZGVy IGZpZWxkIHZhbHVlLCB0aGUgSU5WSVRFIENhcm9sIHNlZXMgd2lsbDxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpi bGFjayI+Jm5ic3A7Jm5ic3A7IGNsZWFybHkgaGF2ZSBiZWVuIGRlc3RpbmVkIG9yaWdpbmFsbHkg Zm9yIEJvYiwgYW5kIHRodXMgQ2Fyb2wgY2FuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTAuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2NvbG9yOmJsYWNrIj4mbmJzcDsm bmJzcDsgdmlldyB0aGUgSU5WSVRFIGFzIHN1c3BlY3QuPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj5UaGF0 IGRlc2NyaWJlcyB0aGUgc2l0dWF0aW9uIGluIGEgd29ybGQgd2l0aG91dCDigJxkaXbigJ0sIHNv IHRoZSBxdWVzdGlvbiBpcywgZG9lcyDigJxkaXbigJ0gbWFrZSB0aGVzZSBzb3J0cyBvZiBhdHRh Y2tzIGVhc2llciB0byBoYXJkZXIgdG8gbW91bnQ/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj5XaXRob3V0 IOKAnGRpduKAnSwgaW4gdGhlIGV4YW1wbGUgYWJvdmUsIENhcm9sIHdpbGwgc2VlIHRoYXQgdGhl IG9yaWdpbmFsIGNhbGxlZCBudW1iZXIgZG9lcyBub3QgbWF0Y2ggaGVycywgYW5kIGNhbiBkZWNp ZGUgb24gdGhvc2UgZ3JvdW5kcyB0byByZWplY3QgdGhlIGNhbGwuIEJ1dCBiZWFyIGluIG1pbmQg dGhpcyBpcyBhbHNvIHdoYXQgQ2Fyb2wgd291bGQgc2VlIGluIGxlZ2l0aW1hdGUNCiBmb3J3YXJk aW5nIGNhc2VzLCBzbyBhIG1vcmUgbnVhbmNlZCBsb2dpYyB3b3VsZCBwcm9iYWJseSBiZSB1c2Vk LiBTaGUgY291bGQgZGVjaWRlIHRoYXQgaWYgdGhlIG9yaWdpbmFsIGNhbGxlZCBudW1iZXIgaXMg YSBudW1iZXIgdGhhdCBzaG91bGQgYmUgZm9yd2FyZGluZyBjYWxscyB0byBoZXIgKHNheSwgaWYg aXQgd2FzIGhlciBvZmZpY2UpLCB0aGF0IHNoZSBzaG91bGQgYWNjZXB0IHRoZSBjYWxsIGFueXdh eS4gWW91IGNvdWxkIGV2ZW4gaW1hZ2luZQ0KIGFwcGxpY2F0aW9uIGJlaGF2aW9yIHRoYXQgd291 bGQgZW5mb3JjZSBwb2xpY2llcyBhbG9uZyB0aG9zZSBsaW5lcyBvbiBoZXIgYmVoYWxmLiBIb3dl dmVyLCBDYXJvbCBoYXMgbm8gYXNzdXJhbmNlIHRoYXQgaXQgd2FzIHJlYWxseSBoZXIgb2ZmaWNl IHRoYXQgZm9yd2FyZGVkIHRoaXMgY2FsbCwgcmF0aGVyIHRoYW4gc29tZSBlYXZlc2Ryb3BwZXIg d2hvIHNvbWVob3cgY2FwdHVyZWQgdGhlIFBBU1Nwb3JULCBub3IgaG93IG1hbnkgdGltZXMgaXQN CiBtaWdodCBoYXZlIGJlZW4gcmVkaXJlY3RlZCBiZWZvcmUgcmVhY2hpbmcgaGVyLCBvciBhbnl0 aGluZyBhbG9uZyB0aG9zZSBsaW5lcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPlRob3NlIGFyZSB0aGUg Z2FwcyB0aGF0IOKAnGRpduKAnSBpcyBtZWFudCB0byBmaWxsLiBJdCBpcyBub3QgYSBzdWJzdGl0 dXRlIGZvciB0aGUgcmVzdCBvZiB0aGUgbG9naWMgYW5kIHBvbGljeSBkZXNjcmliZWQgYWJvdmUs IGJ1dCBpdCBnaXZlcyBDYXJvbCBtb3JlIGluZm9ybWF0aW9uIHRvIGhlbHAgZmlndXJlIG91dCBp ZiB0aGUgY2FsbCBpcyBzdXNwZWN0IGFuZCB3aGF0IHRvIGRvDQogYWJvdXQgaXQuIFdpdGgg4oCc ZGl24oCdLCB3aGF0IENhcm9sIHNlZXMgaXMgYSBzZWNvbmQgUEFTU3BvclQgY3JlYXRlZCBhbmQg c2lnbmVkIGJ5IEJvYiwgd2hpY2ggYWN0dWFsbHkgZ2l2ZXMgQ2Fyb2wgdGhlIGFzc3VyYW5jZSBv ZiB3aGV0aGVyIHRoZSBpbnRlbmRlZCBjYWxsZWQgcGFydHkgaXMgb25lIHdobyByZXRhcmdldGVk IHRoZSBjYWxsLCB3aGljaCB5b3UgZG9u4oCZdCBnZXQgaW4gdGhlIGFic2VuY2Ugb2Yg4oCcZGl2 4oCdLiBJZiBCb2IgaXMgZG9pbmcNCiB0aGlzIG1hbGljaW91c2x5LCB0aGUg4oCcZGl24oCdIGhl IHByb3ZpZGVkIGhhcyBnaXZlbiBDYXJvbCB0aGUgbWVhbnMgdG8gaHVudCBoaW0gZG93biBmb3Ig cmVkcmVzcywgd2hpY2ggaXMgbm90IGV4YWN0bHkgYSBzdHJvbmcgaW5jZW50aXZlIGZvciBoaW0g dG8gdXNlIOKAnGRpduKAnS4gQnV0IGF0IHRoZSBlbmQgb2YgdGhlIGRheSwgaXQgaXMgQ2Fyb2wg d2hvIG5lZWRzIHRvIGRlY2lkZSBpZiBhIGZvcndhcmRlZCBjYWxsIGZyb20gQm9iIHNob3VsZCBi ZQ0KIHRydXN0ZWQgb3Igbm90IOKAkyDigJxkaXbigJ0gaXMgY2VydGFpbmx5IG5vdCBzdWdnZXN0 aW5nIHRoYXQgdHJ1c3QgaXMgYXV0b21hdGljLCBub3IgdGhhdCB0aGUgcHJlc2VuY2Ugb2YgYSDi gJxkaXbigJ0gdGhhdCBjb3JyZWN0bHkgY2hhaW5zIHRvIHRoZSBvcmlnaW5hbCBQQVNTcG9yVCBp cyBhIHN1YnN0aXR1dGUgZm9yIHRoZSBwb2xpY3kgYW5kIHRydXN0IGRlY2lzaW9uIG1hZGUgb24g dGhlIHRlcm1pbmF0aW5nIHNpZGUgb2YgYSBjYWxsLiBBcyB3aXRoIGJhc2VsaW5lDQogU1RJUiwg anVzdCBiZWNhdXNlIHNvbWV0aGluZyB2YWxpZGF0ZXMgYXQgYSBwcm90b2NvbCBsZXZlbCBkb2Vz buKAmXQgbWVhbiB5b3Ugc2hvdWxkIHRydXN0IGl0LCBub3IgdGhhdCBsb2NhbCBwb2xpY3kgZG9l cyBub3QgZGV0ZXJtaW5lIGhvdyB5b3UgdHJlYXQgY2FsbHMuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj5C dXQgYWxsIHRoYXQgc2FpZCwgaWYgeW914oCZcmUgc2VyaW91cyBhYm91dCBzZWN1cml0eSwgdGhl biB5ZXMsIHVzaW5nIERUTFMtU1JUUCB3aXRoIOKAnG1rZXnigJ0gaXMgZ29pbmcgdG8gcHJvdmlk ZSB5b3Ugd2l0aCBhIGJldHRlciBhc3N1cmFuY2UuDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPkpvbiBQ ZXRlcnNvbjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLVVTIj5OZXVzdGFyLCBJbmMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAx LjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20gMGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+RnJvbToNCjwvc3Bhbj48L2I+PHNwYW4gbGFuZz0i RU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5KYWNrIFJpY2thcmQg Jmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86SmFjay5SaWNrYXJkQG1ldGFzd2l0Y2guY29tIj48 c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPkphY2suUmlja2FyZEBt ZXRhc3dpdGNoLmNvbTwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNp emU6MTIuMHB0O2NvbG9yOmJsYWNrIj4mZ3Q7PGJyPg0KPGI+RGF0ZTogPC9iPldlZG5lc2RheSwg SnVseSAyMiwgMjAyMCBhdCA5OjQ3IEFNPGJyPg0KPGI+VG86IDwvYj4mcXVvdDs8L3NwYW4+PGEg aHJlZj0ibWFpbHRvOnN0aXJAaWV0Zi5vcmciPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9u dC1zaXplOjEyLjBwdCI+c3RpckBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tVVMi IHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj4mcXVvdDsgJmx0Ozwvc3Bhbj48 YSBocmVmPSJtYWlsdG86c3RpckBpZXRmLm9yZyI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJm b250LXNpemU6MTIuMHB0Ij5zdGlyQGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1V UyIgc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPiZndDssDQogJnF1b3Q7PC9z cGFuPjxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRmLXN0aXItcGFzc3BvcnQtZGl2ZXJ0QGlldGYu b3JnIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPmRyYWZ0LWll dGYtc3Rpci1wYXNzcG9ydC1kaXZlcnRAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVO LVVTIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+JnF1b3Q7ICZsdDs8L3Nw YW4+PGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtc3Rpci1wYXNzcG9ydC1kaXZlcnRAaWV0Zi5v cmciPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+ZHJhZnQtaWV0 Zi1zdGlyLXBhc3Nwb3J0LWRpdmVydEBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4t VVMiIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj4mZ3Q7LA0KICZxdW90O1Bl dGVyc29uLCBKb24mcXVvdDsgJmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86am9uLnBldGVyc29u QHRlYW0ubmV1c3RhciI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTIuMHB0 Ij5qb24ucGV0ZXJzb25AdGVhbS5uZXVzdGFyPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1VUyIg c3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPiZndDs8YnI+DQo8Yj5TdWJqZWN0 OiA8L2I+UG90ZW50aWFsIHNlY3VyaXR5IHZ1bG5lcmFiaWxpdHkgaW4gU1RJUi9ESVY8YnI+DQo8 Yj5SZXNlbnQtRnJvbTogPC9iPiZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmFsaWFzLWJvdW5j ZXNAaWV0Zi5vcmciPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+ YWxpYXMtYm91bmNlc0BpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxl PSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj4mZ3Q7PGJyPg0KPGI+UmVzZW50LVRvOiA8 L2I+Jmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86am9uLnBldGVyc29uQHRlYW0ubmV1c3RhciI+ PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij5qb24ucGV0ZXJzb25A dGVhbS5uZXVzdGFyPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6 ZToxMi4wcHQ7Y29sb3I6YmxhY2siPiZndDs8YnI+DQo8Yj5SZXNlbnQtRGF0ZTogPC9iPldlZG5l c2RheSwgSnVseSAyMiwgMjAyMCBhdCA5OjQ3IEFNPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBw dCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4g bGFuZz0iRU4tVVMiPkhlbGxvLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJz cDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1VUyI+SSBiZWxpZXZlIEkndmUgY29tZSBh Y3Jvc3MgYSBzZWN1cml0eSB2dWxuZXJhYmlsaXR5IGluIHRoZSBTVElSIHN5c3RlbSB0aGF0IGlz IG1hZGUgZXhwbG9pdGFibGUgYnkgdGhlIGludHJvZHVjdGlvbiBvZiBESVYgcGFzc3BvcnRzLCB0 aGF0IEkgaGF2ZW4ndCBzZWVuIGRpc2N1c3NlZCBoZXJlIGluIGFueSBkZXRhaWwgKHNvcnJ5DQog aWYgaXQgaGFzIGJlZW4pLiBUaGVyZSBhcmUgY3VycmVudGx5IG1pdGlnYXRpb25zIGZvciBpdCBp biB0aGUgcGFzc3BvcnQgc3BlYywgaG93ZXZlciBJIGRvbid0IGJlbGlldmUgdGhleSBnbyBmYXIg ZW5vdWdoIHRvIHByZXZlbnQgdGhpcyBhdHRhY2suPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0i RU4tVVMiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLVVTIj5UaGUgaGlnaCBs ZXZlbCBzdW1tYXJ5IGlzIHRoYXQgYW4gYXR0YWNrZXIgY2FuIGltcGVyc29uYXRlIGFuIGVudGl0 eSB0aGF0IGNhbGxlZCB0aGVtIGJ5IHByZXRlbmRpbmcgdGhleSByZWRpcmVjdGVkIHRoYXQgY2Fs bCB0byB0aGUgcmVjaXBpZW50LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJz cDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1VUyI+QW4gZXhhbXBsZTo8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYu MHB0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0i RU4tVVMiPlRydXN0ZWQ6IEEgcGFydHkgdHJ1c3RlZCBieSBTdWJqZWN0LCB3aGljaCBBdHRhY2tl ciB3aXNoZXMgdG8gaW1wZXJzb25hdGU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ QXR0YWNrZXI6IFRoZSBwYXJ0eSB3aXNoaW5nIHRvIGltcGVyc29uYXRlIFRydXN0ZWQ8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MzYuMHB0Ij48c3BhbiBsYW5nPSJFTi1VUyI+U3ViamVjdDogVGhlIGludGVuZGVkIHRhcmdldCBv ZiBBdHRhY2tlciwgd2hvIHdpbGwgc2VlIGEgdmVyaWZpZWQgY2FsbCBjb21pbmcgZnJvbSBUcnVz dGVkPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 NzIuMHB0O3RleHQtaW5kZW50Oi0xOC4wcHQ7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzUiPg0KPCFb aWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gbGFuZz0iRU4tVVMiPjxzcGFuIHN0eWxlPSJtc28tbGlz dDpJZ25vcmUiPjEuPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFu JnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48L3Nw YW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBsYW5nPSJFTi1VUyI+QXR0YWNrZXIgZ2V0cyBUcnVz dGVkIHRvIGNhbGwgdGhlbS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlz dFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjcyLjBwdCI+PHNwYW4gbGFuZz0iRU4tVVMi PlRoaXMgaXMgYSByZWFzb25hYmxlIG9wZXJhdGlvbiwgYW5kIGlzIGFjdHVhbGx5IHF1aXRlIGEg Y29tbW9uIGZlYXR1cmUgb2Ygc3VwcG9ydCBjb21wYW5pZXMgc28geW91IGRvbid0IGhhdmUgdG8g c2l0IG9uIGhvbGQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJh Z3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDo3Mi4wcHQ7dGV4dC1pbmRlbnQ6LTE4LjBwdDttc28t bGlzdDpsMCBsZXZlbDEgbGZvNSI+DQo8IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBsYW5nPSJF Ti1VUyI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+Mi48c3BhbiBzdHlsZT0iZm9udDo3 LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIGxhbmc9 IkVOLVVTIj5BdHRhY2tlciBhbnN3ZXJzL3JlamVjdHMgdGhlIGNhbGwgYW5kIHNhdmVzIG9mZiB0 aGUgU0hBS0VOIHBhc3Nwb3J0IGZvciBUcnVzdGVkIC0mZ3Q7IEF0dGFja2VyLjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6NzIuMHB0O3RleHQtaW5kZW50Oi0xOC4wcHQ7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzUiPg0K PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gbGFuZz0iRU4tVVMiPjxzcGFuIHN0eWxlPSJtc28t bGlzdDpJZ25vcmUiPjMuPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJv bWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48 L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBsYW5nPSJFTi1VUyI+QXR0YWNrZXIgc2V0cyB1 cCBhIHJlZGlyZWN0IGZyb20gdGhlbSB0byB0aGVpciBpbnRlbmRlZCBTdWJqZWN0LjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6NzIuMHB0O3RleHQtaW5kZW50Oi0xOC4wcHQ7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzUi Pg0KPCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gbGFuZz0iRU4tVVMiPjxzcGFuIHN0eWxlPSJt c28tbGlzdDpJZ25vcmUiPjQuPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3 IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bh bj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBsYW5nPSJFTi1VUyI+QXR0YWNrZXIgY29u c3RydWN0cyBhIGNhbGwgKGNsYWltaW5nIHRvIGJlKSBmcm9tIFRydXN0ZWQgdG8gQXR0YWNrZXIg d2l0aCB0aGUgcHJldmlvdXNseSBzYXZlZCBTSEFLRU4gcGFzc3BvcnQuPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDo3 Mi4wcHQ7dGV4dC1pbmRlbnQ6LTE4LjBwdDttc28tbGlzdDpsMCBsZXZlbDEgbGZvNSI+DQo8IVtp ZiAhc3VwcG9ydExpc3RzXT48c3BhbiBsYW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9Im1zby1saXN0 Oklnbm9yZSI+NS48c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4m cXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bh bj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIGxhbmc9IkVOLVVTIj5UaGUgY2FsbCB3aWxsIGJlIHZl cmlmaWVkLCB0aGVuIHJlZGlyZWN0ZWQgdG8gU3ViamVjdCB3aXRoIGEgRElWIHBhc3Nwb3J0IGZv ciBBdHRhY2tlciAtJmd0OyBTdWJqZWN0LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6NzIuMHB0Ij48c3BhbiBsYW5n PSJFTi1VUyI+VGhpcyBkb2VzIHJlbHkgb24gdGhlIGNlcnRpZmljYXRlIHNpZ25pbmcgdGhlIERJ ViB0byBiZWxvbmcgdG8gYSB0cnVzdGVkIGVudGl0eSwgdGhpcyBzZWVtcyBwb3NzaWJsZSwgYXMg dGhlIHJlZGlyZWN0IGNvdWxkIGJlIGNhcnJpZWQgb3V0IGJ5IEF0dGFja2VyJ3Mgc2VydmljZSBw cm92aWRlci48YnI+DQpBdHRhY2tlcidzIFNQIG1heSByZWZ1c2UgdG8gcmVkaXJlY3QgYWZ0ZXIg c29tZSB0aW1lIGR1ZSB0byBJYVQgdGltZW91dHMsIGJ1dCB0aGlzIGlzIG5vdCByZXF1aXJlZCBi eSB0aGUgc3BlYyBhbmQgSSBiZWxpZXZlIHRoaXMgY2FuIGJlIHdvcmtlZCBhcm91bmQgYnksIGZv ciBleGFtcGxlLCByZXBlYXRlZGx5IGJvdW5jaW5nIG5ldyBjYWxscyBvZmYgYW4gYWNjb21wbGlj ZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjcyLjBwdDt0ZXh0LWluZGVudDotMTguMHB0O21zby1saXN0OmwwIGxl dmVsMSBsZm81Ij4NCjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIGxhbmc9IkVOLVVTIj48c3Bh biBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj42LjxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90 O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gbGFuZz0iRU4tVVMiPlN1 YmplY3QgcmVjZWl2ZXMgYSBjYWxsIGNsYWltaW5nIHRvIGJlIGZyb20gVHJ1c3RlZCAoYWxiZWl0 IHJlZGlyZWN0ZWQgZnJvbSBBdHRhY2tlcikgd2l0aCBhIHZhbGlkIHBhc3Nwb3J0IGNoYWluIG9m IFRydXN0ZWQgLSZndDsgQXR0YWNrZXIgLSZndDsgU3ViamVjdC48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjcyLjBw dCI+PHNwYW4gbGFuZz0iRU4tVVMiPkJvdGggcGFzc3BvcnRzIHdpbGwgYmUgc2lnbmVkIGJ5IHRy dXN0ZWQgZW50aXRpZXM6IFRydXN0ZWQncyBTUCBhbmQgQXR0YWNrZXIncyBTUC48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6NzIu MHB0Ij48c3BhbiBsYW5nPSJFTi1VUyI+SWFUIGRvZXNuJ3QgcHJvdmlkZSBtdWNoIHByb3RlY3Rp b24gaGVyZSBhcywgaW4gdGhlIHByZXNlbmNlIG9mIERJViBwYXNzcG9ydHMsIHRoZSB2YWxpZCB0 aW1lIHJhbmdlIG11c3QgYmUgc2V0IHJlYXNvbmFibHkgaGlnaCB0byBhbGxvdyBmb3IgdGhlIHBv c3NpYmlsaXR5IG9mIHJpbmctYXJvdW5kcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6NzIuMHB0Ij48c3BhbiBsYW5nPSJFTi1V UyI+VGhlIG9yaWdpZCBhbmQgYXR0ZXN0IHdpbGwgYmUgYXNzb2NpYXRlZCB3aXRoIFRydXN0ZWQs IGVyb2RpbmcgYW55IGF1dG9tYXRlZCBkYXRhYmFzZXMgb2Ygcm9ib2NhbGxzIGJhc2VkIG9uIHRo ZSBvcmlnaWQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoz Ni4wcHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5n PSJFTi1VUyI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gbGFuZz0iRU4tVVMiPlRoZSAmcXVv dDtta3kmcXVvdDsgY2xhaW0gc2VlbXMgdG8gYmUgdGhlIHNvbHV0aW9uIHRoYXQgaXMgY3VycmVu dGx5IGJ1aWx0IGludG8gcGFzc3BvcnRzLCBob3dldmVyLCBpdCBpcyBjdXJyZW50bHkgb3B0aW9u YWwsIGFuZCBhcyBmYXIgYXMgSSBhbSBhd2FyZSB1c2luZyBjZXJ0aWZpY2F0ZXMgdG8gYXV0aGVu dGljYXRlIHRoZSBlbmRzIG9mIGENCiBtZWRpYSBzdHJlYW0gaXMgdmVyeSByYXJlIGluIHByYWN0 aWNlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDs8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0 Ij48c3BhbiBsYW5nPSJFTi1VUyI+VW5mb3J0dW5hdGVseSwgSSdtIG5vdCBhYmxlIHRvIGNvbWUg dXAgd2l0aCBhIHNvbHV0aW9uIGFuZCBJIGFtIGhvcGluZyB0aGF0IGlzIHdoZXJlIHlvdSB3aWxs IGJlIGFibGUgdG8gc3RlcCBpbi4gSSBiZWxpZXZlIHRvIGF2b2lkIHRoaXMsIHRoZXJlIG5lZWRz IHRvIGJlIG1vcmUgdmFsaWRhdGlvbiBvZiB0aGUgbWVkaWEgc3RyZWFtDQogdGhhdCBpcyBjcmVh dGVkLCBlaXRoZXIgaW4gdGhlIGZvcm0gb2YgbW9yZSBkYXRhIGJlaW5nIHNpZ25lZCBvciBlbmZv cmNpbmcgdGhhdCB0aGUgbWVkaWEgcGFydGljaXBhbnRzIGFyZSBhdXRoZW50aWNhdGVkLjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBs YW5nPSJFTi1VUyI+VGhhbmsgeW91LDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxiPjxzcGFuIGxhbmc9IkVOLVVT Ij5KYWNrIFJpY2thcmQgfCBTb2Z0d2FyZSBFbmdpbmVlciB8IE1ldGFzd2l0Y2g8L3NwYW4+PC9i PjxzcGFuIGxhbmc9IkVOLVVTIj4NCjxicj4NClRoZSBGYXN0ZXIgV2F5IEZvcndhcmQ8YnI+DQpP ZmZpY2UgKzQ0IDIwIDgxOTYgOTgwMTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIGxhbmc9IkVOLVVTIj5N ZXRhc3dpdGNoIGlzIGEgTWljcm9zb2Z0IGNvbXBhbnk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBsYW5n PSJFTi1VUyI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv Ym9keT4NCjwvaHRtbD4NCg== --_000_BYAPR02MB5189A165DCE3CDE106FEDD6EF3760BYAPR02MB5189namp_-- From nobody Thu Jul 23 08:35:20 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 09CCD3A0909; Thu, 23 Jul 2020 08:35:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tFM4CI3HjpI6; Thu, 23 Jul 2020 08:35:16 -0700 (PDT) Received: from mail-qk1-x72b.google.com (mail-qk1-x72b.google.com [IPv6:2607:f8b0:4864:20::72b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 048893A0817; Thu, 23 Jul 2020 08:35:16 -0700 (PDT) Received: by mail-qk1-x72b.google.com with SMTP id l23so5753830qkk.0; Thu, 23 Jul 2020 08:35:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=h9qf0tgqeYb5Cs964qrq9EXwu6dykfSE0D6OlA95o6w=; b=dS1dpQ+oh1vj0K7YKQpSLJX7e1KSWQunQQnTXKxHj9m9XsJZ1ZvLIxzca3nfsBjDA3 ui3/QD+Pk2aI4AW6OxA7WXRs5rFEZE0wJa4xogrWZobvhccfwHZvRZ9GfmSyncrXMA38 54yJTBxFZwxX16sR9/FV5CFddTdwJHW03K+XdsvdsJqFX5HQBtHOjdPFRYu1aLm2z8Dt 5w6JoeHpvSBf6g2VouYYXs0rEWGf9JB9UYB4FuwkXuEatRdIYXFY2jaPnl0vF7m4lchJ J/r+mzQf39NZoLsRf9Nsu9LA+WGOF9QqFvuyjKqHAjCQXIcOc6ZdXFuX0TF5rDgLKLJD n54Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=h9qf0tgqeYb5Cs964qrq9EXwu6dykfSE0D6OlA95o6w=; b=KAIXukCeYpd2hqrvj7ZTJ19N4J2/4X3Il8hBr01OQdFY8WaTG8GfHIYY8ZBPqEDqXm TFkiLWrjymD8R+eakydfNHlMMe11C7Kc4ymOBSAgNC9lbQW9MMVR9liNWuIR2/j7HKdt iuSRqB0FTH+Ov/BvEVT8a6wTIkKE0moDzcRVODHxuNOUOaarq699O8QJZsSEN8cr1bPW 0ju2dkPKBdvtnTZXHvLilSOCkql4zYv0NK7vr35B7s9QrTEbVVhfDpbJSqGg98HgOMro j0Ri/niK1clKVMoh5T1pmZ62KRaIou5UYwj+mpm9KJzM7/TAwz33JavtRUzH505RzGqD MV1w== X-Gm-Message-State: AOAM531bWiJtMxa88haqbTNQqhJPZDWvxSjMk2hALqDojZPSAABC05+k tuL4AJtuw/x7t3Y3XzPHNVBFROtwFBw2L5UDMrU= X-Google-Smtp-Source: ABdhPJyWzIbhdP45o30opmbnuZaLdhYzIj1HBH6HmPxlTsqBLlVjrBmJCBeB/sOiBHNFaN5B7AYIhOcrRyChM8i8KW4= X-Received: by 2002:a05:620a:4d5:: with SMTP id 21mr5457953qks.439.1595518515066; Thu, 23 Jul 2020 08:35:15 -0700 (PDT) MIME-Version: 1.0 References: <89AC11DC-7E1A-4D1E-9CB8-96C98E790EF5@team.neustar> In-Reply-To: From: David Hancock Date: Thu, 23 Jul 2020 09:35:04 -0600 Message-ID: To: Jack Rickard Cc: "Peterson, Jon" , "stir@ietf.org" , "draft-ietf-stir-passport-divert@ietf.org" Content-Type: multipart/alternative; boundary="00000000000052c17f05ab1d9aff" Archived-At: Subject: Re: [stir] Potential security vulnerability in STIR/DIV X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 15:35:19 -0000 --00000000000052c17f05ab1d9aff Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Could the verification service in step-5 detect/block the attack using this procedure described in Section 12.1 of RFC 8224? "... servers can keep state of recently received requests, and thus if an Identity header field is replayed by an attacker within the Date interval, verifiers can detect that it is spoofed because a message with an identical Date from the same source had recently been received." David Hancock Comcast On Thu, Jul 23, 2020 at 7:22 AM Jack Rickard wrote: > I agree that div does make this kind of attack more difficult, and > requiring that there is some trust of every retargeting entity does make > sense. My assumption was that by only trusting the signers of the passpor= ts > I can trust the orig is the entity calling me, I now see you have to trus= t > the signers and the diverting parties. To clarify this I propose that > something like your explanation is added to the spec, i.e. > > It is Carol who needs to decide if a forwarded call from Bob should be > trusted or not =E2=80=93 =E2=80=9Cdiv=E2=80=9D is certainly not suggestin= g that trust is automatic, > nor that the presence of a =E2=80=9Cdiv=E2=80=9D that correctly chains to= the original > PASSporT is a substitute for the policy and trust decision made on the > terminating side of a call. As with baseline STIR, just because something > validates at a protocol level doesn=E2=80=99t mean you should trust it, n= or that > local policy does not determine how you treat calls. > > > > > > To be clear, my original email was based on the belief that div passports > would provide a "chain-of-trust", allowing you to essentially ignore that > diversions had occurred once you had established there was a valid chain = of > div passports from the originator to the final destination. Although, aft= er > reading your response I realise that's not the case. > > > > My worry is that this model makes div difficult to use and police in > practice, specifically: > > - This model makes implementations more complicated as you can't > separate verification from policy decisions. You have to filter out > untrusted parties before doing the chain finding step of verification,= as > otherwise you might decide upon a chain containing an untrusted party = when > there does exist a valid chain containing only trusted parties (grante= d > this situation is unlikely). > - This model introduces complexity in what should be displayed to a > user, the simple verified/not verified can't be used unless you requir= e > complete trust of all diverting parties, and that could cause false > negatives. > - If a diverted call does get reported as a robocall, it's not clear > whose reputation should be tarnished. It may have been that the origin= al > caller was a robocaller and the call got legitimately diverted to you,= or > it was the below attack where the caller is trustworthy but the divert= er > was the robocaller. > > > > Thanks, > > Jack > > > > *From:* Peterson, Jon > *Sent:* 22 July 2020 23:53 > *To:* Jack Rickard ; stir@ietf.org; > draft-ietf-stir-passport-divert@ietf.org > *Subject:* Re: Potential security vulnerability in STIR/DIV > > > > NOTE: Message is from an external sender > > > > Potential =E2=80=9Cbaiting=E2=80=9D attacks of this form emerge when you = combine baseline > STIR with call forwarding, and are the main threat articulated in the IET= F > =E2=80=9Cdiv=E2=80=9D draft. The introduction describes them as follows: > > > > If Alice calls Bob, for example, Bob might > > attempt to cut-and-paste the Identity header field in Alice's INVITE > > into a new INVITE that Bob sends to Carol, and thus be able to fool > > Carol into thinking the call came from Alice and not Bob. With the > > signature over the To header field value, the INVITE Carol sees will > > clearly have been destined originally for Bob, and thus Carol can > > view the INVITE as suspect. > > > > That describes the situation in a world without =E2=80=9Cdiv=E2=80=9D, so= the question is, > does =E2=80=9Cdiv=E2=80=9D make these sorts of attacks easier to harder t= o mount? > > > > Without =E2=80=9Cdiv=E2=80=9D, in the example above, Carol will see that = the original > called number does not match hers, and can decide on those grounds to > reject the call. But bear in mind this is also what Carol would see in > legitimate forwarding cases, so a more nuanced logic would probably be > used. She could decide that if the original called number is a number tha= t > should be forwarding calls to her (say, if it was her office), that she > should accept the call anyway. You could even imagine application behavio= r > that would enforce policies along those lines on her behalf. However, Car= ol > has no assurance that it was really her office that forwarded this call, > rather than some eavesdropper who somehow captured the PASSporT, nor how > many times it might have been redirected before reaching her, or anything > along those lines. > > > > Those are the gaps that =E2=80=9Cdiv=E2=80=9D is meant to fill. It is not= a substitute for > the rest of the logic and policy described above, but it gives Carol more > information to help figure out if the call is suspect and what to do abou= t > it. With =E2=80=9Cdiv=E2=80=9D, what Carol sees is a second PASSporT crea= ted and signed by > Bob, which actually gives Carol the assurance of whether the intended > called party is one who retargeted the call, which you don=E2=80=99t get = in the > absence of =E2=80=9Cdiv=E2=80=9D. If Bob is doing this maliciously, the = =E2=80=9Cdiv=E2=80=9D he provided > has given Carol the means to hunt him down for redress, which is not > exactly a strong incentive for him to use =E2=80=9Cdiv=E2=80=9D. But at t= he end of the day, > it is Carol who needs to decide if a forwarded call from Bob should be > trusted or not =E2=80=93 =E2=80=9Cdiv=E2=80=9D is certainly not suggestin= g that trust is automatic, > nor that the presence of a =E2=80=9Cdiv=E2=80=9D that correctly chains to= the original > PASSporT is a substitute for the policy and trust decision made on the > terminating side of a call. As with baseline STIR, just because something > validates at a protocol level doesn=E2=80=99t mean you should trust it, n= or that > local policy does not determine how you treat calls. > > > > But all that said, if you=E2=80=99re serious about security, then yes, us= ing > DTLS-SRTP with =E2=80=9Cmkey=E2=80=9D is going to provide you with a bett= er assurance. > > > > Jon Peterson > > Neustar, Inc. > > > > *From: *Jack Rickard > *Date: *Wednesday, July 22, 2020 at 9:47 AM > *To: *"stir@ietf.org" , " > draft-ietf-stir-passport-divert@ietf.org" < > draft-ietf-stir-passport-divert@ietf.org>, "Peterson, Jon" < > jon.peterson@team.neustar> > *Subject: *Potential security vulnerability in STIR/DIV > *Resent-From: * > *Resent-To: * > *Resent-Date: *Wednesday, July 22, 2020 at 9:47 AM > > > > Hello, > > > > I believe I've come across a security vulnerability in the STIR system > that is made exploitable by the introduction of DIV passports, that I > haven't seen discussed here in any detail (sorry if it has been). There a= re > currently mitigations for it in the passport spec, however I don't believ= e > they go far enough to prevent this attack. > > > > The high level summary is that an attacker can impersonate an entity that > called them by pretending they redirected that call to the recipient. > > > > An example: > > > > Trusted: A party trusted by Subject, which Attacker wishes to impersonate > > Attacker: The party wishing to impersonate Trusted > > Subject: The intended target of Attacker, who will see a verified call > coming from Trusted > > > > 1. Attacker gets Trusted to call them. > > This is a reasonable operation, and is actually quite a common feature of > support companies so you don't have to sit on hold. > > 2. Attacker answers/rejects the call and saves off the SHAKEN > passport for Trusted -> Attacker. > > 3. Attacker sets up a redirect from them to their intended Subject. > > 4. Attacker constructs a call (claiming to be) from Trusted to > Attacker with the previously saved SHAKEN passport. > > 5. The call will be verified, then redirected to Subject with a DIV > passport for Attacker -> Subject. > > This does rely on the certificate signing the DIV to belong to a trusted > entity, this seems possible, as the redirect could be carried out by > Attacker's service provider. > Attacker's SP may refuse to redirect after some time due to IaT timeouts, > but this is not required by the spec and I believe this can be worked > around by, for example, repeatedly bouncing new calls off an accomplice. > > 6. Subject receives a call claiming to be from Trusted (albeit > redirected from Attacker) with a valid passport chain of Trusted -> > Attacker -> Subject. > > Both passports will be signed by trusted entities: Trusted's SP and > Attacker's SP. > > IaT doesn't provide much protection here as, in the presence of DIV > passports, the valid time range must be set reasonably high to allow for > the possibility of ring-arounds. > > The origid and attest will be associated with Trusted, eroding any > automated databases of robocalls based on the origid. > > > > > > > > The "mky" claim seems to be the solution that is currently built into > passports, however, it is currently optional, and as far as I am aware > using certificates to authenticate the ends of a media stream is very rar= e > in practice. > > > > Unfortunately, I'm not able to come up with a solution and I am hoping > that is where you will be able to step in. I believe to avoid this, there > needs to be more validation of the media stream that is created, either i= n > the form of more data being signed or enforcing that the media participan= ts > are authenticated. > > > > Thank you, > > *Jack Rickard | Software Engineer | Metaswitch* > The Faster Way Forward > Office +44 20 8196 9801 > > Metaswitch is a Microsoft company > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > --00000000000052c17f05ab1d9aff Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Could the verification service in step-5 = detect/block the attack using this procedure described in Section 12.1 of R= FC 8224?

=C2=A0 "... servers can keep
=C2=A0 =C2=A0state of recently received requests, and thus if an Identity= header
=C2=A0 =C2=A0field is replayed by an attacker within the = Date interval, verifiers
=C2=A0 =C2=A0can detect that it is spoof= ed because a message with an identical
=C2=A0 =C2=A0Date from the= same source had recently been received."

Dav= id Hancock
Comcast

On Thu, Jul 23, 2020 at 7:22 = AM Jack Rickard <Jack.Rickard=3D40metaswitch.com@dmarc.ietf.org> wrote:

I agree that div does make this kind of attack= more difficult, and requiring that there is some trust of every retargetin= g entity does make sense. My assumption was that by only trusting the signe= rs of the passports I can trust the orig is the entity calling me, I now see = you have to trust the signers and the diverting parties. To clarify this I = propose that something like your explanation is added to the spec, i.e.

It is Carol who needs to decide if a forwarded= call from Bob should be trusted or not =E2=80=93 =E2=80=9Cdiv=E2=80=9D is = certainly not suggesting that trust is automatic, nor that the presence of = a =E2=80=9Cdiv=E2=80=9D that correctly chains to the original PASSporT is a substitute for the policy and trust d= ecision made on the terminating side of a call. As with baseline STIR, just= because something validates at a protocol level doesn=E2=80=99t mean you s= hould trust it, nor that local policy does not determine how you treat calls.

=C2=A0

=C2=A0

To be clear, my original email was based on th= e belief that div passports would provide a "chain-of-trust", all= owing you to essentially ignore that diversions had occurred once you had e= stablished there was a valid chain of div passports from the originator to the final = destination. Although, after reading your response I realise that's not= the case.

=C2=A0

My worry is that this model makes div difficul= t to use and police in practice, specifically:

  • This model makes implementations more complicated as you ca= n't separate verification from policy decisions. You have to filter out= untrusted parties before doing the chain finding step of verification, as otherwise = you might decide upon a chain containing an untrusted party when there does= exist a valid chain containing only trusted parties (granted this situatio= n is unlikely).
  • This model introdu= ces complexity in what should be displayed to a user, the simple verified/n= ot verified can't be used unless you require complete trust of all diverting parties, and that could cause false negatives.
  • If a diverted call does get reported a= s a robocall, it's not clear whose reputation should be tarnished. It m= ay have been that the original caller was a robocaller and the call got legitimately diverted to you, or = it was the below attack where the caller is trustworthy but the diverter wa= s the robocaller.

=C2=A0

Thanks,

Jack

=C2=A0

From: Peterson, Jon <jon.peterson@team.neustar>
Sent: 22 July 2020 23:53
To: Jack Rickard <Jack.Rickard@metaswitch.com>; stir@ietf.org; draft-ietf-stir-passpo= rt-divert@ietf.org
Subject: Re: Potential security vulnerability in STIR/DIV<= /u>

=C2=A0

NOTE: Message is from an external sender

=C2=A0

Potential =E2=80=9Cbaiting=E2= =80=9D attacks of this form emerge when you combine baseline STIR with call= forwarding, and are the main threat articulated in the IETF =E2=80=9Cdiv= =E2=80=9D draft. The introduction describes them as follows:<= /span>

=C2=A0

=C2=A0=C2=A0 If Alice calls Bob, = for example, Bob might

=C2=A0=C2=A0 attempt to cut-and-p= aste the Identity header field in Alice's INVITE

=C2=A0=C2=A0 into a new INVITE th= at Bob sends to Carol, and thus be able to fool

=C2=A0=C2=A0 Carol into thinking = the call came from Alice and not Bob. With the

=C2=A0=C2=A0 signature over the T= o header field value, the INVITE Carol sees will

=C2=A0=C2=A0 clearly have been de= stined originally for Bob, and thus Carol can

=C2=A0=C2=A0 view the INVITE as s= uspect.

=C2=A0

That describes the situation in= a world without =E2=80=9Cdiv=E2=80=9D, so the question is, does =E2=80=9Cd= iv=E2=80=9D make these sorts of attacks easier to harder to mount?

=C2=A0

Without =E2=80=9Cdiv=E2=80=9D, = in the example above, Carol will see that the original called number does n= ot match hers, and can decide on those grounds to reject the call. But bear= in mind this is also what Carol would see in legitimate forwarding cases, so a more nuanced logic would probably be used. She coul= d decide that if the original called number is a number that should be forw= arding calls to her (say, if it was her office), that she should accept the= call anyway. You could even imagine application behavior that would enforce policies along those lines on her = behalf. However, Carol has no assurance that it was really her office that = forwarded this call, rather than some eavesdropper who somehow captured the= PASSporT, nor how many times it might have been redirected before reaching her, or anything along those li= nes.

=C2=A0

Those are the gaps that =E2=80= =9Cdiv=E2=80=9D is meant to fill. It is not a substitute for the rest of th= e logic and policy described above, but it gives Carol more information to = help figure out if the call is suspect and what to do about it. With =E2=80=9Cdiv=E2=80=9D, what Carol sees is a second PASSporT= created and signed by Bob, which actually gives Carol the assurance of whe= ther the intended called party is one who retargeted the call, which you do= n=E2=80=99t get in the absence of =E2=80=9Cdiv=E2=80=9D. If Bob is doing this maliciously, the =E2=80=9Cdiv=E2=80=9D he provided has given Carol th= e means to hunt him down for redress, which is not exactly a strong incenti= ve for him to use =E2=80=9Cdiv=E2=80=9D. But at the end of the day, it is C= arol who needs to decide if a forwarded call from Bob should be trusted or not =E2=80=93 =E2=80=9Cdiv=E2=80=9D is certainly not suggesting= that trust is automatic, nor that the presence of a =E2=80=9Cdiv=E2=80=9D = that correctly chains to the original PASSporT is a substitute for the poli= cy and trust decision made on the terminating side of a call. As with basel= ine STIR, just because something validates at a protocol level doesn=E2=80=99t= mean you should trust it, nor that local policy does not determine how you= treat calls.

=C2=A0

But all that said, if you=E2=80= =99re serious about security, then yes, using DTLS-SRTP with =E2=80=9Cmkey= =E2=80=9D is going to provide you with a better assurance.

=C2=A0

Jon Peterson

Neustar, Inc.

=C2=A0

From: Jack R= ickard <Jack.Rickard@metaswit= ch.com= >
Date: Wednesday, July 22, 2020 at 9:47 AM
To: "= stir@ietf.org" <stir@ietf.org>, "draft-ietf-s= tir-passport-divert@ietf.org" <draft-ietf-stir-passport-divert@ietf.org>, "Peterson, Jon" <jon= .peterson@team.neustar>
Subject: Potential security vulnerability in STIR/DIV
Resent-From: <alias-bounces= @ietf.org>
Resent-To: <jon.peterson= @team.neustar>
Resent-Date: Wednesday, July 22, 2020 at 9:47 AM

<= /u>=C2=A0

Hell= o,

=C2= =A0

I be= lieve I've come across a security vulnerability in the STIR system that= is made exploitable by the introduction of DIV passports, that I haven'= ;t seen discussed here in any detail (sorry if it has been). There are currently mitigations for it in the passport sp= ec, however I don't believe they go far enough to prevent this attack.<= u>

=C2= =A0

The = high level summary is that an attacker can impersonate an entity that calle= d them by pretending they redirected that call to the recipient.<= /u>

=C2= =A0

An e= xample:

=C2= =A0

Trus= ted: A party trusted by Subject, which Attacker wishes to impersonate

Atta= cker: The party wishing to impersonate Trusted

Subj= ect: The intended target of Attacker, who will see a verified call coming f= rom Trusted

=C2= =A0

1.=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 Attacker gets Trusted to c= all them.

This is a reasonable operation, and is actua= lly quite a common feature of support companies so you don't have to si= t on hold.

2.=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 Attacker answers/rejects t= he call and saves off the SHAKEN passport for Trusted -> Attacker.

3.=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 Attacker sets up a redirec= t from them to their intended Subject.

4.=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 Attacker constructs a call= (claiming to be) from Trusted to Attacker with the previously saved SHAKEN= passport.

5.=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 The call will be verified,= then redirected to Subject with a DIV passport for Attacker -> Subject.=

This does rely on the certificate signing th= e DIV to belong to a trusted entity, this seems possible, as the redirect c= ould be carried out by Attacker's service provider.
Attacker's SP may refuse to redirect after some time due to IaT timeout= s, but this is not required by the spec and I believe this can be worked ar= ound by, for example, repeatedly bouncing new calls off an accomplice.

6.=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 Subject receives a call cl= aiming to be from Trusted (albeit redirected from Attacker) with a valid pa= ssport chain of Trusted -> Attacker -> Subject.<= /p>

Both passports will be signed by trusted ent= ities: Trusted's SP and Attacker's SP.

IaT = doesn't provide much protection here as, in the presence of DIV passpor= ts, the valid time range must be set reasonably high to allow for the possi= bility of ring-arounds.

The = origid and attest will be associated with Trusted, eroding any automated da= tabases of robocalls based on the origid.

=C2= =A0

=C2= =A0

=C2= =A0

The = "mky" claim seems to be the solution that is currently built into= passports, however, it is currently optional, and as far as I am aware usi= ng certificates to authenticate the ends of a media stream is very rare in practice.

=C2= =A0

Unfo= rtunately, I'm not able to come up with a solution and I am hoping that= is where you will be able to step in. I believe to avoid this, there needs= to be more validation of the media stream that is created, either in the form of more data being signed or enforcing= that the media participants are authenticated.

=C2= =A0

Than= k you,

J= ack Rickard | Software Engineer | Metaswitch
The Faster Way Forward
Office +44 20 8196 9801

Meta= switch is a Microsoft company

=C2= =A0

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir
--00000000000052c17f05ab1d9aff-- From nobody Thu Jul 23 09:01:17 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 12BC63A0AA6; Thu, 23 Jul 2020 09:01:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=metaswitch.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NA6RLQThyyax; Thu, 23 Jul 2020 09:01:06 -0700 (PDT) Received: from NAM12-BN8-obe.outbound.protection.outlook.com (mail-bn8nam12on2092.outbound.protection.outlook.com [40.107.237.92]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9394B3A0A87; Thu, 23 Jul 2020 09:01:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Dz66ylLQxtu4Owpj8NBpdOjD/1nvs9r+EQA4ZkqZVtfGWglDtn8gagIa4PdmSD/xqvnWAMNRj/npwWc8zuIxxBxCMlcz/QhCdbyAbPAiYnPGnk3z++/+Rp6I+RSY4mCHF6gQwyWLDUkl53h/RUjaG7cs/pHqW6ocqed4DMoBVNvH3O95Fr3O75P0Wc67Ax4oL5CqMaa0JItJWpKTd9yWKhSoRrYeozFJmH29xV0kyx81MvlmQWktu1l+u4h0LxC7ekHfYz3DniAIdxDNhTu/7r+6rwP2kKcbR9jalaJDPVj70X8HeDmtHOWBNzFojeH5oavHQqEgIWXxQoKQNJWgrA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GnFZ0EeepyHpesUyGxAZTQojjSxu0jGOCgU+bAsa4Go=; b=H7bpOtN7zwcYvTzdPCgtyRaJTNKdM4ur4P5yTkKcG+Ijo+ZWDkqihPSin+5lZFuT7rjoJGEzCQIkax8V79tJ01Q0xygDk6AcNK2W1JCU9S3Z63Td8OnCITzCRzhnQCXmTlMG/zxMjTvqD5a3sJZw/X6/npZ5brnsIs3R9XKxW8Fecvvc0yrA1Phy/scGdCyoIfBPEBHxoUoJri6ujMOGotZWHULpCYsq7OthS0gr29n7ah3ZW9OvS8y5bxodbbkggiZVpRW9ll2aphgqnWMSPyVbTEwsD+ISQCJtdXUp7SXY2yRYdX2DHbVskFH7lAT+DYjmsLCS6JFA/RrlN4Jtcw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=metaswitch.com; dmarc=pass action=none header.from=metaswitch.com; dkim=pass header.d=metaswitch.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=metaswitch.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GnFZ0EeepyHpesUyGxAZTQojjSxu0jGOCgU+bAsa4Go=; b=FMgD1O0k6L3IOM7OlR+Qg5AwY4myhMEewz0ka45xCCBicYhw5cnL7aX/T9n5V+/gy6lK4QN4AhPiFDBg+u7zf89rwExl42YYlnsrwXu6ZFhlucAmxwcivOAo8CX2HjEHbXzvcSTa9zZa24iCg/Oy2NC31Oq98Urxy5ZSIKmFuSA= Received: from BYAPR02MB5189.namprd02.prod.outlook.com (2603:10b6:a03:62::29) by BYAPR02MB5718.namprd02.prod.outlook.com (2603:10b6:a03:11c::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3174.20; Thu, 23 Jul 2020 16:00:58 +0000 Received: from BYAPR02MB5189.namprd02.prod.outlook.com ([fe80::85af:617:4f9f:b2c3]) by BYAPR02MB5189.namprd02.prod.outlook.com ([fe80::85af:617:4f9f:b2c3%7]) with mapi id 15.20.3216.020; Thu, 23 Jul 2020 16:00:58 +0000 From: Jack Rickard To: David Hancock CC: "Peterson, Jon" , "draft-ietf-stir-passport-divert@ietf.org" , "stir@ietf.org" Thread-Topic: [stir] Potential security vulnerability in STIR/DIV Thread-Index: AdZgO7RfMuiVRPd/TYi0mhEaKJnUqQABGmKAACQy9XAADXsJAAAAmkxQ Date: Thu, 23 Jul 2020 16:00:57 +0000 Message-ID: References: <89AC11DC-7E1A-4D1E-9CB8-96C98E790EF5@team.neustar> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=metaswitch.com; x-originating-ip: [84.92.33.46] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ddacd361-fa07-4072-f2e2-08d82f2196b8 x-ms-traffictypediagnostic: BYAPR02MB5718: x-ld-processed: 9d9e56eb-f613-4ddb-b27b-bfcdf14b2cdb,ExtAddr x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: LD9+rkEpOFP2OjtlMo6s7h1SrU5EkeBzzsq5EMJeTwvwXub95qCYhS3eHWqRnF3k3o7JvuRxsgnm4t3fpLx+CmO8xqbsH+JpJzqMXNOVyo0/SRO9FkTIINOqh0AAO17CN1YW5LozJWDZdWfQeGCzgw5ewSgeijYpX9SUWWPNbe98aNxbGv21VEfBnX16+Z7rC8aSHk5/bh8hjwTfQLi7E7TkOdnGVGe1mFSlJl9ZncopcTpE3PS0R79yNV28KASkhSjlsKFDIuXXJ46XBlXo7wddCAYMlxyiOWKl5g7I8O7H+HfJhIiMK9MaghGByzZjo31V+tdh02XMfLXQFk7mxb+bbGk/8mTiCQ4V82PDBqxnqgRTG4qse/11NV6NSVF23BeF8VkXKc2y/mlx+9FTSA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BYAPR02MB5189.namprd02.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(346002)(376002)(366004)(396003)(39850400004)(136003)(5660300002)(316002)(4326008)(54906003)(71200400001)(966005)(45080400002)(478600001)(9686003)(83380400001)(166002)(6916009)(55016002)(15650500001)(53546011)(66446008)(8936002)(7696005)(6506007)(76116006)(33656002)(30864003)(52536014)(64756008)(66946007)(66476007)(8676002)(26005)(186003)(2906002)(86362001)(66556008); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: H+RkFb5l+lhEyJ0uH6YZeyGTIyFIxvPi0UaJ9w7l6uKHI/vT30ykQvGsbsV0r0oAopAEtlMz2P4eEUB57wiyHyGkZJx3eLel7dRs1ZA/Ahp3MHkynIbZUYrL40BLlfEE9XHIqapGaNq/HQv+5jmAo1fwRmkWdDkLCyrooMTsKS516ZL2M/VVuRK0WGRROaGvhD/FW5jZ/WdzU6JN5x9oltCbnuEvq53JrPx8yxcthaEybP4wXSf0I7AyapcfgYwmUNHCxL6tM+BZyzmCEn9kmsMMm8coGvYkqbkEwyU/jxzz6hvu3NK9+0dy+to3Ap8NkQB7rCU00342L8/cSof9BgGw6EqW2iXHaY/vjthvwc/5etw1CSOHOAtfcsahkARP1TdeHtgvrOif0OjK/Mzkzd8U+MnZXbxQSLw9WmLqokWfsKGievfFQejirLVrk6HvDI2w6AWwxt6y+Kr30FTr9XflLfSwdZ+xoOsT72/y/mk= Content-Type: multipart/alternative; boundary="_000_BYAPR02MB5189902FBF70C0ECC7A19228F3760BYAPR02MB5189namp_" MIME-Version: 1.0 X-OriginatorOrg: metaswitch.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BYAPR02MB5189.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: ddacd361-fa07-4072-f2e2-08d82f2196b8 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Jul 2020 16:00:57.9965 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 9d9e56eb-f613-4ddb-b27b-bfcdf14b2cdb X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: qDDiN0jSJMoWWcAbrBOjTUk31btfmxAkqLIA7OmiDRXrvYAAVqDZK8TpoMP3nJJ/kMJ3V1uO2ZrZahi/uuPiuA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR02MB5718 Archived-At: Subject: Re: [stir] Potential security vulnerability in STIR/DIV X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 16:01:16 -0000 --_000_BYAPR02MB5189902FBF70C0ECC7A19228F3760BYAPR02MB5189namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSB0aGluayB0aGF0IHdvdWxkIHdvcmssIGhvd2V2ZXIgaXQgd291bGQgYmUgdmVyeSBoYXJkIHRv IGltcGxlbWVudCBpbiBhIHdheSB0byBiZSBpbmZhbGxpYmxlLiBNb3N0IFNQcyB3aWxsIGhhdmUg bXVsdGlwbGUgc2VydmVycyBoYW5kbGluZyB2ZXJpZmljYXRpb24gYW5kIHdoaWxlIHJhcGlkbHkg c3luY2hyb25pc2luZyBhIGxpc3Qgb2YgYWxsIHJlY2VudGx5IHNlZW4gSWRlbnRpdHkgaGVhZGVy cyBpcyBwb3NzaWJsZSwgaXQgYWRkcyBhIGxvdCBvZiBjb21wbGV4aXR5Lg0KDQpKYWNrDQoNCkZy b206IHN0aXIgPHN0aXItYm91bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIERhdmlkIEhhbmNv Y2sNClNlbnQ6IDIzIEp1bHkgMjAyMCAxNjozNQ0KVG86IEphY2sgUmlja2FyZCA8SmFjay5SaWNr YXJkPTQwbWV0YXN3aXRjaC5jb21AZG1hcmMuaWV0Zi5vcmc+DQpDYzogUGV0ZXJzb24sIEpvbiA8 am9uLnBldGVyc29uQHRlYW0ubmV1c3Rhcj47IGRyYWZ0LWlldGYtc3Rpci1wYXNzcG9ydC1kaXZl cnRAaWV0Zi5vcmc7IHN0aXJAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbc3Rpcl0gUG90ZW50aWFs IHNlY3VyaXR5IHZ1bG5lcmFiaWxpdHkgaW4gU1RJUi9ESVYNCg0KTk9URTogTWVzc2FnZSBpcyBm cm9tIGFuIGV4dGVybmFsIHNlbmRlcg0KQ291bGQgdGhlIHZlcmlmaWNhdGlvbiBzZXJ2aWNlIGlu IHN0ZXAtNSBkZXRlY3QvYmxvY2sgdGhlIGF0dGFjayB1c2luZyB0aGlzIHByb2NlZHVyZSBkZXNj cmliZWQgaW4gU2VjdGlvbiAxMi4xIG9mIFJGQyA4MjI0Pw0KDQogICIuLi4gc2VydmVycyBjYW4g a2VlcA0KICAgc3RhdGUgb2YgcmVjZW50bHkgcmVjZWl2ZWQgcmVxdWVzdHMsIGFuZCB0aHVzIGlm IGFuIElkZW50aXR5IGhlYWRlcg0KICAgZmllbGQgaXMgcmVwbGF5ZWQgYnkgYW4gYXR0YWNrZXIg d2l0aGluIHRoZSBEYXRlIGludGVydmFsLCB2ZXJpZmllcnMNCiAgIGNhbiBkZXRlY3QgdGhhdCBp dCBpcyBzcG9vZmVkIGJlY2F1c2UgYSBtZXNzYWdlIHdpdGggYW4gaWRlbnRpY2FsDQogICBEYXRl IGZyb20gdGhlIHNhbWUgc291cmNlIGhhZCByZWNlbnRseSBiZWVuIHJlY2VpdmVkLiINCg0KRGF2 aWQgSGFuY29jaw0KQ29tY2FzdA0KDQpPbiBUaHUsIEp1bCAyMywgMjAyMCBhdCA3OjIyIEFNIEph Y2sgUmlja2FyZCA8SmFjay5SaWNrYXJkPTQwbWV0YXN3aXRjaC5jb21AZG1hcmMuaWV0Zi5vcmc8 bWFpbHRvOjQwbWV0YXN3aXRjaC5jb21AZG1hcmMuLmlldGYub3JnPj4gd3JvdGU6DQpJIGFncmVl IHRoYXQgZGl2IGRvZXMgbWFrZSB0aGlzIGtpbmQgb2YgYXR0YWNrIG1vcmUgZGlmZmljdWx0LCBh bmQgcmVxdWlyaW5nIHRoYXQgdGhlcmUgaXMgc29tZSB0cnVzdCBvZiBldmVyeSByZXRhcmdldGlu ZyBlbnRpdHkgZG9lcyBtYWtlIHNlbnNlLiBNeSBhc3N1bXB0aW9uIHdhcyB0aGF0IGJ5IG9ubHkg dHJ1c3RpbmcgdGhlIHNpZ25lcnMgb2YgdGhlIHBhc3Nwb3J0cyBJIGNhbiB0cnVzdCB0aGUgb3Jp ZyBpcyB0aGUgZW50aXR5IGNhbGxpbmcgbWUsIEkgbm93IHNlZSB5b3UgaGF2ZSB0byB0cnVzdCB0 aGUgc2lnbmVycyBhbmQgdGhlIGRpdmVydGluZyBwYXJ0aWVzLiBUbyBjbGFyaWZ5IHRoaXMgSSBw cm9wb3NlIHRoYXQgc29tZXRoaW5nIGxpa2UgeW91ciBleHBsYW5hdGlvbiBpcyBhZGRlZCB0byB0 aGUgc3BlYywgaS5lLg0KSXQgaXMgQ2Fyb2wgd2hvIG5lZWRzIHRvIGRlY2lkZSBpZiBhIGZvcndh cmRlZCBjYWxsIGZyb20gQm9iIHNob3VsZCBiZSB0cnVzdGVkIG9yIG5vdCDigJMg4oCcZGl24oCd IGlzIGNlcnRhaW5seSBub3Qgc3VnZ2VzdGluZyB0aGF0IHRydXN0IGlzIGF1dG9tYXRpYywgbm9y IHRoYXQgdGhlIHByZXNlbmNlIG9mIGEg4oCcZGl24oCdIHRoYXQgY29ycmVjdGx5IGNoYWlucyB0 byB0aGUgb3JpZ2luYWwgUEFTU3BvclQgaXMgYSBzdWJzdGl0dXRlIGZvciB0aGUgcG9saWN5IGFu ZCB0cnVzdCBkZWNpc2lvbiBtYWRlIG9uIHRoZSB0ZXJtaW5hdGluZyBzaWRlIG9mIGEgY2FsbC4g QXMgd2l0aCBiYXNlbGluZSBTVElSLCBqdXN0IGJlY2F1c2Ugc29tZXRoaW5nIHZhbGlkYXRlcyBh dCBhIHByb3RvY29sIGxldmVsIGRvZXNu4oCZdCBtZWFuIHlvdSBzaG91bGQgdHJ1c3QgaXQsIG5v ciB0aGF0IGxvY2FsIHBvbGljeSBkb2VzIG5vdCBkZXRlcm1pbmUgaG93IHlvdSB0cmVhdCBjYWxs cy4NCg0KDQpUbyBiZSBjbGVhciwgbXkgb3JpZ2luYWwgZW1haWwgd2FzIGJhc2VkIG9uIHRoZSBi ZWxpZWYgdGhhdCBkaXYgcGFzc3BvcnRzIHdvdWxkIHByb3ZpZGUgYSAiY2hhaW4tb2YtdHJ1c3Qi LCBhbGxvd2luZyB5b3UgdG8gZXNzZW50aWFsbHkgaWdub3JlIHRoYXQgZGl2ZXJzaW9ucyBoYWQg b2NjdXJyZWQgb25jZSB5b3UgaGFkIGVzdGFibGlzaGVkIHRoZXJlIHdhcyBhIHZhbGlkIGNoYWlu IG9mIGRpdiBwYXNzcG9ydHMgZnJvbSB0aGUgb3JpZ2luYXRvciB0byB0aGUgZmluYWwgZGVzdGlu YXRpb24uIEFsdGhvdWdoLCBhZnRlciByZWFkaW5nIHlvdXIgcmVzcG9uc2UgSSByZWFsaXNlIHRo YXQncyBub3QgdGhlIGNhc2UuDQoNCk15IHdvcnJ5IGlzIHRoYXQgdGhpcyBtb2RlbCBtYWtlcyBk aXYgZGlmZmljdWx0IHRvIHVzZSBhbmQgcG9saWNlIGluIHByYWN0aWNlLCBzcGVjaWZpY2FsbHk6 DQoNCiAgKiAgIFRoaXMgbW9kZWwgbWFrZXMgaW1wbGVtZW50YXRpb25zIG1vcmUgY29tcGxpY2F0 ZWQgYXMgeW91IGNhbid0IHNlcGFyYXRlIHZlcmlmaWNhdGlvbiBmcm9tIHBvbGljeSBkZWNpc2lv bnMuIFlvdSBoYXZlIHRvIGZpbHRlciBvdXQgdW50cnVzdGVkIHBhcnRpZXMgYmVmb3JlIGRvaW5n IHRoZSBjaGFpbiBmaW5kaW5nIHN0ZXAgb2YgdmVyaWZpY2F0aW9uLCBhcyBvdGhlcndpc2UgeW91 IG1pZ2h0IGRlY2lkZSB1cG9uIGEgY2hhaW4gY29udGFpbmluZyBhbiB1bnRydXN0ZWQgcGFydHkg d2hlbiB0aGVyZSBkb2VzIGV4aXN0IGEgdmFsaWQgY2hhaW4gY29udGFpbmluZyBvbmx5IHRydXN0 ZWQgcGFydGllcyAoZ3JhbnRlZCB0aGlzIHNpdHVhdGlvbiBpcyB1bmxpa2VseSkuDQogICogICBU aGlzIG1vZGVsIGludHJvZHVjZXMgY29tcGxleGl0eSBpbiB3aGF0IHNob3VsZCBiZSBkaXNwbGF5 ZWQgdG8gYSB1c2VyLCB0aGUgc2ltcGxlIHZlcmlmaWVkL25vdCB2ZXJpZmllZCBjYW4ndCBiZSB1 c2VkIHVubGVzcyB5b3UgcmVxdWlyZSBjb21wbGV0ZSB0cnVzdCBvZiBhbGwgZGl2ZXJ0aW5nIHBh cnRpZXMsIGFuZCB0aGF0IGNvdWxkIGNhdXNlIGZhbHNlIG5lZ2F0aXZlcy4NCiAgKiAgIElmIGEg ZGl2ZXJ0ZWQgY2FsbCBkb2VzIGdldCByZXBvcnRlZCBhcyBhIHJvYm9jYWxsLCBpdCdzIG5vdCBj bGVhciB3aG9zZSByZXB1dGF0aW9uIHNob3VsZCBiZSB0YXJuaXNoZWQuIEl0IG1heSBoYXZlIGJl ZW4gdGhhdCB0aGUgb3JpZ2luYWwgY2FsbGVyIHdhcyBhIHJvYm9jYWxsZXIgYW5kIHRoZSBjYWxs IGdvdCBsZWdpdGltYXRlbHkgZGl2ZXJ0ZWQgdG8geW91LCBvciBpdCB3YXMgdGhlIGJlbG93IGF0 dGFjayB3aGVyZSB0aGUgY2FsbGVyIGlzIHRydXN0d29ydGh5IGJ1dCB0aGUgZGl2ZXJ0ZXIgd2Fz IHRoZSByb2JvY2FsbGVyLg0KDQpUaGFua3MsDQpKYWNrDQoNCkZyb206IFBldGVyc29uLCBKb24g PGpvbi5wZXRlcnNvbkB0ZWFtLm5ldXN0YXI8bWFpbHRvOmpvbi5wZXRlcnNvbkB0ZWFtLm5ldXN0 YXI+Pg0KU2VudDogMjIgSnVseSAyMDIwIDIzOjUzDQpUbzogSmFjayBSaWNrYXJkIDxKYWNrLlJp Y2thcmRAbWV0YXN3aXRjaC5jb208bWFpbHRvOkphY2suUmlja2FyZEBtZXRhc3dpdGNoLmNvbT4+ OyBzdGlyQGlldGYub3JnPG1haWx0bzpzdGlyQGlldGYub3JnPjsgZHJhZnQtaWV0Zi1zdGlyLXBh c3Nwb3J0LWRpdmVydEBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LWRp dmVydEBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBQb3RlbnRpYWwgc2VjdXJpdHkgdnVsbmVyYWJp bGl0eSBpbiBTVElSL0RJVg0KDQpOT1RFOiBNZXNzYWdlIGlzIGZyb20gYW4gZXh0ZXJuYWwgc2Vu ZGVyDQoNClBvdGVudGlhbCDigJxiYWl0aW5n4oCdIGF0dGFja3Mgb2YgdGhpcyBmb3JtIGVtZXJn ZSB3aGVuIHlvdSBjb21iaW5lIGJhc2VsaW5lIFNUSVIgd2l0aCBjYWxsIGZvcndhcmRpbmcsIGFu ZCBhcmUgdGhlIG1haW4gdGhyZWF0IGFydGljdWxhdGVkIGluIHRoZSBJRVRGIOKAnGRpduKAnSBk cmFmdC4gVGhlIGludHJvZHVjdGlvbiBkZXNjcmliZXMgdGhlbSBhcyBmb2xsb3dzOg0KDQogICBJ ZiBBbGljZSBjYWxscyBCb2IsIGZvciBleGFtcGxlLCBCb2IgbWlnaHQNCiAgIGF0dGVtcHQgdG8g Y3V0LWFuZC1wYXN0ZSB0aGUgSWRlbnRpdHkgaGVhZGVyIGZpZWxkIGluIEFsaWNlJ3MgSU5WSVRF DQogICBpbnRvIGEgbmV3IElOVklURSB0aGF0IEJvYiBzZW5kcyB0byBDYXJvbCwgYW5kIHRodXMg YmUgYWJsZSB0byBmb29sDQogICBDYXJvbCBpbnRvIHRoaW5raW5nIHRoZSBjYWxsIGNhbWUgZnJv bSBBbGljZSBhbmQgbm90IEJvYi4gV2l0aCB0aGUNCiAgIHNpZ25hdHVyZSBvdmVyIHRoZSBUbyBo ZWFkZXIgZmllbGQgdmFsdWUsIHRoZSBJTlZJVEUgQ2Fyb2wgc2VlcyB3aWxsDQogICBjbGVhcmx5 IGhhdmUgYmVlbiBkZXN0aW5lZCBvcmlnaW5hbGx5IGZvciBCb2IsIGFuZCB0aHVzIENhcm9sIGNh bg0KICAgdmlldyB0aGUgSU5WSVRFIGFzIHN1c3BlY3QuDQoNClRoYXQgZGVzY3JpYmVzIHRoZSBz aXR1YXRpb24gaW4gYSB3b3JsZCB3aXRob3V0IOKAnGRpduKAnSwgc28gdGhlIHF1ZXN0aW9uIGlz LCBkb2VzIOKAnGRpduKAnSBtYWtlIHRoZXNlIHNvcnRzIG9mIGF0dGFja3MgZWFzaWVyIHRvIGhh cmRlciB0byBtb3VudD8NCg0KV2l0aG91dCDigJxkaXbigJ0sIGluIHRoZSBleGFtcGxlIGFib3Zl LCBDYXJvbCB3aWxsIHNlZSB0aGF0IHRoZSBvcmlnaW5hbCBjYWxsZWQgbnVtYmVyIGRvZXMgbm90 IG1hdGNoIGhlcnMsIGFuZCBjYW4gZGVjaWRlIG9uIHRob3NlIGdyb3VuZHMgdG8gcmVqZWN0IHRo ZSBjYWxsLiBCdXQgYmVhciBpbiBtaW5kIHRoaXMgaXMgYWxzbyB3aGF0IENhcm9sIHdvdWxkIHNl ZSBpbiBsZWdpdGltYXRlIGZvcndhcmRpbmcgY2FzZXMsIHNvIGEgbW9yZSBudWFuY2VkIGxvZ2lj IHdvdWxkIHByb2JhYmx5IGJlIHVzZWQuIFNoZSBjb3VsZCBkZWNpZGUgdGhhdCBpZiB0aGUgb3Jp Z2luYWwgY2FsbGVkIG51bWJlciBpcyBhIG51bWJlciB0aGF0IHNob3VsZCBiZSBmb3J3YXJkaW5n IGNhbGxzIHRvIGhlciAoc2F5LCBpZiBpdCB3YXMgaGVyIG9mZmljZSksIHRoYXQgc2hlIHNob3Vs ZCBhY2NlcHQgdGhlIGNhbGwgYW55d2F5LiBZb3UgY291bGQgZXZlbiBpbWFnaW5lIGFwcGxpY2F0 aW9uIGJlaGF2aW9yIHRoYXQgd291bGQgZW5mb3JjZSBwb2xpY2llcyBhbG9uZyB0aG9zZSBsaW5l cyBvbiBoZXIgYmVoYWxmLiBIb3dldmVyLCBDYXJvbCBoYXMgbm8gYXNzdXJhbmNlIHRoYXQgaXQg d2FzIHJlYWxseSBoZXIgb2ZmaWNlIHRoYXQgZm9yd2FyZGVkIHRoaXMgY2FsbCwgcmF0aGVyIHRo YW4gc29tZSBlYXZlc2Ryb3BwZXIgd2hvIHNvbWVob3cgY2FwdHVyZWQgdGhlIFBBU1Nwb3JULCBu b3IgaG93IG1hbnkgdGltZXMgaXQgbWlnaHQgaGF2ZSBiZWVuIHJlZGlyZWN0ZWQgYmVmb3JlIHJl YWNoaW5nIGhlciwgb3IgYW55dGhpbmcgYWxvbmcgdGhvc2UgbGluZXMuDQoNClRob3NlIGFyZSB0 aGUgZ2FwcyB0aGF0IOKAnGRpduKAnSBpcyBtZWFudCB0byBmaWxsLiBJdCBpcyBub3QgYSBzdWJz dGl0dXRlIGZvciB0aGUgcmVzdCBvZiB0aGUgbG9naWMgYW5kIHBvbGljeSBkZXNjcmliZWQgYWJv dmUsIGJ1dCBpdCBnaXZlcyBDYXJvbCBtb3JlIGluZm9ybWF0aW9uIHRvIGhlbHAgZmlndXJlIG91 dCBpZiB0aGUgY2FsbCBpcyBzdXNwZWN0IGFuZCB3aGF0IHRvIGRvIGFib3V0IGl0LiBXaXRoIOKA nGRpduKAnSwgd2hhdCBDYXJvbCBzZWVzIGlzIGEgc2Vjb25kIFBBU1Nwb3JUIGNyZWF0ZWQgYW5k IHNpZ25lZCBieSBCb2IsIHdoaWNoIGFjdHVhbGx5IGdpdmVzIENhcm9sIHRoZSBhc3N1cmFuY2Ug b2Ygd2hldGhlciB0aGUgaW50ZW5kZWQgY2FsbGVkIHBhcnR5IGlzIG9uZSB3aG8gcmV0YXJnZXRl ZCB0aGUgY2FsbCwgd2hpY2ggeW91IGRvbuKAmXQgZ2V0IGluIHRoZSBhYnNlbmNlIG9mIOKAnGRp duKAnS4gSWYgQm9iIGlzIGRvaW5nIHRoaXMgbWFsaWNpb3VzbHksIHRoZSDigJxkaXbigJ0gaGUg cHJvdmlkZWQgaGFzIGdpdmVuIENhcm9sIHRoZSBtZWFucyB0byBodW50IGhpbSBkb3duIGZvciBy ZWRyZXNzLCB3aGljaCBpcyBub3QgZXhhY3RseSBhIHN0cm9uZyBpbmNlbnRpdmUgZm9yIGhpbSB0 byB1c2Ug4oCcZGl24oCdLiBCdXQgYXQgdGhlIGVuZCBvZiB0aGUgZGF5LCBpdCBpcyBDYXJvbCB3 aG8gbmVlZHMgdG8gZGVjaWRlIGlmIGEgZm9yd2FyZGVkIGNhbGwgZnJvbSBCb2Igc2hvdWxkIGJl IHRydXN0ZWQgb3Igbm90IOKAkyDigJxkaXbigJ0gaXMgY2VydGFpbmx5IG5vdCBzdWdnZXN0aW5n IHRoYXQgdHJ1c3QgaXMgYXV0b21hdGljLCBub3IgdGhhdCB0aGUgcHJlc2VuY2Ugb2YgYSDigJxk aXbigJ0gdGhhdCBjb3JyZWN0bHkgY2hhaW5zIHRvIHRoZSBvcmlnaW5hbCBQQVNTcG9yVCBpcyBh IHN1YnN0aXR1dGUgZm9yIHRoZSBwb2xpY3kgYW5kIHRydXN0IGRlY2lzaW9uIG1hZGUgb24gdGhl IHRlcm1pbmF0aW5nIHNpZGUgb2YgYSBjYWxsLiBBcyB3aXRoIGJhc2VsaW5lIFNUSVIsIGp1c3Qg YmVjYXVzZSBzb21ldGhpbmcgdmFsaWRhdGVzIGF0IGEgcHJvdG9jb2wgbGV2ZWwgZG9lc27igJl0 IG1lYW4geW91IHNob3VsZCB0cnVzdCBpdCwgbm9yIHRoYXQgbG9jYWwgcG9saWN5IGRvZXMgbm90 IGRldGVybWluZSBob3cgeW91IHRyZWF0IGNhbGxzLg0KDQpCdXQgYWxsIHRoYXQgc2FpZCwgaWYg eW914oCZcmUgc2VyaW91cyBhYm91dCBzZWN1cml0eSwgdGhlbiB5ZXMsIHVzaW5nIERUTFMtU1JU UCB3aXRoIOKAnG1rZXnigJ0gaXMgZ29pbmcgdG8gcHJvdmlkZSB5b3Ugd2l0aCBhIGJldHRlciBh c3N1cmFuY2UuDQoNCkpvbiBQZXRlcnNvbg0KTmV1c3RhciwgSW5jLg0KDQpGcm9tOiBKYWNrIFJp Y2thcmQgPEphY2suUmlja2FyZEBtZXRhc3dpdGNoLmNvbTxtYWlsdG86SmFjay5SaWNrYXJkQG1l dGFzd2l0Y2guY29tPj4NCkRhdGU6IFdlZG5lc2RheSwgSnVseSAyMiwgMjAyMCBhdCA5OjQ3IEFN DQpUbzogInN0aXJAaWV0Zi5vcmc8bWFpbHRvOnN0aXJAaWV0Zi5vcmc+IiA8c3RpckBpZXRmLm9y ZzxtYWlsdG86c3RpckBpZXRmLm9yZz4+LCAiZHJhZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LWRpdmVy dEBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LWRpdmVydEBpZXRmLm9y Zz4iIDxkcmFmdC1pZXRmLXN0aXItcGFzc3BvcnQtZGl2ZXJ0QGlldGYub3JnPG1haWx0bzpkcmFm dC1pZXRmLXN0aXItcGFzc3BvcnQtZGl2ZXJ0QGlldGYub3JnPj4sICJQZXRlcnNvbiwgSm9uIiA8 am9uLi5wZXRlcnNvbkB0ZWFtLm5ldXN0YXI8bWFpbHRvOmpvbi5wZXRlcnNvbkB0ZWFtLm5ldXN0 YXI+Pg0KU3ViamVjdDogUG90ZW50aWFsIHNlY3VyaXR5IHZ1bG5lcmFiaWxpdHkgaW4gU1RJUi9E SVYNClJlc2VudC1Gcm9tOiA8YWxpYXMtYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86YWxpYXMtYm91 bmNlc0BpZXRmLm9yZz4+DQpSZXNlbnQtVG86IDxqb24ucGV0ZXJzb25AdGVhbS5uZXVzdGFyPG1h aWx0bzpqb24ucGV0ZXJzb25AdGVhbS5uZXVzdGFyPj4NClJlc2VudC1EYXRlOiBXZWRuZXNkYXks IEp1bHkgMjIsIDIwMjAgYXQgOTo0NyBBTQ0KDQpIZWxsbywNCg0KSSBiZWxpZXZlIEkndmUgY29t ZSBhY3Jvc3MgYSBzZWN1cml0eSB2dWxuZXJhYmlsaXR5IGluIHRoZSBTVElSIHN5c3RlbSB0aGF0 IGlzIG1hZGUgZXhwbG9pdGFibGUgYnkgdGhlIGludHJvZHVjdGlvbiBvZiBESVYgcGFzc3BvcnRz LCB0aGF0IEkgaGF2ZW4ndCBzZWVuIGRpc2N1c3NlZCBoZXJlIGluIGFueSBkZXRhaWwgKHNvcnJ5 IGlmIGl0IGhhcyBiZWVuKS4gVGhlcmUgYXJlIGN1cnJlbnRseSBtaXRpZ2F0aW9ucyBmb3IgaXQg aW4gdGhlIHBhc3Nwb3J0IHNwZWMsIGhvd2V2ZXIgSSBkb24ndCBiZWxpZXZlIHRoZXkgZ28gZmFy IGVub3VnaCB0byBwcmV2ZW50IHRoaXMgYXR0YWNrLg0KDQpUaGUgaGlnaCBsZXZlbCBzdW1tYXJ5 IGlzIHRoYXQgYW4gYXR0YWNrZXIgY2FuIGltcGVyc29uYXRlIGFuIGVudGl0eSB0aGF0IGNhbGxl ZCB0aGVtIGJ5IHByZXRlbmRpbmcgdGhleSByZWRpcmVjdGVkIHRoYXQgY2FsbCB0byB0aGUgcmVj aXBpZW50Lg0KDQpBbiBleGFtcGxlOg0KDQpUcnVzdGVkOiBBIHBhcnR5IHRydXN0ZWQgYnkgU3Vi amVjdCwgd2hpY2ggQXR0YWNrZXIgd2lzaGVzIHRvIGltcGVyc29uYXRlDQpBdHRhY2tlcjogVGhl IHBhcnR5IHdpc2hpbmcgdG8gaW1wZXJzb25hdGUgVHJ1c3RlZA0KU3ViamVjdDogVGhlIGludGVu ZGVkIHRhcmdldCBvZiBBdHRhY2tlciwgd2hvIHdpbGwgc2VlIGEgdmVyaWZpZWQgY2FsbCBjb21p bmcgZnJvbSBUcnVzdGVkDQoNCg0KMS4gICAgICAgQXR0YWNrZXIgZ2V0cyBUcnVzdGVkIHRvIGNh bGwgdGhlbS4NCg0KVGhpcyBpcyBhIHJlYXNvbmFibGUgb3BlcmF0aW9uLCBhbmQgaXMgYWN0dWFs bHkgcXVpdGUgYSBjb21tb24gZmVhdHVyZSBvZiBzdXBwb3J0IGNvbXBhbmllcyBzbyB5b3UgZG9u J3QgaGF2ZSB0byBzaXQgb24gaG9sZC4NCg0KMi4gICAgICAgQXR0YWNrZXIgYW5zd2Vycy9yZWpl Y3RzIHRoZSBjYWxsIGFuZCBzYXZlcyBvZmYgdGhlIFNIQUtFTiBwYXNzcG9ydCBmb3IgVHJ1c3Rl ZCAtPiBBdHRhY2tlci4NCg0KMy4gICAgICAgQXR0YWNrZXIgc2V0cyB1cCBhIHJlZGlyZWN0IGZy b20gdGhlbSB0byB0aGVpciBpbnRlbmRlZCBTdWJqZWN0Lg0KDQo0LiAgICAgICBBdHRhY2tlciBj b25zdHJ1Y3RzIGEgY2FsbCAoY2xhaW1pbmcgdG8gYmUpIGZyb20gVHJ1c3RlZCB0byBBdHRhY2tl ciB3aXRoIHRoZSBwcmV2aW91c2x5IHNhdmVkIFNIQUtFTiBwYXNzcG9ydC4NCg0KNS4gICAgICAg VGhlIGNhbGwgd2lsbCBiZSB2ZXJpZmllZCwgdGhlbiByZWRpcmVjdGVkIHRvIFN1YmplY3Qgd2l0 aCBhIERJViBwYXNzcG9ydCBmb3IgQXR0YWNrZXIgLT4gU3ViamVjdC4NCg0KVGhpcyBkb2VzIHJl bHkgb24gdGhlIGNlcnRpZmljYXRlIHNpZ25pbmcgdGhlIERJViB0byBiZWxvbmcgdG8gYSB0cnVz dGVkIGVudGl0eSwgdGhpcyBzZWVtcyBwb3NzaWJsZSwgYXMgdGhlIHJlZGlyZWN0IGNvdWxkIGJl IGNhcnJpZWQgb3V0IGJ5IEF0dGFja2VyJ3Mgc2VydmljZSBwcm92aWRlci4NCkF0dGFja2VyJ3Mg U1AgbWF5IHJlZnVzZSB0byByZWRpcmVjdCBhZnRlciBzb21lIHRpbWUgZHVlIHRvIElhVCB0aW1l b3V0cywgYnV0IHRoaXMgaXMgbm90IHJlcXVpcmVkIGJ5IHRoZSBzcGVjIGFuZCBJIGJlbGlldmUg dGhpcyBjYW4gYmUgd29ya2VkIGFyb3VuZCBieSwgZm9yIGV4YW1wbGUsIHJlcGVhdGVkbHkgYm91 bmNpbmcgbmV3IGNhbGxzIG9mZiBhbiBhY2NvbXBsaWNlLg0KDQo2LiAgICAgICBTdWJqZWN0IHJl Y2VpdmVzIGEgY2FsbCBjbGFpbWluZyB0byBiZSBmcm9tIFRydXN0ZWQgKGFsYmVpdCByZWRpcmVj dGVkIGZyb20gQXR0YWNrZXIpIHdpdGggYSB2YWxpZCBwYXNzcG9ydCBjaGFpbiBvZiBUcnVzdGVk IC0+IEF0dGFja2VyIC0+IFN1YmplY3QuDQoNCkJvdGggcGFzc3BvcnRzIHdpbGwgYmUgc2lnbmVk IGJ5IHRydXN0ZWQgZW50aXRpZXM6IFRydXN0ZWQncyBTUCBhbmQgQXR0YWNrZXIncyBTUC4NCklh VCBkb2Vzbid0IHByb3ZpZGUgbXVjaCBwcm90ZWN0aW9uIGhlcmUgYXMsIGluIHRoZSBwcmVzZW5j ZSBvZiBESVYgcGFzc3BvcnRzLCB0aGUgdmFsaWQgdGltZSByYW5nZSBtdXN0IGJlIHNldCByZWFz b25hYmx5IGhpZ2ggdG8gYWxsb3cgZm9yIHRoZSBwb3NzaWJpbGl0eSBvZiByaW5nLWFyb3VuZHMu DQpUaGUgb3JpZ2lkIGFuZCBhdHRlc3Qgd2lsbCBiZSBhc3NvY2lhdGVkIHdpdGggVHJ1c3RlZCwg ZXJvZGluZyBhbnkgYXV0b21hdGVkIGRhdGFiYXNlcyBvZiByb2JvY2FsbHMgYmFzZWQgb24gdGhl IG9yaWdpZC4NCg0KDQoNClRoZSAibWt5IiBjbGFpbSBzZWVtcyB0byBiZSB0aGUgc29sdXRpb24g dGhhdCBpcyBjdXJyZW50bHkgYnVpbHQgaW50byBwYXNzcG9ydHMsIGhvd2V2ZXIsIGl0IGlzIGN1 cnJlbnRseSBvcHRpb25hbCwgYW5kIGFzIGZhciBhcyBJIGFtIGF3YXJlIHVzaW5nIGNlcnRpZmlj YXRlcyB0byBhdXRoZW50aWNhdGUgdGhlIGVuZHMgb2YgYSBtZWRpYSBzdHJlYW0gaXMgdmVyeSBy YXJlIGluIHByYWN0aWNlLg0KDQpVbmZvcnR1bmF0ZWx5LCBJJ20gbm90IGFibGUgdG8gY29tZSB1 cCB3aXRoIGEgc29sdXRpb24gYW5kIEkgYW0gaG9waW5nIHRoYXQgaXMgd2hlcmUgeW91IHdpbGwg YmUgYWJsZSB0byBzdGVwIGluLiBJIGJlbGlldmUgdG8gYXZvaWQgdGhpcywgdGhlcmUgbmVlZHMg dG8gYmUgbW9yZSB2YWxpZGF0aW9uIG9mIHRoZSBtZWRpYSBzdHJlYW0gdGhhdCBpcyBjcmVhdGVk LCBlaXRoZXIgaW4gdGhlIGZvcm0gb2YgbW9yZSBkYXRhIGJlaW5nIHNpZ25lZCBvciBlbmZvcmNp bmcgdGhhdCB0aGUgbWVkaWEgcGFydGljaXBhbnRzIGFyZSBhdXRoZW50aWNhdGVkLg0KDQpUaGFu ayB5b3UsDQpKYWNrIFJpY2thcmQgfCBTb2Z0d2FyZSBFbmdpbmVlciB8IE1ldGFzd2l0Y2gNClRo ZSBGYXN0ZXIgV2F5IEZvcndhcmQNCk9mZmljZSArNDQgMjAgODE5NiA5ODAxDQpNZXRhc3dpdGNo IGlzIGEgTWljcm9zb2Z0IGNvbXBhbnkNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18NCnN0aXIgbWFpbGluZyBsaXN0DQpzdGlyQGlldGYub3JnPG1haWx0 bzpzdGlyQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9z dGlyPGh0dHBzOi8vbmFtMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1o dHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRnN0aXImZGF0 YT0wMiU3QzAxJTdDamFjay5yaWNrYXJkJTQwbWV0YXN3aXRjaC5jb20lN0NkNTMxYjkyMDE2MzA0 MDdkMmQwNDA4ZDgyZjFlMDU3MCU3QzlkOWU1NmViZjYxMzRkZGJiMjdiYmZjZGYxNGIyY2RiJTdD MSU3QzAlN0M2MzczMTExNTMyOTEzNDA3MDkmc2RhdGE9M2dERWVvN2hFTG8lMkZFJTJGVzBqTHJZ SEVzQjdtQll5TXV2dVZPWmNLSSUyQjh5TSUzRCZyZXNlcnZlZD0wPg0K --_000_BYAPR02MB5189902FBF70C0ECC7A19228F3760BYAPR02MB5189namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiU2Vnb2UgVUkiOw0KCXBhbm9zZS0xOjIg MTEgNSAyIDQgMiA0IDIgMiAzO30NCi8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1h bCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowY207DQoJbWFyZ2luLWJv dHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJp b3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAu Z21haWwtbS03NzkyODc1MDEyODk0ODQzNTQ1bXNvbGlzdHBhcmFncmFwaCwgbGkuZ21haWwtbS03 NzkyODc1MDEyODk0ODQzNTQ1bXNvbGlzdHBhcmFncmFwaCwgZGl2LmdtYWlsLW0tNzc5Mjg3NTAx Mjg5NDg0MzU0NW1zb2xpc3RwYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLW5hbWU6Z21haWwtbV8tNzc5 Mjg3NTAxMjg5NDg0MzU0NW1zb2xpc3RwYXJhZ3JhcGg7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87DQoJbWFyZ2luLXJpZ2h0OjBjbTsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCglt YXJnaW4tbGVmdDowY207DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJy aSIsc2Fucy1zZXJpZjt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQt b25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYx Mi4wcHQgNzkyLjBwdDsNCgltYXJnaW46NzIuMHB0IDcyLjBwdCA3Mi4wcHQgNzIuMHB0O30NCmRp di5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9u cyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6MzQ3NzYwODU1Ow0KCW1zby1saXN0LXRlbXBs YXRlLWlkczotMTQzMTgwMDE0Mjt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6MzYuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3lt Ym9sO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDo3Mi4wcHQ7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNv LWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6 bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEwOC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXpl OjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOjE0NC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250 LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjE4 MC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0x OC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7 fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIxNi4wcHQ7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFu c2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2 ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv grc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjI1Mi4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOjI4OC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZh bWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMyNC4w cHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4w cHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0K QGxpc3QgbDENCgl7bXNvLWxpc3QtaWQ6NDkwOTQ5NTg4Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlk czotMTQwODIxMzQ5Mjt9DQpAbGlzdCBsMTpsZXZlbDENCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MzYu MHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTgu MHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30N CkBsaXN0IGwxOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDo3Mi4wcHQ7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2kt Zm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWwz DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEwOC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBw dDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw0DQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOjE0NC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWls eTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjE4MC4wcHQ7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7 DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxp c3QgbDE6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2 ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIxNi4wcHQ7DQoJbXNvLWxldmVsLW51 bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9u dC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw3DQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJ bXNvLWxldmVsLXRhYi1zdG9wOjI1Mi4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsN Cglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1z dG9wOjI4OC4wcHQ7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0xOC4wcHQ7DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpT eW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMyNC4wcHQ7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJ bXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0Kb2wNCgl7 bWFyZ2luLWJvdHRvbTowY207fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowY207fQ0KLS0+PC9zdHls ZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQi IHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+ PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0 IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFk Pg0KPGJvZHkgbGFuZz0iRU4tR0IiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBj bGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJt c28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+SSB0aGluayB0aGF0IHdvdWxkIHdvcmssIGhvd2V2 ZXIgaXQgd291bGQgYmUgdmVyeSBoYXJkIHRvIGltcGxlbWVudCBpbiBhIHdheSB0byBiZSBpbmZh bGxpYmxlLiBNb3N0IFNQcyB3aWxsIGhhdmUgbXVsdGlwbGUgc2VydmVycyBoYW5kbGluZyB2ZXJp ZmljYXRpb24gYW5kIHdoaWxlIHJhcGlkbHkgc3luY2hyb25pc2luZyBhIGxpc3Qgb2YNCiBhbGwg cmVjZW50bHkgc2VlbiBJZGVudGl0eSBoZWFkZXJzIGlzIHBvc3NpYmxlLCBpdCBhZGRzIGEgbG90 IG9mIGNvbXBsZXhpdHkuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZh cmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPkphY2s8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBj bSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJFTi1VUyI+RnJvbTo8L3Nw YW4+PC9iPjxzcGFuIGxhbmc9IkVOLVVTIj4gc3RpciAmbHQ7c3Rpci1ib3VuY2VzQGlldGYub3Jn Jmd0Ow0KPGI+T24gQmVoYWxmIE9mIDwvYj5EYXZpZCBIYW5jb2NrPGJyPg0KPGI+U2VudDo8L2I+ IDIzIEp1bHkgMjAyMCAxNjozNTxicj4NCjxiPlRvOjwvYj4gSmFjayBSaWNrYXJkICZsdDtKYWNr LlJpY2thcmQ9NDBtZXRhc3dpdGNoLmNvbUBkbWFyYy5pZXRmLm9yZyZndDs8YnI+DQo8Yj5DYzo8 L2I+IFBldGVyc29uLCBKb24gJmx0O2pvbi5wZXRlcnNvbkB0ZWFtLm5ldXN0YXImZ3Q7OyBkcmFm dC1pZXRmLXN0aXItcGFzc3BvcnQtZGl2ZXJ0QGlldGYub3JnOyBzdGlyQGlldGYub3JnPGJyPg0K PGI+U3ViamVjdDo8L2I+IFJlOiBbc3Rpcl0gUG90ZW50aWFsIHNlY3VyaXR5IHZ1bG5lcmFiaWxp dHkgaW4gU1RJUi9ESVY8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8dGFibGUgY2xhc3M9Ik1z b05vcm1hbFRhYmxlIiBib3JkZXI9IjAiIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0iMCIg YWxpZ249ImxlZnQiIHdpZHRoPSIxMDAlIiBzdHlsZT0id2lkdGg6MTAwLjAlO2JvcmRlci1jb2xs YXBzZTpjb2xsYXBzZSI+DQo8dGJvZHk+DQo8dHI+DQo8dGQgc3R5bGU9ImJhY2tncm91bmQ6Izkx MEExOTtwYWRkaW5nOjMuMHB0IDEuNXB0IDMuMHB0IDEuNXB0Ij48L3RkPg0KPHRkIHdpZHRoPSIx MDAlIiBzdHlsZT0id2lkdGg6MTAwLjAlO2JhY2tncm91bmQ6I0ZERjJGNDtwYWRkaW5nOjMuMHB0 IDMuNzVwdCAzLjBwdCAxMS4yNXB0O3dvcmQtd3JhcDpicmVhay13b3JkIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tZWxlbWVudDpmcmFtZTttc28tZWxlbWVudC1mcmFtZS1oc3Bh Y2U6Mi4yNXB0O21zby1lbGVtZW50LXdyYXA6YXJvdW5kO21zby1lbGVtZW50LWFuY2hvci12ZXJ0 aWNhbDpwYXJhZ3JhcGg7bXNvLWVsZW1lbnQtYW5jaG9yLWhvcml6b250YWw6Y29sdW1uO21zby1o ZWlnaHQtcnVsZTpleGFjdGx5Ij4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7U2Vnb2UgVUkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMjEyMTIxIj5OT1RF OiBNZXNzYWdlIGlzIGZyb20gYW4gZXh0ZXJuYWwgc2VuZGVyPG86cD48L286cD48L3NwYW4+PC9w Pg0KPC90ZD4NCjwvdHI+DQo8L3Rib2R5Pg0KPC90YWJsZT4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Q291bGQgdGhl IHZlcmlmaWNhdGlvbiBzZXJ2aWNlIGluIHN0ZXAtNSBkZXRlY3QvYmxvY2sgdGhlIGF0dGFjayB1 c2luZyB0aGlzIHByb2NlZHVyZSBkZXNjcmliZWQgaW4gU2VjdGlvbiAxMi4xIG9mIFJGQyA4MjI0 Pw0KPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOyAmcXVvdDsuLi4gc2VydmVycyBjYW4ga2VlcDxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwO3N0YXRlIG9m IHJlY2VudGx5IHJlY2VpdmVkIHJlcXVlc3RzLCBhbmQgdGh1cyBpZiBhbiBJZGVudGl0eSBoZWFk ZXI8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZu YnNwOyAmbmJzcDtmaWVsZCBpcyByZXBsYXllZCBieSBhbiBhdHRhY2tlciB3aXRoaW4gdGhlIERh dGUgaW50ZXJ2YWwsIHZlcmlmaWVyczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7ICZuYnNwO2NhbiBkZXRlY3QgdGhhdCBpdCBpcyBzcG9v ZmVkIGJlY2F1c2UgYSBtZXNzYWdlIHdpdGggYW4gaWRlbnRpY2FsPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgJm5ic3A7RGF0ZSBmcm9t IHRoZSBzYW1lIHNvdXJjZSBoYWQgcmVjZW50bHkgYmVlbiByZWNlaXZlZC4mcXVvdDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RGF2aWQgSGFu Y29jazxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5Db21jYXN0PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gVGh1LCBKdWwgMjMsIDIwMjAgYXQgNzoyMiBBTSBKYWNr IFJpY2thcmQgJmx0O0phY2suUmlja2FyZD08YSBocmVmPSJtYWlsdG86NDBtZXRhc3dpdGNoLmNv bUBkbWFyYy4uaWV0Zi5vcmciPjQwbWV0YXN3aXRjaC5jb21AZG1hcmMuaWV0Zi5vcmc8L2E+Jmd0 OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBj bSA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDow Y207bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttYXJnaW4tYm90dG9tOjEyLjBwdCI+ SSBhZ3JlZSB0aGF0IGRpdiBkb2VzIG1ha2UgdGhpcyBraW5kIG9mIGF0dGFjayBtb3JlIGRpZmZp Y3VsdCwgYW5kIHJlcXVpcmluZyB0aGF0IHRoZXJlIGlzIHNvbWUgdHJ1c3Qgb2YgZXZlcnkgcmV0 YXJnZXRpbmcgZW50aXR5IGRvZXMgbWFrZSBzZW5zZS4gTXkgYXNzdW1wdGlvbiB3YXMgdGhhdCBi eSBvbmx5IHRydXN0aW5nDQogdGhlIHNpZ25lcnMgb2YgdGhlIHBhc3Nwb3J0cyBJIGNhbiB0cnVz dCB0aGUgb3JpZyBpcyB0aGUgZW50aXR5IGNhbGxpbmcgbWUsIEkgbm93IHNlZSB5b3UgaGF2ZSB0 byB0cnVzdCB0aGUgc2lnbmVycyBhbmQgdGhlIGRpdmVydGluZyBwYXJ0aWVzLiBUbyBjbGFyaWZ5 IHRoaXMgSSBwcm9wb3NlIHRoYXQgc29tZXRoaW5nIGxpa2UgeW91ciBleHBsYW5hdGlvbiBpcyBh ZGRlZCB0byB0aGUgc3BlYywgaS5lLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj5JdCBpcyBDYXJvbCB3aG8gbmVlZHMgdG8gZGVjaWRlIGlmIGEgZm9yd2FyZGVkIGNhbGwg ZnJvbSBCb2Igc2hvdWxkIGJlIHRydXN0ZWQgb3Igbm90IOKAkyDigJxkaXbigJ0gaXMgY2VydGFp bmx5IG5vdCBzdWdnZXN0aW5nIHRoYXQgdHJ1c3QgaXMgYXV0b21hdGljLCBub3IgdGhhdCB0aGUg cHJlc2VuY2Ugb2YgYSDigJxkaXbigJ0NCiB0aGF0IGNvcnJlY3RseSBjaGFpbnMgdG8gdGhlIG9y aWdpbmFsIFBBU1Nwb3JUIGlzIGEgc3Vic3RpdHV0ZSBmb3IgdGhlIHBvbGljeSBhbmQgdHJ1c3Qg ZGVjaXNpb24gbWFkZSBvbiB0aGUgdGVybWluYXRpbmcgc2lkZSBvZiBhIGNhbGwuIEFzIHdpdGgg YmFzZWxpbmUgU1RJUiwganVzdCBiZWNhdXNlIHNvbWV0aGluZyB2YWxpZGF0ZXMgYXQgYSBwcm90 b2NvbCBsZXZlbCBkb2VzbuKAmXQgbWVhbiB5b3Ugc2hvdWxkIHRydXN0IGl0LCBub3IgdGhhdA0K IGxvY2FsIHBvbGljeSBkb2VzIG5vdCBkZXRlcm1pbmUgaG93IHlvdSB0cmVhdCBjYWxscy48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj5UbyBiZSBjbGVhciwgbXkgb3JpZ2luYWwgZW1haWwgd2FzIGJhc2VkIG9u IHRoZSBiZWxpZWYgdGhhdCBkaXYgcGFzc3BvcnRzIHdvdWxkIHByb3ZpZGUgYSAmcXVvdDtjaGFp bi1vZi10cnVzdCZxdW90OywgYWxsb3dpbmcgeW91IHRvIGVzc2VudGlhbGx5IGlnbm9yZSB0aGF0 IGRpdmVyc2lvbnMgaGFkIG9jY3VycmVkIG9uY2UNCiB5b3UgaGFkIGVzdGFibGlzaGVkIHRoZXJl IHdhcyBhIHZhbGlkIGNoYWluIG9mIGRpdiBwYXNzcG9ydHMgZnJvbSB0aGUgb3JpZ2luYXRvciB0 byB0aGUgZmluYWwgZGVzdGluYXRpb24uIEFsdGhvdWdoLCBhZnRlciByZWFkaW5nIHlvdXIgcmVz cG9uc2UgSSByZWFsaXNlIHRoYXQncyBub3QgdGhlIGNhc2UuPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj5NeSB3b3JyeSBpcyB0aGF0IHRoaXMgbW9kZWwgbWFrZXMgZGl2IGRpZmZpY3VsdCB0 byB1c2UgYW5kIHBvbGljZSBpbiBwcmFjdGljZSwgc3BlY2lmaWNhbGx5OjxvOnA+PC9vOnA+PC9w Pg0KPHVsIHR5cGU9ImRpc2MiPg0KPGxpIGNsYXNzPSJnbWFpbC1tLTc3OTI4NzUwMTI4OTQ4NDM1 NDVtc29saXN0cGFyYWdyYXBoIiBzdHlsZT0ibXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPg0KVGhp cyBtb2RlbCBtYWtlcyBpbXBsZW1lbnRhdGlvbnMgbW9yZSBjb21wbGljYXRlZCBhcyB5b3UgY2Fu J3Qgc2VwYXJhdGUgdmVyaWZpY2F0aW9uIGZyb20gcG9saWN5IGRlY2lzaW9ucy4gWW91IGhhdmUg dG8gZmlsdGVyIG91dCB1bnRydXN0ZWQgcGFydGllcyBiZWZvcmUgZG9pbmcgdGhlIGNoYWluIGZp bmRpbmcgc3RlcCBvZiB2ZXJpZmljYXRpb24sIGFzIG90aGVyd2lzZSB5b3UgbWlnaHQgZGVjaWRl IHVwb24gYSBjaGFpbiBjb250YWluaW5nIGFuDQogdW50cnVzdGVkIHBhcnR5IHdoZW4gdGhlcmUg ZG9lcyBleGlzdCBhIHZhbGlkIGNoYWluIGNvbnRhaW5pbmcgb25seSB0cnVzdGVkIHBhcnRpZXMg KGdyYW50ZWQgdGhpcyBzaXR1YXRpb24gaXMgdW5saWtlbHkpLjxvOnA+PC9vOnA+PC9saT48bGkg Y2xhc3M9ImdtYWlsLW0tNzc5Mjg3NTAxMjg5NDg0MzU0NW1zb2xpc3RwYXJhZ3JhcGgiIHN0eWxl PSJtc28tbGlzdDpsMSBsZXZlbDEgbGZvMyI+DQpUaGlzIG1vZGVsIGludHJvZHVjZXMgY29tcGxl eGl0eSBpbiB3aGF0IHNob3VsZCBiZSBkaXNwbGF5ZWQgdG8gYSB1c2VyLCB0aGUgc2ltcGxlIHZl cmlmaWVkL25vdCB2ZXJpZmllZCBjYW4ndCBiZSB1c2VkIHVubGVzcyB5b3UgcmVxdWlyZSBjb21w bGV0ZSB0cnVzdCBvZiBhbGwgZGl2ZXJ0aW5nIHBhcnRpZXMsIGFuZCB0aGF0IGNvdWxkIGNhdXNl IGZhbHNlIG5lZ2F0aXZlcy48bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJnbWFpbC1tLTc3OTI4 NzUwMTI4OTQ4NDM1NDVtc29saXN0cGFyYWdyYXBoIiBzdHlsZT0ibXNvLWxpc3Q6bDEgbGV2ZWwx IGxmbzMiPg0KSWYgYSBkaXZlcnRlZCBjYWxsIGRvZXMgZ2V0IHJlcG9ydGVkIGFzIGEgcm9ib2Nh bGwsIGl0J3Mgbm90IGNsZWFyIHdob3NlIHJlcHV0YXRpb24gc2hvdWxkIGJlIHRhcm5pc2hlZC4g SXQgbWF5IGhhdmUgYmVlbiB0aGF0IHRoZSBvcmlnaW5hbCBjYWxsZXIgd2FzIGEgcm9ib2NhbGxl ciBhbmQgdGhlIGNhbGwgZ290IGxlZ2l0aW1hdGVseSBkaXZlcnRlZCB0byB5b3UsIG9yIGl0IHdh cyB0aGUgYmVsb3cgYXR0YWNrIHdoZXJlIHRoZSBjYWxsZXIgaXMNCiB0cnVzdHdvcnRoeSBidXQg dGhlIGRpdmVydGVyIHdhcyB0aGUgcm9ib2NhbGxlci48bzpwPjwvbzpwPjwvbGk+PC91bD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPlRoYW5rcyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ SmFjazxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlk ICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPjxiPjxzcGFuIGxhbmc9IkVOLVVTIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gbGFu Zz0iRU4tVVMiPiBQZXRlcnNvbiwgSm9uICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmpvbi5w ZXRlcnNvbkB0ZWFtLm5ldXN0YXIiPjxzcGFuIGxhbmc9IkVOLVVTIj5qb24ucGV0ZXJzb25AdGVh bS5uZXVzdGFyPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0Ow0KPGJyPg0KPGI+U2Vu dDo8L2I+IDIyIEp1bHkgMjAyMCAyMzo1Mzxicj4NCjxiPlRvOjwvYj4gSmFjayBSaWNrYXJkICZs dDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOkphY2suUmlja2FyZEBtZXRhc3dpdGNoLmNvbSIgdGFy Z2V0PSJfYmxhbmsiPjxzcGFuIGxhbmc9IkVOLVVTIj5KYWNrLlJpY2thcmRAbWV0YXN3aXRjaC5j b208L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7Ow0KPC9zcGFuPjxhIGhyZWY9Im1h aWx0bzpzdGlyQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gbGFuZz0iRU4tVVMiPnN0 aXJAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLVVTIj47DQo8L3NwYW4+PGEgaHJl Zj0ibWFpbHRvOmRyYWZ0LWlldGYtc3Rpci1wYXNzcG9ydC1kaXZlcnRAaWV0Zi5vcmciIHRhcmdl dD0iX2JsYW5rIj48c3BhbiBsYW5nPSJFTi1VUyI+ZHJhZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LWRp dmVydEBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tVVMiPjxicj4NCjxiPlN1Ympl Y3Q6PC9iPiBSZTogUG90ZW50aWFsIHNlY3VyaXR5IHZ1bG5lcmFiaWxpdHkgaW4gU1RJUi9ESVY8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjx0YWJsZSBjbGFzcz0iTXNvTm9ybWFsVGFibGUi IGJvcmRlcj0iMCIgY2VsbHNwYWNpbmc9IjAiIGNlbGxwYWRkaW5nPSIwIiBhbGlnbj0ibGVmdCIg d2lkdGg9IjEwMCUiIHN0eWxlPSJ3aWR0aDoxMDAuMCU7Ym9yZGVyLWNvbGxhcHNlOmNvbGxhcHNl Ij4NCjx0Ym9keT4NCjx0cj4NCjx0ZCBzdHlsZT0iYmFja2dyb3VuZDojOTEwQTE5O3BhZGRpbmc6 My4wcHQgMS41cHQgMy4wcHQgMS41cHQ7YmFja2dyb3VuZC1wb3NpdGlvbjppbml0aWFsIGluaXRp YWw7YmFja2dyb3VuZC1yZXBlYXQ6aW5pdGlhbCBpbml0aWFsIj4NCjwvdGQ+DQo8dGQgd2lkdGg9 IjEwMCUiIHN0eWxlPSJ3aWR0aDoxMDAuMCU7YmFja2dyb3VuZDojRkRGMkY0O3BhZGRpbmc6My4w cHQgMy43NXB0IDMuMHB0IDExLjI1cHQ7d29yZC13cmFwOmJyZWFrLXdvcmQ7YmFja2dyb3VuZC1w b3NpdGlvbjppbml0aWFsIGluaXRpYWw7YmFja2dyb3VuZC1yZXBlYXQ6aW5pdGlhbCBpbml0aWFs Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tZWxlbWVudDpmcmFtZTttc28tZWxlbWVudC1m cmFtZS1oc3BhY2U6Mi4yNXB0O21zby1lbGVtZW50LXdyYXA6YXJvdW5kO21zby1lbGVtZW50LWFu Y2hvci12ZXJ0aWNhbDpwYXJhZ3JhcGg7bXNvLWVsZW1lbnQtYW5jaG9yLWhvcml6b250YWw6Y29s dW1uO21zby1oZWlnaHQtcnVsZTpleGFjdGx5Ij4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7U2Vnb2UgVUkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMjEy MTIxIj5OT1RFOiBNZXNzYWdlIGlzIGZyb20gYW4gZXh0ZXJuYWwgc2VuZGVyPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC90ZD4NCjwvdHI+DQo8L3Rib2R5Pg0KPC90YWJsZT4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6YmxhY2si PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNw YW4gbGFuZz0iRU4tVVMiPlBvdGVudGlhbCDigJxiYWl0aW5n4oCdIGF0dGFja3Mgb2YgdGhpcyBm b3JtIGVtZXJnZSB3aGVuIHlvdSBjb21iaW5lIGJhc2VsaW5lIFNUSVIgd2l0aCBjYWxsIGZvcndh cmRpbmcsIGFuZCBhcmUgdGhlIG1haW4gdGhyZWF0IGFydGljdWxhdGVkIGluIHRoZSBJRVRGIOKA nGRpduKAnSBkcmFmdC4NCiBUaGUgaW50cm9kdWN0aW9uIGRlc2NyaWJlcyB0aGVtIGFzIGZvbGxv d3M6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBs YW5nPSJFTi1VUyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyBJ ZiBBbGljZSBjYWxscyBCb2IsIGZvciBleGFtcGxlLCBCb2IgbWlnaHQ8L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0i Zm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xv cjpibGFjayI+Jm5ic3A7Jm5ic3A7IGF0dGVtcHQgdG8gY3V0LWFuZC1wYXN0ZSB0aGUgSWRlbnRp dHkgaGVhZGVyIGZpZWxkIGluIEFsaWNlJ3MgSU5WSVRFPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6 ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2si PiZuYnNwOyZuYnNwOyBpbnRvIGEgbmV3IElOVklURSB0aGF0IEJvYiBzZW5kcyB0byBDYXJvbCwg YW5kIHRodXMgYmUgYWJsZSB0byBmb29sPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPiZuYnNwOyZu YnNwOyBDYXJvbCBpbnRvIHRoaW5raW5nIHRoZSBjYWxsIGNhbWUgZnJvbSBBbGljZSBhbmQgbm90 IEJvYi4gV2l0aCB0aGU8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWls eTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7IHNpZ25h dHVyZSBvdmVyIHRoZSBUbyBoZWFkZXIgZmllbGQgdmFsdWUsIHRoZSBJTlZJVEUgQ2Fyb2wgc2Vl cyB3aWxsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3Bh biBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDs7Y29sb3I6YmxhY2siPiZuYnNwOyZuYnNwOyBjbGVhcmx5IGhhdmUg YmVlbiBkZXN0aW5lZCBvcmlnaW5hbGx5IGZvciBCb2IsIGFuZCB0aHVzIENhcm9sIGNhbjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4t VVMiIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7O2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsgdmlldyB0aGUgSU5WSVRFIGFzIHN1c3Bl Y3QuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBs YW5nPSJFTi1VUyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj48c3BhbiBsYW5nPSJFTi1VUyI+VGhhdCBkZXNjcmliZXMgdGhlIHNpdHVhdGlvbiBp biBhIHdvcmxkIHdpdGhvdXQg4oCcZGl24oCdLCBzbyB0aGUgcXVlc3Rpb24gaXMsIGRvZXMg4oCc ZGl24oCdIG1ha2UgdGhlc2Ugc29ydHMgb2YgYXR0YWNrcyBlYXNpZXIgdG8gaGFyZGVyIHRvIG1v dW50Pzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4g bGFuZz0iRU4tVVMiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tVVMiPldpdGhvdXQg4oCcZGl24oCdLCBpbiB0aGUgZXhh bXBsZSBhYm92ZSwgQ2Fyb2wgd2lsbCBzZWUgdGhhdCB0aGUgb3JpZ2luYWwgY2FsbGVkIG51bWJl ciBkb2VzIG5vdCBtYXRjaCBoZXJzLCBhbmQgY2FuIGRlY2lkZSBvbiB0aG9zZSBncm91bmRzIHRv IHJlamVjdCB0aGUgY2FsbC4gQnV0DQogYmVhciBpbiBtaW5kIHRoaXMgaXMgYWxzbyB3aGF0IENh cm9sIHdvdWxkIHNlZSBpbiBsZWdpdGltYXRlIGZvcndhcmRpbmcgY2FzZXMsIHNvIGEgbW9yZSBu dWFuY2VkIGxvZ2ljIHdvdWxkIHByb2JhYmx5IGJlIHVzZWQuIFNoZSBjb3VsZCBkZWNpZGUgdGhh dCBpZiB0aGUgb3JpZ2luYWwgY2FsbGVkIG51bWJlciBpcyBhIG51bWJlciB0aGF0IHNob3VsZCBi ZSBmb3J3YXJkaW5nIGNhbGxzIHRvIGhlciAoc2F5LCBpZiBpdCB3YXMgaGVyIG9mZmljZSksDQog dGhhdCBzaGUgc2hvdWxkIGFjY2VwdCB0aGUgY2FsbCBhbnl3YXkuIFlvdSBjb3VsZCBldmVuIGlt YWdpbmUgYXBwbGljYXRpb24gYmVoYXZpb3IgdGhhdCB3b3VsZCBlbmZvcmNlIHBvbGljaWVzIGFs b25nIHRob3NlIGxpbmVzIG9uIGhlciBiZWhhbGYuIEhvd2V2ZXIsIENhcm9sIGhhcyBubyBhc3N1 cmFuY2UgdGhhdCBpdCB3YXMgcmVhbGx5IGhlciBvZmZpY2UgdGhhdCBmb3J3YXJkZWQgdGhpcyBj YWxsLCByYXRoZXIgdGhhbiBzb21lIGVhdmVzZHJvcHBlcg0KIHdobyBzb21laG93IGNhcHR1cmVk IHRoZSBQQVNTcG9yVCwgbm9yIGhvdyBtYW55IHRpbWVzIGl0IG1pZ2h0IGhhdmUgYmVlbiByZWRp cmVjdGVkIGJlZm9yZSByZWFjaGluZyBoZXIsIG9yIGFueXRoaW5nIGFsb25nIHRob3NlIGxpbmVz Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gbGFu Zz0iRU4tVVMiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+PHNwYW4gbGFuZz0iRU4tVVMiPlRob3NlIGFyZSB0aGUgZ2FwcyB0aGF0IOKAnGRpduKA nSBpcyBtZWFudCB0byBmaWxsLiBJdCBpcyBub3QgYSBzdWJzdGl0dXRlIGZvciB0aGUgcmVzdCBv ZiB0aGUgbG9naWMgYW5kIHBvbGljeSBkZXNjcmliZWQgYWJvdmUsIGJ1dCBpdCBnaXZlcyBDYXJv bCBtb3JlIGluZm9ybWF0aW9uDQogdG8gaGVscCBmaWd1cmUgb3V0IGlmIHRoZSBjYWxsIGlzIHN1 c3BlY3QgYW5kIHdoYXQgdG8gZG8gYWJvdXQgaXQuIFdpdGgg4oCcZGl24oCdLCB3aGF0IENhcm9s IHNlZXMgaXMgYSBzZWNvbmQgUEFTU3BvclQgY3JlYXRlZCBhbmQgc2lnbmVkIGJ5IEJvYiwgd2hp Y2ggYWN0dWFsbHkgZ2l2ZXMgQ2Fyb2wgdGhlIGFzc3VyYW5jZSBvZiB3aGV0aGVyIHRoZSBpbnRl bmRlZCBjYWxsZWQgcGFydHkgaXMgb25lIHdobyByZXRhcmdldGVkIHRoZSBjYWxsLCB3aGljaA0K IHlvdSBkb27igJl0IGdldCBpbiB0aGUgYWJzZW5jZSBvZiDigJxkaXbigJ0uIElmIEJvYiBpcyBk b2luZyB0aGlzIG1hbGljaW91c2x5LCB0aGUg4oCcZGl24oCdIGhlIHByb3ZpZGVkIGhhcyBnaXZl biBDYXJvbCB0aGUgbWVhbnMgdG8gaHVudCBoaW0gZG93biBmb3IgcmVkcmVzcywgd2hpY2ggaXMg bm90IGV4YWN0bHkgYSBzdHJvbmcgaW5jZW50aXZlIGZvciBoaW0gdG8gdXNlIOKAnGRpduKAnS4g QnV0IGF0IHRoZSBlbmQgb2YgdGhlIGRheSwgaXQgaXMgQ2Fyb2wgd2hvDQogbmVlZHMgdG8gZGVj aWRlIGlmIGEgZm9yd2FyZGVkIGNhbGwgZnJvbSBCb2Igc2hvdWxkIGJlIHRydXN0ZWQgb3Igbm90 IOKAkyDigJxkaXbigJ0gaXMgY2VydGFpbmx5IG5vdCBzdWdnZXN0aW5nIHRoYXQgdHJ1c3QgaXMg YXV0b21hdGljLCBub3IgdGhhdCB0aGUgcHJlc2VuY2Ugb2YgYSDigJxkaXbigJ0gdGhhdCBjb3Jy ZWN0bHkgY2hhaW5zIHRvIHRoZSBvcmlnaW5hbCBQQVNTcG9yVCBpcyBhIHN1YnN0aXR1dGUgZm9y IHRoZSBwb2xpY3kgYW5kIHRydXN0IGRlY2lzaW9uDQogbWFkZSBvbiB0aGUgdGVybWluYXRpbmcg c2lkZSBvZiBhIGNhbGwuIEFzIHdpdGggYmFzZWxpbmUgU1RJUiwganVzdCBiZWNhdXNlIHNvbWV0 aGluZyB2YWxpZGF0ZXMgYXQgYSBwcm90b2NvbCBsZXZlbCBkb2VzbuKAmXQgbWVhbiB5b3Ugc2hv dWxkIHRydXN0IGl0LCBub3IgdGhhdCBsb2NhbCBwb2xpY3kgZG9lcyBub3QgZGV0ZXJtaW5lIGhv dyB5b3UgdHJlYXQgY2FsbHMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1VUyI+QnV0IGFsbCB0aGF0IHNh aWQsIGlmIHlvdeKAmXJlIHNlcmlvdXMgYWJvdXQgc2VjdXJpdHksIHRoZW4geWVzLCB1c2luZyBE VExTLVNSVFAgd2l0aCDigJxta2V54oCdIGlzIGdvaW5nIHRvIHByb3ZpZGUgeW91IHdpdGggYSBi ZXR0ZXIgYXNzdXJhbmNlLg0KPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJFTi1VUyI+Sm9uIFBldGVyc29uPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBsYW5nPSJF Ti1VUyI+TmV1c3RhciwgSW5jLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtw YWRkaW5nOjMuMHB0IDBjbSAwY20gMGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4t bGVmdDozNi4wcHQiPg0KPGI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTIu MHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+SmFjayBSaWNrYXJkICZsdDs8L3NwYW4+ PGEgaHJlZj0ibWFpbHRvOkphY2suUmlja2FyZEBtZXRhc3dpdGNoLmNvbSIgdGFyZ2V0PSJfYmxh bmsiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+SmFjay5SaWNr YXJkQG1ldGFzd2l0Y2guY29tPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZv bnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPiZndDs8YnI+DQo8Yj5EYXRlOiA8L2I+V2VkbmVz ZGF5LCBKdWx5IDIyLCAyMDIwIGF0IDk6NDcgQU08YnI+DQo8Yj5UbzogPC9iPiZxdW90Ozwvc3Bh bj48YSBocmVmPSJtYWlsdG86c3RpckBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIGxh bmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+c3RpckBpZXRmLm9yZzwvc3Bhbj48 L2E+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNr Ij4mcXVvdDsgJmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86c3RpckBpZXRmLm9yZyIgdGFyZ2V0 PSJfYmxhbmsiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+c3Rp ckBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0O2NvbG9yOmJsYWNrIj4mZ3Q7LA0KICZxdW90Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86 ZHJhZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LWRpdmVydEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsi PjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+ZHJhZnQtaWV0Zi1z dGlyLXBhc3Nwb3J0LWRpdmVydEBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tVVMi IHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj4mcXVvdDsgJmx0Ozwvc3Bhbj48 YSBocmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LWRpdmVydEBpZXRmLm9yZyIg dGFyZ2V0PSJfYmxhbmsiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dCI+ZHJhZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LWRpdmVydEBpZXRmLm9yZzwvc3Bhbj48L2E+PHNw YW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj4mZ3Q7 LA0KICZxdW90O1BldGVyc29uLCBKb24mcXVvdDsgJmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86 am9uLnBldGVyc29uQHRlYW0ubmV1c3RhciIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIGxhbmc9IkVO LVVTIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+am9uLi5wZXRlcnNvbkB0ZWFtLm5ldXN0YXI8 L3NwYW4+PC9hPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xv cjpibGFjayI+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5Qb3RlbnRpYWwgc2VjdXJpdHkgdnVs bmVyYWJpbGl0eSBpbiBTVElSL0RJVjxicj4NCjxiPlJlc2VudC1Gcm9tOiA8L2I+Jmx0Ozwvc3Bh bj48YSBocmVmPSJtYWlsdG86YWxpYXMtYm91bmNlc0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsi PjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+YWxpYXMtYm91bmNl c0BpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0O2NvbG9yOmJsYWNrIj4mZ3Q7PGJyPg0KPGI+UmVzZW50LVRvOiA8L2I+Jmx0Ozwvc3Bh bj48YSBocmVmPSJtYWlsdG86am9uLnBldGVyc29uQHRlYW0ubmV1c3RhciIgdGFyZ2V0PSJfYmxh bmsiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+am9uLnBldGVy c29uQHRlYW0ubmV1c3Rhcjwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250 LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj4mZ3Q7PGJyPg0KPGI+UmVzZW50LURhdGU6IDwvYj5X ZWRuZXNkYXksIEp1bHkgMjIsIDIwMjAgYXQgOTo0NyBBTTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDozNi4wcHQi Pg0KPHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8c3BhbiBsYW5n PSJFTi1VUyI+SGVsbG8sPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjM2LjBw dCI+DQo8c3BhbiBsYW5nPSJFTi1VUyI+SSBiZWxpZXZlIEkndmUgY29tZSBhY3Jvc3MgYSBzZWN1 cml0eSB2dWxuZXJhYmlsaXR5IGluIHRoZSBTVElSIHN5c3RlbSB0aGF0IGlzIG1hZGUgZXhwbG9p dGFibGUgYnkgdGhlIGludHJvZHVjdGlvbiBvZiBESVYgcGFzc3BvcnRzLCB0aGF0IEkgaGF2ZW4n dCBzZWVuIGRpc2N1c3NlZCBoZXJlIGluIGFueSBkZXRhaWwgKHNvcnJ5IGlmIGl0IGhhcyBiZWVu KS4gVGhlcmUgYXJlIGN1cnJlbnRseSBtaXRpZ2F0aW9ucw0KIGZvciBpdCBpbiB0aGUgcGFzc3Bv cnQgc3BlYywgaG93ZXZlciBJIGRvbid0IGJlbGlldmUgdGhleSBnbyBmYXIgZW5vdWdoIHRvIHBy ZXZlbnQgdGhpcyBhdHRhY2suPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjM2 LjBwdCI+DQo8c3BhbiBsYW5nPSJFTi1VUyI+VGhlIGhpZ2ggbGV2ZWwgc3VtbWFyeSBpcyB0aGF0 IGFuIGF0dGFja2VyIGNhbiBpbXBlcnNvbmF0ZSBhbiBlbnRpdHkgdGhhdCBjYWxsZWQgdGhlbSBi eSBwcmV0ZW5kaW5nIHRoZXkgcmVkaXJlY3RlZCB0aGF0IGNhbGwgdG8gdGhlIHJlY2lwaWVudC48 L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 MzYuMHB0Ij4NCjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxzcGFuIGxhbmc9 IkVOLVVTIj5BbiBleGFtcGxlOjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzttYXJnaW4tbGVmdDozNi4wcHQiPg0KPHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoz Ni4wcHQiPg0KPHNwYW4gbGFuZz0iRU4tVVMiPlRydXN0ZWQ6IEEgcGFydHkgdHJ1c3RlZCBieSBT dWJqZWN0LCB3aGljaCBBdHRhY2tlciB3aXNoZXMgdG8gaW1wZXJzb25hdGU8L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxz cGFuIGxhbmc9IkVOLVVTIj5BdHRhY2tlcjogVGhlIHBhcnR5IHdpc2hpbmcgdG8gaW1wZXJzb25h dGUgVHJ1c3RlZDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDozNi4wcHQiPg0KPHNwYW4gbGFuZz0iRU4tVVMiPlN1YmplY3Q6IFRoZSBpbnRl bmRlZCB0YXJnZXQgb2YgQXR0YWNrZXIsIHdobyB3aWxsIHNlZSBhIHZlcmlmaWVkIGNhbGwgY29t aW5nIGZyb20gVHJ1c3RlZDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttYXJnaW4tbGVmdDozNi4wcHQiPg0KPHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tLTc3OTI4NzUwMTI4OTQ4NDM1NDVt c29saXN0cGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6NzIuMHB0Ij4NCjxzcGFuIGxhbmc9 IkVOLVVTIj4xLjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZTo3LjBw dDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjxzcGFuIGxhbmc9IkVOLVVTIj5B dHRhY2tlciBnZXRzIFRydXN0ZWQgdG8gY2FsbCB0aGVtLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tLTc3OTI4NzUwMTI4OTQ4NDM1NDVtc29saXN0cGFyYWdyYXBoIiBz dHlsZT0ibWFyZ2luLWxlZnQ6NzIuMHB0Ij4NCjxzcGFuIGxhbmc9IkVOLVVTIj5UaGlzIGlzIGEg cmVhc29uYWJsZSBvcGVyYXRpb24sIGFuZCBpcyBhY3R1YWxseSBxdWl0ZSBhIGNvbW1vbiBmZWF0 dXJlIG9mIHN1cHBvcnQgY29tcGFuaWVzIHNvIHlvdSBkb24ndCBoYXZlIHRvIHNpdCBvbiBob2xk Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tLTc3OTI4NzUwMTI4OTQ4 NDM1NDVtc29saXN0cGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6NzIuMHB0Ij4NCjxzcGFu IGxhbmc9IkVOLVVTIj4yLjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6 ZTo3LjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjxzcGFuIGxhbmc9IkVO LVVTIj5BdHRhY2tlciBhbnN3ZXJzL3JlamVjdHMgdGhlIGNhbGwgYW5kIHNhdmVzIG9mZiB0aGUg U0hBS0VOIHBhc3Nwb3J0IGZvciBUcnVzdGVkIC0mZ3Q7IEF0dGFja2VyLjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tLTc3OTI4NzUwMTI4OTQ4NDM1NDVtc29saXN0cGFy YWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6NzIuMHB0Ij4NCjxzcGFuIGxhbmc9IkVOLVVTIj4z Ljwvc3Bhbj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZTo3LjBwdDtmb250LWZh bWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjxzcGFuIGxhbmc9IkVOLVVTIj5BdHRhY2tlciBz ZXRzIHVwIGEgcmVkaXJlY3QgZnJvbSB0aGVtIHRvIHRoZWlyIGludGVuZGVkIFN1YmplY3QuPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW0tNzc5Mjg3NTAxMjg5NDg0MzU0 NW1zb2xpc3RwYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDo3Mi4wcHQiPg0KPHNwYW4gbGFu Zz0iRU4tVVMiPjQuPC9zcGFuPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjcu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMi PkF0dGFja2VyIGNvbnN0cnVjdHMgYSBjYWxsIChjbGFpbWluZyB0byBiZSkgZnJvbSBUcnVzdGVk IHRvIEF0dGFja2VyIHdpdGggdGhlIHByZXZpb3VzbHkgc2F2ZWQgU0hBS0VOIHBhc3Nwb3J0Ljwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tLTc3OTI4NzUwMTI4OTQ4NDM1 NDVtc29saXN0cGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6NzIuMHB0Ij4NCjxzcGFuIGxh bmc9IkVOLVVTIj41Ljwvc3Bhbj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZTo3 LjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjxzcGFuIGxhbmc9IkVOLVVT Ij5UaGUgY2FsbCB3aWxsIGJlIHZlcmlmaWVkLCB0aGVuIHJlZGlyZWN0ZWQgdG8gU3ViamVjdCB3 aXRoIGEgRElWIHBhc3Nwb3J0IGZvciBBdHRhY2tlciAtJmd0OyBTdWJqZWN0Ljwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tLTc3OTI4NzUwMTI4OTQ4NDM1NDVtc29saXN0 cGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6NzIuMHB0Ij4NCjxzcGFuIGxhbmc9IkVOLVVT Ij5UaGlzIGRvZXMgcmVseSBvbiB0aGUgY2VydGlmaWNhdGUgc2lnbmluZyB0aGUgRElWIHRvIGJl bG9uZyB0byBhIHRydXN0ZWQgZW50aXR5LCB0aGlzIHNlZW1zIHBvc3NpYmxlLCBhcyB0aGUgcmVk aXJlY3QgY291bGQgYmUgY2FycmllZCBvdXQgYnkgQXR0YWNrZXIncyBzZXJ2aWNlIHByb3ZpZGVy Ljxicj4NCkF0dGFja2VyJ3MgU1AgbWF5IHJlZnVzZSB0byByZWRpcmVjdCBhZnRlciBzb21lIHRp bWUgZHVlIHRvIElhVCB0aW1lb3V0cywgYnV0IHRoaXMgaXMgbm90IHJlcXVpcmVkIGJ5IHRoZSBz cGVjIGFuZCBJIGJlbGlldmUgdGhpcyBjYW4gYmUgd29ya2VkIGFyb3VuZCBieSwgZm9yIGV4YW1w bGUsIHJlcGVhdGVkbHkgYm91bmNpbmcgbmV3IGNhbGxzIG9mZiBhbiBhY2NvbXBsaWNlLjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tLTc3OTI4NzUwMTI4OTQ4NDM1NDVt c29saXN0cGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6NzIuMHB0Ij4NCjxzcGFuIGxhbmc9 IkVOLVVTIj42Ljwvc3Bhbj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZTo3LjBw dDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjxzcGFuIGxhbmc9IkVOLVVTIj5T dWJqZWN0IHJlY2VpdmVzIGEgY2FsbCBjbGFpbWluZyB0byBiZSBmcm9tIFRydXN0ZWQgKGFsYmVp dCByZWRpcmVjdGVkIGZyb20gQXR0YWNrZXIpIHdpdGggYSB2YWxpZCBwYXNzcG9ydCBjaGFpbiBv ZiBUcnVzdGVkIC0mZ3Q7IEF0dGFja2VyIC0mZ3Q7IFN1YmplY3QuPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW0tNzc5Mjg3NTAxMjg5NDg0MzU0NW1zb2xpc3RwYXJhZ3Jh cGgiIHN0eWxlPSJtYXJnaW4tbGVmdDo3Mi4wcHQiPg0KPHNwYW4gbGFuZz0iRU4tVVMiPkJvdGgg cGFzc3BvcnRzIHdpbGwgYmUgc2lnbmVkIGJ5IHRydXN0ZWQgZW50aXRpZXM6IFRydXN0ZWQncyBT UCBhbmQgQXR0YWNrZXIncyBTUC48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6NzIuMHB0Ij4NCjxzcGFuIGxhbmc9IkVOLVVTIj5JYVQgZG9l c24ndCBwcm92aWRlIG11Y2ggcHJvdGVjdGlvbiBoZXJlIGFzLCBpbiB0aGUgcHJlc2VuY2Ugb2Yg RElWIHBhc3Nwb3J0cywgdGhlIHZhbGlkIHRpbWUgcmFuZ2UgbXVzdCBiZSBzZXQgcmVhc29uYWJs eSBoaWdoIHRvIGFsbG93IGZvciB0aGUgcG9zc2liaWxpdHkgb2YgcmluZy1hcm91bmRzLjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDo3Mi4w cHQiPg0KPHNwYW4gbGFuZz0iRU4tVVMiPlRoZSBvcmlnaWQgYW5kIGF0dGVzdCB3aWxsIGJlIGFz c29jaWF0ZWQgd2l0aCBUcnVzdGVkLCBlcm9kaW5nIGFueSBhdXRvbWF0ZWQgZGF0YWJhc2VzIG9m IHJvYm9jYWxscyBiYXNlZCBvbiB0aGUgb3JpZ2lkLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDozNi4wcHQiPg0KPHNwYW4gbGFuZz0iRU4t VVMiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDozNi4wcHQiPg0KPHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDozNi4wcHQiPg0K PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDozNi4wcHQiPg0KPHNwYW4gbGFuZz0iRU4tVVMiPlRo ZSAmcXVvdDtta3kmcXVvdDsgY2xhaW0gc2VlbXMgdG8gYmUgdGhlIHNvbHV0aW9uIHRoYXQgaXMg Y3VycmVudGx5IGJ1aWx0IGludG8gcGFzc3BvcnRzLCBob3dldmVyLCBpdCBpcyBjdXJyZW50bHkg b3B0aW9uYWwsIGFuZCBhcyBmYXIgYXMgSSBhbSBhd2FyZSB1c2luZyBjZXJ0aWZpY2F0ZXMgdG8g YXV0aGVudGljYXRlIHRoZSBlbmRzIG9mIGEgbWVkaWEgc3RyZWFtIGlzIHZlcnkgcmFyZSBpbiBw cmFjdGljZS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6MzYuMHB0Ij4NCjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MzYuMHB0Ij4NCjxz cGFuIGxhbmc9IkVOLVVTIj5VbmZvcnR1bmF0ZWx5LCBJJ20gbm90IGFibGUgdG8gY29tZSB1cCB3 aXRoIGEgc29sdXRpb24gYW5kIEkgYW0gaG9waW5nIHRoYXQgaXMgd2hlcmUgeW91IHdpbGwgYmUg YWJsZSB0byBzdGVwIGluLiBJIGJlbGlldmUgdG8gYXZvaWQgdGhpcywgdGhlcmUgbmVlZHMgdG8g YmUgbW9yZSB2YWxpZGF0aW9uIG9mIHRoZSBtZWRpYSBzdHJlYW0gdGhhdCBpcyBjcmVhdGVkLCBl aXRoZXIgaW4gdGhlIGZvcm0gb2YgbW9yZSBkYXRhDQogYmVpbmcgc2lnbmVkIG9yIGVuZm9yY2lu ZyB0aGF0IHRoZSBtZWRpYSBwYXJ0aWNpcGFudHMgYXJlIGF1dGhlbnRpY2F0ZWQuPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjM2LjBwdCI+ DQo8c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjM2LjBwdCI+DQo8c3BhbiBsYW5nPSJFTi1VUyI+ VGhhbmsgeW91LDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDozNi4wcHQiPg0KPGI+PHNwYW4gbGFuZz0iRU4tVVMiPkphY2sgUmlja2FyZCB8 IFNvZnR3YXJlIEVuZ2luZWVyIHwgTWV0YXN3aXRjaDwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4t VVMiPg0KPGJyPg0KVGhlIEZhc3RlciBXYXkgRm9yd2FyZDxicj4NCk9mZmljZSAmIzQzOzQ0IDIw IDgxOTYgOTgwMTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDozNi4wcHQiPg0KPHNwYW4gbGFuZz0iRU4tVVMiPk1ldGFzd2l0Y2ggaXMgYSBN aWNyb3NvZnQgY29tcGFueTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttYXJnaW4tbGVmdDozNi4wcHQiPg0KPHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJy Pg0Kc3RpciBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86c3RpckBpZXRmLm9yZyIg dGFyZ2V0PSJfYmxhbmsiPnN0aXJAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly9u YW0wMS5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJG d3d3LmlldGYub3JnJTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJGc3RpciZhbXA7ZGF0YT0wMiU3QzAx JTdDamFjay5yaWNrYXJkJTQwbWV0YXN3aXRjaC5jb20lN0NkNTMxYjkyMDE2MzA0MDdkMmQwNDA4 ZDgyZjFlMDU3MCU3QzlkOWU1NmViZjYxMzRkZGJiMjdiYmZjZGYxNGIyY2RiJTdDMSU3QzAlN0M2 MzczMTExNTMyOTEzNDA3MDkmYW1wO3NkYXRhPTNnREVlbzdoRUxvJTJGRSUyRlcwakxyWUhFc0I3 bUJZeU11dnVWT1pjS0klMkI4eU0lM0QmYW1wO3Jlc2VydmVkPTAiIHRhcmdldD0iX2JsYW5rIj5o dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXI8L2E+PG86cD48L286cD48 L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0 bWw+DQo= --_000_BYAPR02MB5189902FBF70C0ECC7A19228F3760BYAPR02MB5189namp_-- From nobody Thu Jul 23 13:22:10 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 030F93A09BC for ; Thu, 23 Jul 2020 13:22:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, NICE_REPLY_A=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=mtcc-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D3cUP5uVKJya for ; Thu, 23 Jul 2020 13:22:06 -0700 (PDT) Received: from mail-pg1-x530.google.com (mail-pg1-x530.google.com [IPv6:2607:f8b0:4864:20::530]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E627B3A0919 for ; Thu, 23 Jul 2020 13:22:05 -0700 (PDT) Received: by mail-pg1-x530.google.com with SMTP id k27so3772472pgm.2 for ; Thu, 23 Jul 2020 13:22:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mtcc-com.20150623.gappssmtp.com; s=20150623; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language; bh=LlR5891IRMRH5RF6LQ3ubhKFw8zZ42txRqrG6GDVZXo=; b=iQhEwNTSBdMeyPaCtklj+dTdQUZ0gozvCyAptEmjRR/rkmtyry1GijhsJCxDdMRrRX NmrHmah38dSpP0zKZbut8VxAtW0w64pMvMwW7HnvK1fWD74d6bp9j7AZSHFRaYSJZn5n QqhQzQiEVp1tf2VU13UWJ7eBD3icDltK16rMaFwrMyifff6UAZ1f0upEDxN0ktzFpVqH SOsS5pCmhSpB2rI+u7ohD9Hm6TqJX7mpDSSq9G9cluMYXA/fFmdfaOVPD2YpbnGndYE3 j6SCuhA1Pa/LVMYlrThdbOmp3NATK+M7ZgzMHEQlUZsuuex+fYBKb6SiwFO2b9EpT2u+ hjYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language; bh=LlR5891IRMRH5RF6LQ3ubhKFw8zZ42txRqrG6GDVZXo=; b=DbBNj7E4ccWQGlWNKpI8x/9tdp7jvUV9DTG0KCLEhKNO7Ctwx0Yd30mrmvqkAIe09C DyOyb6hj2mXzGfx7/BXJnvs69ek0Mk0wdyMfajh1dRejg3ATGmyMKXEB7A1lIOCapda7 eJV14YDHK1Pkqq8syYe1gWgEWGerHXu2oIR4Mk8gu2oYJpYGr8CMuZ1QGsBChsFqpy0r /L+Yvma/J8J667iKrL4F1KyCqtiJK1A1C9GxUpE5QZyVgf442Bwy3xzoaPnjRJ8It0hD 7uDD0dTq8EnT9SUPqITMNHysWBGqdAIXzFgJaycitZWFJBLNqEOA1bQosj2D5284/H8l wMag== X-Gm-Message-State: AOAM530hzEUxcej/HSevYnhvJjNTPknMhXcD7LgD3ps2ubvfM1xNVVeL E1ilGXKiYoVcyf5zFqloyEn4h91o03I= X-Google-Smtp-Source: ABdhPJwPQE7XNZt7/Sh9r9Ct1gbSyYkNzfctn3t9vgUEYXoG7Kqfs6vhVhOlGDdKDgPFZowrB8zfYQ== X-Received: by 2002:a65:6384:: with SMTP id h4mr5648833pgv.196.1595535724443; Thu, 23 Jul 2020 13:22:04 -0700 (PDT) Received: from MichaelsMacBook.lan (107-182-40-136.volcanocom.com. [107.182.40.136]) by smtp.gmail.com with ESMTPSA id t188sm4070710pfc.198.2020.07.23.13.22.02 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 23 Jul 2020 13:22:03 -0700 (PDT) To: stir@ietf.org References: <89AC11DC-7E1A-4D1E-9CB8-96C98E790EF5@team.neustar> From: Michael Thomas Message-ID: <536a91b3-c484-e5bc-f154-a35fb8b30c0d@mtcc.com> Date: Thu, 23 Jul 2020 13:22:01 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------5460D54C91C48D29C6F61794" Content-Language: en-US Archived-At: Subject: Re: [stir] Potential security vulnerability in STIR/DIV X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 20:22:09 -0000 This is a multi-part message in MIME format. --------------5460D54C91C48D29C6F61794 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit On 7/23/20 8:35 AM, David Hancock wrote: > Could the verification service in step-5 detect/block the attack using > this procedure described in Section 12.1 of RFC 8224? > >   "... servers can keep >    state of recently received requests, and thus if an Identity header >    field is replayed by an attacker within the Date interval, verifiers >    can detect that it is spoofed because a message with an identical >    Date from the same source had recently been received." > If this is to prevent an attack, it needs requirement language like MUST. "can" to dev managers means: ignore. Mike > David Hancock > Comcast > > On Thu, Jul 23, 2020 at 7:22 AM Jack Rickard > > wrote: > > I agree that div does make this kind of attack more difficult, and > requiring that there is some trust of every retargeting entity > does make sense. My assumption was that by only trusting the > signers of the passports I can trust the orig is the entity > calling me, I now see you have to trust the signers and the > diverting parties. To clarify this I propose that something like > your explanation is added to the spec, i.e. > > It is Carol who needs to decide if a forwarded call from Bob > should be trusted or not – “div” is certainly not suggesting that > trust is automatic, nor that the presence of a “div” that > correctly chains to the original PASSporT is a substitute for the > policy and trust decision made on the terminating side of a call. > As with baseline STIR, just because something validates at a > protocol level doesn’t mean you should trust it, nor that local > policy does not determine how you treat calls. > > To be clear, my original email was based on the belief that div > passports would provide a "chain-of-trust", allowing you to > essentially ignore that diversions had occurred once you had > established there was a valid chain of div passports from the > originator to the final destination. Although, after reading your > response I realise that's not the case. > > My worry is that this model makes div difficult to use and police > in practice, specifically: > > * This model makes implementations more complicated as you can't > separate verification from policy decisions. You have to > filter out untrusted parties before doing the chain finding > step of verification, as otherwise you might decide upon a > chain containing an untrusted party when there does exist a > valid chain containing only trusted parties (granted this > situation is unlikely). > * This model introduces complexity in what should be displayed > to a user, the simple verified/not verified can't be used > unless you require complete trust of all diverting parties, > and that could cause false negatives. > * If a diverted call does get reported as a robocall, it's not > clear whose reputation should be tarnished. It may have been > that the original caller was a robocaller and the call got > legitimately diverted to you, or it was the below attack where > the caller is trustworthy but the diverter was the robocaller. > > Thanks, > > Jack > > *From:*Peterson, Jon > *Sent:* 22 July 2020 23:53 > *To:* Jack Rickard >; stir@ietf.org > ; draft-ietf-stir-passport-divert@ietf.org > > *Subject:* Re: Potential security vulnerability in STIR/DIV > > > > > NOTE: Message is from an external sender > > Potential “baiting” attacks of this form emerge when you combine > baseline STIR with call forwarding, and are the main threat > articulated in the IETF “div” draft. The introduction describes > them as follows: > >    If Alice calls Bob, for example, Bob might > >    attempt to cut-and-paste the Identity header field in Alice's > INVITE > >    into a new INVITE that Bob sends to Carol, and thus be able to fool > >    Carol into thinking the call came from Alice and not Bob. With the > >    signature over the To header field value, the INVITE Carol sees > will > >    clearly have been destined originally for Bob, and thus Carol can > >    view the INVITE as suspect. > > That describes the situation in a world without “div”, so the > question is, does “div” make these sorts of attacks easier to > harder to mount? > > Without “div”, in the example above, Carol will see that the > original called number does not match hers, and can decide on > those grounds to reject the call. But bear in mind this is also > what Carol would see in legitimate forwarding cases, so a more > nuanced logic would probably be used. She could decide that if the > original called number is a number that should be forwarding calls > to her (say, if it was her office), that she should accept the > call anyway. You could even imagine application behavior that > would enforce policies along those lines on her behalf. However, > Carol has no assurance that it was really her office that > forwarded this call, rather than some eavesdropper who somehow > captured the PASSporT, nor how many times it might have been > redirected before reaching her, or anything along those lines. > > Those are the gaps that “div” is meant to fill. It is not a > substitute for the rest of the logic and policy described above, > but it gives Carol more information to help figure out if the call > is suspect and what to do about it. With “div”, what Carol sees is > a second PASSporT created and signed by Bob, which actually gives > Carol the assurance of whether the intended called party is one > who retargeted the call, which you don’t get in the absence of > “div”. If Bob is doing this maliciously, the “div” he provided has > given Carol the means to hunt him down for redress, which is not > exactly a strong incentive for him to use “div”. But at the end of > the day, it is Carol who needs to decide if a forwarded call from > Bob should be trusted or not – “div” is certainly not suggesting > that trust is automatic, nor that the presence of a “div” that > correctly chains to the original PASSporT is a substitute for the > policy and trust decision made on the terminating side of a call. > As with baseline STIR, just because something validates at a > protocol level doesn’t mean you should trust it, nor that local > policy does not determine how you treat calls. > > But all that said, if you’re serious about security, then yes, > using DTLS-SRTP with “mkey” is going to provide you with a better > assurance. > > Jon Peterson > > Neustar, Inc. > > *From: *Jack Rickard > > *Date: *Wednesday, July 22, 2020 at 9:47 AM > *To: *"stir@ietf.org " >, "draft-ietf-stir-passport-divert@ietf.org > " > >, "Peterson, > Jon" > > *Subject: *Potential security vulnerability in STIR/DIV > *Resent-From: * > > *Resent-To: * > > *Resent-Date: *Wednesday, July 22, 2020 at 9:47 AM > > Hello, > > I believe I've come across a security vulnerability in the STIR > system that is made exploitable by the introduction of DIV > passports, that I haven't seen discussed here in any detail (sorry > if it has been). There are currently mitigations for it in the > passport spec, however I don't believe they go far enough to > prevent this attack. > > The high level summary is that an attacker can impersonate an > entity that called them by pretending they redirected that call to > the recipient. > > An example: > > Trusted: A party trusted by Subject, which Attacker wishes to > impersonate > > Attacker: The party wishing to impersonate Trusted > > Subject: The intended target of Attacker, who will see a verified > call coming from Trusted > > 1.Attacker gets Trusted to call them. > > This is a reasonable operation, and is actually quite a common > feature of support companies so you don't have to sit on hold. > > 2.Attacker answers/rejects the call and saves off the SHAKEN > passport for Trusted -> Attacker. > > 3.Attacker sets up a redirect from them to their intended Subject. > > 4.Attacker constructs a call (claiming to be) from Trusted to > Attacker with the previously saved SHAKEN passport. > > 5.The call will be verified, then redirected to Subject with a DIV > passport for Attacker -> Subject. > > This does rely on the certificate signing the DIV to belong to a > trusted entity, this seems possible, as the redirect could be > carried out by Attacker's service provider. > Attacker's SP may refuse to redirect after some time due to IaT > timeouts, but this is not required by the spec and I believe this > can be worked around by, for example, repeatedly bouncing new > calls off an accomplice. > > 6.Subject receives a call claiming to be from Trusted (albeit > redirected from Attacker) with a valid passport chain of Trusted > -> Attacker -> Subject. > > Both passports will be signed by trusted entities: Trusted's SP > and Attacker's SP. > > IaT doesn't provide much protection here as, in the presence of > DIV passports, the valid time range must be set reasonably high to > allow for the possibility of ring-arounds. > > The origid and attest will be associated with Trusted, eroding any > automated databases of robocalls based on the origid. > > The "mky" claim seems to be the solution that is currently built > into passports, however, it is currently optional, and as far as I > am aware using certificates to authenticate the ends of a media > stream is very rare in practice. > > Unfortunately, I'm not able to come up with a solution and I am > hoping that is where you will be able to step in. I believe to > avoid this, there needs to be more validation of the media stream > that is created, either in the form of more data being signed or > enforcing that the media participants are authenticated. > > Thank you, > > *Jack Rickard | Software Engineer | Metaswitch* > The Faster Way Forward > Office +44 20 8196 9801 > > Metaswitch is a Microsoft company > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir --------------5460D54C91C48D29C6F61794 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit


On 7/23/20 8:35 AM, David Hancock wrote:
Could the verification service in step-5 detect/block the attack using this procedure described in Section 12.1 of RFC 8224?

  "... servers can keep
   state of recently received requests, and thus if an Identity header
   field is replayed by an attacker within the Date interval, verifiers
   can detect that it is spoofed because a message with an identical
   Date from the same source had recently been received."

If this is to prevent an attack, it needs requirement language like MUST. "can" to dev managers means: ignore.

Mike


David Hancock
Comcast

On Thu, Jul 23, 2020 at 7:22 AM Jack Rickard <Jack.Rickard=40metaswitch.com@dmarc.ietf.org> wrote:

I agree that div does make this kind of attack more difficult, and requiring that there is some trust of every retargeting entity does make sense. My assumption was that by only trusting the signers of the passports I can trust the orig is the entity calling me, I now see you have to trust the signers and the diverting parties. To clarify this I propose that something like your explanation is added to the spec, i.e.

It is Carol who needs to decide if a forwarded call from Bob should be trusted or not – “div” is certainly not suggesting that trust is automatic, nor that the presence of a “div” that correctly chains to the original PASSporT is a substitute for the policy and trust decision made on the terminating side of a call. As with baseline STIR, just because something validates at a protocol level doesn’t mean you should trust it, nor that local policy does not determine how you treat calls.

 

 

To be clear, my original email was based on the belief that div passports would provide a "chain-of-trust", allowing you to essentially ignore that diversions had occurred once you had established there was a valid chain of div passports from the originator to the final destination. Although, after reading your response I realise that's not the case.

 

My worry is that this model makes div difficult to use and police in practice, specifically:

  • This model makes implementations more complicated as you can't separate verification from policy decisions. You have to filter out untrusted parties before doing the chain finding step of verification, as otherwise you might decide upon a chain containing an untrusted party when there does exist a valid chain containing only trusted parties (granted this situation is unlikely).
  • This model introduces complexity in what should be displayed to a user, the simple verified/not verified can't be used unless you require complete trust of all diverting parties, and that could cause false negatives.
  • If a diverted call does get reported as a robocall, it's not clear whose reputation should be tarnished. It may have been that the original caller was a robocaller and the call got legitimately diverted to you, or it was the below attack where the caller is trustworthy but the diverter was the robocaller.

 

Thanks,

Jack

 

From: Peterson, Jon <jon.peterson@team.neustar>
Sent: 22 July 2020 23:53
To: Jack Rickard <Jack.Rickard@metaswitch.com>; stir@ietf.org; draft-ietf-stir-passport-divert@ietf.org
Subject: Re: Potential security vulnerability in STIR/DIV

 

NOTE: Message is from an external sender

 

Potential “baiting” attacks of this form emerge when you combine baseline STIR with call forwarding, and are the main threat articulated in the IETF “div” draft. The introduction describes them as follows:

 

   If Alice calls Bob, for example, Bob might

   attempt to cut-and-paste the Identity header field in Alice's INVITE

   into a new INVITE that Bob sends to Carol, and thus be able to fool

   Carol into thinking the call came from Alice and not Bob. With the

   signature over the To header field value, the INVITE Carol sees will

   clearly have been destined originally for Bob, and thus Carol can

   view the INVITE as suspect.

 

That describes the situation in a world without “div”, so the question is, does “div” make these sorts of attacks easier to harder to mount?

 

Without “div”, in the example above, Carol will see that the original called number does not match hers, and can decide on those grounds to reject the call. But bear in mind this is also what Carol would see in legitimate forwarding cases, so a more nuanced logic would probably be used. She could decide that if the original called number is a number that should be forwarding calls to her (say, if it was her office), that she should accept the call anyway. You could even imagine application behavior that would enforce policies along those lines on her behalf. However, Carol has no assurance that it was really her office that forwarded this call, rather than some eavesdropper who somehow captured the PASSporT, nor how many times it might have been redirected before reaching her, or anything along those lines.

 

Those are the gaps that “div” is meant to fill. It is not a substitute for the rest of the logic and policy described above, but it gives Carol more information to help figure out if the call is suspect and what to do about it. With “div”, what Carol sees is a second PASSporT created and signed by Bob, which actually gives Carol the assurance of whether the intended called party is one who retargeted the call, which you don’t get in the absence of “div”. If Bob is doing this maliciously, the “div” he provided has given Carol the means to hunt him down for redress, which is not exactly a strong incentive for him to use “div”. But at the end of the day, it is Carol who needs to decide if a forwarded call from Bob should be trusted or not – “div” is certainly not suggesting that trust is automatic, nor that the presence of a “div” that correctly chains to the original PASSporT is a substitute for the policy and trust decision made on the terminating side of a call. As with baseline STIR, just because something validates at a protocol level doesn’t mean you should trust it, nor that local policy does not determine how you treat calls.

 

But all that said, if you’re serious about security, then yes, using DTLS-SRTP with “mkey” is going to provide you with a better assurance.

 

Jon Peterson

Neustar, Inc.

 

From: Jack Rickard <Jack.Rickard@metaswitch.com>
Date: Wednesday, July 22, 2020 at 9:47 AM
To: "stir@ietf.org" <stir@ietf.org>, "draft-ietf-stir-passport-divert@ietf.org" <draft-ietf-stir-passport-divert@ietf.org>, "Peterson, Jon" <jon..peterson@team.neustar>
Subject: Potential security vulnerability in STIR/DIV
Resent-From: <alias-bounces@ietf.org>
Resent-To: <jon.peterson@team.neustar>
Resent-Date: Wednesday, July 22, 2020 at 9:47 AM

 

Hello,

 

I believe I've come across a security vulnerability in the STIR system that is made exploitable by the introduction of DIV passports, that I haven't seen discussed here in any detail (sorry if it has been). There are currently mitigations for it in the passport spec, however I don't believe they go far enough to prevent this attack.

 

The high level summary is that an attacker can impersonate an entity that called them by pretending they redirected that call to the recipient.

 

An example:

 

Trusted: A party trusted by Subject, which Attacker wishes to impersonate

Attacker: The party wishing to impersonate Trusted

Subject: The intended target of Attacker, who will see a verified call coming from Trusted

 

1.       Attacker gets Trusted to call them.

This is a reasonable operation, and is actually quite a common feature of support companies so you don't have to sit on hold.

2.       Attacker answers/rejects the call and saves off the SHAKEN passport for Trusted -> Attacker.

3.       Attacker sets up a redirect from them to their intended Subject.

4.       Attacker constructs a call (claiming to be) from Trusted to Attacker with the previously saved SHAKEN passport.

5.       The call will be verified, then redirected to Subject with a DIV passport for Attacker -> Subject.

This does rely on the certificate signing the DIV to belong to a trusted entity, this seems possible, as the redirect could be carried out by Attacker's service provider.
Attacker's SP may refuse to redirect after some time due to IaT timeouts, but this is not required by the spec and I believe this can be worked around by, for example, repeatedly bouncing new calls off an accomplice.

6.       Subject receives a call claiming to be from Trusted (albeit redirected from Attacker) with a valid passport chain of Trusted -> Attacker -> Subject.

Both passports will be signed by trusted entities: Trusted's SP and Attacker's SP.

IaT doesn't provide much protection here as, in the presence of DIV passports, the valid time range must be set reasonably high to allow for the possibility of ring-arounds.

The origid and attest will be associated with Trusted, eroding any automated databases of robocalls based on the origid.

 

 

 

The "mky" claim seems to be the solution that is currently built into passports, however, it is currently optional, and as far as I am aware using certificates to authenticate the ends of a media stream is very rare in practice.

 

Unfortunately, I'm not able to come up with a solution and I am hoping that is where you will be able to step in. I believe to avoid this, there needs to be more validation of the media stream that is created, either in the form of more data being signed or enforcing that the media participants are authenticated.

 

Thank you,

Jack Rickard | Software Engineer | Metaswitch
The Faster Way Forward
Office +44 20 8196 9801

Metaswitch is a Microsoft company

 

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir
--------------5460D54C91C48D29C6F61794-- From nobody Thu Jul 23 14:03:03 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 815613A0DB0 for ; Thu, 23 Jul 2020 14:03:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=team.neustar header.b=zC1bUJCR; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=neustar.onmicrosoft.com header.b=enA7Auik Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7uyWBDBazSfe for ; Thu, 23 Jul 2020 14:02:57 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5DCAC3A0E16 for ; Thu, 23 Jul 2020 14:02:54 -0700 (PDT) Received: from pps.filterd (m0049401.ppops.net [127.0.0.1]) by mx0b-0018ba01.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 06NKiMLn018291 for ; Thu, 23 Jul 2020 17:02:53 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=team.neustar; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=team-neustar; bh=rLTTW9TB+qbEifXqe79WsnncDNggwH03W5zGrphoP9w=; b=zC1bUJCRJsrrNJNnXKCirqboBJ4STVB5ChurWOh+SCW4Z9zGlb24fsf3Wtylp7OLxlX7 aChJnLZDpC2y24VDU4/0PKpJnjfVUtXN3EgfoUE3bVealP6sZ7sbUzjAQ26QIof2t5m/ J7plhgwIu9QCygsAeBUntijzNTKlPVndzl0WwvzH1+Jev88zP4nUOgtFrALxuOudB0Mj D9orLhRBwc+bxGF373+mB3tgDf9N3khsvs6PKycmTm871x1woF/laQa5l25bLiFSRqqI ZbuUrs+1g+XAmacScsniqoHH65k7xJonPXJKTxgd836+xh/F3RdA60x8wuhUFc0Mm1nz QQ== Received: from pps.reinject (localhost [127.0.0.1]) by mx0b-0018ba01.pphosted.com with ESMTP id 32bwdcn5sg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 23 Jul 2020 17:02:53 -0400 Received: from m0049401.ppops.net (m0049401.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 06NKuZXo002052 for ; Thu, 23 Jul 2020 17:02:52 -0400 Received: from nam11-dm6-obe.outbound.protection.outlook.com (mail-dm6nam11lp2170.outbound.protection.outlook.com [104.47.57.170]) by mx0b-0018ba01.pphosted.com with ESMTP id 32bwdcn5se-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 23 Jul 2020 17:02:52 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Z8CfcK+WnE2PdNzYbKwF5EfENHf9kuoOpB5tCtiwFW8b9l0SZHw6MUh2wTLSJC/xOMcOpI4vIUHiIkQ6MOZu5zrUm64fTrkZMlxc4j6wezWgsSFtK09W/cA0lkUBetGdpe1U7K+yLe923ywIaYpRnCwBgnUy1yTNtL8ybXyAHGrIEqlc/Xyatgf50ZXZJUxTjnUbCHbiasNk3zi9tf0KqjkEot5/Hm4SguNRATNRKwx+MtJlbjKvVeI3xoTdi4tMeQaPX0JMl4dKkuFs6o8eDO8dxcAPhJmGTFlFz+Dib0pXcV6c+1xE160oSLMi6dP4uaD9O/b5iSvfiSvErZ25BQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Jtv/J90wwNIl4SVUszRC7Nt5e00eA8nmYVyfyfYUZO8=; b=V/c+xEDkSt78WhX2CzCSiOGINOJwXYsZgy2gRrulcwll9nsCC5aOn0BH2xn2G2i+ke970N/2Yb9FPI5ogQryrd/qXgfyrpAG7/kmfebK21KLYbZRV97aNdPYh/OAx95/HEtDfkKQgrcaevoG4paAfd2EMOfK7jfSQENFTrWtp923e0JUTneNmCZLQcB4/dP78nRGq5pJpnoVDpAtx+UNtpYY7XzteT4vzvqnRL2nKWq5XbeOUxmW6JaQ7kUTjz6waa9WcPX1J2lLW2GZY5v7vEGCPnVSO+X7suKH00sVHFATQY5S5oVLqZhAcR3xpS1pnCk+qDYwA1wHKkTdonkcoA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=team.neustar; dmarc=pass action=none header.from=team.neustar; dkim=pass header.d=team.neustar; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=neustar.onmicrosoft.com; s=selector1-neustar-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Jtv/J90wwNIl4SVUszRC7Nt5e00eA8nmYVyfyfYUZO8=; b=enA7AuikVO7ZDmeQEu6ADR9DA7aVVKTMxB/wXSIxVjmKM8mqrlwPOtfEUfUJ6BH1uRbYfwu3OlxqV9yLEz4UEWs5z90KRWhD1gzx/qgKPUoLeMJ+We6zu/IDhnWUK7xqfptadQaQpeUFgmAd3562EbgcPTqqZYOYtVyXxXuXNlk= Received: from BY5PR17MB3569.namprd17.prod.outlook.com (2603:10b6:a03:1b9::20) by BY5PR17MB3537.namprd17.prod.outlook.com (2603:10b6:a03:1bf::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3195.23; Thu, 23 Jul 2020 21:02:49 +0000 Received: from BY5PR17MB3569.namprd17.prod.outlook.com ([fe80::503b:2ce0:8d8b:6b15]) by BY5PR17MB3569.namprd17.prod.outlook.com ([fe80::503b:2ce0:8d8b:6b15%5]) with mapi id 15.20.3216.023; Thu, 23 Jul 2020 21:02:49 +0000 From: "Peterson, Jon" To: Jack Rickard , David Hancock CC: "draft-ietf-stir-passport-divert@ietf.org" , "stir@ietf.org" Thread-Topic: [stir] Potential security vulnerability in STIR/DIV Thread-Index: AdZgO7RfMuiVRPd/TYi0mhEaKJnUqQABGmKAACQy9XAADXsJAAAAmkxQ///hZYA= Date: Thu, 23 Jul 2020 21:02:48 +0000 Message-ID: References: <89AC11DC-7E1A-4D1E-9CB8-96C98E790EF5@team.neustar> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.17.200615 authentication-results: metaswitch.com; dkim=none (message not signed) header.d=none;metaswitch.com; dmarc=none action=none header.from=team.neustar; x-originating-ip: [2600:1700:2ec0:8108::3] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 6f7b5aac-3e81-4e27-d692-08d82f4bc1bd x-ms-traffictypediagnostic: BY5PR17MB3537: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: TnxRhWlvUXb8NSCN+GFRcVOjq/B3AHa8Bc4R3sjkSyH63Ea3W81S86XwvVYZn+U+LWL4cut6FG7XOfofLAZk6QDNfw/gMkaj2odipDd8q1OmS20YwHuZOkq2Jni2030WcrvnfmMlH1We7NVIy9Gi5+aII3xb+027jhwHRBAJGOARFkie6q7+E9xgJv7/JgBsPQFbsdtfqwZZarSjVpIhtO/KrzdXCvDkCIcK9LL9UptiM6hPdAwdBUI8tvh7VN4TePXJAN/Ep0vXqvzltcApnjLdfm3ASPb7LL6kouZyfEty61/knY4x5jK+ts38vKyplwHEWeH9bnm2Tj/5AqqeSQv78pwweiQaR5emDoLRiS+wD3C9oKvO1vsfYy/jVLWvo/2rReuIKoAjtpRaSgYxeFDLB9XDAoDs1YZMoek+rltQDLcevbb8w8uVzaxxXzFvt6la+6dd4jyM2qBKY89Rtg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY5PR17MB3569.namprd17.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(376002)(346002)(39860400002)(366004)(396003)(136003)(478600001)(2616005)(54906003)(6512007)(5660300002)(71200400001)(316002)(8936002)(4326008)(86362001)(2906002)(30864003)(8676002)(6506007)(15650500001)(83380400001)(110136005)(64756008)(186003)(53546011)(6486002)(166002)(66446008)(76116006)(45080400002)(966005)(66556008)(33656002)(66946007)(66476007)(46492007); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: kOCPkBsyLKTnoSjJxzitfIBK+ATrSrQg6xKmkFeG1BWufEf7ReQiJqiK9mKQomTRPcXTIXneZH1Vq2LwFMg5fmEn19+/NtWl1A9Xb2omfALHTHKb3yXZRQFtl+rms6NKxu0e2E+tsVicKipwWi3w+cHPc6kTL+/jXNJDz8Z9eTVjtEXivTuB0ZheWFXfE7tJZFuyluavg2vG73NWf93h6cQejucdKUuIM2I+zPJN5rnGyXhgUPBB/QvDuRx7auvS/ATijB/1noGlCMiFGPyiYQfaZJyGLBNAQWgNWnN7l5CJeY9FHRrq0SY4hxudtZ6jhuoQWpUaWU3AeuWrLHT5nB4bqcRnTIMlfiVZgTTuYot+ryz04ORYUPAgOsXQSWwwHeqhj+QwBLJB/voS93YBQranjQw0kF6cRGu0Hj0jEfMRXqXPx22DrIqcqt5hzGJe0u73Wh8Pt+gZfh2f9I3GvQRH8UuLGBWw89vROtCHnu61TGjLDX5qdGggXXKH1B0DjzQV42/1IsS+fEIb7tsLMQ== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DB79896528E241F79609BFC619FA928Dteamneustar_" X-OriginatorOrg: team.neustar X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY5PR17MB3569.namprd17.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6f7b5aac-3e81-4e27-d692-08d82f4bc1bd X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Jul 2020 21:02:49.0812 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 73a2bbc1-f307-47c4-8f94-5f379c68bc30 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: jAtKQqgitM/vfPLmDsf8IN0Fd997KrZmVWvsGdpFxjj86SsNGtNCJXq3k0E4M6bSpaaDMsojbCw7jrZB4bmp3Py4rRA74NyjizXCEtWoa3o= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR17MB3537 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-07-23_09:2020-07-23, 2020-07-23 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 impostorscore=0 malwarescore=0 priorityscore=1501 phishscore=0 suspectscore=0 mlxlogscore=999 mlxscore=0 adultscore=0 clxscore=1011 bulkscore=0 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=2 engine=8.12.0-2006250000 definitions=main-2007230146 Archived-At: Subject: Re: [stir] Potential security vulnerability in STIR/DIV X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 21:03:01 -0000 --_000_DB79896528E241F79609BFC619FA928Dteamneustar_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: Quoted-printable At a high level, I=E2=80=99m fine with sneaking some clarification text int= o the spec before we publish it about trust not being automatic, but I thin= k that sentiment is kind of built into everything we=E2=80=99ve said about = STIR from the start. Here in the IETF, broadly, we don=E2=80=99t tell you whose signatures you s= hould trust or why. I understand that over in SHAKEN, there are whole gover= nance structures that exist for that purpose. A lot of the complexity of de= ciding whether particular sources of retargeting should be trusted may end = up working itself out under that framework. Similarly, the assumed SHAKEN a= rchitecture depends on a closed network where PASSporTs don=E2=80=99t tend = to trickle down from carriers to enterprises, let alone end users, so some = of the potential for mischief is also mitigated. As for what ends up gettin= g displayed to the user, I doubt there=E2=80=99s much appetite in the IPNNI= TF to make that too complicated. Finally, on the reputation issue, I assume whoever you don=E2=80=99t trust = is the one whose reputation might be affected. Maybe there=E2=80=99s anoth= er use case for 184 responses here? Jon Peterson Neustar, Inc. From: Jack Rickard Date: Thursday, July 23, 2020 at 9:01 AM To: David Hancock Cc: "Peterson, Jon" , "draft-ietf-stir-passport-= divert@ietf.org" , "stir@ietf.org= " Subject: RE: [stir] Potential security vulnerability in STIR/DIV I think that would work, however it would be very hard to implement in a wa= y to be infallible. Most SPs will have multiple servers handling verificati= on and while rapidly synchronising a list of all recently seen Identity hea= ders is possible, it adds a lot of complexity. Jack From: stir On Behalf Of David Hancock Sent: 23 July 2020 16:35 To: Jack Rickard Cc: Peterson, Jon ; draft-ietf-stir-passport-div= ert@ietf.org; stir@ietf.org Subject: Re: [stir] Potential security vulnerability in STIR/DIV NOTE: Message is from an external sender Could the verification service in step-5 detect/block the attack using this= procedure described in Section 12.1 of RFC 8224? "... servers can keep state of recently received requests, and thus if an Identity header field is replayed by an attacker within the Date interval, verifiers can detect that it is spoofed because a message with an identical Date from the same source had recently been received." David Hancock Comcast On Thu, Jul 23, 2020 at 7:22 AM Jack Rickard > wrote: I agree that div does make this kind of attack more difficult, and requirin= g that there is some trust of every retargeting entity does make sense. My = assumption was that by only trusting the signers of the passports I can tru= st the orig is the entity calling me, I now see you have to trust the signe= rs and the diverting parties. To clarify this I propose that something like= your explanation is added to the spec, i.e. It is Carol who needs to decide if a forwarded call from Bob should be trus= ted or not =E2=80=93 =E2=80=9Cdiv=E2=80=9D is certainly not suggesting that= trust is automatic, nor that the presence of a =E2=80=9Cdiv=E2=80=9D that = correctly chains to the original PASSporT is a substitute for the policy an= d trust decision made on the terminating side of a call. As with baseline S= TIR, just because something validates at a protocol level doesn=E2=80=99t m= ean you should trust it, nor that local policy does not determine how you t= reat calls. To be clear, my original email was based on the belief that div passports w= ould provide a "chain-of-trust", allowing you to essentially ignore that di= versions had occurred once you had established there was a valid chain of d= iv passports from the originator to the final destination. Although, after = reading your response I realise that's not the case. My worry is that this model makes div difficult to use and police in practi= ce, specifically: =C2=B7 This model makes implementations more complicated as you can't sepa= rate verification from policy decisions. You have to filter out untrusted p= arties before doing the chain finding step of verification, as otherwise yo= u might decide upon a chain containing an untrusted party when there does e= xist a valid chain containing only trusted parties (granted this situation = is unlikely). =C2=B7 This model introduces complexity in what should be displayed to a u= ser, the simple verified/not verified can't be used unless you require comp= lete trust of all diverting parties, and that could cause false negatives. =C2=B7 If a diverted call does get reported as a robocall, it's not clear = whose reputation should be tarnished. It may have been that the original ca= ller was a robocaller and the call got legitimately diverted to you, or it = was the below attack where the caller is trustworthy but the diverter was t= he robocaller. Thanks, Jack From: Peterson, Jon > Sent: 22 July 2020 23:53 To: Jack Rickard >; stir@ietf.org; draft-ietf-stir-passport-dive= rt@ietf.org Subject: Re: Potential security vulnerability in STIR/DIV NOTE: Message is from an external sender Potential =E2=80=9Cbaiting=E2=80=9D attacks of this form emerge when you co= mbine baseline STIR with call forwarding, and are the main threat articulat= ed in the IETF =E2=80=9Cdiv=E2=80=9D draft. The introduction describes them= as follows: If Alice calls Bob, for example, Bob might attempt to cut-and-paste the Identity header field in Alice's INVITE into a new INVITE that Bob sends to Carol, and thus be able to fool Carol into thinking the call came from Alice and not Bob. With the signature over the To header field value, the INVITE Carol sees will clearly have been destined originally for Bob, and thus Carol can view the INVITE as suspect. That describes the situation in a world without =E2=80=9Cdiv=E2=80=9D, so t= he question is, does =E2=80=9Cdiv=E2=80=9D make these sorts of attacks easi= er to harder to mount? Without =E2=80=9Cdiv=E2=80=9D, in the example above, Carol will see that th= e original called number does not match hers, and can decide on those groun= ds to reject the call. But bear in mind this is also what Carol would see i= n legitimate forwarding cases, so a more nuanced logic would probably be us= ed. She could decide that if the original called number is a number that sh= ould be forwarding calls to her (say, if it was her office), that she shoul= d accept the call anyway. You could even imagine application behavior that = would enforce policies along those lines on her behalf. However, Carol has = no assurance that it was really her office that forwarded this call, rather= than some eavesdropper who somehow captured the PASSporT, nor how many tim= es it might have been redirected before reaching her, or anything along tho= se lines. Those are the gaps that =E2=80=9Cdiv=E2=80=9D is meant to fill. It is not a= substitute for the rest of the logic and policy described above, but it gi= ves Carol more information to help figure out if the call is suspect and wh= at to do about it. With =E2=80=9Cdiv=E2=80=9D, what Carol sees is a second = PASSporT created and signed by Bob, which actually gives Carol the assuranc= e of whether the intended called party is one who retargeted the call, whic= h you don=E2=80=99t get in the absence of =E2=80=9Cdiv=E2=80=9D. If Bob is = doing this maliciously, the =E2=80=9Cdiv=E2=80=9D he provided has given Car= ol the means to hunt him down for redress, which is not exactly a strong in= centive for him to use =E2=80=9Cdiv=E2=80=9D. But at the end of the day, it= is Carol who needs to decide if a forwarded call from Bob should be truste= d or not =E2=80=93 =E2=80=9Cdiv=E2=80=9D is certainly not suggesting that t= rust is automatic, nor that the presence of a =E2=80=9Cdiv=E2=80=9D that co= rrectly chains to the original PASSporT is a substitute for the policy and = trust decision made on the terminating side of a call. As with baseline STI= R, just because something validates at a protocol level doesn=E2=80=99t mea= n you should trust it, nor that local policy does not determine how you tre= at calls. But all that said, if you=E2=80=99re serious about security, then yes, usin= g DTLS-SRTP with =E2=80=9Cmkey=E2=80=9D is going to provide you with a bett= er assurance. Jon Peterson Neustar, Inc. From: Jack Rickard > Date: Wednesday, July 22, 2020 at 9:47 AM To: "stir@ietf.org" >, "draft-ietf-stir-passport-divert@ietf.org" >, "Peterson, Jon" > Subject: Potential security vulnerability in STIR/DIV Resent-From: > Resent-To: > Resent-Date: Wednesday, July 22, 2020 at 9:47 AM Hello, I believe I've come across a security vulnerability in the STIR system that= is made exploitable by the introduction of DIV passports, that I haven't s= een discussed here in any detail (sorry if it has been). There are currentl= y mitigations for it in the passport spec, however I don't believe they go = far enough to prevent this attack. The high level summary is that an attacker can impersonate an entity that c= alled them by pretending they redirected that call to the recipient. An example: Trusted: A party trusted by Subject, which Attacker wishes to impersonate Attacker: The party wishing to impersonate Trusted Subject: The intended target of Attacker, who will see a verified call comi= ng from Trusted 1. Attacker gets Trusted to call them. This is a reasonable operation, and is actually quite a common feature of s= upport companies so you don't have to sit on hold. 2. Attacker answers/rejects the call and saves off the SHAKEN passpor= t for Trusted -> Attacker. 3. Attacker sets up a redirect from them to their intended Subject. 4. Attacker constructs a call (claiming to be) from Trusted to Attack= er with the previously saved SHAKEN passport. 5. The call will be verified, then redirected to Subject with a DIV p= assport for Attacker -> Subject. This does rely on the certificate signing the DIV to belong to a trusted en= tity, this seems possible, as the redirect could be carried out by Attacker= 's service provider. Attacker's SP may refuse to redirect after some time due to IaT timeouts, b= ut this is not required by the spec and I believe this can be worked around= by, for example, repeatedly bouncing new calls off an accomplice. 6. Subject receives a call claiming to be from Trusted (albeit redire= cted from Attacker) with a valid passport chain of Trusted -> Attacker -> S= ubject. Both passports will be signed by trusted entities: Trusted's SP and Attacke= r's SP. IaT doesn't provide much protection here as, in the presence of DIV passpor= ts, the valid time range must be set reasonably high to allow for the possi= bility of ring-arounds. The origid and attest will be associated with Trusted, eroding any automate= d databases of robocalls based on the origid. The "mky" claim seems to be the solution that is currently built into passp= orts, however, it is currently optional, and as far as I am aware using cer= tificates to authenticate the ends of a media stream is very rare in practi= ce. Unfortunately, I'm not able to come up with a solution and I am hoping that= is where you will be able to step in. I believe to avoid this, there needs= to be more validation of the media stream that is created, either in the f= orm of more data being signed or enforcing that the media participants are = authenticated. Thank you, Jack Rickard | Software Engineer | Metaswitch The Faster Way Forward Office +44 20 8196 9801 Metaswitch is a Microsoft company _______________________________________________ stir mailing list stir@ietf.org https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/stir__;!!= N14HnBHF!uMBQq3BdfPK-btqymqh9RujfkE_CdEJz5U2PlK9vdKDLq2zB3LeWRWqGpd4$ --_000_DB79896528E241F79609BFC619FA928Dteamneustar_ Content-Type: text/html; charset="utf-8" Content-ID: <4F8D04AB51178C4C930ACEDE51B0C47B@namprd17.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJTZWdvZSBV SSI7DQoJcGFub3NlLTE6MiAxMSA2IDQgMiAyIDIgMiAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlv bnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2lu OjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250 LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5r DQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlv bjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21z by1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVu ZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJ e21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCglt YXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1s ZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmO30NCnAuZ21haWwtbS03NzkyODc1MDEyODk0ODQzNTQ1bXNvbGlzdHBhcmFncmFwaCwg bGkuZ21haWwtbS03NzkyODc1MDEyODk0ODQzNTQ1bXNvbGlzdHBhcmFncmFwaCwgZGl2LmdtYWls LW0tNzc5Mjg3NTAxMjg5NDg0MzU0NW1zb2xpc3RwYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLW5hbWU6 Z21haWwtbV8tNzc5Mjg3NTAxMjg5NDg0MzU0NW1zb2xpc3RwYXJhZ3JhcGg7DQoJbXNvLW1hcmdp bi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5 bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBl OmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJ e3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpk aXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlv bnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjEyMjE2NTM1NzsNCgltc28tbGlzdC10ZW1w bGF0ZS1pZHM6MjA2MzIzMjYwMDt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9s O30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxLjBpbjsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNp LWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVs Mw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3 Ow0KCW1zby1sZXZlbC10YWItc3RvcDoxLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7 DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWIt c3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3lt Ym9sO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7 DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDoyLjVpbjsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1h bnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxl dmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 74K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDozLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4w cHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10 YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6 U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDo0LjBpbjsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1z by1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGww OmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDo0LjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZTox MC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjQ5 MDk0OTU4ODsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTE0MDgyMTM0OTI7fQ0KQGxpc3QgbDE6 bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAu MHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDINCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6MS4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5 OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MS41aW47DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglt c28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBs MTpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mi4waW47DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6 MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDUNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6Mi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFt aWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6My4waW47 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsN Cgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlz dCBsMTpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6My41aW47DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNp emU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDgNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQt ZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NC41 aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVp bjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpv bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQotLT48 L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJw dXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QXQgYSBoaWdoIGxl dmVsLCBJ4oCZbSBmaW5lIHdpdGggc25lYWtpbmcgc29tZSBjbGFyaWZpY2F0aW9uIHRleHQgaW50 byB0aGUgc3BlYyBiZWZvcmUgd2UgcHVibGlzaCBpdCBhYm91dCB0cnVzdCBub3QgYmVpbmcgYXV0 b21hdGljLCBidXQgSSB0aGluayB0aGF0IHNlbnRpbWVudCBpcyBraW5kIG9mIGJ1aWx0IGludG8g ZXZlcnl0aGluZyB3ZeKAmXZlIHNhaWQgYWJvdXQgU1RJUiBmcm9tIHRoZSBzdGFydC48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+SGVyZSBpbiB0aGUgSUVURiwgYnJvYWRseSwgd2UgZG9u4oCZdCB0 ZWxsIHlvdSB3aG9zZSBzaWduYXR1cmVzIHlvdSBzaG91bGQgdHJ1c3Qgb3Igd2h5LiBJIHVuZGVy c3RhbmQgdGhhdCBvdmVyIGluIFNIQUtFTiwgdGhlcmUgYXJlIHdob2xlIGdvdmVybmFuY2Ugc3Ry dWN0dXJlcyB0aGF0IGV4aXN0IGZvciB0aGF0IHB1cnBvc2UuIEEgbG90IG9mIHRoZSBjb21wbGV4 aXR5IG9mIGRlY2lkaW5nIHdoZXRoZXIgcGFydGljdWxhcg0KIHNvdXJjZXMgb2YgcmV0YXJnZXRp bmcgc2hvdWxkIGJlIHRydXN0ZWQgbWF5IGVuZCB1cCB3b3JraW5nIGl0c2VsZiBvdXQgdW5kZXIg dGhhdCBmcmFtZXdvcmsuIFNpbWlsYXJseSwgdGhlIGFzc3VtZWQgU0hBS0VOIGFyY2hpdGVjdHVy ZSBkZXBlbmRzIG9uIGEgY2xvc2VkIG5ldHdvcmsgd2hlcmUgUEFTU3BvclRzIGRvbuKAmXQgdGVu ZCB0byB0cmlja2xlIGRvd24gZnJvbSBjYXJyaWVycyB0byBlbnRlcnByaXNlcywgbGV0IGFsb25l IGVuZCB1c2VycywNCiBzbyBzb21lIG9mIHRoZSBwb3RlbnRpYWwgZm9yIG1pc2NoaWVmIGlzIGFs c28gbWl0aWdhdGVkLiBBcyBmb3Igd2hhdCBlbmRzIHVwIGdldHRpbmcgZGlzcGxheWVkIHRvIHRo ZSB1c2VyLCBJIGRvdWJ0IHRoZXJl4oCZcyBtdWNoIGFwcGV0aXRlIGluIHRoZSBJUE5OSSBURiB0 byBtYWtlIHRoYXQgdG9vIGNvbXBsaWNhdGVkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5GaW5h bGx5LCBvbiB0aGUgcmVwdXRhdGlvbiBpc3N1ZSwgSSBhc3N1bWUgd2hvZXZlciB5b3UgZG9u4oCZ dCB0cnVzdCBpcyB0aGUgb25lIHdob3NlIHJlcHV0YXRpb24gbWlnaHQgYmUgYWZmZWN0ZWQuICZu YnNwO01heWJlIHRoZXJl4oCZcyBhbm90aGVyIHVzZSBjYXNlIGZvciAxODQgcmVzcG9uc2VzIGhl cmU/PGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Kb24g UGV0ZXJzb248bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk5ldXN0YXIsIElu Yy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEu MHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2Nv bG9yOmJsYWNrIj5Gcm9tOg0KPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBw dDtjb2xvcjpibGFjayI+SmFjayBSaWNrYXJkICZsdDtKYWNrLlJpY2thcmRAbWV0YXN3aXRjaC5j b20mZ3Q7PGJyPg0KPGI+RGF0ZTogPC9iPlRodXJzZGF5LCBKdWx5IDIzLCAyMDIwIGF0IDk6MDEg QU08YnI+DQo8Yj5UbzogPC9iPkRhdmlkIEhhbmNvY2sgJmx0O2RhdmlkaGFuY29jay5pZXRmQGdt YWlsLmNvbSZndDs8YnI+DQo8Yj5DYzogPC9iPiZxdW90O1BldGVyc29uLCBKb24mcXVvdDsgJmx0 O2pvbi5wZXRlcnNvbkB0ZWFtLm5ldXN0YXImZ3Q7LCAmcXVvdDtkcmFmdC1pZXRmLXN0aXItcGFz c3BvcnQtZGl2ZXJ0QGlldGYub3JnJnF1b3Q7ICZsdDtkcmFmdC1pZXRmLXN0aXItcGFzc3BvcnQt ZGl2ZXJ0QGlldGYub3JnJmd0OywgJnF1b3Q7c3RpckBpZXRmLm9yZyZxdW90OyAmbHQ7c3RpckBp ZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OiA8L2I+UkU6IFtzdGlyXSBQb3RlbnRpYWwgc2Vj dXJpdHkgdnVsbmVyYWJpbGl0eSBpbiBTVElSL0RJVjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPkkgdGhpbmsgdGhhdCB3b3VsZCB3b3JrLCBob3dldmVyIGl0 IHdvdWxkIGJlIHZlcnkgaGFyZCB0byBpbXBsZW1lbnQgaW4gYSB3YXkgdG8gYmUgaW5mYWxsaWJs ZS4gTW9zdCBTUHMgd2lsbCBoYXZlIG11bHRpcGxlIHNlcnZlcnMgaGFuZGxpbmcgdmVyaWZpY2F0 aW9uIGFuZCB3aGlsZSByYXBpZGx5IHN5bmNocm9uaXNpbmcgYSBsaXN0IG9mIGFsbCByZWNlbnRs eSBzZWVuDQogSWRlbnRpdHkgaGVhZGVycyBpcyBwb3NzaWJsZSwgaXQgYWRkcyBhIGxvdCBvZiBj b21wbGV4aXR5LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPkphY2s8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUx RTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PGI+RnJvbTo8L2I+IHN0aXIgJmx0O3N0aXItYm91 bmNlc0BpZXRmLm9yZyZndDsNCjxiPk9uIEJlaGFsZiBPZiA8L2I+RGF2aWQgSGFuY29jazxicj4N CjxiPlNlbnQ6PC9iPiAyMyBKdWx5IDIwMjAgMTY6MzU8YnI+DQo8Yj5Ubzo8L2I+IEphY2sgUmlj a2FyZCAmbHQ7SmFjay5SaWNrYXJkPTQwbWV0YXN3aXRjaC5jb21AZG1hcmMuaWV0Zi5vcmcmZ3Q7 PGJyPg0KPGI+Q2M6PC9iPiBQZXRlcnNvbiwgSm9uICZsdDtqb24ucGV0ZXJzb25AdGVhbS5uZXVz dGFyJmd0OzsgZHJhZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LWRpdmVydEBpZXRmLm9yZzsgc3RpckBp ZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW3N0aXJdIFBvdGVudGlhbCBzZWN1cml0 eSB2dWxuZXJhYmlsaXR5IGluIFNUSVIvRElWPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPHRhYmxlIGNsYXNzPSJNc29Ob3JtYWxUYWJsZSIgYm9yZGVyPSIwIiBj ZWxsc3BhY2luZz0iMCIgY2VsbHBhZGRpbmc9IjAiIGFsaWduPSJsZWZ0IiB3aWR0aD0iMTA1JSIg c3R5bGU9IndpZHRoOjEwNS4xMiU7Ym9yZGVyLWNvbGxhcHNlOmNvbGxhcHNlIj4NCjx0Ym9keT4N Cjx0cj4NCjx0ZCBzdHlsZT0iYmFja2dyb3VuZDojOTEwQTE5O3BhZGRpbmc6My4wcHQgMS41cHQg My4wcHQgMS41cHQiPjwvdGQ+DQo8dGQgd2lkdGg9Ijk1JSIgc3R5bGU9IndpZHRoOjk1LjEyJTti YWNrZ3JvdW5kOiNGREYyRjQ7cGFkZGluZzozLjBwdCAzLjc1cHQgMy4wcHQgMTEuMjVwdDt3b3Jk LXdyYXA6YnJlYWstd29yZCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLWVsZW1l bnQ6ZnJhbWU7bXNvLWVsZW1lbnQtZnJhbWUtaHNwYWNlOjIuMjVwdDttc28tZWxlbWVudC13cmFw OmFyb3VuZDttc28tZWxlbWVudC1hbmNob3ItdmVydGljYWw6cGFyYWdyYXBoO21zby1lbGVtZW50 LWFuY2hvci1ob3Jpem9udGFsOmNvbHVtbjttc28taGVpZ2h0LXJ1bGU6ZXhhY3RseSI+DQo8c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1NlZ29lIFVJJnF1b3Q7 LHNlcmlmO2NvbG9yOiMyMTIxMjEiPk5PVEU6IE1lc3NhZ2UgaXMgZnJvbSBhbiBleHRlcm5hbCBz ZW5kZXI8L3NwYW4+PG86cD48L286cD48L3A+DQo8L3RkPg0KPC90cj4NCjwvdGJvZHk+DQo8L3Rh YmxlPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Q291bGQgdGhlIHZlcmlm aWNhdGlvbiBzZXJ2aWNlIGluIHN0ZXAtNSBkZXRlY3QvYmxvY2sgdGhlIGF0dGFjayB1c2luZyB0 aGlzIHByb2NlZHVyZSBkZXNjcmliZWQgaW4gU2VjdGlvbiAxMi4xIG9mIFJGQyA4MjI0Pw0KPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7 ICZxdW90Oy4uLiBzZXJ2ZXJzIGNhbiBrZWVwPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7ICZu YnNwO3N0YXRlIG9mIHJlY2VudGx5IHJlY2VpdmVkIHJlcXVlc3RzLCBhbmQgdGh1cyBpZiBhbiBJ ZGVudGl0eSBoZWFkZXI8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDsgJm5ic3A7ZmllbGQgaXMg cmVwbGF5ZWQgYnkgYW4gYXR0YWNrZXIgd2l0aGluIHRoZSBEYXRlIGludGVydmFsLCB2ZXJpZmll cnM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDsgJm5ic3A7Y2FuIGRldGVjdCB0aGF0IGl0IGlz IHNwb29mZWQgYmVjYXVzZSBhIG1lc3NhZ2Ugd2l0aCBhbiBpZGVudGljYWw8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj4mbmJzcDsgJm5ic3A7RGF0ZSBmcm9tIHRoZSBzYW1lIHNvdXJjZSBoYWQgcmVjZW50 bHkgYmVlbiByZWNlaXZlZC4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj5EYXZpZCBIYW5jb2NrPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5D b21jYXN0PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj5PbiBUaHUsIEp1bCAyMywgMjAyMCBhdCA3OjIyIEFNIEphY2sgUmlja2FyZCAmbHQ7SmFj ay5SaWNrYXJkPTxhIGhyZWY9Im1haWx0bzo0MG1ldGFzd2l0Y2guY29tQGRtYXJjLi5pZXRmLm9y ZyI+NDBtZXRhc3dpdGNoLmNvbUBkbWFyYy5pZXRmLm9yZzwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxl ZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1s ZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9t OjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0Oi41aW4i Pg0KSSBhZ3JlZSB0aGF0IGRpdiBkb2VzIG1ha2UgdGhpcyBraW5kIG9mIGF0dGFjayBtb3JlIGRp ZmZpY3VsdCwgYW5kIHJlcXVpcmluZyB0aGF0IHRoZXJlIGlzIHNvbWUgdHJ1c3Qgb2YgZXZlcnkg cmV0YXJnZXRpbmcgZW50aXR5IGRvZXMgbWFrZSBzZW5zZS4gTXkgYXNzdW1wdGlvbiB3YXMgdGhh dCBieSBvbmx5IHRydXN0aW5nIHRoZSBzaWduZXJzIG9mIHRoZSBwYXNzcG9ydHMgSSBjYW4gdHJ1 c3QgdGhlIG9yaWcgaXMgdGhlIGVudGl0eSBjYWxsaW5nDQogbWUsIEkgbm93IHNlZSB5b3UgaGF2 ZSB0byB0cnVzdCB0aGUgc2lnbmVycyBhbmQgdGhlIGRpdmVydGluZyBwYXJ0aWVzLiBUbyBjbGFy aWZ5IHRoaXMgSSBwcm9wb3NlIHRoYXQgc29tZXRoaW5nIGxpa2UgeW91ciBleHBsYW5hdGlvbiBp cyBhZGRlZCB0byB0aGUgc3BlYywgaS5lLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KSXQgaXMgQ2Fyb2wgd2hvIG5lZWRzIHRvIGRlY2lk ZSBpZiBhIGZvcndhcmRlZCBjYWxsIGZyb20gQm9iIHNob3VsZCBiZSB0cnVzdGVkIG9yIG5vdCDi gJMg4oCcZGl24oCdIGlzIGNlcnRhaW5seSBub3Qgc3VnZ2VzdGluZyB0aGF0IHRydXN0IGlzIGF1 dG9tYXRpYywgbm9yIHRoYXQgdGhlIHByZXNlbmNlIG9mIGEg4oCcZGl24oCdIHRoYXQgY29ycmVj dGx5IGNoYWlucyB0byB0aGUgb3JpZ2luYWwgUEFTU3BvclQgaXMgYSBzdWJzdGl0dXRlIGZvciB0 aGUgcG9saWN5DQogYW5kIHRydXN0IGRlY2lzaW9uIG1hZGUgb24gdGhlIHRlcm1pbmF0aW5nIHNp ZGUgb2YgYSBjYWxsLiBBcyB3aXRoIGJhc2VsaW5lIFNUSVIsIGp1c3QgYmVjYXVzZSBzb21ldGhp bmcgdmFsaWRhdGVzIGF0IGEgcHJvdG9jb2wgbGV2ZWwgZG9lc27igJl0IG1lYW4geW91IHNob3Vs ZCB0cnVzdCBpdCwgbm9yIHRoYXQgbG9jYWwgcG9saWN5IGRvZXMgbm90IGRldGVybWluZSBob3cg eW91IHRyZWF0IGNhbGxzLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NClRvIGJlIGNsZWFyLCBteSBvcmlnaW5h bCBlbWFpbCB3YXMgYmFzZWQgb24gdGhlIGJlbGllZiB0aGF0IGRpdiBwYXNzcG9ydHMgd291bGQg cHJvdmlkZSBhICZxdW90O2NoYWluLW9mLXRydXN0JnF1b3Q7LCBhbGxvd2luZyB5b3UgdG8gZXNz ZW50aWFsbHkgaWdub3JlIHRoYXQgZGl2ZXJzaW9ucyBoYWQgb2NjdXJyZWQgb25jZSB5b3UgaGFk IGVzdGFibGlzaGVkIHRoZXJlIHdhcyBhIHZhbGlkIGNoYWluIG9mIGRpdiBwYXNzcG9ydHMgZnJv bSB0aGUgb3JpZ2luYXRvcg0KIHRvIHRoZSBmaW5hbCBkZXN0aW5hdGlvbi4gQWx0aG91Z2gsIGFm dGVyIHJlYWRpbmcgeW91ciByZXNwb25zZSBJIHJlYWxpc2UgdGhhdCdzIG5vdCB0aGUgY2FzZS48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4N CiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 Oi41aW4iPg0KTXkgd29ycnkgaXMgdGhhdCB0aGlzIG1vZGVsIG1ha2VzIGRpdiBkaWZmaWN1bHQg dG8gdXNlIGFuZCBwb2xpY2UgaW4gcHJhY3RpY2UsIHNwZWNpZmljYWxseTo8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJnbWFpbC1tLTc3OTI4NzUwMTI4OTQ4NDM1NDVtc29saXN0cGFyYWdyYXBo IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS4waW47dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0Omwx IGxldmVsMSBsZm8zIj4NCjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuMHB0O2ZvbnQtZmFtaWx5OlN5bWJvbCI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9y ZSI+wrc8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsi PiZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPlRoaXMgbW9kZWwgbWFrZXMg aW1wbGVtZW50YXRpb25zIG1vcmUgY29tcGxpY2F0ZWQgYXMgeW91IGNhbid0IHNlcGFyYXRlIHZl cmlmaWNhdGlvbiBmcm9tIHBvbGljeSBkZWNpc2lvbnMuIFlvdSBoYXZlIHRvIGZpbHRlciBvdXQg dW50cnVzdGVkIHBhcnRpZXMgYmVmb3JlIGRvaW5nIHRoZSBjaGFpbiBmaW5kaW5nIHN0ZXAgb2Yg dmVyaWZpY2F0aW9uLCBhcyBvdGhlcndpc2UgeW91IG1pZ2h0IGRlY2lkZQ0KIHVwb24gYSBjaGFp biBjb250YWluaW5nIGFuIHVudHJ1c3RlZCBwYXJ0eSB3aGVuIHRoZXJlIGRvZXMgZXhpc3QgYSB2 YWxpZCBjaGFpbiBjb250YWluaW5nIG9ubHkgdHJ1c3RlZCBwYXJ0aWVzIChncmFudGVkIHRoaXMg c2l0dWF0aW9uIGlzIHVubGlrZWx5KS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1t LTc3OTI4NzUwMTI4OTQ4NDM1NDVtc29saXN0cGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MS4waW47dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwxIGxldmVsMSBsZm8zIj4NCjwhW2lm ICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5 OlN5bWJvbCI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+wrc8c3BhbiBzdHlsZT0iZm9u dDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOw0KPC9zcGFuPjwvc3Bh bj48L3NwYW4+PCFbZW5kaWZdPlRoaXMgbW9kZWwgaW50cm9kdWNlcyBjb21wbGV4aXR5IGluIHdo YXQgc2hvdWxkIGJlIGRpc3BsYXllZCB0byBhIHVzZXIsIHRoZSBzaW1wbGUgdmVyaWZpZWQvbm90 IHZlcmlmaWVkIGNhbid0IGJlIHVzZWQgdW5sZXNzIHlvdSByZXF1aXJlIGNvbXBsZXRlIHRydXN0 IG9mIGFsbCBkaXZlcnRpbmcgcGFydGllcywgYW5kIHRoYXQgY291bGQgY2F1c2UgZmFsc2UgbmVn YXRpdmVzLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW0tNzc5Mjg3NTAxMjg5NDg0 MzU0NW1zb2xpc3RwYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjBpbjt0ZXh0LWluZGVu dDotLjI1aW47bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzMiPg0KPCFbaWYgIXN1cHBvcnRMaXN0c10+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6U3ltYm9sIj48c3BhbiBz dHlsZT0ibXNvLWxpc3Q6SWdub3JlIj7CtzxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1Rp bWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRp Zl0+SWYgYSBkaXZlcnRlZCBjYWxsIGRvZXMgZ2V0IHJlcG9ydGVkIGFzIGEgcm9ib2NhbGwsIGl0 J3Mgbm90IGNsZWFyIHdob3NlIHJlcHV0YXRpb24gc2hvdWxkIGJlIHRhcm5pc2hlZC4gSXQgbWF5 IGhhdmUgYmVlbiB0aGF0IHRoZSBvcmlnaW5hbCBjYWxsZXIgd2FzIGEgcm9ib2NhbGxlciBhbmQg dGhlIGNhbGwgZ290IGxlZ2l0aW1hdGVseSBkaXZlcnRlZCB0byB5b3UsIG9yIGl0IHdhcyB0aGUg YmVsb3cNCiBhdHRhY2sgd2hlcmUgdGhlIGNhbGxlciBpcyB0cnVzdHdvcnRoeSBidXQgdGhlIGRp dmVydGVyIHdhcyB0aGUgcm9ib2NhbGxlci48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KVGhhbmtzLDxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KSmFjazxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7 PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRv cDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPGI+RnJvbTo8L2I+IFBldGVyc29u LCBKb24gJmx0OzxhIGhyZWY9Im1haWx0bzpqb24ucGV0ZXJzb25AdGVhbS5uZXVzdGFyIj5qb24u cGV0ZXJzb25AdGVhbS5uZXVzdGFyPC9hPiZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiAyMiBKdWx5 IDIwMjAgMjM6NTM8YnI+DQo8Yj5Ubzo8L2I+IEphY2sgUmlja2FyZCAmbHQ7PGEgaHJlZj0ibWFp bHRvOkphY2suUmlja2FyZEBtZXRhc3dpdGNoLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPkphY2suUmlj a2FyZEBtZXRhc3dpdGNoLmNvbTwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOnN0aXJAaWV0Zi5v cmciIHRhcmdldD0iX2JsYW5rIj5zdGlyQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRy YWZ0LWlldGYtc3Rpci1wYXNzcG9ydC1kaXZlcnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIj4N CmRyYWZ0LWlldGYtc3Rpci1wYXNzcG9ydC1kaXZlcnRAaWV0Zi5vcmc8L2E+PGJyPg0KPGI+U3Vi amVjdDo8L2I+IFJlOiBQb3RlbnRpYWwgc2VjdXJpdHkgdnVsbmVyYWJpbGl0eSBpbiBTVElSL0RJ VjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDouNWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHRhYmxlIGNsYXNzPSJN c29Ob3JtYWxUYWJsZSIgYm9yZGVyPSIwIiBjZWxsc3BhY2luZz0iMCIgY2VsbHBhZGRpbmc9IjAi IGFsaWduPSJsZWZ0IiB3aWR0aD0iMTA1JSIgc3R5bGU9IndpZHRoOjEwNS4xMiU7Ym9yZGVyLWNv bGxhcHNlOmNvbGxhcHNlIj4NCjx0Ym9keT4NCjx0cj4NCjx0ZCBzdHlsZT0iYmFja2dyb3VuZDoj OTEwQTE5O3BhZGRpbmc6My4wcHQgMS41cHQgMy4wcHQgMS41cHQ7YmFja2dyb3VuZC1wb3NpdGlv bjppbml0aWFsIGluaXRpYWw7YmFja2dyb3VuZC1yZXBlYXQ6aW5pdGlhbCBpbml0aWFsIj4NCjwv dGQ+DQo8dGQgd2lkdGg9Ijk1JSIgc3R5bGU9IndpZHRoOjk1LjEyJTtiYWNrZ3JvdW5kOiNGREYy RjQ7cGFkZGluZzozLjBwdCAzLjc1cHQgMy4wcHQgMTEuMjVwdDt3b3JkLXdyYXA6YnJlYWstd29y ZDtiYWNrZ3JvdW5kLXBvc2l0aW9uOmluaXRpYWwgaW5pdGlhbDtiYWNrZ3JvdW5kLXJlcGVhdDpp bml0aWFsIGluaXRpYWwiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1lbGVtZW50OmZyYW1l O21zby1lbGVtZW50LWZyYW1lLWhzcGFjZToyLjI1cHQ7bXNvLWVsZW1lbnQtd3JhcDphcm91bmQ7 bXNvLWVsZW1lbnQtYW5jaG9yLXZlcnRpY2FsOnBhcmFncmFwaDttc28tZWxlbWVudC1hbmNob3It aG9yaXpvbnRhbDpjb2x1bW47bXNvLWhlaWdodC1ydWxlOmV4YWN0bHkiPg0KPHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtTZWdvZSBVSSZxdW90OyxzZXJpZjtj b2xvcjojMjEyMTIxIj5OT1RFOiBNZXNzYWdlIGlzIGZyb20gYW4gZXh0ZXJuYWwgc2VuZGVyPC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC90ZD4NCjwvdHI+DQo8L3Rib2R5Pg0KPC90YWJsZT4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBzdHls ZT0iY29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NClBvdGVudGlhbCDigJxiYWl0aW5n4oCdIGF0 dGFja3Mgb2YgdGhpcyBmb3JtIGVtZXJnZSB3aGVuIHlvdSBjb21iaW5lIGJhc2VsaW5lIFNUSVIg d2l0aCBjYWxsIGZvcndhcmRpbmcsIGFuZCBhcmUgdGhlIG1haW4gdGhyZWF0IGFydGljdWxhdGVk IGluIHRoZSBJRVRGIOKAnGRpduKAnSBkcmFmdC4gVGhlIGludHJvZHVjdGlvbiBkZXNjcmliZXMg dGhlbSBhcyBmb2xsb3dzOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xvcjpibGFjayI+Jm5ic3A7Jm5i c3A7IElmIEFsaWNlIGNhbGxzIEJvYiwgZm9yIGV4YW1wbGUsIEJvYiBtaWdodDwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3 JnF1b3Q7O2NvbG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsgYXR0ZW1wdCB0byBjdXQtYW5kLXBhc3Rl IHRoZSBJZGVudGl0eSBoZWFkZXIgZmllbGQgaW4gQWxpY2UncyBJTlZJVEU8L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3Bh biBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90Oztjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7IGludG8gYSBuZXcgSU5WSVRFIHRoYXQgQm9i IHNlbmRzIHRvIENhcm9sLCBhbmQgdGh1cyBiZSBhYmxlIHRvIGZvb2w8L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBz dHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90 Oztjb2xvcjpibGFjayI+Jm5ic3A7Jm5ic3A7IENhcm9sIGludG8gdGhpbmtpbmcgdGhlIGNhbGwg Y2FtZSBmcm9tIEFsaWNlIGFuZCBub3QgQm9iLiBXaXRoIHRoZTwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7O2Nv bG9yOmJsYWNrIj4mbmJzcDsmbmJzcDsgc2lnbmF0dXJlIG92ZXIgdGhlIFRvIGhlYWRlciBmaWVs ZCB2YWx1ZSwgdGhlIElOVklURSBDYXJvbCBzZWVzIHdpbGw8L3NwYW4+PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBzdHlsZT0i Zm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90Oztjb2xv cjpibGFjayI+Jm5ic3A7Jm5ic3A7IGNsZWFybHkgaGF2ZSBiZWVuIGRlc3RpbmVkIG9yaWdpbmFs bHkgZm9yIEJvYiwgYW5kIHRodXMgQ2Fyb2wgY2FuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDs7Y29sb3I6Ymxh Y2siPiZuYnNwOyZuYnNwOyB2aWV3IHRoZSBJTlZJVEUgYXMgc3VzcGVjdC48L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQombmJz cDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWlu Ij4NClRoYXQgZGVzY3JpYmVzIHRoZSBzaXR1YXRpb24gaW4gYSB3b3JsZCB3aXRob3V0IOKAnGRp duKAnSwgc28gdGhlIHF1ZXN0aW9uIGlzLCBkb2VzIOKAnGRpduKAnSBtYWtlIHRoZXNlIHNvcnRz IG9mIGF0dGFja3MgZWFzaWVyIHRvIGhhcmRlciB0byBtb3VudD88bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KV2l0aG91dCDi gJxkaXbigJ0sIGluIHRoZSBleGFtcGxlIGFib3ZlLCBDYXJvbCB3aWxsIHNlZSB0aGF0IHRoZSBv cmlnaW5hbCBjYWxsZWQgbnVtYmVyIGRvZXMgbm90IG1hdGNoIGhlcnMsIGFuZCBjYW4gZGVjaWRl IG9uIHRob3NlIGdyb3VuZHMgdG8gcmVqZWN0IHRoZSBjYWxsLiBCdXQgYmVhciBpbiBtaW5kIHRo aXMgaXMgYWxzbyB3aGF0IENhcm9sIHdvdWxkIHNlZSBpbiBsZWdpdGltYXRlIGZvcndhcmRpbmcg Y2FzZXMsIHNvIGEgbW9yZSBudWFuY2VkDQogbG9naWMgd291bGQgcHJvYmFibHkgYmUgdXNlZC4g U2hlIGNvdWxkIGRlY2lkZSB0aGF0IGlmIHRoZSBvcmlnaW5hbCBjYWxsZWQgbnVtYmVyIGlzIGEg bnVtYmVyIHRoYXQgc2hvdWxkIGJlIGZvcndhcmRpbmcgY2FsbHMgdG8gaGVyIChzYXksIGlmIGl0 IHdhcyBoZXIgb2ZmaWNlKSwgdGhhdCBzaGUgc2hvdWxkIGFjY2VwdCB0aGUgY2FsbCBhbnl3YXku IFlvdSBjb3VsZCBldmVuIGltYWdpbmUgYXBwbGljYXRpb24gYmVoYXZpb3IgdGhhdCB3b3VsZA0K IGVuZm9yY2UgcG9saWNpZXMgYWxvbmcgdGhvc2UgbGluZXMgb24gaGVyIGJlaGFsZi4gSG93ZXZl ciwgQ2Fyb2wgaGFzIG5vIGFzc3VyYW5jZSB0aGF0IGl0IHdhcyByZWFsbHkgaGVyIG9mZmljZSB0 aGF0IGZvcndhcmRlZCB0aGlzIGNhbGwsIHJhdGhlciB0aGFuIHNvbWUgZWF2ZXNkcm9wcGVyIHdo byBzb21laG93IGNhcHR1cmVkIHRoZSBQQVNTcG9yVCwgbm9yIGhvdyBtYW55IHRpbWVzIGl0IG1p Z2h0IGhhdmUgYmVlbiByZWRpcmVjdGVkIGJlZm9yZQ0KIHJlYWNoaW5nIGhlciwgb3IgYW55dGhp bmcgYWxvbmcgdGhvc2UgbGluZXMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NClRob3NlIGFyZSB0aGUgZ2FwcyB0aGF0IOKA nGRpduKAnSBpcyBtZWFudCB0byBmaWxsLiBJdCBpcyBub3QgYSBzdWJzdGl0dXRlIGZvciB0aGUg cmVzdCBvZiB0aGUgbG9naWMgYW5kIHBvbGljeSBkZXNjcmliZWQgYWJvdmUsIGJ1dCBpdCBnaXZl cyBDYXJvbCBtb3JlIGluZm9ybWF0aW9uIHRvIGhlbHAgZmlndXJlIG91dCBpZiB0aGUgY2FsbCBp cyBzdXNwZWN0IGFuZCB3aGF0IHRvIGRvIGFib3V0IGl0LiBXaXRoIOKAnGRpduKAnSwgd2hhdCBD YXJvbCBzZWVzIGlzDQogYSBzZWNvbmQgUEFTU3BvclQgY3JlYXRlZCBhbmQgc2lnbmVkIGJ5IEJv Yiwgd2hpY2ggYWN0dWFsbHkgZ2l2ZXMgQ2Fyb2wgdGhlIGFzc3VyYW5jZSBvZiB3aGV0aGVyIHRo ZSBpbnRlbmRlZCBjYWxsZWQgcGFydHkgaXMgb25lIHdobyByZXRhcmdldGVkIHRoZSBjYWxsLCB3 aGljaCB5b3UgZG9u4oCZdCBnZXQgaW4gdGhlIGFic2VuY2Ugb2Yg4oCcZGl24oCdLiBJZiBCb2Ig aXMgZG9pbmcgdGhpcyBtYWxpY2lvdXNseSwgdGhlIOKAnGRpduKAnSBoZSBwcm92aWRlZA0KIGhh cyBnaXZlbiBDYXJvbCB0aGUgbWVhbnMgdG8gaHVudCBoaW0gZG93biBmb3IgcmVkcmVzcywgd2hp Y2ggaXMgbm90IGV4YWN0bHkgYSBzdHJvbmcgaW5jZW50aXZlIGZvciBoaW0gdG8gdXNlIOKAnGRp duKAnS4gQnV0IGF0IHRoZSBlbmQgb2YgdGhlIGRheSwgaXQgaXMgQ2Fyb2wgd2hvIG5lZWRzIHRv IGRlY2lkZSBpZiBhIGZvcndhcmRlZCBjYWxsIGZyb20gQm9iIHNob3VsZCBiZSB0cnVzdGVkIG9y IG5vdCDigJMg4oCcZGl24oCdIGlzIGNlcnRhaW5seSBub3QNCiBzdWdnZXN0aW5nIHRoYXQgdHJ1 c3QgaXMgYXV0b21hdGljLCBub3IgdGhhdCB0aGUgcHJlc2VuY2Ugb2YgYSDigJxkaXbigJ0gdGhh dCBjb3JyZWN0bHkgY2hhaW5zIHRvIHRoZSBvcmlnaW5hbCBQQVNTcG9yVCBpcyBhIHN1YnN0aXR1 dGUgZm9yIHRoZSBwb2xpY3kgYW5kIHRydXN0IGRlY2lzaW9uIG1hZGUgb24gdGhlIHRlcm1pbmF0 aW5nIHNpZGUgb2YgYSBjYWxsLiBBcyB3aXRoIGJhc2VsaW5lIFNUSVIsIGp1c3QgYmVjYXVzZSBz b21ldGhpbmcgdmFsaWRhdGVzDQogYXQgYSBwcm90b2NvbCBsZXZlbCBkb2VzbuKAmXQgbWVhbiB5 b3Ugc2hvdWxkIHRydXN0IGl0LCBub3IgdGhhdCBsb2NhbCBwb2xpY3kgZG9lcyBub3QgZGV0ZXJt aW5lIGhvdyB5b3UgdHJlYXQgY2FsbHMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCkJ1dCBhbGwgdGhhdCBzYWlkLCBpZiB5 b3XigJlyZSBzZXJpb3VzIGFib3V0IHNlY3VyaXR5LCB0aGVuIHllcywgdXNpbmcgRFRMUy1TUlRQ IHdpdGgg4oCcbWtleeKAnSBpcyBnb2luZyB0byBwcm92aWRlIHlvdSB3aXRoIGEgYmV0dGVyIGFz c3VyYW5jZS4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6LjVpbiI+DQpKb24gUGV0ZXJzb248bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCk5ldXN0YXIsIEluYy48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAj QjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0O2NvbG9yOmJsYWNrIj5KYWNrIFJpY2thcmQgJmx0Ozwvc3Bhbj48YSBocmVmPSJtYWls dG86SmFjay5SaWNrYXJkQG1ldGFzd2l0Y2guY29tIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMi4wcHQiPkphY2suUmlja2FyZEBtZXRhc3dpdGNoLmNvbTwvc3Bhbj48 L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPiZndDs8YnI+DQo8 Yj5EYXRlOiA8L2I+V2VkbmVzZGF5LCBKdWx5IDIyLCAyMDIwIGF0IDk6NDcgQU08YnI+DQo8Yj5U bzogPC9iPiZxdW90Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86c3RpckBpZXRmLm9yZyIgdGFyZ2V0 PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij5zdGlyQGlldGYub3JnPC9z cGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+JnF1b3Q7 ICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnN0aXJAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5r Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+c3RpckBpZXRmLm9yZzwvc3Bhbj48L2E+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPiZndDssDQogJnF1b3Q7 PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpkcmFmdC1pZXRmLXN0aXItcGFzc3BvcnQtZGl2ZXJ0QGll dGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPmRy YWZ0LWlldGYtc3Rpci1wYXNzcG9ydC1kaXZlcnRAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj4mcXVvdDsgJmx0Ozwvc3Bhbj48YSBo cmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LWRpdmVydEBpZXRmLm9yZyIgdGFy Z2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij5kcmFmdC1pZXRmLXN0 aXItcGFzc3BvcnQtZGl2ZXJ0QGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEyLjBwdDtjb2xvcjpibGFjayI+Jmd0OywNCiAmcXVvdDtQZXRlcnNvbiwgSm9uJnF1b3Q7 ICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmpvbi5wZXRlcnNvbkB0ZWFtLm5ldXN0YXIiIHRh cmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+am9uLi5wZXRlcnNv bkB0ZWFtLm5ldXN0YXI8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2Nv bG9yOmJsYWNrIj4mZ3Q7PGJyPg0KPGI+U3ViamVjdDogPC9iPlBvdGVudGlhbCBzZWN1cml0eSB2 dWxuZXJhYmlsaXR5IGluIFNUSVIvRElWPGJyPg0KPGI+UmVzZW50LUZyb206IDwvYj4mbHQ7PC9z cGFuPjxhIGhyZWY9Im1haWx0bzphbGlhcy1ib3VuY2VzQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFu ayI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPmFsaWFzLWJvdW5jZXNAaWV0Zi5vcmc8 L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj4mZ3Q7 PGJyPg0KPGI+UmVzZW50LVRvOiA8L2I+Jmx0Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86am9uLnBl dGVyc29uQHRlYW0ubmV1c3RhciIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0Ij5qb24ucGV0ZXJzb25AdGVhbS5uZXVzdGFyPC9zcGFuPjwvYT48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+Jmd0Ozxicj4NCjxiPlJlc2VudC1EYXRl OiA8L2I+V2VkbmVzZGF5LCBKdWx5IDIyLCAyMDIwIGF0IDk6NDcgQU08L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpIZWxsbyw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpJIGJlbGlldmUgSSd2 ZSBjb21lIGFjcm9zcyBhIHNlY3VyaXR5IHZ1bG5lcmFiaWxpdHkgaW4gdGhlIFNUSVIgc3lzdGVt IHRoYXQgaXMgbWFkZSBleHBsb2l0YWJsZSBieSB0aGUgaW50cm9kdWN0aW9uIG9mIERJViBwYXNz cG9ydHMsIHRoYXQgSSBoYXZlbid0IHNlZW4gZGlzY3Vzc2VkIGhlcmUgaW4gYW55IGRldGFpbCAo c29ycnkgaWYgaXQgaGFzIGJlZW4pLiBUaGVyZSBhcmUgY3VycmVudGx5IG1pdGlnYXRpb25zIGZv ciBpdCBpbiB0aGUgcGFzc3BvcnQNCiBzcGVjLCBob3dldmVyIEkgZG9uJ3QgYmVsaWV2ZSB0aGV5 IGdvIGZhciBlbm91Z2ggdG8gcHJldmVudCB0aGlzIGF0dGFjay48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpUaGUgaGln aCBsZXZlbCBzdW1tYXJ5IGlzIHRoYXQgYW4gYXR0YWNrZXIgY2FuIGltcGVyc29uYXRlIGFuIGVu dGl0eSB0aGF0IGNhbGxlZCB0aGVtIGJ5IHByZXRlbmRpbmcgdGhleSByZWRpcmVjdGVkIHRoYXQg Y2FsbCB0byB0aGUgcmVjaXBpZW50LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCkFuIGV4YW1wbGU6PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0K VHJ1c3RlZDogQSBwYXJ0eSB0cnVzdGVkIGJ5IFN1YmplY3QsIHdoaWNoIEF0dGFja2VyIHdpc2hl cyB0byBpbXBlcnNvbmF0ZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0OjEuMGluIj4NCkF0dGFja2VyOiBUaGUgcGFydHkgd2lzaGluZyB0byBpbXBlcnNv bmF0ZSBUcnVzdGVkPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6MS4waW4iPg0KU3ViamVjdDogVGhlIGludGVuZGVkIHRhcmdldCBvZiBBdHRhY2tlciwg d2hvIHdpbGwgc2VlIGEgdmVyaWZpZWQgY2FsbCBjb21pbmcgZnJvbSBUcnVzdGVkPG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7 PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iZ21haWwtbS03NzkyODc1MDEyODk0ODQzNTQ1bXNv bGlzdHBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEuNWluIj4NCjEuPHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo3LjBwdDtmb250LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDss c2VyaWYiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyA8L3NwYW4+DQpBdHRh Y2tlciBnZXRzIFRydXN0ZWQgdG8gY2FsbCB0aGVtLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 ImdtYWlsLW0tNzc5Mjg3NTAxMjg5NDg0MzU0NW1zb2xpc3RwYXJhZ3JhcGgiIHN0eWxlPSJtYXJn aW4tbGVmdDoxLjVpbiI+DQpUaGlzIGlzIGEgcmVhc29uYWJsZSBvcGVyYXRpb24sIGFuZCBpcyBh Y3R1YWxseSBxdWl0ZSBhIGNvbW1vbiBmZWF0dXJlIG9mIHN1cHBvcnQgY29tcGFuaWVzIHNvIHlv dSBkb24ndCBoYXZlIHRvIHNpdCBvbiBob2xkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Imdt YWlsLW0tNzc5Mjg3NTAxMjg5NDg0MzU0NW1zb2xpc3RwYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4t bGVmdDoxLjVpbiI+DQoyLjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7LHNlcmlmIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsgPC9zcGFuPg0KQXR0YWNrZXIgYW5zd2Vycy9yZWplY3RzIHRoZSBjYWxs IGFuZCBzYXZlcyBvZmYgdGhlIFNIQUtFTiBwYXNzcG9ydCBmb3IgVHJ1c3RlZCAtJmd0OyBBdHRh Y2tlci48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tLTc3OTI4NzUwMTI4OTQ4NDM1 NDVtc29saXN0cGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KMy48c3BhbiBz dHlsZT0iZm9udC1zaXplOjcuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21hbiZx dW90OyxzZXJpZiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IDwvc3Bhbj4N CkF0dGFja2VyIHNldHMgdXAgYSByZWRpcmVjdCBmcm9tIHRoZW0gdG8gdGhlaXIgaW50ZW5kZWQg U3ViamVjdC48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tLTc3OTI4NzUwMTI4OTQ4 NDM1NDVtc29saXN0cGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KNC48c3Bh biBzdHlsZT0iZm9udC1zaXplOjcuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RpbWVzIE5ldyBSb21h biZxdW90OyxzZXJpZiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IDwvc3Bh bj4NCkF0dGFja2VyIGNvbnN0cnVjdHMgYSBjYWxsIChjbGFpbWluZyB0byBiZSkgZnJvbSBUcnVz dGVkIHRvIEF0dGFja2VyIHdpdGggdGhlIHByZXZpb3VzbHkgc2F2ZWQgU0hBS0VOIHBhc3Nwb3J0 LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9ImdtYWlsLW0tNzc5Mjg3NTAxMjg5NDg0MzU0NW1z b2xpc3RwYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDoxLjVpbiI+DQo1LjxzcGFuIHN0eWxl PSJmb250LXNpemU6Ny4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7 LHNlcmlmIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgPC9zcGFuPg0KVGhl IGNhbGwgd2lsbCBiZSB2ZXJpZmllZCwgdGhlbiByZWRpcmVjdGVkIHRvIFN1YmplY3Qgd2l0aCBh IERJViBwYXNzcG9ydCBmb3IgQXR0YWNrZXIgLSZndDsgU3ViamVjdC48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJnbWFpbC1tLTc3OTI4NzUwMTI4OTQ4NDM1NDVtc29saXN0cGFyYWdyYXBoIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KVGhpcyBkb2VzIHJlbHkgb24gdGhlIGNlcnRpZmlj YXRlIHNpZ25pbmcgdGhlIERJViB0byBiZWxvbmcgdG8gYSB0cnVzdGVkIGVudGl0eSwgdGhpcyBz ZWVtcyBwb3NzaWJsZSwgYXMgdGhlIHJlZGlyZWN0IGNvdWxkIGJlIGNhcnJpZWQgb3V0IGJ5IEF0 dGFja2VyJ3Mgc2VydmljZSBwcm92aWRlci48YnI+DQpBdHRhY2tlcidzIFNQIG1heSByZWZ1c2Ug dG8gcmVkaXJlY3QgYWZ0ZXIgc29tZSB0aW1lIGR1ZSB0byBJYVQgdGltZW91dHMsIGJ1dCB0aGlz IGlzIG5vdCByZXF1aXJlZCBieSB0aGUgc3BlYyBhbmQgSSBiZWxpZXZlIHRoaXMgY2FuIGJlIHdv cmtlZCBhcm91bmQgYnksIGZvciBleGFtcGxlLCByZXBlYXRlZGx5IGJvdW5jaW5nIG5ldyBjYWxs cyBvZmYgYW4gYWNjb21wbGljZS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tLTc3 OTI4NzUwMTI4OTQ4NDM1NDVtc29saXN0cGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41 aW4iPg0KNi48c3BhbiBzdHlsZT0iZm9udC1zaXplOjcuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Rp bWVzIE5ldyBSb21hbiZxdW90OyxzZXJpZiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IDwvc3Bhbj4NClN1YmplY3QgcmVjZWl2ZXMgYSBjYWxsIGNsYWltaW5nIHRvIGJlIGZy b20gVHJ1c3RlZCAoYWxiZWl0IHJlZGlyZWN0ZWQgZnJvbSBBdHRhY2tlcikgd2l0aCBhIHZhbGlk IHBhc3Nwb3J0IGNoYWluIG9mIFRydXN0ZWQgLSZndDsgQXR0YWNrZXIgLSZndDsgU3ViamVjdC48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJnbWFpbC1tLTc3OTI4NzUwMTI4OTQ4NDM1NDVtc29s aXN0cGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MS41aW4iPg0KQm90aCBwYXNzcG9ydHMg d2lsbCBiZSBzaWduZWQgYnkgdHJ1c3RlZCBlbnRpdGllczogVHJ1c3RlZCdzIFNQIGFuZCBBdHRh Y2tlcidzIFNQLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0OjEuNWluIj4NCklhVCBkb2Vzbid0IHByb3ZpZGUgbXVjaCBwcm90ZWN0aW9uIGhlcmUgYXMs IGluIHRoZSBwcmVzZW5jZSBvZiBESVYgcGFzc3BvcnRzLCB0aGUgdmFsaWQgdGltZSByYW5nZSBt dXN0IGJlIHNldCByZWFzb25hYmx5IGhpZ2ggdG8gYWxsb3cgZm9yIHRoZSBwb3NzaWJpbGl0eSBv ZiByaW5nLWFyb3VuZHMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6MS41aW4iPg0KVGhlIG9yaWdpZCBhbmQgYXR0ZXN0IHdpbGwgYmUgYXNzb2NpYXRl ZCB3aXRoIFRydXN0ZWQsIGVyb2RpbmcgYW55IGF1dG9tYXRlZCBkYXRhYmFzZXMgb2Ygcm9ib2Nh bGxzIGJhc2VkIG9uIHRoZSBvcmlnaWQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KVGhl ICZxdW90O21reSZxdW90OyBjbGFpbSBzZWVtcyB0byBiZSB0aGUgc29sdXRpb24gdGhhdCBpcyBj dXJyZW50bHkgYnVpbHQgaW50byBwYXNzcG9ydHMsIGhvd2V2ZXIsIGl0IGlzIGN1cnJlbnRseSBv cHRpb25hbCwgYW5kIGFzIGZhciBhcyBJIGFtIGF3YXJlIHVzaW5nIGNlcnRpZmljYXRlcyB0byBh dXRoZW50aWNhdGUgdGhlIGVuZHMgb2YgYSBtZWRpYSBzdHJlYW0gaXMgdmVyeSByYXJlIGluIHBy YWN0aWNlLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 OjEuMGluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0OjEuMGluIj4NClVuZm9ydHVuYXRlbHksIEknbSBub3QgYWJsZSB0byBjb21lIHVw IHdpdGggYSBzb2x1dGlvbiBhbmQgSSBhbSBob3BpbmcgdGhhdCBpcyB3aGVyZSB5b3Ugd2lsbCBi ZSBhYmxlIHRvIHN0ZXAgaW4uIEkgYmVsaWV2ZSB0byBhdm9pZCB0aGlzLCB0aGVyZSBuZWVkcyB0 byBiZSBtb3JlIHZhbGlkYXRpb24gb2YgdGhlIG1lZGlhIHN0cmVhbSB0aGF0IGlzIGNyZWF0ZWQs IGVpdGhlciBpbiB0aGUgZm9ybSBvZiBtb3JlIGRhdGEgYmVpbmcgc2lnbmVkIG9yDQogZW5mb3Jj aW5nIHRoYXQgdGhlIG1lZGlhIHBhcnRpY2lwYW50cyBhcmUgYXV0aGVudGljYXRlZC48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJz cDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBp biI+DQpUaGFuayB5b3UsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6MS4waW4iPg0KPGI+SmFjayBSaWNrYXJkIHwgU29mdHdhcmUgRW5naW5lZXIgfCBN ZXRhc3dpdGNoPC9iPiA8YnI+DQpUaGUgRmFzdGVyIFdheSBGb3J3YXJkPGJyPg0KT2ZmaWNlICYj NDM7NDQgMjAgODE5NiA5ODAxPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6MS4waW4iPg0KTWV0YXN3aXRjaCBpcyBhIE1pY3Jvc29mdCBjb21wYW55PG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0K Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+X19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpzdGlyIG1haWxpbmcgbGlzdDxicj4NCjxh IGhyZWY9Im1haWx0bzpzdGlyQGlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+c3RpckBpZXRmLm9y ZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3VybGRlZmVuc2UuY29tL3YzL19faHR0cHM6L25h bTAxLnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMqM0EqMkYqMkZ3 d3cuaWV0Zi5vcmcqMkZtYWlsbWFuKjJGbGlzdGluZm8qMkZzdGlyJmFtcDtkYXRhPTAyKjdDMDEq N0NqYWNrLnJpY2thcmQqNDBtZXRhc3dpdGNoLmNvbSo3Q2Q1MzFiOTIwMTYzMDQwN2QyZDA0MDhk ODJmMWUwNTcwKjdDOWQ5ZTU2ZWJmNjEzNGRkYmIyN2JiZmNkZjE0YjJjZGIqN0MxKjdDMCo3QzYz NzMxMTE1MzI5MTM0MDcwOSZhbXA7c2RhdGE9M2dERWVvN2hFTG8qMkZFKjJGVzBqTHJZSEVzQjdt Qll5TXV2dVZPWmNLSSoyQjh5TSozRCZhbXA7cmVzZXJ2ZWQ9MF9fO0pTVWxKU1VsSlNVbEpTVWxK U1VsSlNVbCEhTjE0SG5CSEYhcERwVGh1Z2FmQ21jNktZcmRZRHE4OG9nUGpKYXZlSE5lblFDQnM2 M19MTll2UTdSSG1FS2dWTW03aXZqWS1jYzY4TUNmQSQiIHRhcmdldD0iX2JsYW5rIj5odHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3N0aXI8L2E+PG86cD48L286cD48L3A+DQo8 L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_DB79896528E241F79609BFC619FA928Dteamneustar_-- From nobody Thu Jul 23 14:21:56 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F8C73A0DF2; Thu, 23 Jul 2020 14:21:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R9xv4SOjJr7x; Thu, 23 Jul 2020 14:21:41 -0700 (PDT) Received: from taper.sei.cmu.edu (taper.sei.cmu.edu [147.72.252.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 718973A0DEF; Thu, 23 Jul 2020 14:21:41 -0700 (PDT) Received: from delp.sei.cmu.edu (delp.sei.cmu.edu [10.64.21.31]) by taper.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id 06NLLdp8002817; Thu, 23 Jul 2020 17:21:40 -0400 DKIM-Filter: OpenDKIM Filter v2.11.0 taper.sei.cmu.edu 06NLLdp8002817 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cert.org; s=yc2bmwvrj62m; t=1595539300; bh=XQQjLlprno/BXFHYCKNsZVxkRjlO2el/jdgiuwqiXnA=; h=From:To:CC:Subject:Date:References:In-Reply-To:From; b=h7Ij0qxyEKkcgyTjiqEkGcqvocLwK97W7T9Fyf5/MJa+k5nhIWttV1GMeXhqjLK0z fJCqQtNgTXlAYzFzx63OZDB0wiC3pQMI2Wlt2X3Na2UQEqDqLsDkxUkZE+PFEvpBee up0LnUHNlWSPV7sDq0WmePo+JNdZAfYgdQ3Crb2o= Received: from CASCADE.ad.sei.cmu.edu (cascade.ad.sei.cmu.edu [10.64.28.248]) by delp.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id 06NLLaxk023047; Thu, 23 Jul 2020 17:21:36 -0400 Received: from MORRIS.ad.sei.cmu.edu (147.72.252.46) by CASCADE.ad.sei.cmu.edu (10.64.28.248) with Microsoft SMTP Server (TLS) id 14.3.487.0; Thu, 23 Jul 2020 17:21:36 -0400 Received: from MORRIS.ad.sei.cmu.edu (147.72.252.46) by MORRIS.ad.sei.cmu.edu (147.72.252.46) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1979.3; Thu, 23 Jul 2020 17:21:35 -0400 Received: from MORRIS.ad.sei.cmu.edu ([fe80::555b:9498:552e:d1bb]) by MORRIS.ad.sei.cmu.edu ([fe80::555b:9498:552e:d1bb%13]) with mapi id 15.01.1979.003; Thu, 23 Jul 2020 17:21:35 -0400 From: Roman Danyliw To: "Peterson, Jon" , The IESG CC: "draft-ietf-stir-passport-divert@ietf.org" , "stir-chairs@ietf.org" , "stir@ietf.org" , Russ Housley Thread-Topic: Roman Danyliw's Discuss on draft-ietf-stir-passport-divert-08: (with DISCUSS and COMMENT) Thread-Index: AQHWDRO22bvVjHncxEG2etgqsSydqakGcGkAgA/jmLA= Date: Thu, 23 Jul 2020 21:21:34 +0000 Message-ID: <86c8afb58f3f436daeb1dc94e8686c88@cert.org> References: <158628812675.31223.5976532284560812662@ietfa.amsl.com> <905688A3-7259-4AE3-8AF5-22102A1FF1B6@team.neustar> In-Reply-To: <905688A3-7259-4AE3-8AF5-22102A1FF1B6@team.neustar> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.202.156] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [stir] Roman Danyliw's Discuss on draft-ietf-stir-passport-divert-08: (with DISCUSS and COMMENT) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2020 21:21:44 -0000 SGkgSm9uIQ0KDQpUaGFua3MgZm9yIHRoZSBleHBsYW5hdGlvbnMgYmVsb3cgYW5kIHRoZSB1cGRh dGVkIHRleHQgaW4gLTA5LiAgSXQgYWRkcmVzc2VzIG15IGNvbmNlcm5zIGFuZCBJIHdpbGwgY2xl YXIgbXkgYmFsbG90Lg0KDQpSZWdhcmRzLA0KUm9tYW4NCg0KPiAtLS0tLU9yaWdpbmFsIE1lc3Nh Z2UtLS0tLQ0KPiBGcm9tOiBQZXRlcnNvbiwgSm9uIDxqb24ucGV0ZXJzb25AdGVhbS5uZXVzdGFy Pg0KPiBTZW50OiBNb25kYXksIEp1bHkgMTMsIDIwMjAgMTA6NDIgQU0NCj4gVG86IFJvbWFuIERh bnlsaXcgPHJkZEBjZXJ0Lm9yZz47IFRoZSBJRVNHIDxpZXNnQGlldGYub3JnPg0KPiBDYzogZHJh ZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LWRpdmVydEBpZXRmLm9yZzsgc3Rpci1jaGFpcnNAaWV0Zi5v cmc7IHN0aXJAaWV0Zi5vcmc7DQo+IFJ1c3MgSG91c2xleSA8aG91c2xleUB2aWdpbHNlYy5jb20+ DQo+IFN1YmplY3Q6IFJlOiBSb21hbiBEYW55bGl3J3MgRGlzY3VzcyBvbiBkcmFmdC1pZXRmLXN0 aXItcGFzc3BvcnQtZGl2ZXJ0LTA4Og0KPiAod2l0aCBESVNDVVNTIGFuZCBDT01NRU5UKQ0KPiAN Cj4gDQo+IEhpIFJvbWFuLA0KPiANCj4gVGhhbmtzIGZvciB0aGUgbm90ZXMgb24gdGhpczsgc29y cnkgZm9yIHRha2luZyBhIHdoaWxlIHRvIGdldCBhcm91bmQgdG8gdGhlbS4NCj4gDQo+ICAgICBS b21hbiBEYW55bGl3IGhhcyBlbnRlcmVkIHRoZSBmb2xsb3dpbmcgYmFsbG90IHBvc2l0aW9uIGZv cg0KPiAgICAgZHJhZnQtaWV0Zi1zdGlyLXBhc3Nwb3J0LWRpdmVydC0wODogRGlzY3Vzcw0KPiAN Cj4gICAgIC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0NCj4gICAgIERJU0NVU1M6DQo+ICAgICAtLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t DQo+IA0KPiAgICAgU2VjdGlvbiA1LiAgVGhlIHRleHQgbm90ZXMgdGhhdCBwcm9jZWR1cmVzIGZv ciB0aGUgYXV0aGVudGljYXRpb24gYW5kDQo+ICAgICB2ZXJpZmljYXRpb24gc2VydmljZSBmb3Ig dGhlIOKAnGRpdi1v4oCdIGNsYWltIHdpbGwgYmUg4oCcbGVmdCB0byBmdXR1cmUgd29ya+KAnS4g IENhbg0KPiAgICAgdGhlIHJhdGlvbmFsIGZvciB0aGlzIGRlZmVycmFsIGJlIGV4cGxhaW5lZC4g IENyZWF0aW5nIGFuIGludGVyb3BlcmFibGUNCj4gICAgIHNvbHV0aW9uIHdpdGhvdXQgdGhpcyBn dWlkYW5jZSBzZWVtIGNoYWxsZW5naW5nIGFzIGl0IHdvdWxkIGJlIGNydWNpYWwNCj4gZ3VpZGFu Y2UNCj4gICAgIG9uIHByb2Nlc3NpbmcgdGhpcyBuZXdseSBpbnRyb2R1Y2VkIGNsYWltLg0KPiAN Cj4gVGhpcyAtMDggdGV4dCBtb3N0bHkgcmVzdWx0ZWQgZnJvbSBhIHByb2Nlc3MgbWF0dGVyLiBU byBnZXQgaW50byB0aGUgZG9jdW1lbnQNCj4gaGlzdG9yeSBhIGJpdCwgd2hlbiB3ZSBtb3ZlZCBz dGlyLW9vYiBvZmYgdGhlIFN0YW5kYXJkcyBUcmFjayB0byBhbg0KPiBJbmZvcm1hdGlvbmFsIGlu IHRoZSBsYXRlIHN0YWdlcyBvZiBpdHMgZGV2ZWxvcG1lbnQsIHdlIHN0aWxsIHdhbnRlZCAiZGl2 IiB0byBiZQ0KPiBmdXR1cmUtcHJvb2Ygd2hlbi9pZiBzdGFuZGFyZHMtdHJhY2sgd29yayBiYXNl ZCBvbiB0aGUgT09CIGZyYW1ld29yayByb2xsZWQNCj4gYXJvdW5kIChsaWtlIGZvciBleGFtcGxl IHRoZSBuZXcgT09CIHNlcnZwcm92aWRlciBkcmFmdCBpbiBTVElSKS4gT3VyIHNvbHV0aW9uDQo+ IHdhcyB0byB1cGxldmVsOiB0byBzcGVjaWZ5ICJkaXYtbyIgYXMgc29tZXRoaW5nIG5vdCBzcGVj aWZpY2FsbHkgY291cGxlZCB0byBPT0IsDQo+IGJ1dCBpbnN0ZWFkIGFzIGEgZ2VuZXJhbCBtZWNo YW5pc20gdGhhdCBjb3VsZCBiZSB1c2VkIGJ5IE9PQiBvciBvdGhlcg0KPiBwcm90b2NvbHMgdGhh dCBtaWdodCBwcmVmZXIgdG8gdXNlIG5lc3RlZCAiZGl2LW8iIHN0eWxlIFBBU1Nwb3JUcy4gVGhh dCBpc24ndCBhbg0KPiBlbnRpcmVseSBjeW5pY2FsIG1vdmUsIGFzIHdlIGFudGljaXBhdGUgdGhh dCBwcm90b2NvbHMgb3RoZXIgdGhhbiBTSVAgd2lsbCB1c2UNCj4gdGhlIFBBU1Nwb3JUIG1lY2hh bmlzbSwgYW5kIG1pZ2h0IHdhbnQgdG8gdXNlIHRoZSBuZXN0ZWQgYXBwcm9hY2ggb2YgImRpdi0N Cj4gbyIuDQo+IA0KPiBJIHRoaW5rIHdpdGhpbiB0aG9zZSBjb25zdHJhaW50cywgSSBjYW4gdGhy ZWFkIHRoZSBuZWVkbGUgd2l0aCBzb21lIHVzZWZ1bCB0ZXh0DQo+IGFib3V0IHRoZSBub24tU0lQ IEFTL1ZTIGJlaGF2aW9yIGFzc29jaWF0ZWQgd2l0aCB0aGUgY3JlYXRpb24gb2YgImRpdi1vIg0K PiBQQVNTcG9yVHMgaW4gYSB3YXkgdGhhdCBtYWtlcyBubyBleHBsaWNpdCByZWZlcmVuY2UgdG8g T09CIGFzIHN1Y2gsIGJ1dCB3b3VsZA0KPiBhcHBseSBlcXVhbGx5IGlmIHNheSBYTVBQIG9yIFJU Q1dlYiBvciBzb21lIHNpbWlsYXIgbWVjaGFuaXNtIHdhbnRlZCB0bw0KPiBtYWtlIHVzZSBvZiBQ QVNTcG9yVCBhbmQgbmVzdGVkICJkaXYiLiBJJ3ZlIGFkZGVkIHNvbWUgdGV4dCB0byB0aGlzIGVm ZmVjdCwNCj4gd2hpY2ggSSBob3BlIGlzIHN1ZmZpY2llbnQgLSBsZXQgbWUga25vdyBpZiBpdCBp c24ndC4NCj4gDQo+ICAgICAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQo+ICAgICBDT01NRU5UOg0KPiAgICAgLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLQ0KPiANCj4gICAgIFBsZWFzZSByZXNwb25kIHRvIFBoaWxsaXAgSGFsbGFtLUJh a2VyIFNFQ0RJUiByZXZpZXcgKHRoYW5rcyBQaGlsbGlwISkNCj4gDQo+IERvbmUuDQo+IA0KPiAg ICAgKiogU2VjdGlvbiA0LjEuICBQZXIg4oCcUHJvdmlkZWQgdGhhdCB0aGVzZSBQQVNTcG9yVHMg c2hhcmUgdGhlIHNhbWUgIm9yaWciDQo+IGFuZA0KPiAgICAgImRlc3QiIHZhbHVlcywgdGhlIHJl dGFyZ2V0aW5nIGVudGl0eSdzIGF1dGhlbnRpY2F0aW9uIHNlcnZpY2UgU0hPVUxEDQo+IGdlbmVy YXRlDQo+ICAgICBvbmx5IG9uZSAiZGl2IiBQQVNTcG9yVOKAnSwgd2h5IG5vdCAgTVVTVCBoZXJl PyAgV2hhdOKAmXMgdGhlIGNvcm5lciBjYXNlPw0KPiANCj4gT25lIGNvcm5lciBjYXNlIEkgY2Fu IGltYWdpbmUgaXMgd2hlcmUgZGl2ZXJ0cyBmcm9tIHNwZWNpYWwtdXNlIFBBU1Nwb3JUcyBuZWVk DQo+IHRvIGJlIHNpZ25lZCB3aXRoIGEgY2VydGlmaWNhdGUgaXNzdWVkIGJ5IGEgb25lLW9mZiB0 cnVzdCBhbmNob3IuIFNheSwgZHVlIHRvIHRoZQ0KPiBnb3Zlcm5tZW50IHBvbGljeSBjb25zdHJh aW50cyBvZiB0aGUgInJwaCIgaGVhZGVyIG9yIHNvbWV0aGluZyBzaW1pbGFyLCB5b3UNCj4gbmVl ZCB0byBzaWduIGEgImRpdiIgZm9yIGl0cyBQQVNTcG9yVCB3aXRoIGEgZGlmZmVyZW50IGNyZWRl bnRpYWwgdGhhbiB5b3Ugd291bGQNCj4gdXNlIHRvIHNpZ24gYSAiZGl2IiBmb3Igb3JkaW5hcnkg Y2FycmllciBjYWxscy4gTm90IGEgY29tbW9uIGNhc2UsIGJ1dCwgSSBkb24ndA0KPiB3YW50IHRv IGNsb3NlIHRoZSBkb29yIG9uIGl0Lg0KPiANCj4gICAgICoqIFNlY3Rpb24gNC4yLiAgUGVyIOKA nEhvd2V2ZXIsIG5vdGUgdGhhdCBpbiBzb21lIHVzZSBjYXNlcywgaW5jbHVkaW5nICBjZXJ0YWlu DQo+ICAgICB3YXlzIHRoYXQgYmxpbmQgdHJhbnNmZXIgaXMgaW1wbGVtZW50ZWQsIGl0IGlzIHBv c3NpYmxlIHRoYXQgYW4gZXN0YWJsaXNoZWQNCj4gICAgIGNhbGwgd2lsbCBiZSByZXRhcmdldGVk IGxvbmcgYWZ0ZXIgaXQgaGFzIG9yaWdpbmFsbHkgYmVlbiBwbGFjZWQsIGFuZA0KPiAgICAgdmVy aWZpY2F0aW9uIHNlcnZpY2VzIG1heSB3YW50IHRvIGFsbG93IGEgbG9uZ2VyIHdpbmRvdyBmb3Ig dGhlIGZyZXNobmVzcyBvZg0KPiAgICAgdGhlIGlubmVybW9zdCBQQVNTcG9yVCBpZiB0aGUgY2Fs bCBpcyB0cmFuc2ZlcnJlZCBmcm9tIGEgdHJ1c3RlZCBwYXJ0eS7igJ0sIGFyZQ0KPiAgICAgdGhl cmUgYW55IHJlY29tbWVuZGF0aW9ucyBvciBib3VuZHMgdGhhdCBjYW4gYmUgcGxhY2VkIG9uIHRo ZSBkdXJhdGlvbiBvZg0KPiB0aGlzDQo+ICAgICDigJxsb25nZXIgd2luZG93IG9mIGZyZXNobmVz c+KAnT8NCj4gDQo+IFVuZm9ydHVuYXRlbHksIG5vdCBvbmVzIHRoYXQgYXJlIGltbWVuc2VseSB1 c2VmdWwgLSBtYXliZSBsaWtlIDMgaG91cnM/DQo+IEF0dGVuZGVkIHRyYW5zZmVyIHNlcnZpY2Vz IGNhbiBiZSB0cmlnZ2VyZWQgYW55IHRpbWUgaW50byBhIGNhbGwgLSBpZiB5b3UndmUgZXZlcg0K PiBnb25lIHRocm91Z2ggZXNjYWxhdGlvbiB3aXRoIGEgYmFuayBjb21wYW55IGN1c3RvbWVyIHNl cnZpY2UgbGluZSwgeW91J3ZlDQo+IHByb2JhYmx5IGV4cGVyaWVuY2VkIG11bHRpcGxlIHN1Y2gg dHJhbnNmZXJzIGR1cmluZyBhIHNpbmdsZSBjYWxsIHdoaWNoIGJlZ2lucw0KPiB3aXRoIHlvdSBi ZWluZyBvbiBob2xkIGZvciA0NSBtaW51dGVzLCBhbmQgeW91IGNhbiBlYXNpbHkgc3BlbmQgdGVu IG1pbnV0ZXMNCj4gdGFsa2luZyB0byBvbmUgYWdlbnQgYmVmb3JlIHlvdSBlbmQgdXAgb24gdGhl IGxpbmUgd2l0aCBhbm90aGVyLiBJIHRoaW5rIHRoZQ0KPiAidHJ1c3RlZCBwYXJ0eSIgcG9ydGlv biBoZXJlIGlzIHRoZSBzaWduaWZpY2FudCBiaXQgLSB0aGF0IHJlbHlpbmcgcGFydGllcyBzaG91 bGQNCj4gb25seSBhY2NlcHQgdGhlc2Uga2luZHMgb2Ygc3RhbGUgUEFTU3BvclRzIHdpdGhpbiBh IGNsb3NlZCBjaXJjbGUgb2YgdHJ1c3QuIFN0aWxsLA0KPiBjYWxscyBkb24ndCBsYXN0IGZvciBs aWtlIGEgd2Vlaywgc28gdGhlcmUgbXVzdCBiZSBzb21lIHVwcGVyIGJvdW5kIGhlcmUuIEkgY2Fu DQo+IHB1dCBpbiAzIGhvdXJzIGFzIGEgc29mdCByZWNvbW1lbmRhdGlvbiwgSSBndWVzcywgaWYg aXQgaGVscHMuLi4NCj4gDQo+ICAgICAqKiBFZGl0b3JpYWwgTml0Og0KPiANCj4gICAgIC0tIFNl Y3Rpb24gMy4gVHlwby4gcy9pZGVudGlmaWllci9pZGVudGlmaWVyLw0KPiANCj4gRml4ZWQuIFRo YW5rcyENCj4gDQo+IEpvbiBQZXRlcnNvbg0KPiBOZXVzdGFyLCBJbmMuDQo+IA0KPiANCj4gDQo+ IA0KDQo= From nobody Fri Jul 24 07:43:47 2020 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id BDBD43A0B9A; Fri, 24 Jul 2020 07:43:37 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 7.10.0 Auto-Submitted: auto-generated Precedence: bulk Cc: The IESG , housley@vigilsec.com, rfc-editor@rfc-editor.org, stir@ietf.org, draft-ietf-stir-passport-divert@ietf.org, Russ Housley , superuser@gmail.com, stir-chairs@ietf.org MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-ID: <159560181775.3973.9329379591717759065@ietfa.amsl.com> Date: Fri, 24 Jul 2020 07:43:37 -0700 Archived-At: Subject: [stir] Protocol Action: 'PASSporT Extension for Diverted Calls' to Proposed Standard (draft-ietf-stir-passport-divert-09.txt) X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2020 14:43:38 -0000 The IESG has approved the following document: - 'PASSporT Extension for Diverted Calls' (draft-ietf-stir-passport-divert-09.txt) as Proposed Standard This document is the product of the Secure Telephone Identity Revisited Working Group. The IESG contact persons are Murray Kucherawy and Barry Leiba. A URL of this Internet Draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-passport-divert/ Technical Summary PASSporT is specified in RFC 8225 to convey cryptographically-signed information about the people involved in personal communications. This document extends PASSporT to include an indication that a call has been diverted from its original destination to a new one. This information can greatly improve the decisions made by verification services in call forwarding scenarios. Also specified here is an encapsulation mechanism for nesting a PASSporT within another PASSporT that assists relying parties in some diversion scenarios. Working Group Summary The STIR WG reached consensus, and there is strong support for publication of this document. Document Quality Several people have expressed interest in implementing this specification. Personnel Russ Housley is the document shepherd. Murray "Trouble" Kucherawy is the responsible Area Director. From nobody Fri Jul 24 09:11:01 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 32FDE3A0ECB for ; Fri, 24 Jul 2020 09:11:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.003 X-Spam-Level: X-Spam-Status: No, score=-2.003 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, NICE_REPLY_A=-0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=alum.mit.edu Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KBs6Sxg6iYBM for ; Fri, 24 Jul 2020 09:10:58 -0700 (PDT) Received: from NAM11-BN8-obe.outbound.protection.outlook.com (mail-bn8nam11on2054.outbound.protection.outlook.com [40.107.236.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE22A3A0EC6 for ; Fri, 24 Jul 2020 09:10:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=JOMcVC5QMDDm++rtaCpbxPxeM8i8ZuyJL4b7qLGjKqKCUh3e4xon/IhkCm7oEDJDXZf6mIa6TRHpJepco7+IvRJzwZcdAMmEvtev0Z6M5zlMsZN5ddEOVJxNHcsENbLys0T4cR4DPFfQjRHQEXCIi+jNwRDQfe9QFhT0E5NBmuU5ePHRRVF0AMO28q+dIOdlf9VUEZHpG3nRYpAQ/1eKyP84Giq+hbo8lqo99MAZmon7nUCokTCVRLBUEBlm6eoX6gVJ58h7Cg/rQW49jkABMMjaQNYRPyVp10MvS8t7pYWdAGC1mnRvz0fcVXaDtn60xD4wkb4PLALPfrP2qSnrhA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=33d1NzNtiGb/lJZr6p309Mf95S3KenYClNXEKjw0/Y8=; b=OvebqmXEfCxHkzmI7KMMzlgsTfZdHSaCkPNRuoolGg0gZXlniNjSNHE0mpu4VXuNnnKK1pqsCCif0U2F+uxeH56g6xtg6a5bWyxBBKs3c2g5YV9fxUnRHbwsZh0wTvSPjeozVoInAP1/jYU/ey4/517BhlzFqxFzjslQNPwgdg/+2A/qpsnLOTJ7NOEWZR55ifJI4RZnPveeJiOOldwOHamz24871MlngsYvjGrk1tRXOeVWtMAJbdEWA8NCfezl9yeXclMp9aYtnuEgSk5nzazk9Cwa/8k6Aqj4iePTFxjBoWYN7HMSjRi51CM+luTByLl5lQDGIerGy9NMtey8WA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 18.7.68.33) smtp.rcpttodomain=ietf.org smtp.mailfrom=alum.mit.edu; dmarc=bestguesspass action=none header.from=alum.mit.edu; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alum.mit.edu; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=33d1NzNtiGb/lJZr6p309Mf95S3KenYClNXEKjw0/Y8=; b=hMWYkvO+oU9FDhjnQxe2bCUptYk7aVFtzQC5KNyhUcnImwheRIPaRoRU2U5Kq4QV+TapYEQAYd/X1Ys/ms/aSzyE+MpoX/zWYl6Vd7YhX+cQLRnBlrBgq/yygqkOyDXhHQlT+TyG2JIrhHR8mX8hOi6CsNDHnvgEDDC7xzC4fXg= Received: from CY4PR06CA0055.namprd06.prod.outlook.com (2603:10b6:903:13d::17) by SA0PR12MB4414.namprd12.prod.outlook.com (2603:10b6:806:9a::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.24; Fri, 24 Jul 2020 16:10:56 +0000 Received: from CY1NAM02FT056.eop-nam02.prod.protection.outlook.com (2603:10b6:903:13d:cafe::ca) by CY4PR06CA0055.outlook.office365.com (2603:10b6:903:13d::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.21 via Frontend Transport; Fri, 24 Jul 2020 16:10:56 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 18.7.68.33) smtp.mailfrom=alum.mit.edu; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=bestguesspass action=none header.from=alum.mit.edu; Received-SPF: Pass (protection.outlook.com: domain of alum.mit.edu designates 18.7.68.33 as permitted sender) receiver=protection.outlook.com; client-ip=18.7.68.33; helo=outgoing-alum.mit.edu; Received: from outgoing-alum.mit.edu (18.7.68.33) by CY1NAM02FT056.mail.protection.outlook.com (10.152.74.160) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.10 via Frontend Transport; Fri, 24 Jul 2020 16:10:55 +0000 Received: from Kokiri.localdomain (c-24-62-227-142.hsd1.ma.comcast.net [24.62.227.142]) (authenticated bits=0) (User authenticated as pkyzivat@ALUM.MIT.EDU) by outgoing-alum.mit.edu (8.14.7/8.12.4) with ESMTP id 06OGArK7024932 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT) for ; Fri, 24 Jul 2020 12:10:54 -0400 To: stir@ietf.org References: <89AC11DC-7E1A-4D1E-9CB8-96C98E790EF5@team.neustar> From: Paul Kyzivat Message-ID: Date: Fri, 24 Jul 2020 12:10:53 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 0a87aadb-9afd-40f2-c889-08d82fec256f X-MS-TrafficTypeDiagnostic: SA0PR12MB4414: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: Wk6XnuqkiYVYbpl+zOpa6qOUfZbq2SIafOq7qh4x7XVfnihS3ZLpeGS58ZfoWtcZqxcCCcbHUoLTse82VhtU6M1PepVcrgNujaT34MCubBFRS9r8dEalOta/RsmUBMmxsKFKASM/x2xNznQ4pgnhahEZ+mcPShKi9oqOR1aX5z3cs/VyRVYs1gzAMtibaGXK5s1CipNWySRg1Fa1I5qfYF2Esh/ytUqgBUjrAmwF0HzBrFp7uE//mng3iW7WeBmbxFbfEepexwrxjq2TC+6AsQ4zO4wKnSlEsGOo1SXSNVGhkdfll4QA6Ea1xOlFRj78y6NoB7j0FdRpxI0k5OL9CxZsr2dhgyh5ffEunFRdWeVallR3t4DCBskXC6l1tlr6XrsSydOAWODbCmQaSVsZA6ZqDaJppJQEKEoNbGPkg29mDOLak5YwPzfz/IMR71gz X-Forefront-Antispam-Report: CIP:18.7.68.33; CTRY:US; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:outgoing-alum.mit.edu; PTR:outgoing-alum.mit.edu; CAT:NONE; SFTY:; SFS:(136003)(346002)(39860400002)(396003)(376002)(46966005)(786003)(8936002)(316002)(82740400003)(70206006)(86362001)(70586007)(6916009)(75432002)(5660300002)(31686004)(47076004)(31696002)(356005)(8676002)(82310400002)(36906005)(7596003)(2906002)(53546011)(26005)(186003)(83380400001)(336012)(956004)(2616005)(15650500001)(508600001)(43740500002); DIR:OUT; SFP:1101; X-OriginatorOrg: alum.mit.edu X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Jul 2020 16:10:55.7066 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 0a87aadb-9afd-40f2-c889-08d82fec256f X-MS-Exchange-CrossTenant-Id: 3326b102-c043-408b-a990-b89e477d582f X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3326b102-c043-408b-a990-b89e477d582f; Ip=[18.7.68.33]; Helo=[outgoing-alum.mit.edu] X-MS-Exchange-CrossTenant-AuthSource: CY1NAM02FT056.eop-nam02.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4414 Archived-At: Subject: Re: [stir] Potential security vulnerability in STIR/DIV X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2020 16:11:00 -0000 See below On 7/23/20 9:22 AM, Jack Rickard wrote: > I agree that div does make this kind of attack more difficult, and > requiring that there is some trust of every retargeting entity does make > sense. My assumption was that by only trusting the signers of the > passports I can trust the orig is the entity calling me, I now see you > have to trust the signers and the diverting parties. To clarify this I > propose that something like your explanation is added to the spec, i.e. > > It is Carol who needs to decide if a forwarded call from Bob should be > trusted or not – “div” is certainly not suggesting that trust is > automatic, nor that the presence of a “div” that correctly chains to the > original PASSporT is a substitute for the policy and trust decision made > on the terminating side of a call. As with baseline STIR, just because > something validates at a protocol level doesn’t mean you should trust > it, nor that local policy does not determine how you treat calls. > > To be clear, my original email was based on the belief that div > passports would provide a "chain-of-trust", allowing you to essentially > ignore that diversions had occurred once you had established there was a > valid chain of div passports from the originator to the final > destination. Although, after reading your response I realise that's not > the case. > > My worry is that this model makes div difficult to use and police in > practice, specifically: > > * This model makes implementations more complicated as you can't > separate verification from policy decisions. You have to filter out > untrusted parties before doing the chain finding step of > verification, as otherwise you might decide upon a chain containing > an untrusted party when there does exist a valid chain containing > only trusted parties (granted this situation is unlikely). > * This model introduces complexity in what should be displayed to a > user, the simple verified/not verified can't be used unless you > require complete trust of all diverting parties, and that could > cause false negatives. > * If a diverted call does get reported as a robocall, it's not clear > whose reputation should be tarnished. It may have been that the > original caller was a robocaller and the call got legitimately > diverted to you, or it was the below attack where the caller is > trustworthy but the diverter was the robocaller. When a call is diverted, isn't it possible for the diverting party to be in the media path? If so then you ought not accept diverted calls unless you really trust the diverting party. Thanks, Paul From nobody Sat Jul 25 13:23:48 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40BB13A0AA4 for ; Sat, 25 Jul 2020 13:23:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RjAy7MV8yYga for ; Sat, 25 Jul 2020 13:23:45 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 632883A0AA3 for ; Sat, 25 Jul 2020 13:23:45 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id BD135300B6C for ; Sat, 25 Jul 2020 16:23:42 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id rbLNcywd5har for ; Sat, 25 Jul 2020 16:23:41 -0400 (EDT) Received: from a860b60074bd.fios-router.home (pool-72-66-113-56.washdc.fios.verizon.net [72.66.113.56]) by mail.smeinc.net (Postfix) with ESMTPSA id 65640300A55 for ; Sat, 25 Jul 2020 16:23:41 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.15\)) Message-Id: <9A4C44C8-8C35-4B73-96AF-A755A3C8FA63@vigilsec.com> References: To: IETF STIR Mail List Date: Sat, 25 Jul 2020 16:23:42 -0400 X-Mailer: Apple Mail (2.3445.104.15) Archived-At: Subject: [stir] Visit NomCom during office hours X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Jul 2020 20:23:48 -0000 If anyone is interested in finding out more about NomCom or about = standing for a leadership position, please visit with NomCom during = office hours next week. Russ > I wanted to let everyone know that NomCom will be holding some office = hours next week. If you want to stop by and talk with us (just to say = Hi, ask about NomCom, ask about being a nominee for the various I* = positions, etc.), we'd love to see and hear from you. >=20 > The date and times (which are also posted on the IETF 108 Agenda) are: >=20 > Monday, July 27, 16:00-17:00 UTC WebEx: = https://ietf.webex.com/ietf/j.php?MTID=3Dm13c41ae118e538b6d25efb25d41307ee= > Tuesday, July 28, 09:30-10:30 UTC WebEx: = https://ietf.webex.com/ietf/j.php?MTID=3Dm6132b48c3eac5469a41043ce55dada20= > Thursday, July 30, 20:00-21:00 UTC WebEx: = https://ietf.webex.com/ietf/j..php?MTID=3Dmf7ce451931e35818fd7b3bf44abd102= 6 >=20 > In addition to being available by WebEx, those of us who can will = simultaneously be on Gather.Town (possibly in a special NomCom corner). = To find us, the easiest way is to go to the Participants list (at right = of the Gather screen), find "Barbara Stark", left click on my name and = select "Locate". >=20 > See you next week! > Barbara=20 >=20 From nobody Fri Jul 31 08:29:46 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 818E13A0529 for ; Fri, 31 Jul 2020 08:29:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JoIc352HHzAs for ; Fri, 31 Jul 2020 08:29:42 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D9C433A03EC for ; Fri, 31 Jul 2020 08:29:42 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 4E6C9300464 for ; Fri, 31 Jul 2020 11:29:40 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id GtTKL_5RpMWb for ; Fri, 31 Jul 2020 11:29:39 -0400 (EDT) Received: from a860b60074bd.fios-router.home (pool-72-66-113-56.washdc.fios.verizon.net [72.66.113.56]) by mail.smeinc.net (Postfix) with ESMTPSA id 3791A300B10 for ; Fri, 31 Jul 2020 11:29:39 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.15\)) Date: Fri, 31 Jul 2020 11:29:40 -0400 References: <8372C576-08B7-41C4-B021-38622BABAD25@vigilsec.com> To: IETF STIR Mail List In-Reply-To: <8372C576-08B7-41C4-B021-38622BABAD25@vigilsec.com> Message-Id: <919FC584-18AF-4419-B174-B9FB37B6439D@vigilsec.com> X-Mailer: Apple Mail (2.3445.104.15) Archived-At: Subject: [stir] WG Last Call for draft-ietf-stir-rph-emergency-services-02 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jul 2020 15:29:45 -0000 This is the STIR WG Last Call for "Assertion Values for a Resource = Priority Header Claim and a SIP Priority Header Claim in Support of = Emergency Services Networks=E2=80=9D = . Please review the document = and send your comments to the STIR WG mail list by 22 August 2020. https://datatracker.ietf.org/doc/draft-ietf-stir-rph-emergency-services/ Thanks, Robert & Russ From nobody Fri Jul 31 08:35:21 2020 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 58C893A0827; Fri, 31 Jul 2020 08:35:18 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Secretariat To: , , X-Test-IDTracker: no X-IETF-IDTracker: 7.12.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159620971801.341.5287781807282921335@ietfa.amsl.com> Date: Fri, 31 Jul 2020 08:35:18 -0700 Archived-At: Subject: [stir] The STIR WG has placed draft-peterson-stir-servprovider-oob in state "Candidate for WG Adoption" X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jul 2020 15:35:20 -0000 The STIR WG has placed draft-peterson-stir-servprovider-oob in state Candidate for WG Adoption (entered by Russ Housley) The document is available at https://datatracker.ietf.org/doc/draft-peterson-stir-servprovider-oob/ From nobody Fri Jul 31 08:36:00 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D2243A0881 for ; Fri, 31 Jul 2020 08:35:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1fb6IDf4NERy for ; Fri, 31 Jul 2020 08:35:57 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 112BB3A0846 for ; Fri, 31 Jul 2020 08:35:57 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 90A50300B53 for ; Fri, 31 Jul 2020 11:35:54 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id vYPh698EgWze for ; Fri, 31 Jul 2020 11:35:53 -0400 (EDT) Received: from a860b60074bd.fios-router.home (pool-72-66-113-56.washdc.fios.verizon.net [72.66.113.56]) by mail.smeinc.net (Postfix) with ESMTPSA id A633F300464 for ; Fri, 31 Jul 2020 11:35:53 -0400 (EDT) From: Russ Housley Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.15\)) Date: Fri, 31 Jul 2020 11:35:55 -0400 References: <157429966624.922.6336772483106473689.idtracker@ietfa.amsl.com> <41B1930A-2631-47D3-8693-62363B9C5639@vigilsec.com> To: IETF STIR Mail List In-Reply-To: <41B1930A-2631-47D3-8693-62363B9C5639@vigilsec.com> Message-Id: X-Mailer: Apple Mail (2.3445.104.15) Archived-At: Subject: [stir] Call For Adoption of draft-peterson-stir-servprovider-oob X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jul 2020 15:35:59 -0000 Please take a look at draft-peterson-stir-servprovider-oob. Please = indicate whether you support adoption of this document by the STIR WG. = Please respond before 23 August 2020. If you support adoption, please = indicate whether you would review or implement. This document can be found in the datatracker at = https://datatracker.ietf.org/doc/draft-peterson-stir-servprovider-oob/ Russ & Robert From nobody Fri Jul 31 08:58:19 2020 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE4553A08C6 for ; Fri, 31 Jul 2020 08:58:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vqQ0_tWOl6dO for ; Fri, 31 Jul 2020 08:58:16 -0700 (PDT) Received: from mail-oi1-x233.google.com (mail-oi1-x233.google.com [IPv6:2607:f8b0:4864:20::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D35C3A0A93 for ; Fri, 31 Jul 2020 08:56:29 -0700 (PDT) Received: by mail-oi1-x233.google.com with SMTP id o21so6377110oie.12 for ; Fri, 31 Jul 2020 08:56:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=fzDKzsZpTJDmn056nStGD7olfhamXufU7P9tQf5jHvc=; b=SvJX+QhdZYOG8W54a4fWXrYI6PFXuwGZoXMXuLIwPNO7WfZXqtbZRZFr/Hc3D1WG58 K6HeTfVMj+Bolhok20mdBUfZyDcwe8p9r1y/138x30f/1FWFKh5VSUT0gsUvWv7femp4 uhMqOAU329gqlYm11h4kC9+o5SbGtK/n6ZrrZRFmFW/HMZqZe96WkeYCwpyMcB3dZTpT JeT8LgqEcy7vCC1kypyjflA25XumU8oYYHNjFrS0o01NrvfdKLuH0uDtuDT1DeKapncR ZchLsrILHdgvUrG9Zrya0E9LnhXTWBY6XRhK3E5gneJDVLiMhyri5cj7CEUb3EuHHBgQ RaEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=fzDKzsZpTJDmn056nStGD7olfhamXufU7P9tQf5jHvc=; b=umn1d1KPectZO2TG6dtFvLy+6TL5Rwo6NiROM/zMNlgOtNnTAXupDi9A9HsM7/9DLp w+VAhqARWR3oCoYaieu4Z8F31JEyegGurDg3R/SW3eBOnghqsYby/vk1aiK1LZ9nOe4a 6kUJ5oT7ssgZ6xhZbd1T3mrfzrDmV98WfatVw2H2XTdKD/CBhwb+JRL3sTS8j2MqAJud iIb6hAcfoAVDAf/Thwc9nHo3JPT7+i87ZhGDJTukDQOAmeFvnaD6Ei7dfplVtgXs0l6C y7aPQM9nYY6VTNCDuwf4T3lsYmIerdg3ImfRUDadn//Yj6JjXD6DYxf+KAhGOFywLucL VysQ== X-Gm-Message-State: AOAM531VI8w/mHMH5Ss/llmZkYZVj3JO9j5CQec78d5zs0rCKBc6VHeT qas86dkcizi1xucvQ6MG6h+jUlde0r0yZdt+o8JeHw== X-Google-Smtp-Source: ABdhPJxvN/zbepigeVruzDNyEAilbF+75u5yrwpfIl3dKK3OvIBszaB/6+BvFgztaaVCMC7iln5/Rd7mhDP4/gi6mSI= X-Received: by 2002:aca:d595:: with SMTP id m143mr3273607oig.11.1596210988555; Fri, 31 Jul 2020 08:56:28 -0700 (PDT) MIME-Version: 1.0 References: <157429966624.922.6336772483106473689.idtracker@ietfa.amsl.com> <41B1930A-2631-47D3-8693-62363B9C5639@vigilsec.com> In-Reply-To: From: Mary Barnes Date: Fri, 31 Jul 2020 10:56:17 -0500 Message-ID: To: Russ Housley Cc: IETF STIR Mail List Content-Type: multipart/alternative; boundary="000000000000f59f8805abbed4bc" Archived-At: Subject: Re: [stir] Call For Adoption of draft-peterson-stir-servprovider-oob X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jul 2020 15:58:18 -0000 --000000000000f59f8805abbed4bc Content-Type: text/plain; charset="UTF-8" I support the adoption and am willing to review. Regards, Mary. On Fri, Jul 31, 2020 at 10:36 AM Russ Housley wrote: > Please take a look at draft-peterson-stir-servprovider-oob. Please > indicate whether you support adoption of this document by the STIR WG. > Please respond before 23 August 2020. If you support adoption, please > indicate whether you would review or implement. > > This document can be found in the datatracker at > https://datatracker.ietf.org/doc/draft-peterson-stir-servprovider-oob/ > > Russ & Robert > > _______________________________________________ > stir mailing list > stir@ietf.org > https://www.ietf.org/mailman/listinfo/stir > --000000000000f59f8805abbed4bc Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I support the adoption and am willing to review.

<= /div>
Regards,
Mary.=C2=A0

On Fri, Jul 31, 2020 at 10:36= AM Russ Housley <housley@vigils= ec.com> wrote:
Please take a look at draft-peterson-stir-servprovider-oob. Please in= dicate whether you support adoption of this document by the STIR WG.=C2=A0 = Please respond before 23 August 2020.=C2=A0 If you support adoption, please= indicate whether you would review or implement.

This document can be found in the datatracker at https://datatracker.ietf.org/doc/draft-peterson-stir-ser= vprovider-oob/

Russ & Robert

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir
--000000000000f59f8805abbed4bc--