From benl@google.com Tue Feb 4 09:08:23 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8AF7A1A011D for ; Tue, 4 Feb 2014 09:08:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.914 X-Spam-Level: X-Spam-Status: No, score=-1.914 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F8avCrhTBZD0 for ; Tue, 4 Feb 2014 09:08:21 -0800 (PST) Received: from mail-ve0-x231.google.com (mail-ve0-x231.google.com [IPv6:2607:f8b0:400c:c01::231]) by ietfa.amsl.com (Postfix) with ESMTP id 69E411A011C for ; Tue, 4 Feb 2014 09:08:21 -0800 (PST) Received: by mail-ve0-f177.google.com with SMTP id jz11so6097096veb.8 for ; Tue, 04 Feb 2014 09:08:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=FbVuVeMzdGVew+B+1jxF3rRUYE06UiDSZihNY0nk240=; b=EEeHXGc9zXLEdtRcvxwCXrcVidoYBVJfjzWBjD2WEoqOkHGjA8arXst5wLW5IohRmD xjIxMVrvukuuf5g3zjDogIHOxDR5mN9T5sLRBYiuO3lD1060kd8mw2/xyx0N0UDTlI+/ xfbZIHiHGhBjLMgRHXnWlA22HoT/uKHf93inIurU7xbKUTe8DDRwQNzeaXZnxJLxO6Xk ZcH6vw411y3IIDCANy4puaWQViAeahzhiD4GIqM8fAJXvSM7FtvrRn7oMwYGe//U0hKY R6yPiBx6JYB5n0DY5f4YTysREj2eg6Zc+3RD1FKIP+K6v9k82gEnolNHOoojNjzCgtBr zPig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to :content-type; bh=FbVuVeMzdGVew+B+1jxF3rRUYE06UiDSZihNY0nk240=; b=ijVuwZREdBzpat5yh+nH9k7OPGW9Tc/AWOiatinktamgHFKGztzN/kqWmgDWaQCL7T PPQ3V/6YWhbjWZfBVO0Ion60Eaxg1EgNvQiDjs5lNeQhDY3i4fkNKCCzG7Wb4wWekJLI sORpvvudC7hQhe/z0SLP29POz7WhcrAT2oXiZjzX5OB3sIDivpMbiPuETi3ICqd8DTxz B7b7ccF2DEuUv5YPPVVnhql3N4YQr2hZMuIKGzCTOviMTGjJfj17lDdBXyThJ+8a5E2P 1rXcf0yhfw5FBbfp/vRXys/EXSXEPrHFo1BQ9Bd0DryHUo+Uxl1to2nr9p1eeqcRJ+Ao tgXA== X-Gm-Message-State: ALoCoQk+9CPaPbUU2U6t0/ZfLr44+U3TrYfUZxCRVTVL3MTD8hdD0lr9feF1EgQi4HroA3++FUIg5xJUj+cMwRBaw4Do45UFrjAhju95fE7Y2Ta4I+gKoLFZYqOy97+yofX11+QjoFJMBGn3Bvtw7L+v+Scw82yXJQoT62C7Z8cVrfkKuNPq6kuRCVrMsKnHeoxkHouCEI7K MIME-Version: 1.0 X-Received: by 10.220.252.134 with SMTP id mw6mr254798vcb.51.1391533700663; Tue, 04 Feb 2014 09:08:20 -0800 (PST) Received: by 10.52.230.105 with HTTP; Tue, 4 Feb 2014 09:08:19 -0800 (PST) Date: Tue, 4 Feb 2014 17:08:19 +0000 Message-ID: From: Ben Laurie To: CABFPub , certificate-transparency@googlegroups.com, "therightkey@ietf.org" Content-Type: multipart/mixed; boundary=089e011613d2ec1b2f04f197af62 Subject: [therightkey] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 17:08:23 -0000 --089e011613d2ec1b2f04f197af62 Content-Type: text/plain; charset=UTF-8 Enclosed, our revised plan. Comments welcome. --089e011613d2ec1b2f04f197af62 Content-Type: application/pdf; name="EVCTPlanFeb2014edition.pdf" Content-Disposition: attachment; filename="EVCTPlanFeb2014edition.pdf" Content-Transfer-Encoding: base64 X-Attachment-Id: f_hr9e3puh0 JVBERi0xLjQKJeHp69MKMTQgMCBvYmoKPDwvVHlwZSAvQ2F0YWxvZwovUGFnZXMgMSAwIFIKPj4K ZW5kb2JqCjE1IDAgb2JqCjw8L1R5cGUgL1BhZ2UKL1BhcmVudCAxIDAgUgovUmVzb3VyY2VzIDw8 L1Byb2NTZXRzIFsvUERGIC9UZXh0IC9JbWFnZUIgL0ltYWdlQyAvSW1hZ2VJXQovRXh0R1N0YXRl IDw8L0cwIDE2IDAgUgo+PgovRm9udCA8PC9GMCAxNyAwIFIKL0YxIDE4IDAgUgovRjIgMTkgMCBS Cj4+Cj4+Ci9NZWRpYUJveCBbMCAwIDU5NSA4NDFdCi9Db250ZW50cyAyMCAwIFIKPj4KZW5kb2Jq CjIwIDAgb2JqCjw8L0ZpbHRlciAvRmxhdGVEZWNvZGUKL0xlbmd0aCAxNDY0Nwo+PiBzdHJlYW0K eJytfeuqbTuO3v/zFPsFMnv4bkMI9Emq+neHgjxASDc0dCCd94fok8ecw5KmtHZB2FC1z1rasqwh 27or/broz39K9D+zpl//89//wH+3Vfk//+N//fE/fv3vP/7P8cPrNUfvx29eo87EWI6/Ep70C3/+ +z/92n/5j3/94x/+6fr1r/+XcQ3ClVKuwPMvn5/kXOf+yT/TH3/Vz8/LepV51f9P1OQ3NaPvH111 PARe+Nf7L/Sv//zbH//w1+tXnr/+9i9/pDcTUy30r8qvv/37H//5uvJ//S+//vZvx28b0bROiHYp iFFfV2n5BCkKZK5XL8SnA6RJkHxdr5ZoEwdIViCpvZogti0Fkdcrt7YOkKr2k8t45XoJapMCafnV ykonln9UIL2/2irnhi615zza68qSc0OBzP5K5RLk/ilBypVeNa9xgkwFkvprXCkHtJTcaKF+Yild gZT56vQZo4VaIYkWEBpJH69RptizRjILSctIgSiUVV4rregrVmLLumrE3JpooUvIQtNYcn/NVFvA uVoaSVQglJXOB33qehKrpLL269Xzl1X+8jc6+7nn8Uv+H87st5+7R7j29br6dS6RFd/rpFPa5nm+ yvpQ8ZtXRcMhlTzVDGvXfK2aTn5kJSWNpLHPFYlao8tzdXEytJS0ll6ziiOoRaD1TLS0EghSG7SQ Ol/q87WZ6AuvEAvdb7mXERwNOluvlAVEVRBpvGYZK9hQz8TcEnKu1/rKSXKuv78zf1Xc6eKr4tJt 1/tjKaroigJLDoj6VwVB71kZNYBY+dX7OnFoqVkdWz9x6Kud3jWzjCKVXsNXH/iWLiWJ7soLj+ax kGIgPfCv0nApPFg0SKGFVp8nFvW5EwlwkiB6z4m+VOm4w56F9ONbh1lIPVap0Y74sfIXovsnX/3c UfmLBiFaJHP1K98nPb6pReuMTA/Rir4QHSXawbllfawTBK72GrF/EbFzjoiURdTS8T+3rB/fi96q NE/eZq2T0IkcuYjjobFks1BK4rjlb8dtffCpLz5JbDre2OV98EkLXmseEOYw4RiMfOLI+jDRd0hL LKO/w4WTUk9a69CHCSelrxPEHCaclJWjhTJkHMfA3VAqdNX3dO5Z34yk3dzalr9pnLeRerRQnbfm t9wjiWdHYjEKMQ5Th7b1gHhHxWfLINm7aoo29DkqD4i+NUmVahJEf6JMsjD5NLlsyZAFFnKX//Tk vDIflWehPzUIMbe3SFwyKWTrmjmihWThGk0wt2sQWkiCmIUqLSQESr/XudVXlSKncZB2MehZDz5i hj7cWg3kKQ/azxwr4u2ADiqwaE02z6wXMowjaVlkIAUClRct1JsQf21hrfWqJUeHqJCm0+kaPG85 Y7IARFw/2u7J6ZUkxNAQROzILfjKpdAy9IYGt2mpZEhIUdHrQMFf4maxhhHZTjVFdyXdB69Fpn/E N5IEul3Ob1gU98sESBe0VA1CH2hNwRalBBV6IGZJ0S1XSCFLvUQ7qqSQbVvApaWSQjbhz/C/YqUn 9qItBbTUfL2KwqKNMHqFO9mDwYeuZPdfJUfXXCVZyNclbp8/NQjxZbUSyHYlhUxh0Z+xdoCIc3bp TQ9LiyaXrgUyuIXsqkus0rUwFYgmd9FCgrdNAxhijZ1FZmEZOfqIjS6FcYVXSyOFbP6AJSVNi95y o1dGL6TEspHGQeJcox0VcKXOgHGkJ5DmNwRfNC2kvl8S5FJnEVZszjW6T1uj77zEN8rKHdU6Flo9 OCL0IL4q6XwRyKRvVIXKof1eja6Oa0p9Qu+IHhF6OKNnHrbw6CkS7k7CsLLQSrQboeNLSyxa5ej0 pRM7tVzx7mTLkTodsa6TLVer1NaUytdbJsO8R3vu8CLMSM3tnThX2wwOQCcrbEgs+qKj4/5KpLEF 0t3h0ZjiRjXkssc2vFH7ok80cvR2DlIcS6orOCODVIEpQTRfBr0Ra+bovA6yMwjJF+mOzDBSWh2p IDNsrZYOCM2gt9fjwKGuGWIPeyMOCG0dQa/O+VxFWxvX2s4In1S2wuiSDmjdVhid/QfEWD5whSI8 8YDo85bK0FjMQhXOiJojcunCY0PtANG2HF147DsJ+EIaV5NY9HOS+u2kCbD0rmnRz0kaxSz0xanB FmGwo3k7aQLWsVMjlegbwalR57mj706NVIMPkBNMz96CHWVSvi+5kImRZBLMlc4dWTOMREqBaJuk kg5fSo1oaWUbc8GOIAzjmgF3Ea9ZqaRoR28ryxeGj5V1YNGG2Lo0FmOI0ZeuMMQOEG0qw8pKMziM BfY2qd+BLJQEJGLPWsssmUiBve1TW/LU/NcnrdATOsgoPNminlCYWddskVwW3B3z6hEtMMXqDKQF llhblziu2vqhh3hJ9lsQIwqGlL70RzRG7gDIODln7bnbmg4WWrc17YslgmFJgWgtn96RWnPE/0rv CBlJ4qkxxtpks92/USvdHEsiMdEwemnSD0iWpsRsme4WvY42PnG3jDWj/VRwZZSIcY0u1CleV33P VUiLBDGmGqRFniFj7+Uf1yGlJP8EYqk19h5izim6LBtZ9mQeCXnS9hEs+9SjE9LS7fHwPxECgST9 OZCWBlmgLx18xQYvT0+R+LdKSv5VIvFv8AjCbxLsiFQXUhkOiKQ31MgmvGb0iLdO1I4m7na95wH/ zKzRhuAImpeQKL0huluaemY0Lbhb4DY5dqTNoytvt8kBos2WBOu/BWxhSy2Jc5a0vZFvC/YA+TmO kp/ojnpw6CB0xFGyGzhbCGziemjeJUOW4w61ZD8UlUj3azkdIEZr45DjEqQoq3or3wKLDTlCJ64l WgiJRYiSHFiUXoF4IgcVsh+ia3dQIfuh2H4HFQJyxx1UCMgdd1DhwKL5MkknXrNG5C7oHte5kNHy 8aVHyYEsZNx4ZHYEO2K1uQ3BXRMLfL/D7qYznNZdSK5ZCNfZRabsQa5WDysWkiBGs8aLE4pUxtO2 qvjSJn7xfpVc7kKzJvsyXGgQd7tcSH8AOCqv3oPTCM26KBC90IIffq7gA5Tr/XC5p5GDExKLcY/z 25YEFhOeoG+ksJgYB962lCNyIQxNnCOjZlY8f0VchlrNbACZLVqoIfmkreADQCsuCsSovHjcZg5E qgz6RqOUiHUQhnrN6AMgc05iMVYJ5OUHLHj/FJZvurUC0Yom6dYNIQx/R8hF67NEh4SMideVmxAp TUvGiy5AbLoaXvS8AvGutWosVum9wwbBQm3spM9goT40Fqv13lGOA+SvGoTIZQUkAMFCLTpHCIRc Eou+Meu61Rg3M6iutxrzkKKVruutxrjUNqhLS16YJsxRXgNBAV8W6GrfcQP/eoHq3HqPbkOozqPU 6IFl1Xn0SBagOucqtArNXDKmX21KlcFEQgZC8iuiBXGznqKXvJG4cBprQO6ADz0Fx7VNePPFfWli JQibTXG7WO0a7nxxGWpx4UDIusRCBoSonS16gokjr5RmxJaeL3qCL8H/f9Qgk57gHH1oxErWEMfV BGXoNVJYtF+KYyW9RapsJ1lIJc/gGyGeUq6rBN+IZJ8e8tyjhQaiD1ekEHcShtRyCUSXntZXnXVZ kNB4Gd6jM0m/Pn+t7qGFxFcQNDyheadTHhDaI40MMOR1HsuY2MOdcXmAmKRMJKPFWGAhKSzazkrL LKTV/PwOpvg7QpJYHTlgHCdlIvH4wGLyNsfOTX5AfsMOLY+HT50qelRSozewuKY8nPrHr42ZdOVt yRbXjQIWsylbXO8GG6H4UD4dnPcK/gW0wBeMnMBjIWOEwpTtYiGdg/v+CgEtnIeXRrRpslMnycxB iv6Ud05rsAycbmTNniAmcpN22nzAFTr9mZ6lkxSDBdGSIhink/kWSifaDBbKXPRQSsAVTsOrTSyk TS2k4SHhLABBGh5ZSgG5udzZVweIybG7s6+ChdrOvjo2ZNLwtufU/4icY4f8rIBxpGYuMoCCL5QH 3KJV8FZb3RNu0d4jWpBZhZzigJYF01HKnLZcYHO0MgP2F/jzl5A5E8SAizYLybUgyPJKKVooI8ur iHOm7eVy24XHQtrQQnERDFBfFApyZdIlvrReCIkwLfrQBf7XfIl1TOAGxkKeEVuQiLdadM4Q22ll ROesTKQzrZMtP70k6boQ43pD6xuPHtuCd/8A+QkhDuijq2n3Gt3V+2lxVahU2/20+CCt0FfJ6QAx fjzS1TjFu7gqVOqolsO7EfgUaaG+zoWsT3HQZ8ER9b2B86LvL7CYh2POHxda2Sykr+IL9Z9zBZuG 2zEjWl9c9T/TQefaDZ8vqFLgtICAltx2KP4A0RdgqTsUf9CiXX010RMlQMztRvKySGCiHTXiyzo5 Zx4OOsUZVYQHiH446BQ3BIsDkNF2nNeXhTzWjvMGWOgUtwUFzpVuZE2vslbAFjJUXnS3iYW00wuy MKrgnHFMNoPFXNeFbM41IlqgSifoee6OcKOvtiKhKyimuFJ0MdCl8ILXN1inX/db6LsL6V5gT6sv 3KTjvWjf557NpT+hRIvTqn2xCzq0kDnrLazboXiAfPEWTgVicqKh/ZYUXAvwFrJDMQLpO7PaP62V 9fkZ3WKV9Xm5kPZcsj4/olNUudTtEmKpY/5cxyZArM+xbw+dLwu1I3VsCJkzsXjkhQkQs9CA4XCF fIHSz6+77y2ERj9WyBeEptAuIPiMCE1Veei1owlW+BTH1aZfowatRoce8fqR84nFVuUWjUV7bhoS feAADRaCvJBkBptGbW+WWMymYf818UiYTOSGUqG0AmFove6U579DYYIG9lj+piburYH9tnOANbAP tC4wRFR3m+XDO8ap5u1ieUBs1RrpcQOC9gEpuiSNnlSuKyy+iwVPKqt6rlsJ9rKixfhySL1SOzJB aKhX7GjwdwT1ih0N7rdg9YodDQ+IsZdp0yg+PECMvTx2VesBYqK6pDvNMgNyc7l2WevxpbWSAN2J LcPhCT0UowsmXQAxSaDLuc63xhSDHQDDO3950DpjngvZiC0tlK8a7Zme1O1GeMg1ilHRWIwGRhfg aHkF5EJ34tTBCKRwuqRPbbmgL0okJl0S+iI0PZctMIbzCWD0DBSGJ3FBGFqhW9UaCQJ0K9I7U3Ar lEbiJEGsLQwlTpwho3OS/sWxe/+wFnpQOXbv3woI+lbWFn3GIUX6El/IgMBTWiOJY/0ribOqpb/C WdpKtA70r7XCY1bZHz1rtBCUaORf+WypkAUkevlXLgrOiCspkCikKJYuz5CuSUMeBz3nwTFjzQnR Wv/iZs1JgWhyWXMa0UnkHMUUAiB3SDyKRnGFKi5BjIKGQtUUHGaUm7WWc8CTdr01lYcSnYiH0goJ YhLxMhQreVZ1TDiPW/dyow4N3lQJYlMYaUe9RlxBudkoaQXiBK2JLMgckQtZ6asEB6QhnTWlHn0A lK+3ImgxOYxEy+qRUCJBsUkQo/zCb47WK/6X7oh1KSw6VAh/KiK+B4gOoaIZBCK+/gfoyH5GxPfQ A3R8FCq0xGLioyhJriW6CjvKUJPAYmKSnNsssJhNc26z1BV0UJizu+Qrr3eEnB8JYqOscNGL11fr Cp2UQoXFFPPBc47os/+lBwpRL/FEa5EaqDJVIH/+pMNXPE8O5anU1yy4rvyeEWWS9i0gTEwsveqC xRmAYJ0rHSDf2lcshcWEzQa9bdDy3QpaxM3mDyBkCGgs2ltLL0Gf+ST3W1e4K1fBXB04owsgoeYs 2DRdAAWVa/6m89XQIW0E3IWtwJVrAQjZ0NzWw6clp06PqMSiA1q5moVMBigtNIS8GCdqGbuXic86 WBzcy8SXywyRklhMv4e6duVagKVlTcu3KJ5eSH8j0j9yKivaEaQOJXIB60jquGNPcQtOM900WYLY GF3exW3BpkkD+WEhWCX5B5BkyTWtMtDara1g0/DochXXAaI1fVIwBsrF/E3TeeaWKAcSU6FFnEPD k4NaY5e03RMlWIdkYdtZbmU3Xc0ai25LVvCh0aokYC4+tASxJkXe9Ve+XFZ6Ugb75f0uC9e8Xfc+ CBmXGotJAK30po/zKxpjgC6GbWn5/TQQ08sjWocO/eorkpaKkB5bWn7zCXpH6liBtKAsiu7/SFoq InoSxDa5oHXmnNEXmm23MzkW0s0/yHTkLF6flkZKYpcgtrVhu737bh8AdJ/YsfCg+0TfOdIHyH/T 5sB1x8L9Xg2kUnAs3H0iYDBs/7+/ITIYtv/f/YpoPrH9//5CHZ64EhHb1x1Qd7WoBr8hO+79bhoI xUkQYyTRrbx9+36/B/gNkSz8gPyOU7g+QXxTJXQ7hevvx/lJW3yg3bB8dbMyPmH5AOQdlq9uPsUn LF/dVIhPWL66OS+fsHx10zI+YfnqZoh8wvLVTaiAusjR8gPEtDvru/zdXwh+46uWc0dGz3iH5f1N QxdsjazOA4tR9OAUFiC2GogWIlTBZ4Qu2HppEbkkL2T2n9SaeqG2K6CCDbWyK6COdb6U2dNve7Sh TtTCtRxsiBuuXjVaCJF7SYtxc0/iHKqxqpuiAyWOC6d9iYJreaEq2heXT1je/9D09Oy33aelkCzw 2+5/RfYtzzoiWt6Re5+7n8h9sOl35D7YUbvdtf6XZu8ytIhgR/Auo+l0QC68y2NF6wwkEXQhC6Zc CFkEcwbSXbhbSxKyYFTBsd9//zKsnDPdVrAh1ALxo3uAaKXnHbr3N40qem6KdjwSpgA+aSzaj7S9 y1d0AaFGPkEXCTaNUKzEYltgd1YA/OMKXZAVAF/mUADfJYjVBftO3fOPCPzPeiGtC6KBKoL7wUKI 3KOHmL9nqIvcQ8y/xuBgZj+2L7ofB7Mvuh8Hc7DQ28Hs7wj9zCayrvzjisg9NysLNo2rY60aLQRx 6VJh0Jo2bheJxajRSN1etQXnFUXyg+6PiC/j9ocHO5q3P9zXKdgHLUFsP7NED5a4pGw/M3Q3icSl I4t/rIj/HR1dslRMNJZ8u8MPLJraggYcPTiLKOLpVyQsHaGGUWpwznqDj7qNiG9I0GjRS9SRuf0D xFI4fkudLx9oUxjzVufLbyPEGf9AuzkeD4ib4/GAuDkeD4ib4/GAuDkeBy1ejseBxcvxOEC8HI9g R+8cj4PRXo7HAeLleBwgXo6H/9E/OR4+uZ8cjwNEq9n40uiLcAiDNgpq20nBPuvQeHgbBe434gRZ 1K0cIFrNxpdG3coBouQFvtJtoBTvgMJXWlaP2LLe9olP7TKkGP3sutOGDxCT47F2fnKABR8arar8 A4CmwXByHtSaOSg7lyRYBqk88E76XCn1ziUJ1oHBJUFswf2lsdj0jIWMlIDYMXZGygFi9Oc7UeQg 1iRnkEyuHn4f6M95Rd+n4iuPNALGcXZsEcfZOEET2QzICA4WQj+VLCTbZmekXanjnw84Sotcx2S+ jts4eZAYVyrWqSHEneEcrEPnXVJilFo67r2JG8Ho4LCq0eDo4P4X7XmtEn4gEhYuGfLvOCRnKCym NJ1LS9sKPlC73iabe8e19DbZ3G8IT2rqYtO2j+/bwHE3jRp4dtkeC5l01KKxWL0Xhp8g16TGwmRG zlAEUnaLqYBcCIPCYlTjvjOPAr6g+Q4yj3yRamwn5R5tGhnOSCvyZbdDGJBW5O8IRfCtSh3KdKFC Os+Ink2kZ8yZo2ezl2u3VThAlgYZuzmDv2lkcGxTyr10kZ6xTSkfS8u3+eKzDrk6bJu436hzro64 o74VwbcZqS0dpY8Sye1tCJMmql9iRddvO39virnb7QN3CymQD7F94D4WMkYTJqEcINp7TYeyoTtX QCtZKZcEsRN2aKE5Tmq1ik+GjF5H+7fJkuEpJwcW7d/GEC90o61u6jzUao7GV7eOgjMmkMhwgGjd 8LK0GLV6vjJ6ifn8z9nQYtzxue2OZP6OUJm21Wq/SqvmPRHI/0SY+MGDegJy2x2NP8g1yvkdjfe5 myEuPdwQmVicxu2LJecxII27ugUQGdkzSMAOqKUPXVHH7bMFtcZc3+azBco5h9r9hUg52ZVpB4hJ Usi7Mi2gBZHRJI5rMRM9hsaiJyhBPVdYfssj8BQAmC7db4/A31X18UD7HoGfqz6qm1T3eASehVQc OTWEvQWIuf/62wp3MwkRA+TGGgG5iAFKkK8xQLmQKa9BIJ/NfbekA12yt7nvl3Rc+Tb3/ZIOsjK2 ue+XN6R2m/tuOnTOZTd18FmHRgoDrSECEPYrzB7RgtJciUU3gUMmVy4nhO4Bx24F9JcI1nmXl1Q3 ezKjHFOBfOn2xy0oDnExAb6FGazjBDGjUcvOaapusicGGg2JxU4ruvY8qQALTFuFxSRyJbOQ9isk FKmUYEO4Irlht885XJGkUp+fyHonaB0JYvO46s7SOrDoulvEgyUWE2usqABq4Y6aIde6J4j/paWI XISGLnFfao2bY4ASxE49unZVjX/QCkLGY5Ro0+gai76aB4jeNIxbTqvwsax1R3Jd1lUULEksNkx4 6YWss4RYl5Y4aSaSSAv1tAKpY0/IVXNwXpFUxi1W/E1zETDaSh9YdJgQIoW20j53OZKI7pz+CagI DUkQ220bHqIiNq13hFAiOk8HfGFPx2zRN+LBphLkW5wwyatOt6zjGR8lYAs7OpYAMTY/bNsuDqOe 8YnEs6uIi0ErDOgH2CSIqdqoaU9p8k9aQ+f1q0XS3do7wurviBs85UhhaOi8nsSp1wpDg23Lprir MKCX9o5HugpDw1SHmsQLoD1NmOpwrUgFamj1hVaKvnRzmFCCmDKIVPd8JV/oOmLG6JPof8Ze0p6M 5H/GXjAQoAdy2UlL5WlE/p5RqbKqUDtMyLK1PY3IP4sdTdMxjShYiNtAjRVtCH19JBbDOUQTMdPo wGIqVcYeWBSAoMd+G9HtMtBxeq0WcHfw9LwUvfWYjHRd4cU8eHqevJh/tF4quqF6fhdUJ7A55Fdt 0Huxw4xBqcq1h9QeC30peLkkFpN7iNIDfiR9cjF8nZMc3cRS9t4oEL0jlB6wP8TfET0pPCnoATFT llETg5FE1U2V5ZoY1FtUN5mZ3Tcog/D5wgUv7Ml4QL55eFDj4O+IrtbbNHloMTYQXBkI3LkFDDBw eDqM/41yWbvE2xcGeHiq4L8tZrlLHA6QL8UsSyAxLY6Q1h4vQ/KklrHNidatXrtz9DLS2lkx9rlP z9LWen2mkEq7JBY70rXcWq9LC8ybzmqkXycBeUK5+QFiXEDEl5lzcM4KPIYSxJpAKF+oLQIpdTfz C8gleeJmfgcWU8sydjO/YCGkvnOI0P0AqGXhka3+B0C/OR5gcoDoDzDmHoNy7MhYJnelxAPyO06t 9iTFfOncyrd4+/28GZLFB1oP3PhkrTc3I+iTtd7cNCl6V7fH/iDrSwUje9IDLEhsn+OAMJ4xVCQI CPNuwF+F6zzYD/xVcG8HlJDiyNf5sR/jjZ/7Oj9ATJJL39e5zxX2V8ExfYCY4dq3S8UnN+c7g+Lg 3Jfh2gqLTTfv+4psbrIbGn+yf7u5yW64aNm/fYDoNwy5SvPk3Ld6wAU3RrDneTtDjnW+dXiTWKwb ae2E9APEZLDkPZssArl71vnksqdJYTH37NALmZ4dcDXhxfVZB1cTZ5/4ZwT3bD4BjIuolj3JK1gG kjDCS4FzzTGmK6Ck1z0bK8ACr4AQbXsPL43EOLTgIYKbw5cENDJZ6JgSsIXkKSksJlembGeJLywV DSwwEMWn5ZNOc9BiKhOxIwmivTLwLciFbMY6UnsEucb9U27HzUGubhNXbsdNsBBSMfDiHgtpLO3a j7IvLhWebjzKAXfpDWEPUcBduC6bfEU06+B+uFK0ISRowYd0XLnGE3XnuRyvr94zVy+Ed3vj3oTi AJh2G1y9IEG0+wfiMsVlabLR85514gtU43lXVyS5nLgjsZjRcBCon7AMTYvZM0ogFIiZ6lb2xJRg R23suSsB5/qdCeOfRXZWSRA7vOJu9hOQO++mgr5wN+5eOGr0GdFtaciFTNo72gHWGdDCSe1wv/lH BEntnAlz0KIzYSAvEsSOpkDXmr4CYYA/Sy9kEt+TXsiCWHI1X9BXBd7CgHV9lwMEbMHQrNwjzYUO PL3zJdJcMMZbYTFsQRJXk0da04LOKwqLehjHhcFmM1LoMOm7o2mNz7mBBjrt290ROquan/D+dlY1 N4eKPVGz9gPEWiV1z+drbrYcym3Zh9TcXETE0Xm0RHPT8tJAcxBIjr/QzDzVoLmpZbA5eKpBBLK2 Z8dfB5Ok2bPjY4HNwZ4dn3M5weNynQsVUye7drVnc9PPcoULaZ5ITLMTs46Nbtfd9vDA8hcNMnfo urlJeZnUgiaxmMJfuH9+AIGvUIEYy6XuOtngE8G3g2YP/idi387VArawaweDHHyp5OweDHI4qDWl qWnPeggWQqYXvD/+dy7wIUgspu8Hsl7grPKZW5D1IkGsRTF3h8UDizEX+s5n9y8XNJ7mfPYDi+mN uLaz6gAx6fd1O6t8oYPVUSUWY/OtqheyhgltGlFcf9MwKegN7MGmMSaax/r6O0L/xK2A+xnt8Bsr LDqlnTTArYD7Ke3w87Hu7OerowsGMs0DWiBSEouhhSxQjuIGC8EVyBq4nxg/Lo3F1OyOtRuVHOTq sgS4AtGFJKAFnTKQjnJgMQZD2jnivuyiOXUf4gWw0W3wRbwAtiOKoeVb7FrRYnRa7ogiLkyj05Zy mwMBSL/NgSDV/7pNk2dHZiIeSs6y4IvW9eGjZEXe3xGy6oZ8yE2qP8q8AslFDSw30/S/MxL95T2n cSAtJlwEwiQXMRkMaLsyxQNtQqLoo5BHxHok+XPRr88RmBNDYrGx72u3rwxoyXO3r/TfkI4+ChLk t/ztT8qp7rXy8bf/XcNbHmjf3+4nlH/87X7i+sffHsx3efvb/YTydxJpsBCeU7QDbG5CeRpttwM8 QHTUAtcj2gE2N1s54XpEO8DmpiITht0OMNgR7j5Eav0dcXFqr+cXNQWhaBilaDE6NJ0LSYtR8+Cr Rceag9wvxalz9hxhga82z0heMtpBjWtG5MIVm4r4jCaEum4l+ofpLePckQ2Qtj2CLPgAqF9F6rov u6hfrRjNEtCClkGslobTWxaSzh8Qo7niYpJY7LRnNNuu0TmCirw1V3+oSrkT+g4Q9eJy8WmLJAoa 8tYE/T3DQ9rFAbCjWQwptvr0zi08QMywrba7xARYkAsspUVr4hiJifDoQa1RkNeOoPrr1GvsSdo+ WypPs0wpWGh3Dxcgphsg/FkKRDf1Lu1WBH1y6z0mxj+uXH3aBOvMUON+7RHM/ieqKDnEaJaAFnxo 8RiZ2tL32JWAue+xK8cbaXr93WNXAizo14HOLMdp1UoROy6D7TR2W8rjrP2j7LYUx9nqtWjZfSIx CYwFEx3FG2ISGDEtpfaIKdxzZc6TKTr2y9NSSopuOe77vea5kBkRg24cEoup7EUDeDQG8e+NNt+u Qn/+y3q7Ct1bDpmS7PBxPyInSqIbt7/nniatI+9KXe6JXMpZIg2Jcylzi2527rmSr+hq6fjQSIP0 j3OnD81pkMGm8aGHOKtGt0XXFQlSlSOM264oLMY/TTuq4jwbvqBqdGYhC+UnnZeg3Wz2x5vrFyuh cJR9hW6tAOcVJpx/Nz+fC0fZJ+yWlnxSD5ubTPpJPTxAjOb89gkPT9DTMLTYgYXtdmH75Vd0cU5F rla5rktjsc0TDetsI+1B32j1CCTdrcF9cqEWT4XF+I2zWehL6mFnc8Ev4ip332+fu1w5KkFs90Q0 0u4t2hEqR1mL92ue6J3lvpO+SGGSLfedDBYayP1M4Y5m2S1mjh2Z0tG0+7oEtJBGta42A5HipEBM cvTJhXNZYzGlU2u3r/TJ5RbYHETwq6u4BfaYES1ogc15Pm6hXUGgge0St9KOG1wjKzNYqNdd9OQf Nc4blFhMJ0d8aeR2Hli+OZfTis40O5flzfDVuaxATJtsEqlVa/AZoV5ve8EvEUrtthf8WiQyo7gW yecuOmlvX7h7e9d8Z4gGtJQ7QzSgBUnJHADwaYFzmdNrXO5WxCsUiFHS8+55E9DSLbnGuZx4IKcv C5UjGj1699hDHSOZWVNitkyvkV5HCxTSIpF96+8HanzF+FCfcQ2VvhiC7V+G3LJbglhFPu9p2/5Z hIN6YmaUL1AN0QrMjAp29O7ZHdDy7tntf4CGCbsSiyEX0QoM5AwW6nCkjejBQqOZnRjjXsyN7qjZ x4i+0e2B9ilBFzJ2lbsPTVtL4jBVUxgAxxady7bOVeE1krjOVeE5Oqqdq8KruNq1F5urwqUWZXJV UBW+IrlFH5qmQL5MElILWasDk6EluTqHhyvHxXVq+9Cg7/MSOzL2AtJJUyRxHQ5gtmP9heAKKlK5 0VYHvLtsgfp8QT5vvVZAy+CJzeI8a2t4oEJXYvmdpjjNLaZ5zBu3mOZJVvELnjCxBS3bm1u2sG2X ddJi+tW0dqvObjUN+k3OH7D0e3xPc6ssuDEOa9fuOApujMPatV98hcY4rF37fEFjHPaR+2ON6BaZ MQibNxLE6MVIi2FPuz++J9+dZvxNIy1mJ/T7pUiQlzWFSBmX/rVbFzS3/Icn/MwSMBe94bl1wbGO iQvsuqmAK/2eDBOs0+/JMME6SJBaTXwhbblA/eCcc788DhlSnHMejACqd865KwrI568SxLjIofLW HB0RNpHQPd7fNJtICoupmyq750BAS8aUGrFpQ0tJu1mkf4rYRGriArLNL+ueKnpg0bTQBcRTRYMd YaoIJ5371Vf9rTj71VfjrTj71VcIGAqIpO0sWEgSiR0kBNV6nl/RZH9chhTj9GdttURfkS0kVovd PfMgIbRoPEB0DgmCx2gX6fOfxwStGV26mE2a5BcyqfjIviktora/kz/8Pfd3IkowJuitfvt7nj/T sgwtxu1/vRNR3FOE2aM7EcWVXLSG34ko/igbqJqsW/vje9I7EeXZkbFc3okoPi2wXLq4dW32zdau 3RuK7RbW0F1RYLulyntOG0gouEQLR18UeNbQlCqSTjgahhY7Sei6c2983qIqTJFrbI6msdjul4px xhS43hk8AUjboTWXVhgul0KijYU0zDrGcHkn8bhy0Ms7icdl7WNy+Au1d4aOv6OPyeGKXOdmVbUE 8tR5FnqP3iq2SlINd4RZ6BLEGJfoRCWvU2uVtDu65soTUuh3dM0ld3Dxn8CiHZTo98CNPR6Q20EZ WiXdrQ9IGRNDSXQeEJNo9A66dLec4RN0CRaqd+Sgu8U6aGg3FYjp93CbHN0tZ0AXfDZ/ulurgFwk ThHqboHMp5lDd2tF0AU/SZBvXfALsoiOHX0ZatWKpEUr1xfiDzWgdjf0XCkghds9YEqXz3/S6vYg r+5WtsBu4Q73AS3FUGtGWiFYklogLdzyUyCx3R76bgQYIVmKEju5dOhlzODStsstgu30tfsNBmwb c/f486UJhcpDgtiUKDT1KD2iZe32pAcpOpZy3e1J/T2z0YIcL38dNlqQKeZTy3Ed0vGjhRDXQUG0 L02l7M4gPm9LvceJBqRA24Xp6V9yaNifo0NY+m09BUyBrMAGCyiBEQyr8gExyWbz0lh0HjkGXrHJ GCyEVppodneQa4I6eYeGDhBtJkASEPfxvyGXAyDD6wDRGUZwsGOamH9UUWHMM8n8A4+gzvoBC5LE r1BaMDaryw2ZwVq0zuyRPHFMp8kTr9nS76CCf/lUyMIPIGgkI0GMVcPzUWf0OtQF86m0aNNr7db0 PnMRj+FUf/8QcTymySOv1eq3VeNzF4lV3JreP2ls+GBYqM8Xsot2RlqwUL12RlqwEDqvopOdf6Gi 2R1npPlCt+0aodjYeEzbpbS+MHA9gAT5NhOL4yDBZ5x3HCTY9LzjIMGO1h0HCWjhzidSm9NxELRe zXIhU2IMc0IsZA0k7o57ipSdm5X3lC9/R4jJ8JQv/x5jA6muQOjQMq/Ru3iC6PIEngwj7g5VKnCR riY0eEhoX++3QDFoYSReqgeEiSqgSrC3doAYtTphPN8cJ4iOKqRJykdOJ4ixJUjzm9dJi9F2CwY+ 5nND35pjLzxc/jp10g2NR/RBom0WOnG1C7aY+bgD8x7zCfKtq3XJ69xz1myZg14lgcX27Mdso5AW 6O9cpnlg6bFZR0IxSNBuqtT3RI8A9Bd/IPTWIDboHf5A6A+ORFuJw2yMe06MfCLRTEaLEmTA+ZQk TElEX/ADi/7g3JZCYDHGGJLrf1goL72QjdGh0cM6d2RjdH0bLwe5pocV5j7SEfeZi7IbNiuCTSNj t06BRZ8m7pD6AxbMVpFYTIyu716BB4gpu2l7PFfAXfQiQEV5QAt6EUgs36zhJbHYyhz0gpg1WAgG s6LFToHGJEuBxVhkqeuFbEeta7ddf0D0TINcDLlFW8w16U3rawbDKzKK8Q9aDEjdA5wDctvchenH pk2Uru/CdP8EIAWRC9OPD6B3NAsXpvsHAO3dF+J4wVdEW16xiv5AC2Mqg/2iPl4v8hcNsnY80T8f aLjFBtnBElMg33b0LaCFbh+OJ/r3BsZfDGhMx0JmvHPfvaX8s4ryH+4tFdBCcsCF4IdM6jIj7qbb R0Qud9MVh8z000K6enQloJ1WSeI2NZEdsjs4VOhLJOp2EuJzARYyKmD3+UypGZ1/BSmaKWiDXiQp 1r6cO1R4kKLNsaZJsQOV0zZBg3XGtfPagg2hxwyMx+Na0WYf3esKi1kIxRpD3uvavl/oUyzvdR1j utruPeWfocYNkVt0nlFtzgXpB4i2xkjTv2Cl+l8RnaWaJNeAoK81wqM+61AEzlVeBy16Rz3vHgfB jnDdolVZwDq6brnHgS9RsOmKpMWm4c3dZSygZeEDXOJu0ZUj17W7E/g3FOq8Ofjp640IV3Hw8wAx Rdxjl7YFC5W+S9v8HaHopnTxRNgkurpDqAG5ZOBzJDBYiISB44n+ZyQLjJRCoSybHY1C5rDQYesP KWewAoq3JEb8IeHsgFAvKAorf4BYBocxL8dOWntATGUPNCkkrR0gWsNEYAvVNMFCee7wxAHypTU5 hyceEFsTn/a8sQOLjv2gCRjmjR3kmgQ6zCMUIN/a1F4oEHxAtKsXJqjCYkctXzz65yDly1wlji0c IMYCLbey+4CYhuFQdksL+I8IUkUtxwPyU5MDiOfwdj9RJks27wOhN49Gmgg8PhBm80jkJIvtBDFW KiaA5nyC6CKsDFcAdLPhC9/a4csHxHxwjNdAEPRYSJvDGDorsXyLk3L51AFijEdMHak9BKl7ZFdA LowBhcVEW/se2XWAGBF+W+8+CCZwKBDTs+Hag78O1plQ6tzxvgPE2HQYO7KCPUPKOdfU3zPyOzNS sAIsKA5GlqjPf5SvDYnFDj5MHKo7kGivUFk7VPeA/Gmq12BSN7GOiXG+bVR/QzAZ5ELGjIWrQWIx Zux428vPkf/S0n7bqA8tBuRto/rkwo+A+KQvLbD8uL30AWKmkq89PvH4AKY12thuOf9DozVaulpw oEuut4XpnhBkZi4JYovXul7H9E6rt4H5bNkEOfNtYD5YTAwz3QamTwpEATVahygY63HsuGEAAute 0mKskyvtVFOfFgwdV1i0zlqT3bSZKG42bYZB5blbQwe0lLxr13xZQGamWqj+lL5zXb/mRx807fLf jYcOkN9oPPRA69ByKkgvzf0AMSrJe3rldK2NxDVK9PxMV2VO3HStioXMIzb3IzZd3Xw3Hlrnjqyf v+2umwEt3Hho5WjT3CcriYVMCULbeSAHuaa+oGzPsE9L5lKmdH5Rk/aPLGHkgfh8yfmeBzldyyfn ex5kQEvJu2XQsWnju7x2IogvDEjDyY3MvQAEXajQ7CfYNGZTotlPQO649pza4AOgH7cEsRUGbfcD CriLqZJCXEzaOd1L3A7I31BJZffg8TdUuHt7LcFXLNy9Pc2AWrT6R01nsA43b5fCrV153JldSK55 gOjQcz7DQYopnp7bJeWLAjpzcj5DQC5H7tqKaBlrl1oeICbPpu86yoC5C4p26xG5MJDhqDhAvlRG Dzgq/B1x46Eu5N82+2/b3eFLFHycnAYcLJQRdwrOM14ojv37vEXtAMf+gy3zcPtQtjEMkpvjHFh0 xg8s6JEimUMODafvBowbeecJ+98Z3YuWwqKLN2BlIwn473ho8XI/prKxXN8v929b0/xyf6D9l9t3 Jnxebt/J8nm5fcfG5+V+sLgvt++T+LzcDxb35fZp+bzcxfv+aKndJBYTPOY5PvFC79HU03fEIIcK LqwD5EvbbXZhHSDfHne4sHxaEHVkF9Z0XVh43NmFNV0XVkaClAQxCyFBCi6sYyFtLte5qxSDHbV7 knOwUL8nOfuCiSxbLlMMFkL2E2b9HCBm8HTayaK+vHwmBkVY1h7CHHAXjQclyNfGg8hK9T8jbNQ8 Aq6whpDELWIt1Ht4sr9lmKg8Ri5YCIk7aDVybFk/7hgSLEFsru7cTUIOEBO+7LtJSMA4SMuQJ/pL Ki4XD/oXUBllV+wFC0FbrOIsmi8EbXGlSHKRisulacFCcG5d6URi6guR0pOCk4jW3aQrCqE0rz+G t7QWYYFXCpmV/pbRl7sMSYuOCMItdeVIFNC8kEMmPlfQlzujfMX/iNy8sFVxRIwWMXaSYbAQ++Gl 5GovAhTKGQo3+nKPkqLXFU23ryGE29T0IXcFeYj+cW1QKAXnbCIurYM8RP9xbeyWKj1gS4PPg7SS 4Jw1+DzQ7c9XOjBSOqHbn88W9NyuGAwS0IKgOVrs+ULHXRAlFpMUzK6rViO+DAwjHtFrhSzbSbiD hx5TelIdLfrQGCk9V7gQXQu9jej9RaPEtYQaZdua0Afo0TpofEI2YAuYy70Ue/QUIWTL04oDYknl KCSbgSqGDNqpQEzIFlkA0cXR6W5JU5whPQwEY6mLEISkk5MxlXr1EoGQaXEVIf26uhyNFDPc/AGW WZGiJ1QFzdtFEjebYL/yp9J1S7paia65QbJCuuMIDsigR6SJPevrlOwxuuWu6DWj2/Y1kffjf8MB YenyIOqZQyQspDV+Ebmw1HE2b03EjxN6qj8gxlag1+/8vQkU1kKnraUTxbeh1agpe0B+y1D8OIST Nk4+huL4bYQwFB/Pu2souoHXx1D0Q3YfQzGIML4NxSBO+TYU/fjtx1B0A2WPoejT8jEU/U1/XLx+ QPTj4vXDbR8XbxCFfLt4wyjkdvG6wZzHxesv9HHxumEYmHiT7TcfBG0eJC06UpMxoBM5CAEtfWos tv1l38HMqaMjh+UFQ1HsyFZJkjCw09pn3SLVn53WLi0IIA52WvtxsPc41wOLDnKlydWLwTr5bSe6 OQ6IDipSvtVAcrP8gFpUMvUm9mzmuaKffngxwDrjfja+6LLpleSRNq0tif9NHOmvplc+N6Rf8AJT HjHG417UnENaAZJYDxDj4p2cxOpTgvzTXnsLuIIyyTVn9J0/feMPEBOFvAeB+qKAECMPM/LvH+So JgliZgzBgYuMwr/jRcETtTwmPk/U+m2EeKI+0P4TtTyeP0/U8k7F80Qt7+M+T9SDxX2ilvdxnyfq weI+UT4tnyfqwWJSafquTwloQSsKfsWWd/yeJ+pZSN+znyfKXeh5opYnrnBUbhfjA6Ifl2JosR2a r/vRdVmXMQtHkftlhiDn9QQ7QhQSj5i/Tk+7+dshuiYLJiskej4B+yCzYJwZibhQ6tkjyWUHo8SS tEPuuqfGHyCmP9k9NT7AktOe936AmBfqul2m3vn/VtOIRm83D52axgfCrWl8QNyaxgPEq2k8QLya xgPEq2k8yHVqGoN13jWNBxKvpvHA4tU0PiBuTeMDYtJSuc/EJdhiAhkJzsZ5kvulJ0lDlPYAMeOR kEOfA7bkXF6T7quA/cijazO3CEu5Rx8dIOaSQR3nLIFAcY93kv1oQ+g9k4Vs/2SzAnj195dw6jgf CK+O84EwGdzQKiSEOUx9P4IPiIltYWQKho0dIPrNTm0PGzsWMnWccHMLLOYwwUX9A5bcNS3mnUQq rgIxjVTTHpkQ7AilnpiNFrAOebY9zeALcZ4tWRzRjjCNXmIxIcq+flwI88XlQvZkG3KN6oVcccxp CxaCSKEJ00GuPisQKfR9PUC+pJMX5OL63+iTRXuAmETbvl9+n7voWcQqhi910ELaD1hQWqCwmESn OxP/ADGdVO9MfJ+70ELYCg5o6XdNabCjd75usFC/04v9E5AhUnxxPguZdKm0E8ACviDVEwZsQAuc 4bClfcEspLW2KbDo9GLMaeOI6oFFZ/1gBjlsXJ8WmOQJsTZ/00iY4s6vvuwiYWqgZ+vBXZOOi/zW EYgLhk1w5xz/YkC+1JIghlpUkCG9K6AWBbtNSre2t1faTW/8D41kKE7v8pmLSRI8hc2X7sohjR7d zFzwKbHYlKq2De5gIY5pCCzGmoYs/LBQufRCJu5a7uI7/4HFuDe27H3uIqmKBwwH5JK8NAlih02g sq4EYolsKHr1onuhouCw50gW6pyvgc45vnRz3Sg65/jMbaRn0kMRXYYImDaJxYZD847vBguhJhHN dXzmImLaJIhtpYrIx6oB61pB5KOvaEcoW1RYNC2krqqFTEtWiMsPCyEIprCY1kXlNWqKhA5z47IE sRFTxHLkJaVZRzfQaOKSsn2JSEcn4yRaiAzna3axIx0mXg0+2RVsutMlNXqKyKXf7kacPl96Wq+u QHQok8ybMaL7ElHVVcS9YAfU9Vee4pE2laW1vmitaMskLauLQ/+tyJVs3RmRQlpHHfLQ/0Z9AzHy De4WOJwwv+FbPMC1UYV+pmxVHTBG9cc0F1hNB4ytJEXLaTIyDhjjYcCAIIXH2hC3D/KE+dL3lMvs TppNKd616+yifb2nMEf7eo9hjvC85zCfNGsP7XsQc7B3TKXjyQ4BPejmwoPTTnpM1mTek9NOGNO7 FKEuweav3ki0wjlJ/tKthbvYRNtCE+TRJDkaT7vjVNHWMW0ZE9ZOPGb0AsYtX1J8tDVAVzQKaaOl MJIZM9YOGK08c2kEmsOcp8u4LtEtOYsvalV5u5bRa+GZVDDf6iOa4o7R9xvPvwjklIcuYy5cwOSC j96HFB5d80FXaIfdEMgppy7W+F7hABpad540m/lxcxsg0VoIp8ICidZCPBVekOhrwceUJB47opno kfJu0gZJrefyuOC6RCCN6+OCswWtnfvbBNviREc0uAleFujta8ZXD89pbvLqMfmFSIeEkyI46xxx UzeYDhBCepB6E1xPtVtyDMndkmMUbwRXu7rmzJy3a3cmibZO90HSeAzM2i1mok/KPsprRSxE+9He QzQ811kddmsKrD2+IXjceLIzpkAEbEYHUk6lPfEYa6DvXNrgUUKDUU6mDQ4XNPmRlBLxJfmR02mD T4qxcDw7Ifhc0PebwmM69Yz081roC6DWMt9iYl9LipgZwwBXVw4/xYLbbbWQPUiwlmiM7nrdBUkB NUiU5HHdwYvDI6UVjNXq74Kj89rVGYrIxJ6phTSjQwCaiQYHB7o/2zsRPTxjvIcShqTKpfBY/f96 ZRhOEQ/73GZRxEO4IBSMoZlnkafoIPOIahhPwevf0UxgSjVMH8DBhejly1Jkg/wz/fl/DL57Twpl bmRzdHJlYW0KZW5kb2JqCjE2IDAgb2JqCjw8L1R5cGUgL0V4dEdTdGF0ZQovQ0EgMQovY2EgMQov TEMgMAovTEogMAovTFcgMAovTUwgNAovU0EgdHJ1ZQovQk0gL05vcm1hbAo+PgplbmRvYmoKMTcg MCBvYmoKPDwvVHlwZSAvRm9udAovU3VidHlwZSAvVHlwZTAKL0Jhc2VGb250IC9UcmVidWNoZXRN UwovRW5jb2RpbmcgL0lkZW50aXR5LUgKL0Rlc2NlbmRhbnRGb250cyBbMjEgMCBSXQovVG9Vbmlj b2RlIDIyIDAgUgo+PgplbmRvYmoKMTggMCBvYmoKPDwvVHlwZSAvRm9udAovU3VidHlwZSAvVHlw ZTAKL0Jhc2VGb250IC9BcmlhbC1JdGFsaWNNVAovRW5jb2RpbmcgL0lkZW50aXR5LUgKL0Rlc2Nl bmRhbnRGb250cyBbMjMgMCBSXQovVG9Vbmljb2RlIDI0IDAgUgo+PgplbmRvYmoKMTkgMCBvYmoK PDwvVHlwZSAvRm9udAovU3VidHlwZSAvVHlwZTAKL0Jhc2VGb250IC9BcmlhbE1UCi9FbmNvZGlu ZyAvSWRlbnRpdHktSAovRGVzY2VuZGFudEZvbnRzIFsyNSAwIFJdCi9Ub1VuaWNvZGUgMjYgMCBS Cj4+CmVuZG9iagoyMSAwIG9iago8PC9UeXBlIC9Gb250Ci9Gb250RGVzY3JpcHRvciAyNyAwIFIK L0Jhc2VGb250IC9UcmVidWNoZXRNUwovU3VidHlwZSAvQ0lERm9udFR5cGUyCi9DSURUb0dJRE1h cCAvSWRlbnRpdHkKL0NJRFN5c3RlbUluZm8gPDwvUmVnaXN0cnkgKEFkb2JlKQovT3JkZXJpbmcg KElkZW50aXR5KQovU3VwcGxlbWVudCAwCj4+Ci9XIFswIFs1MDAgMCAwIDMwMS4yNjk1XSAzOCBb NTk4LjE0NDUgMCA1MzUuNjQ0NSAwIDAgMCAyNzguMzIwMyAwIDAgNTA2LjM0NzddIDUyIFs2NzUu NzgxMyAwIDQ4MC45NTcgNTgwLjU2NjQgMCA1ODcuNDAyM10gNjggWzUyNS4zOTA2IDAgNDk1LjEx NzIgMCA1NDUuNDEwMiAzNjkuNjI4OSA1MDEuOTUzMSA1NDYuMzg2NyAyODUuMTU2MyAwIDAgMjk0 LjkyMTkgODMwLjA3ODEgNTQ2LjM4NjcgNTM2LjYyMTEgNTU3LjEyODkgMCAzODguNjcxOSA0MDQu Nzg1MiAzOTYuNDg0NCA1NDYuMzg2NyA0ODkuNzQ2MSAwIDAgNDkzLjE2NDFdXQo+PgplbmRvYmoK MjcgMCBvYmoKPDwvVHlwZSAvRm9udERlc2NyaXB0b3IKL0ZvbnRGaWxlMiAyOCAwIFIKL0ZvbnRO YW1lIC9UcmVidWNoZXRNUwovRmxhZ3MgNAovQXNjZW50IDkzOC45NjQ4Ci9EZXNjZW50IC0yMjIu MTY4Ci9TdGVtViA5Ny42NTYzCi9DYXBIZWlnaHQgMAovSXRhbGljQW5nbGUgMAovRm9udEJCb3gg Wy04NS45Mzc1IC0yNjIuMjA3IDEwODIuMDMxMyA5NDIuODcxMV0KPj4KZW5kb2JqCjI4IDAgb2Jq Cjw8L0xlbmd0aDEgMTcwNzIKL0ZpbHRlciAvRmxhdGVEZWNvZGUKL0xlbmd0aCAxMDMzNQo+PiBz dHJlYW0KeJzte3lcVEfW6Km6K01DLzQ0iMBtOiwGlEURMC6t0oASENFooyIgtIArsohbEpOY0WCi Zhk1k0xizKKTte04ipnE7GpMzDIxiZPF6MRRs5A4mcxMotL9TlU3iE7yvffNe98f7/ebvpw+p6rO rXPqbFXViUAAIBRWgwCZzS3u5kGDu6MAIg8BiE8tql3o/kPNwrMA+ekAIbcsrF3WLD0qvwRAovEt bcHiuto/hO+tBBiIPOLNjQvblr056WgCjuchPzQ2umsNN6ifIO8PCFdhs/7NG68XkH4eYXjDguVz f6t4MwFsCwCs++c2Nyz8fZJJAzC8CyD9o25pm3a9Mm4nwIBlALS5bmFts5z9cTOADueXNgPTHaHJ s/VgtWHk3yFWBfZ5qnZvDMN7/rlyub+854y6U1mPTR3nh8A7yi2+fAD1S3+5f5m6s28k+KEO1oPf paBACUhAwQgZcB32nZP+gbYiIqDNGOc5hCaOv6L3QrGYDUkI68QjMEp6DDaQIijGsZeDkIljKxA/ hfAgwlvYfgHBgXAI4RqEhQgxCDcjTA1CJcJExs/eRXozm4dhbKfKV0O92AWiuBb734By8SziCQhD YbPUBOXSSOQbAfuEdyFLvA/7w7D/KbBIsYjrkX8p4kbEO2Gb8CfEj4JZykS+ZyFMfg/CxDaETQgN UI/yDtNj/h7E01H+r8Vs/49iNikVh+F77bBW+AeMRVwiVsFY+nekReyvhrW0GMrpd2AWQ5CeBZvl R2At6xdLOP9a9o4wEDYLo2CskA6TcOx64WvQSz+AQaSgF75HeAtSUW4yyns7gOEBvm4GbN245t41 cf2ZTj8DXMeqy4HrVwyjabH/OYTX+nS7ElCv/iA8yXxFUlGXlxHWCA/BdYh7EJayOaTd0MTBAi8i 34qgv1fI34FJGgvjkR4W9GUANkEKl+2GXPSfS1wAieK7MAvt/BWzOcI4aQaUyBdxLVUwivmfxV7w faMQ6y/ndnmax9BNCL+TTqDfMEZ7bcXso3wP4xU3f78Kx6uQbwfCI9j+DOEgm0/4ATKY3bnvr8F3 syEBx55AeF98GHLEt9FXuH5sHwm+84hSCqO4HBZ/vXhCIP7oCL8H4STSDdxHLPYwj3r91QvMF0xv BJYfzyC8g7bbHrAzKcH2G0H8OzHM76NzIIvFLcbOMBajLE5w/BjmgQHtOIrr34J6LES7snXdDxcQ tqOv9slrwI0wGeF67i+0LbMdX3c2rOR5inFLzxGC/jCwfGIxjWt4LChzLIs9HlO9mMU/5gW++xOz DbcDi71efBa2SOuQh+nH7MNisBdjbrL8uAw/HIhrrl8vZrZj8chyFvMmiOv6dMIc5nnE8I8wiecD xmsv7rNTn70gj9eWLLJezIJbma70e3hHSvNvl+P82+mP/u3Smwh7EM5hO9/f3ldzLAgTEeZCvXQN 6roW7ZMPXeL92OcBVXoyUGvEgzCX+5rxdyBMg0HiY1gTNkKSHAMT0W56OQM6cO6XWR+uqVx4Huvf XNiI820VG9F/2CfeAhtFF8ShPyeycWE9vos84gxwcb5ZcKc4CmKFi2ARnoYybE8U74SbMFYn4rwT hdtw7ka4DevztaIZdXsVbpUtTGf/Ni6D8eM460M5m6UPIF8chPo+jfqchKlsbcj7hfAyDFZehwSl DHnOIc9fkOcBCOfrexlU8Q7E6xEGcZvEsbmUJMzpoZAj1WAfAnsHcYL0PWRx2/W3zx6U/wPOy+Y8 gzrdgrrmcDt2KCk4F8aH9A3ky+Owj9naCzmKme8B14ixUIhrKBNtWJM7cE3b0NY1WDv+AhXCdhgq 3o19DHBcvAkGSe2Yz8uRvhbGibN5PV4rnIcCYRuMQmyUcwO24vYZAwtlI6yVByP9OeRLKxHrOf8Y 6SDSWbgPoixxjv8ik83nKYZCOg5tN87/OV3if0PeCoPkcuRFHq7jecw3JhdtxfXtzZUrc+vKfAni 3rz8FzwymC+tqDvKwvrzOdb304ifRPws4j8i/gTzeSWrO9J7sE98D2XhXsn3K7ZfhvCYuLM3J/ty 0IL+yL88H6/Iy1uC+ZgczMesK/PwSsz2W77nYc1iNYg+hvEctAXbM1jd5/sG1v5e3itx77uBuu7/ Ec8geXQP5Ikn2D7hPy/Y4G62V6lfwnpZB7Xor3alHOVjrQzWwzkISxEeET+Au+iHcAsDpHchbmZ7 BDv6BE9NFnYewkPVAAQZLh2yBM5z+QcHBVGSFTVEF6oPCzcYTeYIS2SUNTpmQOzAuPgEzZZovyop OSV10NVp6YOHZGRmZQ8dljM8Ny9/xDUjR40e4xg7bnyBs7CoeMLEkmtLyyaVT66YMvW6adNdlTNm zqqaXV1TC3Pq6t1zGxqb5s1fsHDR4uYlLa1t7Us7li1fsXLV9TfcuPqmm29Zc+uv1q67rXP97Xds 2LjpzrvuvufXm7dsvfc3993/2wce3PbQ9ocfefSxHTt/9/gTTz719DOeXd5nd/9+z96ufc/94fkX 9r/40suvvPra6wcOHnrj8JtvHXn7nXffg/ePfvDhR8f+9PEnn352/PMTJ9FXq3ClK8CB58YRcAO5 kdxF/PQgfYN+JtwgdAq3Cw8Jb4t6cZI4S6wW74y/Nf5vmlGL1OK1RC1Zy9SGaiO0kdporUC7UXtE 26E9aZNsEbYoW6It2TbENjuRJsqJhkRzYmTigMT4xLTE4sSaRHfSQ0lPJB1Oeifp9Dl6TrlA/X52 QodtKPs8PYCyj6HsNSh7g/CwSMRwcbI4W9wUvzr+e5QdoVk1jcvO1vL7ZD/8L7JnBmWbUHZMn+x6 lP14UDacky4Qv9//BYDfAjYAnwmgZ2+Pt2cXc3/P8p5lPR09S3sKv3joi5wTwaA4ceuJzSd/OnHr yb+ePHdi2UkPwMnOE6aTg09qJ+M/n/f5uyeVE58c33z8r8fxFH98B0Lb8SXHq49nHM/89N5P7/z4 u08Xfepi80gv8uBbxs/l2QHg9HDM2is+dDt9jO7+l96dV/b0jdwVgJ8ZWU3XcOJJeBjWwK1kGGyG s/Ar2ADr4bfwO3gEzkMnUeEWuBvOwV/hDvg7rCM6OA7fwQPwOPwNvsf70XZ4Ct6Ag/A0zIE62AT1 8Ca44RAchnfgLTgCb8OXMBfeh3fhPXgGGuAnuBM+hKPwATTC1/AN3AbzoAnmw0JYAItgGyyGJdAM LdAK7dAGS6EDvkLLrIDlsBKuh1XQBQ/BjXAD3mJugh+hG54jx8ifSCjRkzASTgQiko/JJ+RT8hmR iEwMxEhMRCHHyefkBDlJ/ky+IGYSQSwkkpwifwEf+MlpcoacJV+Sr8jX5BvSTb4l35Fz5K/ke/I3 8gP5O7rmI/IP8k/yI/mJnCcXyEUSRaykh/hINIkhA0gs/Bm+IANJHGYLkHiSQAmlVKAilahMFaIR G3hgF0kkdqrSEHIVSSLJJIXqaCghhMIp+AtJJYPI1SSN6mkYDacGaqQmaqYRJJ0MJkNIBrXQSBpF rTSaxsAfSCbJItlkKJyGM3QAHIOT8Al8irXtBPwJPiejyRjiIGPJODIedpIC4iSFpIgUkwlkIikh 15JSUkYmkXIymVSQKWQquY5MgwfJdOIilWQGmUlmkSoym1STGlJL5pA6Uk/cZC5pII2whTSReWQ+ 3EcWkIVkEVlMmskS0kJaSRtpJ0tJB1lGloMXnqWD6NWwB/bCa3QM7Ibfw+twM7wCa6GHZsK98C28 Co/CH+EleJmEwAW4COAYPrXENnFCcVGhs2D8uLGOMaNHjbxmRH5e7vCcjCGD01OTk66yJyZEW0xG Q1ioLkRVZEkUKIF0p72wRvMk13jEZHtx8WDWttdiR22/jhqPhl2Fl/N4tBrOpl3O6UDOuVdwOgKc jj5OYtRGwsjB6ZrTrnmOFNi1LjJjsgvpOwrslZqnm9OlnBaTeSMMGzYbvqE5oxsLNA+p0ZyewqWN nc6aApxvV6huvH28Wzc4HXbpQpEMRcqTam/eRVJHE07QVOeIXRTUMCbWIyQ5a+s95ZNdzoJYm62S 98F4PpdHHu9R+FxaE9MZ1mu70l/qvL3LCHNq0vT19vraWS6PUIsvdQrOzs61HlOaZ5C9wDNoxalo XLLbk24vcHrS7DhZSUWfAOKRkox2rfPvgMrbu7+5vKc22CMnGf8OjGRL7DMTjvfSgLqhhrg+m43p sr7LAXOw4Vk92RVoazAn1guOjLRKD61hIy/1jkRex0ZW9470vV5jtzFXOWuCf0sboz2r52iD09H6 /C8J/3Bc8wjJNXPqGhmudXfaCwoCdpvq8jgKkHDUBtfq3JWZgfy1NbiIJmaGyS5Phr3ZY7GPCzBg h8Z80DTFxV8JvuaxjPdATV3wLU+Gs4DppTk7awoCCrK57JNd+2Co/8SuYVrss0NhGFQyPTxR49Ep yc5OV/1cT0JNbD3G51zNFWvzOCrRfJV2l7uSeclu9Aw6geJsXCJ/C9d2BXcvM1u5kqRqLhorVDJv YYdWiF/2cSNxwIju4k3m0XEjNRfWsl42lBLkYNRl82BDSBpfzIYE9ur44lhbpS3w+S9Uig3qJCV5 1H5zGbGjT6eAnF9ULcDNFBqkOd0F/RS8bFIpqGBwtp/XkzJbBAXjGypzZ3HvkJCEmYt9FKfhXcyL 0ZoHyjWX3W2vtGMMOcpdbG3M1ty/JVPsJZNnuLi3gznZqdpLpnSyXnteoAu0zgkewHByYOLkmYcF egux8nR2Ftq1ws6aztou/+o5ds1o79xVUtLZ7KxhYl1owi7/c+tjPYW3V3qMNY1kBJvfPqG+0z7F NTKWB2V5X7J66PiprqBCecEA5QNYQcbtspN1k3c5yLopM1z7jHjcWjfV5cVNa3zNuMpdV+GYa5+G FZn30r5e1tJYC0oIlgUv7mVsKHafA2A1HxV5B2/XdRHgfWpvH4G6LhroM/I+/AxGKbqpLz5KHI+a Igsf6SJ6b3bCQ10k0uFNSFh8MMu2CGEhwgKE+QjzEJoQGhEaEOYiuBHqEeoQ5iDUItQgVCPMRqhC mIUwE2EGQiWCC2E6wjSE6xCmIkxBqECYjFCOMAmhDKEU4VqEEoSJCBMQihGKEAoRnAgFCF0k17tY RTTcu4ihHO9ChoZ5FzA01DufoWzvPIayvE0MZXobGcrwNjA0xDuXocFeN0Pp3nqG0rx1DF3tncPQ IG8tQ6neGoZSvNUMJXtnM5TkrWLoKu8shuzemQwlemcwZPNWMqR5XQwleKczFO+dxlCc9zqGBnqn MhTrncLQAG8FQzHeyQxFe8sZsnonMRTlLWMo0lvKkMV7LUMR3hKGzN6JDJm8ExgyeosZMniLGAr3 FjIU5nUypHf4C1Rb0/SsBBfCNITJFVkJhQVZCU6ESWVZCaUI2pbMLY4t5VvEzHXEcDvZuObBNc+s eXHNO2ukjY0PNj7TKNQ0NTfRjTPJxhmkeTrZWP5g+TPlL5a/Uy5tnPzg5GcmCxsrHqx4pkIYs2rS Klq+smZl80qhuYw0bySZG2s2Nm8UYAPBP8eG5g0UNmRucGwo31CDDdnY7GimNW2kppU0FxBITcWD stmkOnINY96OIobtCdtpNDrdghCOEIagRwhF0CGEIKgICoKMICGICAICRSAIjlWA3yeiVdunFtX2 Ybhq+yBMtR3Vq7b3Q1XbH3Wq7b0Q1fauqtreUVTb27JqOyKptrdE1famoNoOU9X2BlFth0C12cOd iXqnTefUVGeC7IwXnXHUORCcA9RoNUq1qGbVqIarelWnqqqsiipVQS3pUvwVJR61fKZrFyEbKj3m EiiZOm4fEOK/9Y60f/PTOo7ElXhip7g8m+MqSzzZSEDcrigYV1miYcvu2YwFyZMZV5lGcO8cR7Bk 7VJxdPysAI4yNo/elZvrbNICu3JNZcGuTGh+NhsyIaY5urmVf9raWq/8/LsK/zc+bWnsrnYaYR/E IFjEDLDgffEMwjcMfHhbk17Fu+NUAIH9l5738ZY1BfEh0P3S/ezf/hzCu9URvLHtht7b4H7sOwS3 4x3qPuy/1AN4V3uct+vxBnUzcmxGnl76PjyH9+unmWQ43mseIR9CIY3G+8crAEh/DV+T98iNeFuI wPtEI0mHO2gOqRTGSBLSu2ERvjWbvEXeEo/hLW4RvvFHqMbbUzoso++STcKNsJquxhGm66O+7ZAN +1De//VH/d/6o/fD/ME+zB//I5//IX8gV+r/w+c1eA3vyoGniD8dvQ/eWAV6Lz1MDwuDf/b5SfhJ nC/OlwqkX8uN8gtKCH8mKV+oQ9VdIen4LNWF6Jp0r4YW8+fz/zz/ef7z/P/+sKIJq8lsYbU4GwRQ INkRJd0v/Fa8XwEr5GIXKPcTbAJk9PR0k4zqKkRZmREmmynJZrKtFqBnNQUf4BTQg/sA+zW93H9G XC79ESLhtGPDmUgCikqE6QqhNxjJilASKRNhHWyFndCFBfMYnEWxit6qT9Hn6kXQa3q9XKK3yk5T NKNM5rAw/I7KhTNA6QacaZmBdFgIdYcQnTBDmCcIVxtGGKgQqt9CdpC95CD5iJwhMpAzekJUiIZ1 ILDp1+pxMV3+dx1Wk0kuAYvewbA+XJhgCZkQHmIRYMyYbmO38Uga/lVXVVVXZVdXmYYiVcVb1VXE +GFaWjd+VVcdqAr0Z2XyASXZnkhNFvPQ7FyrbNPAZARbtjhqfM3bL3/53QtvL170tO9b30nfHlJD rN9JtzxR6NvtO3/e98Zd9z5FHiBTSDHxot1wHxEJ7nWhMMuRFI13tiKdTlGsSoqSq4hKGBRIBYqa ouaqAqghzDZql/+Cw8Lso+pJsShKUBwiFatqCA2sxZSf0c2Vrq7qRr2rRhpPocbEZIu0BQH39VO+ gXTrxW3CfEnyNT3ec263tG838+I+/LoJtRGg2pGlSCRVIkJBNG4zeVAMLmgEuRGWAXOkqKAnmeeZ TjCQ6YOGPrGb27nL/7YjNCQEqSIRVMI0I8Z/sCNXddWSlu4qVGioaahp3yFp3/kiCFhB+AHlSjDO MVAVo0V6SDwmnhV/FEUQCkAsUkDggrr8PzjCuLAiWSgOzo3rPZ2WZjxt7MbpA1PbIjcfoptx+gu7 WbSX+96TzuHpzQxx8Kgj/rpYIjQOINOthOYY241UaAgn1CioBIoGOsNRxm4mjBGObCYsPCHKmZqQ l+BKENaqW1Sah5yqkfsgHmefQIxCaMwEKWJCqBQSymIKQ6rbnJ9/tBsv7Q7zgIirI0ZErIgQI2OS YnJi2mPEqqpKwmOqqqrbeBwD7HQ2slfziMvKrILqKknRBNkeiCr2LUXZSDDczNg6F9/zw8MJc31f +w6S0cRIsojT98eFhPRMfO6Vg79/+8MFrxJ7GPGQCjKKPOVb6tvmU57fJq33ves7f9H3NMknkXR4 IGuFdZi1ydDl+JV6FVGMBJI0p+bW2jXx6lAiFKfuTKWNESRCcSqJuYkNiULiABjgzAsna8MJhKd0 iGjCeHd8e7yQk+BMcCe0J4g6/Qj9RP08/Qq9NDSRCMirC02IF5OKLS5Lo2WZRbSYcvGcMp004CmF Za8CJMk6wSROSAox9WVkdZXxSJXZms+TLpCISHW/ZjyKXyyCgGdoVW5uVNTQ7OE5w5JTUpKTc4YN H5ptVZIxN+VIS1SU1RoVFWkR7YlTJ+TtGNe+YdKDSzd3nN3zt+prUh8pnNt+dUnbss3Lff88/ur4 rkG5q+sm3liSW/jS2keOTXo6bnjbzLxZo/Pyi17f+uhptJUZM/VujFEFRjlSUhSSKhLlbiLeTQpS KAHKE4EmsqCgSrFYLFFVojwUsILybDxtPF3FU9FusuXYIumTh3xDxJsk6fwFSdq9GyWE+b8RH0MJ MjzoyBNrjEa5RHToDfht1OnkkiKMulwR6xteAlNVlypKhbJQSOWlQJcSTJT2IkKI2OV/aXdiCr7T 5ffsHhDHiZccyZYopK4KDZVLikWCs1jFFDFXnC42iB2iDOIGEiJTyvQdg0nUsoTlKsmo6s6PyYhm wcyequoWFp2AQ5KdDCVkKL3H3XP8OFlO5n9kkY5ceEPMZbnm/0Y4JY6HWEgiyfsgyf+tYxSzihJh jaCkQevQKE01FBso7DUcNHxkOGMQMegiDVJudFH09OiG6I7otdFbopXopFJd6bpIEtnlP+dINqAZ IvVsnsgUW1meREDSM4tLvE9KHiEQIQnYUieHIWugWi0DEWh0zMAKnRpeoRqiDamGPJTsMmw17DR0 GQ4ZjhnOGvRgME+MnxFPhfiKnWqXSl1o53nqCpUKRep0lYLKZo2IiMBsV/X2CqqvMMeE0lCzwqxl DJTctEDuVqHxjJ+hr40fYAgbP6tKOxLcQlgfoiXd3QeqjK+ZzH3JjmGcliTbEzF0r8LQNdoTlZTh GMRRkSaLNTIxWQiEMu4y9FTL1zfsI3Gfjbz2rLemfPiL0798f2pba9qMqzbteX3T4pUb9657+OQA ItY8mD7m6Bnf6jsyqseRzy33uHfcxmrsWPTL79EvVrjT0eSUyEOECKkxeTEU1oZtCdsRJlBQwhgp hClleeZiM11r3mHeaz5oPmOWwGxm1jbzomeOTtLl6Jw64WpxhDhRFAR9hRJmDaNhBlLBNl/cFsSK SF2FITRSCaQzN8lnzDq91qjqOVo1Mmg0zIm+jOW7qT0RcthuGiU8Mzvu7qL79jz36OqbS+798ye+ P5NBhE55RTj2q7hhf3rh+dfrttWR5AsEyPBCVudxjeJAXGMMJJKxjiaXlQhdCulUfqM8rjynHFY+ VmQ6XSKN6jJ1nbpV3alKqWqeWozJdKmrSz2kHlP1MB0DkapGvucGan1CWVE8odZoFqgNPEh3RO+N PhgdEt3lP8W3DEY4ShlzNIkvI2VrjSTPWGx0GRuNopHHq5HHq9G+Vtmi7FAESJFypSJpuiRSpeJq dYQ6URWE6WqD2qEKimpVKQbfUUdeYLuPLw9UTVYzJSAOlhOESK4BZECFRc9algY8JE20zLBQqUIf auHWRwsb07qrAkGKgZlWtaSaeaJ6CXdFFTsmfIYYO1/jaEng7INesVmsAYco6JKU5BxjLquuWFBJ oiIrtmEpyWLYxYsNMzc+vLA8fWbL7Yfv+O1Dm17/y803+K66cVpFKJ1cPIlKz7td1bela1fftsVP QrZtvGnVkTGkqaKsrbV0KotKdJsf7/yRMNsR124mQmReSHGIK0QICQ3XK6FSqVIaWlqsJ6Dv8v/V MYCfE/npRx9SgUltoBURep1BjoDeZBzZW25xWSONB4wHqg7wJCOBALMOjbRjAbbnDOU7BT08Inv6 Eunjj/fff//hx6ZUSyMta9yxcdsuLhE2bjvyVTw/O8wSDoltkAkj4YIjvTjGFdMYsyxGhJS03DRK 3aSdUEEzDjTLZalpeWnFaa60xrRlaevSlDRWueYyZdNiRpQNHA32srBhZeZRVkLWxWyN2RnTFSOu i94avTO6K1pM1efpKbAtkdJ5WSuyqDu3PZcKRi03dYA1IToytyLBEYK7QMIWdYe6VxW2hO4I3YuH jdQpatKUUMLKvsmC8cCKlYmZiQgVQ7IqIoeEh8qRvaWq5wCek7qP9qCDj+Kp9gAeOkz84BFIRJ6d 3Ue7D+D3gaNpVd2mfqeSiNzAPotmtCfiPpubbOImzLUqGBGyosi8TPHSxXbcZBJMaLY31zQ8dvtN v35e25lxav6kP3/15AOV1ataJhx+5LcDZ89J25P+wC7fP99sPE1K665f3uBuWen7ZOviynE3a0/m TIuYR+SdJ8a2tE+rvnf7p0ajkBQ/KGHLr+7ZM1ESb69vvntjW/3tGEdr8QT5J4yjCGjcoxitRtyS u/w/OsL4qbE0IpxlRwTriWD+iFBDS9VSJcQakhIiQEiX/7wjinGEWOaJK0QqVhgidCE6g6LjYYWW qwoc1zCmjuJpLY1HlM00jMWUguE01BQs2ULs0vnO9Un79yf/bsbjL9OHlnVOHn7xlHS65/1rJp14 paeaxRMW45el1/DEbwKXN2Sl0OX/yWFhegqmcH1ph4mAiatrYurG9bsPqexwbYoIm2yEVbJRrzPK 7HzxIQY9z2QW9T0HUEG8qxHmhMCuMlzAaLeZSEmW05mV6SzIvZtMll5zZrJmVsH5kRjoF95jZ3D/ N1RBC6rgdpQpOqsuRZerK9JN1zXoOnSqIlvlFFmQaalCrCQF71sikGhegSJ4tEUxFUnIXumgRIlO HaCyaibKFUoogWAZCmjJlGQ1PwKthuERqW3eX1fu20gyxL0XmqbVPQ4Bb8pxWMcT4KBDUwbimcfW aKMptlzbdNsW20GbBKW5CSSBmymhy98diPgEtTRXIYrKehXs5SUZCZ+D208xliomqynFdMYkgokd 7q/hZuYl3qRZB6YMzB0okOh0xtx7FBEhOspgiRIqYvUVUQk6VWfSxSpRilnmgREoOcbPjrDzalrf Vt+DQYLZc5R9BY+qGCzBWLkUNFaWPsHAkao/cS6L2t8xJ/+m2P2rxix69PQs7elZj+2hj/VcN/zi WfrTpJmunItfiRmrNm0cVfG6t2dY0E7CMbSTCWodZsVgNVDSEUGg9FIAcRvwSDIGYujyqDfxqDeL FeEmDHidHK4EAz4Q73wh3VX/Eu6ouWYyCQMalo/dkLz/5pGzPyA1dPETt5XlXzwlZnQ+4Jva09S7 H+tQv1Cs7zsdEXslQvKsxFRmlXPlIrlBFmV2Z2QqymznnM5UlPVla2EL7IC9cBDv/3Lv1VME4J4C voNC1DyBuEMIu7rh/YQ6w68Ld4cLEyNmRMyLEMIrQiIqhBAen3gj6/Kf/T0jBVxd2pg0fpgNbHL9 jiPcWbzQDQN+yQI8hkQYbVi/jLZEeSwJ/fi0z3fxxF/8cIjE3brFd+rm++iAH0mW7xPfRV+P7wMy hIBv4bE/kA1H2drX+maJ6bh2A56E73UYz8SRqLIi3T91eMPfoqO6Lv9pvnAkvnLEsyXpTCYilpJS KyUKtdIUupaeof+kMlAWwllsAZTyWwblt4yBrrDGMDpdaVAodVrIxBhiqQiLqVBIuCCHhSq9ngyu tTf5lvB9ka12CXNsEnNn5HC2YAsuOFkw4XVKC7iaOPfvX3DvKZ8fvi+4L8rclkvm7NyX2naNzya9 71rgO+X79gffm5lCes+m2Cyy6c3n84I3eXYCC4dqR7RqjDamGg8ZxYPhH4XTcDmkVC5txAzt8n+7 O5ikFx0JPEsN/euNDJKOVuhVWdHpg1vXkexgdrEazOtHYEPvVd9Kj4we496yf3/jkaE1wrK0527p +Y2Y8cSL5sDJl15EnWzwqqNNTYhOoEq4NZym2ovt6+wCjNCTnDgiHDIRk1TWENcRR+OsYC3DQ8cW /Q79Xv0Z9gtV4tkYkhJLSKpCUgwkVSPUPaB9ABWUmAGCRSg2u8yN5mXmQ2bJbLh0uWU/TOHlFuPv hMNiwguEUKFZohlhqTBooQaF3w8xHtNex0Pa61UmvO9WB39l6r3wHghceINHMuAX3qHZOcNShgi9 l93AwYbfdLHkjx3/YK3n8Vtmjre9dF+7d/iSloKq9nXXtxx+9neO3Y33zLt25OhJlUPX3DPRM8OR 1ZAzOv+uRZseZrVkErOS5MJMXe6YrEZER9BUK8EDrHGLStQQAjKeyfglN6Q0kJA/8pRkfoRknpip PDHTI0ZGUEMYlZSwCjNeCCoUc6giB27CGI0H8FBWxY5obDtNG4mxyO5J3KNQFYHnspxc/jtV31Ug OefNVav2k2TfxzPdE8oGLr3jxmeEezefmOD7aHPPN2tbknbEv7CJ6X893m++EDPwnt7qiO2wEB0e HRWVWNUiPEzvUMW1eGo6owp4oD63O/hD2g+OwfxkDaVnzT+aqWK2mlPMAphFftcR+V0nQqgID9GF h6pysOYbuy+rGUtaurv5rZ6dfXJxT7PnyFxrE7nmo9n3x+zfr708y/MHMaPnuh8XFNFzF967Z0zT 4efoi0xnPer8uZiNN/4vdlH2f3g4TCIloZJMZRmvBIIoqgqewTJwg/nsCJNuzs/KjN0l/x+zOhpz 0XvsLxWvOeyKw643ioDn8kkpvAhPlztkKZXm0WLqosuoJF8P9Hr+c0Ie6SI0heQSSsTMSKtcImqh aJeu3h8P2E8HEohLSKiMSgR/OljCfzdY0p0/iv9w0MN+4OrGK0VWZmVl768GIdm+nHdJLLEdtIiF PWb6LbMEnrJPo/cM8F3QEpFhoWKFEB4uh8pCmCE8LBTrvsnYt0Tja1xif4P8N95wuK5VSZ6BpGB2 pogEigihuXghVk2pJgp5YcVhrMjqnVisFDF8ksGkn+QMJYIYatwatjOMkgYZTRNWFDY9rCGsI0yC MAOTbEDJXIYpeGrGSDnAb/7sNwK8go3KCPQHL74Bq2C45AR+wAqYR0vqvqvj8dFZvuOvkGtI7Ct7 5q57fHG564kb6JcXXxNGBv5bZBq99K8IR0Pv/+yOdsRWgMbrPEwM0gKeiycHabEfj4R0fZCWcZdu 5v+iUMB39bCS04F/cbie0zLvv4/TCu/fwWmV03s5HYIzrcKNO0ATiCbjgzSFcDIzSAuQTJqCtNiP R0J6Y5CWIYrsCNIqxJMXgnQIxNOQIK0TvyGfBOlQyJR75eqhOEjr+q0llOmpGDit79cfzmglgdNG pqeSwekIpM3KKE5b+vFH8vUG6Kh+/TH83UmcjuWyAnPG9eNJ6EdfxfmrOD2Y0/MZrfbTWe03v75f vz6o//jFzctbmhoa27TUukFaVn7+cK20qa5lceviuW3a+MUtzYtbatuaFi8aoo1dsEDjnK1ai7vV 3bLUXT9kaot7Tntdo7tNK51S4W5oX1DbcuntvsFp7pZWnELLGpKd3ddZOgXKYDG0wEKo5f+j93Js zYHlJAzcMA/bXyJcGp8CbYgXYbDVYl+98Bthl/CC8CLCPuE54UkYj7zNOEcLNEED7i1toEEq1MEg xFmQj89wpEpxtA55FkMrwlzONZ5LaebftdjThNQiGIIjY1HuAsSX5mzlLTdiN+Kl+F2PnFN53xxo x7kbkWrjkqZABdIN2LuA6/xzsv/1zWl85tagFkz3IZCNz79yMgn/1Xp+Tq90HK/n+rMVLeL6a8zq +D0N+xYhpxu/e+dZhE8tn0Xjo5dsmc57mD1qERpRxkLuH9bH3m7lrVZOubkF5/6s7LlcWw1btTiy nPPXcYluLq+FjzCvz8H3FiC0IdeQn7WdxmNkPpehcc7WoN6taI+my/zLJDO7LeRvNfIV/pzOrLWY 697LxSwwFDL5SAf2NXH5zAa1fEUBbzdw3mW8331Z/ASiWOPS24P0XL7KNmy39GnPvODm4wFLtSG/ xv8hBNN6MR/9JftowTX22ro1aLHAChhHM1Jz8a063sO8vDDoZSY94IF6Plt/6bVcg3ZYgc8Czt/I 5bdwntpg5F8Zk+lBS7mDkdRrySU4k5vHS69POngUaPx7PpfM3k3E+RbzPGJSlnNa455vCvbV/kI8 pPKRucE60uvJhcG1uTGDa3mG13Hda/naFiA1qG/FzJvtPC8a+9YfyNBfiiKWB4FcqeNWZXO29s3X y1XH32/leePmGdCfO71fnDQiZweMQStc8uDPrXUun7E3xi7l7M9F0ZzL/MDqWCCOF/T11wbnbOqL yIDdW4L2a+XZ0hAcq+3zeGu/eScEpbfwbG/jMZgI115m0V+alcVCE5/pl73bHORNxJlZdrVhzwjI wKeDP0NwzitjcQi3/ELkCWTBYpyhhXu+EdsZ/fakWp5Nve2TfI9yX7ZnuS/blXgWiPFillgiFomj 8DsfuWt5jNXzvWwscrTwtbO3/hf9n7UxCmVuZHN0cmVhbQplbmRvYmoKMjIgMCBvYmoKPDwvRmls dGVyIC9GbGF0ZURlY29kZQovTGVuZ3RoIDMxMQo+PiBzdHJlYW0KeJxdkttugzAMhu/zFL7sLipO gbYSQpqYKnGxg8b2ADQxbaQRohAuePuFuGXSIoH0xf7tH5uobl4arRxEH3YULTrolZYWp3G2AuGC V6VZkoJUwt0pvMXQGRZ5cbtMDodG9yMrS4Do00cnZxfYPcvxgk8sercSrdJX2H3Xred2NuYHB9QO YlZVILH3lV4789YNCFGQ7Rvp48ote6/5y/haDEIaOCE3YpQ4mU6g7fQVWRn7U0F59qdiqOW/eBKT 7NKLW2dDeubT4ziNq5XSIhDPiI5EOVFNdCI6E9WBMh4oT4hOREUgTrGCYpw6FNQhp5qHUzB7d8Uf HrdvykiUHaguafnx4SAUJJP8/EgJl+Quz+mSbB3SezMqvw5pXea2ATFb64cfNh6mvs5badx+CjOa VbU+v1tZoasKZW5kc3RyZWFtCmVuZG9iagoyMyAwIG9iago8PC9UeXBlIC9Gb250Ci9Gb250RGVz Y3JpcHRvciAyOSAwIFIKL0Jhc2VGb250IC9BcmlhbC1JdGFsaWNNVAovU3VidHlwZSAvQ0lERm9u dFR5cGUyCi9DSURUb0dJRE1hcCAvSWRlbnRpdHkKL0NJRFN5c3RlbUluZm8gPDwvUmVnaXN0cnkg KEFkb2JlKQovT3JkZXJpbmcgKElkZW50aXR5KQovU3VwcGxlbWVudCAwCj4+Ci9XIFswIFs3NTBd IDEgMzUgMjc3LjgzMiAzNiAzNyA2NjYuOTkyMiAzOSBbNzIyLjE2OF0gNTUgWzYxMC44Mzk4XSA2 MiA2NCAyNzcuODMyIDY4IDcyIDU1Ni4xNTIzIDc2IDc5IDIyMi4xNjggODEgWzU1Ni4xNTIzIDAg MCAwIDMzMy4wMDc4IDUwMCAwIDU1Ni4xNTIzIDUwMF1dCj4+CmVuZG9iagoyOSAwIG9iago8PC9U eXBlIC9Gb250RGVzY3JpcHRvcgovRm9udEZpbGUyIDMwIDAgUgovRm9udE5hbWUgL0FyaWFsLUl0 YWxpY01UCi9GbGFncyA2OAovQXNjZW50IDkwNS4yNzM0Ci9EZXNjZW50IC0yMTEuOTE0MQovU3Rl bVYgMjM3Ljc5MwovQ2FwSGVpZ2h0IDcxNS44MjAzCi9JdGFsaWNBbmdsZSAtMTIKL0ZvbnRCQm94 IFstNTE3LjA4OTggLTMyNC43MDcgMTA4MS41NDMgMTAyNC45MDIzXQo+PgplbmRvYmoKMzAgMCBv YmoKPDwvTGVuZ3RoMSAyODQ4NAovRmlsdGVyIC9GbGF0ZURlY29kZQovTGVuZ3RoIDEzNTQ5Cj4+ IHN0cmVhbQp4nO29eXyURfI/Xt39zJVzcpADCPNMJgkhN0lICEYyQBKBcF8mQCSTZJKMJJmQmSQE 5fICgwfKx1tXFERFlOEO6AruonjhtaurCyKueIuii7ouJPOt7ueZSQK6u5/vd1+/P34vMlZ3dXd1 d/W7q6q7J4BAACAQVgGDrJZWe8uD99nvBUiaAqC9ptnWZH9y/PAkgJmvA8S1NdmWtmhX6PUAJAZ7 yY3OGhuMyWgByMZyyNmGJvfSoCLtaGxHCjnT0GC3BYXq81D2LFICFmsP194pI/8cUl59Y2fd7JmP 3AcwLgjAeKiupb5pSPcVTgAzljVja9rd8mU/mF8DSHsZy9Nqmmwtn8QsegBlk5H+Blx3+vY3f3vk 4b2LQgt/1MeiavizqfUPB3m+5/Kdx8992FOvf1yfAxQMKE+EAKa6sb3TYIL+ELaX6R8HM+ig3w97 jsuw5zApgvmgwd5GyIRxON0I7TWIFdWqQ9ECP7noX0ig5IJFSA5dHBzRzINHyBoi0a3wNN3q3cDi 4BtpG3Sj7EisW4R5Oy3w3ovyd0gukon5UqQWpEqk25CeQvoH0n1IXSjfxvvyMfzkIpLeBE7NPO9f cL4KzRE4gLQA+YXSJ1CpLUA9jsA83lcCKMb6BTjWLO1WmI/1tdj+LNaVY/57LFchvx77eZF/Cfle 3a0EcOyDyH+H9dk4TjDSM6j3WvYCyrq8K+hWkoJjzkcqxjlcmDciXY1yfB2jeD05ApeTI149tpci n4fzTxDyLqjFMb7mmCEmvP80jiWWVyH/KOrxsATeHuQBKZlug8U0Ep6j27xzcP2blXUjHYHn+Jr9 a0L9VZ0uJkXHq/sTzrm8P/XpdhGtuoAOsBwShvn9SFaksfQoNElTcP8+gcmaT2E2Jz36DOI0H9d4 WqqFa/XgfRr1fEazG/th2U8uKJMehCB2FkZj2zLt3fA91gMdifQTPE6/gdu1ifAs2teVOP59SNtw zHZhC7UwB/tniHE+hcHIP4LE507y4cSxQS/ZrLsVViPu57nHYP/3kd4jR4geCbD/Kpx/Kcec7zuZ 1/MFjjMTZWxIZqx3CnJBIGK1H/f1e7Tv93GstaodLuzLYaFqt37iOvhI2JlKAvutcBTpENIrSMcQ s9uQJiI/FcmDhDJEj3PHoB0lCXtFm0EckoR9oG1w++d7JWxWWUO5sDHhM0SD/aNxnHuRntRug2uQ nkJ6EmW+4P7CbZbr6Rub+xS3GV8u7Hsx7KFbaQRfJ7cpf859D6DF74NoW76c+x23fZ5TK4zGfB7L gQJus9zefDnHReiP/sh9wp/3rdWL+tlE/i40qba+ypdzP+VY+PP1cKXAeyfsRr5OaoVqdgOUSH+C WtoLHs1o3MvF3hV8bfRr6NAfAh5Jp2P5vgvyeznp3iVXaw7BtwLPd+EhzJdI79J46V2i0Tzl/VID 5BXNU3SF4C/KLyRySGnjOaf+bf/b+v8bou9pnoI65L/SvOv14nru5D6h+5pkIcm+HOt3Iq1CStGn knv1i0m3bi4YtXi2abkvWGGMxgr50iEokgZhHABIxPq5mhPQxm6Fy6SvwU5W4VnwLgnUDcIz4G6I 5XPR9+B6Tnx8zFv62dEAm7vQlny5z14vzHnMV21K5KrvLf+VvABtkvCzgcdncT5gjBYk7NXb7LfP V6Aa80k++xxop94j/ezzGxw35kK7vDAXZwvGd5+fct/wrZ/HRx7jeIzkcY4WkGSf/IV5X3+Sg35y n4jDR2G+6tv/g7QBqQbbklDPk+j/1/BYhnP9WTsdarQvQgMbCtXa+TjfN1ClzYEhuO5v/WfqVd5v 1PM023eWcpyw/RvfOarJAr2IZ6/DlSLevA7p4hxF3fj5qX0MerRRoFP7fsf9UPjgEijhZ6NUB3dL d3q/xHX8ju1BvLFeuhKuE20AheyM96hU7f2Cn4lsg4hBtdJd3lPsFNoe73uVt0nzDjyovQxq/eNx Gcx5Hddf+zx8LuEaNU+KM3+9Lx7zvdev8X6lO47rfwE+lfahTBx8rnmVrwUxGCXWVCH6PupdycfS zfPuk76EGs1+rEMSfa71fq3iMa8/FsKGORY4pnahOLMPat7Gtho4pquEK3XVOO8S+FwXjXV8rltx /zMwd3tfFef1Kjzf0qGW/YC21Shs8WrNau+LrBtMvnOYHUG/u977vuZazOuR+NpFjnEf/UfcN9BG tNvxfsbvExvwjE+Ae7SboVP7JnRK/4BOzScoPwqK2HfoRxLypd4v1LhdwrRY/zPGXLRv5S6j3Gd0 E73vax8W85UIHfg9xQXL2Rm4ku6DIowlM/Vb0VYWinN6HdrfR0jfKgR/QCpSaZJCNAjb3kYbXYbl h5mRXI783TQH3qBbpSisC+VnrrQaHNI8yGYjMY6E4Z3ibXiU/AIPsFDwSq/CA1I3/IX8gudkBPzI PDCb7Ybzov5NcKJcMX0HCqV7MX4XIoZr4QtpEaxkO+Ac+zOuoQ5jPfbT3AbfahIgHXF/gP1A9JzI J/AVmwdfaW+CB/h8XA7pORy/mpM0EdJFv34kdPXRBTrTMljKJsONqO9nyN83QF/U1a/nWvhM6Pgr +gk9+LjYj8tID8D1AN7jSIlK3juzXx71H9DxfrnMc9zTzfxc0K7AmPcexr4KvLOE47sJevFt04Mv g559KFeO+TdYdxnyGUj4Duo1YF075rswD0Gqw3qU8R7GumJpCPqKEqeuwbqrsb0b61/FHN883nTM jwCcP40UolBPJOZ3IF2LdCdSKRIo+bkPFX28MzBfgXU43vm7sM/PWM5BHt9a539B+g7pYaR12OcE tqchlWF5KVIDt+2L7jX/9fzXz7P/NOdxi+uJ+Wj0wy8uPJP+49y3n/8mv/Ds8u3/v8v73UEvyBUc fOvod5b+yzPTl+MQWf0JY/NYjFGFPC7z2MjjsYhHai7uAUpc/IqfIZivwTh4lsdiHg8xFr+E8XA1 5m2Y8zvoCyjT7tOLP4pVGqo8fXXnsYScgYKkOwnK45q/oleQleR2cid5hHjIceKlFfQIfYV+yAhj zMAsbAXrYrewR9gbUpA0XVooLZI2SPdID0mbpF3Ss9IH0pea/Zo/ar7SnB1247Bf5FB5kDxMjpeT 5Aw5S86Rx8iF8li5WHbKK+XN8uPyNrPGHGGOMsebk8wZ5jnmq8x3mZ+Ip/Ha+ND48PhB8YPjTfEj 4lPjJ8bb4u0WajFazImQSBODEo2JkYkxiUMTExLTEnMTCxMbE1cl3pC4NvGWxA2JjyRuS9yZeCDx ucTDia8lvpn4QeJnSYVJ1qTxSVVJNUl1SYu/0JyhZ0aeo+fkc3nnCs+NPTfuXPG56d7zXi//ZgQ2 CgQ2ku3kKPknIvASIvA+Az8CNyACt7FNEpFCpJnSVdJ66W7pfulR6RmpW3pf+kLj0TyreUtzZtiq YRvlIDlCjpZlRCAFEciWC1QErkYENiECWwcgMNu8wLzej0AYIhAbP0xFoCq+ViAg/wYCM/wIrE/c mLjVj8CriMD7iMAYPwL2pKu/IGfIGekcQQRSzo1GBKznJpwr5Qh4P+Hfk3gjyVVkJvmj9zipwugT irgkQSDioz2/EcsObkO9qb0pvSN6kzFiGb0h3gAv9J7vPdn7zvkPzx8//9b51z6pBPjbceU7mZM3 It318YKTN5z85eMnTnZgCSPuyfVIXSeXf9z20dUfdZ488PGhk7d99MRHd5+4+8SjJzC6ndjC+34U fWLJiUVYyjphPZFzIuF46fGS44XHC47nHc85nnV8xPH440OORx4nx7499vWxL459euxvvNexl44d PPb8MZzl2IvHHju2/VjJsfHHxh1LOBZ/zHxs2OBDxufRj5/XbdE9pHtQ94Duft19unuZ8h1TLwz4 oc8oNKDcTU/4v29Kg9/4YYORXmVvMESBnRjQ8lekvyn0m71f58TeUEuv/rbkRT0fZZv9/MbflOr6 9WrYBDfAjfQ83A2fwU1wG6yDh+BJ2AxG6EJ4rocNcAa+h1vhHlgLf4Dj8B38DrbC3+EHOAuPwjZ4 GV6Cp6EaamA9xp5XwQ5H4BV4A16D1+EofA518Da8CW/BM1AP38Id8Gd4B/4EDfAlfA03w9XggMXQ BI3QDBvBCUugBVrBBW3ghnbogC9gKSyDTjxxl8O1sA8egZWwAmPqavgKvoH95G5yD6GEEYlo4Byc J/eS+8j95AHogV6iJTqCjxPyIHmI/I48jD7+CDGQABJIgsijZBP8BD+TzeQxsoU8Tp4gT5Kt5Cmy jTxNnsFY4CE7yE6yC/4B75Iuso7sJnvIXrKPdJNgEkL2kwMklBhJGAmHk/AxiSCR5FnyHBlEosgt 5PfkeXKQHCIvkD+QaBID28FDYslg8kdymAwhQ0kcGUZeJC/BL/BP+Bt8QkxEJmYSj2+il8kr5FXy GnkdY9EbxEISSCJJIm+St8jb5B3yJ/JnOECGk2QygqTAKfiUvAvvwUfwAfwVjsEJ+At8SL5DV/8e Y/kP5O/kLPmJ/Ez+gXfLf5JUco6cJz2kl6RhnAdKKKWMSlRDtVRH9dRAA0g6DcQbbTANoaHUSMNo OI2gkSSDDqJRJJNk0WgaQ2PpYDqEDqVxdBg1UZneQs00nowk2dSCL7oEmkiT6HCaTEfQFJpK19Kb 2Wb2GBvNCtgYdhkrZJezsayIWdk4Np5NYMWshJWyK9hENolNZmVsCpvKprHpbAabyWax2WwOm8vm sStZOatg89kCtpBVsqvYIlbFbKya1bBaZmd1rJ41MAe7mi1mjayJNTMna2FLWCtzMTdrY+2sgy1l nWwZu4Zdy5ZjRF/JVrHV7Dp2Pcb2G9lNbA1by24mn5BTeNqtw2h/K8b722EHvvK7SC7sgb3wR/Ip 7ILdcBiugxdgDf2GnqZn6Lf0O/p3epb+SH+i39Mf4EfyOT3EwuE5uA9Oo688BneSIridjCPt5A48 YzaQDugm15LT5FumYVo2iOnoz/Qf9Bf6T3qOxeB5E8hiWQAbzILZEDaUxbFhzMRkFsSSmZnF42mU wBJZCstgmSyLjWTZLJWlsXQWxnJYLhvF8lg+nu1aUL/vxpxiQi/weP5tuaTR6vSGgMCg4JBQY1h4 ROSgqOiY2MFDhsYNM8nmeEtCYtLw5BEpqWnpGZlZI7Nzckfl5Y8uGHNZ4eVji6zjxk8oLim9YuKk yWVTpk6bPmPmrNlz5s67srxi/oKFlVctqrJBdU2tva6+wXH14samZmfLklaXu629Y2nnsmuuXb5i 5arV111/w403rVl7c9e6W2697fb1d9y54X/uuvuee++7/4EHH/rdwxsfeXTT5se2PP7Ek1ufYtue fma7Z8fOXbv37N3Xvf/As8/9/vmDh174wx8Pv/jSkZdfefW114++8eZb8PY7f/rzu+/95f0P/nrs +IcnPrp0y7l0y7l0y7l0y+mrvnTLuXTLuXTL+f/PLcdqtRaNvbzwsjEFo/NH5eZkj8zKzEhPS00Z kTw8KTHBEm+WTcPihg4ZHBsTHTUoMiI8zBgaEhwUGGDQ67QaiVECaSWW0irZk1TlkZIsEyem87LF hhW2fhVVHhmrSgfKeOQqISYPlLSiZN0FklZF0uqXJEa5EArT0+QSi+w5WmyRu8n8meXI31psqZA9 pwU/VfBSkigEY8Fsxh5ySUxDsewhVXKJp7S9oaukqhjH2xEYMMEywR6QngY7AgKRDUTOE21p2UGi xxLB0OiSMTso6INRK89gS3GJJ9ZSzFXwsMQSW61nxszykuIhZnNFepqHTKixVHvAMt4TmipEYIKY xqOd4NGJaWQHXw6sk3ekHeq6pdsI1VWpQbWWWtvCcg+zVfA5wlJx3mJP9LJTMX1FHDx8Qvma/q1D WFdJjEPmxa6uNbJn48zy/q1mnlZU4BjYlyaWVnWV4tS3cBRjMlERrj5firIou6WE11RdLXsMlvGW hq6rq3BDBnd5YFaneefgwdb93pMwuETumlNuMXuKhlgqbMVDd0RC16zOXbFWOXZgS3raDmOYguaO kFCVCQruz9j9bYIT4pwrm+WHk3CNLJPQDDxyjYyalFtwIaN5Yh8NXTWjUQx/Kgj28tTiNjg8hglV XcYxvJ7392gS8XLU9SOG1irL6W8G1tjUGm2i8UfgLDcOv4Fhu4/3pKZ6UlK4Xegm4EaijmNFeVR6 Wns3zbO0GGXMED6YUY7dKsZkIuZmM9/Vdd1WqMaCZ9XMcqUsQ/WQnWDNTK3w0CrecsjXMmgub1nl a/F3r7Kg+e4Wt5BBHn2S/79QY1REScMYD4n6F812pb1stqVs5vxyuaSrSsW2bM6AktI+2t+mcp6I CeVsCFU5OoSJVrTEhX5hXigP8kiJ+J9WWHJtt06PpihqiFzqMVZNVNKKALP5P+zU7T3De4msr5uq pmdM6sDyZQPKA9QL6mKosJREy+bM7+oKGNBWinGnq6vUIpd2VXXZur2rqi2y0dK1nz5GH+tqKany 7Wi398C6IZ7SWypwEQ1kTDrAuHBYSbfAdqSDSN8hSZCF6XSkRUgMrHTLzttzrN2YLRLZrmkzs1fx fMrUbFG2TlTygGAlN4xR8qwcLrd5V8lSXt68K3uMUk4ZqZQTErNXjjPSzbjn34k0FNNMpCKklUgS Tr5516A4pZshknfbtGvwkOzQg3QTSmzCfpuEipusAdgcPl07XUe/G5dPvsbRHhbpSpEuEmmRSDNF Gqq2fsVnF+lBkW4XaaZIi0Q6XaROkQp5PNJOk2/w8zV+viJfWcMhjYCJGDGsm4g1jVhNeGcykMCd uaY7ukmgNT/XlCFPMGUj5chXmNIwNyFdkzLRlI5kTik25eP1nIABX+p6iI5GHwgP01u7ybZ9vWuC e9YEg6GbFO1MmWIaZyBj4IDEp8tDuh9J2pnSanoee8uiiK88+tRO07n0bjJvp+mfpm492Wn6xdRN iTXC9A/TKdPPpmdNP5omm15Jecq0H6Xu32nqNnVLKLUxpZs+ZQ01rTPNQuVOmZaaGk3NsmhqNGNm DTTVYKf5KfNN5RgqcJZpspjlChMOs9dUgo3FKd2E7DVZTTebctJF12zeda9ppKnVlGES06Up041Q dEvm2V7TcJwsXsxSYpobbAg25K8/rlv/hG79Ft36Fbr143TrL9Otz9OtH6Vbn6Vbn6lbn6pbn6hb H6eL1IfrjfoQfZA+QK/Xa/WSnupBH9ntPWlN5a//SK2RZ1qJp5LgjZSn/BsRhIsSPYXJ4IlgZbRs 9nhS5jlUA2XVsuen2ZZuEoB+qLGMJ57wMiibMz7GMzq1rFvnneXJTy3z6GYsKN9ByG0VWOuha7sJ zCnvJrG86sYh/Jzbj7sae+OtQ3juvfHWigqIai+KKQofG1ZQWvwrSZWapvb9xKQO+Cmb0bkfd7l8 l850uQ6Ls7G4nhfX82JMnOfustnlnq1xFZ5sznjjKso8G2bLC8v3401/W0nxfrzyY1ZRvp+lkWdK ZvF6llZcUVGGWyPk0Oyf4XLP8Azl9O9BEZeDIv17Qk4iipxFyKHZKXJRMliEnCVKHiA3jDzN5VJ4 hnLRJ2GYkBsWfbKf3I4DlpLiHRaLb6wDQuaAMpanUIiYTChiNgkRdBWTEDERKkRK+0TSVZEMv0iG mImRPhmTIhMs+2SC+Uyp/9GPfXxqaomD28qM8h16GF+Bp4DIo4wtY8W+B8eOfWzIAXiHfQ2BeBAG 4E0q0DIeiopiUo2FJFMb5NFilQ6JS19mjlkx5IAE5AkhHYTVwWpT+rj0cbwJrZc3hfArmdoUs+Iy 85AD5Am1yYjVYThHPz3d7jb8gZgSR7H/P5f606bmbijzpMwu8xThAbRDpyvBW0pxBdZl+eoCA0u6 vYeUygysLOSVjPkF/XUGgyqIaOydnkamm0g+qlCR6kJVcKL+CLpdoDkAsYK2wGApCWIAvJ8jfcHz Xof3W97W6/T+jfLvEfaopPw8BwfhFnyjbMHPDjASCd/infiWX4fvla+gC1/qd5Dd+K5ehi/7R+FZ 8nvaAvPxHR2N7+0/QhZh3rfwLb+cBIMWwvH9fhTmwR3e20kEBEIsTMA3+X72MvuL91tSSpoxTgyB YpgFe9m38D6R6OWaGI3Lmw4aMMBLcJROQb3DYBDkwySYBgtRp8dR1xfhGEnWTPB+BGawwmycuRNu g03wKrmd2mkb3cxe1sz13u/FWXAkPSRBKThQygUdcD+u4zt8u0fgq/pTFiM92PtD7y9e/r3HcMiF cVACbbiaw/AavoY/hX+QuaQO359zWIukkeq9Ud7dqHMcZGNUmwxTYS5UwbWwEhF7CHbQTeyW3sO9 P2PkY/hJR63zYQyufz5idRT+iq/8WHyHDycTyWziIBvJOXwxF9DVdDP9Gd9xyfjJY5vYHvYh+4h9 L02UlkqfaQO9yd4yb4N3qfdh70Hvx4ipCZJhCo65EK4CG66qA1bD9bAWd+tB/DwED+N7cS90A3o4 /Alf9R/DD/AzCSHZ5DJSSOpII1mKAWgP2UfeJO/QSmqjj9Kj+Cacj3NvRm8olmZILumdXugd3XtL 747eN7wh3p3eI95vvD2IpgkxT0RE06Ec7DjzjXAHvlIfg6f4txP4OQDH4Dh8icgZ8GMkkSSaJJAR JB1f/nlkBplJ5pN64iad5DpyG1lP7iMPEg/Zhdo8T14kfyX8K8YfEBmEmQbSUGqi8TSNptMMOo3W 0zV0Pd1G99Dn8PMW/TN9nx6jn+Kb+Rd8u0biJ54lsYlsMr7vneKtvoI9hXi+xk5KEu5fqJQspUk3 SI9J26U3pa+lXzSBmts0GzT3aj7VfKoFrVF7uXaGtkF7l7Zb+4GO6Wbq6nQrdCt11+n24rFn0W+D negdO3Cl/X7oQngE/kSehxNkC4ukT5EZ9HFyNwlhMbCYPUDe1pTBzbSQeshUGsX+ji/4dhjEniRn 4SzspRJ9n6RKj5ON8Bx60i10MV0qhZIrpSelHuKW3sFn9CnYQr/l82gjpcdxtnY8WJvIWOTqoQl+ RyPhNbzO3QhL4A/wO62Brsd9vx2S6EQYRSbxvaHfwdfoHWGkCK5GP+khmzRu+ghZxr6gQTCP9NCP yGUaN9ThUb6a7KLT2GvkFHrec2gvZaSBFpBq6IHPyKPkMzoXptLrYZNUr/kz+ZCkkmmaBrQ/kE6y SayORtBnL/pWcDvsRk84ClPYy7CQ3Inef5SmwiTqhIfY78mXsJtcK9WzBtRyKZXI9egL22AXmygF wnjYzXbD8+QJ9h5Jhe3SUtJMNnhLeirhR+0W6Rm2Q5MnDfW+2nucPEbe8h6g30O+91U2t7eePCjF ol9ei97biggFwlPY/0GMGFtAj1wi+uNtaK+DMLYZ0MtLMXJNgavID+gx1yNKeSQZptF4WEzH6WRt JIBuuH817v8CbfnvEVmLVnBCIfFd8f8DSVt+mzTJKm0bSDrjQNJbB5LhwT4K2KtQ4NmBFJwAEPKg QqFn+N97uUSX6BJdokt0iS7RJbpEl+gSXaJL9P8xUf77Qg1+8AWvg8k7KHmWZIAWdDR/J2ikbpKx m0GAjjN7CMTqtRreToGRCbsMC56PSTX+VNhTOM14tnBqTyEUIW88j8nILHOYOSwREwISnJfZofNW /kduZOkQ/51BOybNcBTnjN1LSiCAlpBucnaXNOYzHPDsaSg6PTIrJz9H1556NO3oUXz8ev+Cr9Tv NAdQxxDYaC3Va7VUq9frNIaAIEmrDwkK0mn1oRqDMeieIEJlXNQwXVCkThdEgyRpGKORjFGiC5UY Zcagc5RQg96s0XaTZ60hOp0kMQb6oCdDr78uJjXWeBZiigqN/HMWV1JUeJqERReEFRSsyUhds/zw moyY1OXGw6lh4QUF+N8aY8hhzeHDa0SqMxauMR4emWUhOREWZmbEzJKGa3UjWNHnPzx/Rc/2r0kR +bTArM+u0hz4ZynZ0jufXk5ajt254mlEogL34XJcYTgMhWR413pFkmwMyx3Ek4J4x6AjQ4/ESRHJ cUOTkwZFBGoSRgRGJA+NixsGJBLBjIwwJycPHw7SkKFmUpUs0WFx5uRw0Een6Lvp3dbgkBRImJ5Q lbAqQUpI6CbvWofFGfjvy4YONcTFXWMIhUz+25zSEQZihOjSmfx3JoUkddk04xkSk1mZumzq95hj Vab49j11mfEHXt/Dt6owtQcKi1LPYoqYZBYaewrXaDI4RoBlEhYeXaArRIMglampOcScHT2MDorU 6qKiMNVasCJvVG5SksXMzNn5YynyFnMFySEvXVtYvWbyjTd3tK/79NbeZ8iId58dY7up9+XTZNqN GZXu8av39N6iORAQNndDRWd31vCHHJ0nOtnEtdeNnT/i3AaDceqKkvrFuKYFiOpORDUUZLjTOjla DgzLHcoTiJQjsyI9kVIoCZWpgQQONZEhQ01yJsmUdVdoiGw0qtiaZDMhyZRGFBjNyaGgH5yinxlv 7CY6a5iCW6m5hRAEjuOGIFUSdIfKqaenGX+aquJzqigVcYFCzRoBzMgsqCSVlUv6AUK1Wp3WkpiT nZ/HPxyT4YjEApJNDjw8Z+nWeYuf/v3q6tt7//LFQ8um5F0xZsqCa6uuuLu3R3Mg2vTwt/+zo/fD D5cPi94SF25Jn1x9buPOg6Zo9DMvrn6z8JqHrXlDKJFB1uWhKzCDnmgZTdbqdOoiNdSMzqFLBvQs g053DRiICRdlgG7voV3m+FyeW4OGDsvNhCzw8L8U1U1e3KsX9nI7/12Sz2QUy+CFSmEoPsMBhEDE B9U4hAMRnnDTqDQTc75Zh0C/TUJ7TRbpOkuvpfd7TcTjj//zNI8Ywb1OZhYrKbfGSBqNqjaTzMSo 1Zh1EE63swNEAxL5aJdGtx19G/cdwwoN24Vhq34/0aKKuDFTT/WcPWU8e/aUUKbIr8/IrAhi1qHn 6oLJarIh7ljv7g/jep26snW/vLYOZ/Ku7XXSR4UGC61xE2ESooVRhkkYWhA5MwnXSGatzqjdrsGp d0lkO8V8L9OVSLAfw+dHe9hU/ZddPGCeOm08beRKXKwDqUQccogl30xielviPiRTjseRDb3OddpR 69DS5nu/kPKksTAcRsEL1pkL0kliQGKgJSgxbQyZTLSZ+gL9leZ6s5SblhIoZSYnBbNQSBxmSU5l EcEB2YOTU1PTAoIjAwKCoxJM0SR6VoRpsC4pINvEAqPLQ6NIVDf5o3VYpqxNyguVh0G50dJioRbv MGtYeC4MMw5zDmPDnqNLIR+SMOVwflaZOvWnSlwPR7YHOQzdRUWneypPrQnJSA1Rg0CBb695MMD/ +DqhsjIR/T8+aVRuHhp8Qj6aPFp8vFY3PC8vJ5v/cTMd0w6KjLYkRaBvhKCPROVk5+Ux41XP1GzY PfMm2+Vk7uRBGUWdrXeY943++/4XXeWxlw2N2hd6edKVdb+7brzDNn9L1Q0zy55eU3Hz7PCgkLjJ I4sSsu2Vxt89cVVpy9yW3n+smJ59VS75LNRoCEm9qmBK9aKt/E/5X40Yj0OMYyEeDu0Hs/ek1YAx 2MQDcRT/pXh5SFiuQZscvy5mXawUE3vFYDSEPbEvxrIklhbYMXjNYAm4LAwZDCychIXGQYKRVKGL ECOZgYxEZktDBqeFrQ/fGE7DwyXZFKSLNkmB4d30TuuQSFmfZImTQ63Rci6EGkNbQj8KlULHJiSN 5Xj/hHgrWJ/iSJ/GgFvJz9yeyiWnhDMhuq+kcnxbl3AnJNFaCTFGkMMTcrI5pmatAiQx8xiDeLMZ nqTe737f/mL9IwTuev6TkPM/SDfXVO7uTaBzyNrF7oPEEX79N01v3fgMueLhb16fNssUe9dDy8iy oUFr79iIeF2OoCWgX+D9gWRaAx5nL7HP2Y9MMvCIMSVzdO50wyrDWwZmMmQaHjZsNxw0eA1avFpI hGl1CApLpjqdRSKRvKaGJhPQarS6ZCmAUgxEzZLBSHggCpckPmAMDrhKekuikjUwNFdq4xFIip43 tt+JlbokFWPOhIXleyTr1Iwi0c1QlFQkWccmitKusiSlNmScGWsjkzEJtyhNcVlKPjRTyaNVUUMk F40bLko7Y81FA36fXcEjHD8mLwx3PD3dL+LpNIWFeEsQx+GS1CUE7zgkIoeRktTdqb3FJ/ackE4f PXouQko691ce9fIQ2ziBba91bpWGTNes0rylYXpi0mRqHtZs1xzUeDU6yphFCYccPZYMHDrGmsEQ rkAHB+FNoKvgLdwuayD6coMkAve8Rf6ojai1KqCBNSa8CHygAQdNlEKG5mMJwQIOlnIu5Cs5ggQ+ kICDJGoRJFDR5vm+cbzREj4QOT90FyCX2j8mLmnNwRtBHsne0/sGvzkhMsV4HyxAL42G76wzEnSj dNRCE/R5tFQ/j14ZVEc79UvDtoYd1D8b9rr+lbAQFhVNJTzxoqM5UsRqLMAjGwEzBAVZgo2RRqxo NZLgYGOESatj3aTXGkYp0SYHRQcHQwABY7DR0E327Qwqx4N/nzW4KJgYg6cHLwp2BkvBz9LlGC0o ObAzuhzvsQesEbgImA6L8Oo7Lwaig1X7FNeCUz0Y+NFbe06l8jsm8KtmYWpRIcQaT8UUcVtBv+WB E7kYZNUQihfMw0rYzInI0fEIKQKkJUL1Yh0rPrF5+OIDttUbBq/Zc+ugSSXrPsipl5L2N9Xe0nbZ yp7l9JHqzFHjX/57b7iCHluA6IXCWes1BnaTYYP+DoOkDY4K3qI/In0p/ZNpk2iyNJrk0Ymkk9xM dCGhlAXS0FDV0Azlem0gQoUGpw1VDC40tBysIcZcvDmgyRnxvpXFrwlGoFXQgqZ3BtFQcGEwzyjs 77X9pLDfxaGS3xyWtE7gf+YF0HAizapZhUSj5QRHKeaUHi3yncNUSxIGhN1ThQEtO4Spz4REiPRd RgWG4q6xxAdhtE4EQIRuY/qsh2blTZ+cOXrRywXzpaQPrmkf/kT8n3tP987jfjgNzwSGeKXBD3sC U0LxNOj2vrcLc8YPhFhk7gp+0PxgPGtny2LvDrwrSAqU8ZSQsXUX5mYuVYzMjWxdzObALcFSKesM XBvIUoISzPGW0UGSHBTI4uL18ZhLJDohalYEJBAyYrApQqcxjQiMk61GYnSTNH5EGEi5DOgnBLpp pNWYzk/yM3oZEo2JNPFMFEcsLGFELkQZo+hJPNRfyJj3gnJ2LEmderay51Qlsq2n0QyXnPYdIqeM PafwlUPClOMZllSK00OkEfmRUfzE4OdzwnB+lnDrQ+w4eHhAR/GPuMzHD0+auydr9bylSxMSez9O nlD88u6X35Z2SKvarmpIH7b8rbx5tiNrulevJosDpzWXVo3LTEm5JnaEc+KK3fvvCapqmZednTQ4 b37u7I7p9y5YsAAXuApxb5eS0Lt6rW2x+ljDXYF7dXsDPh/0aYzOoDcYbgi6KeYu3V0BT7Entfrh Afkx7br2AHdQW4w2jWQaC8ImhUmDYmPQ6aNiI6PQx1ciHFGx3Ok1+kh9Fjq9nmg0etDHRhn00drk UBMNjI0J0AxOjorVa4zR5VHcnUNjyotiiTF2euyiWGesFNtNl+8agh7AI8HQIDlLQ97SnNSc0bBM TZGGamKjNdGawQGjEXR0cXR7btRTT589zf0eM+H3qfj2xuPhNHp+YaHi4NzxNdzxkRFvzBD/SwGv SuKmlI9nhXp+82cCliws9uDL19wTv2rPbeGTrphyh8McFVe158Tjh96/tW7CJmrvqZibWThh8op5 +V3kNTxUCDyKkbMTMQ2Ah6xl4cOZHFQaYA2aEXSzbq1hVdBjZEvAPhKo1WgCoqThAaNBE2Aw5Og1 kXq9BtempzkEIvnLUa/nATIAAgzloDfqKaIxCINmuUyyyBnCnOR2Qok38ACZKq6K3OR6fuT3w0Ll cc3dUq+GOTXOL6lE19+tDwiPziWpFWaWExEVnZePkZ/MeMazIDQqdyapOdizUUrq2Vf1wZI76Up+ SMIiaRko/0qD729ncZ5g1B6r8hSCNN+C719zaNQcUnkJ0E5UXgMxmvMqr4Wh2mKV18FhbZXK6yFJ 51F5A3QFv6/yAdIfxMycD4TqkGqVD4K6kMMqH6zdrUtQ+RBYGJri/8ulK0Nv8v8bjRpjou8fWQRt +HKVZ5AXXqfyEgSFP6jyGuRvUHkthIQ/ofI6qA7fq/J6iIi4SuUNUBLVqvIB1GbUqHwgjIzap/JB kBP1hcoHs/kRMSofAhnRQ/i/fiEx1C0keq7KSzA4epLgNaLeqfK8vkbwWo5/9M0qj5hHLxe8TtQ/ ovK8/i7B60X9CyrP6/cI3qDur8Ir+6vwyv4qvLK/Cq/sr8Ir+6vwyv4qvLK/Cq/sr8Ir+6vwyv4q vLK/Cq/sr8Ir+6vwyv5yPqAfVgH9sArE+kh17YFYL6trD+L/6mb0ByovwdDoo4IPwXp99I8qL2Hf LwVv5OPHGFSej98j+AhRb1F5rI+JFnxkP8wj+2E+SMhfrvJcfqTgo0T9lSrP68sEH8vHiVmi8jhO jF3wQ4T8zSrP5ZW9jus3b1y/eU1inE0qz8e5R/AJYpxnVZ6Ps13wKaL+XZXn9a8IPl2M853K83E+ 4by+H/76fvjr+61L329dQf3kg/rJB/XblyDfvsyBTrzX2KEObFCDuQxPIs2BBsFPBSc0I7lVKRkm YKkVeZ7asN4hJGSsacT+GcgVi3rb/+NImX7NZJiNLY3ib0cqMi6sm4S5Mt9IKMBPFqSrXLaoHYc9 GjGfhX3qUQe36DULx3MhtUI7prVCh2Zss0OTX5NWnFdGKZs6kyLvQIRk7MH78xGb8RbFZ+EtNjFT jTqWDWuUnk1iRL6CBtS+SYzowBa3kG4Qc3HU3eoMLrHCGtHXLdqbxSg85zo5hQ4OdS0tYmyuUY3Q yiVm4y1cvlbkiv5tYjZZzNBfK4cY343tzaLcIcZuUGe3q7JOMZYyt6++UYztVhGpwZKCzIVybhzT LlBxYK6MXaPWtAmk+V71WYlT7EurQLRR9OeacutoUnv5ZqgR/dvVWR3qSnmbgmYfCnUoyUdTavtw dajoOtWVOIR8myj17apLWGyj0O7XbcLnOS7/WuziT/Px8frGaMV5Fqva2lT8a4RNy6rd+zCrFXPX i1qlfwe2ONQ95DKN4s8H8x5OTOuxrV1FWxmhz5dtYq8U65AFhjXq+h1i1xqFTIvwM8Uam0VPZSX9 rdvhtywZ25eqO9MktOG2qeybS/XkRr8eTaLUZ73uC+KN64L11ahzVIsR2gTStQNs0w5LsN6HLLft Gv8K64Rty8IGlgpsXcLu3GI36v27znVX/J37Uprfm1yqlfXFI6W1SeyIDZaJ/orWfNwa0dpnacrs tQKtFuElnf5V+Obm/TtEu00g0arOwX1IQdEt+vs09o3eImyoScRQn24ZF8XVMQN2jce7emH/NqHZ JLG2RoE2/9Peyuy+yMsj52hMZUjGcblMq/AOxatGDBi5/0h99ekD6qeiL/S1PSN8o1WNFU1Co8V+ u/i/PSeUvaxXo6ddjYl9sU0ZdS6eITLMEP1lSBLzTcV0Os5dJ6zdhzK3Z5fYoQZ1tAyYhnJzcGWl SBNwRZyfjrW8fymmU0R9CdbMxpT7zRWIfAl+poraORCM7xROc4Slu37FD2R/vaKxststqj30+c/F +CjnpBMxaBUW1SCkfevxnRY+G6wWrZ0o3+afs8YfdxXs2kTfvnhpVz2KR7W+GK/EFocaz11qvKkX o9j98ZpjW6HOxiNPuxrnq/0npTKn+18g47PADn/ktKvRwO73t1YR29xqrKlTfeXX8PJFCI6Yvd8o fRHm4vlqVfvitlwtoraidbW6M83qyL+2Q8PFqgYipZwWF1vFxTP74i6PsDZxC7LhrI0q2i41vv3W 3BnC9pv7nQGdF+2FXb0B9fcc5WSxCY1aBLL8rHMIf/v3ey6rttjcL+765uXeXyuQdvQ74Vr73dLS /NKt/ey2717xr5Hi2jWJ8X125RwwXofY/8ViN/tHE1/s7pN0oqwSZ9oE4nz8Bv96FL36W3eTGu0V /BWvalHto+9UGGhD/2pFffYxSaz94p3z3Qv5eWhXb4/KapS7aI3Y1eYL9qD1Arz7Rubrc4rTolaN q+3i3tYB/W9+/373feMpPmlX7ycDT3HfeBfvo4JW3226Rox5sR/7dsx2AdZ1/ytt+1C+eIaBd5GB GtnVG7Ybz1HfCPyUGYe16cBP0NGQC/l4asqYjsRSOr5RcpGygL/L50KZKpmFrSOxJVfl8yEHiffK g1H4nuHER28Q95gWnC8TPx3ikyHuAwM9vkZEvt86JzhXLLyzw28XyinoUKMt12mWiNDKGTpNvZs5 1Vs/90/lJG0VLQ6xA7Mx7Ts3uFXx1xi/Tfzv9M4U8vzfxsnE1C0iBN+rTHH2LBJWotwnMvyS/90Z OsQdQJG1/1dm8bVlXmCP/rHndLbY62w1dvlJeU6DXZ7qbHa6sUqe4Gxtcbba3A5ns9zSWJMhF9vc tn8jlMkHk2c7G9t4jUue1Iz9RhYUZKVjkp0hj2tslGc56hvcLnmW3WVvbbfXTnA2u+1NfJDWTtll w05Y76iTa+0uR31zmjyu1WFrlGtQyubAxiZnq11uaGuyNTtcbrmmwdZqq3FjB5fbUeOS3Q22Zhnb OmVnnezAWVpa7bX2GrvL5Wx1ybbmWtmG47fVNMgOdShHs+xua7bLHQ53A3a3Y62zlvfmfKMN58D+ NlTGV+fusDe7HXaUrkGmrbUzQxaQONvtrTZcnrvVbnM3YRPvUNOGS3TxyVzOOlRTqFDX1tiIrNAV p29y4iSO5to2l1ss1eXubLT3R4JvjovPYm9tcjQLiVbnYhzWhvrXtOFEzUKzWoet3snbOxocuMIG e2MLIuKU6x3tdiEgdtkmNyIccpMdsWt21KC4raXFjjA219hxEgVuBwdLti/FxTTZGztlXJsLN7mR j9HkaBTwulW7canz1WCParvc5rLXKmjal7RxZdtqOP5ynROXjCPiotxuR3M9X3qrHffd7Urj2+RC yIQdYbHJVm9b5mjGoe3umjQFNOxe63C1NNo6+RS8d7O9w9Via0HVUKQWVXQ7XHxgLt7S6mxyitEy fLY6RlnaLHt9W6OtVZ7ktjU6asbMw+7ceLMzRmfLyVMdNa1OvlUjFGFFSPDpCj91jig9Ic9pRato srUu5lj8K5/AVdajedrREoW1oejc2fIMm1tOkudMlafX1WUIle2NLntHA4plTJs+Z1LppAnj5kya Pk2eXipPmTShZNrsEnncFbNKSqaWTJsTHBAcMKcBN8m3B3zD+MC4bMTDLfbHrw/6pLO+1dbS0Cnm 4W7BEazulDudbbxnDbdd1K6tuVbYJVoLmpqweLQWB9o5itvqW+12btcZcgV2a7ChUTmruVNiT/cA ZTiAHdw47WgGdr5vrfYaN1pNHe5Kn17cIJz1diEiDMbfDzcafaG6zY1Do5pO9M9+Cxru8imFbuGH wt+Z267cbmtss1WjvdpcaG/9e2fIc5uFB3T6VoFrUjcHncUmu1rsNY46R83FK5cRxWZhu7yvrbbW wfcYzaRVhLQ0Xt0qsBWx4gKlGh1NDr4gnETIdThbF7sUkxfWLSqdHWgzbdWNDlcDnwfHUuBuQrNH /XGrWjplxRVUhAZOJPCYVNe3OB4Ll7TZXWIajKI19tZmdQWtqt5C2NXgbGusRVttd9g7lOB30fK5 HO6kHeNJbV/A9K8R1RJhusbdt8d8YTZV67pfH1ao7O+gRhF1IJzH5h7DBebOHieny8mjc/NHyPkj R6dn5WZlGQxzy7Aya+TI3FxM83Py5fy8UQWjCoIDGtzuljGZmR0dHRlNvo2vcTb19wm7XNxq6+BY oAuiUjjSLGc1eug0jGZODP1p3ElbHTUOmzzbJnzDhWfZ6OzfGDuzwd3UmNnk5v//s8wm1yIbjxMZ vPI/7NBhb8Ra+7/vwkuZKo5CesCXIxPENdslLr62AS2LRcsyOP0bLUqf/vVl/eqd4vrc1r+dbWTP sm1sF9vPdvzGFzTK86B/WzGZibn7Ap2d/eb59dXwR/mv6dYpru8Xzv6xet0ZMJo0WJogWaVx0mgp +1fG+hVkSJZ/JYsH9JgBTmITj5TmCzRuFo8bB3wluP4tJTjWMnGttwHA/wGbJfRNCmVuZHN0cmVh bQplbmRvYmoKMjQgMCBvYmoKPDwvRmlsdGVyIC9GbGF0ZURlY29kZQovTGVuZ3RoIDMwOQo+PiBz dHJlYW0KeJxd0s1ugzAMAOB7niLH7lABKWlXCSF1tJU47EdjewCamC7SCFFID7z9gs06aZEAfUns GENS1cfamsCTNz+oBgLvjNUexuHmFfALXI1lmeDaqLAI76pvHUticDONAfradgMrCs6T97g6Bj/x 1UEPF3hgyavX4I298tVn1UQ3N+e+oQcbeMrKkmvoYqbn1r20PfAEw9a1jusmTOsY87fjY3LABTqj atSgYXStAt/aK7AijaPkxTmOkoHV/9azJezSqa/W4/ZN3J6mh7SclWUocUKJHSrPURuSXHQiPaHy lHQk5ahtRnokSVJF2pPOpAol6fTtCUtfatz8Vnx/Q0HphaTq6BRJklt87ARN0tFyT5NyyUuZ5u7M X/HeenXzPnYdPzW2e260sXD/G9zg5qj5+gEvY6BaCmVuZHN0cmVhbQplbmRvYmoKMjUgMCBvYmoK PDwvVHlwZSAvRm9udAovRm9udERlc2NyaXB0b3IgMzEgMCBSCi9CYXNlRm9udCAvQXJpYWxNVAov U3VidHlwZSAvQ0lERm9udFR5cGUyCi9DSURUb0dJRE1hcCAvSWRlbnRpdHkKL0NJRFN5c3RlbUlu Zm8gPDwvUmVnaXN0cnkgKEFkb2JlKQovT3JkZXJpbmcgKElkZW50aXR5KQovU3VwcGxlbWVudCAw Cj4+Ci9XIFswIFs3NTAgMCAwIDI3Ny44MzJdIDggWzg4OS4xNjAyXSA5IDE0IDMzMy4wMDc4IDE1 IFsyNzcuODMyIDMzMy4wMDc4IDI3Ny44MzIgMjc3LjgzMl0gMTkgMzAgNTU2LjE1MjMgMzEgMzMg NTgzLjk4NDQgMzYgMzcgNjY2Ljk5MjIgMzggMzkgNzIyLjE2OCA0MCBbNjY2Ljk5MjIgNjEwLjgz OTggNzc3LjgzMiAwIDI3Ny44MzIgNTAwIDAgNTU2LjE1MjMgODMzLjAwNzggNzIyLjE2OCA3Nzcu ODMyIDY2Ni45OTIyIDAgNzIyLjE2OCA2NjYuOTkyMiA2MTAuODM5OCA3MjIuMTY4IDY2Ni45OTIy IDk0My44NDc3XSA1OSA2NyAyNzcuODMyIDY4IDY5IDU1Ni4xNTIzIDcwIFs1MDAgNTU2LjE1MjMg NTU2LjE1MjMgMjc3LjgzMiA1NTYuMTUyMyA1NTYuMTUyMyAyMjIuMTY4IDIyMi4xNjggNTAwIDIy Mi4xNjggODMzLjAwNzhdIDgxIDg0IDU1Ni4xNTIzIDg1IFszMzMuMDA3OCA1MDAgMjc3LjgzMiA1 NTYuMTUyMyA1MDAgNzIyLjE2OF0gOTEgMTgxIDUwMCAxODIgWzIyMi4xNjhdXQo+PgplbmRvYmoK MzEgMCBvYmoKPDwvVHlwZSAvRm9udERlc2NyaXB0b3IKL0ZvbnRGaWxlMiAzMiAwIFIKL0ZvbnRO YW1lIC9BcmlhbE1UCi9GbGFncyA0Ci9Bc2NlbnQgOTA1LjI3MzQKL0Rlc2NlbnQgLTIxMS45MTQx Ci9TdGVtViA4Ny44OTA2Ci9DYXBIZWlnaHQgNzE1LjgyMDMKL0l0YWxpY0FuZ2xlIDAKL0ZvbnRC Qm94IFstNjY0LjU1MDggLTMyNC43MDcgMjAyOC4zMjAzIDEwMzcuMTA5NF0KPj4KZW5kb2JqCjMy IDAgb2JqCjw8L0xlbmd0aDEgNDY2MjQKL0ZpbHRlciAvRmxhdGVEZWNvZGUKL0xlbmd0aCAyNTY0 Ngo+PiBzdHJlYW0KeJzsvAd8VEX3P3xm7tztPduy2WR3s9lNSCghhRCIZCnBQgudIJHQm0gJICAl SA/VAgIqzUaVJRRDQEFEERSxYgEBFRQLgoqoJNl9z9zdRODx9zzP+3/f///zed8Pe/O9Z+qdmTPn nDkzdzdAAEANZSBA+tjxQ8b+uH3c1wBN7ACq2ocGjB7yOhmWB/C0ASBOO3rA5LHK9zRPABDMB/eD YwYNIEVLEgEC9wCYnx8+esLk4xtLA5jfHOPrhw8fMsA02rgFy15DJGF08PHc68sxfADRbNiDU4Y+ zUaeA+jxE0D7xKFjh41+OHnz7wANhgOIwUGTJrhXjv1wEkALbE+WPmj0gLHDdndaBmD5DCBmKfC+ 0w9+emTehdX99Xm/K+IUwD8bv0lO5XTPXRVv39hRO8zQQtERo0osT6QCeJe3CnWGtga4sSOUaWgR Ta//iCk8RUzBWz4MAhEoGKAJtAFgGlUt8orKolVobj2C9FN4gJWCBXGvPB4eFntBHzIf+tItMI1D iIcA2wbjsewWjLdGWsXrYvmeiHOIPEQvhCOa1gkxANGdx7HsPl4XnzGWP0eipdBX4YIxYq9wLba3 UjwKQxFrMbyRfQObZLkwGuPPY72DDCCHl8E6K2VbYBWmP4P5gzBtLdI+GN+A4X5YLz0aVsqXQCyn CBmmN8DnLIqON1l4HZqx0vBXOJYifOZ9iHnYRiHS9ogOWCYGaRvEfHIUFpCj4Y2YjxRmY/vzeTqi XZTeg8+Zi/n5WC8J47Mx7MB+yJDqER5ECt0GudQMB5A2wfH3jowbcRSG8zHXjwn7H+3TvyLSxw43 A9t8FeGlueGLSJU39e12zL4N9wqZUIZ0FCIO0ZWegNGsIxDk12rxIggcKJmcT2cRd7HB0BnjBPvZ XdwNa3gc0UlCabiWPQPrhWvQHPOmylbiOAYjv5sirkMT+hM0kvlgJspXO3z+LMRafOYlSR4GQw9s vzHSTHZRkqF5iMXY1pU6PnHeYHwWzms3bKuGawzW7464G+elDPEg7w+234TznM876RXKxbIXsEw/ Dky3ScCxc5nkdXh9fJYvKocb/6awEcssQb6eR8oQFt6HOkhyFgXmvYXPiUXIEPGIxoiLiI2IUYgW iFcQKdg2YLuCJK8oM1w2JflA2RCPIg+xb5LMRsawVprPiM5siD6Lt+ORbYNRUXj4M7m+cJnFvuys ezbXKS4zdVSS71Fc7skvfJxcpuop6h77Ee7mfZB0EGWrjnK9wz5zfVhJe8ICpGtQjmdzmeX9q6Oc L1zWJJ6gTkRp3k1jTZd0BKkA4I3K+uw6WseLejocnsdnlsgGok1ZD/ewCXCP8BgMZFehndAAGovp mIbjwbJB+iN0UxyCTJzLLhhffRtdxSH/hIwUD+E4tyI/P4Fnkafj2Cc0kX1CRHFr+HsRyDFxK50h hf+F3g5yKJLHKcfNef930/9XQE+JW9Fmbg3/IH4SDuN4Huc6If+RpCPcdRTTKxBliFRFGlmlGEUq 5T3BIMO1DTGGBaCFGIAcdgjnx4J2HnUB03uKX8FBYQksZJ+EPydlUEY/gXlyCwygK9GmYVv0FMzm 4M9HOvYmObpF5m6XpTpaJ6+3U27zozLlQipD/XsvigtRXEf8jnL0HIm0kcPts7Q+oI1GzIvIa/hG vXwegxeQLqqTz9vkdNRt8qm5XS5vp9Lagva9Tk+xHwvrxs/tI7dx3EZyO8ftTF352+lN9cvpFpRj bodPQN+oXidGcR/28euo7qMdxvnuHQ7L2odfku0ObxJM4U2yDAx/hhDDL+G4J9evqX3Coeh62qBu LY2kg7puHRUzYXTUnj0v2Ztf4UlpHe0l9U8p2wEzxWqcd7SBUn/XR3UQ+Yn9HsVKkOdrYDGOI1aY j/qI6Yh+nCfSXADY+brA10RhBfKZr0VLYLZwGv0FXjcTjNJ6kQ+9se/HpDRcUznlaWJv2Cj7ETJY T7S1h2Awnys+Dt4fPveKiaBVWNBOfAJN2WYsYwEVllsv8SAAL0lyweuOQr8IeSEfBHKU2c5Yhj9v g1QnAKYoP56XeCHVR1+EyxfnBT5TZoFukj/xI6wTe0Jv1KEN8jLYIOuJOmeBTfiMF7BeT94XrOeQ 1usVcD/q1wK0TQvQ5oAk/33D1cJWHM9ktOsIoQx5tBXsYhnycJQ09nYsYmPnc/0RtoCfy4hsBdph 7k+sgHKWBgWyUbAE05aIaCex3UWYNgf1Nx11dyHWd0XtNmDbCzGd183nvgz3Ebi+yAMQIyuT/ACQ +sD9FGxf+B42CPfBApTj1ooVyIe50AjXC4Kyl4BoGoEUnxHF4gikNEOEEo9ggOlSeiZ8SLcIapRb vobuY7NgBOsFGUJTiGVGaMQ+QF39C54W9NCfHYenWSUs5nEWAylCEMe/G31Lnn4SCnk6/RDjq6Av y8P6C+Ah1h9KhZ0oex+Dig3FucZ64lKUkySs/ys+NwryDfQVeqFuzcPwX+FtvJzUxu5wbw52DzSS 6t0Eqa91uK3PtAPy7T6cU+wvD9/SX+xrfT/r+vgP/ZPGyZ+L9XgZ9jTgniV8BuGL0FBXugS2ItbT L6Ct0AmmkE1oYJ6B9uQi4pkotsM9Et2J6IprfDaZhmjMsuEVxCwMN0T6GmJHJI6+WzacRszFZ7+O dBffF3DQNtCMU0xbi1iFeKcu72bwtv4p/WaIcXBrfA+UcZBr4VqO28sjn5the83YXchPBMricg7Z TOgrn4Tzl4zpCfjM2+LYTgbbAyP/U3/+E8hJSJd4GEHg5jHWzQdS63+BMzdRN6fRteH/Uf/+V4Dz OxNRLPH3Z7BEZUhHTkEi0l5IewkTYTIHxhthvKiOnwR3vxI2wRNSev38RdJRVnBLCXfdnn57/PZ5 /U9xugteuBl1clAvD4/DHA6Wj+URt8cVx2AOh+xNzHvzX+Pspf+AvpAqrJH6BJKM3RaXdcE1E0GT sK8Oqc5ijvr4SdRlBC8r1dfCEg5JdxF0N4zgqM/PRvuNuImvzThfsU0pv25+6ubl9vnB/gXYe4i+ uFa8B+lIuyNtXUfr5TtqL26R+a4Rea+Pc1ty8bYyf+vE37pxkq81//zM/z8Bdec44ijirf/dbXEr w22EgduJM+iH5KMf+Qn6J/fDbIBatCU1TRAvoh3qgfRTTMPVO9QAocWwEdOGIX0WoPp3DI/H9E8i CFMWB+ujfmUspu2N1lVEn9c9Ur/6bYAbKFE3dkTqV29BjMTwL4jpGP4S6etIV2H5H7DeHKSHI/m1 /TE+CXEA4z9i/EFEHwwvR2pB2hARgzBh/ZUc3B/5l33o/+v0n/cf/y1Fn2UQ9tPFz7yQTrt9D/Ff 07r5/A/09r1G3fz/J3rTmcFtNMIH3DN9jX5f8Oa9z7/b49RRnM/QzWA9w7XoU2q4H819We4/S/5j lEr7N8mPxXYBzHWU+87cf+W+M/dfkW5AukAmSv3pyff5vF8gLSkSnJJCgLIbxjCk6gNM2Yyf0fJj UGgOM8hMsow8TjaQIDlDwrSIHqXH6JcCEQRBKXiFGUK5sFjYILzHNKwL68f6syfYU+xZ9hzbxfaz z9n34j7xDfEH8ZpMI4uTuWQtZN1ko2SjZeNkM2TzZKtkz8s2y3bI3pV9IvsrYW7CX2692+JOcCe6 /e7G7nR3pruFO8/dyt3OPcY90/28+yX3No/oifFYPYkev6exp4fnAc8Kz6ZEmihL1CeaEi2JjkRX YoPEtMR7EgckDvFSr8Hr8YGP+jQ+g8/ss/ucviRfQ1+WL8/3oK/MN8e3wLfY94Rvg2+br8JX5Tvg O+J7x3fS97nvW3+eP+Bv4y/xD/IP9Y+6JF6yX2pxlV5tWk2r3dXNqvOqW1W3rm5X3aW6qHp69aLq FdXhmoG1+bW/hmrCNeEwPwGH9RLn1pMd5AS5gZx7Czn3mQD1nJuDnFsqPMcI07Gu7AG2nK1ka9hG 9jKrZJ+xS2JQ3C++L16Ncs4jC8hK/pFzVxPKEta7Ne4Yt83tRs6lIucy3LlRzo1Ezj2HnNtyC+e6 e+73LK/nnBE5F5uYEOVcSeJgiXPu/4FzhfWcW+5b79tSz7njyLnPkHMt6jk3xD/yEpE4R66yaoKc S61ujpwLVLetbl/dq3pqdXn10uqamgdqWyHnyjjnwt+gYK4Im+lx+qrQJHyGvosaoUeJfJw8TEaR 8TXrMT6Cy2woLZQaahBKweA0mAqT4EEYDh2hVc2XNWdq3q95p+Z8zYc1J3nJmtU1q2q21WzA64ma mTVzah6tGVGTCfBNMcDXZyKn+ufnIlZ8df/5Oef/+mrT+Ycx9goC7er58vPTv5p4buS5Keervml4 fum5TedWnl15duPZRQBnX+R1z9nOjjuLlvls+tnA2cyzSWfanyk4k3cm90yzM5ln0s80OJN4Ju6M +Qw5/fPpH09fOn3x9Ne81um3Th88/dppbOX0m6dfOL3jdMHpNqdbn046nXjaczrBcchxw/GV4TX0 9F6Tvyh/Vv6M/Gn5Gvlq+Sr5Mfl2+Qb5Oly/vpe1EnF3Kgziukua3fqegn4bwS3xq4K1Li4Mhn/z ETqjpfnnnKWItegRdWbdWAnSgTfnsgcQQyP4nz6skIN1i8Y6/7t+3FbTz1Lqw0n/tqTqf8zpeEtU gOdgDswVHoCV8C3Mg6WwCJ6FzfA8ugjlyNbZ8ARchV9gCTwFC+AwnIErsBa2wG/wK1yDjbAN3oa3 YDsMhEGwHAbDcRgCR+EYvAfvwLtwAr6DofABnIT34WUYBj/DY/AxfAgfoax+Dz/CQhgJI2AUjEbp fQjWwxgYB2NhPJTCRJiAMv0wXILJKN1T4BGYjnL+CmyAmTADymAW/AA/wT6ykjxFKBEIIyJUQw1Z RVaTNeRpqIUQkRE5UUCYPEOeJWvJOrRFG4iSqIiaaMhG8hxchz/I8+QF8iJ5iWwim8kWspVsI9vJ y2izgmQnqSC74E/4hJSTRWQ32UP2kldIJdESHdlHqoieGIiRmOA8fEViiJnsJweIhVjJYvIqeY0c JIfI6+QwsRE77IAgiSUO8gY5QuKIk8STBPImeQv+ghvwNXxDXMRNPCSRHCVvk2PkOHmHvIs28z3i JUnER/zkJHmffEA+JB+Rj9FDSCYppAFJhQtwkXwCp+AcfA5fwGk4C5/Cl+QKuUp+wbXqV/IbuUau kz/In+QvcoOkkWpSQ2pJiDTEdQwooZQKlFGRyqicKqiSqkgjqqYaqqU6qqcGaqQmGkPNpDG1UCtp QtKpjdppLHXQOOqk8TSBuqibLqYemkiakgzqJZk0ifqonybTFNqAptI0uoAuFA2ikV4RZgmzhbnC fGGhsERYJjwhrBBWC8/iyvmCsFnYKmwXdgg7hT3CPuFV4XXhTeGYcAJ19QPhE+Fz4UvhK+Gi8L1w Wbgi/EJ/ob/S3+g1+ju9Tv+gf9K/6A1aTWsElaAWNLi6EBzU8+wF9iJ7iW1im9kWtpVtY9txVdnB gmwnq8CVeTfbw/ayV3Cd2ceqcJ0+wF5lr7GD7BB7nR1mb7Aj7E32FjvK3mbH2HH2DnuXnWDvsZPs ffYB+5B9xD5mn7BT7FNcpT5nX7DT7Az7kp1l59h59hX7mn3DLrCL7Fv2HbvEvmc/sB/ZT+wy+5ld YVfZL+xX9hu7xn4n35AL7Dr7g/3J/mI3WDXshApaTrJgD+yFN3B3tAt2wxF4FF6H+WiLugjdhEKh q9BT6CX0FvoI3YUe8Dv5jh5iM+AArIbLqJkvwOMkH5aR1mQSeQzXiyfIw1BJppHL5Gc2jo1ns1ip UCT0Fe4X+gnFbA6byB5mc9kkNo9NYfPZAraQlbNFbDGbzJ5kS9hStgxX5MekNflp9gz6NGvRs1nF VrPpbB1bzzbgSv2ckC00E34T+B5RBlD3ophQvNHbzA5mCkyUyRVKlVqj1ekNRlOM2WK12WMdcc74 BJfbk+hN8vmTUxqkpjVs1LhJetOMzKzsZjnNc1u0zLurVX6gdZu27Qra333Pvfd16Nipc5fCrt26 9+jZq3efor739yt+oH/JABg4aPCQocOGjxg56sHRD40ZO2586YSJkx6ePGXqI9Omz5hZNuvR2XPm zpu/YGH5osVLli5b/tjjTzy5YuVTq1avefqZZ9euW79h43PPv/DiS5s2b9kqbNv+8o7gzopdu/fs faVyX9X+A6++dvDQ64ffOPLmW0ffPnb8nXdPvHfyffjgw48+/uTUp599/sXpM1+ePXfHd7zjO97x He/4jnd8xzu+4x3f8Y7veMd3/O98x0Dr1oH8VnfltWyR2zwnOyszo2l6k8aNGqalNkhJ9vuSvIke tysh3hnniLXbrBZzjMlo0Ou0GrVKqZDLRCZQAg0LvO1L3EF/SZD5vffc04jHvQMwYcBNCSVBNya1 v7VM0F0iFXPfWjKAJYfeVjIQKRmoL0kM7jzIa9TQXeB1B0+087orSd+ufTC8pJ23yB28LIU7SeHl UliLYY8HK7gL7MPbuYOkxF0QbD9peHlBSTt83E61qq237RBVo4awU6XGoBpDQZt37E5ia0WkALUV tNhJQaHFTgUd3nYFwVhvO96DoOArGDA4WNi1T0G7OI+nqFHDIGk7yDswCN42QX2aVATaSs0EZW2D cqkZ9wg+Gljk3tnwUPniSgMMLEnTDPYOHtCvT1AYUMTbMKZhu+2CtqkX7H9H8eGmtn3m35wbJ5QX 2Ee4ebS8fL47uL5rn5tzPfxeVITPwLrU176kvD02vRiZ2KG7G1ujc4v6BMlcbNLNR8JHFRnfEG8B TykZ6Q4qvW28w8tHluDUOMqD0G2Kp8LhCOwLnwdHgbu8Rx+vJ5gf5y0a0M650wzl3absig24Y2/N adRwp8EYYexOnT4a0GhvDgypz5NCUnEe6tCtnrOE98h7LwpE0D3IjT3p48UxNee3Ic2hfFBzLIaf IoK1goNxRkYElW1Lyg0teDqvHxR96COW/462vcR7+adbUwZEU2Q+w+/Ag1xO6kUN8+vCwbS0YGoq FxF5W5xT7GMrKZ7dqOGkSur1jjW4kSD7oBB5O6CoRRNkv8fDJ3hRZQAGYiRY1rVPJO6GgXEVEGiS VhSkJTznUF2OpSfPKavLqa9e4kVJ3i3t+ixBhb/+T2+wxhQMbxEk1n+TPSSS36G7t0PXvn3cBeUl Ud526HFLLJLfvD4vGgrGtO0jxNFoiMYJUi4KZb/6wjzSRxNkPvyTSUI9uFKuQKmUUoi7fdBQck/k XqTyeP7LSpXhq7yWRP6uFu1msEXarfGWt8Rv6Z6mXMAOMz/t0KNvebnqljwUtUiD90YJSjz06ONx tw1CT9RMH/5Vhg815yiKCwaQZW15AZS/SFI0ekvBuGi4CD9cOhs1bI+Grry8vdfdvrykfEBluGyg 123wlu+jh+nh8rEFJXWCUxmuWhQXbL+4CHk1nLRo1NoLesEGVxBhhAAuvDdBdEH0RyxDrEPIpHI8 ZQxiJuIg4qqUExBsFY9nBiqRLJLIrpEPZkjRAZFov2Ipuqt3UYR26hqh7e6NFGsRKdY0K5LcuE2E JjeMUJMvo4xTlTbjUGsruu7vIyiMxTuhR0BPCLhgvWCBIIIKsmhKQDDtSvJnrDsoMEB3QCDolrrC hwRSoTVmtFbRML0CJnDRn+nlSA69vEtnzFjX+j76NexAHEQI9Gu8vqJfwUx6HjVAj/d8xDrEQcRJ xBWEjJ7H6xxeZ+lZLPUlNEHkI/oj1iEOIq4g5PRLvBvoGa5P0p2H8xGUnsG7gZ7GYZ3Gu55+gaEv 6BfYtY8qcnIz9kmBtCbRgMsXDdjiogGTNaOSfljxVwNXJf1mlzvNtb51Ov0YggiKjX2MD/8Y3IhC RAliLEKGoVMYOgVliOWI9YggQoZ1TmGdU1jnOOJdxClIRwQQhQgFfb8Cm6mkJyv8bVytrfQ9ehRs yNQT9G2Jvkvfkug79E2JHkOagPQ4fasiwQWt1ZgPWMeA1IC0CeaL9PVdSSZXuLWRHkT2uPDeBJGP 6ILoj1iGkNGDNLFisMuED9kPxxWAJSvge4m+CBsVEBjpCvjbooy5+c3f4i4M4W2de52fBvwrV2OU 3/xLH8cQv/nnLMYQv/mnzsIQv/kfnIQhfvMPHokhfvP37Y8hfvN36YEhvFXSta8kJbtyuowi7tZ6 +jBy6WHk0sPIpYeB0Yf5BX8x3renK1JTkWNrAmkNUl1lVaTsACnrRso2krIhpGwGKZtFyvJI2QOk LI2UOUlZAikLkLL9pDmyoowEdt8SzQ3YSdlxUradlJWSMj8p85GyJFLmJjmBSuqpuDdTIgUS2dWa 6xXSu1pl6LGPHuSoB8Xag2p/EO8nEWEpFsBC7sRI4dgEThN3peZH4o1bZIxpfQ99Ayu+gdPwBpxD MJygN1CM3sCHvIEP0OM9H9EfcQhxBRFGyLB0InZ8mXTX470JIh/RHzETcQUhk7pzBUFhTLSLO6SO NYl2uguP0TfwSsTLQz2BeIPTkGa4R1jmJPoE0iUhnEBzwMp3+Sajwoi7tb1/aP/8QwvK1kq6lC6D eJyI5VG6rOKveFclWVXh3+9qbSFPQQJDqSO54Cc+pM2hVIpng1PBaRY46VakGRXOXlhNX+Fv6Koi Ol5rr+sv5wXX985KisFLzv2uT92VjFS4PsGUrXtdHzsXuo41qVRgygF/JUFS5ZaK7nM2d20/LhWd hRlrKlwzONnrmu682zXKKWUMiWQ8UIqxgN7Vzd/XdQ8+r51zoCtQis/c68p3PuDKi5TK5nX2utKx C2mRYCp2toFTatSbID2wZ04lGR5oKF8p7yPvIm8mz5A3lHvkLnm8PE5uVpgUBoVOoVGoFAqFTMEU VAEKc2X4fCCNHwCbZQZO+HcGCDApbKD8zs+KuV0jCgr3QTBG6EA7dG9DOgQPDYIOA93B6929lUSF C6jobUOCpg7QoUebYPO0DpXycLdgTlqHoLzw/j47CVlahKlBuqCS4OpXScI8aW4cd1X3ASHGuUvi OE2Zu6SoCOzWSfn2fFMrY277dv9wK4ne0/7+2G8JxwdXdujeJ7glviiYwQPh+KIOwSe4L7sP989X C9rtw600kqI++4RW5NeCbjxdaNWuqKhDJekllQM3+QXLocT8IpVTJICblwO3IiFSbk2knA/rY7kk TrCcUgk+qZxPqZTKMcLL7SxNKmi3MylJKmNzQ6lUptTmvrnMcR+W8fmkMtYyOC6VOW4t42WCraQi TicWSXBKRYgDnFIRJ3FIRXr9XaRJtMjC+iILpZYE8ncZZ6SM9nxdGe15LJP2336GtElLI7taFg3q x/cBJd6CIYiS4KJJw+3BsoFu985BRdENgr9k4KDhnA4YEizyDmkXHORt597Zst8/ZPfj2S297XZC v4IefXb2CwxpV9Ey0LLAO6Bd0a67C7NybmlrYX1bWYX/8LBC/rAs3tbdOf+QncOz7+Zt5fC2cnhb dwfultoCScYL++xUQJsidDsluouqVSivJXGeojZWw9hWkvC29NhnxFUx/sU+NXrhGtzRaRE8q1Hr Rq15FuoUz9LxzV40yz6jpSeuimyKZhkw2ehtA2kTJpZOBHvBiHaRv1L8YNKEiZzhkXta6f/0wbwC 3Le1K50A0CGY2r1DMB/93J1yOaaW8CEFW9SlqdUF6G5GEhtjYgueKAj1BXlaHk9TKqMF/3X+J0Zp W64FZXT/LhJIIBOgtEgIJnToQdEU9Ih61VXoLvHlobQIB1hK0khp3TOkbkMkDHy8dZgwMRqK8mFC lEZqYZXSOnbUf7AOmiqxCmIRDvEliGV+sAOEv0Nc4jQ0InyJ53NKf8DClVEAbILtZARsh4NwmFwF frK3D3YD93jawTMwDZ6E+biK9cWUhdANLxHTnySx4d3QBDbgOrYBTmDZ3jADqsBK7OHvYSbMFT7C WnNBC4nQGgphDCwhHcMToR+cY7MhBzrCQzCWlIX7hJeGHw8/Dy/APuHtcC2owQGD8DoR/ln8LHwG GmGNFbAazpHHlXsggK2UYclnYTysEYoZCQ8L38AeeOBh7AODTnCCHKJp+PQh8B2xk2lCW3zKc+Fg +AiWckIxDIc1UEWyyd3UI/YLdwqfACu2MRmfuhoqYC9elfAqfEE04tXw8+GrEAsN4V4cz254jxwS QrWzQvmc0cilBpCLOWPgNTgK7xMveZ2OETVihhgQp4Y/BjM0hZ7Y25ew5rfkDzoDr5nCW6x9uA3o kC+PcW7Dm/AVcZAmpAvpRRvQMXStMB4U2GJTvAbDCOT3Knz6WZSavVRDTwrPsa2sWhYfOh/W4Yz4 4Wl4Fl4nWhypm5SSR8kp8g1tS/vTp+nXwpNsM/tQPgBH/QCMhiWwFf4gJtKcdCX3k+FkGplPHiOr yQnyPrlEW9MedBS9IgwXxgmvsjZ4dWelbLY4T1wkuxTqEzoS+iD0RzgjPA+6ojzMwt6vgLU4sn1w Ej7H6xx8TUSiJjq8+KlvT/IIXjPIErJROoPeja28T74m3+MK9DuppriwUhmN46eseHnpeHQon6TP 0JN4vU9/on8JNiFRSBOyhTyhSBiDvZovLMdrj/AVc7CTLIx8zhBXiuvETeJW8TB/nyZ/FJf0d2ue q02tPRuC0ILQylBFaHf4K7DgHOJigVuoPOz9ALxG4nyvRInbAR8RDfLOQVJJK9IROdOfjCTjyGTk 5Byyhrwg9f1lcgC59Cm5gn3WUqfU58Y0m7ahXfB6gA6h49D3epzupqfoDUEuqAW9YBFShbuFYmGI MEGYIqwUgsK7wpfC18J1oQavMFMxF0tkfpbG7mb92US2ln3HvhP7ie+IF2Uq2WjZPFml7Bd0YlrJ C+Vd5cXyZfK98o8VJfwUFfbAKze/6iDnhVlCgbAHltJMFos7lvdQnvvDYKETRUmlm8gCOp3spkni ZFlL2pJ0hqu4tX+SvkXX0eu0pdCJdCDdYST/pSr/yMyM//I7j70Bl9kBHNt7+OTJMg2ZQa/INFBB pN9NkzeFdJYmvANfCOeInG2A00xFbOQyfUkoRCl4lbUS+4BHeAZeFsaR6bCHFgCoqhWLUY47ky1o F3qQDPKnEEavtzNKUY7wDcyGUfQzuIx6vACeIoPZMFgKmWQafAcvolY0EB+Spcos5BgdwcppDNkN lG3mv2cmSUQQzTCHFAtrZFfo5zARTjIVnBW2Ye9P0peFTuyq2I0MRw2YDvNgXHgWTBH7sA/JMBBI L/Cx82jdpgkZzIN0JlqVfmjT9qJ2V6EdaC10whQ7Sk5HlIueaCHW4LUK7QRDCRqBOt4brdh7sFvW g1bCMFFH0OoAsHdC3aBv+EVYHR4GD4Ufh0ZoD+aHp+ETN8FFWAabyNzQIzAWd46fo253FNvTk2L7 cCNaTj+n3enKW+cXue0jdvgBr5ehPbQS90M5+xS6Q354cfgTlO4UtLCrYSD6pxdwlD9jC/cIhyAz 1JnuDLcXxuJ4z0HX8EthF1HB8PCD0AUOwAtyEQbI06INPPjvQc034UkAwXQTyhHv81/YI6ahYVyF MtQcQP4ogOIUzjpf47sBaBYDaJtHoJt2E0IR6Of8DcMFACOuUDG49425CmCeivgZwNouCkyzTYvi XYDYBQCOtQBxSJ0ZEcRjeVcZ4hqAOwjg+QLAe/xWJPmjmHEr/AGAZHQjUtYANHgPIA3X0YY41kY4 psaTAJo4ENcBmv4JkPEMQCY+K+ssQDam5eDzmmMfc3HcLR9CRWoBcFd7gFafAbRGfrRdCVAw4w7+ T6B94h3cwR3cwR3cwR3cwR3cwR3cwR3cwR3cwR38fwCUSC9cRP6tfjm02U3JBZm8kq4OxIDILgig krMLBGIVMvECFQ7QpqAkq0ljsKcZrufV5nU2XMvrVJsH+Rg21OCtabrH6DH68EaAQY1bOFQT4F+y d7NDvJmHw8dl68SPQA02iINkyCTygGp57HIHHa5wxMXxL7ro7bFmuz3WHmfRxzqappkO0HXY5hDQ 0HUBteCIjRVInN3uS+HpLkxvTNdV+NTOA3QNpOFYmtI1uxK3Zct43IJxPT5S6QYCE7N69+W9Lr58 7bLhOt4g/3LtZUOeIS8fYcAwMZpycznmN06bbjjSNN3edkqgG8lskJDmgkx3Uxdp5MdQkyQMaane BTZmcRGjCkMxCgylxqe4SIYHbw2TG7sg3Ys3HdG4iFXEm0FtcoFZjjeoe61I6gKzSHFMVrPMDKvF LPMm+kmizGK2ZmY0y87yCySTkP8h7+G1K8v3vDJv7k6S27aob5t2CCHx8ZqvyMW1T2HGfMxowRML ivqyvs+eefNg1bG3yJsTnl5SOmHN0tIbpTLlX3+QpWtP84yj5MiEpxdP4BnIrGmhrrQE58kAdwVU yXoCBpNcYTBUksxdsE6nQBowytfpHgDBILgFQdhmfHaxxNza65y5KA/5KAqkmPipMSunWU6mTI6X xUDIuRXvdep7YNaU5Lu8OP5Q1wPkT6L7+Yva6veLylfufzXkCrlva1+TQlMMVKkyEDApeQ9U6wTC e6CHdcIDep1LR3XbTP/cfowXjFnJfrwyrTarxUBrZyHTE+9KnjrrQN9OJ0NdyXny1YF9K8v7flhd +8XPoV9DCmx9S+gsmQ0nQAWd96hQLbbKKklhwE+EPEqJiuSBigoYAVlzeYsu0B/GwExYj9K9Xr1h FfbiWvG1C4bLKFQoYZJoGSKy1TQ9MzsTZ1Ge3KxZzt4Thb0zcpsJJ06MW+TvFDvgfmy3NamkI+lo 1MSGgdixdKxAO5FO2KQXqEMciwVi2dgl9rTOhgvFhm+hSafLTdNhHA4y22NpTRuQyj17+PdpqvA2 H3svgC9gp7yzeZEu7gC2HvPXM6mX14uLuQpEOlV14sQJ6bs44e9oLvJdgO77QAifrTDn0srw2YDb nPuUQKiwTtghUGESEDP/uSfBcirhEtBLOB+bsXG2ayo+Oc+AGhaZg/li47RiSZdIcVqahcvy5uWh PrHiTzf46w7oGf6OGcVDOM/xsGe3zB1rcFaGr1ZQt/q18HmwIkwIffh8YCCTzacL1Av0x3SiUq62 04KYjpb7YtvG9YjpZ+kX2y1ulHyUelDMg5ZRsSVxU+jDsknqqfr5slXylYZj9i/oKdkp9Wm9w5HA RHOCVmsrVQY83qx0JQGlQUmVy13GUqgMHwroMNUNAeza8oSjiyQ2paFEFY9L48zi7CLF46AYmvMP QcQYTFw5rSYULtTPZH+MgWun0eD3JsplPUd9tH5SxYQ2Iz/a8PGUx/ZtnjZt8+YZ0+4rph8RRu7a 1n9XKPxFKBR6Y/uqV8izoaeuXCXDycifR8zjc3EOGVSNvFFBacAtBLTGrFFsJl1GVyvYNkaUIBOp oBSJhpLjKqnvJj4iIFx/HBoxoNVniXVDSheJWwyIVIxVV5E8MhciUjQuLU0aW8SG59tyiTGXjxCK 0zxeo0wmz0ZJzaTVu1t/1OOpr5tMYI+0muZ6+e7j/Xn/8nC+5di/BPgu0Kyl2FK2Xzwo2y8/qjjm lN+rKdL00I3SDNZNNU2NWWg6YLrouBh31aE5qH4lhsYZnIZ4Q4JB9lr4KshxghVIleGrAUeCyqCQ yY47HWan06FwOlDmFA6noE0wVNLnd3UxEmMlse/RJphFSKik+wN6QjWqUttH2B8+n2Q/nQVuMJDm AY1xTz7tT8fQmZTRKpqEa8WynZEJ5fY/jQuptGzhKlB8wWjiY8fbfF3jNB0KbERfoW6Wm0MxKR7v s3j8OciRZtz4ehMlRY4YZjRuMjmT1+RQm++5NVc2rX7k0WfIvpg/P/jo+j0vHd7YL2H79tZ5gw7N OHJx6KgnnimPOfn5D9v7bDnw/IIBTZGTvcLfMityMg0+CqSIWqu2QDtPywqMvY2T4oRu1gcNI82D rRO1U8zztOXmhXEvaFWiW+Bfr1Pzn1QzOfFqNYQzKIAP20/4lye0JHu3RmNh9ir6PMTS4YEkS4JT ZAkNtKbS/u4xbuouk5f6JR3wE/Ab/NS/vJG9kjSviP2IVPH/VY6So/5bGRpWksd31unDtahGXCuO KEUt8i+3CZo5zsgIH1GKkHMoSGRcTI41ul6hRuTUB+u4x9kn53fA1a3XbteKUTN3bJye2dFsUpdW zhs5YrF5t+eHlycfHzV08KPLQ5dOvR4ms+2r5wcfnbbBvJZOnj7o0Tlz3HuODqsY3P+ZxgmvLj0U +v1b7DH/X2kGsQq1RwvXAs1MfTTDNWs0mzXHNGJHoaP2SSaYULZAIxPkokotyEGj0WqPC8wsCEzQ AtVomVzYT/eDAl2k9QEV/5egGg0cV7FKOvQVUVQF4l1ZqkqSE9DKA4neLHmZJ1u+XE+5xmm15iyg BuqmAt2jqySLJc79VIzcS0u7hqL3rUHSN3SerucZc3NJ1OlgKHh6vR55J33xSYv215SrrQx/HFBn 5gqJjXIFFh+fxx2GIuQslgmYNQF1rqasMFcT8OdqEp1IG+VKLkURumDZJNOYafEaBSOhK2vn0Gef eOut3aFs0v8FYW/NfS+ENqBqrKgdhULD7bBHfBF1+YdAfAfHlPjy+JUxL8W8oTmlOR2nUMbYdakO QZkupqurUF0FFD1DjMpiiok5rtObdTFmnV6L8heI0akSLAHdelyRdfqAhVgsThOq6St6Rj7isonK G/CyBKfW2N8wxjDTsMzADCiHdkkO7QTsBju1L3ebDpBs0JMVKMXNK3R7/kkeXbfK498SyRddlMP8 yyiRxUYELr8X5isap4nIXJC0WlJoMq74ZsFEaYzxWDwCSiRYzHLuafV81bL6wUd3b1/ce3HK5qX0 89pXusx57BBRTFhy7e1aUmYoX3Rk45qKLvlW+su20KR+oesfHH2s4jxf1TohNy2oz/GQChWB5FGx pJ08YGkX287d19TDPUoYLB+sGGka7J6gmOicq5jnPKX42GqUo0LvTnZ73R6u2caUhIC2UEtRlOLI R/0571CJlWJCnJiYYNbiets8YIE9vlKDxDv0jQwGAzUsb6jizEoguQFVvq2/bYxtpo3ZKmnSrrTo ana5jlNR1ZVUtknx5Tq2cJWVo8PEVy+ZnGuoids3byIYDTlcX4n5Jq4J1bvsDe8d1at1z4G09YFh u2sffn/OV6ELzy68tP3L2pwuSzuPf37jI1O3sO66kemd0lv9fGZQSeiPD8svzyAdyDSy+fVNh2u+ LN5SVLl21Y4dfE0ZgFprFV9CnR0b0B3REoZ/VMGUqJHc3KdTwpQabakgUD7sLpKBF6hDryhV/ghd SH/Snwr5SMaQmbjAxuqiUoLblOJxeZ2uXe5suM5XO+6dcNufa8yNGHouDehFyUCQyb3NTKacAcKe xaHLHZrp9wmP/raQ3di+eEXIFKquPL2d/ECOPlPnu8RK618qvBbIauHoaA1477f29g4VHrSOdgzz TnVMT1jsWJSwxrrZccDxg/Vb93V3zF3WtdbtVqFFg8EymsyVyYuzbfe4Ze6UhC66/lxznDjDIvmo MDLpu7m+uKpILqhxzo236UpDLgm7uSAY690XY8BIjcvTjt5uri/frBp1Ew7F3IOUNKEVzc5K5lON FHCmTUbJpfETaaoju46x263TBnSfXtiMNNs/em8Nkb+17PIjU3/ZuO0L+s4LEyZXbJ42fQPpbpj6 UMeZn43V2HuNIorPzhHDmtA36Ft/F9r18kEh6+m9R55ZHJnvsfA1a8n4d/37BjTLhDJ0aUSZoKDi ftoXEwXat4IGZFWkEI1wIQr8VrLVzahDwfIkN2eiPLqny+MzC7FNHJ0u48fuQKW/HF2HAGeWWAix jBXeqQkJlM7aRNbsCh0Jvb7rX3pQRpcxtIkE1wTKe4B7WOyBGCC8B2KkB7KtuOHJk4FD4RaJGO3B t8XYfl6ny7wL/9ADQrL5H2tZky2QmrDwDp0VGrCL5JO8XaGhKEvhWtwcF+FqJccNY0JgUBNDumGY YriyxLBAWG44Jr4lO2S4alArxCLSixYahquDht80v2l/0ymZhmmZTlCrlCJj6AwoZHK5BsMKmUaO 7rxbrjFjAhUEN9OYsYQyQRQVCTJBVknHBpSg0Hwf4D/rriJqIEQdMGncMEQudCtkJ9k5JixnhFUS ElAXag7Jz2mE5Rqi4XGDXn5STmfKy+RU/oT+1KfSpmdcLAL/7DhyR6wBxc2en+e4nH8hj2+GLvOt AJrg+Y3taVH/CrUvd77hyBHdkSPzxQhFoewQVHfvEEzo2rfPbqYXFPIq9A0h/CeX1SIyflyxFzcR XsEjxHgEf7JMLtDMD2ifL7fWPr3hc/LL6vaJzkyx6kZ7ciDUjvYlK/c9vGQR7lJWol35HvlrlGzy rEAhY+29vbxDvaXKOUrZCMdEcayyVD1bnK2WJVuVgj05NcEar1TGmBJSUxs0AGd8AnLJlZBgBIXd L+vh82scDeMT3JIQFqe17BcRQn4ecr3T5TrHEoGalodrfW4TIz9YIBHHCE1sptFzk+ejo17iyYi4 lX4vLtwZOVwXeXgl9W96p3TosLnLepe9vjj0BLlrVvP7OrR/dG3oNBn9gL9t3xY9ViwObRerivYN eeDFzOQDZcN2ljQVuhmtQzvdO6ZB9Xq5pvmo9t2mNOWyPjT8nTgJd3fxUBkoGURHxlM3ZGgHoQ5M iC+DOfHLYY24VXhBu0/YrT2qfR8uxP8Wb9SZ4o3x8UKqLMWY6nS77tb2Mve29IodLo6Kf8S0yLRG WK1b49xEnqebjJ/oYsAMDoPZ4GB821iRkku4VUpOyTXogbC4mASNEJfAlAa//j7wuwkhDpfN71YQ RWzCoH4RO92Jq3Jxp7oFyiixLC2tmG+7yHhikzFvYhJyx5SUmcFscj+3TdRiNnHrxHYfviv0xsXL oU+f3kHaHj5DGrY8mHn4ic3f9Bv97bznvqa06ZXq18lDH14kPXeef6fR+sc3hq48tj/0ffkBtOdr UQf7oozokT9zAn63i7RVRCbeaEjQgwI7qiRKhyveEJ33hL/nnS+s9ZPeNL3tlEAzIU6ukClEBVMw WazdYacytUqj0qoEmcVqtsZYBVmcYPMQkw5vdoXTQ6wqowekQ6FU/MwikpDYrDbcWpopiojPkxHd euDq7FlL/trad0bRhNLOUx87MTe0k+Q+9kLTgk5PPdh5e+hdscoS33Fg6OSRl0KhzQMytjdrWvD9 i9/+kZrApWAj6gL/rroa7g9YZGKCQiGXg8D4QFXKBDUo5HzOnAZTlryHcJ9b5dZSlUPLlNFRa1re H5kovmmUpurahbTbBb5pOnbe4oliI0uqWSuk1XwizBGrtofyt4W023lPNmFP5mJPlNAhkCr1ZJmc 1HcGO/IM7lPUlDrU9a2rWva7rfULkaWcr2m3t7xJ+LLmIg3WFvJWW2yvHYpPGI06sA91wAefBQri zHEWWpJMHlDEEJOQlAQek436AFsnMluCTvAkyJSE+JN9SWjzsS/JJehtjC9LJsnxfreKqGL9g+6v k9pOhmIUhU7YBe5QSbLLmSFFI7uiXO5poGi0Y944p8MZ6xRkGr/BZ/G7/Aof83t9dm28B6z6GA8W Nse45RhLFH0e4lSjjJiNeEtQejyQJOANogeI/ACz/ncKXGpQS7J9xlu0xGqTN6aoJvwIzmxiqCg5 RqEjHb0s9P76z0Lrdu8ihafXEfK4f4dn4N4xcw8/7Gk+n9DHZlxtRfO3kdrz40v3kQc+O0VKdw+r fDJ9bFmnrnO6LFh3JPRn2YAcYuQzeRBvs3AmBXhyD585yk8edjW/SzqB2JWZFaGN0iM0pUGEen0R Gp8QoXZH5MSiidaQ5RaXiztE5DquYstgPQSBNUHXvxDOwVUQTW5MXI7NbWSniiQlxN1QRRmuYcVF 48bn1RbXcYRvs7hIZBoPHubrAvY1J/ydMEBaCzoFDEPoMNkEOlG2QLvAKFNS9KYcAQ9L0CuVfpVK 4VcXu2OIOyYQUxhTEsNiiB86mPZKDV42FI+7ztc1nOnL+ZKbEdlONMvGxiSP2d9yh3zsoHtHphwu ev3R10+Q9fZN09qWzhB+rYmtPD7yLOcbX5dSsS8iZAY0hDIhQQSFm6+69KWATk6FqNjLbjI13xZH tC0yLI9l5WH6IQ7tt+1YkH8/WI/PM5CJgZlA9QozjVOwSZp5mrc1glJzr+ZevdCA+bQNdX2E+9kk 7WTdfK1CTUVFrraZrgvtIOBGRdFJ20anWkVXCyvlKxWbhJfkMhPV63TpIjWLIlXgPjldVGBQoemm 70YC6D4o+H93U2u1Op0BFEpaYiozUVMV3YQbuKYVoltRSZoGVBqlyh3QzFQTdRXthX6OGnNoJTod Sj0Bt36sgRgqaa9X3GKJWCYKYiXdtMvYEnkdyw9Ui/PsOHTJr8Cwoz5yoRi9jPw8fsxaf6HvJXkb 86dL3gYSnJ6/3YpXQROuBkX4FPpdpySvokNQg3kpmMc33X/u1Kl4anQP/vFeT66uoUfah+/NydVl 5EjBPY0wNbrXTitCvwTGFUsmm1htzXKIx+g1Ei8xriJJ5P50ayxuuom4P9RrR6iPWFX962P3FD4t 1Nxoz96pzmbnq91cFnBTIboka/jDTpOa60F2jCVLwX03uQK9OAWVC4JCyShVyhVMcMtkYrFbTdzq QnWJeqy6TC2qFWgmpaNADdaM2suIeqRxyUH3LE86eUBTbeLHDuh/scYRBhH+Y6vdikD7XAEfsLd9 riKQEQlm5MoTY6Vj4L2xGMyIBHmqN3I4rPbmynVmRAyPX9sbg8H4SDAegxYe/HOnJffWtx6SAStC ESYoxcipZ44KtOpoTQjZM4vNRNaUVZfhqjwI7fWX4seggziYGShx6InZYDbH2eLiGDMws9qmjmOb bXt1b+kEm80eR93xAWOXmC62gKOP2EfZ29DT2D+mr62/vZejd9wi22pqiE0QBFOCWmnxu3GxcZTF k3i9n/Mq1nmzC1LMfZCbj3zRAYkxgCeD8eVYsq45BtwlgTGLogsCg8gC0uwd0n7r7tDegydDVZve JvGfniZxU75/7L3Qp/Q4GU2ePRx64cy50Po9b5O+r4X+CJ0kWSRuF1E/EboIEf+D1eL8a8EOvQPZ Q4yjzLSDoYP5fsP9ZqbWJKAKgs0eWRlNfoXD7SD457BrozYi9mY3dFzx9U6X61dGySmp8zttCegu UY/HiOF6b4I2eLzTg48X/Rw6FlpAHjmwtrhj0zmhhWKVzjRk7+j9odrabQJZPLPfbIsWe7oBJRVd TuxnIukY0JvUOmJq5uzrGqoY7WKmyvDXu0yOLKRXdyUmZxl5PD45yxCl+ijF/M92xfsj+VjeEKU8 P1CKAZ/uPud97u7qfs7RzvHKybop+rmqBfqntJv1lfpLuu/0Bp1G4zbqzUaj3qjXKE1x1OOwqmS4 a9VqRLtSabU5YhNsNvAkSjyz2/V6nSLBr3tGVuxOGptUliQkJdqjvPO23PS3W4FzH3vBzv25yNtB iYWYjG68dEwcOSUW619rRD+REzmVIqDP1RtaGE0tuHyTcZIZ0aGaOGJzjahIJoQu4Mw1JJoRLkS9 ZhTdtC1Axy/GKzSmODteaaakExfPBlp+5N2pxz/qlNKzY/ja4Z4P9W7k6fAV2TB3Zeennguli1Vd 3p7yzKl4X1LniaFxpOmcxc3V8tqJQmbOlLuHS28V+oW/Yz+i/5MOocAzg4RBrFSYwJgvOVvIdbYV 7pV3jC9wtUtqn9xdKJL3i++dsjBGl6L1J9EkIdnXTJ/lbecraNLX3cvb0/egeqR2lG6oeYh9inqq dqp+umFiUqlvnlCuXqgt1y8xzE2a7Xtcu1K/0pLgS9Jp1aIHvek4hVzGBCojvqRETEOnL67RMpTi y1ZoZCBuUkhKyFiynMhwJQ4GfI0SEqyCmNBIGed33Kf0QwPSwJHh8ZuI39RD0tmm9Q7YBdx23rJz 4MfRiGt8E45zxjecJLofH4caHZOTQDMzov50UrLfn50VOY+O7iksZpuV2aTZwLU8yd/vFW3/t6eP 2dK9sF/L0INdRwyb8euTz/01T6zSb98c3JDbnHzep2zqvOpnj4Z+W00+NTy0pHeb0nYFw7y2AWk5 zw0Z8/rgEe/O0i1aOuv+LpmZo1Ja7pk08WTphO9xDOmo91XS3r9LQCvSBGQPSP/gSllJS3e5I1vw V2RuQpsIRMDwHiIJLc9V7F0d0XkuuobaC8XfGqT3jvl1r+KzuR9MY0LxrDwUJ2q3b7/xG5eCDWhV E7FNM4wLqPz6PqyP4piCWfnSYcWlI4u1VLRn9ykm6V8UL+nlGqBGfvzmlCnNflrsthK3tdBKS6xj rWVWwaqVfGFeV4l1VcUWvubgnKQVc6cY3aSIIZVMEGoJQfcoYkAlT0lymoys5PDgUPXH74VujD18 9/bpp/aKVTU7vwzVPLeUaL8XutRUHNwz8LD01hHXRxDbSyf7vwfuaSKSVEgRfKommnRNiWahYqFy ueaQ5qpG7dYUaiijagXuapRuhWhWKET0D91UNFMqKgkVv3er0FsZoiBDqIL3Xp2SW6ggZYrlCowT EtDSQEpuf0qW0XWUUp5idIuFIk1HD2W5eEi8KoropSzYpS7ZFPFSxvE3ahx2Q+QFqCP2sj3yEvSm k4+IJ2JGb6MC9Mi2XyqUJsIJOmuV4Z+lN4uSU5KCxZpJTgnw/98jrUNowz0kM+JjZBLauvbtD8n0 xq7ERmTxW7Xo4VZ/WjZ28mTWQPJ0YwHkk7idJosD7RqA39jA5LfnQjNjrqmZ/V6423iv6W57H+ht 7GPqbTesUqzSU4GhiyeTI69Uao1GqdXp9RpzjMnE/2Ov3VIZztslgt3NqcZk5DTQ14JeB4iUouth JgTsokKRYLGbLRa7SaNUJlhMGDQZNXq922A0GwxGk1KjsFtEvdGAciVaNKJgN+jR4VYoKNppu8lk NILCYbM5DK2VpCu4QYN3CyIAIum6182PDWJjK8minVGb7YjtVIseYa0jttbeuWBIu2/rLXedR8jN dvS7HXXnTp1u9g9vJWiJ5+sMR47gLe9IXejmG86NHufGyKfQpLJXhq9HJsyHial/T1jU59Rhyi5N QAw0l+ZwPJ/AmMgExpiQxGSio8iPsghZG3rk6LkkR3MVsf3wYRevs9G3b4Qe2h96J1luM4eOoUrk P7XixyThbK0j9NNvi3YLL6ObVLzYPeTu6ue4ZiwKjaB2yZI0D7iYkEaoQZSlgdwkUCqXvcxEn2Q4 timeHV7nKVzLk+xF/clFDG4ovMZMyyKy5PPPQyPkXVf89fkK/uzk0AiyW3p2VsDJxDS5zCDQNCAm mSgS+jITfHLYpnyaH4Ze+4fnEk82ennZHrI7VPr552RJaMQKWfIK9CXuC19iTtYKUiCHxAeWKrXK 1FitI7WBNjUV9ySWnLgWqfemFmuLU0dqR6SWpJdr5zVYY33asVlreTF2S8re2P0pR2JPpnxo+TJF 0c5KXDaXPa1halYuy214L7unYS9FUdpQxYi0SZr5mmOav7R/pRlzsnSEGZokZdkyPGZ7/wZjGtAG zia6fN0y3TpdWCeu0+3QXdEJOp1TsFXSLQGrfYXZ6ZRDQbIqwymoGwwwDACfJ6mS3h8wJAf4q1O3 P92/wy/6m+ZyK+JK8Gal5x7KpetzSa7NZ09sknRQdlJGXbJ8GZU1bc7P4vmRPJoJ/l2kvNqLF7l1 vFD3GhVzx0WODHL/Pj/m2wuftKfkq1SOdGVnJUdeXLWi0rJltVjMVpvXL8jkOho5rcdCQt7gfSN3 HLi79J7sUV8MI5kFC2ZOiQ/aH3p/4YIthQalLfGA0zbwyJh+GaNHDN/oj5/ds/3WuZ1ndTbrtI4k n+qhRncVjbOPW9QhMOC+xpOvVs+9qzn5MsVpSOnU5J6S+7vc9TDO4DycQb5v4d/hOBXYRkSNPknM FgtEMd8VdFGXK9GZ6WzjHOta7pK1iMmz5jk6Wjs6ihXF2j76YusDjpGKB7XD9Q9ZH3Iccn2u+cL2 RezXMT/Zfor9Jv68K+yKdYtN9E3M6WK+PiB21BeKQ8Uv4n9nNwwag0XHZBTinKg5KotTp7Ynva8m BnUAt0NlaqaegBsLyBR8lB4i6FGsJ0FylTAXySddiEBiE+7Oib4YGs9Pba5xX2GctFDhn3RcK3Ee s2GcB1XCiM4Bes4G8CYmC+gb1L8DI41e2j1+58Ad4wKhX189MIpm9Xxs0rYXJk7aJlbV/r6sy7Lj paEroVPPkpUHey468c77b51AbSoMXxIuo9Q74ETgbqWGuJxtY9rausd0t5XElNiepk8La7TPG553 aBTaWNVIOkIYKU7UjNWWaV/U7FHuVe3RaKy4p/+GCrrE/vox+pl6QU+4sN6bLp2RlMBYWA7r4Txc xeVSr1eji2FyquV2J1M79USfpEuMw14kqdNcaLHRnt7rtCSdlBOXPF9O5U3jso5I9mEcf3E0PvpP 7fYB4Ubt8vhrl8fXnW4Zc5sY0MkqvlDnVBFb5FVhlvSlmHpPijNLyNsZf+XlL0J/jP9+4fYzrh2x M/su2PL8nJFLyVzbKydJPFFtI3TWjg1xox5846NThx9FyWqPXDoXPbU/Fdiqokzr02Zp22nFbHO2 szftoepm7u4cRgeLQ5SDzCXOQ66PxU9ivoy9GHPRfMX2Y+xFSYKsLleag4tdBweXQXljmqRtbG1B s7UdaIG2vfleZ29VL+0w7UXZd9Yb5JrOQCyCTm3Qo2Sp5UZA0RLU9kwCPqPeZzC8byQGY8BYYiwz MuMEU9JB+Un5OXlYzjjvusgFeWxCVmFUsDpdRpGSvv+Vd0HygDj+Fi2u1J5srtSo1RGGoZgR802v V5sPOTLzk4kjP55dsrLJrlr3tomTXtj0yOQN89Yurn5uHRHKu7amuhvtqend46+/9cW7R5BnHVAb E1CyLMizs4HBLnBaaE+hWCxW9lQPEUaJY5RD1AoDGIiBJps+F2+YrzvkTU0tYps6W5s6OVo7u5r6 xXZzDjCNdgxwTpZNtlyn1+0GsBK91mYrtHKXT7A69csN6w3UYGBxTpUcuOApyYoYFC5bQCv5gcmp WUEt0Tpc/FjP58/iNBDPLaOLuKyZhiR5ICk16yaWRXUxrVPtBdy8pqVdH5cmeY210deVebXj8qR3 RqboGxQybnydsEW24Wa5R3IliUd6ey0THqhq+PO+70NXiPnMJ0RHai6pKuYOWlz7Be2qad5r4bTN pJftud3EhbZAQ1JCZ0N/Gdw7qoaTFfPaDn+Rr3gxuCkvw52SDXYFEsxKoo9tEpseG4gdG/u05hnt Zq3CoU3RBmMPxbJYProUhysrXqEVNHqnilhomjmGCTJQrTMTczgmwGw+BgJ9nEjnM7uaNs+SzmlU TlfWcmzrOXvsAVIFHrhOVGDH4eO2En16XEPRkbxczB36POm7SrnGyBmy2WCUKeUyBS4pBtz6glGm jyNpJC111iyShoI1nq+2mdlZOXxPg3rI1dDCvwtSsW5djGP2pI794ppndGt38qSwZvG4UVnte5ue VbUvGbi4ZijKUJtQV+EHlCH+ZvtqoEStFs0N1T5zR3WBWaaMj41vqPabG3pz1c3M96nbm3vJ+6iH q2+ofrfoGnsbJrfytkrumLy84fqG8maeZg3yG7ZXt/cUNOjh6dFghHyQZ1CDkoZlDb9IvuT52Xsl 2WizyiyVdOfuFGeMXLJgBjduiLj9KoND8D5w6ZoeaC06nXpVQaJTo7JaMn2ZKp/d/r6NGGwBW4mt zMZsE/TEB4mupIP6k/pz+rCeufT5+i5oFWPTGk7wcIVM6ywp5DW+LRzHt0rX+TdFLkTfiF+I7E7G oRWz8Vcu0tqZHHkVzjXTll13phtzk3oO3aHOaDth+gK7jkwKnr760AdLDkx9ccjp9a/9sPrF6dM2 bZ86eVMfR1dfxuC+OcFFJO/LVYQsXlVWM/LPk5O3CqkfHDr47htvvYGzPx9AuCTtxnbuAyv/ApHF luVj2UKBUKVl0je9kmyxWTaFUWM0CyIBvVOUm9UqjU8ZyGyWFVaSQ0qi7Cxt32xZzbKC1qtWOta6 3hq0hq3MSs2+yKmgBQtf5d/ydCNnzwODzpa7C+3RrwBK54Np1yLfdMyLrIHca5bETSfTyX06mSbu /2rtS8DjKK6Eq4/pa3pmenpGoxmdbd22ZEmWZMsjGzTGNrIxksCyHWQs8GjUktqeQ55DssCAWQgm CSEO2aztbLJcXo7NgQ/Z2BAWbwJswrGYDSQL+Qjmw0kgCfuz+b3+l/VK+l9V94zGNkn2sjzdr6ur Xr16V73XVT1DOQRQNIQf4t2J6geo+lZzZoQ82V3pJlzhCtx7pm4/Nf69dVOZ7dd9eTlMg79/YODg N6dvph/ec2vf/bdNPws6di+Y2HKyYsCj20IDveJe8SHxkHhKfE/8ROSRWC6OibvFB62iM+KsKJWL MFfxLM2IHHM7hTgbx0ocX21D5MulD7Gn2DMsd4r9hKURq7Gn4Yple4TsCJPLyZ4rGFlunzcWeXKH Z3FrAQOjuHdqaor97euvXyhgay68g1flH5m5nuogNKroQKgb4mfbMrbVdo/NVijYbDzL0qzNgyiH nWa8Muu22XlMl53jS9yuvWD3kMPIsqNakvbaqXJ7p73XztgDHu9353VlFZKsF/UoOGnZgTq7cexB 1olyJLpbW/cogrmk6BQUV42gSMWU6OSLkSkEvP23tYAy99XhfBrvXbpnama0Ykl5+5Kp1hX71rIf vfHGp7cecK59gN1y4aEXuoewdwP+M/+GVwGpV0NFPLeJ2ywyLsf/tZ3nmI3MhESrnOaZ1ybgh3hq bZsI5yk4qzZSMI8UhO6GEo5lbSzXLnYBd7iF0g3SBJOR3mE+4PjHOKqSq+GrhSC3VOx09Dr62X7u Br5fvI2dtB0QX+L+kf0pd5b7iP9/3KdCgSpJNoZhaY7jIRWEC8gHq3nOy/Mcw7LVNslrs0kSSJ4V KJAv/kUZwW5HEou/VNFWAQm7K1SpkfilaC9MPfZqRFdD3IeoTtQL+haQHe/P6xqe4zt5XLQj+7zI Shhhei4M4nwdb8WDs59sBuVBAsJyhhzNzXkhSWwoDYpCaelyDi90lwbh9OYRjZwOz7O24JE1gR3I +h4zbvbUkXnkkfoRHz794ogS5MwTuZLJ6bA9u6ZAmV+AFlLfZSnB64PevN7l5ACtzh/x48a/O1xs VqcG+kmwis0R77KupHhQaOpvPprZRj3/i5mH74Dk8fvUoZnx6SG6/JYZvNv8LlCDdqLd951ENpiU 2peay3Bti81z8yLzXGEu04WqwSu5bOW2B23v2dheOHxiY8ptY7bdtlkbi39FkWZMR4MxEYdTBDPQ g4g6BWEoned12JxN1tebVkmcb5KMBI/grilrrQ48I1cDM1EleukkEmf/KbTC7gDPeJY9K75f+EvN 9pbtvEYXClql6C/WRIapLCvhCkrsYIIUV1kUUKTT1RT+xRW6GmzRWb2XbCAeOOav3ltMFQMUCiC6 tbKaOo0oHC/T5QhrC4MCVdUnqJ1H5wwVcoTpsxCgfHxuYJo8Y4C0AM/J4FCIKrkL81d4nbLXU+OV 3cWU6ijIukuyrRpvyCSPGQvJzmHiM8nknO89H255bNv4vvLbX/6rvzlaueXKsT+fumHo2js72Jqv 99w8eMMzTx2frqW/Fb254+sHp/fRR3buvO4bX51+25pHfgXc8qFXQx4bw3noJ5QTygfMrz2fMOc9 HIttdhEwcFKh9iun/Wf8s35WE7xOr0+FCYXifA7J4ZSdVXYyq9gp+G/v8RNB4lnF/4mfHvM/5D/k P+Vn/QzdWuCzJhb1somlMDupnFtuZrowrZhPBLCLy80rPs4tSoLESwyn1Lg5ZzHlklSLYXgxG4yH 6HTBEivFzWPYnkcy7259+DpFmlqwfU3qcbZm31Orx7pbbptO0ffEYyseeHUa7+pYBfFwLfDEgQLo 70IDKi8F5C5ujbCJ6xdGOEMQ2pQOtcO32L9aWaeu8632b7FtEdcrA+qAb70/ZouJQ0pMjfmG/BNU gcjZHDcyG2wbpBvlKKPbdCkqS4UlLO8GlfNWkX0TnqrqtmaeQrzCaxDaLnoPKxqUB3DwC7CzCoWg ClY0Gi0qwoGv+Y7BjvqB8wMDc68Z4OwAm7/YZ+sTB22DIgs27iF7MJG1IzM/Fll18Asv/pzy3frb L7038/HJI3vuOXL083uO0B6q9v7xmfenX/vtn1FllOPVV15948VXXoau98wY7DzgiwpR3uuhv5aV hcoVyjqF7dQOaXS5Nl+uLG0paCm9qnRM26sJHYUdxdcUXlPcL9wobyncUrxN2C4bSqxwe/Ep7Sfe d/3vFv2k7Kz3bNkZbVbzVbL1Sn3BYrZDuZq9Rtms/NL+29IZxe52QuaAk3XOB8k6cgaqTkuUIoWk rdJuiZXSlKeVblWrEfrMdL0c0nXqs/J1krC7g/npuidrZL4CL9nBWOtm8li152DHA6P3nt6Wee/W zV9pdD82vvPbj6dTh2cM23NfvP76+2b3Pzpz4UvXdkxfYA6+9sIrb73y8s+AX2tmDOYM8EtBJehv Q/vtdD29wL+MXkdPylxnQWdgXWBv2UNltjZPW3Fn2SrPqmJI5osjnkjx1rLdZW9yb6m/4j6Sf+NX 5tMVcn1BkF4sr6WvljfTBv22/HP/B76PAr8q/g/aRbEObxHknU7OC+kUchY6WxHOOl2U4gq5trp2 u1hX2v0ZWWdp2UVxrhnknlt+OX/QDsptJelLrMj2opSzYcG+jc/N/J/ET25/cccj0/O+szP12FPj mUdnDFpY1kM1UvxDM3c9dv+/r2S++9prP/z7N3/69zia+DyESy8Bd9zortCyJg+lsFQl28auZPvY YTbNcqJbEAXR4XGLDsQIlJ2oAZLEur0CJVRoHspDV7j/YJSqdr2Qi1LPKgPnknjPDx5UMLt5Hik/ 3uMk6/wDSbwKb8rfzHt48BWff+RKo/PGm6686qplN3nL2JqHd6zpeLy2q3NrcvpNTH/n7IfMYaC/ mXo7dCtb4a3oEK8RV1VtqtArdon3i3dXPeb5dsMPGIdYWOQvbF7X8NNCWzG9kaaVFkrybxG2iFuk LfYt8hbHNmGbuE3aZt8mb3NM1UzVuvDaUtX8JVWbpX77UM1QXboyXbW76mvSN+UH6vY1fL35oPSk /GjtwbqjNS/W+ErxcrpaFtws1FbLEluk1RSw9sbSIpwYlZQHOgO9gZsDTwVeD3CuQHkgEXgvwJYH vhKgA8/SGyHjRzh/UvCODIU6DVESpVA03oB31OtrIxvxypzuNopq3FIaLaVLSwp4tqTRXl5EFVUF Qh5/W+AEfeMRvmoB1Hy6JHh6AbWgqAW3qoFsfmvLqRa6s2V3C92iUBRVhbQqV8V7ueBqUTaB39GN 3/1K9hCnj3P4c/XW46IdkMbXgzdPEsNNns1tiyo0p4JQ7cKySkg0a9yKqngUhqtwaMVIrOOLKdtC OJR54XKes7IYVVQ6ZGE+hMF1taLE1bPFqFwpxZOGuRmKHMgmgwX1d96Js5QdOMyf2+5fW1PbCHnd kvbL1vvgDy+Ok0Sv84jrC7fu2rm4+msvHehdsXTBV/tue26z+5CcMnZt8/maiu9+ft8m46XbXn+b uqJke1JfdUWlv7pl7Z09XZN15fVrbh3xr9+yvr2ypNQjVbWu2LVl84Of+w7WtKrZ39MLbAdQIdp9 Ekl4E1QNDqZPhVYAsDsAGY7skCgG+RSx3iWBq2TsLqUCVVAOtVqmZnlhtbh6Kz/G7+b38iyCOeYh /hB/ij/Nc/wz9Dbkp5YcHjaNhbyECFndWewFPsaP4bEXgIRC+bG5bl1daD57wk8K3O3kTRGyGkcr RdcuH4w23H330WPHPPV1ZQ8/qFypP0JH7qP46MyX75v+WndDER7LXWA1Z8g34T53EhXh5z4QIdKa x4cX8T8JzVe9bfUeqkrw+GTK47ODwbthOKjVV+0vJCFGIXWqkCrsKSJmj0OMok+K6LGih4oOFc0W sUWQ3+YcAn5TTxNPQybIij2BXNr6cTa6AM9Ant0uD1pb+kGliljF6XA58HoW3okJMQYrFyOH4DaT pwUL7gSPCHpiPYSrrSEJVOHcNi6mc9dbNz3aq9in7O749dffv2zqm1NrYr2LU/QD00e/vKjr+r6v 3EsHIVmk8PtGzIfAC4m66enFkKJXuIMStmaHOyhCeNUm4AN9YvY3R+FMWWeo8U8hsWxeG6qDA1x9 GBIh2kY+OMDVO6FjdY1tSIODS56P6sQaKYgWS2tQl7SJ2kT3CzeIw9QwbQiGuBNNUBP0pLBTnJD2 UHvoe5gv8PcKXxS/hfaLX5W+gx6RnkNP84elH6MXpXfQW9Lv0AfSBXROapCQTfIjn1SHaqR2qRdB ZmMLqb42WwgCRQmSrGpR8oqihBga8imywgd5GLhuslzH8ZLIIMrWJFNyhRAKhSBnp8UTVPGxEKQF tA2gkKjRIarC/pt/JNvmigLTA9MDRf6Pzw6Yj/OCueTLHbxs1xYkNjvmdliQTRbZ1TMPZDnfm4n+ 7dnqcn/9707OxNma6btHEhvG6Xtx9k7hH6SwPQ0SUenDIcXlpRaw8yX6GveN7vvdjBvrp1g+r00p KTWz29B3y6vaWE4WPVyxGFBtLGI5u2h3CqqCPIyXLxGK7aUQvFXzC4R6ZxtazHcIy5yrmC4uxHcL 6+wrXV3ua9QbXevV7fyQMKJOcrfwaeEk94zruPqv3AWxzu6uQ3WOWmedq1Zt8i5F7eqEcI+wn9kn P049QT9hf0w+ho5zzzh/BFnx2+KH7IeuX6vnuH8XS1SGLMnyNlGSBLssS4rbDfa17qgNqdqJ2bWh Ycnl1H7o5gWNd6tqvY2HVJl3SrJc7XB6HQ6n4Ha56iXBC83xOq0lRURTvMoKLrfsdEhuiWVUhyzj vcBYrKoL7zaSvOcVB7XVgRceGMcJ6vGQpPVKVEK6Q6KlE/TGkNjrphLuO9x4e8DGkF2xUVtJPsiA 4B8/Rp33nB8m00Kg+9zAgB/cPvzHCjDg/+w1Wksj3OT4n1ii5Z3KcvzBMP6sO1Ted8OUQ5M1+vuz ZxAFH+fs6SnU7NLUE7NnqKXWv/51h9r6ICUXZk8f5vF7MFAwr2/doVayziHMnjnMa2apam0axFt4 Th93aRi3cGL29BG+GWM8gpbSz5g95ZDn2hWSdu7ZM0cljdXwu6T92Vf7nLNvHleDqAE++IGBJ0ge F5AMmOwjxEpOdNxTSNaHmVqGWjfz7DNPdrKtT558cPEVx5+amXr2yfk/A6X/y7Pul+n49P5XXqOH L7xD7zr2H6/j38sAf/QvoP0KNfG0S6VcFQHysCF0PBDc7PoL9i+EA85vuE7ZTnGn+FdcoivkCxYx HrHAUaQspjrsd1L324Um9XNsP99vv8G5j9ov7bc/TZ+Qf2R/2fmq8g7zlviG4+fKLyVV5TiGF0SR 4jjRxjIwW7nA6Tool8uh2MFn0w47IysS56JdkvISekmklWokehESGdrxkoNyVMuMV5YZSYT0neYU B2ghknpVSl3ruF2ukFxhTrw9JIEjeTrEXcftJq+urAw5NeZ2uqIXBrrWvesF67Ve4lvAtSi/VM59 TLbJzqkYeRPdUqAB61XAoMu1RyCKYx7hhLUp95RnyukvDdrJFsfSoFxRGGTgg6+PzAsq5PF9QZCq mBcUQyXZLVxYihBx4Acy4J9aC7GnasfPY5haykXdPXPg/UcbSxqqj/5s5qvUl959p2PmI7qOmvm0 q/mq1gsz8vQ/UNf0zwxg7zVv5nrmn0F+RdSeo64SyoWpOFgSrPNucj0lMSFHCBiq1TW3KfjAy6Lq c/jVWnutXOtYIi9xLHYecNvr1DrPGl+/2u/pLzBUw2MUTHLjjkn3Ld5bCj7v+KL7PvU+zxe8+6Un 7N9XnnU/4/2N9GvvvzqmlU+9syVl4AJkBfwJeP6A1+OpViUvXLhkcBjVdslrt0seVZVlO8eUBFyo RCmhm0qeL6FLTtCdx1yekBrynqA3hOydakilb1afV2n1BHXVcRdVgVYXS/iW6tLsoZAmN8u9MnOd PCvTMtQ42uSCwdKdU8XaLnAeRQFlGr9UBFLF2339yrmzAfzi+sdFfuVjAiE/Dm6yIhbyn9thGe8h AgXP4ASL9INFPovk2Q+RffZDKs8evbO/ON4elCrag06YhI8VBN3Wrrx+/I48mCTI01NrLgu0k50b 1hSEX/yurLjDu6xh+ZpCd43NPhP7wbv1FeX1H0zNRFdUNe/a1DYz8qRSV1W83VXK1k0fyNy5a5ze fuFHT13V34flHGU+oq6w/RjZUTpU8xP+A54+zP+Qp38vUF8THhbolPBnAr1R0GGyhUzJziDh2zz+ MooyivkUHLUdLacQzSxH/FKhFjImvDVG/tZkdi+jgrNkiP6m87+GAkH4h5I74B+1gzz89vLmV1Ls +rvy+hsblixm2H9746/vWXb9/C7fzX3md1hfzfSQ333F/2as34DF1EvUlRZMI6ftFxbMoJtspyyY zatjQ37bP1swh5xcmQXz6AWuwYIFVMPvsmARfdFx0IIl9gekZwzb0aCz0YJlNOzca8EObor7xIKd aIvzfO6nye9wrbdgCF9c/2LBNOLVFRbMoCa1xYLZvDo2JKtrLZiD+mEL5tGgOmrBAvJ4FAsW0Wpf lQVLdNj1hgXb0SKfYcEyhMDfsGAHs1l92YKdqNGHv7eDYhmgTfZdILANYKXQTmAOlxcWE5gn5bUE FgjcTmDRkpEJmzIyYVNGJmzKyITZvDqmjEzYlJEJmzIyYVNGJmzKyIRNGZmwKSMTNmVkwqaMTNiU EYalvPHayVi6CCznlTvJ2D9HYAWPpXCEwB6A1cIMgb159QswHgv25ZUHSNs9BC4mfZk4S/PqlOfB VaT+1wm8gMCPEnghgQ9jWMijX8jrS84rl7Nj2YAm0RjS0TAKowicNfQkfDagUQJ3owSKwydt1dLQ SrhKAoyPYSg3SA0NSqLQvhGgVaQ8/D/E1JSjTEN9cCdKfk/ZrJOCsrVwNvtbhILw14wWWlALKV0B LaJwXg9tRoCGNGm1HvCl4JNE43AcIjTE4Z6OYjlKktCvBrXCVk9mfQM4pEEL3B5jjKMG0gu+EyY9 RSxcYSgxW8YIRjyCUaA+RjAacCdNao+SvjDX01YPKTLCCGmbJvfjBAs+Y5oShAbDGssYwY0pihCq UqQ3fAfXHyJnk/4M6U0jPeRTZRD8abgfJ9cTBPeo1btu1U0QXGbf2fIowZ22OBKBK5Mzl9ZLA06d cMWAs4k7YpVkCKexrOa0JEHkkiQcjZL2mFKsHTGrVbaHCGk/bvVqWCPF90xuznFhGGpibGbpHF8N i7sJayQGqZ8hV3NSTRGNjRLqPlsnspaTyo0F34sRfHM4ktDPdovasMX/CNFpzdL7LM+GSN8jpNRs PwF3DEuGuE4UZG/qSAKOI3Bv3OK2iWHOlsNEVqZ2aISHEWv8BpFalNQZI3ZmamOctDRHkq/dRk6z NLi/05JMjFCDddOUW8qy5GiOjhi5mtPe9CX+JnXJ+CJWH4MEQ4Zweugi3dTRDijPcjZDfkEoO8Jh otsa0YGdhLcpondpIo2RnNQx7aa9Y1tqyFlTytKyOX9k3o0RiYTRLaS9STXGGyF35zTN7H2IcGuM WMlkbhTZvnH7CXI/TDiRtPrANmRyMU3aZynOYh8jOhQjPjRLW+NlfrXjIqlhfzdC9B9LtwNtsvrL +lrsK5fCUUN1gAnLIEnswbSj+Xm4ukGv566+R/Q8adl9jGDfnpPxf9fnm3IZsTyhbvm3OT9lYt0I 84GGriPtNVRD+uuGYy/0PUw0N8sxrJspwu1RC1sj6oF6G2D2uBo+K2FEGO6FUtz+ajheS8pXQ0kf HLENdAEXV8NfNyndgBzkW3wkMkrDssNL59BsuUmxKbkxS7ZztnA5f8w5LwE8SBLtGCW1s+PJev6s Pg2Su5NQP5PrM5LzoSbvMqTtnO/TLevAHmrOX5t+wrB8c8ryHSMEi57zvZi3/VZv2IuMWz57MDfr mX2m/whnsro1kfOCumXZes52ksRPpS2/MWzp/WfxK2vtmGN6HpY5b3F5f0OWfmFdHiQe2KR60JJM 3ML8WRKqJaO6mFOm579cKy7vOetDsbcMk4gmDL1GLW6nLF/1h/puJLofz/Pnk5fJQreimXzLMWeJ MKFojHAWz1sGsbc/LXPN0sV4ng/N9outf4hw2sibrZJ5EVdDrnYyT2/nYoQ/zilMXYzgz+pV4iJ8 E0T+24k0871J1g/P1UxAXdPPZAjHMf7R3HhMuvK1O2Z5bpP/plWNWfox5+Ev1qE/NqI5/VhLxn65 5LIxHp7bdCsSNEdjxpURItX4JTJIXsLvOcx4fAni+YcsvzpOYrAJlB/F/WnpZ/GZNqlbscbFM3IW 3+VyNLk1FxlHCM7L7TgrsfAlvB7+L1E7x+XLe7g4rriYIt2KltMwQ2Yx4FlmBZQuRHhuXIraUDvM hxocF8HVQsg32uDTjHDOuRGts2o2k1/za4M/E25HrfDBrZagxZCb4A/GPkpikjHorwn+JshfI5nb L7b4CPF8f2iewNAqYp0TOb0wZ0HD8raYpvXEQ5tzaI8VZyWsCB7bpzmTJskdg0igD45z8wbWKpxZ 4Tjhv0Z3E6kfg76a4JgmHgLLqonMPTcTLTHjicZczf/dHiZIDGDW1f9Xesnea7pEH3O4N0yO6cPh iK49qW0Y1bXuRDyRhiJtZSI5lkiG00Yiro1FI43aqnA6/CcqNWFkWl8imsElKW1tHNotCgabF8Kh pVFbEY1q642R0XRKW6+n9OS4PrQyEU/rMYwkOamlwtAIyo1hbUhPGSPxBm1F0ghHtQjUChtwM5ZI 6tpoJhaOG6m0FhkNJ8ORNDRIpY1ISkuPhuMa3JvUEsOaAb2MJfUhPaKnUolkSgvHh7Qw4M9ERjXD QmXEtXQmrmsTRnoUmutQmhjCrTEcDUMf0D4MxGTL0hN6PG3oUDsCQCY52agRliTG9WQYhpdO6uF0 DG7hBpEMDDGFO0slhoFMQsJwJhoFkNAK3ccS0IkRH8qk0mSoqfRkVM/nBBZOCveiJ2NGnNRIJrYD 2jDQH8lAR3FC2ZARHkng+xOjBoxwVI+OAUcS2ogxrpMKRMphLQrs0GI68C5uRKB6eGxMBzbGIzp0 YrLbwMzS9J0wmJgendRgbCkQchTjiBlRwt60pTcpq78ItBjUtUxKHzK5qe/IYGIzEcx/bTgBQwaM MKh02oiP4KEndZB7OtWAxZQClhE9gstYeCR8ixEH1Ho60mAyDZoPGamxaHgSd4Fbx/WJ1Fh4DEiD KkNAYtpIYcS4+lgyEUsQbI1ZXe0wh7ZeH8lEw8mOTdAOa21L49IWra7biCQTWEbzSa3uDeT0hLYh CbKPhZPb8Yj/mObDWEZACXXQN6JTUHVjn3ZdOK3VaBu6td7h4UZCmB5N6ROjUK2xp3fD2qvXrlyx YW1vj9Z7tXbt2pWre/pWayu61q9e3b26Z4NDckgbRkEUWU5jsWDEMDgYdZpIIUcPWF5iJBkeG50k /WDlx3wanNQmExncMoI1FKjLxIeI9oFOgEIRvQadMECboXp4JKnrWHsbtX5oNhoG1UkMYtODlumL iMHcmsAqqIOwdSydpB5Jg24MA+/n6MJiT4zopApRi1w7ECdo/GAmDaiBzARYYd6AalNZokD5c6zI NcYaqo2Ho5nwIGhlOAVald+6UdsYJ3o+mR0FjMkSDphEWEuN6RFj2IhcPnINuBgnGorbhoeGDCxj 0JwkcVwNuDhJeEs8wiVERY2YgQcEnZB6E4nk9pSp2ESHSWFiAnQmMxg1UqO4H8BlsjsGyg30g6jG JjVT4S0OXdwR4cfa4bnBYY+3I6OnSDfgKyN6Mm6NIGnRTSqnRhOZ6BDo6rihT5gu7rLh43ogSR28 xtCcW8yNEcgizjiSnpMxHljYonr4s9ESknMNLF9hIYJ+wukOXGFj3wptoVa3tK19vta+aOnC5rbm ZlHcuA4KmxctamuDY3tru9a+ZHFwcdAhjabTYx1NTRMTE42xrOAjiVi+TejaqmR4AvMCTBCIAkzr E4NgoT3gsxLg4BuwkSaNiBHW+sLENlIwYy1t+QO4m0bTsWhTLB0Px/SmWOrmMPYTjbjwP9lgQo9C qf6nm+CrJouPpDYEQwmSBuMAJE4CXUgBKQdM5tvg+iMSCmTv95FgEYdEOGgZYr7BHGaeY56Hz0nm GeY7ebjCJDDIXr9PcOsX9aVfhI3gY8vYRew6tou9Ao5BqB0mKeKQFY6MUoeohxlEQjz8ECZJwjOM A6H/Dwr7yEwKZW5kc3RyZWFtCmVuZG9iagoyNiAwIG9iago8PC9GaWx0ZXIgL0ZsYXRlRGVjb2Rl Ci9MZW5ndGggMzM2Cj4+IHN0cmVhbQp4nF2STW6DMBCF95zCy3YRYRtIEwkhJaSRWPRHTXsAYg8p UjGWIQtuX+NHE6mWAH3jeTPPjOOyOlSmHVn87np1opE1rdGOhv7qFLEzXVoTCcl0q8aFwlt1tY1i Lz5Nw0hdZZo+ynPG4g+/O4xuYg873Z/pMYrfnCbXmgt7+CpPnk9Xa3+oIzMyHhUF09T4Si+1fa07 YnGQrSrt99txWnnNPeNzssRkYAE3qtc02FqRq82Fopz7VbD86FcRkdH/9gWH7Nyo79qF9MSnc77j RaBNIJmBjqAykODIPIDKQMkWhMwEmVKAngP5z0zZPlCKKhmq7NeeJBfbYHZx9fTn8X6mfRBx9JQb 9EQXsUMQzWQKQjAVCC66A4KwLBfLOH8K50mGIOSZhGXUzFBlLRavcDf/4/ku3Aaors752YULE4Y2 j6s1dLtTtrezan5+AUm3roYKZW5kc3RyZWFtCmVuZG9iagoyIDAgb2JqCjw8L1R5cGUgL1BhZ2UK L1BhcmVudCAxIDAgUgovUmVzb3VyY2VzIDw8L1Byb2NTZXRzIFsvUERGIC9UZXh0IC9JbWFnZUIg L0ltYWdlQyAvSW1hZ2VJXQovRXh0R1N0YXRlIDw8L0cwIDE2IDAgUgo+PgovRm9udCA8PC9GMCAx OSAwIFIKL0YxIDMgMCBSCi9GMiAxNyAwIFIKL0YzIDQgMCBSCj4+Cj4+Ci9NZWRpYUJveCBbMCAw IDU5NSA4NDFdCi9Db250ZW50cyA1IDAgUgo+PgplbmRvYmoKMSAwIG9iago8PC9UeXBlIC9QYWdl cwovQ291bnQgMgovS2lkcyBbMTUgMCBSIDIgMCBSXQo+PgplbmRvYmoKNSAwIG9iago8PC9GaWx0 ZXIgL0ZsYXRlRGVjb2RlCi9MZW5ndGggMTA1ODQKPj4gc3RyZWFtCnictV3rCmVLTv5/nqJfwG3d LyCClxl/KwM+gOiAoKC+P5gv61ZJVmV3wxwahp590klWVSqVe8Ufgf78VaT/GSX++Lf/+g3/v87C //d///23f/3x37/9z/Jj+Ize2vJfPr2MyFjuv/7VDUb44g/8+Zd/+nH85X///Ntf/1P48ef/I5wx pvKjE1r+C6H8DyaEX1Iq4/jln+nPnoH79zw/eYTyl2csXYzFFA7eYij94TYAxfEXQtHbjxTa+BFn +hEPoL//029//Uf65/XHn/7jt3itNyjEhB//67e/CaGmv/3xp/9c/nNOn1xSFjBRwdDHtFHaClOa hhmfqGGGgqntU1ObK0zICqYRrVkkP3+nYHo0eAytPj+jzSjwVAUzCsFIWgbPzB9a6OryPPsnd7nM RYKkUD89NvlZilSK5UM/yiXUeFL6lBDkp/9RwxCtnAU/5R80zPzQV0k8U8Fk+nSFp2o8JBpfaZVi aGkRSxXfNZLAo7Y9kWj0GsRWlKBhymfG4e0WCc4njCpYzn9QMJ0+vabpnZw0SApnFSxXTWvMz8y9 ehKW5vikPocnqTkQP71MTzRyjJ8Wu+SnaxgSjUFaxeEnp/KJSYJoNKQ0SpvJW+ac26flJvHozyLJ mH16ApYhGN1VGZnUSivyiBqOIRdjDE9OcxufnKI8o0rN0V5+hobRtEj1fKU1sqWlzkSetKG0hJ7a zXN+ooLR/BQSnkzS4a1hCf1T5nAFtZDw0L02PJ4LhGfk6PKTaJ1raN76lEzf/g1PJn6+4pmGH/Nd pdN1IhWC3vdS6ycomFP3/OFPm5uXRPJD17Mru3SKPrmF4h3s0vunh9Q8BVFGomuzD/c7SZ4kJcPN rHTZ+eqqkjTVotSV0sI1NqKk1JXiuJKk5CHVlaFFeqan6Z7sWuirulT5FmZ+SiyuFNRKq1zlDW3w NPquKW9ovYa1h09qLXpSWel6qQqPPkmVrpdZgis9ZCx8YhjFOyV1Ej9d3fR/r2EGXR3D3YsW2mc2 X34aXUF0dUhaTcMQLQ2jaSWiRSLvSXwjDTFbdTUxKcYPGbiuJm6kIYrCoy0hshHpLvuCpzTDj/n2 WiwtddpbS58RuqvRW8P6VFeeG91UOUqrNEalsaZUWCwlJHIndPH1WwzwVfKNXFvXYVyeRd4yYJyV uoJrsywm3HZdwmiHBp5XFiDWnyE0nVVP3i1fJHVQ4xR4vil8Yo0urb7+E+MqkOtCtqdkT3/BCHRv wLdbYIzrgrslTpcWGZ8ZPuuKR9vL4Ts/KX7nh2TM8GMM3URajyTC4zkl3HVRrGFWpyhlwDTBc9Iw 5I7WzO7fg0edolQtLX3vp4YbMbp7mvgOl7SM34Y7PMbiriHd4fq7rLOAO3wMlx/c4oevucUDh6Ie vuZWNjJu8ZrFtxsLHrf4bC4pXOJk7woYbTLjEh+h+TCkqFNyRSxjS1uNLp6GS7MXbwkzLvHD33rw aBOeLvGm8BgTni/x6YpPxiUelTbSvt2ki6NKbWTwTL5YPWkudIdHBaKNajrsaZbicVNwhR+u3YNH m5J8hcsFVHGKkgPdUNGV95KJVM3D29CCm3e26C1OqfHyk7Y3R8HNe/hJW71SsOkaj4YZgBnyljKW NsH0nF2eZ7/8ra3OqAE8V/dQVFhlfSRPMiq2VMNoa5N0c0jBvSsq+WS5peEdikrWVA/ykBp+aL+S grEW+yRPxD/IZNCT3i3DE+faE+m57vNDPn1VMNYaJ1qpNBcP6e+kYTQe8unJ03D3lBTPZ4YplYax tOunaBhttdK+9yLvN2P9pmRpaTx03JPGo3nO5VNH8Y5yK0QqNfdYNHLXw1QqQbNTA90VEo8Ww1bp 05u8Ag0tUglTnXbth5BG0GiSXsEBNDG9aJadLR4boNNti9dvhjPWtd52tmJgifI/MGrNlij/Hg/d weGIvD8w2jSlO/g0hx6Yb3Y/uxL9BtfJhceV6D+Nkl2JG9xxJR6YrSvRd0K0uBJ9J/eLK/HA/LQr 0XeyubgSD3t7V+KB2bsSe1qPK/Hg2bsSW34WV2LLz+JKbJd0cSW2PC+uxLPDe1eiq4P55ko8ePau xPNde1diz/PjSjzfvncl9mv4uBL7NXxciT0/jyux/a5MJkhXMMYuJxPkTG1tj1KO80ptPTDadse+ t1E8njP2PVcpY0qPZTJTkoIx9j2ZnpqWscthesbQXH4qApQjut9ViZ9SBR4dpMtkytTR3XORSSfM HNxzkTuCmF2eC+3WkU+i8ehLjdw+wpOGd3bgcMxUs8dPgWwoPPreKZCNXMUa6vurYN97zy4eBATj FOus769SEKTz9WEp8LWkPtQ6oUAnTLmE2gOCK5qLYNl4Ex0w093SQmo+h9Y80aCT/mllyOOlRKzQ lkYNo+PJAV5bKx6tGuC1yevLeAGRzLgQPc2CFEGVICaSTps+cnYvnYpN70ohGJ+ESEV5SL9ESw8L rd0Wmrbn1I2OiG6+I7FJKRI6bzC8VxDN4ixkA8HSyNv8RCRV3AYsjbyN0ZO2omu6CVJarUW+gqeg peWAjhFdVQgCOLTua3qh9UcNQ/woPMaCgroOPssFAS0kVBeWtRkJTaxh9GdBE0fcis5nVdQANbk8 2vIiA66nUb0djdDEPQz30wdpo4gEpsMPHe3K0bMHRquROAGDBOYihNpCCUiTCXaMoRMtKWt4JdRB ia/SpSWIDtFSeyuYsOm1CzzGziEL/ajTcNiBPk+heLvONh7frQvPSjmmet2J+91iG68n9wDCxit5 Slp6JzpoKRhNi+x2svOSuz6c/OuuxCfEFovaL13CM6+7db+nOSDW6ePJoRp+TElDTJaWtrtSPO/x /XflhPXp0VvDnPN5j+/3K8NHmFJhGnuyEK3pK9VckUScrjJEKcvssbtr2HDZF/ciQCnLURLj8AMZ G1LTmTUctM6cFHfWkHzDo3Rkr3lhK04FY0tQEKJtHsuFFBTZFlKcdQUK2RVHVch+eRCcPiozHHYQ nW5KbaiKtFKiwWN4LsRzrslbHpiKQcHYShFERFPzRKO08p0Wop1fYV54NvYkrXPvxRMN2JMpzu7t RQ3Ec3M/HebkUQayoNGBcJiTXV5eupaM7UkFY2glopWnq30qaYQwoivNKEtJyqDTaCAZU5kjL1Up M2f3VKAq5ajw2CsWMvg+jStF9tKDOPhRcbJX8rX3s+LEWWYyWb7SIunRtIxNDukZWSo6dQLpgJIC r+5WNIiP2lG1PI3unJh8e6SlQH6htEcMOyQ9IwZx5zxuRE7kFcCER0XGWbTNv6GoVf/Gpj5dLMdP FSW28ic4FIys3P8QPzEu+ZP8dy/Yj5/yfGXC/EZwmjHxE5MEMsuF/kn8uxfsx0+kzN+YML9B6SvG xE9MEsgsF/on8e9esPNPmYyUNyb0b4BTjMmf2DcEMsuF+kn+uxfsx08lvDJhfiM4zZj4iUkCmeVC /yT+3Qt2v72C1Bwd5Qqn+gM2yO7ok9QDOZBkB9df6LY4eys2YXV2pMieeY/HRDR3cJ7hgdGaKxby sQ/35oExaRLyaTUekxWoZ8PEA2OdUYTdU3T5aelM2yx4VGg+dqLV+R7e8zPIgWZv4gaxfma/wgsP Ke33IiqYY/eWJ4VwhRe2tMhhu8ILDx7tJcV4hQ62n5VIax+hg4dl7STBUQglejuBfoncY/N2IqHQ ReGxPRUkGd/wwKnVeExSoltaOlFQUYWLSJ3zXeRMpJjnyxLSheWfWfBJyrPdhxbSWtCY9Jc9tLkL ScmmxgYlEElKpfZRJkog5KHVhwRl8q1NuRQ6Nkx2QojylBijlyQucx5sL3KFRC6X2bwTUEjkyKqN 3mkrGc7OLJ7IFVJYR87WoVXgEBWhsEwgujZzak28v3Vz+k1cvFtatf2cyN3XxEApCnIY8qL4lX5B /6Jgc5rwnTacvigQ3asogl9gdEQS3xlYeT8wb9G9wmtxw7xF91qMgtZb7jWGJng28TRE9wrv3wOj 27AiYh3s2TwwRhXGz5TLY0Jl8J1DFJ/1s1v8aJV7j6Ve+Yvt8XFBP3tTf00Gcfv0iNzW7yWDcB9L mjv5Qp0Ff8MCo+Wr1dM4eGBsx+UkHZKiwGMMiEIGDfSwg6dP0o2SlqkNoT3NnHxYYHR35ySeWc84 tOY8b/4HxpwJ0tW54dwsMPpMkK4+rtEFRp8JtEryNbrA6DOBVkm+Rh8YcyhK/FSOdCx4fvVQPEL3 ex6KZXN+UTHDvqGL9Hc+E7SIG/l6zsQDo+XrORM3jHMmHjz7M7HH85yJB4/OzDxn4oHRRv5zJva0 njNxwzhn4oHZn4kHZn8mHpj9mbhhnDPx4PnlM3HJ3O96JJ696b94JBrqG8Lvaatgz+ed1dNZRpL3 w1Z5YN7kfSaW5RvGyGkfHzIjq4DRcjraaas4tCZ9I8fjHhhrz3C/cxEwppYM/c5NfLu1Z+Zhqywg xpxBu3MTn2XtGfQ7D/FZvy6mtxz8XnIaxZpqP4nE+PSTlv3T/kQS35h0B5jqF0MRLspFfu1g3L// +igN30+EW11Jcb37HcgHkqcqYExOjHRW5TqMBcY0rcdT7y8wOo9XroDLAmN6Vc6AywNiS8eugMsD o7ry4ludSR0XdFIHFPWgXPX6gOizN+8leEBMDUkiV1mh0YEgBGcyQuELjL6uyd0weHQMLIFWEl9l ij9yPMtnFjwvQ0zMp2ta5RaRsdsTVPxm/V2aVh0f8rS6uz6o8K1sye356fTtFTnI5duNCxk+U9GK /6hh6mcOpC6c7yK1HDU/L2r523fBxDDfpaNXCTxLSbV6uZrvMkHCjD1FScYDYypWoGVSEt+u474o /yhcHLPg0TzznkpatrQD3967++09etuZ+hWC3h8bVH6c2uWB0YHGeWmXLSkUbBzjb/akcrgKm/df xH2CnLfZr0xGGJaLlhd+jIKexxidvXBxTW5u7gGl1Tvt1/0BRU3uYSs7tHBfp+keUPQS0i1ZXH56 OOvZnSXs4yyUW2BMnQUpDK6d3ytm1Fkc8cA9DGpyg5QME1aMV25iLxklRYPmpcwiRCnvb2UWmpRp zMONy97YcoRNdPJKg+yPcGlXeeQCo/mByp3yUBieO0oW43BpjWYlTK/PjAaPSe6HKxmw39EarlLM BY8uAIjZSJhJyseXw66T8lyuKddHZ8FRcHtEnPdrWHEdq3U2hbu4aqvEYxogkUb7sl9oFMxqnU1Z cyuGlhmTgbEdUcqPKX0edk/fxnZozaIr8FH8oPGYtrJgtY8+F+QhneW+e34aH2WJR1fOt2RlTHt/ jbtppoumtLMEd4HRHXUVPeXZVfJo3qtNnAp98TeuwJVo9MXfcJK5ktecZNfAbmG3/6Oc1/cDoqvs 56WpFhDF+yRVzxf8nlC81PiCRZuhtxpfYLRXjxJtPqsLKe3Vp37qxAWPmSN4yZnDDzafz88DE3Rm peI+EF9uy6/LmWBzPguqni9Lh2VuoMNl6dDqlyp7YPQRQ9BD49H1/RgR2NgI2POcsKOsovf8oIHu aCJz8KBGm+2xZUt1RCNdjW/79eFcNTejLTDaXC1Xun+hpa3reqX7FxjTQHepaOfb0QDFanPBo01j vr7lOtvC6fh9nUe162ya41CioI6FsZ/tflk73O6XMeyi3S9bFN3Ohj6HH/KUD4Xn8IP6A25d2O8X hnHkGaO3hhzg4Ka/vaLL0OM8Y2QvhxmKnBsMHVo4yyOLb7cDO667Z6+iMvY9ZvecZrhW1V9DFDOP OYq3F5i5dzQq7tcHBQc9u8tccMMrUsYaRb9FyOLTjQWdLTsmd18srbdReakEV4WXOs9xn/vtKjju vXZvu2CtH7NlnCVEvyyPKN2LGFvrs7kso1225eqyjHZZuVumpw2Dd3pOLkyMZ3fMXvHWdHWV7oWQ lOXZ+bI/yBUe9XDPVoVDzXNXFzQv8zqOJk6HnXo1ce7PRL0baPYbekzYU2aYqWUuhpatZQY/wRVC zPSo3CzrfPuMZ7POXjc33ANDmWvaYL2bY/Zr2MiNa3G6Jh3M+dnkHWhNfkwCkjaLnZ6HaX7FtREa 7gpusnFooQGrKjNURRbb1SzrLOHdLLvfrta58GR4OqNh21vxP31c85YcfiYG9UX3ymnoe2nzzUr3 /Yu044yjvSzXN4i27TiQyyKbdmKEZsD1v9sm0SvA/8Ak7YAg0Nsxd+SByboQFsF7Ho/h0EJEoRTJ r/ZAEODnurtlZd4C/Fzjt+AxAX4E73txadUrAbLAGPfiygEtMKb+C57MrN5ucmHu4aHt+elXEfCC x8z5oA2NEo9ZH3YqJc+qxRnF/lYWW9hYA0T0CGw+IJr5iXHArGJvEFOczHlcPkcPGi1r5KWS9VsE HuOBkjmeWV09MBpPqXRmh/gqW3RdoGcEP1XGBF6buztdtJt1urJKD4g5s5fMLSDG4b9k7oF5a+4+ 6k0WPNrDDvNsJF9gtMzx2UYA4oGxkYNwZiEWGJO8K4aWPf+X7C54ttGFhWdTdH9FsRxa5Zots9Ay dXVXpHSBMXV1ETnpKvh5Of9HJ7mzF/3qWnf2gmNUebjfPq7O9oVnU5sxvtOa0dAyNRUwZVKLAo8e 1R+u2Sn7vUjs2lR3fRJSSwqPrVdCh3xoLj8ozec+8b08P73kDs93L/mCR9OC/6PwmBL/enXjO9/e 4vGUgQcCUqG6LLezqX9BY4ImmJoZpGSYoAlXM/ukuNtcrI2BQC1zcillzIypSh/oMEa85mru1xhv HRwm9152ME+osYm74DGPHcCcbsOlhVkFc8rv0mEDuFEaxvSIk8ldoqu/M4ZI9xJ9mE73XGuePsgk PFnBmLAKhEfRMnsBV4ttXGdP0aPBoz73OoxnDvXpkoKnpT/dRF6u+TT7o47Iy1Aw+kZGWCXyDBuH 1jWgZi89hTTPKDl7q4zIS4ihu3jo5spVKnjNDQYMTAWjY06keNqUCswGXtAwopSlCbygO77KTdfd 8X18Or8m4Hw6BEOC2KcN0Gge/E3nRvNUPHa40byW7i1hpTtpKLViEqlEipvR98f4aTTffxaCM8eU z/3q1JzpipQmjQ7b8eQihcckLus1wdPhB53moUjp0QlZdJoXpVb02w/9mii63y50fwffOuBBqTW6 ksEN4oodOygVQ0fH9LaUh6mmWFw82PaWu7ftdJN8mjRETGyG1IG2VTQlskNKGclFU9A+L2GimW9K pLg2eL/KrV4t9ouA6RhGI36q0k46rdvK+YCEQ6uRYIwql0fHXTCCoOboCXMjW5fO39tu+f5Z2ik8 ONhcGPuAaH2H2huOLSwgak9mPcMPC4hO6161XQsv2msI/cwOLzDaa8DEPK6r8WDK2WG4wBiv+kqW LTDag8tXsuyBMV5VvpJly6cb7yydtSUOPwgicyJswWM6PJBwnNHbiYjMgYKxbdNXI+6CxySIr2TQ XjC4bZqTQc76jKsSwaGFvml+JG3h+aVv+niQbU8LfdPHFM0Hxsz5gmWs8NgE8ZV92e9FgufO88v2 34Uk8uS2+wVGl5WWKxu0lw2esHq4Ovtvvz2m/Wdx7iC4RzDRDdaC0gd6CR93aM/O5Q5thWdxh7YL uLhDW72S+d2dFD1uDndIKQSTQcaIKrmCJhOdbxt8D1NuG3yroDLe1OFZk/tDyuNVRyyeYGB0KvEt FYsp00Rrd3OXp12DJPebjsffsoKxng4G+1cphCaBHM+BlAst07E+z4GU+/NXYNvEnLwlZFenqHP8 kmQOCo/2FjGBVdOyHev07SN077vgD53OxVZ8Srmdi+2WYgLr6VxsxZnHavFTZc63Y6xW7NnbUzzS Vqs8OnZkFtFSMNbZwfB/dW/rbv1BMjZL9VQCHo/ouQ1XNibmWMm73c7Vgrczi7eGyEUfg/0dPPdD A/v1qfcjAntZrfcjAguMqS09HxHYa9V6PyLgkCLNkuoY3lbU+xEBBw/53F3j0Z8OEdMwZoYX5nPF 6H5Xh9Evr22TGx8w+uWV/FZ+SnecewfWiblaQYq8ztmSajkdjK2o8hsUvqZr6EsL8ko2OVu4TSW5 lyAee8s8e2v/6exb9e6eLrqUPiNOVzTgW80htYb1rWh5qu8QNBKNnJIrYuxbaTx6KzCWrUx5mep1 Js1SZnI1eBskhnW6t0Uj7TO0FlNmVifNEtt0L+4eA90o8c1A8v24srNrUcRz+HE3iE7FzXqmzx8Q m0MLV7qu7I40e2kaRq1BjNdM5wXGeGB3fmxPK995vwdGv2aRp8XzOriK97bszhl7YEmi0e3zXKnJ caL9ErIDFiUp84h3MXhs6utqeVlgtKM7rjYdD6ac1aUOz0iPaTza+Zy307jdUrz0fTqNW1oYxZJH lLTMpOXbadyuD0axhMP5fNbZ9NqNy0F98GiPJ19lfftvT+Uq69uvM49R5uI2Z33qNfrZ+fZ2jX52 1hCpCX5awPkuTmxJpWF8MPbk5nT54efXkqs2Dl9uSlraD8FTGVwttVcbhy83i7eG/FRGl+fLdtxd 44b3qgW+XNQw2k/LxdCy6S+km4q77/DlIo8k3u8Fp7Z4JLGzhshg8Ehi59vxktvhE271Dz/fp/C8 VQxPxY9ZH7y9kKKrf9gp5FfsHJ6R5tB4jONYLS2T/7peqNufC3b4Qp2e3mCHT8HY/Becy+GeC3b4 YnXPBT/Lwa90LzCmCbCcr3Q7tPAsB89jdr6rXrOf92fwmaPs8NPTOf94L2N4CbD7q3NPUV7MGpPc IpiRxK7rQrsKN39IA8C6aXjnrrgnGa5cVnhsC2A+xzHvNSZe7j7GMTu0MtzG4ko8+3IaRvsqeCvw SANtJQxtgscL4A4/eBBO4zEZMGSuxnTXpxMtfu1tL4X1fhHugfn2ohnfY+OWEiVr4xql8IBo5hFi DuzYbEEixm4eN90NYyzAeLXILjAm/XD1TS0wb8Yv9xc9MK/FYdzwvfCs+cnT4Hkzfs/0w57ncvVf eTBXG6TD81NA9uDRBnuLlpYpMkM/fKsuDD8GNuSeGssWqQV/mefV8rOQMi1sd7R/7EQfLWxntH9L C3N7jrd+97Qwt+d463ehZSa7Xm/9LjBm+ANK85OkZWZQXW/97o8FDNvGb/QuMNpARvnFEczfiiEb v/xGhsNzw9sWCo9eHxi/R1JgjwcGTkruseB3RjQenXUaxdCyb8ml840MZ9+5Fp6LGbbHi9vlFB77 hsj1ZsfCsxlJcRvR2/XhhMgXntnQVjzbGrK71urh2bw3dydN9rRgBB21Xw8t894cDOTsngtS32RI tuTJD2ZbxKbOu96LdhU37bfiSZrsPx3vTUg0phINz018ocRDfiUl4z08aZXt3bWkVbYbwRb0qO7i IK0SFJ63KRrHCyJ7fpAy6UEqKGOx5uvlD4dnvLvc1Rqal0hgjabirSHGaJw24oPHpEzI45nuFcgG dCtyu14mbcwgr1Lbl3e+ouGszoDVNr2TXkg7zSgv0rfHto+SpOe7TevelXrY3iUwsc/Uw3Yb0LmX +MHg/TagOKzF4IoyXiE5a2W2epnTHEetzHYBOYWhYOwEDaLVkrvKlZzumIOrK9G6R/vuyg5a91oJ 7r2OIrMRunuvo8jsjInv92LeMfE9rXnHxLc8t3DHxLcqg9MlCo99jjtYfsxEj47BWC7PeLJb03pr AcyKZ5MLyQUz0V2V0UithBh9WqWjV8Tnmdy4XKQ+MLVfdWKCjyfyKDMLOWaXHVI9ZM5K1WNSIeFT 5Y1tMlekesbI8rTrYSakV1KqzZOMTlZPrcO9ADskbCqr+Se6ksa2cPTOliwg6ngg3M3dcg+InhiJ rqQjy7GgMWP+4ul4jm11IM8q4e60BY/pJkSHl8RjO4UwXQVW79jWjcZ8dcItMKZT7JpVMralrhjz d3QuOd/VXvh5fZ5D8mO8r3HNHlpgXqavHnOyxrbWlcf8Dcmz7QLK58sDC8/G07uGpyx4dCfMPaxk vz4pXkGAPc/pnku155lTIexQj23VLKdCNIzxGJOhZccOXoNR9vvF6RIeeOesIQ/IyPK7XrxBrtpy 2MEQOp5MsD8WCU0aoQ6XnXG+2+mQGlfyZuFYrzKSJRpGJzmQCOEEz/6U8uhB7qPafxaPHpw1eacr Y9cnzyR3+nfIP0uK1ttYFI43OLTIfD46qRaNaZIceBO7d/e7eAyCuzrdcmOcHS5kVPpbBxmHvjIS Hlg8geWsWTyXIKAHd/qNjbDgGTj09S4gJh2f6ADQhy4gpjN2fvpQIFpfoVsdg8cWGFMTHCbpWAlj 76BkaWk8caKrTMJoXU2WFXkCAsZk2tHaUSSMravux6Arjx+yvoaGeQlsalq29jp/Zv/yXdcTlOt3 6buVJJdT/x4/ZKKVOOV+mdR/IU0z/f3iqZmSlu2Mr3Qio78X8A/nF57JUxjd55nWhpxwn2eUBxha JvqZyWZUPGs8eI2wfoNBL0Fs3ndhhG5tc7jfhf40BWM7Y4OlZR62yoaWqXGHp6DwGFo14EHH6q4h 2WYh5SK+6+VubWiq82hBE5ce3TUkeY4Kj53rW4+aVo9nuoDrlDC28HweN573XYjGBle1IBibkTdY lfMfNMzEg9fdI4VgbC1JbIXJtCMoovGYICpPcpbiYy5yUpld0rJVD6QyR5FbYRp6cTEpmJeKhkr+ kLcVCMYGDWPmpPXvtEicDS1jNGCIlYQx1QGtfFL+wg8itqUkdw17JNXSoifObFqM5rKMoePyINvn peeHrv/hrg4Jc/mCBonNr2iG5sZWTnCFirflKJxoxVVO6Bvm2iXnoCPqW4aCMSPb5jGz3fnwgucK 5pQs66/C8wlJwtjI8DiK1x0lV0hKZ1E8Gxg8MVHdS5KjxwrGho+zoWUK3Enppt6m++2kdGtowxNT dCBzMb3HD7k9uQx/fUiWk8JjC/fbpzQJY9uU81Hz6IhhjZioKWF+xrCf6l0u17CPWy/wNuwfEPPO BG1O4veqtp42Ro2QdesRQnS28Lu1W8+NjnVWWKzpX75SimEYUiaPHusRNlphtLnJbQ4KxgzOQbvb F5hcDR47FGscgfsVRpvjCGMlBWPcA6hGuVnWPWjXA2T7NazkqlW1F7qdlE423UH+GpJrW6eEsaZ/ 4WddV5ZNxIyusSxBXp7eml9AEM1QIKbil8xIRKUd2cFAnDEVjKn4JfMPYyCc78ZAHJKx5n04Wjdz hZ3k4ElnMt6RQTzgVRSMffO2GVomrgSzf0gYEyqk22VEBWPmCCNXKtfH7AXdLoet6Xw7kpNF0jKv fXR+vEx8u2mjpZujhSj2wrw+MoOhZW3xgkaR7J1jvNVx2LX7b8cc4cPW3Iszih6ihjFdoHjOt8gz qmlhekUvrg5DQUNQMLYqmGQ1FPescxeoXGa9FYipaTQ6mQHzePYaXZZh+ioYax7XTxjN1RqZdE/V MJofZI+ihLElDfyE83T54fzk6N7xgmk7xnCPTokkhlHC2E5RuCHBFWc8DMJTDpzvKtw5nlxxRknD QDPKikd/F89zC+7VDuNW47FvG3fa9xw9GSuNX2TI3nEveBNS82wKFmh9FIw1OBH9KtGTH1Q1RF+D owlUKfC3HtBUqyuFeF+kjDq83cJYnB6/wODBu6JgTOHwWcTj4SHDh5MZHh6SjEZes/vtZSK2416m lTQLdwx669Py0Yvs8dNxMXX35KDygXhyjVC8L8KvJ64wei4Ot7SM4q7hJMWbhys+qHwY2ceDqgae 0OesD11KnzRH9jQLVzXE4J4KDDau6nCZwgdSCPRdgmVdRJDxCGp2Raxlut+mhLEzi8NRpOqxXAvS klLx6qIPTggl9wiiCTTWNFxamJPP0YlFQemCjt6PwZWOomtkFSeNR8OgkTJXaUMpfnrgcUhS/fzR dzz5MKaw2blBRlleAUyFO+2IwKAvDEh0Ye82bWfNQqK7hDHTbPCaUv+CJwXMmpV4tHvG4squzg3z VgKPAreV1Mt45KbQmBGhGNIj0dh8E92ULQzBsZmgnI4KLmebUCTPRY0rjJmy2o7KbI9Wg/HM99ee Zz4YTUiFmWHUYTy35EkOckktShj71CJZJEXhMf4ijOfm7ygOT5XLbMor8ofD83uOUV1RortZKK4I aQ6PGRRXNA6w7jcUI1a579XZ0MSTzSSM8YLRqUEuiAtD1n5tEsb2kKJkUeHRK8jP90mYN0+w5Zy9 s5VIq9b0hRZd3L1+oUUCRrdOdr+dBIxuHQljHn/EU82puHsxUWooVaVxURBnVDA2u8M3QfLWJyMW +Y0WGYealvEEMQZiSJi37E6ZJbo8w4AMrjjjFckjBO2wQ/ZjbdXVl3gEJ/YudaGZxJqOuV7eEpKR MKv6LJ38wivemNTn4Wmkw3os7vL0dEz8876LPFwMrnfuUX4n5xs7mA+v2DHLg1dVOPPgwVzZAIdl kviq8Bink+yRPhQt4wSno+zPhYHboGBenr4sfboaAU9fhhndE4gMTw9ZiobpjIVrIWGsEwzXQlkR ZjYsXIviHgs83MPlnh4tlDziYXbnCGKk0igKRmeK+HEfxY+ZMTsRxxwuLRSCTwVjemwx2FvCvI5U qlnw8xNZF7TDncCyXvc965LbZlmfrMsNsi2nekC25VQLyLac6oHZl1PtGX7KqRZapk+0WlqvORUF Y3pAodamu4BHTkXiMfwgp6Lw2F7SeOWBHn5MaXBC5jG7eOo56mvFYx6jwHmTeF5LjDF81Vsf7sL6 wg+CV4of+2BB/76nI5g9tdNWyllG5+w73Q1HGd0CY0q3xlnatueH8zNZyY8p3UIJj88zGlcNLW2d xXGW0S0wpnG1nWV0Dq1E+jEq2TDWNMbbsXu0XUM8WJC6gjEvmwfo/S8w3eCxlvI5OMlbH7Km81Qw er9Q2jrCcNeQ5PDMle3XcMQrV7bnmeQwKDymJA2t9enLfmFcdf6yhrMf07yd78pko5x5uQePyQWR /cHlbwuM7rokvdoVzJvFfZTIObRQT3Xk97bfnsmOMTybXFC/cok3jG4lyXjApTdXj6FWSuMx/CDm pvC8NcDmoGjp9Wk8e0DcBW/mdCQjxDuDaG/NXcFo8x4N+EoMNcskPiV3jxu8OskvgDoSj+7WKdGY 0iNEFrLLDBJBrblqtyR0NdXkw+RPKUoENcMohFIw1pTOhpYx3zCk6Eihbo8E55OihHlrkT3To3s8 9U6PbkUZBUyzJffYoICpKBjz7SReQdGyr9GT6ilViLLJbyFocARDtgZmDdXQenu9Un+77oGo/DK1 q1FrRHWLPDW6yghDRUuYrvbGUNEzDrSnhXZb9enmXQOMjlRbYZJFqPacakv1p8PZTwpGJ2fQSnvE S/a0MB1kKBj9VgWc/R78b4ezr/GY1zRpLxQe812YMhKCa81WjJeMyT2C/PB9kTD6KLcQr8jC9gZE YqopGPuoA+1FiO5+cSttjtn7LmSdesnJW8OWBmZrSzym3bZeKeY9P2i3ndH1CBoaPo6owZ6fggyX oqWzPBi2/40Wqr4ULbNfDVmw5KpM2qtPahJGj79oJIfcHu2cHYw57Sn5ezEQ7A+u5YPnPWeergXV eVTolDLWNQwsXgnzU1kwus3eT/6VBbsBTKQAJ4gjBQ8OHQYox3iuFURXVqJCTABonzLgcUe0u+zp oPX3aPVZYMxDoqhSkDA2UZY+x2Ww/WruuppBfpN2TVF6KdHYXFq6KhQfbrR3T2cwzpZdPKi8HOzB PXheniNtCs/bNKl8pBEfPHonEAH4xg8asxQ/r41Zh/e6h0EyrcllfqvOnBqP3tGRLi94LxkDLzRL GJtMy5cX/KzP25OFXcLYKk50fCgY83AGOj6+4Em3J/jwYxqRb09wD5OLwWObjOPlDW1PDhqRT0/w gTFjqdLlUd4wPxPZbHejaPcVGotv+9oo+oBktYOsP9uurh5DCFglbklwDXiRNExMM6JwTcG86Kra JYwpGU71Uq4PjNaL0DJBwrzGK4+67D0tpOM1jBllQFqmSBj7rM7V/rnAmFhkvzTIQ8tomXBpkAdG VyLAGviKpxl+zLf3bGmZIvBwlSLsvwvToaPiR68hYpGHltnLzxyXJtruKccij3KFLR6ORSoYk5Hn OZ0cv9ieipTSVdKwlWeOMxYJY1tE06WtHhgzNmFeMaD9t6MOvCtaJrOPohnFs/52ksOsYF5jkbP4 60wy1jSMGaIXDK1HM/4z/fl/MLIGxgplbmRzdHJlYW0KZW5kb2JqCjMgMCBvYmoKPDwvVHlwZSAv Rm9udAovU3VidHlwZSAvVHlwZTAKL0Jhc2VGb250IC9BcmlhbC1Cb2xkTVQKL0VuY29kaW5nIC9J ZGVudGl0eS1ICi9EZXNjZW5kYW50Rm9udHMgWzYgMCBSXQovVG9Vbmljb2RlIDcgMCBSCj4+CmVu ZG9iago0IDAgb2JqCjw8L1R5cGUgL0ZvbnQKL1N1YnR5cGUgL1R5cGUwCi9CYXNlRm9udCAvQXJp YWxNVAovRW5jb2RpbmcgL0lkZW50aXR5LUgKL0Rlc2NlbmRhbnRGb250cyBbOCAwIFJdCi9Ub1Vu aWNvZGUgOSAwIFIKPj4KZW5kb2JqCjYgMCBvYmoKPDwvVHlwZSAvRm9udAovRm9udERlc2NyaXB0 b3IgMTAgMCBSCi9CYXNlRm9udCAvQXJpYWwtQm9sZE1UCi9TdWJ0eXBlIC9DSURGb250VHlwZTIK L0NJRFRvR0lETWFwIC9JZGVudGl0eQovQ0lEU3lzdGVtSW5mbyA8PC9SZWdpc3RyeSAoQWRvYmUp Ci9PcmRlcmluZyAoSWRlbnRpdHkpCi9TdXBwbGVtZW50IDAKPj4KL1cgWzAgWzc1MF0gMSAyMCAy NzcuODMyIDIxIDI4IDU1Ni4xNTIzIDI5IFszMzMuMDA3OF0gMzYgMzggNzIyLjE2OCA0MCBbNjY2 Ljk5MjIgNjEwLjgzOTggMCAwIDI3Ny44MzIgMCAwIDYxMC44Mzk4IDAgMCA3NzcuODMyIDY2Ni45 OTIyIDAgNzIyLjE2OCA2NjYuOTkyMiA2MTAuODM5OCAwIDY2Ni45OTIyXSA2OCBbNTU2LjE1MjMg NjEwLjgzOTggNTU2LjE1MjMgNjEwLjgzOTggNTU2LjE1MjMgMzMzLjAwNzggNjEwLjgzOTggNjEw LjgzOTggMjc3LjgzMiAwIDAgMjc3LjgzMiA4ODkuMTYwMl0gODEgODQgNjEwLjgzOTggODUgWzM4 OS4xNjAyIDU1Ni4xNTIzIDMzMy4wMDc4IDYxMC44Mzk4IDU1Ni4xNTIzIDAgNTU2LjE1MjNdXQo+ PgplbmRvYmoKMTAgMCBvYmoKPDwvVHlwZSAvRm9udERlc2NyaXB0b3IKL0ZvbnRGaWxlMiAxMSAw IFIKL0ZvbnROYW1lIC9BcmlhbC1Cb2xkTVQKL0ZsYWdzIDYKL0FzY2VudCA5MDUuMjczNAovRGVz Y2VudCAtMjExLjkxNDEKL1N0ZW1WIDEzNy4yMDcKL0NhcEhlaWdodCA3MTUuODIwMwovSXRhbGlj QW5nbGUgMAovRm9udEJCb3ggWy02MjcuOTI5NyAtMzc2LjQ2NDggMjAzMy42OTE0IDEwNDcuODUx Nl0KPj4KZW5kb2JqCjExIDAgb2JqCjw8L0xlbmd0aDEgNDE3MjgKL0ZpbHRlciAvRmxhdGVEZWNv ZGUKL0xlbmd0aCAyMDkyNgo+PiBzdHJlYW0KeJzsvXl8VEXWN36qbt17e9/S6S1Ld6fTnQ1ISAIh EMkNhIhGIKwmaCSsAi4E2dQZISqyq6CyqChxA8SFJgFMWDTu+4ALDgpqVBxFZWRmEFGS7vfU7Q4C o/M8z+/5vf+8HxK+99R2ajl16tSput0BCADooQEEyKu/YXL9Y47bEgF6hAEs114//rrJb0+LHAa4 A+Mpw64bf2O9QW89AUBcyOW7dsbE8fDeroMAFaMA7I9PvW72jdc1XP4XzO+D8capUyePt71sfQPL Ig+kY3TSW3fre2N4D6L31dfeNGX06bnvAIw9BZC9c0r91dc9KvzdDpA1FUC8eOLc2b6/H7wP80uT AeQ+E68bX3/19iF3AyRimwl3Ae87fe+HO/XkznHmkp80bg3wn0e/KknhdMdFTft+/bWj0zJIMwHL ahFELYBPuX9kKAy0wK+/RoZbBsXTz/yImTwFn/+EEpgIIlCwQC6UAUhDLNeirKgUZ6HFcWyBFuFt qGezwIaokFOgRnwdxpJv4ErMuwYxUEiBZPY0jMbyczA+C+m9tDjaieXHIB5FFCCGIEKIKxCXxzES UYY8byK2YB3jeD0q/Qqmy+/CRdgWINYgxiPuE8fAasxbKxXDBJ6Oba3AOgIYvh/TH5K2wCoMr8P8 Gl5WpZx/DFyK+d0wfK84JhqV7wQZ0wDDnZjuwPbv4X1GGsL2Z7FZ0WMYzsa6L8H8xUhHIx0V769L DX/FedSx8jEu5WGUz3xMX4UYgViOuALlw/nzkM+L8TsxrMd+aZEaECYGkIZlSuhFEEbaHdsfGB83 qOPGcZwZE/Zf7dPvg8u07Gxgn/i4jiLeRew/q2/n485zMAvKhQJ1/viYjYh+9F0YgHKJ8HGJX0d/ 5kDNPIjj2o0Q2SToqYHoFuxnqbgd1mE8H1GiYhYQth5mCCdwDrbDzdIaeATTgfZEnIQg/QE8UhCK UH7VWP/liMlY58uqPkzifYj+gNTLvgYP1lWHmI5tv9klJy4bjA/Gea3Gsh18xaBcFyKmoQzWIW7g /cP2c7nMcd5/JmMiT2LZdmynkgPb9KrAscfmFeYg/0ysi6jtxOYhRhGYPx1l+iziBcSLvA9dUPUs DrWuLSDQLdF/IU1AeBDvIlZxfUPUIRp5GWxfh+V1qr6iznDd5PrBdUN8XdXVkbzvsTGoa2F5fM1c h/xXINyITOlpuDKOTCzL5TOB6yxfL111c93iet1FVZ2+hus9+Y6Pk+vUWfQ+sQ2G8z6o7aJudVG+ 7rDemzgVEtU+PSAcgJVcZ7m+dVEuF65rfD3yNRGnVWeNtVt8jXRD/lRV11EXu2iXLM7QffAA1jlG WoV6+j0MZZ/AUOEdGCrehPQeHF8rpuF42AG0YTkwTNMGWTiXw5D3/vPoOg75AJmObd3NnkJZHICH VLkeoGnsABHFp6JHRSBvik/R+Wr43+j5IG2xPE45zs77n6b/fwH9SHwKpmD4O/FANIrjuYevCfl7 kofwdVFMb0I0ILI1OWSd5hrSIo8Gi4R7G2IGU6CvqEARa4NSlggKyimI6aOli1W7uxLrf518D3fi fC2SEyEgHEXbiG3Rj3B/QPD6kQ45S4/O0bnzdamLdunr+ZTrDLe7SEWkblx3uxC7EZ/E8QXiS9TH 69X1i3sDt8/q/oA2GnFnTF+jx87o55uwHuldXfp5np5mn6ef8vl6eT7lewu37+regusU+3Fn1/i5 feQ2jttIbuf43tdV/nx6Fv9qtB1/Ve3wuzA2vq6zEHmIXKxjT9yO7BZaoidwjX4rfRDdLZdGdwtv RXdL90c3ytdE35C2R9fjuLPO7KltMVvG11PXXsrlxPfFrn1UDMGUuD17QC2L7av76BjVDoB0E66/ 6TAB632H76t8HQrrcd2hPLG+29hmuJZ9CSux72ZhayydjYSh3CayuRjGdLTpPF8vrFTzR7B/wVyW heHNSB8EqyTDXOklzhN9V037KpbH08SxsBb1LpcthcfFbVDN54qPg/aKvsXnHte8R9MAD8mAOvwl PMB+xTG34RhfV+mDqj5x3ubor3x8cj9wigKOj5dBcB7xIfDF5bFGlUWbKqPVqg6jLHid0oeqvwHi QSy/AW7R6OABTQbap5/AI6MtUdvaBpdrFFXuTN2v/4Hr43vUsdGwRLRHf1H1/+loVPgV19D3uL44 COYlglv8Hh7EtbRElU+MLufrR/geErmO4PhGqf7E96jjT8AN0lOwQmpDvTuAe8EBnLfvcSzXQB8M r2JPRU9j2UFYB/C2MX246p/wfUqJ7ufrRW4Dl6xg+1iG90H1/7Bd4Wvs772wBG1JmeZ7eEzycb+G ENS9VETPGNT4AsR8xIoY1DRLjBI/1nGLmj4Z3qBbBIr6zfPfZE/i2nsQyoRNoGNT0H/4Dm6jubBY GIp6dwz3DAH5MM66QaZwDCqFU+r+s1jUQZFazoH7+LdQxWqQvw0msSaYJEQx7EKsRn1EPrEFxooT 0c+6CuuJg/ZGHi1UScsxnBt9mpdT2zgVdXCwmyBf5TsLal+7wPv86Fl9Xo2yvRX1gfcXw2f3l/f1 TD/jffy9/qnj5PUin1rmEPfUo3huiQZjNDKc3glPIRrpJ+iHt8F8sgadlfVQQb5GrI/jGRis0m2I 4VDB5pMliCoEY/PhYaTdkX6HOIBYj9iD+DvrBXdg3S8ibebnAg76PNoupJj/BGIv4rOuvLPB2/q9 9LPB/gbnxMV8WMBBu6FP2A3+vfzDUMhuRDuch/JECHOhikMywQxZAzPol5jObdJ5cTzvrGUzIPW/ 6s9/BbIP8lQZxqCcPcau+UDq+G/g8FnUxymur+58f/7f9vF/CpzfBYirVfk3Qg9Vh75F+cugJXvg KtKO+rceLuOIx+tUeT6M6z4+T5i+RE0/b/5QV3oLI0A5Px3Dt3F0xc+f1/8qjvVuPRtdetAFOR99 EQT7DMsjzo/jfrCIQ+I61k2N38LRFT/T7h9hFBSinCqQgqpj58UlC8zhoPUYXwdcz6/jOBMfhX7V qJh+cqBsp3GgDIED067mQNkBB5ZdyHGWXKu5XLFNzgtd89Ol5+fPD+8XewXLHUGfeRR4zqdn9Dtu L87R+eExfT8T57bk6/PK/LYmflsbuFb+qM7/l4Br5y3E64jX/m+3xa0MtxEWbic+QH8jjL7qY3jG fBvuBOhcAnD6RYCOcWiH8FTd8QymjcZwCOk/EC5Mm4YUd6PTqGUdqI2RDxHvIhpZEtwY9yvdGB8U 4+3cGK8vGOPnfL+it3O6d4z/9GLEgxj+CwK17PTLSO9D+hOWDyNfDdL5mHYb0kKMVyEqMP4exvsj KIb7Io4isJ8d6MZ05CL/w4i53B/5nXPo/7/0D84f/10auwOAWtXnxP6ef4b4b9Ou+fwv6Plnja75 /69o11ni32hcDujzvcVx1tnnP55xuijO5y9xnED8yJZGO9GnlFU/Gn1Z1efm/mOcqv72AdWfJPE7 RZVy35n7r9x35v4r0vVI7xD3YX9mwWX8nM/7haovxJGsLgjQjsAYhnTVwLS9+R0tvwaFPriPLSB3 k3vIIyRMDpMoraGv0zfppwIRBEErBIT5wjJhhfCI8BdmYMPYlWwcu5etZQ+xx1gz280+ZkfFVvFl 8TvxhGSQkiSv1FcaIV0jXSfNlOZLi6R10uPSk9JW6R3pgPRL6h2pv/jMvkRfqi/NF/L18OX5Cnx9 fSW+/r5y3wzfAt/jvk2+p/2iP8Hv8Kf5Q/4e/lH+q/yr/ZvTaJqUZk6zpSWmedK8aVlpOWmD08an TQ7QgCXgD0KQBg1BS9AedAWTg+nBbsHCYEnw2mBDcGFwSXBF8N7gI8Gng03BXcE9wVeCbwf3BT8O /i1UElJCA0J1oYmhKaFrvhW/dX3b9zg93vM0Pe073ft0yen+p8tOl58edrrm9C2nl59efTraMaGz tPOfkY5oRzTKb8ChUZVcI9lK3iW/ouReQ8kdFOCM5Bai5O4SHmOEmdhwdhVbydawB9ij7FnWwg6y b8WwuFvcLx6PS84vKVLd70rueGpDaqPP4EvwOX0+lFw2Si7fVxyX3HSU3GMouS3nSG6k/wr/yjOS s6Lk3GmpccnVpU1SJef7A8lVnZHcymBjcMsZyb2FkjuIkut7RnKTQ9O/JarkyHF2mqDksk/3Qckp pweerjg95vTNp5edvut0R8dVnf1Rcg1cclF+nlodtdO36F4hN3qYvoMrwowaeQ+ZR64hN3Q0Ynwa 19lITiQ7khXJxOCf4WaYC9fCVLgM+nd82nG4Y3/H2x3tHe937OMlO+7vWNfxdMcj+Htvx4KOhR23 dUzrKAD4qhbgy8OxW/32OxCrv7iifWH7L19sbp+HsecQKxHL2m/5Ys7n0z+/qX3XV93a7/p88+dr Plvz2aOfLQf4bCPn/dz52czP0MJ/lveZ8lnBZ+mHKw4POlxyuPhw78MFh/MOZx1OO5x02H6YHPr7 oe8PfXvo60Nfcq5Drx164dDzh7CVQ68eeuLQ1kODDg04VHYo/VDaIf+hVE+b51fPF5bn0dN7Xt4o PySvlx+UH5Dvl9fJb8rPyI/IG3D/Oir1F+8UQZjI1y7pfe57Cvq3GM6JH8czU/xHmAT/4UcYKjT8 Qc5dCNxb2FA2gtUhnXB2Lp4DAc9vKv7oh1VxsBHx2ND/1I/zOEMs80w4/T+W1P1hzmXnRAV4DBbC HcJVsAb+BovgLlgOD8GT8Di6CMtQrLfDvXAc/oFWei0sgZfgMPwID8MW+Bf8E07Ao/A0vAGvwTMw ASbCSpgEb8FkeB3ehL/A2/AOvAvfwBR4D/bBfngWroa/wyr4EN6HD1BXj8L3sBSmwzS4Bq5D7b0e GmEGzIR6uAFmwRyYjTo9D76FG1G7b4I/wS2o58/BI7AA5kMD3ArfwQ/QStaQtYQSgTAiwmnoIOvI /eQB8iB0QoRIRCYaiJL15CHyMNmAtugRoiU6oicG8ih5DE7Cz+Rx8gTZSDaRzeRJsoU8RZ4mz5Bn 0WaFyTbSRJrhFBwgy8hysp3sIDvJc6SFGImJtJJdxEwsxEps0A5fkARiJ7vJHpJIHGQF2UueJy+Q NvIieYk4iQu2Qpi4iYe8TF4hSSSZpJBU8ip5DX6BX+FL+Ip4iY/4SRp5nbxB3iRvkbfJO2gz/0IC JJ0ESYjsI/vJe+R98gH5EHaRDJJJskg2HIGvyQH4CD6Hj+ETOASfwV/hU/IjOU7+gXvVP8m/yAly kvxMTpFfyK8kh5wmHaSTREg33MeAEkqpQBkVqURlqqFaqiPdqZ4aqJGaqJlaqJXaaAK1kx40kTpI LsmjTuqibuqhSTSZptBU6qU+uoL6aRrpSfJpgBTQdBqkIZpBM2kWzaY5dAldKlpEK/1RuFW4XbhD WCwsFe4U7hbuFVYL9wsP4c75hPCk8JTwjLBV2CbsEFqFvcKLwqvCm8K7uFbfEw4IHwufCl8IXwtH hWPCj8I/6D/oP+m/6An6Ez1Jf6an6C/0V3qadgg6QS8YcHchOKjH2RNsI9vENrMn2Rb2FHuaPYO7 ylYWZttYE+7M29kOtpM9h/tMK9uF+/Qetpc9z15gbexF9hJ7mb3CXmWvsdfZG+xN9hZ7m73D3mV/ YfvYfvYee599wD5kB9hH7K+4S33MPmGH2GH2KfuMfc7a2RfsS/YVO8K+Zn9j37Bv2VH2Hfue/cCO sb+zH9lx9g/2T/YvdoL9RL4iR9hJ9jM7xX5hv7LTsA2a6DJSCDtgJ7yMp6Nm2A6vwG3wIr+3EoYJ I4QqYbgwWhgjXC5UCyOFUfAT+Ya28XsWuB+O4cp8Au4hpXA3KSNzySrcL+4l86CF/JkcI39nM9kN 7FY2S6gRxgpXCFcKtWwhm8PmsTvYXLaI3cQWsyVsKVvGlrMV7EZ2H7uT3cXuxh15lbonP8jWo0/z MHo269j97Ba2gTWyR3CnfkzoJfQW/iXwt94SQNeLYoIeOdDzzA5mCkyUZI1WpzcYTWaL1ZZgT3Q4 XW5PUnJKqtfnTwukB0MZmVnZOd2698jN65lfUNird1Gf4r79Si7qX6qUDRhYPqji4sGXXFp52ZCh w6qGjxg5avSYy6trxl5xZe1V4+rGw4SJkyZPuXrqtOnXXHvd9TPqZ94wa/acufNuvOnmP/35lvkL Gm697faFdyxavGTpsuUr7rzr7pWr7rn3vtVr1q67/4EH1z/08IbGRx597PEnNm7a/OSWp4Snn3l2 a3hbU/P2HTufa2ndtXvP3udfaHvxpZdfefW11994862333n3L/v2w3vvf/DhgY/+evDjTw4d/vSz zy/4jhd8xwu+4wXf8YLveMF3vOA7XvAdL/iO/z3fUVGU0v4XlfTrW9ynqFdhQX7PvNwe3bvlZGdl ZoSC6YE0v8+bmpKc5HG7nI5Ee4LNajGbjAa9TquRJZEJlEC3QYGKOl84VBdmocDgwd15PDAeE8af lVAX9mFSxbllwr46tZjv3JIKlpxyXkklVlI5U5JYfCVQ0r2bb1DAF363POBrIWOHV2P4zvJAjS98 TA0PUcMr1bARw34/MvgGuaaW+8KkzjcoXDF36rJBdeVY3Ta9bmBg4GRd926wTafHoB5DYWegfhtx 9idqgDoH9d1GQWPEToU9gfJBYXegnPcgLAQHjZ8UrhpePag8ye+v6d4tTAZODEwIQ2BA2JyjFoGB ajNhaWBYVpvxTeOjgeW+bd3alq1oscCEuhzDpMCk8VdWh4XxNbwNaw62Wx523nzE9VsUK7cNrF58 dm6SsGyQa5qPR5ctW+wLtw2vPjvXz581NVgH8tJgRd2yCmx6BQqxcqQPW6N31FSHyR3YpI+PhI8q Nr7JgUE8pW66L6wNDAhMXTa9DqfGsywMI27yN3k8Smu0HTyDfMtGVQf84dKkQM348uRtdlg24qZm t+Jzn5vTvds2izUm2G0mczxgMJ4dmHwmTw2pxXmocsQZyRLeo8AlqBBh30Qf9qQ6gGPqwx+T+8Cy iX2wGP7UEOQKT8IZmRbWDqxbZunL0zl/WAyii7jsJzTtdYFjP5ybMj6eIgUtPwEPcj05o2qY3xUO 5+SEs7O5isgDcU6xj/3VeK/u3ea20N6BeosPCYoPqlC242v65qL4/X4+wctbFJiAkXDD8OpY3AcT kppAyc2pCdM6ntPWlZM4muc0dOWcYa8LoCZvVw99iWFN6Mw/s8WRMGhq3zBx/IfsybH8ypGByuFj q32DltXFZVs56pxYLL/Pmbx4KJwwsFpIovEQTRLUXFTKK88U5pFqQ5gF8Z+kKvWksIBKqSYQX0XY Ujc49qzR+f1/yNMia85iaoke51wq+Y0t3stw35xz4/3OiZ/TO8MyAfvLQrRy1Nhly3Tn5FWgAVq2 rCLgq1hWt2x8S7RhQsBnCSxrpZvopmX1g+q6JrQlumt5UrhiRQ0OYirp2x32Cg+AmRDwRtuEdc0W e77SItzfbE7IV8oswmqoQlAIC0OgDUFhhrAKFiAoFq9s6t4zv5UHmnWmfAuWXw4+RANCgEZ8EjWu IHj55c0JDl797U1mq8r3p6a8wlig2eLKryqzCzcCESYL10MAvHhgux5SkU5EmoJ0AjrQRrWfSrPZ kt+A7ZVi8VIhEbIwuww97Xyk5YIHktRic5pMsXbmNGVm55fphIGCSy1iFoxQiFQjyE35Xt9uQcGe KsKSZq2e929JkyUxfy86DzLYsVQDlnJ6zXsFHeQi+EhGNWuN+SvLDLgpNiIolroeq9igPhXh+ias CNsbJCSDA/OuEVIgEWmFkNqU6G3bLdyrFruH14Lt9W/SFHDSbDTlt5Vphf6YG0avvw3BW1vZHOqT D2UhIRPyEBSFugBDC/iH6IVlGFqG07QMp2YZTs0y7MUykNDPXoo5S7FMrnAz1AvzYCViA4YZVpnY hBJsVQPpmfmtgltwoSQsu1F2BFM9zVoT75mryZagFnM1G0z5pXuFWTAMQbHzs5udrvwZu4VsdSjd ml1JnKG+SWtA0Tljc4GMDj4He4VkIVWVRIoqgXCZF+MEzIIXCB4893Pp0A/oAT6/dB/GOX07Tt+N 07/EaLSN7m/GVpQW+j6n7WXJ9GusbBz9FDZgiNLd9GXIQ4ZPaAvvBf2YtkIp0oMYn4S0FWkB0l1N /je8LbSlGQn2/cEmo4MPlr7clJMbD3iD8YAzKR6wOfLLgvQl+iIkYxV/RZqO9EXaBmlIX0DqQtpG Z+MxxUt30F7QD+n2OH2F7uE6TZ+jO6EP0uYmE+9CuEnmZGuTxMmzTRCLVeV699Bn6VPgwaLPNIU8 mLq5OZTuNe/G+gh9gs5uSvHaynT0EVJNTmChRjjIKdjoo01FvJKVTXt83la6kq5UXEVKUOmubBTy gnnd8zYKvqCvu6/It9FXZqF3gYjCwwVLl+OzCHwUtQehIFbSpU2sKFzWiWPi46LQgM9GNVSHz3o1 BPi0nMk9roZK6R0wDEGxjvmIBYgGxK3A8Hkz4k+IPyNuUVNmI+Yg5qH5qEeOeuSoR456laMeOeqR ox456lWOerX1OQjOUYccdchRhxx1KkcdctQhRx1y1KkcvL91yFGnclQhRxVyVCFHlcpRhRxVyFGF HFUqRxVyVCFHlcqhIIeCHApyKCqHghwKcijIoagcCnIoyKGoHHnIkYcceciRp3LkIUcecuQhR57K kYcceciRp3L4kMOHHD7k8KkcPuTwIYcPOXwqhw85fMjhUzksyGFBDgtyWFQOC3JYkMOCHBaVw6LO zxwE52hHjnbkaEeOdpWjHTnakaMdOdpVjnbkaEeOdjpvm7C/7FVk2Y8s+5Flv8qyH1n2I8t+ZNmv suxHlv3Isj8+9NmqMCiqzXzEAkQDgvO2IW8b8rYhb5vK26aq1xwE5w0jRxg5wsgRVjnCyBFGjjBy hFWOMHKEkSOscjQiRyNyNCJHo8rRiByNyNGIHI0qR6OquHMQnON/rpT/46mht5JqDW6utIFkqXQB /KDS+XBQpbfANpX+GTaq9E9wm0pvhiKVzoOQSrE+lc4Gr4Y0eYvMZQ40AcMQ4xAzEBsQWxEvIGQ1 tA/xOSJKeylpzCwPkzfIW+UXZHGr3C5TszRM2iBtlV6QxK1Su0R9ZUnUqNpRNC1wt/pcgM8fEbiJ 4LNUDZXSQmy3EO1sL/wtpIWK9Zjvx2yyL5u8kE22ZpO7s0mZll5MmGrpfFCEZy0vqVYMof7eg4ii UEZ/tEx37fzB6W0K9fa2kD0xkqXkIP0BsQ2xEXEbogiRj+iOCCK8alo2lq9W0uJV7kFkIPwIH28C HPzazWbVKK3USDY2v2oELW8nIxP5djdl5CFpacoYhuS5powJ3jIt2QkZ3A0iO3DmnkK6tcl7BLOf iZGnm7y7kWxu8hYiqW3K6IHkiqaMd71lRjIavIyzjorTkThuTkc0ecdgseFN3iwkOU0ZIV46GxsK Ym4WqYYjSINxrvRYS4Embz8kaU3eYl5aAxl84okE3dXuiQhOhWbs0I+tpJoRRe895r3X+wOyf4+C RfX42NfCkOwLtpAxis67p/vDWLjM21Sm4+Vxf9gWp2FOd3g3Bpd6H8S6SHCn935vD+9d3Vs0mHwn 9nup2kST9zY8FzylJHgbvHne2d2PeGd5L/WO947w1gYxvcl7pXcP7ybUkGr61E5vFVZ4CY4i2OS9 ONiidrHCe5NX8WZ4i317uHyhT6zeou57uAQgP9Z6N5RvdrCF6/joohZiVbLl4/JK+Qp5gNxPDshp cqqcIts1No1FY9IYNDqNRiNpmIZqQGNvibYrOfylkV2ycCIx/mRq2EL5k79fwsMFJRoKl0I4Qaik lSMHkMpw20SonOALnxwZaCE6dLvFwAAStlVC5agB4T45lS1ydES4KKcyLFddUb2NkLtqMDVMl7QQ GFXdQqI86Y4kfr7dRuCOO5NagRD3HXfW1IDLMbfUVWrrby2uKP+dR138mfPbj+vsYEp4TeXI6vCW lJpwPg9EU2oqw7fy028rNVPjoPJWauKkprqV1VPzoBE8ndWX12CxI2ox1GYTFoMMTrCYZgD4eDG0 JwN4MZyjWLkQsmM5PydYTmeEkFoupDOq5Rjh5bYd9A0q3+bzqWWCAAfVMgeDcFYZ1BjkLd8WCqml Aj5SzUuR6oBP7ViWWpHXi0W6e9UiBP06tSIvURsL5/5WJBgv0utMkV5qWwL5rYw3Vsae2VXGnoll cv6XP5MH5JDmnnPmv8wvFOoCgyYj6sLL5051hRsm+Hzb5s+J3zSE6iZMnMrp+MnhOYHJ5eH5gXLf tp4v/072yzy7Z6B8G7w8aFT1tpeVyeVNPZWegwLjy2uaS0uqy85pa+mZtqpLfqeyEl5ZNW+rtOx3 sst4dilvq4y3VcbbKlVK1bYGTeN6X1W9TQMDavAAq9JmqtehDtcl+WsGOCz1/blCt/bzu+Yn7WJA NoMej/OGwICwEcGzupd1L+NZuM54lonfGsWzXPP7+ZN2kc3xLAsmWwMDoEu0wAtVhnsNrwz7R46t 5qoSVsb//pzN4j9qtgsGTSvHfxifrQJ/zy4Js373Z/bv/cyZM2cWf8zJmQVQGc4eWRnujefvbbKM TdWV12Baj640QVDTtmm1g1qibZiZg50gs3lzPJRDclCCig5PXTJtlBplyo8Ks5s9Kfkz9uIOvgCB 5zg6rylXPS/Tec1pQX5+md2c2ytG8XzKaZPHn48tNBchK6fBGFWs3TGwMriy+8qixmBj98YiCVN3 bsRE70a+lTblbhRgds6sLkFgcHYNChu7xdt7pCk5RW24kQdycmpyZhFVXv8ubNIl9DOCnRWvdZZa /eyuCYmlz4JY4VhmzpwupjlxFjVzjsqCQXEXJKvYBMkshAcoiB7pQmRa9AjP45R+h2Y6JYb4TxM8 DX8lmcQHzeRXcMIp4iY94RJUvZ/RL9sKnbAaD+ujYA2x4YHMAaPhEsKwTA6sIA9G50aPwkVwDzwa fY7cFt2C+XfDa3AKe/AZboNFMBTLj4bJcFT4GmqiD4AGFoMeD2wjiAPGw0f4+xP24V64D54nf46e wlbtcBvWVwJlUBZ9MdoB2bCCrRQPanfAKthNpOjE6DR0f9JgGc2JfhT9HEJQA4/B09inHNLGBoMf roE7YB1xC69haDU8DhFioLXCQPEFbOkSGAPXwzxYBlvgLWIjVeJB8Xj0T9FvUMUSIBP7NA2Okl5k CH2CGaL9o5/AFdAKb+B4+W8bu4JtEq+IlEYfir6ER+vniI7sIS+K+eJdnbdGH4k+CwbsT0+UyFBs ZwLcDi/Cm/AP+CddEF0Ag2EktvwqSSE+EkKJf0TddD6dL3wAPXC0tdjbObABwjgju2A37EXZHIJ2 +JrYSRK5lEwgq8g/qYFOovuEB4XtwoeMsCdR3gEIooxmwxOwU31Lt4+IWH8eqSLTyQyyljxE2mmY /kB/Zhp2OzvNOsVQpD1yOjo0+hMeqD1wGdwMC1C2j6nvKf4CB+Cf8C84SSykD5mqflqinfxAtTSN DqP1dA0ejZ8RhgqrhBdZLzaAXcPeZZ+Ii8Tl8ng50rExcm/kmch70eei76HumLD+EFSgRG9FrXgC XoAPsPaP4VP4kusP1t+PjCVXYSuzyBJyH3mGvEreI9/hKEH9TaP9aDm2OoPegHK6jd5L78PW9/Fr DPoJ/ZR+T38SRCFN6C3MFB4RwkKLsF/4G7OwEOvBerJhbCyL4szkixeLI8XN4lPiS+JxqUSaJNVL 38q3yQs173Rmd34WgcjUSDjSjLqrQU26GSXxMDyKer8d5+AtlOhfsMftcAJnwUP8JAP7XUwqSCUZ Qi4nV5LJ5DaymNxD1pEHyaPkWRwBjoHK2PccWkZH0vF0Ml1IF9M76Xb83UXfpB/Rg/QY9twpBIQc oadwifoe53ocw2z1kxSr8HeLsE/4QPhG+FY4hrPmZKlsDruZ3c82se3sPfEy8Tr8fVR8QWwT3xM7 xA6JSh4pWcqVpkubpS9lSe4tV8lL5Q/lf2nqSTLJxp77zn5RTN24BlPpFmpnC8gxTEjBI4UZR56D 8zASV8W/oFSI4LyYeD72LZG6WQLnlBQW5hcSZDf0Iq/CAokK6PWxdmgih2k7e5leBAdIHXGzTcL1 4lvUD0+hNVpJ99DdZABspyV0DF0vAPkat7yvUd9vhPvINWQWPEWOkb7kFlJEFsCH1CGMJAuhJPoo ZURLLiHHAXsAt7JJcNV/fqdOiuEwHI08zIzsz2ifWmANzujT8Dl5En4lYvQHtG4CWqPxaGVWoL7f Adzq1eI6W4Dr0Y0W5FppH2znn52Si6T+7GY4Dr/AUXEXatQAtKTfRKaxh9lX0aJod1xhuMpgM667 qXAxrpivUUv2YpzHrsSVrkNbko+rugrGwiS4Ba3eqmg4uj56e/Sm6Ax4G3l/Jd3Ir6QRV0QLcpTA G/h7N3xMluM6vPg/j/OPfiKToA2+Iy4SJPm4Ho6Jc8WV4hZxu/i8+K7UE6W9EB5Ejf4StVmHI5gI 78F38DPR4Ny4oRsUYn/7YN+r4VpaI+yFgcQD9bhmM9GOD4iPZBbWchtKbz2u5724No6jnbgSnoeD hBInjmgitq/BeipRzuOw9EacwdtJM6ZMQqudDd/juE2kD562u4GCNa1Bq9WGfToMf0NpR9V+dUO7 UE7GYF0/w+UwCVvoDVX8W0jRnWiphkK58A7KO51YYABJI48jXx2uUBOkQLH4FaHQLTI02odOE/bi HhPF9EbcvZLgIjITe2HGcXRCIhkGvSIjsA+xn2v/FzgcA8rqHNDHz4Xw4W8Q8Qgt1v8xpE9i0Nji 2A+gvfYsnPgNuqrfoK8GMGTGYFwBYH4HwDIhBuuf//tImApgnwSQ2AjgWAngWg/gRiRdCZDMEfkN KdMBvKmAhx7EKQD/iRjSDgIE3wIIoceR8T5A5qkYsndewAVcwAVcwAVcwAVcwAVcwAVcwAVcwAVc wAVcwFmg/FPbIv6CADIM2E5JRJJbaKmSACKLCKCTWYSAWyOJESrsISHQkjBxgSvHcrKks2So5UTJ kM4SKMWwpQMfPfP8Vr81iA8CDDp8QluHwr9w5WNt/DMccyKt5AnC3xCU7tBq9JJObiGpSpK0nvTR 63Q3kJCcbgYv+CAPud2Gq+e6crCJ2iFHOo9B6ZBjJzqJtRisxcU98xL8iXZJkjN69y4KrCDu7Dlj i0YPpkuI+82b76z3zU6eMJq3dy8+nsb2BEhXEmkf0NHQWfWzM/V38tp75hVg3+/lL+Mi33DuAgBm ENsghQSUcTtcOz2tSW+x1137Xfvd+z2agUkDkwemjHE/yFa7trCNyRrJ44NMqcgzmA10DXQP9GjS XenudI/gCLExbIlrfdL65PUpW5K3pGhskGJJ8aX0TJmbsjBlZcpHKZoU/r7YYU8sTKEWgznFgl2k vJcKdp2/UrY5CqGFPtJMicHMPx0U8BpyDdSgYLphY4KoPehwkGHYZY/XfNAyj7pTP3hJHdqQE8eG Wk7OLCkZYkEJdubMPIJTlVM7s8RqKybWgpxa/q4ZUqJtTdZi3ocms0oUk6WYaSzFosaK1Focez1c 0zOP1FYOr94LSdF2SEakRNv79OlTQ2bW1tYSq7+3rah3Ue9ehaFAmiQHe6cX5DtwlmSJSTIzdGRY Gn94Pqfv5JrqqZrIt26iee3jUxcPKYicvNhBxMjp+4j20LbSy0dfNXn6n5K/feu7Zyc2Tyg7URXi 3y+/PPoNy8aZcEIAWpV+0/VzNIs1a92bxE2aJ01bElpNO617E9qs+xKMiWJva7nlZscO+r5lv13e DfuQnRHZZbMk+ZJoEh9cEkotaaPZ6PXn+qmfy9C/UdHu10a1graFDGveSghpIX4lzctyGWW8ANuY KJKDMC/14DADMXiCroM2d3qXjFURo3bGJHyi9mTtsZyZpQiCUgZELRcc1BIxpEqmd0G+LdEOgTSw WgBlROyOgvy42Jg5clw3amDNnyzT1odPR07t+yzyJcn++6ZDnY/MHz50av2o4fVsZOqoqsbOP0dO fPhF5DipIUvJvWTS7o6jS1ffvPzuO/gHzMuif2P2uLzeUar7WSutk/U3a5ZqnhSf1Gw0bUzYAa3C DlOLdXvCq/CWtS3BWpgwRl9jHGcdkVCXILnFeY77nZ9aPreLUxNITHzepFwUnxITnWjx+1B0XJhG VXzDtJ9rj8fF1xgT3w4L86H0ugSOEjS6Dg6zEZsnGJOk4SwJnojL8I8kiAKcWQszaxOCDi6rIimQ RnsVovC4CANpIaIKL1EVZC2x6EYNuvxm6/QNz5wm2nc/J6mRj358+kN61S0jhl6NEpxBRqaOrGrs +BPRf/Q5sUY2ReZEro+sf05IXrLmTyvuuqMBJfgmGoAvWUi1ij2UJKEPkaQ+TKfdKlAqhYhPzBOp uFXz7lPcEtZy81dyEkqPlaIVSUArgovB+ia3I8QtGDnt+FfMqqh/K0F8QdyF9epIfivI0YOKtqi4 UMrEh8ylpc3sVSgp+MDYQaXKn4F5+MiCbFwDmbpcQx8oEksN02E6nSxMEadqrtZ9K5gvlQjVaImg 02qZrCXEB7IdQJa0jPlEyS6KkkaneFL663gTek9KoS5IBUFi/AOWikmSqcgYAY3B6fSgpRmv6L1E fdXfQATSQtMVrVdL8rQNWqrdRdOBYQmtTySiW3/VxC4j6j5Zi3M309U5dNDk8r/hpoBCKS0Zcgzn LxetTk7JYrFHzuJbXlncw8WJbCkpWfzKKzi1lWH9yMpw6vCxaIuEaKRJw3S7ohEUTcc2ifXpEzcx MSPk9wv4S/wJgiC+EHm+oXPnTZHXaD9SnP3Wa2RIpFnc1bGM+jrb0RiOj34jXiV+AB74UBmySLvU vtSxAdZJr2s/FD7U/yRog9pMQ6Yxy57lmCPO0S4SNXKC7HQmOJ1ZNFsIinKmWEqGkfvFtdo3hVf1 Mhlh4X9v8TjOITfJVlehSnVGpGSs4nR1ZxqTYrIVmirHmckwMzEria5CNNeZSpqtu04w/2gaAz8C VkmJJy+ZJCdmNMrELHvlPFnAPXdFc9L8kTFZzuQ2BVdB3KicQIt9JIdTHuiZh6aEG1xRYgEfXwB+ n9PhjBkXq4UvAVZKvAMi7/4QORxZQm4mhcS4eVJ+5JDnibmPvf1G49wtNOmK40fJ3WQsuZ6s3nBV uOKGhd9Ffo1898Mavu/xvz97HDVUDyuVizQikzVByeYVSZ64FZVe1AosSAnVaYN60MhSpUAH60BP 9B6fMc+oGAUj0/oI37xQTnR5s6FnfFDcU1BHVTLkRMmJmNPAYS3OrZ2p7kMibkApxWJLtKHJo5Jt CXzrqcFCgojaou7Qif44VrPSjqO0vdMnFIi7TkV2/xyZ+TP2fi32fiH2Xgs3KKXYe0kMyj5NnuYF zecalqtZqaEaDcSGoMX+l0rDJCqNEPhXnT0+fZ6e6s/tv+73+l/Lu887b+Od/73+rRWOdfajkzrX 8749capzFZfsCnxsx74JMEMdbXN+YaHIlSgQVKlSancWgqiIVWKD2C6KXrFOrBePi6xBRKWhAmio 8DF6bGFoB6GNqyLv536MMbie9dwQ154b4k5ZaQnfeGbegDLkrs0Kkinu+rUC+/EQyugJ8Vl0+y5S PFUyr5uhxoOGiR6ZCmcPX+rZevbwI7zeIZ3xqnmt/sSHSCZtF589fcnP3L7V4Kr7BledGZLgUWX0 WnGtZp1hnYlpiGzSmGVXhutG7TybPM96Y+IitlSz1LDIdIdtqX1J4hLnEtcij0G2aeyyJ9HmsXtc iR45obtR6+4uC46MrToCOovOpxN0uFgUX16KklKXUp/SkNKYIvlSjqfQFEtGIxDu4eVxvwlXVPL8 l8+sqCGW2pkna9VNRrXTuIZmQm1CYRH6kL0L4gsJiN12ZjOuGZj/zNVLm0k5uSMyP7I30hqZT3r+ bdu2rz597rl2+mH7uvqmnL64dTwQeSgyA5fT1F8i0Wi049RpLge+ik7hXHM5zFOCkthqb3UJF4vk avEjkdqsQaPJBEkWrodm0ODwZMLNf7NWX8iNgeLwpuTFxyemWMxnz0ny2So5xDLzZI46qi6FVP1w qJ2pzg+aBofqKkuBgJvi0PjYMkKB1eQQMY2Yv2XC2qHT33zx0a1zB141uFejuMvh/3Tr4pZp1sTO v7KXInU9JpRVTTXqsGE0DeIeHE8i+OGUclux+RLz5fJ0/XTDFu0mU2Ngp+mgVidpJJ1T49D1NlWY KsyyxqK12k12s93S29TbfLF5jukmywc6/Y3aG91zU5Zol7gXpUhah11rMJtGmuaYFpruMz1mEk0+ o8FuNBrMhkSj0xFMsNhJnb3RTu128Pm5uFBwiaAx8Y0rA4wWIzV+mJTRKIWlNmk/+pqL6wPEF8gL 0IA/8WyppfWc+JvUVF04dqL2WNc29dtS5j5H8eIeObWmWyyvqAcO7n+gzUUvFwWar8pTdjicCX6h Bw0ErNbfpBpYQ2d8f6DhpRfrbpneHHn4oxtGXTWl5NCB6SXDBqdv/0bcNeyt2574a3KfRU+hV1f6 VI2/c70wNL16wKVXGERuHy5Fv+2fuHa6kbByUau1JWVn5mvdGG5LibgtJbpyJouTM2dLNxpnZ35s +ChgqNGNNo1OqwlMNUyxXe2flnl1t3kpi1LW+A22QEu0vTnVW8ipMtntKRyeNjzwYtqLATYzbWbg 1rRbA1+kfRGQcnTZxvS09ECxsTBQqas0lqcNDEw3Tg7cZLw5balxWdpG3Sbj5rQErU5rlNKkgFvn NjrS5LSAzsiIc4xLcfsKZ7jIDNcGF3XtopPxXNCmGDzF3iSS1N0uwGDCbdolHl9hHlFIFakjK0kj nh/biIb8nSmeYgsjrHu21vVj1EmcSoKz0FkpZ4Q8PbwZjZawhVoqyY/W2AS6u78f1/nKkdXbQOlT M4TPHnqNSHNu4LvkzJwTtTlHYvSGnCM2Z3GtavvUrSUN5ZGU0h/lsT9Ov2pKKE5D8SDB2JtNNh7b r5htxUafrVinwszTvlVMBkwzFutcHAnF53z0tia+1OKeqaoG/LdXYW80Kiy2LcvomjodTNUcvmdf SnyeDYvvXnXRZYWtf69bvODHJ4mdOOXIwYRbbrn1ktxufUh435wVUXgh8l3kI/Jp8qolNw0vvCTJ 1qPfmJuerX95yj/fMs6c2CutuDCYO+W6vcvnH76G8D9twz9zxFpV3/IGJZCrzWN5YpW2Hr22lVpZ IiINMoHKoNGik8cWoPfWQrorOklGPw/4sYFHrYKpitbTBrqSMurWdD4dl/rw6m0Upa7ufZ0l+EAf 70jc5pSomwFuBb34zkc+jwxhd0aGspdOnTrdHwj/O0/iKOyVBD82g0A0fH+3FQtIlFGevoVtmo/I R/Rj9rEozqU3sRvFtWQNvZ+tEzdoNALopVzN1XQqq9PMI7IbHFIWhKRL4GLpchwlOuM+AnYcvCSc 8XOFFjpB0UuAez+jaC7EXXQ8//osn1o9IwtYg/o3OBhrIXpFt0BoED4X2gWG/WnbgSUEIuwieqDc w83Do4xbPsvDRQ2rPVFbm+PidsOiGo5j53q16kmlthZySA7Uop9K8B/Vd54gZWQWuZr07fyXuOv0 y+wi3IcpXBL9lvVg/fGUlk+GKlNljyZZTHF4Lk0anHxJ8JDlc6u2t7vCfXloivvq0KLQPe57PRs9 rUmve95IMkiSMdEhuR0ZUlZijXseXUQ3Sjuk1yTDC4UfW2hKen5PazdjupLTozBdScvEhzulcEZ6 RzpNr1BP+Hkmc+FFKYTfRIRTfklhKSndSAEomMr3Twqj/UqytdSvJFnw4fIU+lvo7B1MNhh13fgu hXkqxWyVYoluWEJR7PrUniFNljbTWOM1bDBQr4FE8cismByFBs+wQlJYh3p6FxdsQZZ/nJN87iTD nOOcM5yC010wrazLg8FVPfNYLXe3cmKxI9yjOYYLDlUOzxLqWlctds4xfjJAGy2YLDFNxJMirsgM XH/cVgt2h9PPl6SEh0Z1WRb1Lort74Rvi+qhUb23IJOjOe/v29NSKSQFI9/pLbIw+PHax/eOefCe Vy+rmlE5ilzV+7v0ouryywYVWPT0yx4P3Fez9LlIy4o7LksucmsqKpqWjL2zMjnoSx4+qF/kfVu+ K6Ok35j8UFH6ZO4PLMa5vk/1B5LhoVawRU8pPfXFRUkXJ1HbGGmMboxjjKsm+WdZ6sX6Gfsl9Eoa xCqNlQmDku6T79fqDCZ00sDDv20gynYu6QS93gw6p1/jqU8lqZYsKoTM/Nt4BlIP/ATrTimNSXMm HsE6S/42FP2EmJeA3g933/A4TWoHViv6KdIU3RTHFNe0ZLG2BmpVX5HfUcSO1hmJCWi7zvhEi4n7 tqaXIpHO1iu2KbbCS26qvX3h1ZMXibs6j98X+SbyS+R45JMratbT7CeG1W94aucjD3G7NBrHXop6 7oYvlOHV5hpbjWOqeZptmuMW103utXSt4TXLa66/Wj5yHZWOao4mHE08JSX0SeiTeKntUkeFq8Yw zSD3tRU5ilzCPHGeebG4yLzUvdm2ydFq2+nQmlT9Syo0qQvYXmgqMPIUd2qhSs3WQuMuwkCHMrNZ 9aBgUVCwHBSsRC3chcaDYZbPKROeSvyQa+QBo3+YiZg8SbLf7vZUl/121YOnspwTx3L4uaz2SE7s WIY0tg/M7Lrlid1FFIlc6+L3PKxn5HvTxGHTbllwTdWURGLPOfHu0cj3xHHspa/pD/kjR63asnf9 FTNyn3+JhAgjMglu4nozCmU3Pq43K5XuthqpRldji2nLOlSNU1ptfWpDKu0rFBr6Jha6LxXKDZcm lrvv12rtqrroudYoJr1sMuNU6JxZJmOIcE0xm8FzN9cdv8adUl1yZoQzT8Y0RrXuMV9Z9X5QV4zT pGm6abaYtki1NX5/r/gA0Wt2Wv3kbFVh4yOny7aNfS5yOvJS023E3WnLLb95/JKFV09avP6KGpKB XoCJuO+jlo76LZdd/8Tjzz2yQb27+pZloK7YIZk81goWXCcV+uL7tQ8Y11g2i5t0u7W7jS0ejcZO BtOLpQrdsNTNxp3STs/rujcMH+kOGk7JPxuNyebkRCUppTBRMVkLzYkvJO5LFBJVbUgtVanJiZTe qaDraasy1ZmoyWXj3spOd1IhKbCpJ/sUX+yEn5YVozndY9SVrFLFjMaykX8z0YLdHmez8a8EMb3N xcWdrpfBT3ITY0qUmzoudUbqhlSWavZrFKO5EAUet3U55xz1j/GvJNldSqa91KWkmvGBBtbFLbHq a5R2qs6MDTuBJWy8M1jIFjfEnDZ1FUUjqvonKgNghq2Yd7rJyUm4Wavrr0bL/KXqF4pqjnATWqs2 b1JQSibeqIk3b1JQWOo3hmrUaxx0qdBHLlCPlmgtCFdxHzo8XMdB8KtuUELM63HSX4mr99Gtke/v mEbsHxwjNqlTEW4bP2BshnDjmCtLSggZkfvAIztWfYq6kBN5PbL3luWDybU3Lxg4cBa3Gy7+9/jQ H3ZAi5Lfm5Fs5rP4rDWswSVq2AsumuiwUrvNYTUlmMFiSuBfGLVrNWY9GaeP4kGeT4ROIlazg0Qd xMGjqfx7pcf510wT7DptQalmmKZKI2gyLbnWcVZqbSFMMZoSQtQ+DhodbQ7q4DqhNRQ63M4bW+k0 iM0ZmlT+tqOjFh0h9xFw4TLhRwdEKT6K8834E9+IEgpUTzDfKatWIbEgMYDmNeBaX3z/nBtnhQb2 v6jX++9HvlnPQlWLFo5Mf8VSPLzy047nhEvUtR8ZzupU/yCX5Ct181IWp1CbwVjfc5GxoSfzETzj CHmkgBYIChlIBwo15hp7TXBM1hicqlPWUwnWfsYCR7/Mgm7o2jsqM8u7HTd0OnV34X6sNxj12QZj hsnhTOxuNKBz6krn+r9D1X9VzU1WVUWa9YYYzcyOqX8gGKM9C2PLQJuYpG7q40RubrzmDE5Muu5c 3PpE2eWWsrP0IY+Lmxyt2+3x3N2T9EQD1KLooCDdb3PnnbE9J+LWx3LM0nmka6vqPHFDzNU+koNH M6d6HivmwPNl1zY2U7VN5mn2acGrs6bkTMuV+E7mFB3Ors29F5qpuJI6e/nxWEoDPvQGEs66e7+J lGlSMsdcXxRMMM5v++iWCYS88GoDkfvX77478s8vO26vu/quJVMn316R0Scx1e/oGbjqwad33H2A 6InnmdUdF+/ZNb2k9S4Tvf3Jhx55+InGh1Ak96A/XoO22wFNSo6ZeEkxnyzLADLA+hn5hWhl0SGm 02rrVKtICE2wW20Jgp0SMxddiiBrdTp7os4BoNeFNFrFl164VUuiWqJFYfL3RWnphStdjS5a7zru oj+6iAvsIUeiapqwbGMiOZ5IEt3O0ph48SwUv8LC0Ml4TLXx3I89hjJ1qj6UpiT+uoI7Aak0EdW1 UN3SJB4kTy3ZO379sJTIN77hF1VcXxDBU23n1xsG1y+5u3MV7blpbK/ypYs6f8BBo/6q79/U+y4Z 5rWClt9wWXWlirZKSxu0YW2bdr/2R63o1dZpF2gbMUEUJBlEJuBOpaj3WgLUot8jiZLMdFTGfVHV OH96IXNr4uP6bRyl6hJUr+IscU/whpyu6/h7Y9fxbCdhkY7Tl7LQ6U+63hCqPRyp3sgpWbx/YpVI G8Sw2CbuF3+MXcMtEBsxQcTOCOhKCCECXT0BN/u3nsTbjr9QjN+6zQeQ1uFqziD9WiELuWuxLbSe hkTJYSgUCjWFrsJAOR2kGeQqDxh8Qm7WSG1dVkPWhqzHpU3yRsMOaYchnLU/qz3LBFm5WVWY8ULW 51lSluJJLizFeIOaKcp+JntSuLlr0sl+1eox2WK1ZiQlJ4cydChOsyVksypje9VZyQwUTgutUMye pFBKMqbNSCZ1ySQZ07YHQ6EM7ik0AWSom6e2lFOlN/Y7A4tmKGWIEkR6RmGG0veiwtyMfRmfZwjm DG9GQ4YAGb6MvIxoBstwZ35V0uXaxw/OsVVechL3KTSlJ2fWctKljurRChf/We9/bsjh5pTkJPgT uWPvVN17p0NVz4wz6vmbps4nwvK2KWvyKh69cs6jmaivKRnD+03tEfkmtbR32dTukW9YaNWTo0aP HjXuyvJ1nTV03MM9SgYvXxOhtOLBsd0qFt7f2YFztoqvYJwzB2xQXHKCM2GsZqqGtTCCs2Up15Sb j1pESV2uVtlklAx6PbpYlIQcoC5XPP3yt7J/sFx1+pDBxOVrNBrOrFoDOY72+dxVq0rq3xauevw8 4535z1mmqpBw8bKayDfpw4svmZ2Dyi8u/6D2gWFemvr05D5VC5siXhZav33g1IV/4mt1BPpdD+BI jeilr1UGf0u+0fyc8HMie51+K1KbW3RraY1lTMIYR41rLV0nrdOsNbRoD9BD4mHtAcM34jfSt0bL Js3b9B3pZc1rBnGOZqm0UCNYVS3UO7mI7Ey2F8ueuqT6JJpk8sM5bnXscBJzNrssunaaZQr6mtNc jHBzTmoTCm04LFBfnqaHgmfZ7hHLOtf/gxRG3vzhnsjPy4hvzfXXr159/fVraNoKIi2LvP7jPyIv L4xufnjz5sb1mzfz8S6PXMvW4ngt6Fc/oPTokzA4gdoKhWJjcUJhUrlwifGShPKkX5K0/GzW5W+f lH9J0uD6Ofsc5tDrLWZT1znMmmUymUMWi+pg688/iQ05VoITaTnyb2cx1d7yPYyfxc7yr9F/wJns feY9ZwZ3sX8b9XIiFTw7vZXQSEdr9d3DcIodd02ZcNuiiVcvwamtmhT5LNIZORn5uGJ051Ghtfmp h5o3PboBFXIxgFCkjn2zkrlWJFoTGSlOEeeIQq6t2jTVVG9jOq3Z4DXQuw1RAy01DDNQQwudp2TJ Muq3QCVdJmgt2jxtvZZpPQtsG2x0nG2Bbattv43ZLBAigjp+ShtIIx5c3dbSVpIMXcfRM+p8stY9 JOY+oSRQu4vzY6KYCZVh50j+lwbGVm/T5fdBOfhVnT7jSElW0sg1euA15XU1l198Ub8RuSy09pry Xj/1KNsS+QeOMQ/12YJjzKbXKw9LVimgyXBanYF1tnX2tRmrs7WyvcJObbuNrabX/V8HThlPpklZ xtHGycbV+rW2TWmtBrksoKSXh65OmxRabFtsX5R2e7q2KDRIqtBfahxmrvAPSJPT0jNCRYZe/l5p vQK90mVJJ1q1fpcxw5CWlhaQ09OUbrMMN9pvSpybNSd7SeLC7AcSV2dvT9seMDaQu50rXPdnP5kd 7ialtUTf5t6VP07T1MvbdB5vb/amx+JujxpXkjBwjZH0TqtIW2e8L+2VtA/TJH+awciYB+L+GxRw T67Z2b2UxF19NZ4WLFTvY1NwtwASu5FldaSBHCcCEIt6P8vUkgkOLEmIUg+MjGPHGWUVmXqHglU7 CpwK1utUsFKn0quo0MlvmJxKMAsfWK/Z6VUvc5hztEdBe2f2kCpP1EM9FQmy0+9Q/IFCh5LsLfQ6 yOfokRdo/FXBu4M0qLhSCoMefpOkOHFzqepG8rqR3G6kW6o/z0IsBXgqj29AsXevutLY9qs14vab c2ML16wO3FTUa6O4oeQvRbj5zOGXw7Xq7XDcjeRR/k71hliUO5Xx01JO/IMG+FMb+2xMevRNRau3 lZoz8YEz8MNOY7HBbijmwSYDvx/+bpu+GOJ/haHmzGcU+OdgMkIZ6epNMN+pzr4I5n/clt9G5RGP 7fqJ1xUF7YmXRJ6+Yv4nX3/yYWbkZ+u46hl5vuQQebGm+sSPH3eS3JwRozOTc32Jdmtl/zH3L9tz 1/Ke/Qd4HYHUxOQpl1Yuuuf9MPA/BvktXSU+hPb7XSXLB3g80GWZ+5ouNdWYZXciuARHIjhtCXbi tFE7cQlaWScbXHyizeBsdIadQh2SNqfgxGNQUyLh5q0ZEvnnwWYrJoNem6vLBTyJjMMVzQ9KmS4h 5LSNTiy1b7BvtQt19gb7Svt++3G7CHaL3WfPszO723NjY9fGXxkuwjXdT33Nb4+28cvkjthdsuWE eoo6pn6ODIsewS3fWhA/RdUSPDLZVZk6udD45bo10KugV9BKb27TZyRnXOqa8OfLbi7Wa2+9lXhY qD0y6rac5KRPsguGD+q5muxr/+DxyFKUz51oEUayEO7l6xXn5darrWtEQSu5pRJaYq2kldZvqKx6 3lamd4Au0Y4HRDwlhhITgRszk0Pd0WNHyf+wo2s1Z7ZyDTmuIZo/dsBj28F5O3lt7EolhIP0x4bd uzcPCkP77p12zZbLiNs7onTwDdnEvWH0hKu2rKGNEVf75H7D5hwhbejS4jj16LOMxXHq4e9Kopjp yS2U+UPiDw1/CC3Rg81IVWfa5+lb+AAjkqDXaHQGPZ4YqE3waD26NOiuf11vwIV2XMlM8RXqQNTb wa0PQra+EPrqF4NWDzqm12m1lBIJw9pifuOmuJIzC/VGr/ppAGZ0Oj0WXalumPraNk/RM1qsZ6Vs GBPYLpqHDlKDYjb0AuJDgyQQt+EV1Bc3V5gc15BjtbhT1LrVz5OocdU/5M6hrZjYitWPBeXU8kuI 2GdDiD/Bya93E/yEPBcZRTLe6OuUTJa3iD+CAun8cscgR/fuNFX1/A0opTouJdKgLM+U32B0ndxK DpMD8nGjqJE9zCVlSkXQRzOY1JA/kzmyLkRy5N6kr1xBLpXX6U9Jp2RtkIXkbF0h66sbyIbqXmaa y3SjWI1uErtOdyO5RXcfWyPv0h1gh3UdOqPAZDzROZiPZesKWKmugmkTmVvXVzdUd41uE3uOvak7 ybQyirvZ5uJzc7A50clpu5JosBYSppMZUJVoQKsRcBbbd2Z1L4wKhAcVsyO9UAhRrZ1SrSjp9fHs 43rCg4oTs/UhEO0AoiSKuIdrtDiBeGi/rkkq0CJR9JrJw4wbjO1GwSjwZFqg58m247FLrtjHJif/ NkMzXfzI7h5iqT2phiA3psn44C9FcmZ2vReJhbpO707+OjWHf5Zl5g2EPwoIThyfM78gGMiCyCpy +Z7XyKWRdWRpZNPBT2iACpHDJD2i7XyPXBJ5Lva9+nHsZoj9z34AEfXJw+idkP7xMAWN+Bl0/Q+A 1fz/L1fDDOzi+/GwCC7x23hYApfkiodleEXKi4c1EJIb4mEtLDNujod17CW1ZR7WwwRTfjxsgCmm ++Jho7RdOhEPm+BK069n/uucBeYx8TAB0fxTPEyB2QbFwwJ0s/WOhxnobKXxsAgG26XxsIThCfGw DBNs18fDGkhIcMTDWhjkyI6HdXS8+UA8rIeejhnxsAEKHI3xsFEYa9sfD5ugh+MD/j8mMgH7ZnIa 42EGHidRwyKm65wZ8TADx/9p7Wp+40iqeEcZLUlwECwL9mqBLQm0myB7xs46sR20CK/jBCuxHdnj oD2tarprpkvuj0lXtSeziDt7Rpw5wgoJCe2BE9oLnDjxJ8BtD5yQuMLvvar+GI+TsLCypufNq/f9 fvWqZg7J4htMvwL+K4vveroTvLq4xvSXqC+Lh55GLxZ3mL4C/sJi6OlOsLT4E6av+v462vXX0a6/ jnb9dbTrr6Ndfx3t+uto119Hu/462vXX0a6/jnb9dbTrr6Ndfx3t+kv0Na7VTz1NtcqZ/jL4ry7+ 0tOd4DuLHzG9wDX5xNNUk18z/RX6x4IX/+rpTvCtxT8z/VW284mnyY6T/zrX/B+eppr/jenXOJ5/ e5ri+SfT3wD/taXXPd0JxJLr7zdJfmnL05BfWmH6dZY/9jTJP2D6DcLAkvE0MLA0YvrbHM+hpyke 1+s3Wf4jT5P8z5j+HmFg6VeeBgaWfsH096k+S3/wNOqz9FumV9jOXzxNdj4l+kqr/lda9b/SyutK K6+FlvxCS36h1ZeFqi/9YBqMAxUMAxmEeBfBx3j1g5jp/SAPMryslxLBDj4VoOkpwdcsIcBJoN8F dY/58v+01KsjE8ExVhL+v1GcjAFvD+/O31qwhb/VYMVTt5i7DY0E70fQGSEGy1pHsGfwKoIzPCOO IcOaCtI6kgJ+BaSk9+TkNSokoEH6ZDELltkLrUj2FHpb9O9iOc2ULVIGMaJP2aLGimXpmH1R1a33 YDjDkHUtr2dshd4pppxj0D6XMdumiEKOyrA3WiH5iN9d/CV7E+yhHZVm+xbrGX+esO3Ye1deNmdb znfFT9i29RUJ8clV5rychU3FVdF4d7ZDzym50tSrBiU596XgiiasT5ESOlKvVXkIWf/Me9U+U1pz 1WyqMIQkWXPcpq7aVzf3mWiWL/lT01XDiE04uosxUe0cU+dCaynba2wU8HPqo5W+/iFjWnjcVzWL 2PeIuU5/ghXte0gyCXrvMJLjOcLama+2s9DsZcm9cugQXMPQ56+5awnLjHmfOTRmrOkyaaNb18gS WH/mO5NyNIRN1zfjd3JSx5Hypwa99ty8MefyC72PAVsoudLRDDZV8BT8qrKE7bDOcMjYFoyBZ1xb w7iz3I1R3XWK3e132kvL9W4yHmXNPHKrKXdEBh+yvoua7Ia82iDNeY+4WmPeJdM6i8o36U94XXIl Cu+D9pCromX9KuLK+pgxlPIMrWLrzs3VuzNde48nZwTuE++pmrI0JTfxFMEN2KDqF7wT3A662bKy UlvZB7Yb/u8Y64Xf+ynj57Tu8/86911vRn4aKj/jmlnlrJ7gTBDBY9YXwVvsbx/PQ/geMnqrqhE+ DVc89ta6wQHk+jhB7uO1g4yIPgSX9O/j+Yj5u+Ac40n74AFOjl387TO3H1wPrvGrz8g1F+Ba1HwX seve2Pe32Q/z9XHnXo4aFIyQmKWrfKrpX2FqwKtTyJe1z7Ceo652Jes280/5HUJTqpnZblZoP5+N nx8jtqLq+Uu1fd97o0ly5uf2oD75nE/7gspUKJvUk1D53a3q/VPwrLJ+dgw99i+qV7XjqWKqZaWZ GPP+Io8vwvKAp7CLeuA7k3nLF3Xobc5qtlJu+s+jYt5zNUdpYkq+1Uh4TXy1jZ9Xz/PdZexnrZk+ neuF8jea9s5xJ4XkiMZcWTq7NO+3l/dceCxmrTla+aXdH3GldevEKlq3ruVaumjhtrknvLhSFF3K 9itc5TP2Jtz/U+5me5pUs7iRzCHr5kzJFSf7cZ2Pi6uN7tRPb1d/t6vGHh/NlJ/F0IsyavCxx7nP d66659H5pvxt0GXj7pYhdzU714PiXL0by5RfzrefyM/VM76HTYL2Te7l3a/suT2p/H1j9lSu7M33 0VWruR2HbHN+H1cdk+dqPfxc0TZVnvcwe7eYjUj5G7PFWVlZoFNmG9yVgE7JzWA92MDJKPBcw6cV fOdYx2s1oO/ZJ8FDL7mK1TWsrHt6I3iH/jMTvO4Et/H9hF5kPeZ7yRj+evib8F+Xz/fZHR/y5Hve OUHUPd6dkxoX7hTUftpSTEc8od0ZeuDvWrm/xdP+dCdpwSuaO3CMZ3NuEKro2xXdGD5f3D2Wp//p soen5QlBverx2fMBo8TdJ7q15BfrYcJ3ACervhAv1VrvHB5r2/3pWA1lqMTHoh8rsZ9nuQVL7OTF OC+k1XkmxknYFfeklS8R6pExcZwnJXGM2Mugt7a1tbqCx62u2E4ScaRHsTXiSBlVnKloJ8+sSslI MRVGQgl8PRSRMnqULYvtQstEhJCSGotpXigRl6nMtLEijGUhQwsFY3VohI1lJrA2FflQaHgZFypS oTImL4yQWSQk7JdhLLQ3pTNhy0yJibYx1BW4eUTaRCcSPqAvEUzFsxOVWa0gHYIoi2lXcEnyM1VI pGcLJW2KJVIIS6RoyJnJhwiTQxiWSQKSY4X7NIcTnUWlsZyqsdNEtStBzTHkRRWpzliiyE9hViL+ sISjjCOLtBzltD6JNTKMVTJGRXIx0meKBbjLUiQoh0gVapfpEOJyPFYoYxYqOHHl1lQsoZ4hmVQl U4HcDJqckI1UJ1xe63FjvL8QGgMlSqMiV031tKRgy5DqL4Y5UoZFJGWtzkaUeqHQd2uWqU0GJWMc 4WMqR/JDncG0suGyKxrUI23GiZySC9LO1MSM5RihQSRCiFYbMkzi4yJPc7bWrbB616X2Xp5Ed59A iSB7q7t5S9zY12GRU4NussgKiez3mf6N6BfofiqLU8r5RdhHNiPAUAFxjCqInhyLx9KKt0R/XxwO h10OTSVGTWKIdQ8O+3v393a2+3uHB+Lwvni0t7N7cLwrth8c7e7u7x70r1+7fq0foxlVrakxZBjp IW/Lfajjwd7LR4Ucx1P2Q/CnSg2mYpqXpBkSRhFdmUWMP6ACkGJkAxUaeIa4HBVKEX674n2oxRLg yQe0+aBpZ4Khkk0IhArtVtSfQoUW6Bii+k1c1Ph8pFiEgVHroaHA/KC0MI0wc+zDVkJvmyoowL8u Ra1MGBVnMinlALiUBrhqa3fFScZIn1ZZICffHGwKKcxYhXqow/nMBaqYMUZJV0aRph4DOwWPrmVi F1xbngnngkp0qikhOGG5SV6cGgdtRjEz8wkwUw4SbWLyA1uu3CngjfjRqvFUOMj7Cs064nrsDZvk aOY9LZVhN5iWoSoyn0Hh42ZhE+dlEgGrZ1pN3JCbS5/k0EmFuRE1g7HOEWHxOA5t02NKTPqohxeb 5ZBrBT8tvCH4kfYuCZwcb4sVcWNzfeOm2FjbXFldX129evXkIZira2vr63huvLMhNu7c3rq9df1a bO34bq83mUy6adX4ME/be0KJe4WcUC2wBREULB3lA+zQA0ytHCN+mTZpoUMtxbHkvWFwZm3eeo7t XmzTpJfaTKaql5oPJM2JLjH/S4WJSsBVL1ehTz1fR5ae+bnkgH96KPgrmJxZsUF56TqO+c9muEO+ NrY59/3PTS3e5Z9f/uPlP13+FM/fX+hNz3l7BMp9Lch5tZxZfcDXveqrIn0hmo3gM7yfBv+C9mfg t9eesEab82N+P+NMZlce+58gSr445vzV5HnRz0TQebPzw84POjudO53Nzo8673YedrZmNPsX1vIh vV9aA3+W636qO531celrwd8vfxdXrdmq5f7H0/8AdQJP9AplbmRzdHJlYW0KZW5kb2JqCjcgMCBv YmoKPDwvRmlsdGVyIC9GbGF0ZURlY29kZQovTGVuZ3RoIDMzOAo+PiBzdHJlYW0KeJxdkk1ugzAQ hfecwst0EYHBQCMhpJQ0Eov+qGkPQOwhRSrGMmTB7Wv8SCrVElgfnjfzhnFY1YdadxML3+0gTzSx ttPK0jhcrSR2pkunAx4z1clpJf+WfWOC0IlP8zhRX+t2CIqCsfDDnY6Tndlmr4YzPQThm1VkO31h m6/q5Ph0NeaHetITi4KyZIpal+mlMa9NTyz0sm2t3Hk3zVun+Yv4nA2x2DOHGzkoGk0jyTb6QkER uVWy4uhWGZBW/875Kju38ruxPjxx4VG0j0pPR09x5Ylz0DMo9ZTEoB0o8xQLT4KDMlACqkA7ECoI VEiQJUWW9MlT/uitrx7zm+N7hxwJ+QEO1ryP8IqEIkX6GCHoURzxce0jR2m0I8TN1rJl6EPAawp5 Bssp5CkK5fHqFe6WP77cjPs45dVaN0l/ffwIl+F1mu43zAxmUS3PL5Z8sNsKZW5kc3RyZWFtCmVu ZG9iago4IDAgb2JqCjw8L1R5cGUgL0ZvbnQKL0ZvbnREZXNjcmlwdG9yIDEyIDAgUgovQmFzZUZv bnQgL0FyaWFsTVQKL1N1YnR5cGUgL0NJREZvbnRUeXBlMgovQ0lEVG9HSURNYXAgL0lkZW50aXR5 Ci9DSURTeXN0ZW1JbmZvIDw8L1JlZ2lzdHJ5IChBZG9iZSkKL09yZGVyaW5nIChJZGVudGl0eSkK L1N1cHBsZW1lbnQgMAo+PgovVyBbMCBbNzUwXSAxIDM1IDI3Ny44MzIgMzYgWzY2Ni45OTIyIDAg NzIyLjE2OF0gNDQgWzI3Ny44MzJdIDQ5IFs3MjIuMTY4IDc3Ny44MzIgNjY2Ljk5MjIgMCAwIDY2 Ni45OTIyIDYxMC44Mzk4XSA2MiA2NCAyNzcuODMyIDY4IDY5IDU1Ni4xNTIzIDcwIFs1MDAgNTU2 LjE1MjMgNTU2LjE1MjMgMjc3LjgzMiA1NTYuMTUyMyA1NTYuMTUyMyAyMjIuMTY4IDAgMCAyMjIu MTY4IDgzMy4wMDc4XSA4MSA4NCA1NTYuMTUyMyA4NSBbMzMzLjAwNzggNTAwIDI3Ny44MzIgNTU2 LjE1MjMgNTAwIDcyMi4xNjggNTAwIDUwMF1dCj4+CmVuZG9iagoxMiAwIG9iago8PC9UeXBlIC9G b250RGVzY3JpcHRvcgovRm9udEZpbGUyIDEzIDAgUgovRm9udE5hbWUgL0FyaWFsTVQKL0ZsYWdz IDQKL0FzY2VudCA5MDUuMjczNAovRGVzY2VudCAtMjExLjkxNDEKL1N0ZW1WIDg3Ljg5MDYKL0Nh cEhlaWdodCA3MTUuODIwMwovSXRhbGljQW5nbGUgMAovRm9udEJCb3ggWy02NjQuNTUwOCAtMzI0 LjcwNyAyMDI4LjMyMDMgMTAzNy4xMDk0XQo+PgplbmRvYmoKMTMgMCBvYmoKPDwvTGVuZ3RoMSAz ODk3MgovRmlsdGVyIC9GbGF0ZURlY29kZQovTGVuZ3RoIDE5Nzg1Cj4+IHN0cmVhbQp4nOy9eXxU RdY/fKpu3dt79+1Op5ekk+4s3QlJIJCEJRBJswRQZN8SJBIIAcIOYVWWMMi+iDog4MIiKohKAwED osQNFUVwQQdBQAXFBcEZZEZCut9TtzshoDPzvM/v9/7zfsjNt86pverUqVOnbncACADooBIEaD5p Stmkn16a/A1ApgNAWzdh2PiyN8ioPIA5GQCxhvHDZk7SfKR/DIBgPnjGTSwdBm/fexHA3w3AunX0 +Kkzj2yp8GN+G4xvGj26bJhlvPkFLHsVkYzREUdyr61G/iCi1ahxs0ZW/QQagP4/A6T6R04aNX5G yvbfAJqMBhADpdOnetZO+mQ6QFvsT2peOn7YpFFVPR4GiP4bQNQq4GOnH//84KLz64ea8n5Tx6qB /2z5NiWN07137X7v+s66UXJb9b0Y1WB5ohTAUNU+2BM6yXB9ZzBbbhtJb/gRU3mKmIpBPpSCCBRk yISOAEyvrUNZUSlSheY2IEC/gPtZBUQj7lbFwQxxIBSSxTCYvgCzOYQ48LMXYQqWfQHjHZAe4HWx /ADEWUQeYiAiJpLWAzEM0Y/Hsex+XhfbmMTbUWgFDFa7YaI4MFSH/a0V34WRiKeR38K+hW1SLozH +Fasd4gBtOZlsM5a6QVYh+lPYn4ppj2NtBDjm5EfgvWaR3iNaiU4OUVImN4E21kemW+K8Aa0YhWh r3EuRdjmPYhF2EdvpF0Q3bFMFNKOiMXkXVhC3g1twXyksAD7X8zTEZ0jtBu2sxDz87FeMsYXIB+D 45CQmhAJiFT6IuRSKxxEmonzHxSeN+JdGM3n3DAnHH9kTH9EeIzdGwP7fA2RRHNDF5BqGo3tdiy4 DXcL2VCJdCwiFtGHHoXx7F4gKK/14gUQOFAzuZzOIO5iI6AnxgmOs59YBRt4HNFDQUWojj0Jm4Sr 0AbzHpDW4jxGoLxbIK5BJv0ZmkpemIf61Rnbn494Gtu8qOjDCOiP/TdDms0uKDq0CLEC+7pcLycu G4zPx3Xti33d4DsG6/dDdMV1qUSM4+PB/jO5zPm6k4HBXCx7HssM4cB0uwKcO9dJXofXx7a8ET3c cpPCFiyzEuV6DilDRPMx1EPRswgw7zC240RIiDhEM8QFxBbEWERbxCuIVOwbsF9B0VfUGa6bin6g bojvogxxbIrOhufwtLKe4T2zOdIW7ydBehHGRpDA2+T7hessjmVXfdt8T3GdqaeKfo/lek9+5fPk OtVAce+xn6ArH4OyB1G36infdzhmvh/W0gGwBOkG1OMFXGf5+OoplwvXNUUmuCciNK/RXJsrewSp AJAU0fUF9bReFg10NGzFNkuk4WhTNkE3NhW6CY/AcHYFOgtNoJnYHNNwPlg2QH+CvuoayMa17IXx 9bfRdRyqE2SMWIPz3IHyPAFPoUwnsxM0kZ0gorgj9IMI5H1xB52r8H+gt4PUhPM45Wic9/82/X8D +rm4A23mjtCP4olQCOfzKN8Tqp9Ic4SnnmL6bkQlIk2dTtapx5Jq1QCQJTzbEBOZH9qKfmjNanB9 otHO417A9AHi13BIWAlL2YnQSVIJlfQELFJFwzC6Fm0a9kU/hwUcvH2kkxrp0S06d7su1dN6fb2d cpsf0Sk3Ugn330cRnI/gGuI31KNnSLiP1tw+K+cD2mjEorC+hq436Of78CzS5fX6eZuejr1NP/W3 6+XtVDlb0L7X71Mcx9L6+XP7yG0ct5HcznE7U1/+dtqo/jL6Auoxt8NHYXBkXydGcA+O8ZvI3kc7 jOs9KBSSuoSel6pC2wRLaJuUhfzfEGLoeZz3zIYztTAUjJynTerP0nA66OrPUTEbxkfs2VbF3vwd /qqcowOV8WmknTBPrMV1RxuojHdTZA+iPHHcY1kJynwDrMB5OIXFuB8xHTGEy0RZCwAHPxf4mSis QTnzs2glLBBOob/A62aDWTkv8mEQjv19JQ3PVE55mjgItkg/QRYbgLa2BkbwteLz4OPha6+eBgZ1 NNqJE9CCbccy0aDFcpsUGfjheUUveN2x6BehLFSloEKd7YlleHublTp+sETksVWRhVIffRGuX1wW 2KYUDX0Vf+In2CgOgEG4hzarKmGzNAD3XDRswzaexXoD+FiwXoxyXq+B+3B/LUHbtARtDij6PzhU K+zA+cxEu44QKlFGO8AhVqIMxypz78zCNnYx3z/CC+DjOiKtQTvM/Yk1sIylQ4E0FlZi2koR7ST2 uxzTHsL92xz37lKs747YbcC+l2I6r5vPfRnuI/D9ovJDlFSp+AGgjIH7Kdi/8ANsFu6BJajHHdRr UA4LoSmeFwR1Lx7RIgwlPjeCFWEoaXKYkgRBhjlKejZ8Ql8QdKi3/Azdz+ZDORsIWUILcDIzNGUf 4179HZ4QTDCUHYEnWDWs4HEWBalCAOdfhb4lTz8GvXk6/QTj62Awy8P6S2ACGwoVwi7Uvc9Ay0bi WmM9cRXqSTLW/zu2GwH5FgYLA3FvLUL+99CLvJzSR1VoEAfrBk2Veo2gjLUet42Zdke53YNriuPl /C3jxbE2jLN+jH8yPmWevF2sx8uwJwDvLKHTCG+YBvvQlbADsYl+CZ2EHjCLbEMD8yR0IRcQT0bw EnRT6C5EHzzjW5LZiGasJbyCmI98BtLXETvDcfTdWsIpxEJs+w2ke/i9gIN2hFacYtrTiHWID+rz GoP39WfpjSHGwq3xvVDJQa6G6jhuL49yboX9tWJ3oTwRqIurOaR5MFg1HdcvBdPjsc3b4thPFtsL Y/7beP4byDForsgwDH/jOdavB1Lb/wCnG1EPp5Gz4f9ofP8b4PrOQxQr8v0FoiM6ZCSfQyLSgUgH CtNgJgfGm2K8qF6eBG+/CrbBY0p6w/qF01FX8EoJd92efnv89nX9b3G6B55tjHo9aNCHR+EhDpaP 5RG3x9Xvw0Mc0juY984f4+z5/4LBkCZsUMYEio7dFpd64ZmJoMk41hilzgqOhvgx3MsIXlapb4CV HMreRdAqKOdoyG+J9hvRSK6tuFyxTyW/fn3q1+X29cHx+dlHiMF4VnwEzZH2Q9qhnjbod8Re3KLz fcL63hDntuTCbWVu7ombe+MYP2v+vM3/PwH3zhHEu4jD/1/3xa0MtxEytxOn0Q/JRz/yBPon98EC gDq0JTcyEc+hHeqP9AtMw9M72ARhQN6MaaOQPgVQ+xvyUzD9RBghymJhU8SvdGLavkhddaS9fuH6 te8BXEeNur4zXL/2BcQY5H9FzEH+K6RvIF2H5X/Eeg8hfTOcXzcU49MRBzH+E8bHIQqRX400GmkG IgphwfprObg/8od76P91+uf3j/8pRZ+lFMfp5u+8kM6+/Q7xP6b16/lf6O13jfr1/2+00TuD22hY Dnhn+gb9vkDju89/uuPUU1zPYGOwAaE69Cn13I/mviz3nxX/MUKV+5vix2K/ANZ6yn1n7r9y35n7 r0g3I10iicp4BvB7Ph8XKEeKApeyIUDTF2PIaQuBaVrxd7T8NSi0gblkHnmYPEo2kwA5TUK0iL5L 36dfCUQQBI2QJMwVlgkrhM3CR0zPerEhbCh7jD3OnmLPsD3sVXaS/SDuF98SfxSvSnopVnJLbaW+ 0lhpvDRZmistktZJW6Xt0k7pQ+mE9Hv8wvjfPSZPtCfek+jxeZp5mnuyPW09eZ72ns6eiZ55nq2e 5z0vJogJUQm2hMQEX0KzhP4J9yesSdiWSBOlRFOiJTE6MSbRndgkMT2xW+KwxLIkmiQnJXjBS716 r+y1eh1elzfZm+HN8eZ5x3krvQ95l3hXeB/zbva+6N3tPeA96H3b+4H3mPek9ztfns/v6+gr8ZX6 RvrGXhQvOi62vUKvtKiltZ7aVrV5te1rO9R2ru1VW1Q7p3Z57Zra0I3hdfl1fw/eCN0IhfgbcNik SG4T2UmOkusoucMoub8J0CC5h1Byq4RnGGFG1ofdz1aztWwD28JeZtXsb+yiGBBfFY+LVyKSS5D8 UsmfSu5KfGX8Jo/eE+WxezwouTSUXJYnNyK5MSi5Z1ByL9wiuX4J9yWsbpCcGSXnTIyPSK4kcYQi Oc+/kVzvBsmt9m7yvtAguSMoub+h5No2SK7MN+YiUSRHrrBagpJLq22DkvPXdqrtUjuw9oHaZbWr am/cuL+uPUqukksu9C0q5pqQlR6hrwmZodP0Q9wRJtTIR8kMMpZMubEJ4+VcZ4PpwbRgk2AqsrPh AZgO42A03Avtb3x14/SN4zc+uHHuxic3jvGSN9bfWHfjxRub8XnsxrwbD934y43yG9kA3xYDfHM6 /Fb/3ELEmq/vO/fQud+/3nZuBsZeQaBdPbfs3Jyvp50dc3bWuQPfZpxbdXbb2bVn1p7ZcmY5wJnn eN2z9jOTz6BlPtP8jP9M9pnk011OF5zOO517utXp7NPNTzc5nXg69rT1NDn1y6mfTl08deHUN7zW qcOnDp16/RT2cuqdU8+e2nmq4FTHUx1OJZ9KPJVwKj6mJuZ6zNfy6+jpva56TvWU6knVE6oNqvWq dar3VS+pNqs24vn1g9RexNupUMr3Lml16+cU9LswbolfEWz1cWEE/IcfoSdamj/PWYV4Gj2inqwv K0E6vHEuux8xMox/98N6c7C+kVjP/zSO22r6WGoDn/wfS2r/bc69t0QFeAYegoXC/bAWvoNFsAqW w1OwHbaii7AMxboAHoMr8CushMdhCbwJp+EyPA0vwD/g73AVtsCL8B4chpdgOJTCahgBR6AM3oX3 4SP4AD6Eo/A9jISP4Rgch5dhFPwCj8Bn8Al8irr6A/wES2EMlMNYGI/aOwE2wUSYDJNgClTANJiK Oj0DLsJM1O5Z8CDMQT1/BTbDPJgLlTAffoSfYT9ZSx4nlAiEERFq4QZZR9aTDeQJqIMgkYiKqCFE niRPkafJRrRFm4mGaImO6MkW8gxcg3+SreRZ8hx5nmwj28kLZAd5kbxEXkabFSC7yG6yB/4FJ8gy spxUkb1kH3mFVBMDMZL95AAxEZmYiQXOwdckiljJq+QgiSY2soK8Rl4nh0gNeYO8SezEATshQJwk hrxF3iaxxEXiSDx5hxyG3+E6fAPfEjfxkASSSN4l75H3yRHyAfkQbeZHJIkkEy/xkWPkOPmYfEI+ JZ+hh5BCUkkTkgbn4QI5AZ/DWTgJX8IpOANfwFfkMrlCfsWz6u/kH+QquUb+Sf5FfifXSTqpJTdI HQmSDDzHgBJKqUAZFalEVVRNNVRLmlId1VMDNVITlamZWmgUtZJmNJraSCZpTu3UQZ00hsZSF42j 8dRNPXQFTaCJpAXJokkkmyZTL/XRFJpKm9A0mk6X0KWiLJrpZWG+sEBYKCwWlgorhYeFx4Q1wnrh KTw5nxW2CzuEl4Sdwi5hr7BfeE14Q3hHeF84inv1Y+GEcFL4SvhauCD8IFwSLgu/0l/p3+k/6FX6 G71G/0n/RX+n12ktvSFoBZ2gx9OF4KS2smfZc+x5to1tZy+wHexF9hKeKjtZgO1iu/FkrmJ72T72 Cp4z+9kBPKcPstfY6+wQq2FvsDfZW+xt9g47zN5l77H32RH2AfuQHWUfsWPsOPuYfcI+ZZ+xE+xz 9gWeUifZl+wUO82+YmfYWXaOfc2+Yd+y8+wC+459zy6yH9iP7Cf2M7vEfmGX2RX2K/s7+we7yn4j 35Lz7Br7J/sX+51dZ7WwC3bTZSQH9sI+eAtvR3ugCt6Gv8AbsBhtUS+hr9Bb6CMMEAYKg4RCoZ/Q H34j39MaNhcOwnq4hDvzWXiU5MPDpAOZTh7B8+IxMgOqyWxyifzCJrMpbD6rEIqEwcJ9whChmD3E prEZbCGbzhaxWWwxW8KWsmVsOVvBZrK/spVsFXsYT+RHlDP5CfYk+jRPo2ezjq1nc9hGtoltxpP6 GaGl0Er4h8DviBJA/QfFhGJAbzM7mCkwUVKpNVqd3mA0yWZLlDXaZnc4Y2JdcfFuT0JiUrLXl5La JC09o2mzzOYtsrJzWrZq3Sa3bbu8u9rn+zt07NS5oEvXbnff0/3eHj179e7Tt1//AQMHFRYNvm9I 8f1DS4bB8NIRZSNHjS4fM3bc+AkTJ02eUjF12vQZM2c98ODsOXPnVc7/y4KHFi5avGTpsuUrVq56 ePUjjz721zVrH1+3fsMTTz719MZNm7c8s/XZ557ftv2FHcKLL728M7Br956qvfteqd5/4NWDr71+ qOaNN996+53D7773/pEPPjz60bHj8PEnn3524vMv/nbyy1Onvzpz9o7veMd3vOM73vEd7/iOd3zH O77jHd/xju/4P/Md/R06+PPb35XXrm1um9Ytc7KzWjTPbNY0Iz2tSWqKz5uclJjgccfHuWJjnA67 LdoaZTHLJqNBr9Nq1CpJZAIlkFGQ1KXEE/CVBJgvqVu3pjyeNAwThjVKKAl4MKnLrWUCnhKlmOfW kn4sOfK2kv5wSX9DSSJ78iCvaYanIMkTONo5yVNNBvcpRH5l56QiT+CSwvdQ+NUKb0A+IQEreAoc ozt7AqTEUxDoMn30soKSztjcLp22U1KnMm3TDNil1SGrQy5gT5q0i9jbE4Wh9oK2uyioDTioQExS 54KAM6kzH0FA8BYMGxHo3aewoHNsQkJR04wA6VSaNDwASR0DpnSlCHRSuglInQIqpRtPOZ8NLPfs yqhZtqJahuEl6foRSSOGDSkMCMOKeB/mdOy3c8D+wHnHzSg2bulUuLhxbqywrMBR7uHRZcsWewKb +hQ2zk3gYVERtoF1qbdLybIu2PUKFGL3fh7sjS4sKgyQhdilh8+Ezyo8v7KkAp5SMsYT0CR1TBq9 bEwJLk3MsgD0nZWwOybGvz90DmIKPMv6FyYlBPJjk4qGdXbtssKyvrP2OP0e5605TTN2yeawYHcZ TRFGb2jMlDXkKZxSnHPd+zZIlvARJd2NChHwlHpwJIVJOKc2PChrA8tK22Ax/CkiWCswAlekPKDp VLJMbsvTef2A6EUfcdlvaNtLki79fGvKsEiK5JV/A85yPWlQNcyv5wPp6YG0NK4iqk64pjjG9kq8 ZdOM6dU0KWmS7EGC4oPeKNthRW0zUfwJCXyBl1f7YThGApV9CsNxDwyP3Q3+zPSiAC3hOTX1OdED eE5lfU5D9ZIk1OQq5dYXHVD7Gn5Nsi2qYHTbALH9h+yycH73fknd+wwu9BQsK4nItnv/W2Lh/DYN eREuENWpUIilEY7GCkouKuWQhsI8UqgPMC/+SopSj6hWqVErlRTi6RKQS7qFwyJtQsL/sFJ16Aqv pZCb1SLDDLRNvzXe7pb4LcPTLxNwwMxHu/cfvGyZ9pY8VLVwh3dHCGo89C9M8HQKwADcmV78rQ7V tOEoig34UWSdeAHUv3BSJHpLwdgIX4Q/XDubZnRBQ7dsWZckT5dlJcuGVYcqhyd55KRl++mb9M1l kwpK6hWnOnRgeWygy4oilNVo0rZphyQwCXa4jAghBHBjmInohRiKeBixESEp5XjKRMQ8xCHEFSXH L9h3P5rtr0ayXCF7xozLUqLDwtEhxUp0z6CiMO3RJ0w73x0u1jZcrEVOOLlZxzBNyQhTizerklOt Iaumgw1d9+MICpMwJPRtMBECbtgkREMAQQUpkuIXLHuSfVkbDwkM0B0QCLql7lCNQHYbzFkdtDRE L4MF3PQXeimcQy/tMZqzNna4h34DOxGHEAL9Bp+v6dcwj57DHWDCMB+xEXEIcQxxGSHRc/icxecM PYOlvoJMRD5iKGIj4hDiMkJFv8JQpqf5flJCzucjKD2NoUxP4bROYWiiXyL3Jf0Sh/bp7ta5WfsV Jj0zwri9EcYeG2Estqxq+snu35u4q+m3ezzp7k0dmtPPIICg2Nln2Phn4EH0RpQgJiEk5D5H7nOo RKxGbEIEEBLW+RzrfI51jiA+RHwOzRF+RG+Emh7fjd1U02O7fR3dHWz0I/ou2FGoR+l7Cv2QHlbo B/Qdhb6PNB7pEXp4d7wbOugwH7COjFRGmon5In1jT7LFHepgpodQPG4MMxH5iF6IoYiHERI9RBN3 j3BbsJFX4YgasORu+EGhz8EWNfjHuP2+TqhjHh742t6FHAYbPRt91O9bux6jPPCtehQ5HvgeWoEc D3wPzEeOB75x05HjgW/EGOR44Bs8FDke+Hr1Rw6Davr0K8kp7ta9xhJPBxOdgVKagVKagVKaAYzO 4A/8zvjYntidloYS2+BPb5LmrjxAKg+Syr6kcgupLCOVc0nlfFKZRyrvJ5XppNJFKuNJpZ9Uvkra oCgqib/qlmiu30Eqj5DKl0hlBan0kUovqUwmlR7S2l9NE3bfna2QAoXs6cD3FdK72meZcIwJKNEE VOsE3PaHMDyGCCkxPxbyJIYLO+M5TdyTlh+ON2ubNbFDN/oWVnwLl+EtOItguEBvoRq9hY28hQ2Y MMxHDEXUIC4jQggJSyfiwB9WQhOGmYh8xFDEPMRlhKQM5zKCwsTIEHcqA8uMDLoXj9G38EnEJ4Em +ONkl5wudxMedhFTPOkVH4qnrcHGb/kWs9qMt7V9/zT8658G0HTQ0FX0YYjDhVgdoQ/v/j3OXU3W 7fa96u4QTR6HeIZaR3LBR7xI20CFEm8JLjWnOeCiO5Bm7XYNxGqm3b4M9wFi5LX2uX93nXf/4Kqm yF50ver+wlPNyG73CUzZsc/9mWup+/3MajWmHPRVEyQHPErR/a427peOKEXnY8aG3e65nOxzz3F1 dY91KRll4Yz7KzDmN7n7+ga7u2F7nV3D3f4KbHOfO991vzsvXKolr7PP3RyHkB5m03CwTVxKp0nx SoMDWleT0f4M1VpVoaqXqpUqS5WhSlC5VXGqWJVVbVHLaqNar9aq1WpJzdRUDWprdeicP52/ALZK Mif8OwMEmMLLlIf8XTG3a0RN4R4IRAndafd+HUn3QE0pdB/uCVzrl1RNtHiAikkdScDSHbr37xho k969WhXqG2id3j2g6n1f4S5CVhVhaoAuqSZ4+lWTEE9aGMtd1f1AiHnhylhOUxeuLCoCh216viPf 0t6c26XznwQlkTD95o/jFj4usLZ7v8LAC3FFgSzOhOKKugce477sfrw/XynovB+v0kiKCvcL7cnf C/rydKF956Ki7tVkoFIOPORXLIca86tSTh0PHl4OPOr4cLkN4XJerI/lkjnBchoNeJVyXo1GKccI L7erIrmg867kZKWM3QMVSpkKu6dxmSNeLOP1KmVslXBEKXPEVsnLBNorRVwuLBLvUoqQGHApRVwk Riky8GaRzEiRpQ1Flio9CeRmGVe4jOFcfRnDOSyT/j/9KeuYnk72tCsqHcLvASVJBWWIksDy6aMd gcrhHs+u0qLIBcFXMrx0NKfDygJFSWWdA6VJnT272g35k+whPLtdUuddMKSgf+GuIf6yzrvb+dsV JA3rXLSna++c1rf0tbShr5zef9JYb95YDu+ra+s/yW7Ns7vyvlrzvlrzvrr6uyp9gaLjvQt3qaFj EbqdCt1DdVrU15LYhKKONnlSe0V52yU45sYeYPyLfTr0wvV4ozMgeFbTDk078CzcUzzLyC97kSzH 3HYJsQfItkiWjMnmpI6QPnVaxTRwFJR3Dv9W4A8mTZ3GBR4O0yv+3Q/mFeC9rXPFVIDugbR+3QP5 6OfuUqkwtYRPKdC2Pk2nK0B3M5zYDBPb8kRBaCjI0/J4mkYTKfjH9Z8WoZ34Lqikr+4h/ngyFSqK hEB89/4UTUH/iFd9AN0lfjxUFOEEK0g6qahvQxk2hHng863H1GkRLiKHqREaroVVKurF0fCDddBU iQfAiYgRnwcn84EDIPQ94iKnwfLQRZ7PKf0RC1dHALANXiLl8BIcgjfJFeBv9vZDFXCPpzM8CbPh r7AYT7HBmLIU+uIjYvpfiTNUBZmwGc+xzXAUyw6CuXAAbMQR+gHmwULhU6y1EAyQCB2gN0yEleTe 0DQYAmfZAmgN98IEmEQqQ4WhVaFHQ1vhWdgvvBeqAx3EQCk+R0O/iH8LnYamWGMNrIez5FHNXvBj L5VY8imYAhuEYkZCo0LXcQQJMAPHwKAHHCU1NB1bL4PviYPMFjphK8+EAqG3sZQLimE0bIADpCXp ShPEIaEeoaNgwz5mYqvrYTfsw6caXoMviV68EtoaugJOyIC7cT5V8BGpEYJ184P5XNAopSaQizkT 4XV4F46TJPIGnSjqxSzRLz4Q+gys0AIG4Gifx5rfkX/SufjMEw6zLqGOYES5PMKlDe/A1ySGZJJe ZCBtQifSp4UpoMYeW+AzAspR3uuw9TOoNfuonh4TnmE7WK0UFzwXMuKK+OAJeAreIAacqYdUkL+Q z8m3tBMdSp+g3wh/ZdvZJ6phOOv7YTyshB3wT2IhbUgfch8ZTWaTxeQRsp4cJcfJRdqB9qdj6WVh tDBZeI11xKcfq2ALxEXiculisDD4dvDj4D9DWaFF0Af1YT6Ofg08jTPbD8fgJD5n4RsiEh0x4sPf +g4gD+Izl6wkW5R30FXYy3HyDfkBT6DfSC3Fg5VKNJa/ZcUniU5Bh/Kv9El6DJ/j9Gf6u2AXEoV0 oaWQJxQJE3FUi4XV+OwVvmYx7BgLoZyzxLXiRnGbuEN8k3+epvoLHukf3nimLq3uTBCCS4Jrg7uD VaGvIRrXEA8LvELl4eiH4TMG13statxO+JToUXYxJI20J/eiZIaSMWQymYmSfIhsIM8qY3+ZHEQp fUEu45gN1KWMuRltSTvSXvjcT8voZPS9HqVV9HN6XVAJOsEkRAtpQlehWCgTpgqzhLVCQPhQ+Er4 Rrgm3MAnxLTMzRKZj6Wzrmwom8aeZt+z78Uh4gfiBUkrjZcWSdXSr+jEtFf1VvVRFaseVu1TfaYu 4W9RYS+80vijDnJOmC8UCHthFc1mTryxfIT6PBRGCD0oairdRpbQOaSKJoszpXa0HekJV/Bq/1d6 mG6k12g7oQfpTvrBGP6XqvxHsjL+l9957C24xA7i3D7ClmdKejKXXpb0sJsofzdN3hGas3ThA/hS OEtUbDOcYlpiJ5fo80Jv1ILXWHuxEBKEJ+FlYTKZA3tpAYC2Vr0C9bgneQHtQn+SRf4lhNDr7Yla 1Fr4FhbAWPo3uIT7eAk8TkawUbAKssls+B6ew13RRJwgpUnR5H1azpbRKFIFlG3nf89MkokgWuEh UixskC7TkzANjjEtnBFexNEfoy8LPdgVsS8ZjTtgDiyCyaH5MEssZJ+QUSCQgeBl59C6zRayWALS eWhVhqBN24e7+wDagQ5CD0xxoObci3oxAC3EBnzWoZ1gqEHluMcHoRX7CKqk/rQaRolGglYHgH0Q 7AuDQ8/B+tAomBB6FJqiPVgcmo0tboML8DBsIwuDD8IkvDmexL19r9iFHhO7hJrSZfQk7UfX3rq+ KG0vccCP+LwMXaC9+CosY19AP8gPrQidQO1ORQu7Hoajf3oeZ/kL9tBNqIHsYE+6K9RFmITzPQt9 Qs+H3EQLo0PjoBcchGdVIgxTpUc6GPd/gPNhEA9i9f8d0CthMOO/wYE/QjyOuotUNeIm1NcANGP+ Aw6HoY2/FbpzAAYrgLEtgGkCgIynpHk3QFQigBXvYNYDNxF9P4BtBYB9E4ADyznxrI2VENhufHPE DUCnGSBhA0DyOgBfIf83E+7gDu7gDu7gDu7gDu7gDu7gDu7gDu7gDu7gDu4gAsq/qCfiAwKooGMV JeclVTVd748CkZ0XQKti5wk41ZJ4ngoHaQvQkPWkGTjS5Wt5dXk95at5PeryIB95+QYGLZonmBPM XgwIMLjhEWpu+PmX7D2shn/W/0LwDFkAR0ELPfdqscMdUjXp7fcRIY9SoiV5oKUCRkBqo2rbC4bC RJgHm3Bwm3Sb12GXV4uvnpcv5cnYIQ/lS3LdJWK25LZont0yO9oqqVJatWq972jvQVm5rYSjRycv 9/VwDrsP+z2AnS/GfgXw+h2Ud5MXbnwnsE2Yv4kp7V8rLr6ETYebO3D06FHl+wmh72mu+CnW7bcf hNCZ3dZcWh064/dYcx8XCBU2CjsFKkwHYuV/AkewnFa4CPQiqSbb9wKwPQ9gy3ny1Usytp2Xn7dY bJZePEd+u0VzUpyeHk2yCdm+OljoFH++ji3QUB2uR5F4AFfDSOL9pZlyc3mUerSmRF4irJbfFw9L NfIVWacWi8hA2lserQvI/9D/w/APo4bpmYEZBZ1WIzKmNxjVkkqlR14t6VU4DY9Kb8UEKggeprdi CU28KKrjJUGqppP8GlDrf/Dzr/gfIDogROe36D1QphL69mbH2FkmrGaEVRPi1/XW16jO6oXVeqLn cdmkOqai81SVKqp6zPT5F8oyTXYi8NeBk45xypcugSM/L+ZS/vk8vnyXuAhQAoubOTjhK5hrzs1d LL/9tvHttxeLYYry6R7Q9eseiO8zuLCKmQS16kDoCi7Hv9rgTxGZMrk4CYWXJCQIUQmCL0VSCTT7 Y1r41Y66JzafJL+u75LoyhYPXO9CDgY708Fk7f4ZK5fjeo4MfS9Ox/WMg2p/SSkdE0c9kGUohUkw Na4SHopbDRvEHcKzhv1CleFdw3E4H/ePOLPREmeOixPSpFRzmsvj7moYaB0UPdA5Whwb96BluWWD sN64wbWNbKXbzCeMUWCFGNkqxzCuKLtTc0l1qMafkporm4Cw2Kh4vRAbzzSyz3QP+DyEkBi33edR E7UzvnSIIx03VXGPSz1RG3tcusr1Mf+S2Y46TtLTi4snQzGZQuwSS0pMpi1zLMnZWcyu8vmSEiUa bbXYsrNasao37wq+deFS8IsndpJOb54mGe0OZb/52PZvh4z/btEz31Da4nLtG2TCJxfIgF3nPmi6 6dEtwcuPvBr8YdlBlM4hVOL5qH0C/HUvoaCmIo59T5u7chSanROmTZuHaWqTME3yhmlcfJg6YhTq zzTIOR5xtbhTRK1DHXwYd3MAWCb4oTechSsgWjyYuBq728I+L1K2YKchhbsrUQOLiyZPyasrrv8M Hvd8Pm5Mc7b50Jt8VXGsT+JOceNYNfDjLouO99cyKjpHzTVcpUZdV1OVIKg1jFKNSs0EjySJxR4d 8eh660p0k3SVOlGn1uCweE091vRgm8XaduFhpHOThkqcJyv2LT8PlZRwLWXN0hfP4drJv55QpfZ3 yRWwgX1dctX+rDCblatKdCpGYp8T2awwy1OTwqZDl5SrMloRUTx+dV8UsnFhNg7ZaM7+a1d0bmTq JPItBh4UoQQICiGJmJ98V6AH3r0RFA/UzmfzrndhlbWVQKEU9fsr8TMwQizM85fEmIhVtlpj7bGx jMnMqrPrYtl2+z7jYaNgtztiqSfOb+4V1cvujykUCzWD5AHmoVGD7UMdA2MGxS63r6eyM14QLPE6 TbTPoyKqmMo4EmfycVk5XY3VtZjrq6Kt3LKhnqKyRsmQkMUs0Vaq6GtrGbKzwJxDUV2hlCwhrT4g XXZUBfcdOhY8sO09EvfFKRI764dHPgp+QY+Q8eSpN4PPnj4b3LT3PTL49eA/g8dIDondQ3SPBS/w vzTmf1FXh+tvAAcM8rcsM4+10u5yd+t98n1WptPHm4xGsDviKddji08d44kh+BvjMHiIstTOdkOU pVYOssnF1/jw+Ulmyc1UjjJSDMXZ5oQsezxuLZqQYEa+VcscX4ovKeFp2uTRHuMeLfol+H5wCXnw 4NPF97Z4KLhUPGC0lO0b/2qwru5FgayYN2RBtAG7GhL6nv2ENqc5BP1PlgqlrEKYypg3paWQ6+ok 3K26N67A3Tm5S0o/oUg1JG5Q6tIoY6rBl0yThRRvK1NOUmdvQeZgz8CkAd5xujGGscaR1jLHLN0D hgdMc+RpyRXeRcIy3VLDMtNKeWHyAu+jhrWmtdHx3mSjQScmuOLiY9UqiQlUIt7kREyTxPjYpg+j JC7ZoKlMPKQ3KSGTyGoi4ZkV8HubxsfbBDG+qSbWF3OPxgdNSJOYrASfhfgs/ZV1b1F6X2Tdz6OB v8VSyXXF5xFXzRZ7LlotbtqJhVsvKJ6MWhHVOp6iiQpLMTnF52uZ06pVdpbNFrFh0Va7jdltNjzM JdQY35BXDEPfmzPxhX69h7QLjutTPmru3//6zO+LxAOml7YHNue2IScLKx9YVPvUu8F/rCdfyBNW DupY0blgVJJ9WHrrZ8omvjGi/MP5xuWr5t/XKzt7bGq7vdOnHauY+gPOoTn/ZFM5ZXv5DSKNR/GA 8mdFmmpasccTPuxekTyEZqJHgvxeoigNz1XvWx/WG5QAmofzxd/Jik+SX+8AtUyITjDTqGAcWxaM FQ0vvXT9H9yTWB4spw6lzzZ+NxPSCZVFKR1UFoFSlfQyE71KFy+qnxpdr5dX85SWkQs3HmVOiE4y Z0cvJytPngyWq/qs+f3kGt52SrCcVClt5/hdTExXSbJA04FYJFEk9GUmeFXwouaJwfx4/pN2SUJL tCktE0hVsOLkSbIyWL5GSlmDe+ye0EXmYu0hFVqTOP8qjUGT5jTEpDUxpKXlGlpFt45tm3Z3WrGh OG2MoTytpPkyw6ImG2xPxGw3RD/nfCF1n/PV1Ledx1I/if4qVd3ZRtx2tyM9Iy0nl+Vm3M26ZQxU F6WPVJenT9cv1r+v/93we7q5dY6RMDkzOceelWB1DG0ysQlt4so05hsfNm40hoziRuNO42WjYDS6 BHs1fcFvc6yxulwqKEjRZrkEXZNh8jDwJiRX0/v8cooffLLP42vu2+kTfS1yuaF3xyflNM+tyaWb ckmu3etIzEw+JB2TqFvKl6jUog3KfTIqM5r+9GvFl1BWFy5wxT6ff6nuPGpzJuZORqootjmi2WRy MUz2co1V9Lm18rTMSeEarUppTxUFt0VHW232JJ8gqYxoT/hJjYWEvBH7x+w82LWiW8uxX44i2QVL 5s2KCzgmHF+65IXessaeeNBlH/72xCFZ48tHb/HFLRjQZcfCnvN7Wo2GmGSvdkLTu4omOyYv7+4f dk+zmVdqF97VhnyV6pJTe2R2K7mv110zcAUX4QryU1JGj+dz/4tE1JuSxZZigSjmuwNu6najm+Tq 6JrkXu2W2kbl2fJi7rXdG1OsLjYUmopt98eMUY8zjDZNsE2IqXGf1H9p/9L5TdTP9p+d38adc4fc To+Yacq0NhfzTX7xXlNvcaT4Zdxv7Lqsl6ONTKIQ65JURBvtMuocycd1RNb58fCt1DHdVDzGIFvw UlpD0PZsIgFyhTA3ySe9iECc8V1bh20MegE95Lqr3KpMVmwM/ppzFa8fJY/ZMDkBt4QZzQjaaRmS ElMEtCLZiqnGBSBNn6+asmv4zsn+4N9fOziW5gx4ZPqLz06b/qJ4oO63h3s9fKQieDn4+VNk7aEB y49+cPzwUdxNvUMXhUuo9TFw1N9VoyduV6eoTvZ+Uf3sJVEl9ifoE8IGw1Z5a4xebXBqx9ByYYw4 TT/JUGl4Tr9Xs0+7V6+36Rfpv6WCMXGoaaJpnkkwEa6sdzdXPJ8SdDZXoyt0Dj0gDZhMOjRGFpdO 5XAxnctETMnGxFgcRbIu3U0IukLkbld08jEVcavy0ctuEZvztmIfJl/CYErkj472A+F/5XNpytVL UxRLjLpqzs2U0RwXn683v+g4opLiCWzhRrfB5nJhCXm74i6//GXwn1N+WPrSafdO57zBS17Y+tCY VWSh/ZVjJI5oXyR0/s7NsWPHvfXp52/+BTWrC0rpLGqWWdGsHVrKDF5DjqGzQWxpbekaRPtr+1r7 uUbREWKZptRa4qpxfyaeiPrKeSHqgvWy/SfnBUWDbG53egxXu+4xXAdVzWiyoZmtLW1p6E4LDF2s d7sGaQcaRhkuSN/brpOrRplEC0YdutKxKDEzoGoJOkc2Aa/Z5JXl42Yim/3mEnOlmZmnWpIP4e3k rCqkYlx2vVSCyhmf0zuiWD0uoUopt8i881xkeRw3VYtv6oSWfFPjrg4LDNWMWG+qltCm7O15J6aN +WxBydrMPXWeF6dNf3bbgzM3L3p6Re0zG4mwrE8HarzehVo+PPLG4S8/fBtl1h13YzxqVjTK7Ix/ hBtc0XSAUCwWawboyoSx4kRNmU4tg0xkmmI5KV63XotRtbC0dbZwdbD0iOng6mMZ4uzrGmYZHzPM NVOaGX2NXnPIYCMmg93e21Zim2QTbC7TanmTTGWZxbq0KuCKpyFrolC57H4Dt4GalLScgIEYYtzc Wff6cjj1x3HL6CZuW7acrPInp+U0EllkL6b3qDuPrlJ6+rXJ6YqzV3deUTQ8qibnKfc4LjvuN5HJ U+qVLez0WVUJNi45kuBT7KJw/4GMX/b/ELxMrKdPECO5cVG7e2HpirovaR99m4FLZ28nA+3PVBE3 2gI9SQ2eCf4ue3YeGE3WLOo0+jl+4kWhC1iJPpUd9vjjrRpicmY6mzv9zknOJ/RPGrYb1DGGVEPA WeNkTj671Bh3TpzaIOhNLi2JpunWKCZIoN1oJdZQlJ/ZvQwE+ihRbgN7WrTJUW4FWpc7ZzX29YzD eZAcgAS4RrTgwOnjtQRPfzxD0f+5VMyP/jx+ll7Ce2yL5p1m+a2yWdKoJDUeKbLGEgtmyRRL0JFP mz+fpKNiTeGnbXbLnNbc+8F9yLdhdDYe7bs3boyKWTD93iGxbbL6dj52TNiwYvLYnC6DLE9pu5QM X3FjJOpQx2Af4UfUoXhIgyv+Ep1OtGbovNZ7dQVWSRPnjMvQ+awZSbm6VtZ7dF2sA1WFutG669rf oo3NkjJS2ie1T7k3ZXXGpgxVq4RWTfIzuui6JBQ06Z/Qv0m5qjShtElJRmXGlykXE35Jupxittuk 6Gq6qyrVFaVSLJjsQdeJ269KqIHjwLVrjr+D6HKZtAWJLr3WFp3tzdZ6HY7jdiLb/fYSe6Wd2aea iBcS3cmHTMdMZ00hE3Ob8k290Co60zOmJvANmd5T2ZBXuQM5mTtV1/hLHn7qFp/nNC9yqZhst9vs 4bMzBbWLhnemHb0XxWP0RTXaniN36rI6TZ2zxGEk0wOnrkz4eOXBB54rO7Xp9R/XPzdn9raXHpi5 rTCmjzdrxODWgeUk76t1hKxYV3ljzL+OzdwhpH1cc+jDtw6/hau/GEDg3+62wq79YEO1METbc7ys pVAgHDAwgf+hS7LdmWNXm/VmqyASMLlElVWn1Xs1/uxWOSENqdEQTU8b1yh7TqucgO2KjU6ybbIF bCEbs1GrN3wHjcbCV/gbJw9K9hww6BndtXfY0kduo+kopHTlNZJyBqJrHVY3o2RUeY2SPpYY1Kho wK+M8yG9mKRnh09G9KjNSWZFKlK0eXHV3JrpL3evmja298o8PAb//mjx1ifrhtLNix/st2pO3auo Y0twi+Up7wFUMMdf3EuzWrNJE9DUaM5qrmhUoHFrJmkqNRsjSec0IY3WrcGzSsWooJGEuQQkUWJa SeUVQfnj/wCrYeeYVMOuMArMw45jjLGe6voZ4l1fcaHzL4XfByH4kk+ZHNUyO1rAWSypqqpiPx07 VhvNfLVfcguwAIPWyhhX7AcRt23rNuHXDzktw7R5izBNDL+e8Htx3UyiW9wonhVZLwyuiIJbnCRW iiGR8X8HlArhpeAtKUsSg3t0I5AaPKhpo3VhDaNOTw+PW1HPKco9nYt8QVXkHQXqjuTDvZoEh/eD JvQ3fwedAXXnPDuv+dp+wSOeEK95qF3tSdI4Yj0aQUiKd0nRLp0OnSYpKcYpa497Cf83g6jXbo8x elebibmaFO91eFfHkljk/E6g2Ulecpx/uXMTUDfkQy+UiDPZW01m7knoWr+30IuqO48m/NLV4rqe BWWdv0PHiVstFHkPPAL5KyYu+HqF0lujfFa9OZZYDNH1CsXtOp9dtHJls/MgrFWK+WqsX5uznhsz /XH33CNPv7AnaUj7SX+tKhxx7/y2zLem59DhhQd27qtLoU+NG9p2zda6x+numTN7b3ik7mRkp32H 0rLBh/4oUZCi6Da5Wv5W+D7qinAtSmLVoSv+FijAWTJZJx93nHOEHMyjthqtNgtuOSLZDFqDUW9M 1in7TkfwV9fToSwk33eOKw46ybHJEXDUOJhDoNnRtsjWs/xh69nrt93VvPBdADde+M6EDujNnWeT zBqtWqvSCpLsM0vGWGLSWiICS5vPTVZ68WRFZpFLQCOBLd4y7auSzb1lbVXa2G4VzzPf4zsLJvXI mlNXQRdNGN/h0Q/rDqLWdUaPIQVlYgAnvOEvtqi0Tn1XqZt6oFSkHiWVq9U5cltLW1tLR4Hc3dLd VuAYIg7R9JWLLcW2vo7x4njNCHm8ZbxthGMGidZIouE+ob/YX3uffpxQJpZpx+m1dhdTmVHlrMkq LoqoZG9OcxUBlazy4OHf4ixXNEx3cvcAeWMy+LEIVzQKLWK4a8Bfl11Ct6D4WnFxesM7IO4/dRpS 6Nf0E/tphovDNYwUF0XJrVESEL7fQ2Nr3Xnr0ndOEduDPy0/G7y0f/fiRbv3LFy8m0aRlFXTg1/X Hf3pLySeGD784MOP3/ngCHa9OFjOElAuFjwHj/mf1ctN5bvk7jLL9wQ81O1pok+Ky4rOiusYN8mz 2qNua28be4/9ntgi9X36IfYhsWPUY/Xl8nj72Ngaz6fWrxxfxXwaf956Pv6cJ+SxJbF0OT26JWsr d2H3yIPlC7qf4oKyzmxE34pfZyQbXmfA6Ew+riWy1q8t0VZqmXYqicqm2RYvwJ9eaNx4oSF/dqNR rjTm3MYXmqj6TWaLtlJ+rKWYhUaiWry17aOjlxwfM+3sg4MfbmZ+bvrMHc9PrdgVLBdfW9anz4rQ umeCtcvvbVtXK2w9+vYHJz448gXKq1uwXDiH8pLBBa/71+loOk1ztKPd6Sy9lB+d7+zuXB2/KV7M icqJzY/vHNU5Fq87saVRpbEl8ZXxn0knLN9JP+h/dMhNaKI+PTqXttTfTbvoB9NyelJ/yvGt7Qfn d7E3qIkwgzUGPXOjZEWHE4x2YzZwv9xEZJPfVGKqNDHTVPOf+OVx8bd4AmE34GreH+UDk4k5co1p FTn7b3HKM9IeH/Ba8PLET+e+M3lLXcKLMyue2zl92jPBcqpu15M0I6pNwQXPrbreSXjp6NG33v3s 83f5WbIQvcnDKB0zLPC3y4wiMiNJLId1Yv3YSDaVSRqzWqPWGKLMGgMIaqJT1AC0mtTVaqJO9ESR KJpo/rfnuKXr2w3nON7Hrk7B+4YyKf65h3Legfz+YiN/rQzFU0hxvZENe4YqtBULt7Qvz7/v/vYd O7a73xrPfJsnd2v7fErX/JIpdZ/x8efjXWwXjr85Oel/kCVaE9tq7tF0Th6YWJY4W7NK81Dyc1E7 Mt4UDBp7jMPevHvG53Yxlg6gVM4iWscQ9RDNEO0Q3RD9EMMY9RjNGO0Y3Rj9GEOVryrFxN/TJTdp lTxYW6Qb4RuROjVpanJl8mPaJ/WPpj6esab5Vu12/TMpW1P3+N7x2eL4621LfO5gdYpXr2UxHl80 0zWLi+Guo8vtzHf2cg517nQec0omp9s50XnWydzOh53U+SodgHci4B6mTPyEyuQ4oUBkQvmHJ3us thzlQ5R4ozmHkGZD4sbF0ThXtIq5muncMSQm2emPcuQ4q+l9u1XJaVjyFVfu8TSSFpPFa/nwvlOS VZNF87Mqs2iWjDfqZPAkmxLPAuHHJQVni/orzuQe/JO6KT0Vo89vOVfTIxfqyXjRSUdrPkXZuFPO h98CRV4C4VHgT2kan4SuuM8sW+QoWZASDZ5Y0KSqYonYFIN4K0YTjEmxkJhk0KubaGNJaopGK6Wz WHDLcfzQ4B8U5oUD5aV/Wvr8+dyPm8wdoeKo1rawmqf4Upqh59uq9R/eneLDX1YrrnD+btPSB2fP bOl97PD6Xh3apD3Sb85rg80BfUX57DE2W2bsQ4ceH1h+eM6xk+Qu19gpZZ3vSnJ4s+6e37PrrFR3 ercHRzn6DunbOskVF6VNzu4we8jgjYNe5JqWHPo7TRPX472rcj9o+Yc/vhwNl3IHZCqd6APqDVoi gE3WpJu0aCoFnUlOhERisHj1JKRSF2gKSlSTVJWq1SoGeMZsUgVUNarjKkl1gI4BB2m1a2R4sygf 9qLfe55bgUv8RSW3AubsbPn98IenXnv4ds7vUubWZn5/snIRUTnm3rzh4zIeemjP3r1R6anxmzfK 7cu20NIVRDUuuHJF3WM9MmIUDxJ3zTnlbzlf2w8x/GaMHiL1RNlyTNzVaGKx5qRHkWR1lE1Pomw6 3PBmnA5k27wOu+Ji2EmNndh7xijbnrsYMVdi6KSYTTGBmFAMi8EbQINBQO9Y49EcR1+ZaXo6Gxz7 S/XeBVoG5e1WXtgiKCoVw2SjwWSgkkotqUU1+hhMHwsGtTkWuIeRljYfLSLqSeQ1RQqKAi9CdkVN WnFeyJ994v5nesm6Kp15Qp8+q9pVPVnVbXyvlhX00bo9K1t07dPv4SU0F91pAjH8loOy0JL7X2mJ l5hEc66W72aDOVeD7lWOmge0OvTjHqQkQrHE3/ya+IQcSMUAYxf9GvS2wYYBxr70701tlgMeDEz6 JpCq8WlzoaW2G3TVDiQDaZG6UDOSjKTl6nLNTJhBZtBZ6pmaGdrFZDFdJCxVLVEv0zwF6zSPaF+E LdrX4BXVLu378I72Szih/Rm+1dbCVW2GFkStA2zaVPBpW2t7gV+rEf0WW47oR0dRq1KrvRqtVaPR 4vWeooG24hVf1GrRdKvVlBJJpdUIQMRMPdEnqv1+P95qqKaaxO7147WAisj5NR7qJ4m6Hz/hS3Yp xllXXFcc47h0vjj8wiMXfUK+Zfm7I/7J9uI5yifbyoeEuKXRD2r8t8RQnECyo9B7bh2VTcjLwXGv n/e6Hek/7w9OYL66h0ZN7D+dLgnfbyQA8RVcEQvd5ZdNVpLGmmjpPeb7zKvMgpnrp8adkCO74lL4 /rvif8mdnMMkvSZKitU4LSIDJuk0OqPaIkOUYFW51LG6OHTevKo0dboxB1qq2qrbGTsLXSW/qoe6 u66Tqav5Hst9pr6WsaoR6lGWWdIDqqnq/dIB0z7Lb1KtJlVnToVUQ4ox1ZRiybS2gdaWGepF6nXC 4/rnyTa6Tfecfi/skw4Y32OfSyc1F9lF0/eWq9J1jcsiiCKqsErUaLVqnV6vlc1m3F/d94hg8VSH 7vaP1JqMnrfMKrVHZbZY0vHyLIoqo1av9xqMVoPBqDabTOlatRWrg9iwikCJysLUJrPeaNCatUyw GPR6tVql4stqMfFP/7TWa7KBlBj4q1nBUE2e92s9vbRkonaelmqr6QC/ppeZTDTPM1Mzj+lkkZQo 90EBF/75veRa1LWRyrHg7HG1uNiBZh9/uQIUO75rWHU58ljCN6jc8LcZMFzco7Ey3EpQExYb5bdV RjmPg/Mc3QPufoVVBo/eQw+GzgFBGEPHq6C5yWOpDp0jbSI/Rd0DOf0K94M6dHyXqjlREhL6dQ9k K2+C1aFzu1SecKol8g2K/byhfSYPb1tdHTq+W9Wct7gb2tAD4Z4aGm+oZ1fqmUPn9mg9zAM8Aw2v 8lf5xtBn+yy5kIGoDn22K4p/Vl0UvgHDZPTSuJIrOh5l54qeJKQIpHvw1QPb81n29v0bW961b2ew 6tXtTb5ApX/ivPkInVC37oOjdGTtl3T23hvH+L/4gvboV9R+mcx4xWQhpkRnrsTt0T5n7mDTWrZW vd64wVQj1kg1qg9MGpPflhsjRGmiDTFyS9JWN5+s0qkzLYNYkapIV2h8nKzTrtO9Qqv17+mOGD+U vxROaD42nJIvaC0WSRJUao2GSJJGZAKeViY0ugZiMhlkHdpsatAJelkrmahJKx+Gwxoqe0FjBdAI 1HDYQAxevWDV6wWtBq/vVJINqIWg7WUhlrsNc/WJWtMwSTPXr0VD8opf6i1VKl+46eQ3eoS5NLEX TvRu8+ywd3g1bFvQtMgX5KuXviu+RcWU7w1FFIh/fwi4rplMi9WK4oRDJFyb8tR54XWqMjricnXK Vw7icvWJ9lwBweO7E3Jl5QVndC5JTMjV+F31Xzbgq4geB9qtYrRP2XZuqVojhytITOSh4Pqvn2nm yvDu+SL4CFn+1Zdtgz/QVBL8vWvzjtm1QX3dR+SeomAxt14JwT7CL7h+MWTxHpOLmPgotrpyU60D TTu1gt/gR4F6UpvnyDxQ6TUWm8FhSdGl6FMMrfStDC2N6826VEtqVDdbkaUoqii63FIeVR49S5pu mGV+wPpA9ELDMvMKy4qopdZ12m26g/Kr5gPWH7XfW38z1Mm/W0OueDQBehntCVp+pzUqymvRWjFi 0qPB8Oq0Vp1OG2Wx6PU6SXA5TeCSXTTTdchFXdU0f68pym/xW6tpf78u3+K30KGWQxZqqSYd95lI IhTEanmWxeTR+f0efXN9L73QWx/SUz2W2JNpwsnS/KpYz2w0HjFOuY5/FQpXlX8TyiFfPe+Uz+PF L8YhX1I4cHDnpn6J1fyLUSKusTGyxouVBUXLYMQd6cAd+SroQxdBF7pIGu1Ha+jMvta52sTWuUY8 hPdG55oTw98fweVUtiSuZ1RK+MUpPjePILxdoO8wz9ouI6+b3ewTdcHxb36VnuhO/7YqOK5DcvPZ A3OCo7bLqcmxY01xLLVu/bT5s6fTsbXv7exY1A/wp4vA/zVi/r/qAASVkPME/Yj2EZ6CUTwD9f/7 zv1iTYRnjcqI4BB/ifASGKX4CK+Ct6WMCK8Gn2p2hNfAMsPWCK9lbyo9c14Hw43NIrweRhpXR3iD VCVdifBGGGK81vDP1s8z9YX6/wNdNP0a4SmoLB0ivACZlqwIzxqVEUFvuTvCS1h+WIRXwXDL6Aiv hqgoOcJroMCWHOG1dJjp4wivgxa28givR+dyQ4Q3CIMtRyK8EZrZ+PcXCRNwbHpbrcIr/wu7Xafw Ek+3xyq8SklPUXi1wrdWeE1kjcJ8eI3CfHiNwnx4jcI8a1QmvEZhPrxGYT68RmE+vEZhPrxGYT68 RmE+vEZhPrxGYT68RmE+vEac1zaar06ZS1eF1zdKNypzH6TwMp+LfZTCRyFvsU9TeGuj8tG8nQhv a5TuVOouVvhYpa9wm3GNyrgb8clK+TUKn6bwzyh8U4XfxXl1o/GrG/Wlb5Sur59Lf5gFk6AMRsIw KEXqge2I/jBa4XvARJiAmBop5YFOGJuCPA+HYXq5UsKDKeOwfjPkOivpw/4PW8psGJkH+mHOOOXf 2g6XqcC0u5GG+2sBufg0h6YRLktJ7YA1xiHti3VG4RimKrX6YnsViCkwHcMRyhgmYF4ZjG8YyRTs 14OlhkV6CpcvRwl5sAavz1ucABlKLzxnmNJTaaStYZgSrjleaZHPYDSOfrzSYjnmTFVKj1b64lKf GumhQplhqVJ3qpI/QWmFUz6micoYyiNzmaS0zUdUqoyqQumN5/DyIxQaHv80pTeP0kPjUZUr7U/F /AlKfIbS9uhI72WRshOVtsJ916ePU9qeGpFIKcbCkrm93FRss0yRSjnScNulkZRpiqT5Wt3UkonK ukxRJDpOqc9HyrVjfKRWfQ+lSv3pkV7LIzPleWFp3pTCSCzJWwun3pRreUS6EyMzKVfKT1NiN1e1 QtHYccro/lwn6ndORcNceN54pb2bbUzBfsZGRjssIv9SRac9Eb2vl9kIpe9RSmq4/gzMKY+sIS8z Dtc+rCMTMRyFedMj0g63cHMvD1PWKqwdHkWGpZH5lyurNk4pM0nZZ2FtnKDUDM+ksXaXN2iWB/Nn RlZmvDIarpvhdauI7ORxDeMYr8Ruau/U2+xNxW3zK430MVxpYZoi6RG36GYZTMb0eslOU/51qfoZ jlR026PowExFthWK3k1VVmNUw6rzsYf3O99LGQ27qSKiZTftUTh3vLIiw+ABpX541LzdUiX3pqaF ex+hSGuSsktmNcyivm9ef4aSP0yRxJRIH3wPhaU4ValfP+L61icpOjResaH1Y2v2B7va9pZV4/Zu lKL/fHXbwsBIf/W2ltvKNhh6IBVb4mswRdkP4X3UpFFbPVCvb8ZeVvR8SmTfj1daH9uwxv9bmx9e l1ERS1gWsW837VS41QF4Hnigt1LfAz6lvx4Y9sK+RyqaWy8xrpsVirRHR1prBj2xXH88PbogOuGM ON8LU3n9Lhjeq6QXYEo/DPke6IpSLMCnh5LaHwygVdBf0dqKP9FpT0N6eMThlZsUWdube+GP8gmf eRNRBlMU7RitlK6fT73lr9en4UruLCw/raHP0gYbGpbdNKXuTdtXFtkd3ELdtNdhO1Eesc0VEdsx SmmlrMH2ctkWRXrjVmR6xGYPbzj1wn1O/Q+SqdetGQ1WsCyys8sa9s4UxU5NjdiNkRG9/zN51e92 LrGyRq3ctBZ/7G9ERL+4Lg9XLHB41MMjKzMh0vKfrVCKMqtbJRW2/H/Uij/2XG9DubUcpng0w7DX cRFpV0Rs1b/ru5mi+xMa2fNZf1iLsog303jn/D+tXc1u20YQVmBfEsCvEOypTQBbsh0l/gF6MBwn EFLbhS0X6ClYkSNxa5LL7C7Nso/SW28t0EN7bIGiz9Jj36LfDEn92E3cAIFAilzO/3w7M/TBarqE FosKiSz3LSP77f6cqxaL+VIN7fTy7o8l0mapW7mliWtzTu2WcLuYET4cKbYuE/kdruyKvEryfy3Z XK4mXR1eUFrQNnWmlIiz/GTuT2PXMrqztnI38W92VdHiY1HhVzH0IY8W+BiJ73cz18143NuonQQb b5q5MpKs5rdy4G7FeyGZ/bNS+eO2rt7IDFb1lqe4+7PfyWv2JLWzxmpH7uTdzWMTrcVkHInMu/u4 y5i+FevpR1m7iPJdDatzxapF1E7LAR2yk8Bd5girWz3ujfu9YW8P/VDhvIO7LbxvDHFs9/id86r3 pqXclv/0OMSnud7rPcPBXC96z/FuwgdLT2QmKaBvgE8ln7709tUdH0nle1+f4KuXsjurOS6aLmja ass2XUiFbnroWTtn2XaC5/3ZdFInT4xk4BLnRd9gVPGbFc8JH2f3QOj5V5MGOAepEJyrgfSet4KS Zp7ozyk/rYZKZoCGlj6Jlu7Z4BYe57LHdUFTHZH6WY0TUqc2twFL6ti6wjodjM1VkUZ99VIHfQ/R gIWpS5uWvOLVKAffzsHB9hZOu311lKbqwsyS4NUFeXI3FB/bPFDGQlytvAYT1s1UxeTNLN9UR87o VEWg0gYPM+tIJWWmc+ODihLtdBTA4IOJvAqJzhWe1cpOlYGWwlFMEXlvnVc6j5WG/DJKlGlFmVyF MidVmZCAnbBqY+bm61RDB/g1jOnWQkV5MATqCBelq/tKQmJvyGm4FxzpkOERM0QlXPSszNspzBQT pmWa4lJshfrMQonJ49IHcdWHOqXlSHByPGshl5lcKJy9hlgN+6MSinKxLDZ6Zvl5lRh4mFBaICJW zcwNCYFkWasU4VAZIXa5iUCui4IQxjwiKGnCbThYir6DMxmltYJvHklOWUZmUglvaHHjW30ROCak Sk9xE016V7KxZcTxV1MLlyERToVg8hm77gh5D36T0+QRMsERbjM909+bHKIpRJtN0MAeG1+kumYV zJ1T5QtdwDSQxDAxGM+CmbxwNrMird9h9bBx7YJmZard4dfgY9Tu9vd31ZNTEznLOXoqVKdj+fpJ jR1yn2l3zR5/CPnwZQYQEvAmmALp1aX6Sgf1mRqfqvPptC+GUeqpSkDWPzsfj16Njo/Go/Mzdf5K fTk6Pjm7PFFHry9OTk5PzsYbjzYejROkoos0p4UFwzl4HSQLc3uw8+zM6SKpRQ+Dn+M0qVVtS+aM GKGwrsxjQR8wAUAJroEJAzSDXM8cEaO3r74BW6IBHTvhrQfOsGIMR6tiCBKSTZwdR1EANqaI/cIu TrudkZAILOZ8SCcQPykDRMNMi1245NDnvjMK4J+HYs7MCFU3Oi31BKjUHqha5u6rq1xwXndewKc2 OdgSWvmCIjM10V3PFaKYC0KZV8ex4RwDOU4K1yYvO4mtVIRbRqUmM+wQlAhdZd21b4AtGJZFWwEz 5SQ1PmE9kNWEOwO4YT9SVdSqAXwboVVFEo/RdOEcV7x3JXlRg1oZkctbD1xrtxD7xJZpDKzeGKqa EnfHfaZDJglVI16UxbmPMEuKcRQWOWbHdGv19L/FislzhrZWtIKgR4dDJri6PFJb6sn+cO+p2tvZ 39oebm8/fHj1BovbOzvDIc57z/bU3ovnB88PNh4lIRSHg0FVVf2sS3xks+U9Qeql0xXHAlsQRkHS hZ1gh56hZlkU+E3epM5ERqtLLXvDo2Pt775H9iAJWTrIQq4zGmT+reY60efF/8lQUYpVup+F7wZt HIUaw5CV12AtP+tYy5hUP9hAM/8W9//IKNA9v5RhkUciHlritR/Wflv7c+0vHL+v/bH2y5IsLYNB d/+3yKYVXbQiTeStP17fWX+z/nr9C5wPQK3lFTFux5Hkwa8PflzryYjHf4RxMp6xjF7vX0d9sU4K ZW5kc3RyZWFtCmVuZG9iago5IDAgb2JqCjw8L0ZpbHRlciAvRmxhdGVEZWNvZGUKL0xlbmd0aCAz MDMKPj4gc3RyZWFtCnicXZHJasMwEIbveoo5pofgNQkFY0idBHzoQt0+gC2NU0EtC1k5+O0rz7gp VCDBN+uvmaiqT7XRHqI3N8oGPfTaKIfTeHMSocOrNiJJQWnpV6JXDq0VUUhu5snjUJt+FEUBEL0H 7+TdDJujGjt8ENGrU+i0ucLms2oCNzdrv3FA4yEWZQkK+1DpubUv7YAQUdq2VsGv/bwNOX8RH7NF SIkTViNHhZNtJbrWXFEUcTglFJdwSoFG/fMfOKvr5VfrKDoL0XF8jEuiC1FaEaU5UZ4w7Zkyporp kSg7E+2eiPKY6UQK1l673853oUlCYUnKPc9ciY0Zy8pXI7fODlyXFeSrOhayZ5E5f2C3GqtVAfdc xrGs7T5reXMujJl2S/NdJqsN3tdvR7tkLfcHmaidpwplbmRzdHJlYW0KZW5kb2JqCnhyZWYKMCAz MwowMDAwMDAwMDAwIDY1NTM1IGYgCjAwMDAwNjg5NDkgMDAwMDAgbiAKMDAwMDA2ODcyMCAwMDAw MCBuIAowMDAwMDc5NjY5IDAwMDAwIG4gCjAwMDAwNzk4MDUgMDAwMDAgbiAKMDAwMDA2OTAxMiAw MDAwMCBuIAowMDAwMDc5OTM2IDAwMDAwIG4gCjAwMDAxMDE3NDAgMDAwMDAgbiAKMDAwMDEwMjE0 OSAwMDAwMCBuIAowMDAwMTIyNzM4IDAwMDAwIG4gCjAwMDAwODA0OTMgMDAwMDAgbiAKMDAwMDA4 MDcyNSAwMDAwMCBuIAowMDAwMTAyNjM4IDAwMDAwIG4gCjAwMDAxMDI4NjQgMDAwMDAgbiAKMDAw MDAwMDAxNSAwMDAwMCBuIAowMDAwMDAwMDY0IDAwMDAwIG4gCjAwMDAwMTUwMDcgMDAwMDAgbiAK MDAwMDAxNTEwMiAwMDAwMCBuIAowMDAwMDE1MjQwIDAwMDAwIG4gCjAwMDAwMTUzODEgMDAwMDAg biAKMDAwMDAwMDI4NiAwMDAwMCBuIAowMDAwMDE1NTE1IDAwMDAwIG4gCjAwMDAwMjY2NjEgMDAw MDAgbiAKMDAwMDAyNzA0NCAwMDAwMCBuIAowMDAwMDQxMjc3IDAwMDAwIG4gCjAwMDAwNDE2NTgg MDAwMDAgbiAKMDAwMDA2ODMxMiAwMDAwMCBuIAowMDAwMDE2MDE3IDAwMDAwIG4gCjAwMDAwMTYy MzcgMDAwMDAgbiAKMDAwMDAyNzQwNCAwMDAwMCBuIAowMDAwMDI3NjM5IDAwMDAwIG4gCjAwMDAw NDIzNTEgMDAwMDAgbiAKMDAwMDA0MjU3NyAwMDAwMCBuIAp0cmFpbGVyCjw8L1NpemUgMzMKL1Jv b3QgMTQgMCBSCj4+CnN0YXJ0eHJlZgoxMjMxMTIKJSVFT0Y= --089e011613d2ec1b2f04f197af62-- From jeremy.rowley@digicert.com Tue Feb 4 09:33:30 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 99A451A0100 for ; Tue, 4 Feb 2014 09:33:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.437 X-Spam-Level: X-Spam-Status: No, score=-3.437 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zZuxa2i5pmTa for ; Tue, 4 Feb 2014 09:33:29 -0800 (PST) Received: from mail.digicert.com (mail.digicert.com [64.78.193.232]) by ietfa.amsl.com (Postfix) with ESMTP id 506791A0035 for ; Tue, 4 Feb 2014 09:33:29 -0800 (PST) Received: from JROWLEYL1 (unknown [67.137.52.8]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.digicert.com (Postfix) with ESMTPSA id B36BB8FA006; Tue, 4 Feb 2014 10:33:28 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digicert.com; s=mail; t=1391535208; bh=T6IAU/h6dpuZ7o58OBGzndripZAqP1ryMvlb2TSgd1s=; h=From:To:References:In-Reply-To:Subject:Date; b=i3btP+NZbbuFULrm/5EsKeivImzmUjBti+cLsFcRQcE/F1ZwazyO1QIAiHux+7dUi KVJPcyNGMN35/YKKdrCJmix/es0U1xKbvaOlRMRnDnTEPTi40aSFy6HvRN9FYPGFrr /sU0SnPkHuEP5s6vZIaNdbLpT3LGRs160pfVmByI= From: "Jeremy Rowley" To: "'Ben Laurie'" , "'CABFPub'" , , References: In-Reply-To: Date: Tue, 4 Feb 2014 10:33:32 -0700 Message-ID: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQGGS/IGH2GP3iOZeF9RA+GsPjuqQZs3BZqQ Content-Language: en-us Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 17:33:30 -0000 Three or four proofs for a 27 month certificate is way too many. The = number of proofs should be decided based on the customer's risk profile, = not a set number based on certificate lifecycle. Adding 400 bytes per = certificate will make EV certificates unusable by entities concerned = with performance.=20 Jeremy -----Original Message----- From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] = On Behalf Of Ben Laurie Sent: Tuesday, February 04, 2014 10:08 AM To: CABFPub; certificate-transparency@googlegroups.com; = therightkey@ietf.org Subject: [cabfpub] Updated Certificate Transparency + Extended = Validation plan Enclosed, our revised plan. Comments welcome. From agl@google.com Tue Feb 4 09:52:43 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 227EB1A0100 for ; Tue, 4 Feb 2014 09:52:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.914 X-Spam-Level: X-Spam-Status: No, score=-1.914 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1VXoeKtSsfKM for ; Tue, 4 Feb 2014 09:52:41 -0800 (PST) Received: from mail-vb0-x235.google.com (mail-vb0-x235.google.com [IPv6:2607:f8b0:400c:c02::235]) by ietfa.amsl.com (Postfix) with ESMTP id 735D91A0035 for ; Tue, 4 Feb 2014 09:52:41 -0800 (PST) Received: by mail-vb0-f53.google.com with SMTP id p17so5882235vbe.40 for ; Tue, 04 Feb 2014 09:52:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type:content-transfer-encoding; bh=jptaGbUSGx3JIkcNWj/Ytew9HsZTWTgGsVD3O2UfvsY=; b=RUHFlLqdLZY4MP20yn1zu65ByYt89RSW3R+btaMGNY0ghRDOBm5xlA4ghs1+l4TQnq HLuLmI+DZ1OsDI2bOUIOLohjGIpkYsep2sCQkBD6XTWm2YGtEXg+SEXYst2WDEa6mf5C WKUHs/AfEw4oUlEcCEmbzk97Xjc2dZK9cm6XFve9bDdt0zSqrKGEdgJOV3GG5ZUOcqrg f5cZCfpJcCNXGzOryJtpb3lmxET02t9NjvOq28jW5gD/vbzhjWZsJgE8cgNgSCZhSzTo AKVghzjGEDmnJEHNQbgWghpMuuTQR+xyxoUH4bZ8A90Km48m5+KBRO3UolhmfNhJc888 m1eg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type:content-transfer-encoding; bh=jptaGbUSGx3JIkcNWj/Ytew9HsZTWTgGsVD3O2UfvsY=; b=FX5a7b4vXAUYDnT8znrFeZwP53HHmBsO9jzHcHZypstx9UMgiF3zTG5NmcLXKLbFgh eTppwwxkPVvQoj1+lUgiz+P+0FHX0u50tTx+SL277ITZK4goxzmxGI3IjOFFDQ1OfDKe LeTGbYD7pU1mYZ/gI/zqYYjE1LVpz7huRKcoI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc:content-type :content-transfer-encoding; bh=jptaGbUSGx3JIkcNWj/Ytew9HsZTWTgGsVD3O2UfvsY=; b=baGOltubzyIk5SKDOzxsc5RQ4yV6BNS2eipodUBDJH5gBHnbKM5Lz/6/8O9EFBpZS5 dVVccIg8glhjNvGZFSLaRyjAjYcs57GjyxHa0cGcHrGwtxrCpfYRpLVB0Of3YDPOmHh9 iQhAMhvvZdUXfrNawTdCqIJadQ4sH99SvXxn8BA2xdcdpo/CPaU9kUy1V2WGNqTDMecd nplLixVMdZxykhcUTYYfg6kDtdeJ6o20B9bSzrkvap1RpTfWT2ETQG/spaSbCyu4ANp+ L3m75yz/IsaU3b0kbA8tIAHGr9QllT71aZjxQVna1MLFKt+q1uVZHZibdrx8hMLtSJYW 0cvg== X-Gm-Message-State: ALoCoQks0NF1KiZDIic54FpmyQoz9cNUVgVfiS/TkcNTDmedgB8+fwz94hF3eOv0xgvab3auK/vghRddq3DbuL5v2x8lsGJYBlFiYFvJti67rz89jazM0FWN43wbOafgnOqdGK521Rx4oziCTnTC8j7owbjkfQbEpPlC2cTTRvO0F3bwfrGnrO4ZtGUzwbeXBRmWrtCRw2HA X-Received: by 10.52.246.42 with SMTP id xt10mr6700837vdc.9.1391536360897; Tue, 04 Feb 2014 09:52:40 -0800 (PST) MIME-Version: 1.0 Sender: agl@google.com Received: by 10.52.104.37 with HTTP; Tue, 4 Feb 2014 09:52:20 -0800 (PST) In-Reply-To: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> From: Adam Langley Date: Tue, 4 Feb 2014 12:52:20 -0500 X-Google-Sender-Auth: mo1xIr9hP_FZi6lholnAyzmxheM Message-ID: To: certificate-transparency@googlegroups.com Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Mailman-Approved-At: Tue, 04 Feb 2014 09:53:44 -0800 Cc: therightkey@ietf.org, Ben Laurie , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 17:52:43 -0000 On Tue, Feb 4, 2014 at 12:33 PM, Jeremy Rowley wrote: > Three or four proofs for a 27 month certificate is way too many. The num= ber of proofs should be decided based on the customer's risk profile, not a= set number based on certificate lifecycle. Adding 400 bytes per certificat= e will make EV certificates unusable by entities concerned with performance= . The customer doesn't carry the risk: the risk is that we'll be unable to revoke a log in clients due to the number of certificates that depend on it. We should make the SCTs as small as possible, the the switch to larger initcwnds in recent years has released much of the pressure on keeping certificate sizes below the tradition initcwnd limit. Cheers AGL From sleevi@google.com Tue Feb 4 10:08:29 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 140AE1A0135 for ; Tue, 4 Feb 2014 10:08:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.913 X-Spam-Level: X-Spam-Status: No, score=-1.913 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zQAUpFzimoAV for ; Tue, 4 Feb 2014 10:08:26 -0800 (PST) Received: from mail-qa0-x22a.google.com (mail-qa0-x22a.google.com [IPv6:2607:f8b0:400d:c00::22a]) by ietfa.amsl.com (Postfix) with ESMTP id 696171A0126 for ; Tue, 4 Feb 2014 10:08:26 -0800 (PST) Received: by mail-qa0-f42.google.com with SMTP id k4so13094396qaq.29 for ; Tue, 04 Feb 2014 10:08:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=PdO1511Rp0WoaUi8iE84eTe2yDibBgIl+mjEIlFBYCA=; b=I5KYiiufve3EG7zJ1b/ArfNV+xk+azT3ePEM3RNT8u6DvsWXs1ziGikPJIH5y5qIPS nrNWh/UAmI0B7GfWvElkHXPNVxVhr4o8h4iyPQpE2gxqbWeSRfpV3OcZcKt6GxoUfdNT dNKMs53pyptLqOTHzzFWTbiEaDvdF5Pm5yNFRvMAGXwzoHGXQWaM2p+8qRPEAkI31QfF Ak64qItPPuAASZ7gyo9MlxQpwApBlqXauCmFBjgeUXp84Wn+XbaP9UKeOWwqGGjwlvWy niES7M4c7+sn12u3bRnqj5Z+lOS7SrTEbsCK1YqYqUdZc+t1QrUwR3TJOXy8RvSVu13J LROQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=PdO1511Rp0WoaUi8iE84eTe2yDibBgIl+mjEIlFBYCA=; b=UfJCxWH97xLGOmiBvDVoUCCYKR8tkEcbvfHRspljwNwy0YaaKlFEYqIK8Lq1MyXBFo G2EcV4w6IPot795eNqtV5tw+0xqoLXhrtrPwFCMyHiJZ10DitAjvKLwwyNHwumKOszrq PypIsj0AYnjerQiHusDkyfOgS/Nq69Z6CMyNOIuHO3UUwSl5rn9Ed8duByT49uEUcfvW xUqM7+mktBXMkMHf0OjHzXgH6mahlAhcOJDqb3EuxGDGsmInHACpLqqXm9Q1KTFa426F qoGy45S2Yn4DLfyPEWEw1jAV46Ghmmb7wud2CDAX8SWLjrJ6JJzz/MOaRbevmgv8WvRt eElw== X-Gm-Message-State: ALoCoQk41bqR55T9H0nqKk9isI3O6o6uhWJhfeV7fEzfvli8cRdhiLhdPd8Hke99ar2HdAx/ZQwZgSTzir2/ObX7f09IhHbtEz6lo1lrspa2csCqPbWmotFFNFvMTdGgMBS19FNkCW/B1Bav7L0LSGEy3c8I8l7pg346N8tE0rnyEv5btxTa3C+whCmfQwA3HMPqyGtNFzEF MIME-Version: 1.0 X-Received: by 10.140.33.198 with SMTP id j64mr64246736qgj.14.1391537305784; Tue, 04 Feb 2014 10:08:25 -0800 (PST) Received: by 10.229.154.208 with HTTP; Tue, 4 Feb 2014 10:08:25 -0800 (PST) Received: by 10.229.154.208 with HTTP; Tue, 4 Feb 2014 10:08:25 -0800 (PST) In-Reply-To: References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> Date: Tue, 4 Feb 2014 10:08:25 -0800 Message-ID: From: Ryan Sleevi To: Adam Langley Content-Type: multipart/alternative; boundary=001a1139b400cdac9d04f19886a3 X-Mailman-Approved-At: Tue, 04 Feb 2014 10:09:00 -0800 Cc: therightkey@ietf.org, certificate-transparency@googlegroups.com, CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 18:08:29 -0000 --001a1139b400cdac9d04f19886a3 Content-Type: text/plain; charset=UTF-8 One can also use OCSP Stapling or the TLS extension. OCSP stapling is particularly useful for also dealing with the revocation status in a single response. On Feb 4, 2014 9:52 AM, "Adam Langley" wrote: > On Tue, Feb 4, 2014 at 12:33 PM, Jeremy Rowley > wrote: > > Three or four proofs for a 27 month certificate is way too many. The > number of proofs should be decided based on the customer's risk profile, > not a set number based on certificate lifecycle. Adding 400 bytes per > certificate will make EV certificates unusable by entities concerned with > performance. > > The customer doesn't carry the risk: the risk is that we'll be unable > to revoke a log in clients due to the number of certificates that > depend on it. > > We should make the SCTs as small as possible, the the switch to larger > initcwnds in recent years has released much of the pressure on keeping > certificate sizes below the tradition initcwnd limit. > > > Cheers > > AGL > _______________________________________________ > Public mailing list > Public@cabforum.org > https://cabforum.org/mailman/listinfo/public > --001a1139b400cdac9d04f19886a3 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

One can also use OCSP Stapling or the TLS extension. OCSP st= apling is particularly useful for also dealing with the revocation status i= n a single response.

On Feb 4, 2014 9:52 AM, "Adam Langley"= <agl@chromium.org> wrote:
On Tue, Feb 4, 2014 at 12:33 PM, Jeremy Rowley
<jeremy.rowley@digicert.co= m> wrote:
> Three or four proofs for a 27 month certificate is way too many. =C2= =A0The number of proofs should be decided based on the customer's risk = profile, not a set number based on certificate lifecycle. Adding 400 bytes = per certificate will make EV certificates unusable by entities concerned wi= th performance.

The customer doesn't carry the risk: the risk is that we'll be unab= le
to revoke a log in clients due to the number of certificates that
depend on it.

We should make the SCTs as small as possible, the the switch to larger
initcwnds in recent years has released much of the pressure on keeping
certificate sizes below the tradition initcwnd limit.


Cheers

AGL
_______________________________________________
Public mailing list
Public@cabforum.org
= https://cabforum.org/mailman/listinfo/public
--001a1139b400cdac9d04f19886a3-- From jeremy.rowley@digicert.com Tue Feb 4 11:00:04 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 738C61A0165 for ; Tue, 4 Feb 2014 11:00:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.837 X-Spam-Level: X-Spam-Status: No, score=-4.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5leG3Do90DoR for ; Tue, 4 Feb 2014 11:00:01 -0800 (PST) Received: from mail.digicert.com (mail.digicert.com [64.78.193.232]) by ietfa.amsl.com (Postfix) with ESMTP id D907C1A0164 for ; Tue, 4 Feb 2014 11:00:01 -0800 (PST) Received: from JROWLEYL1 (unknown [67.137.52.7]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.digicert.com (Postfix) with ESMTPSA id 0AEAD8FA006; Tue, 4 Feb 2014 12:00:01 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digicert.com; s=mail; t=1391540401; bh=MmRAMLF/l3lLlXGrnXjpwDJc+G1vT8NKXqb3za4yjgk=; h=From:To:Cc:References:In-Reply-To:Subject:Date; b=BnP+y8xAEr+1LI2lSepa9E+CqGcgtkyVuVGG0ZPn5CnPNY5CgD2pe/ElEK1OOW7GF 9B5B9tUq/1YgSok6uITs2yR0KAPXlzaZvDMT87R3qRyA9yaDq5W3yHcSBFMa0vujEm C79Skl6YnaupIE5zDhDkhtYMcRsyDX09uvi6qTpI= From: "Jeremy Rowley" To: "'Adam Langley'" , References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> In-Reply-To: Date: Tue, 4 Feb 2014 12:00:05 -0700 Message-ID: <05bf01cf21db$5146c2a0$f3d447e0$@digicert.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQGGS/IGH2GP3iOZeF9RA+GsPjuqQQF9nIx2AUxrmLGbIM2csA== Content-Language: en-us Cc: therightkey@ietf.org, 'Ben Laurie' , 'CABFPub' Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 19:00:04 -0000 The entire point is to disclose the entire universe of public certificates to the customer. If the customer doesn't want to use it, the purpose is no longer being fulfilled. The way we plan on implementing CT will ensure logs are not irrevocable. I agree we should make SCTs as small as possible, but the last I've heard from our team is they are still at 100 bytes per log. Jeremy -----Original Message----- From: therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of Adam Langley Sent: Tuesday, February 04, 2014 10:52 AM To: certificate-transparency@googlegroups.com Cc: therightkey@ietf.org; Ben Laurie; CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan On Tue, Feb 4, 2014 at 12:33 PM, Jeremy Rowley wrote: > Three or four proofs for a 27 month certificate is way too many. The number of proofs should be decided based on the customer's risk profile, not a set number based on certificate lifecycle. Adding 400 bytes per certificate will make EV certificates unusable by entities concerned with performance. The customer doesn't carry the risk: the risk is that we'll be unable to revoke a log in clients due to the number of certificates that depend on it. We should make the SCTs as small as possible, the the switch to larger initcwnds in recent years has released much of the pressure on keeping certificate sizes below the tradition initcwnd limit. Cheers AGL _______________________________________________ therightkey mailing list therightkey@ietf.org https://www.ietf.org/mailman/listinfo/therightkey From agl@google.com Tue Feb 4 11:05:23 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C3891A01AB for ; Tue, 4 Feb 2014 11:05:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.914 X-Spam-Level: X-Spam-Status: No, score=-1.914 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yHDeoDW2gplB for ; Tue, 4 Feb 2014 11:05:21 -0800 (PST) Received: from mail-vb0-x22e.google.com (mail-vb0-x22e.google.com [IPv6:2607:f8b0:400c:c02::22e]) by ietfa.amsl.com (Postfix) with ESMTP id 965E71A01A5 for ; Tue, 4 Feb 2014 11:05:21 -0800 (PST) Received: by mail-vb0-f46.google.com with SMTP id o19so6063937vbm.33 for ; Tue, 04 Feb 2014 11:05:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=V+gponN8JZ0iuOCJP4ZsYVMMsJLW08B5RbWINjqa+AE=; b=pQ1oja4/QjcOnNLlJPJg0Hd/s3LGiIRMK344YYDu0N1CfJPv18+gacn9hyj0CFk7Qo 2J//sijpsqk/foHCEBpCUzcy1WPdZnPLZQOzG2O/2509fULHmUqcMdrHJtIr7y2xYN67 D+iVz+yfdN2J6lnLxzUt/Guuq289T4h3s54IWP0tJoONVUSAYwyp04xZs9phhzSCFXgA 3CIDCtfPe8hYzA6w/L/cnzq+vIY+9B18aXgDCVGGAJUY5/SotqdPytgiqvEb3WRrELei Q0AdGpTJfiFPGMl6SwBBcnmdh8PJZeOnF6Y7AdHeDN8RMzMinPxTAFiES7h9WpKjAYXB rTkA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=V+gponN8JZ0iuOCJP4ZsYVMMsJLW08B5RbWINjqa+AE=; b=PPiN9XQwJFVcXe4TwYUOsvgn7PaB8OAGNXaBYqzVWh4tzNfJ509StGcgjz3GGnlSsQ 8gJUPGcqmLyxhxeiQ+6jACO+orfIzdfjXRsUJ7DhbfxINAc+5JMlSsIkrdd5k0roFtkW Glfzyiry2ydGa9T/AuKBS7X9QqrKDobAwdLVo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc:content-type; bh=V+gponN8JZ0iuOCJP4ZsYVMMsJLW08B5RbWINjqa+AE=; b=TtTK8lwmhX+dr6ynusDVpI8babStJo+6E62+JZaAJPJ7+RzOGDbp/OaKSYwcSshpmb 7g/I5x133qnCSl90LCu90X96242hXWt9vruIi+YR8RzHpdbVWqhKOqoRsoox+7X67s1i zV792t/1HZSDKACtxvPnRKQ2XTrpbRrCsx4NRKxFFOUdf6sAb/j2k321WFHH4CAGMxyq biIrHB3gYIm64VOyTqW1ZsZDXFqnfrkIPonssso/4lnq9iX/TEB39moCh7srR97YMhMx 5uC/A8Dw46dxNyXFUTCbP3mqngs334Uej0/2p9eFFtl39SLXVrRCBAG9fK/EsWLfiFfE RCHQ== X-Gm-Message-State: ALoCoQlgRX/vKRldGGv1nHI1BlbHl3+Pe06edMEa3+wX39O2/nzWkRVF9z/EeAvYZWBuNGPTUsxqMR3LAkaaw7q+1R0BDZBPNxEGNH8wzgAtBddiXNiwkShJv/r8+sRyI6IEPUnoc6bS0MfzcXieO83Nl3+Qia0bqIgGSFrJIy3v8vos7+Ai64iPKMI1pNyVPmKzqS1JEKNU X-Received: by 10.58.133.15 with SMTP id oy15mr10826530veb.19.1391540720871; Tue, 04 Feb 2014 11:05:20 -0800 (PST) MIME-Version: 1.0 Sender: agl@google.com Received: by 10.52.104.37 with HTTP; Tue, 4 Feb 2014 11:05:00 -0800 (PST) In-Reply-To: <01dc01cf21db$146dac40$3d4904c0$@globalsign.com> References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <01dc01cf21db$146dac40$3d4904c0$@globalsign.com> From: Adam Langley Date: Tue, 4 Feb 2014 14:05:00 -0500 X-Google-Sender-Auth: h-vMCTAikDqyE3Xvgy5Wte9ROPo Message-ID: To: certificate-transparency Content-Type: text/plain; charset=UTF-8 Cc: therightkey , Ben Laurie , Jeremy Rowley , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 19:05:23 -0000 On Tue, Feb 4, 2014 at 1:58 PM, Doug Beattie wrote: > The number of proofs should be related to the reputation of the CA, the number > of years the CA has been in business I think you're assuming that a larger number of proofs is designed to catch possible malpractice on the part of the CA, but that's not it at all. The aim is to make sure that bad /logs/ can be distrusted. The major obstacle to killing logs is that certificates depend on the proofs and that, if we killed all the logs that a certificate was depending on, the site in question might go dark. In order to make sure that logs can be distrusted without blowback, the number of proofs increases as the duration of the certificate does. Thus, even if we kill one log every 12 months (which we certainly hope not to do!), longer lived certificates would still be functional towards the end of their lives. Cheers AGL From jeremy.rowley@digicert.com Tue Feb 4 11:06:16 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C2DD1A01CD for ; Tue, 4 Feb 2014 11:06:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.837 X-Spam-Level: X-Spam-Status: No, score=-4.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jzUqufOZN28C for ; Tue, 4 Feb 2014 11:06:12 -0800 (PST) Received: from mail.digicert.com (mail.digicert.com [64.78.193.232]) by ietfa.amsl.com (Postfix) with ESMTP id 1971A1A01EA for ; Tue, 4 Feb 2014 11:06:01 -0800 (PST) Received: from JROWLEYL1 (unknown [67.137.52.7]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.digicert.com (Postfix) with ESMTPSA id 956F27FA136; Tue, 4 Feb 2014 12:06:00 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digicert.com; s=mail; t=1391540760; bh=fWgh5adxrIL5ng5vPWKCdqtV+MTPAbKQo1YG09eeaek=; h=From:To:Cc:References:In-Reply-To:Subject:Date; b=vH6OSaPNgpgQlGxFyQb6k58DSrtSQ88Xyf4mY8xxCZqcz1PH2lgI36XBdecRU6kFo 6FL23Xdwu4HWPxVJqyREUDGoB0hsP8w24fGRU/j0PT2DuqvELHMAiL0UtXE1eYX3Zm c/MgVcnQOmzVrb08Y1qby3GEqo4PHe1/tAVeZhjM= From: "Jeremy Rowley" To: "'Adam Langley'" , References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <05bf01cf21db$5146c2a0$f3d447e0$@digicert.com> In-Reply-To: <05bf01cf21db$5146c2a0$f3d447e0$@digicert.com> Date: Tue, 4 Feb 2014 12:06:04 -0700 Message-ID: <05c401cf21dc$27903e40$76b0bac0$@digicert.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQGGS/IGH2GP3iOZeF9RA+GsPjuqQQF9nIx2AUxrmLEBZNtvppsVqNwA Content-Language: en-us Cc: therightkey@ietf.org, 'CABFPub' Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 19:06:16 -0000 Also, I'm not sure how basing the number of logs based on the lifecycle actually minimizes the impact of log revocation. If a log containing a couple thousand 1-year certificates is compromised, the damage from revocation is about the same as a log containing thousands of 3-year certs. Unless you plan is to revoke the log and wait for all impacted certificates to actually expire (giving a 12 month risk), the impact depends on the number of certificates valid at the time of revocation, not the expiration date of the certificate. -----Original Message----- From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On Behalf Of Jeremy Rowley Sent: Tuesday, February 04, 2014 12:00 PM To: 'Adam Langley'; certificate-transparency@googlegroups.com Cc: therightkey@ietf.org; 'CABFPub' Subject: Re: [cabfpub] [therightkey] Updated Certificate Transparency + Extended Validation plan The entire point is to disclose the entire universe of public certificates to the customer. If the customer doesn't want to use it, the purpose is no longer being fulfilled. The way we plan on implementing CT will ensure logs are not irrevocable. I agree we should make SCTs as small as possible, but the last I've heard from our team is they are still at 100 bytes per log. Jeremy -----Original Message----- From: therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of Adam Langley Sent: Tuesday, February 04, 2014 10:52 AM To: certificate-transparency@googlegroups.com Cc: therightkey@ietf.org; Ben Laurie; CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan On Tue, Feb 4, 2014 at 12:33 PM, Jeremy Rowley wrote: > Three or four proofs for a 27 month certificate is way too many. The number of proofs should be decided based on the customer's risk profile, not a set number based on certificate lifecycle. Adding 400 bytes per certificate will make EV certificates unusable by entities concerned with performance. The customer doesn't carry the risk: the risk is that we'll be unable to revoke a log in clients due to the number of certificates that depend on it. We should make the SCTs as small as possible, the the switch to larger initcwnds in recent years has released much of the pressure on keeping certificate sizes below the tradition initcwnd limit. Cheers AGL _______________________________________________ therightkey mailing list therightkey@ietf.org https://www.ietf.org/mailman/listinfo/therightkey _______________________________________________ Public mailing list Public@cabforum.org https://cabforum.org/mailman/listinfo/public From jeremy.rowley@digicert.com Tue Feb 4 11:10:12 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F6F81A01CD for ; Tue, 4 Feb 2014 11:10:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.837 X-Spam-Level: X-Spam-Status: No, score=-4.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C23S9i7TS7Ag for ; Tue, 4 Feb 2014 11:10:10 -0800 (PST) Received: from mail.digicert.com (mail.digicert.com [64.78.193.232]) by ietfa.amsl.com (Postfix) with ESMTP id BDC2B1A01D1 for ; Tue, 4 Feb 2014 11:10:09 -0800 (PST) Received: from JROWLEYL1 (unknown [67.137.52.8]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.digicert.com (Postfix) with ESMTPSA id 36FE08FA0B0; Tue, 4 Feb 2014 12:10:09 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digicert.com; s=mail; t=1391541009; bh=F+V0GEne23lw4CXIWYRP2EmkuP1vUFI271grt8y1HWs=; h=From:To:Cc:References:In-Reply-To:Subject:Date; b=OdEPfDS2LfADcQgeeAT9u8pXl9FTPRgtYQM/TZd5uG3jhHsj7IVUg9No0xzX2rwB7 62IIjP1L4u6cT+9uGVVr3u8p/NDlAgoSl/4rn/hUYjUOTM+KCx+622RS6nKKbi2hmm 3txdydSNoswfljal7+8SaqLXm1VxE6YDdXbw+pHc= From: "Jeremy Rowley" To: "'Adam Langley'" , "'certificate-transparency'" References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <01dc01cf21db$146dac40$3d4904c0$@globalsign.com> In-Reply-To: Date: Tue, 4 Feb 2014 12:10:13 -0700 Message-ID: <05c501cf21dc$bbc70da0$335528e0$@digicert.com> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQGGS/IGH2GP3iOZeF9RA+GsPjuqQQF9nIx2AcGvbgECdUvoyJsJe7iQ Content-Language: en-us Cc: 'therightkey' , 'Ben Laurie' , 'CABFPub' Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 19:10:12 -0000 I do not think this is correct. The number of proofs actually increases = as you decrease validity periods. A 2-year certificate only lets the = customer skip a year in the renewal process. A 2-year certificate will = lower the number of certificates logged by one (since the customer would = need to log two 1-year certificates instead of one 2-year certificate). = The number of domains requiring a certificate identifies the quantity of = proofs, not the number of certificates actually issued. Jeremy -----Original Message----- From: agl@google.com [mailto:agl@google.com] On Behalf Of Adam Langley Sent: Tuesday, February 04, 2014 12:05 PM To: certificate-transparency Cc: Jeremy Rowley; Ben Laurie; CABFPub; therightkey Subject: Re: [cabfpub] Updated Certificate Transparency + Extended = Validation plan On Tue, Feb 4, 2014 at 1:58 PM, Doug Beattie = wrote: > The number of proofs should be related to the reputation of the CA,=20 > the number of years the CA has been in business I think you're assuming that a larger number of proofs is designed to = catch possible malpractice on the part of the CA, but that's not it at = all. The aim is to make sure that bad /logs/ can be distrusted. The major = obstacle to killing logs is that certificates depend on the proofs and = that, if we killed all the logs that a certificate was depending on, the = site in question might go dark. In order to make sure that logs can be = distrusted without blowback, the number of proofs increases as the = duration of the certificate does. Thus, even if we kill one log every 12 = months (which we certainly hope not to do!), longer lived certificates = would still be functional towards the end of their lives. Cheers AGL From sleevi@google.com Tue Feb 4 11:21:51 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E0C591A01DF for ; Tue, 4 Feb 2014 11:21:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.913 X-Spam-Level: X-Spam-Status: No, score=-1.913 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fB7iFB-lUbm7 for ; Tue, 4 Feb 2014 11:21:47 -0800 (PST) Received: from mail-qa0-x22a.google.com (mail-qa0-x22a.google.com [IPv6:2607:f8b0:400d:c00::22a]) by ietfa.amsl.com (Postfix) with ESMTP id 60D2A1A0187 for ; Tue, 4 Feb 2014 11:21:47 -0800 (PST) Received: by mail-qa0-f42.google.com with SMTP id k4so13043991qaq.15 for ; Tue, 04 Feb 2014 11:21:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=J+1Jah/6mKjqsysNHLH4huALhjSujRYb3vkX5VaU6VU=; b=Y0ymzPz9lvtMH7TYPj1tZWE+l9ydCTWxeXI7uytgqwNCCj2Yq4WMxrmVtvOqj5RX2P 1CZE05YnOsfRESiVR6t1V+KfFZRFl3aoD/ZRWgIocUCIzqPB1PcxjoMG8c9IGzrNbSGB CjHY3AsUGFczcEKehn8FOLc7yN8X50V6Da6p5g9E3Wi1B+G22syjhFIZqAltJ3VmvkNg nlW87ynQQ7ewllOzpMPI8EFFic/EKeyTB+o98k8h1TBB5EUjK9eW6WJyvfla3FyKmq5o u+bIjfZqrZsMBUwA4WHMPRHOXcj+x5u6LZgxk3pY7fzHzJIEY7lLMwXtNAbTqrBLCmKS dQLQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=J+1Jah/6mKjqsysNHLH4huALhjSujRYb3vkX5VaU6VU=; b=l2oT045tz6jVFGSX63Uwp0uun8tlRHKKpBtM7MzWZAGQcSUj9IB8nSazOYmRjow/vd sDrvgA3sfF4RBwz6tDZcfWFQ4ZEiYpk/G0gszPXPnSC8vkSWxFCmUPqv0G7jxSNk7o+v oxISFnKISTcUxksNkJEjlwGVCXH7fuz7fCEx3/OZJFw348Sjz3REbLy3uTxKYXWRn3ws L2BIP5ZEKyWU7mAsUKdASz+AUUkNhZWtMnh+z7aW2bok9Uv2pJvcUX5gVUfyCEjnB3NB vBaJ5lDEGo7/9Y/Hk+ZaEHIcFr9mgxt23yETOVpORt/wNV9mPLE0iOAtca2G5d8rcJZI t1GA== X-Gm-Message-State: ALoCoQku3VmliJqzaA54RTAOLwXOLWpXPPBtS4m0UcbP9FjEtmRbyEbyOJ9pLdhixcHoU3eR9GCUhn4gfLezbOm8ehF7tMj4cSOwcMtf6wg1poFIDGuBT+ssutGg1L2BE4OxgpGqr8ZyOicY+Tw/Mb2e1vy+vR8tu5YDIvdp/72GyUHHW1sdqjeNfll6Cze9z3e8/gwBv1Di MIME-Version: 1.0 X-Received: by 10.140.109.228 with SMTP id l91mr65092760qgf.72.1391541706759; Tue, 04 Feb 2014 11:21:46 -0800 (PST) Received: by 10.229.154.208 with HTTP; Tue, 4 Feb 2014 11:21:46 -0800 (PST) In-Reply-To: <05c401cf21dc$27903e40$76b0bac0$@digicert.com> References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <05bf01cf21db$5146c2a0$f3d447e0$@digicert.com> <05c401cf21dc$27903e40$76b0bac0$@digicert.com> Date: Tue, 4 Feb 2014 11:21:46 -0800 Message-ID: From: Ryan Sleevi To: Jeremy Rowley Content-Type: multipart/alternative; boundary=001a1138fa841f333904f1998d3b Cc: therightkey@ietf.org, Adam Langley , certificate-transparency@googlegroups.com, CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 19:21:52 -0000 --001a1138fa841f333904f1998d3b Content-Type: text/plain; charset=UTF-8 On Tue, Feb 4, 2014 at 11:06 AM, Jeremy Rowley wrote: > Also, I'm not sure how basing the number of logs based on the lifecycle > actually minimizes the impact of log revocation. If a log containing a > couple thousand 1-year certificates is compromised, the damage from > revocation is about the same as a log containing thousands of 3-year certs. > Unless you plan is to revoke the log and wait for all impacted certificates > to actually expire (giving a 12 month risk), the impact depends on the > number of certificates valid at the time of revocation, not the expiration > date of the certificate. > > The "impact" is only present if a single SCT is acceptable. Increasing the number of SCTs decreases the impact of log revocation, as the probability that any given certificate will be directly affected by a single revocation (which is far, far less common one would hope) decreases relative to the number of distinct logs it is logged in. Further, a 1 year certificate that is renewed every year has a greater chance to respond to any revocation events than a 3 year certificate, which will not be re-issued for 3 years, and thus is unable to respond to any revocation events (as unlikely as they may be) that happen in the interim. > -----Original Message----- > From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On > Behalf Of Jeremy Rowley > Sent: Tuesday, February 04, 2014 12:00 PM > To: 'Adam Langley'; certificate-transparency@googlegroups.com > Cc: therightkey@ietf.org; 'CABFPub' > Subject: Re: [cabfpub] [therightkey] Updated Certificate Transparency + > Extended Validation plan > > The entire point is to disclose the entire universe of public certificates > to the customer. If the customer doesn't want to use it, the purpose is no > longer being fulfilled. The way we plan on implementing CT will ensure logs > are not irrevocable. I agree we should make SCTs as small as possible, but > the last I've heard from our team is they are still at 100 bytes per log. > > Jeremy > > -----Original Message----- > From: therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of Adam > Langley > Sent: Tuesday, February 04, 2014 10:52 AM > To: certificate-transparency@googlegroups.com > Cc: therightkey@ietf.org; Ben Laurie; CABFPub > Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + > Extended Validation plan > > On Tue, Feb 4, 2014 at 12:33 PM, Jeremy Rowley > > wrote: > > Three or four proofs for a 27 month certificate is way too many. The > number of proofs should be decided based on the customer's risk profile, > not > a set number based on certificate lifecycle. Adding 400 bytes per > certificate will make EV certificates unusable by entities concerned with > performance. > > The customer doesn't carry the risk: the risk is that we'll be unable to > revoke a log in clients due to the number of certificates that depend on > it. > > We should make the SCTs as small as possible, the the switch to larger > initcwnds in recent years has released much of the pressure on keeping > certificate sizes below the tradition initcwnd limit. > > > Cheers > > AGL > _______________________________________________ > therightkey mailing list > therightkey@ietf.org > https://www.ietf.org/mailman/listinfo/therightkey > > _______________________________________________ > Public mailing list > Public@cabforum.org > https://cabforum.org/mailman/listinfo/public > > _______________________________________________ > Public mailing list > Public@cabforum.org > https://cabforum.org/mailman/listinfo/public > --001a1138fa841f333904f1998d3b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable



On Tue, Feb 4, 2014 at 11:06 AM, Jeremy Rowley &l= t;jeremy.ro= wley@digicert.com> wrote:
Also, I'm not sure how basing the number= of logs based on the lifecycle
actually minimizes the impact of log revocation. If a log containing a
couple thousand 1-year certificates is compromised, the damage from
revocation is about the same as a log containing thousands of 3-year certs.=
Unless you plan is to revoke the log and wait for all impacted certificates=
to actually expire (giving a 12 month risk), the impact depends on the
number of certificates valid at the time of revocation, not the expiration<= br> date of the certificate.


The &qu= ot;impact" is only present if a single SCT is acceptable.
Increasing the number of SCTs decreases the impact of log revo= cation, as the probability that any given certificate will be directly affe= cted by a single revocation (which is far, far less common one would hope) = decreases relative to the number of distinct logs it is logged in.

Further, a 1 year certificate that is renewed every yea= r has a greater chance to respond to any revocation events than a 3 year ce= rtificate, which will not be re-issued for 3 years, and thus is unable to r= espond to any revocation events (as unlikely as they may be) that happen in= the interim.
=C2=A0
-----Original Message-----
From: public-bounces@cabforu= m.org [mailto:public-bou= nces@cabforum.org] On
Behalf Of Jeremy Rowley
Sent: Tuesday, February 04, 2014 12:00 PM
To: 'Adam Langley'; certificate-transparency@googlegroups.com
Cc: therightkey@ietf.org; '= CABFPub'
Subject: Re: [cabfpub] [therightkey] Updated Certificate Transparency +
Extended Validation plan

The entire point is to disclose the entire universe of public certificates<= br> to the customer. =C2=A0If the customer doesn't want to use it, the purp= ose is no
longer being fulfilled. The way we plan on implementing CT will ensure logs=
are not irrevocable. =C2=A0I agree we should make SCTs as small as possible= , but
the last I've heard from our team is =C2=A0they are still at 100 bytes = per log.

Jeremy

-----Original Message-----
From: therightkey [mailto:t= herightkey-bounces@ietf.org] On Behalf Of Adam
Langley
Sent: Tuesday, February 04, 2014 10:52 AM
To: certificat= e-transparency@googlegroups.com
Cc: therightkey@ietf.org; Ben L= aurie; CABFPub
Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency +
Extended Validation plan

On Tue, Feb 4, 2014 at 12:33 PM, Jeremy Rowley <jeremy.rowley@digicert.com>
wrote:
> Three or four proofs for a 27 month certificate is way too many. =C2= =A0The
number of proofs should be decided based on the customer's risk profile= , not
a set number based on certificate lifecycle. Adding 400 bytes per
certificate will make EV certificates unusable by entities concerned with performance.

The customer doesn't carry the risk: the risk is that we'll be unab= le to
revoke a log in clients due to the number of certificates that depend on it= .

We should make the SCTs as small as possible, the the switch to larger
initcwnds in recent years has released much of the pressure on keeping
certificate sizes below the tradition initcwnd limit.


Cheers

AGL
_______________________________________________
therightkey mailing list
therightkey@ietf.org
https://www.ietf.org/mailman/listinfo/therightkey

_______________________________________________
Public mailing list
Public@cabforum.org
= https://cabforum.org/mailman/listinfo/public

_______________________________________________
Public mailing list
Public@cabforum.org
= https://cabforum.org/mailman/listinfo/public

--001a1138fa841f333904f1998d3b-- From agl@google.com Tue Feb 4 11:42:04 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E81521A01A5 for ; Tue, 4 Feb 2014 11:42:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.914 X-Spam-Level: X-Spam-Status: No, score=-1.914 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oaLuSEXCE_BV for ; Tue, 4 Feb 2014 11:42:03 -0800 (PST) Received: from mail-ve0-x235.google.com (mail-ve0-x235.google.com [IPv6:2607:f8b0:400c:c01::235]) by ietfa.amsl.com (Postfix) with ESMTP id 63BFB1A0127 for ; Tue, 4 Feb 2014 11:42:03 -0800 (PST) Received: by mail-ve0-f181.google.com with SMTP id cz12so6497313veb.12 for ; Tue, 04 Feb 2014 11:42:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=awgcWskYzN7kZMTMO8fAGYtTW6HURyHaKfqq174BIXQ=; b=OS8D5OrOhEFLs8MPEcd6pkY1pjYYd+7BAvqG4jjqSc4EqnZNUvyWuja4B2lbC25mqb rvyW4L2DmamLFkpuOzfE9JR5T97doVJg1dswv+SjrUPFkx54kLDaTVPknKAVS1AcfFJ1 XTwOxwEjgxUsFfaS1IPFME3rpMuWdXP+xBLnFIPHJhluLvHvBvYAQNZ9XTMj1/8UBvyk BnHofSZ5MY4Q3+18wlXuAJG91I9o/XxFV2yxjb17D6eRtwXv8FXspo3SWkVglWzYm4wJ ioGuo6bppZaqf99t7f3EUbZjAdCG+zYeDWgU+PwmXMwzd/XE/Shs3cbD+xzmLMpYFJgd 3mqQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=awgcWskYzN7kZMTMO8fAGYtTW6HURyHaKfqq174BIXQ=; b=D1mIldsbqEgZECU7K5VvBhqcmRBG6u45bRb1Qmi7KwodUY6ZRxZ6K0xbtNushOX4hm 4wqmuqMypKlOc0KOwDJ0B7AP6c0MssqhP393Voi61FRBEMvOSzOhosdxrn/LGesATluM rQHV/PhI/6IueeQYCXjYaHJUKmi3peqsNK+yk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc:content-type; bh=awgcWskYzN7kZMTMO8fAGYtTW6HURyHaKfqq174BIXQ=; b=j3iRq/lHNOlyzV4fYTIuAsJQxgvxl5a06an72dxD4UqC9/eS5fwEskn/RyLTRdZcFv RkbQzrOr05AbACzt2UOIhe8NeYLHXFciyNGv4uibfJi8nI1PP+ljlSmpiM1ALWlNZwlH Xn3wYVZJ6hTkVhcT/WuSPvYpiGFyr/80h9ysmjrIHI2+6DG/H6pkN0lqMJR4b3ylu5I9 uo8AQXKbOhT3wOacSkpL5a4Z5n/41t0KJcWbKEbp9mny5t2a89Ejywu1SV8yNfCAPY9c 7Haeunfw3V3FSJl1sVnSk0Z6enNjK156T3XiCFfC1rW342ZLJn9Mq4ATNRlfoPa7FKR2 ICFw== X-Gm-Message-State: ALoCoQnSNfCV+S/2a2Hb8pa1kk5DpPKiH37QUbVmwxH/+OqQF16Nkkop8E1i5vzbvPScP5o/ZSkEFm7hYKKfDXNZeTyZmrEoLM2IGCORlaEFqOXai5l2joTx8MsycV8GclKzYh/nZgW3SSRGsToagMlDFmGS3HW4rh/vujCR5jDmC8MNOvQB8gQFSQaS7okXL7PlaqATubhr X-Received: by 10.52.232.168 with SMTP id tp8mr1919625vdc.38.1391542922724; Tue, 04 Feb 2014 11:42:02 -0800 (PST) MIME-Version: 1.0 Sender: agl@google.com Received: by 10.52.104.37 with HTTP; Tue, 4 Feb 2014 11:41:42 -0800 (PST) In-Reply-To: <05c501cf21dc$bbc70da0$335528e0$@digicert.com> References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <01dc01cf21db$146dac40$3d4904c0$@globalsign.com> <05c501cf21dc$bbc70da0$335528e0$@digicert.com> From: Adam Langley Date: Tue, 4 Feb 2014 14:41:42 -0500 X-Google-Sender-Auth: 1Vfg2LH4PivfEkK8kjn06pAd-QU Message-ID: To: certificate-transparency@googlegroups.com Content-Type: text/plain; charset=UTF-8 Cc: therightkey , Ben Laurie , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 19:42:05 -0000 On Tue, Feb 4, 2014 at 2:10 PM, Jeremy Rowley wrote: > I do not think this is correct. The number of proofs actually increases as you decrease validity periods. Consider a certificate setting out on a journey. It always needs to have identity papers with it because the Browser Police are always on the lookout for unregistered certificates. However, the Browser Police sometimes decide that certain forms of ID are no longer acceptable and so a certificate needs to carry several forms of ID with it. If it's setting out on a one year journey it's wise to have two forms of ID because one might become distrusted over the year, but it's vanishingly unlikely that both would be. However, if our plucky certificate is setting out on a two year journey then it's wise to carry three forms of ID just in case two become useless while it's out in the world. The longer it'll be out, the more forms of id it should carry to ensure that one is always acceptable. Cheers AGL From jeremy.rowley@digicert.com Tue Feb 4 12:10:53 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 757F01A01E3 for ; Tue, 4 Feb 2014 12:10:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.837 X-Spam-Level: X-Spam-Status: No, score=-4.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SiS6VdXQfuR7 for ; Tue, 4 Feb 2014 12:10:50 -0800 (PST) Received: from mail.digicert.com (mail.digicert.com [64.78.193.232]) by ietfa.amsl.com (Postfix) with ESMTP id 529881A016C for ; Tue, 4 Feb 2014 12:10:38 -0800 (PST) Received: from JROWLEYL1 (unknown [67.137.52.8]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.digicert.com (Postfix) with ESMTPSA id 9122D2E030; Tue, 4 Feb 2014 13:10:37 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digicert.com; s=mail; t=1391544637; bh=drHDbMtOKTrNFC2wgGWnz2k58ugYlH4J6jug7pyQCFg=; h=From:To:Cc:References:In-Reply-To:Subject:Date; b=RZivAaS2g9IzJxJZGX/qU/lysDIER89lnWcDg4yjdxd9AiQTveCGGU4qm8B9jUPb5 1x2T6ZX+iZheWai+nwGttDl8Bzs6anQg+db3/G4RDI/QC2kOLegZKfqYpa2lta+g/j m1xuO+D3UHdPMilRuXxoAmhZbueg/Lvd9KegqBbI= From: "Jeremy Rowley" To: "'Adam Langley'" , References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <01dc01cf21db$146dac40$3d4904c0$@globalsign.com> <05c501cf21dc$bbc70da0$335528e0$@digicert.com> In-Reply-To: Date: Tue, 4 Feb 2014 13:10:41 -0700 Message-ID: <063601cf21e5$2e696440$8b3c2cc0$@digicert.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQGGS/IGH2GP3iOZeF9RA+GsPjuqQQF9nIx2AcGvbgECdUvoyAIXRB8jAYfEWOSa7JSZQA== Content-Language: en-us Cc: 'therightkey' , 'CABFPub' Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 20:10:53 -0000 That has little to do with distrusting a log. That's an argument for shorter-lived certificates in general. To continue your analogy: If the certificate sets out on a two year journey with a passport, it might realize this is better than grabbing a utility bill and phone receipt. Why would it carry garbage when it already has something everyone accepts? Jeremy -----Original Message----- From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On Behalf Of Adam Langley Sent: Tuesday, February 04, 2014 12:42 PM To: certificate-transparency@googlegroups.com Cc: therightkey; CABFPub Subject: Re: [cabfpub] Updated Certificate Transparency + Extended Validation plan On Tue, Feb 4, 2014 at 2:10 PM, Jeremy Rowley wrote: > I do not think this is correct. The number of proofs actually increases as you decrease validity periods. Consider a certificate setting out on a journey. It always needs to have identity papers with it because the Browser Police are always on the lookout for unregistered certificates. However, the Browser Police sometimes decide that certain forms of ID are no longer acceptable and so a certificate needs to carry several forms of ID with it. If it's setting out on a one year journey it's wise to have two forms of ID because one might become distrusted over the year, but it's vanishingly unlikely that both would be. However, if our plucky certificate is setting out on a two year journey then it's wise to carry three forms of ID just in case two become useless while it's out in the world. The longer it'll be out, the more forms of id it should carry to ensure that one is always acceptable. Cheers AGL _______________________________________________ Public mailing list Public@cabforum.org https://cabforum.org/mailman/listinfo/public From agl@google.com Tue Feb 4 12:19:24 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D2491A01F0 for ; Tue, 4 Feb 2014 12:19:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.914 X-Spam-Level: X-Spam-Status: No, score=-1.914 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IBD67a306T-w for ; Tue, 4 Feb 2014 12:19:23 -0800 (PST) Received: from mail-vb0-x22d.google.com (mail-vb0-x22d.google.com [IPv6:2607:f8b0:400c:c02::22d]) by ietfa.amsl.com (Postfix) with ESMTP id EF14B1A01C8 for ; Tue, 4 Feb 2014 12:19:22 -0800 (PST) Received: by mail-vb0-f45.google.com with SMTP id m10so6016491vbh.4 for ; Tue, 04 Feb 2014 12:19:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=MHViUR0HnD8hC6NXu4IKfWK8CxGJwYol2jsGNkUEnxk=; b=Tczb3wLb0CDxx9wo4dSXAf5SP0UYBOuGpMADBwhBdAG6ECBQhhgZKXNjutHGe3/3XY hDpwX+zGZlStsIg9CsqCG6dJUFvQG0zzb7Ol+hz3jKA0fVOX/2vrOHUujM/qXzuL6yrN CAhMa4LRZxitDxbZK1qYWk5CmZdn1Av5rtmi2CYfbwAuOu9xUWdkD7O69RBck/9OWLkd fBL9EvAxKmXYgmURJUNbfBMJIAaw9v9lWoKEWxcCKSnoauccx7OiLEWBzr3XrsMjoU5u ZtBnXQE2bUTxu8cGMXTE0zp6EPR/ChGsht7S4eJqPiwI39ZPc5eKGauMLgnp7b+emf29 DlUQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=MHViUR0HnD8hC6NXu4IKfWK8CxGJwYol2jsGNkUEnxk=; b=B9xi2c1tvonnp/oFXNBd7Bj9dI9+0lM6kOYWFMz95xTYp5AMf0Dg24N/uCzeh3Yg2H B4Iqbb4pE0ICVrv1equ/e/4UXVmerINozYnNYE77dOOhCtVwF8Za6DZIMoNvmndIb8j1 HRBu/hG9pz2POXcopgwENE/lBEWGncZACggn0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc:content-type; bh=MHViUR0HnD8hC6NXu4IKfWK8CxGJwYol2jsGNkUEnxk=; b=TEl0lmf+ns2ld8OB1ijWG9CxU+L+DdTDR/dn6/DoQo39A9Z9iHfNqZbsqiLkwYiI2k 87hlZ5/44ppnIgDYBlaWLMdbee0D5Rm/pQsGJ6XtjHp5AVm/Ii11qa+mr0/qW3VyN6Kt kUCx0yKgwLxUR2KYPoH8UGUL9dr9CKffYh2jGKcKuuJ/h1qFLHjh1oQHBoz+xDBUY9nx njTq/PnQlxt3sSLgsCXFjcIfu54JUSaY0pYf704JG1OHHVvpn4h1O/MOzBcIQkBEE1Q0 xP5VuHkuQ2xlnoNmh+ZEO1MlCnc6rLbM20bn1nIfMCqoAst8RsBqMgbhxG9MT4bx0O9N CX9A== X-Gm-Message-State: ALoCoQm/QoQrmZ8UpOydPg6q+60B2n2FQuwLmIZV+D2NXD13HCLt8DH/PaGzuEysrHvpmrI5A6jiowMfnwgFrFFsyCjBBrx439NDSIFyxdjlOJDSYjex4Z/ftBlLPbDYh38zkfa5eX/qRWRgQzLiGsrE3LY3knpXicgbEZxjAduJ4VJgfiJOf2gKjgmioTh+X1ceuedidn05 X-Received: by 10.52.232.168 with SMTP id tp8mr2043323vdc.38.1391545162349; Tue, 04 Feb 2014 12:19:22 -0800 (PST) MIME-Version: 1.0 Sender: agl@google.com Received: by 10.52.104.37 with HTTP; Tue, 4 Feb 2014 12:19:02 -0800 (PST) In-Reply-To: <063601cf21e5$2e696440$8b3c2cc0$@digicert.com> References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <01dc01cf21db$146dac40$3d4904c0$@globalsign.com> <05c501cf21dc$bbc70da0$335528e0$@digicert.com> <063601cf21e5$2e696440$8b3c2cc0$@digicert.com> From: Adam Langley Date: Tue, 4 Feb 2014 15:19:02 -0500 X-Google-Sender-Auth: ohtTkwwHfMLAbzwB5uqWUbi_tgg Message-ID: To: Jeremy Rowley Content-Type: text/plain; charset=UTF-8 Cc: therightkey , certificate-transparency , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 20:19:25 -0000 On Tue, Feb 4, 2014 at 3:10 PM, Jeremy Rowley wrote: > If the certificate sets out on a two year journey with a passport, it might > realize this is better than grabbing a utility bill and phone receipt. Why > would it carry garbage when it already has something everyone accepts? We don't want to be in the position where we can't distrust a log (*any log*) because it would render certificates invalid. Which is why we're specifying that certificates carry multiple SCTs. Cheers AGL From jeremy.rowley@digicert.com Tue Feb 4 12:24:54 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CAA761A01A6 for ; Tue, 4 Feb 2014 12:24:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.837 X-Spam-Level: X-Spam-Status: No, score=-4.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7Ph_8H8DgHZC for ; Tue, 4 Feb 2014 12:24:53 -0800 (PST) Received: from mail.digicert.com (mail.digicert.com [64.78.193.232]) by ietfa.amsl.com (Postfix) with ESMTP id E79BC1A0187 for ; Tue, 4 Feb 2014 12:24:52 -0800 (PST) Received: from JROWLEYL1 (unknown [67.137.52.7]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.digicert.com (Postfix) with ESMTPSA id 6F91E8FA149; Tue, 4 Feb 2014 13:24:52 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digicert.com; s=mail; t=1391545492; bh=HBEC5c9xDExC7UNjvD2cDL2SfGioPl5RajUH/w0ntoM=; h=From:To:Cc:References:In-Reply-To:Subject:Date; b=OuaUSKzkgRw25pEz+8jfjlPE2T6KFLWAwyrkPilfFg61fAzlg1wo+tg2GW1+BP7il yClFZvAFZ5fP3Uzy4B25RT5pKn0wW5gGLcCkwBePPj9FT2IhJZPCWBK9Lf8+/KjnYp taJlg/QqVsCwyEll/U9PtYj7HwCxGZJM9Lr8R1VU= From: "Jeremy Rowley" To: "'Adam Langley'" References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <01dc01cf21db$146dac40$3d4904c0$@globalsign.com> <05c501cf21dc$bbc70da0$335528e0$@digicert.com> <063601cf21e5$2e696440$8b3c2cc0$@digicert.com> In-Reply-To: Date: Tue, 4 Feb 2014 13:24:56 -0700 Message-ID: <066901cf21e7$2bf25ee0$83d71ca0$@digicert.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQGGS/IGH2GP3iOZeF9RA+GsPjuqQQF9nIx2AcGvbgECdUvoyAIXRB8jAYfEWOQBcT6DxgD34cL8mtlQG3A= Content-Language: en-us Cc: 'therightkey' , 'certificate-transparency' , 'CABFPub' Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 20:24:55 -0000 What's wrong with rendering certificates invalid? Isn't the burden on the CA to ensure their customers are satisfied? If the CA wants to take the risk, let them. We'll make sure our customers 100% understand the risks when deciding how many proofs to embed. Jeremy -----Original Message----- From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On Behalf Of Adam Langley Sent: Tuesday, February 04, 2014 1:19 PM To: Jeremy Rowley Cc: therightkey; certificate-transparency; CABFPub Subject: Re: [cabfpub] Updated Certificate Transparency + Extended Validation plan On Tue, Feb 4, 2014 at 3:10 PM, Jeremy Rowley wrote: > If the certificate sets out on a two year journey with a passport, it > might realize this is better than grabbing a utility bill and phone > receipt. Why would it carry garbage when it already has something everyone accepts? We don't want to be in the position where we can't distrust a log (*any log*) because it would render certificates invalid. Which is why we're specifying that certificates carry multiple SCTs. Cheers AGL _______________________________________________ Public mailing list Public@cabforum.org https://cabforum.org/mailman/listinfo/public From agl@google.com Tue Feb 4 12:32:18 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB2051A011F for ; Tue, 4 Feb 2014 12:32:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.914 X-Spam-Level: X-Spam-Status: No, score=-1.914 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lk8fqsE1CLaK for ; Tue, 4 Feb 2014 12:32:16 -0800 (PST) Received: from mail-ve0-x235.google.com (mail-ve0-x235.google.com [IPv6:2607:f8b0:400c:c01::235]) by ietfa.amsl.com (Postfix) with ESMTP id 376291A0100 for ; Tue, 4 Feb 2014 12:32:16 -0800 (PST) Received: by mail-ve0-f181.google.com with SMTP id cz12so6548522veb.12 for ; Tue, 04 Feb 2014 12:32:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=yDdo7hSevAO0RVpLqtZ6JLeuFn0GYTCuH7cmLimSy5s=; b=p4Z0u/Ij6QzRPFjXKOr5QPlqN4NzIMmMisG0zPdeI5MZfDFhOsMoaae55nUxUEmnhh HOcHDRbKlHDM+gCz8ncNC9N2z67DExbySyeWcaYa29AAtZATFfShSEmrFq9L38vSWqrI Kv+xP9WYTdLGSO1MiFwcG9fGBhgDDrZK0gMZNVnqCn3vqDCW3/LcNKCXaB9rGtMnOOka 5FXo0s6bt+bNE2TMxuxpWGiRnqpERS8ulmIDWTczKD7TFpZdsdpYPV+RFsR5uIKwB26C ET+0pfXOxz90QPoh2ksVBaw0jNhUOLKTco9S37okcVe8Sb4odMaxtZ0BcTM1XFE4y8T6 UOVw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=yDdo7hSevAO0RVpLqtZ6JLeuFn0GYTCuH7cmLimSy5s=; b=nY8KMozubhXdSU1cfKvmuhIMZH5wQleB8RF3IWuPOqxeGtjiZxQWth0YSgm4rdqqoe Kd3FrGX7HwzxQgkNV75IDeaa6i5i6tACtLhj0gQ+6rcemwWii6nkPy/MIky1F0ragx0l zS8BKMAHE0YCeGPlyZQw6ylDm0qHN7cpuC9Sc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc:content-type; bh=yDdo7hSevAO0RVpLqtZ6JLeuFn0GYTCuH7cmLimSy5s=; b=U+qDeoHPA+ZaEcuPbDZFi4oVXPsTZsd2UwmogulCZCAW0z0e6/2VT7Qwv7q4mSJTxD 97fQXC259aR3zBSRTrRzqPnFd/LIxIUtl8epYgBh+1THk5O1cRZFGC9I6I9bk6P4Kur4 StVq59I9kVAH9eE7hZSlZkKcfg+sOkAmD8NKgG7SE1T4oDbwqu4kpvX10Aer2+yN9Nj8 CPFnEgtc+FjweUqeYxsMiJVlbfoU2DxIXmgPS+i82azh57KQodMRLA/ZC2wVyCRcGIVT o8QJ3G4C2eni9E9kkyrFn0rLKQmtqeMlBqqeG0/qvbjHS4buB/9jT/jVTCpyM370Ouyw IHpA== X-Gm-Message-State: ALoCoQmCPDfiZigzID/UvK8mTS6Z/5p6/n8Xe5uUGCvDNCZRMDUGAikhwF1Zc9B2GPNIqs8vTYrDILpjl/g+bDbkcn4WL+/WSiegMVpV3HrD9HLw6lBFO9XZwqtQl2Ju3ajRHI2Yyc848t3MCdIox3tO8BJ/2krldtoWg4IOyN+uNu1sNq3yBgDQNN3cNS+zXlKkhBqXxqYr X-Received: by 10.58.219.1 with SMTP id pk1mr72404vec.49.1391545935441; Tue, 04 Feb 2014 12:32:15 -0800 (PST) MIME-Version: 1.0 Sender: agl@google.com Received: by 10.52.104.37 with HTTP; Tue, 4 Feb 2014 12:31:55 -0800 (PST) In-Reply-To: <066901cf21e7$2bf25ee0$83d71ca0$@digicert.com> References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <01dc01cf21db$146dac40$3d4904c0$@globalsign.com> <05c501cf21dc$bbc70da0$335528e0$@digicert.com> <063601cf21e5$2e696440$8b3c2cc0$@digicert.com> <066901cf21e7$2bf25ee0$83d71ca0$@digicert.com> From: Adam Langley Date: Tue, 4 Feb 2014 15:31:55 -0500 X-Google-Sender-Auth: j_gkYtg4ltRyKxL-6LddPgDyOlQ Message-ID: To: Jeremy Rowley Content-Type: text/plain; charset=UTF-8 Cc: therightkey , certificate-transparency , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 20:32:18 -0000 On Tue, Feb 4, 2014 at 3:24 PM, Jeremy Rowley wrote: > What's wrong with rendering certificates invalid? Isn't the burden on the > CA to ensure their customers are satisfied? If the CA wants to take the > risk, let them. We'll make sure our customers 100% understand the risks when > deciding how many proofs to embed. But the burden of an invalid certificate significantly falls on users/browsers, not just on the site. If distrusting a log causes 1% of the Internet to go dark, we essentially cannot do it. It's because of these externalities that we're seeking these assurances. Cheers AGL From jeremy.rowley@digicert.com Tue Feb 4 12:37:42 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D39151A011E for ; Tue, 4 Feb 2014 12:37:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.837 X-Spam-Level: X-Spam-Status: No, score=-4.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SPiYp6wOAW8A for ; Tue, 4 Feb 2014 12:37:41 -0800 (PST) Received: from mail.digicert.com (mail.digicert.com [64.78.193.232]) by ietfa.amsl.com (Postfix) with ESMTP id EE9EC1A010F for ; Tue, 4 Feb 2014 12:37:40 -0800 (PST) Received: from JROWLEYL1 (unknown [67.137.52.7]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.digicert.com (Postfix) with ESMTPSA id 73EFF7FA06B; Tue, 4 Feb 2014 13:37:40 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digicert.com; s=mail; t=1391546260; bh=PgJteEySAO0wCVnRqFFabRbrjHJnCEZIWOLPlLZUJRU=; h=From:To:Cc:References:In-Reply-To:Subject:Date; b=P7MsvLPyrNuhHK6qI6QzBbTgFKmIO6AvjMilzx9/KP7Vqm440xbYc+pNIBWtxcoz5 +dHuEAH7lHN1KJvIX6epL5Wa38hvuLHm8dy286JlGYP3GUX5D4SsEFyT+BUMDXm9by WT5Z1RJV6mb949fm5GQW0Uuchf9KckRCAHQzB0Ws= From: "Jeremy Rowley" To: "'Adam Langley'" References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <01dc01cf21db$146dac40$3d4904c0$@globalsign.com> <05c501cf21dc$bbc70da0$335528e0$@digicert.com> <063601cf21e5$2e696440$8b3c2cc0$@digicert.com> <066901cf21e7$2bf25ee0$83d71ca0$@digicert.com> In-Reply-To: Date: Tue, 4 Feb 2014 13:37:44 -0700 Message-ID: <069201cf21e8$f5b8c510$e12a4f30$@digicert.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQGGS/IGH2GP3iOZeF9RA+GsPjuqQQF9nIx2AcGvbgECdUvoyAIXRB8jAYfEWOQBcT6DxgD34cL8ASpNQTABMq68OprGa73Q Content-Language: en-us Cc: 'therightkey' , 'certificate-transparency' , 'CABFPub' Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 20:37:43 -0000 Doesn't that simply require the cert user to either start using OCSP with an embedded certificate or getting a new certificate from the user? Plus, under the current plan, the site doesn't go dark. Instead, their EV cert isn't recognized as an EV certificate. -----Original Message----- From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On Behalf Of Adam Langley Sent: Tuesday, February 04, 2014 1:32 PM To: Jeremy Rowley Cc: therightkey; certificate-transparency; CABFPub Subject: Re: [cabfpub] Updated Certificate Transparency + Extended Validation plan On Tue, Feb 4, 2014 at 3:24 PM, Jeremy Rowley wrote: > What's wrong with rendering certificates invalid? Isn't the burden on > the CA to ensure their customers are satisfied? If the CA wants to > take the risk, let them. We'll make sure our customers 100% understand > the risks when deciding how many proofs to embed. But the burden of an invalid certificate significantly falls on users/browsers, not just on the site. If distrusting a log causes 1% of the Internet to go dark, we essentially cannot do it. It's because of these externalities that we're seeking these assurances. Cheers AGL _______________________________________________ Public mailing list Public@cabforum.org https://cabforum.org/mailman/listinfo/public From agl@google.com Tue Feb 4 12:50:56 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 512FC1A012C for ; Tue, 4 Feb 2014 12:50:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.914 X-Spam-Level: X-Spam-Status: No, score=-1.914 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pG6BDSQlgxFR for ; Tue, 4 Feb 2014 12:50:54 -0800 (PST) Received: from mail-vb0-x22a.google.com (mail-vb0-x22a.google.com [IPv6:2607:f8b0:400c:c02::22a]) by ietfa.amsl.com (Postfix) with ESMTP id B11D51A010F for ; Tue, 4 Feb 2014 12:50:54 -0800 (PST) Received: by mail-vb0-f42.google.com with SMTP id i3so6283388vbh.29 for ; Tue, 04 Feb 2014 12:50:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=iU2WWIZKT8yPskyYq6SpBrCPIbLjt3aXS07ey+fqFzU=; b=T3IIV1gVDhN1JAGu2l89oAmIiarokJRICWSwKk75H/I4k+GEV12j/cWzTBa2CZEg9p 640bIB8m+cK1FThUPlyKabx9qJ6C+yAc1iY14HMhqTCW+SX48aF17IE7GlN0I1/CHbU1 aoN+5eMLCo2urPkboL4QG8S+Iu73CmPxxJOZ7J20x351Kmd5OuT+xTD6U0fR+VY1tODb GCSEj+0btiTbhpQQLg2a2w7eFIRTlJFO5J7yOJs3mMrnIVOWcpkvC4sULxEyOZcnr/35 1TJhSSHqHqQJQ0eu2zEmhuVyexPb4i7EYIib6BqamODu9mS4a37F/XIKbaw5yXh1qkvC DFrw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=iU2WWIZKT8yPskyYq6SpBrCPIbLjt3aXS07ey+fqFzU=; b=gu44s0cOOf1hXbDVvccZJ/fSfpgQGEi+h+EHe51Ajg1i55yvYACLivMCGh4z35GWHk Pem3soVJlhWcsDokVpCWYnGEaYS9a5b6xSy4N2DdAwaHYiQw5wc/s86g6oH6TxNgdpFA r0yUNcBoGDh2whb7ex6Gm0mRgsOIa9mRmlFbE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc:content-type; bh=iU2WWIZKT8yPskyYq6SpBrCPIbLjt3aXS07ey+fqFzU=; b=ldMDLvsyYteSgwjWoNe10i7pklOBIsOJXXGU4vKRxYvNIKM3r/ZJ6Vv3FVU4tOCmeF greTQYrkC0LchJRlKWcMMHWysNcaaW0QHOQZcSzYHkshtr14qail4saIfp6s5dNUqxjQ kyyZNczz8T9odR4uR6BUpe06eBR6SF5t1V+h3xuQCaPTK80fUowgCVJjfudAyJOCIfOu q2tWV6eQZuR2Uzmc4G5HHm3GwlPhNmfI4mNlwRSlBABvG05p8cPbwQMMWlOKnyjwu1hr D1cDPDhg8qU0/q7TQjcQYW2SqoxEvRO1SfvUVcsxCorRS01mE76pVm+jr0wGGtb9efWQ fBJA== X-Gm-Message-State: ALoCoQnLfgCYIpmlbibmN9gF9r8wycA8dTs7XWqwiCOKDQ8hdyB8AwGMVMVYCgjUrtcRbnnQrcufTce7saHG+INRa6Se/YGPUgjXmdC3qwWn2dyeCl+6bRPTuQmXL/wIAPzgHh4V0gotifhT1bEiGvHNOyQFt8fCgdOsDdF25wJ8VovyXMjt+dSBo2tnDisHcEdT0fyzTTeY X-Received: by 10.58.85.133 with SMTP id h5mr34003343vez.4.1391547053920; Tue, 04 Feb 2014 12:50:53 -0800 (PST) MIME-Version: 1.0 Sender: agl@google.com Received: by 10.52.104.37 with HTTP; Tue, 4 Feb 2014 12:50:33 -0800 (PST) In-Reply-To: <069201cf21e8$f5b8c510$e12a4f30$@digicert.com> References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <01dc01cf21db$146dac40$3d4904c0$@globalsign.com> <05c501cf21dc$bbc70da0$335528e0$@digicert.com> <063601cf21e5$2e696440$8b3c2cc0$@digicert.com> <066901cf21e7$2bf25ee0$83d71ca0$@digicert.com> <069201cf21e8$f5b8c510$e12a4f30$@digicert.com> From: Adam Langley Date: Tue, 4 Feb 2014 15:50:33 -0500 X-Google-Sender-Auth: rcUjx0dd1wjWfoUINhOf1YEn61s Message-ID: To: certificate-transparency Content-Type: text/plain; charset=UTF-8 Cc: therightkey , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 20:50:56 -0000 On Tue, Feb 4, 2014 at 3:37 PM, Jeremy Rowley wrote: > Doesn't that simply require the cert user to either start using OCSP with an > embedded certificate or getting a new certificate from the user? If the certificate was used with OCSP stapling, the CA had a reasonably short OCSP validity window and the CA could update the SCT in the OCSP response quickly then that would solve the problem. However, for the purposes of this spec I don't think we said anything about that because of the complexity. Having multiple SCTs is clearly ok and that kept things simple. > Plus, under the current plan, the site doesn't go dark. Instead, their EV cert isn't recognized as an EV certificate. For EV certificates the problem is greatly reduced. But EV certificates are just a trial for doing it universally and we have the end state in mind. Cheers AGL From benl@google.com Tue Feb 4 12:54:16 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A3061A011F for ; Tue, 4 Feb 2014 12:54:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.914 X-Spam-Level: X-Spam-Status: No, score=-1.914 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wI2NNAmRPahC for ; Tue, 4 Feb 2014 12:54:14 -0800 (PST) Received: from mail-vc0-x22b.google.com (mail-vc0-x22b.google.com [IPv6:2607:f8b0:400c:c03::22b]) by ietfa.amsl.com (Postfix) with ESMTP id ADC2A1A00EC for ; Tue, 4 Feb 2014 12:54:14 -0800 (PST) Received: by mail-vc0-f171.google.com with SMTP id le5so6257907vcb.16 for ; Tue, 04 Feb 2014 12:54:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=Zjw6nPutzgSAnTN+xdpgDWaGrBcEvaD+DtAUwYQYwoo=; b=ZCiHDzoqp0vbo4jA35Jo77NlEuAj/dRDkEqsrXWokJgz3+hk+R44FBBs4HAjBIzaHJ aEIcXCw9ZA/60Hdfv9QeElO+22LCob+N38Y6035SMK6SxJbsr3xoY3FhAWzp0qu8M02L a+untnkWCzD/2VUAXK83qCZF32t0uJIGaZIXHgpWDrqY5HZ/IN12wx/GEnkDImQGQTIK NDCueGdtawMZ8aPl2iKk1ARTiHXUvsWjse0CD87pwlz7jSrvptjC1dXFUZCgyenIt2oT 1esnfn1MFib77nnJEVoQ9BKfu7Hooq5dacBfF4RjtykLywqPZYmhuhdTLIKrWfPuC8Wo jh9w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=Zjw6nPutzgSAnTN+xdpgDWaGrBcEvaD+DtAUwYQYwoo=; b=W/4Hul6g7PoqtyPTQAEmr+jXmGDHuH5HlHPXFH48SIFJnKANzIJ1BkoPRjruNPK5bw shBlyfITrVjoA4BGk8/FF4CBjtq5CAJREGEuIbvN8kPSOZODoCjNhxv/KavgIbAp3fA3 casozTXZpjkfIfxhs6bBySfE48/A32rU6NeiFFvthvEcQgOySUB+sAhyPL0z16b2IJv5 pmh3V9SXbuOwNF/TtwAjD75c8y46ThFa3XCAsOP4dxhZ7EzpeJ4rAGw/Ac9Z+z1hPHMN uC+Ayi2fE4kvDgmkcvejS3P2MMp0XF/A0Ua2qFhFcwguTWOs1DOvP72t4yNJsgaMxSv4 2eeQ== X-Gm-Message-State: ALoCoQnM01NKuzRWTGcKKXpflrx6vSZnV0KfVPSecgeKRcSv+6vzmX0KoGvHBfYxn2ZR7xJY6zidh49apZhwaq4EhlYfWlTgvObt7jNpbrQHXgjTH4yyajfmPzhu42Yh5ANuEsEBe2BmIfoFg0FMGjbk5tJRt4jpPxAWKkZ1iirjqFykq16y4PHaC+OtSyqwf9XInP2+q7Wk MIME-Version: 1.0 X-Received: by 10.52.61.168 with SMTP id q8mr1473495vdr.40.1391547254064; Tue, 04 Feb 2014 12:54:14 -0800 (PST) Received: by 10.52.230.105 with HTTP; Tue, 4 Feb 2014 12:54:13 -0800 (PST) In-Reply-To: References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <01dc01cf21db$146dac40$3d4904c0$@globalsign.com> <05c501cf21dc$bbc70da0$335528e0$@digicert.com> <063601cf21e5$2e696440$8b3c2cc0$@digicert.com> <066901cf21e7$2bf25ee0$83d71ca0$@digicert.com> <069201cf21e8$f5b8c510$e12a4f30$@digicert.com> Date: Tue, 4 Feb 2014 20:54:13 +0000 Message-ID: From: Ben Laurie To: certificate-transparency@googlegroups.com Content-Type: text/plain; charset=UTF-8 Cc: therightkey , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 20:54:16 -0000 On 4 February 2014 20:50, Adam Langley wrote: > On Tue, Feb 4, 2014 at 3:37 PM, Jeremy Rowley > wrote: >> Doesn't that simply require the cert user to either start using OCSP with an >> embedded certificate or getting a new certificate from the user? > > If the certificate was used with OCSP stapling, the CA had a > reasonably short OCSP validity window and the CA could update the SCT > in the OCSP response quickly then that would solve the problem. > > However, for the purposes of this spec I don't think we said anything > about that because of the complexity. Having multiple SCTs is clearly > ok and that kept things simple. Actually, we do. For the TLS extension and OCSP stapling a single SCT is allowed. From sleevi@google.com Tue Feb 4 13:14:54 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2CEB01A012C for ; Tue, 4 Feb 2014 13:14:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.913 X-Spam-Level: X-Spam-Status: No, score=-1.913 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZwoacXfh5w3u for ; Tue, 4 Feb 2014 13:14:52 -0800 (PST) Received: from mail-qc0-x22b.google.com (mail-qc0-x22b.google.com [IPv6:2607:f8b0:400d:c01::22b]) by ietfa.amsl.com (Postfix) with ESMTP id 013E91A010F for ; Tue, 4 Feb 2014 13:14:51 -0800 (PST) Received: by mail-qc0-f171.google.com with SMTP id n7so14636199qcx.2 for ; Tue, 04 Feb 2014 13:14:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=u3FqsFx0WuK3PjpXFSZFDdOi8DIMeSzQDnqI++vHB70=; b=JFaSJJh6qX4rrpMnUFbF59QZZUEbI9SWIUTatDmTJHad7ZpTdOUNzVFHK2ZiEN+tbX xvwmxiUUxCHvmbQaiu5XqlsqPZhIIDWxmvIkhDAEBNTSRz+YAz6V29da3OY2ZwpHyADT qUkC/4DcPkwQCrHg7DLWFISaAfCUhjs/mbCqycrebfXE7y8nWT2ftaSSsVoo/JYcNx6e alcpsOwBnvPsj816n1FBZictZfs9pECjVoERhOOmlq1PZ98faqGp+dipJWv0OaLWoH/d LYY8j/NCXrKLKtsYE/6nr8diihaXfZnCpnTPL7Sp0UUJAgfz3/ThlG3MAnqmxa2TqFgX w9EA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=u3FqsFx0WuK3PjpXFSZFDdOi8DIMeSzQDnqI++vHB70=; b=KrESjop2XnawU/kAbPmB14Fp5Es8w36JYLlDMh2OKJd1ILKB/ayT8DnQmgSrIxFpqz TgJuKOlnzYPAPsIa4duTGofsEhv06H5w1LKZGKi2eGG3ShxP5DIXFEnwRQokZFwkZKfv qwwNxMvvcDNyFytyEoe5KvoDZXTXl/PpW0n4vbghaGCNLn3DuC2VjLwD3x+YaQP9bQqT sX27Cnzipn9Uw0lT/WiYrtrqVpT9GUWsQCv2OUleZteFB7cDTQMNrEa93SaEVeZ9H3pj Bafs/TFnhC7JFCWJLJe8b2Ks20Qix43UxyIP6KRUIMeszD4Ocmfc5D67wKxHWfgqWMNc Uv2w== X-Gm-Message-State: ALoCoQluASFS2gGMQpvLGYR5IV80+FSy2mVw+S/HNuoog0jEYooUu4sb9YzrvSuJ9ptQUhLALAqdspnsaP31uSAj/pZ4YMwx+Yum5HOsASGr7b6iNR0cWz9Xc2KDj0hY8yZdmglXUNFletGBLm3HdBXKM1+aTx2cuJlpmlbiTeC8/+sYETGIvwW4rRjbBm1+1sRqMhHYOe+c MIME-Version: 1.0 X-Received: by 10.224.74.129 with SMTP id u1mr5058658qaj.49.1391548491306; Tue, 04 Feb 2014 13:14:51 -0800 (PST) Received: by 10.229.154.208 with HTTP; Tue, 4 Feb 2014 13:14:51 -0800 (PST) In-Reply-To: References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <01dc01cf21db$146dac40$3d4904c0$@globalsign.com> <05c501cf21dc$bbc70da0$335528e0$@digicert.com> <063601cf21e5$2e696440$8b3c2cc0$@digicert.com> <066901cf21e7$2bf25ee0$83d71ca0$@digicert.com> <069201cf21e8$f5b8c510$e12a4f30$@digicert.com> Date: Tue, 4 Feb 2014 13:14:51 -0800 Message-ID: From: Ryan Sleevi To: Adam Langley Content-Type: multipart/alternative; boundary=089e01538ddc8327a204f19b214e Cc: therightkey , certificate-transparency , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 21:14:54 -0000 --089e01538ddc8327a204f19b214e Content-Type: text/plain; charset=UTF-8 On Tue, Feb 4, 2014 at 12:50 PM, Adam Langley wrote: > On Tue, Feb 4, 2014 at 3:37 PM, Jeremy Rowley > wrote: > > Doesn't that simply require the cert user to either start using OCSP > with an > > embedded certificate or getting a new certificate from the user? > > If the certificate was used with OCSP stapling, the CA had a > reasonably short OCSP validity window and the CA could update the SCT > in the OCSP response quickly then that would solve the problem. > > However, for the purposes of this spec I don't think we said anything > about that because of the complexity. Having multiple SCTs is clearly > ok and that kept things simple. > > > Plus, under the current plan, the site doesn't go dark. Instead, their > EV cert isn't recognized as an EV certificate. > > For EV certificates the problem is greatly reduced. But EV > certificates are just a trial for doing it universally and we have the > end state in mind. Also, EV has the added benefit of recommending/requiring (depending on which doc) fresh revocation checks. As such, CAs that feel that multiple logs are too onerous can benefit from the OCSP delivery method. Failing to obtain fresh revocation information can already cause a loss of EV UI, so including an SCT should be a much less onerous cross to bear. It also allows for issuance patterns other than pre-certs. Of course, it means that any sites purchasing certificates from such a CA support OCSP stapling. --089e01538ddc8327a204f19b214e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable



On Tue, Feb 4, 2014 at 12:50 PM, Adam Langley <= ;agl@chromium.org= > wrote:
On Tue, Feb 4, 2014 at 3:3= 7 PM, Jeremy Rowley
<jeremy.rowley@digicert.co= m> wrote:
> Doesn't that simply require the cert user to either start using OC= SP with an
> embedded certificate or getting a new certificate from the user?

If the certificate was used with OCSP stapling, the CA had a
reasonably short OCSP validity window and the CA could update the SCT
in the OCSP response quickly then that would solve the problem.

However, for the purposes of this spec I don't think we said anything about that because of the complexity. Having multiple SCTs is clearly
ok and that kept things simple.

> Plus, under the current plan, the site doesn't go dark. Instead, t= heir EV cert isn't recognized as an EV certificate.

For EV certificates the problem is greatly reduced. But EV
certificates are just a trial for doing it universally and we have the
end state in mind.

Also, EV has the added b= enefit of recommending/requiring (depending on which doc) fresh revocation = checks. As such, CAs that feel that multiple logs are too onerous can benef= it from the OCSP delivery method. Failing to obtain fresh revocation inform= ation can already cause a loss of EV UI, so including an SCT should be a mu= ch less onerous cross to bear.

It also allows for issuance patterns other than pre-cer= ts.

Of course, it means that any sites purchasing = certificates from such a CA support OCSP stapling.=C2=A0
<= /div> --089e01538ddc8327a204f19b214e-- From wthayer@godaddy.com Tue Feb 4 17:47:16 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7CBE31A01B5 for ; Tue, 4 Feb 2014 17:47:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.602 X-Spam-Level: X-Spam-Status: No, score=-2.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HlHavkvtmSla for ; Tue, 4 Feb 2014 17:47:14 -0800 (PST) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2lp0208.outbound.protection.outlook.com [207.46.163.208]) by ietfa.amsl.com (Postfix) with ESMTP id E2BB11A0196 for ; Tue, 4 Feb 2014 17:47:13 -0800 (PST) Received: from CO1PR02MB064.namprd02.prod.outlook.com (10.242.163.16) by CO1PR02MB061.namprd02.prod.outlook.com (10.242.163.11) with Microsoft SMTP Server (TLS) id 15.0.868.8; Wed, 5 Feb 2014 01:47:05 +0000 Received: from CO1PR02MB064.namprd02.prod.outlook.com ([169.254.5.65]) by CO1PR02MB064.namprd02.prod.outlook.com ([169.254.5.16]) with mapi id 15.00.0868.013; Wed, 5 Feb 2014 01:47:04 +0000 From: Wayne Thayer To: Ben Laurie , CABFPub , "certificate-transparency@googlegroups.com" , "therightkey@ietf.org" Thread-Topic: [therightkey] Updated Certificate Transparency + Extended Validation plan Thread-Index: AQHPIhQrw5SajTkA5EmxZlNEt+tDmw== Date: Wed, 5 Feb 2014 01:47:04 +0000 Message-ID: <647dad549e3047e4a94c721a616f1dee@CO1PR02MB064.namprd02.prod.outlook.com> References: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [68.231.156.37] x-forefront-prvs: 01136D2D90 x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(6009001)(164054003)(377454003)(13464003)(189002)(199002)(81816001)(2201001)(76786001)(46102001)(81686001)(87936001)(85852003)(19580405001)(92566001)(77096001)(2656002)(53806001)(83322001)(76576001)(76796001)(51856001)(4396001)(80976001)(19580395003)(54356001)(87266001)(85306002)(47976001)(49866001)(47736001)(56816005)(74366001)(66066001)(80022001)(65816001)(94316002)(47446002)(90146001)(74662001)(74876001)(77982001)(86362001)(59766001)(74502001)(54316002)(79102001)(81542001)(56776001)(93516002)(50986001)(83072002)(69226001)(33646001)(94946001)(81342001)(74316001)(31966008)(63696002)(93136001)(74706001)(24736002); DIR:OUT; SFP:1101; SCL:1; SRVR:CO1PR02MB061; H:CO1PR02MB064.namprd02.prod.outlook.com; CLIP:68.231.156.37; FPR:FCFDC01D.9EC2D312.C0D0FA38.88E5C1D9.20263; InfoNoRecordsMX:1; A:1; LANG:en; Content-Type: text/plain; charset="iso-8859-1" Content-ID: <86BC0CD3417AF3449E17B02ACBB1EB37@namprd02.prod.outlook.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: godaddy.com Subject: Re: [therightkey] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 01:47:16 -0000 I'm somewhat confused by the following two points: >>5. By July 2014 all EV certificates with validity periods beyond [July >>2014] should be logged in at least [one] qualifying log (see below). >>6. On 1 Jan 2015 Chrome will create a whitelist of valid EV certificates >>already issued without an embedded SCT [issued by CAs participating in CT] from all qualifying logs. If EV certificates issued prior to 1 Jan 2015 will be whitelisted, what is the purpose of point #5? Also, regarding point #7, I understand if it=B9s not practical to distribut= e a large whitelist to mobile platforms, but IMO retroactively removing the EV indicator from existing certs rather than letting them naturally expire before enforcing CT on mobile platforms creates a bad EV experience in return for little additional transparency & security. Thanks, Wayne -----Original Message----- From: therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of Ben Laurie Sent: Tuesday, February 04, 2014 10:08 AM To: CABFPub; certificate-transparency@googlegroups.com; therightkey@ietf.org Subject: [therightkey] Updated Certificate Transparency + Extended Validation plan Enclosed, our revised plan. Comments welcome. From sleevi@google.com Tue Feb 4 17:55:48 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5FC91A0196 for ; Tue, 4 Feb 2014 17:55:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.913 X-Spam-Level: X-Spam-Status: No, score=-1.913 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Uqw-BdZoiVSv for ; Tue, 4 Feb 2014 17:55:46 -0800 (PST) Received: from mail-qa0-x22c.google.com (mail-qa0-x22c.google.com [IPv6:2607:f8b0:400d:c00::22c]) by ietfa.amsl.com (Postfix) with ESMTP id 7D2881A0190 for ; Tue, 4 Feb 2014 17:55:46 -0800 (PST) Received: by mail-qa0-f44.google.com with SMTP id w5so13790180qac.31 for ; Tue, 04 Feb 2014 17:55:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=UOdjj+tTzV68Efxa8DJvC31FkWCWfq1JBKAxxP3sxk4=; b=Ls6nA1RykonCJV4Tb9mFBA0pq44rnjenrUSmVLa6GI0D8S2NfPwltVTo6R/wTmq3z8 8l4j9Hf+ETGjblNwtwuOKKNVZaQHrxq/KemgDveurr7XivuYE9Ig8bzY606zrKKm1jov WOvYhlEHUcfPeuTlubbdEZLenoDOIrFNEivImCTnSeGMDKXfSyaFi1cu1kbQmheccXfN jjO4ZAifOzEKi9hGjcURt/Em4iZo/VYBAvSBxftddvHoo9ve7sUFVcJwXl9iNRF/GluE eNRXBN1u9MI+5OH14FWT20kZrAXm+lxsp9Y8CzfSIrlu/dBrXWupCFiwWcJUyUFdFqcr xsIA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=UOdjj+tTzV68Efxa8DJvC31FkWCWfq1JBKAxxP3sxk4=; b=U+APTyP+Gk6MI2diP0aF6py2JzlPeADhgs0AZCcIiYS+3AHz/oQPtoAVa2a4HjlQHQ 64yjtGbhMLzTqXQ7iFVwPADNa9h7nKkVgvTRlrp4O5VAyw/Hahe+tspPWPmxirnSrOEj /S4qZwSlS6LFRsD2UGbb4QwD4wmctf8l2jXKrmWSEKk86bSIiLaopVJALF9ER/QzT85P BBpr+2eamaKCwsYAV2OfWc8Eyeh51B/J1gXhYCq5jZuN6syhZURLzb8c44dK/7Ul4tYf b/SiWDkw9WdRdwVwaZaGw3PTuL/rWHc3KwrDcqKduEiT6bk6fxqGG8GRzscf1sWQ0FOn Dn1w== X-Gm-Message-State: ALoCoQl5Gn94rnTD26JAq/cn8n/Y4/TnhRGD7Rc3mNVefPzKwdSsq5mIokl3BYUE8ktCrFPiO+Z93iJtMj9dKm06GiotJr7pdQFXRbRJTNR2uZn1Sg+YbjR6X3hB8rOAy1sQoZ13f6ZlbGfOVc4zjYVJ8iJ7YgtZjUX9dX1aSDD0DQ4U3blBRGW2MwrJGtAVJIDsj4ogyxHe MIME-Version: 1.0 X-Received: by 10.140.37.146 with SMTP id r18mr67623582qgr.61.1391565345677; Tue, 04 Feb 2014 17:55:45 -0800 (PST) Received: by 10.229.154.208 with HTTP; Tue, 4 Feb 2014 17:55:45 -0800 (PST) In-Reply-To: <647dad549e3047e4a94c721a616f1dee@CO1PR02MB064.namprd02.prod.outlook.com> References: <647dad549e3047e4a94c721a616f1dee@CO1PR02MB064.namprd02.prod.outlook.com> Date: Tue, 4 Feb 2014 17:55:45 -0800 Message-ID: From: Ryan Sleevi To: Wayne Thayer Content-Type: multipart/alternative; boundary=001a11c1628e1c722604f19f0e64 Cc: "therightkey@ietf.org" , Ben Laurie , "certificate-transparency@googlegroups.com" , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 01:55:48 -0000 --001a11c1628e1c722604f19f0e64 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Feb 4, 2014 at 5:47 PM, Wayne Thayer wrote: > I'm somewhat confused by the following two points: > > >>5. By July 2014 all EV certificates with validity periods beyond [July > >>2014] should be logged in > at least [one] qualifying log (see below). > >>6. On 1 Jan 2015 Chrome will create a whitelist of valid EV certificate= s > >>already issued without > an embedded SCT [issued by CAs participating in CT] from all qualifying > logs. > > If EV certificates issued prior to 1 Jan 2015 will be whitelisted, what i= s > the purpose of point #5? > > Also, regarding point #7, I understand if it=C2=B9s not practical to dist= ribute > a large whitelist to mobile platforms, but IMO retroactively removing the > EV indicator from existing certs rather than letting them naturally expir= e > before enforcing CT on mobile platforms creates a bad EV experience in > return for little additional transparency & security. > > Thanks, > > Wayne > > Hi Wayne, Considering we already do not indicate EV on Android, nor have we ever, I don't think this perceived loss of functionality is as significant as you may believe. Further, considering the very real and distinct performance characteristics of mobile (radio warmups, RTTs, initcwnds), the idea of fetching OCSP, or, worse, CRLs - especially when some CAs have CRLs that are quite large (20+ MB) - in order to assure the EV display is... non-ideal. So again, the EV indicator on mobile is not as strong or as present as it may be on desktop platforms. > -----Original Message----- > From: therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of Ben > Laurie > Sent: Tuesday, February 04, 2014 10:08 AM > To: CABFPub; certificate-transparency@googlegroups.com; > therightkey@ietf.org > Subject: [therightkey] Updated Certificate Transparency + Extended > Validation plan > > Enclosed, our revised plan. > > Comments welcome. > > _______________________________________________ > Public mailing list > Public@cabforum.org > https://cabforum.org/mailman/listinfo/public > --001a11c1628e1c722604f19f0e64 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable



On Tue, Feb 4, 2014 at 5:47 PM, Wayne Thayer <= wthayer@godaddy.co= m> wrote:
I'm somewhat confused by the following t= wo points:

>>5. By July 2014 all EV certificates with validity periods beyond [J= uly
>>2014] should be logged in
at least [one] qualifying log (see below).
>>6. On 1 Jan 2015 Chrome will create a whitelist of valid EV certifi= cates
>>already issued without
an embedded SCT [issued by CAs participating in CT] from all qualifying
logs.

If EV certificates issued prior to 1 Jan 2015 will be whitelisted, what is<= br> the purpose of point #5?

Also, regarding point #7, I understand if it=C2=B9s not practical to distri= bute
a large whitelist to mobile platforms, but IMO retroactively removing the EV indicator from existing certs rather than letting them naturally expire<= br> before enforcing CT on mobile platforms creates a bad EV experience in
return for little additional transparency & security.

Thanks,

Wayne


Hi Wayn= e,

Considering we already do not indicate EV on An= droid, nor have we ever, I don't think this perceived loss of functiona= lity is as significant as you may believe.

Further, considering the very real and distinct perform= ance characteristics of mobile (radio warmups, RTTs, initcwnds), the idea o= f fetching OCSP, or, worse, CRLs - especially when some CAs have CRLs that = are quite large (20+ MB) - in order to assure the EV display is... non-idea= l. So again, the EV indicator on mobile is not as strong or as present as i= t may be on desktop platforms.
=C2=A0
-----Original Message-----
From: therightkey [mailto:t= herightkey-bounces@ietf.org] On Behalf Of Ben
Laurie
Sent: Tuesday, February 04, 2014 10:08 AM
To: CABFPub; c= ertificate-transparency@googlegroups.com;
therightkey@ietf.org
Subject: [therightkey] Updated Certificate T= ransparency + Extended
Validation plan

Enclosed, our revised plan.
Comments welcome.

_______________________= ________________________
Public mailing list
Public@cabforum.org
= https://cabforum.org/mailman/listinfo/public

--001a11c1628e1c722604f19f0e64-- From wthayer@godaddy.com Tue Feb 4 18:32:38 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E85D01A01A6 for ; Tue, 4 Feb 2014 18:32:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aa-E-QwXXV2v for ; Tue, 4 Feb 2014 18:32:37 -0800 (PST) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1blp0181.outbound.protection.outlook.com [207.46.163.181]) by ietfa.amsl.com (Postfix) with ESMTP id A8C601A0170 for ; Tue, 4 Feb 2014 18:32:36 -0800 (PST) Received: from CO1PR02MB064.namprd02.prod.outlook.com (10.242.163.16) by CO1PR02MB016.namprd02.prod.outlook.com (10.242.162.155) with Microsoft SMTP Server (TLS) id 15.0.868.8; Wed, 5 Feb 2014 02:32:33 +0000 Received: from CO1PR02MB064.namprd02.prod.outlook.com (10.242.163.16) by CO1PR02MB064.namprd02.prod.outlook.com (10.242.163.16) with Microsoft SMTP Server (TLS) id 15.0.868.8; Wed, 5 Feb 2014 02:32:32 +0000 Received: from CO1PR02MB064.namprd02.prod.outlook.com ([169.254.5.65]) by CO1PR02MB064.namprd02.prod.outlook.com ([169.254.5.16]) with mapi id 15.00.0868.013; Wed, 5 Feb 2014 02:32:32 +0000 From: Wayne Thayer To: Ryan Sleevi Thread-Topic: [cabfpub] [therightkey] Updated Certificate Transparency + Extended Validation plan Thread-Index: AQHPIhVktT0tAjjGeUGeNuv5LEU/QJqle4AA Date: Wed, 5 Feb 2014 02:32:31 +0000 Message-ID: References: <647dad549e3047e4a94c721a616f1dee@CO1PR02MB064.namprd02.prod.outlook.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [68.231.156.37] x-forefront-prvs: 01136D2D90 x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(979002)(377454003)(189002)(13464003)(199002)(31966008)(47976001)(50986001)(83322001)(19580395003)(81542001)(74502001)(19580405001)(69226001)(77096001)(81342001)(74662001)(76786001)(36756003)(76796001)(4396001)(74366001)(83072002)(2656002)(56816005)(49866001)(65816001)(63696002)(74706001)(92566001)(93516002)(54356001)(53806001)(15975445006)(59766001)(81686001)(90146001)(81816001)(87936001)(66066001)(80022001)(79102001)(47736001)(47446002)(87266001)(80976001)(86362001)(54316002)(56776001)(77982001)(51856001)(46102001)(92726001)(93136001)(16236675002)(74876001)(85852003)(94316002)(85306002)(94946001)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1101; SCL:1; SRVR:CO1PR02MB064; H:CO1PR02MB064.namprd02.prod.outlook.com; CLIP:68.231.156.37; FPR:3C78F43D.8FD617CA.19DF3788.84C9DD5D.2026C; InfoNoRecordsMX:1; A:1; LANG:en; Content-Type: multipart/alternative; boundary="_000_CF16EFDA678DAwthayergodaddycom_" MIME-Version: 1.0 X-OriginatorOrg: godaddy.com Cc: "therightkey@ietf.org" , Ben Laurie , "certificate-transparency@googlegroups.com" , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 02:32:39 -0000 --_000_CF16EFDA678DAwthayergodaddycom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Wayne, Considering we already do not indicate EV on Android, nor have we ever, I d= on't think this perceived loss of functionality is as significant as you ma= y believe. Further, considering the very real and distinct performance characteristics= of mobile (radio warmups, RTTs, initcwnds), the idea of fetching OCSP, or,= worse, CRLs - especially when some CAs have CRLs that are quite large (20+= MB) - in order to assure the EV display is... non-ideal. So again, the EV = indicator on mobile is not as strong or as present as it may be on desktop = platforms. In that case, what does this statement mean? Chrome for mobile platforms will cease to show EV indicators for certificat= es that are not CT qualified according to the criteria below. -----Original Message----- From: therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of Ben Laurie Sent: Tuesday, February 04, 2014 10:08 AM To: CABFPub; certificate-transparency@googlegroups.com; therightkey@ietf.org Subject: [therightkey] Updated Certificate Transparency + Extended Validation plan Enclosed, our revised plan. Comments welcome. _______________________________________________ Public mailing list Public@cabforum.org https://cabforum.org/mailman/listinfo/public --_000_CF16EFDA678DAwthayergodaddycom_ Content-Type: text/html; charset="us-ascii" Content-ID: <48E1540298FD8948AFE9A771271238CC@namprd02.prod.outlook.com> Content-Transfer-Encoding: quoted-printable

Hi Wayne,

Considering we already do not indicate EV on Android, nor have we ever= , I don't think this perceived loss of functionality is as significant as y= ou may believe.

Further, considering the very real and distinct performance characteri= stics of mobile (radio warmups, RTTs, initcwnds), the idea of fetching OCSP= , or, worse, CRLs - especially when some CAs have CRLs that are quite large= (20+ MB) - in order to assure the EV display is... non-ideal. So again, the EV indicator on mobile is not as= strong or as present as it may be on desktop platforms.

In that case, what does this statement mean?

Chrome f= or mobile platforms will cease to show EV indicators for certificates that = are not CT qualified according to the criteria below.




-----Original Message-----
From: therightkey [mailto:t= herightkey-bounces@ietf.org] On Behalf Of Ben
Laurie
Sent: Tuesday, February 04, 2014 10:08 AM
To: CABFPub; c= ertificate-transparency@googlegroups.com;
therightkey@ietf.org
Subject: [therightkey] Updated Certificate Transpa= rency + Extended
Validation plan

Enclosed, our revised plan.

Comments welcome.

_______________________________________________
Public mailing list
Public@cabforum.org
= https://cabforum.org/mailman/listinfo/public

 --_000_CF16EFDA678DAwthayergodaddycom_-- From jeremy.rowley@digicert.com Tue Feb 4 18:38:04 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC7D41A0170 for ; Tue, 4 Feb 2014 18:38:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.836 X-Spam-Level: X-Spam-Status: No, score=-4.836 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E74-BAujQ1_E for ; Tue, 4 Feb 2014 18:38:02 -0800 (PST) Received: from mail.digicert.com (mail.digicert.com [64.78.193.232]) by ietfa.amsl.com (Postfix) with ESMTP id 689CE1A0190 for ; Tue, 4 Feb 2014 18:38:02 -0800 (PST) Received: from JROWLEYL1 (c-67-166-110-179.hsd1.ut.comcast.net [67.166.110.179]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.digicert.com (Postfix) with ESMTPSA id 8F13F2E0A7; Tue, 4 Feb 2014 19:38:01 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digicert.com; s=mail; t=1391567881; bh=A1Ob75Nbirfz3utoBcYWf72Yl/YJZQNhyZsJPVgaAtA=; h=From:To:Cc:References:In-Reply-To:Subject:Date; b=MtDrA0EdSzco86cL5IumvS57f181JhaSWetDXZUHwM8rFy9qLW82xn1uk2ebin8EL fXe8aHyxCdPZpn7HJXWv5/QVozVo9b7+Oar6HdBpTeXhnOuOzeO9Ij1TGfWtsjiu+6 udK6BXn9gl1cLFqXI90BbomNrqw85mpVozB9BGbc= From: "Jeremy Rowley" To: "'Wayne Thayer'" , "'Ryan Sleevi'" References: <647dad549e3047e4a94c721a616f1dee@CO1PR02MB064.namprd02.prod.outlook.com> In-Reply-To: Date: Tue, 4 Feb 2014 19:38:05 -0700 Message-ID: <08b001cf221b$4cd7b4a0$e6871de0$@digicert.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_08B1_01CF21E0.A07B2690" X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQGGS/IGH2GP3iOZeF9RA+GsPjuqQQIVdKDBAjguOYYBXOgcbJsKSiSg Content-Language: en-us Cc: therightkey@ietf.org, 'Ben Laurie' , certificate-transparency@googlegroups.com, 'CABFPub' Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 02:38:04 -0000 This is a multipart message in MIME format. ------=_NextPart_000_08B1_01CF21E0.A07B2690 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit I'm confused as well. Does that mean Android will start showing an EV indicator? From: therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of Wayne Thayer Sent: Tuesday, February 04, 2014 7:33 PM To: Ryan Sleevi Cc: therightkey@ietf.org; Ben Laurie; certificate-transparency@googlegroups.com; CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan Hi Wayne, Considering we already do not indicate EV on Android, nor have we ever, I don't think this perceived loss of functionality is as significant as you may believe. Further, considering the very real and distinct performance characteristics of mobile (radio warmups, RTTs, initcwnds), the idea of fetching OCSP, or, worse, CRLs - especially when some CAs have CRLs that are quite large (20+ MB) - in order to assure the EV display is... non-ideal. So again, the EV indicator on mobile is not as strong or as present as it may be on desktop platforms. In that case, what does this statement mean? Chrome for mobile platforms will cease to show EV indicators for certificates that are not CT qualified according to the criteria below. -----Original Message----- From: therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of Ben Laurie Sent: Tuesday, February 04, 2014 10:08 AM To: CABFPub; certificate-transparency@googlegroups.com; therightkey@ietf.org Subject: [therightkey] Updated Certificate Transparency + Extended Validation plan Enclosed, our revised plan. Comments welcome. _______________________________________________ Public mailing list Public@cabforum.org https://cabforum.org/mailman/listinfo/public ------=_NextPart_000_08B1_01CF21E0.A07B2690 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I’m confused as well.  Does that mean Android will start = showing an EV indicator?

 

From:= = therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of = Wayne Thayer
Sent: Tuesday, February 04, 2014 7:33 = PM
To: Ryan Sleevi
Cc: therightkey@ietf.org; Ben = Laurie; certificate-transparency@googlegroups.com; = CABFPub
Subject: Re: [therightkey] [cabfpub] Updated = Certificate Transparency + Extended Validation = plan

 

 

Hi Wayne,

 

Considering we already do not indicate EV on Android, nor have we ever, = I don't think this perceived loss of functionality is as significant as = you may believe.

 

Further, considering the very real and distinct performance = characteristics of mobile (radio warmups, RTTs, initcwnds), the idea of = fetching OCSP, or, worse, CRLs - especially when some CAs have CRLs that = are quite large (20+ MB) - in order to assure the EV display is... = non-ideal. So again, the EV indicator on mobile is not as strong or as = present as it may be on desktop = platforms.

 

In that case, what does this statement = mean?

 

Chrome for mobile platforms will cease to show EV indicators for = certificates that are not CT qualified according to the criteria = below.

 

 

 

-----Original Message-----
From: therightkey [mailto:therightkey-bounces@ietf.org= ] On Behalf Of Ben
Laurie
Sent: Tuesday, February 04, 2014 = 10:08 AM
To: CABFPub; certificate-tra= nsparency@googlegroups.com;
therightkey@ietf.org<= /span>

Subject: [therightkey] Updated Certificate Transparency + = Extended
Validation plan

Enclosed, our revised plan.

Comments = welcome.

_______________________________________________
Public mailing = list
Public@cabforum.org
https://cabforum.org/mailman/listinfo/public

 

<= /body> ------=_NextPart_000_08B1_01CF21E0.A07B2690-- From sleevi@google.com Tue Feb 4 18:48:44 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2F0141A0004 for ; Tue, 4 Feb 2014 18:48:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.913 X-Spam-Level: X-Spam-Status: No, score=-1.913 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G212T0b0agwh for ; Tue, 4 Feb 2014 18:48:41 -0800 (PST) Received: from mail-qa0-x229.google.com (mail-qa0-x229.google.com [IPv6:2607:f8b0:400d:c00::229]) by ietfa.amsl.com (Postfix) with ESMTP id A6A8D1A0002 for ; Tue, 4 Feb 2014 18:48:41 -0800 (PST) Received: by mail-qa0-f41.google.com with SMTP id w8so13917300qac.0 for ; Tue, 04 Feb 2014 18:48:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=+vmFelaQ0/ano7RXVDARwF7uEvDs9hJQ2OFTchwELnE=; b=lUFq6fIAhWk80eKvZRhDilPyOevqY3mROhba1CMIjGFaog1I6Plb64lAJSmeBVFsxp E7YRfDUm1G5pqeW4SMvWyZZR3N3IGlTTatgEESprpdBAlKJy+Gdmy1v1J06pqLKXlHq+ xeoyFLnb5BDqpd1e+0VSvEJp+R/+am23ZcHZTZVziRqGF074aWu6i5O5+I5TB39Aton6 O6gUWM/FYmmAleDFhKY8rgHfkQBuL3RTnvyyZ6ohCdIAMRGn+P+Cqh+FYDT+cSlm8zk1 2lCczcPCmWcMTu0Klm9iA72HVc3OSde5PqiCWpHzK6zaYTAcyStyVO5NYg5SDEKlcah3 2Aeg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=+vmFelaQ0/ano7RXVDARwF7uEvDs9hJQ2OFTchwELnE=; b=Yghk+XPanKExGmv1iwoRk8Uv407cREsRyU5PY+43jAlr7ieHSi0uFSvkGXHrBcXU8e CfCvSYn+a5B7sunblyLoS/dvxWflqbJ6Rf9RLOD8WDT2qf/BdlukeQcGK+X7g9NnYDRV AzpeHEGSX0tJmOh+iLYHYyJj4hc7PzEZYVWx6QOYD4Dqfvwh7VVzLvM3cGySkLv1dUaQ A+ConIZdmYiJRTYUYXpB+5Xh9jZNti8gTxO7UOYQpfAU7aaiQIxMOUxEikSxyokdXJ+c cn8U/M857FeTT75GVp0rYBQS/1pmj9TAh6a/78eZpD7YCapWoABOCNsR8Jn7l/rPiBfG uqXA== X-Gm-Message-State: ALoCoQl/T0ouv4TRlh3WlQsbiFdX3+PgReJ5VX8XkKTLlf/Ux2FDJZeQG4LIpL9UqSMT9g3HtmLPfNidy0JmvYko0nSK3iI1ORc3P2c5d0E8Fok0Z+oWPsIpquh5n9YP/nocuPhv9e9x/9Qft7KQ/3l61qgUALmujJ2GMu/3fOJvsnni6pRgRzXLOgriQ0cdip88uXUFLmLy MIME-Version: 1.0 X-Received: by 10.224.79.133 with SMTP id p5mr72781659qak.56.1391568520894; Tue, 04 Feb 2014 18:48:40 -0800 (PST) Received: by 10.229.154.208 with HTTP; Tue, 4 Feb 2014 18:48:40 -0800 (PST) In-Reply-To: <08b001cf221b$4cd7b4a0$e6871de0$@digicert.com> References: <647dad549e3047e4a94c721a616f1dee@CO1PR02MB064.namprd02.prod.outlook.com> <08b001cf221b$4cd7b4a0$e6871de0$@digicert.com> Date: Tue, 4 Feb 2014 18:48:40 -0800 Message-ID: From: Ryan Sleevi To: Jeremy Rowley Content-Type: multipart/alternative; boundary=047d7bf0de7a5e6e8804f19fcb01 Cc: therightkey , Ben Laurie , certificate-transparency , Wayne Thayer , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 02:48:44 -0000 --047d7bf0de7a5e6e8804f19fcb01 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Feb 4, 2014 at 6:38 PM, Jeremy Rowley w= rote: > I=E2=80=99m confused as well. Does that mean Android will start showing = an EV > indicator? > > > > *From:* therightkey [mailto:therightkey-bounces@ietf.org] *On Behalf Of *= Wayne > Thayer > *Sent:* Tuesday, February 04, 2014 7:33 PM > *To:* Ryan Sleevi > *Cc:* therightkey@ietf.org; Ben Laurie; > certificate-transparency@googlegroups.com; CABFPub > *Subject:* Re: [therightkey] [cabfpub] Updated Certificate Transparency + > Extended Validation plan > > > > > > Hi Wayne, > > > > Considering we already do not indicate EV on Android, nor have we ever, I > don't think this perceived loss of functionality is as significant as you > may believe. > > > > Further, considering the very real and distinct performance > characteristics of mobile (radio warmups, RTTs, initcwnds), the idea of > fetching OCSP, or, worse, CRLs - especially when some CAs have CRLs that > are quite large (20+ MB) - in order to assure the EV display is... > non-ideal. So again, the EV indicator on mobile is not as strong or as > present as it may be on desktop platforms. > > > > In that case, what does this statement mean? > > > > Chrome for mobile platforms will cease to show EV indicators for > certificates that are not CT qualified according to the criteria below. > It means that for any CAs that hope to be recognized as EV on Chrome for mobile platforms (which include iOS), implementing CT by the dates outlined is seen as a requirement for such treatment. We wanted to specifically call attention to this - the whitelist is seen as a temporary measure for Desktop, but given the unique characteristics of mobile platforms, we're pursuing this requirement at a more aggressive pace. While Chrome for Android - and the Chrome-based WebView, as the WebView preceding it - do not provide special treatment for EV, any future plans for EV indications on these platforms have incorporated the above requirements and dates. > > > > > > > -----Original Message----- > From: therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of Ben > Laurie > Sent: Tuesday, February 04, 2014 10:08 AM > To: CABFPub; certificate-transparency@googlegroups.com; > therightkey@ietf.org > > Subject: [therightkey] Updated Certificate Transparency + Extended > Validation plan > > Enclosed, our revised plan. > > Comments welcome. > > _______________________________________________ > Public mailing list > Public@cabforum.org > https://cabforum.org/mailman/listinfo/public > > > > --047d7bf0de7a5e6e8804f19fcb01 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable



On Tue, Feb 4, 2014 at 6:38 PM, Jeremy Rowley <= ;jeremy.row= ley@digicert.com> wrote:

I=E2=80=99m c= onfused as well.=C2=A0 Does that mean Android will start showing an EV indi= cator?

=C2=A0

From: theright= key [mailto:therightkey-bounces@ietf.org] On Behalf Of Wayne Thayer
Sent: Tuesday, February 04, 2014 7:33 PM
To: Ryan SleeviCc: ther= ightkey@ietf.org; Ben Laurie; certificate-transparency@googlegroups= .com; CABFPub
Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparenc= y + Extended Validation plan

=C2=A0

=C2=A0

Hi Wayne,

= =C2=A0

Considering we already do no= t indicate EV on Android, nor have we ever, I don't think this perceive= d loss of functionality is as significant as you may believe.=

=C2=A0<= /p>

Further, considering the = very real and distinct performance characteristics of mobile (radio warmups= , RTTs, initcwnds), the idea of fetching OCSP, or, worse, CRLs - especially= when some CAs have CRLs that are quite large (20+ MB) - in order to assure= the EV display is... non-ideal. So again, the EV indicator on mobile is no= t as strong or as present as it may be on desktop platforms.<= /span>

=C2=A0

In that case, what does this statement mean?

=C2=A0<= /p>

C= hrome for mobile platforms will cease to show EV indicators for certificate= s that are not CT qualified according to the criteria below.


It means tha= t for any CAs that hope to be recognized as EV on Chrome for mobile platfor= ms (which include iOS), implementing CT by the dates outlined is seen as a = requirement for such treatment. We wanted to specifically call attention to= this - the whitelist is seen as a temporary measure for Desktop, but given= the unique characteristics of mobile platforms, we're pursuing this re= quirement at a more aggressive pace.

While Chrome for Android - and the Chrome-based WebView= , as the WebView preceding it - do not provide special treatment for EV, an= y future plans for EV indications on these platforms have incorporated the = above requirements and dates.
=C2=A0

=C2=A0

=C2=A0

=C2= =A0

<= div>

-----Original Message-----
From= : therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of Ben
Laurie
Sent: Tuesday, February 04, 2014 10:08 AM
To: CABFPub; cer= tificate-transparency@googlegroups.com;
therightkey@ietf.org=

Subject: [therightkey] Updated Certificate Transparency + Extended
Va= lidation plan

Enclosed, our revised plan.

Comments welcome.<= /span>

_________________= ______________________________
Public mailing list
Public@cabforum.org
= https://cabforum.org/mailman/listinfo/public

=C2= =A0

<= /div>
--047d7bf0de7a5e6e8804f19fcb01-- From wthayer@godaddy.com Tue Feb 4 19:12:20 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D65651A0012 for ; Tue, 4 Feb 2014 19:12:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ja3DfEWD-lYo for ; Tue, 4 Feb 2014 19:12:12 -0800 (PST) Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2lp0244.outbound.protection.outlook.com [207.46.163.244]) by ietfa.amsl.com (Postfix) with ESMTP id DB9FE1A000C for ; Tue, 4 Feb 2014 19:12:11 -0800 (PST) Received: from CO1PR02MB064.namprd02.prod.outlook.com (10.242.163.16) by CO1PR02MB062.namprd02.prod.outlook.com (10.242.163.12) with Microsoft SMTP Server (TLS) id 15.0.868.8; Wed, 5 Feb 2014 03:12:09 +0000 Received: from CO1PR02MB064.namprd02.prod.outlook.com ([169.254.5.65]) by CO1PR02MB064.namprd02.prod.outlook.com ([169.254.5.16]) with mapi id 15.00.0868.013; Wed, 5 Feb 2014 03:12:09 +0000 From: Wayne Thayer To: Ryan Sleevi , Jeremy Rowley Thread-Topic: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan Thread-Index: AQHPIhtL+WmzA48PxEuQCqmiz/uBapql9VYA//+RLgA= Date: Wed, 5 Feb 2014 03:12:08 +0000 Message-ID: References: <647dad549e3047e4a94c721a616f1dee@CO1PR02MB064.namprd02.prod.outlook.com> <08b001cf221b$4cd7b4a0$e6871de0$@digicert.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [68.231.156.37] x-forefront-prvs: 01136D2D90 x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(377454003)(24454002)(189002)(199002)(19580405001)(87936001)(81686001)(80976001)(85852003)(92566001)(92726001)(83072002)(76786001)(46102001)(54356001)(2656002)(16236675002)(77096001)(51856001)(53806001)(4396001)(76796001)(81816001)(19580395003)(66066001)(83322001)(90146001)(50986001)(47976001)(49866001)(36756003)(81342001)(94316002)(47446002)(80022001)(65816001)(74876001)(74502001)(93516002)(93136001)(56816005)(74662001)(81542001)(86362001)(74366001)(47736001)(85306002)(56776001)(87266001)(54316002)(69226001)(94946001)(77982001)(79102001)(59766001)(31966008)(74706001)(63696002); DIR:OUT; SFP:1101; SCL:1; SRVR:CO1PR02MB062; H:CO1PR02MB064.namprd02.prod.outlook.com; CLIP:68.231.156.37; FPR:1E58F0F5.A7D6C7C2.E1D3370B.88E9E15C.203AA; InfoNoRecordsMX:1; A:1; LANG:en; Content-Type: multipart/alternative; boundary="_000_CF16F6CD678E6wthayergodaddycom_" MIME-Version: 1.0 X-OriginatorOrg: godaddy.com Cc: therightkey , Ben Laurie , certificate-transparency , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 03:12:21 -0000 --_000_CF16F6CD678E6wthayergodaddycom_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable On Tue, Feb 4, 2014 at 6:38 PM, Jeremy Rowley > wrote: I'm confused as well. Does that mean Android will start showing an EV indi= cator? From: therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of Wayne Thayer Sent: Tuesday, February 04, 2014 7:33 PM To: Ryan Sleevi Cc: therightkey@ietf.org; Ben Laurie; certific= ate-transparency@googlegroups.com; CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Ext= ended Validation plan Hi Wayne, Considering we already do not indicate EV on Android, nor have we ever, I d= on't think this perceived loss of functionality is as significant as you ma= y believe. Further, considering the very real and distinct performance characteristics= of mobile (radio warmups, RTTs, initcwnds), the idea of fetching OCSP, or,= worse, CRLs - especially when some CAs have CRLs that are quite large (20+= MB) - in order to assure the EV display is... non-ideal. So again, the EV = indicator on mobile is not as strong or as present as it may be on desktop = platforms. In that case, what does this statement mean? Chrome for mobile platforms will cease to show EV indicators for certificat= es that are not CT qualified according to the criteria below. It means that for any CAs that hope to be recognized as EV on Chrome for mo= bile platforms (which include iOS), implementing CT by the dates outlined i= s seen as a requirement for such treatment. We wanted to specifically call = attention to this - the whitelist is seen as a temporary measure for Deskto= p, but given the unique characteristics of mobile platforms, we're pursuing= this requirement at a more aggressive pace. While Chrome for Android - and the Chrome-based WebView, as the WebView pre= ceding it - do not provide special treatment for EV, any future plans for E= V indications on these platforms have incorporated the above requirements a= nd dates. In that case, my original objection stands - this policy retroactively down= grades existing EV certificates if and when a mobile platform chooses to im= plement an EV indicator. There are certainly times when it's necessary to a= pply a new policy to existing certificates to protect relying parties, but = IMO this isn't one of them. --_000_CF16F6CD678E6wthayergodaddycom_ Content-Type: text/html; charset="iso-8859-1" Content-ID: Content-Transfer-Encoding: quoted-printable

On Tue, Feb 4, 2014 at 6:38 PM, Jeremy Rowley <jeremy.= rowley@digicert.com> wrote:

I’m confused as well.  D= oes that mean Android will start showing an EV indicator?

 

From: therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of Wayne Thayer
Sent: Tuesday, February 04, 2014 7:33 PM
To: Ryan Sleevi
Cc: therig= htkey@ietf.org; Ben Laurie; certificate-transparency@googlegroups.com; CABFPub
Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparenc= y + Extended Validation plan

 

 

Hi Wayne,

 

Considering we already do not indicate EV on Android, nor = have we ever, I don't think this perceived loss of functionality is as sign= ificant as you may believe.

 

Further, considering the very real and distinct performanc= e characteristics of mobile (radio warmups, RTTs, initcwnds), the idea of f= etching OCSP, or, worse, CRLs - especially when some CAs have CRLs that are quite large (20+ MB) - in order to as= sure the EV display is... non-ideal. So again, the EV indicator on mobile i= s not as strong or as present as it may be on desktop platforms.<= /u>

 

In that case, what does this statement mean?=

 

Chrome for mobile platforms will c= ease to show EV indicators for certificates that are not CT qualified accor= ding to the criteria below.


It means that for any CAs that hope to be recognized as EV on Chrome f= or mobile platforms (which include iOS), implementing CT by the dates outli= ned is seen as a requirement for such treatment. We wanted to specifically = call attention to this - the whitelist is seen as a temporary measure for Desktop, but given the unique character= istics of mobile platforms, we're pursuing this requirement at a more aggre= ssive pace.

While Chrome for Android - and the Chrome-based WebView, as the WebVie= w preceding it - do not provide special treatment for EV, any future plans = for EV indications on these platforms have incorporated the above requireme= nts and dates.
 
In that case, my original objection stands – this policy retroac= tively downgrades existing EV certificates if and when a mobile platform ch= ooses to implement an EV indicator. There are certainly times when it’= ;s necessary to apply a new policy to existing certificates to protect relying parties, but IMO this isn’t one of t= hem.
--_000_CF16F6CD678E6wthayergodaddycom_-- From sleevi@google.com Tue Feb 4 19:23:25 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 43BF61A0019 for ; Tue, 4 Feb 2014 19:23:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.913 X-Spam-Level: X-Spam-Status: No, score=-1.913 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yOBF0QKLH-UK for ; Tue, 4 Feb 2014 19:23:22 -0800 (PST) Received: from mail-qc0-x230.google.com (mail-qc0-x230.google.com [IPv6:2607:f8b0:400d:c01::230]) by ietfa.amsl.com (Postfix) with ESMTP id 940D31A0016 for ; Tue, 4 Feb 2014 19:23:22 -0800 (PST) Received: by mail-qc0-f176.google.com with SMTP id e16so15330778qcx.35 for ; Tue, 04 Feb 2014 19:23:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=eIhb5a24KUaUwO4fO8ur7jxl5NAHKm5TwJ9X0rtmw0s=; b=prXzMHhECier7+lVrMa8sN68jXbsT0Y8XebhSe8tMDALUEzHzVxpyuMrxBD44q5V1v Whsiqjxjjz0M6A0qCkWyg+M83PPLS/51NNdoq45wovpq/V6eipD1Jbosbc83UOpjeJBF kjsyJWsebuLzHdWVfOzTykL3scm1efvOwGiWJSp5Jp97TXFRpD6JXboNblBBQnKi4TJt KTgZs9SL9Dqm4m0RW4afKKAq80SGbA898vgyQY/5qDUfFOUhhKLUCI/xAZnxFXflH0uc /+Veginzo1fWc1uVj9v15rpZ8h0vnLA2sB0rszB1iJyCZH+e+TxrN8npEDYdwOFcNczG UV4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=eIhb5a24KUaUwO4fO8ur7jxl5NAHKm5TwJ9X0rtmw0s=; b=eUw8Lj9GfV8P+NEc8x8X1Ju2avkYDQXxzmXW+nUKbTo07NgDm6qeczFVMK/9OxY8Xi LJtYB0z21NfHZ33xvJR2/pkzpFCwywawZZr0xGAizDsF81jfmk2ThJxnXtYadFLVCm6a Q5eq9h4as/xQ4k6OXSaMrCVlLBUHJ5G8wDWdZKp965AFFv69lIv7eeV2H1hZYWm20zf7 MNcl76LK6HwBWH6ybnZbzd/MbwKubGV/ZrLoR1UbrVD4h11Izt+hUUeZgWV5kjZQm88V BcytiW1H+wmRZLfoW4gMteDY15dlOi1Zx6LAnhEQEEM8u30aI6wnvONUW5Cf4/kHl6Zx A+OA== X-Gm-Message-State: ALoCoQkMLVEvvvX/zXsxbIKo9fZkw6Awt0T9hhQYV1hwi07yDG2IDz0DoF/ByIhcpCP7HMzXE4uuYzbrVyQ9IkHNL+jVJ9JFA6p5iQw1kpnjocwJu8NEEZtObHM/obARcneqyb1xWCkN+4R3xNYTMHtLWhc2onbOwjQfyEuxYWdJpLZZwCtLerql5D5fVZY4wm9w1FKFmVug MIME-Version: 1.0 X-Received: by 10.224.111.195 with SMTP id t3mr72942281qap.2.1391570601895; Tue, 04 Feb 2014 19:23:21 -0800 (PST) Received: by 10.229.154.208 with HTTP; Tue, 4 Feb 2014 19:23:21 -0800 (PST) In-Reply-To: References: <647dad549e3047e4a94c721a616f1dee@CO1PR02MB064.namprd02.prod.outlook.com> <08b001cf221b$4cd7b4a0$e6871de0$@digicert.com> Date: Tue, 4 Feb 2014 19:23:21 -0800 Message-ID: From: Ryan Sleevi To: Wayne Thayer Content-Type: multipart/alternative; boundary=047d7b60457e67f85b04f1a047e3 Cc: therightkey , Ben Laurie , certificate-transparency , Jeremy Rowley , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 03:23:25 -0000 --047d7b60457e67f85b04f1a047e3 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Feb 4, 2014 at 7:12 PM, Wayne Thayer wrote: > > On Tue, Feb 4, 2014 at 6:38 PM, Jeremy Rowley wrote: > >> I=E2=80=99m confused as well. Does that mean Android will start showin= g an EV >> indicator? >> >> >> >> *From:* therightkey [mailto:therightkey-bounces@ietf.org] *On Behalf Of = *Wayne >> Thayer >> *Sent:* Tuesday, February 04, 2014 7:33 PM >> *To:* Ryan Sleevi >> *Cc:* therightkey@ietf.org; Ben Laurie; >> certificate-transparency@googlegroups.com; CABFPub >> *Subject:* Re: [therightkey] [cabfpub] Updated Certificate Transparency >> + Extended Validation plan >> >> >> >> >> >> Hi Wayne, >> >> >> >> Considering we already do not indicate EV on Android, nor have we ever, = I >> don't think this perceived loss of functionality is as significant as yo= u >> may believe. >> >> >> >> Further, considering the very real and distinct performance >> characteristics of mobile (radio warmups, RTTs, initcwnds), the idea of >> fetching OCSP, or, worse, CRLs - especially when some CAs have CRLs that >> are quite large (20+ MB) - in order to assure the EV display is... >> non-ideal. So again, the EV indicator on mobile is not as strong or as >> present as it may be on desktop platforms. >> >> >> >> In that case, what does this statement mean? >> >> >> >> Chrome for mobile platforms will cease to show EV indicators for >> certificates that are not CT qualified according to the criteria below. >> > > It means that for any CAs that hope to be recognized as EV on Chrome for > mobile platforms (which include iOS), implementing CT by the dates outlin= ed > is seen as a requirement for such treatment. We wanted to specifically ca= ll > attention to this - the whitelist is seen as a temporary measure for > Desktop, but given the unique characteristics of mobile platforms, we're > pursuing this requirement at a more aggressive pace. > > While Chrome for Android - and the Chrome-based WebView, as the WebView > preceding it - do not provide special treatment for EV, any future plans > for EV indications on these platforms have incorporated the above > requirements and dates. > > > In that case, my original objection stands =E2=80=93 this policy retroac= tively > downgrades existing EV certificates if and when a mobile platform chooses > to implement an EV indicator. There are certainly times when it=E2=80=99s= necessary > to apply a new policy to existing certificates to protect relying parties= , > but IMO this isn=E2=80=99t one of them. > Wayne, While I appreciate your position, I am absolutely baffled as how you can present this as a "downgrade". If and when Android supports EV, certificates that fail to meet this requirements will continue to appear exactly the same as they do today and they have in the past. Certificates which do conform to these program requirements will, presumably, be granted distinguishing UI. To the customer who purchased a certificate today, their certificate will continue to appear in that future world exactly how it appears today, presumably - providing them exactly what they expected. I can only interpret your objection as an objection to root store programs requiring additional requirements above and beyond that of the EV Guidelines. I can only presume that you have similar objections to root store programs requiring additional requirements above and beyond the Baseline Requirements - as (to the best of my knowledge) - every root program already does today. Could you perhaps quantify exactly what you see as the downgrade, given that such a hypothetical user experience (as again, EV is not presently implemented in Chrome for Android) does not change? --047d7b60457e67f85b04f1a047e3 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable



On Tue, Feb 4, 2014 at 7:12 PM, Wayne Thayer <= wthayer@godaddy.co= m> wrote:

On Tue, Feb 4, 2014 at 6:38 PM, Jeremy Rowley <jeremy.= rowley@digicert.com> wrote:

I=E2=80=99m confused as well.=C2=A0 Does tha= t mean Android will start showing an EV indicator?

=C2=A0

From: therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of Wayne Thayer
Sent: Tuesday, February 04, 2014 7:33 PM
To: Ryan Sleevi
Cc: therig= htkey@ietf.org; Ben Laurie; certificate-transparency@googlegroups.com; CABFPub
Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparenc= y + Extended Validation plan

=C2=A0

=C2=A0

Hi Wayne,

=C2=A0

Considering we already do not indicate EV on Android, nor have = we ever, I don't think this perceived loss of functionality is as signi= ficant as you may believe.

=C2=A0

Further, considering the very real and distinct performance cha= racteristics of mobile (radio warmups, RTTs, initcwnds), the idea of fetchi= ng OCSP, or, worse, CRLs - especially when some CAs have CRLs that are quite large (20+ MB) - in order to assure= the EV display is... non-ideal. So again, the EV indicator on mobile is no= t as strong or as present as it may be on desktop platforms.<= /span>

=C2=A0

In that case, what does this statement mean?

=C2=A0

Chrome for mobile platforms will cease = to show EV indicators for certificates that are not CT qualified according = to the criteria below.


It means that for any CAs that hope to be recognized as EV on Chrome f= or mobile platforms (which include iOS), implementing CT by the dates outli= ned is seen as a requirement for such treatment. We wanted to specifically = call attention to this - the whitelist is seen as a temporary measure for Desktop, but given the unique character= istics of mobile platforms, we're pursuing this requirement at a more a= ggressive pace.

While Chrome for Android - and the Chrome-based WebView, as the WebVie= w preceding it - do not provide special treatment for EV, any future plans = for EV indications on these platforms have incorporated the above requireme= nts and dates.
=C2=A0
In that case, my original objection stands =E2=80=93 this policy= retroactively downgrades existing EV certificates if and when a mobile pla= tform chooses to implement an EV indicator. There are certainly times when = it=E2=80=99s necessary to apply a new policy to existing certificates to protect relying parties, but IMO this isn=E2=80=99t one of= them.

Wayne,

While I appreciate your position, I am absolutely baffled as how yo= u can present this as a "downgrade".

If and when Android supports EV, certificates that fail= to meet this requirements will continue to appear exactly the same as they= do today and they have in the past. Certificates which do conform to these= program requirements will, presumably, be granted distinguishing UI. To th= e customer who purchased a certificate today, their certificate will contin= ue to appear in that future world exactly how it appears today, presumably = - providing them exactly what they expected.

I can only interpret your objection as an objection to = root store programs requiring additional requirements above and beyond that= of the EV Guidelines. I can only presume that you have similar objections = to root store programs requiring additional requirements above and beyond t= he Baseline Requirements - as (to the best of my knowledge) - every root pr= ogram already does today.

Could you perhaps quantify exactly what you see as the = downgrade, given that such a hypothetical user experience (as again, EV is = not presently implemented in Chrome for Android) does not change?
--047d7b60457e67f85b04f1a047e3-- From wthayer@godaddy.com Tue Feb 4 20:31:22 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B8A061A0026 for ; Tue, 4 Feb 2014 20:31:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Inn1-0Qnb9wP for ; Tue, 4 Feb 2014 20:31:19 -0800 (PST) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1blp0190.outbound.protection.outlook.com [207.46.163.190]) by ietfa.amsl.com (Postfix) with ESMTP id 7F2651A0020 for ; Tue, 4 Feb 2014 20:31:16 -0800 (PST) Received: from CO1PR02MB064.namprd02.prod.outlook.com (10.242.163.16) by CO1PR02MB061.namprd02.prod.outlook.com (10.242.163.11) with Microsoft SMTP Server (TLS) id 15.0.868.8; Wed, 5 Feb 2014 04:31:14 +0000 Received: from CO1PR02MB064.namprd02.prod.outlook.com ([169.254.5.65]) by CO1PR02MB064.namprd02.prod.outlook.com ([169.254.5.16]) with mapi id 15.00.0868.013; Wed, 5 Feb 2014 04:31:13 +0000 From: Wayne Thayer To: Ryan Sleevi Thread-Topic: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan Thread-Index: AQHPIhtL+WmzA48PxEuQCqmiz/uBapql9VYA//+RLgCAAHiCgP//nZYA Date: Wed, 5 Feb 2014 04:31:12 +0000 Message-ID: References: <647dad549e3047e4a94c721a616f1dee@CO1PR02MB064.namprd02.prod.outlook.com> <08b001cf221b$4cd7b4a0$e6871de0$@digicert.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [68.231.156.37] x-forefront-prvs: 01136D2D90 x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(24454002)(189002)(199002)(377454003)(90146001)(74662001)(47446002)(79102001)(54316002)(74502001)(77982001)(86362001)(59766001)(74876001)(47736001)(47976001)(49866001)(66066001)(65816001)(94316002)(80022001)(56816005)(74366001)(56776001)(81542001)(94946001)(74706001)(63696002)(93136001)(81342001)(31966008)(36756003)(69226001)(93516002)(83072002)(50986001)(85852003)(92726001)(77096001)(19580405001)(92566001)(81816001)(16236675002)(87936001)(81686001)(76786001)(46102001)(87266001)(85306002)(76796001)(51856001)(2656002)(83322001)(53806001)(19580395003)(80976001)(54356001)(4396001); DIR:OUT; SFP:1101; SCL:1; SRVR:CO1PR02MB061; H:CO1PR02MB064.namprd02.prod.outlook.com; CLIP:68.231.156.37; FPR:DE28F0E5.A7F69542.F1D3FFCB.48E9E15C.20564; InfoNoRecordsMX:1; A:1; LANG:en; Content-Type: multipart/alternative; boundary="_000_CF16FF486791Awthayergodaddycom_" MIME-Version: 1.0 X-OriginatorOrg: godaddy.com Cc: therightkey , Ben Laurie , certificate-transparency , Jeremy Rowley , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 04:31:23 -0000 --_000_CF16FF486791Awthayergodaddycom_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable On Tue, Feb 4, 2014 at 7:12 PM, Wayne Thayer > wrote: On Tue, Feb 4, 2014 at 6:38 PM, Jeremy Rowley > wrote: I=92m confused as well. Does that mean Android will start showing an EV in= dicator? From: therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of Wayne Thayer Sent: Tuesday, February 04, 2014 7:33 PM To: Ryan Sleevi Cc: therightkey@ietf.org; Ben Laurie; certific= ate-transparency@googlegroups.com; CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Ext= ended Validation plan Hi Wayne, Considering we already do not indicate EV on Android, nor have we ever, I d= on't think this perceived loss of functionality is as significant as you ma= y believe. Further, considering the very real and distinct performance characteristics= of mobile (radio warmups, RTTs, initcwnds), the idea of fetching OCSP, or,= worse, CRLs - especially when some CAs have CRLs that are quite large (20+= MB) - in order to assure the EV display is... non-ideal. So again, the EV = indicator on mobile is not as strong or as present as it may be on desktop = platforms. In that case, what does this statement mean? Chrome for mobile platforms will cease to show EV indicators for certificat= es that are not CT qualified according to the criteria below. It means that for any CAs that hope to be recognized as EV on Chrome for mo= bile platforms (which include iOS), implementing CT by the dates outlined i= s seen as a requirement for such treatment. We wanted to specifically call = attention to this - the whitelist is seen as a temporary measure for Deskto= p, but given the unique characteristics of mobile platforms, we're pursuing= this requirement at a more aggressive pace. While Chrome for Android - and the Chrome-based WebView, as the WebView pre= ceding it - do not provide special treatment for EV, any future plans for E= V indications on these platforms have incorporated the above requirements a= nd dates. In that case, my original objection stands =96 this policy retroactively do= wngrades existing EV certificates if and when a mobile platform chooses to = implement an EV indicator. There are certainly times when it=92s necessary = to apply a new policy to existing certificates to protect relying parties, = but IMO this isn=92t one of them. Wayne, While I appreciate your position, I am absolutely baffled as how you can pr= esent this as a "downgrade". If and when Android supports EV, certificates that fail to meet this requir= ements will continue to appear exactly the same as they do today and they h= ave in the past. Certificates which do conform to these program requirement= s will, presumably, be granted distinguishing UI. To the customer who purch= ased a certificate today, their certificate will continue to appear in that= future world exactly how it appears today, presumably - providing them exa= ctly what they expected. I can only interpret your objection as an objection to root store programs = requiring additional requirements above and beyond that of the EV Guideline= s. I can only presume that you have similar objections to root store progra= ms requiring additional requirements above and beyond the Baseline Requirem= ents - as (to the best of my knowledge) - every root program already does t= oday. Ryan, I believe that I have repeatedly stated my support for Google=92s overall p= lan to implement CT, so please don't blow this discussion out of proportion= by interpreting it as me objecting to anything and everything a root store= operator chooses to do unilaterally. On the other hand, more coordination = amongst root store operators would be great! Could you perhaps quantify exactly what you see as the downgrade, given tha= t such a hypothetical user experience (as again, EV is not presently implem= ented in Chrome for Android) does not change? My concern is one of timing. Rather than letting perfectly good EV certific= ates expire naturally or be grandfathered in, they are treated as non-EV ce= rtificates under this policy. When I use the terms =91downgrade=92 and =91r= etroactive', I am specifically referring to a policy in which some EV certi= ficates issued prior to the implementation of the policy (retroactive) are = treated as non-EV (downgrade). I now understand that there is currently no = change in how they are displayed in Chrome for Android, but (1) the policy = and your comments imply that there will be, and (2) however hypothetical it= may be, a precedent is being set here. If this still doesn=92t make sense, maybe we can discuss it at the CAB Foru= m meeting in a few weeks. Also, can someone answer my question on point #5 in my original message? --_000_CF16FF486791Awthayergodaddycom_ Content-Type: text/html; charset="Windows-1252" Content-ID: <45917BCDAB117645AF8B8036C38D1E1F@namprd02.prod.outlook.com> Content-Transfer-Encoding: quoted-printable

On Tue, Feb 4, 2014 at 7:12 PM, Wayne Thayer <wthayer@godadd= y.com> wrote:

On Tue, Feb 4, 2014 at 6:38 PM, Jeremy Rowley <jeremy.= rowley@digicert.com> wrote:

I=92m confused as well.  Does = that mean Android will start showing an EV indicator?

From: therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of Wayne Thayer
Sent: Tuesday, February 04, 2014 7:33 PM
To: Ryan Sleevi
Cc: therig= htkey@ietf.org; Ben Laurie; certificate-transparency@googlegroups.com; CABFPub
Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparenc= y + Extended Validation plan

 

Hi Wayne,

Considering we already do not indicate EV on Android, nor = have we ever, I don't think this perceived loss of functionality is as sign= ificant as you may believe.

Further, considering the very real and distinct performanc= e characteristics of mobile (radio warmups, RTTs, initcwnds), the idea of f= etching OCSP, or, worse, CRLs - especially when some CAs have CRLs that are quite large (20+ MB) - in order to as= sure the EV display is... non-ideal. So again, the EV indicator on mobile i= s not as strong or as present as it may be on desktop platforms. 

In that case, what does this statement mean?

Chrome for mobile platforms will c= ease to show EV indicators for certificates that are not CT qualified accor= ding to the criteria below.


It means that for any CAs that hope to be recognized as EV on Chrome f= or mobile platforms (which include iOS), implementing CT by the dates outli= ned is seen as a requirement for such treatment. We wanted to specifically = call attention to this - the whitelist is seen as a temporary measure for Desktop, but given the unique character= istics of mobile platforms, we're pursuing this requirement at a more aggre= ssive pace.

While Chrome for Android - and the Chrome-based WebView, as the WebVie= w preceding it - do not provide special treatment for EV, any future plans = for EV indications on these platforms have incorporated the above requireme= nts and dates.
 
In that case, my original objection stands =96 this policy retroactive= ly downgrades existing EV certificates if and when a mobile platform choose= s to implement an EV indicator. There are certainly times when it=92s neces= sary to apply a new policy to existing certificates to protect relying parties, but IMO this isn=92t one of them.=

Wayne,

While I appreciate your position, I am absolutely baffled as how you c= an present this as a "downgrade".

If and when Android supports EV, certificates that fail to meet this r= equirements will continue to appear exactly the same as they do today and t= hey have in the past. Certificates which do conform to these program requir= ements will, presumably, be granted distinguishing UI. To the customer who purchased a certificate today, thei= r certificate will continue to appear in that future world exactly how it a= ppears today, presumably - providing them exactly what they expected.

I can only interpret your objection as an objection to root store prog= rams requiring additional requirements above and beyond that of the EV Guid= elines. I can only presume that you have similar objections to root store p= rograms requiring additional requirements above and beyond the Baseline Requirements - as (to the best of my knowled= ge) - every root program already does today.

Ryan,

I believe that I have repeatedly stated my support for Google=92s over= all plan to implement CT, so please don't blow this discussion out of propo= rtion by interpreting it as me objecting to anything and everything a root = store operator chooses to do unilaterally. On the other hand, more coordination amongst root store operators would be= great!


Could you perhaps quantify exactly what you see as the downgrade, give= n that such a hypothetical user experience (as again, EV is not presently i= mplemented in Chrome for Android) does not change?

My concern is one of timing. Rather than letting perfectly good EV cer= tificates expire naturally or be grandfathered in, they are treated as non-= EV certificates under this policy. When I use the terms =91downgrade=92 and= =91retroactive', I am specifically referring to a policy in which some EV certificates issued prior to the implementati= on of the policy (retroactive) are treated as non-EV (downgrade). I now und= erstand that there is currently no change in how they are displayed in Chro= me for Android, but (1) the policy and your comments imply that there will be, and (2) however hypothetical i= t may be, a precedent is being set here.

If this still doesn=92t make sense, maybe we can discuss it at the CAB= Forum meeting in a few weeks.

Also, can someone answer my question on point #5 in my original messag= e?

--_000_CF16FF486791Awthayergodaddycom_-- From sleevi@google.com Tue Feb 4 20:39:45 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6BD801A0026 for ; Tue, 4 Feb 2014 20:39:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.913 X-Spam-Level: X-Spam-Status: No, score=-1.913 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TLAjsB8WcROA for ; Tue, 4 Feb 2014 20:39:42 -0800 (PST) Received: from mail-qa0-x22a.google.com (mail-qa0-x22a.google.com [IPv6:2607:f8b0:400d:c00::22a]) by ietfa.amsl.com (Postfix) with ESMTP id 32CB81A0023 for ; Tue, 4 Feb 2014 20:39:41 -0800 (PST) Received: by mail-qa0-f42.google.com with SMTP id k4so14107903qaq.29 for ; Tue, 04 Feb 2014 20:39:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=Ny/SxiWABFd96PyElcReUyRa7yzV8CDaE96dck+8ysk=; b=Yrmw0dW3GBMrwOOb57pECy1Yr13wXjO5uZR5D3OhADmck8nAgBvE2+ai1e50UwoFQM I8f0hKCYlg3rLcrp0ept6ut/pP3WdEFfeFNRZZvDRLsrmMjKjOkpahox4bQGVm2JKm4W BVzOMJ0/8S0/reTgVop2jpPRCKxrfGj/0c5qMKG4KAJe1/bQCcRf0I6YL1q63KMjQMDS wvPdlrWH0XQ7uY1sG5PupUcbK0lMmUegFtnncgOEgEYhKZP7fSOYdyV3sUQmL6JFkxLY H3g/lqpL8fPm+8PE25BriqDRw8mkXB8f+9nrib4l/EWPuTJ9LxVnWaZJJsk9rB/nsIi0 Vegg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=Ny/SxiWABFd96PyElcReUyRa7yzV8CDaE96dck+8ysk=; b=lLCW8ozEECD6vTHXRclWWbGmO8inHysdjtD9kAGLGn1qGFL0ikMmdHYha8AflTb7Mg QzQwcQWyhLIMhZxKxPNmwgZ7QCa42Yw8eNG2GBa41K963CZ120C+USwHTRtzfLl2sSuY XWMAgGdo2fUDNKKlOAGnAuux9AqaFmRfyvH/1pmm3+1755C9+6uTwOtDxT+L64pDIr9n e/BagPmSaOHXBGCYB2UhosUZl9vUr87j6RV+GqROQdqTAf+ffsTIkT098bsSi0aeKMcY J1czf/QAgAcRF4zomRTyFyO9R2Eunt4Ie/BcTtteO8fLabsGMHyRqa4pbmVEd2M46RFZ CbFA== X-Gm-Message-State: ALoCoQmPmoyjxy/Z7j/0BJKFvNLrbzrEtTx7lb+Sx1h6fSSEmXzdisWydn04SJ5KbHWQnZr7vTyywbNQ/zFp1BnDNQbW2wnPlNZxn2q9nbF9ZPrn58xZvyQicxSWwx9ZgCklKJVXlBfmp/TtvdvMIc1vSZw3ypfPqidOuGSDyV6HLntAq7gYQaY6eXOdzBRJQDTiWGEvy0OS MIME-Version: 1.0 X-Received: by 10.229.13.195 with SMTP id d3mr72380791qca.4.1391575180389; Tue, 04 Feb 2014 20:39:40 -0800 (PST) Received: by 10.229.154.208 with HTTP; Tue, 4 Feb 2014 20:39:40 -0800 (PST) In-Reply-To: References: <647dad549e3047e4a94c721a616f1dee@CO1PR02MB064.namprd02.prod.outlook.com> <08b001cf221b$4cd7b4a0$e6871de0$@digicert.com> Date: Tue, 4 Feb 2014 20:39:40 -0800 Message-ID: From: Ryan Sleevi To: Wayne Thayer Content-Type: multipart/alternative; boundary=001a1133624c4e42a404f1a15827 Cc: therightkey , Ben Laurie , certificate-transparency , Jeremy Rowley , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 04:39:45 -0000 --001a1133624c4e42a404f1a15827 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Feb 4, 2014 at 8:31 PM, Wayne Thayer wrote: > > On Tue, Feb 4, 2014 at 7:12 PM, Wayne Thayer wrote: > >> >> On Tue, Feb 4, 2014 at 6:38 PM, Jeremy Rowley > > wrote: >> >>> I=E2=80=99m confused as well. Does that mean Android will start showi= ng an EV >>> indicator? >>> >>> *From:* therightkey [mailto:therightkey-bounces@ietf.org] *On Behalf Of >>> *Wayne Thayer >>> *Sent:* Tuesday, February 04, 2014 7:33 PM >>> *To:* Ryan Sleevi >>> *Cc:* therightkey@ietf.org; Ben Laurie; >>> certificate-transparency@googlegroups.com; CABFPub >>> *Subject:* Re: [therightkey] [cabfpub] Updated Certificate Transparency >>> + Extended Validation plan >>> >>> >>> >>> Hi Wayne, >>> >>> Considering we already do not indicate EV on Android, nor have we ever, >>> I don't think this perceived loss of functionality is as significant as= you >>> may believe. >>> >>> Further, considering the very real and distinct performance >>> characteristics of mobile (radio warmups, RTTs, initcwnds), the idea of >>> fetching OCSP, or, worse, CRLs - especially when some CAs have CRLs tha= t >>> are quite large (20+ MB) - in order to assure the EV display is... >>> non-ideal. So again, the EV indicator on mobile is not as strong or as >>> present as it may be on desktop platforms. >>> >>> In that case, what does this statement mean? >>> >>> Chrome for mobile platforms will cease to show EV indicators for >>> certificates that are not CT qualified according to the criteria below. >>> >> >> It means that for any CAs that hope to be recognized as EV on Chrome >> for mobile platforms (which include iOS), implementing CT by the dates >> outlined is seen as a requirement for such treatment. We wanted to >> specifically call attention to this - the whitelist is seen as a tempora= ry >> measure for Desktop, but given the unique characteristics of mobile >> platforms, we're pursuing this requirement at a more aggressive pace. >> >> While Chrome for Android - and the Chrome-based WebView, as the WebView >> preceding it - do not provide special treatment for EV, any future plans >> for EV indications on these platforms have incorporated the above >> requirements and dates. >> >> >> In that case, my original objection stands =E2=80=93 this policy retroa= ctively >> downgrades existing EV certificates if and when a mobile platform choose= s >> to implement an EV indicator. There are certainly times when it=E2=80=99= s necessary >> to apply a new policy to existing certificates to protect relying partie= s, >> but IMO this isn=E2=80=99t one of them. >> > > Wayne, > > While I appreciate your position, I am absolutely baffled as how you can > present this as a "downgrade". > > If and when Android supports EV, certificates that fail to meet this > requirements will continue to appear exactly the same as they do today an= d > they have in the past. Certificates which do conform to these program > requirements will, presumably, be granted distinguishing UI. To the > customer who purchased a certificate today, their certificate will contin= ue > to appear in that future world exactly how it appears today, presumably - > providing them exactly what they expected. > > I can only interpret your objection as an objection to root store > programs requiring additional requirements above and beyond that of the E= V > Guidelines. I can only presume that you have similar objections to root > store programs requiring additional requirements above and beyond the > Baseline Requirements - as (to the best of my knowledge) - every root > program already does today. > > > Ryan, > > I believe that I have repeatedly stated my support for Google=E2=80=99s = overall > plan to implement CT, so please don't blow this discussion out of > proportion by interpreting it as me objecting to anything and everything = a > root store operator chooses to do unilaterally. On the other hand, more > coordination amongst root store operators would be great! > > > Could you perhaps quantify exactly what you see as the downgrade, given > that such a hypothetical user experience (as again, EV is not presently > implemented in Chrome for Android) does not change? > > > My concern is one of timing. Rather than letting perfectly good EV > certificates expire naturally or be grandfathered in, they are treated as > non-EV certificates under this policy. When I use the terms =E2=80=98down= grade=E2=80=99 and > =E2=80=98retroactive', I am specifically referring to a policy in which s= ome EV > certificates issued prior to the implementation of the policy (retroactiv= e) > are treated as non-EV (downgrade). I now understand that there is current= ly > no change in how they are displayed in Chrome for Android, but (1) the > policy and your comments imply that there will be, and (2) however > hypothetical it may be, a precedent is being set here. > > I'm still not sure I follow the argument, so apologies for my ignorance. EV treatment will only be granted to certificates that conform to these policies. Are you imagining a scenario in which a certificate appears as EV in Android (which again, is not a feature currently implemented), and then later in the future, no longer does? And I'm not sure what your view of the precedent is. Chrome has already applied policies it believes are necessary to protect users - we no longer treat internal host names as secure, for example, independent of the Baseline Requirements 2015 sunset. Equally, we are aggressively proceeding with ensuring that the security indicator is appropriate for certificates that fail to meet minimum cryptographic requirements or validity dates. A certificate which does not display as EV today, and which does not display as EV tomorrow, does not particularly seem like a "downgrade"? > If this still doesn=E2=80=99t make sense, maybe we can discuss it at the= CAB > Forum meeting in a few weeks. > > Also, can someone answer my question on point #5 in my original message? > > --001a1133624c4e42a404f1a15827 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable



On Tue, Feb 4, 2014 at 8:31 PM, Wayne Thayer <= wthayer@godaddy.co= m> wrote:

On Tue, Feb 4, 2014 at 7:12 PM, Wayne Thayer <wthayer@godadd= y.com> wrote:

On Tue, Feb 4, 2014 at 6:38 PM, Jeremy Rowley <jeremy.= rowley@digicert.com> wrote:

I=E2=80=99m confused as well.=C2=A0 Does tha= t mean Android will start showing an EV indicator?

From: therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of Wayne Thayer
Sent: Tuesday, February 04, 2014 7:33 PM
To: Ryan Sleevi
Cc: therig= htkey@ietf.org; Ben Laurie; certificate-transparency@googlegroups.com; CABFPub
Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparenc= y + Extended Validation plan

=C2=A0

Hi Wayne,

Considering we already do not indicate EV on Android, nor have = we ever, I don't think this perceived loss of functionality is as signi= ficant as you may believe.

Further, considering the very real and distinct performance cha= racteristics of mobile (radio warmups, RTTs, initcwnds), the idea of fetchi= ng OCSP, or, worse, CRLs - especially when some CAs have CRLs that are quite large (20+ MB) - in order to assure= the EV display is... non-ideal. So again, the EV indicator on mobile is no= t as strong or as present as it may be on desktop platforms.=C2=A0

In that case, what does this statement mean?

Chrome for mobile platforms will cease = to show EV indicators for certificates that are not CT qualified according = to the criteria below.


It means that for any CAs that hope to be recognized as EV on Chrome f= or mobile platforms (which include iOS), implementing CT by the dates outli= ned is seen as a requirement for such treatment. We wanted to specifically = call attention to this - the whitelist is seen as a temporary measure for Desktop, but given the unique character= istics of mobile platforms, we're pursuing this requirement at a more a= ggressive pace.

While Chrome for Android - and the Chrome-based WebView, as the WebVie= w preceding it - do not provide special treatment for EV, any future plans = for EV indications on these platforms have incorporated the above requireme= nts and dates.
=C2=A0
In that case, my original objection stands =E2=80=93 this policy retro= actively downgrades existing EV certificates if and when a mobile platform = chooses to implement an EV indicator. There are certainly times when it=E2= =80=99s necessary to apply a new policy to existing certificates to protect relying parties, but IMO this isn=E2=80=99t one of= them.

Wayne,

While I appreciate your position, I am absolutely baffled as how you c= an present this as a "downgrade".

If and when Android supports EV, certificates that fail to meet this r= equirements will continue to appear exactly the same as they do today and t= hey have in the past. Certificates which do conform to these program requir= ements will, presumably, be granted distinguishing UI. To the customer who purchased a certificate today, thei= r certificate will continue to appear in that future world exactly how it a= ppears today, presumably - providing them exactly what they expected.

I can only interpret your objection as an objection to root store prog= rams requiring additional requirements above and beyond that of the EV Guid= elines. I can only presume that you have similar objections to root store p= rograms requiring additional requirements above and beyond the Baseline Requirements - as (to the best of my knowled= ge) - every root program already does today.

Ryan,

I believe that I have repeatedly stated my support for Google=E2=80=99= s overall plan to implement CT, so please don't blow this discussion ou= t of proportion by interpreting it as me objecting to anything and everythi= ng a root store operator chooses to do unilaterally. On the other hand, more coordination amongst root store operators would be= great!


Could you perhaps quantify exactly what you see as the downgrade, give= n that such a hypothetical user experience (as again, EV is not presently i= mplemented in Chrome for Android) does not change?

My concern is one of timing. Rather than letting perfectly good = EV certificates expire naturally or be grandfathered in, they are treated a= s non-EV certificates under this policy. When I use the terms =E2=80=98down= grade=E2=80=99 and =E2=80=98retroactive', I am specifically referring to a policy in which some EV certificates issued prior to the implementati= on of the policy (retroactive) are treated as non-EV (downgrade). I now und= erstand that there is currently no change in how they are displayed in Chro= me for Android, but (1) the policy and your comments imply that there will be, and (2) however hypothetical i= t may be, a precedent is being set here.


I'm still not sur= e I follow the argument, so apologies for my ignorance. EV treatment will o= nly be granted to certificates that conform to these policies. Are you imag= ining a scenario in which a certificate appears as EV in Android (which aga= in, is not a feature currently implemented), and then later in the future, = no longer does?

And I'm not sure what your view of the precedent is= . Chrome has already applied policies it believes are necessary to protect = users - we no longer treat internal host names as secure, for example, inde= pendent of the Baseline Requirements 2015 sunset. Equally, we are aggressiv= ely proceeding with ensuring that the security indicator is appropriate for= certificates that fail to meet minimum cryptographic requirements or valid= ity dates.

A certificate which does not display as EV today, and w= hich does not display as EV tomorrow, does not particularly seem like a &qu= ot;downgrade"?
=C2=A0
If this still doesn=E2=80=99t make sense, maybe we can discuss it at t= he CAB Forum meeting in a few weeks.

Also, can someone answer my question on point #5 in my original messag= e?


--001a1133624c4e42a404f1a15827-- From rob.stradling@comodo.com Wed Feb 5 04:36:52 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 338E81A00F7 for ; Wed, 5 Feb 2014 04:36:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.69 X-Spam-Level: X-Spam-Status: No, score=-0.69 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_NET=0.611, J_CHICKENPOX_22=0.6, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7wWw_-eqgn_u for ; Wed, 5 Feb 2014 04:36:49 -0800 (PST) Received: from ian.brad.office.comodo.net (eth5.brad-fw.brad.office.ccanet.co.uk [178.255.87.226]) by ietfa.amsl.com (Postfix) with ESMTP id 065C81A00F3 for ; Wed, 5 Feb 2014 04:36:48 -0800 (PST) Received: (qmail 5738 invoked by uid 1000); 5 Feb 2014 12:36:45 -0000 Received: from nigel.brad.office.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (CAMELLIA256-SHA encrypted) ESMTPSA; Wed, 05 Feb 2014 12:36:45 +0000 Message-ID: <52F2305C.5040107@comodo.com> Date: Wed, 05 Feb 2014 12:36:44 +0000 From: Rob Stradling User-Agent: Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20100101 Thunderbird/24.1.1 MIME-Version: 1.0 To: certificate-transparency@googlegroups.com References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: therightkey@ietf.org, Ben Laurie , CABFPub Subject: [therightkey] Thoughts on reducing SCT sizes (was Re: [cabfpub] Updated Certificate Transparency + Extended Validation plan) X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 12:36:52 -0000 On Tue, Feb 4, 2014 at 12:33 PM, Jeremy Rowley wrote: > Three or four proofs for a 27 month certificate is way too many. > Adding 400 bytes per certificate will make EV certificates unusable by entities concerned with performance. The updated CT+EV plan requires three SCTs for a (maximum length) 27-month EV certificate, not four. 400 bytes for three SCTs is about right though. Assuming RFC6962-compliant v1 SCTs that contain no SCT extensions and are signed using ECDSA and a P-256 private key, then, including all of the ASN.1 fluff for the SCT List certificate extension, I calculate that it'll be... 140 or 141 bytes to embed 1 SCT 261 to 263 bytes to embed 2 SCTs 380 to 383 bytes to embed 3 SCTs For (non-EV) validity periods between 27 and 39 months: 499 to 503 bytes to embed 4 SCTs On 04/02/14 17:52, Adam Langley wrote: > We should make the SCTs as small as possible Agreed. Time for some back-of-an-envelope sums. For SCT v2, if we were to pack in the data as tightly as possible I reckon we could cut it down to as little as... 84 bytes to embed 1 SCT 159 bytes to embed 2 SCTs 231 bytes to embed 3 SCTs 303 bytes to embed 4 SCTs Here's how... 1. Use a shorter OID for the SCT List extension. Perhaps CABForum could define 2.23.140.n (with n < 128). Save 6 bytes. 2. The first 2 bytes of the SignedCertificateTimestampList structure are its total length. Since this can be calculated from the OCTET STRING length, these 2 bytes could be omitted. Save 2 bytes. 3. Pack the SCT fields into as few bytes as possible for the common case, whilst retaining options for future expansion. Save 37 bytes per SCT. Replace... (1 byte) Version sct_version; (32 bytes) LogID id; (8 bytes) uint64 timestamp; (2+? bytes) CtExtensions extensions; ...with... (2 bits) sct_version (00=v1; 01=v2; 10,11=unassigned) (2 bits) log_id_type (00=SHA-256(log_public_key); 01=1-byte Registered Log ID; 10=2-byte Registered Log ID; 11=4-byte Registered Log ID) (2 bits) timestamp_size (00=8-bytes; 01=6-bytes; 10=5-bytes; 11=4-bytes) (1 bit) extensions (0=CtExtensions is present; 1=CtExtensions is absent) (1 bit) signature_type (0=digitally-signed struct; 1=raw Ed25519 signature) For the common case: (1 byte) Registered Log ID (4 bytes) Timestamp (seconds, not milliseconds) 4. Use the Ed25519 signature scheme instead of ECDSA. ECDSA signatures using a P-256 key seem to be 72 or 73 bytes, whereas Ed25519 signatures are 64 bytes. Save 8 or 9 bytes per SCT. Also, for Ed25519, omit the 2 bytes containing the hash algorithm and signature algorithm from the "digitally-signed struct" header. Save 2 bytes per SCT. -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From benl@google.com Wed Feb 5 04:44:43 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 412AA1A00F4 for ; Wed, 5 Feb 2014 04:44:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.914 X-Spam-Level: X-Spam-Status: No, score=-1.914 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5XNJ2xfVaiWe for ; Wed, 5 Feb 2014 04:44:37 -0800 (PST) Received: from mail-vb0-x232.google.com (mail-vb0-x232.google.com [IPv6:2607:f8b0:400c:c02::232]) by ietfa.amsl.com (Postfix) with ESMTP id B912D1A00DD for ; Wed, 5 Feb 2014 04:44:37 -0800 (PST) Received: by mail-vb0-f50.google.com with SMTP id w8so234669vbj.37 for ; Wed, 05 Feb 2014 04:44:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=3fj3TFEWyHMuyJ6J5YfAzapaIV2RGGT5zeyarhOnsBw=; b=US3ysDlDwpqPYPUJApVzuE7/IPBMeXfwUo8ggxfKIZw7KI6549hsr5S6gpJKlZQ9ip VlBz5bhxBVMne4/VBvbDzS2qlWaYyYRe6dCMosg4dAR8A7nzukQtwfRZDB3FMXZDqxdP b49hIXbhyGWieO4Ubate6SyaTgd5c17hidh9A6kHi/ib0YgA2j6SV8je461LXMkUkCnP +q3jyCubxomTnVIslAITq15gWubCOrfgs1CNgR25hOgOI+o1rMaQVgnV1isJNHPGtwVE vZBDOYuQhQxKoxthDOAoxsGGmIr7t9NsRjIYvQAcXuo5nPaNzwnF4aIQZBCmEDaAR8du wjzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=3fj3TFEWyHMuyJ6J5YfAzapaIV2RGGT5zeyarhOnsBw=; b=LEcsJ6Fcqg9hZ9Fx4wfnRgaaUBh87q1yzsIrZufKsyf76ywA6QcHEwxKMniJLT7mzD Ghb4T+EHhxB5qrBOem7GkCvtvPC5z+/xIaOURspujzF+q6yB/ctp8GHC9Ow1D9YLK+Nd 5ZhZqY7O/TTQgsNn8lXh77YAamC2ZcZckNh3RKNJJs5ViqZBgoOvK/PRXRdYzAQJI7WN kVRfFun2Zj8JDx0sqGDoRsMQjr9PYV24LCRdh/ZaBjni3QYtEqEVZqLjDfHUrNH+0oG6 x/g5MGNzKcTxgBu13nF2NrwTv/BPFjCivSCGK3EWNMX1UZXTXcn4nh6doKxT8jXlsYQf 3e+A== X-Gm-Message-State: ALoCoQnAcRzc9OaSDyNBGQVNZXPETOIIzILBv/GitU49amdc7DzKj5Xnf/0CgvrGTHI2qDHPyFrHky7sHCqSAf4dhAZOpw4VrM9lk1IEdJjNL5qXSdl9gFvTPIsFcqu+XfTMBAMfrRKH/ysEOV8r2L3xKBHdFdrmzoRyD8I9CPTykWtTWFGNibOTq/+G5ZRIwns2oPeqC9Gm MIME-Version: 1.0 X-Received: by 10.52.171.39 with SMTP id ar7mr747582vdc.5.1391604276688; Wed, 05 Feb 2014 04:44:36 -0800 (PST) Received: by 10.52.230.105 with HTTP; Wed, 5 Feb 2014 04:44:36 -0800 (PST) In-Reply-To: <647dad549e3047e4a94c721a616f1dee@CO1PR02MB064.namprd02.prod.outlook.com> References: <647dad549e3047e4a94c721a616f1dee@CO1PR02MB064.namprd02.prod.outlook.com> Date: Wed, 5 Feb 2014 12:44:36 +0000 Message-ID: From: Ben Laurie To: Wayne Thayer Content-Type: text/plain; charset=UTF-8 Cc: "therightkey@ietf.org" , "certificate-transparency@googlegroups.com" , CABFPub Subject: Re: [therightkey] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 12:44:43 -0000 On 5 February 2014 01:47, Wayne Thayer wrote: > I'm somewhat confused by the following two points: > >>>5. By July 2014 all EV certificates with validity periods beyond [July >>>2014] should be logged in > at least [one] qualifying log (see below). >>>6. On 1 Jan 2015 Chrome will create a whitelist of valid EV certificates >>>already issued without > an embedded SCT [issued by CAs participating in CT] from all qualifying > logs. > > If EV certificates issued prior to 1 Jan 2015 will be whitelisted, what is > the purpose of point #5? Sorry, this wasn't particularly clear. By "logged in a qualifying log" we meant also that the certificate should include an appropriate number of SCTs. The whitelist _may_ not include certificates issued after July 2014. From rob.stradling@comodo.com Wed Feb 5 04:54:41 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23D471A00DD for ; Wed, 5 Feb 2014 04:54:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.29 X-Spam-Level: X-Spam-Status: No, score=-1.29 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_NET=0.611, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QDvKgngJ4fig for ; Wed, 5 Feb 2014 04:54:40 -0800 (PST) Received: from ian.brad.office.comodo.net (eth5.brad-fw.brad.office.ccanet.co.uk [178.255.87.226]) by ietfa.amsl.com (Postfix) with ESMTP id DBFE91A00F2 for ; Wed, 5 Feb 2014 04:54:39 -0800 (PST) Received: (qmail 27471 invoked by uid 1000); 5 Feb 2014 12:54:38 -0000 Received: from nigel.brad.office.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (CAMELLIA256-SHA encrypted) ESMTPSA; Wed, 05 Feb 2014 12:54:38 +0000 Message-ID: <52F2348E.1090805@comodo.com> Date: Wed, 05 Feb 2014 12:54:38 +0000 From: Rob Stradling User-Agent: Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20100101 Thunderbird/24.1.1 MIME-Version: 1.0 To: Jeremy Rowley References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> In-Reply-To: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: therightkey@ietf.org, 'Ben Laurie' , certificate-transparency@googlegroups.com, 'CABFPub' Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 12:54:41 -0000 On 04/02/14 17:33, Jeremy Rowley wrote: > Adding 400 bytes per certificate will make EV certificates unusable by entities concerned with performance. BTW Jeremy, in seeking to get some perspective on this issue, I notice that the current EV cert for www.digicert.com has a Certificate Policies User Notice that takes up 338 bytes! (2 bytes per character, 'cos for some reason you use a BMPString). "Any use of this Certificate constitutes acceptance of the DigiCert CP/CPS and the Relying Party Agreement which limit liability and are incorporated herein by reference" Is it really necessary to include this notice in each cert? Have any "entities concerned with performance" complained about it? You could save 169 bytes immediately by simply switching from BMPString to UTF8String! ;-) -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From prvs=01133b6ec5=carl.mehner@usaa.com Wed Feb 5 06:40:59 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D257B1A0180 for ; Wed, 5 Feb 2014 06:40:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.435 X-Spam-Level: X-Spam-Status: No, score=-7.435 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id laF4lyDrCEil for ; Wed, 5 Feb 2014 06:40:56 -0800 (PST) Received: from prodomx03.usaa.com (prodomx03.usaa.com [167.24.101.121]) by ietfa.amsl.com (Postfix) with ESMTP id 887021A01C7 for ; Wed, 5 Feb 2014 06:40:56 -0800 (PST) Received: from pps.filterd (prodomx03.usaa.com [127.0.0.1]) by prodomx03.usaa.com (8.14.5/8.14.5) with SMTP id s15EZxQW016725; Wed, 5 Feb 2014 08:40:45 -0600 Received: from prodexch05w.eagle.usaa.com (prodexch05w.eagle.usaa.com [10.70.40.23]) by prodomx03.usaa.com with ESMTP id 1htqf7nam2-1; Wed, 05 Feb 2014 08:40:45 -0600 Received: from PRODEXCH02W.eagle.usaa.com (10.170.41.12) by PRODEXCH05W.eagle.usaa.com (10.70.40.23) with Microsoft SMTP Server (TLS) id 14.3.158.1; Wed, 5 Feb 2014 08:40:45 -0600 Received: from PRODEXMB01W.eagle.usaa.com ([169.254.1.35]) by PRODEXCH02W.eagle.usaa.com ([10.170.41.12]) with mapi id 14.03.0158.001; Wed, 5 Feb 2014 08:40:45 -0600 From: "Mehner, Carl" To: Ryan Sleevi , Wayne Thayer Thread-Topic: EXTERNAL: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan Thread-Index: AQHPIisiUONIlBY+lkiUkrvK1NkBXpqmeM8AgABCbsA= Date: Wed, 5 Feb 2014 14:40:44 +0000 Message-ID: <19075EB00EA7FE49AFF87E5818D673D4110388FD@PRODEXMB01W.eagle.usaa.com> References: <647dad549e3047e4a94c721a616f1dee@CO1PR02MB064.namprd02.prod.outlook.com> <08b001cf221b$4cd7b4a0$e6871de0$@digicert.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.122.15.114] Content-Type: multipart/alternative; boundary="_000_19075EB00EA7FE49AFF87E5818D673D4110388FDPRODEXMB01Weagl_" MIME-Version: 1.0 X-Proofpoint-Direction: FromExch X-Proofpoint-Direction: Internet X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.11.87, 1.0.14, 0.0.0000 definitions=2014-02-05_05:2014-02-05,2014-02-05,1970-01-01 signatures=0 Cc: therightkey , Ben Laurie , certificate-transparency , Jeremy Rowley , CABFPub Subject: Re: [therightkey] EXTERNAL: Re: [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 14:41:00 -0000 --_000_19075EB00EA7FE49AFF87E5818D673D4110388FDPRODEXMB01Weagl_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 UnlhbiwNCg0KVG9kYXkgRVYgY2VydGlmaWNhdGVzIGRvIGRpc3BsYXkgdGhlIEVWIGdyZWVuIGJh ciB0cmVhdG1lbnQgaW4gQ2hyb21lIG9uIGlPUyAoYWxiZWl0IGJyaWVmbHkpIGFzIHdlbGwgYXMg YSBtZXNzYWdlIGFib3V0IHZhbGlkYXRpbmcgdGhlIG9yZ2FuaXphdGlvbiBhbmQgbG9jYXRpb24g d2hlbiB5b3UgY2xpY2sgb24gdGhlIGNlcnRpZmljYXRlICh2cyBqdXN0IHRoZSDigJx3ZWJzaXRl IGhhcyBiZWVuIHZlcmlmaWVk4oCdIHRoYXQgeW91IGdldCBpbiBDaHJvbWUgb24gQW5kcm9pZCBm b3IgRVYgYW5kIG9uIGFueSBwbGF0Zm9ybSBmb3Igbm9uLUVWIGNlcnRzKQ0KDQoNCg0KRm9sbG93 aW5nIHRoZSBtb2JpbGUgc3RpcHVsYXRpb25zIGluIG51bWJlciA3IG9uIHlvdXIgZG9jdW1lbnQs IGluIHRoZSBjYXNlIG9mIENocm9tZSBvbiBpT1MsIHRoaXMgd291bGQgYmUgdGhlIGRvd25ncmFk ZSB0aGF0IFdheW5lIG1lbnRpb25zLiBBIGNlcnRpZmljYXRlIGFwcGVhcnMgYXMgRVYgaW4gQ2hy b21lIGZvciBpT1Mgb24gMzEgSmFuIDIwMTUsIGFuZCB3b3VsZCBub3QgZGlzcGxheSBhcyBFViBh ZnRlciAxIEZlYiAyMDE1Lg0KDQoNCg0KDQoNCkNhcmwgTWVobmVyDQoNCg0KDQpGcm9tOiB0aGVy aWdodGtleSBbbWFpbHRvOnRoZXJpZ2h0a2V5LWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBP ZiBSeWFuIFNsZWV2aQ0KU2VudDogVHVlc2RheSwgRmVicnVhcnkgMDQsIDIwMTQgMTA6NDAgUE0N ClRvOiBXYXluZSBUaGF5ZXINCkNjOiB0aGVyaWdodGtleTsgQmVuIExhdXJpZTsgY2VydGlmaWNh dGUtdHJhbnNwYXJlbmN5OyBKZXJlbXkgUm93bGV5OyBDQUJGUHViDQpTdWJqZWN0OiBFWFRFUk5B TDogUmU6IFt0aGVyaWdodGtleV0gW2NhYmZwdWJdIFVwZGF0ZWQgQ2VydGlmaWNhdGUgVHJhbnNw YXJlbmN5ICsgRXh0ZW5kZWQgVmFsaWRhdGlvbiBwbGFuDQoNCg0KDQoNCg0KDQoNCk9uIFR1ZSwg RmViIDQsIDIwMTQgYXQgODozMSBQTSwgV2F5bmUgVGhheWVyIDx3dGhheWVyQGdvZGFkZHkuY29t PG1haWx0bzp3dGhheWVyQGdvZGFkZHkuY29tPj4gd3JvdGU6DQoNCg0KDQogICBPbiBUdWUsIEZl YiA0LCAyMDE0IGF0IDc6MTIgUE0sIFdheW5lIFRoYXllciA8d3RoYXllckBnb2RhZGR5LmNvbTxt YWlsdG86d3RoYXllckBnb2RhZGR5LmNvbT4+IHdyb3RlOg0KDQoNCg0KICAgICAgT24gVHVlLCBG ZWIgNCwgMjAxNCBhdCA2OjM4IFBNLCBKZXJlbXkgUm93bGV5IDxqZXJlbXkucm93bGV5QGRpZ2lj ZXJ0LmNvbTxtYWlsdG86amVyZW15LnJvd2xleUBkaWdpY2VydC5jb20+PiB3cm90ZToNCg0KICAg ICAgSeKAmW0gY29uZnVzZWQgYXMgd2VsbC4gIERvZXMgdGhhdCBtZWFuIEFuZHJvaWQgd2lsbCBz dGFydCBzaG93aW5nIGFuIEVWIGluZGljYXRvcj8NCg0KICAgICAgRnJvbTogdGhlcmlnaHRrZXkg W21haWx0bzp0aGVyaWdodGtleS1ib3VuY2VzQGlldGYub3JnPG1haWx0bzp0aGVyaWdodGtleS1i b3VuY2VzQGlldGYub3JnPl0gT24gQmVoYWxmIE9mIFdheW5lIFRoYXllcg0KICAgICAgU2VudDog VHVlc2RheSwgRmVicnVhcnkgMDQsIDIwMTQgNzozMyBQTQ0KICAgICAgVG86IFJ5YW4gU2xlZXZp DQogICAgICBDYzogdGhlcmlnaHRrZXlAaWV0Zi5vcmc8bWFpbHRvOnRoZXJpZ2h0a2V5QGlldGYu b3JnPjsgQmVuIExhdXJpZTsgY2VydGlmaWNhdGUtdHJhbnNwYXJlbmN5QGdvb2dsZWdyb3Vwcy5j b208bWFpbHRvOmNlcnRpZmljYXRlLXRyYW5zcGFyZW5jeUBnb29nbGVncm91cHMuY29tPjsgQ0FC RlB1Yg0KICAgICAgU3ViamVjdDogUmU6IFt0aGVyaWdodGtleV0gW2NhYmZwdWJdIFVwZGF0ZWQg Q2VydGlmaWNhdGUgVHJhbnNwYXJlbmN5ICsgRXh0ZW5kZWQgVmFsaWRhdGlvbiBwbGFuDQoNCg0K DQogICAgICAgICBIaSBXYXluZSwNCg0KICAgICAgICAgQ29uc2lkZXJpbmcgd2UgYWxyZWFkeSBk byBub3QgaW5kaWNhdGUgRVYgb24gQW5kcm9pZCwgbm9yIGhhdmUgd2UgZXZlciwgSSBkb24ndCB0 aGluayB0aGlzIHBlcmNlaXZlZCBsb3NzIG9mIGZ1bmN0aW9uYWxpdHkgaXMgYXMgc2lnbmlmaWNh bnQgYXMgeW91IG1heSBiZWxpZXZlLg0KDQogICAgICAgICBGdXJ0aGVyLCBjb25zaWRlcmluZyB0 aGUgdmVyeSByZWFsIGFuZCBkaXN0aW5jdCBwZXJmb3JtYW5jZSBjaGFyYWN0ZXJpc3RpY3Mgb2Yg bW9iaWxlIChyYWRpbyB3YXJtdXBzLCBSVFRzLCBpbml0Y3duZHMpLCB0aGUgaWRlYSBvZiBmZXRj aGluZyBPQ1NQLCBvciwgd29yc2UsIENSTHMgLSBlc3BlY2lhbGx5IHdoZW4gc29tZSBDQXMgaGF2 ZSBDUkxzIHRoYXQgYXJlIHF1aXRlIGxhcmdlICgyMCsgTUIpIC0gaW4gb3JkZXIgdG8gYXNzdXJl IHRoZSBFViBkaXNwbGF5IGlzLi4uIG5vbi1pZGVhbC4gU28gYWdhaW4sIHRoZSBFViBpbmRpY2F0 b3Igb24gbW9iaWxlIGlzIG5vdCBhcyBzdHJvbmcgb3IgYXMgcHJlc2VudCBhcyBpdCBtYXkgYmUg b24gZGVza3RvcCBwbGF0Zm9ybXMuDQoNCiAgICAgIEluIHRoYXQgY2FzZSwgd2hhdCBkb2VzIHRo aXMgc3RhdGVtZW50IG1lYW4/DQoNCiAgICAgIENocm9tZSBmb3IgbW9iaWxlIHBsYXRmb3JtcyB3 aWxsIGNlYXNlIHRvIHNob3cgRVYgaW5kaWNhdG9ycyBmb3IgY2VydGlmaWNhdGVzIHRoYXQgYXJl IG5vdCBDVCBxdWFsaWZpZWQgYWNjb3JkaW5nIHRvIHRoZSBjcml0ZXJpYSBiZWxvdy4NCg0KDQoN CiAgICAgIEl0IG1lYW5zIHRoYXQgZm9yIGFueSBDQXMgdGhhdCBob3BlIHRvIGJlIHJlY29nbml6 ZWQgYXMgRVYgb24gQ2hyb21lIGZvciBtb2JpbGUgcGxhdGZvcm1zICh3aGljaCBpbmNsdWRlIGlP UyksIGltcGxlbWVudGluZyBDVCBieSB0aGUgZGF0ZXMgb3V0bGluZWQgaXMgc2VlbiBhcyBhIHJl cXVpcmVtZW50IGZvciBzdWNoIHRyZWF0bWVudC4gV2Ugd2FudGVkIHRvIHNwZWNpZmljYWxseSBj YWxsIGF0dGVudGlvbiB0byB0aGlzIC0gdGhlIHdoaXRlbGlzdCBpcyBzZWVuIGFzIGEgdGVtcG9y YXJ5IG1lYXN1cmUgZm9yIERlc2t0b3AsIGJ1dCBnaXZlbiB0aGUgdW5pcXVlIGNoYXJhY3Rlcmlz dGljcyBvZiBtb2JpbGUgcGxhdGZvcm1zLCB3ZSdyZSBwdXJzdWluZyB0aGlzIHJlcXVpcmVtZW50 IGF0IGEgbW9yZSBhZ2dyZXNzaXZlIHBhY2UuDQoNCg0KDQogICAgICBXaGlsZSBDaHJvbWUgZm9y IEFuZHJvaWQgLSBhbmQgdGhlIENocm9tZS1iYXNlZCBXZWJWaWV3LCBhcyB0aGUgV2ViVmlldyBw cmVjZWRpbmcgaXQgLSBkbyBub3QgcHJvdmlkZSBzcGVjaWFsIHRyZWF0bWVudCBmb3IgRVYsIGFu eSBmdXR1cmUgcGxhbnMgZm9yIEVWIGluZGljYXRpb25zIG9uIHRoZXNlIHBsYXRmb3JtcyBoYXZl IGluY29ycG9yYXRlZCB0aGUgYWJvdmUgcmVxdWlyZW1lbnRzIGFuZCBkYXRlcy4NCg0KDQoNCiAg IEluIHRoYXQgY2FzZSwgbXkgb3JpZ2luYWwgb2JqZWN0aW9uIHN0YW5kcyDigJMgdGhpcyBwb2xp Y3kgcmV0cm9hY3RpdmVseSBkb3duZ3JhZGVzIGV4aXN0aW5nIEVWIGNlcnRpZmljYXRlcyBpZiBh bmQgd2hlbiBhIG1vYmlsZSBwbGF0Zm9ybSBjaG9vc2VzIHRvIGltcGxlbWVudCBhbiBFViBpbmRp Y2F0b3IuIFRoZXJlIGFyZSBjZXJ0YWlubHkgdGltZXMgd2hlbiBpdOKAmXMgbmVjZXNzYXJ5IHRv IGFwcGx5IGEgbmV3IHBvbGljeSB0byBleGlzdGluZyBjZXJ0aWZpY2F0ZXMgdG8gcHJvdGVjdCBy ZWx5aW5nIHBhcnRpZXMsIGJ1dCBJTU8gdGhpcyBpc27igJl0IG9uZSBvZiB0aGVtLg0KDQoNCg0K ICAgV2F5bmUsDQoNCg0KDQogICBXaGlsZSBJIGFwcHJlY2lhdGUgeW91ciBwb3NpdGlvbiwgSSBh bSBhYnNvbHV0ZWx5IGJhZmZsZWQgYXMgaG93IHlvdSBjYW4gcHJlc2VudCB0aGlzIGFzIGEgImRv d25ncmFkZSIuDQoNCg0KDQogICBJZiBhbmQgd2hlbiBBbmRyb2lkIHN1cHBvcnRzIEVWLCBjZXJ0 aWZpY2F0ZXMgdGhhdCBmYWlsIHRvIG1lZXQgdGhpcyByZXF1aXJlbWVudHMgd2lsbCBjb250aW51 ZSB0byBhcHBlYXIgZXhhY3RseSB0aGUgc2FtZSBhcyB0aGV5IGRvIHRvZGF5IGFuZCB0aGV5IGhh dmUgaW4gdGhlIHBhc3QuIENlcnRpZmljYXRlcyB3aGljaCBkbyBjb25mb3JtIHRvIHRoZXNlIHBy b2dyYW0gcmVxdWlyZW1lbnRzIHdpbGwsIHByZXN1bWFibHksIGJlIGdyYW50ZWQgZGlzdGluZ3Vp c2hpbmcgVUkuIFRvIHRoZSBjdXN0b21lciB3aG8gcHVyY2hhc2VkIGEgY2VydGlmaWNhdGUgdG9k YXksIHRoZWlyIGNlcnRpZmljYXRlIHdpbGwgY29udGludWUgdG8gYXBwZWFyIGluIHRoYXQgZnV0 dXJlIHdvcmxkIGV4YWN0bHkgaG93IGl0IGFwcGVhcnMgdG9kYXksIHByZXN1bWFibHkgLSBwcm92 aWRpbmcgdGhlbSBleGFjdGx5IHdoYXQgdGhleSBleHBlY3RlZC4NCg0KDQoNCiAgIEkgY2FuIG9u bHkgaW50ZXJwcmV0IHlvdXIgb2JqZWN0aW9uIGFzIGFuIG9iamVjdGlvbiB0byByb290IHN0b3Jl IHByb2dyYW1zIHJlcXVpcmluZyBhZGRpdGlvbmFsIHJlcXVpcmVtZW50cyBhYm92ZSBhbmQgYmV5 b25kIHRoYXQgb2YgdGhlIEVWIEd1aWRlbGluZXMuIEkgY2FuIG9ubHkgcHJlc3VtZSB0aGF0IHlv dSBoYXZlIHNpbWlsYXIgb2JqZWN0aW9ucyB0byByb290IHN0b3JlIHByb2dyYW1zIHJlcXVpcmlu ZyBhZGRpdGlvbmFsIHJlcXVpcmVtZW50cyBhYm92ZSBhbmQgYmV5b25kIHRoZSBCYXNlbGluZSBS ZXF1aXJlbWVudHMgLSBhcyAodG8gdGhlIGJlc3Qgb2YgbXkga25vd2xlZGdlKSAtIGV2ZXJ5IHJv b3QgcHJvZ3JhbSBhbHJlYWR5IGRvZXMgdG9kYXkuDQoNCg0KDQogICBSeWFuLA0KDQoNCg0KICAg SSBiZWxpZXZlIHRoYXQgSSBoYXZlIHJlcGVhdGVkbHkgc3RhdGVkIG15IHN1cHBvcnQgZm9yIEdv b2dsZeKAmXMgb3ZlcmFsbCBwbGFuIHRvIGltcGxlbWVudCBDVCwgc28gcGxlYXNlIGRvbid0IGJs b3cgdGhpcyBkaXNjdXNzaW9uIG91dCBvZiBwcm9wb3J0aW9uIGJ5IGludGVycHJldGluZyBpdCBh cyBtZSBvYmplY3RpbmcgdG8gYW55dGhpbmcgYW5kIGV2ZXJ5dGhpbmcgYSByb290IHN0b3JlIG9w ZXJhdG9yIGNob29zZXMgdG8gZG8gdW5pbGF0ZXJhbGx5LiBPbiB0aGUgb3RoZXIgaGFuZCwgbW9y ZSBjb29yZGluYXRpb24gYW1vbmdzdCByb290IHN0b3JlIG9wZXJhdG9ycyB3b3VsZCBiZSBncmVh dCENCg0KDQoNCg0KDQogICBDb3VsZCB5b3UgcGVyaGFwcyBxdWFudGlmeSBleGFjdGx5IHdoYXQg eW91IHNlZSBhcyB0aGUgZG93bmdyYWRlLCBnaXZlbiB0aGF0IHN1Y2ggYSBoeXBvdGhldGljYWwg dXNlciBleHBlcmllbmNlIChhcyBhZ2FpbiwgRVYgaXMgbm90IHByZXNlbnRseSBpbXBsZW1lbnRl ZCBpbiBDaHJvbWUgZm9yIEFuZHJvaWQpIGRvZXMgbm90IGNoYW5nZT8NCg0KDQoNCiAgIE15IGNv bmNlcm4gaXMgb25lIG9mIHRpbWluZy4gUmF0aGVyIHRoYW4gbGV0dGluZyBwZXJmZWN0bHkgZ29v ZCBFViBjZXJ0aWZpY2F0ZXMgZXhwaXJlIG5hdHVyYWxseSBvciBiZSBncmFuZGZhdGhlcmVkIGlu LCB0aGV5IGFyZSB0cmVhdGVkIGFzIG5vbi1FViBjZXJ0aWZpY2F0ZXMgdW5kZXIgdGhpcyBwb2xp Y3kuIFdoZW4gSSB1c2UgdGhlIHRlcm1zIOKAmGRvd25ncmFkZeKAmSBhbmQg4oCYcmV0cm9hY3Rp dmUnLCBJIGFtIHNwZWNpZmljYWxseSByZWZlcnJpbmcgdG8gYSBwb2xpY3kgaW4gd2hpY2ggc29t ZSBFViBjZXJ0aWZpY2F0ZXMgaXNzdWVkIHByaW9yIHRvIHRoZSBpbXBsZW1lbnRhdGlvbiBvZiB0 aGUgcG9saWN5IChyZXRyb2FjdGl2ZSkgYXJlIHRyZWF0ZWQgYXMgbm9uLUVWIChkb3duZ3JhZGUp LiBJIG5vdyB1bmRlcnN0YW5kIHRoYXQgdGhlcmUgaXMgY3VycmVudGx5IG5vIGNoYW5nZSBpbiBo b3cgdGhleSBhcmUgZGlzcGxheWVkIGluIENocm9tZSBmb3IgQW5kcm9pZCwgYnV0ICgxKSB0aGUg cG9saWN5IGFuZCB5b3VyIGNvbW1lbnRzIGltcGx5IHRoYXQgdGhlcmUgd2lsbCBiZSwgYW5kICgy KSBob3dldmVyIGh5cG90aGV0aWNhbCBpdCBtYXkgYmUsIGEgcHJlY2VkZW50IGlzIGJlaW5nIHNl dCBoZXJlLg0KDQoNCg0KDQoNCiAgIEknbSBzdGlsbCBub3Qgc3VyZSBJIGZvbGxvdyB0aGUgYXJn dW1lbnQsIHNvIGFwb2xvZ2llcyBmb3IgbXkgaWdub3JhbmNlLiBFViB0cmVhdG1lbnQgd2lsbCBv bmx5IGJlIGdyYW50ZWQgdG8gY2VydGlmaWNhdGVzIHRoYXQgY29uZm9ybSB0byB0aGVzZSBwb2xp Y2llcy4gQXJlIHlvdSBpbWFnaW5pbmcgYSBzY2VuYXJpbyBpbiB3aGljaCBhIGNlcnRpZmljYXRl IGFwcGVhcnMgYXMgRVYgaW4gQW5kcm9pZCAod2hpY2ggYWdhaW4sIGlzIG5vdCBhIGZlYXR1cmUg Y3VycmVudGx5IGltcGxlbWVudGVkKSwgYW5kIHRoZW4gbGF0ZXIgaW4gdGhlIGZ1dHVyZSwgbm8g bG9uZ2VyIGRvZXM/DQoNCg0KDQogICBBbmQgSSdtIG5vdCBzdXJlIHdoYXQgeW91ciB2aWV3IG9m IHRoZSBwcmVjZWRlbnQgaXMuIENocm9tZSBoYXMgYWxyZWFkeSBhcHBsaWVkIHBvbGljaWVzIGl0 IGJlbGlldmVzIGFyZSBuZWNlc3NhcnkgdG8gcHJvdGVjdCB1c2VycyAtIHdlIG5vIGxvbmdlciB0 cmVhdCBpbnRlcm5hbCBob3N0IG5hbWVzIGFzIHNlY3VyZSwgZm9yIGV4YW1wbGUsIGluZGVwZW5k ZW50IG9mIHRoZSBCYXNlbGluZSBSZXF1aXJlbWVudHMgMjAxNSBzdW5zZXQuIEVxdWFsbHksIHdl IGFyZSBhZ2dyZXNzaXZlbHkgcHJvY2VlZGluZyB3aXRoIGVuc3VyaW5nIHRoYXQgdGhlIHNlY3Vy aXR5IGluZGljYXRvciBpcyBhcHByb3ByaWF0ZSBmb3IgY2VydGlmaWNhdGVzIHRoYXQgZmFpbCB0 byBtZWV0IG1pbmltdW0gY3J5cHRvZ3JhcGhpYyByZXF1aXJlbWVudHMgb3IgdmFsaWRpdHkgZGF0 ZXMuDQoNCg0KDQogICBBIGNlcnRpZmljYXRlIHdoaWNoIGRvZXMgbm90IGRpc3BsYXkgYXMgRVYg dG9kYXksIGFuZCB3aGljaCBkb2VzIG5vdCBkaXNwbGF5IGFzIEVWIHRvbW9ycm93LCBkb2VzIG5v dCBwYXJ0aWN1bGFybHkgc2VlbSBsaWtlIGEgImRvd25ncmFkZSI/DQoNCg0KDQogICBJZiB0aGlz IHN0aWxsIGRvZXNu4oCZdCBtYWtlIHNlbnNlLCBtYXliZSB3ZSBjYW4gZGlzY3VzcyBpdCBhdCB0 aGUgQ0FCIEZvcnVtIG1lZXRpbmcgaW4gYSBmZXcgd2Vla3MuDQoNCg0KDQogICBBbHNvLCBjYW4g c29tZW9uZSBhbnN3ZXIgbXkgcXVlc3Rpb24gb24gcG9pbnQgIzUgaW4gbXkgb3JpZ2luYWwgbWVz c2FnZT8NCg0KDQoNCg0KDQo= --_000_19075EB00EA7FE49AFF87E5818D673D4110388FDPRODEXMB01Weagl_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTIgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpUYWhvbWE7DQoJ cGFub3NlLTE6MiAxMSA2IDQgMyA1IDQgNCAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eToiVGltZXMgTmV3IFJvbWFuIiwic2VyaWYiO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCnANCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1tYXJnaW4tdG9wLWFs dDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRp bWVzIE5ldyBSb21hbiIsInNlcmlmIjt9DQpwLk1zb0FjZXRhdGUsIGxpLk1zb0FjZXRhdGUsIGRp di5Nc29BY2V0YXRlDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoi QmFsbG9vbiBUZXh0IENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0 Ow0KCWZvbnQtc2l6ZTo4LjBwdDsNCglmb250LWZhbWlseToiVGFob21hIiwic2Fucy1zZXJpZiI7 fQ0Kc3Bhbi5CYWxsb29uVGV4dENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkJhbGxvb24gVGV4dCBD aGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkJhbGxvb24g VGV4dCI7DQoJZm9udC1mYW1pbHk6IlRhaG9tYSIsInNhbnMtc2VyaWYiO30NCnNwYW4uRW1haWxT dHlsZTIwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIiwic2Fucy1zZXJpZiI7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0K CXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6 ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5X b3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0 ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEw MjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNo YXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAv Pg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFu Zz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNl Y3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90 Oztjb2xvcjojMUY0OTdEIj5SeWFuLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5Ub2Rh eSBFViBjZXJ0aWZpY2F0ZXMgZG8gZGlzcGxheSB0aGUgRVYgZ3JlZW4gYmFyIHRyZWF0bWVudCBp biBDaHJvbWUgb24gaU9TIChhbGJlaXQgYnJpZWZseSkgYXMgd2VsbCBhcyBhIG1lc3NhZ2UgYWJv dXQgdmFsaWRhdGluZyB0aGUgb3JnYW5pemF0aW9uIGFuZCBsb2NhdGlvbg0KIHdoZW4geW91IGNs aWNrIG9uIHRoZSBjZXJ0aWZpY2F0ZSAodnMganVzdCB0aGUg4oCcd2Vic2l0ZSBoYXMgYmVlbiB2 ZXJpZmllZOKAnSB0aGF0IHlvdSBnZXQgaW4gQ2hyb21lIG9uIEFuZHJvaWQgZm9yIEVWIGFuZCBv biBhbnkgcGxhdGZvcm0gZm9yIG5vbi1FViBjZXJ0cyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFG NDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPkZvbGxvd2luZyB0aGUg bW9iaWxlIHN0aXB1bGF0aW9ucyBpbiBudW1iZXIgNyBvbiB5b3VyIGRvY3VtZW50LCBpbiB0aGUg Y2FzZSBvZiBDaHJvbWUgb24gaU9TLCB0aGlzIHdvdWxkIGJlIHRoZSBkb3duZ3JhZGUgdGhhdCBX YXluZSBtZW50aW9ucy4gQSBjZXJ0aWZpY2F0ZQ0KIGFwcGVhcnMgYXMgRVYgaW4gQ2hyb21lIGZv ciBpT1Mgb24gMzEgSmFuIDIwMTUsIGFuZCB3b3VsZCBub3QgZGlzcGxheSBhcyBFViBhZnRlciAx IEZlYiAyMDE1LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYm cXVvdDs7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0Qi PkNhcmwgTWVobmVyPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQg I0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O1RhaG9tYSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij5Gcm9tOjwvc3Bhbj48L2I+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7 LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPiB0aGVyaWdodGtleSBbbWFpbHRvOnRoZXJpZ2h0a2V5 LWJvdW5jZXNAaWV0Zi5vcmddDQo8Yj5PbiBCZWhhbGYgT2YgPC9iPlJ5YW4gU2xlZXZpPGJyPg0K PGI+U2VudDo8L2I+IFR1ZXNkYXksIEZlYnJ1YXJ5IDA0LCAyMDE0IDEwOjQwIFBNPGJyPg0KPGI+ VG86PC9iPiBXYXluZSBUaGF5ZXI8YnI+DQo8Yj5DYzo8L2I+IHRoZXJpZ2h0a2V5OyBCZW4gTGF1 cmllOyBjZXJ0aWZpY2F0ZS10cmFuc3BhcmVuY3k7IEplcmVteSBSb3dsZXk7IENBQkZQdWI8YnI+ DQo8Yj5TdWJqZWN0OjwvYj4gRVhURVJOQUw6IFJlOiBbdGhlcmlnaHRrZXldIFtjYWJmcHViXSBV cGRhdGVkIENlcnRpZmljYXRlIFRyYW5zcGFyZW5jeSAmIzQzOyBFeHRlbmRlZCBWYWxpZGF0aW9u IHBsYW48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tYm90dG9tOjEyLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+T24gVHVlLCBGZWIgNCwgMjAxNCBhdCA4OjMxIFBNLCBXYXluZSBUaGF5ZXIg Jmx0OzxhIGhyZWY9Im1haWx0bzp3dGhheWVyQGdvZGFkZHkuY29tIiB0YXJnZXQ9Il9ibGFuayI+ d3RoYXllckBnb2RhZGR5LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0 OnNvbGlkICNCNUM0REYgNC41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdDttYXJnaW4tbGVm dDozLjc1cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJp ZiZxdW90OyI+T24gVHVlLCBGZWIgNCwgMjAxNCBhdCA3OjEyIFBNLCBXYXluZSBUaGF5ZXIgJmx0 OzxhIGhyZWY9Im1haWx0bzp3dGhheWVyQGdvZGFkZHkuY29tIiB0YXJnZXQ9Il9ibGFuayI+d3Ro YXllckBnb2RhZGR5LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxk aXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNv bGlkICNCNUM0REYgNC41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdDttYXJnaW4tbGVmdDoz Ljc1cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZx dW90OyI+T24gVHVlLCBGZWIgNCwgMjAxNCBhdCA2OjM4IFBNLCBKZXJlbXkgUm93bGV5ICZsdDs8 YSBocmVmPSJtYWlsdG86amVyZW15LnJvd2xleUBkaWdpY2VydC5jb20iIHRhcmdldD0iX2JsYW5r Ij5qZXJlbXkucm93bGV5QGRpZ2ljZXJ0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1z ZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5J4oCZbSBjb25mdXNlZCBhcyB3ZWxsLiZuYnNwOyBE b2VzIHRoYXQgbWVhbiBBbmRyb2lkIHdpbGwgc3RhcnQgc2hvd2luZyBhbiBFViBpbmRpY2F0b3I/ PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2Jv cmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPkZy b206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTom cXVvdDtUYWhvbWEmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+IHRoZXJpZ2h0a2V5IFtt YWlsdG86PGEgaHJlZj0ibWFpbHRvOnRoZXJpZ2h0a2V5LWJvdW5jZXNAaWV0Zi5vcmciIHRhcmdl dD0iX2JsYW5rIj50aGVyaWdodGtleS1ib3VuY2VzQGlldGYub3JnPC9hPl0NCjxiPk9uIEJlaGFs ZiBPZiA8L2I+V2F5bmUgVGhheWVyPGJyPg0KPGI+U2VudDo8L2I+IFR1ZXNkYXksIEZlYnJ1YXJ5 IDA0LCAyMDE0IDc6MzMgUE08YnI+DQo8Yj5Ubzo8L2I+IFJ5YW4gU2xlZXZpPGJyPg0KPGI+Q2M6 PC9iPiA8YSBocmVmPSJtYWlsdG86dGhlcmlnaHRrZXlAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5r Ij50aGVyaWdodGtleUBpZXRmLm9yZzwvYT47IEJlbiBMYXVyaWU7DQo8YSBocmVmPSJtYWlsdG86 Y2VydGlmaWNhdGUtdHJhbnNwYXJlbmN5QGdvb2dsZWdyb3Vwcy5jb20iIHRhcmdldD0iX2JsYW5r Ij5jZXJ0aWZpY2F0ZS10cmFuc3BhcmVuY3lAZ29vZ2xlZ3JvdXBzLmNvbTwvYT47IENBQkZQdWI8 YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFt0aGVyaWdodGtleV0gW2NhYmZwdWJdIFVwZGF0ZWQg Q2VydGlmaWNhdGUgVHJhbnNwYXJlbmN5ICYjNDM7IEV4dGVuZGVkIFZhbGlkYXRpb24gcGxhbjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUg c3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNCNUM0REYgNC41cHQ7cGFkZGlu ZzowaW4gMGluIDBpbiA0LjBwdDttYXJnaW4tbGVmdDozLjc1cHQ7bWFyZ2luLXRvcDo1LjBwdDtt YXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGJsb2NrcXVvdGUgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4g MGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1y aWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij5IaSBXYXluZSw8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7 c2Fucy1zZXJpZiZxdW90OyI+Q29uc2lkZXJpbmcgd2UgYWxyZWFkeSBkbyBub3QgaW5kaWNhdGUg RVYgb24gQW5kcm9pZCwgbm9yIGhhdmUgd2UgZXZlciwgSSBkb24ndCB0aGluayB0aGlzIHBlcmNl aXZlZCBsb3NzIG9mIGZ1bmN0aW9uYWxpdHkNCiBpcyBhcyBzaWduaWZpY2FudCBhcyB5b3UgbWF5 IGJlbGlldmUuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPkZ1cnRoZXIsIGNvbnNp ZGVyaW5nIHRoZSB2ZXJ5IHJlYWwgYW5kIGRpc3RpbmN0IHBlcmZvcm1hbmNlIGNoYXJhY3Rlcmlz dGljcyBvZiBtb2JpbGUgKHJhZGlvIHdhcm11cHMsIFJUVHMsIGluaXRjd25kcyksDQogdGhlIGlk ZWEgb2YgZmV0Y2hpbmcgT0NTUCwgb3IsIHdvcnNlLCBDUkxzIC0gZXNwZWNpYWxseSB3aGVuIHNv bWUgQ0FzIGhhdmUgQ1JMcyB0aGF0IGFyZSBxdWl0ZSBsYXJnZSAoMjAmIzQzOyBNQikgLSBpbiBv cmRlciB0byBhc3N1cmUgdGhlIEVWIGRpc3BsYXkgaXMuLi4gbm9uLWlkZWFsLiBTbyBhZ2Fpbiwg dGhlIEVWIGluZGljYXRvciBvbiBtb2JpbGUgaXMgbm90IGFzIHN0cm9uZyBvciBhcyBwcmVzZW50 IGFzIGl0IG1heSBiZSBvbiBkZXNrdG9wIHBsYXRmb3Jtcy48L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMC41cHQiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9i bG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5z LXNlcmlmJnF1b3Q7Ij5JbiB0aGF0IGNhc2UsIHdoYXQgZG9lcyB0aGlzIHN0YXRlbWVudCBtZWFu Pzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIHN0eWxlPSJtYXJnaW46 MGluO21hcmdpbi1ib3R0b206LjAwMDFwdCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo4LjVwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+ Q2hyb21lIGZvciBtb2JpbGUgcGxhdGZvcm1zIHdpbGwgY2Vhc2UgdG8gc2hvdyBFViBpbmRpY2F0 b3JzIGZvciBjZXJ0aWZpY2F0ZXMgdGhhdCBhcmUgbm90IENUIHF1YWxpZmllZCBhY2NvcmRpbmcg dG8gdGhlIGNyaXRlcmlhIGJlbG93Ljwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsi PjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZh bWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+SXQgbWVhbnMgdGhhdCBmb3IgYW55IENBcyB0 aGF0IGhvcGUgdG8gYmUgcmVjb2duaXplZCBhcyBFViBvbiBDaHJvbWUgZm9yIG1vYmlsZSBwbGF0 Zm9ybXMgKHdoaWNoIGluY2x1ZGUgaU9TKSwgaW1wbGVtZW50aW5nIENUIGJ5IHRoZSBkYXRlcyBv dXRsaW5lZCBpcyBzZWVuIGFzIGEgcmVxdWlyZW1lbnQNCiBmb3Igc3VjaCB0cmVhdG1lbnQuIFdl IHdhbnRlZCB0byBzcGVjaWZpY2FsbHkgY2FsbCBhdHRlbnRpb24gdG8gdGhpcyAtIHRoZSB3aGl0 ZWxpc3QgaXMgc2VlbiBhcyBhIHRlbXBvcmFyeSBtZWFzdXJlIGZvciBEZXNrdG9wLCBidXQgZ2l2 ZW4gdGhlIHVuaXF1ZSBjaGFyYWN0ZXJpc3RpY3Mgb2YgbW9iaWxlIHBsYXRmb3Jtcywgd2UncmUg cHVyc3VpbmcgdGhpcyByZXF1aXJlbWVudCBhdCBhIG1vcmUgYWdncmVzc2l2ZSBwYWNlLjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlm JnF1b3Q7Ij5XaGlsZSBDaHJvbWUgZm9yIEFuZHJvaWQgLSBhbmQgdGhlIENocm9tZS1iYXNlZCBX ZWJWaWV3LCBhcyB0aGUgV2ViVmlldyBwcmVjZWRpbmcgaXQgLSBkbyBub3QgcHJvdmlkZSBzcGVj aWFsIHRyZWF0bWVudCBmb3IgRVYsIGFueSBmdXR1cmUgcGxhbnMgZm9yIEVWIGluZGljYXRpb25z IG9uIHRoZXNlDQogcGxhdGZvcm1zIGhhdmUgaW5jb3Jwb3JhdGVkIHRoZSBhYm92ZSByZXF1aXJl bWVudHMgYW5kIGRhdGVzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+Jm5ic3A7PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Js b2NrcXVvdGU+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90 O3NhbnMtc2VyaWYmcXVvdDsiPkluIHRoYXQgY2FzZSwgbXkgb3JpZ2luYWwgb2JqZWN0aW9uIHN0 YW5kcyDigJMgdGhpcyBwb2xpY3kgcmV0cm9hY3RpdmVseSBkb3duZ3JhZGVzIGV4aXN0aW5nIEVW IGNlcnRpZmljYXRlcyBpZiBhbmQgd2hlbiBhIG1vYmlsZSBwbGF0Zm9ybSBjaG9vc2VzIHRvIGlt cGxlbWVudCBhbiBFViBpbmRpY2F0b3IuDQogVGhlcmUgYXJlIGNlcnRhaW5seSB0aW1lcyB3aGVu IGl04oCZcyBuZWNlc3NhcnkgdG8gYXBwbHkgYSBuZXcgcG9saWN5IHRvIGV4aXN0aW5nIGNlcnRp ZmljYXRlcyB0byBwcm90ZWN0IHJlbHlpbmcgcGFydGllcywgYnV0IElNTyB0aGlzIGlzbuKAmXQg b25lIG9mIHRoZW0uPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+V2F5bmUsPG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5z LXNlcmlmJnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPldoaWxl IEkgYXBwcmVjaWF0ZSB5b3VyIHBvc2l0aW9uLCBJIGFtIGFic29sdXRlbHkgYmFmZmxlZCBhcyBo b3cgeW91IGNhbiBwcmVzZW50IHRoaXMgYXMgYSAmcXVvdDtkb3duZ3JhZGUmcXVvdDsuPG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYm cXVvdDsiPklmIGFuZCB3aGVuIEFuZHJvaWQgc3VwcG9ydHMgRVYsIGNlcnRpZmljYXRlcyB0aGF0 IGZhaWwgdG8gbWVldCB0aGlzIHJlcXVpcmVtZW50cyB3aWxsIGNvbnRpbnVlIHRvIGFwcGVhciBl eGFjdGx5IHRoZSBzYW1lIGFzIHRoZXkgZG8gdG9kYXkgYW5kIHRoZXkgaGF2ZSBpbiB0aGUgcGFz dC4gQ2VydGlmaWNhdGVzDQogd2hpY2ggZG8gY29uZm9ybSB0byB0aGVzZSBwcm9ncmFtIHJlcXVp cmVtZW50cyB3aWxsLCBwcmVzdW1hYmx5LCBiZSBncmFudGVkIGRpc3Rpbmd1aXNoaW5nIFVJLiBU byB0aGUgY3VzdG9tZXIgd2hvIHB1cmNoYXNlZCBhIGNlcnRpZmljYXRlIHRvZGF5LCB0aGVpciBj ZXJ0aWZpY2F0ZSB3aWxsIGNvbnRpbnVlIHRvIGFwcGVhciBpbiB0aGF0IGZ1dHVyZSB3b3JsZCBl eGFjdGx5IGhvdyBpdCBhcHBlYXJzIHRvZGF5LCBwcmVzdW1hYmx5IC0gcHJvdmlkaW5nDQogdGhl bSBleGFjdGx5IHdoYXQgdGhleSBleHBlY3RlZC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVv dDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+SSBjYW4gb25seSBpbnRl cnByZXQgeW91ciBvYmplY3Rpb24gYXMgYW4gb2JqZWN0aW9uIHRvIHJvb3Qgc3RvcmUgcHJvZ3Jh bXMgcmVxdWlyaW5nIGFkZGl0aW9uYWwgcmVxdWlyZW1lbnRzIGFib3ZlIGFuZCBiZXlvbmQgdGhh dCBvZiB0aGUgRVYgR3VpZGVsaW5lcy4gSSBjYW4gb25seSBwcmVzdW1lDQogdGhhdCB5b3UgaGF2 ZSBzaW1pbGFyIG9iamVjdGlvbnMgdG8gcm9vdCBzdG9yZSBwcm9ncmFtcyByZXF1aXJpbmcgYWRk aXRpb25hbCByZXF1aXJlbWVudHMgYWJvdmUgYW5kIGJleW9uZCB0aGUgQmFzZWxpbmUgUmVxdWly ZW1lbnRzIC0gYXMgKHRvIHRoZSBiZXN0IG9mIG15IGtub3dsZWRnZSkgLSBldmVyeSByb290IHBy b2dyYW0gYWxyZWFkeSBkb2VzIHRvZGF5LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1 b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPlJ5YW4sPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oywm cXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVv dDsiPkkgYmVsaWV2ZSB0aGF0IEkgaGF2ZSByZXBlYXRlZGx5IHN0YXRlZCBteSBzdXBwb3J0IGZv ciBHb29nbGXigJlzIG92ZXJhbGwgcGxhbiB0byBpbXBsZW1lbnQgQ1QsIHNvIHBsZWFzZSBkb24n dCBibG93IHRoaXMgZGlzY3Vzc2lvbiBvdXQgb2YgcHJvcG9ydGlvbiBieSBpbnRlcnByZXRpbmcg aXQgYXMNCiBtZSBvYmplY3RpbmcgdG8gYW55dGhpbmcgYW5kIGV2ZXJ5dGhpbmcgYSByb290IHN0 b3JlIG9wZXJhdG9yIGNob29zZXMgdG8gZG8gdW5pbGF0ZXJhbGx5LiBPbiB0aGUgb3RoZXIgaGFu ZCwgbW9yZSBjb29yZGluYXRpb24gYW1vbmdzdCByb290IHN0b3JlIG9wZXJhdG9ycyB3b3VsZCBi ZSBncmVhdCE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNCNUM0REYgNC41cHQ7cGFkZGluZzowaW4gMGlu IDBpbiA0LjBwdDttYXJnaW4tbGVmdDozLjc1cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJp ZiZxdW90OyI+Q291bGQgeW91IHBlcmhhcHMgcXVhbnRpZnkgZXhhY3RseSB3aGF0IHlvdSBzZWUg YXMgdGhlIGRvd25ncmFkZSwgZ2l2ZW4gdGhhdCBzdWNoIGEgaHlwb3RoZXRpY2FsIHVzZXIgZXhw ZXJpZW5jZSAoYXMgYWdhaW4sIEVWIGlzIG5vdCBwcmVzZW50bHkgaW1wbGVtZW50ZWQgaW4gQ2hy b21lIGZvcg0KIEFuZHJvaWQpIGRvZXMgbm90IGNoYW5nZT88bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlm JnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+TXkg Y29uY2VybiBpcyBvbmUgb2YgdGltaW5nLiBSYXRoZXIgdGhhbiBsZXR0aW5nIHBlcmZlY3RseSBn b29kIEVWIGNlcnRpZmljYXRlcyBleHBpcmUgbmF0dXJhbGx5IG9yIGJlIGdyYW5kZmF0aGVyZWQg aW4sIHRoZXkgYXJlIHRyZWF0ZWQgYXMgbm9uLUVWIGNlcnRpZmljYXRlcyB1bmRlciB0aGlzDQog cG9saWN5LiBXaGVuIEkgdXNlIHRoZSB0ZXJtcyDigJhkb3duZ3JhZGXigJkgYW5kIOKAmHJldHJv YWN0aXZlJywgSSBhbSBzcGVjaWZpY2FsbHkgcmVmZXJyaW5nIHRvIGEgcG9saWN5IGluIHdoaWNo IHNvbWUgRVYgY2VydGlmaWNhdGVzIGlzc3VlZCBwcmlvciB0byB0aGUgaW1wbGVtZW50YXRpb24g b2YgdGhlIHBvbGljeSAocmV0cm9hY3RpdmUpIGFyZSB0cmVhdGVkIGFzIG5vbi1FViAoZG93bmdy YWRlKS4gSSBub3cgdW5kZXJzdGFuZCB0aGF0IHRoZXJlDQogaXMgY3VycmVudGx5IG5vIGNoYW5n ZSBpbiBob3cgdGhleSBhcmUgZGlzcGxheWVkIGluIENocm9tZSBmb3IgQW5kcm9pZCwgYnV0ICgx KSB0aGUgcG9saWN5IGFuZCB5b3VyIGNvbW1lbnRzIGltcGx5IHRoYXQgdGhlcmUgd2lsbCBiZSwg YW5kICgyKSBob3dldmVyIGh5cG90aGV0aWNhbCBpdCBtYXkgYmUsIGEgcHJlY2VkZW50IGlzIGJl aW5nIHNldCBoZXJlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPkknbSBzdGlsbCBub3Qgc3VyZSBJIGZvbGxvdyB0aGUgYXJndW1lbnQsIHNvIGFwb2xv Z2llcyBmb3IgbXkgaWdub3JhbmNlLiBFViB0cmVhdG1lbnQgd2lsbCBvbmx5IGJlIGdyYW50ZWQg dG8gY2VydGlmaWNhdGVzIHRoYXQgY29uZm9ybSB0byB0aGVzZSBwb2xpY2llcy4gQXJlIHlvdSBp bWFnaW5pbmcgYSBzY2VuYXJpbyBpbiB3aGljaCBhIGNlcnRpZmljYXRlIGFwcGVhcnMgYXMgRVYg aW4gQW5kcm9pZCAod2hpY2gNCiBhZ2FpbiwgaXMgbm90IGEgZmVhdHVyZSBjdXJyZW50bHkgaW1w bGVtZW50ZWQpLCBhbmQgdGhlbiBsYXRlciBpbiB0aGUgZnV0dXJlLCBubyBsb25nZXIgZG9lcz88 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QW5k IEknbSBub3Qgc3VyZSB3aGF0IHlvdXIgdmlldyBvZiB0aGUgcHJlY2VkZW50IGlzLiBDaHJvbWUg aGFzIGFscmVhZHkgYXBwbGllZCBwb2xpY2llcyBpdCBiZWxpZXZlcyBhcmUgbmVjZXNzYXJ5IHRv IHByb3RlY3QgdXNlcnMgLSB3ZSBubyBsb25nZXIgdHJlYXQgaW50ZXJuYWwgaG9zdCBuYW1lcyBh cyBzZWN1cmUsIGZvciBleGFtcGxlLCBpbmRlcGVuZGVudCBvZiB0aGUgQmFzZWxpbmUgUmVxdWly ZW1lbnRzDQogMjAxNSBzdW5zZXQuIEVxdWFsbHksIHdlIGFyZSBhZ2dyZXNzaXZlbHkgcHJvY2Vl ZGluZyB3aXRoIGVuc3VyaW5nIHRoYXQgdGhlIHNlY3VyaXR5IGluZGljYXRvciBpcyBhcHByb3By aWF0ZSBmb3IgY2VydGlmaWNhdGVzIHRoYXQgZmFpbCB0byBtZWV0IG1pbmltdW0gY3J5cHRvZ3Jh cGhpYyByZXF1aXJlbWVudHMgb3IgdmFsaWRpdHkgZGF0ZXMuPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkEgY2VydGlmaWNhdGUgd2hpY2ggZG9l cyBub3QgZGlzcGxheSBhcyBFViB0b2RheSwgYW5kIHdoaWNoIGRvZXMgbm90IGRpc3BsYXkgYXMg RVYgdG9tb3Jyb3csIGRvZXMgbm90IHBhcnRpY3VsYXJseSBzZWVtIGxpa2UgYSAmcXVvdDtkb3du Z3JhZGUmcXVvdDs/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4g MGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41 cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7 Ij5JZiB0aGlzIHN0aWxsIGRvZXNu4oCZdCBtYWtlIHNlbnNlLCBtYXliZSB3ZSBjYW4gZGlzY3Vz cyBpdCBhdCB0aGUgQ0FCIEZvcnVtIG1lZXRpbmcgaW4gYSBmZXcgd2Vla3MuPG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVv dDtzYW5zLXNlcmlmJnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjVw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsi PkFsc28sIGNhbiBzb21lb25lIGFuc3dlciBteSBxdWVzdGlvbiBvbiBwb2ludCAjNSBpbiBteSBv cmlnaW5hbCBtZXNzYWdlPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFt aWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_19075EB00EA7FE49AFF87E5818D673D4110388FDPRODEXMB01Weagl_-- From rob.stradling@comodo.com Wed Feb 5 07:26:51 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D319E1A016E for ; Wed, 5 Feb 2014 07:26:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.29 X-Spam-Level: X-Spam-Status: No, score=-1.29 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_NET=0.611, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rE8eIQu-keTX for ; Wed, 5 Feb 2014 07:26:49 -0800 (PST) Received: from ian.brad.office.comodo.net (eth5.brad-fw.brad.office.ccanet.co.uk [178.255.87.226]) by ietfa.amsl.com (Postfix) with ESMTP id 082811A00FD for ; Wed, 5 Feb 2014 07:26:48 -0800 (PST) Received: (qmail 10579 invoked by uid 1000); 5 Feb 2014 15:26:45 -0000 Received: from nigel.brad.office.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (CAMELLIA256-SHA encrypted) ESMTPSA; Wed, 05 Feb 2014 15:26:45 +0000 Message-ID: <52F25835.60702@comodo.com> Date: Wed, 05 Feb 2014 15:26:45 +0000 From: Rob Stradling User-Agent: Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20100101 Thunderbird/24.1.1 MIME-Version: 1.0 To: Ben Laurie References: In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: "therightkey@ietf.org" , certificate-transparency@googlegroups.com, CABFPub Subject: Re: [therightkey] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 15:26:52 -0000 On 04/02/14 17:08, Ben Laurie wrote: > Enclosed, our revised plan. > > Comments welcome. Ben, Table 1 and Footnote 4 seem a bit confused, wrongly implying that 39-month EV certs do exist and/or that >39-month non-EV certs don't exist. >27 month EV SSL certificates shouldn't exist, as per the EV Guidelines. >60 month non-EV SSL certificates shouldn't have been issued by any CA since the BRs came into effect. >39 month non-EV SSL certificates shouldn't be issued from 1st April 2015, as per the BRs. Also, what happened to the idea of only requiring 1 SCT for a 1-month cert? -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From agl@google.com Wed Feb 5 07:40:13 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 476DA1A01AF for ; Wed, 5 Feb 2014 07:40:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.914 X-Spam-Level: X-Spam-Status: No, score=-1.914 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BQm3zU_y41-Y for ; Wed, 5 Feb 2014 07:40:11 -0800 (PST) Received: from mail-vb0-x235.google.com (mail-vb0-x235.google.com [IPv6:2607:f8b0:400c:c02::235]) by ietfa.amsl.com (Postfix) with ESMTP id 89DC81A0192 for ; Wed, 5 Feb 2014 07:40:11 -0800 (PST) Received: by mail-vb0-f53.google.com with SMTP id p17so405077vbe.26 for ; Wed, 05 Feb 2014 07:40:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=UYIs/mirxWiCI2VOjALiVBRBL/ASuTCdXDbDt6dVNRE=; b=iwNr5vYOLUnua339P9CkjcQSuuLtd+ByWMOTidCGjFXc+P77iibGGXRvfRcwGP0b6b i/gMs+P0vvfnGQP8xsx9L3KjrCccSwk0bWH2JDRzoS4shiBfe5J5zffq6OTmvJFfNajO N3UaI8ZOwQ2i+kJfCI8SXf0gpznHH4Q7jidXcR9gGDqhfKSuHtwiEbC8AiWS3074OPut 5QMQYf1ZU38MPedNLX+JBJaVfPF2RqPFutytWS2pUnYx67CzimaYRtj6n5KBVa9xQZiW CfmF0vWFO0sDXoQyTscQlMwS2wGMLy7HVtBGaDcUCZzMJIUrlpawFBYkDQHwEUwu8Sdk aj3A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=UYIs/mirxWiCI2VOjALiVBRBL/ASuTCdXDbDt6dVNRE=; b=RFdeWBbU9maF/kXToxOwssTbDoqC52WjKUKf3BJaSnPBcfDcc9HUC9WFxOu1h8Mfci EVIj4SLY3gEErIlKy/54VcdJ4Vf/yGQinTmCDyPKAF05d3gCvm7vQLbt9Eap+ZPil2Km RmMTR5N8gbJ1WdcZor30CdjMssSnmUoN87bwU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc:content-type; bh=UYIs/mirxWiCI2VOjALiVBRBL/ASuTCdXDbDt6dVNRE=; b=ElpRPsvw9Iwehk5OUCCWSqCgPM5C6KxmvzKIVlPWSxbxiRD0vEpzQDaEynLw0R4om/ Uf0vizfyYCG5bBfx3Rma7er78SjGx4QOQQ6o7E8se9GZViSXojSNaY+lU8txshfFXkps 5M2gETI8N1uRccoK7+nrxjmJ/CsiiNfKdRxeQM/1Sdl09kfhuHokfM2znGi+gFfUB/1g NhRu2AmnkpIYQ/IZW0gHvyqNg79lignwiNO+oXNifyNGKD4r5zv6Wv6Qh1achDlVaa6/ r+pdAoPs7xCFC4cnw4DngGkRYg11CDgDsiZ6AUaMOcCt2UBwW7Bau4HHX4j4oFG5cGP2 eBVg== X-Gm-Message-State: ALoCoQmQxvxT4KwXpgvay48pmz+z2HNrWvW8CXPdWF+rRXhpCEzpC+15QaK8t/dw6dfeLh3W4UrCUOCT+uO+G3vVtkXGR6+8o696daPZkvpTHaS8lI+VYwo0ll5+J26GH10O5arJbSB79Owx0rRKdwyDl79Ej+ErY0lllu07xBf8iHWFVx1PBHv9pPx1KTmwVP+cmIzwPH5b X-Received: by 10.58.123.70 with SMTP id ly6mr1470896veb.26.1391614810670; Wed, 05 Feb 2014 07:40:10 -0800 (PST) MIME-Version: 1.0 Sender: agl@google.com Received: by 10.52.104.37 with HTTP; Wed, 5 Feb 2014 07:39:49 -0800 (PST) In-Reply-To: <52F25835.60702@comodo.com> References: <52F25835.60702@comodo.com> From: Adam Langley Date: Wed, 5 Feb 2014 10:39:49 -0500 X-Google-Sender-Auth: FEWZjBCL_cqzaM2x0hHG0a0WJgM Message-ID: To: certificate-transparency Content-Type: text/plain; charset=UTF-8 Cc: "therightkey@ietf.org" , Ben Laurie , CABFPub Subject: Re: [therightkey] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 15:40:13 -0000 On Wed, Feb 5, 2014 at 10:26 AM, Rob Stradling wrote: > Also, what happened to the idea of only requiring 1 SCT for a 1-month cert? I'm to blame for that. Certificates with a single SCT put a lower bound on how quickly we can distrust a log (at least without special measures, such as shipping the whole, public log hashes to all the clients, which is probably impractical.) Since I'm not aware of any CAs issuing one month certs, and it only saves ~100 bytes vs 2 SCTs, it seemed to be something that should be dropped. Cheers AGL From jeremy.rowley@digicert.com Wed Feb 5 08:19:05 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 711431A010A for ; Wed, 5 Feb 2014 08:19:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.237 X-Spam-Level: X-Spam-Status: No, score=-4.237 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, J_CHICKENPOX_22=0.6, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8laNX3Co85CW for ; Wed, 5 Feb 2014 08:19:03 -0800 (PST) Received: from mail.digicert.com (mail.digicert.com [64.78.193.232]) by ietfa.amsl.com (Postfix) with ESMTP id A5D1C1A00E2 for ; Wed, 5 Feb 2014 08:19:03 -0800 (PST) Received: from JROWLEYL1 (unknown [67.137.52.7]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.digicert.com (Postfix) with ESMTPSA id C69438FA03E; Wed, 5 Feb 2014 09:19:02 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digicert.com; s=mail; t=1391617143; bh=iFYBri7tp+ITMTibPkk7J5A+7SNPXguGQhsn+ZKXwGQ=; h=From:To:Cc:References:In-Reply-To:Subject:Date; b=sbx07fTxB0dTqFZsZWO6xbzgQpTs2y3TXT1i1fo/p57xGcj7pt0HoVkUNPI+/tgvB giKqfm9zSIjL5thz/7XkX9xFCKvu0Dd4B3jo4B3IFtaMIkTpr9N0ot+TZMlRX4o72b kX1DeeMe00at5J5KXi3LzjEIast/HITgIiMGonkE= From: "Jeremy Rowley" To: "'Rob Stradling'" , References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <52F2305C.5040107@comodo.com> In-Reply-To: <52F2305C.5040107@comodo.com> Date: Wed, 5 Feb 2014 09:19:07 -0700 Message-ID: <0b3f01cf228d$fef92e30$fceb8a90$@digicert.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQGGS/IGH2GP3iOZeF9RA+GsPjuqQQF9nIx2AUxrmLEBqP6rfZsU6tPA Content-Language: en-us Cc: therightkey@ietf.org, 'CABFPub' Subject: Re: [therightkey] [cabfpub] Thoughts on reducing SCT sizes (was Re: Updated Certificate Transparency + Extended Validation plan) X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 16:19:05 -0000 Table 1 of the plan document said both 3 SCTs and 4 SCTs for 27 months. Until there is clarification on which is required, 3-4 is the best representation of the requirement. I'm hoping Ben meant 15-27 months = 3 and >27 = 4, but it's not clear from the document. Jeremy -----Original Message----- From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On Behalf Of Rob Stradling Sent: Wednesday, February 05, 2014 5:37 AM To: certificate-transparency@googlegroups.com Cc: therightkey@ietf.org; CABFPub Subject: [cabfpub] Thoughts on reducing SCT sizes (was Re: Updated Certificate Transparency + Extended Validation plan) On Tue, Feb 4, 2014 at 12:33 PM, Jeremy Rowley wrote: > Three or four proofs for a 27 month certificate is way too many. > Adding 400 bytes per certificate will make EV certificates unusable by entities concerned with performance. The updated CT+EV plan requires three SCTs for a (maximum length) 27-month EV certificate, not four. 400 bytes for three SCTs is about right though. Assuming RFC6962-compliant v1 SCTs that contain no SCT extensions and are signed using ECDSA and a P-256 private key, then, including all of the ASN.1 fluff for the SCT List certificate extension, I calculate that it'll be... 140 or 141 bytes to embed 1 SCT 261 to 263 bytes to embed 2 SCTs 380 to 383 bytes to embed 3 SCTs For (non-EV) validity periods between 27 and 39 months: 499 to 503 bytes to embed 4 SCTs On 04/02/14 17:52, Adam Langley wrote: > We should make the SCTs as small as possible Agreed. Time for some back-of-an-envelope sums. For SCT v2, if we were to pack in the data as tightly as possible I reckon we could cut it down to as little as... 84 bytes to embed 1 SCT 159 bytes to embed 2 SCTs 231 bytes to embed 3 SCTs 303 bytes to embed 4 SCTs Here's how... 1. Use a shorter OID for the SCT List extension. Perhaps CABForum could define 2.23.140.n (with n < 128). Save 6 bytes. 2. The first 2 bytes of the SignedCertificateTimestampList structure are its total length. Since this can be calculated from the OCTET STRING length, these 2 bytes could be omitted. Save 2 bytes. 3. Pack the SCT fields into as few bytes as possible for the common case, whilst retaining options for future expansion. Save 37 bytes per SCT. Replace... (1 byte) Version sct_version; (32 bytes) LogID id; (8 bytes) uint64 timestamp; (2+? bytes) CtExtensions extensions; ...with... (2 bits) sct_version (00=v1; 01=v2; 10,11=unassigned) (2 bits) log_id_type (00=SHA-256(log_public_key); 01=1-byte Registered Log ID; 10=2-byte Registered Log ID; 11=4-byte Registered Log ID) (2 bits) timestamp_size (00=8-bytes; 01=6-bytes; 10=5-bytes; 11=4-bytes) (1 bit) extensions (0=CtExtensions is present; 1=CtExtensions is absent) (1 bit) signature_type (0=digitally-signed struct; 1=raw Ed25519 signature) For the common case: (1 byte) Registered Log ID (4 bytes) Timestamp (seconds, not milliseconds) 4. Use the Ed25519 signature scheme instead of ECDSA. ECDSA signatures using a P-256 key seem to be 72 or 73 bytes, whereas Ed25519 signatures are 64 bytes. Save 8 or 9 bytes per SCT. Also, for Ed25519, omit the 2 bytes containing the hash algorithm and signature algorithm from the "digitally-signed struct" header. Save 2 bytes per SCT. -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online _______________________________________________ Public mailing list Public@cabforum.org https://cabforum.org/mailman/listinfo/public From jeremy.rowley@digicert.com Wed Feb 5 08:24:26 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0D9461A0128 for ; Wed, 5 Feb 2014 08:24:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.837 X-Spam-Level: X-Spam-Status: No, score=-4.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hQvbv0d9vA9c for ; Wed, 5 Feb 2014 08:24:24 -0800 (PST) Received: from mail.digicert.com (mail.digicert.com [64.78.193.232]) by ietfa.amsl.com (Postfix) with ESMTP id 8F0E01A00EE for ; Wed, 5 Feb 2014 08:24:24 -0800 (PST) Received: from JROWLEYL1 (unknown [67.137.52.7]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.digicert.com (Postfix) with ESMTPSA id BD2508FA14E; Wed, 5 Feb 2014 09:24:23 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digicert.com; s=mail; t=1391617464; bh=AUmcrHxEq5Lrg/Q/fvAlkKev4kChOZomM/I4wMBEqK0=; h=From:To:Cc:References:In-Reply-To:Subject:Date; b=O9Ydmm/JVTC4msVBnZOBGUYwpWnxf7wUldzm8eaEsPwzWmeXsL2H3Etr28FkQs2Gr 52fxzvXVuDcdJtEre7d59mMjFVBatFJMjXkKFAiNXzFZm3d00j9rQl0Vqor591zpia /W+i5Tyf2qlhkOmMZADXWDpVfL19ZMOwwdaT+270= From: "Jeremy Rowley" To: "'Rob Stradling'" References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <52F2348E.1090805@comodo.com> In-Reply-To: <52F2348E.1090805@comodo.com> Date: Wed, 5 Feb 2014 09:24:28 -0700 Message-ID: <0b4601cf228e$be4de4b0$3ae9ae10$@digicert.com> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQGGS/IGH2GP3iOZeF9RA+GsPjuqQQF9nIx2ATI8Ee2bIwWp4A== Content-Language: en-us Cc: therightkey@ietf.org, 'Ben Laurie' , certificate-transparency@googlegroups.com, 'CABFPub' Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 16:24:26 -0000 We could also remove the subject field to save a bunch of space, but = that would defeat the point of the certificate. Similarly, removing the = public notice defeats the purpose of our relying party warranty. = However, I do think we need to shorten the message and deliver it more = efficiently.=20 Thanks for the heads up. Jeremy -----Original Message----- From: Rob Stradling [mailto:rob.stradling@comodo.com]=20 Sent: Wednesday, February 05, 2014 5:55 AM To: Jeremy Rowley Cc: certificate-transparency@googlegroups.com; 'Ben Laurie'; 'CABFPub'; = therightkey@ietf.org Subject: Re: [cabfpub] Updated Certificate Transparency + Extended = Validation plan On 04/02/14 17:33, Jeremy Rowley wrote: > Adding 400 bytes per certificate will make EV certificates unusable by = entities concerned with performance. BTW Jeremy, in seeking to get some perspective on this issue, I notice = that the current EV cert for www.digicert.com has a Certificate Policies = User Notice that takes up 338 bytes! (2 bytes per character, 'cos for = some reason you use a BMPString). "Any use of this Certificate constitutes acceptance of the DigiCert = CP/CPS and the Relying Party Agreement which limit liability and are = incorporated herein by reference" Is it really necessary to include this notice in each cert? Have any "entities concerned with performance" complained about it? You could save 169 bytes immediately by simply switching from BMPString = to UTF8String! ;-) -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From jeremy.rowley@digicert.com Wed Feb 5 08:29:51 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B59581A00EE for ; Wed, 5 Feb 2014 08:29:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.837 X-Spam-Level: X-Spam-Status: No, score=-4.837 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3aeuA24kCgS2 for ; Wed, 5 Feb 2014 08:29:50 -0800 (PST) Received: from mail.digicert.com (mail.digicert.com [64.78.193.232]) by ietfa.amsl.com (Postfix) with ESMTP id 29B521A0119 for ; Wed, 5 Feb 2014 08:29:50 -0800 (PST) Received: from JROWLEYL1 (unknown [67.137.52.7]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.digicert.com (Postfix) with ESMTPSA id 60EBBAE309; Wed, 5 Feb 2014 09:29:49 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digicert.com; s=mail; t=1391617789; bh=tVNt3Lr88vLMnq6alwUOF+wvkKMpf0El8/e1oKv7utg=; h=From:To:Cc:References:In-Reply-To:Subject:Date; b=QDhpum4cPsUz0LgQ4lKxkmaA3aPf0yw9JTUXx6Q9beDV6ZKCJNumeYwqcX8iNF7wX zLualaZ7RrkPsD/+VSeuHF8bu+e+rF6Bg0zPVBesdvlK7aYnsnfIiMeXFCjnNf3VA/ DrksLKGkL0KBgJ37dRB3NPKDx3fLZzuorkvNPdvo= From: "Jeremy Rowley" To: "'Adam Langley'" , "'certificate-transparency'" References: <52F25835.60702@comodo.com> In-Reply-To: Date: Wed, 5 Feb 2014 09:29:44 -0700 Message-ID: <0b6601cf228f$805d0040$811700c0$@digicert.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQGGS/IGH2GP3iOZeF9RA+GsPjuqQQMYIoXUAMQ1K+ybGaPEQA== Content-Language: en-us Cc: therightkey@ietf.org, 'CABFPub' Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 16:29:51 -0000 We've issued one month certs before. We would have used shorter certs if the CAB Forum had relaxed the OCSP requirements. Since these are supposed to be extremely streamlined, one SCT would be great. Jeremy -----Original Message----- From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On Behalf Of Adam Langley Sent: Wednesday, February 05, 2014 8:40 AM To: certificate-transparency Cc: therightkey@ietf.org; CABFPub Subject: Re: [cabfpub] Updated Certificate Transparency + Extended Validation plan On Wed, Feb 5, 2014 at 10:26 AM, Rob Stradling wrote: > Also, what happened to the idea of only requiring 1 SCT for a 1-month cert? I'm to blame for that. Certificates with a single SCT put a lower bound on how quickly we can distrust a log (at least without special measures, such as shipping the whole, public log hashes to all the clients, which is probably impractical.) Since I'm not aware of any CAs issuing one month certs, and it only saves ~100 bytes vs 2 SCTs, it seemed to be something that should be dropped. Cheers AGL _______________________________________________ Public mailing list Public@cabforum.org https://cabforum.org/mailman/listinfo/public From jeremy.rowley@digicert.com Wed Feb 5 08:32:42 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C58AF1A011A for ; Wed, 5 Feb 2014 08:32:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.836 X-Spam-Level: X-Spam-Status: No, score=-4.836 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.535, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1pG0KiStTWEP for ; Wed, 5 Feb 2014 08:32:40 -0800 (PST) Received: from mail.digicert.com (mail.digicert.com [64.78.193.232]) by ietfa.amsl.com (Postfix) with ESMTP id 0315A1A0128 for ; Wed, 5 Feb 2014 08:32:40 -0800 (PST) Received: from JROWLEYL1 (unknown [67.137.52.7]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.digicert.com (Postfix) with ESMTPSA id 058A27FA07D; Wed, 5 Feb 2014 09:32:38 -0700 (MST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digicert.com; s=mail; t=1391617959; bh=eVhk81wstNCGfkpK5ma7XJOtAphcUmdikGaFpGMxmX4=; h=From:To:Cc:References:In-Reply-To:Subject:Date; b=m+QZac6EGeaGq5miiOL7JDf1w4YVPWJd42lcL/D5Ez/8t0/8mnH/aSWOyDPA8gR1p Swi9m/dSbwO0oL4AtD+OK+ISfy6dDaH5OuOSt5Gz6hLvIkR6Tp+mBO3YWBAoKTElOT f5KEfBhuTPe4XO52BNQC8bxcAIakT2MasaSSw//s= From: "Jeremy Rowley" To: , References: In-Reply-To: Date: Wed, 5 Feb 2014 09:32:36 -0700 Message-ID: <0b6a01cf228f$e58aa490$b09fedb0$@digicert.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0B6B_01CF2255.392CDE00" X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQH3lqM5qG9xv6ylC8uWMtjhP1KDYZpV8bzw Content-Language: en-us Cc: therightkey@ietf.org, public-bounces@cabforum.org, certificate-transparency@googlegroups.com, public@cabforum.org Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 16:32:43 -0000 This is a multipart message in MIME format. ------=_NextPart_000_0B6B_01CF2255.392CDE00 Content-Type: text/plain; charset="ISO-8859-2" Content-Transfer-Encoding: quoted-printable True - short lived certs are typically not EV certs, but, as pointed = out, the eventual plan is for all certs. We might as well make it uniform = now. =20 =20 Anyone use a short-lived cert must be able to easily replace existing certificates. That, combined with the relatively low number of certificates, minimalizes the risk of a site going dark because of a compromised log. =20 =20 Jeremy =20 From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] = On Behalf Of michal.proszkiewicz@unizeto.pl Sent: Wednesday, February 05, 2014 9:20 AM To: agl@chromium.org Cc: therightkey@ietf.org; public-bounces@cabforum.org; certificate-transparency@googlegroups.com; public@cabforum.org Subject: Re: [cabfpub] Updated Certificate Transparency + Extended Validation plan =20 If we are talking about EV certificates then probably there are not many that are valid for a 1 month.=20 It may be the case for other types of certificates. For example CERTUM = issue trusted test SSL certificates valid for 30 days (standard DV = verification procedures and DV certificate profile).=20 >From the other hand we give our customer possibility to manually shorten validity period to one day if they like (for every certificate type).=20 -Micha=B3=20 Adam Langley =20 Wys=B3ane przez: public-bounces@cabforum.org=20 2014-02-05 16:40=20 Do certificate-transparency =20 DW "therightkey@ietf.org" , CABFPub = Temat Re: [cabfpub] Updated Certificate Transparency + Extended = Validation plan =20 =09 On Wed, Feb 5, 2014 at 10:26 AM, Rob Stradling = wrote: > Also, what happened to the idea of only requiring 1 SCT for a 1-month cert? I'm to blame for that. Certificates with a single SCT put a lower bound on how quickly we can distrust a log (at least without special measures, such as shipping the whole, public log hashes to all the clients, which is probably impractical.) Since I'm not aware of any CAs issuing one month certs, and it only saves ~100 bytes vs 2 SCTs, it seemed to be something that should be dropped. Cheers AGL _______________________________________________ Public mailing list Public@cabforum.org https://cabforum.org/mailman/listinfo/public ------=_NextPart_000_0B6B_01CF2255.392CDE00 Content-Type: text/html; charset="ISO-8859-2" Content-Transfer-Encoding: quoted-printable

True – short lived certs are typically not EV certs, but, as = pointed out, the eventual plan is for all certs.=A0 We might as well = make it uniform now.=A0

 

Anyone use a short-lived cert must be able to easily replace existing = certificates. =A0That, combined with the relatively low number of = certificates, minimalizes the risk of a site going dark because of a = compromised log.=A0

 

Jeremy

 

From:= = public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On = Behalf Of michal.proszkiewicz@unizeto.pl
Sent: Wednesday, = February 05, 2014 9:20 AM
To: agl@chromium.org
Cc: = therightkey@ietf.org; public-bounces@cabforum.org; = certificate-transparency@googlegroups.com; = public@cabforum.org
Subject: Re: [cabfpub] Updated Certificate = Transparency + Extended Validation plan

 


If we are = talking about EV certificates then probably there are not many that are = valid for a 1 month.

It may be = the case for other types of certificates. For example CERTUM issue = trusted test SSL certificates valid for 30 days (standard DV = verification procedures and DV certificate profile). =

From the = other hand we give our customer possibility to manually shorten validity = period to one day if they like (for every certificate type). =

-Micha=B3


Adam Langley = <agl@chromium.org> =
Wys=B3ane = przez: public-bounces@cabforum.org

2014-02-05 = 16:40

Do=

certificate-tr= ansparency <certificate-tra= nsparency@googlegroups.com> =

DW=

"therightkey@ietf.org" = <therightkey@ietf.org>, = CABFPub <public@cabforum.org> =

Temat

Re: [cabfpub] = Updated Certificate Transparency + Extended       =  Validation plan

 




On = Wed, Feb 5, 2014 at 10:26 AM, Rob Stradling <rob.stradling@comodo.com>= wrote:
> Also, what happened to the idea of only requiring 1 = SCT for a 1-month cert?

I'm to blame for = that.

Certificates with a single SCT put a lower bound = on how quickly we can
distrust a log (at least without = special measures, such as shipping
the whole, public log = hashes to all the clients, which is probably
impractical.) = Since I'm not aware of any CAs issuing one month certs,
and = it only saves ~100 bytes vs 2 SCTs, it seemed to be something = that
should be = dropped.


Cheers

AGL
_____= __________________________________________
Public mailing = list
Public@cabforum.org
https://cabforum.org/mailman/listinfo/public

------=_NextPart_000_0B6B_01CF2255.392CDE00-- From carl@redhoundsoftware.com Wed Feb 5 08:51:37 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 104121A010D for ; Wed, 5 Feb 2014 08:51:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z_LDTnSAHWDj for ; Wed, 5 Feb 2014 08:51:36 -0800 (PST) Received: from mail-qc0-f182.google.com (mail-qc0-f182.google.com [209.85.216.182]) by ietfa.amsl.com (Postfix) with ESMTP id CB2991A00E2 for ; Wed, 5 Feb 2014 08:51:35 -0800 (PST) Received: by mail-qc0-f182.google.com with SMTP id c9so1055327qcz.13 for ; Wed, 05 Feb 2014 08:51:35 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:user-agent:date:subject:from:to:cc:message-id :thread-topic:references:in-reply-to:mime-version:content-type :content-transfer-encoding; bh=YSw7pySJ7HgiyIos1dDaxgEVDVKiXrJv5BoxIfQXiw4=; b=myA4bzavdBZ7uU4Cno8SP0S18Lv12avARZUK4l9imeXo3stnXYVqKxwtcN2EBjcWAE 70kRGQQav5U61TiMf160z/BnOSR97AqomDyB7U9Xc9Q/n1MqcnSeGhHRIeiQ82JiH6YH ZoF0Svg3GUNQezCnAcpk2K2yyfcb9wUym6Hs3jm3VDSulM02KQNlB+89ne7oAuo+gQIV 11JY0N4pp5xRYHohYRk5j9kFGcuOz/PabIKDYvvP4kN4tkClNwE7kwd/22tK97qoZWwa eeAXQlJI0MohX3JJ0vdGmldqhSeHgQA2m8Jyd7NuZ6QRj0hbSiXF1v3jEk2Kb13iIpPH BAcQ== X-Gm-Message-State: ALoCoQlOnkHiyIvPNSpj5rO/go9nK6KvD+2nz8JFAzs7oxOA2CVlhuzA3JTE7Woc2d9Y/8Iy0RoS X-Received: by 10.224.136.195 with SMTP id s3mr4185831qat.95.1391619094996; Wed, 05 Feb 2014 08:51:34 -0800 (PST) Received: from [192.168.2.4] (pool-173-79-106-67.washdc.fios.verizon.net. [173.79.106.67]) by mx.google.com with ESMTPSA id k1sm78491788qat.16.2014.02.05.08.51.32 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Wed, 05 Feb 2014 08:51:34 -0800 (PST) User-Agent: Microsoft-MacOutlook/14.3.9.131030 Date: Wed, 05 Feb 2014 11:51:29 -0500 From: Carl Wallace To: Adam Langley Message-ID: Thread-Topic: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <01dc01cf21db$146dac40$3d4904c0$@globalsign.com> <05c501cf21dc$bbc70da0$335528e0$@digicert.com> In-Reply-To: Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit Cc: therightkey Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 16:51:37 -0000 On 2/4/14, 2:41 PM, "Adam Langley" wrote: >On Tue, Feb 4, 2014 at 2:10 PM, Jeremy Rowley > wrote: >> I do not think this is correct. The number of proofs actually >>increases as you decrease validity periods. > >Consider a certificate setting out on a journey. It always needs to >have identity papers with it because the Browser Police are always on >the lookout for unregistered certificates. However, the Browser Police >sometimes decide that certain forms of ID are no longer acceptable and >so a certificate needs to carry several forms of ID with it. If it's >setting out on a one year journey it's wise to have two forms of ID >because one might become distrusted over the year, but it's >vanishingly unlikely that both would be. > >However, if our plucky certificate is setting out on a two year >journey then it's wise to carry three forms of ID just in case two >become useless while it's out in the world. The longer it'll be out, >the more forms of id it should carry to ensure that one is always >acceptable. This would be more clear if the section of the document that notes Chrome will periodically refresh the list of qualifying logs also indicated the list of formerly qualifying logs will also be updated. You will need both lists. From paul.hoffman@vpnc.org Wed Feb 5 08:55:40 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D24BF1A0159 for ; Wed, 5 Feb 2014 08:55:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.347 X-Spam-Level: X-Spam-Status: No, score=-1.347 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_COM=0.553] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bvb2jSBy_uq8 for ; Wed, 5 Feb 2014 08:55:40 -0800 (PST) Received: from hoffman.proper.com (IPv6.Hoffman.Proper.COM [IPv6:2605:8e00:100:41::81]) by ietfa.amsl.com (Postfix) with ESMTP id DF48E1A014E for ; Wed, 5 Feb 2014 08:55:39 -0800 (PST) Received: from [10.20.30.90] (50-1-98-67.dsl.dynamic.sonic.net [50.1.98.67]) (authenticated bits=0) by hoffman.proper.com (8.14.7/8.14.7) with ESMTP id s15GZXZM027407 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Wed, 5 Feb 2014 09:35:34 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) X-Authentication-Warning: hoffman.proper.com: Host 50-1-98-67.dsl.dynamic.sonic.net [50.1.98.67] claimed to be [10.20.30.90] Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\)) From: Paul Hoffman In-Reply-To: <52F25835.60702@comodo.com> Date: Wed, 5 Feb 2014 08:55:36 -0800 Content-Transfer-Encoding: quoted-printable Message-Id: References: <52F25835.60702@comodo.com> To: "therightkey@ietf.org" X-Mailer: Apple Mail (2.1827) Cc: certificate-transparency@googlegroups.com, CABFPub Subject: Re: [therightkey] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 16:55:41 -0000 On Feb 5, 2014, at 7:26 AM, Rob Stradling = wrote: > Table 1 and Footnote 4 seem a bit confused, wrongly implying that = 39-month EV certs do exist and/or that >39-month non-EV certs don't = exist. >=20 > >27 month EV SSL certificates shouldn't exist, as per the EV = Guidelines. >=20 > >60 month non-EV SSL certificates shouldn't have been issued by any CA = since the BRs came into effect. >=20 > >39 month non-EV SSL certificates shouldn't be issued from 1st April = 2015, as per the BRs. The above seems to be based in the belief that no one than CABForum = members issue certificates. It also seems to be based on the idea that = no CABForum member will ever not follow the current-at-the-time CABForum = rules. The CT work seems to be based on the idea that other CAs exist, and even = that CABForum members might not follow the CABForum rules. Those seem = like good assumptions to me. --Paul Hoffman= From agl@google.com Wed Feb 5 09:18:22 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D0F1E1A00F7 for ; Wed, 5 Feb 2014 09:18:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.914 X-Spam-Level: X-Spam-Status: No, score=-1.914 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8N3nkY4lzJ03 for ; Wed, 5 Feb 2014 09:18:20 -0800 (PST) Received: from mail-vb0-x229.google.com (mail-vb0-x229.google.com [IPv6:2607:f8b0:400c:c02::229]) by ietfa.amsl.com (Postfix) with ESMTP id A35801A004B for ; Wed, 5 Feb 2014 09:18:20 -0800 (PST) Received: by mail-vb0-f41.google.com with SMTP id g10so519141vbg.14 for ; Wed, 05 Feb 2014 09:18:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=QNykBQRJ5xWT7DcqpW6LBtrTZz5r0ESdxOJo/tQsLYQ=; b=NH8WIJtEEAk3MyuLBPLgTHc/GeYwhncN9zwMOqlcI74lwyCh/NshGjf8fBUSeXAufR 4Y9DuT2XfrD5tk+o/8L0qui0HagfOaFZ2LLRbqJ8HZloBEtFx8ymyyQsQkQw28yQnevO lkbLNg0bM4rG8zSqLiwQbMPyJIib+sBU6PTFF2ABTjQwxRwIVzepSzSMwR1S2WxHVNKM QHqVN/Ug38CB7aQfyPOshLEwMKQpg+lpmzTX7+W8ZZOtel5ouKC9prh0bBLKr7PkieH6 ZISAhUDTlwQ/uWRVtt/8giuI9d/fvt3AywVYOKTW0fVKr2yVod5X3tvGKTpxX83kRbpK OEyQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=QNykBQRJ5xWT7DcqpW6LBtrTZz5r0ESdxOJo/tQsLYQ=; b=PfzApGHiQNd9IL2pbqvKnKS8I9jRICzSJyC6Ty5V9VW5d9d/sHz4oSere54outqTnN 9314R5P4hEiWHWnu4OiyzWp5zkEwMjjuRpneW/qfMySF0fy4Yd2fdV96iUDkeR8Psvfs qWS6AhKumpjJEnzo/k/c8qZ7elxF4kZqv6W20= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc:content-type; bh=QNykBQRJ5xWT7DcqpW6LBtrTZz5r0ESdxOJo/tQsLYQ=; b=bqYRkGKN8UAc97NfHlzcQKLlnbpbaLL/vwfj1vRvWLKlhlYqrV/UGByqi2SKA58vc3 ERtJJP/4cqtdTXqA34N2XMonR2srUBDUAjWwIEUkg/gPPMGKEgmmAcwPmACbNc6RSDWG nUwAVjA5E10iW4souUw7FQH/iT9rcK82Qm+vASYPYIpzdC8clpkWX/O94N29GL3EKsBR 9e4v652T48CEzbZJjv4qi41aMypfKB6dfHjcV1cPOjt8H91jYjaI1Q6P3uXdulMW2f3s uVVSNcbqMhSj5ADEWWXg2gNvgri6iDWs27pGhdG4FXPVcSr8Hrlc8gPgtbfxrgRXCbhT pp6Q== X-Gm-Message-State: ALoCoQkL9178C+zZ3ZyEA01dE8zl7ItarikVwnrHIg9EQvLoF9sE7Fa8O0kRRGXtKFjdu5bnP4IUJb00RewsrIoMmX8pTjb9ejsyJBf7ATEUJ/ZaRPLbEkG/GCZkTtcMYxqBxbnk0Nv/E7mchzzFyUiXlqYPNKCl0vCO6j23JU1WnypJOaCtKHcFGdZxzzbuGeFCkVRnSbaR X-Received: by 10.58.186.132 with SMTP id fk4mr1749576vec.9.1391620699682; Wed, 05 Feb 2014 09:18:19 -0800 (PST) MIME-Version: 1.0 Sender: agl@google.com Received: by 10.52.104.37 with HTTP; Wed, 5 Feb 2014 09:17:59 -0800 (PST) In-Reply-To: References: <52F25835.60702@comodo.com> From: Adam Langley Date: Wed, 5 Feb 2014 12:17:59 -0500 X-Google-Sender-Auth: 6STs44PPdCLlNfTQlNfz9K2axLs Message-ID: To: certificate-transparency Content-Type: text/plain; charset=UTF-8 Cc: "therightkey@ietf.org" , CABFPub Subject: Re: [therightkey] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 17:18:23 -0000 On Wed, Feb 5, 2014 at 11:55 AM, Paul Hoffman wrote: > The CT work seems to be based on the idea that other CAs exist, and even that CABForum members might not follow the CABForum rules. Those seem like good assumptions to me. In this case I think the table was drafted with all certificates in mind and we didn't remove the inapplicable rows when just considering EV certificates. In general, CAs that issue outside of the Baseline are skating on thin ice whether they are CA/B Forum members or not. We can (and do) enforce Baseline limits in software. Cheers AGL From rob.stradling@comodo.com Wed Feb 5 09:26:37 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 07A6E1A016B for ; Wed, 5 Feb 2014 09:26:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.29 X-Spam-Level: X-Spam-Status: No, score=-1.29 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_NET=0.611, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u0WREz-ffOIC for ; Wed, 5 Feb 2014 09:26:34 -0800 (PST) Received: from ian.brad.office.comodo.net (eth5.brad-fw.brad.office.ccanet.co.uk [178.255.87.226]) by ietfa.amsl.com (Postfix) with ESMTP id BFC1A1A00F7 for ; Wed, 5 Feb 2014 09:26:33 -0800 (PST) Received: (qmail 29605 invoked by uid 1000); 5 Feb 2014 17:26:30 -0000 Received: from nigel.brad.office.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (CAMELLIA256-SHA encrypted) ESMTPSA; Wed, 05 Feb 2014 17:26:30 +0000 Message-ID: <52F27445.6040701@comodo.com> Date: Wed, 05 Feb 2014 17:26:29 +0000 From: Rob Stradling User-Agent: Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20100101 Thunderbird/24.1.1 MIME-Version: 1.0 To: Adam Langley , certificate-transparency References: <52F25835.60702@comodo.com> In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Cc: "therightkey@ietf.org" , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 17:26:37 -0000 On 05/02/14 15:39, Adam Langley wrote: > On Wed, Feb 5, 2014 at 10:26 AM, Rob Stradling wrote: >> Also, what happened to the idea of only requiring 1 SCT for a 1-month cert? > > I'm to blame for that. > > Certificates with a single SCT put a lower bound on how quickly we can > distrust a log (at least without special measures, such as shipping > the whole, public log hashes to all the clients, which is probably > impractical.) Sure. How quickly do you want to be able to distrust a log (without needing to resort to using probably impractical special measures)? Presumably it's somewhere between 10 and 31 days, since 1 SCT is acceptable for Stapled OCSP and the BRs permit OCSP Responses to be valid for up to 10 days. > Since I'm not aware of any CAs issuing one month certs, Maybe not today, but... > and it only saves ~100 bytes vs 2 SCTs, it seemed to be something that > should be dropped. Do you still think [1] is a good plan? I think we should design CT with the assumption that [1] might happen in the future. Just looking at what CAs are issuing today seems short-sighted IMHO. How about requiring only 1 SCT for certs with durations <= the maximum validity period for an OCSP Response? [1] https://www.imperialviolet.org/2011/03/18/revocation.html "A much better solution would be for certificates to only be valid for a few days and to forget about revocation altogether. This doesn't mean that the private key needs to change every few days, just the certificate. And the certificate is public data, so servers could just download their refreshed certificate over HTTP periodically and automatically (like OCSP stapling). Clients wouldn't have to perform revocation checks (which are very complex and slow), CAs wouldn't have to pay for massive, DDoS proof serving capacity and revocation would actually work. If the CA went down for six hours, nobody cares. Only if the CA is down for days is there a problem. If you want to “revoke” a certificate, just stop renewing it." -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From paul.hoffman@vpnc.org Wed Feb 5 09:37:53 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 577941A0122 for ; Wed, 5 Feb 2014 09:37:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.347 X-Spam-Level: X-Spam-Status: No, score=-1.347 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_COM=0.553] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5wMILEXdvZ3E for ; Wed, 5 Feb 2014 09:37:52 -0800 (PST) Received: from hoffman.proper.com (IPv6.Hoffman.Proper.COM [IPv6:2605:8e00:100:41::81]) by ietfa.amsl.com (Postfix) with ESMTP id 34BB71A010D for ; Wed, 5 Feb 2014 09:37:52 -0800 (PST) Received: from [10.20.30.90] (50-1-98-67.dsl.dynamic.sonic.net [50.1.98.67]) (authenticated bits=0) by hoffman.proper.com (8.14.7/8.14.7) with ESMTP id s15HHh0r028915 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Wed, 5 Feb 2014 10:17:45 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) X-Authentication-Warning: hoffman.proper.com: Host 50-1-98-67.dsl.dynamic.sonic.net [50.1.98.67] claimed to be [10.20.30.90] Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\)) From: Paul Hoffman In-Reply-To: Date: Wed, 5 Feb 2014 09:37:44 -0800 Content-Transfer-Encoding: quoted-printable Message-Id: <7776D195-B579-4493-9A30-B094587BE4FF@vpnc.org> References: <52F25835.60702@comodo.com> To: Adam Langley X-Mailer: Apple Mail (2.1827) Cc: "therightkey@ietf.org" , certificate-transparency , CABFPub Subject: Re: [therightkey] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 17:37:53 -0000 On Feb 5, 2014, at 9:17 AM, Adam Langley wrote: > On Wed, Feb 5, 2014 at 11:55 AM, Paul Hoffman = wrote: >> The CT work seems to be based on the idea that other CAs exist, and = even that CABForum members might not follow the CABForum rules. Those = seem like good assumptions to me. >=20 > In this case I think the table was drafted with all certificates in > mind and we didn't remove the inapplicable rows when just considering > EV certificates. >=20 > In general, CAs that issue outside of the Baseline are skating on thin > ice whether they are CA/B Forum members or not. We can (and do) > enforce Baseline limits in software. Where "we" is Chrome, yes? Is the list of the rules you enforce = published somewhere other than in the source code? If so, that would = help the CT conversation a great deal. --Paul Hoffman= From rob.stradling@comodo.com Wed Feb 5 09:48:07 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 08C7C1A020B for ; Wed, 5 Feb 2014 09:48:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.29 X-Spam-Level: X-Spam-Status: No, score=-1.29 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_NET=0.611, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M9imJ_siKdMn for ; Wed, 5 Feb 2014 09:48:05 -0800 (PST) Received: from ian.brad.office.comodo.net (eth5.brad-fw.brad.office.ccanet.co.uk [178.255.87.226]) by ietfa.amsl.com (Postfix) with ESMTP id ADC6F1A01F7 for ; Wed, 5 Feb 2014 09:48:04 -0800 (PST) Received: (qmail 31566 invoked by uid 1000); 5 Feb 2014 17:48:02 -0000 Received: from nigel.brad.office.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (CAMELLIA256-SHA encrypted) ESMTPSA; Wed, 05 Feb 2014 17:48:02 +0000 Message-ID: <52F27952.4040806@comodo.com> Date: Wed, 05 Feb 2014 17:48:02 +0000 From: Rob Stradling User-Agent: Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20100101 Thunderbird/24.1.1 MIME-Version: 1.0 To: certificate-transparency@googlegroups.com, "therightkey@ietf.org" References: <52F25835.60702@comodo.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: CABFPub Subject: Re: [therightkey] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 17:48:07 -0000 On 05/02/14 16:55, Paul Hoffman wrote: > On Feb 5, 2014, at 7:26 AM, Rob Stradling wrote: > >> Table 1 and Footnote 4 seem a bit confused, wrongly implying that 39-month EV certs do exist and/or that >39-month non-EV certs don't exist. >> >>> 27 month EV SSL certificates shouldn't exist, as per the EV Guidelines. >> >>> 60 month non-EV SSL certificates shouldn't have been issued by any CA since the BRs came into effect. >> >>> 39 month non-EV SSL certificates shouldn't be issued from 1st April 2015, as per the BRs. > > The above seems to be based in the belief that no one than CABForum members issue certificates. It also seems to be based on the idea that no CABForum member will ever not follow the current-at-the-time CABForum rules. > > The CT work seems to be based on the idea that other CAs exist, and even that CABForum members might not follow the CABForum rules. Those seem like good assumptions to me. Paul, there are 2 things going on here. 1. The IETF CT work (i.e. RFC6962) hasn't specified anything about requiring multiple SCTs, and I doubt RFC6962-bis will change that. In this context, other CAs do exist (both CABForum non-members and non-publicly-trusted CAs). 2. The Chrome CT roll-out plan. In this context, CAs that don't adhere to the BRs and EVGs are likely to find that their non-compliant certs are rejected for other reasons. This is the context to which I was speaking. -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From agl@google.com Wed Feb 5 09:49:43 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CFB431A020C for ; Wed, 5 Feb 2014 09:49:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.914 X-Spam-Level: X-Spam-Status: No, score=-1.914 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QrpcnJ-zKEN8 for ; Wed, 5 Feb 2014 09:49:42 -0800 (PST) Received: from mail-vb0-x22c.google.com (mail-vb0-x22c.google.com [IPv6:2607:f8b0:400c:c02::22c]) by ietfa.amsl.com (Postfix) with ESMTP id 4F4451A020B for ; Wed, 5 Feb 2014 09:49:42 -0800 (PST) Received: by mail-vb0-f44.google.com with SMTP id f12so554538vbg.31 for ; Wed, 05 Feb 2014 09:49:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=KyFfsh2IxGwi323hvcMFbKb7rcLu55g4kD4BF8AMOOA=; b=hSH07WdiOeBXU5Y72cYykiM4a1y+41Sowi0VMfjbuv4xSrRQ1SrD3RttrkhqIJkh3k +ibavDd/3cqpI4jxrAtisY73M6Q8pQyLEfE4QqHb0chyJ1sg6kPFVpuSbYtrNAfWgvJ+ NXK7JVkULHbG0fCmBrB5Pu1796P03FCOrVmMxZee4VH3pL5vx3zoE9bcuJDUhcrVxP5n OgDrmmrFmKKnW3C4CvYTO79tK0+3SqwK94zrh4dLVaLjjDCsC5hN7CiPS8kqnjNT8RV3 C0KnsZDAluRLMRhMtdAWH6VjPaUa2ZsNe5rUql2xbIB2ta6hB4mbGp/q0WSQwBjy7/bc NiIQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=KyFfsh2IxGwi323hvcMFbKb7rcLu55g4kD4BF8AMOOA=; b=fhNhAFxw6KatA6jicqIExlFhfSZxetJdL7Jcs4fSJEgyO5BoZfK9HoH+FMurX23fAA to89ZXpjuIjiZh2XCKq10fZzu/zsbLSsBIXm2WEhmbvdNxECAw3zVWRyUJbfBK7fqfUc m2hFLKwDBNwOLtpTycSzfigDqDM1IdAS9Ukh0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc:content-type; bh=KyFfsh2IxGwi323hvcMFbKb7rcLu55g4kD4BF8AMOOA=; b=O/udXVUaidPaoDQwCuUCVlTjPjsOVFf9wos2XJYF+NNgeQT/lIPEn5SeCqubDHznYF 6T25y4jW+Czwbvj33qc8ttolp07ldE2l9KX8thMs5DnHa7y74U6qHwj8DsxyQBe1sFky jnq3FOXzanM0OAhI2ImOEyMBb473jncD7KgdUvJ6h1pD3fkW7kTwOB4mCOqh1yqQEONR SbiDrZvtbXFqZkY2n4WlxAOto4ZUL0EYDcuWR34JVSC9W7/Bl0Qt9cG53KZ0uBHPWvfT dRc+xuqu2wbMEtpNtgyo1wsePoWXh3/QLWhxbBDf0/GH/pPAEhacCw8tmb3fIQAf926m o/lg== X-Gm-Message-State: ALoCoQk0mWxLzS5Ll56PqTMQMphD2GMnUnJqba9OqvELAILzvgkQRW49SXV01qH8oSiffAYaWBBkebr0NtGa7pwrMpu4qgV/yr3WacGVT3AQKIawvwdaeGAihXi0X7jKzGUNa52HRJBS0gSBPj9OxIMKmVwkVkM7MuaQIbt5mfOs+fztW9CLTMA4e9wUMaVC3E0Jhyv70iG3 X-Received: by 10.221.40.10 with SMTP id to10mr1838154vcb.22.1391622581354; Wed, 05 Feb 2014 09:49:41 -0800 (PST) MIME-Version: 1.0 Sender: agl@google.com Received: by 10.52.104.37 with HTTP; Wed, 5 Feb 2014 09:49:21 -0800 (PST) In-Reply-To: <52F27445.6040701@comodo.com> References: <52F25835.60702@comodo.com> <52F27445.6040701@comodo.com> From: Adam Langley Date: Wed, 5 Feb 2014 12:49:21 -0500 X-Google-Sender-Auth: WxsQ90hrCMLUQjUqro41rZfq00E Message-ID: To: certificate-transparency Content-Type: text/plain; charset=UTF-8 Cc: "therightkey@ietf.org" , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 17:49:44 -0000 On Wed, Feb 5, 2014 at 12:26 PM, Rob Stradling wrote: > Presumably it's somewhere between 10 and 31 days, since 1 SCT is acceptable > for Stapled OCSP and the BRs permit OCSP Responses to be valid for up to 10 > days. The speed at which we need to distrust a log depends on the minimum number of SCTs actually, which is why allowing a single SCT in stapled OCSP responses is such a large concession. If the minimum number of SCTs were two then the pressure to distrust a log (and the pressure on the logs) would be dramatically reduced because compromising one log wouldn't be sufficient. > Do you still think [1] is a good plan? Sure, if any CAs are willing to do it now :) > How about requiring only 1 SCT for certs with durations <= the maximum > validity period for an OCSP Response? I agree that, if we're going to allow one SCT for stapled OCSP responses then we might as well allow one for 10 day certs. However, the only case where ~100 bytes makes any different is if the certificate chain is right on the edge of the initcwnd and the server cannot (somehow?) set the initcwnd. I.e. it's gone cargo cult. Cheers AGL From rob.stradling@comodo.com Wed Feb 5 10:21:19 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A4A3D1A0140 for ; Wed, 5 Feb 2014 10:21:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.29 X-Spam-Level: X-Spam-Status: No, score=-1.29 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_NET=0.611, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nSXKTXDitfmJ for ; Wed, 5 Feb 2014 10:21:17 -0800 (PST) Received: from ian.brad.office.comodo.net (eth5.brad-fw.brad.office.ccanet.co.uk [178.255.87.226]) by ietfa.amsl.com (Postfix) with ESMTP id 0C98E1A01C7 for ; Wed, 5 Feb 2014 10:21:16 -0800 (PST) Received: (qmail 10479 invoked by uid 1000); 5 Feb 2014 18:21:14 -0000 Received: from nigel.brad.office.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (CAMELLIA256-SHA encrypted) ESMTPSA; Wed, 05 Feb 2014 18:21:14 +0000 Message-ID: <52F2811A.9030800@comodo.com> Date: Wed, 05 Feb 2014 18:21:14 +0000 From: Rob Stradling User-Agent: Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20100101 Thunderbird/24.1.1 MIME-Version: 1.0 To: certificate-transparency@googlegroups.com References: <52F25835.60702@comodo.com> <52F27445.6040701@comodo.com> In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: "therightkey@ietf.org" , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 18:21:19 -0000 On 05/02/14 17:49, Adam Langley wrote: > On Wed, Feb 5, 2014 at 12:26 PM, Rob Stradling wrote: >> Presumably it's somewhere between 10 and 31 days, since 1 SCT is acceptable >> for Stapled OCSP and the BRs permit OCSP Responses to be valid for up to 10 >> days. > > The speed at which we need to distrust a log depends on the minimum > number of SCTs actually, which is why allowing a single SCT in stapled > OCSP responses is such a large concession. If the minimum number of > SCTs were two then the pressure to distrust a log (and the pressure on > the logs) would be dramatically reduced because compromising one log > wouldn't be sufficient. > >> Do you still think [1] is a good plan? > > Sure, if any CAs are willing to do it now :) I think "servers could just download their refreshed certificate over HTTP periodically and automatically" is the showstopper at the moment. Yes they could, but I'm not aware of any server that actually implements such a feature. For at least httpd and nginx, I guess it would be pretty easy (albeit crude) to implement this in a simple shell script. The bigger problem would be getting it widely deployed to servers. >> How about requiring only 1 SCT for certs with durations <= the maximum >> validity period for an OCSP Response? > > I agree that, if we're going to allow one SCT for stapled OCSP > responses then we might as well allow one for 10 day certs. > > However, the only case where ~100 bytes makes any different is if the > certificate chain is right on the edge of the initcwnd and the server > cannot (somehow?) set the initcwnd. I.e. it's gone cargo cult. What % of deployed servers can't (and/or don't?) set the initcwnd? How small (in bytes) does a certificate chain need to be in order to avoid overflowing the initcwnd? Thanks. -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online Office Tel: +44.(0)1274.730505 Office Fax: +44.(0)1274.730909 www.comodo.com COMODO CA Limited, Registered in England No. 04058690 Registered Office: 3rd Floor, 26 Office Village, Exchange Quay, Trafford Road, Salford, Manchester M5 3EQ This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender by replying to the e-mail containing this attachment. Replies to this email may be monitored by COMODO for operational or business reasons. Whilst every endeavour is taken to ensure that e-mails are free from viruses, no liability can be accepted and the recipient is requested to use their own virus checking software. From Rick_Andrews@symantec.com Thu Feb 6 10:51:36 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2528B1A0172 for ; Thu, 6 Feb 2014 10:51:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.436 X-Spam-Level: X-Spam-Status: No, score=-7.436 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BHmUje-WVC6G for ; Thu, 6 Feb 2014 10:51:34 -0800 (PST) Received: from tus1smtoutpex01.symantec.com (tus1smtoutpex01.symantec.com [216.10.195.241]) by ietfa.amsl.com (Postfix) with ESMTP id EB33E1A0208 for ; Thu, 6 Feb 2014 10:51:33 -0800 (PST) X-AuditID: d80ac3f1-b7fbd8e0000048d0-66-52f3d9b4145c Received: from ecl1mtahubpin01.ges.symantec.com (ecl1mtahubpin01.ges.symantec.com [10.48.69.201]) by tus1smtoutpex01.symantec.com (Symantec Brightmail Gateway out) with SMTP id B0.69.18640.4B9D3F25; Thu, 6 Feb 2014 18:51:32 +0000 (GMT) Received: from [155.64.220.139] (helo=TUS1XCHHUBPIN03.SYMC.SYMANTEC.COM) by ecl1mtahubpin01.ges.symantec.com with esmtp (Exim 4.76) (envelope-from ) id 1WBU2t-0004jr-T9; Thu, 06 Feb 2014 18:51:31 +0000 Received: from TUS1XCHEVSPIN33.SYMC.SYMANTEC.COM ([155.64.220.146]) by TUS1XCHHUBPIN03.SYMC.SYMANTEC.COM ([155.64.220.139]) with mapi; Thu, 6 Feb 2014 10:51:17 -0800 From: Rick Andrews To: Ben Laurie , CABFPub , "certificate-transparency@googlegroups.com" , "therightkey@ietf.org" Date: Thu, 6 Feb 2014 10:51:16 -0800 Thread-Topic: [therightkey] Updated Certificate Transparency + Extended Validation plan Thread-Index: Ac8hy7q25KVc0LjMSAauxrLju8TdvwBoGRYA Message-ID: <544B0DD62A64C1448B2DA253C011414607C3F53600@TUS1XCHEVSPIN33.SYMC.SYMANTEC.COM> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrAIsWRmVeSWpSXmKPExsXCZeB6UnfLzc9BBl+vm1ls+HyNzWJl1wwm iynP1zBbfLzwk8WBxWPdzLPMHgs2lXrsmXiSzWPJkp9MASxRXDYpqTmZZalF+nYJXBk/7z9m KnjGU/H0KncD4x6eLkZODgkBE4k5TTPYIGwxiQv31gPZXBxCAu8YJfa/eMMIkhASeMUo8fKB FURiJaPEg/ebwRJsAnoSWx5fYQexRQTOMkqc+SwJYrMIqEj8mH4RrEZYIELizK9drBA1kRIP Jy9lhLCNJGY93QbWyysQJbFuZT8LxLIAiRs9z8HqOQUCJY40t4LVMAJd9/3UGiYQm1lAXOLW k/lMEFcLSCzZc54ZwhaVePn4HytEvajEnfb1QLs4gOo1Jdbv0odoVZSY0v0Qaq2gxMmZT1gm MIrNQjJ1FkLHLCQds5B0LGBkWcUoU1JabFicW5JfWlKQWmFgqFdcmZsIjLVkveT83E2MwHi7 wXX44w7G60sVDzEKcDAq8fAWH/scJMSaWAZUeYhRgoNZSYRXcy9QiDclsbIqtSg/vqg0J7X4 EKM0B4uSOO+S9BVBQgLpiSWp2ampBalFMFkmDk6pBsZVp6NjnpmVT95uE6zjcTKx4PYjnlni MjdOx6htVn/87urKnLduHrIODmv2FWf7ZzG7h/l+vjbbP2ijfEbq5+tif9/KBThXmuqd/2ri 8WfSjWRP/bhplXXH/SUv6O6w+HMkrfzAD+aY1EXCdjw/2eYsPznd52RJdvQKeX7bM/P6X63c lcKy5KISS3FGoqEWc1FxIgBnrk2dswIAAA== Subject: Re: [therightkey] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Feb 2014 18:51:36 -0000 QmVuLA0KDQpDYW4geW91IGNsYXJpZnkgc29tZXRoaW5nPyBUaGUgU0NUIGRlbGl2ZXJ5IG9wdGlv bnMgZGVzY3JpYmVkIGluIHRoZSBSRkMgYXJlIG9wdGlvbnMgZm9yIHRoZSB3ZWIgc2l0ZSBvd25l ciwgbm90IGZvciB0aGUgQ0EuIENBcyB3aWxsIG5lZWQgdG8gc3VwcG9ydCBhbGwgdGhyZWUgb3B0 aW9ucy4gV2Ugd2lsbCBoYXZlIGN1c3RvbWVycyB3aG8gd29u4oCZdCBkbyBzdGFwbGluZyBhbmQg Y2Fu4oCZdCBoYW5kbGUgVExTIGV4dGVuc2lvbnMsIHNvIHRoZXkganVzdCB3YW50IHRoZSBTQ1Rz IGVtYmVkZGVkIGluIHRoZSBjZXJ0LiBCdXQgbm90IGFsbCBjdXN0b21lcnMgd2lsbCBwcmVmZXIg dGhhdCBvcHRpb24uIEkgYmVsaWV2ZSBvdGhlciBjdXN0b21lcnMgd2lsbCB3YW50IHRoZSBTQ1Qt aW4tdGhlLU9DU1AtcmVzcG9uc2Ugb3IgVExTIGV4dGVuc2lvbiBvcHRpb24sIGJlY2F1c2UgaW4g dGhvc2Ugb3B0aW9ucyB5b3UgZG9u4oCZdCBoYXZlIHRvIHRyYW5zbWl0IHRoZSBTQ1RzIGluIGV2 ZXJ5IFNTTCBoYW5kc2hha2UuIEkgc3VzcGVjdCBzb21lIG9mIG91ciBsYXJnZSBjdXN0b21lcnMg d2hvIGFyZSBvYnNlc3NlZCB3aXRoIHBlcmZvcm1hbmNlIHdpbGwgZGVtYW5kIG9uZSBvZiB0aGVz ZSBvcHRpb25zLg0KIA0KU28gQ0FzIHdpbGwgbmVlZCB0byBzdXBwb3J0IGFsbCB0aHJlZSBvcHRp b25zLCB1bmxlc3MgeW914oCZcmUgc28gc21hbGwgYSBDQSB0aGF0IHlvdXIgZmV3IEVWIGN1c3Rv bWVycyBhZ3JlZSBvbiBvbmUgb3B0aW9uLiBJcyB0aGF0IHlvdXIgZXhwZWN0YXRpb24/DQoNCi1S aWNrDQoNCj4gLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4gRnJvbTogdGhlcmlnaHRrZXkg W21haWx0bzp0aGVyaWdodGtleS1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhhbGYgT2YNCj4gQmVu IExhdXJpZQ0KPiBTZW50OiBUdWVzZGF5LCBGZWJydWFyeSAwNCwgMjAxNCA5OjA4IEFNDQo+IFRv OiBDQUJGUHViOyBjZXJ0aWZpY2F0ZS10cmFuc3BhcmVuY3lAZ29vZ2xlZ3JvdXBzLmNvbTsNCj4g dGhlcmlnaHRrZXlAaWV0Zi5vcmcNCj4gU3ViamVjdDogW3RoZXJpZ2h0a2V5XSBVcGRhdGVkIENl cnRpZmljYXRlIFRyYW5zcGFyZW5jeSArIEV4dGVuZGVkDQo+IFZhbGlkYXRpb24gcGxhbg0KPiAN Cj4gRW5jbG9zZWQsIG91ciByZXZpc2VkIHBsYW4uDQo+IA0KPiBDb21tZW50cyB3ZWxjb21lLg0K From agl@google.com Thu Feb 6 11:05:48 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 871B21A03E2 for ; Thu, 6 Feb 2014 11:05:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.914 X-Spam-Level: X-Spam-Status: No, score=-1.914 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2J0CpBN7pTn2 for ; Thu, 6 Feb 2014 11:05:46 -0800 (PST) Received: from mail-vc0-x22c.google.com (mail-vc0-x22c.google.com [IPv6:2607:f8b0:400c:c03::22c]) by ietfa.amsl.com (Postfix) with ESMTP id A6A251A00EA for ; Thu, 6 Feb 2014 11:05:46 -0800 (PST) Received: by mail-vc0-f172.google.com with SMTP id lf12so1793529vcb.31 for ; Thu, 06 Feb 2014 11:05:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type:content-transfer-encoding; bh=CA7J8ETM8DwTkbJYC/yP87WbSf1WSxh+A2pPda7AEHc=; b=QVsy3ftZJaYnxgM7xh4ufQzGIm26RlyGzZadsxb+GM3nZSL9RxLI7tHSPtGMcqMs7Q lyIlJ529BfIz9nh0g1EehtnZKMWPc4NO44JxvXj0xGDXsblUScYfEm5CH86Ai6q2KQ9Z cyG83W4LfzpP6+SZDx/1BrC9ZkdsGcak9LPbw9eIUjzwClhELoDkUmxq+j7Fkf5sLs4B keOnCXCr8aCHq+s5XjYX4a7eUjphbUBuHM7sZJLN0/3gDs8kPJoA34UBcliqencGoFBi s3ikR/U6CqRLGo8hrD8Bx2Q8x/itbOn8OkVBxEpXc8c5QZNIQlUS+A5/aIZiQZe9wUny SLPg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type:content-transfer-encoding; bh=CA7J8ETM8DwTkbJYC/yP87WbSf1WSxh+A2pPda7AEHc=; b=Q1CQTF8kl+APVC3Xl7ENFa2fjmiBSZipPvpqNLs7DLDG7XAJfUzia1vj7IoTj3DqhB cNYr7HtEHqcQHsYx1R0P/PCol+ygohrZHB8xcmM2QWQy0wK5ZU7bwRVK05tjDJzmLXB7 1a6kn42otL4hOexC1Pxn4JhJ0H7DwFywOeGPg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc:content-type :content-transfer-encoding; bh=CA7J8ETM8DwTkbJYC/yP87WbSf1WSxh+A2pPda7AEHc=; b=R8dNgC//zFhTNAbiR7TGqGQwLTnXrcAlWQtO0O+YD/81aECo9QQuCVHR0VSrrDFeZw DJKdiHPC2dfIZgxpkr+KucfDdHgWKRjvTucouNtHAH96Tk4bSAYSbRvcATcmca21F+9T Wy6X5K0ZjUWAVcnXhYBRWqKXMNgcCnDwj5G75DZOEjyzoCbb0NA4CxyUOfTaRj8OF+Ie EomtLIJSAaW9e1dbNlWWrVBzR40dtpTxETVW+uyi/mL6Z/QeqTEROUnubRmZrT+0mbeA jPHrOBstFWsKiAsrAQ9PnozGO0+kKguqu6ojo5wq+eLNwsiLENc0KnVt9WDw2NR+lTzK Xnmg== X-Gm-Message-State: ALoCoQkFChLh5k9l4mqY3QtyTt00H88gO3pX76PlGwJizyQhv2/YFXyrVXDsPEKKvCGUZQNRPOSNT0+PxyqZHNTDdj+TJf5v1Ndh3xjW8pSmORG2+jTKWGj52pvO8MR7F6RF0FeLKX0D72dGb4tF+oAWLHV8N/lpi3eJ1sO3BQttE6IKHpqzA0Zf1lIRJ+1ypp4wC7n8q8Xb X-Received: by 10.58.235.129 with SMTP id um1mr7102459vec.17.1391713545225; Thu, 06 Feb 2014 11:05:45 -0800 (PST) MIME-Version: 1.0 Sender: agl@google.com Received: by 10.52.104.37 with HTTP; Thu, 6 Feb 2014 11:05:25 -0800 (PST) In-Reply-To: <544B0DD62A64C1448B2DA253C011414607C3F53600@TUS1XCHEVSPIN33.SYMC.SYMANTEC.COM> References: <544B0DD62A64C1448B2DA253C011414607C3F53600@TUS1XCHEVSPIN33.SYMC.SYMANTEC.COM> From: Adam Langley Date: Thu, 6 Feb 2014 14:05:25 -0500 X-Google-Sender-Auth: v77p211SFmDPT6bcg5hvTOT0j_A Message-ID: To: certificate-transparency Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Cc: "therightkey@ietf.org" , Ben Laurie , CABFPub Subject: Re: [therightkey] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Feb 2014 19:05:48 -0000 On Thu, Feb 6, 2014 at 1:51 PM, Rick Andrews wr= ote: > Can you clarify something? The SCT delivery options described in the RFC = are options for the web site owner, not for the CA. CAs will need to suppor= t all three options. We will have customers who won=E2=80=99t do stapling a= nd can=E2=80=99t handle TLS extensions, so they just want the SCTs embedded= in the cert. But not all customers will prefer that option. I believe othe= r customers will want the SCT-in-the-OCSP-response or TLS extension option,= because in those options you don=E2=80=99t have to transmit the SCTs in ev= ery SSL handshake. I suspect some of our large customers who are obsessed w= ith performance will demand one of these options. > > So CAs will need to support all three options, unless you=E2=80=99re so s= mall a CA that your few EV customers agree on one option. Is that your expe= ctation? SCTs embedded in the certificate won't be sent for resumption handshakes of course. The TLS extension will be sent in the same cases as SCTs embedded in the certificate. (And the TLS extension doesn't need the CA to do anything.) The stapled OCSP response is likely to be sent in the same cases also. One could imagine a client that doesn't request a stapled OCSP response when it has a cached OCSP response for the certificate that it saw from the server last time. But, if the server responds with a different certificate it's stuck. So I expect clients to always request the OCSP staple. So a CA only really need worry about the embedded case. Customers who are concerned about the performance impact of a few hundred extra bytes very likely have much easier avenues to reduce the size, like having different certs for different names rather than dozens of SANs. Cheers AGL From stephen.farrell@cs.tcd.ie Thu Feb 6 11:21:11 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A89BF1A045D for ; Thu, 6 Feb 2014 11:21:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.435 X-Spam-Level: X-Spam-Status: No, score=-2.435 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.535] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id txF7ktkoqjUc for ; Thu, 6 Feb 2014 11:21:05 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) by ietfa.amsl.com (Postfix) with ESMTP id DAC861A0428 for ; Thu, 6 Feb 2014 11:21:04 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 8A4B1BE9A for ; Thu, 6 Feb 2014 19:21:03 +0000 (GMT) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CHtx2lwA8RJC for ; Thu, 6 Feb 2014 19:21:03 +0000 (GMT) Received: from [134.226.36.180] (stephen-think.dsg.cs.tcd.ie [134.226.36.180]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 6BC44BE8B for ; Thu, 6 Feb 2014 19:21:03 +0000 (GMT) Message-ID: <52F3E0A0.1080306@cs.tcd.ie> Date: Thu, 06 Feb 2014 19:21:04 +0000 From: Stephen Farrell User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: "therightkey@ietf.org" X-Enigmail-Version: 1.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: [therightkey] trans WG approved by IESG X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Feb 2014 19:21:11 -0000 Hi, On its telechat today the IESG approved formation of the trans WG. [1] Now I need some WG chairs. Some folk have volunteered already (and thanks for that) but I'd be interested in checking to see if there are others who'd be interested and able to help out that way. If you are, please drop me a mail in the next day or two. The formal announcement won't go out until we've appointed the chairs, but interested folks should be planning on a WG session in London. That's currently scheduled for Wed March 5th 15:20. [2] (There's a very small chance that might change but its unlikely at this point.) Thanks, Stephen. [1] https://datatracker.ietf.org/doc/charter-ietf-trans/ [2] https://datatracker.ietf.org/meeting/89/agenda.html From sleevi@google.com Tue Feb 4 11:18:49 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F6101A0187 for ; Tue, 4 Feb 2014 11:18:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.913 X-Spam-Level: X-Spam-Status: No, score=-1.913 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Nen-r2k5L_7W for ; Tue, 4 Feb 2014 11:18:46 -0800 (PST) Received: from mail-qc0-x229.google.com (mail-qc0-x229.google.com [IPv6:2607:f8b0:400d:c01::229]) by ietfa.amsl.com (Postfix) with ESMTP id 1268C1A0127 for ; Tue, 4 Feb 2014 11:18:45 -0800 (PST) Received: by mail-qc0-f169.google.com with SMTP id w7so14679437qcr.0 for ; Tue, 04 Feb 2014 11:18:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=sZLZbRZz8pSBsxAHYkknJJ0RZN92k0AYfDT6hkj7PCg=; b=YJVjJ8ClwKwc8WJpxWfyD/LLgMnJwf9e9htvSK0DGsWw1kzIaJuE9wDP3bu+y/TfvP z92HFTohGirQgSwV5+80LY7fwxb8NiktETe0xjAMhPoQ3d4bSby+UBMWkvuE2d3H6kXI XsheTz9dUvsscvXC1o27PKYx10J3bSCIaeMPyJ2u+HPKLVbfmnSKBPy9CIL7+SGf5qX/ /zw3NPlB5bputG8MAJo8GolB4iO4pKlXWTSvloXeAKdNOgvB4RLAknxA96iLwlVq1XNt kEOpFGKXd9VX0+YE7sMw6bUDgjETxfabqMovVvvYsq5ANXvB+betFtEyaTLHqom0N/8y O9FA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=sZLZbRZz8pSBsxAHYkknJJ0RZN92k0AYfDT6hkj7PCg=; b=cQkmGftRLJBT7mEVt1YCp56jupZT6ZHVkHBTn5ypCdPg80TAqosUn5k7MepZ0KzQwO aBZnuhbFHlWlUrU5sry+VxR8i25LCKacLJJ15E1qRvABg0fyKsblFmD2FkG7YM2Zmzhu 6QF6pSRQ74G4mmA9Gzl3j/AmyLwGgHWM+YOtSAG0XDu9SJu7OZbc1+uNM77d08QDWEYg LExI6vtNBxVvQ4UOFyUIKyb95X7YSSoeBVxRRTluUbJ7ntRlGgWmluxG5v4XbJgD6oLF Spz6mzECgWPxRmg2t8W5TXdV9BJCfTCveIXKyUOq+YOSvfExRrPTiz40FUzw1nfmpRGt F0ew== X-Gm-Message-State: ALoCoQkugMrE50ZSR9a09f88p7na+HEcvw+wanb7PVJJphtUfzGuh2/pW0RQ3UoqK1jsHYlzyPKzufqDNx/+QvBjXDae2lUZbCqvPquaP3rytzpLD4ZKWfiK3uOSsJOeHJwYIuIMaAnZpH4Dif322duVIIODX3N9o7S1RuXbiKzFVri5/9aa0KRfqBkCnwrDuRKjhKV9PCx9 MIME-Version: 1.0 X-Received: by 10.140.107.53 with SMTP id g50mr65428118qgf.63.1391541525427; Tue, 04 Feb 2014 11:18:45 -0800 (PST) Received: by 10.229.154.208 with HTTP; Tue, 4 Feb 2014 11:18:45 -0800 (PST) In-Reply-To: <05bf01cf21db$5146c2a0$f3d447e0$@digicert.com> References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <05bf01cf21db$5146c2a0$f3d447e0$@digicert.com> Date: Tue, 4 Feb 2014 11:18:45 -0800 Message-ID: From: Ryan Sleevi To: Jeremy Rowley Content-Type: multipart/alternative; boundary=001a113a6a22504c2704f199825c X-Mailman-Approved-At: Fri, 07 Feb 2014 08:05:52 -0800 Cc: Adam Langley , certificate-transparency@googlegroups.com, CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Feb 2014 19:18:49 -0000 --001a113a6a22504c2704f199825c Content-Type: text/plain; charset=UTF-8 On Tue, Feb 4, 2014 at 11:00 AM, Jeremy Rowley wrote: > The entire point is to disclose the entire universe of public certificates > to the customer. If the customer doesn't want to use it, the purpose is no > longer being fulfilled. The way we plan on implementing CT will ensure logs > are not irrevocable. I agree we should make SCTs as small as possible, but > the last I've heard from our team is they are still at 100 bytes per log. > > Jeremy > Moving therightkey@ietf.org to bcc to avoid cross-posting. I wanted to correct a misunderstanding that I've seen repeated several times within the CA/Browser Forum, and which I've tried to correct repeatedly. No, the entire point is NOT to disclose the entire universe of public certificates to the customer. The entire point is to disclose the entire universe of public certificates __to the public__. That is, if no *customer* ever uses CT to monitor logs (an improbable and extremely unlike situation, as demonstrated by the IETF WG chartering), we will STILL see CT as a benefit to the public and as a success. This is because CT provides capabilities to allow ALL relying parties to audit public CAs. This capability extends to allowing root store operators to audit compliance to their programs. This capability extends to those who ingest root programs to examine the authorities trusted by these root programs. This allows independent third parties to monitor compliance to stated policies and practices. The current practice sees a random audit at a point in time conducted by an auditor (ETSI or WebTrust), often with a quite small percentage (3%, at most, IIRC), with the results of those audits not disclosed to any entity beyond the CA. Even if every browser program required full disclosure to the browser, this would fail to meet the goals. I want to make sure it's clear the _why_ we're requiring CT, and where the value is derived from, as suggesting the *entire* point is just for the customer misses out the significant improvements to the ecosystem. It's already clear that root store operators care about these things - as seen by Google's indexing or Microsoft's SmartScreen reporting ( http://realworldcrypto.files.wordpress.com/2013/06/shumow.pdf ). These are NOT sufficient technologies, as has been previously suggested, but they do demonstrate the increasing concern of root stores - and the interested parties such as EFF and the Certificate Observatory. CT addresses many of these holes, but only when it's required. We're happy to add CT to the list of requirements that CAs that wish to participate in our root stores and EV programs because of this, and we hope that other root store operators will follow. > > -----Original Message----- > From: therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of Adam > Langley > Sent: Tuesday, February 04, 2014 10:52 AM > To: certificate-transparency@googlegroups.com > Cc: therightkey@ietf.org; Ben Laurie; CABFPub > Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + > Extended Validation plan > > On Tue, Feb 4, 2014 at 12:33 PM, Jeremy Rowley > > wrote: > > Three or four proofs for a 27 month certificate is way too many. The > number of proofs should be decided based on the customer's risk profile, > not > a set number based on certificate lifecycle. Adding 400 bytes per > certificate will make EV certificates unusable by entities concerned with > performance. > > The customer doesn't carry the risk: the risk is that we'll be unable to > revoke a log in clients due to the number of certificates that depend on > it. > > We should make the SCTs as small as possible, the the switch to larger > initcwnds in recent years has released much of the pressure on keeping > certificate sizes below the tradition initcwnd limit. > > > Cheers > > AGL > _______________________________________________ > therightkey mailing list > therightkey@ietf.org > https://www.ietf.org/mailman/listinfo/therightkey > > _______________________________________________ > Public mailing list > Public@cabforum.org > https://cabforum.org/mailman/listinfo/public > --001a113a6a22504c2704f199825c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Tue, Feb 4, 2014 at 11:00 AM, Jeremy Rowley <jeremy.rowley= @digicert.com> wrote:
The entire point is to disclose the entire universe of pub= lic certificates
to the customer. =C2=A0If the customer doesn't want to use it, the purp= ose is no
longer being fulfilled. The way we plan on implementing CT will ensure logs=
are not irrevocable. =C2=A0I agree we should make SCTs as small as possible= , but
the last I've heard from our team is =C2=A0they are still at 100 bytes = per log.

Jeremy

Moving therightkey@ietf.org to bcc to avoid cross-posting.

I wanted to correct a misunderstanding that I've s= een repeated several times within the CA/Browser Forum, and which I've = tried to correct repeatedly.

No, the entire point is NOT to disclose the entire univ= erse of public certificates to the customer. The entire point is to disclos= e the entire universe of public certificates __to the public__.

That is, if no *customer* ever uses CT to monitor logs (an i= mprobable and extremely unlike situation, as demonstrated by the IETF WG ch= artering), we will STILL see CT as a benefit to the public and as a success= .

This is because CT provides capabilities to allow ALL r= elying parties to audit public CAs. This capability extends to allowing roo= t store operators to audit compliance to their programs. This capability ex= tends to those who ingest root programs to examine the authorities trusted = by these root programs. This allows independent third parties to monitor co= mpliance to stated policies and practices.

The current practice sees a random audit at a point in = time conducted by an auditor (ETSI or WebTrust), often with a quite small p= ercentage (3%, at most, IIRC), with the results of those audits not disclos= ed to any entity beyond the CA. Even if every browser program required full= disclosure to the browser, this would fail to meet the goals.

I want to make sure it's clear the _why_ we're = requiring CT, and where the value is derived from, as suggesting the *entir= e* point is just for the customer misses out the significant improvements t= o the ecosystem.

It's already clear that root store operators care a= bout these things - as seen by Google's indexing or Microsoft's Sma= rtScreen reporting (=C2=A0http://realworldcrypto.files.wordpress.com/2013/06= /shumow.pdf ). These are NOT sufficient technologies, as has been previ= ously suggested, but they do demonstrate the increasing concern of root sto= res - and the interested parties such as EFF and the Certificate Observator= y.

CT addresses many of these holes, but only when it'= s required. We're happy to add CT to the list of requirements that CAs = that wish to participate in our root stores and EV programs because of this= , and we hope that other root store operators will follow.
=C2=A0

-----Original Message-----
From: therightkey [mailto:t= herightkey-bounces@ietf.org] On Behalf Of Adam
Langley
Sent: Tuesday, February 04, 2014 10:52 AM
To: certificat= e-transparency@googlegroups.com
Cc: therightkey@ietf.org; Ben L= aurie; CABFPub
Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency +
Extended Validation plan

On Tue, Feb 4, 2014 at 12:33 PM, Jeremy Rowley= <jeremy.rowley@digicert.c= om>
wrote:
> Three or four proofs for a 27 month certificate is way too many. =C2= =A0The
number of proofs should be decided based on the customer's risk profile= , not
a set number based on certificate lifecycle. Adding 400 bytes per
certificate will make EV certificates unusable by entities concerned with performance.

The customer doesn't carry the risk: the risk is that we'll be unab= le to
revoke a log in clients due to the number of certificates that depend on it= .

We should make the SCTs as small as possible, the the switch to larger
initcwnds in recent years has released much of the pressure on keeping
certificate sizes below the tradition initcwnd limit.


Cheers

AGL
_______________________________________________
therightkey mailing list
therightkey@ietf.org
https://www.ietf.org/mailman/listinfo/therightkey

_______________________________________________
Public mailing list
Public@cabforum.org
= https://cabforum.org/mailman/listinfo/public

--001a113a6a22504c2704f199825c-- From michal.proszkiewicz@unizeto.pl Wed Feb 5 08:19:49 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BAC371A0132 for ; Wed, 5 Feb 2014 08:19:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.651 X-Spam-Level: X-Spam-Status: No, score=0.651 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_PL=1.135, HOST_EQ_PL=1.95, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.535] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T4EeVPMZasdX for ; Wed, 5 Feb 2014 08:19:47 -0800 (PST) Received: from mail.unizeto.pl (mail.unizeto.pl [213.222.192.4]) by ietfa.amsl.com (Postfix) with ESMTP id 164C91A00EE for ; Wed, 5 Feb 2014 08:19:46 -0800 (PST) Received: from lotus.unizeto.pl ([192.168.128.14]) by f-secure.unizeto.pl (8.14.5/8.14.5) with ESMTP id s15GJdIV013351; Wed, 5 Feb 2014 17:19:39 +0100 In-Reply-To: To: agl@chromium.org MIME-Version: 1.0 X-Mailer: Lotus Notes Release 7.0.3 September 26, 2007 Message-ID: From: michal.proszkiewicz@unizeto.pl Date: Wed, 5 Feb 2014 17:19:38 +0100 X-MIMETrack: Serialize by Router on HUB/UNIZETO(Release 7.0.3FP1|February 24, 2008) at 2014-02-05 17:19:39, Serialize complete at 2014-02-05 17:19:39 Content-Type: multipart/alternative; boundary="=_alternative 0059B047C1257C76_=" X-Mailman-Approved-At: Fri, 07 Feb 2014 08:05:52 -0800 Cc: therightkey@ietf.org, public-bounces@cabforum.org, certificate-transparency@googlegroups.com, public@cabforum.org Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Feb 2014 16:21:24 -0000 To jest wielocz)ciowa wiadomo w formacie MIME. --=_alternative 0059B047C1257C76_= Content-Type: text/plain; charset="ISO-8859-2" Content-Transfer-Encoding: quoted-printable If we are talking about EV certificates then probably there are not many=20 that are valid for a 1 month. It may be the case for other types of certificates. For example CERTUM=20 issue trusted test SSL certificates valid for 30 days (standard DV=20 verification procedures and DV certificate profile). >From the other hand we give our customer possibility to manually shorten=20 validity period to one day if they like (for every certificate type). -Micha=B3 Adam Langley =20 Wys=B3ane przez: public-bounces@cabforum.org 2014-02-05 16:40 Do certificate-transparency DW "therightkey@ietf.org" , CABFPub=20 Temat Re: [cabfpub] Updated Certificate Transparency + Extended Validation = plan On Wed, Feb 5, 2014 at 10:26 AM, Rob Stradling =20 wrote: > Also, what happened to the idea of only requiring 1 SCT for a 1-month=20 cert? I'm to blame for that. Certificates with a single SCT put a lower bound on how quickly we can distrust a log (at least without special measures, such as shipping the whole, public log hashes to all the clients, which is probably impractical.) Since I'm not aware of any CAs issuing one month certs, and it only saves ~100 bytes vs 2 SCTs, it seemed to be something that should be dropped. Cheers AGL =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F Public mailing list Public@cabforum.org https://cabforum.org/mailman/listinfo/public --=_alternative 0059B047C1257C76_= Content-Type: text/html; charset="ISO-8859-2" Content-Transfer-Encoding: quoted-printable
If we are talking about EV certifica= tes then probably there are not many that are valid for a 1 month.

It may be the case for other types of certificates. For example CERTUM issue trusted test SSL certificates valid for 30 days (standard DV verification procedures and DV certificate profile= ).

From the other hand we give our cust= omer possibility to manually shorten validity period to one day if they like (for every certificate type).

-Micha=B3



Adam Langley <agl@= chromium.org>
Wys=B3ane przez: public-bounces@cabf= orum.org

2014-02-05 16:40

Do
certificate-transparency <certifi= cate-transparency@googlegroups.com>
DW
"therightkey@ietf.org" <= ;therightkey@ietf.org>, CABFPub <public@cabforum.org>
Temat
Re: [cabfpub] Updated Certificate Tr= ansparency + Extended        Validation plan





On Wed, Feb 5, 2014 at 10:26 AM, Rob Stradling <r= ob.stradling@comodo.com> wrote:
> Also, what happened to the idea of only requiring 1 SCT for a 1-month cert?

I'm to blame for that.

Certificates with a single SCT put a lower bound on how quickly we can
distrust a log (at least without special measures, such as shipping
the whole, public log hashes to all the clients, which is probably
impractical.) Since I'm not aware of any CAs issuing one month certs,
and it only saves ~100 bytes vs 2 SCTs, it seemed to be something that
should be dropped.


Cheers

AGL
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F
Public mailing list
Public@cabforum.org
https://cabforum.org/mailman/listinfo/public
--=_alternative 0059B047C1257C76_=-- From contact@taoeffect.com Fri Feb 7 11:16:24 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36B0F1A0416 for ; Fri, 7 Feb 2014 11:16:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.334 X-Spam-Level: X-Spam-Status: No, score=-1.334 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_SOFTFAIL=0.665] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bu4LxGSy-ial for ; Fri, 7 Feb 2014 11:16:21 -0800 (PST) Received: from homiemail-a61.g.dreamhost.com (caiajhbdcbbj.dreamhost.com [208.97.132.119]) by ietfa.amsl.com (Postfix) with ESMTP id AEEB31A01D2 for ; Fri, 7 Feb 2014 11:16:21 -0800 (PST) Received: from homiemail-a61.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a61.g.dreamhost.com (Postfix) with ESMTP id A432A578078; Fri, 7 Feb 2014 11:16:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=taoeffect.com; h= content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; s=taoeffect.com; bh=kCfzKzWivOjvNcKht CkD5vuUqls=; b=SsJnefsr349Dt4Y/wpY6BeHMKFo+hAQbjv/ZvJxfXUrRov82o i0W8wIDBl2lxGRrGNdE1KKF5/5+78nTmicg+rtJbWB9/yM4x99XtdBLNSSsAh7vS nll+VLrcKk/RxGD4/9Q7lcR0H+u+fnBH3v7/+fNsdVsmhDxmAsKTJU/An0= Received: from [192.168.1.7] (173-31-103-210.client.mchsi.com [173.31.103.210]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: contact@taoeffect.com) by homiemail-a61.g.dreamhost.com (Postfix) with ESMTPSA id CB7CD578071; Fri, 7 Feb 2014 11:16:19 -0800 (PST) Content-Type: multipart/signed; boundary="Apple-Mail=_70AE6957-137D-487B-B8EA-00F3F38305ED"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\)) From: Tao Effect In-Reply-To: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> Date: Fri, 7 Feb 2014 13:16:16 -0600 Message-Id: References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> To: Tao Effect Support X-Mailer: Apple Mail (2.1827) Cc: Leif Johansson , "therightkey@ietf.org" , Rob Stradling , Phillip Hallam-Baker Subject: [therightkey] First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Feb 2014 19:16:24 -0000 --Apple-Mail=_70AE6957-137D-487B-B8EA-00F3F38305ED Content-Type: multipart/alternative; boundary="Apple-Mail=_5ACE188F-7D68-4E4B-AD98-8EA5A7DAD983" --Apple-Mail=_5ACE188F-7D68-4E4B-AD98-8EA5A7DAD983 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 Formerly known as DNSNMC, working code was pushed to the GitHub repo at = the end of January (as hoped for in the previous email), and yesterday = the first public server went online! Details here: https://github.com/okTurtles/dnschain A rely for querying the blockchain without changing your DNS settings is = available at dns.dnschain.net. For example, if you'd like to know who = "Greg" is, and what his GPG fingerprint is, just ask: http://dns.dnschain.net/id/greg Or, "what's the domain info stored in the blockchain for okturtles.bit"? http://dns.dnschain.net/d/okturtles If you change your DNS settings to a DNSChain server, you'll be able to = use the ".dns" meta-TLD: http://namecoin.dns/d/okturtles http://namecoin.dns/id/greg And you'll be able to access .bit TLDs: http://okturtles.bit Cheers! Greg -- Please do not email me anything that you are not comfortable also = sharing with the NSA. On Jan 3, 2014, at 11:33 PM, Tao Effect wrote: > I agree with the criticism expressed here. There needs to be code (at = the very least) that people can get their hands on and try out, before = using the word "deprecated". >=20 > Thanks for pointing that out Phillip! >=20 > I'm working getting said code up on Github ASAP. The holidays and = other things slowed me down a bit. It will be put up under this github = group soon (this month, I expect/hope): https://github.com/okTurtles >=20 >=20 > -- > Please do not email me anything that you are not comfortable also = sharing with the NSA. >=20 > On Jan 3, 2014, at 10:57 AM, Phillip Hallam-Baker = wrote: >=20 >> Part of my trouble with this thread is that the original proposal was = presented in the way it was. >>=20 >> It might well be that there is a better way to do PKI than the = approach Kohnfelder described in his master's thesis. But I don't think = that the person who comes up with it will be describing the existing = system as 'deprecated' before a single line of code is deployed. >>=20 >>=20 >> I am currently working on podcasts to describe my new approach to a = general audience because getting any PKI deployed depends on buy in from = people that are far outside this group and the IETF and even the techie = community.=20 >>=20 >> We are not going to get change until we have real people appearing in = Apple Stores and Microsoft stores asking how they can get usable secure = email to protect them from [The russian mafia/ GRU/ Iran/ China/ NSA]. = If Google had physical stores in malls, I would include them in that = list. >>=20 >>=20 >> But we are not going to get people hassling for deployment until = there is a scheme that is really right and not just 'good enough' for a = group of highly motivated ideologues like ourselves. >>=20 >> Part of the problem with PGP and S/MIME is that people just want it = to work so much that they blind themselves to the obvious defects let = alone the less obvious ones. The result looks like a Palm Treo, not an = iPhone. You could use the Palm to surf the Web and send email and it = kinda worked without crashing more than six times a day. But people at = Palm never did understand why that was so much of a problem and they = never made much of an effort to make the phone really right because web = on your phone is so cool it doesn't really need to be perfect... right? >>=20 >> When someone is so infatuated by their own idea that they describe it = as 'deprecating' the existing system before they have even tried it in = the real world then I don't think it is going to get very far. >>=20 >>=20 >> Anyway, I am thinking we should have international cryptography day = sometime in early summer. Give some time to get code wrote. >> _______________________________________________ >> therightkey mailing list >> therightkey@ietf.org >> https://www.ietf.org/mailman/listinfo/therightkey >=20 > _______________________________________________ > therightkey mailing list > therightkey@ietf.org > https://www.ietf.org/mailman/listinfo/therightkey --Apple-Mail=_5ACE188F-7D68-4E4B-AD98-8EA5A7DAD983 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=iso-8859-1 Formerly known as DNSNMC, working code was pushed to = the GitHub repo at the end of January (as hoped for in the previous = email), and yesterday the first public server went = online!

Details here:


A rely for querying the = blockchain without changing your DNS settings is available at dns.dnschain.net. For example, if = you'd like to know who "Greg" is, and what his GPG fingerprint is, just = ask:




If you change your DNS settings to a = DNSChain server, you'll be able to use the ".dns" = meta-TLD:

=

And you'll be able to access .bit = TLDs:


Cheers!
Greg

--
Please do not email me anything that you are not comfortable also = sharing with the NSA.

On Jan 3, 2014, at 11:33 PM, Tao Effect <contact@taoeffect.com> = wrote:

I agree with the criticism expressed here. There = needs to be code (at the very least) that people can get their hands on = and try out, before using the word = "deprecated".

Thanks for pointing that out = Phillip!

I'm working getting said code up on = Github ASAP. The holidays and other things slowed me down a bit. It will = be put up under this github group soon (this month, I = expect/hope): https://github.com/okTurtles


--
Please do not email me anything that you are not = comfortable also sharing with the NSA.

On Jan 3, 2014, at 10:57 AM, Phillip Hallam-Baker <hallam@gmail.com> = wrote:

Part of my = trouble with this thread is that the original proposal was presented in = the way it was.

It = might well be that there is a better way to do PKI than the approach = Kohnfelder described in his master's thesis. But I don't think that the = person who comes up with it will be describing the existing system as = 'deprecated' before a single line of code is deployed.


I am = currently working on podcasts to describe my new approach to a general = audience because getting any PKI deployed depends on buy in from people = that are far outside this group and the IETF and even the techie = community. 

We are = not going to get change until we have real people appearing in Apple = Stores and Microsoft stores asking how they can get usable secure email = to protect them from [The russian mafia/ GRU/ Iran/ China/ NSA]. If = Google had physical stores in malls, I would include them in that = list.


But we are = not going to get people hassling for deployment until there is a scheme = that is really right and not just 'good enough' for a group of highly = motivated ideologues like ourselves.

Part of = the problem with PGP and S/MIME is that people just want it to work so = much that they blind themselves to the obvious defects let alone the = less obvious ones. The result looks like a Palm Treo, not an iPhone. You = could use the Palm to surf the Web and send email and it kinda worked = without crashing more than six times a day. But people at Palm never did = understand why that was so much of a problem and they never made much of = an effort to make the phone really right because web on your phone is so = cool it doesn't really need to be perfect... right?

When = someone is so infatuated by their own idea that they describe it as = 'deprecating' the existing system before they have even tried it in the = real world then I don't think it is going to get very far.


Anyway, I am = thinking we should have international cryptography day sometime in early = summer. Give some time to get code wrote.
_______________________________________________
therightkey mailing = list
therightkey@ietf.org
https://www.iet= f.org/mailman/listinfo/therightkey

_______________________________________________
therightkey = mailing list
therightkey@ietf.org
https://w= ww.ietf.org/mailman/listinfo/therightkey

<= /body>= --Apple-Mail=_5ACE188F-7D68-4E4B-AD98-8EA5A7DAD983-- --Apple-Mail=_70AE6957-137D-487B-B8EA-00F3F38305ED Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJS9TEAAAoJEOxnICvpCVJHKvUP/ixzvBW+Oav5R77JS5Gy3ZGv NDaeUjTKJVFO92OLvDN48u2kE6AkVdm/ye8qSX49HLjMqKyqTA3TEv6jwefCRxfP XtiBA4iPP2SvL6XCzist7t3OGqo837MpDi+5N1cRsYdg76/nonLNbLHzZMenqZDz 46fUrM7jSh5iuYXfS37ZrfkWGOy46TOr4DqE/XNMt6eV0g3cIWtAJ7SD4dwEkp+5 FL6V6PsgOyPUGqYWWZsi9FiAFid7wha5MdCWYX6RGxY/Xj9vJV1uSVevY9YsFnrT 6hs24dCpenVnAlRiOLw5p60+8DNAXRyjhzjXHAPIqhDME6SZV8wghCuvwWdi+XVH 4kYqYoV0g5sKolhP1NOrg87KA169cKUuoWFf/Zz1n/NLr1Uq99R75RIN+z4VTeeS 9TRXQ9fMgLFvDqvjbljjKlLfExl3U3GRr4uvMFV8GyQsIv6j5vUHRmpfcIptNs+q DOMerZ9+T7zXyWcQizEovO7mN5p0MLI/dJKXxnwmIVIqLDRngZtZW4/291uSdybP YbOkraEJ2vDATMWT48CGOb0/BuTAvRgwe7W0ckeWyM2yl3IUMPeYlNtZH28DWFBF g0S7Rxsd01wc68A5t4xJ2RpOJ/4rF+4beDM8wZXqD7C7RkGJdPXhMS2EV+ST9Dmh B01bOvHIe2Rf46kxtsAL =MPJY -----END PGP SIGNATURE----- --Apple-Mail=_70AE6957-137D-487B-B8EA-00F3F38305ED-- From ajs@anvilwalrusden.com Fri Feb 7 11:32:15 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 666D31A0274 for ; Fri, 7 Feb 2014 11:32:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.141 X-Spam-Level: X-Spam-Status: No, score=-0.141 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_INFO=1.448, HOST_MISMATCH_NET=0.311] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uQXRJD08j72I for ; Fri, 7 Feb 2014 11:32:14 -0800 (PST) Received: from mx1.yitter.info (ow5p.x.rootbsd.net [208.79.81.114]) by ietfa.amsl.com (Postfix) with ESMTP id 4002C1A04F5 for ; Fri, 7 Feb 2014 11:32:14 -0800 (PST) Received: from crankycanuck.ca (nat-01-mht.dyndns.com [216.146.45.240]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.yitter.info (Postfix) with ESMTPSA id 9985A8A031; Fri, 7 Feb 2014 19:32:13 +0000 (UTC) Date: Fri, 7 Feb 2014 14:32:12 -0500 From: Andrew Sullivan To: Tao Effect , therightkey@ietf.org Message-ID: <20140207193212.GQ22727@crankycanuck.ca> References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Subject: Re: [therightkey] First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Feb 2014 19:32:15 -0000 On Fri, Feb 07, 2014 at 01:16:16PM -0600, Tao Effect wrote: > > If you change your DNS settings to a DNSChain server, you'll be able to use the ".dns" meta-TLD: > Given that you're basically telling people to use these names in a context where DNS names are expected to go, I would like to suggest that you want to do something than make up a string that you think won't collide in the DNS, for two reasons: (1) these queries will sometimes leak by accident onto the public DNS, where they're "junk", and (2) a new TLD applicant of the future could ask for .dns, and there's no obvious reason why ICANN would have to say no. This will represent a security risk to your users. I would like to suggest some other domain name. You can register any available thing you like. It need not actually resolve in the public DNS, as long as it is registered so that nobody else can get it. Over in the DNSOP working group, there's quite a lively discussion about these issues going on. Best regards, A -- Andrew Sullivan ajs@anvilwalrusden.com From contact@taoeffect.com Fri Feb 7 17:35:10 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C46A1A058A for ; Fri, 7 Feb 2014 17:35:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.334 X-Spam-Level: X-Spam-Status: No, score=-1.334 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_SOFTFAIL=0.665] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ExV2pB1Yvpd8 for ; Fri, 7 Feb 2014 17:35:08 -0800 (PST) Received: from homiemail-a7.g.dreamhost.com (caiajhbdcbhh.dreamhost.com [208.97.132.177]) by ietfa.amsl.com (Postfix) with ESMTP id 3B4A31A01E6 for ; Fri, 7 Feb 2014 17:35:08 -0800 (PST) Received: from homiemail-a7.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a7.g.dreamhost.com (Postfix) with ESMTP id 9C96A25C06A; Fri, 7 Feb 2014 17:35:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=taoeffect.com; h= content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; s=taoeffect.com; bh=oFv3ALvlMX8oF7FtQ K9T623g2TU=; b=K39xYl/kT/TIf7vLbIwsFMFrkN+gnq8Keu0KRO1En/2W4QXtr tKBWfnjfMEFlezvDQbfKF5dYUWNf9VN4Sy/gbzZW1b5kRqf+R3nXCDYfxO2x+sHh a8CSaghj9l8CuG14sUZjjCdVqBL+4ZLgUk7yseTmFAoXCTkSCwCUuwQm5I= Received: from [192.168.1.7] (173-31-103-210.client.mchsi.com [173.31.103.210]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: contact@taoeffect.com) by homiemail-a7.g.dreamhost.com (Postfix) with ESMTPSA id CED5325C06D; Fri, 7 Feb 2014 17:35:06 -0800 (PST) Content-Type: multipart/signed; boundary="Apple-Mail=_8D0250B6-DB3B-4BBD-A608-10BFB4CA6A51"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\)) From: Tao Effect In-Reply-To: <20140207193212.GQ22727@crankycanuck.ca> Date: Fri, 7 Feb 2014 19:34:59 -0600 Message-Id: <32201143-1945-4705-A240-522F41535545@taoeffect.com> References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> <20140207193212.GQ22727@crankycanuck.ca> To: Andrew Sullivan X-Mailer: Apple Mail (2.1827) Cc: therightkey@ietf.org Subject: Re: [therightkey] First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Feb 2014 01:35:10 -0000 --Apple-Mail=_8D0250B6-DB3B-4BBD-A608-10BFB4CA6A51 Content-Type: multipart/alternative; boundary="Apple-Mail=_7493EDAF-162A-4F8E-8F23-BC024ED893F6" --Apple-Mail=_7493EDAF-162A-4F8E-8F23-BC024ED893F6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi Andrew, Thanks for the feedback! > Given that you're basically telling people to use these names in a > context where DNS names are expected to go, I would like to suggest > that you want to do something than make up a string that you think > won't collide in the DNS, for two reasons: (1) these queries will > sometimes leak by accident onto the public DNS, where they're "junk", > and (2) a new TLD applicant of the future could ask for .dns, and > there's no obvious reason why ICANN would have to say no. This will > represent a security risk to your users. This equally applies to GNUnet's DNS system (.gnu?), to Namecoin's .bit, = and to Tor's .onion links. The public DNS is broken and insecure. ICANN is an old, centralized, and insecure thing, that I personally = feel, at this point, is more deserving of the label "junk". ;-) > I would like to suggest some other domain name. You can register any > available thing you like. It need not actually resolve in the public > DNS, as long as it is registered so that nobody else can get it. How do I register the .dns TLD? Does it involve paying money to ICANN? I'd rather not pay them anymore = than I'm already begrudgingly paying them. Is it even possible? I doubt it. :-p "Hey guys, I'd like to put you out of business and make the whole domain = registration thing decentralized, could you please give me .dns?" XD -g -- Please do not email me anything that you are not comfortable also = sharing with the NSA. --Apple-Mail=_7493EDAF-162A-4F8E-8F23-BC024ED893F6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Hi = Andrew,

Thanks for the = feedback!

Given that you're = basically telling people to use these names in a
context where DNS = names are expected to go, I would like to suggest
that you want to do = something than make up a string that you think
won't collide in the = DNS, for two reasons: (1) these queries will
sometimes leak by = accident onto the public DNS, where they're "junk",
and (2) a new TLD = applicant of the future could ask for .dns, and
there's no obvious = reason why ICANN would have to say no.  This will
represent a = security risk to your users.

This equally = applies to GNUnet's DNS system (.gnu?), to Namecoin's .bit, and to Tor's = .onion links.

The public DNS is broken and = insecure.

ICANN is an old, centralized, and = insecure thing, that I personally feel, at this point, is more deserving = of the label "junk". ;-)

I = would like to suggest some other domain name.  You can register = any
available thing you like.  It need not actually resolve in = the public
DNS, as long as it is registered so that nobody else can = get it.

How do I register the .dns = TLD?

Does it involve paying money to ICANN? I'd = rather not pay them anymore than I'm already begrudgingly paying = them.

Is it even possible? I doubt it. = :-p

"Hey guys, I'd like to put you out of = business and make the whole domain registration thing decentralized, = could you please give me = .dns?"

XD

-g
<= div>
--
Please do not email me anything that you are not comfortable also = sharing with the NSA.

= --Apple-Mail=_7493EDAF-162A-4F8E-8F23-BC024ED893F6-- --Apple-Mail=_8D0250B6-DB3B-4BBD-A608-10BFB4CA6A51 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJS9YnGAAoJEOxnICvpCVJHYLIP/R27ac8KE2jmijCUgDYQxB5x wARJwS0hzY+tRtw2SyPPREInaOCwkIwf/jGjLIvzUBoc5mPWllIKxOglqfQBfJp5 NHFSDeGZHX/yoIK+ThSorgnt3z0PizB/OFvu/WNgCb96AR7b0ECeJV/STMBBLfDM Bx2ZYNncQfTyJ7u2aCrCdhu+nSkqrCYXJD2sbGNp4xnxmm4xL/lrjdiuyh/TWj5e SN0DDUoZXdhw1jJ+LPi9pFFx4hhNJ/n04M6aY8DytspCsyM/2raflSWpejKCfbQn jf/mWG4sb1jsTBswEu7YzhQmSwET9pC+44SAj2lb822jLfwzJyliIdOBvN2W8xU1 Fs9dbhift7fvDJ6HetAbPOjjoj3xw4u8otqGAuSqnNHNA+2OCCcFpyG4iaj9RKtN FffUlhvdRhKYIEenSeEzJSI4FzW2hHmWHiljx/g2p4RiWy9HqWzgvEez1+M9UDpw HoFCeLEy36Bcgy2NWIvXgfMJYKlrlGMShrP5OytgUcF4DbKba1hzsraNpy9WjM/e ji0I+wnhka6xowjvpNeSMrZuMhL8aAsYfd7JOm0MtVwvyWzBXcE7JbmRnwK6+sEq Dw34YHmmkasa5fPMmg316CI8EYO3TfAwhDGpknd7mX8RWMgEEd+Buer19+LgAKca zFMjbr8wHkQYm6w/kWR6 =c6fk -----END PGP SIGNATURE----- --Apple-Mail=_8D0250B6-DB3B-4BBD-A608-10BFB4CA6A51-- From paul@nohats.ca Fri Feb 7 18:02:17 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F9BE1AD8F5 for ; Fri, 7 Feb 2014 18:02:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.535 X-Spam-Level: X-Spam-Status: No, score=-2.535 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-0.535] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HG0xHkFjg6j3 for ; Fri, 7 Feb 2014 18:02:14 -0800 (PST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) by ietfa.amsl.com (Postfix) with ESMTP id A9AA81ACCEB for ; Fri, 7 Feb 2014 18:02:14 -0800 (PST) Received: from bofh.nohats.ca (bofh.nohats.ca [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 17DEC800AA; Fri, 7 Feb 2014 21:02:14 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1391824934; bh=4ES3k7Ps8F22eNzdflETv5igIHaHmpxp/D8Q56vLMaY=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=CjXb1aa+nGBab9V4ODkjBoeJhoKwtPoBhvcHwUOt0RQoMj9oSdobzkORxp07nry5/ o4+BDf/iyYCLDzlsY8pYi0Y8RMqFiMdBR0Tut68NksVzAd/YULdIaQ2fC0E8NeBO4l UKbe2qntfyzNYlFC/EtehbAmXc4jSkW/AHYGSSGg= Received: from localhost (paul@localhost) by bofh.nohats.ca (8.14.7/8.14.7/Submit) with ESMTP id s1822DZx012602; Fri, 7 Feb 2014 21:02:13 -0500 X-Authentication-Warning: bofh.nohats.ca: paul owned process doing -bs Date: Fri, 7 Feb 2014 21:02:13 -0500 (EST) From: Paul Wouters To: Tao Effect In-Reply-To: <32201143-1945-4705-A240-522F41535545@taoeffect.com> Message-ID: References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> <20140207193212.GQ22727@crankycanuck.ca> <32201143-1945-4705-A240-522F41535545@taoeffect.com> User-Agent: Alpine 2.10 (LFD 1266 2009-07-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; format=flowed; charset=ISO-8859-15 Content-Transfer-Encoding: 8BIT Cc: therightkey@ietf.org Subject: Re: [therightkey] First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Feb 2014 02:02:17 -0000 On Fri, 7 Feb 2014, Tao Effect wrote: > Hi Andrew, > Thanks for the feedback! Unfortunately, you did not actually read Andrew's feedback. > This equally applies to GNUnet's DNS system (.gnu?), to Namecoin's .bit, and to Tor's .onion links. Which is also seeing quite some resistence (and justly so) > The public DNS is broken and insecure. So why do you want a TLD in it? It's broken and insecure. Go somewhere secure? Oh, you mean it is still useful and secure enough for you? Maybe it is secure and useful enough for everyone else too? > ICANN is an old, centralized, and insecure thing, that I personally feel, at this point, is more deserving of the label > "junk". ;-) https://nohats.ca/wordpress/blog/2012/04/09/you-cant-p2p-the-dns-and-have-it-too/ > I would like to suggest some other domain name.  You can register any > available thing you like.  It need not actually resolve in the public > DNS, as long as it is registered so that nobody else can get it. > > > How do I register the .dns TLD? That's not what Andrew asked you. Why can you not register and use icannmustdiediedie.org? > Does it involve paying money to ICANN? I'd rather not pay them anymore than I'm already begrudgingly paying them. Yes, pay ICANN $120k > Is it even possible? I doubt it. :-p Yes it is. I'm sure you can pay that $120k immediately once you tell your angel investor about your grand plan on how to save _everyone_ in the world from their $10/year domain rip-off. > "Hey guys, I'd like to put you out of business and make the whole domain registration thing decentralized, could you please > give me .dns?" How come you _need_ them _and_ will put them out of business? Why not pretend you succeeded and ICANN and the DNS is dead. So no need for your .dns TLD anymore, since the root is dead. Why do you want .dns again? You didn't even address two valid points Andrew brought up: 1) You are going to cause sending junk queries all over the internet. What are your plans to preven/reduce that? 2) Why do you need a TLD .dns, and why can't you use a $15/year iwillneverrunnameservershere.org My bet is that you are going to provide some kind of mapping service to bridge cryptographically secure hashes into memorable names, thus becoming your own ICANN. See the above link :P Paul From hallam@gmail.com Fri Feb 7 18:23:49 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E6531AD944 for ; Fri, 7 Feb 2014 18:23:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tjeBWHEQhjYU for ; Fri, 7 Feb 2014 18:23:47 -0800 (PST) Received: from mail-la0-x234.google.com (mail-la0-x234.google.com [IPv6:2a00:1450:4010:c03::234]) by ietfa.amsl.com (Postfix) with ESMTP id 20D841A0597 for ; Fri, 7 Feb 2014 18:23:46 -0800 (PST) Received: by mail-la0-f52.google.com with SMTP id c6so3189366lan.25 for ; Fri, 07 Feb 2014 18:23:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=7adevd0bBao3+5Rh9ERJvcWZ0bITTzX9oyD5y6mu+GM=; b=NGdSYo95eoVfR8gdXIzlYdy5sUj7F5RWhH9tV85v1Smp+wcjHx3YlDbKy9DNi84vVI 01WquqA08dsH/FOpLV7HdEitn0RVWOX8mXX19KRFAyZdxfAlxoVGIV2veemKPmKZjb1u iAKRN1tJ8hLDj7G14b/WTmDMRNtKvisFB1Y9j68M6u+lggpzJkGzseqQq85eL7cyvGo5 tyh2FvSAAUd2j6p5PEUQ5RWr4W/9FiGqDyM4lHkRdRYoBKiViQ3IQU/z3qcPDYDnM5Ko pLgz5SaXjld27OZjhr2/AmC2z+BJvE2LOE4eDy7iuD5XRsAzx1FIQJbOlrvLHr8SROKz dJoA== MIME-Version: 1.0 X-Received: by 10.112.114.228 with SMTP id jj4mr11508781lbb.13.1391826226100; Fri, 07 Feb 2014 18:23:46 -0800 (PST) Received: by 10.112.37.168 with HTTP; Fri, 7 Feb 2014 18:23:46 -0800 (PST) In-Reply-To: References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> <20140207193212.GQ22727@crankycanuck.ca> <32201143-1945-4705-A240-522F41535545@taoeffect.com> Date: Fri, 7 Feb 2014 21:23:46 -0500 Message-ID: From: Phillip Hallam-Baker To: Paul Wouters Content-Type: multipart/alternative; boundary=001a1134cbfccbbd3d04f1dbcb76 Cc: "therightkey@ietf.org" , Tao Effect Subject: Re: [therightkey] First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Feb 2014 02:23:49 -0000 --001a1134cbfccbbd3d04f1dbcb76 Content-Type: text/plain; charset=ISO-8859-1 https://www.mtgox.com/press_release_20140207.html MtGox is not BitCoin, the system could survive technically without them. But if the integrity of MtGox was to come under serious doubt it would be the end of BitCoin in all forms. The bubble would pop and the value of BTC drop to a few cents. Of course nobody would imagine that a group of people preaching the value of self-interest would be anything other than completely honest. This whole event might well turn out to be an object lesson in why government regulation is actually a good thing in a payment system. --001a1134cbfccbbd3d04f1dbcb76 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
https://www.mtgox.com/press_release_20140207= .html

MtGox= is not BitCoin, the system could survive technically without them.

But if the in= tegrity of MtGox was to come under serious doubt it would be the end of Bit= Coin in all forms. The bubble would pop and the value of BTC drop to a few = cents.

Of course n= obody would imagine that a group of people preaching the value of self-inte= rest would be anything other than completely honest.

This whole event might well turn out t= o be an object lesson in why government regulation is actually a good thing= in a payment system.=A0
--001a1134cbfccbbd3d04f1dbcb76-- From contact@taoeffect.com Fri Feb 7 19:48:51 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0EC9C1ADBD7 for ; Fri, 7 Feb 2014 19:48:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.334 X-Spam-Level: X-Spam-Status: No, score=-1.334 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_SOFTFAIL=0.665] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LSk1Z2lGh-4T for ; Fri, 7 Feb 2014 19:48:49 -0800 (PST) Received: from homiemail-a37.g.dreamhost.com (caiajhbdcahe.dreamhost.com [208.97.132.74]) by ietfa.amsl.com (Postfix) with ESMTP id 036101A0342 for ; Fri, 7 Feb 2014 19:48:48 -0800 (PST) Received: from homiemail-a37.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a37.g.dreamhost.com (Postfix) with ESMTP id A18B720806C; Fri, 7 Feb 2014 19:48:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=taoeffect.com; h= content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; s=taoeffect.com; bh=+klH/vzIFfjfk61vW WVb+SyzEb8=; b=SZVFaH552SSF6D7194XImat7aT12VtfPlmQvYbc8cI5LiE61d e1jBZtIrqmHeZwsXcAMYMfPyz6kHgME6t08dsn7hA7Cl9eA/SiI5wP7NTRgDFvji 8wbpMkupPhem+AYK7i+ZOVrBp3+9Vh6AdP3Dgoi5nBh4q9tBlhVPtoPfJk= Received: from [192.168.1.7] (173-31-103-210.client.mchsi.com [173.31.103.210]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: contact@taoeffect.com) by homiemail-a37.g.dreamhost.com (Postfix) with ESMTPSA id D689220806B; Fri, 7 Feb 2014 19:48:47 -0800 (PST) Content-Type: multipart/signed; boundary="Apple-Mail=_EC24C6D7-9315-497E-9FC2-27154D60FAD8"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\)) From: Tao Effect In-Reply-To: Date: Fri, 7 Feb 2014 21:48:42 -0600 Message-Id: References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> <20140207193212.GQ22727@crankycanuck.ca> <32201143-1945-4705-A240-522F41535545@taoeffect.com> To: Paul Wouters X-Mailer: Apple Mail (2.1827) Cc: therightkey@ietf.org Subject: Re: [therightkey] First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Feb 2014 03:48:51 -0000 --Apple-Mail=_EC24C6D7-9315-497E-9FC2-27154D60FAD8 Content-Type: multipart/alternative; boundary="Apple-Mail=_81C72F93-DCB0-420D-B1A1-277E646D71EB" --Apple-Mail=_81C72F93-DCB0-420D-B1A1-277E646D71EB Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi Paul, On Feb 7, 2014, at 8:02 PM, Paul Wouters wrote: > So why do you want a TLD in it? It's broken and insecure. Go somewhere > secure? Oh, you mean it is still useful and secure enough for you? = Maybe > it is secure and useful enough for everyone else too? ... oh dear ... > = https://nohats.ca/wordpress/blog/2012/04/09/you-cant-p2p-the-dns-and-have-= it-too/ Think that blog post was shot down on metzdowd or randombit, I won't = bother repeating the conversation here. Sufficed to say that it's = incorrect. > Yes, pay ICANN $120k I'd rather not, and there's no need or compelling reason to. They can = take their monopoly and slowly disappear with it. > Yes it is. I'm sure you can pay that $120k immediately once you tell > your angel investor about your grand plan on how to save _everyone_ in > the world from their $10/year domain rip-off. Don't need angel investors. Code works, and I have my server. You can = use it if you'd like, I won't charge you. :-) > How come you _need_ them _and_ will put them out of business? It sounds like you do not understand what DNSChain is. I don't need them, nor does anyone else. I'm using .dns right now, and = .bit, and so are others, and ICANN is not involved in any way. > Why not pretend you succeeded and ICANN and the DNS is dead. So no = need for your > .dns TLD anymore, since the root is dead. Why do you want .dns again? DNS wouldn't be dead if ICANN were gone, it would just be different. Instead of depending on a centralized authority that charges everyone = money, it would be distributed. The blockchain works. DHT works. We have the technology. It's here now. No need to push a centralized authority on anyone. > You didn't even address two valid points Andrew brought up: >=20 > 1) You are going to cause sending junk queries all over the internet. > What are your plans to preven/reduce that? Sorry, I don't understand what the problem is? Could you elaborate? > 2) Why do you need a TLD .dns, and why can't you use a $15/year > iwillneverrunnameservershere.org It's a meta-TLD, not a TLD. Each .dns is owned by just one DNSChain server. Yours, hopefully. :-) Cheers, Greg -- Please do not email me anything that you are not comfortable also = sharing with the NSA. --Apple-Mail=_81C72F93-DCB0-420D-B1A1-277E646D71EB Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Hi = Paul,

On Feb 7, 2014, at 8:02 PM, Paul Wouters <paul@nohats.ca> = wrote:

So why do you = want a TLD in it? It's broken and insecure. Go somewhere
secure? Oh, = you mean it is still useful and secure enough for you? Maybe
it is = secure and useful enough for everyone else = too?

... oh dear = ...

https://nohats.ca/wordpress/blog/2012/04/09/you-cant-p2p-= the-dns-and-have-it-too/

Think that = blog post was shot down on metzdowd or randombit, I won't bother = repeating the conversation here. Sufficed to say that it's = incorrect.

Yes, pay ICANN $120k

I'd = rather not, and there's no need or compelling reason to. They can take = their monopoly and slowly disappear with = it.

Yes it is. I'm = sure you can pay that $120k immediately once you tell
your angel = investor about your grand plan on how to save _everyone_ in
the world = from their $10/year domain rip-off.

Don't = need angel investors. Code works, and I have my server. You can use it = if you'd like, I won't charge you. = :-)

How come you = _need_ them _and_ will put them out of = business?

It sounds like you do not = understand what DNSChain is.

I don't need them, = nor does anyone else. I'm using .dns right now, and .bit, and so are = others, and ICANN is not involved in any = way.

Why not pretend = you succeeded and ICANN and the DNS is dead. So no need for your
.dns = TLD anymore, since the root is dead. Why do you want .dns = again?

DNS wouldn't be dead if ICANN were = gone, it would just be different.

Instead of = depending on a centralized authority that charges everyone money, it = would be distributed.

The blockchain works. DHT = works.

We have the technology. It's here = now.

No need to push a centralized authority on = anyone.

You didn't = even address two valid points Andrew brought up:

1) You are going = to cause sending junk queries all over the internet.
  What = are your plans to preven/reduce = that?

Sorry, I don't understand what = the problem is? Could you elaborate?

2) Why do you need a TLD .dns, and why can't you use a = $15/year
  iwillneverrunnameserversh= ere.org

It's a meta-TLD, not a = TLD.

Each .dns is owned by just one DNSChain = server. Yours, hopefully. = :-)

Cheers,
Greg

--
Please do not email me anything that you are not comfortable also = sharing with the NSA.

= --Apple-Mail=_81C72F93-DCB0-420D-B1A1-277E646D71EB-- --Apple-Mail=_EC24C6D7-9315-497E-9FC2-27154D60FAD8 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJS9akdAAoJEOxnICvpCVJH6g4P/iXxnWyDCKqzm5NxcAKeB+my xRcTrgcXWISBJ26bXx4pde4P+yrL8rjbOvt6nzzlcqp0uu262WUbIyW3tz2cC/Zj kuUP2UwGbAPsQi/XnempYXEPpcMHFXFYb81EFlANoQm0ZvN+wqROEamrhE6kzwRF 8bXsW00Gh99lfAvbWy8ESfQxUdtSrQPjlt263CrdKnwQ/tEiWlBjNU/AnZlnrAhO Pe4v0di7EBRonwBxWniaq4S6YWgqAWZ9yz2g8RshEnQ9hlpNblmbMVnzAjSnM/q+ eLoH8fAbr/P4ur3dUcR3dqHpL7XSA5yv+ib/vQa4RqtxXwqrK7SF+RUPhqQk6umn oxK8uhw9MF+DtGu3WtTRfCAmsWXu0X6jAk5+/oFTmq2w/LhhWkLCxUH0rl1Ry5GZ 33mkRuD8idLJ9pt59eZ4imRRLmXb4/NLXqXxqXWczqaFsodmvCqkkoXEQj5Wfsix W9PZ0ZRCTSDP4Smeved1sr4DCIt/bCS1o8UjzHcGQ2tQjb/w/C8PkrHGBsDU7F5Z uEQAqQTN18PmJ2eHoOMHXQjtNHrI20x5QGaOkp/fPAG4FgId6Xtk1yPyc6GU60Kz +TrFWTz4PCUjG5sgm+ipsdtI/WnNq3VtBQWG5tt8tXeTaEg6JAaVGFCEB3fCVgYW CoLPZBpNsjfZYL7edIZa =yN9g -----END PGP SIGNATURE----- --Apple-Mail=_EC24C6D7-9315-497E-9FC2-27154D60FAD8-- From contact@taoeffect.com Fri Feb 7 21:20:44 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75E031ADDBD for ; Fri, 7 Feb 2014 21:20:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.334 X-Spam-Level: X-Spam-Status: No, score=-1.334 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_SOFTFAIL=0.665] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LYrADIPKI6LG for ; Fri, 7 Feb 2014 21:20:42 -0800 (PST) Received: from homiemail-a62.g.dreamhost.com (caiajhbdccac.dreamhost.com [208.97.132.202]) by ietfa.amsl.com (Postfix) with ESMTP id 275941ADDAF for ; Fri, 7 Feb 2014 21:20:42 -0800 (PST) Received: from homiemail-a62.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a62.g.dreamhost.com (Postfix) with ESMTP id 776D263406F; Fri, 7 Feb 2014 21:20:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=taoeffect.com; h= content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; s=taoeffect.com; bh=1tsWqklS6PYpNk3Jj MvVPLGRVNQ=; b=f3sabyzO64YqyqBw0Vmtf1wwKfW8k/CCCgkKwZOedsZQR7CdR TkRxLXzHcbGcBKq6Zcxw+CJKde2pTU7FkCmtMPYb2dV9jW4nrhdJ9uanJtRjGnO5 Y6kLLaSntUMcNYWe1onQ6WJpRNh0/BE9wUilIVvQnd8ev7PhMniz3a5N8w= Received: from [192.168.1.7] (173-31-103-210.client.mchsi.com [173.31.103.210]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: contact@taoeffect.com) by homiemail-a62.g.dreamhost.com (Postfix) with ESMTPSA id C2A7663406E; Fri, 7 Feb 2014 21:20:25 -0800 (PST) Content-Type: multipart/signed; boundary="Apple-Mail=_5DD71681-A87B-4517-8FCB-6B1794E3C692"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\)) From: Tao Effect In-Reply-To: Date: Fri, 7 Feb 2014 23:20:12 -0600 Message-Id: References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> <20140207193212.GQ22727@crankycanuck.ca> <32201143-1945-4705-A240-522F41535545@taoeffect.com> To: Tao Effect Support X-Mailer: Apple Mail (2.1827) Cc: therightkey@ietf.org, Paul Wouters Subject: Re: [therightkey] First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Feb 2014 05:20:44 -0000 --Apple-Mail=_5DD71681-A87B-4517-8FCB-6B1794E3C692 Content-Type: multipart/alternative; boundary="Apple-Mail=_0A2D155F-B335-416B-933F-FE7ECFF99597" --Apple-Mail=_0A2D155F-B335-416B-933F-FE7ECFF99597 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Significant improvements to the project's README were just pushed, = hopefully this helps clarify what the project does: https://github.com/okTurtles/dnschain -- Please do not email me anything that you are not comfortable also = sharing with the NSA. On Feb 7, 2014, at 9:48 PM, Tao Effect wrote: > Hi Paul, >=20 > On Feb 7, 2014, at 8:02 PM, Paul Wouters wrote: >=20 >> So why do you want a TLD in it? It's broken and insecure. Go = somewhere >> secure? Oh, you mean it is still useful and secure enough for you? = Maybe >> it is secure and useful enough for everyone else too? >=20 > ... oh dear ... >=20 >> = https://nohats.ca/wordpress/blog/2012/04/09/you-cant-p2p-the-dns-and-have-= it-too/ >=20 > Think that blog post was shot down on metzdowd or randombit, I won't = bother repeating the conversation here. Sufficed to say that it's = incorrect. >=20 >> Yes, pay ICANN $120k >=20 > I'd rather not, and there's no need or compelling reason to. They can = take their monopoly and slowly disappear with it. >=20 >> Yes it is. I'm sure you can pay that $120k immediately once you tell >> your angel investor about your grand plan on how to save _everyone_ = in >> the world from their $10/year domain rip-off. >=20 > Don't need angel investors. Code works, and I have my server. You can = use it if you'd like, I won't charge you. :-) >=20 >> How come you _need_ them _and_ will put them out of business? >=20 > It sounds like you do not understand what DNSChain is. >=20 > I don't need them, nor does anyone else. I'm using .dns right now, and = .bit, and so are others, and ICANN is not involved in any way. >=20 >> Why not pretend you succeeded and ICANN and the DNS is dead. So no = need for your >> .dns TLD anymore, since the root is dead. Why do you want .dns again? >=20 > DNS wouldn't be dead if ICANN were gone, it would just be different. >=20 > Instead of depending on a centralized authority that charges everyone = money, it would be distributed. >=20 > The blockchain works. DHT works. >=20 > We have the technology. It's here now. >=20 > No need to push a centralized authority on anyone. >=20 >> You didn't even address two valid points Andrew brought up: >>=20 >> 1) You are going to cause sending junk queries all over the internet. >> What are your plans to preven/reduce that? >=20 > Sorry, I don't understand what the problem is? Could you elaborate? >=20 >> 2) Why do you need a TLD .dns, and why can't you use a $15/year >> iwillneverrunnameservershere.org >=20 >=20 > It's a meta-TLD, not a TLD. >=20 > Each .dns is owned by just one DNSChain server. Yours, hopefully. :-) >=20 > Cheers, > Greg >=20 > -- > Please do not email me anything that you are not comfortable also = sharing with the NSA. >=20 > _______________________________________________ > therightkey mailing list > therightkey@ietf.org > https://www.ietf.org/mailman/listinfo/therightkey --Apple-Mail=_0A2D155F-B335-416B-933F-FE7ECFF99597 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Significant improvements to the project's README = were just pushed, hopefully this helps clarify what the project = does:

https://github.com/okTurtle= s/dnschain

--
Please do not email me anything that you are not comfortable also = sharing with the NSA.

On Feb 7, 2014, at 9:48 PM, Tao Effect = <contact@taoeffect.com> wrote:

Hi Paul,

On = Feb 7, 2014, at 8:02 PM, Paul Wouters <paul@nohats.ca> = wrote:

So why do you = want a TLD in it? It's broken and insecure. Go somewhere
secure? Oh, = you mean it is still useful and secure enough for you? Maybe
it is = secure and useful enough for everyone else = too?

... oh dear = ...

https://nohats.ca/wordpress/blog/2012/04/09/you-cant-p2p-= the-dns-and-have-it-too/

Think that = blog post was shot down on metzdowd or randombit, I won't bother = repeating the conversation here. Sufficed to say that it's = incorrect.

Yes, pay ICANN $120k

I'd = rather not, and there's no need or compelling reason to. They can take = their monopoly and slowly disappear with = it.

Yes it is. I'm = sure you can pay that $120k immediately once you tell
your angel = investor about your grand plan on how to save _everyone_ in
the world = from their $10/year domain rip-off.

Don't = need angel investors. Code works, and I have my server. You can use it = if you'd like, I won't charge you. = :-)

How come you = _need_ them _and_ will put them out of = business?

It sounds like you do not = understand what DNSChain is.

I don't need them, = nor does anyone else. I'm using .dns right now, and .bit, and so are = others, and ICANN is not involved in any = way.

Why not pretend = you succeeded and ICANN and the DNS is dead. So no need for your
.dns = TLD anymore, since the root is dead. Why do you want .dns = again?

DNS wouldn't be dead if ICANN were = gone, it would just be different.

Instead of = depending on a centralized authority that charges everyone money, it = would be distributed.

The blockchain works. DHT = works.

We have the technology. It's here = now.

No need to push a centralized authority on = anyone.

You didn't = even address two valid points Andrew brought up:

1) You are going = to cause sending junk queries all over the internet.
  What = are your plans to preven/reduce = that?

Sorry, I don't understand what = the problem is? Could you elaborate?

2) Why do you need a TLD .dns, and why can't you use a = $15/year
  iwillneverrunnameservers= here.org

It's a meta-TLD, not a = TLD.

Each .dns is owned by just one DNSChain = server. Yours, hopefully. = :-)

Cheers,
Greg

--
Please do not email me anything that you are not = comfortable also sharing with the = NSA.

_________________________________________= ______
therightkey mailing = list
therightkey@ietf.org
https://www.ietf.org/mailman/listinfo/ther= ightkey

= --Apple-Mail=_0A2D155F-B335-416B-933F-FE7ECFF99597-- --Apple-Mail=_5DD71681-A87B-4517-8FCB-6B1794E3C692 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJS9b6SAAoJEOxnICvpCVJHPXoQAMH3pw3BV+Gq4Zhp+syXcUT4 GKSiqAp2K9pVboXRH4FlT1rhUNhEf2gwuoNIcJcWy7DDxK6TFkE1HEfQ/+FCqJOy k+/KzbHqAtNfrtM+MgjkWuCmyO+0r/5Ci9hPvLwhCC02Kho0C91LzcMDv0Qu30Dj lGQVj45YQ/prbF34jMsLh6p7vFtrdqhV/ccVIJjv9poc66CB2g17QfcBM7F8oIBR upBsU/DYACozirGUNaC3lIO2AoK0faZlUrzL931Yg54K/3m4DhbqQENldORJRW+q UCpAHoTFTdn8IHYS5MuG7cWAtbx7WeEi+EbXYsfc69DEoTpTH9RnynS5xsmdkWo4 99F5wzTsgJtHqmDc7+jQ0GPwQ8EpehRHnZIYxXKfRZ0udMUcQBrfrNzd4M+DCE3J hF9z7e/JYMyx6q/x/BC5ZLSK/ToLt5MAbydhjDFEYntO+uQYhiu5s2NC1WD3WLL3 DX9LkZvhO35YJRhPg5aZEKocghb6gPWwZTJnuAa264wRw8NkW65N94kDrMVM/x0x FT6BSIUxCDtEmveD2sFLXEg/2ZLUF+PPvDRsRbnoY5R/Th2aE58nhYXAS1ZrLom5 vBmkB5iuVW8l5JKIzIi+rRpOApkIwgViN9Of4HAVQdQQAUsrFVkh5OIquGCLznPC U5VvOId5F5w7ITNrgOFp =/Q8c -----END PGP SIGNATURE----- --Apple-Mail=_5DD71681-A87B-4517-8FCB-6B1794E3C692-- From benl@google.com Sat Feb 8 05:13:51 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D1271A02CC for ; Sat, 8 Feb 2014 05:13:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.027 X-Spam-Level: X-Spam-Status: No, score=-0.027 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RHytc5cPLskK for ; Sat, 8 Feb 2014 05:13:50 -0800 (PST) Received: from mail-vb0-x233.google.com (mail-vb0-x233.google.com [IPv6:2607:f8b0:400c:c02::233]) by ietfa.amsl.com (Postfix) with ESMTP id D22371A02C3 for ; Sat, 8 Feb 2014 05:13:49 -0800 (PST) Received: by mail-vb0-f51.google.com with SMTP id 11so3433695vbe.24 for ; Sat, 08 Feb 2014 05:13:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=Jf/ZZzGhPkdOdY03sMr+dO4mVSEABz45LEbcwWnUFkk=; b=EXcXpBk944M1+oDUBKGyyCXu7YBEqPRfiFW/a1L0YIScHGzSNrOpcF9CtcTkfbUe+m hhgL4zR3b6Mh1hHM0pVdkRJy1/E+M9tfBbzpwVvzVOObcA7+8nZz2i4JSy40F8lgt7ZF gVevffQiOFOWzlOd8sq07cJa/0E2ZppzTNhgekK8J1puA7g/7RgGUaAiuBTcV3QB7S7Z aBzOAeDi8z0rMzWXjqWM0q+LxbDgkeMbFOv1BDBA2A2YfSkC3W1lbR2SpFFVU1PY0NUm eKZbs8l1DUUVTRz4u7BN6FSRdrgPbmBUO7kxBBGMOh8BQdPX1d+8KRfVt1lOeQFFQ8PM ai4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=Jf/ZZzGhPkdOdY03sMr+dO4mVSEABz45LEbcwWnUFkk=; b=AqPGgqV0S5Z53doXRcWV+2tKEc8Tpw0L4M8q4HEiNbgWvTsk1B1zGBKObL8Uon3CkV wlTAlr7vRdczMsvme5TtzF7Z7KPGvUM2DacOmlgWJ4IWGAfOVtxRUK5iZzR6CIHhEjqv E0XHm5dACgJCWC3klCyKjEZb2RJURBSsPOru8W2z2ClwTUm6OeoyMFIdzqW7hpOa6RvO +DwXjJ7IyjkUpPc/d4gPU5a1ly72Emh1oNtUfT+/eYcO5pdrZK3YiGBO20QmzoahfbYF Ba/Od2D6OWMQsddRbhxZLuwF0uMjWfbWTaU5SOyQCsbQuBobVZ6xWEmtwQdrY82u4Bog flwg== X-Gm-Message-State: ALoCoQljAasUEvGRUqBH8cehowqwYgB/ZFCp5fvgE/9PPqKBhX8Zg3iVppWWDOUtsISKOBNKjpDvbqgKBgUD1tiAjM4sWEosWzXHOe/Xiijc2B93mzqbHUAraiLb8kQTVwmIVo6q2sJ7TZYpZXk8ODHBJa0kfayiQaEON7pv60VhE7/n2qIL1cZeZTaqsbIR7VmVFHUw11IN MIME-Version: 1.0 X-Received: by 10.52.163.65 with SMTP id yg1mr12685297vdb.14.1391865230231; Sat, 08 Feb 2014 05:13:50 -0800 (PST) Received: by 10.52.230.105 with HTTP; Sat, 8 Feb 2014 05:13:50 -0800 (PST) In-Reply-To: <52F25835.60702@comodo.com> References: <52F25835.60702@comodo.com> Date: Sat, 8 Feb 2014 13:13:50 +0000 Message-ID: From: Ben Laurie To: Rob Stradling Content-Type: text/plain; charset=UTF-8 Cc: "therightkey@ietf.org" , "certificate-transparency@googlegroups.com" , CABFPub Subject: Re: [therightkey] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Feb 2014 13:13:51 -0000 On 5 February 2014 15:26, Rob Stradling wrote: > On 04/02/14 17:08, Ben Laurie wrote: >> >> Enclosed, our revised plan. >> >> Comments welcome. > > > Ben, > > Table 1 and Footnote 4 seem a bit confused, wrongly implying that 39-month > EV certs do exist and/or that >39-month non-EV certs don't exist. > >>27 month EV SSL certificates shouldn't exist, as per the EV Guidelines. > >>60 month non-EV SSL certificates shouldn't have been issued by any CA since >> the BRs came into effect. > >>39 month non-EV SSL certificates shouldn't be issued from 1st April 2015, >> as per the BRs. Yes, I will release a slightly updated version clarifying this (and other points) a bit more. > Also, what happened to the idea of only requiring 1 SCT for a 1-month cert? > > > -- > Rob Stradling > Senior Research & Development Scientist > COMODO - Creating Trust Online From benl@google.com Sat Feb 8 05:28:56 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B922B1A02F9 for ; Sat, 8 Feb 2014 05:28:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.027 X-Spam-Level: X-Spam-Status: No, score=-0.027 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I25Yhx7hWg_i for ; Sat, 8 Feb 2014 05:28:54 -0800 (PST) Received: from mail-vb0-x236.google.com (mail-vb0-x236.google.com [IPv6:2607:f8b0:400c:c02::236]) by ietfa.amsl.com (Postfix) with ESMTP id 8A8E81A02F7 for ; Sat, 8 Feb 2014 05:28:54 -0800 (PST) Received: by mail-vb0-f54.google.com with SMTP id w20so3464606vbb.41 for ; Sat, 08 Feb 2014 05:28:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=ztmQW4b4ZfOds7e40wVtX4DGcj2h/Sn7wF+ShiyBFlk=; b=D9b7rcfKti/0Ojb5iguh/xUWeo2myOlYHpH30qet4PIL8jC8EmE9lZ0TMXwWZmduXZ 5xm2agxpl6lTQ2OIrcssLBQQEgTueutFD/9uXPGIQXwpACXBTrGDQOGm9wJO7jqnX5QK LA8sJyLoC3nOJ+usd+jTEAZMQD3NFBtMRlA/29eT6tGD+LUyLIDyjgRbwwNKOYd3WMep 1yaq6TZWWzdi1je5Ffk5lcK0qzUdxpqrTAC2LDiIBjhrKnZTLvAOWBrfYP9oexUQzMp1 MDV3U4s6AC94SMLxzeKq/JvIsM7B0uxAXKEfr5U4tDV7iIMQFq7xh2Ej9Xn5Qe3GS8zN HLVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=ztmQW4b4ZfOds7e40wVtX4DGcj2h/Sn7wF+ShiyBFlk=; b=i/Jvgh8iNBC4jFo7L7wlq3l3Gftjjp3fSm0l23N6WM4opdKve+rsgnxR48rcM3+Zda 1Tw4WbjMCKImgPCTRw9Xd4HiXI4KPCwi9r5fvvjdIhWQBxPrB5dYjoAqMt3/Kuwdx2+w m+IFKY5E5+iY/lL8UGrnSFhdK5JCdBEn/khs9q1UtCssBU2dD/J1Cj3if6cdqhLRdQmc hOPiCRfz8NecmmL+QnO2xrMrweDSAxwMEdieIMuJ9hLcRs2E4WNmcrTFIs55c7tUWW0H J3mpL7uQjC3J63KnorGnjQbuOY3Kv6kY76HdxiXYeYEorGcBfbOGL8wX1JsBQBKvQzEh 5ThQ== X-Gm-Message-State: ALoCoQkECz8obQaNaBkAceCXoawFtDM9OulykEJVbdOvhAL8CuN7kN5kqugbiEDG7GpluPgLhTZphd3puddQgwU+v6nKi498ezcW3rhtZPBf762B8E2kXmW9m6NSNeMt2qya6R1QW5fZMT0F0WZpUUaCdKMXks0w8Zi8yOrNApY60bSe8dIKGDVvOuMG4YOG/zt5vOzTrxXe MIME-Version: 1.0 X-Received: by 10.52.247.231 with SMTP id yh7mr269549vdc.34.1391866134797; Sat, 08 Feb 2014 05:28:54 -0800 (PST) Received: by 10.52.230.105 with HTTP; Sat, 8 Feb 2014 05:28:54 -0800 (PST) In-Reply-To: References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <01dc01cf21db$146dac40$3d4904c0$@globalsign.com> <05c501cf21dc$bbc70da0$335528e0$@digicert.com> Date: Sat, 8 Feb 2014 13:28:54 +0000 Message-ID: From: Ben Laurie To: Carl Wallace Content-Type: text/plain; charset=UTF-8 Cc: therightkey , Adam Langley Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Feb 2014 13:28:56 -0000 On 5 February 2014 16:51, Carl Wallace wrote: > > On 2/4/14, 2:41 PM, "Adam Langley" wrote: > >>On Tue, Feb 4, 2014 at 2:10 PM, Jeremy Rowley >> wrote: >>> I do not think this is correct. The number of proofs actually >>>increases as you decrease validity periods. >> >>Consider a certificate setting out on a journey. It always needs to >>have identity papers with it because the Browser Police are always on >>the lookout for unregistered certificates. However, the Browser Police >>sometimes decide that certain forms of ID are no longer acceptable and >>so a certificate needs to carry several forms of ID with it. If it's >>setting out on a one year journey it's wise to have two forms of ID >>because one might become distrusted over the year, but it's >>vanishingly unlikely that both would be. >> >>However, if our plucky certificate is setting out on a two year >>journey then it's wise to carry three forms of ID just in case two >>become useless while it's out in the world. The longer it'll be out, >>the more forms of id it should carry to ensure that one is always >>acceptable. > > This would be more clear if the section of the document that notes Chrome > will periodically refresh the list of qualifying logs also indicated the > list of formerly qualifying logs will also be updated. You will need both > lists. Good point, I will update the document. > > > > _______________________________________________ > therightkey mailing list > therightkey@ietf.org > https://www.ietf.org/mailman/listinfo/therightkey From benl@google.com Sat Feb 8 05:32:18 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B6DD1A02F9 for ; Sat, 8 Feb 2014 05:32:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.027 X-Spam-Level: X-Spam-Status: No, score=-0.027 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7P4nxn5LEeV0 for ; Sat, 8 Feb 2014 05:32:16 -0800 (PST) Received: from mail-vb0-x22d.google.com (mail-vb0-x22d.google.com [IPv6:2607:f8b0:400c:c02::22d]) by ietfa.amsl.com (Postfix) with ESMTP id 6BFC81A02A8 for ; Sat, 8 Feb 2014 05:32:16 -0800 (PST) Received: by mail-vb0-f45.google.com with SMTP id m10so3489859vbh.18 for ; Sat, 08 Feb 2014 05:32:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=5lyVHEmR3XZ3owCmvumkc9C1YXLRPYXpSPJyzrZiVks=; b=hgjHDM4hYFUlHWYlepgAylDsO061vw6EOvqRdUz3UyuVmeqj2/EiF1iO0GdNq6MTmm 4jgbAkzXCrtUPNU+Q67TOZ3MbNObphzXXiwVlVMXX+oIYUD540nCrvExSkWt9ZpM1GWI 16AVVgiEJgZTHHQ1e5yTdXmNx5eqrHeNz/iOeoUu9kW9t1UiTpAFPG2q6xpE5yODKJfJ Rk6CBuMvDGmxtwwUgcfvfblqjacurCfPCdUQhfc+U+ONM7HnByw8+LTqiUT1YbzUxJOT GLloimxHpqDLIII77IC3U1bLbCGrP7L23fx5/8j8IOO3d6OGBED3IopWshDgVPPuQhSy 5k4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=5lyVHEmR3XZ3owCmvumkc9C1YXLRPYXpSPJyzrZiVks=; b=gLB8Xh+9Z4xem6VC2ODtLWFyB82wjNriepe9eO/Pd2rCyMfHGAKF+0DGz/gCGnTuOM Vefw9ZTaaJChyy4JYG3NU3Zn/ZMBwcGhro1qfjRQPzs7fM8CY6dxZsFn6jhO8NR+IOI8 dc2u7l6X0zD9rypoLUGdvFL81TElGI2qiUzQoNgOooDoakrpBfOzxkG1TYJxL1cb2hGC zZxiLnFOAucBfNKqepUMxBXd5/+xC+KdPhU+f95zJbxFj0/gfIM71c744374cckBN74L zEwTSmVVpcnB7VBrHsQAWzDLtrTeQIhnxQBv4gIjoLvV2NfVwjDtRnYPqIyWR0m0+KxZ HfPA== X-Gm-Message-State: ALoCoQm3W5h5SkATisbKgsnqxtCI8Vb2T3zNgM7nRSmHBb2odE/NzUs2q3TqTmeG8Xo8PyFL7HnpWKz+YVBX03e0anhqk24YRtgoCl6MqBvxdc32p9/r0cbkRPqMqZBGDA79GrYuZHRGAwoRPZQpGyMRjiWTPmbnnF9ek/tbJ7ToCUHXFZZkYm/MUr6fGydHvQLHbC2VPjw4 MIME-Version: 1.0 X-Received: by 10.221.29.196 with SMTP id rz4mr15015726vcb.8.1391866336816; Sat, 08 Feb 2014 05:32:16 -0800 (PST) Received: by 10.52.230.105 with HTTP; Sat, 8 Feb 2014 05:32:16 -0800 (PST) In-Reply-To: <52F2811A.9030800@comodo.com> References: <52F25835.60702@comodo.com> <52F27445.6040701@comodo.com> <52F2811A.9030800@comodo.com> Date: Sat, 8 Feb 2014 13:32:16 +0000 Message-ID: From: Ben Laurie To: "certificate-transparency@googlegroups.com" Content-Type: text/plain; charset=UTF-8 Cc: "therightkey@ietf.org" , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Feb 2014 13:32:18 -0000 On 5 February 2014 18:21, Rob Stradling wrote: > On 05/02/14 17:49, Adam Langley wrote: >> >> On Wed, Feb 5, 2014 at 12:26 PM, Rob Stradling >> wrote: >>> >>> Presumably it's somewhere between 10 and 31 days, since 1 SCT is >>> acceptable >>> for Stapled OCSP and the BRs permit OCSP Responses to be valid for up to >>> 10 >>> days. >> >> >> The speed at which we need to distrust a log depends on the minimum >> number of SCTs actually, which is why allowing a single SCT in stapled >> OCSP responses is such a large concession. If the minimum number of >> SCTs were two then the pressure to distrust a log (and the pressure on >> the logs) would be dramatically reduced because compromising one log >> wouldn't be sufficient. >> >>> Do you still think [1] is a good plan? >> >> >> Sure, if any CAs are willing to do it now :) > > > I think "servers could just download their refreshed certificate over HTTP > periodically and automatically" is the showstopper at the moment. Yes they > could, but I'm not aware of any server that actually implements such a > feature. Work is under way for Apache: https://github.com/trawick/ct-httpd/. From benl@google.com Sat Feb 8 05:40:11 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 415301A0302 for ; Sat, 8 Feb 2014 05:40:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.027 X-Spam-Level: X-Spam-Status: No, score=-0.027 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ByEgwsTjkMhr for ; Sat, 8 Feb 2014 05:40:09 -0800 (PST) Received: from mail-vb0-x234.google.com (mail-vb0-x234.google.com [IPv6:2607:f8b0:400c:c02::234]) by ietfa.amsl.com (Postfix) with ESMTP id 7892C1A0300 for ; Sat, 8 Feb 2014 05:40:09 -0800 (PST) Received: by mail-vb0-f52.google.com with SMTP id p14so3565946vbm.11 for ; Sat, 08 Feb 2014 05:40:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=rWqbKdNIo4umHuIP7QBOSeBiocREjNk5cVvywJxyGtM=; b=F6b6KXf6rDalR29IyVKJS3joL88IyHDgX1uJ6YdFDvS04YYi25TX1B8xVc20tUG+JO Cy91CnRlnWpfkUoaLiplnQ5yeEz6BJtGVRfQLtqIB+8GSsZEdlb4ZBSAhEW1maW9dImP UF6HwezJgX0PGoC0UP3BRw12Nvatw6lrOPO+tjf59gTkBNARbmzZ5S2237y7Ni9igjuK rVBKKt1DreJ9ORc4aQ+oXiYctN/RQFSy3c31XEH6e33Ef839nQbeLSIqvSF191vkNxyF L2jurvv1sMrdaPzXZu98DBImgs9L/VWf9QuSlXVK3D4cUCEd2yhZ9XqUAB/dcpyM15aK 3T1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=rWqbKdNIo4umHuIP7QBOSeBiocREjNk5cVvywJxyGtM=; b=Ch9J/8xo/Ps2RcdXyFD5EYGkFEsg8kz7720usj3jBP79A5RVXO9Spd+KYXYfgDbk4/ mb88SeKrcRtxGMpvsF+b+M0f2q+ODteDaX6NychGGJq067loxJe5bnBhshBhb5RKxyVa MPd0+szPp710Xxm/nzh0GRDWgB8J86Bic4x0YzOR3hZeX7Y9A378eIURW+C1F+TNqIBs TvG2CjskKjs9j4I5tIgi2DL51kLoJXw3yxlsK2svS54D/gdWLq4KD24mwbtHvW9NLHRj 2nZxjmW+xu9LVZaut99cmCkOMRqUvLpCanjxk14XAxq5YlkGVQhS874KPkuwIMwXcnex PrLw== X-Gm-Message-State: ALoCoQklekQBOrNeuNjxAQ5TqVHmM5Uv/Ch40FgDBMcL5gzQlcTB2Rj2d67jBeux+HboJiYv0gFGZhlu3IQcaBBrLZZwMQ2lSAi2mGNRowWKuI65dt4GMN3GC4TkURJKAObYj73Ti9vLYmd2KW9lldGl2A+/bMuSIJFoKYpYQ0U4a8RBiQPe9o4Bae+UEFS+0ZloF9eJTnSc MIME-Version: 1.0 X-Received: by 10.58.132.203 with SMTP id ow11mr15217746veb.1.1391866809849; Sat, 08 Feb 2014 05:40:09 -0800 (PST) Received: by 10.52.230.105 with HTTP; Sat, 8 Feb 2014 05:40:09 -0800 (PST) In-Reply-To: References: <544B0DD62A64C1448B2DA253C011414607C3F53600@TUS1XCHEVSPIN33.SYMC.SYMANTEC.COM> Date: Sat, 8 Feb 2014 13:40:09 +0000 Message-ID: From: Ben Laurie To: Adam Langley Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Cc: "therightkey@ietf.org" , certificate-transparency , CABFPub Subject: Re: [therightkey] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Feb 2014 13:40:11 -0000 On 6 February 2014 19:05, Adam Langley wrote: > On Thu, Feb 6, 2014 at 1:51 PM, Rick Andrews = wrote: >> Can you clarify something? The SCT delivery options described in the RFC= are options for the web site owner, not for the CA. CAs will need to suppo= rt all three options. We will have customers who won=E2=80=99t do stapling = and can=E2=80=99t handle TLS extensions, so they just want the SCTs embedde= d in the cert. But not all customers will prefer that option. I believe oth= er customers will want the SCT-in-the-OCSP-response or TLS extension option= , because in those options you don=E2=80=99t have to transmit the SCTs in e= very SSL handshake. I suspect some of our large customers who are obsessed = with performance will demand one of these options. >> >> So CAs will need to support all three options, unless you=E2=80=99re so = small a CA that your few EV customers agree on one option. Is that your exp= ectation? > > SCTs embedded in the certificate won't be sent for resumption > handshakes of course. > > The TLS extension will be sent in the same cases as SCTs embedded in > the certificate. (And the TLS extension doesn't need the CA to do > anything.) > > The stapled OCSP response is likely to be sent in the same cases also. > One could imagine a client that doesn't request a stapled OCSP > response when it has a cached OCSP response for the certificate that > it saw from the server last time. But, if the server responds with a > different certificate it's stuck. So I expect clients to always > request the OCSP staple. > > So a CA only really need worry about the embedded case. Customers who > are concerned about the performance impact of a few hundred extra > bytes very likely have much easier avenues to reduce the size, like > having different certs for different names rather than dozens of SANs. Just to clarify: if CAs want to use OCSP stapling, then obviously they need to add CT support to their OCSP responder. But the only thing CAs really _have_ to do is the embedded case. From drc@virtualized.org Sat Feb 8 11:04:17 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1266F1A0451 for ; Sat, 8 Feb 2014 11:04:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.55 X-Spam-Level: X-Spam-Status: No, score=-0.55 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.548, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tVYNkSvHeqqD for ; Sat, 8 Feb 2014 11:04:14 -0800 (PST) Received: from alpha.virtualized.org (alpha.virtualized.org [199.233.229.186]) by ietfa.amsl.com (Postfix) with ESMTP id 053091A0443 for ; Sat, 8 Feb 2014 11:04:14 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by alpha.virtualized.org (Postfix) with ESMTP id 2D2DB84CEE; Sat, 8 Feb 2014 14:04:14 -0500 (EST) Received: from alpha.virtualized.org ([127.0.0.1]) by localhost (alpha.virtualized.org [127.0.0.1]) (maiad, port 10024) with ESMTP id 72271-05; Sat, 8 Feb 2014 14:04:13 -0500 (EST) Received: from [10.0.1.3] (c-67-169-100-133.hsd1.ca.comcast.net [67.169.100.133]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: drc@virtualized.org) by alpha.virtualized.org (Postfix) with ESMTPSA id 1998684CED; Sat, 8 Feb 2014 14:04:12 -0500 (EST) Content-Type: multipart/signed; boundary="Apple-Mail=_67CB2093-8A58-4897-B0B9-AA63BF520343"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\)) From: David Conrad In-Reply-To: Date: Sat, 8 Feb 2014 11:04:08 -0800 Message-Id: References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> <20140207193212.GQ22727@crankycanuck.ca> <32201143-1945-4705-A240-522F41535545@taoeffect.com> To: Tao Effect X-Mailer: Apple Mail (2.1827) Cc: therightkey@ietf.org Subject: Re: [therightkey] First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Feb 2014 19:04:17 -0000 --Apple-Mail=_67CB2093-8A58-4897-B0B9-AA63BF520343 Content-Type: multipart/alternative; boundary="Apple-Mail=_32A5C230-BC3B-4B3B-9011-50B9A1D32665" --Apple-Mail=_32A5C230-BC3B-4B3B-9011-50B9A1D32665 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Feb 7, 2014, at 7:48 PM, Tao Effect wrote: > No need to push a centralized authority on anyone. What happens when someone else decides to use the .dns "meta-TLD" (as = you call it) for something other than DNSChain? >> 1) You are going to cause sending junk queries all over the internet. >> What are your plans to preven/reduce that? >=20 > Sorry, I don't understand what the problem is? Could you elaborate? = https://www.icann.org/en/about/staff/security/ssr/name-collision-mitigatio= n-05dec13-en.pdf >> 2) Why do you need a TLD .dns, and why can't you use a $15/year >> iwillneverrunnameservershere.org >=20 >=20 > It's a meta-TLD, not a TLD. You might want to look at RFC 6761. Regards, -drc --Apple-Mail=_32A5C230-BC3B-4B3B-9011-50B9A1D32665 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii On Feb = 7, 2014, at 7:48 PM, Tao Effect <contact@taoeffect.com> = wrote:
No need to push a centralized authority on = anyone.

What happens when = someone else decides to use the .dns "meta-TLD" (as you call it) for = something other than DNSChain?

1) You are going to cause sending junk queries all over = the internet.
  What are your plans to preven/reduce = that?

Sorry, I don't understand what = the problem is? Could you = elaborate?


2) Why do you need a TLD .dns, and why can't you use a = $15/year
  iwillneverrunnameservers= here.org

It's a meta-TLD, not a = TLD.

You might want to = look at RFC = 6761.

Regards,
-drc

= --Apple-Mail=_32A5C230-BC3B-4B3B-9011-50B9A1D32665-- --Apple-Mail=_67CB2093-8A58-4897-B0B9-AA63BF520343 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJS9n+oAAoJENV6ebf0/4rXu0sH/1C6tqHTpNlcukvoHacFn66R qZ/X0VfEZYbPLXhwoxREq6PjgKbfDN+mjJ+VSwT0+1iMzF7ZkaZY5ibC7TlSTtRf 91OK4TrV7Yfix9/yM5owHT1yWCq9guur3V/I/Fe0iZCSkfZRsKRZ1gn4LBtCVXCo v9YJgoFuS0UTc0ZRFhYa9dX5Itj8DnZt/NG+p3HilPIWjXOc2c5F8u5T2a6SEeF3 0ZSlU5rBb1O5MfJdSQ2YYAFjjWqPB5pRlqtHS1qEibQ588oYgDD4/08PVfhc/+Sv Leo/lE5hdtFXw2MASFN/0ZhFNi6vnBJD6srQBAxzFK1PqZ360VcrZCSCSwYzimg= =f77N -----END PGP SIGNATURE----- --Apple-Mail=_67CB2093-8A58-4897-B0B9-AA63BF520343-- From paul.hoffman@vpnc.org Sat Feb 8 14:00:28 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D50351A0432 for ; Sat, 8 Feb 2014 14:00:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.347 X-Spam-Level: X-Spam-Status: No, score=-1.347 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_COM=0.553] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cy0IyfYU_iIs for ; Sat, 8 Feb 2014 14:00:28 -0800 (PST) Received: from hoffman.proper.com (IPv6.Hoffman.Proper.COM [IPv6:2605:8e00:100:41::81]) by ietfa.amsl.com (Postfix) with ESMTP id DDCA51A0428 for ; Sat, 8 Feb 2014 14:00:27 -0800 (PST) Received: from [10.20.30.90] (50-1-98-67.dsl.dynamic.sonic.net [50.1.98.67]) (authenticated bits=0) by hoffman.proper.com (8.14.8/8.14.7) with ESMTP id s18M0Qt6005081 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Sat, 8 Feb 2014 15:00:27 -0700 (MST) (envelope-from paul.hoffman@vpnc.org) X-Authentication-Warning: hoffman.proper.com: Host 50-1-98-67.dsl.dynamic.sonic.net [50.1.98.67] claimed to be [10.20.30.90] Content-Type: multipart/signed; boundary="Apple-Mail=_A8137A4D-FC01-4F16-866E-07E6BD439FCF"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\)) From: Paul Hoffman In-Reply-To: Date: Sat, 8 Feb 2014 14:00:22 -0800 Message-Id: <23D8B61D-A198-40FB-9672-83AF23018AE9@vpnc.org> References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> <20140207193212.GQ22727@crankycanuck.ca> <32201143-1945-4705-A240-522F41535545@taoeffect.com> To: Tao Effect X-Mailer: Apple Mail (2.1827) Cc: therightkey@ietf.org Subject: Re: [therightkey] First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Feb 2014 22:00:29 -0000 --Apple-Mail=_A8137A4D-FC01-4F16-866E-07E6BD439FCF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Feb 7, 2014, at 7:48 PM, Tao Effect wrote: > It's a meta-TLD, not a TLD. Say what? If the idea is that I can get a certificate with = paulehoffman.dns put in the field reserved for domain names, and have = that accepted by TLS servers, it is a TLD. No "meta". If this TLD gets allocated to someone else, or gets blocked by = middleboxes, you have no one to blame but yourself. It would be = *trivial* to avoid this problem by buying an SLD and pre-paying for 20 = years of registration. --Paul Hoffman --Apple-Mail=_A8137A4D-FC01-4F16-866E-07E6BD439FCF Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- iQEcBAEBAgAGBQJS9qj5AAoJEJz/fXByZmLZtCMH/2EEVcSUFNhiCKCE0RkiGVMb mHkp55/J+5YzR78nMcL9QODnUWEu95p/XWif7uC0P5aJQTEAqz3DhQmBLX+1yNMZ 1F4lI4Kl5NrGUn1dPZ5akGizYlb3cpBSbPdLd2G9U5i+7GAaNf41CYN7P6ANvRZC IeoK0b9xlrdvSATgzxXsL2iCLe1qck41ZYLrRbrINMCPuF5qjP8MU7babpjhBRmZ R+HzpdUQ28RB5x14AK3LE9rbMdGaIir98MrzAwcj0U9nh0qQaq2bVr40NtGLOhwI EEuzboOS8t4z6BjIvNs7exOJEVn5hGcrRW4RXX+4MylSoufV8q79vTbkUizvQe8= =gU3Y -----END PGP SIGNATURE----- --Apple-Mail=_A8137A4D-FC01-4F16-866E-07E6BD439FCF-- From contact@taoeffect.com Sat Feb 8 14:13:31 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB5DA1A0621 for ; Sat, 8 Feb 2014 14:13:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.334 X-Spam-Level: X-Spam-Status: No, score=-1.334 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_SOFTFAIL=0.665] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fI2e4qPZv9rb for ; Sat, 8 Feb 2014 14:13:29 -0800 (PST) Received: from homiemail-a5.g.dreamhost.com (caiajhbdcagg.dreamhost.com [208.97.132.66]) by ietfa.amsl.com (Postfix) with ESMTP id 99A981A0420 for ; Sat, 8 Feb 2014 14:13:29 -0800 (PST) Received: from homiemail-a5.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a5.g.dreamhost.com (Postfix) with ESMTP id 1D8FB70406A; Sat, 8 Feb 2014 14:13:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=taoeffect.com; h= content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; s=taoeffect.com; bh=87p7oZOw280T3ZNVv XMwJYAnVRI=; b=moFauTUUNIApUooYGrVYyt/RcFlsB2qc2DDaPKoA0ZGKYUWPs Sls7CvviIPg2HMBPbZ2kxB4sKcfcNukPtjjDhh5OVsy2bgh7svXatHakIfZZxEOo btHwN97ZyyAC8aAktgznp2to2ZZNGEFEDi34Ls/PtYq+B/2sZi8RFdkjHg= Received: from [192.168.1.7] (173-31-103-210.client.mchsi.com [173.31.103.210]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: contact@taoeffect.com) by homiemail-a5.g.dreamhost.com (Postfix) with ESMTPSA id 585A0704060; Sat, 8 Feb 2014 14:13:29 -0800 (PST) Content-Type: multipart/signed; boundary="Apple-Mail=_FE69326E-226A-42C6-B2AE-555F458A3D17"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\)) From: Tao Effect In-Reply-To: <23D8B61D-A198-40FB-9672-83AF23018AE9@vpnc.org> Date: Sat, 8 Feb 2014 16:13:23 -0600 Message-Id: <28A83700-B9E8-4FA2-BC39-EAAF967871C8@taoeffect.com> References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> <20140207193212.GQ22727@crankycanuck.ca> <32201143-1945-4705-A240-522F41535545@taoeffect.com> <23D8B61D-A198-40FB-9672-83AF23018AE9@vpnc.org> To: Paul Hoffman X-Mailer: Apple Mail (2.1827) Cc: therightkey@ietf.org Subject: Re: [therightkey] First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Feb 2014 22:13:32 -0000 --Apple-Mail=_FE69326E-226A-42C6-B2AE-555F458A3D17 Content-Type: multipart/alternative; boundary="Apple-Mail=_45D350F1-8139-4E79-AE66-191C282AD788" --Apple-Mail=_45D350F1-8139-4E79-AE66-191C282AD788 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Paul, Your understanding is incorrect. > If the idea is that I can get a certificate with paulehoffman.dns=20 That is not the idea. Docs are on GitHub, and I know you're smart enough = to comprehend them. > If this TLD gets allocated to someone else, or gets blocked by = middleboxes It cannot get allocated by anyone else. It is designed specifically for = DNSChain servers, and they will not look that up in the old DNS = networks. You can definitely fork the 120k and own it on the old network. It = doesn't matter. Documentation, that has gone through considerable improvements in the = last 24 hours, is still available at the same URL: https://github.com/okTurtles/dnschain Cheers, Greg -- Please do not email me anything that you are not comfortable also = sharing with the NSA. On Feb 8, 2014, at 4:00 PM, Paul Hoffman wrote: > On Feb 7, 2014, at 7:48 PM, Tao Effect wrote: >=20 >> It's a meta-TLD, not a TLD. >=20 > Say what? If the idea is that I can get a certificate with = paulehoffman.dns put in the field reserved for domain names, and have = that accepted by TLS servers, it is a TLD. No "meta". >=20 > If this TLD gets allocated to someone else, or gets blocked by = middleboxes, you have no one to blame but yourself. It would be = *trivial* to avoid this problem by buying an SLD and pre-paying for 20 = years of registration. >=20 > --Paul Hoffman > _______________________________________________ > therightkey mailing list > therightkey@ietf.org > https://www.ietf.org/mailman/listinfo/therightkey --Apple-Mail=_45D350F1-8139-4E79-AE66-191C282AD788 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Paul,

Your understanding is = incorrect.

If the = idea is that I can get a certificate with = paulehoffman.dns 

That is not the idea. = Docs are on GitHub, and I know you're smart enough to comprehend = them.

If= this TLD gets allocated to someone else, or gets blocked by = middleboxes

It cannot get allocated by anyone = else. It is designed specifically for DNSChain servers, and they will = not look that up in the old DNS networks.

You = can definitely fork the 120k and own it on the old network. It doesn't = matter.

Documentation, that has gone through = considerable improvements in the last 24 hours, is still available at = the same URL:


Cheers,
Greg

--
Please do not email me anything that you are not comfortable also = sharing with the NSA.

On Feb 8, 2014, at 4:00 PM, Paul Hoffman <paul.hoffman@vpnc.org> = wrote:

On Feb 7, 2014, at 7:48 PM, Tao Effect <contact@taoeffect.com> = wrote:

It's a meta-TLD, not a = TLD.

Say what? If the idea is that I can get a = certificate with paulehoffman.dns put in the field reserved for domain = names, and have that accepted by TLS servers, it is a TLD. No = "meta".

If this TLD gets allocated to someone else, or gets = blocked by middleboxes, you have no one to blame but yourself. It would = be *trivial* to avoid this problem by buying an SLD and pre-paying for = 20 years of registration.

--Paul = Hoffman
_______________________________________________
therightkey = mailing list
therightkey@ietf.org
https://w= ww.ietf.org/mailman/listinfo/therightkey

<= /body>= --Apple-Mail=_45D350F1-8139-4E79-AE66-191C282AD788-- --Apple-Mail=_FE69326E-226A-42C6-B2AE-555F458A3D17 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJS9qwGAAoJEOxnICvpCVJH2DMQAM280JwA+Cfw5EypM4EsXvJz HkQussiumCAmCnQnsMNtLF2NJuKO7RvACT8F35TWeG3lPrK3QILlar9DgrnWIqgV nUkx1k8AjGCFNG7mHzmdRbeBkXN7e5oWfn1K8XtVwwrGikhN0ALbqxqD/qjehXwU RCYoBFk6UosxaPX8p8rESVRmOG/0cAaYV8NOQ0x6ZRtIxvlScQu7+0BxCSO6ZQqs zTMyq8y4GWVoROLspnLHlqS8QCtBN0zquxlcE41gi/jcT/kdKn9pYoV+sWGcrEZz ET1XcOj3aCPKg9zxjUp9j+eWGMS3326Abs/vHycE9GszExPrPb62HakM7JLr0eL5 qh0U/7PxEwWGHDG4eVedXla5rDzwQfv0GZCyqS3uouL7nsSy26cCpdO2qjAmCk+j A0IBpyjlVPOy44oPkK++q6folG6ZapXxZoXwz2afqRoqWiOK7pXT9z9tswydrY41 KnpQXvCHIE4HiBsEaMjvxTMHvrtY7O+VfBYjsCM3q9DkbebCZHptKY9Sn448OX7M Nc8DPMCGma5Bq3Q7ZSRpJAzneYrh3DC0v6pTVlV4h25XbH1gNKb3emazuBBMSfPy lv6EGcXS+7/2Ji++54hqzQ92mecNxrqqgcXw1cAHgK6SAo2NAqpH/m5sz+ki+FW3 c4FJRIbQ9MOXe4bW+R/1 =UptF -----END PGP SIGNATURE----- --Apple-Mail=_FE69326E-226A-42C6-B2AE-555F458A3D17-- From contact@taoeffect.com Sat Feb 8 14:29:17 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5AD2F1A0613 for ; Sat, 8 Feb 2014 14:29:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.334 X-Spam-Level: X-Spam-Status: No, score=-1.334 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_SOFTFAIL=0.665] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wJXWytg_zwZQ for ; Sat, 8 Feb 2014 14:29:15 -0800 (PST) Received: from homiemail-a4.g.dreamhost.com (caiajhbdccah.dreamhost.com [208.97.132.207]) by ietfa.amsl.com (Postfix) with ESMTP id 3EFAE1A060E for ; Sat, 8 Feb 2014 14:29:15 -0800 (PST) Received: from homiemail-a4.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a4.g.dreamhost.com (Postfix) with ESMTP id C5D1015C001; Sat, 8 Feb 2014 14:29:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=taoeffect.com; h= content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; s=taoeffect.com; bh=1gQ8TqQo4S9Pq1kfW 09Eoozui7M=; b=QwdUiB3vGDPH+Zvle/Mr9Qw3Oi1WJNY+KFKsPvw0aNJblj8Uc Tpz7czKG7IlIE3lJi2l9C+0eKrzVOKF3QsbW3rMBH6rfGjwEgrMzWAsjDckyBX5B 1A7TDWfetsaIJj10EU/bShRtbDAT9oLYXTi16YuXhbySjk0bgMS6sTr+oo= Received: from [192.168.1.7] (173-31-103-210.client.mchsi.com [173.31.103.210]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: contact@taoeffect.com) by homiemail-a4.g.dreamhost.com (Postfix) with ESMTPSA id D95C551C069; Sat, 8 Feb 2014 14:29:14 -0800 (PST) Content-Type: multipart/signed; boundary="Apple-Mail=_D58EB991-D5BD-4D6D-853C-F3D0D87D1D8D"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\)) From: Tao Effect In-Reply-To: <28A83700-B9E8-4FA2-BC39-EAAF967871C8@taoeffect.com> Date: Sat, 8 Feb 2014 16:29:12 -0600 Message-Id: <2E172F95-FDC3-46D0-9F10-540C925165DB@taoeffect.com> References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> <20140207193212.GQ22727@crankycanuck.ca> <32201143-1945-4705-A240-522F41535545@taoeffect.com> <23D8B61D-A198-40FB-9672-83AF23018AE9@vpnc.org> <28A83700-B9E8-4FA2-BC39-EAAF967871C8@taoeffect.com> To: Tao Effect Support X-Mailer: Apple Mail (2.1827) Cc: therightkey@ietf.org, Paul Hoffman Subject: Re: [therightkey] First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Feb 2014 22:29:17 -0000 --Apple-Mail=_D58EB991-D5BD-4D6D-853C-F3D0D87D1D8D Content-Type: multipart/alternative; boundary="Apple-Mail=_CCA03D1D-E047-4243-A092-48C991A81224" --Apple-Mail=_CCA03D1D-E047-4243-A092-48C991A81224 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii I think I might be partly responsible for the misunderstanding expressed = in this thread. I had failed to protest the comparison of a meta-TLD like *.dns to *.bit = and *.onion. They are not the same thing at all, and hence the difference in = terminology. I think I was able to state the difference more clearly and succinctly = in another list, so hopefully it might help here: *.dns is a meta-TLD. You cannot register meta-TLDs. You own them = already. There is therefore no need to register them. There might exist = other terms for this concept, but I wasn't aware of them. Cheers, Greg -- Please do not email me anything that you are not comfortable also = sharing with the NSA. On Feb 8, 2014, at 4:13 PM, Tao Effect wrote: > Paul, >=20 > Your understanding is incorrect. >=20 >> If the idea is that I can get a certificate with paulehoffman.dns=20 >=20 > That is not the idea. Docs are on GitHub, and I know you're smart = enough to comprehend them. >=20 >> If this TLD gets allocated to someone else, or gets blocked by = middleboxes >=20 > It cannot get allocated by anyone else. It is designed specifically = for DNSChain servers, and they will not look that up in the old DNS = networks. >=20 > You can definitely fork the 120k and own it on the old network. It = doesn't matter. >=20 > Documentation, that has gone through considerable improvements in the = last 24 hours, is still available at the same URL: >=20 > https://github.com/okTurtles/dnschain >=20 > Cheers, > Greg >=20 > -- > Please do not email me anything that you are not comfortable also = sharing with the NSA. >=20 > On Feb 8, 2014, at 4:00 PM, Paul Hoffman = wrote: >=20 >> On Feb 7, 2014, at 7:48 PM, Tao Effect wrote: >>=20 >>> It's a meta-TLD, not a TLD. >>=20 >> Say what? If the idea is that I can get a certificate with = paulehoffman.dns put in the field reserved for domain names, and have = that accepted by TLS servers, it is a TLD. No "meta". >>=20 >> If this TLD gets allocated to someone else, or gets blocked by = middleboxes, you have no one to blame but yourself. It would be = *trivial* to avoid this problem by buying an SLD and pre-paying for 20 = years of registration. >>=20 >> --Paul Hoffman >> _______________________________________________ >> therightkey mailing list >> therightkey@ietf.org >> https://www.ietf.org/mailman/listinfo/therightkey >=20 > _______________________________________________ > therightkey mailing list > therightkey@ietf.org > https://www.ietf.org/mailman/listinfo/therightkey --Apple-Mail=_CCA03D1D-E047-4243-A092-48C991A81224 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii I = think I might be partly responsible for the misunderstanding expressed = in this thread.

I had failed to protest the = comparison of a meta-TLD like *.dns to *.bit and = *.onion.

They are not the same thing at all, = and hence the difference in terminology.

I = think I was able to state the difference more clearly and succinctly in = another list, so hopefully it might help = here:

*.dns is a meta-TLD. You cannot = register meta-TLDs. You own them already. There is therefore no need to = register them. There might exist other terms for this concept, but I = wasn't aware of = them.

Cheers,
Greg

--
Please do not email me anything that you are not comfortable also = sharing with the NSA.

On Feb 8, 2014, at 4:13 PM, Tao Effect <contact@taoeffect.com> = wrote:

Paul,

Your understanding is = incorrect.

If the = idea is that I can get a certificate with = paulehoffman.dns 

That is not the idea. = Docs are on GitHub, and I know you're smart enough to comprehend = them.

If= this TLD gets allocated to someone else, or gets blocked by = middleboxes

It cannot get allocated by anyone = else. It is designed specifically for DNSChain servers, and they will = not look that up in the old DNS networks.

You = can definitely fork the 120k and own it on the old network. It doesn't = matter.

Documentation, that has gone through = considerable improvements in the last 24 hours, is still available at = the same URL:


Cheers,
Greg

--
Please do not email me anything that you are not = comfortable also sharing with the NSA.

On Feb 8, 2014, at 4:00 PM, Paul Hoffman <paul.hoffman@vpnc.org> = wrote:

On Feb 7, 2014, at 7:48 PM, Tao Effect <contact@taoeffect.com> = wrote:

It's a meta-TLD, not a = TLD.

Say what? If the idea is that I can get a = certificate with paulehoffman.dns put in the field reserved for domain = names, and have that accepted by TLS servers, it is a TLD. No = "meta".

If this TLD gets allocated to someone else, or gets = blocked by middleboxes, you have no one to blame but yourself. It would = be *trivial* to avoid this problem by buying an SLD and pre-paying for = 20 years of registration.

--Paul = Hoffman
_______________________________________________
therightkey = mailing list
therightkey@ietf.org
https://www.iet= f.org/mailman/listinfo/therightkey

_______________________________________________
therightkey = mailing list
therightkey@ietf.org
https://w= ww.ietf.org/mailman/listinfo/therightkey

<= /body>= --Apple-Mail=_CCA03D1D-E047-4243-A092-48C991A81224-- --Apple-Mail=_D58EB991-D5BD-4D6D-853C-F3D0D87D1D8D Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJS9q+4AAoJEOxnICvpCVJHEN4P/jrcyKa3zRfgscUFpk0Vma1k CRwKYfNmUY2Gvhn2AGPR1zo4iE2BXCEhjOSzHhlhmysRdBB5n0x0DkR7rkMaKVM/ EP2rbLks4G4H0Ue5KufGTLsMCmSalM07UYT7v/I8XAgxBiU+MLONyvvF07vYRKMl AELBZC0PiQ3919O/iARsKVc+/vZkcJ97kQP5UzP+kI0Q3koQQauE03R6c8lysAGD 0ElVY1bBrOrhVLEmaZFnkudumSC22v3hGztCH6+TySjbrtXb9cu1647IFus5MSlg UDOv7QFMb9eN/14f89XoC58QUVihptMpwy/n5D2DP3yv2ll0q4nBsaCYtVuiJHHR PPt9rHj2mQ3UeXW7EL2NM8O7vAvraUtQxPLJEVcpBjJV1Gx9lhmkOMqghR1j9gIK vctgD+NsfNyKYUZL5N5S0fW4wn8SMIwslWMnkXxn9Gt2pfheX7dfmtF4iizgJKVd wi4PGeE/CfE4k6kkJNFrHGKvVGdMW2fBIRCav0S4GyjoUgoeg9GVlr+AM3+fxUPT bQKObLlkBx+aVxsJlibm/D590GhXnH8Qj/s08R7uj/N1Qic3n9z9OTGX3wB/h13G PaFpWgitJufizoQlUMlZH+EX2T2MJLoajwEmH4m0wwGQrARlRYAj0FjJDpg2tKn2 tieOJQUQQJtrllvxdJtV =P7+0 -----END PGP SIGNATURE----- --Apple-Mail=_D58EB991-D5BD-4D6D-853C-F3D0D87D1D8D-- From paul@nohats.ca Sat Feb 8 14:30:29 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8BE041A03CA for ; Sat, 8 Feb 2014 14:30:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.649 X-Spam-Level: X-Spam-Status: No, score=-0.649 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-0.548] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vnRX5dX7Bxk8 for ; Sat, 8 Feb 2014 14:30:27 -0800 (PST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) by ietfa.amsl.com (Postfix) with ESMTP id 444121A01C0 for ; Sat, 8 Feb 2014 14:30:27 -0800 (PST) Received: from bofh.nohats.ca (bofh.nohats.ca [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id C91EC800AA; Sat, 8 Feb 2014 17:30:26 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1391898626; bh=o7yqR/X3J7GMvmpuKDtR0yhHRFnfCCZR/issl1Qy458=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=MFS6lcFiU/+16YvRrPqw8mJJg6uorPyu9xeDEF7qrBQ1ELj0fTP/igQeZ0mEj7xHr yd1VCAk5/UN6qYwEBpVip1gQjXuGDJTvk9KHhMic09lXWEo/AOjtwuKTX1lGLzpDF0 ILJY0iA4ti98DZNUTc0Wfd5NmV+LfDqDUnX03Jbw= Received: from localhost (paul@localhost) by bofh.nohats.ca (8.14.7/8.14.7/Submit) with ESMTP id s18MUP0R003459; Sat, 8 Feb 2014 17:30:26 -0500 X-Authentication-Warning: bofh.nohats.ca: paul owned process doing -bs Date: Sat, 8 Feb 2014 17:30:25 -0500 (EST) From: Paul Wouters To: Tao Effect In-Reply-To: <28A83700-B9E8-4FA2-BC39-EAAF967871C8@taoeffect.com> Message-ID: References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> <20140207193212.GQ22727@crankycanuck.ca> <32201143-1945-4705-A240-522F41535545@taoeffect.com> <23D8B61D-A198-40FB-9672-83AF23018AE9@vpnc.org> <28A83700-B9E8-4FA2-BC39-EAAF967871C8@taoeffect.com> User-Agent: Alpine 2.10 (LFD 1266 2009-07-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: therightkey@ietf.org Subject: Re: [therightkey] First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Feb 2014 22:30:29 -0000 On Sat, 8 Feb 2014, Tao Effect wrote: > It cannot get allocated by anyone else. It is designed specifically for DNSChain servers, and they will not look that up in > the old DNS networks. Then why do you care about the "real" .dns TLD? Paul From contact@taoeffect.com Sat Feb 8 14:33:36 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4818F1A047A for ; Sat, 8 Feb 2014 14:33:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.334 X-Spam-Level: X-Spam-Status: No, score=-1.334 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_SOFTFAIL=0.665] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1HGt4p2sYVF1 for ; Sat, 8 Feb 2014 14:33:35 -0800 (PST) Received: from homiemail-a3.g.dreamhost.com (caiajhbdccah.dreamhost.com [208.97.132.207]) by ietfa.amsl.com (Postfix) with ESMTP id EF0BC1A01C0 for ; Sat, 8 Feb 2014 14:33:34 -0800 (PST) Received: from homiemail-a3.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a3.g.dreamhost.com (Postfix) with ESMTP id 8F712284071; Sat, 8 Feb 2014 14:33:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=taoeffect.com; h= content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; s=taoeffect.com; bh=x1OV6sz8GWBIE2cyH LP6x7qzojs=; b=qYWUwPThZ8JzzBWtJzUMV3Ab+2kSAKFYVTjTm6W1L4InstxoV +4QJQ8JoSP2yBycJQoBGnYa+vH26ifn/TBwqdPjr0JBfCHCliBkKbWCvPdioG6DC VTcbGvjn7COCBjm4h3TjtxQiQxXmdW1kN5wBgxV7d7WK3EU+iqRd1ANnQ8= Received: from [192.168.1.7] (173-31-103-210.client.mchsi.com [173.31.103.210]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: contact@taoeffect.com) by homiemail-a3.g.dreamhost.com (Postfix) with ESMTPSA id C23CE28406E; Sat, 8 Feb 2014 14:33:34 -0800 (PST) Content-Type: multipart/signed; boundary="Apple-Mail=_1E652CBD-96A2-4EFF-8858-84DC8E7C13C4"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\)) From: Tao Effect In-Reply-To: Date: Sat, 8 Feb 2014 16:33:32 -0600 Message-Id: References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> <20140207193212.GQ22727@crankycanuck.ca> <32201143-1945-4705-A240-522F41535545@taoeffect.com> <23D8B61D-A198-40FB-9672-83AF23018AE9@vpnc.org> <28A83700-B9E8-4FA2-BC39-EAAF967871C8@taoeffect.com> To: Paul Wouters X-Mailer: Apple Mail (2.1827) Cc: therightkey@ietf.org Subject: Re: [therightkey] First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Feb 2014 22:33:36 -0000 --Apple-Mail=_1E652CBD-96A2-4EFF-8858-84DC8E7C13C4 Content-Type: multipart/alternative; boundary="Apple-Mail=_898ADDA4-326C-4302-A3A5-8FC570856FBF" --Apple-Mail=_898ADDA4-326C-4302-A3A5-8FC570856FBF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Feb 8, 2014, at 4:30 PM, Paul Wouters wrote: > Then why do you care about the "real" .dns TLD? Not sure what statements of mine you're referring to... feel free to = quote them. I don't want to misunderstand you. -- Please do not email me anything that you are not comfortable also = sharing with the NSA. --Apple-Mail=_898ADDA4-326C-4302-A3A5-8FC570856FBF Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii On Feb = 8, 2014, at 4:30 PM, Paul Wouters <paul@nohats.ca> = wrote:

Then why do you care about the = "real" .dns TLD?

Not sure what statements = of mine you're referring to... feel free to quote them. I don't want to = misunderstand you.

--
Please do not email me anything that you are not comfortable also = sharing with the NSA.

= --Apple-Mail=_898ADDA4-326C-4302-A3A5-8FC570856FBF-- --Apple-Mail=_1E652CBD-96A2-4EFF-8858-84DC8E7C13C4 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJS9rC8AAoJEOxnICvpCVJHwFkQAJZ72RA9KYwv94irPFoVjttM Ui1kVCzozZ+rjLeDYc7t7tQe1RTQ+J29aj/e7KT4r5R6Wu2uLYima5FYcIWQrCuu wqHb4KHaajHd/1n9dgHtofzHBiL3ojvXpwwpsMbHH0GcSHTi4KgHVvDi7SxjHSZI TlyDVGj3daYUUM0yljPvrwdMszO/+rk8EOU2fdOJrS7DShuzL6E17+bUO9/NX13T 7ixXxqMsAqPSBjhui1xc0AVVxDoIIO0Z7Sq/2LPSAnUTyohsB5xP+uAQ194deBJj XoVX7CWYf9QjEJzD5VfraCWbQY76MV8VYU8KDHFClxL85Jcb+qQ0WzCxcBaBhknj A5hP/J0OfpAXbVB8hK1hQIbdsY+Fc7WFqdR3CbvSNMVU3MKN+7+A3VdC0kKd3BE4 MiY90MMqXGTcJd5ArcZndjqZU5jUS/pJfi0GPKtiHFPYiEg6Q1rMz4zE5qFjEI4d +f2L5e6xaPYPe17RvaWqnXGugM/6DoR5m73eK24huvYUVJOaQAuiwCbuei0OzSLt hRXC0mf06vv/wRDiTkmbuVXjQ4/DWasbvnef3DFL54KpEG5GR6Vnhx1tMcd/GFJl /0YnUdj8udxQpURQSBUzQTMcyJm7YSZVL8UWMCyY8qkFuVjtn6hfJy3cE5oNCWmA YdXSayVgvMJEaHRkKKRz =O2UL -----END PGP SIGNATURE----- --Apple-Mail=_1E652CBD-96A2-4EFF-8858-84DC8E7C13C4-- From hallam@gmail.com Sat Feb 8 18:12:12 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE9341A0673 for ; Sat, 8 Feb 2014 18:12:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5ZnoTrjv-FOh for ; Sat, 8 Feb 2014 18:12:09 -0800 (PST) Received: from mail-lb0-x236.google.com (mail-lb0-x236.google.com [IPv6:2a00:1450:4010:c04::236]) by ietfa.amsl.com (Postfix) with ESMTP id 653791A066E for ; Sat, 8 Feb 2014 18:12:09 -0800 (PST) Received: by mail-lb0-f182.google.com with SMTP id w7so3752465lbi.41 for ; Sat, 08 Feb 2014 18:12:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=AaZiDrJl+xk4xsi/BFVCCZ4aF1b1+8FxMe63lHGcuSg=; b=BwLLVdC7xUMZs9jH2RFPvnjGWwW1kvDK74P/0qGrvV+dmDRXfNjUM7F7rONywygkgI +VIhUB1ITVbQCwaG+dnMLbxgufWVAAzEgkBFwUhzcSHCxA6cVvdLHnhx8sxpKnWZUHX3 x9L6UnqzPT2m6Mkww4YW1Oz+tL4p4lZ6tqbrzNLGSyTxMWTYXIqv1Dc4XsU9CUpUEbNN T3OCBihvmHIsMceuKmxsL5NvTLaSwMBcSq6IlXNEgb9oGQFG6ujMF6NEcWrdFWbe5k4i BcCrvJ98XBYk4D7CF2GAgVMVZD6heZZhTviRe1S6Tt+DUkFo8220SpBMot5c8B+6xJGZ 9rXA== MIME-Version: 1.0 X-Received: by 10.152.8.47 with SMTP id o15mr16235542laa.20.1391911929015; Sat, 08 Feb 2014 18:12:09 -0800 (PST) Received: by 10.112.37.168 with HTTP; Sat, 8 Feb 2014 18:12:08 -0800 (PST) In-Reply-To: <23D8B61D-A198-40FB-9672-83AF23018AE9@vpnc.org> References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> <20140207193212.GQ22727@crankycanuck.ca> <32201143-1945-4705-A240-522F41535545@taoeffect.com> <23D8B61D-A198-40FB-9672-83AF23018AE9@vpnc.org> Date: Sat, 8 Feb 2014 21:12:08 -0500 Message-ID: From: Phillip Hallam-Baker To: Paul Hoffman Content-Type: multipart/alternative; boundary=001a11c36402166ff204f1efc01e Cc: "therightkey@ietf.org" , Tao Effect Subject: Re: [therightkey] First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Feb 2014 02:12:12 -0000 --001a11c36402166ff204f1efc01e Content-Type: text/plain; charset=ISO-8859-1 On Sat, Feb 8, 2014 at 5:00 PM, Paul Hoffman wrote: > On Feb 7, 2014, at 7:48 PM, Tao Effect wrote: > > > It's a meta-TLD, not a TLD. > > Say what? If the idea is that I can get a certificate with > paulehoffman.dns put in the field reserved for domain names, and have that > accepted by TLS servers, it is a TLD. No "meta". > > If this TLD gets allocated to someone else, or gets blocked by > middleboxes, you have no one to blame but yourself. It would be *trivial* > to avoid this problem by buying an SLD and pre-paying for 20 years of > registration. > Paul, Why would anyone need a certificate in this system? The binding to a public key is intrinsic to the whole naming architecture. Come to that, why would anyone need .dns??? If namecoin is going to replace the DNS, why make the mistake of upper level hierarchy? Surely the new system should be the apex of the hierarchy and the legacy DNS subordinated under .icann. I do have a solution though. There are some TLDs that are not expletives that are almost certain to be permanently withheld from issue. I suggest they consider using .pot or .weed. -- Website: http://hallambaker.com/ --001a11c36402166ff204f1efc01e Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable



On Sat, Feb 8, 2014 at 5:00 PM, Paul Hoffman <= paul.hoffman@vpn= c.org> wrote:
On Feb 7, 2014, at 7:48 PM, = Tao Effect <contact@taoeffect.c= om> wrote:

> It's a meta-TLD, not a TLD.

Say what? If the idea is that I can get a certificate with paulehoffm= an.dns put in the field reserved for domain names, and have that accepted b= y TLS servers, it is a TLD. No "meta".

If this TLD gets allocated to someone else, or gets blocked by middleboxes,= you have no one to blame but yourself. It would be *trivial* to avoid this= problem by buying an SLD and pre-paying for 20 years of registration.

Paul,=A0

Why woul= d anyone need a certificate in this system? The binding to a public key is = intrinsic to the whole naming architecture.

Come t= o that, why would anyone need .dns??? If namecoin is going to replace the D= NS, why make the mistake of upper level hierarchy? Surely the new system sh= ould be the apex of the hierarchy and the legacy DNS subordinated under .ic= ann.


I do have a solution though. There are s= ome TLDs that are not expletives that are almost certain to be permanently = withheld from issue. I suggest they consider using .pot or .weed.


=A0
--
Website: http://hallambaker.com/
--001a11c36402166ff204f1efc01e-- From contact@taoeffect.com Sun Feb 9 17:10:47 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 789611A0654 for ; Sun, 9 Feb 2014 17:10:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.066 X-Spam-Level: X-Spam-Status: No, score=0.066 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_SOFTFAIL=0.665] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C8u4DcsRqnZN for ; Sun, 9 Feb 2014 17:10:44 -0800 (PST) Received: from homiemail-a6.g.dreamhost.com (caiajhbdcbef.dreamhost.com [208.97.132.145]) by ietfa.amsl.com (Postfix) with ESMTP id C60221A051B for ; Sun, 9 Feb 2014 17:10:44 -0800 (PST) Received: from homiemail-a6.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a6.g.dreamhost.com (Postfix) with ESMTP id 98BE2598074 for ; Sun, 9 Feb 2014 17:10:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=taoeffect.com; h=from :content-type:message-id:mime-version:subject:date:references:to :in-reply-to; s=taoeffect.com; bh=Uyvw73wRxzuw83/FY0HC8oMAt9c=; b=EoNQrL95kV4c3vTNSBnI0F33rjdHn/6AjQvicpAmTajmKos8q5hP7G9Gj+DJE yQxlYydjk3FFrc6vBOh37CiKLMJ7lAdfZvbu8L6P9Sk5e7TCR9P4/U4jZqltQDP6 i+vkKFPSni+H3zCsomS2iXFfUMDBiWC3W4pC2wOMaEdr/Q= Received: from [192.168.1.7] (173-31-103-210.client.mchsi.com [173.31.103.210]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: contact@taoeffect.com) by homiemail-a6.g.dreamhost.com (Postfix) with ESMTPSA id C4EBB59806C for ; Sun, 9 Feb 2014 17:10:43 -0800 (PST) From: Tao Effect Content-Type: multipart/signed; boundary="Apple-Mail=_4035A5B2-C389-4718-8786-94B9F5B373B5"; protocol="application/pgp-signature"; micalg=pgp-sha512 Message-Id: Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\)) Date: Sun, 9 Feb 2014 19:10:35 -0600 References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> <20140207193212.GQ22727@crankycanuck.ca> <32201143-1945-4705-A240-522F41535545@taoeffect.com> <23D8B61D-A198-40FB-9672-83AF23018AE9@vpnc.org> To: "therightkey@ietf.org" In-Reply-To: X-Mailer: Apple Mail (2.1827) Subject: Re: [therightkey] First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Feb 2014 01:10:47 -0000 --Apple-Mail=_4035A5B2-C389-4718-8786-94B9F5B373B5 Content-Type: multipart/alternative; boundary="Apple-Mail=_997E4934-B7D8-4186-B66E-DDCF6CC93A45" --Apple-Mail=_997E4934-B7D8-4186-B66E-DDCF6CC93A45 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 DNSChain 0.0.1 was just released and published to NPM! You can now use NPM to install it on servers. :-) https://npmjs.org/package/dnschain Next up: response signing (and more!). Cheers! Greg -- Please do not email me anything that you are not comfortable also = sharing with the NSA. --Apple-Mail=_997E4934-B7D8-4186-B66E-DDCF6CC93A45 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=iso-8859-1 DNSChain 0.0.1 was just released = and published to NPM!

You can now use NPM to install = it on servers. :-)


Next up: response signing (and = more!).

Cheers!
Greg

--
Please do not email me anything that you are not comfortable also = sharing with the NSA.

= --Apple-Mail=_997E4934-B7D8-4186-B66E-DDCF6CC93A45-- --Apple-Mail=_4035A5B2-C389-4718-8786-94B9F5B373B5 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJS+CcPAAoJEOxnICvpCVJH1foQAMZZXLxCtZnv1GcWg5PkL75n uva99T7Ko1CSBFreQduGomo9n/5QgeuVMKLzkyFbuHIoLhVHcgjlYXyWMeFbctot IDAwjeVm1IKy4O/jDIYF1aX6+pripeDFUgIkxMajanvyRRVtrWRPmMQxtj6dqQVq xxHDLgrdOkjkR6g5zHs7KrPIonRxDiiemYJiJlKGivTeUMxq7JCfK/WZ6o0gkII9 tV+QSktTm2/TAfmbLuwKeN4gEx+LhM6y7c+eHoHLHShdfTg+WVeqIpkcBdO6MPa0 l6ky6gyoQ75Bs9rhl+KUWn4CeyrYLMFU8FsFHVYSSpKqZweyFdLgp6xr2Yso2KnD cEVLXspEZ3s3KuVr+ghfTCYcDueG+sAFRqtPmuw+iPpoyTc/uVIQWbvDnfJIbj8C hgJ3FAiZSDfPt55iFvSZyWfvSWJeTSH1xL8dKK7G/uJCmUO0WeXdZXbZxwK2DYZO joW4Z4DF/BVf/PgXUjGD33yABqSswSkeTxHW9o3Oz+ChVkBlys6s+vSyVynuP79W f3omUF+jPEMEP2r+RoGKmHHUdwd3spqWOZ9umwgqKQrCDJ+9ahz5a46bIV6t9cir rxh6KfcpaGg8dFbq+WYUkYxc+9kRgJ544MbrSH5epz/0ZxFB4JjnbsEnMqqlfA5x 0aIsqMMuk03XXPo3iGQz =y/Bu -----END PGP SIGNATURE----- --Apple-Mail=_4035A5B2-C389-4718-8786-94B9F5B373B5-- From rob.stradling@comodo.com Mon Feb 10 02:13:44 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9AEC01A05DE for ; Mon, 10 Feb 2014 02:13:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.11 X-Spam-Level: X-Spam-Status: No, score=0.11 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, HELO_MISMATCH_NET=0.611, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Be-czQoH13vI for ; Mon, 10 Feb 2014 02:13:41 -0800 (PST) Received: from ian.brad.office.comodo.net (eth5.brad-fw.brad.office.ccanet.co.uk [178.255.87.226]) by ietfa.amsl.com (Postfix) with ESMTP id 0E96F1A07D5 for ; Mon, 10 Feb 2014 02:13:40 -0800 (PST) Received: (qmail 8487 invoked by uid 1000); 10 Feb 2014 10:13:37 -0000 Received: from nigel.brad.office.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (CAMELLIA256-SHA encrypted) ESMTPSA; Mon, 10 Feb 2014 10:13:37 +0000 Message-ID: <52F8A650.6060209@comodo.com> Date: Mon, 10 Feb 2014 10:13:36 +0000 From: Rob Stradling User-Agent: Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20100101 Thunderbird/24.1.1 MIME-Version: 1.0 To: certificate-transparency@googlegroups.com References: <52F25835.60702@comodo.com> <52F27445.6040701@comodo.com> <52F2811A.9030800@comodo.com> In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: "therightkey@ietf.org" , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Feb 2014 10:13:44 -0000 On 08/02/14 13:32, Ben Laurie wrote: > On 5 February 2014 18:21, Rob Stradling wrote: >> On 05/02/14 17:49, Adam Langley wrote: >>> >>> On Wed, Feb 5, 2014 at 12:26 PM, Rob Stradling >>> wrote: >>>> >>>> Presumably it's somewhere between 10 and 31 days, since 1 SCT is >>>> acceptable >>>> for Stapled OCSP and the BRs permit OCSP Responses to be valid for up to >>>> 10 >>>> days. >>> >>> >>> The speed at which we need to distrust a log depends on the minimum >>> number of SCTs actually, which is why allowing a single SCT in stapled >>> OCSP responses is such a large concession. If the minimum number of >>> SCTs were two then the pressure to distrust a log (and the pressure on >>> the logs) would be dramatically reduced because compromising one log >>> wouldn't be sufficient. >>> >>>> Do you still think [1] is a good plan? >>> >>> >>> Sure, if any CAs are willing to do it now :) >> >> >> I think "servers could just download their refreshed certificate over HTTP >> periodically and automatically" is the showstopper at the moment. Yes they >> could, but I'm not aware of any server that actually implements such a >> feature. > > Work is under way for Apache: https://github.com/trawick/ct-httpd/. That looks like great work, but AFAICT it's only for fetching SCTs from CT Logs. I was talking about the lack of any mechanism in popular webserver software for automatically fetching and installing certificates from CAs. In particular: a short-duration certificate that reuses the same public key as the previous certificate. -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From benl@google.com Mon Feb 10 03:35:45 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 316A91A086A for ; Mon, 10 Feb 2014 03:35:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.927 X-Spam-Level: X-Spam-Status: No, score=-1.927 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KWxfbzd80xs6 for ; Mon, 10 Feb 2014 03:35:42 -0800 (PST) Received: from mail-vc0-x22f.google.com (mail-vc0-x22f.google.com [IPv6:2607:f8b0:400c:c03::22f]) by ietfa.amsl.com (Postfix) with ESMTP id 70CCA1A080B for ; Mon, 10 Feb 2014 03:35:42 -0800 (PST) Received: by mail-vc0-f175.google.com with SMTP id ij19so4676566vcb.34 for ; Mon, 10 Feb 2014 03:35:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=gpnpDEng+YUPpRVVBUzVB2G+4v1Tw+cFdGSFtza6UMo=; b=SXe4Hlc9KzYiBFMTWqr3ewfppiTEXQwyR2bLFyTCUsgt7YPVwrtaiVaX5H41HrrCU6 c+zgj/Pkh+OW4bwLsN4LSODPE4AxYM6vaZKNvF79/LWsYaosbPvzIg0dJMmB6IE1bAR5 bTJXi0FoK+s2u2j3YSqK8ZoQQ9+1mmfnKCqClI2sibybhllWfWUdRoXPJelRZewaKVkZ 2hyVqWghJh4Gl5rOoqyPW2Hy8ZaOTkw1qtqwY/f9n/rEUke/eVF6AvWipPT7bKD3sC6Z cBYwKLhl6MrafaV/8LySMJAb9MB3JLssDH+ERA+ATiHSWyTznzHVUuuFofL1si6Vcbhn tC2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=gpnpDEng+YUPpRVVBUzVB2G+4v1Tw+cFdGSFtza6UMo=; b=mxzmNknOByIJIW1lg/ZibO3ispBv1nZbRaATh38lzeWaNCN5aTOe5JFeD3jsL/fmhY 19dsswNyHqwY9b1mMD0mPctFYE4j614lgonUG9sQhEUqimc05nczjZs/61u1iVw8+6oH TwIadd25inFP3pDAX5MGJM8qj2grjv+NXHPtPtW8eydmfV6CfZF7GyMFZLQ+UNFaVTuI tBQtkCDtlMfopliEopmNE1ScfbX/vzhBxrAoQaxTSSlDBbgvpg2+xjdsW/30UesKYm2G 8PrPam+8aSqJ8Jf1wjkwSuZhPcYtD87tOBu7Hlas9ieuV0/t+l0at6ch9oqiYlMqVaHR W78Q== X-Gm-Message-State: ALoCoQlHtAoCClTFpIATowTZ8qI2fzO/o2QfgQXOcMiEJqFxLhbHGhpYnr/4tU4ht3X5+8wnrRmOfGqs1sTo0xf+NVwMWQFr5c4hrtEfZVQmb/2LoTft+jW4zB9PnDzW1ttdx9/L833U1Zzy2PQlr1XvXMzAV11BQcm/Dg8ZTq8VBGKSk9XiwsL+kIVrC3TWUwKHw1130Bcv MIME-Version: 1.0 X-Received: by 10.58.69.111 with SMTP id d15mr23365240veu.3.1392032141688; Mon, 10 Feb 2014 03:35:41 -0800 (PST) Received: by 10.52.230.105 with HTTP; Mon, 10 Feb 2014 03:35:41 -0800 (PST) In-Reply-To: <52F8A650.6060209@comodo.com> References: <52F25835.60702@comodo.com> <52F27445.6040701@comodo.com> <52F2811A.9030800@comodo.com> <52F8A650.6060209@comodo.com> Date: Mon, 10 Feb 2014 11:35:41 +0000 Message-ID: From: Ben Laurie To: "certificate-transparency@googlegroups.com" Content-Type: text/plain; charset=UTF-8 Cc: "therightkey@ietf.org" , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Feb 2014 11:35:45 -0000 On 10 February 2014 10:13, Rob Stradling wrote: > On 08/02/14 13:32, Ben Laurie wrote: >> >> On 5 February 2014 18:21, Rob Stradling wrote: >>> >>> On 05/02/14 17:49, Adam Langley wrote: >>>> >>>> >>>> On Wed, Feb 5, 2014 at 12:26 PM, Rob Stradling >>>> >>>> wrote: >>>>> >>>>> >>>>> Presumably it's somewhere between 10 and 31 days, since 1 SCT is >>>>> acceptable >>>>> for Stapled OCSP and the BRs permit OCSP Responses to be valid for up >>>>> to >>>>> 10 >>>>> days. >>>> >>>> >>>> >>>> The speed at which we need to distrust a log depends on the minimum >>>> number of SCTs actually, which is why allowing a single SCT in stapled >>>> OCSP responses is such a large concession. If the minimum number of >>>> SCTs were two then the pressure to distrust a log (and the pressure on >>>> the logs) would be dramatically reduced because compromising one log >>>> wouldn't be sufficient. >>>> >>>>> Do you still think [1] is a good plan? >>>> >>>> >>>> >>>> Sure, if any CAs are willing to do it now :) >>> >>> >>> >>> I think "servers could just download their refreshed certificate over >>> HTTP >>> periodically and automatically" is the showstopper at the moment. Yes >>> they >>> could, but I'm not aware of any server that actually implements such a >>> feature. >> >> >> Work is under way for Apache: https://github.com/trawick/ct-httpd/. > > > That looks like great work, but AFAICT it's only for fetching SCTs from CT > Logs. > > I was talking about the lack of any mechanism in popular webserver software > for automatically fetching and installing certificates from CAs. In > particular: a short-duration certificate that reuses the same public key as > the previous certificate. Ah, I see! But why would you need it if you can refresh the SCTs yourself? From rob.stradling@comodo.com Mon Feb 10 03:50:18 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC0C21A0820 for ; Mon, 10 Feb 2014 03:50:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.29 X-Spam-Level: X-Spam-Status: No, score=-1.29 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_NET=0.611, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zEB_MkZ9AoYN for ; Mon, 10 Feb 2014 03:50:15 -0800 (PST) Received: from ian.brad.office.comodo.net (eth5.brad-fw.brad.office.ccanet.co.uk [178.255.87.226]) by ietfa.amsl.com (Postfix) with ESMTP id 0A71D1A080B for ; Mon, 10 Feb 2014 03:50:14 -0800 (PST) Received: (qmail 15994 invoked by uid 1000); 10 Feb 2014 11:50:13 -0000 Received: from nigel.brad.office.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (CAMELLIA256-SHA encrypted) ESMTPSA; Mon, 10 Feb 2014 11:50:13 +0000 Message-ID: <52F8BCF5.4060506@comodo.com> Date: Mon, 10 Feb 2014 11:50:13 +0000 From: Rob Stradling User-Agent: Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20100101 Thunderbird/24.1.1 MIME-Version: 1.0 To: certificate-transparency@googlegroups.com References: <52F25835.60702@comodo.com> <52F27445.6040701@comodo.com> <52F2811A.9030800@comodo.com> <52F8A650.6060209@comodo.com> In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Cc: "therightkey@ietf.org" , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Feb 2014 11:50:18 -0000 On 10/02/14 11:35, Ben Laurie wrote: > On 10 February 2014 10:13, Rob Stradling wrote: >> On 08/02/14 13:32, Ben Laurie wrote: >>> >>> On 5 February 2014 18:21, Rob Stradling wrote: >>>> >>>> On 05/02/14 17:49, Adam Langley wrote: >>>>> >>>>> >>>>> On Wed, Feb 5, 2014 at 12:26 PM, Rob Stradling >>>>> >>>>> wrote: >>>>>> >>>>>> >>>>>> Presumably it's somewhere between 10 and 31 days, since 1 SCT is >>>>>> acceptable >>>>>> for Stapled OCSP and the BRs permit OCSP Responses to be valid for up >>>>>> to >>>>>> 10 >>>>>> days. >>>>> >>>>> >>>>> >>>>> The speed at which we need to distrust a log depends on the minimum >>>>> number of SCTs actually, which is why allowing a single SCT in stapled >>>>> OCSP responses is such a large concession. If the minimum number of >>>>> SCTs were two then the pressure to distrust a log (and the pressure on >>>>> the logs) would be dramatically reduced because compromising one log >>>>> wouldn't be sufficient. >>>>> >>>>>> Do you still think [1] is a good plan? >>>>> >>>>> >>>>> >>>>> Sure, if any CAs are willing to do it now :) >>>> >>>> >>>> >>>> I think "servers could just download their refreshed certificate over >>>> HTTP >>>> periodically and automatically" is the showstopper at the moment. Yes >>>> they >>>> could, but I'm not aware of any server that actually implements such a >>>> feature. >>> >>> >>> Work is under way for Apache: https://github.com/trawick/ct-httpd/. >> >> >> That looks like great work, but AFAICT it's only for fetching SCTs from CT >> Logs. >> >> I was talking about the lack of any mechanism in popular webserver software >> for automatically fetching and installing certificates from CAs. In >> particular: a short-duration certificate that reuses the same public key as >> the previous certificate. > > Ah, I see! But why would you need it if you can refresh the SCTs yourself? To fix certificate revocation checking, by avoiding the need for it (as Adam proposed a couple of years ago - see [1]). But really, I was just trying to point out that just because CAs aren't noticeably issuing short-duration certs today, it doesn't mean that they won't do so in the future. So I think it is worth permitting just 1 embedded SCT for short-duration certs (for some value of "short"). [1] https://www.imperialviolet.org/2011/03/18/revocation.html "A much better solution would be for certificates to only be valid for a few days and to forget about revocation altogether. This doesn't mean that the private key needs to change every few days, just the certificate. And the certificate is public data, so servers could just download their refreshed certificate over HTTP periodically and automatically (like OCSP stapling). Clients wouldn't have to perform revocation checks (which are very complex and slow), CAs wouldn't have to pay for massive, DDoS proof serving capacity and revocation would actually work. If the CA went down for six hours, nobody cares. Only if the CA is down for days is there a problem. If you want to “revoke†a certificate, just stop renewing it." -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From Rick_Andrews@symantec.com Mon Feb 10 17:00:06 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9A7E1A0639 for ; Mon, 10 Feb 2014 17:00:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.449 X-Spam-Level: X-Spam-Status: No, score=-7.449 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k29wxuDEBrHb for ; Mon, 10 Feb 2014 17:00:05 -0800 (PST) Received: from tus1smtoutpex01.symantec.com (tus1smtoutpex01.symantec.com [216.10.195.241]) by ietfa.amsl.com (Postfix) with ESMTP id 204BD1A0631 for ; Mon, 10 Feb 2014 17:00:05 -0800 (PST) X-AuditID: d80ac3f1-b7fd78e000001002-52-52f97614c7b8 Received: from tus1opsmtapin01.ges.symantec.com (tus1opsmtapin01.ges.symantec.com [192.168.214.43]) by tus1smtoutpex01.symantec.com (Symantec Brightmail Gateway out) with SMTP id DB.F3.04098.41679F25; Tue, 11 Feb 2014 01:00:04 +0000 (GMT) Received: from [155.64.220.137] (helo=TUS1XCHHUBPIN01.SYMC.SYMANTEC.COM) by tus1opsmtapin01.ges.symantec.com with esmtp (Exim 4.76) (envelope-from ) id 1WD1hk-0005WC-K6; Tue, 11 Feb 2014 01:00:04 +0000 Received: from TUS1XCHEVSPIN33.SYMC.SYMANTEC.COM ([155.64.220.146]) by TUS1XCHHUBPIN01.SYMC.SYMANTEC.COM ([155.64.220.137]) with mapi; Mon, 10 Feb 2014 16:59:53 -0800 From: Rick Andrews To: Ben Laurie , Adam Langley Date: Mon, 10 Feb 2014 16:59:52 -0800 Thread-Topic: [therightkey] Updated Certificate Transparency + Extended Validation plan Thread-Index: Ac8k004VpWH2RenBSnGSbYPEdJ6NLgB8IfTg Message-ID: <544B0DD62A64C1448B2DA253C011414607C42BDAD5@TUS1XCHEVSPIN33.SYMC.SYMANTEC.COM> References: <544B0DD62A64C1448B2DA253C011414607C3F53600@TUS1XCHEVSPIN33.SYMC.SYMANTEC.COM> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrFIsWRmVeSWpSXmKPExsVyYMU1bV2Rsp9BBj+O6Fnc6H3HarHh8zU2 i5VdM5gspjxfw2zx8cJPFgdWj3UzzzJ7zG64yOKxYFOpx56JJ9k8liz5yRTAGsVlk5Kak1mW WqRvl8CVsXrSCcaCZyIV0xdPZmxgXCDSxcjJISFgIvFnwVImCFtM4sK99WxdjFwcQgIfGCV2 LpvCDOG8YpS4tuoklLOKUeLQjkY2kBY2AT2JLY+vsIPYIgKOEt/7PrKAFDELzGCUmPv7PCtI gkVAVeL0i5OMILawQITEh113mSEaIiVObp0I1WwkcfPtFLA4r0CUxKTJx6G2rWeS+HzyEdg2 ToFAicUrt4DZjEDHfj+1BuxwZgFxiVtP5kM9ISCxZM95ZghbVOLl43+sEPWiEnfa1wMdwQFU rymxfpc+RKuixJTuh+wQewUlTs58wjKBUXwWkqmzEDpmIemYhaRjASPLKkaZktJiw+LckvzS koLUCgNDveLK3ERgfCbrJefnbmIExugNrsMfdzBeX6p4iFGAg1GJhzc47GeQEGtiGVDlIUYJ DmYlEd6zdkAh3pTEyqrUovz4otKc1OJDjNIcLErivEvSVwQJCaQnlqRmp6YWpBbBZJk4OKUa GLccSv+mc9El6MSpB3LbLDYuEFrbo5vAqBYSvzIv89tiNXaT/mP6AjunXeTisyr1yNunM/VR sKLH+XTDp50cxT7Xi/qFQrMOumz6NHF25TXGSaV3dvaeD526YVWGX7tFclpuyS25zee7jNo3 JqakG83lr1rZ/9P+wY/1EfPSiz9M87n40DMtTImlOCPRUIu5qDgRAChi2PXNAgAA Cc: "therightkey@ietf.org" , certificate-transparency , CABFPub Subject: Re: [therightkey] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Feb 2014 01:00:07 -0000 PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiB0aGVyaWdodGtleSBbbWFpbHRv OnRoZXJpZ2h0a2V5LWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZg0KPiBCZW4gTGF1cmll DQo+IFNlbnQ6IFNhdHVyZGF5LCBGZWJydWFyeSAwOCwgMjAxNCA1OjQwIEFNDQo+IFRvOiBBZGFt IExhbmdsZXkNCj4gQ2M6IHRoZXJpZ2h0a2V5QGlldGYub3JnOyBjZXJ0aWZpY2F0ZS10cmFuc3Bh cmVuY3k7IENBQkZQdWINCj4gU3ViamVjdDogUmU6IFt0aGVyaWdodGtleV0gVXBkYXRlZCBDZXJ0 aWZpY2F0ZSBUcmFuc3BhcmVuY3kgKyBFeHRlbmRlZA0KPiBWYWxpZGF0aW9uIHBsYW4NCj4gDQo+ IE9uIDYgRmVicnVhcnkgMjAxNCAxOTowNSwgQWRhbSBMYW5nbGV5IDxhZ2xAY2hyb21pdW0ub3Jn PiB3cm90ZToNCj4gPiBPbiBUaHUsIEZlYiA2LCAyMDE0IGF0IDE6NTEgUE0sIFJpY2sgQW5kcmV3 cw0KPiA8Umlja19BbmRyZXdzQHN5bWFudGVjLmNvbT4gd3JvdGU6DQo+ID4+IENhbiB5b3UgY2xh cmlmeSBzb21ldGhpbmc/IFRoZSBTQ1QgZGVsaXZlcnkgb3B0aW9ucyBkZXNjcmliZWQgaW4gdGhl DQo+IFJGQyBhcmUgb3B0aW9ucyBmb3IgdGhlIHdlYiBzaXRlIG93bmVyLCBub3QgZm9yIHRoZSBD QS4gQ0FzIHdpbGwgbmVlZA0KPiB0byBzdXBwb3J0IGFsbCB0aHJlZSBvcHRpb25zLiBXZSB3aWxs IGhhdmUgY3VzdG9tZXJzIHdobyB3b27igJl0IGRvDQo+IHN0YXBsaW5nIGFuZCBjYW7igJl0IGhh bmRsZSBUTFMgZXh0ZW5zaW9ucywgc28gdGhleSBqdXN0IHdhbnQgdGhlIFNDVHMNCj4gZW1iZWRk ZWQgaW4gdGhlIGNlcnQuIEJ1dCBub3QgYWxsIGN1c3RvbWVycyB3aWxsIHByZWZlciB0aGF0IG9w dGlvbi4gSQ0KPiBiZWxpZXZlIG90aGVyIGN1c3RvbWVycyB3aWxsIHdhbnQgdGhlIFNDVC1pbi10 aGUtT0NTUC1yZXNwb25zZSBvciBUTFMNCj4gZXh0ZW5zaW9uIG9wdGlvbiwgYmVjYXVzZSBpbiB0 aG9zZSBvcHRpb25zIHlvdSBkb27igJl0IGhhdmUgdG8gdHJhbnNtaXQNCj4gdGhlIFNDVHMgaW4g ZXZlcnkgU1NMIGhhbmRzaGFrZS4gSSBzdXNwZWN0IHNvbWUgb2Ygb3VyIGxhcmdlIGN1c3RvbWVy cw0KPiB3aG8gYXJlIG9ic2Vzc2VkIHdpdGggcGVyZm9ybWFuY2Ugd2lsbCBkZW1hbmQgb25lIG9m IHRoZXNlIG9wdGlvbnMuDQo+ID4+DQo+ID4+IFNvIENBcyB3aWxsIG5lZWQgdG8gc3VwcG9ydCBh bGwgdGhyZWUgb3B0aW9ucywgdW5sZXNzIHlvdeKAmXJlIHNvDQo+IHNtYWxsIGEgQ0EgdGhhdCB5 b3VyIGZldyBFViBjdXN0b21lcnMgYWdyZWUgb24gb25lIG9wdGlvbi4gSXMgdGhhdCB5b3VyDQo+ IGV4cGVjdGF0aW9uPw0KPiA+DQo+ID4gU0NUcyBlbWJlZGRlZCBpbiB0aGUgY2VydGlmaWNhdGUg d29uJ3QgYmUgc2VudCBmb3IgcmVzdW1wdGlvbg0KPiA+IGhhbmRzaGFrZXMgb2YgY291cnNlLg0K PiA+DQo+ID4gVGhlIFRMUyBleHRlbnNpb24gd2lsbCBiZSBzZW50IGluIHRoZSBzYW1lIGNhc2Vz IGFzIFNDVHMgZW1iZWRkZWQgaW4NCj4gPiB0aGUgY2VydGlmaWNhdGUuIChBbmQgdGhlIFRMUyBl eHRlbnNpb24gZG9lc24ndCBuZWVkIHRoZSBDQSB0byBkbw0KPiA+IGFueXRoaW5nLikNCg0KSSB0 aG91Z2h0IHRoZSBUTFMgZXh0ZW5zaW9uIHdpbGwgYmUgc2VudCBvbmx5IGlmIHRoZSBjbGllbnQg cmVxdWVzdHMgaXQuICdDbGllbnRzIHRoYXQgc3VwcG9ydCB0aGUgZXh0ZW5zaW9uIFNIT1VMRCBz ZW5kIGEgQ2xpZW50SGVsbG8gZXh0ZW5zaW9uIHdpdGggdGhlIGFwcHJvcHJpYXRlIHR5cGUgYW5k IGVtcHR5ICJleHRlbnNpb25fZGF0YSIuJw0KDQpBbmQgSSBzdXNwZWN0IHRoYXQgQ0FzIHdvdWxk IG5lZWQvd2FudCB0byBjcmVhdGUgYSBzZXJ2aWNlIHRvIGhlbHAgdGhlaXIgY3VzdG9tZXJzIG9i dGFpbiBTQ1RzIGlmIHRoZXkgY2hvb3NlIHRoZSBUTFMgZXh0ZW5zaW9uIG9wdGlvbi4gDQoNCi1S aWNrDQo= From me@chemalogo.com Mon Feb 10 08:29:22 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A0EA1A07EE for ; Mon, 10 Feb 2014 08:29:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.667 X-Spam-Level: X-Spam-Status: No, score=-1.667 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-0.7, T_REMOTE_IMAGE=0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ln93eOwXbFjy for ; Mon, 10 Feb 2014 08:29:18 -0800 (PST) Received: from mail-qa0-f51.google.com (mail-qa0-f51.google.com [209.85.216.51]) by ietfa.amsl.com (Postfix) with ESMTP id 9AFAE1A06DC for ; Mon, 10 Feb 2014 08:29:18 -0800 (PST) Received: by mail-qa0-f51.google.com with SMTP id f11so9738779qae.24 for ; Mon, 10 Feb 2014 08:29:18 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc:content-type; bh=DqqAPnlObq4NoZ0+R9GIcvKzoMAUbxN+ORAC5GTbC2Q=; b=gN+xDxFyf6Es45K5Ouo66msbLtIj9+Yx0T2/0i5XVS/ax/X8GShe6uTMEXtvjGe+BB 2duXtWHg/EiIxqYB4vYqJHQRURfUYESbPMZGAnhhzgcxPPUHrgqnJZyw7RyulYAzN1kr 6eiFC/KtUa6GR7AWaINURB8XEAkiH2zLkj6w8ldCJNCaGzij8b6XO8skkNwUuRQXHWGI PZVzAbulzHFFFJ1wbXroLvB4Y7xZMuqg58bWZJ0Er1jhDbyDlSisr84xUkBBSjDvVXUe gRaabfT1Nxug/emtl7p9tbmi4kz2PbKVjrgoeWGadsY/YNh5iF2cqDt79UxTSKqr5PSC nxPQ== X-Gm-Message-State: ALoCoQlcOkYurA7k9MIADmH+rS3zFKSO9oE8U460PHYqrE59sR1VX3FfsICIQIL/85KqPvdpxp68 X-Received: by 10.229.139.199 with SMTP id f7mr45030498qcu.2.1392049757961; Mon, 10 Feb 2014 08:29:17 -0800 (PST) MIME-Version: 1.0 Sender: me@chemalogo.com Received: by 10.140.101.197 with HTTP; Mon, 10 Feb 2014 08:28:47 -0800 (PST) X-Originating-IP: [84.88.59.1] In-Reply-To: <52F8BCF5.4060506@comodo.com> References: <52F25835.60702@comodo.com> <52F27445.6040701@comodo.com> <52F2811A.9030800@comodo.com> <52F8A650.6060209@comodo.com> <52F8BCF5.4060506@comodo.com> From: =?UTF-8?Q?Chema_L=C3=B3pez_Gonz=C3=A1lez?= Date: Mon, 10 Feb 2014 17:28:47 +0100 X-Google-Sender-Auth: -LINmhKDthOG1v0bOtZr-pX4w3c Message-ID: To: Rob Stradling , certificate-transparency@googlegroups.com Content-Type: multipart/alternative; boundary=001a11c3e454555f7f04f20fd797 X-Mailman-Approved-At: Mon, 10 Feb 2014 17:03:12 -0800 Cc: "therightkey@ietf.org" , CABFPub Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Feb 2014 19:23:56 -0000 --001a11c3e454555f7f04f20fd797 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Have anyone take into account the current position of EJBCA, a mayor player in this stuff of digital certificates? To summarize: "My suggestion: - Skip PreCertificates altogether" On the other hand, trying to use a thing that looks like a certificate (X.509v3) not to do the task of a certificate is like trying to use a screwdriver to nail nails. We agree that the information contained in the precertificate is relevant, and that the signature of such information is also necessary, but maybe the container could be a different format or ASN.1 structure different from a X.509v3 cert. [image: AC Firmaprofesional S.A.] *Chema L=C3=B3pez Gonz=C3=A1lez AC Firmaprofesional S.A.* Av. Torre Blanca, 57. Edificio ESADECREAPOLIS - 1B13 08173 Sant Cugat del Vall=C3=A8s. Barcelona. Tel: 93.477.42.45 / 666.429.224 El contenido de este mensaje y de sus anexos es confidencial. Si no es el destinatario, le hacemos saber que est=C3=A1 prohibido utilizarlo, divulgar= lo y/o copiarlo sin tener la autorizaci=C3=B3n correspondiente. Si ha recibido= este mensaje por error, le agradecer=C3=ADamos que lo haga saber inmediatamente = al remitente y que proceda a destruir el mensaje. On Mon, Feb 10, 2014 at 12:50 PM, Rob Stradling w= rote: > On 10/02/14 11:35, Ben Laurie wrote: > > On 10 February 2014 10:13, Rob Stradling > wrote: > >> On 08/02/14 13:32, Ben Laurie wrote: > >>> > >>> On 5 February 2014 18:21, Rob Stradling > wrote: > >>>> > >>>> On 05/02/14 17:49, Adam Langley wrote: > >>>>> > >>>>> > >>>>> On Wed, Feb 5, 2014 at 12:26 PM, Rob Stradling > >>>>> > >>>>> wrote: > >>>>>> > >>>>>> > >>>>>> Presumably it's somewhere between 10 and 31 days, since 1 SCT is > >>>>>> acceptable > >>>>>> for Stapled OCSP and the BRs permit OCSP Responses to be valid for > up > >>>>>> to > >>>>>> 10 > >>>>>> days. > >>>>> > >>>>> > >>>>> > >>>>> The speed at which we need to distrust a log depends on the minimum > >>>>> number of SCTs actually, which is why allowing a single SCT in > stapled > >>>>> OCSP responses is such a large concession. If the minimum number of > >>>>> SCTs were two then the pressure to distrust a log (and the pressure > on > >>>>> the logs) would be dramatically reduced because compromising one lo= g > >>>>> wouldn't be sufficient. > >>>>> > >>>>>> Do you still think [1] is a good plan? > >>>>> > >>>>> > >>>>> > >>>>> Sure, if any CAs are willing to do it now :) > >>>> > >>>> > >>>> > >>>> I think "servers could just download their refreshed certificate ove= r > >>>> HTTP > >>>> periodically and automatically" is the showstopper at the moment. Ye= s > >>>> they > >>>> could, but I'm not aware of any server that actually implements such= a > >>>> feature. > >>> > >>> > >>> Work is under way for Apache: https://github.com/trawick/ct-httpd/. > >> > >> > >> That looks like great work, but AFAICT it's only for fetching SCTs fro= m > CT > >> Logs. > >> > >> I was talking about the lack of any mechanism in popular webserver > software > >> for automatically fetching and installing certificates from CAs. In > >> particular: a short-duration certificate that reuses the same public > key as > >> the previous certificate. > > > > Ah, I see! But why would you need it if you can refresh the SCTs > yourself? > > To fix certificate revocation checking, by avoiding the need for it (as > Adam proposed a couple of years ago - see [1]). > > But really, I was just trying to point out that just because CAs aren't > noticeably issuing short-duration certs today, it doesn't mean that they > won't do so in the future. So I think it is worth permitting just 1 > embedded SCT for short-duration certs (for some value of "short"). > > > [1] https://www.imperialviolet.org/2011/03/18/revocation.html > "A much better solution would be for certificates to only be valid for a > few days and to forget about revocation altogether. This doesn't mean > that the private key needs to change every few days, just the > certificate. And the certificate is public data, so servers could just > download their refreshed certificate over HTTP periodically and > automatically (like OCSP stapling). Clients wouldn't have to perform > revocation checks (which are very complex and slow), CAs wouldn't have > to pay for massive, DDoS proof serving capacity and revocation would > actually work. If the CA went down for six hours, nobody cares. Only if > the CA is down for days is there a problem. If you want to =E2=80=9Crevok= e=E2=80=9D a > certificate, just stop renewing it." > > -- > Rob Stradling > Senior Research & Development Scientist > COMODO - Creating Trust Online > > _______________________________________________ > Public mailing list > Public@cabforum.org > https://cabforum.org/mailman/listinfo/public > --001a11c3e454555f7f04f20fd797 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Have anyone take into account t= he=C2=A0current position of EJBCA, a mayor player in this stuff of dig= ital certificates?

To summarize:
"= My suggestion:
- Skip PreCertificates altogether"

On the other hand, trying to use a thing that looks like a certificate (X.5= 09v3) not to do the task of a certificate is like trying to use a screwdriv= er to nail nails.

We agree that the information contained in the precertificate is relevant, = and that the signature of such information is also necessary, but maybe the= container could be a different format or ASN.1 structure different from a = X.509v3 cert.


<= div class=3D"gmail_extra">



3D"=

Chema = L=C3=B3pez Gonz=C3=A1lez
=C2=A0
AC Firmaprofesional S.A.



Av. Torre Blanca, 57.=C2=A0 Edificio ESADECREAPOLIS - 1B13
08173 Sant Cugat de= l Vall=C3=A8s. Barcelona.
Tel:=C2=A093.477.42.45=C2= =A0/=C2=A0666.429.224

El contenido de este mensaje y de= sus anexos es confidencial. Si no es el destinatario, le hacemos saber que= est=C3=A1 prohibido utilizarlo, divulgarlo y/o copiarlo sin tener la autor= izaci=C3=B3n correspondiente. Si ha recibido este mensaje por error, le agr= adecer=C3=ADamos que lo haga saber inmediatamente al remitente y que proced= a a destruir el mensaje.


On Mon, Feb 10, 2014 at 12:50 PM, Rob St= radling <rob.stradling@comodo.com> wrote:
On 10/02/14 11:35, Ben Laurie wrote:
> On 10 February 2014 10:13, Rob Stradling <rob.stradling@comodo.com> wrote:
>> On 08/02/14 13:32, Ben Laurie wrote:
>>>
>>> On 5 February 2014 18:21, Rob Stradling <rob.stradling@comodo.com> wrote:
>>>>
>>>> On 05/02/14 17:49, Adam Langley wrote:
>>>>>
>>>>>
>>>>> On Wed, Feb 5, 2014 at 12:26 PM, Rob Stradling
>>>>> <rob.st= radling@comodo.com>
>>>>> wrote:
>>>>>>
>>>>>>
>>>>>> Presumably it's somewhere between 10 and 31 da= ys, since 1 SCT is
>>>>>> acceptable
>>>>>> for Stapled OCSP and the BRs permit OCSP Responses= to be valid for up
>>>>>> to
>>>>>> 10
>>>>>> days.
>>>>>
>>>>>
>>>>>
>>>>> The speed at which we need to distrust a log depends o= n the minimum
>>>>> number of SCTs actually, which is why allowing a singl= e SCT in stapled
>>>>> OCSP responses is such a large concession. If the mini= mum number of
>>>>> SCTs were two then the pressure to distrust a log (and= the pressure on
>>>>> the logs) would be dramatically reduced because compro= mising one log
>>>>> wouldn't be sufficient.
>>>>>
>>>>>> Do you still think [1] is a good plan?
>>>>>
>>>>>
>>>>>
>>>>> Sure, if any CAs are willing to do it now :)
>>>>
>>>>
>>>>
>>>> I think "servers could just download their refreshed = certificate over
>>>> HTTP
>>>> periodically and automatically" is the showstopper at= the moment. Yes
>>>> they
>>>> could, but I'm not aware of any server that actually i= mplements such a
>>>> feature.
>>>
>>>
>>> Work is under way for Apache: https://github.com/trawick/ct-httpd/= .
>>
>>
>> That looks like great work, but AFAICT it's only for fetching = SCTs from CT
>> Logs.
>>
>> I was talking about the lack of any mechanism in popular webserver= software
>> for automatically fetching and installing certificates from CAs. = =C2=A0In
>> particular: a short-duration certificate that reuses the same publ= ic key as
>> the previous certificate.
>
> Ah, I see! But why would you need it if you can refresh the SCTs yours= elf?

To fix certificate revocation checking, by avoiding the need fo= r it (as
Adam proposed a couple of years ago - see [1]).

But really, I was just trying to point out that just because CAs aren't=
noticeably issuing short-duration certs today, it doesn't mean that the= y
won't do so in the future. =C2=A0So I think it is worth permitting just= 1
embedded SCT for short-duration certs (for some value of "short")= .


[1] https://www.imperialviolet.org/2011/03/18/revocation.html<= /a>
"A much better solution would be for certificates to only be valid for= a
few days and to forget about revocation altogether. This doesn't mean that the private key needs to change every few days, just the
certificate. And the certificate is public data, so servers could jus= t
download their refreshed certificate over HTTP periodical= ly and
automatically (like OCSP stapling). Clients wouldn&= #39;t have to perform
revocation checks (which are very complex and slow), CAs wouldn't have<= br> to pay for massive, DDoS proof serving capacity and revocation would
actually work. If the CA went down for six hours, nobody cares. Only if
the CA is down for days is there a problem. If you want to =E2=80=9Crevoke= =E2=80=9D a
certificate, just stop renewing it."

--
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online

___________________________________= ____________
Public mailing list
Public@cabforum.org
= https://cabforum.org/mailman/listinfo/public

--001a11c3e454555f7f04f20fd797-- From paul@marvell.com Mon Feb 10 17:47:41 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78A0D1A0649 for ; Mon, 10 Feb 2014 17:47:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.566 X-Spam-Level: X-Spam-Status: No, score=-1.566 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, IP_NOT_FRIENDLY=0.334, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sJKB9S9eC-Pu for ; Mon, 10 Feb 2014 17:47:40 -0800 (PST) Received: from mx0b-0016f401.pphosted.com (mx0b-0016f401.pphosted.com [67.231.156.173]) by ietfa.amsl.com (Postfix) with ESMTP id 0FFB41A0635 for ; Mon, 10 Feb 2014 17:47:39 -0800 (PST) Received: from pps.filterd (m0045851.ppops.net [127.0.0.1]) by mx0b-0016f401.pphosted.com (8.14.5/8.14.5) with SMTP id s1B1lbJS010270; Mon, 10 Feb 2014 17:47:37 -0800 Received: from sc-owa03.marvell.com ([199.233.58.149]) by mx0b-0016f401.pphosted.com with ESMTP id 1hxacbx1un-21 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Mon, 10 Feb 2014 17:47:37 -0800 Received: from SC-vEXCH2.marvell.com ([10.93.76.134]) by SC-OWA03.marvell.com ([fe80::4561:8e1c:d59b:f770%17]) with mapi; Mon, 10 Feb 2014 17:47:34 -0800 From: Paul Lambert To: Phillip Hallam-Baker , Paul Hoffman Date: Mon, 10 Feb 2014 17:47:33 -0800 Thread-Topic: Forest Model -> was RE: [therightkey] First public DNSChain server went online yesterday! Thread-Index: Ac8lPFqpZ1yIjPI/Qo+ElAVW/EjhlgBjUX5w Message-ID: <7BAC95F5A7E67643AAFB2C31BEE662D018B81B8A99@SC-VEXCH2.marvell.com> References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> <20140207193212.GQ22727@crankycanuck.ca> <32201143-1945-4705-A240-522F41535545@taoeffect.com> <23D8B61D-A198-40FB-9672-83AF23018AE9@vpnc.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/alternative; boundary="_000_7BAC95F5A7E67643AAFB2C31BEE662D018B81B8A99SCVEXCH2marve_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.11.87, 1.0.14, 0.0.0000 definitions=2014-02-10_04:2014-02-10,2014-02-10,1970-01-01 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=7.0.1-1305240000 definitions=main-1402100180 Cc: "therightkey@ietf.org" , Tao Effect Subject: [therightkey] Forest Model -> was RE: First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Feb 2014 01:47:41 -0000 --_000_7BAC95F5A7E67643AAFB2C31BEE662D018B81B8A99SCVEXCH2marve_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable >Why would anyone need a certificate in this system? The binding to a publi= c key is intrinsic to the whole naming architecture. Yes! >Come to that, why would anyone need .dns??? If namecoin is going to replac= e the DNS, >why make the mistake of upper level hierarchy? Surely the new system shoul= d be the apex >of the hierarchy and the legacy DNS subordinated under .icann. > >I do have a solution though. There are some TLDs that are not expletives t= hat are almost >certain to be permanently withheld from issue. I suggest they consider usi= ng .pot or .weed. I prefer the forest model ... every key can define a namespace: paulehoffman.com.73940a8b75ac184ddbe3ca3c2c809c67 Paul --_000_7BAC95F5A7E67643AAFB2C31BEE662D018B81B8A99SCVEXCH2marve_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

>Why would anyone need a certificate in= this system? The binding to a public key is intrinsic to the whole naming = architecture.

Yes!

 =

&= gt;Come to that, why would anyone need .dns??? If namecoin is going to repl= ace the DNS,

>why make the mistake of upper level hiera= rchy? Surely the new system should be the apex

>of the = hierarchy and the legacy DNS subordinated under .icann.

>= ; 

>I do have a solution though. There are some TLD= s that are not expletives that are almost

>certain to b= e permanently withheld from issue. I suggest they consider using .pot or .w= eed.

 

I prefer the forest model ̷= 0; every key can define a namespace:

 

paulehoffman.com.73940a8b75ac184ddbe3ca3c2c809c= 67

 

 

Paul<= /o:p>

= --_000_7BAC95F5A7E67643AAFB2C31BEE662D018B81B8A99SCVEXCH2marve_-- From paul@nohats.ca Mon Feb 10 17:52:58 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6E131A0635 for ; Mon, 10 Feb 2014 17:52:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.649 X-Spam-Level: X-Spam-Status: No, score=-0.649 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-0.548] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kD7bRWS2XNZa for ; Mon, 10 Feb 2014 17:52:56 -0800 (PST) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) by ietfa.amsl.com (Postfix) with ESMTP id 70F901A0656 for ; Mon, 10 Feb 2014 17:52:56 -0800 (PST) Received: from bofh.nohats.ca (bofh.nohats.ca [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 207F8800AA; Mon, 10 Feb 2014 20:52:55 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1392083575; bh=sQcYQ0jK2yuKPhzT73MEdaaa19Pi60er7QrZvTQUCto=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=VPw6pt61cMyfd9NHrCE6/oon6cySygUiTzB4cg5Moe66bNRAH1JKfBb2PONB0CATZ FGx+cv5+wGMaiSYbEA5Sk3/clIy82y/lvOhED0sEfNOvsAWgGFlGPJFesNMfA85w/1 aLqISOJ4wadhUpmj82RUMFH6Yz4NGr1FDCnk7Tmo= Received: from localhost (paul@localhost) by bofh.nohats.ca (8.14.7/8.14.7/Submit) with ESMTP id s1B1qqKp012274; Mon, 10 Feb 2014 20:52:54 -0500 X-Authentication-Warning: bofh.nohats.ca: paul owned process doing -bs Date: Mon, 10 Feb 2014 20:52:51 -0500 (EST) From: Paul Wouters To: Paul Lambert In-Reply-To: <7BAC95F5A7E67643AAFB2C31BEE662D018B81B8A99@SC-VEXCH2.marvell.com> Message-ID: References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> <20140207193212.GQ22727@crankycanuck.ca> <32201143-1945-4705-A240-522F41535545@taoeffect.com> <23D8B61D-A198-40FB-9672-83AF23018AE9@vpnc.org> <7BAC95F5A7E67643AAFB2C31BEE662D018B81B8A99@SC-VEXCH2.marvell.com> User-Agent: Alpine 2.10 (LFD 1266 2009-07-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8BIT Cc: "therightkey@ietf.org" Subject: Re: [therightkey] Forest Model -> was RE: First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Feb 2014 01:52:59 -0000 On Mon, 10 Feb 2014, Paul Lambert wrote: > I prefer the forest model … every key can define a namespace: > > paulehoffman.com.73940a8b75ac184ddbe3ca3c2c809c67 And now to make that memorable or spray paintable on your car, you need a mapping system like DNS. Back to the drawing board! Paul From paul@marvell.com Mon Feb 10 18:50:14 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 770381A074F for ; Mon, 10 Feb 2014 18:50:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.567 X-Spam-Level: X-Spam-Status: No, score=-1.567 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, IP_NOT_FRIENDLY=0.334, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WT6AFzw0JPUu for ; Mon, 10 Feb 2014 18:50:13 -0800 (PST) Received: from mx0a-0016f401.pphosted.com (mx0a-0016f401.pphosted.com [67.231.148.174]) by ietfa.amsl.com (Postfix) with ESMTP id 65D271A074E for ; Mon, 10 Feb 2014 18:50:13 -0800 (PST) Received: from pps.filterd (m0045849.ppops.net [127.0.0.1]) by mx0a-0016f401.pphosted.com (8.14.5/8.14.5) with SMTP id s1B2oCvn019426; Mon, 10 Feb 2014 18:50:13 -0800 Received: from sc-owa01.marvell.com ([199.233.58.136]) by mx0a-0016f401.pphosted.com with ESMTP id 1hweacka5h-19 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NOT); Mon, 10 Feb 2014 18:50:13 -0800 Received: from SC-vEXCH2.marvell.com ([10.93.76.134]) by SC-OWA01.marvell.com ([10.93.76.21]) with mapi; Mon, 10 Feb 2014 18:49:31 -0800 From: Paul Lambert To: Paul Wouters Date: Mon, 10 Feb 2014 18:49:30 -0800 Thread-Topic: [therightkey] Forest Model -> was RE: First public DNSChain server went online yesterday! Thread-Index: Ac8my/65X3CUqu2HThGbVmrZrznLRQAB34KQ Message-ID: <7BAC95F5A7E67643AAFB2C31BEE662D018B81B8ADC@SC-VEXCH2.marvell.com> References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> <20140207193212.GQ22727@crankycanuck.ca> <32201143-1945-4705-A240-522F41535545@taoeffect.com> <23D8B61D-A198-40FB-9672-83AF23018AE9@vpnc.org> <7BAC95F5A7E67643AAFB2C31BEE662D018B81B8A99@SC-VEXCH2.marvell.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.11.87, 1.0.14, 0.0.0000 definitions=2014-02-11_01:2014-02-10,2014-02-11,1970-01-01 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=7.0.1-1305240000 definitions=main-1402100193 Cc: "therightkey@ietf.org" Subject: Re: [therightkey] Forest Model -> was RE: First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Feb 2014 02:50:14 -0000 DQoNCl0tLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KXUZyb206IFBhdWwgV291dGVycyBbbWFp bHRvOnBhdWxAbm9oYXRzLmNhXQ0KXVNlbnQ6IE1vbmRheSwgRmVicnVhcnkgMTAsIDIwMTQgNTo1 MyBQTQ0KXVRvOiBQYXVsIExhbWJlcnQNCl1DYzogdGhlcmlnaHRrZXlAaWV0Zi5vcmcNCl1TdWJq ZWN0OiBSZTogW3RoZXJpZ2h0a2V5XSBGb3Jlc3QgTW9kZWwgLT4gd2FzIFJFOiBGaXJzdCBwdWJs aWMgRE5TQ2hhaW4NCl1zZXJ2ZXIgd2VudCBvbmxpbmUgeWVzdGVyZGF5IQ0KXQ0KXU9uIE1vbiwg MTAgRmViIDIwMTQsIFBhdWwgTGFtYmVydCB3cm90ZToNCl0NCl0+IEkgcHJlZmVyIHRoZSBmb3Jl c3QgbW9kZWwg4oCmIGV2ZXJ5IGtleSBjYW4gZGVmaW5lIGEgbmFtZXNwYWNlOg0KXT4NCl0+IHBh dWxlaG9mZm1hbi5jb20uNzM5NDBhOGI3NWFjMTg0ZGRiZTNjYTNjMmM4MDljNjcNCl0NCl1BbmQg bm93IHRvIG1ha2UgdGhhdCBtZW1vcmFibGUgb3Igc3ByYXkgcGFpbnRhYmxlIG9uIHlvdXIgY2Fy LCB5b3UgbmVlZA0KXWEgbWFwcGluZyBzeXN0ZW0gbGlrZSBETlMuDQpZZXMgLi4uIGNsZWFybHkg bG9uZywgb25seSBpbGx1c3RyYXRlZCB0aGlzIHdheSBhcyBkZXNjcmlwdGl2ZSB0b29sLg0KV2Ug YWxyZWFkeSBpbiBlZmZlY3QgYXNzb2NpYXRlIG9uZSBvciBtb3JlIGtleXMgYXMgdGhlIGF1dGhv cml0aWVzIGZvcg0KbmFtZSBzcGFjZXMgICAuLi4NCg0KXUJhY2sgdG8gdGhlIGRyYXdpbmcgYm9h cmQhDQpPciBzaW1wbHkgZGVmaW5lIGltcGxpY2l0IGNvbnRleHQgb2YgY29tbXVuaWNhdGlvbnMg dG8gYmUgd2l0aGluIGENCmFncmVlZCBuYW1lIHNwYWNlIHRodXMgbWFraW5nIHRoZSBmcmllbmRs eSBuYW1lcyBzaG9ydGVyLg0KDQpQYXVsICh5ZXQgYW5vdGhlcikNCg0KXQ0KXVBhdWwNCg== From benl@google.com Tue Feb 11 03:00:31 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A8E161A07CD for ; Tue, 11 Feb 2014 03:00:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.927 X-Spam-Level: X-Spam-Status: No, score=-1.927 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sSBd6Jt7tpv5 for ; Tue, 11 Feb 2014 03:00:29 -0800 (PST) Received: from mail-ve0-x233.google.com (mail-ve0-x233.google.com [IPv6:2607:f8b0:400c:c01::233]) by ietfa.amsl.com (Postfix) with ESMTP id 9974A1A0376 for ; Tue, 11 Feb 2014 03:00:29 -0800 (PST) Received: by mail-ve0-f179.google.com with SMTP id jx11so6071272veb.10 for ; Tue, 11 Feb 2014 03:00:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=EXysm+zMhLMjUQugN0jAL7iosaKp/nPQLiCmaa9Y6mA=; b=b3A27bSzutCEJk/x+HC338wO0NZTLVbhoE49V/f2mN5kW0Lqwt46MYNzkPeiQZkyWd 0aXfxp9caue7ndYZbOItGo2NrA6grTgceEvv1mChaPKqY1aWo4auGolb+w+OHh6IitEu WvoLxb9k3nY0Z8uGN1jy39haLyKAJhJwTfTTUF8Dj/+tU4gqeAKYWSfulWGoE+UCCRrT uAiGdOt6ltfVZyp1MaPZLsPRT3bVD3GJ6osTsUOapyyD84nAmSKKQmutpiNoRatFMi4U GE6INh2tuP0jCg9DXbnBFU9lkv12EjRpVQXvuGooWiPR4T3Ms2c2v1pGKUFsDxUGF95b 1UKw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=EXysm+zMhLMjUQugN0jAL7iosaKp/nPQLiCmaa9Y6mA=; b=YF+oN5SkX19Ul5rRSWv5xRUjez0QwWShotI7VAVY7B924fBnekyBxdUF/cEn9skWOR tQh+i6kI6xx9MB/urehxYThseO0pPOhEv1aROvIs1uhekXfz/lCBLulPDI3PmHIInIkw fauQc+Zmwsh+ZoTUVC4Ahpup17fGuXgoE8/C2rTqaS7R0OKsBTwdODC0KvJ3aBtvI9R/ dJf2s91iEjI0a2fEgivFjrnwoaL0cvFrCfDaQeZLB6/XCab1qp4R8JOu6+R03bZLBoym S3s5ogUARHCHCyOpzWuhtIaG1kGjZyqxg4rXGUzkc2Zd3Du532kBpeSZRO5G/bmpR9dT SJwQ== X-Gm-Message-State: ALoCoQmcRItlojbDayT/pAuPIZnQliB22DJZUzpNZPBo7M4WYlOBtmyl76jsewSxf3twg2uMTyCX+KrCLxnvuiJSYuaGsny6cu33nBBwKXEHVsYk9dZiSC+DXX39bnXF6b2t+OMdQD6214FdMp5MQBanadgqviVf5ztgzPGMOMv5R1dPJOZYChZ7i/9Zk+JSxSm7N3yICVzT MIME-Version: 1.0 X-Received: by 10.58.4.138 with SMTP id k10mr28087815vek.8.1392116428829; Tue, 11 Feb 2014 03:00:28 -0800 (PST) Received: by 10.52.230.105 with HTTP; Tue, 11 Feb 2014 03:00:28 -0800 (PST) In-Reply-To: <544B0DD62A64C1448B2DA253C011414607C42BDAD5@TUS1XCHEVSPIN33.SYMC.SYMANTEC.COM> References: <544B0DD62A64C1448B2DA253C011414607C3F53600@TUS1XCHEVSPIN33.SYMC.SYMANTEC.COM> <544B0DD62A64C1448B2DA253C011414607C42BDAD5@TUS1XCHEVSPIN33.SYMC.SYMANTEC.COM> Date: Tue, 11 Feb 2014 11:00:28 +0000 Message-ID: From: Ben Laurie To: Rick Andrews Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Cc: "therightkey@ietf.org" , Adam Langley , certificate-transparency , CABFPub Subject: Re: [therightkey] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Feb 2014 11:00:31 -0000 On 11 February 2014 00:59, Rick Andrews wrote: >> -----Original Message----- >> From: therightkey [mailto:therightkey-bounces@ietf.org] On Behalf Of >> Ben Laurie >> Sent: Saturday, February 08, 2014 5:40 AM >> To: Adam Langley >> Cc: therightkey@ietf.org; certificate-transparency; CABFPub >> Subject: Re: [therightkey] Updated Certificate Transparency + Extended >> Validation plan >> >> On 6 February 2014 19:05, Adam Langley wrote: >> > On Thu, Feb 6, 2014 at 1:51 PM, Rick Andrews >> wrote: >> >> Can you clarify something? The SCT delivery options described in the >> RFC are options for the web site owner, not for the CA. CAs will need >> to support all three options. We will have customers who won=E2=80=99t d= o >> stapling and can=E2=80=99t handle TLS extensions, so they just want the = SCTs >> embedded in the cert. But not all customers will prefer that option. I >> believe other customers will want the SCT-in-the-OCSP-response or TLS >> extension option, because in those options you don=E2=80=99t have to tra= nsmit >> the SCTs in every SSL handshake. I suspect some of our large customers >> who are obsessed with performance will demand one of these options. >> >> >> >> So CAs will need to support all three options, unless you=E2=80=99re = so >> small a CA that your few EV customers agree on one option. Is that your >> expectation? >> > >> > SCTs embedded in the certificate won't be sent for resumption >> > handshakes of course. >> > >> > The TLS extension will be sent in the same cases as SCTs embedded in >> > the certificate. (And the TLS extension doesn't need the CA to do >> > anything.) > > I thought the TLS extension will be sent only if the client requests it. = 'Clients that support the extension SHOULD send a ClientHello extension wit= h the appropriate type and empty "extension_data".' That is true, but I would expect all CT-capable clients to support the extension. > And I suspect that CAs would need/want to create a service to help their = customers obtain SCTs if they choose the TLS extension option. Sure. From hallam@gmail.com Tue Feb 11 04:41:41 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D8E211A05E7 for ; Tue, 11 Feb 2014 04:41:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fVFAI-YQZL7E for ; Tue, 11 Feb 2014 04:41:39 -0800 (PST) Received: from mail-la0-x234.google.com (mail-la0-x234.google.com [IPv6:2a00:1450:4010:c03::234]) by ietfa.amsl.com (Postfix) with ESMTP id C0C371A03BF for ; Tue, 11 Feb 2014 04:41:38 -0800 (PST) Received: by mail-la0-f52.google.com with SMTP id c6so5761367lan.39 for ; Tue, 11 Feb 2014 04:41:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=jz1dRe3H6of5n1AiTkruJCnFMyWoad/v7r1shspBDwg=; b=B+W84m9x59bKTUBTuSkwRkL+5NVh2dbMVt+YUZLOEmQickifho+81UvCOR3tC6SQPF v0Pmq8Wt3M9V7naE+Qkm0cIWuX8M7yzSapQsQVuoAFl8SrMQwufg1A+gxlDFJ46mpESt 0d9pE/Ykwziln1udqZd3sacbYAM/A0Tm2F2VvPL+WeS8w1mmDjaiPJecWB5oNf870Whc /vyM2NLhrVsU4sk5u+FnrAQKZuzOTHny5dlEhoSmIZ6DGd+RsfHdvqOtdLBaRxnZWNl0 6VkHxcAjSeteWNLw1I4RL3n0GDhfGlRrOUTvHH8E3W5wkSkyXaaiQ+7VKfGUMuAIhv6o gwoQ== MIME-Version: 1.0 X-Received: by 10.112.158.131 with SMTP id wu3mr24905861lbb.6.1392122497539; Tue, 11 Feb 2014 04:41:37 -0800 (PST) Received: by 10.112.37.168 with HTTP; Tue, 11 Feb 2014 04:41:37 -0800 (PST) In-Reply-To: References: <06140551-4076-4402-ABA6-3EB78CFB9F0B@taoeffect.com> <20140207193212.GQ22727@crankycanuck.ca> <32201143-1945-4705-A240-522F41535545@taoeffect.com> <23D8B61D-A198-40FB-9672-83AF23018AE9@vpnc.org> <7BAC95F5A7E67643AAFB2C31BEE662D018B81B8A99@SC-VEXCH2.marvell.com> Date: Tue, 11 Feb 2014 07:41:37 -0500 Message-ID: From: Phillip Hallam-Baker To: Paul Wouters Content-Type: multipart/alternative; boundary=001a11c37b32f3221904f220c6b8 Cc: Paul Lambert , "therightkey@ietf.org" Subject: Re: [therightkey] Forest Model -> was RE: First public DNSChain server went online yesterday! X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Feb 2014 12:41:42 -0000 --001a11c37b32f3221904f220c6b8 Content-Type: text/plain; charset=ISO-8859-1 On Mon, Feb 10, 2014 at 8:52 PM, Paul Wouters wrote: > On Mon, 10 Feb 2014, Paul Lambert wrote: > > I prefer the forest model ... every key can define a namespace: >> >> paulehoffman.com.73940a8b75ac184ddbe3ca3c2c809c67 >> > > And now to make that memorable or spray paintable on your car, you need > a mapping system like DNS. > > Back to the drawing board! > Compared to the other usability issues involved in using what people call the 'dark web' this would be the least of their problems. Since the definition of the dark web is 'so complicated that the people using it can't understand that they are still visible' usability issues are inevitable. -- Website: http://hallambaker.com/ --001a11c37b32f3221904f220c6b8 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable



On Mon, Feb 10, 2014 at 8:52 PM, Paul Wouters <= ;paul@nohats.ca>= wrote:
On Mon, 10 Feb 2014, Paul La= mbert wrote:

I prefer the forest model … every key can define a namespace:

paulehoffman.com.= 73940a8b75ac184ddbe3ca3c2c809c67

And now to make that memorable or spray paintable on your car, you need
a mapping system like DNS.

Back to the drawing board!

Compared to = the other usability issues involved in using what people call the 'dark= web' this would be the least of their problems.

Since the definition of the dark web is 'so complicated that the p= eople using it can't understand that they are still visible' usabil= ity issues are inevitable.
 
--
Website: http://hallambaker.com/
--001a11c37b32f3221904f220c6b8-- From kirk_hall@trendmicro.com Tue Feb 11 10:30:33 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CEF431A06E4 for ; Tue, 11 Feb 2014 10:30:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.038 X-Spam-Level: X-Spam-Status: No, score=-2.038 tagged_above=-999 required=5 tests=[BAYES_50=0.8, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lnW-TsE-HH4T for ; Tue, 11 Feb 2014 10:30:28 -0800 (PST) Received: from sjdciscan01.udc.trendmicro.com (sjdciscan01.udc.trendmicro.com [66.180.82.17]) by ietfa.amsl.com (Postfix) with ESMTP id 5BFFB1A06E0 for ; Tue, 11 Feb 2014 10:30:28 -0800 (PST) Received: from sjdciscan01.udc.trendmicro.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BBDF53480F7; Tue, 11 Feb 2014 10:30:27 -0800 (PST) Received: from SJDCEXCH02.us.trendnet.org (unknown [10.45.26.202]) by sjdciscan01.udc.trendmicro.com (Postfix) with ESMTP id AFE27348048; Tue, 11 Feb 2014 10:30:27 -0800 (PST) Received: from SJDCEXMBX03.us.trendnet.org ([fe80::b99c:8504:fc41:2920]) by SJDCEXCH02.us.trendnet.org ([fe80::7428:736b:4a63:a6f0%20]) with mapi id 14.03.0158.001; Tue, 11 Feb 2014 10:30:26 -0800 From: "kirk_hall@trendmicro.com" To: CABFPub Thread-Topic: [cabfpub] Updated Certificate Transparency + Extended Validation plan Thread-Index: AQHPJn1Lf/wdPWRmiU6b4/LwwgW0rpqwYH5A Date: Tue, 11 Feb 2014 18:30:26 +0000 Message-ID: References: <52F25835.60702@comodo.com> <52F27445.6040701@comodo.com> <52F2811A.9030800@comodo.com> <52F8A650.6060209@comodo.com> <52F8BCF5.4060506@comodo.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.30.173.61] Content-Type: multipart/alternative; boundary="_000_EF70381B2D29784EA4FC66042BE81EAF1EB9FDB4SJDCEXMBX03ustr_" MIME-Version: 1.0 X-TM-AS-MML: No X-TM-AS-Product-Ver: IMSVA-8.2.0.1679-7.5.0.1017-20496.001 X-TMASE-Version: IMSVA-8.2.0.1679-7.5.1017-20496.001 X-TMASE-Result: 10--92.872400-5.000000 X-TMASE-MatchedRID: vWvnoyq7eMyQxSBF6iuIxihfkXJQ0v2poHOSwQSJZWjTi04NASO/NeYA h37ZsBDCNePNQCxEcft9Q5/gynnG1ltd8oZ0H4XrBn3hPeehyhUmupo8uESIT/zOShQnsZOJdl7 DHkZIxlCYf3r4ZCpo6pTVN3FiLkyoG+BgV9t6tu7e/Cwn+T0mju8OddJtGrGjPEvNRW6dl1ltdr 9d0G+tOvTWKs29qDlrM/dZg2GSzOXrbJ+dblsc90t8xr14ILk3F7nBLhzmytiC66rD6suanGMdY zySsvg8wFk84lhmgzyTMTaQzhvoeisFC/oQii5L1w2oUru1aWE2O3qnaevuHK8zfGxMvR+8Y6Gj tu6/t30Q2zDF7O7/jiKqCdRGXMBRq/32/J963ESSYAG4vpgb7NZpMXtnu7WlR7YjJ+7GUQyTeuX 4xo2DECDQvhfLY4eVXXcgqthMLBhT1rrN8sUDVuh0gvTBf35VacpE1GlTeUtgyQAHv9EXt+/1Oy ZjKYohH181YDtIVap9WQH9y/pSXchPTsVKofW/hED19NH5COasglNQLyiYOu+i/sPYbk7UR0BY8 wG7yRAfN1sSaNSB9V1elrlsxo2gYwC4oI83Ws3jCY5EoRRE2EaL0jQnHLXY8eApKlVnJ0mmG+fa k9r3aoVdLK46KrcftBJxpKi3RIxrZSmaQ7x/l6hXc8M1GpA5vt1d/1M1QiiOUv+G6OvDW7iMC5w dwKqdXvJL/s0A5TJaW2Ktn+I8/tJbhln2l+m6Fu25gKvbeeMVaGy/EyU2eeD2Gw854pMrJXKk/r oE/RCudq0Am+x7A8z1fqX318VPixll4b4uxTDi8zVgXoAlttVnSDvjSUv5mBJMroHl9O1SGbiD2 e4lZw26WqZTNzOIAqYBE3k9Mpw= X-Mailman-Approved-At: Tue, 11 Feb 2014 10:32:07 -0800 Cc: "therightkey@ietf.org" , "certificate-transparency@googlegroups.com" Subject: Re: [therightkey] [cabfpub] Updated Certificate Transparency + Extended Validation plan X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Feb 2014 18:31:15 -0000 --_000_EF70381B2D29784EA4FC66042BE81EAF1EB9FDB4SJDCEXMBX03ustr_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Q2hlbWEsIHRoYW5rcyBmb3IgcG9zdGluZyB0aGUgbGluayB0byB0aGUgRUpCQ0EgYmxvZyBvbiBw cmUtY2VydGlmaWNhdGVzLiAgSeKAmXZlIHBhc3RlZCBpbiB0aGUgdGV4dCBiZWxvdy4gIFdlIHNo b3VsZCBkaXNjdXNzIHRoZXNlIHF1ZXN0aW9ucyBpbiBNb3VudGFpbiBWaWV3Lg0KDQpCeSB0aGUg d2F5LCB0aGUgYmxvZyBiZWxvdyBzYXlzIHRoYXQgQ2VydGlmaWNhdGUgVHJhbnNwYXJlbmN5IGlz IHN1cHBvcnRlZCBpbiBFSkJDQSBFbnRlcnByaXNlPGh0dHA6Ly93d3cucHJpbWVrZXkuc2UvUHJv ZHVjdHMvRUpCQ0ErUEtJLz4gYXMgb2YgRUpCQ0EgdmVyc2lvbiA2LjAuNC4gIEhvd2V2ZXIsIGlu IGxvb2tpbmcgYXQgdGhlIEVKQkNBIHdlYnNpdGUsIHRoYXQgdmVyc2lvbiBoYXMgbm90IHlldCBi ZWVuIHJlbGVhc2VkLCBzbyBhbnkgQ0EgdXNpbmcgRUpCQ0Egd2lsbCBub3QgaGF2ZSB1cGRhdGVk IHNvZnR3YXJlIHRvIHVzZS4NCg0KS2lyayBSLiBIYWxsDQpPcGVyYXRpb25zIERpcmVjdG9yLCBU cnVzdCBTZXJ2aWNlcw0KVHJlbmQgTWljcm8NCg0KKioqKioqKioqKioqKg0KDQpDZXJ0aWZpY2F0 ZSBUcmFuc3BhcmVuY3kgYW5kIFByZUNlcnRpZmljYXRlcywgaG93IHdpbGwgdGhhdCB3b3JrPw0K DQpUaGUgQ2VydGlmaWNhdGUgVHJhbnNwYXJlbmN5IGluaXRpYXRpdmUgKFJGQzY5NjI8aHR0cDov L3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNjk2Mj4pIGlzIGFuIGFkbWlyYWJsZSBzdWdnZXN0aW9u IHRvIGltcHJvdmUgc2VjdXJpdHkgb2YgVExTIHdlYiBzZXNzaW9uIGZvciBjZXJ0aWZpY2F0ZXMg aXNzdWVkIGJ5IHB1YmxpYyBDQXMuIEl0IGhhcyBjb29sIHRlY2hub2xvZ3kgd2l0aCBNZXJrbGUg dHJlZXMsIGlzIGFkbWlyYWJsZSBzaG9ydCBhbmQgY291bGQgaGF2ZSBiZWVuIHN0cmFpZ2h0IGZv cndhcmQgd2FzIGl0IG5vdCBmb3Igc29tZXRoaW5nIGNhbGxlZCBQcmVDZXJ0aWZpY2F0ZXMuIFBy ZUNlcnRpZmljYXRlcyBhcmUgaGFyZCBmb3IgbWUgdG8gdW5kZXJzdGFuZCwgSSBkb24ndCBsaWtl IHRoZW0uIEkgaG9wZSBpdCBpcyBiZWNhdXNlIEkgZG9uJ3QgdW5kZXJzdGFuZCB0aGVtLi4uaWYg c28gcGxlYXNlIGxldCBtZSBrbm93Lg0KDQpXcml0aW5nIHRoaXMgcG9zdCBpcyBhIHdheSB0byBz b3J0IHRoaW5ncyBvdXQgZm9yIG15c2VsZiBhbmQgSSdkIGJlIGhhcHB5IHRvIGVkaXQgdGhpcyBw b3N0IGlmIGV4cGxhaW5lZCB3aHkgSSAianVzdCBkb24ndCBnZXQgaXQiLiBPZiBjb3Vyc2UgSSBh bSBwb3N0aW5nIHRoaXMgdG8gdGhlIENUIGZvcnVtIGFzIHdlbGwuLi4NCg0KSW4gdGhlIHNha2Ug b2YgdHJhbnNwYXJlbmN5LCBJJ20gd3JpdGluZyB3aXRoIHRoZSB2aWV3IHBvaW50IG9mIGFuIGlt cGxlbWVudGVyIG9mIG9wZW4gc291cmNlIENBIHNvZnR3YXJlPGh0dHA6Ly9lamJjYS5vcmcvPiAo aWYgeW91IGRpZG4ndCBmaWd1cmUgdGhhdCBvbmUgb3V0IGZyb20gdGhlIGJsb2cgbmFtZTotKSku DQoNClVwZGF0ZSAxOiBJIGdvdCBsb3RzIG9mIGNvbW1lbnRzIGFscmVhZHkgb3ZlciBhdCB0aGUg Q2VydGlmaWNhdGUgVHJhbnNwYXJlbmN5IEZvcnVtPGh0dHBzOi8vZ3JvdXBzLmdvb2dsZS5jb20v Zm9ydW0vP2Zyb21ncm91cHMjIXRvcGljL2NlcnRpZmljYXRlLXRyYW5zcGFyZW5jeS8xdFd6U1hL ZTNnUT4sIHJlYWxseSBnb29kLg0KDQpVcGRhdGUgMjogSSBjcmVhdGVkIGFuIGlzc3VlIGluIHRo ZSBDZXJ0aWZpY2F0ZSBUcmFuc3BhcmVuY3kgaXNzdWUgdHJhY2tlci4gaHR0cHM6Ly9jb2RlLmdv b2dsZS5jb20vcC9jZXJ0aWZpY2F0ZS10cmFuc3BhcmVuY3kvaXNzdWVzL2RldGFpbD9pZD0xOA0K DQpVcGRhdGUgMzogT2YgY291cnNlIG15IHZpZXdzIG9uIENUIGNoYW5nZXMgYXMgdGhlIGRpc2N1 c3Npb24gY29udGludWVzLCB0aGUgcG9zdCBiZWxvdyB3YXMgbXkgb3JpZ2luYWwgc3RhcnRpbmcg cG9pbnQuIEZvbGxvdyB0aGUgZGlzY3Vzc2lvbiBpbiBVcGRhdGUgMSBmb3IgdXBkYXRlcy4NCg0K VXBkYXRlIDQ6IEVKQkNBIHN1cHBvcnRzIENlcnRpZmljYXRlIFRyYW5zcGFyZW5jeSBpbiBFSkJD QSBFbnRlcnByaXNlPGh0dHA6Ly93d3cucHJpbWVrZXkuc2UvUHJvZHVjdHMvRUpCQ0ErUEtJLz4g YXMgb2YgRUpCQ0EgdmVyc2lvbiA2LjAuNC4NCg0KT24gdG8gUHJlQ2VydGlmaWNhdGVzLi4uDQoN ClByZUNlcnRpZmljYXRlcyBhcmUgZGVmaW5lZCBpbiBzZWN0aW9uICIzLjEuIExvZyBFbnRyaWVz PGh0dHA6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzY5NjIjc2VjdGlvbi0zLjE+IiBhcyAodGV4 dCB0cmltZWQgYnkgbWUpICJUaGUgUHJlY2VydGlmaWNhdGUgaXMgY29uc3RydWN0ZWQgZnJvbSB0 aGUgY2VydGlmaWNhdGUgdG8gYmUgaXNzdWVkIGJ5IGFkZGluZyBhIHNwZWNpYWwgY3JpdGljYWwg cG9pc29uIGV4dGVuc2lvbiB0byB0aGUgZW5kLWVudGl0eSBUQlNDZXJ0aWZpY2F0ZSIuIFRoZW4g aXQgZGVzY3JpYmVzIGhvdyBpdCBjYW4gYmUgcHJvZHVjZWQgYW5kIGl0IGlzIG1lbnRpb25lZCB0 aHJvdWdob3V0IHRoZSBzcGVjIGluIG1hbnkgcGxhY2VzLg0KQSBQcmVDZXJ0aWZpY2F0ZSBpcyBh IGVzc2VudGlhbGx5IGEgY2VydGlmaWNhdGUgc2lnbmVkIHdpdGggb25lIG9mIHR3byBvcHRpb25z Og0KDQoxLiBQcmVDZXJ0aWZpY2F0ZXMgc2lnbmVkIGJ5IHRoZSByZWFsIENBLg0KVGhpcyBzb3Vu ZHMgdmVyeSBkYW5nZXJvdXMgYXMgd2lsbCBicmVhayB0aGUgZnVuZGFtZW50YWwgWC41MDkgcnVs ZSBvZiB1bmlxdWUgaXNzdWVyRE4vc2VyaWFsTnVtYmVyIHBhaXJzLiBUaGUgY29uc2VxdWVuY2Vz IG9mIGhhdmluZyB0d28gImNlcnRpZmljYXRlcyIgd2l0aCB0aGUgc2FtZSBpc3N1ZXJETi9zZXJp YWxOdW1iZXIgaW4gdGhlIHdpbGQgY2FuIG5vdCBwb3NzaWJseSBiZSBlc3RpbWF0ZWQsIG1ha2lu ZyB0aGlzIHByYWN0aWNlIHF1aXRlIGRhbmdlcm91cyBpbWhvLg0KDQoyLiBQcmVDZXJ0aWZpY2F0 ZXMgc2lnbmVkIGJ5IGEgc2VwYXJhdGUgUHJlQ2VydGlmaWNhdGUgc2lnbmluZyBDQSwgd2hpY2gg aXMgYSBTdWJDQSB0byB0aGUgcmVhbCBzaWduaW5nIENBLiBUaGlzIGlzIGEgbGVzcyBzY2FyeSwg c2luY2UgaXQgaXMgbm9ybWFsIHByYWN0aWNlIHRoYXQgZGlmZmVyZW50IENBcyBjYW4gaXNzdWUg Y2VydGlmaWNhdGUgd2l0aCB0aGUgc2FtZSBzdWJqZWN0RE4vc2VyaWFsTnVtYmVyLCBqdXN0IG5v dCB0aGUgc2FtZSBpc3N1ZXJETi4NCg0KVGhlIGFjdHVhbCBpbXBsZW1lbnRhdGlvbiBvZiBpc3N1 aW5nIFByZUNlcnRpZmljYXRlcyBtYWtlcyBpdCBxdWl0ZSBpbXByYWN0aWNhbC4gSSB3b3VsZCBi ZWxpZXZlIHRoYXQgbW9zdCBDQSBpbXBsZW1lbnRhdGlvbnMgY3JlYXRlcyB0aGUgVEJTQ2VydGlm aWNhdGU8aHR0cDovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNTI4MCNzZWN0aW9uLTQuMS4xLjE+ IGFzIHBhcnQgb2YgdGhlIGFjdHVhbCBjZXJ0aWZpY2F0ZSBpc3N1YW5jZS4gVGhlIENBIHdpbGwg bm90IGNyZWF0ZSB0aGUgVEJTQ2VydGlmaWNhdGUgdG8gaGF2ZSBpcyBseWluZyBhcm91bmQgZm9y IGEgY291cGxlIG9mIGRheXMgYmVmb3JlIHVzaW5nIGl0IHRvIGlzc3VlIHRoZSByZWFsIGNlcnRp ZmljYXRlLg0KVGh1cywgaWYgdGhlIENBIGlzIHRvIGNyZWF0ZSBhIFByZUNlcnRpZmljYXRlIHRv IHNlbmQgdG8gdGhlIENUIGxvZywgaXQgbWlnaHQgYXMgd2VsbCBpc3N1ZSB0aGUgcmVhbCBjZXJ0 aWZpY2F0ZSBhbmQgc2VuZCBpdCB0byB0aGUgbG9nLiBUaGUgdGltZSBkaWZmZXJlbmNlIHNob3Vs ZCBiZSBpbiB0aGUgbWlsbGlzZWNvbmRzIGZvciBtb3N0IENBcy4NCklmIHRoZSBDQSB3YW50cyB0 byB3YWl0IGJlZm9yZSBkaXN0cmlidXRpbmcgdGhlIHJlYWwgY2VydGlmaWNhdGUsIHRvIG1ha2Ug c3VyZSBpdCdzIGluIHRoZSBsb2dzIGJlZm9yZSBwdXQgaW50byBwcm9kdWN0aW9uLCBpdCBjYW4g c3VyZWx5IGRvIHNvIGFzIHdlbGwuDQoNClRoZSBQcmVDZXJ0aWZpY2F0ZSBpbWhvIHN1ZmZlcnMg ZnJvbSBzZXZlcmFsIGNvbXBsaWNhdGluZyBmYWN0b3JzIGZvciBpbXBsZW1lbnRlcnMsIGJvdGgg b24gdGhlIENBIGFuZCB0aGUgQ1QgbG9nIHNpZGUuIFRoZSBUQlNDZXJ0aWZpY2F0ZSBtdXN0IGhh dmUgYSBwb2lzb24gZXh0ZW5zaW9uIGluc2VydGVkLCBhbmQgcmVtb3ZlZCwgZWZmZWN0aXZlbHkg cmUtZW5jb2RpbmcgdGhlIEFTTi4xIFRCU0NlcnRpZmljYXRlIHNldmVyYWwgdGltZXMsIGFsbCB0 aGVzZSBhcmUgcG9pbnRzIG9mIGZhaWx1cmUuDQoNClRoZSByZWFzb24gZm9yIFByZUNlcnRpZmlj YXRlcyBhcmUgbm90IGNsZWFybHkgZXhwbGFpbmVkLiBXaHkgd291bGQgeW91IHdhbnQgdG8gdXNl IFByZUNlcnRpZmljYXRlcz8NCg0KRmluZSBjb21iaW5nIHRocm91Z2ggdGhlIHNwZWMgZ2l2ZXMg bWUgc29tZSBpZGVhcyBvbiB3aHksIGZvciBleGFtcGxlIHRvIGJlIGFibGUgdG8gZW1iZWQgdGhl IENlcnRpZmljYXRlIGV4dGVuc2lvbiBmcm9tIFByZUNlcnRpZmljYXRlIENUIGxvZ3MgaW4gdGhl IGZpbmFsIGNlcnRpZmljYXRlIChzZWN0aW9uIDMuMzxodHRwOi8vdG9vbHMuaWV0Zi5vcmcvaHRt bC9yZmM2OTYyI3NlY3Rpb24tMy4zPikuIEJ1dCB0aGUgdGhlIFRCU0NlcnRpZmljYXRlIG9mIHRo ZSBQcmVDZXJ0aWZpY2F0ZSBpcyB0aGVuIG5vIGxvbmdlciB0aGUgcmVhbCBUQlNDZXJ0aWZpY2F0 ZT8gSW4gdGhhdCBjYXNlLCB3aHkgaXMgdGhlIFByZUNlcnRpZmljYXRlIHRoZSBUQlNDZXJ0aWZp Y2F0ZSBhdCBhbGwsIGFuZCBub3QganVzdCBhIG5ldyBkYXRhIHN0cnVjdHVyZSB3aXRoIHRoZSBk YXRhIHRoZSBDVCBsb2cgd2FudHM/DQoNClRoZSBQcmVDZXJ0aWZpY2F0ZSBjb21wbGljYXRlcyB0 aGUgQ1Qgc3BlYyBieSBvcmRlcnMgb2YgbWFnbml0dWRlLCB3aGljaCBpcyBub3QgYSBnb29kIHRo aW5nLiBUaGVyZSBhcmUgc28gbWFueSBpZnMgYW5kIGJ1dHMgYWJvdXQgUHJlQ2VydGlmaWNhdGUg dGhlIFJGQyBpcyBub3QgZXZlbiBpdHNlbGYgY29uc2l0ZW50IGFib3V0IHdoYXQgaXQgaXMuDQoN Ck9rLCBJIGtub3cgdGhlIFByZUNlcnRpZmljYXRlIGlzIGlzIG9wdGlvbmFsLCBidXQgdGhlIGJl c3Qgc3RhbmRhcmRzLCB3aG8gZ2V0cyBmYXN0LCB3aWRlIGFuZCByb2J1c3QgZGVwbG95bWVudCwg YXJlIHRoZSBzaW1wbGVyIG9uZXMgKEtJU1MpLiBTa2lwcGluZyBQcmVDZXJ0aWZpY2F0ZXMgZnJv bSB0aGUgQ1Qgc3BlYyBtYWtlcyBpdCBzbyBtdWNoIHNpbXBsZXIuDQoNCk15IHN1Z2dlc3Rpb246 DQotIFNraXAgUHJlQ2VydGlmaWNhdGVzIGFsdG9nZXRoZXINCg0KSSBzZWUgdGhvdWdoIHdoeSBw ZW9wbGUgd2lsbCBub3QgYWNjZXB0IHRoYXQganVzdCBiZWNhdXNlIEkgc2F5IHNvbWV0aGluZy4u LnNvIGluIHRoYXQgY2FzZQ0KDQotIEV4cGxhaW4gdGhlIHB1cnBvc2UgYmVoaW5kIFByZUNlcnRp ZmljYXRlcyB3ZWxsDQotIERlc2NyaWJlIHdoYXQgdGhlIGFjdHVhbCBpbmZvcm1hdGlvbiBmcm8g UHJlQ2VydGlmaWNhdGUgYXJlIHVzZWQNCi0gQmUgY29uc2lzdGVudCB0aHJvdWdob3V0IGluIHRo ZSBSRkMNCg0KDQoNCkZyb206IHB1YmxpYy1ib3VuY2VzQGNhYmZvcnVtLm9yZyBbbWFpbHRvOnB1 YmxpYy1ib3VuY2VzQGNhYmZvcnVtLm9yZ10gT24gQmVoYWxmIE9mIENoZW1hIEzDs3BleiBHb256 w6FsZXoNClNlbnQ6IE1vbmRheSwgRmVicnVhcnkgMTAsIDIwMTQgODoyOSBBTQ0KVG86IFJvYiBT dHJhZGxpbmc7IGNlcnRpZmljYXRlLXRyYW5zcGFyZW5jeUBnb29nbGVncm91cHMuY29tDQpDYzog dGhlcmlnaHRrZXlAaWV0Zi5vcmc7IENBQkZQdWINClN1YmplY3Q6IFJlOiBbY2FiZnB1Yl0gVXBk YXRlZCBDZXJ0aWZpY2F0ZSBUcmFuc3BhcmVuY3kgKyBFeHRlbmRlZCBWYWxpZGF0aW9uIHBsYW4N Cg0KSGF2ZSBhbnlvbmUgdGFrZSBpbnRvIGFjY291bnQgdGhlIGN1cnJlbnQgcG9zaXRpb24gb2Yg RUpCQ0E8aHR0cDovL2Jsb2cuZWpiY2Eub3JnLzIwMTMvMDkvY2VydGlmaWNhdGUtdHJhbnNwYXJl bmN5LWFuZC5odG1sPiwgYSBtYXlvciBwbGF5ZXIgaW4gdGhpcyBzdHVmZiBvZiBkaWdpdGFsIGNl cnRpZmljYXRlcz8NCg0KVG8gc3VtbWFyaXplOg0KIk15IHN1Z2dlc3Rpb246DQotIFNraXAgUHJl Q2VydGlmaWNhdGVzIGFsdG9nZXRoZXIiDQoNCk9uIHRoZSBvdGhlciBoYW5kLCB0cnlpbmcgdG8g dXNlIGEgdGhpbmcgdGhhdCBsb29rcyBsaWtlIGEgY2VydGlmaWNhdGUgKFguNTA5djMpIG5vdCB0 byBkbyB0aGUgdGFzayBvZiBhIGNlcnRpZmljYXRlIGlzIGxpa2UgdHJ5aW5nIHRvIHVzZSBhIHNj cmV3ZHJpdmVyIHRvIG5haWwgbmFpbHMuDQoNCldlIGFncmVlIHRoYXQgdGhlIGluZm9ybWF0aW9u IGNvbnRhaW5lZCBpbiB0aGUgcHJlY2VydGlmaWNhdGUgaXMgcmVsZXZhbnQsIGFuZCB0aGF0IHRo ZSBzaWduYXR1cmUgb2Ygc3VjaCBpbmZvcm1hdGlvbiBpcyBhbHNvIG5lY2Vzc2FyeSwgYnV0IG1h eWJlIHRoZSBjb250YWluZXIgY291bGQgYmUgYSBkaWZmZXJlbnQgZm9ybWF0IG9yIEFTTi4xIHN0 cnVjdHVyZSBkaWZmZXJlbnQgZnJvbSBhIFguNTA5djMgY2VydC4NCg0KDQoNCg0KDQoNCltBQyBG aXJtYXByb2Zlc2lvbmFsIFMuQS5dPGh0dHA6Ly93d3cuZmlybWFwcm9mZXNpb25hbC5jb20vPg0K DQoNCkNoZW1hIEzDs3BleiBHb256w6FsZXoNCg0KQUMgRmlybWFwcm9mZXNpb25hbCBTLkEuDQoN Cg0KDQpBdi4gVG9ycmUgQmxhbmNhLCA1Ny4NCkVkaWZpY2lvIEVTQURFQ1JFQVBPTElTIC0gMUIx Mw0KMDgxNzMgU2FudCBDdWdhdCBkZWwgVmFsbMOocy4gQmFyY2Vsb25hLg0KVGVsOiA5My40Nzcu NDIuNDUgLyA2NjYuNDI5LjIyNA0KDQoNCkVsIGNvbnRlbmlkbyBkZSBlc3RlIG1lbnNhamUgeSBk ZSBzdXMgYW5leG9zIGVzIGNvbmZpZGVuY2lhbC4gU2kgbm8gZXMgZWwgZGVzdGluYXRhcmlvLCBs ZSBoYWNlbW9zIHNhYmVyIHF1ZSBlc3TDoSBwcm9oaWJpZG8gdXRpbGl6YXJsbywgZGl2dWxnYXJs byB5L28gY29waWFybG8gc2luIHRlbmVyIGxhIGF1dG9yaXphY2nDs24gY29ycmVzcG9uZGllbnRl LiBTaSBoYSByZWNpYmlkbyBlc3RlIG1lbnNhamUgcG9yIGVycm9yLCBsZSBhZ3JhZGVjZXLDrWFt b3MgcXVlIGxvIGhhZ2Egc2FiZXIgaW5tZWRpYXRhbWVudGUgYWwgcmVtaXRlbnRlIHkgcXVlIHBy b2NlZGEgYSBkZXN0cnVpciBlbCBtZW5zYWplLg0KDQpPbiBNb24sIEZlYiAxMCwgMjAxNCBhdCAx Mjo1MCBQTSwgUm9iIFN0cmFkbGluZyA8cm9iLnN0cmFkbGluZ0Bjb21vZG8uY29tPG1haWx0bzpy b2Iuc3RyYWRsaW5nQGNvbW9kby5jb20+PiB3cm90ZToNCk9uIDEwLzAyLzE0IDExOjM1LCBCZW4g TGF1cmllIHdyb3RlOg0KPiBPbiAxMCBGZWJydWFyeSAyMDE0IDEwOjEzLCBSb2IgU3RyYWRsaW5n IDxyb2Iuc3RyYWRsaW5nQGNvbW9kby5jb208bWFpbHRvOnJvYi5zdHJhZGxpbmdAY29tb2RvLmNv bT4+IHdyb3RlOg0KPj4gT24gMDgvMDIvMTQgMTM6MzIsIEJlbiBMYXVyaWUgd3JvdGU6DQo+Pj4N Cj4+PiBPbiA1IEZlYnJ1YXJ5IDIwMTQgMTg6MjEsIFJvYiBTdHJhZGxpbmcgPHJvYi5zdHJhZGxp bmdAY29tb2RvLmNvbTxtYWlsdG86cm9iLnN0cmFkbGluZ0Bjb21vZG8uY29tPj4gd3JvdGU6DQo+ Pj4+DQo+Pj4+IE9uIDA1LzAyLzE0IDE3OjQ5LCBBZGFtIExhbmdsZXkgd3JvdGU6DQo+Pj4+Pg0K Pj4+Pj4NCj4+Pj4+IE9uIFdlZCwgRmViIDUsIDIwMTQgYXQgMTI6MjYgUE0sIFJvYiBTdHJhZGxp bmcNCj4+Pj4+IDxyb2Iuc3RyYWRsaW5nQGNvbW9kby5jb208bWFpbHRvOnJvYi5zdHJhZGxpbmdA Y29tb2RvLmNvbT4+DQo+Pj4+PiB3cm90ZToNCj4+Pj4+Pg0KPj4+Pj4+DQo+Pj4+Pj4gUHJlc3Vt YWJseSBpdCdzIHNvbWV3aGVyZSBiZXR3ZWVuIDEwIGFuZCAzMSBkYXlzLCBzaW5jZSAxIFNDVCBp cw0KPj4+Pj4+IGFjY2VwdGFibGUNCj4+Pj4+PiBmb3IgU3RhcGxlZCBPQ1NQIGFuZCB0aGUgQlJz IHBlcm1pdCBPQ1NQIFJlc3BvbnNlcyB0byBiZSB2YWxpZCBmb3IgdXANCj4+Pj4+PiB0bw0KPj4+ Pj4+IDEwDQo+Pj4+Pj4gZGF5cy4NCj4+Pj4+DQo+Pj4+Pg0KPj4+Pj4NCj4+Pj4+IFRoZSBzcGVl ZCBhdCB3aGljaCB3ZSBuZWVkIHRvIGRpc3RydXN0IGEgbG9nIGRlcGVuZHMgb24gdGhlIG1pbmlt dW0NCj4+Pj4+IG51bWJlciBvZiBTQ1RzIGFjdHVhbGx5LCB3aGljaCBpcyB3aHkgYWxsb3dpbmcg YSBzaW5nbGUgU0NUIGluIHN0YXBsZWQNCj4+Pj4+IE9DU1AgcmVzcG9uc2VzIGlzIHN1Y2ggYSBs YXJnZSBjb25jZXNzaW9uLiBJZiB0aGUgbWluaW11bSBudW1iZXIgb2YNCj4+Pj4+IFNDVHMgd2Vy ZSB0d28gdGhlbiB0aGUgcHJlc3N1cmUgdG8gZGlzdHJ1c3QgYSBsb2cgKGFuZCB0aGUgcHJlc3N1 cmUgb24NCj4+Pj4+IHRoZSBsb2dzKSB3b3VsZCBiZSBkcmFtYXRpY2FsbHkgcmVkdWNlZCBiZWNh dXNlIGNvbXByb21pc2luZyBvbmUgbG9nDQo+Pj4+PiB3b3VsZG4ndCBiZSBzdWZmaWNpZW50Lg0K Pj4+Pj4NCj4+Pj4+PiBEbyB5b3Ugc3RpbGwgdGhpbmsgWzFdIGlzIGEgZ29vZCBwbGFuPw0KPj4+ Pj4NCj4+Pj4+DQo+Pj4+Pg0KPj4+Pj4gU3VyZSwgaWYgYW55IENBcyBhcmUgd2lsbGluZyB0byBk byBpdCBub3cgOikNCj4+Pj4NCj4+Pj4NCj4+Pj4NCj4+Pj4gSSB0aGluayAic2VydmVycyBjb3Vs ZCBqdXN0IGRvd25sb2FkIHRoZWlyIHJlZnJlc2hlZCBjZXJ0aWZpY2F0ZSBvdmVyDQo+Pj4+IEhU VFANCj4+Pj4gcGVyaW9kaWNhbGx5IGFuZCBhdXRvbWF0aWNhbGx5IiBpcyB0aGUgc2hvd3N0b3Bw ZXIgYXQgdGhlIG1vbWVudC4gWWVzDQo+Pj4+IHRoZXkNCj4+Pj4gY291bGQsIGJ1dCBJJ20gbm90 IGF3YXJlIG9mIGFueSBzZXJ2ZXIgdGhhdCBhY3R1YWxseSBpbXBsZW1lbnRzIHN1Y2ggYQ0KPj4+ PiBmZWF0dXJlLg0KPj4+DQo+Pj4NCj4+PiBXb3JrIGlzIHVuZGVyIHdheSBmb3IgQXBhY2hlOiBo dHRwczovL2dpdGh1Yi5jb20vdHJhd2ljay9jdC1odHRwZC8uDQo+Pg0KPj4NCj4+IFRoYXQgbG9v a3MgbGlrZSBncmVhdCB3b3JrLCBidXQgQUZBSUNUIGl0J3Mgb25seSBmb3IgZmV0Y2hpbmcgU0NU cyBmcm9tIENUDQo+PiBMb2dzLg0KPj4NCj4+IEkgd2FzIHRhbGtpbmcgYWJvdXQgdGhlIGxhY2sg b2YgYW55IG1lY2hhbmlzbSBpbiBwb3B1bGFyIHdlYnNlcnZlciBzb2Z0d2FyZQ0KPj4gZm9yIGF1 dG9tYXRpY2FsbHkgZmV0Y2hpbmcgYW5kIGluc3RhbGxpbmcgY2VydGlmaWNhdGVzIGZyb20gQ0Fz LiAgSW4NCj4+IHBhcnRpY3VsYXI6IGEgc2hvcnQtZHVyYXRpb24gY2VydGlmaWNhdGUgdGhhdCBy ZXVzZXMgdGhlIHNhbWUgcHVibGljIGtleSBhcw0KPj4gdGhlIHByZXZpb3VzIGNlcnRpZmljYXRl Lg0KPg0KPiBBaCwgSSBzZWUhIEJ1dCB3aHkgd291bGQgeW91IG5lZWQgaXQgaWYgeW91IGNhbiBy ZWZyZXNoIHRoZSBTQ1RzIHlvdXJzZWxmPw0KVG8gZml4IGNlcnRpZmljYXRlIHJldm9jYXRpb24g Y2hlY2tpbmcsIGJ5IGF2b2lkaW5nIHRoZSBuZWVkIGZvciBpdCAoYXMNCkFkYW0gcHJvcG9zZWQg YSBjb3VwbGUgb2YgeWVhcnMgYWdvIC0gc2VlIFsxXSkuDQoNCkJ1dCByZWFsbHksIEkgd2FzIGp1 c3QgdHJ5aW5nIHRvIHBvaW50IG91dCB0aGF0IGp1c3QgYmVjYXVzZSBDQXMgYXJlbid0DQpub3Rp Y2VhYmx5IGlzc3Vpbmcgc2hvcnQtZHVyYXRpb24gY2VydHMgdG9kYXksIGl0IGRvZXNuJ3QgbWVh biB0aGF0IHRoZXkNCndvbid0IGRvIHNvIGluIHRoZSBmdXR1cmUuICBTbyBJIHRoaW5rIGl0IGlz IHdvcnRoIHBlcm1pdHRpbmcganVzdCAxDQplbWJlZGRlZCBTQ1QgZm9yIHNob3J0LWR1cmF0aW9u IGNlcnRzIChmb3Igc29tZSB2YWx1ZSBvZiAic2hvcnQiKS4NCg0KDQpbMV0gaHR0cHM6Ly93d3cu aW1wZXJpYWx2aW9sZXQub3JnLzIwMTEvMDMvMTgvcmV2b2NhdGlvbi5odG1sDQoiQSBtdWNoIGJl dHRlciBzb2x1dGlvbiB3b3VsZCBiZSBmb3IgY2VydGlmaWNhdGVzIHRvIG9ubHkgYmUgdmFsaWQg Zm9yIGENCmZldyBkYXlzIGFuZCB0byBmb3JnZXQgYWJvdXQgcmV2b2NhdGlvbiBhbHRvZ2V0aGVy LiBUaGlzIGRvZXNuJ3QgbWVhbg0KdGhhdCB0aGUgcHJpdmF0ZSBrZXkgbmVlZHMgdG8gY2hhbmdl IGV2ZXJ5IGZldyBkYXlzLCBqdXN0IHRoZQ0KY2VydGlmaWNhdGUuIEFuZCB0aGUgY2VydGlmaWNh dGUgaXMgcHVibGljIGRhdGEsIHNvIHNlcnZlcnMgY291bGQganVzdA0KZG93bmxvYWQgdGhlaXIg cmVmcmVzaGVkIGNlcnRpZmljYXRlIG92ZXIgSFRUUCBwZXJpb2RpY2FsbHkgYW5kDQphdXRvbWF0 aWNhbGx5IChsaWtlIE9DU1Agc3RhcGxpbmcpLiBDbGllbnRzIHdvdWxkbid0IGhhdmUgdG8gcGVy Zm9ybQ0KcmV2b2NhdGlvbiBjaGVja3MgKHdoaWNoIGFyZSB2ZXJ5IGNvbXBsZXggYW5kIHNsb3cp LCBDQXMgd291bGRuJ3QgaGF2ZQ0KdG8gcGF5IGZvciBtYXNzaXZlLCBERG9TIHByb29mIHNlcnZp bmcgY2FwYWNpdHkgYW5kIHJldm9jYXRpb24gd291bGQNCmFjdHVhbGx5IHdvcmsuIElmIHRoZSBD QSB3ZW50IGRvd24gZm9yIHNpeCBob3Vycywgbm9ib2R5IGNhcmVzLiBPbmx5IGlmDQp0aGUgQ0Eg aXMgZG93biBmb3IgZGF5cyBpcyB0aGVyZSBhIHByb2JsZW0uIElmIHlvdSB3YW50IHRvIOKAnHJl dm9rZeKAnSBhDQpjZXJ0aWZpY2F0ZSwganVzdCBzdG9wIHJlbmV3aW5nIGl0LiINCi0tDQpSb2Ig U3RyYWRsaW5nDQpTZW5pb3IgUmVzZWFyY2ggJiBEZXZlbG9wbWVudCBTY2llbnRpc3QNCkNPTU9E TyAtIENyZWF0aW5nIFRydXN0IE9ubGluZQ0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18NClB1YmxpYyBtYWlsaW5nIGxpc3QNClB1YmxpY0BjYWJmb3J1bS5v cmc8bWFpbHRvOlB1YmxpY0BjYWJmb3J1bS5vcmc+DQpodHRwczovL2NhYmZvcnVtLm9yZy9tYWls bWFuL2xpc3RpbmZvL3B1YmxpYw0KDQoNCjx0YWJsZSBjbGFzcz0iVE1fRU1BSUxfTk9USUNFIj48 dHI+PHRkPjxwcmU+DQpUUkVORCBNSUNSTyBFTUFJTCBOT1RJQ0UNClRoZSBpbmZvcm1hdGlvbiBj b250YWluZWQgaW4gdGhpcyBlbWFpbCBhbmQgYW55IGF0dGFjaG1lbnRzIGlzIGNvbmZpZGVudGlh bCANCmFuZCBtYXkgYmUgc3ViamVjdCB0byBjb3B5cmlnaHQgb3Igb3RoZXIgaW50ZWxsZWN0dWFs IHByb3BlcnR5IHByb3RlY3Rpb24uIA0KSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lw aWVudCwgeW91IGFyZSBub3QgYXV0aG9yaXplZCB0byB1c2Ugb3IgDQpkaXNjbG9zZSB0aGlzIGlu Zm9ybWF0aW9uLCBhbmQgd2UgcmVxdWVzdCB0aGF0IHlvdSBub3RpZnkgdXMgYnkgcmVwbHkgbWFp bCBvcg0KdGVsZXBob25lIGFuZCBkZWxldGUgdGhlIG9yaWdpbmFsIG1lc3NhZ2UgZnJvbSB5b3Vy IG1haWwgc3lzdGVtLg0KPC9wcmU+PC90ZD48L3RyPjwvdGFibGU+ --_000_EF70381B2D29784EA4FC66042BE81EAF1EB9FDB4SJDCEXMBX03ustr_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTQgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7 fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpUYWhvbWE7DQoJcGFub3NlLTE6MiAxMSA2IDQg MyA1IDQgNCAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpHZW9yZ2lhOw0KCXBhbm9z ZS0xOjIgNCA1IDIgNSA0IDUgMiAzIDM7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQnJh ZGxleSBIYW5kIElUQyI7DQoJcGFub3NlLTE6MyA3IDQgMiA1IDMgMiAzIDIgMzt9DQovKiBTdHls ZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1h bA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIu MHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLCJzZXJpZiI7fQ0KYTpsaW5rLCBz cGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsN Cgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxp bmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRl eHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJ bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjEyLjBwdDsN Cglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIiwic2VyaWYiO30NCnNwYW4uRW1haWxTdHls ZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxp YnJpIiwic2Fucy1zZXJpZiI7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXtt c28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsInNhbnMt c2VyaWYiO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJn aW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldv cmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hh cGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlm XS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQi Pg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94 bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIg dmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij5DaGVtYSwgdGhhbmtzIGZvciBw b3N0aW5nIHRoZSBsaW5rIHRvIHRoZSBFSkJDQSBibG9nIG9uIHByZS1jZXJ0aWZpY2F0ZXMuJm5i c3A7IEnigJl2ZSBwYXN0ZWQgaW4gdGhlIHRleHQgYmVsb3cuJm5ic3A7IFdlIHNob3VsZCBkaXNj dXNzIHRoZXNlIHF1ZXN0aW9ucyBpbiBNb3VudGFpbiBWaWV3LjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVv dDtzYW5zLXNlcmlmJnF1b3Q7Ij5CeSB0aGUgd2F5LCB0aGUgYmxvZyBiZWxvdyBzYXlzIHRoYXQN Cjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVv dDtzYW5zLXNlcmlmJnF1b3Q7Ij5DZXJ0aWZpY2F0ZSBUcmFuc3BhcmVuY3kgaXMgc3VwcG9ydGVk IGluJm5ic3A7PGEgaHJlZj0iaHR0cDovL3d3dy5wcmltZWtleS5zZS9Qcm9kdWN0cy9FSkJDQSYj NDM7UEtJLyI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5v bmUiPkVKQkNBIEVudGVycHJpc2U8L3NwYW4+PC9hPiZuYnNwO2FzIG9mIEVKQkNBIHZlcnNpb24g Ni4wLjQuJm5ic3A7DQogSG93ZXZlciwgaW4gbG9va2luZyBhdCB0aGUgRUpCQ0Egd2Vic2l0ZSwg dGhhdCB2ZXJzaW9uIGhhcyBub3QgeWV0IGJlZW4gcmVsZWFzZWQsIHNvIGFueSBDQSB1c2luZyBF SkJDQSB3aWxsIG5vdCBoYXZlIHVwZGF0ZWQgc29mdHdhcmUgdG8gdXNlLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90 Oztjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48Yj48aT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjE0LjBwdDtmb250LWZhbWls eTomcXVvdDtCcmFkbGV5IEhhbmQgSVRDJnF1b3Q7O2NvbG9yOiMwRjI0M0UiPktpcmsgUi4gSGFs bDxvOnA+PC9vOnA+PC9zcGFuPjwvaT48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij5PcGVyYXRpb25zIERpcmVjdG9yLCBUcnVzdCBTZXJ2 aWNlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1 b3Q7c2Fucy1zZXJpZiZxdW90OyI+VHJlbmQgTWljcm88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7Ij4qKioqKioqKioqKioqPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNl cmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJiYWNrZ3JvdW5kOndoaXRlIj48YSBuYW1lPSI1Mzk5 NzA5MjE2MzAwNzQyMjg0Ij48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxNi4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiND QzY2MDAiPkNlcnRpZmljYXRlIFRyYW5zcGFyZW5jeSBhbmQgUHJlQ2VydGlmaWNhdGVzLCBob3cg d2lsbCB0aGF0IHdvcms/PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90OyI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPlRoZSZuYnNwO0NlcnRpZmljYXRlIFRyYW5z cGFyZW5jeSZuYnNwO2luaXRpYXRpdmUgKDxhIGhyZWY9Imh0dHA6Ly90b29scy5pZXRmLm9yZy9o dG1sL3JmYzY5NjIiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlv bjpub25lIj5SRkM2OTYyPC9zcGFuPjwvYT4pIGlzIGFuDQogYWRtaXJhYmxlIHN1Z2dlc3Rpb24g dG8gaW1wcm92ZSBzZWN1cml0eSBvZiBUTFMgd2ViIHNlc3Npb24gZm9yIGNlcnRpZmljYXRlcyBp c3N1ZWQgYnkgcHVibGljIENBcy4gSXQgaGFzIGNvb2wgdGVjaG5vbG9neSB3aXRoIE1lcmtsZSB0 cmVlcywgaXMgYWRtaXJhYmxlIHNob3J0IGFuZCBjb3VsZCBoYXZlIGJlZW4gc3RyYWlnaHQgZm9y d2FyZCB3YXMgaXQgbm90IGZvciBzb21ldGhpbmcgY2FsbGVkIFByZUNlcnRpZmljYXRlcy4gUHJl Q2VydGlmaWNhdGVzDQogYXJlIGhhcmQgZm9yIG1lIHRvIHVuZGVyc3RhbmQsIEkgZG9uJ3QgbGlr ZSB0aGVtLiBJIGhvcGUgaXQgaXMgYmVjYXVzZSBJIGRvbid0IHVuZGVyc3RhbmQgdGhlbS4uLmlm IHNvIHBsZWFzZSBsZXQgbWUga25vdy48YnI+DQo8YnI+DQpXcml0aW5nIHRoaXMgcG9zdCBpcyBh IHdheSB0byBzb3J0IHRoaW5ncyBvdXQgZm9yIG15c2VsZiBhbmQgSSdkIGJlIGhhcHB5IHRvIGVk aXQgdGhpcyBwb3N0IGlmIGV4cGxhaW5lZCB3aHkgSSAmcXVvdDtqdXN0IGRvbid0IGdldCBpdCZx dW90Oy4gT2YgY291cnNlIEkgYW0gcG9zdGluZyB0aGlzIHRvIHRoZSBDVCBmb3J1bSBhcyB3ZWxs Li4uPGJyPg0KPGJyPg0KSW4gdGhlIHNha2Ugb2YgdHJhbnNwYXJlbmN5LCBJJ20gd3JpdGluZyB3 aXRoIHRoZSB2aWV3IHBvaW50IG9mIGFuIGltcGxlbWVudGVyIG9mJm5ic3A7PGEgaHJlZj0iaHR0 cDovL2VqYmNhLm9yZy8iPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3Jh dGlvbjpub25lIj5vcGVuIHNvdXJjZSBDQSBzb2Z0d2FyZTwvc3Bhbj48L2E+Jm5ic3A7KGlmIHlv dSBkaWRuJ3QgZmlndXJlIHRoYXQgb25lIG91dCBmcm9tIHRoZSBibG9nIG5hbWU6LSkpLjxicj4N Cjxicj4NCjxiPlVwZGF0ZSAxPC9iPjogSSBnb3QgbG90cyBvZiBjb21tZW50cyBhbHJlYWR5IG92 ZXIgYXQgdGhlJm5ic3A7PGEgaHJlZj0iaHR0cHM6Ly9ncm91cHMuZ29vZ2xlLmNvbS9mb3J1bS8/ ZnJvbWdyb3VwcyMhdG9waWMvY2VydGlmaWNhdGUtdHJhbnNwYXJlbmN5LzF0V3pTWEtlM2dRIj48 c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+Q2VydGlm aWNhdGUgVHJhbnNwYXJlbmN5IEZvcnVtPC9zcGFuPjwvYT4sIHJlYWxseQ0KIGdvb2QuPGJyPg0K PGJyPg0KPGI+VXBkYXRlIDI8L2I+OiBJIGNyZWF0ZWQgYW4gaXNzdWUgaW4gdGhlIENlcnRpZmlj YXRlIFRyYW5zcGFyZW5jeSBpc3N1ZSB0cmFja2VyLiZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vY29k ZS5nb29nbGUuY29tL3AvY2VydGlmaWNhdGUtdHJhbnNwYXJlbmN5L2lzc3Vlcy9kZXRhaWw/aWQ9 MTgiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5o dHRwczovL2NvZGUuZ29vZ2xlLmNvbS9wL2NlcnRpZmljYXRlLXRyYW5zcGFyZW5jeS9pc3N1ZXMv ZGV0YWlsP2lkPTE4PC9zcGFuPjwvYT48YnI+DQo8YnI+DQo8Yj5VcGRhdGUgMzwvYj46IE9mIGNv dXJzZSBteSB2aWV3cyBvbiBDVCBjaGFuZ2VzIGFzIHRoZSBkaXNjdXNzaW9uIGNvbnRpbnVlcywg dGhlIHBvc3QgYmVsb3cgd2FzIG15IG9yaWdpbmFsIHN0YXJ0aW5nIHBvaW50LiBGb2xsb3cgdGhl IGRpc2N1c3Npb24gaW4gVXBkYXRlIDEgZm9yIHVwZGF0ZXMuPGJyPg0KPGJyPg0KPGI+VXBkYXRl IDQ8L2I+OiBFSkJDQSBzdXBwb3J0cyBDZXJ0aWZpY2F0ZSBUcmFuc3BhcmVuY3kgaW4mbmJzcDs8 YSBocmVmPSJodHRwOi8vd3d3LnByaW1la2V5LnNlL1Byb2R1Y3RzL0VKQkNBJiM0MztQS0kvIj48 c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+RUpCQ0Eg RW50ZXJwcmlzZTwvc3Bhbj48L2E+Jm5ic3A7YXMgb2YgRUpCQ0EgdmVyc2lvbiA2LjAuNC48YnI+ DQo8YnI+DQpPbiB0byBQcmVDZXJ0aWZpY2F0ZXMuLi48YnI+DQo8YnI+DQpQcmVDZXJ0aWZpY2F0 ZXMgYXJlIGRlZmluZWQgaW4gc2VjdGlvbiAmcXVvdDs8YSBocmVmPSJodHRwOi8vdG9vbHMuaWV0 Zi5vcmcvaHRtbC9yZmM2OTYyI3NlY3Rpb24tMy4xIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93 dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+My4xLiBMb2cgRW50cmllczwvc3Bhbj48L2E+JnF1 b3Q7IGFzICh0ZXh0IHRyaW1lZCBieSBtZSkgJnF1b3Q7VGhlIFByZWNlcnRpZmljYXRlIGlzIGNv bnN0cnVjdGVkIGZyb20gdGhlIGNlcnRpZmljYXRlDQogdG8gYmUgaXNzdWVkIGJ5IGFkZGluZyBh IHNwZWNpYWwgY3JpdGljYWwgcG9pc29uIGV4dGVuc2lvbiB0byB0aGUgZW5kLWVudGl0eSBUQlND ZXJ0aWZpY2F0ZSZxdW90Oy4gVGhlbiBpdCBkZXNjcmliZXMgaG93IGl0IGNhbiBiZSBwcm9kdWNl ZCBhbmQgaXQgaXMgbWVudGlvbmVkIHRocm91Z2hvdXQgdGhlIHNwZWMgaW4gbWFueSBwbGFjZXMu PGJyPg0KQSBQcmVDZXJ0aWZpY2F0ZSBpcyBhIGVzc2VudGlhbGx5IGEgY2VydGlmaWNhdGUgc2ln bmVkIHdpdGggb25lIG9mIHR3byBvcHRpb25zOjxicj4NCjxicj4NCjEuIFByZUNlcnRpZmljYXRl cyBzaWduZWQgYnkgdGhlIHJlYWwgQ0EuPGJyPg0KVGhpcyBzb3VuZHMgdmVyeSBkYW5nZXJvdXMg YXMgd2lsbCBicmVhayB0aGUgZnVuZGFtZW50YWwgWC41MDkgcnVsZSBvZiB1bmlxdWUgaXNzdWVy RE4vc2VyaWFsTnVtYmVyIHBhaXJzLiBUaGUgY29uc2VxdWVuY2VzIG9mIGhhdmluZyB0d28gJnF1 b3Q7Y2VydGlmaWNhdGVzJnF1b3Q7IHdpdGggdGhlIHNhbWUgaXNzdWVyRE4vc2VyaWFsTnVtYmVy IGluIHRoZSB3aWxkIGNhbiBub3QgcG9zc2libHkgYmUgZXN0aW1hdGVkLCBtYWtpbmcgdGhpcyBw cmFjdGljZSBxdWl0ZQ0KIGRhbmdlcm91cyBpbWhvLjxicj4NCjxicj4NCjIuIFByZUNlcnRpZmlj YXRlcyBzaWduZWQgYnkgYSBzZXBhcmF0ZSBQcmVDZXJ0aWZpY2F0ZSBzaWduaW5nIENBLCB3aGlj aCBpcyBhIFN1YkNBIHRvIHRoZSByZWFsIHNpZ25pbmcgQ0EuIFRoaXMgaXMgYSBsZXNzIHNjYXJ5 LCBzaW5jZSBpdCBpcyBub3JtYWwgcHJhY3RpY2UgdGhhdCBkaWZmZXJlbnQgQ0FzIGNhbiBpc3N1 ZSBjZXJ0aWZpY2F0ZSB3aXRoIHRoZSBzYW1lIHN1YmplY3RETi9zZXJpYWxOdW1iZXIsIGp1c3Qg bm90IHRoZSBzYW1lIGlzc3VlckROLjxicj4NCjxicj4NClRoZSBhY3R1YWwgaW1wbGVtZW50YXRp b24gb2YgaXNzdWluZyBQcmVDZXJ0aWZpY2F0ZXMgbWFrZXMgaXQgcXVpdGUgaW1wcmFjdGljYWwu IEkgd291bGQgYmVsaWV2ZSB0aGF0IG1vc3QgQ0EgaW1wbGVtZW50YXRpb25zIGNyZWF0ZXMgdGhl Jm5ic3A7PGEgaHJlZj0iaHR0cDovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNTI4MCNzZWN0aW9u LTQuMS4xLjEiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpu b25lIj5UQlNDZXJ0aWZpY2F0ZTwvc3Bhbj48L2E+Jm5ic3A7YXMNCiBwYXJ0IG9mIHRoZSBhY3R1 YWwgY2VydGlmaWNhdGUgaXNzdWFuY2UuIFRoZSBDQSB3aWxsIG5vdCBjcmVhdGUgdGhlIFRCU0Nl cnRpZmljYXRlIHRvIGhhdmUgaXMgbHlpbmcgYXJvdW5kIGZvciBhIGNvdXBsZSBvZiBkYXlzIGJl Zm9yZSB1c2luZyBpdCB0byBpc3N1ZSB0aGUgcmVhbCBjZXJ0aWZpY2F0ZS48YnI+DQpUaHVzLCBp ZiB0aGUgQ0EgaXMgdG8gY3JlYXRlIGEgUHJlQ2VydGlmaWNhdGUgdG8gc2VuZCB0byB0aGUgQ1Qg bG9nLCBpdCBtaWdodCBhcyB3ZWxsIGlzc3VlIHRoZSByZWFsIGNlcnRpZmljYXRlIGFuZCBzZW5k IGl0IHRvIHRoZSBsb2cuIFRoZSB0aW1lIGRpZmZlcmVuY2Ugc2hvdWxkIGJlIGluIHRoZSBtaWxs aXNlY29uZHMgZm9yIG1vc3QgQ0FzLjxicj4NCklmIHRoZSBDQSB3YW50cyB0byB3YWl0IGJlZm9y ZSBkaXN0cmlidXRpbmcgdGhlIHJlYWwgY2VydGlmaWNhdGUsIHRvIG1ha2Ugc3VyZSBpdCdzIGlu IHRoZSBsb2dzIGJlZm9yZSBwdXQgaW50byBwcm9kdWN0aW9uLCBpdCBjYW4gc3VyZWx5IGRvIHNv IGFzIHdlbGwuPGJyPg0KPGJyPg0KVGhlIFByZUNlcnRpZmljYXRlIGltaG8gc3VmZmVycyBmcm9t IHNldmVyYWwgY29tcGxpY2F0aW5nIGZhY3RvcnMgZm9yIGltcGxlbWVudGVycywgYm90aCBvbiB0 aGUgQ0EgYW5kIHRoZSBDVCBsb2cgc2lkZS4gVGhlIFRCU0NlcnRpZmljYXRlIG11c3QgaGF2ZSBh IHBvaXNvbiBleHRlbnNpb24gaW5zZXJ0ZWQsIGFuZCByZW1vdmVkLCBlZmZlY3RpdmVseSByZS1l bmNvZGluZyB0aGUgQVNOLjEgVEJTQ2VydGlmaWNhdGUgc2V2ZXJhbCB0aW1lcywgYWxsDQogdGhl c2UgYXJlIHBvaW50cyBvZiBmYWlsdXJlLjxicj4NCjxicj4NClRoZSByZWFzb24gZm9yIFByZUNl cnRpZmljYXRlcyBhcmUgbm90IGNsZWFybHkgZXhwbGFpbmVkLiBXaHkgd291bGQgeW91IHdhbnQg dG8gdXNlIFByZUNlcnRpZmljYXRlcz88YnI+DQo8YnI+DQpGaW5lIGNvbWJpbmcgdGhyb3VnaCB0 aGUgc3BlYyBnaXZlcyBtZSBzb21lIGlkZWFzIG9uIHdoeSwgZm9yIGV4YW1wbGUgdG8gYmUgYWJs ZSB0byBlbWJlZCB0aGUgQ2VydGlmaWNhdGUgZXh0ZW5zaW9uIGZyb20gUHJlQ2VydGlmaWNhdGUg Q1QgbG9ncyBpbiB0aGUgZmluYWwgY2VydGlmaWNhdGUgKDxhIGhyZWY9Imh0dHA6Ly90b29scy5p ZXRmLm9yZy9odG1sL3JmYzY5NjIjc2VjdGlvbi0zLjMiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5k b3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5zZWN0aW9uDQogMy4zPC9zcGFuPjwvYT4pLiBC dXQgdGhlIHRoZSBUQlNDZXJ0aWZpY2F0ZSBvZiB0aGUgUHJlQ2VydGlmaWNhdGUgaXMgdGhlbiBu byBsb25nZXIgdGhlIHJlYWwgVEJTQ2VydGlmaWNhdGU/IEluIHRoYXQgY2FzZSwgd2h5IGlzIHRo ZSBQcmVDZXJ0aWZpY2F0ZSB0aGUgVEJTQ2VydGlmaWNhdGUgYXQgYWxsLCBhbmQgbm90IGp1c3Qg YSBuZXcgZGF0YSBzdHJ1Y3R1cmUgd2l0aCB0aGUgZGF0YSB0aGUgQ1QgbG9nIHdhbnRzPzxicj4N Cjxicj4NClRoZSBQcmVDZXJ0aWZpY2F0ZSBjb21wbGljYXRlcyB0aGUgQ1Qgc3BlYyBieSBvcmRl cnMgb2YgbWFnbml0dWRlLCB3aGljaCBpcyBub3QgYSBnb29kIHRoaW5nLiBUaGVyZSBhcmUgc28g bWFueSBpZnMgYW5kIGJ1dHMgYWJvdXQgUHJlQ2VydGlmaWNhdGUgdGhlIFJGQyBpcyBub3QgZXZl biBpdHNlbGYgY29uc2l0ZW50IGFib3V0IHdoYXQgaXQgaXMuPGJyPg0KPGJyPg0KT2ssIEkga25v dyB0aGUgUHJlQ2VydGlmaWNhdGUgaXMgaXMgb3B0aW9uYWwsIGJ1dCB0aGUgYmVzdCBzdGFuZGFy ZHMsIHdobyBnZXRzIGZhc3QsIHdpZGUgYW5kIHJvYnVzdCBkZXBsb3ltZW50LCBhcmUgdGhlIHNp bXBsZXIgb25lcyAoS0lTUykuIFNraXBwaW5nIFByZUNlcnRpZmljYXRlcyBmcm9tIHRoZSBDVCBz cGVjIG1ha2VzIGl0IHNvIG11Y2ggc2ltcGxlci48YnI+DQo8YnI+DQpNeSBzdWdnZXN0aW9uOjxi cj4NCi0gU2tpcCBQcmVDZXJ0aWZpY2F0ZXMgYWx0b2dldGhlcjxicj4NCjxicj4NCkkgc2VlIHRo b3VnaCB3aHkgcGVvcGxlIHdpbGwgbm90IGFjY2VwdCB0aGF0IGp1c3QgYmVjYXVzZSBJIHNheSBz b21ldGhpbmcuLi5zbyBpbiB0aGF0IGNhc2U8YnI+DQo8YnI+DQotIEV4cGxhaW4gdGhlIHB1cnBv c2UgYmVoaW5kIFByZUNlcnRpZmljYXRlcyB3ZWxsPGJyPg0KLSBEZXNjcmliZSB3aGF0IHRoZSBh Y3R1YWwgaW5mb3JtYXRpb24gZnJvIFByZUNlcnRpZmljYXRlIGFyZSB1c2VkPGJyPg0KLSBCZSBj b25zaXN0ZW50IHRocm91Z2hvdXQgaW4gdGhlIFJGQzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDsiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xv cjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7LCZxdW90O3Nh bnMtc2VyaWYmcXVvdDsiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEw LjBwdDtmb250LWZhbWlseTomcXVvdDtUYWhvbWEmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90 OyI+IHB1YmxpYy1ib3VuY2VzQGNhYmZvcnVtLm9yZyBbbWFpbHRvOnB1YmxpYy1ib3VuY2VzQGNh YmZvcnVtLm9yZ10NCjxiPk9uIEJlaGFsZiBPZiA8L2I+Q2hlbWEgTMOzcGV6IEdvbnrDoWxlejxi cj4NCjxiPlNlbnQ6PC9iPiBNb25kYXksIEZlYnJ1YXJ5IDEwLCAyMDE0IDg6MjkgQU08YnI+DQo8 Yj5Ubzo8L2I+IFJvYiBTdHJhZGxpbmc7IGNlcnRpZmljYXRlLXRyYW5zcGFyZW5jeUBnb29nbGVn cm91cHMuY29tPGJyPg0KPGI+Q2M6PC9iPiB0aGVyaWdodGtleUBpZXRmLm9yZzsgQ0FCRlB1Yjxi cj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW2NhYmZwdWJdIFVwZGF0ZWQgQ2VydGlmaWNhdGUgVHJh bnNwYXJlbmN5ICYjNDM7IEV4dGVuZGVkIFZhbGlkYXRpb24gcGxhbjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IYXZlIGFueW9uZSB0YWtlIGludG8gYWNjb3Vu dCB0aGUmbmJzcDs8YSBocmVmPSJodHRwOi8vYmxvZy5lamJjYS5vcmcvMjAxMy8wOS9jZXJ0aWZp Y2F0ZS10cmFuc3BhcmVuY3ktYW5kLmh0bWwiPmN1cnJlbnQgcG9zaXRpb24gb2YgRUpCQ0E8L2E+ LCBhIG1heW9yIHBsYXllciBpbiB0aGlzIHN0dWZmIG9mIGRpZ2l0YWwgY2VydGlmaWNhdGVzPzxv OnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VG8gc3VtbWFyaXpl OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLWxlZnQ6 MzAuMHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZx dW90OzxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0dlb3Jn aWEmcXVvdDssJnF1b3Q7c2VyaWYmcXVvdDs7Y29sb3I6IzMzMzMzMyI+TXkgc3VnZ2VzdGlvbjo8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTomcXVvdDtHZW9yZ2lh JnF1b3Q7LCZxdW90O3NlcmlmJnF1b3Q7O2NvbG9yOiMzMzMzMzMiPi0gU2tpcCBQcmVDZXJ0aWZp Y2F0ZXMgYWx0b2dldGhlcjwvc3Bhbj4mcXVvdDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9i bG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gdGhlIG90aGVyIGhh bmQsIHRyeWluZyB0byB1c2UgYSB0aGluZyB0aGF0IGxvb2tzIGxpa2UgYSBjZXJ0aWZpY2F0ZSAo WC41MDl2Mykgbm90IHRvIGRvIHRoZSB0YXNrIG9mIGEgY2VydGlmaWNhdGUgaXMgbGlrZSB0cnlp bmcgdG8gdXNlIGEgc2NyZXdkcml2ZXIgdG8gbmFpbCBuYWlscy48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2UgYWdyZWUgdGhhdCB0aGUgaW5m b3JtYXRpb24gY29udGFpbmVkIGluIHRoZSBwcmVjZXJ0aWZpY2F0ZSBpcyByZWxldmFudCwgYW5k IHRoYXQgdGhlIHNpZ25hdHVyZSBvZiBzdWNoIGluZm9ybWF0aW9uIGlzIGFsc28gbmVjZXNzYXJ5 LCBidXQgbWF5YmUgdGhlIGNvbnRhaW5lciBjb3VsZCBiZSBhIGRpZmZlcmVudCBmb3JtYXQgb3Ig QVNOLjEgc3RydWN0dXJlIGRpZmZlcmVudCBmcm9tIGEgWC41MDl2MyBjZXJ0LjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGJyIGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjx0YWJs ZSBjbGFzcz0iTXNvTm9ybWFsVGFibGUiIGJvcmRlcj0iMCIgY2VsbHBhZGRpbmc9IjAiPg0KPHRi b2R5Pg0KPHRyPg0KPHRkIHN0eWxlPSJwYWRkaW5nOi43NXB0IC43NXB0IC43NXB0IC43NXB0Ij4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9Imh0dHA6Ly93d3cuZmlybWFwcm9mZXNpb25h bC5jb20vIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxMTU1Q0M7dGV4dC1k ZWNvcmF0aW9uOm5vbmUiPjxpbWcgYm9yZGVyPSIwIiBpZD0iX3gwMDAwX2kxMDI1IiBzcmM9Imh0 dHA6Ly93d3cuZmlybWFwcm9mZXNpb25hbC5jb20vaW1hZ2VzL2ZwX2Zpcm1hcy5wbmciIGFsdD0i QUMgRmlybWFwcm9mZXNpb25hbCBTLkEuIj48L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC90 ZD4NCjx0ZCBzdHlsZT0icGFkZGluZzouNzVwdCAuNzVwdCAuNzVwdCAuNzVwdCI+DQo8cD48Yj48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssJnF1b3Q7c2Fucy1zZXJp ZiZxdW90Oztjb2xvcjojOTk5OTk5Ij5DaGVtYSBMw7NwZXogR29uesOhbGV6PGJyPg0KJm5ic3A7 PGJyPg0KQUMgRmlybWFwcm9mZXNpb25hbCBTLkEuPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iY29s b3I6Izk5OTk5OSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC90ZD4NCjwvdHI+DQo8dHI+DQo8 dGQgc3R5bGU9InBhZGRpbmc6Ljc1cHQgLjc1cHQgLjc1cHQgLjc1cHQiPjwvdGQ+DQo8dGQgc3R5 bGU9InBhZGRpbmc6Ljc1cHQgLjc1cHQgLjc1cHQgLjc1cHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGJyPg0KPHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LCZxdW90 O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6Izk5OTk5OSI+QXYuIFRvcnJlIEJsYW5jYSwgNTcuPC9z cGFuPiZuYnNwOzxicj4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90 OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiM5OTk5OTkiPkVkaWZpY2lvIEVTQURFQ1JF QVBPTElTIC0gMUIxMzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssJnF1b3Q7 c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojOTk5OTk5Ij4wODE3MyBTYW50IEN1Z2F0IGRlbCBWYWxs w6hzLiBCYXJjZWxvbmEuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiM5OTk5OTkiPlRlbDombmJzcDs8 L3NwYW4+OTMuNDc3LjQyLjQ1PHNwYW4gc3R5bGU9ImNvbG9yOiM5OTk5OTkiPiZuYnNwOy88L3Nw YW4+PHNwYW4gc3R5bGU9ImNvbG9yOiMzMzMzRkYiPiZuYnNwOzY2Ni40MjkuMjI0PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L3RkPg0KPC90cj4NCjwvdGJvZHk+DQo8L3RhYmxlPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+RWwgY29udGVuaWRvIGRlIGVzdGUgbWVuc2FqZSB5IGRlIHN1cyBhbmV4 b3MgZXMgY29uZmlkZW5jaWFsLiBTaSBubyBlcyBlbCBkZXN0aW5hdGFyaW8sIGxlIGhhY2Vtb3Mg c2FiZXIgcXVlIGVzdMOhIHByb2hpYmlkbyB1dGlsaXphcmxvLCBkaXZ1bGdhcmxvIHkvbyBjb3Bp YXJsbyBzaW4gdGVuZXIgbGEgYXV0b3JpemFjacOzbiBjb3JyZXNwb25kaWVudGUuIFNpIGhhIHJl Y2liaWRvIGVzdGUgbWVuc2FqZSBwb3IgZXJyb3IsDQogbGUgYWdyYWRlY2Vyw61hbW9zIHF1ZSBs byBoYWdhIHNhYmVyIGlubWVkaWF0YW1lbnRlIGFsIHJlbWl0ZW50ZSB5IHF1ZSBwcm9jZWRhIGEg ZGVzdHJ1aXIgZWwgbWVuc2FqZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gTW9uLCBG ZWIgMTAsIDIwMTQgYXQgMTI6NTAgUE0sIFJvYiBTdHJhZGxpbmcgJmx0OzxhIGhyZWY9Im1haWx0 bzpyb2Iuc3RyYWRsaW5nQGNvbW9kby5jb20iIHRhcmdldD0iX2JsYW5rIj5yb2Iuc3RyYWRsaW5n QGNvbW9kby5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij5PbiAxMC8w Mi8xNCAxMTozNSwgQmVuIExhdXJpZSB3cm90ZTo8YnI+DQomZ3Q7IE9uIDEwIEZlYnJ1YXJ5IDIw MTQgMTA6MTMsIFJvYiBTdHJhZGxpbmcgJmx0OzxhIGhyZWY9Im1haWx0bzpyb2Iuc3RyYWRsaW5n QGNvbW9kby5jb20iPnJvYi5zdHJhZGxpbmdAY29tb2RvLmNvbTwvYT4mZ3Q7IHdyb3RlOjxicj4N CiZndDsmZ3Q7IE9uIDA4LzAyLzE0IDEzOjMyLCBCZW4gTGF1cmllIHdyb3RlOjxicj4NCiZndDsm Z3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7Jmd0OyBPbiA1IEZlYnJ1YXJ5IDIwMTQgMTg6MjEsIFJvYiBT dHJhZGxpbmcgJmx0OzxhIGhyZWY9Im1haWx0bzpyb2Iuc3RyYWRsaW5nQGNvbW9kby5jb20iPnJv Yi5zdHJhZGxpbmdAY29tb2RvLmNvbTwvYT4mZ3Q7IHdyb3RlOjxicj4NCiZndDsmZ3Q7Jmd0OyZn dDs8YnI+DQomZ3Q7Jmd0OyZndDsmZ3Q7IE9uIDA1LzAyLzE0IDE3OjQ5LCBBZGFtIExhbmdsZXkg d3JvdGU6PGJyPg0KJmd0OyZndDsmZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyZndDsmZ3Q7Jmd0 Ozxicj4NCiZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IE9uIFdlZCwgRmViIDUsIDIwMTQgYXQgMTI6MjYg UE0sIFJvYiBTdHJhZGxpbmc8YnI+DQomZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyAmbHQ7PGEgaHJlZj0i bWFpbHRvOnJvYi5zdHJhZGxpbmdAY29tb2RvLmNvbSI+cm9iLnN0cmFkbGluZ0Bjb21vZG8uY29t PC9hPiZndDs8YnI+DQomZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyB3cm90ZTo8YnI+DQomZ3Q7Jmd0OyZn dDsmZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7Jmd0 OyZndDsmZ3Q7Jmd0OyZndDsgUHJlc3VtYWJseSBpdCdzIHNvbWV3aGVyZSBiZXR3ZWVuIDEwIGFu ZCAzMSBkYXlzLCBzaW5jZSAxIFNDVCBpczxicj4NCiZndDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyBh Y2NlcHRhYmxlPGJyPg0KJmd0OyZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IGZvciBTdGFwbGVkIE9DU1Ag YW5kIHRoZSBCUnMgcGVybWl0IE9DU1AgUmVzcG9uc2VzIHRvIGJlIHZhbGlkIGZvciB1cDxicj4N CiZndDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyB0bzxicj4NCiZndDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0 OyAxMDxicj4NCiZndDsmZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyBkYXlzLjxicj4NCiZndDsmZ3Q7Jmd0 OyZndDsmZ3Q7PGJyPg0KJmd0OyZndDsmZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyZndDsmZ3Q7 Jmd0Ozxicj4NCiZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IFRoZSBzcGVlZCBhdCB3aGljaCB3ZSBuZWVk IHRvIGRpc3RydXN0IGEgbG9nIGRlcGVuZHMgb24gdGhlIG1pbmltdW08YnI+DQomZ3Q7Jmd0OyZn dDsmZ3Q7Jmd0OyBudW1iZXIgb2YgU0NUcyBhY3R1YWxseSwgd2hpY2ggaXMgd2h5IGFsbG93aW5n IGEgc2luZ2xlIFNDVCBpbiBzdGFwbGVkPGJyPg0KJmd0OyZndDsmZ3Q7Jmd0OyZndDsgT0NTUCBy ZXNwb25zZXMgaXMgc3VjaCBhIGxhcmdlIGNvbmNlc3Npb24uIElmIHRoZSBtaW5pbXVtIG51bWJl ciBvZjxicj4NCiZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IFNDVHMgd2VyZSB0d28gdGhlbiB0aGUgcHJl c3N1cmUgdG8gZGlzdHJ1c3QgYSBsb2cgKGFuZCB0aGUgcHJlc3N1cmUgb248YnI+DQomZ3Q7Jmd0 OyZndDsmZ3Q7Jmd0OyB0aGUgbG9ncykgd291bGQgYmUgZHJhbWF0aWNhbGx5IHJlZHVjZWQgYmVj YXVzZSBjb21wcm9taXNpbmcgb25lIGxvZzxicj4NCiZndDsmZ3Q7Jmd0OyZndDsmZ3Q7IHdvdWxk bid0IGJlIHN1ZmZpY2llbnQuPGJyPg0KJmd0OyZndDsmZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7Jmd0 OyZndDsmZ3Q7Jmd0OyZndDsgRG8geW91IHN0aWxsIHRoaW5rIFsxXSBpcyBhIGdvb2QgcGxhbj88 YnI+DQomZ3Q7Jmd0OyZndDsmZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7Jmd0OyZndDsmZ3Q7PGJyPg0K Jmd0OyZndDsmZ3Q7Jmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyZndDsmZ3Q7Jmd0OyBTdXJlLCBpZiBh bnkgQ0FzIGFyZSB3aWxsaW5nIHRvIGRvIGl0IG5vdyA6KTxicj4NCiZndDsmZ3Q7Jmd0OyZndDs8 YnI+DQomZ3Q7Jmd0OyZndDsmZ3Q7PGJyPg0KJmd0OyZndDsmZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7 Jmd0OyZndDsgSSB0aGluayAmcXVvdDtzZXJ2ZXJzIGNvdWxkIGp1c3QgZG93bmxvYWQgdGhlaXIg cmVmcmVzaGVkIGNlcnRpZmljYXRlIG92ZXI8YnI+DQomZ3Q7Jmd0OyZndDsmZ3Q7IEhUVFA8YnI+ DQomZ3Q7Jmd0OyZndDsmZ3Q7IHBlcmlvZGljYWxseSBhbmQgYXV0b21hdGljYWxseSZxdW90OyBp cyB0aGUgc2hvd3N0b3BwZXIgYXQgdGhlIG1vbWVudC4gWWVzPGJyPg0KJmd0OyZndDsmZ3Q7Jmd0 OyB0aGV5PGJyPg0KJmd0OyZndDsmZ3Q7Jmd0OyBjb3VsZCwgYnV0IEknbSBub3QgYXdhcmUgb2Yg YW55IHNlcnZlciB0aGF0IGFjdHVhbGx5IGltcGxlbWVudHMgc3VjaCBhPGJyPg0KJmd0OyZndDsm Z3Q7Jmd0OyBmZWF0dXJlLjxicj4NCiZndDsmZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7Jmd0Ozxicj4N CiZndDsmZ3Q7Jmd0OyBXb3JrIGlzIHVuZGVyIHdheSBmb3IgQXBhY2hlOiA8YSBocmVmPSJodHRw czovL2dpdGh1Yi5jb20vdHJhd2ljay9jdC1odHRwZC8iIHRhcmdldD0iX2JsYW5rIj4NCmh0dHBz Oi8vZ2l0aHViLmNvbS90cmF3aWNrL2N0LWh0dHBkLzwvYT4uPGJyPg0KJmd0OyZndDs8YnI+DQom Z3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7IFRoYXQgbG9va3MgbGlrZSBncmVhdCB3b3JrLCBidXQgQUZB SUNUIGl0J3Mgb25seSBmb3IgZmV0Y2hpbmcgU0NUcyBmcm9tIENUPGJyPg0KJmd0OyZndDsgTG9n cy48YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7IEkgd2FzIHRhbGtpbmcgYWJvdXQgdGhlIGxh Y2sgb2YgYW55IG1lY2hhbmlzbSBpbiBwb3B1bGFyIHdlYnNlcnZlciBzb2Z0d2FyZTxicj4NCiZn dDsmZ3Q7IGZvciBhdXRvbWF0aWNhbGx5IGZldGNoaW5nIGFuZCBpbnN0YWxsaW5nIGNlcnRpZmlj YXRlcyBmcm9tIENBcy4gJm5ic3A7SW48YnI+DQomZ3Q7Jmd0OyBwYXJ0aWN1bGFyOiBhIHNob3J0 LWR1cmF0aW9uIGNlcnRpZmljYXRlIHRoYXQgcmV1c2VzIHRoZSBzYW1lIHB1YmxpYyBrZXkgYXM8 YnI+DQomZ3Q7Jmd0OyB0aGUgcHJldmlvdXMgY2VydGlmaWNhdGUuPGJyPg0KJmd0Ozxicj4NCiZn dDsgQWgsIEkgc2VlISBCdXQgd2h5IHdvdWxkIHlvdSBuZWVkIGl0IGlmIHlvdSBjYW4gcmVmcmVz aCB0aGUgU0NUcyB5b3Vyc2VsZj88bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5UbyBmaXggY2VydGlmaWNhdGUgcmV2b2NhdGlvbiBjaGVja2luZywg YnkgYXZvaWRpbmcgdGhlIG5lZWQgZm9yIGl0IChhczxicj4NCkFkYW0gcHJvcG9zZWQgYSBjb3Vw bGUgb2YgeWVhcnMgYWdvIC0gc2VlIFsxXSkuPGJyPg0KPGJyPg0KQnV0IHJlYWxseSwgSSB3YXMg anVzdCB0cnlpbmcgdG8gcG9pbnQgb3V0IHRoYXQganVzdCBiZWNhdXNlIENBcyBhcmVuJ3Q8YnI+ DQpub3RpY2VhYmx5IGlzc3Vpbmcgc2hvcnQtZHVyYXRpb24gY2VydHMgdG9kYXksIGl0IGRvZXNu J3QgbWVhbiB0aGF0IHRoZXk8YnI+DQp3b24ndCBkbyBzbyBpbiB0aGUgZnV0dXJlLiAmbmJzcDtT byBJIHRoaW5rIGl0IGlzIHdvcnRoIHBlcm1pdHRpbmcganVzdCAxPGJyPg0KZW1iZWRkZWQgU0NU IGZvciBzaG9ydC1kdXJhdGlvbiBjZXJ0cyAoZm9yIHNvbWUgdmFsdWUgb2YgJnF1b3Q7c2hvcnQm cXVvdDspLjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4N Cjxicj4NClsxXSA8YSBocmVmPSJodHRwczovL3d3dy5pbXBlcmlhbHZpb2xldC5vcmcvMjAxMS8w My8xOC9yZXZvY2F0aW9uLmh0bWwiIHRhcmdldD0iX2JsYW5rIj4NCmh0dHBzOi8vd3d3LmltcGVy aWFsdmlvbGV0Lm9yZy8yMDExLzAzLzE4L3Jldm9jYXRpb24uaHRtbDwvYT48YnI+DQomcXVvdDtB IG11Y2ggYmV0dGVyIHNvbHV0aW9uIHdvdWxkIGJlIGZvciBjZXJ0aWZpY2F0ZXMgdG8gb25seSBi ZSB2YWxpZCBmb3IgYTxicj4NCmZldyBkYXlzIGFuZCB0byBmb3JnZXQgYWJvdXQgcmV2b2NhdGlv biBhbHRvZ2V0aGVyLiBUaGlzIGRvZXNuJ3QgbWVhbjxicj4NCnRoYXQgdGhlIHByaXZhdGUga2V5 IG5lZWRzIHRvIGNoYW5nZSBldmVyeSBmZXcgZGF5cywganVzdCB0aGU8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Y2VydGlmaWNhdGUuIEFuZCB0aGUgY2VydGlm aWNhdGUgaXMgcHVibGljIGRhdGEsIHNvIHNlcnZlcnMgY291bGQganVzdDxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPmRvd25sb2FkIHRoZWlyIHJlZnJlc2hlZCBj ZXJ0aWZpY2F0ZSBvdmVyIEhUVFAgcGVyaW9kaWNhbGx5IGFuZDxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIu MHB0Ij5hdXRvbWF0aWNhbGx5IChsaWtlIE9DU1Agc3RhcGxpbmcpLiBDbGllbnRzIHdvdWxkbid0 IGhhdmUgdG8gcGVyZm9ybTxicj4NCnJldm9jYXRpb24gY2hlY2tzICh3aGljaCBhcmUgdmVyeSBj b21wbGV4IGFuZCBzbG93KSwgQ0FzIHdvdWxkbid0IGhhdmU8YnI+DQp0byBwYXkgZm9yIG1hc3Np dmUsIEREb1MgcHJvb2Ygc2VydmluZyBjYXBhY2l0eSBhbmQgcmV2b2NhdGlvbiB3b3VsZDxicj4N CmFjdHVhbGx5IHdvcmsuIElmIHRoZSBDQSB3ZW50IGRvd24gZm9yIHNpeCBob3Vycywgbm9ib2R5 IGNhcmVzLiBPbmx5IGlmPGJyPg0KdGhlIENBIGlzIGRvd24gZm9yIGRheXMgaXMgdGhlcmUgYSBw cm9ibGVtLiBJZiB5b3Ugd2FudCB0byDigJxyZXZva2XigJ0gYTxicj4NCmNlcnRpZmljYXRlLCBq dXN0IHN0b3AgcmVuZXdpbmcgaXQuJnF1b3Q7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPi0tPGJy Pg0KUm9iIFN0cmFkbGluZzxicj4NClNlbmlvciBSZXNlYXJjaCAmYW1wOyBEZXZlbG9wbWVudCBT Y2llbnRpc3Q8YnI+DQpDT01PRE8gLSBDcmVhdGluZyBUcnVzdCBPbmxpbmU8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NClB1YmxpYyBtYWlsaW5n IGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86UHVibGljQGNhYmZvcnVtLm9yZyI+UHVibGljQGNh YmZvcnVtLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL2NhYmZvcnVtLm9yZy9tYWlsbWFu L2xpc3RpbmZvL3B1YmxpYyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vY2FiZm9ydW0ub3JnL21h aWxtYW4vbGlzdGluZm8vcHVibGljPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQoNCjx0YWJsZT48dHI+PHRkIGJn Y29sb3I9I2ZmZmZmZj48Zm9udCBjb2xvcj0jMDAwMDAwPjxwcmU+PHRhYmxlIGNsYXNzPSJUTV9F TUFJTF9OT1RJQ0UiPjx0cj48dGQ+PHByZT4NClRSRU5EIE1JQ1JPIEVNQUlMIE5PVElDRQ0KVGhl IGluZm9ybWF0aW9uIGNvbnRhaW5lZCBpbiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMg aXMgY29uZmlkZW50aWFsIA0KYW5kIG1heSBiZSBzdWJqZWN0IHRvIGNvcHlyaWdodCBvciBvdGhl ciBpbnRlbGxlY3R1YWwgcHJvcGVydHkgcHJvdGVjdGlvbi4gDQpJZiB5b3UgYXJlIG5vdCB0aGUg aW50ZW5kZWQgcmVjaXBpZW50LCB5b3UgYXJlIG5vdCBhdXRob3JpemVkIHRvIHVzZSBvciANCmRp c2Nsb3NlIHRoaXMgaW5mb3JtYXRpb24sIGFuZCB3ZSByZXF1ZXN0IHRoYXQgeW91IG5vdGlmeSB1 cyBieSByZXBseSBtYWlsIG9yDQp0ZWxlcGhvbmUgYW5kIGRlbGV0ZSB0aGUgb3JpZ2luYWwgbWVz c2FnZSBmcm9tIHlvdXIgbWFpbCBzeXN0ZW0uDQo8L3ByZT48L3RkPjwvdHI+PC90YWJsZT48L3By ZT48L2ZvbnQ+PC90ZD48L3RyPjwvdGFibGU+ --_000_EF70381B2D29784EA4FC66042BE81EAF1EB9FDB4SJDCEXMBX03ustr_-- From nobody Fri Feb 14 13:52:58 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2085E1A03E4 for ; Fri, 14 Feb 2014 13:52:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.448 X-Spam-Level: X-Spam-Status: No, score=-2.448 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.548] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tYRj0j1XMq3h for ; Fri, 14 Feb 2014 13:52:49 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) by ietfa.amsl.com (Postfix) with ESMTP id 825221A0448 for ; Fri, 14 Feb 2014 13:52:48 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 878FABE68; Fri, 14 Feb 2014 21:52:46 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gU2HQCXuvFDf; Fri, 14 Feb 2014 21:52:37 +0000 (GMT) Received: from [10.87.48.12] (unknown [86.45.56.73]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 86EE7BE51; Fri, 14 Feb 2014 21:52:37 +0000 (GMT) Message-ID: <52FE9025.2090700@cs.tcd.ie> Date: Fri, 14 Feb 2014 21:52:37 +0000 From: Stephen Farrell User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: "therightkey@ietf.org" References: <52F3E0A0.1080306@cs.tcd.ie> In-Reply-To: <52F3E0A0.1080306@cs.tcd.ie> X-Enigmail-Version: 1.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/56iyhWzw_-rr_JWuDcsQIrDeqGk Cc: Melinda Shore Subject: Re: [therightkey] trans WG approved by IESG X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Feb 2014 21:52:51 -0000 Hi all, I'm delighted to let you know that Melinda Shore has agreed to chair the trans WG. Please join me in saying thanks. Melinda will I'm sure start to help get us all organised for a productive session in London over the next short while. Again: thanks Melinda! An official-looking announcement should pop out sometime soonish. Cheers, S. On 02/06/2014 07:21 PM, Stephen Farrell wrote: > > Hi, > > On its telechat today the IESG approved formation of > the trans WG. [1] > > Now I need some WG chairs. Some folk have volunteered > already (and thanks for that) but I'd be interested in > checking to see if there are others who'd be interested > and able to help out that way. > > If you are, please drop me a mail in the next day or two. > > The formal announcement won't go out until we've appointed > the chairs, but interested folks should be planning on a > WG session in London. That's currently scheduled for > Wed March 5th 15:20. [2] (There's a very small chance > that might change but its unlikely at this point.) > > Thanks, > Stephen. > > [1] https://datatracker.ietf.org/doc/charter-ietf-trans/ > [2] https://datatracker.ietf.org/meeting/89/agenda.html > > _______________________________________________ > therightkey mailing list > therightkey@ietf.org > https://www.ietf.org/mailman/listinfo/therightkey > > From nobody Fri Feb 14 14:06:39 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 014E81A004A; Fri, 14 Feb 2014 14:06:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IqfWPR78MXLt; Fri, 14 Feb 2014 14:06:32 -0800 (PST) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 57EA01A0166; Fri, 14 Feb 2014 14:06:26 -0800 (PST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: IETF-Announce X-Test-IDTracker: no X-IETF-IDTracker: 5.0.0.p1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20140214220626.12566.95239.idtracker@ietfa.amsl.com> Date: Fri, 14 Feb 2014 14:06:26 -0800 Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/FrJKtoKombFcH2oK-XeqLFUNRq0 Cc: trans WG Subject: [therightkey] WG Action: Formed Public Notary Transparency (trans) X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Feb 2014 22:06:37 -0000 A new IETF working group has been formed in the Security Area. For additional information please contact the Area Directors or the WG Chair. Public Notary Transparency (trans) ------------------------------------------------ Current Status: Proposed WG Chairs: Melinda Shore Assigned Area Director: Stephen Farrell Mailing list Address: therightkey@ietf.org To Subscribe: https://www.ietf.org/mailman/listinfo/therightkey Archive: http://www.ietf.org/mail-archive/web/therightkey/ Charter: Mitigating web site certificate mis-issuance is the initial problem of interest for this working group. Certificate Transparency (CT, RFC6962) allows such mis-issuance to be detected in interesting and useful cases, for example by an auditor acting for the web site, or one acting to check general CA behaviour. The working group will produce a standards-track version of the experimental RFC 6962 for HTTP over TLS, reflecting implementation and deployment experience since that specification was completed. Many Internet protocols for example, SMTPS, IPsec, DNSSEC, OpenPGP and HTTPS, require a mapping between some kind of identifier and some kind of public key. These protocols rely on either ad-hoc mappings, (as in a web of trust), or on authorities (such as CAs) that attest to the mappings. History shows that neither of these mechanisms is entirely satisfactory. Ad-hoc mappings are difficult to discover and maintain, and authorities make mistakes or are subverted. Cryptographically verifiable logs can help to ameliorate these problems by making it possible to discover errors quickly, so that other mechanisms can be applied to rectify them. A cryptographically verifiable log is an append-only log of hashes of more-or-less anything that is structured in such a way as to provide efficiently-accessible, cryptographically-supported evidence of correct log behaviour. For example, RFC 6962 says: "The append-only property of each log is technically achieved using Merkle Trees, which can be used to show that any particular version of the log is a superset of any particular previous version. Likewise, Merkle Trees avoid the need to blindly trust logs: if a log attempts to show different things to different people, this can be efficiently detected by comparing tree roots and consistency proofs. Similarly, other misbehaviors of any log (e.g., issuing signed timestamps for certificates they then don't log) can be efficiently detected and proved to the world at large." These logs can potentially also assist with other interesting problems, such as how to assure end users that software they are running is, indeed, the software they intend to run. While the privacy issues related to use of RFC6962 for public web sites are minimal, the working group will consider privacy as it might impact on uses of CT e.g. within enterprises or for other uses of logs. Work items: - Publish an update to RFC 6962 as a standards-track mechanism to apply verifiable logs to HTTP over TLS. As DANE (RFC6698) provides an alternative keying infrastructure to that used in the current web PKI, the working group should consider appropriate client behavior in the presence of both DANE-based keying and current web PKI when standardising CT. - Discuss mechanisms and techniques that allow cryptographically verifiable logs to be deployed to improve the security of protocols other than HTTP over TLS, for example SMTP/TLS or software distribution. Where such mechanisms appear sufficiently useful, the WG will re-charter to add relevant new work items. Should no such items be chartered the WG will close when documents associated with the first work item are complete. Milestones: TBD From nobody Fri Feb 14 14:42:14 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5B881A0396 for ; Fri, 14 Feb 2014 14:42:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ycHnPi87AdEu for ; Fri, 14 Feb 2014 14:42:03 -0800 (PST) Received: from mail-pb0-x22f.google.com (mail-pb0-x22f.google.com [IPv6:2607:f8b0:400e:c01::22f]) by ietfa.amsl.com (Postfix) with ESMTP id ABB701A03B6 for ; Fri, 14 Feb 2014 14:41:59 -0800 (PST) Received: by mail-pb0-f47.google.com with SMTP id rp16so12852893pbb.6 for ; Fri, 14 Feb 2014 14:41:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=0MLs3rlPQcpCwDjXe6WoLro/QFpnnbJjOaZ5hylvWOA=; b=wZdVmoF8vpxBYUbPjpygKx9y36Sghh/wvp0HcQM73N8teB8nKkfZrllTdtFHkuBV2L IfKq0pi6YpkjCTRLYaZ3Zf3lundRpiV8FteJFHVc00DkjAQlAqXC027vUJrMl0LUSGcx SeqipW6ILSq69TRX0NA0WqtHDzBrIeInAKfgc0+CHCripBSuW8PVGoU5G9Gwo33P/GhS lQqNjV2a/UJH1wSTm4/UMTVWCS9jFALcW0k3LCZhwp4X8oU8oWGFM8+dPAha7E/KFs9E sTbmXQAtu8n41ejNYkPbA+IHEJwyVHUXbUbMP3PwEmKSMr6JExwyV5q/o73hE5gFVr6g QAag== X-Received: by 10.68.189.5 with SMTP id ge5mr11962679pbc.42.1392417718211; Fri, 14 Feb 2014 14:41:58 -0800 (PST) Received: from spandex.local (216-67-29-177-rb2.sol.dsl.dynamic.acsalaska.net. [216.67.29.177]) by mx.google.com with ESMTPSA id it4sm20807014pbc.39.2014.02.14.14.41.56 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 14 Feb 2014 14:41:57 -0800 (PST) Message-ID: <52FE9BB3.6050808@gmail.com> Date: Fri, 14 Feb 2014 13:41:55 -0900 From: Melinda Shore User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130620 Thunderbird/17.0.7 MIME-Version: 1.0 To: Stephen Farrell References: <52F3E0A0.1080306@cs.tcd.ie> <52FE9025.2090700@cs.tcd.ie> In-Reply-To: <52FE9025.2090700@cs.tcd.ie> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/xPqjCDUlCu7pzgbP2U4Fj5kxWuo Cc: "therightkey@ietf.org" Subject: Re: [therightkey] trans WG approved by IESG X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Feb 2014 22:42:10 -0000 Hi, folks: I am *extremely* pleased to be involved with this effort and am very optimistic about the working group's results. I'm hopeful that we can ramp up pretty quickly, and there are a few things we'll need to take care of straight out of the gate: 1) we'll need to identify milestones around document adoption and publication, 2) we'll need to adopt documents as working group drafts 3) We should probably figure out if we want to move the mailing list from "therightkey" to "trans" We've got a short slot in London, which I think will largely be given over to taking care of business. I don't like to use meeting time for "presentations" if it can be avoided. IETF meetings are working meetings and time in those should be used to do things that can't be done on mailing list, in particular as an opportunity for real-time discussion to work out issues that are difficult to deal with on the mailing list. So, over the next few days expect to see some email dealing with administrivia so that we can get back to the real work of getting the documents done. I'm really looking forward to working with you all, Melinda From nobody Fri Feb 14 14:48:12 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EFB631A03F7 for ; Fri, 14 Feb 2014 14:48:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y9Jn-whzkleg for ; Fri, 14 Feb 2014 14:48:00 -0800 (PST) Received: from mail-lb0-x235.google.com (mail-lb0-x235.google.com [IPv6:2a00:1450:4010:c04::235]) by ietfa.amsl.com (Postfix) with ESMTP id C24C81A031E for ; Fri, 14 Feb 2014 14:47:57 -0800 (PST) Received: by mail-lb0-f181.google.com with SMTP id z11so8665435lbi.26 for ; Fri, 14 Feb 2014 14:47:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=k8VJEfs2T6mQE+7EoKezez8SgP3hBY7RhBjmukg3yAU=; b=xLDJe9K9WEdC/JDew5uCN3ihIT0HfwEHrKpkkhN0GoCRf3d76Yoy+bu4sIhQYF0l0I GRAt0g9ZK/ojK3fmGNLbi0KMh7m5MV33fsV3zc6R+jsM7XQRbueZmQcelolE/NOXUxkX /ww5B1zz8P4bCRzeOg6+83OUBh60yKelWdMSJccq/6uCB1ic93uZNn3cxAXH6eOebZfh swK6yq2FZlJHUMolm95bbfRpu21Q8dZSUydUHp8UaPA7JL84IJL4vrE2AWovrbzj+pox QxLEWlsl92W4LCToN5yNQJTMkatcVZkV1qDTlWeAp8SpafUKFUrxopwB9iEY9/t1V0td j1Aw== MIME-Version: 1.0 X-Received: by 10.112.114.228 with SMTP id jj4mr6875343lbb.13.1392418075151; Fri, 14 Feb 2014 14:47:55 -0800 (PST) Received: by 10.112.37.168 with HTTP; Fri, 14 Feb 2014 14:47:54 -0800 (PST) In-Reply-To: <52FE9BB3.6050808@gmail.com> References: <52F3E0A0.1080306@cs.tcd.ie> <52FE9025.2090700@cs.tcd.ie> <52FE9BB3.6050808@gmail.com> Date: Fri, 14 Feb 2014 17:47:54 -0500 Message-ID: From: Phillip Hallam-Baker To: Melinda Shore Content-Type: multipart/alternative; boundary=001a1134cbfcbf944a04f2659893 Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/1DLJA2WCSdQjoiJwhLM4SfznsZg Cc: "therightkey@ietf.org" , Stephen Farrell Subject: Re: [therightkey] trans WG approved by IESG X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Feb 2014 22:48:04 -0000 --001a1134cbfcbf944a04f2659893 Content-Type: text/plain; charset=ISO-8859-1 On Fri, Feb 14, 2014 at 5:41 PM, Melinda Shore wrote: > Hi, folks: > > I am *extremely* pleased to be involved with this effort and > am very optimistic about the working group's results. I'm > hopeful that we can ramp up pretty quickly, and there are a > few things we'll need to take care of straight out of the gate: > > 1) we'll need to identify milestones around document adoption > and publication, > > 2) we'll need to adopt documents as working group drafts > > 3) We should probably figure out if we want to move the > mailing list from "therightkey" to "trans" > Yes, definitely. My experience is that WGs get told to get with the program and align their names anyway. But even if not, therightkey will still be useful for the more speculative stuff some of us are doing. I am not going to build my email scheme that involves CT like approaches direct on CT for WebPKI because that is research on research which is a bad idea. -- Website: http://hallambaker.com/ --001a1134cbfcbf944a04f2659893 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable



On Fri, Feb 14, 2014 at 5:41 PM, Melinda Shore &l= t;melinda.shor= e@gmail.com> wrote:
Hi, folks:

I am *extremely* pleased to be involved with this effort and
am very optimistic about the working group's results. =A0I'm
hopeful that we can ramp up pretty quickly, and there are a
few things we'll need to take care of straight out of the gate:

1) we'll need to identify milestones around document adoption
=A0 =A0and publication,

2) we'll need to adopt documents as working group drafts

3) We should probably figure out if we want to move the
=A0 =A0mailing list from "therightkey" to "trans"

Yes, definitely. My experience is that WGs g= et told to get with the program and align their names anyway.
But even if not, therightkey will still be useful for the more s= peculative stuff some of us are doing.=A0

I am not= going to build my email scheme that involves CT like approaches direct on = CT for WebPKI because that is research on research which is a bad idea.


--
Website: http://hallambaker.com/
--001a1134cbfcbf944a04f2659893-- From nobody Fri Feb 14 14:58:53 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 00F981A03A9 for ; Fri, 14 Feb 2014 14:58:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HajqYK1LcmjK for ; Fri, 14 Feb 2014 14:58:44 -0800 (PST) Received: from mail-ea0-f182.google.com (mail-ea0-f182.google.com [209.85.215.182]) by ietfa.amsl.com (Postfix) with ESMTP id 61D8C1A041C for ; Fri, 14 Feb 2014 14:58:43 -0800 (PST) Received: by mail-ea0-f182.google.com with SMTP id r15so6079003ead.13 for ; Fri, 14 Feb 2014 14:58:41 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to :subject:references:in-reply-to:content-type; bh=wU+sWyEqfp/VYdf1u7S/R2B61/Czjont42G3lll4y84=; b=JuDVUYCZiFLEvdqvKGM02dtGXKLldrpo/7wpC6uK56Z2RCl91WXe4YOsAQt2vFjwz7 KAvIFrq4KPHFG6Entljp0mAdV2VkicTDNvIGqnfUmnihaUFdziicSkCnrgw3eLqvnnGu LHdozssU2iKzprwB94DE+/GSduUApNmH9DVNO36UDEDz2xS0upcfntQ0FUBAcpsqoEOA stiMDNDPCSISZX0oh+wbr6q/WOGzeg0vnqsbOlfFBVZ0h6jsn+6jSPBdHW71Dv8+o0xP UXU7AleFfCKWkBdU3kJU1+0JvnwkEqcxwfQ9wTyBHzlLn8kjBE/D8Ml80F5AnVdnvLuJ 4qNQ== X-Gm-Message-State: ALoCoQm9YkkfczNLWiYMGKD2T/ItQYoOZbG8dc/RJkw9Oyj00QbbkZ185iFp0WETotsbnoFIDAps X-Received: by 10.15.67.197 with SMTP id u45mr11881452eex.24.1392418721348; Fri, 14 Feb 2014 14:58:41 -0800 (PST) Received: from [10.0.0.115] (tb62-102-145-131.cust.teknikbyran.com. [62.102.145.131]) by mx.google.com with ESMTPSA id u6sm25041637eep.11.2014.02.14.14.58.40 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 14 Feb 2014 14:58:40 -0800 (PST) Message-ID: <52FE9F9F.5090803@mnt.se> Date: Fri, 14 Feb 2014 23:58:39 +0100 From: Leif Johansson User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: therightkey@ietf.org References: <52F3E0A0.1080306@cs.tcd.ie> <52FE9025.2090700@cs.tcd.ie> <52FE9BB3.6050808@gmail.com> In-Reply-To: X-Enigmail-Version: 1.6 Content-Type: multipart/alternative; boundary="------------070401020100070807080307" Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/5_sTl-tix4lL0gEiZCEu0G4kycY Subject: Re: [therightkey] trans WG approved by IESG X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Feb 2014 22:58:49 -0000 This is a multi-part message in MIME format. --------------070401020100070807080307 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit On 2014-02-14 23:47, Phillip Hallam-Baker wrote: > > > > On Fri, Feb 14, 2014 at 5:41 PM, Melinda Shore > > wrote: > > Hi, folks: > > I am *extremely* pleased to be involved with this effort and > am very optimistic about the working group's results. I'm > hopeful that we can ramp up pretty quickly, and there are a > few things we'll need to take care of straight out of the gate: > > 1) we'll need to identify milestones around document adoption > and publication, > > 2) we'll need to adopt documents as working group drafts > > 3) We should probably figure out if we want to move the > mailing list from "therightkey" to "trans" > > > Yes, definitely. My experience is that WGs get told to get with the > program and align their names anyway. > > yes I think so too --------------070401020100070807080307 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit
On 2014-02-14 23:47, Phillip Hallam-Baker wrote:



On Fri, Feb 14, 2014 at 5:41 PM, Melinda Shore <melinda.shore@gmail.com> wrote:
Hi, folks:

I am *extremely* pleased to be involved with this effort and
am very optimistic about the working group's results.  I'm
hopeful that we can ramp up pretty quickly, and there are a
few things we'll need to take care of straight out of the gate:

1) we'll need to identify milestones around document adoption
   and publication,

2) we'll need to adopt documents as working group drafts

3) We should probably figure out if we want to move the
   mailing list from "therightkey" to "trans"

Yes, definitely. My experience is that WGs get told to get with the program and align their names anyway.


yes I think so too
--------------070401020100070807080307-- From nobody Mon Feb 17 06:23:09 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BBC361A04C3 for ; Mon, 17 Feb 2014 06:23:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.927 X-Spam-Level: X-Spam-Status: No, score=-1.927 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XsEOplBsvt7E for ; Mon, 17 Feb 2014 06:23:03 -0800 (PST) Received: from mail-vc0-x233.google.com (mail-vc0-x233.google.com [IPv6:2607:f8b0:400c:c03::233]) by ietfa.amsl.com (Postfix) with ESMTP id 4D9451A01D8 for ; Mon, 17 Feb 2014 06:23:03 -0800 (PST) Received: by mail-vc0-f179.google.com with SMTP id lh14so11715748vcb.38 for ; Mon, 17 Feb 2014 06:23:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=gnhsidzrtcTEyNyfUyuc+RAHoFpPk2LyxRQGvD7dVF0=; b=ECi3AezqiYuLqdSuK9xBXT1y5TqskK02F7oRkWQVJxz2m6l2CNZHGPAHeGQhQfcDt3 ck47VAwxaAgfDcmZUkF9SpwCjUbA99Fl1G0+2khgmmzgVThVj7TR4haKKY06N7hehtHA Ksn61WP1ZG2ttkD9pZcuCspRjL4c0c8Gq/2yyefWOl+8N0KWcSRq/VQ8YTDtSEXKcZ2u v0FyWz3Y4dPeguTLyotNfkveW0JAPa+sbHJdFNGOq7cM1ohQdUpjbhJbhngLLWOdqSNx XE5w0RSjWMmp9w5sf8cZ7tI+2zDknyrQC9ym9UZCHO/0HGkevnvoIM7esGoNC2Oj+v7V UcsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=gnhsidzrtcTEyNyfUyuc+RAHoFpPk2LyxRQGvD7dVF0=; b=hyI6iRrMFOahtnVIwIIoKk0megd4lrTcYopi6HB9wwREwtG68S6R/E0+uPoP8JZ82g 4nRwAlht2ECyxziyRTb3bB1ZW/QBsOqDQif44bcZglA2HYQuoSzkWyH3HPequ2P99y0W gCz0dsJMJahXlF/Yfqi5ap4KvXVPMBMhK3quVFBHmB0kMKKFhXQGWYwymYni65b7BczQ Qwe5oZudfa7oRBnBfR9kWHAE/q9j07dKtENUvBjWW2If/pc5WHTADgHvMw6OlGkNg8rD lifhfPYPtUUOcY0cpgHvWb6+gNEP1bbAYyTiG+UB3tlxd4tiq6VhwKobl4EgoX88VOya xDAQ== X-Gm-Message-State: ALoCoQl7UR/v3DfbZtSdNxskOf4UL22zERmz4yvzDyq1/BYWIjrIJfEoCD9JpI3lC1DsueFPBDmGLk8rBB9XL36RsOj5YVVQrmQqNCSulN8uFnrnwdFkcSjfcR0HUr8HAebwtOk6tqs7ekjpLfEw3hYQNJ/p55aOVW28BhTgJ6OAhsd7JIlaWSFyTmRc9DZjIO5M5adfEDio MIME-Version: 1.0 X-Received: by 10.220.139.198 with SMTP id f6mr459356vcu.47.1392646980539; Mon, 17 Feb 2014 06:23:00 -0800 (PST) Received: by 10.52.230.105 with HTTP; Mon, 17 Feb 2014 06:23:00 -0800 (PST) In-Reply-To: <52FE9BB3.6050808@gmail.com> References: <52F3E0A0.1080306@cs.tcd.ie> <52FE9025.2090700@cs.tcd.ie> <52FE9BB3.6050808@gmail.com> Date: Mon, 17 Feb 2014 14:23:00 +0000 Message-ID: From: Ben Laurie To: Melinda Shore Content-Type: text/plain; charset=UTF-8 Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/KSY4HYIU2Vjsu0RZcjb-4OIyjyU Cc: "therightkey@ietf.org" , Stephen Farrell Subject: Re: [therightkey] trans WG approved by IESG X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Feb 2014 14:23:06 -0000 On 14 February 2014 22:41, Melinda Shore wrote: > Hi, folks: > > I am *extremely* pleased to be involved with this effort and > am very optimistic about the working group's results. I'm > hopeful that we can ramp up pretty quickly, and there are a > few things we'll need to take care of straight out of the gate: > > 1) we'll need to identify milestones around document adoption > and publication, > > 2) we'll need to adopt documents as working group drafts > > 3) We should probably figure out if we want to move the > mailing list from "therightkey" to "trans" +1 to moving. > We've got a short slot in London, which I think will > largely be given over to taking care of business. I don't > like to use meeting time for "presentations" if it can be > avoided. IETF meetings are working meetings and time in those > should be used to do things that can't be done on mailing > list, in particular as an opportunity for real-time > discussion to work out issues that are difficult to deal > with on the mailing list. +1 to this, too! > So, over the next few days expect to see some email dealing > with administrivia so that we can get back to the real work > of getting the documents done. > > I'm really looking forward to working with you all, Likewise. See you in London! From nobody Mon Feb 17 10:33:33 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CFC41A050A for ; Mon, 17 Feb 2014 10:33:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fXaa66FstcnW for ; Mon, 17 Feb 2014 10:33:30 -0800 (PST) Received: from mail-pb0-x230.google.com (mail-pb0-x230.google.com [IPv6:2607:f8b0:400e:c01::230]) by ietfa.amsl.com (Postfix) with ESMTP id 6CB5A1A053A for ; Mon, 17 Feb 2014 10:33:30 -0800 (PST) Received: by mail-pb0-f48.google.com with SMTP id rr13so15603187pbb.7 for ; Mon, 17 Feb 2014 10:33:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject :content-type:content-transfer-encoding; bh=ppRuKvBSzrldSzs3C972DFv4BAMyfUEQ6/IGZp04M/Y=; b=ZUZaUl7SMhuQfL2SNTVvyF8oc6unneJdZIU4umlEqxpMqI43wfIW2Pecqs7cmjFBZI yZUBiCgtZO83c3wy2IrBA1kb8S1zO20/nxJJ5IJEkxefrHRnvT4Yaqne4p2hmjAMwXcs Ul4XY/W3/UC5Bz8f1yXBgKkjGvwbkWA/K8bNQ70ZmGWKnka/KEUoW/Bc62vHA/dTsx9g mW0Tl+SDy0phKNbEAWxEiHAIAnd3GKXa+wjKKxvQoLSLrG1t24nOnKDTYcyf97P/YPHD DJnI3jraUdLmBWEnfa5Rjn4lzquYvOWBChnsUbnNJSXa+wk4CRiE4ujx6311q8VpST6o I+FQ== X-Received: by 10.68.139.73 with SMTP id qw9mr27687951pbb.121.1392662007886; Mon, 17 Feb 2014 10:33:27 -0800 (PST) Received: from spandex.local (63-140-93-251.dynamic.dsl.acsalaska.net. [63.140.93.251]) by mx.google.com with ESMTPSA id qw8sm48030077pbb.27.2014.02.17.10.33.26 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 17 Feb 2014 10:33:26 -0800 (PST) Message-ID: <530255F5.50804@gmail.com> Date: Mon, 17 Feb 2014 09:33:25 -0900 From: Melinda Shore User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130620 Thunderbird/17.0.7 MIME-Version: 1.0 To: "therightkey@ietf.org" Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/QmeIqURa7dIkHKJRuBfbVCUTWnQ Subject: [therightkey] Mailing list update X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Feb 2014 18:33:32 -0000 I've asked that this mailing list be transitioned to use the "trans" name (as opposed to either keeping it as "therightkey" or creating a new mailing list). If you are on this mailing list you do not need to do anything - you'll be subscribed automatically to the new mailing list. Melinda From nobody Mon Feb 17 10:35:34 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A0141A0103 for ; Mon, 17 Feb 2014 10:35:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.978 X-Spam-Level: X-Spam-Status: No, score=-1.978 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AsOq01OmHoKV for ; Mon, 17 Feb 2014 10:35:31 -0800 (PST) Received: from mail-we0-f179.google.com (mail-we0-f179.google.com [74.125.82.179]) by ietfa.amsl.com (Postfix) with ESMTP id C85951A053A for ; Mon, 17 Feb 2014 10:35:30 -0800 (PST) Received: by mail-we0-f179.google.com with SMTP id q58so10795308wes.38 for ; Mon, 17 Feb 2014 10:35:27 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=OmwccNNCb2K4lbEgfcAx83u7rgl+PGrQeGlFQYMM/fQ=; b=NoXNmVWCk1YvaM50Yx6G1KF6f3ijQZatMIH4pYdTI8qRbhxAsEvkRUlBLAkbdwy0gS u0wnI+JyWCga25stt15edzJhAXmyg0w/3sv1MPaBGsrcZZvFvHb5KgnB667BFfmQNCpn 6h8E3sZuuQY8ivRQLAyadydT5823+KAbym076myBgzZERYkyZrwZrXGCGjii2oUcOBgR 1oPZeviL/rImAcb81fpEkvpPDbFHm4PmSJabgduyRGkIlb3lnEolc7WDAND9n97ve4dU cAl6VL1BmB3Uys98kiATK3/T9A3YcuYJORpx7e5+aD9TIP9nXPSO9GJIbxD8n+xK1gXn D12w== X-Gm-Message-State: ALoCoQnQhn18JgcGcGNArLJgk+YgGlqF8bjbSi9/KiKaenIV90TktLjTXndrFVeOUhhr3Vx4FM0W MIME-Version: 1.0 X-Received: by 10.180.77.129 with SMTP id s1mr14362371wiw.56.1392662127535; Mon, 17 Feb 2014 10:35:27 -0800 (PST) Received: by 10.216.45.146 with HTTP; Mon, 17 Feb 2014 10:35:27 -0800 (PST) X-Originating-IP: [166.137.186.143] In-Reply-To: <530255F5.50804@gmail.com> References: <530255F5.50804@gmail.com> Date: Mon, 17 Feb 2014 10:35:27 -0800 Message-ID: From: Trevor Perrin To: Melinda Shore Content-Type: text/plain; charset=ISO-8859-1 Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/Qk0ToVSNCQBCY9epfnsD7ZDYgsU Cc: "therightkey@ietf.org" Subject: Re: [therightkey] Mailing list update X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Feb 2014 18:35:33 -0000 I thought this list was for more general discussion - not just CT? Trevor On Mon, Feb 17, 2014 at 10:33 AM, Melinda Shore wrote: > I've asked that this mailing list be transitioned to use the > "trans" name (as opposed to either keeping it as "therightkey" > or creating a new mailing list). If you are on this mailing > list you do not need to do anything - you'll be subscribed > automatically to the new mailing list. > > Melinda > > _______________________________________________ > therightkey mailing list > therightkey@ietf.org > https://www.ietf.org/mailman/listinfo/therightkey From nobody Mon Feb 17 10:38:23 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82B371A0548 for ; Mon, 17 Feb 2014 10:38:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GaRlJFg2HW_0 for ; Mon, 17 Feb 2014 10:38:21 -0800 (PST) Received: from mail-pa0-x229.google.com (mail-pa0-x229.google.com [IPv6:2607:f8b0:400e:c03::229]) by ietfa.amsl.com (Postfix) with ESMTP id DF5E71A050A for ; Mon, 17 Feb 2014 10:38:20 -0800 (PST) Received: by mail-pa0-f41.google.com with SMTP id fa1so15719462pad.28 for ; Mon, 17 Feb 2014 10:38:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=MST12nhLV2vqNhjbk4KGzgP1ZvXyug97WlhwWmsvmQo=; b=gEO0DTFdufl0GTyxtuqtHShvjwFuNdzqi8cE1+7S1NoEv9tq+1wFv/6CBdHyVrWutc SUfrw9fi4nYLcKxK1Jn3OINDOEZuycS59MQdPGoBuDdY9YPykNl/iK+QyezBRXF3M2m9 3wT1RSB6kdphpEcbK4SWeipg9LHbCa58V2tLr2kmtLxznf4jrjw+QDM5wPTXN9vprsqt dJ7of+LLiEKHZFT/E/IcPjY1dzKjoVqRNcFgA+MwU5jXaLOCX081BgpGDeb8oKdzVV6L Sapu1ONrYK9GhW/mX9nRCmHyVriNiWWx/3oUdbetCEER6mewz78jPHGD9jGw/9uRj/fF yMCA== X-Received: by 10.66.102.39 with SMTP id fl7mr27706070pab.43.1392662298465; Mon, 17 Feb 2014 10:38:18 -0800 (PST) Received: from spandex.local (63-140-93-251.dynamic.dsl.acsalaska.net. [63.140.93.251]) by mx.google.com with ESMTPSA id sy10sm123202874pac.15.2014.02.17.10.38.16 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 17 Feb 2014 10:38:17 -0800 (PST) Message-ID: <53025717.1050204@gmail.com> Date: Mon, 17 Feb 2014 09:38:15 -0900 From: Melinda Shore User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130620 Thunderbird/17.0.7 MIME-Version: 1.0 To: Trevor Perrin References: <530255F5.50804@gmail.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/CJgBoyuLL_mv43KH87bgvc3-stM Cc: "therightkey@ietf.org" Subject: Re: [therightkey] Mailing list update X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Feb 2014 18:38:22 -0000 On 2/17/14 9:35 AM, Trevor Perrin wrote: > I thought this list was for more general discussion - not just CT? We don't need to shut this list down if people find it useful. The main issues were 1) whether or not to create a separate trans working group mailing list, and 2) whether or not to subscribe everybody on this mailing list to the new one. Melinda From nobody Mon Feb 17 10:42:08 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2A8C1A0520 for ; Mon, 17 Feb 2014 10:42:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.978 X-Spam-Level: X-Spam-Status: No, score=-1.978 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p_NN5NW71CeA for ; Mon, 17 Feb 2014 10:42:05 -0800 (PST) Received: from mail-wi0-f171.google.com (mail-wi0-f171.google.com [209.85.212.171]) by ietfa.amsl.com (Postfix) with ESMTP id A018B1A04F0 for ; Mon, 17 Feb 2014 10:42:04 -0800 (PST) Received: by mail-wi0-f171.google.com with SMTP id cc10so2714876wib.10 for ; Mon, 17 Feb 2014 10:42:01 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=XUO0OskSRv6HVNkY9l0x79c4GlxFVzTOdNZ7o4mWars=; b=RxM/mOa0UxF30CnBpMJO+7zqpG2DpM4tvRWEdSAbZKfKz2jDhst6hypd4x2fVr1sIT 3ky7n4yyyDZlnq//PWGmi4SZjtfeVust7G2Ep1IYEqNv5AlX7FA+NVf77QeD71840Bqe IjXksBwN4V0B87q8JHQAGEzk8GPp24pvZbLN60nhh3v6RJ06I2lqKzo8WxBZr2eO+cLF O1z0T1Y0h4pBmGP5tHGJqZMDg3SsO4fA4POlde3uf/Le6hzxkqWF3JSX41J2/paHDkPC ekYr4uLY9bVnEmr4OBKm14aBF8Ln57wVtiRWsKwIvTEaL/qPVwVEBUPHm6NGFMLpTeOC 0M8A== X-Gm-Message-State: ALoCoQkM/FyPzZ27cXdrfh0okacfqG/hpuo8nJlksZVxcsa0Ee2hbB8kOIeSB1WVGtI0/S58axkC MIME-Version: 1.0 X-Received: by 10.194.240.7 with SMTP id vw7mr3154513wjc.75.1392662521444; Mon, 17 Feb 2014 10:42:01 -0800 (PST) Received: by 10.216.45.146 with HTTP; Mon, 17 Feb 2014 10:42:01 -0800 (PST) X-Originating-IP: [166.137.186.143] In-Reply-To: <53025717.1050204@gmail.com> References: <530255F5.50804@gmail.com> <53025717.1050204@gmail.com> Date: Mon, 17 Feb 2014 10:42:01 -0800 Message-ID: From: Trevor Perrin To: Melinda Shore Content-Type: text/plain; charset=ISO-8859-1 Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/HuffYHktzoWZvhFs8wnam_jsiCY Cc: "therightkey@ietf.org" Subject: Re: [therightkey] Mailing list update X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Feb 2014 18:42:06 -0000 I would've assumed / preferred the new WG would get a new list, as not everyone interested in general discussion of this problem space would want to follow all the CT spec details, but that's just my opinion. Trevor On Mon, Feb 17, 2014 at 10:38 AM, Melinda Shore wrote: > On 2/17/14 9:35 AM, Trevor Perrin wrote: >> I thought this list was for more general discussion - not just CT? > > We don't need to shut this list down if people find it useful. > The main issues were 1) whether or not to create a separate > trans working group mailing list, and 2) whether or not to > subscribe everybody on this mailing list to the new one. > > Melinda > From nobody Mon Feb 17 10:46:40 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C3AA1A03FB for ; Mon, 17 Feb 2014 10:46:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.927 X-Spam-Level: X-Spam-Status: No, score=-1.927 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CXyA10iQJvQO for ; Mon, 17 Feb 2014 10:46:37 -0800 (PST) Received: from mail-vc0-x22e.google.com (mail-vc0-x22e.google.com [IPv6:2607:f8b0:400c:c03::22e]) by ietfa.amsl.com (Postfix) with ESMTP id 148C31A0239 for ; Mon, 17 Feb 2014 10:46:36 -0800 (PST) Received: by mail-vc0-f174.google.com with SMTP id im17so11885862vcb.5 for ; Mon, 17 Feb 2014 10:46:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=gSia57FmkdGoGm0hSH2xLLt0omx/wqfyk5w93qlX0nQ=; b=EnPdVAGeZMJ5vxlO4k4B5OhqGOJbfERq5DX2hxsuJgDJaAKXNGotx6ATiTFeCsFYKE dgC31/iX71Ocq7GL0eBpwwXK41O1sbRTeCTxn2otOlYNgcmY+u1cUEQ67gHxwEboXGJm Cqe8dddp0b8L4E/aRtdsjuERg5ErDDGOnUsHtrGPJCc9vuMC72dad6H5OKOnFiSQw+Yc R9WC3lmqATNmkErAE4QJrJ5HS3+34xJjBx5idMoidUzHjMI2prjcVlK9LSb4QYXCFHpz xXo5FGcKwzkW6e3SqzfDTUPa7vp7GSUjjqrpGlse96SxEreZw0dEYTpvBg5G7FboViL1 zpXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=gSia57FmkdGoGm0hSH2xLLt0omx/wqfyk5w93qlX0nQ=; b=lY7plPZ7FDN6m7LO/HC1Ch/poeEOq90VI4iwnItkBAP8kUuvVLq7V7U9LJzCLlCB3H GaCiz8Hxlmml8m+IF++lqtvWiYJKh8JmWsfHGVqnT+M6YGNa56GjTZLxHS8IuSjGu6az CNMb7NtmB567EQOllRvdPxvgK5h4lVBmcoTArGDlsDB4+8VLzuBEcPab8G2dYyZDqi2R mUl3xRIQolpvgMyG6ttZT4KUmYXAvC0hZ06QA+aL0I/eN6kVTFkGhHik7To+2nxtyRvo w6MpJpyZUGzfRlZ4F32rnN2rb5kW0w1jzYk1sHQulAElV1KyDg4boViQfKieqePyetYS 57xA== X-Gm-Message-State: ALoCoQkWKAUsgyAUIEdOsyPfnlFOE26OszkDD3m9gFbbq+TTWx5EKkL5aQYCqQ2J749QgO8PtY/8DnJVRRpTpx58FPsK2moOiHFnocyjUk+0aWCGp0+i1t2h5qNsWmn7bDmREHemFwy0WTa329+hhJNKNdUSfEpGDpfOFT2CXheqOvFqgXa6Ss2xk2ruw2hV19sFiJwOkTL7 MIME-Version: 1.0 X-Received: by 10.52.63.233 with SMTP id j9mr4501vds.69.1392662794268; Mon, 17 Feb 2014 10:46:34 -0800 (PST) Received: by 10.52.230.105 with HTTP; Mon, 17 Feb 2014 10:46:34 -0800 (PST) In-Reply-To: References: <530255F5.50804@gmail.com> <53025717.1050204@gmail.com> Date: Mon, 17 Feb 2014 18:46:34 +0000 Message-ID: From: Ben Laurie To: Trevor Perrin Content-Type: text/plain; charset=UTF-8 Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/qzxz8bm9BvWIWBw5sysWKA4kzhc Cc: "therightkey@ietf.org" , Melinda Shore Subject: Re: [therightkey] Mailing list update X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Feb 2014 18:46:39 -0000 On 17 February 2014 18:42, Trevor Perrin wrote: > I would've assumed / preferred the new WG would get a new list, as not > everyone interested in general discussion of this problem space would > want to follow all the CT spec details, but that's just my opinion. Agreed that we should keep this list for more general discussions. Neutral on whether all subscribers should be signed up to the new list (probably easiest, though, they can always unsubscribe). > > > Trevor > > > On Mon, Feb 17, 2014 at 10:38 AM, Melinda Shore wrote: >> On 2/17/14 9:35 AM, Trevor Perrin wrote: >>> I thought this list was for more general discussion - not just CT? >> >> We don't need to shut this list down if people find it useful. >> The main issues were 1) whether or not to create a separate >> trans working group mailing list, and 2) whether or not to >> subscribe everybody on this mailing list to the new one. >> >> Melinda >> > > _______________________________________________ > therightkey mailing list > therightkey@ietf.org > https://www.ietf.org/mailman/listinfo/therightkey From nobody Mon Feb 17 10:48:00 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 15EA01A0564 for ; Mon, 17 Feb 2014 10:47:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U6vgyM8MIVsU for ; Mon, 17 Feb 2014 10:47:56 -0800 (PST) Received: from mail-la0-x22f.google.com (mail-la0-x22f.google.com [IPv6:2a00:1450:4010:c03::22f]) by ietfa.amsl.com (Postfix) with ESMTP id EB8091A03FB for ; Mon, 17 Feb 2014 10:47:55 -0800 (PST) Received: by mail-la0-f47.google.com with SMTP id hr17so11373190lab.20 for ; Mon, 17 Feb 2014 10:47:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=n8O8X6iy39ApxbmoC9qwyfTRYACSiAQgv3SYCrXKO+E=; b=lfPLeUdGp3IyzzLsth1jMOhJsPOv6hSn8V047TjfGhG5eSivhNGh1/ly3oeuG4acNF vYCoH8aCDZv0MU9e2weHgKoHpHfyMQvjtcuqJLS1SY5Y3oHT98+roc7eYKi2HyjhrIjv cigDdpVp3HoamnYOiphFyZLZyq+smVTonnvo0Y3RqsLft0Duvi8jrmeqZWXaFpWTrLSm PmM3Dx/X1TkcGEx3gNJqGWRCcO4Oqa+FRgI1rOK5UxynMG9GBJvOo5OX2OjVL7F4wYAq QtgbWKIs+K9ZlD6iSjBdc8BGp10lU3K0vWaaXvfNonY4CP6Yhyik5sCzkKfMbUYsuoq4 +DjQ== MIME-Version: 1.0 X-Received: by 10.112.132.131 with SMTP id ou3mr17600489lbb.29.1392662872686; Mon, 17 Feb 2014 10:47:52 -0800 (PST) Received: by 10.112.37.168 with HTTP; Mon, 17 Feb 2014 10:47:52 -0800 (PST) In-Reply-To: <53025717.1050204@gmail.com> References: <530255F5.50804@gmail.com> <53025717.1050204@gmail.com> Date: Mon, 17 Feb 2014 13:47:52 -0500 Message-ID: From: Phillip Hallam-Baker To: Melinda Shore Content-Type: multipart/alternative; boundary=047d7b343dbed1876f04f29e97d0 Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/DGaHXq6ITjHuu2anKgZCYnqSnJE Cc: Trevor Perrin , "therightkey@ietf.org" Subject: Re: [therightkey] Mailing list update X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Feb 2014 18:47:59 -0000 --047d7b343dbed1876f04f29e97d0 Content-Type: text/plain; charset=ISO-8859-1 I think it is very useful. CT is an extension to the WebPKI for SSL it is dealing in organizations. In PPE I am proposing a Trust infrastructure to support individual users so PPE = PKIX + PGP + CT. I don't think you want to be discussing that on the Trans working group even if we end up using Trans data formats in PPE. Though what would be very relevant to Trans would be questions like 'are the data structures proposed for Trans sufficiently extensible to support other applications'. If Trans can't support PPE then that is a specification smell. So it is relevant in that situation. On Mon, Feb 17, 2014 at 1:38 PM, Melinda Shore wrote: > On 2/17/14 9:35 AM, Trevor Perrin wrote: > > I thought this list was for more general discussion - not just CT? > > We don't need to shut this list down if people find it useful. > The main issues were 1) whether or not to create a separate > trans working group mailing list, and 2) whether or not to > subscribe everybody on this mailing list to the new one. > > Melinda > > _______________________________________________ > therightkey mailing list > therightkey@ietf.org > https://www.ietf.org/mailman/listinfo/therightkey > -- Website: http://hallambaker.com/ --047d7b343dbed1876f04f29e97d0 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
I think it is very useful.

CT is an ext= ension to the WebPKI for SSL it is dealing in organizations.

=
In PPE I am proposing a Trust infrastructure to support individu= al users so PPE =3D PKIX + PGP + CT.

I don't think you want to be discussing that on the= Trans working group even if we end up using Trans data formats in PPE. Tho= ugh what would be very relevant to Trans would be questions like 'are t= he data structures proposed for Trans sufficiently extensible to support ot= her applications'.

If Trans can't support PPE then that is a specifica= tion smell. So it is relevant in that situation.=A0



On Mon, Fe= b 17, 2014 at 1:38 PM, Melinda Shore <melinda.shore@gmail.com>= ; wrote:
On 2/17/14 9:35 AM, Trevor P= errin wrote:
> I thought this list was for more general discussion - not just CT?

We don't need to shut this list down if people find it useful. The main issues were 1) whether or not to create a separate
trans working group mailing list, and 2) whether or not to
subscribe everybody on this mailing list to the new one.

Melinda

_______________________________________________
therightkey mailing list
therightkey@ietf.org
https://www.ietf.org/mailman/listinfo/therightkey



--
= Website: http://hallambaker.com/
--047d7b343dbed1876f04f29e97d0-- From nobody Mon Feb 17 11:01:43 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44ADB1A01DB for ; Mon, 17 Feb 2014 11:01:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KTPg79ZnLhSu for ; Mon, 17 Feb 2014 11:01:40 -0800 (PST) Received: from mail-pd0-x22b.google.com (mail-pd0-x22b.google.com [IPv6:2607:f8b0:400e:c02::22b]) by ietfa.amsl.com (Postfix) with ESMTP id AFD211A012E for ; Mon, 17 Feb 2014 11:01:40 -0800 (PST) Received: by mail-pd0-f171.google.com with SMTP id g10so15200047pdj.30 for ; Mon, 17 Feb 2014 11:01:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject :content-type:content-transfer-encoding; bh=Brjlzh+0HbfeqcuIWgDnUT7HM/fCEMSEmimXXV2bEcM=; b=Y+mI2Z3IBgxL0COxP4qlDfEJhkPW6sXLaNl7RiTy0A4aFS4eh/NqcJ3PR/dsWuTTxO HDPyGzFSWnpK1hy7AziqFtQ6IYvKGLeQi9Q2yvWCXjAg5IKQ/hRLVqnE1whtJdhdXShW On+BGV8G97+S3NM9oPkEnsmZjnAGXSyyRG3x3xx2Lu4wfC02stROiuFdxpYRv9bJFBP7 +p88bwPf4VqrziWhBlIvHZjvaDHTKJBGZJ99Sgq6QQuGBVzgGp7nfIIaKieUYOmw/4x9 sydSE20jmqJ6cdMy3TvmMZMqoGwHFN7iP1/6Fs+pUQ+P5vtw10ko+0s9GbesiFhKqggN sU1g== X-Received: by 10.66.146.229 with SMTP id tf5mr28507826pab.50.1392663698241; Mon, 17 Feb 2014 11:01:38 -0800 (PST) Received: from spandex.local (63-140-93-251.dynamic.dsl.acsalaska.net. [63.140.93.251]) by mx.google.com with ESMTPSA id hr2sm48212180pbb.8.2014.02.17.11.01.36 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 17 Feb 2014 11:01:37 -0800 (PST) Message-ID: <53025C8F.5020803@gmail.com> Date: Mon, 17 Feb 2014 10:01:35 -0900 From: Melinda Shore User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130620 Thunderbird/17.0.7 MIME-Version: 1.0 To: "therightkey@ietf.org" Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/1ac2xqsk7OwcAR_kezlBaYcXoJ4 Subject: [therightkey] Ramping up X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Feb 2014 19:01:42 -0000 1) I've asked Ben and his co-authors to resubmit draft-laurie-rfc6962-bis as draft-ietf-trans-rfc6962-bis 2) We need to nail down milestones. In particular we need to have a reasonable ballpark estimate of when we'll get the bis draft into working group last call. I'd like more feedback from the authors and working group participants on what they and you feel needs to be done to wrap up the draft. Does late 2014 seem reasonable for working group last call? 3) Another question is whether or not there are sections of 6962bis which ought to be moved to separate documents, such as client behavior. 4) London planning: I am generally not a fan of burning up meeting time on PowerPoint-driven presentations - they're sometimes unavoidable but IETF meetings are working meetings and I'd rather use the time productively, for face to face discussion of things which are difficult to work out on the mailing list or which would benefit from more interactivity than we can get with email. We don't have a huge amount of spare time in London but we can squeeze in some people in if they've got something that needs attention or that would help move the document along 5) the corollary to 4 is that I do try to get as much done on the mailing list as possible. One thing that's been useful in some circumstances in the past has been an issue tracker. We do have a working group wiki page with an issue tracker, and I'd like to get a sense of whether the working group in general and the authors more specifically would find it helpful in progressing the document. 6) Are there other process issues you'd like to see addressed? Once I hear from Ben et al. I'll get a draft agenda for London posted. Thanks, Melinda From nobody Mon Feb 17 12:08:17 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0494B1A025C for ; Mon, 17 Feb 2014 12:08:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GVF6bxyf81pY for ; Mon, 17 Feb 2014 12:08:12 -0800 (PST) Received: from mail-la0-x230.google.com (mail-la0-x230.google.com [IPv6:2a00:1450:4010:c03::230]) by ietfa.amsl.com (Postfix) with ESMTP id B55721A0536 for ; Mon, 17 Feb 2014 12:08:11 -0800 (PST) Received: by mail-la0-f48.google.com with SMTP id mc6so11426359lab.21 for ; Mon, 17 Feb 2014 12:08:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=3D+tAAnm9UHfArBHU+V1TQvQu/SNpzzRgn4/1cPEBDI=; b=KPOaCojmIfYGrFVgqpmt5YoBavof6fdPN0GHDbqVVCa1IRzBPgk+Q1CD+nuv1i33n4 DdPCNreg8PwFv9HVprVaZ1J1DUU3pX/8UC9gNo1sP1Uog4CdvE8/b+n+f045KCY4QVZV bIR8CylA3eV0tVax0TWQTpVmH7ExTQrGmXHNY/LfKavjh5AP+ukKbQ6/buBhjSMAeiZO Vugu5edcukXwFnPHCBfbF0+5i4l5gHjVNgQ3ApkGs5MbMhV6hnbmLBaCDd0efym/KRzU 8MUzto3fdUg3HA4etd2e9jBna/RyPDTBqdiAQY594rRGleE5IIOZC21RnwrH1XjhMJVy 5I0g== MIME-Version: 1.0 X-Received: by 10.112.39.167 with SMTP id q7mr22216lbk.82.1392667688433; Mon, 17 Feb 2014 12:08:08 -0800 (PST) Received: by 10.112.37.168 with HTTP; Mon, 17 Feb 2014 12:08:08 -0800 (PST) In-Reply-To: <53025C8F.5020803@gmail.com> References: <53025C8F.5020803@gmail.com> Date: Mon, 17 Feb 2014 15:08:08 -0500 Message-ID: From: Phillip Hallam-Baker To: Melinda Shore Content-Type: multipart/alternative; boundary=001a1134d7aedc00cd04f29fb651 Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/CGigslBAoEPZvMEFT0GV3-fgT9E Cc: "therightkey@ietf.org" Subject: Re: [therightkey] Ramping up X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Feb 2014 20:08:15 -0000 --001a1134d7aedc00cd04f29fb651 Content-Type: text/plain; charset=ISO-8859-1 The fact that designers have been forced to go through the process of generating a description is often very useful. What I have been doing is to make the presentation of what and why into podcasts that are up on YouTube. I think UNIX would have come out very differently if the designers had been required to work with a technical writer and explain what was going on. Lot of needless obfustication would have been easier to fix than to explain. Which is of course why there is a resistance to doing such exercises. On Mon, Feb 17, 2014 at 2:01 PM, Melinda Shore wrote: > 1) I've asked Ben and his co-authors to resubmit > draft-laurie-rfc6962-bis as draft-ietf-trans-rfc6962-bis > > 2) We need to nail down milestones. In particular we need > to have a reasonable ballpark estimate of when we'll get > the bis draft into working group last call. I'd like more > feedback from the authors and working group participants > on what they and you feel needs to be done to wrap up > the draft. Does late 2014 seem reasonable for working > group last call? > > 3) Another question is whether or not there are sections > of 6962bis which ought to be moved to separate documents, > such as client behavior. > > 4) London planning: I am generally not a fan of burning up > meeting time on PowerPoint-driven presentations - they're > sometimes unavoidable but IETF meetings are working meetings > and I'd rather use the time productively, for face to face > discussion of things which are difficult to work out on > the mailing list or which would benefit from more interactivity > than we can get with email. We don't have a huge amount of > spare time in London but we can squeeze in some people in > if they've got something that needs attention or that would > help move the document along > > 5) the corollary to 4 is that I do try to get as much done on > the mailing list as possible. One thing that's been useful > in some circumstances in the past has been an issue tracker. > We do have a working group wiki page with an issue tracker, > and I'd like to get a sense of whether the working group in > general and the authors more specifically would find it > helpful in progressing the document. > > 6) Are there other process issues you'd like to see addressed? > > Once I hear from Ben et al. I'll get a draft agenda for London > posted. > > Thanks, > > Melinda > > _______________________________________________ > therightkey mailing list > therightkey@ietf.org > https://www.ietf.org/mailman/listinfo/therightkey > -- Website: http://hallambaker.com/ --001a1134d7aedc00cd04f29fb651 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
The fact that designers have been forced to go through the= process of generating a description is often very useful.=A0

What I have been doing is to make the presentation of what and why in= to podcasts that are up on YouTube.

I think UNIX would have come out very differently if th= e designers had been required to work with a technical writer and explain w= hat was going on. Lot of needless obfustication would have been easier to f= ix than to explain.

Which is of course why there is a resistance to doing s= uch exercises.


On Mon, Feb 17, 2014 at 2:01 PM, Melinda Shore <melinda= .shore@gmail.com> wrote:
1) I've asked Ben and his co-authors to = resubmit
=A0 =A0draft-laurie-rfc6962-bis as draft-ietf-trans-rfc6962-bis

2) We need to nail down milestones. =A0In particular we need
=A0 =A0to have a reasonable ballpark estimate of when we'll get
=A0 =A0the bis draft into working group last call. =A0I'd like more
=A0 =A0feedback from the authors and working group participants
=A0 =A0on what they and you feel needs to be done to wrap up
=A0 =A0the draft. =A0Does late 2014 seem reasonable for working
=A0 =A0group last call?

3) Another question is whether or not there are sections
=A0 =A0of 6962bis which ought to be moved to separate documents,
=A0 =A0such as client behavior.

4) London planning: I am generally not a fan of burning up
=A0 =A0meeting time on PowerPoint-driven presentations - they're
=A0 =A0sometimes unavoidable but IETF meetings are working meetings
=A0 =A0and I'd rather use the time productively, for face to face
=A0 =A0discussion of things which are difficult to work out on
=A0 =A0the mailing list or which would benefit from more interactivity
=A0 =A0than we can get with email. =A0We don't have a huge amount of =A0 =A0spare time in London but we can squeeze in some people in
=A0 =A0if they've got something that needs attention or that would
=A0 =A0help move the document along

5) the corollary to 4 is that I do try to get as much done on
=A0 =A0the mailing list as possible. =A0One thing that's been useful =A0 =A0in some circumstances in the past has been an issue tracker.
=A0 =A0We do have a working group wiki page with an issue tracker,
=A0 =A0and I'd like to get a sense of whether the working group in
=A0 =A0general and the authors more specifically would find it
=A0 =A0helpful in progressing the document.

6) Are there other process issues you'd like to see addressed?

Once I hear from Ben et al. I'll get a draft agenda for London
posted.

Thanks,

Melinda

_______________________________________________
therightkey mailing list
therightkey@ietf.org
https://www.ietf.org/mailman/listinfo/therightkey



--
Website: http://hallambaker.com/
--001a1134d7aedc00cd04f29fb651-- From nobody Tue Feb 18 07:30:01 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 610A21A04D0 for ; Tue, 18 Feb 2014 07:30:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.327 X-Spam-Level: X-Spam-Status: No, score=-1.327 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, J_CHICKENPOX_22=0.6, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wI0V-OvNhuOF for ; Tue, 18 Feb 2014 07:29:56 -0800 (PST) Received: from mail-vc0-x236.google.com (mail-vc0-x236.google.com [IPv6:2607:f8b0:400c:c03::236]) by ietfa.amsl.com (Postfix) with ESMTP id 37B431A0693 for ; Tue, 18 Feb 2014 07:29:56 -0800 (PST) Received: by mail-vc0-f182.google.com with SMTP id id10so13013317vcb.41 for ; Tue, 18 Feb 2014 07:29:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=4iyM2P7BGM7s7mmMu9cqJy4aZK1KHYKHAjVSaqbOPGI=; b=Xxl3UFIu5aLeGLZPKUzmXq2SE69wldn1Au6BZKU1InN17RM3XdzST3vZ1S95fh0iWk Vn21B+LF+POVZhC50M2m6AoQUHWf/vv7LMBAjX2+O8oqFEHBUODwGDXsVkKGKWAETyID 8Y5Ipj7izdNn583gjqcRc7tFY9xVhvLJ39Oh8AOwv0Lue8Zg8JuZLqjNJIRe3rbEbEm9 swsdu/Oe6ex7HQg9gShGyZhXymn1xVYtQP37JQHidkbB/OTfLbdg+IZab7Tt5ImmgCSs Vde35DZQg2YhmZtC07AREWRlOluNXupFY7/QsUPgSt/2HvFOzQjtmnfP220IzCreotbP VFmg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=4iyM2P7BGM7s7mmMu9cqJy4aZK1KHYKHAjVSaqbOPGI=; b=cZxrqJxT7ryAT4ME8acG3+NiUfFDrk2qGevqQe6PGqh0xlRcUXm3WcYgwCem0z1uf4 SfWegg/ZrvMTQozSgh5KAsIITnZK3sdsY9oPKVfmONbYSH11KHX2rvpZOfAF6i6fKrkS boKh60pxype6e9Y/nusGDZQ8VoLNidyVKhlwnJ6yXEVV8OENUL/ZPfPPjB0cWnr4OhK3 GWCU1sBBikeqb1OMG+KAnnSy5DkV+4JZrIIbk8rHPybV3MWVWv6LSqLJP4RigxcqR3jp n8pkSSoyuTkxOH2jOWzRwbJSaaoJ+PQpj++BD3VKrMdKJ2QoI+56WWhsu1Toj7sixn8/ EPOg== X-Gm-Message-State: ALoCoQkEF/fnGXv/wXACtRpdtnBVWVSwFCcmlHTZSaC+EoTReEbFREuSdu6QenieyqrfwCh9rYKbCUThwQfYAa8BO20fYeeBK9NQAhXIudUnQcPhbBetidPLpPnkbEWpqefqyajQ/I6lkYtnT6wYdWIpPheOrR7wjjs5zB77Kuyg+IsecF36Mhr00HV/hPtaLbXdDTxXh8ss MIME-Version: 1.0 X-Received: by 10.220.247.68 with SMTP id mb4mr5852798vcb.37.1392737393003; Tue, 18 Feb 2014 07:29:53 -0800 (PST) Received: by 10.52.230.105 with HTTP; Tue, 18 Feb 2014 07:29:52 -0800 (PST) In-Reply-To: <0b3f01cf228d$fef92e30$fceb8a90$@digicert.com> References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <52F2305C.5040107@comodo.com> <0b3f01cf228d$fef92e30$fceb8a90$@digicert.com> Date: Tue, 18 Feb 2014 15:29:52 +0000 Message-ID: From: Ben Laurie To: "certificate-transparency@googlegroups.com" Content-Type: text/plain; charset=UTF-8 Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/L81al36CLVQpkixhPPYjJfSoaBE Cc: "therightkey@ietf.org" , Rob Stradling , CABFPub Subject: Re: [therightkey] [cabfpub] Thoughts on reducing SCT sizes (was Re: Updated Certificate Transparency + Extended Validation plan) X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Feb 2014 15:30:00 -0000 Sorry for long delay. On 5 February 2014 16:19, Jeremy Rowley wrote: > Table 1 of the plan document said both 3 SCTs and 4 SCTs for 27 months. > Until there is clarification on which is required, 3-4 is the best > representation of the requirement. I'm hoping Ben meant 15-27 months = 3 and > 27 = 4, but it's not clear from the document. Yes, that's exactly what I meant. > > Jeremy > > -----Original Message----- > From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On > Behalf Of Rob Stradling > Sent: Wednesday, February 05, 2014 5:37 AM > To: certificate-transparency@googlegroups.com > Cc: therightkey@ietf.org; CABFPub > Subject: [cabfpub] Thoughts on reducing SCT sizes (was Re: Updated > Certificate Transparency + Extended Validation plan) > > On Tue, Feb 4, 2014 at 12:33 PM, Jeremy Rowley wrote: >> Three or four proofs for a 27 month certificate is way too many. > >> Adding 400 bytes per certificate will make EV certificates unusable by > entities concerned with performance. > > The updated CT+EV plan requires three SCTs for a (maximum length) 27-month > EV certificate, not four. 400 bytes for three SCTs is about right though. > > Assuming RFC6962-compliant v1 SCTs that contain no SCT extensions and are > signed using ECDSA and a P-256 private key, then, including all of the ASN.1 > fluff for the SCT List certificate extension, I calculate that it'll be... > > 140 or 141 bytes to embed 1 SCT > > 261 to 263 bytes to embed 2 SCTs > > 380 to 383 bytes to embed 3 SCTs > > For (non-EV) validity periods between 27 and 39 months: > 499 to 503 bytes to embed 4 SCTs > > On 04/02/14 17:52, Adam Langley wrote: > >> We should make the SCTs as small as possible > > Agreed. Time for some back-of-an-envelope sums. For SCT v2, if we were to > pack in the data as tightly as possible I reckon we could cut it down to as > little as... > > 84 bytes to embed 1 SCT > > 159 bytes to embed 2 SCTs > > 231 bytes to embed 3 SCTs > > 303 bytes to embed 4 SCTs > > Here's how... > > 1. Use a shorter OID for the SCT List extension. Perhaps CABForum could > define 2.23.140.n (with n < 128). Save 6 bytes. > > 2. The first 2 bytes of the SignedCertificateTimestampList structure are its > total length. Since this can be calculated from the OCTET STRING length, > these 2 bytes could be omitted. Save 2 bytes. > > 3. Pack the SCT fields into as few bytes as possible for the common case, > whilst retaining options for future expansion. Save 37 bytes per SCT. > Replace... > (1 byte) Version sct_version; > (32 bytes) LogID id; > (8 bytes) uint64 timestamp; > (2+? bytes) CtExtensions extensions; > ...with... > (2 bits) sct_version (00=v1; 01=v2; 10,11=unassigned) > (2 bits) log_id_type (00=SHA-256(log_public_key); > 01=1-byte Registered Log ID; > 10=2-byte Registered Log ID; > 11=4-byte Registered Log ID) > (2 bits) timestamp_size (00=8-bytes; > 01=6-bytes; > 10=5-bytes; > 11=4-bytes) > (1 bit) extensions (0=CtExtensions is present; > 1=CtExtensions is absent) > (1 bit) signature_type (0=digitally-signed struct; > 1=raw Ed25519 signature) > For the common case: > (1 byte) Registered Log ID > (4 bytes) Timestamp (seconds, not milliseconds) > > 4. Use the Ed25519 signature scheme instead of ECDSA. ECDSA signatures > using a P-256 key seem to be 72 or 73 bytes, whereas Ed25519 signatures are > 64 bytes. Save 8 or 9 bytes per SCT. > Also, for Ed25519, omit the 2 bytes containing the hash algorithm and > signature algorithm from the "digitally-signed struct" header. Save 2 bytes > per SCT. > > -- > Rob Stradling > Senior Research & Development Scientist > COMODO - Creating Trust Online > _______________________________________________ > Public mailing list > Public@cabforum.org > https://cabforum.org/mailman/listinfo/public > > -- > You received this message because you are subscribed to the Google Groups "certificate-transparency" group. > To unsubscribe from this group and stop receiving emails from it, send an email to certificate-transparency+unsubscribe@googlegroups.com. > For more options, visit https://groups.google.com/groups/opt_out. From nobody Tue Feb 18 07:38:05 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 630F01A06A5 for ; Tue, 18 Feb 2014 07:38:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.849 X-Spam-Level: X-Spam-Status: No, score=-1.849 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, J_CHICKENPOX_22=0.6, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OadfvhqWR1dI for ; Tue, 18 Feb 2014 07:38:00 -0800 (PST) Received: from ipedge1.entrust.com (ipedge1.entrust.com [216.191.252.10]) by ietfa.amsl.com (Postfix) with ESMTP id 853AF1A0238 for ; Tue, 18 Feb 2014 07:38:00 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.97,502,1389762000"; d="scan'208";a="2040838" Received: from unknown (HELO sottexchcas.corp.ad.entrust.com) ([10.4.51.93]) by ipedge1.entrust.com with ESMTP; 18 Feb 2014 10:37:57 -0500 Received: from SOTTEXCH10.corp.ad.entrust.com ([fe80::389b:f45b:7ea1:79b7]) by sottexchcas1.corp.ad.entrust.com ([::1]) with mapi id 14.03.0174.001; Tue, 18 Feb 2014 10:37:57 -0500 From: Tim Moses To: Ben Laurie Thread-Topic: [therightkey] [cabfpub] Thoughts on reducing SCT sizes (was Re: Updated Certificate Transparency + Extended Validation plan) Thread-Index: AQHPLL5KeVtYHlXE70+nyJFnvXx2Gpq7JU35 Date: Tue, 18 Feb 2014 15:37:56 +0000 Message-ID: References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <52F2305C.5040107@comodo.com> <0b3f01cf228d$fef92e30$fceb8a90$@digicert.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/NdZx3pvVrR0_n9xAkU2XO74KmmY Cc: "therightkey@ietf.org" , Rob Stradling , "certificate-transparency@googlegroups.com" , CABFPub Subject: Re: [therightkey] [cabfpub] Thoughts on reducing SCT sizes (was Re: Updated Certificate Transparency + Extended Validation plan) X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Feb 2014 15:38:03 -0000 Ben - Will Chrome deny EV status to a certificate with too few SCTs, or wi= ll it grant EV status as long as at least one of its SCTs is from a log tha= t remains in the program? All the best. Tim. > On Feb 18, 2014, at 10:30 AM, "Ben Laurie" wrote: >=20 > Sorry for long delay. >=20 >> On 5 February 2014 16:19, Jeremy Rowley wro= te: >> Table 1 of the plan document said both 3 SCTs and 4 SCTs for 27 months. >> Until there is clarification on which is required, 3-4 is the best >> representation of the requirement. I'm hoping Ben meant 15-27 months =3D= 3 and >> 27 =3D 4, but it's not clear from the document. >=20 > Yes, that's exactly what I meant. >=20 >>=20 >> Jeremy >>=20 >> -----Original Message----- >> From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] O= n >> Behalf Of Rob Stradling >> Sent: Wednesday, February 05, 2014 5:37 AM >> To: certificate-transparency@googlegroups.com >> Cc: therightkey@ietf.org; CABFPub >> Subject: [cabfpub] Thoughts on reducing SCT sizes (was Re: Updated >> Certificate Transparency + Extended Validation plan) >>=20 >>> On Tue, Feb 4, 2014 at 12:33 PM, Jeremy Rowley wrote: >>> Three or four proofs for a 27 month certificate is way too many. >> >>> Adding 400 bytes per certificate will make EV certificates unusable by >> entities concerned with performance. >>=20 >> The updated CT+EV plan requires three SCTs for a (maximum length) 27-mon= th >> EV certificate, not four. 400 bytes for three SCTs is about right thoug= h. >>=20 >> Assuming RFC6962-compliant v1 SCTs that contain no SCT extensions and ar= e >> signed using ECDSA and a P-256 private key, then, including all of the A= SN.1 >> fluff for the SCT List certificate extension, I calculate that it'll be.= .. >>=20 >> 140 or 141 bytes to embed 1 SCT >>=20 >> 261 to 263 bytes to embed 2 SCTs >>=20 >> 380 to 383 bytes to embed 3 SCTs >>=20 >> For (non-EV) validity periods between 27 and 39 months: >> 499 to 503 bytes to embed 4 SCTs >>=20 >>> On 04/02/14 17:52, Adam Langley wrote: >>> >>> We should make the SCTs as small as possible >>=20 >> Agreed. Time for some back-of-an-envelope sums. For SCT v2, if we were= to >> pack in the data as tightly as possible I reckon we could cut it down to= as >> little as... >>=20 >> 84 bytes to embed 1 SCT >>=20 >> 159 bytes to embed 2 SCTs >>=20 >> 231 bytes to embed 3 SCTs >>=20 >> 303 bytes to embed 4 SCTs >>=20 >> Here's how... >>=20 >> 1. Use a shorter OID for the SCT List extension. Perhaps CABForum could >> define 2.23.140.n (with n < 128). Save 6 bytes. >>=20 >> 2. The first 2 bytes of the SignedCertificateTimestampList structure are= its >> total length. Since this can be calculated from the OCTET STRING length= , >> these 2 bytes could be omitted. Save 2 bytes. >>=20 >> 3. Pack the SCT fields into as few bytes as possible for the common case= , >> whilst retaining options for future expansion. Save 37 bytes per SCT. >> Replace... >> (1 byte) Version sct_version; >> (32 bytes) LogID id; >> (8 bytes) uint64 timestamp; >> (2+? bytes) CtExtensions extensions; >> ...with... >> (2 bits) sct_version (00=3Dv1; 01=3Dv2; 10,11=3Dunassigned) >> (2 bits) log_id_type (00=3DSHA-256(log_public_key); >> 01=3D1-byte Registered Log ID; >> 10=3D2-byte Registered Log ID; >> 11=3D4-byte Registered Log ID) >> (2 bits) timestamp_size (00=3D8-bytes; >> 01=3D6-bytes; >> 10=3D5-bytes; >> 11=3D4-bytes) >> (1 bit) extensions (0=3DCtExtensions is present; >> 1=3DCtExtensions is absent) >> (1 bit) signature_type (0=3Ddigitally-signed struct; >> 1=3Draw Ed25519 signature) >> For the common case: >> (1 byte) Registered Log ID >> (4 bytes) Timestamp (seconds, not milliseconds) >>=20 >> 4. Use the Ed25519 signature scheme instead of ECDSA. ECDSA signatures >> using a P-256 key seem to be 72 or 73 bytes, whereas Ed25519 signatures = are >> 64 bytes. Save 8 or 9 bytes per SCT. >> Also, for Ed25519, omit the 2 bytes containing the hash algorithm and >> signature algorithm from the "digitally-signed struct" header. Save 2 b= ytes >> per SCT. >>=20 >> -- >> Rob Stradling >> Senior Research & Development Scientist >> COMODO - Creating Trust Online >> _______________________________________________ >> Public mailing list >> Public@cabforum.org >> https://cabforum.org/mailman/listinfo/public >>=20 >> -- >> You received this message because you are subscribed to the Google Group= s "certificate-transparency" group. >> To unsubscribe from this group and stop receiving emails from it, send a= n email to certificate-transparency+unsubscribe@googlegroups.com. >> For more options, visit https://groups.google.com/groups/opt_out. >=20 > _______________________________________________ > therightkey mailing list > therightkey@ietf.org > https://www.ietf.org/mailman/listinfo/therightkey From nobody Tue Feb 18 08:59:04 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 32B841A0402 for ; Tue, 18 Feb 2014 08:59:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.327 X-Spam-Level: X-Spam-Status: No, score=-1.327 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, J_CHICKENPOX_22=0.6, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iLPKncZ7Jot5 for ; Tue, 18 Feb 2014 08:58:59 -0800 (PST) Received: from mail-vc0-x236.google.com (mail-vc0-x236.google.com [IPv6:2607:f8b0:400c:c03::236]) by ietfa.amsl.com (Postfix) with ESMTP id 51BD71A03FF for ; Tue, 18 Feb 2014 08:58:59 -0800 (PST) Received: by mail-vc0-f182.google.com with SMTP id id10so13615896vcb.27 for ; Tue, 18 Feb 2014 08:58:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=I4CC2k3LKj1qLGKIJp8QbrxXzBvD49y5TskRJJ4e51k=; b=XLj/VaCwcvhPbhzEPuuNkpNyLSrGdiQ9zRYShiyrkcafelgpePknv7OeP4yH6cyQQb MEJHM3cPvoPcwtqLuMiIxkBcL0k7Q93gXnqJGutvsZepnl1mhyG7BHdnB+pj40v4uT2Q ude+2ryAM1AVWEkSNv4P85l7FCqA0+vkGOQ/NTM0gYhv2kn+Ckrzu4Bntap2DKrYXgVo hdbRtabL5c7DYEVnGO5KbXmMgydcyhuhjSthzvCy/d5Oun1wl05Y8J4igZ7sxFL8GKXE mu4Gaa0LCcQH5p03bc8Vetuymt9Pzo6CAOqW6mQKly0CFyZf2cpiv1AP9Bd1e+3B4uei FB8g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=I4CC2k3LKj1qLGKIJp8QbrxXzBvD49y5TskRJJ4e51k=; b=P7+OhYskTpjcrW8AXMhOJuklK41FiIBnmm9ZRK7nBCmWwiAQNczfquDaUKv8d/51JI unkE2LRrRg64E4rQGY+7BA/83wPG5FFYWlGQgsinBvSWq24GtGsUyunnMDCpfW4bMpoI 4kVHs310TZgnNHEMRKrCFG87goxkm1hY55aaGeXiJljVLbOOTiDlvaktaOih/4dd2nHw vNgMNmw8FpKK8PQp263VchQJ0MjpRnj0inMCynRZdWYCVxNs2wi0K6RjLKVnt5nnVovf oeYtOLtt6TG3ERfg2gfMSpDf/7CdUlMmVQ/Dqh7CVgEErFDEWp+lag4c21ezGD/OCSh1 dhhA== X-Gm-Message-State: ALoCoQkZEOkw3/K9Ilanm/5gcMJej5mAKuAj8imB64kCJZPj7qLtS/xB7OVZBLsIiA2KVoUAOdVLZ/19SaltyNOsF19wTO/ljDpCTaWZ0E4nE/CK6Jfu5WHK7AtZArxvInuDI4Y4zSo3OdUX6gaxCbnTHmFG0PwjnWdtsOB5Szz8JXDPSlMrDFFhuGHokeAg4TktgBkrHtE5 MIME-Version: 1.0 X-Received: by 10.52.188.41 with SMTP id fx9mr18267100vdc.19.1392742736121; Tue, 18 Feb 2014 08:58:56 -0800 (PST) Received: by 10.52.230.105 with HTTP; Tue, 18 Feb 2014 08:58:56 -0800 (PST) In-Reply-To: References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <52F2305C.5040107@comodo.com> <0b3f01cf228d$fef92e30$fceb8a90$@digicert.com> Date: Tue, 18 Feb 2014 16:58:56 +0000 Message-ID: From: Ben Laurie To: Tim Moses Content-Type: text/plain; charset=UTF-8 Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/X6RWYUtzGRjtDUx-SktHOeGgIeA Cc: "therightkey@ietf.org" , Rob Stradling , "certificate-transparency@googlegroups.com" , CABFPub Subject: Re: [therightkey] [cabfpub] Thoughts on reducing SCT sizes (was Re: Updated Certificate Transparency + Extended Validation plan) X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Feb 2014 16:59:01 -0000 On 18 February 2014 15:37, Tim Moses wrote: > Ben - Will Chrome deny EV status to a certificate with too few SCTs, or will it grant EV status as long as at least one of its SCTs is from a log that remains in the program? It will deny. > > All the best. Tim. > >> On Feb 18, 2014, at 10:30 AM, "Ben Laurie" wrote: >> >> Sorry for long delay. >> >>> On 5 February 2014 16:19, Jeremy Rowley wrote: >>> Table 1 of the plan document said both 3 SCTs and 4 SCTs for 27 months. >>> Until there is clarification on which is required, 3-4 is the best >>> representation of the requirement. I'm hoping Ben meant 15-27 months = 3 and >>> 27 = 4, but it's not clear from the document. >> >> Yes, that's exactly what I meant. >> >>> >>> Jeremy >>> >>> -----Original Message----- >>> From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On >>> Behalf Of Rob Stradling >>> Sent: Wednesday, February 05, 2014 5:37 AM >>> To: certificate-transparency@googlegroups.com >>> Cc: therightkey@ietf.org; CABFPub >>> Subject: [cabfpub] Thoughts on reducing SCT sizes (was Re: Updated >>> Certificate Transparency + Extended Validation plan) >>> >>>> On Tue, Feb 4, 2014 at 12:33 PM, Jeremy Rowley wrote: >>>> Three or four proofs for a 27 month certificate is way too many. >>> >>>> Adding 400 bytes per certificate will make EV certificates unusable by >>> entities concerned with performance. >>> >>> The updated CT+EV plan requires three SCTs for a (maximum length) 27-month >>> EV certificate, not four. 400 bytes for three SCTs is about right though. >>> >>> Assuming RFC6962-compliant v1 SCTs that contain no SCT extensions and are >>> signed using ECDSA and a P-256 private key, then, including all of the ASN.1 >>> fluff for the SCT List certificate extension, I calculate that it'll be... >>> >>> 140 or 141 bytes to embed 1 SCT >>> >>> 261 to 263 bytes to embed 2 SCTs >>> >>> 380 to 383 bytes to embed 3 SCTs >>> >>> For (non-EV) validity periods between 27 and 39 months: >>> 499 to 503 bytes to embed 4 SCTs >>> >>>> On 04/02/14 17:52, Adam Langley wrote: >>>> >>>> We should make the SCTs as small as possible >>> >>> Agreed. Time for some back-of-an-envelope sums. For SCT v2, if we were to >>> pack in the data as tightly as possible I reckon we could cut it down to as >>> little as... >>> >>> 84 bytes to embed 1 SCT >>> >>> 159 bytes to embed 2 SCTs >>> >>> 231 bytes to embed 3 SCTs >>> >>> 303 bytes to embed 4 SCTs >>> >>> Here's how... >>> >>> 1. Use a shorter OID for the SCT List extension. Perhaps CABForum could >>> define 2.23.140.n (with n < 128). Save 6 bytes. >>> >>> 2. The first 2 bytes of the SignedCertificateTimestampList structure are its >>> total length. Since this can be calculated from the OCTET STRING length, >>> these 2 bytes could be omitted. Save 2 bytes. >>> >>> 3. Pack the SCT fields into as few bytes as possible for the common case, >>> whilst retaining options for future expansion. Save 37 bytes per SCT. >>> Replace... >>> (1 byte) Version sct_version; >>> (32 bytes) LogID id; >>> (8 bytes) uint64 timestamp; >>> (2+? bytes) CtExtensions extensions; >>> ...with... >>> (2 bits) sct_version (00=v1; 01=v2; 10,11=unassigned) >>> (2 bits) log_id_type (00=SHA-256(log_public_key); >>> 01=1-byte Registered Log ID; >>> 10=2-byte Registered Log ID; >>> 11=4-byte Registered Log ID) >>> (2 bits) timestamp_size (00=8-bytes; >>> 01=6-bytes; >>> 10=5-bytes; >>> 11=4-bytes) >>> (1 bit) extensions (0=CtExtensions is present; >>> 1=CtExtensions is absent) >>> (1 bit) signature_type (0=digitally-signed struct; >>> 1=raw Ed25519 signature) >>> For the common case: >>> (1 byte) Registered Log ID >>> (4 bytes) Timestamp (seconds, not milliseconds) >>> >>> 4. Use the Ed25519 signature scheme instead of ECDSA. ECDSA signatures >>> using a P-256 key seem to be 72 or 73 bytes, whereas Ed25519 signatures are >>> 64 bytes. Save 8 or 9 bytes per SCT. >>> Also, for Ed25519, omit the 2 bytes containing the hash algorithm and >>> signature algorithm from the "digitally-signed struct" header. Save 2 bytes >>> per SCT. >>> >>> -- >>> Rob Stradling >>> Senior Research & Development Scientist >>> COMODO - Creating Trust Online >>> _______________________________________________ >>> Public mailing list >>> Public@cabforum.org >>> https://cabforum.org/mailman/listinfo/public >>> >>> -- >>> You received this message because you are subscribed to the Google Groups "certificate-transparency" group. >>> To unsubscribe from this group and stop receiving emails from it, send an email to certificate-transparency+unsubscribe@googlegroups.com. >>> For more options, visit https://groups.google.com/groups/opt_out. >> >> _______________________________________________ >> therightkey mailing list >> therightkey@ietf.org >> https://www.ietf.org/mailman/listinfo/therightkey From nobody Tue Feb 18 09:08:05 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A3E31A03F9 for ; Tue, 18 Feb 2014 09:08:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i-mCAPCUEU05 for ; Tue, 18 Feb 2014 09:07:57 -0800 (PST) Received: from che.mayfirst.org (che.mayfirst.org [209.234.253.108]) by ietfa.amsl.com (Postfix) with ESMTP id 7CE691A024F for ; Tue, 18 Feb 2014 09:07:57 -0800 (PST) Received: from [10.70.10.63] (unknown [38.109.115.130]) by che.mayfirst.org (Postfix) with ESMTPSA id 4B45AF984; Tue, 18 Feb 2014 12:07:53 -0500 (EST) Message-ID: <5303935D.4060206@fifthhorseman.net> Date: Tue, 18 Feb 2014 12:07:41 -0500 From: Daniel Kahn Gillmor User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Icedove/24.2.0 MIME-Version: 1.0 To: "therightkey@ietf.org" References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <52F2305C.5040107@comodo.com> <0b3f01cf228d$fef92e30$fceb8a90$@digicert.com> In-Reply-To: X-Enigmail-Version: 1.6 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="pO6pjnaMc1jw0rsh2OLkQLRcDg5wV7mhJ" Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/7DUWIs_pQljyyyf4f91mszIKzwA Cc: "certificate-transparency@googlegroups.com" , CABFPub Subject: Re: [therightkey] [cabfpub] Thoughts on reducing SCT sizes (was Re: Updated Certificate Transparency + Extended Validation plan) X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Feb 2014 17:08:03 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --pO6pjnaMc1jw0rsh2OLkQLRcDg5wV7mhJ Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 02/18/2014 11:58 AM, Ben Laurie wrote: > On 18 February 2014 15:37, Tim Moses wrote: >> Ben - Will Chrome deny EV status to a certificate with too few SCTs, = or will it grant EV status as long as at least one of its SCTs is from a = log that remains in the program? >=20 > It will deny. Doesn't this reintroduce the perverse incentive to avoid killing a known-misbehaving log? one of the nice things about requiring corroborative SCTs on new certs is that we can kill any log that is misbehaving without any pushback from certificate-holders concerned that their site will "go dark" (or "lose the fancy green label", in this EV case). If we make it so that the EV label goes away when either of the corroborators dies, then certificate holders have incentive to support a failed log, even though this goes against the best interests of their use= rs. --dkg --pO6pjnaMc1jw0rsh2OLkQLRcDg5wV7mhJ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Icedove - http://www.enigmail.net/ iQJ8BAEBCgBmBQJTA5NdXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRFQjk2OTEyODdBN0FEREUzNzU3RDkxMUVB NTI0MDFCMTFCRkRGQTVDAAoJEKUkAbEb/fpco9oP/0Zna0KMdsArG+IBaP2vL4eB +Xbr1tDj0rD5cElCnshSac6OB6KMmxyHmDthIDNiIvJJazAzmqIQMQtj3GFlLG5g RlxdiI17fICS9repL8/i1IR1aRbsn1MH9pDxqOukIjgrGlj8vB+viaE0rkWfBHjS 4j2zpd9fKSjAjS0qW4DyxRSjiNarDSPT88Z8dik2x5DvkYz0EWPrg+Tq8+9wGTKv zx5qo2gx02mJ4kNc7gIHnKJseyn4JY8sRQgGN7EynBpA6AA6gRNnZjZkIq1veZxk PDpRf6gJ2JyCwuvmuzuwmE1mKrWHlv4skKydtRYH67iyvlQsti06VItzIvoBv5aI ayQQ9TPdAdZInQo9ZGPDAJXgprwPUGhxztkOsn91GicNX74CUXQNKZnpjjwt+XoM tipxuUC5L+tGwemJxHZodcnse85a+dsN/w2YDM/UJu49fWZ2Q3UsWz7YTknCFxtM 5UOeJFw+AEuAcyKLCdo138qIBFoyJ5Jmxr/yQsRINaan5ul864V75UW4NEEg4040 a2U3xSRO6jqu0Ju3jjFQkWkWGLwMv1F7i5NAUp+MaDO14dbVUHzmBXmKvVdL2NtH eiDyqxPNCHqr+H5w3H68SD8t+mm1Oek1ntE7SHI3xVsaAs7nV38ragCyXym9HHTd 49f028wiD4FrhhyPR3a+ =6NDr -----END PGP SIGNATURE----- --pO6pjnaMc1jw0rsh2OLkQLRcDg5wV7mhJ-- From nobody Tue Feb 18 10:28:03 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 687281A0408 for ; Tue, 18 Feb 2014 10:28:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.927 X-Spam-Level: X-Spam-Status: No, score=-1.927 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ow4pEmTeFKOW for ; Tue, 18 Feb 2014 10:28:01 -0800 (PST) Received: from mail-ve0-x22c.google.com (mail-ve0-x22c.google.com [IPv6:2607:f8b0:400c:c01::22c]) by ietfa.amsl.com (Postfix) with ESMTP id 0BB5D1A03ED for ; Tue, 18 Feb 2014 10:28:00 -0800 (PST) Received: by mail-ve0-f172.google.com with SMTP id c14so14049880vea.3 for ; Tue, 18 Feb 2014 10:27:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=aRdAYj2kk41miUz/El1JNLfCpK9RzE8tg9i0toR69B0=; b=NvSpCkiOYtE8dJ79zCSiXjQJtiwHE1kUyuVWWx84qPIX4GmqJNRRVfG2guJmGpVoFi OMMHBlt96NTxC9fyGdTKk6mzv28FASCzGv9d7mlNOZzpQ1U9CS/QMvUWevK9eznD0Fwv 5SsZ9eyjB9vig/dWltGIh/v7n4TpVTY/CsfZO3NF8Grl1JRaUpxc0pFh6OlaTbik6xHf 7f1VdXeHw7ZSlbi+hPYMCg8wHGYg9uUGMwULZzbLFobZy5EIpief3LxKX5nVtF6IEyKD 0N0GHoYUKLJo7PxqlyQaorOvy1wJ2lKh7su946hhE/HwbnIosYo+0ukHR/4Hzm/ut9lb ujLg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=aRdAYj2kk41miUz/El1JNLfCpK9RzE8tg9i0toR69B0=; b=eOUqA+qcghcoAMJ8iYNCECWj03pyt6+0OsYE9jpHC/hHvfrxTpnXpbqHir+xC7XwrV 75veWgvtNsa3P0bZ+ZwEyANln5ZKIbfSD1y1iuUB5KBDoJrcROrIS6ei3jBYs57dC6zv xLOiGTxOB4BzEkw9mv1l6H1D4rZnpLhnEDiWC0vDp9Z1Bi0QtFSbSbXMnUXlQJ6gc7lI BWVsAiQFqhnOmwmyHeZupOdfTHFBUKsOAbGgiCo3og8c9lNN8ykwcXtZRGrEXN70PcKS +SMYWKpCM5pxwCdqb7UeT6c+IKeX3pILHJSsR49PqmXSTDByjOs88X4CmWGcJSEYSiIR e78g== X-Gm-Message-State: ALoCoQkcHnGsgQidjtoIS1kGfsZR7hinMaeaTg0w3IReUgy1XAn1q/oxRzY5UuGQUytMnXqDai5zMyxfu8piej7pGi/cU8PdASANwGcn9HG27WyAOqG3ttbs3hrGiJlb8jyhx4CC+KeTb04OAMWSlLMxuNNJXcG55WnyD7Msc5JKvq1hhLweb7MH4WGU9u/T22THbSOHoYkG MIME-Version: 1.0 X-Received: by 10.221.27.194 with SMTP id rr2mr110703vcb.60.1392748077589; Tue, 18 Feb 2014 10:27:57 -0800 (PST) Received: by 10.52.230.105 with HTTP; Tue, 18 Feb 2014 10:27:57 -0800 (PST) In-Reply-To: <5303935D.4060206@fifthhorseman.net> References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <52F2305C.5040107@comodo.com> <0b3f01cf228d$fef92e30$fceb8a90$@digicert.com> <5303935D.4060206@fifthhorseman.net> Date: Tue, 18 Feb 2014 18:27:57 +0000 Message-ID: From: Ben Laurie To: "certificate-transparency@googlegroups.com" Content-Type: text/plain; charset=UTF-8 Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/-Nm3W9cx1aBah6Pt92X49et01CU Cc: "therightkey@ietf.org" , CABFPub Subject: Re: [therightkey] [cabfpub] Thoughts on reducing SCT sizes (was Re: Updated Certificate Transparency + Extended Validation plan) X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Feb 2014 18:28:02 -0000 On 18 February 2014 17:07, Daniel Kahn Gillmor wrote: > On 02/18/2014 11:58 AM, Ben Laurie wrote: >> On 18 February 2014 15:37, Tim Moses wrote: >>> Ben - Will Chrome deny EV status to a certificate with too few SCTs, or will it grant EV status as long as at least one of its SCTs is from a log that remains in the program? >> >> It will deny. > > Doesn't this reintroduce the perverse incentive to avoid killing a > known-misbehaving log? > > one of the nice things about requiring corroborative SCTs on new certs > is that we can kill any log that is misbehaving without any pushback > from certificate-holders concerned that their site will "go dark" (or > "lose the fancy green label", in this EV case). > > If we make it so that the EV label goes away when either of the > corroborators dies, then certificate holders have incentive to support a > failed log, even though this goes against the best interests of their users. That's not the rule. The rule is you need one SCT from a live log, and N SCTs from logs that were valid at the time of issue. From nobody Tue Feb 18 10:40:42 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D95C11A0136 for ; Tue, 18 Feb 2014 10:40:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8z4OW3u9TXwI for ; Tue, 18 Feb 2014 10:40:38 -0800 (PST) Received: from che.mayfirst.org (che.mayfirst.org [209.234.253.108]) by ietfa.amsl.com (Postfix) with ESMTP id D3C3A1A0150 for ; Tue, 18 Feb 2014 10:40:38 -0800 (PST) Received: from [10.70.10.63] (unknown [38.109.115.130]) by che.mayfirst.org (Postfix) with ESMTPSA id 4D608F984; Tue, 18 Feb 2014 13:40:34 -0500 (EST) Message-ID: <5303A920.2020406@fifthhorseman.net> Date: Tue, 18 Feb 2014 13:40:32 -0500 From: Daniel Kahn Gillmor User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Icedove/24.2.0 MIME-Version: 1.0 To: "certificate-transparency@googlegroups.com" References: <04a001cf21cf$3a649190$af2db4b0$@digicert.com> <52F2305C.5040107@comodo.com> <0b3f01cf228d$fef92e30$fceb8a90$@digicert.com> <5303935D.4060206@fifthhorseman.net> In-Reply-To: X-Enigmail-Version: 1.6 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="XXR6i8CxIrxbCwJ7RFdpDRm2TDfEe59gg" Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/akuHAQNbJ2CxFg7ySWnhFpFB3LQ Cc: "therightkey@ietf.org" , CABFPub Subject: Re: [therightkey] [cabfpub] Thoughts on reducing SCT sizes (was Re: Updated Certificate Transparency + Extended Validation plan) X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Feb 2014 18:40:41 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --XXR6i8CxIrxbCwJ7RFdpDRm2TDfEe59gg Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 02/18/2014 01:27 PM, Ben Laurie wrote: > On 18 February 2014 17:07, Daniel Kahn Gillmor = wrote: >> Doesn't this reintroduce the perverse incentive to avoid killing a >> known-misbehaving log? [...] > That's not the rule. The rule is you need one SCT from a live log, and > N SCTs from logs that were valid at the time of issue Thanks. That makes sense, and resolves my concern. --dkg --XXR6i8CxIrxbCwJ7RFdpDRm2TDfEe59gg Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Icedove - http://www.enigmail.net/ iQJ8BAEBCgBmBQJTA6kgXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRFQjk2OTEyODdBN0FEREUzNzU3RDkxMUVB NTI0MDFCMTFCRkRGQTVDAAoJEKUkAbEb/fpcpEkQAKVCPvnZtTqLNuqZau9Zglpu Io8WyhiZHcuqjmPiHofDZcHpmqR1qUGdeOwFVIWcKlU9XEoV72WajC02N9WiDlw0 4E5f0E/Nm5ddU9sHGcU7CzLu8D0gidhZNsa3nTzdH46m2c/9ypozg7/a6k9LwnQV 9Inxmc8yB9eagMOa1hXDYiHtd6vmDLYlALwQEyClvYUrvCwcvSoQaGQWeIfsDXp0 DGtWQGYDZhjsFuBG8LBvrvSxg1JOUi8mIG1vKnDD+sry7owq5hFj1hv0WAJ8bhjs L6TTIYkfDuA1v4/yKhj5O+onZMllaVmXl8T5vi75pyEEkSXxxObXBNVPsD/6xGVg xWj8oxE24V6V+NJ3cMsXG+/72bkDSpehhikDBfC0qwQ0oItqkViUKT0RR0e0Vuqj bWAQmx41XAl43TgGu6oMwZ7nd7wd+Nvnyps8i/KaKrwgo9qZY+p6OSqapyGbKhMw m0Ve/jDFP/IT0c9yl34O/BMZT2TJmnLPpFXYkaiFTVJoRh9IBBhhL8rjXGYby+An nuxoeH4BmDletB9B0wDFdIApuoDKsNkvXocI2Qc2DfPhpqPP19JDHIXDmNZsZkMp OAYvma1KiIogKufKMBLJ5OM3Z7TxcC2wfRHNZ8NZul1LLB9wZORulgBnr7d0/h9d eR8gGaqNSU6s1b8WZFpH =dv0a -----END PGP SIGNATURE----- --XXR6i8CxIrxbCwJ7RFdpDRm2TDfEe59gg-- From nobody Tue Feb 18 11:10:46 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA8151A0250; Tue, 18 Feb 2014 11:10:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aXw_hTR_d1XL; Tue, 18 Feb 2014 11:10:39 -0800 (PST) Received: from mail-pd0-x22d.google.com (mail-pd0-x22d.google.com [IPv6:2607:f8b0:400e:c02::22d]) by ietfa.amsl.com (Postfix) with ESMTP id B00671A0135; Tue, 18 Feb 2014 11:10:36 -0800 (PST) Received: by mail-pd0-f173.google.com with SMTP id y10so16626158pdj.32 for ; Tue, 18 Feb 2014 11:10:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:cc:subject :content-type:content-transfer-encoding; bh=yx+ghlE1qDt0batCGXD0CY5FvadW8BiX3+bOiGuYz6s=; b=0tBUcdNHQzWG44c0HNp9aKPd+YEY3wlwgcgxy6Gz4PqG6Pafas+N0E+lE9BprxK/xX 6ZomrtV41FjPBfi+cUzQFM9wUZPLOpl2DODPGI3naMS2UVG4ZNGkJinoTTvGL+UXT45K kdaJHlLpX/oJRqclAglfP2Xn1kYQ5xsi2ZK47fwoWs5PwXbDSyeACvnWDgeILqUJFslG JwD+tRyuchiGWOlOxIpGI5IqVBCpaOmK1yP4pJDhHenHg9VQwHugtL9ReQvuYohRbXP3 VWeC4VRFohpJD3CyUeYxfwBJOse1l/oLFm2F+X2nhA1Mu/qz1rkjihRDGVwCa8wi5Zcn ZfnQ== X-Received: by 10.68.200.74 with SMTP id jq10mr5445103pbc.169.1392750633871; Tue, 18 Feb 2014 11:10:33 -0800 (PST) Received: from spandex.local (63-140-93-251.dynamic.dsl.acsalaska.net. [63.140.93.251]) by mx.google.com with ESMTPSA id jk16sm58443894pbb.34.2014.02.18.11.10.32 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 18 Feb 2014 11:10:33 -0800 (PST) Message-ID: <5303B027.30005@gmail.com> Date: Tue, 18 Feb 2014 10:10:31 -0900 From: Melinda Shore User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130620 Thunderbird/17.0.7 MIME-Version: 1.0 To: trans@ietf.org Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/18QMyRQIO2IYsWAi64KdQ9QsG3E Cc: "therightkey@ietf.org" Subject: [therightkey] New mailing list X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Feb 2014 19:10:42 -0000 You've probably noticed that the new trans mailing list has been created. I asked that the subscribers from therightkey@ietf.org be added to the trans mailing list[*] BUT that therightkey mailing list continue to be open. Discussions specific to progressing working group deliverables (and potential working group items) belong on trans; discussions of other responses to PKI problems or of more general interest still belong on therightkey. Thanks, Melinda * If you'd like to unsubscribe from trans, go here: https://www.ietf.org/mailman/listinfo/trans From nobody Tue Feb 18 12:56:00 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C76E1A0221 for ; Tue, 18 Feb 2014 12:56:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.448 X-Spam-Level: X-Spam-Status: No, score=-2.448 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.548] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JdaAQCCbMfdG for ; Tue, 18 Feb 2014 12:55:55 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) by ietfa.amsl.com (Postfix) with ESMTP id BEBAC1A0214 for ; Tue, 18 Feb 2014 12:55:55 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id AC6CABE5B; Tue, 18 Feb 2014 20:55:51 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v4ptEhR9DD+n; Tue, 18 Feb 2014 20:55:50 +0000 (GMT) Received: from [10.87.48.12] (unknown [86.45.62.20]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 57235BE50; Tue, 18 Feb 2014 20:55:50 +0000 (GMT) Message-ID: <5303C8D6.9000101@cs.tcd.ie> Date: Tue, 18 Feb 2014 20:55:50 +0000 From: Stephen Farrell User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0 MIME-Version: 1.0 To: Melinda Shore References: <5303B027.30005@gmail.com> In-Reply-To: <5303B027.30005@gmail.com> X-Enigmail-Version: 1.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/2o7NakAkJUnknipwd-4Kuu-ZTMI Cc: "therightkey@ietf.org" Subject: Re: [therightkey] New mailing list X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Feb 2014 20:56:00 -0000 Thanks Melinda, (Trimmed this one to therightkey, as is now proper:-) On 02/18/2014 07:10 PM, Melinda Shore wrote: > You've probably noticed that the new trans mailing list has > been created. I asked that the subscribers from therightkey@ietf.org > be added to the trans mailing list[*] BUT that therightkey mailing > list continue to be open. Discussions specific to progressing > working group deliverables (and potential working group items) > belong on trans; discussions of other responses to PKI problems > or of more general interest still belong on therightkey. And just so folks are clear: we're still very interested in discussion of other substantive improvements to key management for the Internet, so please do continue to use this list for such. Hopefully, we'll see some more worthwhile ideas mature as CT has. Cheers, S. > > Thanks, > > Melinda > > * If you'd like to unsubscribe from trans, go here: > https://www.ietf.org/mailman/listinfo/trans > > _______________________________________________ > therightkey mailing list > therightkey@ietf.org > https://www.ietf.org/mailman/listinfo/therightkey > From nobody Wed Feb 19 11:25:22 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4DDAB1A04FF for ; Wed, 19 Feb 2014 11:25:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.927 X-Spam-Level: X-Spam-Status: No, score=-1.927 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.548, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rNnlmprxfc8S for ; Wed, 19 Feb 2014 11:25:18 -0800 (PST) Received: from mail-ve0-x22e.google.com (mail-ve0-x22e.google.com [IPv6:2607:f8b0:400c:c01::22e]) by ietfa.amsl.com (Postfix) with ESMTP id 609CB1A01F0 for ; Wed, 19 Feb 2014 11:25:18 -0800 (PST) Received: by mail-ve0-f174.google.com with SMTP id pa12so874583veb.19 for ; Wed, 19 Feb 2014 11:25:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=lXWP1EJS7k5GrcW5m4MNPHmWOxQxxxplOfuskg7jfds=; b=NiiJaM++CCTugFfN1P3YkJIy17DKQYp0ldzrcGJFIUIXZdAkhUA+WaYpfTqxbYuVYk EhBDtdN3TR1u3nPVlpfGCUWf7qo2dwfB08F/lMK9W29DT2+GDJ7JUfWIew+m8Z82N71Q uX5PIaOtaxpX6pBgn1NdMmgOxNUf/XzEX/A0iGiN7bX8rglErei3OF3RxemXvCY7RSFc 6bXm26xHf/L/79JGxIDM2ECeqYDKPtKhnWhtqGArtYnDY8Gk3kAIkBs6lZpZxx6MYnkq CXGLKPwKyiy7luftXnmeh3MgjNjVAi3ykbff4x/SlgqXyKy2ZUHtvMUPVVg/PpFyq3XV WMkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=lXWP1EJS7k5GrcW5m4MNPHmWOxQxxxplOfuskg7jfds=; b=FM3QXTo70ShD0aeA+tCxLdhePb56RFzDUwNOJuo+DJNPOCsk+URf2F+8jw/P4gYSFR hvNWayFKjEp1XaEK5r6IFLpReu9YCAmOO8SZ5qgPCG6Kl1ctCY++Y4AStd70fH1z0oMu H55h4HFoCzLMYET7GCYYbYqmz1K1oqXFceOuJrJKLaoUFISr6WujJqHYiAbEYS/vZ//2 iRSUbvOqKvSha+bFvXHVnDfY7I9qn0T+2bKDCUYEqxvmBctcA7g2QbiMp4DAV2U1phF8 DOBMMWT68l0F4mCPherKJYuwYFORDzBSAOdfdAuddkOWIUWv0fYZSCkOeWVGOGY6hM1H teCg== X-Gm-Message-State: ALoCoQkp5o0Qo7gmpvH6r+eVnu/j4xmxws8BjnRFNbIb8let6Rdw0gh5/wtCY/6ThFn38Fhb+RvgkSoVDdr0RRVkPn+vY04Q7XgUqsCIlRkAqsG9TceiLJihAN1zcB/XQYbzkKOkdo1Gi2cVNi7uqiA14459Iuq+U9RxcGwdb7ZQG7VD0z6Hpf3Qqt1HcCNhhqDOpjVfOM2Y MIME-Version: 1.0 X-Received: by 10.220.252.134 with SMTP id mw6mr1558984vcb.51.1392837914881; Wed, 19 Feb 2014 11:25:14 -0800 (PST) Received: by 10.52.230.105 with HTTP; Wed, 19 Feb 2014 11:25:14 -0800 (PST) In-Reply-To: <53025C8F.5020803@gmail.com> References: <53025C8F.5020803@gmail.com> Date: Wed, 19 Feb 2014 19:25:14 +0000 Message-ID: From: Ben Laurie To: Melinda Shore Content-Type: text/plain; charset=UTF-8 Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/FQOFwizGMPqSd06eNrpYGYh8OdM Cc: "therightkey@ietf.org" Subject: Re: [therightkey] Ramping up X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Feb 2014 19:25:20 -0000 On 17 February 2014 19:01, Melinda Shore wrote: > 1) I've asked Ben and his co-authors to resubmit > draft-laurie-rfc6962-bis as draft-ietf-trans-rfc6962-bis Now done: https://datatracker.ietf.org/doc/draft-ietf-trans-rfc6962-bis/. From nobody Thu Feb 20 12:42:26 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD5AA1A02CF for ; Thu, 20 Feb 2014 12:42:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.11 X-Spam-Level: X-Spam-Status: No, score=0.11 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, HELO_MISMATCH_NET=0.611, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JqLRdUB_skVh for ; Thu, 20 Feb 2014 12:42:21 -0800 (PST) Received: from ian.brad.office.comodo.net (eth5.brad-fw.brad.office.ccanet.co.uk [178.255.87.226]) by ietfa.amsl.com (Postfix) with ESMTP id 4D41C1A02F0 for ; Thu, 20 Feb 2014 12:42:20 -0800 (PST) Received: (qmail 1402 invoked by uid 1000); 20 Feb 2014 20:42:15 -0000 Received: from nigel.brad.office.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Thu, 20 Feb 2014 20:42:15 +0000 Message-ID: <530668A7.8070308@comodo.com> Date: Thu, 20 Feb 2014 20:42:15 +0000 From: Rob Stradling User-Agent: Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20100101 Thunderbird/24.3.0 MIME-Version: 1.0 To: Melinda Shore , "trans@ietf.org" References: <53025C8F.5020803@gmail.com> In-Reply-To: <53025C8F.5020803@gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/LglsbwBap-2Kz8R2T3Q-I-M-hIA Subject: Re: [therightkey] Ramping up X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Feb 2014 20:42:25 -0000 On 17/02/14 19:01, Melinda Shore wrote: > 5) the corollary to 4 is that I do try to get as much done on > the mailing list as possible. One thing that's been useful > in some circumstances in the past has been an issue tracker. > We do have a working group wiki page with an issue tracker, > and I'd like to get a sense of whether the working group in > general and the authors more specifically would find it > helpful in progressing the document. Hi Melinda. Thanks for taking on the WG chair role. :-) Given the close relationship between RFC6962(-bis) and the open-source CT project, we've so far been logging issues for RFC6962-bis on the issue tracker at https://code.google.com/p/certificate-transparency/issues/list I don't suppose it really matters which issue tracker we use. Using an issue tracker will definitely be "helpful in progressing the document" though, IMHO. -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From nobody Thu Feb 20 13:09:35 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B6B71A0290 for ; Thu, 20 Feb 2014 13:09:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tyIk8SJjveR9 for ; Thu, 20 Feb 2014 13:09:31 -0800 (PST) Received: from mail-pb0-x232.google.com (mail-pb0-x232.google.com [IPv6:2607:f8b0:400e:c01::232]) by ietfa.amsl.com (Postfix) with ESMTP id 019E71A02E1 for ; Thu, 20 Feb 2014 13:09:29 -0800 (PST) Received: by mail-pb0-f50.google.com with SMTP id rq2so2458899pbb.37 for ; Thu, 20 Feb 2014 13:09:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=VEcJ6BifFm4I0cDiUiZWkjAlaBh0rF8RYxpYp+VTBm4=; b=gC1joSkqHpt65KXr/7idieN2t/P+5m5CcvsM0D8kaFPuwLXuxBcSvY0u2DpKx+6RUY E83E/DapWDPm+NJgPCAqcA+nypQ4CyZm7djpvb8Bswb57Rn0Qv1rWhOlPNEjEl3RbPKe 0ESTlIMxdMZIupSW7areG+ItWSadmc8YRy8B8ZIlHyfGyJsuEE5j0zJBSnrgBC+4RUog LSmnhL5pH+7IDVnO6zQJ4rUKTYI2Bsj+wYfrbzeTMRZYHzM74FOx2DehRAhgPvevm1ZA DtXUCIvh8NsMgMP5f+gedO5SkLgiXTYSZsStcToA0iipRCfQAdSJyWvrSP0BWjME6VEe /ftw== X-Received: by 10.69.20.11 with SMTP id gy11mr4667124pbd.64.1392930566437; Thu, 20 Feb 2014 13:09:26 -0800 (PST) Received: from spandex.local (216-67-47-153-rb1.fai.dsl.dynamic.acsalaska.net. [216.67.47.153]) by mx.google.com with ESMTPSA id ja8sm14347579pbd.3.2014.02.20.13.09.23 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 20 Feb 2014 13:09:24 -0800 (PST) Message-ID: <53066F02.7060603@gmail.com> Date: Thu, 20 Feb 2014 12:09:22 -0900 From: Melinda Shore User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130620 Thunderbird/17.0.7 MIME-Version: 1.0 To: Rob Stradling References: <53025C8F.5020803@gmail.com> <530668A7.8070308@comodo.com> In-Reply-To: <530668A7.8070308@comodo.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/tp6l2IqvsM9ahVQOzH5rC0QtCgU Cc: "trans@ietf.org" Subject: Re: [therightkey] Ramping up X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Feb 2014 21:09:33 -0000 On 2/20/14 11:42 AM, Rob Stradling wrote: > Given the close relationship between RFC6962(-bis) and the open-source > CT project, we've so far been logging issues for RFC6962-bis on the > issue tracker at > https://code.google.com/p/certificate-transparency/issues/list > > I don't suppose it really matters which issue tracker we use. Using an > issue tracker will definitely be "helpful in progressing the document" > though, IMHO. Thanks, that's really helpful. We ran into a parallel situation in scim and ended up transitioning the issues that were specific to the spec to the IETF issue tracker and keeping ones specific to the implementation (and granted, that line isn't always clear) in the Google code issue tracker. There are two main questions when using an existing tracker (well, maybe 2.5): 1) making sure that what goes into the tracker reflects working group issues with the spec (and that when an issue is closed it's because it reflects working group consensus), and 2) making sure that people who are involved with the spec but not with the implementation can add/comment/close working group issues 2.5) making sure that working group participants cannot scribble all over implementation issues Melinda From nobody Mon Feb 24 08:26:24 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E737A1A00D9 for ; Mon, 24 Feb 2014 08:26:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.775 X-Spam-Level: X-Spam-Status: No, score=0.775 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.547, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wcgmKCTIBi_K for ; Mon, 24 Feb 2014 08:26:19 -0800 (PST) Received: from mail-ob0-x22e.google.com (mail-ob0-x22e.google.com [IPv6:2607:f8b0:4003:c01::22e]) by ietfa.amsl.com (Postfix) with ESMTP id B9BAC1A00B8 for ; Mon, 24 Feb 2014 08:26:19 -0800 (PST) Received: by mail-ob0-f174.google.com with SMTP id uy5so7519683obc.33 for ; Mon, 24 Feb 2014 08:26:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=OcTByA8CUOYSl/rmfscdvEWyqNyFM2xWozvA8N4uJxs=; b=YIQCyQhZ20Xp++bGtXWNI4e0lKzpM/yMQ9SbLqlHWeqOtq6pS333Kcani5a+XE0bK+ OXd+JQ6gORqetR+Mdqx4NiDO0628CVgAuAEvMnrsEaLrX1JSMXSgLXWALpAmr3FKDYZT Pzy+nehlTS3BMPjoI8j8r+VSnfjirwS8ZigHrPCrZmhu7pHGyC0kDoEbBz8qM4/XyWCz Ocg2cqsnHyUoqiA/016H4NDsqYHzWgh9oNF5n5Xu2ma8wV4PM1zmth3YnPHUowhkv5/4 Y8z31ooCFnju6GTwJ43qgC/U7YQpWkWGdJfwTCHCpMKT8QP7nJ53osKb80+oOCievSXq 8bJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=OcTByA8CUOYSl/rmfscdvEWyqNyFM2xWozvA8N4uJxs=; b=cNMWJOMcbh5fzXmHX/dvO3WATujanDa458hsaoyF7Z35cm9iDDyuzeOZGnvMOTRd64 sFGQCZWELpYjNxp+6OrtGM33JHiWu/94aIwvL6UdgO1Ti7S3Sp7okNdiCc/GWKJ/EWaz jrAyViXw8Y77aInAr6a7tPcnmMUWcVZip1sJoJa9tPuBHISNQoZ3Pibc54ZsnNEDXKKb XJ7wvB1YuVeqsmkDFA0ifHvCxXUHutxCBBObSiJD03zoj61Z0v7h3QzqTUtSeJV2JDnh A/mbNGQZ5hzE1CXp+yR3PEJ+li294B9UC2yRK33XwOPlDknjHYMPwgmHDty409m7JqZG k0NQ== X-Gm-Message-State: ALoCoQn8w3SmaybqEaxgYT5c4fth57fNSklH9CSR8EpOeZ8VOFycVJ/MJAQcrlyqRJ4bHqLsLntw/o872wPupjt7Ra4QF2V4u8g1C0WmTyM8cJq8XX6HFec4H0y1RqV4Nz/n2j+aAvzeP3XCsdqBGBNjKtiQHRT/qU+BoUcca5Gwuq5TWzTbmP93GL0j2uNhUzkY3YKjDm4P MIME-Version: 1.0 X-Received: by 10.182.158.71 with SMTP id ws7mr18303717obb.6.1393259178968; Mon, 24 Feb 2014 08:26:18 -0800 (PST) Received: by 10.182.142.198 with HTTP; Mon, 24 Feb 2014 08:26:18 -0800 (PST) In-Reply-To: <53066F02.7060603@gmail.com> References: <53025C8F.5020803@gmail.com> <530668A7.8070308@comodo.com> <53066F02.7060603@gmail.com> Date: Mon, 24 Feb 2014 16:26:18 +0000 Message-ID: From: Eran Messeri To: Melinda Shore Content-Type: multipart/alternative; boundary=089e01494a167159ed04f3296ec1 Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/KJmfq1fXQ-eKxrKlQ7mmrYjhhxA Cc: "trans@ietf.org" , Rob Stradling Subject: Re: [therightkey] Ramping up X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Feb 2014 16:26:22 -0000 --089e01494a167159ed04f3296ec1 Content-Type: text/plain; charset=UTF-8 There are ~8 issues in the open-source CT issue tracker that pertain to RFC6962-bis. I'll happily migrate them to another issue tracker if that's the consensus. Eran On Thu, Feb 20, 2014 at 9:09 PM, Melinda Shore wrote: > On 2/20/14 11:42 AM, Rob Stradling wrote: > > Given the close relationship between RFC6962(-bis) and the open-source > > CT project, we've so far been logging issues for RFC6962-bis on the > > issue tracker at > > https://code.google.com/p/certificate-transparency/issues/list > > > > I don't suppose it really matters which issue tracker we use. Using an > > issue tracker will definitely be "helpful in progressing the document" > > though, IMHO. > > Thanks, that's really helpful. We ran into a parallel situation > in scim and ended up transitioning the issues that were specific > to the spec to the IETF issue tracker and keeping ones specific > to the implementation (and granted, that line isn't always > clear) in the Google code issue tracker. > > There are two main questions when using an existing tracker (well, > maybe 2.5): > > 1) making sure that what goes into the tracker reflects working > group issues with the spec (and that when an issue is closed > it's because it reflects working group consensus), and > 2) making sure that people who are involved with the spec but > not with the implementation can add/comment/close working > group issues > 2.5) making sure that working group participants cannot scribble > all over implementation issues > > Melinda > > _______________________________________________ > therightkey mailing list > therightkey@ietf.org > https://www.ietf.org/mailman/listinfo/therightkey > --089e01494a167159ed04f3296ec1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
There are ~8 issues in the open-source CT issue tracker th= at pertain to RFC6962-bis. I'll happily migrate them to another issue t= racker if that's the consensus.=C2=A0

Eran


On Thu, Feb 20, 2014 at 9:09 PM, Melinda= Shore <melinda.shore@gmail.com> wrote:
On 2/20/14 11:42 AM, Rob Stradling wrote:
> Given the close relationship between RFC6962(-bis) and the open-source=
> CT project, we've so far been logging issues for RFC6962-bis on th= e
> issue tracker at
> https://code.google.com/p/certificate-transparency/i= ssues/list
>
> I don't suppose it really matters which issue tracker we use. =C2= =A0Using an
> issue tracker will definitely be "helpful in progressing the docu= ment"
> though, IMHO.

Thanks, that's really helpful. =C2=A0We ran into a parallel situa= tion
in scim and ended up transitioning the issues that were specific
to the spec to the IETF issue tracker and keeping ones specific
to the implementation (and granted, that line isn't always
clear) in the Google code issue tracker.

There are two main questions when using an existing tracker (well,
maybe 2.5):

1) making sure that what goes into the tracker reflects working
=C2=A0 =C2=A0group issues with the spec (and that when an issue is closed =C2=A0 =C2=A0it's because it reflects working group consensus), and
2) making sure that people who are involved with the spec but
=C2=A0 =C2=A0not with the implementation can add/comment/close working
=C2=A0 =C2=A0group issues
2.5) making sure that working group participants cannot scribble
=C2=A0 =C2=A0all over implementation issues

Melinda

_______________________________________________
therightkey mailing list
therightkey@ietf.org
https://www.ietf.org/mailman/listinfo/therightkey

--089e01494a167159ed04f3296ec1-- From nobody Mon Feb 24 09:57:23 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 196071A02A7 for ; Mon, 24 Feb 2014 09:57:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v4B43jgTXqXR for ; Mon, 24 Feb 2014 09:57:20 -0800 (PST) Received: from mail-pb0-x22f.google.com (mail-pb0-x22f.google.com [IPv6:2607:f8b0:400e:c01::22f]) by ietfa.amsl.com (Postfix) with ESMTP id 9AA191A02A4 for ; Mon, 24 Feb 2014 09:57:20 -0800 (PST) Received: by mail-pb0-f47.google.com with SMTP id up15so361374pbc.20 for ; Mon, 24 Feb 2014 09:57:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=UBIbOFYb9RHoRebb7BTSp7FYWGzcQJEBGnzb4oAlDWc=; b=CzCuq3oqswZPKYmzGSccjBh4/cOEenMOU8kTDxCfpFi9P2CXr655018P7NIxSj7LdM wA0dY07Di77JOAb7bb1DBqNvFrTr4Nl+uF2Qkgvo8C6IJTFVlNXnGlKY5nzxqn9eXmvl 1W8gOk46U5SNpHqDiiDwAcvQJPmF+Jmn3NQRZ2aKp2DiKTsK6J5wp+acNeXl8SwlY5WN 8dwiCr2yRn0/ODiZIZOWJOXaoe3oJMz03JCc2jVFn1wNrXuZ7lvUFfQ7k3JuSp+FJYbc p7JaCq3acHZsX+QwhByBn2G9GCia/T1PUReKQVv9knqPZq748DvvXDPPCDAem2xT4/vz sGpQ== X-Received: by 10.66.142.132 with SMTP id rw4mr27187224pab.6.1393264640213; Mon, 24 Feb 2014 09:57:20 -0800 (PST) Received: from spandex.local (63-140-68-38-rb2.sol.dsl.dynamic.acsalaska.net. [63.140.68.38]) by mx.google.com with ESMTPSA id ix2sm2049448pbc.45.2014.02.24.09.57.18 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 24 Feb 2014 09:57:19 -0800 (PST) Message-ID: <530B87FD.7010803@gmail.com> Date: Mon, 24 Feb 2014 08:57:17 -0900 From: Melinda Shore User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130620 Thunderbird/17.0.7 MIME-Version: 1.0 To: Eran Messeri References: <53025C8F.5020803@gmail.com> <530668A7.8070308@comodo.com> <53066F02.7060603@gmail.com> In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/32Uk933m0v2fzHihli31wwMsOAg Cc: "trans@ietf.org" , Rob Stradling Subject: Re: [therightkey] Ramping up X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Feb 2014 17:57:22 -0000 On 2/24/14 7:26 AM, Eran Messeri wrote: > There are ~8 issues in the open-source CT issue tracker that pertain to > RFC6962-bis. I'll happily migrate them to another issue tracker if > that's the consensus. I'm personally good with that, if there are no objections. The issues tracker is associated with a Trac wiki, at http://trac.tools.ietf.org/wg/trans/trac/wiki. You'll need a tools account. If you don't already have one you can request one here: http://trac.tools.ietf.org/tools/loginmgr/newlogin Thanks again! Melinda From nobody Mon Feb 24 18:01:15 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD09A1A0398; Mon, 24 Feb 2014 18:01:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.602 X-Spam-Level: X-Spam-Status: No, score=-2.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mu2dKxOkSdYE; Mon, 24 Feb 2014 18:01:12 -0800 (PST) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0157.outbound.protection.outlook.com [207.46.163.157]) by ietfa.amsl.com (Postfix) with ESMTP id 0F5BB1A0221; Mon, 24 Feb 2014 18:01:11 -0800 (PST) Received: from BL2PR03MB467.namprd03.prod.outlook.com (10.141.92.23) by BL2PR03MB418.namprd03.prod.outlook.com (10.141.92.13) with Microsoft SMTP Server (TLS) id 15.0.883.10; Tue, 25 Feb 2014 02:01:09 +0000 Received: from BL2PR03MB467.namprd03.prod.outlook.com ([10.141.92.23]) by BL2PR03MB467.namprd03.prod.outlook.com ([10.141.92.23]) with mapi id 15.00.0883.010; Tue, 25 Feb 2014 02:01:09 +0000 From: Anoosh Saboori To: Melinda Shore , "trans@ietf.org" Thread-Topic: Dealing with fraudulent certificates via certificate reputation Thread-Index: Ac8xzK0o1YcgswOlSnSDIRHhJZhbwQ== Date: Tue, 25 Feb 2014 02:01:09 +0000 Message-ID: <873b20cac6834d9cb347dee1e131dad2@BL2PR03MB467.namprd03.prod.outlook.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [71.227.155.230] x-forefront-prvs: 01334458E5 x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(6009001)(199002)(189002)(81686001)(81816001)(33646001)(15975445006)(85852003)(56776001)(85306002)(83072002)(80976001)(4396001)(94316002)(83322001)(19580395003)(74876001)(74502001)(74662001)(31966008)(87936001)(2656002)(65816001)(66066001)(87266001)(56816005)(90146001)(80022001)(92566001)(47446002)(49866001)(94946001)(69226001)(81542001)(47976001)(47736001)(74316001)(63696002)(76786001)(76576001)(59766001)(77982001)(86362001)(76176001)(76796001)(74366001)(15202345003)(74706001)(50986001)(53806001)(54356001)(86612001)(93516002)(93136001)(81342001)(79102001)(51856001)(54316002)(76482001)(95416001)(46102001)(24736002); DIR:OUT; SFP:1101; SCL:1; SRVR:BL2PR03MB418; H:BL2PR03MB467.namprd03.prod.outlook.com; CLIP:71.227.155.230; FPR:7272C748.9AB064C6.43DB0D43.D85A3729.2012E; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/Qd13PBes6o3Rb3E9GXiS_Z4yR7w Cc: Magnus Nystrom , Anthony Nadalin , "therightkey@ietf.org" , Nelly Porter Subject: [therightkey] Dealing with fraudulent certificates via certificate reputation X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Feb 2014 02:01:13 -0000 Hello, We would like to introduce certificate reputation, which was shipped as par= t of IE 11. This feature aims to address some of the issues with Web PKI t= hat were raised by Diginotar and Comodo incidents. We asked to take few min= utes on the trans WG meeting in the next IETF meeting to present this featu= re and chairs requested us to start a thread on this in WG mailing list. Pl= ease see below for description of this feature. http://blogs.technet.com/b/pki/archive/2014/02/22/a-novel-method-in-ie11-fo= r-dealing-with-fraudulent-digital-certificates.aspx=20 Thank you, Anoosh From nobody Wed Feb 26 05:35:02 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A47941A02AC for ; Wed, 26 Feb 2014 05:34:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.926 X-Spam-Level: X-Spam-Status: No, score=-1.926 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, RP_MATCHES_RCVD=-0.547, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wdft2AsJpHFU for ; Wed, 26 Feb 2014 05:34:51 -0800 (PST) Received: from mail-ve0-x22a.google.com (mail-ve0-x22a.google.com [IPv6:2607:f8b0:400c:c01::22a]) by ietfa.amsl.com (Postfix) with ESMTP id 385C81A033F for ; Wed, 26 Feb 2014 05:34:43 -0800 (PST) Received: by mail-ve0-f170.google.com with SMTP id pa12so570821veb.1 for ; Wed, 26 Feb 2014 05:34:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=G0LzLqA8VN9xqw4udALs2KPkuNV4spPuvtvkKKYUV/o=; b=ZT8IrywndJDQp5IQPlMOZz2FA0ldZp0SODX3xJztUKHimFeYjyR90eJNOJbbYTkrl/ bMYuQe+K/XIWFfMglRyaVEa5T0oyBLJr9fUuvroDsTzjmQ8P2lI22uCPJmdykpnPqVZ5 pbxITUQEEaHK5jWzCdqKxTt7J4KRz1h25LulHLGuBihnmXcFvnbcYp2iUTVLVX9EUDPJ j6p9jY7Ucnvfiem6FE7Bq+BtLQrb0Qje+6ljacLjioj+tuwwSEVwMMZO7u5xVlxb+fa2 nRh+bOic/Ge8NAlPRumMJNnXSRqYsM1BKJzgqWkATo1I7AszC02DVMg5dwH96PKFKx7Q qJqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=G0LzLqA8VN9xqw4udALs2KPkuNV4spPuvtvkKKYUV/o=; b=TVhy1Zb4gCO2ebLz8zbkMBufo3dLqxSgOwCw8irFroeK2fJk28AgmoWvIF2P3o7qfg M6et4gSZHOVXDe+6xzaNJgbkJ1PQibPdtX74GUWDNtudywlzgYH3GQgn9PCtD3UXwMnj I/JOGG5kemmXE+td/hzIDC7mlXprzsAUSPUEZld6oAKmX6zPUzJSzxpVnLgVe8A7ZaGR ZdsaZFehUS1BBUA+lA0uhCcOW51H59az1l1yw5SWMVbNgNsHeirsufaaY4uA8NhcsdMs uDFJEtZHb+JNYRcowq+Oln4iUbfMF/gsDIxXrldV6n2GJNFfT29n9SOfPQnoi9SuP806 +XxQ== X-Gm-Message-State: ALoCoQnr0VIDSKTIvNo2dlDPjSkYy7gJCCqzgr6pWIHlh+xfaYq+IT11ijvoBo3k9fGP7ct97TSe7b+pvqQWC2nbA3/NJwtHUe3CVnoNuMFal7h7e0/S6u2yn61wig4cg4NFEpNEW00u7xpomaNZ3/EL8oV0QMuZA2rtJhPSPk8wEpXb2sY44kQcVP94uz0UaaH3+t7c2VzO MIME-Version: 1.0 X-Received: by 10.52.155.66 with SMTP id vu2mr55310vdb.50.1393421681836; Wed, 26 Feb 2014 05:34:41 -0800 (PST) Received: by 10.52.230.105 with HTTP; Wed, 26 Feb 2014 05:34:41 -0800 (PST) In-Reply-To: <873b20cac6834d9cb347dee1e131dad2@BL2PR03MB467.namprd03.prod.outlook.com> References: <873b20cac6834d9cb347dee1e131dad2@BL2PR03MB467.namprd03.prod.outlook.com> Date: Wed, 26 Feb 2014 13:34:41 +0000 Message-ID: From: Ben Laurie To: Anoosh Saboori Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/FfA9X_eI3q3TGwSoyt_eYDsQc3E Cc: Anthony Nadalin , "therightkey@ietf.org" , "trans@ietf.org" , Melinda Shore , Nelly Porter , Magnus Nystrom Subject: Re: [therightkey] Dealing with fraudulent certificates via certificate reputation X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Feb 2014 13:34:53 -0000 On 25 February 2014 02:01, Anoosh Saboori wrote: > Hello, > > We would like to introduce certificate reputation, which was shipped as p= art of IE 11. This feature aims to address some of the issues with Web PKI= that were raised by Diginotar and Comodo incidents. We asked to take few m= inutes on the trans WG meeting in the next IETF meeting to present this fea= ture and chairs requested us to start a thread on this in WG mailing list. = Please see below for description of this feature. > > http://blogs.technet.com/b/pki/archive/2014/02/22/a-novel-method-in-ie11-= for-dealing-with-fraudulent-digital-certificates.aspx I think this is great stuff, but is it appropriate for trans? It doesn't involve a public log at all (why not?) - perhaps better suited for the tls WG meeting? Or are you considering aligning with the goals of the trans WG? From nobody Thu Feb 27 16:09:48 2014 Return-Path: X-Original-To: therightkey@ietfa.amsl.com Delivered-To: therightkey@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD1081A0693; Thu, 27 Feb 2014 16:09:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nbFtC9STt5O7; Thu, 27 Feb 2014 16:09:41 -0800 (PST) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1lp0145.outbound.protection.outlook.com [207.46.163.145]) by ietfa.amsl.com (Postfix) with ESMTP id 39D3D1A0675; Thu, 27 Feb 2014 16:09:40 -0800 (PST) Received: from BL2PR03MB467.namprd03.prod.outlook.com (10.141.92.23) by BL2PR03MB308.namprd03.prod.outlook.com (10.141.68.26) with Microsoft SMTP Server (TLS) id 15.0.893.10; Fri, 28 Feb 2014 00:09:38 +0000 Received: from BL2PR03MB467.namprd03.prod.outlook.com ([10.141.92.23]) by BL2PR03MB467.namprd03.prod.outlook.com ([10.141.92.23]) with mapi id 15.00.0883.010; Fri, 28 Feb 2014 00:09:38 +0000 From: Anoosh Saboori To: Ben Laurie Thread-Topic: [therightkey] Dealing with fraudulent certificates via certificate reputation Thread-Index: AQHPMveDNG7tget80U+9jLu2RXaAKprJy79g Date: Fri, 28 Feb 2014 00:09:37 +0000 Message-ID: <3d3218434709470cb720c71d76e560f4@BL2PR03MB467.namprd03.prod.outlook.com> References: <873b20cac6834d9cb347dee1e131dad2@BL2PR03MB467.namprd03.prod.outlook.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [2001:4898:80e0:ee43::3] x-forefront-prvs: 0136C1DDA4 x-forefront-antispam-report: SFV:NSPM; SFS:(10009001)(6009001)(428001)(24454002)(189002)(377454003)(13464003)(51704005)(199002)(69226001)(80022001)(15202345003)(81686001)(74316001)(95416001)(19580395003)(94946001)(65816001)(59766001)(77982001)(81542001)(80976001)(63696002)(86362001)(81342001)(74366001)(94316002)(83322001)(19580405001)(85306002)(4396001)(15975445006)(93516002)(93136001)(53806001)(31966008)(54356001)(561944002)(90146001)(92566001)(83072002)(74662001)(56776001)(74502001)(79102001)(76576001)(74706001)(33646001)(76482001)(51856001)(47736001)(47976001)(2656002)(81816001)(50986001)(49866001)(87266001)(54316002)(95666003)(46102001)(76796001)(47446002)(74876001)(87936001)(85852003)(24736002)(3826001); DIR:OUT; SFP:1101; SCL:1; SRVR:BL2PR03MB308; H:BL2PR03MB467.namprd03.prod.outlook.com; CLIP:2001:4898:80e0:ee43::3; FPR:6E3EF2A4.9EF3EFC2.FFD30D33.48CA3F2D.202F2; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (: microsoft.com does not designate permitted sender hosts) Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: microsoft.com Archived-At: http://mailarchive.ietf.org/arch/msg/therightkey/M9566Yo0l_8-zJwRS4-pRgeXKGg Cc: Anthony Nadalin , "therightkey@ietf.org" , "trans@ietf.org" , Melinda Shore , Nelly Porter , Magnus Nystrom Subject: Re: [therightkey] Dealing with fraudulent certificates via certificate reputation X-BeenThere: therightkey@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Feb 2014 00:09:45 -0000 VGhhbmsgeW91LCBCZW4uIEluIHRoZSBibG9nLCB0aGVyZSBhcmUgZmV3IHN1Z2dlc3Rpb25zIGFy b3VuZCBob3cgc2l0ZSBvd25lcnMgY2FuIGJlIG5vdGlmaWVkIHdoZW4gY2hhbmdlcyB0byB0aGVp ciBjZXJ0aWZpY2F0ZXMgIGFyZSBkZXRlY3RlZC4gVGhpcyB0ZWNobmljYWxseSBhbGxvd3MgdGhl IHNpdGUgb3duZXIgdG8gYmUgaW4gZnVsbCBjb250cm9sIG9mIGRlY2lzaW9uIG1ha2luZyB3aXRo IHJlc3BlY3QgdG8gImhpcyIgY2VydGlmaWNhdGVzIGFuZCBkZWNpZGUgd2hldGhlciBuZXdseSBy ZXBvcnRlZCBjZXJ0aWZpY2F0ZXMgYXJlIGZyYXVkdWxlbnQgb3Igbm90LiBUaGlzIHNvbHV0aW9u IGhhcyBzb21lIGludGVyZXN0aW5nIHByaXZhY3kgcHJlc2VydmluZyBwcm9wZXJ0aWVzIHRvIGl0 IHRoYXQgd2Ugd291bGQgbGlrZSB0byBwcmVzZW50IGF0IHRoZSBXRyBtZWV0aW5nLiBZb3UgYXJl IHJpZ2h0IHRoYXQgdGhlIGdvYWwgb2YgdGhpcyBwcm9wb3NhbCBpcyBub3QgdG8gcHJvdmlkZSBw dWJsaWMgbG9ncy4NCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IEJlbiBMYXVy aWUgW21haWx0bzpiZW5sQGdvb2dsZS5jb21dIA0KU2VudDogV2VkbmVzZGF5LCBGZWJydWFyeSAy NiwgMjAxNCA1OjM1IEFNDQpUbzogQW5vb3NoIFNhYm9vcmkNCkNjOiBNZWxpbmRhIFNob3JlOyB0 cmFuc0BpZXRmLm9yZzsgTWFnbnVzIE55c3Ryb207IEFudGhvbnkgTmFkYWxpbjsgdGhlcmlnaHRr ZXlAaWV0Zi5vcmc7IE5lbGx5IFBvcnRlcg0KU3ViamVjdDogUmU6IFt0aGVyaWdodGtleV0gRGVh bGluZyB3aXRoIGZyYXVkdWxlbnQgY2VydGlmaWNhdGVzIHZpYSBjZXJ0aWZpY2F0ZSByZXB1dGF0 aW9uDQoNCk9uIDI1IEZlYnJ1YXJ5IDIwMTQgMDI6MDEsIEFub29zaCBTYWJvb3JpIDxhbnNhYm9v ckBtaWNyb3NvZnQuY29tPiB3cm90ZToNCj4gSGVsbG8sDQo+DQo+IFdlIHdvdWxkIGxpa2UgdG8g aW50cm9kdWNlIGNlcnRpZmljYXRlIHJlcHV0YXRpb24sIHdoaWNoIHdhcyBzaGlwcGVkIGFzIHBh cnQgb2YgSUUgMTEuIFRoaXMgZmVhdHVyZSBhaW1zIHRvIGFkZHJlc3MgIHNvbWUgb2YgdGhlIGlz c3VlcyB3aXRoIFdlYiBQS0kgdGhhdCB3ZXJlIHJhaXNlZCBieSBEaWdpbm90YXIgYW5kIENvbW9k byBpbmNpZGVudHMuIFdlIGFza2VkIHRvIHRha2UgZmV3IG1pbnV0ZXMgb24gdGhlIHRyYW5zIFdH IG1lZXRpbmcgaW4gdGhlIG5leHQgSUVURiBtZWV0aW5nIHRvIHByZXNlbnQgdGhpcyBmZWF0dXJl IGFuZCBjaGFpcnMgcmVxdWVzdGVkIHVzIHRvIHN0YXJ0IGEgdGhyZWFkIG9uIHRoaXMgaW4gV0cg bWFpbGluZyBsaXN0LiBQbGVhc2Ugc2VlIGJlbG93IGZvciBkZXNjcmlwdGlvbiBvZiB0aGlzIGZl YXR1cmUuDQo+DQo+IGh0dHA6Ly9ibG9ncy50ZWNobmV0LmNvbS9iL3BraS9hcmNoaXZlLzIwMTQv MDIvMjIvYS1ub3ZlbC1tZXRob2QtaW4taWUNCj4gMTEtZm9yLWRlYWxpbmctd2l0aC1mcmF1ZHVs ZW50LWRpZ2l0YWwtY2VydGlmaWNhdGVzLmFzcHgNCg0KSSB0aGluayB0aGlzIGlzIGdyZWF0IHN0 dWZmLCBidXQgaXMgaXQgYXBwcm9wcmlhdGUgZm9yIHRyYW5zPyBJdCBkb2Vzbid0IGludm9sdmUg YSBwdWJsaWMgbG9nIGF0IGFsbCAod2h5IG5vdD8pIC0gcGVyaGFwcyBiZXR0ZXIgc3VpdGVkIGZv ciB0aGUgdGxzIFdHIG1lZXRpbmc/IE9yIGFyZSB5b3UgY29uc2lkZXJpbmcgYWxpZ25pbmcgd2l0 aCB0aGUgZ29hbHMgb2YgdGhlIHRyYW5zIFdHPw0K