From nobody Wed Mar 1 05:06:48 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CAFFD12997E for ; Wed, 1 Mar 2017 05:06:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=azet.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2IpZY3Ejep5e for ; Wed, 1 Mar 2017 05:06:45 -0800 (PST) Received: from mail-wr0-x236.google.com (mail-wr0-x236.google.com [IPv6:2a00:1450:400c:c0c::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D6551295D0 for ; Wed, 1 Mar 2017 05:06:45 -0800 (PST) Received: by mail-wr0-x236.google.com with SMTP id u48so29774862wrc.0 for ; Wed, 01 Mar 2017 05:06:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=azet.org; s=gmail; h=subject:mime-version:from:in-reply-to:date:cc:message-id:references :to; bh=k+KSqaEwUtq8+UKc158S1JYfQEJxL7/9PagjeH0zfs0=; b=GlLHFkYC4LMVDXVAa6IwhWi0l5umlrxKC8JXkJjkIeQJ5+6IK0UFK1brbxQhLTB35d O/v0XUPRXuE+A22/FMFEhUZE0I2aL/MYnH1vKuKG+5TE1oiCwpvZlJ6Vl+CmKazujjc+ gzcA0Yc1F+JReWXoJcE1QynJSH6u68ue80X/o= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:mime-version:from:in-reply-to:date:cc :message-id:references:to; bh=k+KSqaEwUtq8+UKc158S1JYfQEJxL7/9PagjeH0zfs0=; b=SNwLi9Dw08ENEw6iSx/FXCtz8wYflB8MM9XA08C1/gWMOSFj93+XtYuQ3t57CtcIVw mVcg97sW1KmBqvFO+xu/rVeWVZ0VqRBB7UJo++8MPDjfbgHjGoDVmgQrg3ZVCBvbECm2 iP3RbbpBJ/g22yMe/TfMKDKyiap3oE1vAFHASafFVhpkABpsocskQvoG2B9GZHdTYH03 RQ9rqFyWCe9/uIEowq3AecS2bpVKMh64c0ekFKEzqeR41kA1w7RToh9oXd0vi5DiL5r2 wkqM1IIjh2d461cddD2DuxbV63VJpgwZDtxOj7ByPml2oj4c3LmE6R2330oU1kIVjnE9 CH3A== X-Gm-Message-State: AMke39mBy5rZNcgECdowPdZVhQe6DpnhbQhr69LmhkhRU7E7HvJvz2G/0rBD0NwXgxZyrQ== X-Received: by 10.223.149.37 with SMTP id 34mr7449742wrs.107.1488373602793; Wed, 01 Mar 2017 05:06:42 -0800 (PST) Received: from [192.168.1.121] ([41.143.43.27]) by smtp.gmail.com with ESMTPSA id v130sm13092664wmv.2.2017.03.01.05.06.33 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 01 Mar 2017 05:06:41 -0800 (PST) Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) Content-Type: multipart/signed; boundary="Apple-Mail=_5755FC85-4608-42FA-A519-2DFB10D16144"; protocol="application/pgp-signature"; micalg=pgp-sha512 X-Pgp-Agent: GPGMail From: Aaron Zauner In-Reply-To: <91c7562e92814e3a9ebb57dfa6c59610@usma1ex-dag1mb1.msg.corp.akamai.com> Date: Wed, 1 Mar 2017 13:06:27 +0000 Message-Id: References: <20170222171156.GA31015@LK-Perkele-V2.elisa-laajakaista.fi> <1CAE4CFE-2A9D-4A8D-93D4-2BA304894F96@gmail.com> <91c7562e92814e3a9ebb57dfa6c59610@usma1ex-dag1mb1.msg.corp.akamai.com> To: "Salz, Rich" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "draft-ietf-tls-ecdhe-psk-aead@tools.ietf.org" , "tls@ietf.org" Subject: Re: [TLS] Last call comments and WG Chair review of draft-ietf-tls-ecdhe-psk-aead X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 13:06:47 -0000 --Apple-Mail=_5755FC85-4608-42FA-A519-2DFB10D16144 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On 24 Feb 2017, at 14:07, Salz, Rich wrote: >=20 >> Assuming 256-bit AES-CCM suites are needed, I think the better place = to put >> them is in the TLS 1.3 document. >=20 > That's a really big assumption. ;) >=20 > I think the burden is on folks to *prove* (yeah, I know) that = additional cipher suites are needed. +1. I'm against adding CCM based suites to the TLS 1.3 spec. (I may be biased having worked on the OCB cipher-suite spec and patent = exemptions for TLS - but for example; these were only aimed at TLS 1.2 = at that time. I don't see why the IoT/embedded-world can't make use of = ChaCha/Poly in future implementations?) Aaron --Apple-Mail=_5755FC85-4608-42FA-A519-2DFB10D16144 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJYtsdUAAoJEOTbZJL9ubXVB9kP/0htv08ApRBwLCup+Efb1nDc 3jlbTJn5hYBI5RJdcdfefqTUQAJxkYDQYnKqQYCYjr9eJyh2SRtiCtua9oy7KfOa o5bXJqyF+rL1OFsKMYPzGiKDRRWTNJ5WTkoPP+DRqkTR4JcLafdpVgVAfoNvhG8G 5dNwDbpYhwATKF69jx5RL7dBAVLqS1sNzMJtJ9Lu53pAP2XPTT7XWnVbrUgrwUpr 59hey1uvMHN9sXPfWwfQ8+iXuMX9Dmhzjr/Krgz+zx7+AljISw4AORR5DKBTXa4g Sv+FLgAJfhs+/zMOMVzTejog88Mpb3r24rrFf+dbI59n7KGuiJbNv4rFJmlmqvS+ D4En3yEPT0SAde/svFnMaNZtP0c02zI4kqKLpB1xT7zBgx6skAzCUD+kgGmFQOQh SDEjJe1iZ/m40EvpHg4fz8/jtqIJlPFErErt5q+GXN6Xw2q5JzYXv1As/JMBnQPt BVLfQCfbOZXnHqRHcNFWktCPzOU4jQ5e9Ky61rPPKAnWKFSm0XuKTKr1AvpMuv5I RJPquuaLkUTzlw25OlFC7iN8Hm2FeE9RcQbmsGly0DDBu3aN66IU4n7o95X5jo8l IbwdKhTKYYZTAWkwJt3/bg8uExZMlJ5EzKo9Z0+QuoQs0HeBlofuAezL4stACoa7 hUf3pWAQgzzG18CqpdCj =bhXr -----END PGP SIGNATURE----- --Apple-Mail=_5755FC85-4608-42FA-A519-2DFB10D16144-- From nobody Wed Mar 1 05:12:18 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 794AF1295B4 for ; Wed, 1 Mar 2017 05:12:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=azet.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PxxWOKcPThNZ for ; Wed, 1 Mar 2017 05:12:15 -0800 (PST) Received: from mail-wm0-x232.google.com (mail-wm0-x232.google.com [IPv6:2a00:1450:400c:c09::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 647891295A0 for ; Wed, 1 Mar 2017 05:12:15 -0800 (PST) Received: by mail-wm0-x232.google.com with SMTP id i17so8266136wmf.0 for ; Wed, 01 Mar 2017 05:12:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=azet.org; s=gmail; h=subject:mime-version:from:in-reply-to:date:cc:message-id:references :to; bh=ERclPtGHmQwDI8Z6ZImSOHsFXc8Da3GmMTzMfqyVZj0=; b=NCvNVkEqCKF4QZLJbU6ieqtM6mxktTrBHYMVJGUgr9D4fT/km9TdyCa/YTC9P21NN4 yuo4aC2n+n6ANGE2Vlp8UqNhjffdljBAJ6c+34GsvDE5sg67mMOyhCEA5iJYXevViqE+ xzDZxAdpi5Z3TIfpja2Ytpov4KFLLsdWUdkkY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:mime-version:from:in-reply-to:date:cc :message-id:references:to; bh=ERclPtGHmQwDI8Z6ZImSOHsFXc8Da3GmMTzMfqyVZj0=; b=IAWseDsAaxevl9e5Gk5KCLNHHERCSJpT2qBDqCQGK7LVRB3PK/s2aks6KT06q0lu3A F8jHSU+l4vIaUkAZBlb9DzXUXAklQdZNaUfUhvzEsabbW49KU0qW/WT51h42wV7PNXDt 0aijjrajZgXm6ns5USi6OgkpwTsUk494UVVtvcybqX99SnktVNS4lJbD5EZjS+dZuvYV 2pAezqxgU1yJNGUN5pe08kBTNobcwQWarUm15nAUjLVzuvhIB4S08Xl5oPLy4ygCNW0W Le2HeKaZ3NftlQqEZKjhXK9bq7TDG++SZpAtRJtU2ZnEKG8tsNaSRNm5/MizxSsKirCj 065A== X-Gm-Message-State: AMke39njyOHreFQ43uJRoMPwoAsTfZuc8NxQz/+23/x9i6rbRDNCZwzH7PRLYpz36nraZg== X-Received: by 10.28.203.204 with SMTP id b195mr3425506wmg.51.1488373933775; Wed, 01 Mar 2017 05:12:13 -0800 (PST) Received: from [192.168.1.121] ([41.143.43.27]) by smtp.gmail.com with ESMTPSA id m201sm6951872wmd.19.2017.03.01.05.12.11 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 01 Mar 2017 05:12:13 -0800 (PST) Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) Content-Type: multipart/signed; boundary="Apple-Mail=_730454EA-7C14-4F96-9548-200CE3398D6F"; protocol="application/pgp-signature"; micalg=pgp-sha512 X-Pgp-Agent: GPGMail From: Aaron Zauner In-Reply-To: Date: Wed, 1 Mar 2017 13:11:25 +0000 Message-Id: <26137F3B-5655-44CA-877E-7168CE02DBF1@azet.org> References: <352D31A3-5A8B-4790-9473-195C256DEEC8@sn3rd.com> To: "Dang, Quynh (Fed)" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: IRTF CFRG , "" Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 13:12:16 -0000 --Apple-Mail=_730454EA-7C14-4F96-9548-200CE3398D6F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 > On 25 Feb 2017, at 14:28, Dang, Quynh (Fed) = wrote: >=20 > Hi Sean, Joe, Eric and all, >=20 > I would like to address my thoughts/suggestions on 2 issues in option = a. >=20 > 1) The data limit should be addressed in term of blocks, not records. = When the record size is not the full size, some user might not know what = to do. When the record size is 1 block, the limit of 2^24.5 blocks = (records) is way too low unnecessarily for the margin of 2^-60. In that = case, 2^34.5 1-block records is the limit which still achieves the = margin of 2^-60. I respectfully disagree. TLS deals in records not in blocks, so in the = end any semantic change here will just confuse implementors, which isn't = a good idea in my opinion. Aaron --Apple-Mail=_730454EA-7C14-4F96-9548-200CE3398D6F Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJYtsh+AAoJEOTbZJL9ubXVPU0QAN5yFc9KMjMLylANnEW+Bj/1 h1+Uz1PDNU4mNrPFZkr5gCkmk7O5nJOUv1GqZ1Js3ixMaKfcl6JJxOlFLp5e7044 aiEiPGvCNz0uuuFczPklSMBWhkoeoLCEX/m1arm3VgpIz7Xbpa5LbyhtXWc5qzzF 7hLdYUzeAZLDk/dhRViM8y2n/5aE37+GE0cP4JVlmO4kxHFslJykbsLmSBEsPTmn 1NNuETkpOP3RLHcH5a3VExKYJEDfCFWMSeSuoje125/2nUd6+upPgP7EFrrG1I9U 31n03E1mkf1HMNtMz+Jp758+Cp2UzKvcj9YRvNtr+tq9AC9H+jyAr6EoDbbEDC26 b/Ll9gPYyXqyf3GiNCnkA7W6urgjefZfASAknAIT8wc1lfLdrXVQ9Fmj0OQqrbE+ d2QWpMELbsxf96x6zGoXxE3h5wnMlIRRSjF4KvCetvWktPZFq+/48fFJSARmNkhY AjSPAe4K3GapkYHmN4Snt2+a7GerUq3yYkb1nA+3r0sauZus9znfaZNyBjPx3gyl 77n5seCUF54Q+PBODltX6zMnQCzxtSHcf+/KySoTskNqf3scbrYNfw+rR/MEPnB0 BK/wja1Jo7tHfDEPvJOBvOc7QzOv/aS6ytvc2hMxBt0yl18eVnYBfgq8P0sHbsMM UFnX0PgkdO8rcaEU29x1 =KMxk -----END PGP SIGNATURE----- --Apple-Mail=_730454EA-7C14-4F96-9548-200CE3398D6F-- From nobody Wed Mar 1 05:19:04 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E15CB1295D9 for ; Wed, 1 Mar 2017 05:18:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bzPLRB36lc06 for ; Wed, 1 Mar 2017 05:18:56 -0800 (PST) Received: from gcc01-CY1-obe.outbound.protection.outlook.com (mail-cy1gcc01on0109.outbound.protection.outlook.com [23.103.200.109]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE8F7129541 for ; Wed, 1 Mar 2017 05:18:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=KGV9SLW6OObsRsNCkK0ACHi3o5nFnrbiAvaVNZSoLMk=; b=iIERUT6FyaSpT9eX84U8CqpRFeTrtOQK+3JlaT4e83uEnXUzkxos6Ng2xMC3w86/DdNbn9drULC14/YQqW8ScPKbBInQWe4G80X1gBLKrsgCfBtGQgBrXOeGwCQpP8t9Gq5T0hvEFZ7jo8rckCSS/eqDblwZVEFlVq/w0c/CVQE= Received: from CY4PR09MB1464.namprd09.prod.outlook.com (10.173.191.22) by CY4PR09MB1461.namprd09.prod.outlook.com (10.173.191.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.933.12; Wed, 1 Mar 2017 13:18:55 +0000 Received: from CY4PR09MB1464.namprd09.prod.outlook.com ([10.173.191.22]) by CY4PR09MB1464.namprd09.prod.outlook.com ([10.173.191.22]) with mapi id 15.01.0933.016; Wed, 1 Mar 2017 13:18:55 +0000 From: "Dang, Quynh (Fed)" To: Aaron Zauner Thread-Topic: [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). Thread-Index: AQHSj3N1z8IXvDyfJEuMUkRo/k0w1KF/+8GA//+uQQA= Date: Wed, 1 Mar 2017 13:18:54 +0000 Message-ID: References: <352D31A3-5A8B-4790-9473-195C256DEEC8@sn3rd.com> <26137F3B-5655-44CA-877E-7168CE02DBF1@azet.org> In-Reply-To: <26137F3B-5655-44CA-877E-7168CE02DBF1@azet.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.1.161129 authentication-results: azet.org; dkim=none (message not signed) header.d=none;azet.org; dmarc=none action=none header.from=nist.gov; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [129.6.105.150] x-ms-office365-filtering-correlation-id: a679fd2b-c3d1-401e-2f66-08d460a58306 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR09MB1461; x-microsoft-exchange-diagnostics: 1; CY4PR09MB1461; 7:X4o1ZDyGmSxfgOObWJ/OQDihiQIroHoBXJJHj2mR9nfcen+VZgZ9uRO660He8vvn57ZZ6W1/V0sNMOeqBELIRjUbDrO5foxcNO/CMRa6pmgzscaux5CRHSbYUT4PbHCA+iQek4AuApaB8BiTImucvf46YU0jNLRsuLIgxwXQm541K9HOxdwNh+l4MnBkQ5pfKqENhscpvv7KfzoocKRRxFNOCGEy0R4WK0fYW+wvG/ZRDdnvrBwsNuBFKjtAjKKSg6/K6UDjwKlDPIeeM6uRjIYcm4w0tO6KrElazJafp0jWs3DOmbgP+f6Wkes1DD7yJOQQoMO9YbqJemA73AY1Pg== x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(65766998875637); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(6041248)(20161123555025)(20161123562025)(20161123564025)(20161123560025)(20161123558025)(6072148); SRVR:CY4PR09MB1461; BCL:0; PCL:0; RULEID:; SRVR:CY4PR09MB1461; x-forefront-prvs: 0233768B38 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(7916002)(39850400002)(39410400002)(39840400002)(39860400002)(39450400003)(24454002)(377454003)(7736002)(6246003)(86362001)(54356999)(76176999)(6486002)(50986999)(53936002)(2950100002)(6916009)(4326008)(5660300001)(189998001)(38730400002)(106116001)(53546006)(110136004)(3660700001)(102836003)(77096006)(83506001)(2906002)(66066001)(2900100001)(6436002)(6506006)(122556002)(229853002)(8676002)(36756003)(8936002)(92566002)(3846002)(236005)(99286003)(6116002)(6512007)(54896002)(54906002)(81166006)(25786008)(3280700002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR09MB1461; H:CY4PR09MB1464.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_D4DC341D311E1qdangnistgov_" MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Mar 2017 13:18:54.8422 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR09MB1461 Archived-At: Cc: IRTF CFRG , "" Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 13:18:59 -0000 --_000_D4DC341D311E1qdangnistgov_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable From: Aaron Zauner > Date: Wednesday, March 1, 2017 at 8:11 AM To: 'Quynh' > Cc: Sean Turner >, ">" >, IRTF CFRG > Subject: Re: [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769= ). On 25 Feb 2017, at 14:28, Dang, Quynh (Fed) > wrote: Hi Sean, Joe, Eric and all, I would like to address my thoughts/suggestions on 2 issues in option a. 1) The data limit should be addressed in term of blocks, not records. When = the record size is not the full size, some user might not know what to do. = When the record size is 1 block, the limit of 2^24.5 blocks (records) is wa= y too low unnecessarily for the margin of 2^-60. In that case, 2^34.5 1-bl= ock records is the limit which still achieves the margin of 2^-60. I respectfully disagree. TLS deals in records not in blocks, so in the end = any semantic change here will just confuse implementors, which isn't a good= idea in my opinion. Over the discussion of the PRs, the preference was blocks. Quynh. Aaron --_000_D4DC341D311E1qdangnistgov_ Content-Type: text/html; charset="us-ascii" Content-ID: <595E4712A92CFB47929993E3FDF9ED5B@namprd09.prod.outlook.com> Content-Transfer-Encoding: quoted-printable


From: Aaron Zauner <azet@azet.org>
Date: Wednesday, March 1, 2017 at 8= :11 AM
To: 'Quynh' <Quynh.Dang@nist.gov>
Cc: Sean Turner <sean@sn3rd.com>, "<tls@ietf.org>" <tl= s@ietf.org>, IRTF CFRG <cfrg@irt= f.org>
Subject: Re: [Cfrg] Closing out tls= 1.3 "Limits on key usage" PRs (#765/#769).


On 25 Feb 2017, at 14:28, Dang, Quynh (Fed) <quynh.dang@nist.gov> wrote:
Hi Sean, Joe, Eric and all,
I would like to address my thoughts/suggestions on 2 issues in option = a.
1) The data limit should be addressed in term of blocks, not records. = When the record size is not the full size, some user might not know what to= do. When the record size is 1 block, the limit of 2^24.5 blocks (records) = is way too low unnecessarily for the margin of 2^-60.  In that case, 2^34.5 1-block records is th= e limit which still achieves the margin of 2^-60.

I respectfully disagree. TLS deals in records not in blocks, so in the= end any semantic change here will just confuse implementors, which isn't a= good idea in my opinion.

Over the discussion of the PRs, the preference was blocks. 

Quynh. 



Aaron

 --_000_D4DC341D311E1qdangnistgov_-- From nobody Wed Mar 1 05:58:30 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78C2B12947D for ; Wed, 1 Mar 2017 05:58:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.903 X-Spam-Level: X-Spam-Status: No, score=-1.903 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H1GooyEZDWAH for ; Wed, 1 Mar 2017 05:58:27 -0800 (PST) Received: from brontes.bolet.org (www.bolet.org [62.210.214.227]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 103301293F3 for ; Wed, 1 Mar 2017 05:58:27 -0800 (PST) Received: by brontes.bolet.org (Postfix, from userid 1000) id 9E47420834; Wed, 1 Mar 2017 14:57:54 +0100 (CET) Date: Wed, 1 Mar 2017 14:57:54 +0100 From: Thomas Pornin To: Aaron Zauner Message-ID: <20170301135754.GA16901@bolet.org> References: <20170222171156.GA31015@LK-Perkele-V2.elisa-laajakaista.fi> <1CAE4CFE-2A9D-4A8D-93D4-2BA304894F96@gmail.com> <91c7562e92814e3a9ebb57dfa6c59610@usma1ex-dag1mb1.msg.corp.akamai.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) Archived-At: Cc: "draft-ietf-tls-ecdhe-psk-aead@tools.ietf.org" , "tls@ietf.org" Subject: Re: [TLS] Last call comments and WG Chair review of draft-ietf-tls-ecdhe-psk-aead X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 13:58:28 -0000 On Wed, Mar 01, 2017 at 01:06:27PM +0000, Aaron Zauner wrote: > I don't see why the IoT/embedded-world can't make use of ChaCha/Poly > in future implementations? IF the embedded platform is "generic" (say, it's an ARM Cortex M0+), then ChaCha20 is faster than anything using AES. Poly1305 is less clear because it relies on multiplications and multiplications can be expensive on small microcontrollers; in my own tests with my own implementations, ChaCha20 and Poly1305 run at roughly the same speed on a Cortex M0+ (with the 1-cycle multiplier option). Even a table-based AES (that is, formally "not constant-time", though on a cache-less microcontroller it might be fine nonetheless) will be about twice slower. Similarly, the GHASH part of GCM will be slower than Poly1305 (unless you use big key-dependent tables, which is not constant-time but also rarely doable in small embedded systems, where RAM is a very scarce resource). HOWEVER, there are some microcontrollers with hardware acceleration for AES, e.g. the ESP32 (a popular micrcontroller-with-WiFi) has some circuitry that can do an AES block encryption in 11 clock cycles, which is much faster than ChaCha20. Moreover, in the presence of such hardware, CCM will also be much faster than GCM, the GHASH part becoming prohibitively expensive (relatively to encryption). The push for CCM mainly comes from that kind of hardware. (EAX mode might be even preferable on AES-able hardware, but CCM has a stronger legacy foothold.) --Thomas Pornin From nobody Wed Mar 1 06:24:47 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ECF3C12955A for ; Wed, 1 Mar 2017 06:24:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=azet.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RVyu7UjnvI98 for ; Wed, 1 Mar 2017 06:24:44 -0800 (PST) Received: from mail-wr0-x22e.google.com (mail-wr0-x22e.google.com [IPv6:2a00:1450:400c:c0c::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 59F2112952E for ; Wed, 1 Mar 2017 06:24:44 -0800 (PST) Received: by mail-wr0-x22e.google.com with SMTP id u48so31352817wrc.0 for ; Wed, 01 Mar 2017 06:24:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=azet.org; s=gmail; h=subject:mime-version:from:in-reply-to:date:cc:message-id:references :to; bh=E+6wN7j5giQLnctTPVLqaSdM4DtM05NXOsMfxaOqxQE=; b=cRD12fUtjEaJyBUaUsKAl/tgbD6IDOnlI8tFe0RQt0pR4GFUI3MG1VzvvuVLiyxUFj cDrObwXra3icL8l4/Ja/ZlhbKVyOCkSU5y9O6WPAaNKw36TljIbfeuAzvWftPUsCjLGJ O8e2rqxIaGUMeD+KNWSNzFz++W78Isx28KjDk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:mime-version:from:in-reply-to:date:cc :message-id:references:to; bh=E+6wN7j5giQLnctTPVLqaSdM4DtM05NXOsMfxaOqxQE=; b=oBkwzezr2tA/GrOXmK6FpzpUv/ffKnN6XSDaWAkNUk0SOXXuRuhSKhQeBa0JrWUyiF 9ui9bgPXRcYXSUZgZg5UPCZny/atuZWetoLwt4Ctt/kt6UAUeMq83FCQqPdGRGb8+C/b vgVJIklcXUJBwBPfgSDKJHGOpZrQoIKaJt76D11q/kT7gt+I29+ez/JeLz5MPTPq2s/A mVDPikwFicTFagcUYtbtZuhEjyiFbHGeQE9ahjRGFY/VSpFDZpAWNaUIwvs9VonsoFG0 oMNEoxKR3GRx9ugMnlolDbY0S3GYkJRWgMYaTJqIbekYtrp+++JQAEHeoYeLM8S8Hl/D l7/w== X-Gm-Message-State: AMke39lieTOy8w2bIr4u++Bu0jw3C46vi889EH0eX49lwT0rVTYosAAI/aGZQ2AobkqHyQ== X-Received: by 10.223.175.196 with SMTP id y4mr7417080wrd.77.1488378282826; Wed, 01 Mar 2017 06:24:42 -0800 (PST) Received: from [192.168.1.121] ([160.178.204.57]) by smtp.gmail.com with ESMTPSA id p93sm6780589wrc.67.2017.03.01.06.24.41 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 01 Mar 2017 06:24:42 -0800 (PST) Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) Content-Type: multipart/signed; boundary="Apple-Mail=_7A411B51-E70C-45CA-9662-6BFD89ADE5E9"; protocol="application/pgp-signature"; micalg=pgp-sha512 X-Pgp-Agent: GPGMail From: Aaron Zauner In-Reply-To: Date: Wed, 1 Mar 2017 14:24:37 +0000 Message-Id: <2572E3FC-0139-4946-A12D-9D9509C402F1@azet.org> References: <352D31A3-5A8B-4790-9473-195C256DEEC8@sn3rd.com> <26137F3B-5655-44CA-877E-7168CE02DBF1@azet.org> To: "Dang, Quynh (Fed)" X-Mailer: Apple Mail (2.3124) Archived-At: Cc: IRTF CFRG , "" Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 14:24:46 -0000 --Apple-Mail=_7A411B51-E70C-45CA-9662-6BFD89ADE5E9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On 01 Mar 2017, at 13:18, Dang, Quynh (Fed) = wrote: >=20 >=20 >=20 > From: Aaron Zauner > Date: Wednesday, March 1, 2017 at 8:11 AM > To: 'Quynh' > Cc: Sean Turner , "" , = IRTF CFRG > Subject: Re: [Cfrg] Closing out tls1.3 "Limits on key usage" PRs = (#765/#769). >=20 >>=20 >>> On 25 Feb 2017, at 14:28, Dang, Quynh (Fed) = wrote: >>> Hi Sean, Joe, Eric and all, >>> I would like to address my thoughts/suggestions on 2 issues in = option a. >>> 1) The data limit should be addressed in term of blocks, not = records. When the record size is not the full size, some user might not = know what to do. When the record size is 1 block, the limit of 2^24.5 = blocks (records) is way too low unnecessarily for the margin of 2^-60. = In that case, 2^34.5 1-block records is the limit which still achieves = the margin of 2^-60. >>=20 >> I respectfully disagree. TLS deals in records not in blocks, so in = the end any semantic change here will just confuse implementors, which = isn't a good idea in my opinion. >=20 > Over the discussion of the PRs, the preference was blocks. I don't see a clear preference. I see Brian Smith suggested switching to = blocks to be more precise in a PR. But in general it seems to me that = "Option A" was preferred in this thread anyhow - so these PRs aren't = relevant? I'm not sure that text on key-usage limits in blocks in a spec = that fundamentally deals in records is less confusing, quite the = opposite (at least to me). As I pointed out earlier: I strongly = recommend that any changes to the spec are as clear als possible to = engineers (non-crypto/math people) -- e.g. why the spec is suddenly = dealing in blocks instead of records et cetera. Again; I really don't = see any reason to change text here - to me all suggested changes are = even more confusing. Aaron --Apple-Mail=_7A411B51-E70C-45CA-9662-6BFD89ADE5E9 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJYttmmAAoJEOTbZJL9ubXVLj8P/1uOMf2t1u+IcxFcv+UnoXYg yAt1hVlI+oGsaNHTTZgnyByvoqgivwx43r/MYV6vBTwm1ZkC2eSYeYIotqh4YJSB QE8Cr+rJu+LqbBnBnpVJxJzx9Szc9jkYlMvwemfaz7hFs/Jw9t6U80WtDIrxSdSn XUrw7u9idGRvhIHhRRZcI9/9GaaXOu4Z1HBq5CpMrfPZ2yP1Y9FmpTxIjtI13VsC 6pHtqgqO7rbqZM6Kb12SUmUwcOsu7oeHToWzAJN5X+55yabBGX4lfdERe/Yyp2M1 f32xE+6unw7jj9hoZV9IPvYvNqKI6Tyd/YlzOwwgbv6GMWawJ4uO4xPjwVc71BvD 3626kXB9LIs6EhTHPay4wX3/3E2LDoqaXA4bE6edoLBLc+BnYJDYdL72v1Go5Ffv KsdpNsqqnCmQ7RYbZFEKy6430NIRLGGOuC1pcz1XxH7FtSPcWHa5a87VGZAq2ZjP QL3DU71M6p+TL2AGLNvCVgOyB0vu9g8eIBjPPip/SrD9rCIQBdJcJPySnpgkScjq tIGTuJRQWb59OIuQ9tFFZ18POX4HS8s3Xbp4Hr3fGeaCY227Et+wZh9Vh5rti4Bv Yih1X1T/cajvkX5jhdqoBC6KBAEv94JtOXpHbz3Wf2PFUWD91jizWdpm+1EqqNlC l+pFOdGqFpB6kxrRbn6T =05qZ -----END PGP SIGNATURE----- --Apple-Mail=_7A411B51-E70C-45CA-9662-6BFD89ADE5E9-- From nobody Wed Mar 1 06:28:41 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D2EAA1293DA for ; Wed, 1 Mar 2017 06:28:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.702 X-Spam-Level: X-Spam-Status: No, score=-2.702 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pKBCizZBiOox for ; Wed, 1 Mar 2017 06:28:38 -0800 (PST) Received: from prod-mail-xrelay08.akamai.com (prod-mail-xrelay08.akamai.com [96.6.114.112]) by ietfa.amsl.com (Postfix) with ESMTP id 7A77E1289C4 for ; Wed, 1 Mar 2017 06:28:38 -0800 (PST) Received: from prod-mail-xrelay08.akamai.com (localhost.localdomain [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id 12570200041; Wed, 1 Mar 2017 14:28:38 +0000 (GMT) Received: from prod-mail-relay09.akamai.com (prod-mail-relay09.akamai.com [172.27.22.68]) by prod-mail-xrelay08.akamai.com (Postfix) with ESMTP id F05E0200004; Wed, 1 Mar 2017 14:28:37 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; s=a1; t=1488378517; bh=R8KB3d7YPDu6cGVoE+CAFr9Ke8fNGzjhiYg3MYkwbMM=; l=129; h=From:To:CC:Date:References:In-Reply-To:From; b=zweu/tC/5T1qk07RWrUFmlj18ozbjWKEsQEvSTcgJOELsDX6sMLLjqAfx+lkv5T7g 9wzUGYB88L/kwWlFzN/K8G3R85leOGpMY3SXdslWio6i6jf+aQzEJU0kDLLEcPTMiR WOnCg6eHv0Tf6ZB3U0Pb0vYM6+Ys2DMPnWOAkG7Y= Received: from email.msg.corp.akamai.com (usma1ex-cas2.msg.corp.akamai.com [172.27.123.31]) by prod-mail-relay09.akamai.com (Postfix) with ESMTP id D5A171E07C; Wed, 1 Mar 2017 14:28:37 +0000 (GMT) Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb4.msg.corp.akamai.com (172.27.123.104) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Wed, 1 Mar 2017 09:28:37 -0500 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1178.000; Wed, 1 Mar 2017 09:28:37 -0500 From: "Salz, Rich" To: Thomas Pornin , Aaron Zauner Thread-Topic: [TLS] Last call comments and WG Chair review of draft-ietf-tls-ecdhe-psk-aead Thread-Index: AQHSjG+AlPI2FEigPUqrjf2oARXzl6F06JEA///CuVCAAO0yAIACYtYAgAAlk4CAABSvIIAIHqSAgAAOYAD//7SKoA== Date: Wed, 1 Mar 2017 14:28:36 +0000 Message-ID: References: <20170222171156.GA31015@LK-Perkele-V2.elisa-laajakaista.fi> <1CAE4CFE-2A9D-4A8D-93D4-2BA304894F96@gmail.com> <91c7562e92814e3a9ebb57dfa6c59610@usma1ex-dag1mb1.msg.corp.akamai.com> <20170301135754.GA16901@bolet.org> In-Reply-To: <20170301135754.GA16901@bolet.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.35.230] Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: "draft-ietf-tls-ecdhe-psk-aead@tools.ietf.org" , "tls@ietf.org" Subject: Re: [TLS] Last call comments and WG Chair review of draft-ietf-tls-ecdhe-psk-aead X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 14:28:40 -0000 You know what amazes about IoT? No matter what someone tries to do there i= s a chip/SoC out there that can't do it. Shrug. From nobody Wed Mar 1 06:29:19 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A9B551294DB for ; Wed, 1 Mar 2017 06:29:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pWg-gKd6S5vm for ; Wed, 1 Mar 2017 06:29:16 -0800 (PST) Received: from mail-wr0-x22f.google.com (mail-wr0-x22f.google.com [IPv6:2a00:1450:400c:c0c::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E30A3129449 for ; Wed, 1 Mar 2017 06:29:15 -0800 (PST) Received: by mail-wr0-x22f.google.com with SMTP id g10so31388057wrg.2 for ; Wed, 01 Mar 2017 06:29:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=dFq0wwj5gF1FvnS2Z2sCLe/BcfrH19Pz+MieGybbZB0=; b=Th7hTm/8QQHKHglS8V8gH2sRqxlFFjwqwsKZE75SaTSOGXaUHLjlW+xtyDKrNeXKcV vVJszi0HCKPU6xaC8i1KSYd0SMdYgXN1peQsjEhwnrRS6gJ7d1TdJ/4q6HyiB5m5QBns KvLIQR7OrJ8J/2ln32Z/MDU+rBUZOYWUzDXemSNfy8YGQtVYXpaBV73grdkb8YEPBD2q Cfzi/xq1zyao6CZ7JNkY96rXya1l9Vn9+Wps79wwHTK7hg5581s3MP5bErqlzs3JgnhO VTA640fYDhwM7Lb33ERXykhwh57BAwIXtEIqykzMZjWbA4sWifUILau5LwMIKIHFoktc l//A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=dFq0wwj5gF1FvnS2Z2sCLe/BcfrH19Pz+MieGybbZB0=; b=ns1HyF3ThhRSXQ0Ibs3nIdFL5vYx+2aZUtCEC9LhjKD4ClRVFShBOCQYF4yANZ/+6I CR5XRmJFA/TBoWq9bDirsSXSMvZYtnnLiAmU/HhL1KHs+25jNC1azey5H8zZ5XH2RXcr hXtJy8KDypx/WdwzjA2DLhXoxjlfu2+u7qvua58f7OMDm8DmoCS4tCHhG5A6DUz8EjHM e8RvGPrx0dsozpSFv/98gjPLN1QwIvb3ZMz0UdoV8pO2+TYhNboP4ev6SjUUabzOBCEN YtaAKEGepLfsKNNpyJAE1mqd7LRRvjiJnZJ5kEJ29ZtVkislv1WrUyslFwCct1XuCbZd JUKw== X-Gm-Message-State: AMke39kxjzoDt9mTMHqc3BcWtiyJcYPnEn8Nlt/IJvGIEEsjJBUvuA5vqrjpMzBCA0EMYg== X-Received: by 10.223.130.144 with SMTP id 16mr8287946wrc.32.1488378554289; Wed, 01 Mar 2017 06:29:14 -0800 (PST) Received: from [172.24.249.232] (dyn32-131.checkpoint.com. [194.29.32.131]) by smtp.gmail.com with ESMTPSA id n9sm2983844wrn.40.2017.03.01.06.29.12 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 01 Mar 2017 06:29:13 -0800 (PST) From: Yoav Nir Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_AB196D08-5532-488E-8F8A-50326F38395B"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Wed, 1 Mar 2017 16:29:09 +0200 In-Reply-To: To: Aaron Zauner References: <20170222171156.GA31015@LK-Perkele-V2.elisa-laajakaista.fi> <1CAE4CFE-2A9D-4A8D-93D4-2BA304894F96@gmail.com> <91c7562e92814e3a9ebb57dfa6c59610@usma1ex-dag1mb1.msg.corp.akamai.com> X-Mailer: Apple Mail (2.3259) Archived-At: Cc: "draft-ietf-tls-ecdhe-psk-aead@tools.ietf.org" , "tls@ietf.org" Subject: Re: [TLS] Last call comments and WG Chair review of draft-ietf-tls-ecdhe-psk-aead X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 14:29:18 -0000 --Apple-Mail=_AB196D08-5532-488E-8F8A-50326F38395B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On 1 Mar 2017, at 15:06, Aaron Zauner wrote: >=20 >=20 >> On 24 Feb 2017, at 14:07, Salz, Rich wrote: >>=20 >>> Assuming 256-bit AES-CCM suites are needed, I think the better place = to put >>> them is in the TLS 1.3 document. >>=20 >> That's a really big assumption. ;) >>=20 >> I think the burden is on folks to *prove* (yeah, I know) that = additional cipher suites are needed. >=20 > +1. I'm against adding CCM based suites to the TLS 1.3 spec. Hold on. CCM with a 128-bit key suites are already in the current = version of the spec. CCM with a 256-bit key suites are not. Are you advocating just not adding the 256-bit key ciphersuites, or = removing those already in? Yoav --Apple-Mail=_AB196D08-5532-488E-8F8A-50326F38395B Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYttq2AAoJELhJCxUKWMyZkm8H/R1nas9n03Bld26KFRJA8W7/ k+g9SPDS/qoHXfQrmbag0DSzijo4CfKWhMe98wkuT+3TILqKl1BtrCAcyrw7faKi 0EtDjoRzC/+e+poqBWFKaq13KvLn1a7JW5jhtX7sc97czTe874U1N5hNM+exQ+nP Ot6rs1KRYO//wuBfdW+GBnin6wOhP4zie/ya4C6Vp+babj/eIKPYzqB2Yf6G66fl C9qsDDelciL0MbX7u0zX56tvtEcGjf+bdheH6boU8/10QMWVBZ+FZxqW93F5vLHe a3mW5t2EixYkyM7nYRydBL0cr9Afnbi3bDTf/ePUe77hQGab3cKqgwKUc+BSrFE= =xub6 -----END PGP SIGNATURE----- --Apple-Mail=_AB196D08-5532-488E-8F8A-50326F38395B-- From nobody Wed Mar 1 06:31:36 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E360129553 for ; Wed, 1 Mar 2017 06:31:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9VPuI2Auz64O for ; Wed, 1 Mar 2017 06:31:32 -0800 (PST) Received: from gcc01-dm2-obe.outbound.protection.outlook.com (mail-dm2gcc01on0114.outbound.protection.outlook.com [23.103.201.114]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D0E8712953D for ; Wed, 1 Mar 2017 06:31:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=M2g1eztAId+QHNq5+KMh9itnFJFl574ik456g/jR1tI=; b=NUKcLiHSL8XgSJ2oI/LrdfNH6vew64bmAu143dNrI15fb9q6UeY9nbS7Vyvxi0sG0jL1l8aVhYR9vFrrJ0lS2stzY9JQ+O0fsUiOuZcjnSfsk1ueaNOQ3xvRxvxIA5RtVHf5PFA37XfdgtYEHDFRJeojHRG2GWq43iGjWKwvEY0= Received: from CY4PR09MB1464.namprd09.prod.outlook.com (10.173.191.22) by CY4PR09MB1461.namprd09.prod.outlook.com (10.173.191.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.933.12; Wed, 1 Mar 2017 14:31:31 +0000 Received: from CY4PR09MB1464.namprd09.prod.outlook.com ([10.173.191.22]) by CY4PR09MB1464.namprd09.prod.outlook.com ([10.173.191.22]) with mapi id 15.01.0933.016; Wed, 1 Mar 2017 14:31:30 +0000 From: "Dang, Quynh (Fed)" To: Aaron Zauner , "Dang, Quynh (Fed)" Thread-Topic: [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). Thread-Index: AQHSj3N1z8IXvDyfJEuMUkRo/k0w1KF/+8GA//+uQQCAAGYzgP//rheA Date: Wed, 1 Mar 2017 14:31:30 +0000 Message-ID: References: <352D31A3-5A8B-4790-9473-195C256DEEC8@sn3rd.com> <26137F3B-5655-44CA-877E-7168CE02DBF1@azet.org> <2572E3FC-0139-4946-A12D-9D9509C402F1@azet.org> In-Reply-To: <2572E3FC-0139-4946-A12D-9D9509C402F1@azet.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.1.161129 authentication-results: azet.org; dkim=none (message not signed) header.d=none;azet.org; dmarc=none action=none header.from=nist.gov; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [129.6.105.150] x-microsoft-exchange-diagnostics: 1; CY4PR09MB1461; 7:LlIukQqq6F7mxgo0E8/8lKsyrcbaT3WQYyLDe9SpStnV1mIOZGGRwlQCt9S5gQ+nwH2+4ncBCXxd9USsAaet/GmqohO+QJReDdwBqSBvr2tTogtA+o6cqud+gI7aawRj8mjPRHOy1g1woWY1QebkkKo16/lzvTUoA1kts4JeDKFhA0qabzeWwz0nfRXO7Sp6K2LZ3xzhNN2oJ2BxxCZIU5ce7k9YyhWgyqxn1haxY0hYMEMdKuaX+ZeXcaBmTRvzwZvGqQ5nKp+H6NQXK9ddqwva0Mq34N6ziGUmLA5Kc9JgL66LCKGsQaL20Rc+Kw0+kCCasWv+7l7Dw78HJ1z6gQ== x-forefront-antispam-report: SFV:SKI; SCL:-1SFV:NSPM; SFS:(10019020)(7916002)(39860400002)(39840400002)(39450400003)(39410400002)(39850400002)(24454002)(377454003)(6506006)(6436002)(122556002)(66066001)(2900100001)(229853002)(2906002)(83506001)(102836003)(77096006)(81166006)(54906002)(54896002)(6512007)(3280700002)(25786008)(8936002)(92566002)(8676002)(36756003)(6116002)(99286003)(3846002)(236005)(54356999)(6486002)(76176999)(50986999)(93886004)(6246003)(7736002)(86362001)(106116001)(53546006)(189998001)(38730400002)(3660700001)(53936002)(2950100002)(5660300001)(4326008); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR09MB1461; H:CY4PR09MB1464.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; x-ms-office365-filtering-correlation-id: a4c94d87-d5ce-4d9c-986e-08d460afa711 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR09MB1461; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(65766998875637); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(6041248)(20161123555025)(20161123562025)(20161123564025)(20161123560025)(20161123558025)(6072148); SRVR:CY4PR09MB1461; BCL:0; PCL:0; RULEID:; SRVR:CY4PR09MB1461; x-forefront-prvs: 0233768B38 spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_D4DC4473311F2qdangnistgov_" MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Mar 2017 14:31:30.1271 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR09MB1461 Archived-At: Cc: IRTF CFRG , "" Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 14:31:34 -0000 --_000_D4DC4473311F2qdangnistgov_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable From: Aaron Zauner > Date: Wednesday, March 1, 2017 at 9:24 AM To: 'Quynh' > Cc: Sean Turner >, ">" >, IRTF CFRG > Subject: Re: [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769= ). On 01 Mar 2017, at 13:18, Dang, Quynh (Fed) > wrote: From: Aaron Zauner > Date: Wednesday, March 1, 2017 at 8:11 AM To: 'Quynh' > Cc: Sean Turner >, ">" >, IRTF CFRG > Subject: Re: [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769= ). On 25 Feb 2017, at 14:28, Dang, Quynh (Fed) > wrote: Hi Sean, Joe, Eric and all, I would like to address my thoughts/suggestions on 2 issues in option a. 1) The data limit should be addressed in term of blocks, not records. When = the record size is not the full size, some user might not know what to do. = When the record size is 1 block, the limit of 2^24.5 blocks (records) is wa= y too low unnecessarily for the margin of 2^-60. In that case, 2^34.5 1-bl= ock records is the limit which still achieves the margin of 2^-60. I respectfully disagree. TLS deals in records not in blocks, so in the end = any semantic change here will just confuse implementors, which isn't a good= idea in my opinion. Over the discussion of the PRs, the preference was blocks. I don't see a clear preference. I see Brian Smith suggested switching to bl= ocks to be more precise in a PR. But in general it seems to me that "Option= A" was preferred in this thread anyhow - so these PRs aren't relevant? I'm= not sure that text on key-usage limits in blocks in a spec that fundamenta= lly deals in records is less confusing, quite the opposite (at least to me)= . As I pointed out earlier: I strongly recommend that any changes to the sp= ec are as clear als possible to engineers (non-crypto/math people) -- e.g. = why the spec is suddenly dealing in blocks instead of records et cetera. Ag= ain; I really don't see any reason to change text here - to me all suggeste= d changes are even more confusing. Hi Aaron, The technical reasons I explained are reasons for using records. I don=92t= see how that is confusing. If you like records, then the record number =3D the total blocks / the reco= rd size in blocks: this is simplest already. Quynh. Aaron --_000_D4DC4473311F2qdangnistgov_ Content-Type: text/html; charset="Windows-1252" Content-ID: <62B4F4EBC219C747A5E248B268771BCD@namprd09.prod.outlook.com> Content-Transfer-Encoding: quoted-printable


From: Aaron Zauner <azet@azet.org>
Date: Wednesday, March 1, 2017 at 9= :24 AM
To: 'Quynh' <Quynh.Dang@nist.gov>
Cc: Sean Turner <sean@sn3rd.com>, "<tls@ietf.org>" <tl= s@ietf.org>, IRTF CFRG <cfrg@irt= f.org>
Subject: Re: [Cfrg] Closing out tls= 1.3 "Limits on key usage" PRs (#765/#769).


On 01 Mar 2017, at 13:18, Dang, Quynh (Fed) <quynh.dang@nist.gov> wrote:
From: Aaron Zauner <azet@azet.org<= /a>>
Date: Wednesday, March 1, 2017 at 8:11 AM
Cc: Sean Turner <sean@sn3rd.com>, "<tls@ietf.org>"= ; <tls@ietf.org>, IRTF CFRG <<= a href=3D"mailto:cfrg@irtf.org">cfrg@irtf.org>
Subject: Re: [Cfrg] Closing out tls1.3 "Limits on key usage"= PRs (#765/#769).
On 25 Feb 2017, at 14:28, Dang, Quynh (Fed) <quynh.dang@nist.gov> wrote:
Hi Sean, Joe, Eric and all,
I would like to address my thoughts/suggestions on 2 issues in option = a.
1) The data limit should be addressed in term of blocks, not records. = When the record size is not the full size, some user might not know what to= do. When the record size is 1 block, the limit of 2^24.5 blocks (records) = is way too low unnecessarily for the margin of 2^-60.  In that case, 2^34.5 1-block records is th= e limit which still achieves the margin of 2^-60.
I respectfully disagree. TLS deals in records not in blocks, so in the= end any semantic change here will just confuse implementors, which isn't a= good idea in my opinion.
Over the discussion of the PRs, the preference was blocks.

I don't see a clear preference. I see Brian Smith suggested switching = to blocks to be more precise in a PR. But in general it seems to me that &q= uot;Option A" was preferred in this thread anyhow - so these PRs aren'= t relevant? I'm not sure that text on key-usage limits in blocks in a spec that fundamentally deals in records is less con= fusing, quite the opposite (at least to me). As I pointed out earlier: I st= rongly recommend that any changes to the spec are as clear als possible to = engineers (non-crypto/math people) -- e.g. why the spec is suddenly dealing in blocks instead of records et c= etera. Again; I really don't see any reason to change text here - to me all= suggested changes are even more confusing.

Hi Aaron,

The  technical reasons I explained are reasons for using records.= I don=92t see how that is confusing.

If you like records, then the record number =3D the total blocks / the= record size in blocks: this is simplest already. 

Quynh.  





Aaron


 --_000_D4DC4473311F2qdangnistgov_-- From nobody Wed Mar 1 06:33:29 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E901D128B44 for ; Wed, 1 Mar 2017 06:33:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id owfO84SFxgG9 for ; Wed, 1 Mar 2017 06:33:26 -0800 (PST) Received: from mail-wm0-x230.google.com (mail-wm0-x230.google.com [IPv6:2a00:1450:400c:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 30BC2129460 for ; Wed, 1 Mar 2017 06:33:24 -0800 (PST) Received: by mail-wm0-x230.google.com with SMTP id u199so37878175wmd.1 for ; Wed, 01 Mar 2017 06:33:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=0qy3Go+isfvFvV61v3CjOA30AHTa/wbpt7gLJVxKfA4=; b=aL6a22vore0QzqO5UBQF/ma7r58nb6arRR2ueMpohpTZAtWVtgf6EXXJblipj0Ei0x leE6dnRvRX6uXSILmeWmo6IIqQAvSoruduI1KzlOrW9wzmrK3aI0mpBFsOCa8YFIqyRw qz+MpCeayBd3fB4OYBkoDMfbdi1PeHoAWSR7KI7fe29KhZqY4jARSJAoSuZ+xVNkvvdG oqVFvuUQYhCgCriG4fGQJPYPPSUTTxC1UQ4DA3NKgXySauoKW8jm99xK/RczUGHHbLfV J0yYA9qNMIXU7gLUCJ3zF7/Bo6sW5Bfcd8EY9HRczDgjBfgpsQc8eToeW0FaIitGNZ2Q QXbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=0qy3Go+isfvFvV61v3CjOA30AHTa/wbpt7gLJVxKfA4=; b=SUaYlXwvTgdtLszQ9KhLNgbOOkkGwFzjY9DQcyG4xjiLyoWW441nKrs9IK+rQ8/QIl ibK1VAbd4CB4rL/QB2R8BmhiAQNKh3L8Cu+zAvC/R04x6mplOzG8Qbs+17kzOwCwOs0B je0MV2n2N2yiE8vCjWYATdvHpEa76tmTP1VLBwCy/i7D575R9zhoyV3EQLzCy4VSZYfA DWpvaEQfeRNl0m06KONkmBohPtLnfGUU9pC30phx6IbfivPegslpjUuq/szFH7kcAYBO NgIjGGTG5NTCP5hFohbmIF29sKO6+GTo53lSXmWi//rBCFgdTjrH5ts+5lBrpKe1pFaa 0Z+Q== X-Gm-Message-State: AMke39lIZK1+NK8ZPvJBvyggfaCByqueQoqRnS1XnF4rTKCg95s0k6E+Tc+65LO3utP+aQ== X-Received: by 10.28.22.18 with SMTP id 18mr3845850wmw.126.1488378802593; Wed, 01 Mar 2017 06:33:22 -0800 (PST) Received: from [172.24.249.232] (dyn32-131.checkpoint.com. [194.29.32.131]) by smtp.gmail.com with ESMTPSA id h75sm6837134wrh.37.2017.03.01.06.33.21 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 01 Mar 2017 06:33:21 -0800 (PST) From: Yoav Nir Message-Id: <6DC0788D-5A86-46EB-AB59-F7D4161EAEF9@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_B7285D4F-81C8-40C5-A54F-71BE24494BC8"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Wed, 1 Mar 2017 16:33:19 +0200 In-Reply-To: To: Rich Salz References: <20170222171156.GA31015@LK-Perkele-V2.elisa-laajakaista.fi> <1CAE4CFE-2A9D-4A8D-93D4-2BA304894F96@gmail.com> <91c7562e92814e3a9ebb57dfa6c59610@usma1ex-dag1mb1.msg.corp.akamai.com> <20170301135754.GA16901@bolet.org> X-Mailer: Apple Mail (2.3259) Archived-At: Cc: "draft-ietf-tls-ecdhe-psk-aead@tools.ietf.org" , "tls@ietf.org" Subject: Re: [TLS] Last call comments and WG Chair review of draft-ietf-tls-ecdhe-psk-aead X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 14:33:28 -0000 --Apple-Mail=_B7285D4F-81C8-40C5-A54F-71BE24494BC8 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii And they all cost 10 cents a piece, never get updated, and control the = floodgates that hold back the biblical flood. > On 1 Mar 2017, at 16:28, Salz, Rich wrote: >=20 > You know what amazes about IoT? No matter what someone tries to do = there is a chip/SoC out there that can't do it. >=20 > Shrug. >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls --Apple-Mail=_B7285D4F-81C8-40C5-A54F-71BE24494BC8 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYttuwAAoJELhJCxUKWMyZYr4H/jno7b4QGZvW0f7M0ZSsIBtj 29c8ChKTPmlyl6D4A8HjOtBW0U2u88zHieBIDTK/oAHMgIozkRBARwsIu7RfF4R5 dGOspuMc6CNtyJQ92RkOMVIDa+avctpZpT6OZ8YhF6XvsHv2akPSD6vgP54L8Trz DEK+l41QZnvfWUr6dk5yqEae5A5vHbg9mgwPrCQCV75fh1ZdQLzpga6vKXlp32oi Yz2/ZwXS8iX298f9ssHDLVtP96dHWdrElOndRx1WUmQk5iCbot534izPZ8MIXsy8 XbZCgzDHB2ZDsHfVZX8jCkUCUTYZB5IsdPGOBa6jx/jvUN2U1jtihd5dJqRZFqM= =wGbd -----END PGP SIGNATURE----- --Apple-Mail=_B7285D4F-81C8-40C5-A54F-71BE24494BC8-- From nobody Wed Mar 1 06:35:28 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B18D1294E0 for ; Wed, 1 Mar 2017 06:35:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=azet.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rZC2e6KkkiL9 for ; Wed, 1 Mar 2017 06:35:25 -0800 (PST) Received: from mail-wm0-x22d.google.com (mail-wm0-x22d.google.com [IPv6:2a00:1450:400c:c09::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9782B1293E0 for ; Wed, 1 Mar 2017 06:35:25 -0800 (PST) Received: by mail-wm0-x22d.google.com with SMTP id u199so37928585wmd.1 for ; Wed, 01 Mar 2017 06:35:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=azet.org; s=gmail; h=subject:mime-version:from:in-reply-to:date:cc:message-id:references :to; bh=CShkxmpa0M7dVygEplHVHFSZmvV6++NN7ZcuNx0kOlA=; b=Ir5B3ip20afs1TV3pQ3vV2RmNLOhUYCjZsz0O9i4dzPe6jCny0r35u/a6iaGAEzPdb 65nJTqsjG9fmWYJ6hM+vP8MSwTKB5LqI3/5TlURKomUjj/GkkO17IitKc3xFSmSu87IF CSAlUu5/txFVksTwCGcEyLnePzrwQKnR0p7wE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:mime-version:from:in-reply-to:date:cc :message-id:references:to; bh=CShkxmpa0M7dVygEplHVHFSZmvV6++NN7ZcuNx0kOlA=; b=FBKxWSHyLT8T9qaBcVZ32Vjhw2fMCBJY7zUviy4sQya0wUN7Utr7QfkmRanBKBUnfE tb1cROwSryQXKCYMZbedkJh/gVtYuk40HdJF0utbPZE3X/fefc90KLmRto5ltcNgN5/J XQnYvNbbcRhXAVrvcPVPGNcg9nze1uWuJUj6vlFbXMsUNRanMi0f/kQhQ/5YHYaOsAqU Qwx214ShgvfbUTVkZQwgZxnT6GTU/R2iTUCEbCLJNcOs44yj3Fpghx4jbigTmutz3vfo uGxWN8l5FBJcfrYU81tOG58EMEDK+xl2lUAkIoyYrke6hU4aVY98ZdWSE1W7uY/w5kcA oZhw== X-Gm-Message-State: AMke39nzG2H44aSt75oEJ4z8cAYDb0468yJS2CfQNM7Z0+wmdgemEp1VLCgqX4BCowftuw== X-Received: by 10.28.57.131 with SMTP id g125mr3596894wma.33.1488378924020; Wed, 01 Mar 2017 06:35:24 -0800 (PST) Received: from [192.168.1.121] ([160.178.204.57]) by smtp.gmail.com with ESMTPSA id d6sm23120173wmd.6.2017.03.01.06.35.16 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 01 Mar 2017 06:35:23 -0800 (PST) Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) Content-Type: multipart/signed; boundary="Apple-Mail=_8BF68E03-ECBD-4CD4-B762-DA92D3E2B615"; protocol="application/pgp-signature"; micalg=pgp-sha512 X-Pgp-Agent: GPGMail From: Aaron Zauner In-Reply-To: Date: Wed, 1 Mar 2017 14:35:11 +0000 Message-Id: References: <20170222171156.GA31015@LK-Perkele-V2.elisa-laajakaista.fi> <1CAE4CFE-2A9D-4A8D-93D4-2BA304894F96@gmail.com> <91c7562e92814e3a9ebb57dfa6c59610@usma1ex-dag1mb1.msg.corp.akamai.com> To: Yoav Nir X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "draft-ietf-tls-ecdhe-psk-aead@tools.ietf.org" , "tls@ietf.org" Subject: Re: [TLS] Last call comments and WG Chair review of draft-ietf-tls-ecdhe-psk-aead X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 14:35:27 -0000 --Apple-Mail=_8BF68E03-ECBD-4CD4-B762-DA92D3E2B615 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On 01 Mar 2017, at 14:29, Yoav Nir wrote: >=20 >=20 >> On 1 Mar 2017, at 15:06, Aaron Zauner wrote: >>=20 >>=20 >>> On 24 Feb 2017, at 14:07, Salz, Rich wrote: >>>=20 >>>> Assuming 256-bit AES-CCM suites are needed, I think the better = place to put >>>> them is in the TLS 1.3 document. >>>=20 >>> That's a really big assumption. ;) >>>=20 >>> I think the burden is on folks to *prove* (yeah, I know) that = additional cipher suites are needed. >>=20 >> +1. I'm against adding CCM based suites to the TLS 1.3 spec. >=20 > Hold on. CCM with a 128-bit key suites are already in the current = version of the spec. CCM with a 256-bit key suites are not. >=20 > Are you advocating just not adding the 256-bit key ciphersuites, or = removing those already in? Both. I don't see why we need to keep legacy cruft around in a new = protocol because of some embedded corner case, sorry. Also, OCB would be much faster as it's is a single-pass scheme (and all = patent restrictions that had been the reason CCM was initially invented = anyway have been resolved for TLS), but for the sake of not ending up = with countless cipher-suites again I'm not advocating adding that = either. Also: what Rich Salz said. Aaron --Apple-Mail=_8BF68E03-ECBD-4CD4-B762-DA92D3E2B615 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJYttwgAAoJEOTbZJL9ubXVMvIP/Rt2Q3D/QzYfroppJcxxgxtV yq8m9T4O6OfEyB9rZDEuROm3tMSJYMBkNxqRkYVorGVqvOlAU88JGLlm+XEyu2Ez yiksz8P1u90SNxAhGM4cU+AVTxv2zUCISYXdvyaFfOQ4kN6vO/gQrIDZ++hgYqtX iLVpNVJ/kI/zDmCd8E1T5tEWCkPwC14HhvUiESmuIISq2rUyWzyj/FYUKO0BAkTz dMQbMBpSTaoozxud03o6QmWALeib+LVx8KkISgcdFQg+VsVooj7yU/HMhLkRLS8h pb1l08mMlDsgjnWWylWVTRTU910uHcvnSciUMx73whzfu2f6DeoZMay1ulgoerDh GMzUdEV35/hNZLw+rZzdWn5390myZu5JtZSniLD22HzPCr1XNJaQ1Mf5sUxLUYNL VBYOI9qR3mqFGvxMbGMRJnXpUHsxQi7l9wEaWzSq70SKLXAcfmWYKkeL94t0e//D Ub6Bo5q1OdQCkxyN6FkZue9c5QuQNwL9NNhgKfpMnZH4KvvJYP57d0i/vKG+9rJW bYWbz+c490Lr1wVwYE5QDSGjG/xPAYIrcWLw+irO8mlAd87QE8876ZG6NhhmMVM7 zwii3bAGoeX3LtTPcnLv1J1jreusIB/uJU+rxH2NkpPTInGSUGnTtH07YW7ZU3oz Hu+D//noADGd1xv6EDFo =tLj7 -----END PGP SIGNATURE----- --Apple-Mail=_8BF68E03-ECBD-4CD4-B762-DA92D3E2B615-- From nobody Wed Mar 1 06:38:11 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5AF1B12948F for ; Wed, 1 Mar 2017 06:38:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.92 X-Spam-Level: X-Spam-Status: No, score=-1.92 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=rhul.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8EjZbhc0SyLD for ; Wed, 1 Mar 2017 06:38:08 -0800 (PST) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-ve1eur01on0071.outbound.protection.outlook.com [104.47.1.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 661FF129476 for ; Wed, 1 Mar 2017 06:38:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rhul.onmicrosoft.com; s=selector1-rhul-ac-uk; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=P9i0mCP6vGjwxggAbO+vsotzgjbmLCuISYVIWWdGU/c=; b=Q6e7xcuPBlbUx7GwdV6Exb6FitYH2/tUls2LF1tI0plBjfeRMzHihvF63vI5CCHCuRErXekN0glE2baokpfle7Pe77Qm2al1i+VsimC+Q4505Pfw0cX3wYWotxBHTfl0Z+mU4KaRTxFYz94tCxiO9kG5Ka/kRSA39EUl7Od8s+8= Received: from HE1PR0301MB1916.eurprd03.prod.outlook.com (10.167.188.8) by HE1PR0301MB1913.eurprd03.prod.outlook.com (10.167.187.155) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.933.12; Wed, 1 Mar 2017 14:38:04 +0000 Received: from HE1PR0301MB1916.eurprd03.prod.outlook.com ([10.167.188.8]) by HE1PR0301MB1916.eurprd03.prod.outlook.com ([10.167.188.8]) with mapi id 15.01.0933.020; Wed, 1 Mar 2017 14:38:04 +0000 From: "Paterson, Kenny" To: "Dang, Quynh (Fed)" , Aaron Zauner Thread-Topic: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). Thread-Index: AQHSkplvWMtDYzfg7Eqo+yVbFyANhQ== Date: Wed, 1 Mar 2017 14:38:04 +0000 Message-ID: References: <352D31A3-5A8B-4790-9473-195C256DEEC8@sn3rd.com> <26137F3B-5655-44CA-877E-7168CE02DBF1@azet.org> <2572E3FC-0139-4946-A12D-9D9509C402F1@azet.org> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.1.161129 authentication-results: nist.gov; dkim=none (message not signed) header.d=none;nist.gov; dmarc=none action=none header.from=rhul.ac.uk; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [118.7.148.183] x-microsoft-exchange-diagnostics: 1; HE1PR0301MB1913; 7:FDHJwklbiyuFwGPDyLZ1xFrnb9JN/9xrzFN9iUwVPV7SkB7oE55/ByPyIBL2H06okEfKSBIfaPAQ7s/UD07Nr/FkQFxjDNcCmVyqeJ7SwBF8ri7MwCWZQocsFOjY5UIVmQ2/I38HA3ThKJXUYIP8gm7EPcyTmneU7e2sR2jZF2BkMZNLAStDd7yoj7qRlcYUWGG0yJ6hj6FOF/RgFbk9qqDyaL5+V/a0t15WTHd0lTiaAIPbsrmf4Zz3RqPlgwjfLfYcWfg51zUlanJ+yBNeZ5kA9UGv/dMIrF+NeZ3zMaIM6cLAfa0E49YyEReEfYm6hSFvnYF4D4sOwLXr9Ibiww== x-forefront-antispam-report: SFV:SKI; SCL:-1SFV:NSPM; SFS:(10009020)(6009001)(7916002)(39450400003)(24454002)(377454003)(6436002)(74482002)(66066001)(54906002)(83506001)(93886004)(25786008)(53936002)(86362001)(7736002)(8676002)(53546006)(6486002)(38730400002)(2950100002)(5660300001)(42882006)(77096006)(2900100001)(92566002)(6506006)(50986999)(6512007)(106116001)(3846002)(76176999)(54356999)(6246003)(102836003)(6116002)(229853002)(189998001)(8656002)(81166006)(99286003)(8936002)(3660700001)(3280700002)(122556002)(2906002)(36756003)(4326008)(305945005); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0301MB1913; H:HE1PR0301MB1916.eurprd03.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; x-ms-office365-filtering-correlation-id: c2659d18-a81b-458f-e98d-08d460b091cf x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001); SRVR:HE1PR0301MB1913; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(65766998875637); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6041248)(20161123562025)(20161123558025)(20161123555025)(20161123564025)(20161123560025)(6072148); SRVR:HE1PR0301MB1913; BCL:0; PCL:0; RULEID:; SRVR:HE1PR0301MB1913; x-forefront-prvs: 0233768B38 spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: rhul.ac.uk X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Mar 2017 14:38:04.2446 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2efd699a-1922-4e69-b601-108008d28a2e X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0301MB1913 Archived-At: Cc: IRTF CFRG , "" Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 14:38:10 -0000 SGksDQoNCk9uIDAxLzAzLzIwMTcgMTQ6MzEsICJUTFMgb24gYmVoYWxmIG9mIERhbmcsIFF1eW5o IChGZWQpIg0KPHRscy1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBxdXluaC5kYW5nQG5p c3QuZ292PiB3cm90ZToNCj5Gcm9tOiBBYXJvbiBaYXVuZXIgPGF6ZXRAYXpldC5vcmc+DQo+RGF0 ZTogV2VkbmVzZGF5LCBNYXJjaCAxLCAyMDE3IGF0IDk6MjQgQU0NCj5UbzogJ1F1eW5oJyA8UXV5 bmguRGFuZ0BuaXN0Lmdvdj4NCj5DYzogU2VhbiBUdXJuZXIgPHNlYW5Ac24zcmQuY29tPiwgIjx0 bHNAaWV0Zi5vcmc+IiA8dGxzQGlldGYub3JnPiwgSVJURg0KPkNGUkcgPGNmcmdAaXJ0Zi5vcmc+ DQo+U3ViamVjdDogUmU6IFtDZnJnXSBDbG9zaW5nIG91dCB0bHMxLjMgIkxpbWl0cyBvbiBrZXkg dXNhZ2UiIFBScw0KPigjNzY1LyM3NjkpLg0KPg0KPg0KPg0KPj4NCj4+DQo+Pj5PbiAwMSBNYXIg MjAxNywgYXQgMTM6MTgsIERhbmcsIFF1eW5oIChGZWQpIDxxdXluaC5kYW5nQG5pc3QuZ292PiB3 cm90ZToNCj4+PkZyb206IEFhcm9uIFphdW5lciA8YXpldEBhemV0Lm9yZz4NCj4+PkRhdGU6IFdl ZG5lc2RheSwgTWFyY2ggMSwgMjAxNyBhdCA4OjExIEFNDQo+Pj5UbzogJ1F1eW5oJyA8UXV5bmgu RGFuZ0BuaXN0Lmdvdj4NCj4+PkNjOiBTZWFuIFR1cm5lciA8c2VhbkBzbjNyZC5jb20+LCAiPHRs c0BpZXRmLm9yZz4iIDx0bHNAaWV0Zi5vcmc+LCBJUlRGDQo+Pj5DRlJHIDxjZnJnQGlydGYub3Jn Pg0KPj4+U3ViamVjdDogUmU6IFtDZnJnXSBDbG9zaW5nIG91dCB0bHMxLjMgIkxpbWl0cyBvbiBr ZXkgdXNhZ2UiIFBScw0KPj4+KCM3NjUvIzc2OSkuDQo+Pj4+Pk9uIDI1IEZlYiAyMDE3LCBhdCAx NDoyOCwgRGFuZywgUXV5bmggKEZlZCkgPHF1eW5oLmRhbmdAbmlzdC5nb3Y+DQo+Pj4+Pndyb3Rl Og0KPj4+Pj5IaSBTZWFuLCBKb2UsIEVyaWMgYW5kIGFsbCwNCj4+Pj4+SSB3b3VsZCBsaWtlIHRv IGFkZHJlc3MgbXkgdGhvdWdodHMvc3VnZ2VzdGlvbnMgb24gMiBpc3N1ZXMgaW4gb3B0aW9uDQo+ Pj4+PmEuDQo+Pj4+PjEpIFRoZSBkYXRhIGxpbWl0IHNob3VsZCBiZSBhZGRyZXNzZWQgaW4gdGVy bSBvZiBibG9ja3MsIG5vdCByZWNvcmRzLg0KPj4+Pj5XaGVuIHRoZSByZWNvcmQgc2l6ZSBpcyBu b3QgdGhlIGZ1bGwgc2l6ZSwgc29tZSB1c2VyIG1pZ2h0IG5vdCBrbm93DQo+Pj4+PndoYXQgdG8g ZG8uIFdoZW4gdGhlIHJlY29yZCBzaXplIGlzIDEgYmxvY2ssIHRoZSBsaW1pdCBvZiAyXjI0LjUN Cj4+Pj4+YmxvY2tzIChyZWNvcmRzKSBpcyB3YXkgdG9vIGxvdyB1bm5lY2Vzc2FyaWx5IGZvcg0K Pj4+Pj4gdGhlIG1hcmdpbiBvZiAyXi02MC4gIEluIHRoYXQgY2FzZSwgMl4zNC41IDEtYmxvY2sg cmVjb3JkcyBpcyB0aGUNCj4+Pj4+bGltaXQgd2hpY2ggc3RpbGwgYWNoaWV2ZXMgdGhlIG1hcmdp biBvZiAyXi02MC4NCj4+Pj5JIHJlc3BlY3RmdWxseSBkaXNhZ3JlZS4gVExTIGRlYWxzIGluIHJl Y29yZHMgbm90IGluIGJsb2Nrcywgc28gaW4gdGhlDQo+Pj4+ZW5kIGFueSBzZW1hbnRpYyBjaGFu Z2UgaGVyZSB3aWxsIGp1c3QgY29uZnVzZSBpbXBsZW1lbnRvcnMsIHdoaWNoDQo+Pj4+aXNuJ3Qg YSBnb29kIGlkZWEgaW4gbXkgb3Bpbmlvbi4NCj4+Pk92ZXIgdGhlIGRpc2N1c3Npb24gb2YgdGhl IFBScywgdGhlIHByZWZlcmVuY2Ugd2FzIGJsb2Nrcy4NCj4+DQo+Pg0KPj5JIGRvbid0IHNlZSBh IGNsZWFyIHByZWZlcmVuY2UuIEkgc2VlIEJyaWFuIFNtaXRoIHN1Z2dlc3RlZCBzd2l0Y2hpbmcg dG8NCj4+YmxvY2tzIHRvIGJlIG1vcmUgcHJlY2lzZSBpbiBhIFBSLiBCdXQgaW4gZ2VuZXJhbCBp dCBzZWVtcyB0byBtZSB0aGF0DQo+PiJPcHRpb24gQSIgd2FzIHByZWZlcnJlZCBpbiB0aGlzIHRo cmVhZCBhbnlob3cgLSBzbyB0aGVzZSBQUnMgYXJlbid0DQo+PnJlbGV2YW50PyBJJ20gbm90IHN1 cmUgdGhhdCB0ZXh0IG9uIGtleS11c2FnZQ0KPj4gbGltaXRzIGluIGJsb2NrcyBpbiBhIHNwZWMg dGhhdCBmdW5kYW1lbnRhbGx5IGRlYWxzIGluIHJlY29yZHMgaXMgbGVzcw0KPj5jb25mdXNpbmcs IHF1aXRlIHRoZSBvcHBvc2l0ZSAoYXQgbGVhc3QgdG8gbWUpLiBBcyBJIHBvaW50ZWQgb3V0DQo+ PmVhcmxpZXI6IEkgc3Ryb25nbHkgcmVjb21tZW5kIHRoYXQgYW55IGNoYW5nZXMgdG8gdGhlIHNw ZWMgYXJlIGFzIGNsZWFyDQo+PmFscyBwb3NzaWJsZSB0byBlbmdpbmVlcnMgKG5vbi1jcnlwdG8v bWF0aCBwZW9wbGUpDQo+PiAtLSBlLmcuIHdoeSB0aGUgc3BlYyBpcyBzdWRkZW5seSBkZWFsaW5n IGluIGJsb2NrcyBpbnN0ZWFkIG9mIHJlY29yZHMNCj4+ZXQgY2V0ZXJhLiBBZ2FpbjsgSSByZWFs bHkgZG9uJ3Qgc2VlIGFueSByZWFzb24gdG8gY2hhbmdlIHRleHQgaGVyZSAtIHRvDQo+Pm1lIGFs bCBzdWdnZXN0ZWQgY2hhbmdlcyBhcmUgZXZlbiBtb3JlIGNvbmZ1c2luZy4NCj4+DQo+Pg0KPg0K Pg0KPkhpIEFhcm9uLA0KPg0KPg0KPlRoZSAgdGVjaG5pY2FsIHJlYXNvbnMgSSBleHBsYWluZWQg YXJlIHJlYXNvbnMgZm9yIHVzaW5nIHJlY29yZHMuIEkgZG9u4oCZdA0KPnNlZSBob3cgdGhhdCBp cyBjb25mdXNpbmcuDQo+DQo+DQo+SWYgeW91IGxpa2UgcmVjb3JkcywgdGhlbiB0aGUgcmVjb3Jk IG51bWJlciA9IHRoZSB0b3RhbCBibG9ja3MgLyB0aGUNCj5yZWNvcmQgc2l6ZSBpbiBibG9ja3M6 IHRoaXMgaXMgc2ltcGxlc3QgYWxyZWFkeS4NCj4NCg0KVGhhdCBmb3JtdWxhIGRvZXMgbm90IGNv cnJlY3RseSBjb21wdXRlIGhvdyBtYW55IHJlY29yZHMgaGF2ZSBiZWVuIHNlbnQgb24NCmEgY29u bmVjdGlvbiwgYmVjYXVzZSB0aGUgcmVjb3JkIHNpemUgaW4gYmxvY2tzIGlzIHZhcmlhYmxlLCBu b3QgY29uc3RhbnQuDQpZb3UgY2FuIG1vZGlmeSBpdCB0byBnZXQgYm91bmRzIG9uIHRoZSB0b3Rh bCBudW1iZXIgb2YgcmVjb3JkcyBzZW50LCBidXQNCnRoZSBib3VuZHMgYXJlIHNsb3BweSBiZWNh dXNlIHNvbWUgcmVjb3JkcyBvbmx5IGNvbnN1bWUgMiBibG9ja3MgKG9uZSBmb3INCmVuY3J5cHRp b24sIG9uZSBmb3IgbWFza2luZyBpbiBHSEFTSCkgd2hpbGUgc29tZSBjb25zdW1lIGZhciBtb3Jl Lg0KDQpJdCdzIHNpbXBsZXIgZm9yIGFuIGltcGxlbWVudGF0aW9uIHRvIGNvdW50IGhvdyBtYW55 IHJlY29yZHMgaGF2ZSBiZWVuDQpzZW50IG9uIGEgY29ubmVjdGlvbiAuLi4uIGJ5IHVzaW5nIHRo ZSBjb25uZWN0aW9uJ3Mgc2VxdWVuY2UgbnVtYmVyLiBUaGlzDQpwdXRzIGxlc3MgYnVyZGVuIG9u IHRoZSBpbXBsZW1lbnRhdGlvbi9pbXBsZW1lbnRlci4NCg0KQ2hlZXJzDQoNCktlbm55IA0KDQoN Cg== From nobody Wed Mar 1 06:48:41 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 092541294D6 for ; Wed, 1 Mar 2017 06:48:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h0IS1k88v8q2 for ; Wed, 1 Mar 2017 06:48:38 -0800 (PST) Received: from gcc01-CY1-obe.outbound.protection.outlook.com (mail-cy1gcc01on0097.outbound.protection.outlook.com [23.103.200.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 296B41294A3 for ; Wed, 1 Mar 2017 06:48:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=bLv61Wtg4Svazk8WLu3tH4b3nL9WJLz46ZVIoYhzRn0=; b=AHz+vLxleJrH1VngnmE8T/U4ENzv4MZhq0ALzsaV/ASTAzxjmmU+76iiZ7RtbfpKBktaJ4m2pr3pTOdMf+6fqxllnYGcqa7H4I4g7zpO730H4owkEyGpigsgvp5SzlzjDwdjwxBODLBPk1MQXJgYHJIwNSI+iEc+sVBXPMKphCw= Received: from CY4PR09MB1464.namprd09.prod.outlook.com (10.173.191.22) by CY4PR09MB1461.namprd09.prod.outlook.com (10.173.191.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.933.12; Wed, 1 Mar 2017 14:48:37 +0000 Received: from CY4PR09MB1464.namprd09.prod.outlook.com ([10.173.191.22]) by CY4PR09MB1464.namprd09.prod.outlook.com ([10.173.191.22]) with mapi id 15.01.0933.016; Wed, 1 Mar 2017 14:48:36 +0000 From: "Dang, Quynh (Fed)" To: "Paterson, Kenny" , "Dang, Quynh (Fed)" , Aaron Zauner Thread-Topic: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). Thread-Index: AQHSj3N1z8IXvDyfJEuMUkRo/k0w1KF/+8GA//+uQQCAAGYzgP//rheAgABVqwD//68bAA== Date: Wed, 1 Mar 2017 14:48:36 +0000 Message-ID: References: <352D31A3-5A8B-4790-9473-195C256DEEC8@sn3rd.com> <26137F3B-5655-44CA-877E-7168CE02DBF1@azet.org> <2572E3FC-0139-4946-A12D-9D9509C402F1@azet.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.1.161129 authentication-results: rhul.ac.uk; dkim=none (message not signed) header.d=none;rhul.ac.uk; dmarc=none action=none header.from=nist.gov; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [129.6.105.150] x-microsoft-exchange-diagnostics: 1; CY4PR09MB1461; 7:AA82+RjZZ4p+C2u8Rsb/4F6pYO/Z8Eh4yTnzWeexjQc5hLnjSU6qlUMw5+0aEZO2LS7ajIWxHKuPwMItfSrvqabQ2WD7SPjJHGvYajmIDWr90Y8CUhjDVWqnkfHYdLfCVdpc9cW0XqxAGecoiTiruZATQojS0/bIqXnFNoEBaTIx9CPGPJXJPNLOhZ1H3HPWnnQp8JC12UC/R59HQsKd8I6IHftzP19opGkOHimRFACDHtA7fcMNsefSLu/goQLZvct60BrLzxE2Ib/KlATbaCf+6kf4BDYbMjjSEOcr08TqI1A9tmRy/rjpSS3ErhnwU+QDaEaOBMzsudVJyq5xPA== x-forefront-antispam-report: SFV:SKI; SCL:-1SFV:NSPM; SFS:(10019020)(7916002)(39850400002)(39410400002)(39860400002)(39840400002)(39450400003)(24454002)(377454003)(6246003)(7736002)(86362001)(8656002)(54356999)(93886004)(76176999)(6486002)(50986999)(53936002)(2950100002)(4326008)(5660300001)(189998001)(38730400002)(106116001)(53546006)(3660700001)(102836003)(77096006)(2906002)(83506001)(66066001)(2900100001)(6436002)(6506006)(122556002)(229853002)(36756003)(8676002)(8936002)(92566002)(3846002)(236005)(6116002)(99286003)(54906002)(54896002)(6512007)(81166006)(25786008)(3280700002); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR09MB1461; H:CY4PR09MB1464.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; x-ms-office365-filtering-correlation-id: a2f78698-ee32-40ba-28d6-08d460b20ab1 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR09MB1461; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(65766998875637); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6055026)(6041248)(20161123555025)(20161123562025)(20161123564025)(20161123560025)(20161123558025)(6072148); SRVR:CY4PR09MB1461; BCL:0; PCL:0; RULEID:; SRVR:CY4PR09MB1461; x-forefront-prvs: 0233768B38 spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_D4DC48E231204qdangnistgov_" MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Mar 2017 14:48:36.2847 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR09MB1461 Archived-At: Cc: IRTF CFRG , "" Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 14:48:40 -0000 --_000_D4DC48E231204qdangnistgov_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable From: "Paterson, Kenny" > Date: Wednesday, March 1, 2017 at 9:38 AM To: 'Quynh' >, Aaron Zauner= > Cc: IRTF CFRG >, ">" > Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#76= 5/#769). Hi, On 01/03/2017 14:31, "TLS on behalf of Dang, Quynh (Fed)" on behalf of quynh.dang@= nist.gov> wrote: From: Aaron Zauner > Date: Wednesday, March 1, 2017 at 9:24 AM To: 'Quynh' > Cc: Sean Turner >, ">" >, IRTF CFRG > Subject: Re: [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). On 01 Mar 2017, at 13:18, Dang, Quynh (Fed) > wrote: From: Aaron Zauner > Date: Wednesday, March 1, 2017 at 8:11 AM To: 'Quynh' > Cc: Sean Turner >, ">" >, IRTF CFRG > Subject: Re: [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). On 25 Feb 2017, at 14:28, Dang, Quynh (Fed) > wrote: Hi Sean, Joe, Eric and all, I would like to address my thoughts/suggestions on 2 issues in option a. 1) The data limit should be addressed in term of blocks, not records. When the record size is not the full size, some user might not know what to do. When the record size is 1 block, the limit of 2^24.5 blocks (records) is way too low unnecessarily for the margin of 2^-60. In that case, 2^34.5 1-block records is the limit which still achieves the margin of 2^-60. I respectfully disagree. TLS deals in records not in blocks, so in the end any semantic change here will just confuse implementors, which isn't a good idea in my opinion. Over the discussion of the PRs, the preference was blocks. I don't see a clear preference. I see Brian Smith suggested switching to blocks to be more precise in a PR. But in general it seems to me that "Option A" was preferred in this thread anyhow - so these PRs aren't relevant? I'm not sure that text on key-usage limits in blocks in a spec that fundamentally deals in records is less confusing, quite the opposite (at least to me). As I pointed out earlier: I strongly recommend that any changes to the spec are as clear als possible to engineers (non-crypto/math people) -- e.g. why the spec is suddenly dealing in blocks instead of records et cetera. Again; I really don't see any reason to change text here - to me all suggested changes are even more confusing. Hi Aaron, The technical reasons I explained are reasons for using records. I don=92t see how that is confusing. If you like records, then the record number =3D the total blocks / the record size in blocks: this is simplest already. That formula does not correctly compute how many records have been sent on a connection, because the record size in blocks is variable, not constant. You can modify it to get bounds on the total number of records sent, but the bounds are sloppy because some records only consume 2 blocks (one for encryption, one for masking in GHASH) while some consume far more. It's simpler for an implementation to count how many records have been sent on a connection .... by using the connection's sequence number. This puts less burden on the implementation/implementer. I think the record size is configurable and it does not change regularly in= the same session (or connection). Somebody corrects me here! Quynh. Cheers Kenny --_000_D4DC48E231204qdangnistgov_ Content-Type: text/html; charset="Windows-1252" Content-ID: <33123FDCE82F2B4E9BFAEE9561EF5730@namprd09.prod.outlook.com> Content-Transfer-Encoding: quoted-printable


From: "Paterson, Kenny" &= lt;Kenny.Paterson@rhul.ac.uk>
Date: Wednesday, March 1, 2017 at 9= :38 AM
To: 'Quynh' <Quynh.Dang@nist.gov>, Aaron Zauner <azet@azet.org>
Cc: IRTF CFRG <cfrg@irtf.org>, "<tls@ietf.org>" <tls@ie= tf.org>
Subject: Re: [TLS] [Cfrg] Closing o= ut tls1.3 "Limits on key usage" PRs (#765/#769).

Hi,

On 01/03/2017 14:31, "TLS on behalf of Dang, Quynh (Fed)"
<tls-bounces@ietf.org o= n behalf of quynh.dang@nist.gov> wrote:
From: Aaron Zauner <azet@azet.org<= /a>>
Date: Wednesday, March 1, 2017 at 9:24 AM
Cc: Sean Turner <sean@sn3rd.com>, "<tls@ietf.org>"= ; <tls@ietf.org>, IRTF
Subject: Re: [Cfrg] Closing out tls1.3 "Limits on key usage"= PRs
(#765/#769).





On 01 Mar 2017, at 13:18, Dang, Quynh (Fed) <quynh.dang@nist.gov> wrote:
From: Aaron Zauner <azet@azet.org<= /a>>
Date: Wednesday, March 1, 2017 at 8:11 AM
Cc: Sean Turner <sean@sn3rd.com>, "<tls@ietf.org>"= ; <tls@ietf.org>, IRTF
Subject: Re: [Cfrg] Closing out tls1.3 "Limits on key usage"= PRs
(#765/#769).
On 25 Feb 2017, at 14:28, Dang, Quynh (Fed) <quynh.dang@nist.gov>
wrote:
Hi Sean, Joe, Eric and all,
I would like to address my thoughts/suggestions on 2 issues in option<= /div>
a.
1) The data limit should be addressed in term of blocks, not records.<= /div>
When the record size is not the full size, some user might not know
what to do. When the record size is 1 block, the limit of 2^24.5
blocks (records) is way too low unnecessarily for
the margin of 2^-60.  In that case, 2^34.5 1-block records i= s the
limit which still achieves the margin of 2^-60.
I respectfully disagree. TLS deals in records not in blocks, so in the=
end any semantic change here will just confuse implementors, which
isn't a good idea in my opinion.
Over the discussion of the PRs, the preference was blocks.


I don't see a clear preference. I see Brian Smith suggested switching = to
blocks to be more precise in a PR. But in general it seems to me that<= /div>
"Option A" was preferred in this thread anyhow - so these PR= s aren't
relevant? I'm not sure that text on key-usage
limits in blocks in a spec that fundamentally deals in records is less=
confusing, quite the opposite (at least to me). As I pointed out
earlier: I strongly recommend that any changes to the spec are as clea= r
als possible to engineers (non-crypto/math people)
-- e.g. why the spec is suddenly dealing in blocks instead of records<= /div>
et cetera. Again; I really don't see any reason to change text here - = to
me all suggested changes are even more confusing.




Hi Aaron,


The  technical reasons I explained are reasons for using rec= ords. I don=92t
see how that is confusing.


If you like records, then the record number =3D the total blocks / the=
record size in blocks: this is simplest already.


That formula does not correctly compute how many records have been sen= t on
a connection, because the record size in blocks is variable, not const= ant.
You can modify it to get bounds on the total number of records sent, b= ut
the bounds are sloppy because some records only consume 2 blocks (one = for
encryption, one for masking in GHASH) while some consume far more.

It's simpler for an implementation to count how many records have been=
sent on a connection .... by using the connection's sequence number. T= his
puts less burden on the implementation/implementer.

I think the record size is configurable and it does not change regular= ly in the same session (or connection).  Somebody corrects me here!&nb= sp;

Quynh. 



Cheers

Kenny



--_000_D4DC48E231204qdangnistgov_-- From nobody Wed Mar 1 10:37:06 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6934012964E for ; Wed, 1 Mar 2017 10:37:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.698 X-Spam-Level: X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MMMVHvoE51tG for ; Wed, 1 Mar 2017 10:36:59 -0800 (PST) Received: from mail-wm0-x22a.google.com (mail-wm0-x22a.google.com [IPv6:2a00:1450:400c:c09::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 73016129444 for ; Wed, 1 Mar 2017 10:36:59 -0800 (PST) Received: by mail-wm0-x22a.google.com with SMTP id u199so43607037wmd.1 for ; Wed, 01 Mar 2017 10:36:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=u/zHggTYzfNirQVlKzJwj+TEM4D6LxIhVdKeKly5QQU=; b=rO7X1N66J3AE5uTmb9P7Z7RqX6tWi4gMsDzf7+iHHoFGDQMJgh/6D4FNoOTYC6f+sI oQFm6LlVEBrgmgQ6/Li4mhTGk3K0ouvq1fhuGhADv5KUZWn6Oq0neC2xYjClHR4Q6VzO SDBw6oC/UHeLIB9Zfgen1D6mbvjPBZpfynw7x6R4lzZf9sND7Zr8u68rYXZ8olwvMfIi CKxu++ePyf8TEBo7it/aWGbZxdbzolLmc7IYkQzs376OmlNqpEQwYjmqmthfu4jzrS1n xMpFT6QXqPhP0tg/g3vusLlF0r5/7UoXxGzaiWKy2c/yoPmBwC3+tcwKrbsKcDgkTmmN EC3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=u/zHggTYzfNirQVlKzJwj+TEM4D6LxIhVdKeKly5QQU=; b=X5iaPzqbX8fDvnDsDGrmIq76LsgV79sVFMW4U5Sz+N4ESMEIghxInSkyTXaqdTApCn zA/gjsViqAKKRIit2Q8YXJEy6BTQibTyFsiVYwvFnpsIBg9nG+tGpw0Dv1gYAhMUlxTB MfpUrG9jiw0muRvQXuZkU6sQuH3gY8hXSQgF9k4Rn2N9cuazlG3LiOoRUXH80Vl/X77u j+4aof362+qrshjdr2JkaPqf2GDsc5Ww6z5161ZfHPAiXk/aOM/MjFvZx1l8UJ7fxiUm Tl9U+Iy4kSge7kVEGhNL4LCaD1d7DfRpY/PiOLB+WvzK6oRDpEP4nqdk9sFvxJoGm2JE 8ZtQ== X-Gm-Message-State: AMke39kkM8jSGvZxGNPpkCbLL1aGg6pjF74doiQedRZETDQWQ9ZqcMYTIetNPelTgid5uCVdzlJzBGALISohlA== X-Received: by 10.28.165.147 with SMTP id o141mr4160034wme.67.1488393417898; Wed, 01 Mar 2017 10:36:57 -0800 (PST) MIME-Version: 1.0 Received: by 10.223.163.2 with HTTP; Wed, 1 Mar 2017 10:36:57 -0800 (PST) Received: by 10.223.163.2 with HTTP; Wed, 1 Mar 2017 10:36:57 -0800 (PST) In-Reply-To: References: <352D31A3-5A8B-4790-9473-195C256DEEC8@sn3rd.com> <26137F3B-5655-44CA-877E-7168CE02DBF1@azet.org> <2572E3FC-0139-4946-A12D-9D9509C402F1@azet.org> From: Watson Ladd Date: Wed, 1 Mar 2017 10:36:57 -0800 Message-ID: To: "Dang, Quynh" Content-Type: multipart/alternative; boundary=001a114b40aef5c17a0549af98f0 Archived-At: Cc: cfrg@irtf.org, tls@ietf.org Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 18:37:01 -0000 --001a114b40aef5c17a0549af98f0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable That is not how HTTP works. Lots of records are small because they result from small writes. On Mar 1, 2017 6:48 AM, "Dang, Quynh (Fed)" wrote: > > > From: "Paterson, Kenny" > Date: Wednesday, March 1, 2017 at 9:38 AM > To: 'Quynh' , Aaron Zauner > Cc: IRTF CFRG , "" > Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs > (#765/#769). > > Hi, > > On 01/03/2017 14:31, "TLS on behalf of Dang, Quynh (Fed)" > wrote: > > From: Aaron Zauner > Date: Wednesday, March 1, 2017 at 9:24 AM > To: 'Quynh' > Cc: Sean Turner , "" , IRTF > CFRG > Subject: Re: [Cfrg] Closing out tls1.3 "Limits on key usage" PRs > (#765/#769). > > > > > > On 01 Mar 2017, at 13:18, Dang, Quynh (Fed) wrote: > From: Aaron Zauner > Date: Wednesday, March 1, 2017 at 8:11 AM > To: 'Quynh' > Cc: Sean Turner , "" , IRTF > CFRG > Subject: Re: [Cfrg] Closing out tls1.3 "Limits on key usage" PRs > (#765/#769). > > On 25 Feb 2017, at 14:28, Dang, Quynh (Fed) > wrote: > Hi Sean, Joe, Eric and all, > I would like to address my thoughts/suggestions on 2 issues in option > a. > 1) The data limit should be addressed in term of blocks, not records. > When the record size is not the full size, some user might not know > what to do. When the record size is 1 block, the limit of 2^24.5 > blocks (records) is way too low unnecessarily for > the margin of 2^-60. In that case, 2^34.5 1-block records is the > limit which still achieves the margin of 2^-60. > > I respectfully disagree. TLS deals in records not in blocks, so in the > end any semantic change here will just confuse implementors, which > isn't a good idea in my opinion. > > Over the discussion of the PRs, the preference was blocks. > > > > I don't see a clear preference. I see Brian Smith suggested switching to > blocks to be more precise in a PR. But in general it seems to me that > "Option A" was preferred in this thread anyhow - so these PRs aren't > relevant? I'm not sure that text on key-usage > limits in blocks in a spec that fundamentally deals in records is less > confusing, quite the opposite (at least to me). As I pointed out > earlier: I strongly recommend that any changes to the spec are as clear > als possible to engineers (non-crypto/math people) > -- e.g. why the spec is suddenly dealing in blocks instead of records > et cetera. Again; I really don't see any reason to change text here - to > me all suggested changes are even more confusing. > > > > > Hi Aaron, > > > The technical reasons I explained are reasons for using records. I don= =E2=80=99t > see how that is confusing. > > > If you like records, then the record number =3D the total blocks / the > record size in blocks: this is simplest already. > > > That formula does not correctly compute how many records have been sent o= n > a connection, because the record size in blocks is variable, not constant= . > You can modify it to get bounds on the total number of records sent, but > the bounds are sloppy because some records only consume 2 blocks (one for > encryption, one for masking in GHASH) while some consume far more. > > It's simpler for an implementation to count how many records have been > sent on a connection .... by using the connection's sequence number. This > puts less burden on the implementation/implementer. > > > I think the record size is configurable and it does not change regularly > in the same session (or connection). Somebody corrects me here! > > Quynh. > > > > Cheers > > Kenny > > > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > --001a114b40aef5c17a0549af98f0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
That is not how HTTP works. Lots of records are small bec= ause they result from small writes.

On Mar 1, 2017 6:48 AM, "Dang, Quynh (Fed)&quo= t; <quynh.dang@nist.gov> w= rote:


From: "Paterson, Kenny" &= lt;Kenny.Pat= erson@rhul.ac.uk>
Date: Wednesday, March 1, 2017 at 9= :38 AM
To: 'Quynh' <Quynh.Dang@nist.gov>, = Aaron Zauner <azet@az= et.org>
Cc: IRTF CFRG <cfrg@irtf.org>, "<tls@ietf.org>" <<= a href=3D"mailto:tls@ietf.org" target=3D"_blank">tls@ietf.org>
Subject: Re: [TLS] [Cfrg] Closing o= ut tls1.3 "Limits on key usage" PRs (#765/#769).

Hi,

On 01/03/2017 14:31, "TLS on behalf of Dang, Quynh (Fed)"
From: Aaron Zauner <azet@azet.org>
Date: Wednesday, March 1, 2017 at 9:24 AM
To: 'Quynh' <Quynh.Dang@nist.gov>
Cc: Sean Turner <sean@sn3rd.com>, "<tls@ietf.org>" <tls@ietf.org>, IRTF
Subject: Re: [Cfrg] Closing out tls1.3 "Limits on key usage"= PRs
(#765/#769).





On 01 Mar 2017, at 13:18, Dang, Quynh (Fed) <quynh.dang@nist.gov> wrote:
From: Aaron Zauner <azet@azet.org>
Date: Wednesday, March 1, 2017 at 8:11 AM
To: 'Quynh' <Quynh.Dang@nist.gov>
Cc: Sean Turner <sean@sn3rd.com>, "<tls@ietf.org>" <tls@ietf.org>, IRTF
Subject: Re: [Cfrg] Closing out tls1.3 "Limits on key usage"= PRs
(#765/#769).
On 25 Feb 2017, at 14:28, Dang, Quynh (Fed) <quynh.dang@nist.gov>
wrote:
Hi Sean, Joe, Eric and all,
I would like to address my thoughts/suggestions on 2 issues in option<= /div>
a.
1) The data limit should be addressed in term of blocks, not records.<= /div>
When the record size is not the full size, some user might not know
what to do. When the record size is 1 block, the limit of 2^24.5
blocks (records) is way too low unnecessarily for
the margin of 2^-60.=C2=A0=C2=A0In that case, 2^34.5 1-block records i= s the
limit which still achieves the margin of 2^-60.
I respectfully disagree. TLS deals in records not in blocks, so in the=
end any semantic change here will just confuse implementors, which
isn't a good idea in my opinion.
Over the discussion of the PRs, the preference was blocks.


I don't see a clear preference. I see Brian Smith suggested switch= ing to
blocks to be more precise in a PR. But in general it seems to me that<= /div>
"Option A" was preferred in this thread anyhow - so these PR= s aren't
relevant? I'm not sure that text on key-usage
limits in blocks in a spec that fundamentally deals in records is less=
confusing, quite the opposite (at least to me). As I pointed out
earlier: I strongly recommend that any changes to the spec are as clea= r
als possible to engineers (non-crypto/math people)
-- e.g. why the spec is suddenly dealing in blocks instead of records<= /div>
et cetera. Again; I really don't see any reason to change text her= e - to
me all suggested changes are even more confusing.




Hi Aaron,


The=C2=A0=C2=A0technical reasons I explained are reasons for using rec= ords. I don=E2=80=99t
see how that is confusing.


If you like records, then the record number =3D the total blocks / the=
record size in blocks: this is simplest already.


That formula does not correctly compute how many records have been sen= t on
a connection, because the record size in blocks is variable, not const= ant.
You can modify it to get bounds on the total number of records sent, b= ut
the bounds are sloppy because some records only consume 2 blocks (one = for
encryption, one for masking in GHASH) while some consume far more.

It's simpler for an implementation to count how many records have = been
sent on a connection .... by using the connection's sequence numbe= r. This
puts less burden on the implementation/implementer.

I think the record size is configurable and it does not change regular= ly in the same session (or connection).=C2=A0 Somebody corrects me here!=C2= =A0

Quynh.=C2=A0



Cheers

Kenny




_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--001a114b40aef5c17a0549af98f0-- From nobody Wed Mar 1 10:44:16 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BE7C129663 for ; Wed, 1 Mar 2017 10:44:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e2Dj6W8saFdP for ; Wed, 1 Mar 2017 10:44:12 -0800 (PST) Received: from gcc01-dm2-obe.outbound.protection.outlook.com (mail-dm2gcc01on0096.outbound.protection.outlook.com [23.103.201.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2639512965F for ; Wed, 1 Mar 2017 10:44:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Uf0WwVwZLXEOzzDyvS1n84LjUz2/sxbZ8TNYd7onACs=; b=ueK2QWLTUHjThBj2ttyWpACac/RO4v+oIVDSc4jPYfQ7sZqLaCKH2oRKiwau3czDXA/zZ36LhAhzeYXvNXRjn+fSJ1dt60cvaHB75E0pSr32kt+2j3G93ejyIiv94ow1P51g33YcNlcYZhrM4PZ/kd0XTBGJH1xpviQTSxjD0Nc= Received: from CY4PR09MB1464.namprd09.prod.outlook.com (10.173.191.22) by CY4PR09MB1462.namprd09.prod.outlook.com (10.173.191.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.933.12; Wed, 1 Mar 2017 18:44:10 +0000 Received: from CY4PR09MB1464.namprd09.prod.outlook.com ([10.173.191.22]) by CY4PR09MB1464.namprd09.prod.outlook.com ([10.173.191.22]) with mapi id 15.01.0933.016; Wed, 1 Mar 2017 18:44:09 +0000 From: "Dang, Quynh (Fed)" To: Watson Ladd , "Dang, Quynh (Fed)" Thread-Topic: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). Thread-Index: AQHSj3N1z8IXvDyfJEuMUkRo/k0w1KF/+8GA//+uQQCAAGYzgP//rheAgABVqwD//68bAAASdHaA//+uLQA= Date: Wed, 1 Mar 2017 18:44:08 +0000 Message-ID: References: <352D31A3-5A8B-4790-9473-195C256DEEC8@sn3rd.com> <26137F3B-5655-44CA-877E-7168CE02DBF1@azet.org> <2572E3FC-0139-4946-A12D-9D9509C402F1@azet.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.1.161129 authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=nist.gov; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [129.6.105.150] x-microsoft-exchange-diagnostics: 1; CY4PR09MB1462; 7:cCFTDdcsJG7geALs0+m7jmfU+h/QYecWU5t2729P5fQt+Pxqra9c5yrM3nQTg8lH0cWmqpf09d6YaLvYytoJwwDeHLeD97Odtbqyghoknv9ZrbWjTEQah793uHLCKk7+BvMWXhFcJ+fm69g3FOGIFcjYbceRWTrKgwgRwhn164M3p8Zvcc/UxPqds/S/q4eIls93jypLoa2r33RxWiAbCHh3IodBgjoY3Z2GFASYeocqeuxzAEoE96ECTl5nbBHoT5dJ4PjX75C1GqSKzNjBe3Xa8EOnekNz713VIk5lj24i+KqygSSWTVONNptWCXVnZkO7hlMxTA8KBRYDJekpWA== x-forefront-antispam-report: SFV:SKI; SCL:-1SFV:NSPM; SFS:(10019020)(7916002)(39860400002)(39850400002)(39840400002)(39450400003)(39410400002)(377454003)(24454002)(99286003)(6512007)(2900100001)(66066001)(122556002)(189998001)(54896002)(54906002)(236005)(6306002)(39060400002)(8936002)(4001350100001)(2906002)(83506001)(76176999)(7906003)(77096006)(7736002)(6486002)(3660700001)(25786008)(50986999)(229853002)(8656002)(3280700002)(36756003)(38730400002)(6506006)(106116001)(5660300001)(6436002)(102836003)(53546006)(86362001)(92566002)(81166006)(54356999)(2950100002)(6246003)(8676002)(53936002)(3846002)(6116002)(4326008)(606005)(93886004); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR09MB1462; H:CY4PR09MB1464.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; x-ms-office365-filtering-correlation-id: e53225a8-85d4-432d-1bed-08d460d2f261 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR09MB1462; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(65766998875637)(266576461109395); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(6041248)(20161123558025)(20161123564025)(20161123560025)(20161123555025)(20161123562025)(6072148); SRVR:CY4PR09MB1462; BCL:0; PCL:0; RULEID:; SRVR:CY4PR09MB1462; x-forefront-prvs: 0233768B38 spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_D4DC7F7F3122Dqdangnistgov_" MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Mar 2017 18:44:08.9829 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR09MB1462 Archived-At: Cc: "cfrg@irtf.org" , "tls@ietf.org" Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 18:44:14 -0000 --_000_D4DC7F7F3122Dqdangnistgov_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable From: Watson Ladd > Date: Wednesday, March 1, 2017 at 1:36 PM To: 'Quynh' > Cc: "tls@ietf.org" >= , "cfrg@irtf.org" >, Aaron Zauner >, "Paterson, Kenny" <= Kenny.Paterson@rhul.ac.uk> Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#76= 5/#769). That is not how HTTP works. Lots of records are small OK. What is the percentage ? Even all records were small, providing a corre= ct number would be a good thing. If someone wants to rekey a lot often, I a= m not suggesting against that. Quynh. because they result from small writes. On Mar 1, 2017 6:48 AM, "Dang, Quynh (Fed)" > wrote: From: "Paterson, Kenny" > Date: Wednesday, March 1, 2017 at 9:38 AM To: 'Quynh' >, Aaron Zauner= > Cc: IRTF CFRG >, ">" > Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#76= 5/#769). Hi, On 01/03/2017 14:31, "TLS on behalf of Dang, Quynh (Fed)" on behalf of quynh.dang@= nist.gov> wrote: From: Aaron Zauner > Date: Wednesday, March 1, 2017 at 9:24 AM To: 'Quynh' > Cc: Sean Turner >, ">" >, IRTF CFRG > Subject: Re: [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). On 01 Mar 2017, at 13:18, Dang, Quynh (Fed) > wrote: From: Aaron Zauner > Date: Wednesday, March 1, 2017 at 8:11 AM To: 'Quynh' > Cc: Sean Turner >, ">" >, IRTF CFRG > Subject: Re: [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). On 25 Feb 2017, at 14:28, Dang, Quynh (Fed) > wrote: Hi Sean, Joe, Eric and all, I would like to address my thoughts/suggestions on 2 issues in option a. 1) The data limit should be addressed in term of blocks, not records. When the record size is not the full size, some user might not know what to do. When the record size is 1 block, the limit of 2^24.5 blocks (records) is way too low unnecessarily for the margin of 2^-60. In that case, 2^34.5 1-block records is the limit which still achieves the margin of 2^-60. I respectfully disagree. TLS deals in records not in blocks, so in the end any semantic change here will just confuse implementors, which isn't a good idea in my opinion. Over the discussion of the PRs, the preference was blocks. I don't see a clear preference. I see Brian Smith suggested switching to blocks to be more precise in a PR. But in general it seems to me that "Option A" was preferred in this thread anyhow - so these PRs aren't relevant? I'm not sure that text on key-usage limits in blocks in a spec that fundamentally deals in records is less confusing, quite the opposite (at least to me). As I pointed out earlier: I strongly recommend that any changes to the spec are as clear als possible to engineers (non-crypto/math people) -- e.g. why the spec is suddenly dealing in blocks instead of records et cetera. Again; I really don't see any reason to change text here - to me all suggested changes are even more confusing. Hi Aaron, The technical reasons I explained are reasons for using records. I don=92t see how that is confusing. If you like records, then the record number =3D the total blocks / the record size in blocks: this is simplest already. That formula does not correctly compute how many records have been sent on a connection, because the record size in blocks is variable, not constant. You can modify it to get bounds on the total number of records sent, but the bounds are sloppy because some records only consume 2 blocks (one for encryption, one for masking in GHASH) while some consume far more. It's simpler for an implementation to count how many records have been sent on a connection .... by using the connection's sequence number. This puts less burden on the implementation/implementer. I think the record size is configurable and it does not change regularly in= the same session (or connection). Somebody corrects me here! Quynh. Cheers Kenny _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls --_000_D4DC7F7F3122Dqdangnistgov_ Content-Type: text/html; charset="Windows-1252" Content-ID: <5F1E939A8BA7284A85C0EA5D4A3FD77C@namprd09.prod.outlook.com> Content-Transfer-Encoding: quoted-printable


From: Watson Ladd <watsonbladd@gmail.com>
Date: Wednesday, March 1, 2017 at 1= :36 PM
To: 'Quynh' <Quynh.Dang@nist.gov>
Cc: "tls@ietf.org" <tls@ietf.= org>, "cfrg@irtf.org"= <cfrg@irtf.org>, Aaron Zauner <azet@azet.org>, "Paterson= , Kenny" <Kenny.Paters= on@rhul.ac.uk>
Subject: Re: [TLS] [Cfrg] Closing o= ut tls1.3 "Limits on key usage" PRs (#765/#769).

That is not how HTTP works. Lots of records are small

OK. What is the percentage ? Even all records were small, providing a = correct number would be a good thing. If someone wants to rekey a lot often= , I am not suggesting against that.

Quynh. 

because they result from small writes.

On Mar 1, 2017 6:48 AM, "Dang, Quynh (Fed)&= quot; <quynh.dang@nist.gov>= ; wrote:


From: "Paterson, Kenny" &= lt;Kenny.Pat= erson@rhul.ac.uk>
Date: Wednesday, March 1, 2017 at 9= :38 AM
To: 'Quynh' <Quynh.Dang@nist.gov>, Aaron Za= uner <azet@azet.org>
Cc: IRTF CFRG <cfrg@irtf.org>, "<tls@ietf.org>" <<= a href=3D"mailto:tls@ietf.org" target=3D"_blank">tls@ietf.org>
Subject: Re: [TLS] [Cfrg] Closing o= ut tls1.3 "Limits on key usage" PRs (#765/#769).

Hi,

On 01/03/2017 14:31, "TLS on behalf of Dang, Quynh (Fed)"
From: Aaron Zauner <azet@azet.org>
Date: Wednesday, March 1, 2017 at 9:24 AM
To: 'Quynh' <Quynh.Dang@nist.gov>
Cc: Sean Turner <sean@sn3rd.com>, "<tls@ietf.org>" <tls@ietf.org>, IRTF
Subject: Re: [Cfrg] Closing out tls1.3 "Limits on key usage"= PRs
(#765/#769).





On 01 Mar 2017, at 13:18, Dang, Quynh (Fed) <quynh.dang@nist.gov> wrote:
From: Aaron Zauner <azet@azet.org>
Date: Wednesday, March 1, 2017 at 8:11 AM
To: 'Quynh' <Quynh.Dang@nist.gov>
Cc: Sean Turner <sean@sn3rd.com>, "<tls@ietf.org>" <tls@ietf.org>, IRTF
Subject: Re: [Cfrg] Closing out tls1.3 "Limits on key usage"= PRs
(#765/#769).
On 25 Feb 2017, at 14:28, Dang, Quynh (Fed) <quynh.dang@nist.gov>
wrote:
Hi Sean, Joe, Eric and all,
I would like to address my thoughts/suggestions on 2 issues in option<= /div>
a.
1) The data limit should be addressed in term of blocks, not records.<= /div>
When the record size is not the full size, some user might not know
what to do. When the record size is 1 block, the limit of 2^24.5
blocks (records) is way too low unnecessarily for
the margin of 2^-60.  In that case, 2^34.5 1-block records i= s the
limit which still achieves the margin of 2^-60.
I respectfully disagree. TLS deals in records not in blocks, so in the=
end any semantic change here will just confuse implementors, which
isn't a good idea in my opinion.
Over the discussion of the PRs, the preference was blocks.


I don't see a clear preference. I see Brian Smith suggested switching = to
blocks to be more precise in a PR. But in general it seems to me that<= /div>
"Option A" was preferred in this thread anyhow - so these PR= s aren't
relevant? I'm not sure that text on key-usage
limits in blocks in a spec that fundamentally deals in records is less=
confusing, quite the opposite (at least to me). As I pointed out
earlier: I strongly recommend that any changes to the spec are as clea= r
als possible to engineers (non-crypto/math people)
-- e.g. why the spec is suddenly dealing in blocks instead of records<= /div>
et cetera. Again; I really don't see any reason to change text here - = to
me all suggested changes are even more confusing.




Hi Aaron,


The  technical reasons I explained are reasons for using rec= ords. I don=92t
see how that is confusing.


If you like records, then the record number =3D the total blocks / the=
record size in blocks: this is simplest already.


That formula does not correctly compute how many records have been sen= t on
a connection, because the record size in blocks is variable, not const= ant.
You can modify it to get bounds on the total number of records sent, b= ut
the bounds are sloppy because some records only consume 2 blocks (one = for
encryption, one for masking in GHASH) while some consume far more.

It's simpler for an implementation to count how many records have been=
sent on a connection .... by using the connection's sequence number. T= his
puts less burden on the implementation/implementer.

I think the record size is configurable and it does not change regular= ly in the same session (or connection).  Somebody corrects me here!&nb= sp;

Quynh. 



Cheers

Kenny




_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

 --_000_D4DC7F7F3122Dqdangnistgov_-- From nobody Wed Mar 1 13:18:24 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C961F1296BF for ; Wed, 1 Mar 2017 13:18:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GLwdkcVqRWGB for ; Wed, 1 Mar 2017 13:18:22 -0800 (PST) Received: from mail-qk0-x235.google.com (mail-qk0-x235.google.com [IPv6:2607:f8b0:400d:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C0A6F127076 for ; Wed, 1 Mar 2017 13:18:22 -0800 (PST) Received: by mail-qk0-x235.google.com with SMTP id n186so89876874qkb.3 for ; Wed, 01 Mar 2017 13:18:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=vrCITNjcd07mVfW48E4dyb9ZT0FeLYXbjNqQymK8pAM=; b=nOSw+LES7Hn4IE3qnSnU2cr5N87fh/JMcaEWSgZAGbNVJfXM2ydtWYuCcvod+6Y3Ei Svqadgsre21VVe3YAcb2/5u9C593pT7dSTsduhl81SY4zvQspaiBiF6Cx3Bqody88w0V J05zf/XIxzKVGRVN4PDYLTplulPCilod1OTw6GRd2GuoAasq8KC5yqLMjG3V5X9fYnXN ZlDzZcTlq27O/DjMiFIjkwmEv9gzMq+GdTEhYJEHrbwEKoPn1NwSpM1iquZDIIm0qGAb VNjWlSHnejSlQALXnZ+tOWdpD2jWajHdU+Z0NwVco9kMHhfTSqj2boSN+8+op3kaQYG/ zH9g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=vrCITNjcd07mVfW48E4dyb9ZT0FeLYXbjNqQymK8pAM=; b=p51+Up6YdEbL6BK1YllwUVoCIfu2muD1sNf98dEQyC5bj58l475x8PTdMEjSIg4dZT t9Qejr9/zxZibyeYe0uNVDXl52T0UPa2JLhC272HrvmaP4jivJQ+GSCph0aANIySfYwk H21RHEYR3d67F/CrF6XgoNf1VKXR31aPTVO3uw7MhOzWgeCUzGVnHtgowjONzUaGh8J/ J1UV/DFTn3Lr0wm3k6onCA3PO/GH6fAwUr3Rhkg0BQ9tUMsOmbVcYPGTRhAG+4Zrh7jT NzUNfUasSW5UBC+jLTevj9H1KYkTyp75Gh0sfTTUl4pDlV3DshS6GWbCEPWlDsllL8XA 5Rmw== X-Gm-Message-State: AMke39kSFc99hCjRevon/ern8m4fe6G+LrfdyfEaMHWwof4PnsmZuKhSh3pW4jp666ewd0zAsTDwcbWeT49C+Q== X-Received: by 10.200.46.208 with SMTP id i16mr12941392qta.13.1488403101872; Wed, 01 Mar 2017 13:18:21 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.19.112 with HTTP; Wed, 1 Mar 2017 13:18:21 -0800 (PST) In-Reply-To: References: <352D31A3-5A8B-4790-9473-195C256DEEC8@sn3rd.com> <26137F3B-5655-44CA-877E-7168CE02DBF1@azet.org> <2572E3FC-0139-4946-A12D-9D9509C402F1@azet.org> From: Martin Thomson Date: Thu, 2 Mar 2017 08:18:21 +1100 Message-ID: To: "Dang, Quynh (Fed)" Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "cfrg@irtf.org" , "tls@ietf.org" Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Mar 2017 21:18:23 -0000 On 2 March 2017 at 05:44, Dang, Quynh (Fed) wrote: > OK. What is the percentage ? Even all records were small, providing a > correct number would be a good thing. If someone wants to rekey a lot often, > I am not suggesting against that. It will vary greatly depending on circumstance. Most of the time the record size matches the MTU. Other times it matches the write size, which can be only a small number of octets. For bulk transfers it can approach the record maximum. All on the same connection sometimes. I really don't know what you are suggesting here. The point is the accounting in terms of records doesn't really give you any insight into the number of blocks. From nobody Wed Mar 1 22:48:08 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50ECE1293E3 for ; Wed, 1 Mar 2017 22:48:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BrG7NdxJTb_h for ; Wed, 1 Mar 2017 22:48:06 -0800 (PST) Received: from mail-wr0-x231.google.com (mail-wr0-x231.google.com [IPv6:2a00:1450:400c:c0c::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BA2A6120725 for ; Wed, 1 Mar 2017 22:48:05 -0800 (PST) Received: by mail-wr0-x231.google.com with SMTP id l37so45069352wrc.1 for ; Wed, 01 Mar 2017 22:48:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=KoUvdxJ4UNONeHrW6mRbE4Ok938h0HDNBD0H67l6yTU=; b=CGaj7N3VECLbA1NjNm4G/Z4pvIXrrPJQfXVzov/HJiVIvsrIjil5+hddc91ULCbPsN X83hh6IjguEBa66k7yevxNbx3zwSQv3DbRrL1ZARvR42HE27jKIAIKret3aEkL9uvQu1 FyiZOM+XBqvKFMBEdXqZAvPgLu5mzj/tHOHDgiU9wg1fDO5ybcVwaf+5eRT+Wy0ilUwn f+ZR83lGUxa7UVEYo4Il3WqqQKStoj1hSwXUCIo5fVeFJEKAc4Tul+T7ODbptXIibFe0 Gl+7YyTc9JdVctY6pA5g1wL294nn8F9MoI72XoVBu0TTpdEgrvmgRgdTY01vMAG9Fa6Z XkTg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=KoUvdxJ4UNONeHrW6mRbE4Ok938h0HDNBD0H67l6yTU=; b=Lk11i43V4cBV7eulDqIRUnb6YmL4orY7iD2B8n661xcznG/noyTrG3OwFyiEbwCsoj pvMQy64xsg/GKXeQ+5vQKAv22GhIx51oFYrye3phZSB2BEYmAVU16ybi1byGoky2FEtl kvxwjygHv1xh9SFfA9NDy1qHE09s1RQ+ZTZmNMn9+8SIS6lf6KVsj5u5yYkyc8BHatDB OIGKCVKmRGhF51zhbVsVZZ5J0rjdnK0YQul2pvxoegNi5SIIvTd8Sr2rS7aDJywnzRAW HDWK7yeK/D+B9w6YK+AIz/t4vD3zcCgXkm6qHLHVJeHxiHckvdqi1e+L355Q35D5zI+I 5Y7w== X-Gm-Message-State: AMke39nyG9R8cVQAl5fqXZYnEZKqBPEDoTv2+YKGUjwVFGhY5u7g0FO8RP/yyoBeWFtpnA== X-Received: by 10.223.151.138 with SMTP id s10mr10398288wrb.65.1488437283152; Wed, 01 Mar 2017 22:48:03 -0800 (PST) Received: from [192.168.137.219] ([176.12.142.80]) by smtp.gmail.com with ESMTPSA id d42sm9503212wrd.7.2017.03.01.22.48.01 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 01 Mar 2017 22:48:02 -0800 (PST) From: Yoav Nir Message-Id: <087331C6-E504-4FDA-A689-95F0F4080F1D@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_CD3AC8F7-7D68-4166-AFDF-8F133A6C8DEA"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Thu, 2 Mar 2017 08:47:59 +0200 In-Reply-To: To: Stephen Farrell References: X-Mailer: Apple Mail (2.3259) Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] AD review of draft-ietf-tls-rfc4492bis-12.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 06:48:07 -0000 --Apple-Mail=_CD3AC8F7-7D68-4166-AFDF-8F133A6C8DEA Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 17 Feb 2017, at 18:58, Stephen Farrell = wrote: >=20 >=20 > Hiya, >=20 > I've had a read of this and asked for IETF LC to start. >=20 > My comments below can be handled with any other IETF LC > comments. >=20 > Thanks, > S. >=20 > - Bits of this are fairly complex reading, given that ECC > isn't trivial and nor are the changes nor how they were done > to keep some things more or less backwards compatible. It'd > help I think if we could say something more about > implementation status in the shepherd write-up. In light of RFC 7942, I=E2=80=99ve added an Implementation Status = section to my working copy (soon to be pushed to github). > - abstract: doesn't this need to say that this obsoletes > RFC4492 in the abstract text. (Yes, PITA formalities, I > know:-) Added. > - 5.1.1: "Note that other specifications have since added > other values to this enumeration." Could/should we reference > those others? I don't care, but someone will ask and it'd be > good to have the answer in the archive if it's "no, and > here's why=E2=80=A6" I think not. Same as the main TLS spec doesn=E2=80=99t mention every = GOST and CAMELLIA that people add, we don=E2=80=99t have to mention = Brainpool. But I will note that some of these additions are not curves = at all. > - 5.1.1: Is this text still correct: "secp256r1, etc: > Indicates support of the corresponding named curve or class > of explicitly defined curves." Do we need to say there that > we're ditching explicitly defined curves? Yes, it should. > - 5.2: Is this still right, given the deprecation of > compressed points earlier? " Note that the server may include > items that were not found in the client's list (e.g., the > server may prefer to receive points in compressed format even > when a client cannot parse this format: the same client may > nevertheless be capable of outputting points in compressed > format).=E2=80=9D Right. The example no longer works. I=E2=80=99ll remove it and say that = there=E2=80=99s no other options than uncompressed. > - 5.3: Doesn't this need a change: "...unless the client has > indicated support for explicit curves of the appropriate > type"? Maybe more change is needed in that para as well? I removed the whole sentence. There are no more explicit curves. > - section 6: Do we still need the *_NULL_* suites? Did we ever? But I=E2=80=99m sure somebody uses them somewhere for = something. Unlike weak encryption, they don=E2=80=99t tend to end up = being used when people encrypt things. > - Just checking, I assume this is down to editing history > but what happened to TBD1 and TBD2? There were determined :) These were Curve25519 and Curve448. We got temporary assignments so that = Google and others could deploy them. Yoav --Apple-Mail=_CD3AC8F7-7D68-4166-AFDF-8F133A6C8DEA Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYt8AfAAoJELhJCxUKWMyZXTIH/R3v9DEeuvD9Q4MCi3Paydj+ hSZ4gqyOzP29PO4C7yC9QNQSaCdhRPKYYtlG47vc/4frSJYB5V7v8ijzgHHOHk/q 9ZAwx3TINHvB2l0b/D+Li4YuDp1vypajQEI1oC9h0kM0ETjVmDKkwuQfE5W/8MUz 8lW8J91Sg2VEJMlJdLqM/SgLiW1J4CysZVocbg04b7xKXxhmjYC6vtk5+vYWZ8yY O9TzDk9IdrLkfAUTGZ785QQHh21AiLrzSLxafYAPzMrEw37zQJq1K1CwaJ0+agA3 KcCmhr2Ok6ITkJ/4QwQMlt+xoy4+PXP1Lzdcn75naMVrgmTT1XZktlrZyS4lbSs= =0mM1 -----END PGP SIGNATURE----- --Apple-Mail=_CD3AC8F7-7D68-4166-AFDF-8F133A6C8DEA-- From nobody Thu Mar 2 00:18:28 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B9456129459 for ; Thu, 2 Mar 2017 00:18:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.302 X-Spam-Level: X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1NK44jgUoRHT for ; Thu, 2 Mar 2017 00:18:24 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A5DDB12941E for ; Thu, 2 Mar 2017 00:18:24 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id D3160BEAF; Thu, 2 Mar 2017 08:18:21 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CYk1W6c51gLF; Thu, 2 Mar 2017 08:18:20 +0000 (GMT) Received: from [10.87.48.75] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 37439BE5C; Thu, 2 Mar 2017 08:18:20 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1488442700; bh=2dodsedm2nEILZAuZhJ+PzJtFf7D6O9DiQ49npaCfVA=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=QCo1NDnVNm2XPxjzOtk7nVY1iYJ8BsuGhzty7DXbIDO/p64619SoHnlH30vDTu46S bpP61d4IK7HHbyr10oe2MH9smgY5kI2zScOnZqbY17agojXZqMpTwUmGPZi6pFOMsq tG694H2RMfGb/n8/gxt59AjX+XaB1KwIA2Cl21T4= To: Yoav Nir References: <087331C6-E504-4FDA-A689-95F0F4080F1D@gmail.com> From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: Date: Thu, 2 Mar 2017 08:18:19 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: <087331C6-E504-4FDA-A689-95F0F4080F1D@gmail.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="ljMB642BAK1uk9q0O8eX4iGFfkEcJt3an" Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] AD review of draft-ietf-tls-rfc4492bis-12.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 08:18:27 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --ljMB642BAK1uk9q0O8eX4iGFfkEcJt3an Content-Type: multipart/mixed; boundary="0uRM697n78nSjhpbdKTflTxKtGkH4l90k"; protected-headers="v1" From: Stephen Farrell To: Yoav Nir Cc: "tls@ietf.org" Message-ID: Subject: Re: [TLS] AD review of draft-ietf-tls-rfc4492bis-12.txt References: <087331C6-E504-4FDA-A689-95F0F4080F1D@gmail.com> In-Reply-To: <087331C6-E504-4FDA-A689-95F0F4080F1D@gmail.com> --0uRM697n78nSjhpbdKTflTxKtGkH4l90k Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Thanks Yoav, Those all look like fine resolutions for my comments. Cheers, S. On 02/03/17 06:47, Yoav Nir wrote: >=20 >> On 17 Feb 2017, at 18:58, Stephen Farrell = wrote: >> >> >> Hiya, >> >> I've had a read of this and asked for IETF LC to start. >> >> My comments below can be handled with any other IETF LC >> comments. >> >> Thanks, >> S. >> >> - Bits of this are fairly complex reading, given that ECC >> isn't trivial and nor are the changes nor how they were done >> to keep some things more or less backwards compatible. It'd >> help I think if we could say something more about >> implementation status in the shepherd write-up. >=20 > In light of RFC 7942, I=E2=80=99ve added an Implementation Status secti= on to my working copy (soon to be pushed to github). >=20 >> - abstract: doesn't this need to say that this obsoletes >> RFC4492 in the abstract text. (Yes, PITA formalities, I >> know:-) >=20 > Added. >=20 >> - 5.1.1: "Note that other specifications have since added >> other values to this enumeration." Could/should we reference >> those others? I don't care, but someone will ask and it'd be >> good to have the answer in the archive if it's "no, and >> here's why=E2=80=A6" >=20 > I think not. Same as the main TLS spec doesn=E2=80=99t mention every GO= ST and CAMELLIA that people add, we don=E2=80=99t have to mention Brainpo= ol. But I will note that some of these additions are not curves at all. >=20 >> - 5.1.1: Is this text still correct: "secp256r1, etc: >> Indicates support of the corresponding named curve or class >> of explicitly defined curves." Do we need to say there that >> we're ditching explicitly defined curves? >=20 > Yes, it should. >=20 >> - 5.2: Is this still right, given the deprecation of >> compressed points earlier? " Note that the server may include >> items that were not found in the client's list (e.g., the >> server may prefer to receive points in compressed format even >> when a client cannot parse this format: the same client may >> nevertheless be capable of outputting points in compressed >> format).=E2=80=9D >=20 > Right. The example no longer works. I=E2=80=99ll remove it and say that= there=E2=80=99s no other options than uncompressed. >=20 >> - 5.3: Doesn't this need a change: "...unless the client has >> indicated support for explicit curves of the appropriate >> type"? Maybe more change is needed in that para as well? >=20 > I removed the whole sentence. There are no more explicit curves. >=20 >> - section 6: Do we still need the *_NULL_* suites? >=20 > Did we ever? But I=E2=80=99m sure somebody uses them somewhere for som= ething. Unlike weak encryption, they don=E2=80=99t tend to end up being u= sed when people encrypt things. >=20 >> - Just checking, I assume this is down to editing history >> but what happened to TBD1 and TBD2? >=20 > There were determined :) >=20 > These were Curve25519 and Curve448. We got temporary assignments so tha= t Google and others could deploy them. >=20 > Yoav >=20 --0uRM697n78nSjhpbdKTflTxKtGkH4l90k-- --ljMB642BAK1uk9q0O8eX4iGFfkEcJt3an Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCAAGBQJYt9VLAAoJEC88hzaAX42iiVwIALf6lnMLY7Ohw64StRqAcWlE XulVsRfgFeHwq4V9TmyIgOg4F6vCt7JRGQ4lFFT9gLXt9Cw7LBeomRO0AfdLyQuC s6fm0TJZ0Crd0Is8uuhTO7rD48pJmhUhRmVjKO6fWP0B2mIJpbbGGzmEvweKz8Gf XFe9k6DCssF70g018xT8xXSXKL6g9Ux17Ij5An0FIa5jQi4ZwkHCnyyIMabcGN5Y pO+jZCe/KiPyBG9YLIN8L3PMuASekiq7l96GHuyABb6yomqVZitboAlY29g9Fg2h dB1J/DC/C0UIFtNUYK81Ih69EceUqHB9SiKYJKgjWd8vnBx7OSmuVvxJpgOP/zc= =N6nK -----END PGP SIGNATURE----- --ljMB642BAK1uk9q0O8eX4iGFfkEcJt3an-- From nobody Thu Mar 2 03:01:08 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DE5661297BE for ; Thu, 2 Mar 2017 03:01:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nistgov.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mHQzQ9FYSSv9 for ; Thu, 2 Mar 2017 03:01:01 -0800 (PST) Received: from gcc01-dm2-obe.outbound.protection.outlook.com (mail-dm2gcc01on0139.outbound.protection.outlook.com [23.103.201.139]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2DC5B1296F5 for ; Thu, 2 Mar 2017 03:01:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nistgov.onmicrosoft.com; s=selector1-nist-gov; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=hsnxmx9cMie9T1+Te4F1Qw1zNV5eUuPaN9hRfBtPUCA=; b=W+/xqfraHXEeNpqtXfsd/EZBE3X/K1hglVjdwXZjwjnCj1yno8n1DwY3lGAVYBVCUcn/1ewAYaYxfDmRU1A6TQJ6qQvHjK95LwTGQWrVuwTikXvRPn7ahBEUoNdA9I4pRRVd/oXdWNq4GCRO9m/vZ/vDD++Fss51A3zRKejQZYM= Received: from CY4PR09MB1464.namprd09.prod.outlook.com (10.173.191.22) by CY4PR09MB1462.namprd09.prod.outlook.com (10.173.191.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.933.12; Thu, 2 Mar 2017 11:00:59 +0000 Received: from CY4PR09MB1464.namprd09.prod.outlook.com ([10.173.191.22]) by CY4PR09MB1464.namprd09.prod.outlook.com ([10.173.191.22]) with mapi id 15.01.0933.016; Thu, 2 Mar 2017 11:00:59 +0000 From: "Dang, Quynh (Fed)" To: Martin Thomson , "Dang, Quynh (Fed)" Thread-Topic: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). Thread-Index: AQHSj3N1z8IXvDyfJEuMUkRo/k0w1KF/+8GA//+uQQCAAGYzgP//rheAgABVqwD//68bAAASdHaA//+uLQCAAH7rgIAAkgOA Date: Thu, 2 Mar 2017 11:00:59 +0000 Message-ID: References: <352D31A3-5A8B-4790-9473-195C256DEEC8@sn3rd.com> <26137F3B-5655-44CA-877E-7168CE02DBF1@azet.org> <2572E3FC-0139-4946-A12D-9D9509C402F1@azet.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.7.1.161129 authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=nist.gov; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [129.6.222.254] x-microsoft-exchange-diagnostics: 1; CY4PR09MB1462; 7:3wBgkCXzCTsK9Yco7/Pecnp+hnHMKYEMg9QjfGd0/24piOW8Qw6/4c5ngm5ge97eLxXRc9gVVW3/r4F/u8K8UZ4KT+AEo0PPV3WSJ2KaR/xjMVu/olAxXGMIhYFEoZBly++6YfOy3n/nySrNOrwhkyC3fYmV7MG7etTu1Racy9CSFJa70jVSt7RaphruNPXbyZz2ZneTwv4qyF5PT8Xcp3+cYt4ECUK2DJLWspK4bns6olvY6e36f6bYcAP+pkaywwTbv/JwwkEirTtjrNm07TlxCaZ3m9QLPCKOSH+GN119GR0iJ2eKAU0UQsrU9EaJQmVDuZsDPbtIkWyCyEPEeQ== x-forefront-antispam-report: SFV:SKI; SCL:-1SFV:NSPM; SFS:(10019020)(7916002)(39410400002)(39450400003)(39840400002)(39850400002)(39860400002)(24454002)(377454003)(99286003)(6512007)(83506001)(236005)(2900100001)(54896002)(2906002)(39060400002)(4001350100001)(345774005)(189998001)(122556002)(8936002)(77096006)(7736002)(76176999)(54906002)(6486002)(25786008)(3660700001)(229853002)(3280700002)(50986999)(6436002)(36756003)(102836003)(38730400002)(5660300001)(6506006)(86362001)(53546006)(66066001)(106116001)(92566002)(81166006)(54356999)(2950100002)(68736007)(6246003)(8676002)(3846002)(53936002)(6116002)(93886004)(4326008); DIR:OUT; SFP:1102; SCL:1; SRVR:CY4PR09MB1462; H:CY4PR09MB1464.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; x-ms-office365-filtering-correlation-id: 69fbdab1-3946-40f4-15da-08d4615b68c3 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:CY4PR09MB1462; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(65766998875637)(155532106045638)(12901024606220)(266576461109395); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(6041248)(20161123555025)(20161123560025)(20161123558025)(20161123562025)(20161123564025)(6072148); SRVR:CY4PR09MB1462; BCL:0; PCL:0; RULEID:; SRVR:CY4PR09MB1462; x-forefront-prvs: 023495660C spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_D4DD63AF31268qdangnistgov_" MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Mar 2017 11:00:59.1484 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR09MB1462 Archived-At: Cc: "cfrg@irtf.org" , "tls@ietf.org" Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 11:01:04 -0000 --_000_D4DD63AF31268qdangnistgov_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable From: Martin Thomson > Date: Wednesday, March 1, 2017 at 4:18 PM To: 'Quynh' > Cc: Watson Ladd >, "cfr= g@irtf.org" >, "t= ls@ietf.org" > Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#76= 5/#769). On 2 March 2017 at 05:44, Dang, Quynh (Fed) > wrote: OK. What is the percentage ? Even all records were small, providing a correct number would be a good thing. If someone wants to rekey a lot often= , I am not suggesting against that. It will vary greatly depending on circumstance. Most of the time the record size matches the MTU. Other times it matches the write size, which can be only a small number of octets. For bulk transfers it can approach the record maximum. All on the same connection sometimes. I really don't know what you are suggesting here. The point is the accounting in terms of records doesn't really give you any insight into the number of blocks. Hi Martin, Thank you for the information. In the PRs=92 discussions, I saw that Brian and Rich wanted blocks. You, Er= ic and other people were comfortably discussing the issue in term of blocks= . Implementing and running TLS were your career, so I made suggestions base= d on blocks. Aaron wanted records, so I gave him the equation to figure that out. I did = not mean to suggest to use records. Quynh. --_000_D4DD63AF31268qdangnistgov_ Content-Type: text/html; charset="Windows-1252" Content-ID: Content-Transfer-Encoding: quoted-printable


From: Martin Thomson <martin.thomson@gmail.com>
Date: Wednesday, March 1, 2017 at 4= :18 PM
To: 'Quynh' <Quynh.Dang@nist.gov>
Cc: Watson Ladd <watsonbladd@gmail.com>, "cfrg@irtf.org" <cfrg@irtf.org>, "tls@iet= f.org" <tls@ietf.org>
Subject: Re: [TLS] [Cfrg] Closing o= ut tls1.3 "Limits on key usage" PRs (#765/#769).

On 2 March 2017 at 05:44, Dang, Quynh (Fed) <quynh.dang@nist.gov> wrote:
OK. What is the percentage ? Even all records were small, providing a<= /div>
correct number would be a good thing. If someone wants to rekey a lot = often,
I am not suggesting against that.

It will vary greatly depending on circumstance.  Most of the= time the
record size matches the MTU.  Other times it matches the wri= te size,
which can be only a small number of octets.  For bulk transf= ers it can
approach the record maximum.  All on the same connection som= etimes.

I really don't know what you are suggesting here.  The point= is the
accounting in terms of records doesn't really give you any insight
into the number of blocks.

Hi Martin,

Thank you for the information. 

In the PRs=92 discussions, I saw that Brian and Rich wanted blocks. Yo= u, Eric and other people were comfortably discussing the issue in term of b= locks. Implementing and running TLS were your career, so I made suggestions= based on blocks.

Aaron wanted records, so I gave him the equation to figure that out. I= did not mean to suggest to use records.

Quynh. 

 --_000_D4DD63AF31268qdangnistgov_-- From nobody Thu Mar 2 08:17:27 2017 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C3AE12943D; Thu, 2 Mar 2017 08:17:25 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.46.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148847144517.19585.2986041348165406720.idtracker@ietfa.amsl.com> Date: Thu, 02 Mar 2017 08:17:25 -0800 Archived-At: Cc: tls@ietf.org Subject: [TLS] I-D Action: draft-ietf-tls-rfc4492bis-13.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 16:17:25 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Transport Layer Security of the IETF. Title : Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier Authors : Yoav Nir Simon Josefsson Manuel Pegourie-Gonnard Filename : draft-ietf-tls-rfc4492bis-13.txt Pages : 33 Date : 2017-03-02 Abstract: This document describes key exchange algorithms based on Elliptic Curve Cryptography (ECC) for the Transport Layer Security (TLS) protocol. In particular, it specifies the use of Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) key agreement in a TLS handshake and the use of Elliptic Curve Digital Signature Algorithm (ECDSA) and Edwards Digital Signature Algorithm (EdDSA) as authentication mechanisms. This document obsoletes and replaces RFC 4492. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tls-rfc4492bis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-13 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tls-rfc4492bis-13 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Mar 2 13:44:16 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5BB1F129670 for ; Thu, 2 Mar 2017 13:44:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=briansmith-org.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FoAt1ak46nMp for ; Thu, 2 Mar 2017 13:44:14 -0800 (PST) Received: from mail-it0-x232.google.com (mail-it0-x232.google.com [IPv6:2607:f8b0:4001:c0b::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E002B1295EF for ; Thu, 2 Mar 2017 13:44:13 -0800 (PST) Received: by mail-it0-x232.google.com with SMTP id 203so2016462ith.0 for ; Thu, 02 Mar 2017 13:44:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=briansmith-org.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=PmXHXrUwBBn3FKB1UU9gitiSHibI8xN3gm54gcAYriU=; b=nVw1c2CYUAg2mngp1P/32NRJLF60WVhHh9snq/T6MNTSUENcNmMs3+n36J0Gm4dieL WXAa8EFoaHcqfV5FVHGuVPjlrTIC3da9ED58GUDkIWVi1Zo9JJkPhdP77vDbbEarXkSi T5cFmzyTAHG/X+NeMUVTFhqYXOsvYxC2js5PpW/Hzailv+rVbXc/4dbyFzE7rkhDHjWI 2LXyyhfN2i6/G0TJtrIWq3SLsuL4KjPwpxK7HedbkrFG8HyIOC793+a067NeRSBHOJ7d A+5SyLNPlZTnViNplQ4rWdEIq2xg1a55n8DXA/ghM3za1Js8M/rHUwkigAx3zVa7ZE2v 4asQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=PmXHXrUwBBn3FKB1UU9gitiSHibI8xN3gm54gcAYriU=; b=FMjTFToB2A0XQDi4GFTDnSO6stAnJoVJQVtZJmatPeuW9UCLBtRbU0Iy8HA0nwHWsu WzFY9Gy/xcsfWnxanpGSosA5W933zRpH7cykFM19A6DoxU+2/RXRP+KJ5iRBSQ3WgZ8V DmkFuSWlTijvnS/Ii0DcOrrqyznXcXQBEUNLRrjE9yDfxhq2NT3F5Z1/XWZ+il7OtuJz Q8mgDtszs9pfmJ6XdrsbPKWvyEHkZq+ULeYg91Fm3YFzJtKRFv4z8Az4bolRxOIGaP/E BaDmkUoN8oOjgOF5X5Ss0UTUoOGlo71eC/58jHNZK101CuuqzvTKdSSokk5qGdcUa0jk Jgaw== X-Gm-Message-State: AMke39k7ark8PGsQxIr4HA9X2xFAhjQuGdxEY4b/iguRq7CIi+67R5vCYHwBjq0D+RDjP45I4qQIK92UEfBLIQ== X-Received: by 10.36.60.211 with SMTP id m202mr493249ita.58.1488491053194; Thu, 02 Mar 2017 13:44:13 -0800 (PST) MIME-Version: 1.0 Received: by 10.36.87.82 with HTTP; Thu, 2 Mar 2017 13:44:12 -0800 (PST) In-Reply-To: <2572E3FC-0139-4946-A12D-9D9509C402F1@azet.org> References: <352D31A3-5A8B-4790-9473-195C256DEEC8@sn3rd.com> <26137F3B-5655-44CA-877E-7168CE02DBF1@azet.org> <2572E3FC-0139-4946-A12D-9D9509C402F1@azet.org> From: Brian Smith Date: Thu, 2 Mar 2017 11:44:12 -1000 Message-ID: To: Aaron Zauner Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: IRTF CFRG , "" Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 21:44:15 -0000 Aaron Zauner wrote: > I'm not sure that text on key-usage limits in blocks in a spec > that fundamentally deals in records is less confusing, quite > the opposite (at least to me). 1. Consider an implementation that negotiates with another implementation to use a very large record size such as 1MB records. If the limit is specified in terms of records then the limit would need to be readjusted to the new max record size, or else the new extension is potentially unsafe to use. This shows that specifying the limits in terms of records is brittle. 2. If it is only safe to use an AES-GCM key for a certain number of blocks, where in the code is the best place to enforce the limit on the number of blocks? IMO, it is better to enforce it in the AES-GCM implementation itself, underneath the TLS layer. In that case the limit is best expressed in terms of the number of blocks. Specifying the limit in terms of records would be optimizing for implementations that enforce the limit at the wrong layer of abstraction. > As I pointed out earlier: I strongly recommend that any changes > to the spec are as clear als possible to engineers > (non-crypto/math people) -- e.g. why the spec is suddenly > dealing in blocks instead of records et cetera. Again; I really > don't see any reason to change text here - to me all suggested > changes are even more confusing. Given a limit in blocks, the arithmetic to keep track of the number of blocks is trivial, and very similar to the arithmetic that's already needed to split up a large byte stream into records and keep track of the record sequence number. Cheers, Brian -- https://briansmith.org/ From nobody Thu Mar 2 14:55:28 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 62E79128B37 for ; Thu, 2 Mar 2017 14:55:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BGAU-3ffwzAa for ; Thu, 2 Mar 2017 14:55:25 -0800 (PST) Received: from mail-qk0-x22d.google.com (mail-qk0-x22d.google.com [IPv6:2607:f8b0:400d:c09::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A2DE127601 for ; Thu, 2 Mar 2017 14:55:25 -0800 (PST) Received: by mail-qk0-x22d.google.com with SMTP id n127so149744174qkf.0 for ; Thu, 02 Mar 2017 14:55:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:subject:date:message-id:cc:to :mime-version; bh=xMJFhFtvypj1uSk8SPG8LdFqltjYCyNcsrU0PFCU6yM=; b=gOj65LHO72drRazn3OvH6fTtR7RtOqfLzXQ12lTFsg8390I039W+8ig7RiqiLBX9rV CphAePr1mTtk4SpjC2JzC4f9d3PqYge0T1OG2ao7lQdQ5Xw1bFPHwki0A2NWBXiOOD3z ge0JZCIt3akrP7oL7M10taVWIWGUTkvADHy8E= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:subject:date :message-id:cc:to:mime-version; bh=xMJFhFtvypj1uSk8SPG8LdFqltjYCyNcsrU0PFCU6yM=; b=V78ejyqR8/CDGcgFo1qFx7IVHj24gq30d1yyusdUcGDWJsA357ZcQX2Kr2BwEjL8df XisXtQ7tTuRG32osiKrlt97BCJKwjbJjSmsPxU/QwwL3Ua6RedRzTlSpD+DvhwxTTt0Q OKcbRvAH/HladTP9tohe0aE04cYpJTTszrc7XPfOnluXiZfWMvy0OcsQbPBG1o2a+JIE OzYw1R2gr0DlK7ZGyaSnirpIpTAEJqlT7AQv/G2bYFJvIRhSMn7wV/GAeo2M34LhY0E0 EWmA+H917Vut5qCpzDuNOSpLIjAVOxNV5Sac3c871y1CHa1QTkbHyQvzSSlAc79PFz7c a54A== X-Gm-Message-State: AMke39mmLh+VWRG+5dJt+UvBo3CIvofhK93FxGmgq4QjaEFqf/IrOdYbiUan0PtGDikKTw== X-Received: by 10.55.100.67 with SMTP id y64mr20379967qkb.290.1488495323274; Thu, 02 Mar 2017 14:55:23 -0800 (PST) Received: from [172.16.0.92] ([96.231.228.203]) by smtp.gmail.com with ESMTPSA id t25sm6306780qkl.29.2017.03.02.14.55.21 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 02 Mar 2017 14:55:22 -0800 (PST) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Thu, 2 Mar 2017 17:55:20 -0500 Message-Id: <453016F5-98A0-4BD7-8ACD-0B2EAF5F912D@sn3rd.com> To: "" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) Archived-At: Cc: draft-ietf-tls-rfc4492bis@ietf.org Subject: [TLS] Prepending "TLS" to registry names X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 22:55:26 -0000 Some of the TLS registry names begin with =E2=80=9CTLS=E2=80=9D and some = don=E2=80=99t. I added =E2=80=9CTLS=E2=80=9D to the beginning of names = of registries in = https://github.com/tlswg/draft-ietf-tls-iana-registry-updates. Maybe we = should do the same here? PR for proposed change: https://github.com/tlswg/rfc4492bis/pull/32 spt= From nobody Thu Mar 2 15:15:34 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 83CCC127601 for ; Thu, 2 Mar 2017 15:15:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KKn7a3Bc75UI for ; Thu, 2 Mar 2017 15:15:32 -0800 (PST) Received: from resqmta-po-08v.sys.comcast.net (resqmta-po-08v.sys.comcast.net [IPv6:2001:558:fe16:19:96:114:154:167]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 08469127A90 for ; Thu, 2 Mar 2017 15:15:31 -0800 (PST) Received: from resomta-po-14v.sys.comcast.net ([96.114.154.238]) by resqmta-po-08v.sys.comcast.net with SMTP id jZwUc772Zq9PljZwYcwOpq; Thu, 02 Mar 2017 23:15:30 +0000 Received: from [IPv6:::1] ([24.5.144.109]) by resomta-po-14v.sys.comcast.net with SMTP id jZwXcMFBsBKYljZwXcdZdR; Thu, 02 Mar 2017 23:15:30 +0000 To: tls@ietf.org, cfrg@ietf.org References: <352D31A3-5A8B-4790-9473-195C256DEEC8@sn3rd.com> <26137F3B-5655-44CA-877E-7168CE02DBF1@azet.org> <2572E3FC-0139-4946-A12D-9D9509C402F1@azet.org> From: Andrey Jivsov Message-ID: Date: Thu, 2 Mar 2017 15:15:28 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit X-CMAE-Envelope: MS4wfBf7lS8Q0JEbAWXCA/HtzBX4ko3u6Qf3WoVF+wD0qO/OO7ObLu4M76RVC1o0+e6YW8KtbyAx5IHKn4rlkXoBLIkEz3iKUYmGU31G1ClFzxNs8wrpUdw6 13jFtXnJXtzwVMMceT6uWzV4jcZEq5xBiOle6GZ008GlMNrkE+C1y9oluNcwRSU/fnN+DPnPeObVEQ== Archived-At: Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Mar 2017 23:15:33 -0000 I also think that counting in blocks is cleaner. Counting in bytes is a close alternative. I have a few nits below: On 03/02/2017 01:44 PM, Brian Smith wrote: > Aaron Zauner wrote: >> I'm not sure that text on key-usage limits in blocks in a spec >> that fundamentally deals in records is less confusing, quite >> the opposite (at least to me). > > 1. Consider an implementation that negotiates with another > implementation to use a very large record size such as 1MB records. If > the limit is specified in terms of records then the limit would need > to be readjusted to the new max record size, or else the new extension > is potentially unsafe to use. This shows that specifying the limits in > terms of records is brittle. Hm, while I agree that counting in wrong units is the main problem here, we over-count with records, which means that we re-key faster than needed. > 2. If it is only safe to use an AES-GCM key for a certain number of > blocks, where in the code is the best place to enforce the limit on > the number of blocks? IMO, it is better to enforce it in the AES-GCM > implementation itself, underneath the TLS layer. In that case the > limit is best expressed in terms of the number of blocks. Specifying > the limit in terms of records would be optimizing for implementations > that enforce the limit at the wrong layer of abstraction. Given that the event of reaching the limit requires TLS-level action, checking the limit at the TLS level seems reasonable. The lower-level block-cipher code should still have the logic to error out (using a more relaxed limit). > >> As I pointed out earlier: I strongly recommend that any changes >> to the spec are as clear als possible to engineers >> (non-crypto/math people) -- e.g. why the spec is suddenly >> dealing in blocks instead of records et cetera. Again; I really >> don't see any reason to change text here - to me all suggested >> changes are even more confusing. > > Given a limit in blocks, the arithmetic to keep track of the number of > blocks is trivial, and very similar to the arithmetic that's already > needed to split up a large byte stream into records and keep track of > the record sequence number. Also please consider counting in bytes. This may be more natural, especially with AES-GCM that doesn't expose higher levels to the block size granularity (as much as CBC does, anyway). > > Cheers, > Brian > From nobody Thu Mar 2 17:54:26 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DC87A129431; Thu, 2 Mar 2017 17:54:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.034 X-Spam-Level: * X-Spam-Status: No, score=1.034 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_DYNAMIC_IPADDR=1.951, RDNS_DYNAMIC=0.982, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JB97MqqNptY7; Thu, 2 Mar 2017 17:54:20 -0800 (PST) Received: from ip-64-139-1-69.sjc.megapath.net (ip-64-139-1-69.sjc.megapath.net [64.139.1.69]) by ietfa.amsl.com (Postfix) with ESMTP id E366E1279EB; Thu, 2 Mar 2017 17:54:19 -0800 (PST) Received: from shuksan (localhost [127.0.0.1]) by ip-64-139-1-69.sjc.megapath.net (Postfix) with ESMTP id CC005406061; Thu, 2 Mar 2017 17:54:18 -0800 (PST) X-Mailer: exmh version 2.7.2 01/07/2005 with nmh-1.3 To: Andrey Jivsov From: Hal Murray In-Reply-To: Message from Andrey Jivsov of "Thu, 02 Mar 2017 15:15:28 PST." Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Thu, 02 Mar 2017 17:54:18 -0800 Message-Id: <20170303015418.CC005406061@ip-64-139-1-69.sjc.megapath.net> Archived-At: Cc: cfrg@ietf.org, hmurray@megapathdsl.net, tls@ietf.org Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 01:54:22 -0000 crypto@brainhub.org said: > I also think that counting in blocks is cleaner. Counting in bytes is a > close alternative. Does counting bytes work? If the real limit is blocks, I think you will have to round up the byte count when you send a partial block. If re-keying too often isn't too expensive, you could get a safe answer by counting bytes and assuming that every byte went in a separate block. You might want to round down many more orders of magnitude so the re-key code gets exercised often enough. Or maybe provide a back door to set the limit so that path can be tested with reasonable resources. -- These are my opinions. I hate spam. From nobody Thu Mar 2 18:33:04 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D0B0129460 for ; Thu, 2 Mar 2017 18:33:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RSu1C3fs_n4s for ; Thu, 2 Mar 2017 18:33:01 -0800 (PST) Received: from resqmta-po-03v.sys.comcast.net (resqmta-po-03v.sys.comcast.net [IPv6:2001:558:fe16:19:96:114:154:162]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84F87129477 for ; Thu, 2 Mar 2017 18:33:01 -0800 (PST) Received: from resomta-po-01v.sys.comcast.net ([96.114.154.225]) by resqmta-po-03v.sys.comcast.net with SMTP id jd0tcbXfXyXuHjd1gc5PG9; Fri, 03 Mar 2017 02:33:00 +0000 Received: from [IPv6:::1] ([24.5.144.109]) by resomta-po-01v.sys.comcast.net with SMTP id jd1fcqYwG8jz5jd1gc1zIs; Fri, 03 Mar 2017 02:33:00 +0000 To: Hal Murray References: <20170303015418.CC005406061@ip-64-139-1-69.sjc.megapath.net> From: Andrey Jivsov Message-ID: Date: Thu, 2 Mar 2017 18:32:59 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 In-Reply-To: <20170303015418.CC005406061@ip-64-139-1-69.sjc.megapath.net> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit X-CMAE-Envelope: MS4wfH3tVOs1W5JO6eUaHvUYL+A87IgD3LIENcTPlu4GC2Oum77KKCkQphZCelAjc94Jmek9toovK9KI3Rc0C8jv5qClqrLDOipcVgv8a9HfUDC4I3hzDfFN vG5l3cpEPg45bPODvNN077c9eI7DTmW59orWygaA1dXLO+N487YUkx2tZn0DRoQ0rRIZsFeYrY7exkx5r42JJU5clD2tDFvoqSs= Archived-At: Cc: cfrg@ietf.org, tls@ietf.org Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 02:33:03 -0000 On 03/02/2017 05:54 PM, Hal Murray wrote: > > crypto@brainhub.org said: >> I also think that counting in blocks is cleaner. Counting in bytes is a >> close alternative. > > Does counting bytes work? If the real limit is blocks, I think you will have > to round up the byte count when you send a partial block. > > If re-keying too often isn't too expensive, you could get a safe answer by > counting bytes and assuming that every byte went in a separate block. > > You might want to round down many more orders of magnitude so the re-key code > gets exercised often enough. Or maybe provide a back door to set the limit > so that path can be tested with reasonable resources. > I like the idea of setting the rekey limits, so that the code can be tested. There is no 3DES in TLS 1.3. You refer to some under-counting. The worst case is mod 16 = 1 byte sized TLS records, in which case the "tails" will only be counted as 1 block per 16 TLS records v.s. desired 16. We are undercounting less than one 16-byte block per record. One can count in record_size_in_bytes + 16 as one solution (overcount). However, is it true that 1-byte terminal blocks must be counted as full 16-byte blocks? 1-byte blocks don't seem to directly apply to the proofs with distinguishing game. With 1-byte plaintext / ciphertext we are not making statements about two values from the 1^128 members space. Rather, we are discussing two values from the tiny 256 members space. Also, a truncated AES-GCM encryption behaves as PRF and not PRP. From nobody Fri Mar 3 01:22:15 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9097912942F; Fri, 3 Mar 2017 01:22:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i41Kgq-7D_p4; Fri, 3 Mar 2017 01:22:12 -0800 (PST) Received: from mail-wm0-x241.google.com (mail-wm0-x241.google.com [IPv6:2a00:1450:400c:c09::241]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F7DA1293F4; Fri, 3 Mar 2017 01:22:12 -0800 (PST) Received: by mail-wm0-x241.google.com with SMTP id m70so2131184wma.1; Fri, 03 Mar 2017 01:22:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=wEWtpphl9RZzzGtA1kNj91g6/6XNiY0y+GjbawoKf/I=; b=mYwqRfErUJ2ceUdPSJo6dt/yBYDQw7/eWlQAPFMtuG++CExL2eSZbDi12jvISDZOsR MBasr4wNIFfGVbVswigQYqaBmhRioXXEXzn4ViCl5aLFau74zzx1F+GU/4MjmLq634MB AbBRXt21iHCI2ms7azBw6Hmawj5mT/cipCF6HuO//FVcsPrRDlZVf5J9PqJfh939NfQQ GvcMJZYkaEeZGOrG536wXSMg7vUuFpwEr9rlXJrMgrQ+tjclUbc5NDYMvR+atQ9z2Qua S6mJTJDemtRi41zblR8l0mXtEby9W6TuAX/YoyFniOttJiQX/+Zeogf1ruHtugVzd9Rh OEmQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=wEWtpphl9RZzzGtA1kNj91g6/6XNiY0y+GjbawoKf/I=; b=OOWsFkkkau1+2S+sAKngeixrBlFZb9WLC1MvPQoKpOF7wBmN/C+WUDuAhqGbrdYxb9 d6Ybx4s+KXPgw7DLvOmWP/AaUczacuXm/Gy0/VKXY9lyWGPITIgBpCchoFmJUcqtz34M 4yqSKadcu7F25tmqre3LFKw9CUlwB3sy6xgOvdvqVdrgnzZ4Tqf35gasNGbZKxT2jYZY PBq0vfEP13u9Gfe4kyboUMqbECdcy+2nc14lkF3+mcma3i+HpWCrvkaIIFaL31GSFCr0 ynh7Hk6GSQYOPXGA1ciF4DZeSgCRWAMwJmCtHBSk4433rf8Pv8aNeocJR3hPdQifCS2F /FKA== X-Gm-Message-State: AMke39lL1MbVY/Jsjxvnd/WxAIyXGzoaQrx4WVGtEEzVW99w34o7lqbPOrxXqIFo2VIZBg== X-Received: by 10.28.198.132 with SMTP id w126mr1749078wmf.69.1488532930820; Fri, 03 Mar 2017 01:22:10 -0800 (PST) Received: from [192.168.1.18] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id r195sm2250748wme.25.2017.03.03.01.22.09 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 03 Mar 2017 01:22:10 -0800 (PST) From: Yoav Nir Message-Id: <3F458D44-2232-498C-944F-C3F72A53291A@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_E2B79941-1801-4DDA-9E97-E175F83AF075"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Fri, 3 Mar 2017 11:22:08 +0200 In-Reply-To: To: Andrey Jivsov References: <352D31A3-5A8B-4790-9473-195C256DEEC8@sn3rd.com> <26137F3B-5655-44CA-877E-7168CE02DBF1@azet.org> <2572E3FC-0139-4946-A12D-9D9509C402F1@azet.org> X-Mailer: Apple Mail (2.3259) Archived-At: Cc: cfrg@ietf.org, "tls@ietf.org list" Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769). X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 09:22:13 -0000 --Apple-Mail=_E2B79941-1801-4DDA-9E97-E175F83AF075 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi As an implementer I have no problem counting records, bytes or blocks = (OK, the last you usually don=E2=80=99t count directly but (n+15)/16 is = not beyond the capabilities of any implementer) So IMO whichever gives the tightest bound should be selected, and that = means blocks. Exercising the rekey code is up to developers, not document writers. Yoav --Apple-Mail=_E2B79941-1801-4DDA-9E97-E175F83AF075 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYuTXAAAoJELhJCxUKWMyZUR8H/iYd6W3i+BVVgeR1ApHqfkXL W2M5Omn2J9+8ivXDpMkYZpaJpvId46+wCr+VlLCxwI7dMLhRVdkrp9iVgXdA+TSO Q5hzUQGZAdPiG1LBti6tD+uY711YVXZS4QWAnQE24kpQKwmnc/SlsDpMMAKrTzIA qld80MMneGopfP9X3WXunpO1YCajaR5c2rAsTCj9J0fXG6MYU5izqNnhnKmOEcBC IK+Vf/WNtiPXEkGZEoGY1CmePCG9cnFmTC43zoPZTeLfo7AV4Va1iKmfLAdZGmHE YIMJY90ooPjIhcXvZGhJ3PF5meVbqUR+YqtackskvXWp4HxoP8ko0WAQpywhWnY= =2uHZ -----END PGP SIGNATURE----- --Apple-Mail=_E2B79941-1801-4DDA-9E97-E175F83AF075-- From nobody Fri Mar 3 15:32:26 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 67235129453 for ; Fri, 3 Mar 2017 15:32:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.202 X-Spam-Level: X-Spam-Status: No, score=-4.202 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fByqfPb09HG8 for ; Fri, 3 Mar 2017 15:32:22 -0800 (PST) Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5641C12941D for ; Fri, 3 Mar 2017 15:32:22 -0800 (PST) Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v23NWLa3003416 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 3 Mar 2017 23:32:21 GMT Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by userv0022.oracle.com (8.14.4/8.14.4) with ESMTP id v23NWKFW006141 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Fri, 3 Mar 2017 23:32:21 GMT Received: from abhmp0003.oracle.com (abhmp0003.oracle.com [141.146.116.9]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v23NWKLj024246 for ; Fri, 3 Mar 2017 23:32:20 GMT Received: from [10.132.189.81] (/10.132.189.81) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 03 Mar 2017 15:32:20 -0800 To: tls@ietf.org From: Bradford Wetmore Message-ID: <85c7a8fe-6963-ebbf-f600-49e88477ac26@oracle.com> Date: Fri, 3 Mar 2017 15:32:19 -0800 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Source-IP: userv0022.oracle.com [156.151.31.74] Archived-At: Subject: [TLS] "Spec Compliance" and the older TLS protocols X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 23:32:24 -0000 An interpretation question for our older RFCs, in particular TLSv1 [RFC2246] and TLSv1.1 [RFC4346] in the context of recent developments [SWEET32]. In particular, likely for minimal interoperability reasons, specific 3DES-based ciphersuites must be implemented in TLS: TLS 1.0 In the absence of an application profile standard specifying otherwise, a TLS compliant application MUST implement the cipher suite TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA. TLS 1.1 In the absence of an application profile standard specifying otherwise, a TLS compliant application MUST implement the cipher suite TLS_RSA_WITH_3DES_EDE_CBC_SHA. Ignoring the data limits approach, the degree of vendor/implementation response to these ciphersuites varies: 1. default enabled/available ciphersuites remain the same, 2. reduce the ciphersuite priority, but the ciphersuites are still enabled/available by default, 3. "disable" the ciphersuites by default, but allow for reenabling through API or system configuration, 4. remove the ciphersuites from the binary (e.g. via conditional compilation/packaging), 5. completely remove all trace from the library's source. So, strictly speaking from a RFC point of view (not practical or security POV, those are different questions), what do these "MUST implement" statements mean in order for an implementation to still be considered "spec-compliant" in the post-SWEET32 era. 1-2 above? 1-3? [RFC2119] isn't clear on whether 3 would be ok. Would 4-5 be considered technically non-compliant implementations? Thanks, Brad [SWEET32] https://sweet32.info/ [RFC2119] https://www.ietf.org/rfc/rfc2119.txt [RFC2246] https://www.rfc-editor.org/rfc/rfc2246.txt [RFC4346] https://www.rfc-editor.org/rfc/rfc4346.txt From nobody Fri Mar 3 16:00:15 2017 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id C72BD12967D; Fri, 3 Mar 2017 15:55:31 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , X-Test-IDTracker: no X-IETF-IDTracker: 6.46.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148858533181.15846.15286410494313978315.idtracker@ietfa.amsl.com> Date: Fri, 03 Mar 2017 15:55:31 -0800 Archived-At: Cc: tls@ietf.org Subject: [TLS] tls - Requested session has been scheduled for IETF 98 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Mar 2017 23:55:32 -0000 Dear Sean Turner, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. tls Session 1 (2:30:00) Tuesday, Morning Session I 0900-1130 Room Name: Zurich E/F size: 200 --------------------------------------------- Request Information: --------------------------------------------------------- Working Group Name: Transport Layer Security Area Name: Security Area Session Requester: Sean Turner Number of Sessions: 1 Length of Session(s): 2.5 Hours Number of Attendees: 120 Conflicts to Avoid: First Priority: curdle uta acme cfrg dane httpbis rtcweb saag stir tcpinc tokbind perc quic Second Priority: sacm oauth People who must be present: Eric Rescorla Stephen Farrell Sean Turner Joseph A. Salowey Resources Requested: Meetecho support in room Special Requests: --------------------------------------------------------- From nobody Sun Mar 5 02:55:29 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 14389129451 for ; Sun, 5 Mar 2017 02:55:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bNeSN_te3FDd for ; Sun, 5 Mar 2017 02:55:27 -0800 (PST) Received: from mail-qk0-x22f.google.com (mail-qk0-x22f.google.com [IPv6:2607:f8b0:400d:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 722D5129440 for ; Sun, 5 Mar 2017 02:55:27 -0800 (PST) Received: by mail-qk0-x22f.google.com with SMTP id v125so55573268qkh.2 for ; Sun, 05 Mar 2017 02:55:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=kL5L/yFWMjmGGKZvMtqO5HyKfCKx54jzDV4x+8Mt75Q=; b=doLfsOy4DRxYVHSPgRQDM60VTp9bzoPgdIHp41QfR7JhgKX2FOPibrUpVr7a4OSlRc 7EnI6Fsi/YnOBkN0GdX8XnqKh8CO1ZSrLw0K4eY1PNA68eBsgloLoEkGgSnmDT9hnoo2 aGPw9OGqaypK+Pv54QaC11uJwYmnKH4b4zGp0qBN6wxLQFLzDn3ApVdSHm1sJxKV1WkN siUfUzkQUlN6zvXSfIAq9R9Qml3ZpHDms/oQW4hnOanV2YydzIZl70xS1JMLU9Z9xu1q PrmRlV4lvDpRFvoBR0t/Lvd4oOHLxXweyp4TcfwR+txienAngrxYfy/VcOehiC0Iwcz4 ZaQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=kL5L/yFWMjmGGKZvMtqO5HyKfCKx54jzDV4x+8Mt75Q=; b=aBxYrjHvOZSFTsnb9k/ZBi2SE2ZLeq87Oz7Ojw3V05oIucH9KvP3YNMNKJfxm3SKkR 7wghF/EZmRQ5col/Tk9eGQ1HQ/9E3rv7/120NEs4UFGx6s8n2dbcRAJaSmKeXGlbQSli HxuG94pLQMiPG1mP0zQdsJMf7m0MhKsTqbb+UJHbUAazpC9k+zq9vYe05aNsBekZ9ojw jghVkLtEFpBOXDkbpGhjTqdBoI7TH0DMrHDA04xlYHaHWb12Jn+uo8xjrwraFLS9p2zz pdlGVbFIjbGVn8mI/Kl2irvWxhPMJkDC71eRYS7XLoOj0FVYnWRbVlCAvUYS/NE8CMs2 b44g== X-Gm-Message-State: AMke39kOuhZeMyWsz0ytoxa/gJZJJmW7An+r6cimR/K6Dz3q3Pvi9prG8szZbVd0MIRJOs59j4sIiXFvi4rUtw== X-Received: by 10.237.51.5 with SMTP id u5mr12136028qtd.247.1488711326544; Sun, 05 Mar 2017 02:55:26 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.19.112 with HTTP; Sun, 5 Mar 2017 02:55:26 -0800 (PST) In-Reply-To: <85c7a8fe-6963-ebbf-f600-49e88477ac26@oracle.com> References: <85c7a8fe-6963-ebbf-f600-49e88477ac26@oracle.com> From: Martin Thomson Date: Sun, 5 Mar 2017 21:55:26 +1100 Message-ID: To: Bradford Wetmore Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] "Spec Compliance" and the older TLS protocols X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Mar 2017 10:55:29 -0000 If you want to lawyer up on this, I think that the official interpretation is that those RFCs were obsoleted by RFC 5246 and so if you support 5246, you can do what it says and not what the older specs say. I don't think that anyone will fault you if you decide to burn all traces of DES from your stack. It's your stack, and there's enough AES to go around. On 4 March 2017 at 10:32, Bradford Wetmore wrote: > An interpretation question for our older RFCs, in particular TLSv1 [RFC2246] > and TLSv1.1 [RFC4346] in the context of recent developments [SWEET32]. > > In particular, likely for minimal interoperability reasons, specific > 3DES-based ciphersuites must be implemented in TLS: > > TLS 1.0 > > In the absence of an application profile standard specifying > otherwise, a TLS compliant application MUST implement the cipher > suite TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA. > > TLS 1.1 > > In the absence of an application profile standard specifying > otherwise, a TLS compliant application MUST implement the cipher > suite TLS_RSA_WITH_3DES_EDE_CBC_SHA. > > Ignoring the data limits approach, the degree of vendor/implementation > response to these ciphersuites varies: > > 1. default enabled/available ciphersuites remain the same, > > 2. reduce the ciphersuite priority, but the ciphersuites are still > enabled/available by default, > > 3. "disable" the ciphersuites by default, but allow for reenabling through > API or system configuration, > > 4. remove the ciphersuites from the binary (e.g. via conditional > compilation/packaging), > > 5. completely remove all trace from the library's source. > > So, strictly speaking from a RFC point of view (not practical or security > POV, those are different questions), what do these "MUST implement" > statements mean in order for an implementation to still be considered > "spec-compliant" in the post-SWEET32 era. 1-2 above? 1-3? [RFC2119] isn't > clear on whether 3 would be ok. > > Would 4-5 be considered technically non-compliant implementations? > > Thanks, > > Brad > > [SWEET32] https://sweet32.info/ > [RFC2119] https://www.ietf.org/rfc/rfc2119.txt > [RFC2246] https://www.rfc-editor.org/rfc/rfc2246.txt > [RFC4346] https://www.rfc-editor.org/rfc/rfc4346.txt > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls From nobody Sun Mar 5 04:04:19 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 07EA112947A for ; Sun, 5 Mar 2017 04:04:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bJssdmD10q5t for ; Sun, 5 Mar 2017 04:04:16 -0800 (PST) Received: from mail-wr0-x22b.google.com (mail-wr0-x22b.google.com [IPv6:2a00:1450:400c:c0c::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 872D0128B38 for ; Sun, 5 Mar 2017 04:04:16 -0800 (PST) Received: by mail-wr0-x22b.google.com with SMTP id u108so99465233wrb.3 for ; Sun, 05 Mar 2017 04:04:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=CPXZ2JbMF9HGZ5tykmf/6cAUVEFrT9IErusxdheahXE=; b=s294d5qpm4uoQNJ99w6kUfQrzxg5pgQYphSGGv8b/7O/nIAJO0F1V0UX1rUxZ/D+Es 6WChrWBlWvifjz5025SYLgXQCntZgtvvUeHKx/0YrlGb0jiJn7VrbVYeoHgWKE8YTPD5 6paEC+raaUhHxADFEufKTLl7NB+x3/URCykkvmoBu8Mn5RogICke/s0k9Fq+dq4Jh9RL xvPzU3zBXtVDtqkhrZPMcdKcibV/gZkD4+UMEHUBEdRqwsFNFmqusPtrQ9lsQA/LKyfS F6lGS8aM0EzbnSJnqcQPLDGNdvLL791Hn6Gl38nHD5wkyLkFTjVlC5y3GBlHhs2pSBPQ 9oYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=CPXZ2JbMF9HGZ5tykmf/6cAUVEFrT9IErusxdheahXE=; b=X8hIn7b/qsmKJyzGWQRhq3q7nwy417t+ZQSV+DTBx8PDsV+q8JBgtKfAkJbvCGK1D7 OQcYq0BZ43R0oBmeEu0ypQSB36w7SQENkexhfwNVg0fqMXzgQM4HZMVGdD67uOY75auX ACdklWDTflhdz69nsVUq/C7SQypn7gfEqPM5WkPEywTF15gFqGpc3im+ZOSbscI/tjC2 TuexzWeaOFpulU3G7+nCe+d68f+o+HL9GoxTG3d7ZYdeG2kMlSwCCfpmH9QXdw++rj9y qF9zfUsNru0JJtRsmr0lYk7nbNeBqP7YPOpZXRqZw6W5twTgHCbMgQ3vVS/rbx2DpNyh Du2w== X-Gm-Message-State: AMke39lMsAJrsonW4n3v5nOJIUzv9AfQyMg+Ld9trUezJHu9QA7xUk3lcPgZd313HAEYqA== X-Received: by 10.223.135.1 with SMTP id a1mr1562627wra.174.1488715454705; Sun, 05 Mar 2017 04:04:14 -0800 (PST) Received: from [172.24.250.100] (dyn32-131.checkpoint.com. [194.29.32.131]) by smtp.gmail.com with ESMTPSA id 63sm10626935wmg.22.2017.03.05.04.04.13 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 05 Mar 2017 04:04:13 -0800 (PST) From: Yoav Nir Message-Id: <073D1922-03EA-4D7E-AD3E-78A85F42EF90@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_5BA52019-208D-4E0D-9A79-3A6C69116F70"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Sun, 5 Mar 2017 14:04:09 +0200 In-Reply-To: <85c7a8fe-6963-ebbf-f600-49e88477ac26@oracle.com> To: Bradford Wetmore References: <85c7a8fe-6963-ebbf-f600-49e88477ac26@oracle.com> X-Mailer: Apple Mail (2.3259) Archived-At: Cc: tls@ietf.org Subject: Re: [TLS] "Spec Compliance" and the older TLS protocols X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Mar 2017 12:04:18 -0000 --Apple-Mail=_5BA52019-208D-4E0D-9A79-3A6C69116F70 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi, Brad What Martin said. Additionally, I work for a vendor that has to really = =E2=80=9Clawyer up=E2=80=9D sometimes. So if RFC 2246 says =E2=80=9CMUST implement X=E2=80=9D and your code = doesn=E2=80=99t implement X, just don=E2=80=99t claim compliance with = RFC 2246. You can still have TLS 1.0 code for BC. In general, people looking for statements about compliance will be fine = with only claiming compliance with the latest and greatest as long as = the latest and greatest is also implemented in their =E2=80=9Cother = side=E2=80=9D. So TLS 1.2 is likely good enough. As for what =E2=80=9CMUST implement=E2=80=9D means, there have been very = long-winded discussions about this over the years. The general agreement = seems to be =E2=80=9Cmust implement but not necessarily enabled=E2=80=9D. = So if your implementation has TLS_RSA_WITH_3DES_EDE_CBC_SHA and it=E2=80=99= s disabled by default and there=E2=80=99s some way to enable it, you can = still claim RFC 4346 compliance. Yoav > On 4 Mar 2017, at 1:32, Bradford Wetmore = wrote: >=20 > An interpretation question for our older RFCs, in particular TLSv1 = [RFC2246] and TLSv1.1 [RFC4346] in the context of recent developments = [SWEET32]. >=20 > In particular, likely for minimal interoperability reasons, specific = 3DES-based ciphersuites must be implemented in TLS: >=20 > TLS 1.0 >=20 > In the absence of an application profile standard specifying > otherwise, a TLS compliant application MUST implement the cipher > suite TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA. >=20 > TLS 1.1 >=20 > In the absence of an application profile standard specifying > otherwise, a TLS compliant application MUST implement the cipher > suite TLS_RSA_WITH_3DES_EDE_CBC_SHA. >=20 > Ignoring the data limits approach, the degree of vendor/implementation = response to these ciphersuites varies: >=20 > 1. default enabled/available ciphersuites remain the same, >=20 > 2. reduce the ciphersuite priority, but the ciphersuites are still = enabled/available by default, >=20 > 3. "disable" the ciphersuites by default, but allow for reenabling = through API or system configuration, >=20 > 4. remove the ciphersuites from the binary (e.g. via conditional = compilation/packaging), >=20 > 5. completely remove all trace from the library's source. >=20 > So, strictly speaking from a RFC point of view (not practical or = security POV, those are different questions), what do these "MUST = implement" statements mean in order for an implementation to still be = considered "spec-compliant" in the post-SWEET32 era. 1-2 above? 1-3? = [RFC2119] isn't clear on whether 3 would be ok. >=20 > Would 4-5 be considered technically non-compliant implementations? >=20 > Thanks, >=20 > Brad >=20 > [SWEET32] https://sweet32.info/ > [RFC2119] https://www.ietf.org/rfc/rfc2119.txt > [RFC2246] https://www.rfc-editor.org/rfc/rfc2246.txt > [RFC4346] https://www.rfc-editor.org/rfc/rfc4346.txt >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls --Apple-Mail=_5BA52019-208D-4E0D-9A79-3A6C69116F70 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYu/66AAoJELhJCxUKWMyZHPAIAJq5fiaTam32+XdsDrIWlNwj pXl3u5GFr2VC1eA1cEhaMDWQZPM0HD8ejmZlv5uS1RpAt3ENDW+dLM5M9oZcTHdi JZ4/xT+z/FD6NZu/6BjJ+d7uUagIL/SqzDpeeAWCdQyf4sOs5wwqO497+aT3QxtP IZCH1fG4eaXVleSlAFVDXsZ7P5rOv1B34F6k2B1mhWUOOLfPp/2j3zG0FGMGkLJY QCgJdWwN/LcXVgMUk3rtHklYFTTaWEF05zxQhZsh8BYppPZDzBxXfmzkKEWVcSNF i8vrfO+iWq6/iGRtX2f1wuttUudcs/66HiBMsSpUldUfmH4RAoh4gDo2S6XTy80= =etck -----END PGP SIGNATURE----- --Apple-Mail=_5BA52019-208D-4E0D-9A79-3A6C69116F70-- From nobody Sun Mar 5 16:18:02 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9568E129562 for ; Sun, 5 Mar 2017 16:18:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3IJAGRgJnXSR for ; Sun, 5 Mar 2017 16:18:00 -0800 (PST) Received: from mail-qk0-x22f.google.com (mail-qk0-x22f.google.com [IPv6:2607:f8b0:400d:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4EE4312955D for ; Sun, 5 Mar 2017 16:18:00 -0800 (PST) Received: by mail-qk0-x22f.google.com with SMTP id p64so11717181qke.1 for ; Sun, 05 Mar 2017 16:18:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=fiPFUhSMS6NcvVRdtf60dmW2z8dSLOGJAE1HebLMpzA=; b=gR6iX8oXIzzyemtSn+dyyix40CM9QPcOs00xXFgFm43GVLWe/hmwbF2oMGMN/DXUOD 2OCgyEr6mk7KwO1ZS9qBWFm2WeVYKU93cc19TqaPjLC3RgHUIpM9kiZHJwzX1BVld+sP 8fkTrV9umPYE6NoCZPyROnx3EH+C17vKuJAUci6dD/OprnUWspEc7zm0GhHWdHXxprQm as251Y1+ieYDxJlAUD9hISkynLq/t/A2bIw5Rv2k/WCNqq4/eilP16EqJ/sGJWfxZj+S VVJR2igljSN8LFGad8sMF4lNzXdkeajGJqSdz8RnRxIGxV4WJUYHBPHByzpUlgMi4462 E+yw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=fiPFUhSMS6NcvVRdtf60dmW2z8dSLOGJAE1HebLMpzA=; b=LmDrFNVc7MwgubTIgVcF0+45mZdXjwgFWFX+mS0ozkcSpZEAz4mIDe7goCzdS8+OZJ ywqL9Ly5I9GzfrjU6+EuPv6YSsCrM/l/NIRuda+l0SWqD+oaI1c6Yp4gvFY5sf8dEUEF 9tY+npy9XJ+yfmVEredYtab0bcHXyVlxRGhwk2TkU+A27Gq3xBXEwmReuy6pf3lfmMEi eBtKZ45Vjux0zacapoS7g6bC+ObPaPfgk3kgFyUqXEczxQWueZd7GeBmS6z7Vb9uYkIl kTjyWq74U+y3oJf+0Lxis95evmTS1Ygdd2b/x3Wpg9svX8YRGQkeuAUIYzsmiyNhJBzK 2PSw== X-Gm-Message-State: AMke39koKFSyD6LQQ++hw5qugRtlEWCDOAq6UdBK5qaSwL722sg+baBfX0SxL9MSiIuQMJBKh7F0UA96xZouRA== X-Received: by 10.200.33.210 with SMTP id 18mr1284097qtz.159.1488759479408; Sun, 05 Mar 2017 16:17:59 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.19.112 with HTTP; Sun, 5 Mar 2017 16:17:59 -0800 (PST) From: Martin Thomson Date: Mon, 6 Mar 2017 11:17:59 +1100 Message-ID: To: "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: [TLS] Application Data payload X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 00:18:01 -0000 The section on the maximum early data size says this: "Only Application Data payload is counted." I don't know how to interpret that. I can see arguments for counting TLSInnerPlaintext.content or all of TLSInnerPlaintext. From nobody Sun Mar 5 22:06:22 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D875D129445 for ; Sun, 5 Mar 2017 22:06:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R3ymNPlPmtab for ; Sun, 5 Mar 2017 22:06:19 -0800 (PST) Received: from mail-qk0-x22e.google.com (mail-qk0-x22e.google.com [IPv6:2607:f8b0:400d:c09::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9E1C127071 for ; Sun, 5 Mar 2017 22:06:19 -0800 (PST) Received: by mail-qk0-x22e.google.com with SMTP id 1so137939054qkl.3 for ; Sun, 05 Mar 2017 22:06:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=6y2bLYtxBQzLCswHG9s98zK1t9lqOSe0yfafkOf4KlA=; b=e4nd3z4zUTgGMN4JWJEzcMzUyPHPsde0nfIoz690BcCK5/pGgmUxMzqpRHBiRwLAEu UEBtXd8xDJ4bnQv84KUK0n3n/JNTLSkxVwrGAdqyScmSdmlrhwb/8F2fn0Nr9R9tHdFY 3vKTmFDbRV+UK2jfweeztl0ZIcP22tqEKsycLKaswuCHoekMlKSL5shhTDT1BsKuV0nK pUnr4U+Dx/OD/dVSeFNFEItsycyoVmuqhr4oDxda4hum18XaPebIAYJ7UkT2SYZtWKtt NONUVkB75qDkeURPsurrb3BgOiGmjndYzl2e7PVXIJDPA8da6xfehjoT48ynoxFmiUvS x6Iw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=6y2bLYtxBQzLCswHG9s98zK1t9lqOSe0yfafkOf4KlA=; b=jB7w8nvuaYfebdmvw9KIz2aYTlck73FnJ/51Wt1VlyA7E22UyLx4Qvjzk6A/zhix8/ UNSKe0t8WxJ6pP/GuUBgK78ooNAMt0EXeyYGKePvnXpjTbLSkLZn5Roe6xIkGX0jovza SAJUI9kOmszizw/3U3PIPxdIvSXQkHRBWLKB4smQ2YSpVXfE5gAUccWtgga6WCfn7RP6 ICrQ7HhF8q9QS0nIt0U7i+xuD3GoTNMFE+q/vWEPBJfLrVFu7KwRmhDWmF8y21GRHSjf awwPKsaB9PR5i9ESHicQWq5JEY2Om2GtNMFmzdJIRWjvZb1dKzHa5eDkXE7c/6JUIwri rCJg== X-Gm-Message-State: AMke39kPO3Y6qIKUPrkSI0UQlE0l+PuRWzRRUF1z90BmU9LKKUpiP2c+9qWy3sO83inPFGjWsCexMN76tkZSQA== X-Received: by 10.55.17.138 with SMTP id 10mr15244931qkr.202.1488780378783; Sun, 05 Mar 2017 22:06:18 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.19.112 with HTTP; Sun, 5 Mar 2017 22:06:18 -0800 (PST) In-Reply-To: References: From: Martin Thomson Date: Mon, 6 Mar 2017 17:06:18 +1100 Message-ID: To: "tls@ietf.org" , Filippo Valsorda Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] Application Data payload X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 06:06:21 -0000 (Adding Filippo, who wrote the original change.) I just did some spelunking of the archives, and poking at boring SSL. I found that David Benjamin mentions unencrypted data, which seems to be consistent with what boring implements: I don't think that this makes sense: the true cost to the server is in the data it has to store, not process (a client has many better options for causing the server to expend CPU resources). Any data that can be ignored is cheap. On 6 March 2017 at 11:17, Martin Thomson wrote: > The section on the maximum early data size says this: > > "Only Application Data payload is counted." > > I don't know how to interpret that. I can see arguments for counting > TLSInnerPlaintext.content or all of TLSInnerPlaintext. From nobody Mon Mar 6 00:41:20 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CF7C12946C for ; Mon, 6 Mar 2017 00:41:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.923 X-Spam-Level: X-Spam-Status: No, score=-6.923 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WXuPTOSg1fUK for ; Mon, 6 Mar 2017 00:41:17 -0800 (PST) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CEC5D129465 for ; Mon, 6 Mar 2017 00:41:17 -0800 (PST) Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 8F1D1C02C017; Mon, 6 Mar 2017 08:41:18 +0000 (UTC) Received: from dhcp-10-40-1-102.brq.redhat.com ([10.40.3.156]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id v268fGZs026259 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 6 Mar 2017 03:41:17 -0500 Message-ID: <1488789676.3078.5.camel@redhat.com> From: Nikos Mavrogiannopoulos To: Bradford Wetmore , tls@ietf.org Date: Mon, 06 Mar 2017 09:41:16 +0100 In-Reply-To: <85c7a8fe-6963-ebbf-f600-49e88477ac26@oracle.com> References: <85c7a8fe-6963-ebbf-f600-49e88477ac26@oracle.com> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 2.68 on 10.5.11.24 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Mon, 06 Mar 2017 08:41:18 +0000 (UTC) Archived-At: Subject: Re: [TLS] "Spec Compliance" and the older TLS protocols X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 08:41:19 -0000 On Fri, 2017-03-03 at 15:32 -0800, Bradford Wetmore wrote: > An interpretation question for our older RFCs, in particular TLSv1  > [RFC2246] and TLSv1.1 [RFC4346] in the context of recent > developments  > [SWEET32]. > > In particular, likely for minimal interoperability reasons, specific  > 3DES-based ciphersuites must be implemented in TLS: > > TLS 1.0 > >     In the absence of an application profile standard specifying >     otherwise, a TLS compliant application MUST implement the cipher >     suite TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA. > > TLS 1.1 > >     In the absence of an application profile standard specifying >     otherwise, a TLS compliant application MUST implement the cipher >     suite TLS_RSA_WITH_3DES_EDE_CBC_SHA. I do not think the TLS 1.0 MUST requirement for a mandatory ciphersuite was ever implemented at the time TLS 1.0 was the latest protocol. None of the browsers of the time supported TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA. TLS 1.1 was modified to reflect the actual situation as you see above. > So, strictly speaking from a RFC point of view (not practical or  > security POV, those are different questions), what do these "MUST  > implement" statements mean in order for an implementation to still > be  > considered "spec-compliant" in the post-SWEET32 era.  1-2 above?  1- > 3?  > [RFC2119] isn't clear on whether 3 would be ok. Spec compliance at the time of TLS 1.0 and TLS 1.1 was interoperation with the available browsers and servers. The spec itself didn't result to guaranteed interoperability. regards, Nikos From nobody Mon Mar 6 01:12:06 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B062129421 for ; Mon, 6 Mar 2017 01:12:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.602 X-Spam-Level: X-Spam-Status: No, score=-2.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id equcfn61zshL for ; Mon, 6 Mar 2017 01:12:02 -0800 (PST) Received: from mout.gmx.net (mout.gmx.net [212.227.15.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 58F53126BF6 for ; Mon, 6 Mar 2017 01:12:02 -0800 (PST) Received: from [192.168.91.177] ([80.92.114.23]) by mail.gmx.com (mrgmx003 [212.227.17.190]) with ESMTPSA (Nemesis) id 0LskfZ-1cI7cs4BzN-012IW4 for ; Mon, 06 Mar 2017 10:12:00 +0100 To: "" From: Hannes Tschofenig Openpgp: id=071A97A9ECBADCA8E31E678554D9CEEF4D776BC9 Message-ID: <296debba-b5a5-d063-4e01-59a3f110fe14@gmx.net> Date: Mon, 6 Mar 2017 10:11:58 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="GdCclr7mlFM0vwAfKAXG2kNA9sGt7cIPV" X-Provags-ID: V03:K0:dCoaN9sb34wbXmPKTp0Dg3o2JIRHNxklAjyWVMFaq6/CmMUM+6E xczL0Ta0YTwQVYfGWKbAKyYppd1G0VTZ4JeD9JpGE/rmUoaTvUjLSaDhAHumLPL96sgjnuA QENqUxBw4Hhzh1jxZIcCjYZsmhRG/imJldzsNmu5zBDOvY4EL70wuWhBM17pm0VSmYxEjNZ 6b3giepczPwZ9w2/4vr5w== X-UI-Out-Filterresults: notjunk:1;V01:K0:nlvXRveX3wY=:gn9Vb61hrpzYDq1UBB4cvu xlC+BqxFm7Ee/YoNrU99A1YbKsdb2oqmYFavMJoLpF0BU/Wr1YqKli45xSk/JEKX7dr6UQJFJ yznH7c8KRliq+HJ0yE201q9ZARH72UzuzbTBs8LmcSWKUN/xoH+oJbNrVrrBHiwJ7tOteQ4xo pNNmixYFRBRWsb1ghcw7BNoCFdSrcJGryCEdXkzGk0eEx9a6Z78N9MfWTXPgPd3Y85yeg0bkV BsQSgh8TmxJAsxCHs3zYzHrGaHMbjwJ8At/L2XKJdtRIJVNn+/unFLz3sYVjKxszAROW17A4P IloVouY4fF8sh/MtSEN7lkVg7lRuMcV/eweLValaLoFsuLSereXrb1++WPhwfMKf9d948Zivd 8Ry/2GCPlLQKV3Xeria/+diL7TkNMtM75um4XYsZVruuCpUBDGQa/vNByMrytq2tThKhUpw3j b1aPrM/i5zNWWseWWw8gtJNmPd2oWU4o5HoL6FRH7A5jboCpwYzJGVUo0yynpbvA10BnQcFqP tq2ofksAN4uGNfZoDEBW8NM3OeRjg77VFiagemeAIGW5M3LLyjIw+V918N9FvLx2jXwWrLE/w QTFy9mh4vhxbGRpdkh2VyOWl7JHsA1FQyj8aU9OhkfeeP+BIs3BM7GqTQTm5p4q3YbkJK2S3E uexlUyh3Wz99EbgoKZ3Z6REpr8NB5DBk339RaMil8zQ5RTmhvLJnJQOvClBHlk2RtZ8tDdxWL Eghf3CmOGkk55ATKr5gik/heySyOrZj8VRuFKazlP6uPjnDt7cVbuBnJi2Y= Archived-At: Subject: [TLS] TLS 1.3 Record Layer Format X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 09:12:04 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --GdCclr7mlFM0vwAfKAXG2kNA9sGt7cIPV Content-Type: multipart/mixed; boundary="iDkQrFHRnSfX7c4CeVtuuhPE9WHo3BdpI"; protected-headers="v1" From: Hannes Tschofenig To: "" Message-ID: <296debba-b5a5-d063-4e01-59a3f110fe14@gmx.net> Subject: TLS 1.3 Record Layer Format --iDkQrFHRnSfX7c4CeVtuuhPE9WHo3BdpI Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi all, at the Seoul IETF meeting it was mentioned that the record layer format may be simplified (by removing unused fields) if deployment tests real no problems. Sorry if I missed information about the outcome of these deployment tests but the current spec version still has the old record layer format.= As I mentioned in previous meetings I believe that such a record layer simplification would be quite useful for environments where link layer technologies provide very small MTU sizes. Ciao Hannes --iDkQrFHRnSfX7c4CeVtuuhPE9WHo3BdpI-- --GdCclr7mlFM0vwAfKAXG2kNA9sGt7cIPV Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: GPGTools - http://gpgtools.org iQEcBAEBCgAGBQJYvSffAAoJEGhJURNOOiAt73QIAI4Vmg/jjVKa8+zJrKUJ/an1 HPXq7XHH9F6NxOozJ0Wtuq6LFtYsXzMZOLSbWEphVm7DAMyXKOfVdOBou7BsGn9J cLNGtEzvNrxuW5R9MsV9iBiiBgPwTocA/9BriA1ePkpxmz6c14CL/vBR9Pjxm7nL 8ikB3F7lfLoB2/GjPpLwwLUEZp3jC+otcnJ90dYoPLPQnhDHgUNUGTP4XSxV9tHY YH+Cxo6g1sjuLLOWCQPPkhk6nVJlkbz13D6R02W/7BzXIB85isuQ53kKD/gykdiH 9fRhEzg0ZpwrFORLX47Ra+ZgAYIA90IAboWAYHHqA3TvQGzcyVI3wEwFR0k2DOg= =LA0N -----END PGP SIGNATURE----- --GdCclr7mlFM0vwAfKAXG2kNA9sGt7cIPV-- From nobody Mon Mar 6 07:55:28 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CFAAC129860 for ; Mon, 6 Mar 2017 07:55:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wyTOt1JPye1Z for ; Mon, 6 Mar 2017 07:55:25 -0800 (PST) Received: from welho-filter1.welho.com (welho-filter1.welho.com [83.102.41.23]) by ietfa.amsl.com (Postfix) with ESMTP id DD68312985F for ; Mon, 6 Mar 2017 07:55:24 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by welho-filter1.welho.com (Postfix) with ESMTP id 6FC7E1F5EC; Mon, 6 Mar 2017 17:55:23 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp1.welho.com ([IPv6:::ffff:83.102.41.84]) by localhost (welho-filter1.welho.com [::ffff:83.102.41.23]) (amavisd-new, port 10024) with ESMTP id lLUec5fYMHSP; Mon, 6 Mar 2017 17:55:23 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp1.welho.com (Postfix) with ESMTPSA id 3C788C4; Mon, 6 Mar 2017 17:55:23 +0200 (EET) Date: Mon, 6 Mar 2017 17:55:17 +0200 From: Ilari Liusvaara To: Hannes Tschofenig Message-ID: <20170306155516.GA24925@LK-Perkele-V2.elisa-laajakaista.fi> References: <296debba-b5a5-d063-4e01-59a3f110fe14@gmx.net> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <296debba-b5a5-d063-4e01-59a3f110fe14@gmx.net> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Cc: "" Subject: Re: [TLS] TLS 1.3 Record Layer Format X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 15:55:27 -0000 On Mon, Mar 06, 2017 at 10:11:58AM +0100, Hannes Tschofenig wrote: > Hi all, > > at the Seoul IETF meeting it was mentioned that the record layer format > may be simplified (by removing unused fields) if deployment tests real > no problems. > > Sorry if I missed information about the outcome of these deployment > tests but the current spec version still has the old record layer format. Yeah, I haven't seen those results either. > As I mentioned in previous meetings I believe that such a record layer > simplification would be quite useful for environments where link layer > technologies provide very small MTU sizes. AFAIK, one can save 3 bytes from the header for encrypted records in TLS 1.3. Won't go well with SRTP mux tho. (2 octet encoding for such record headers: +-+---------------+ |1|Length(15 bits)| +-+---------------+ These won't overlap with other TLS 1.3 records, as all others always have MSB of first octet clear). -Ilari From nobody Mon Mar 6 10:04:42 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 281EB1294BE for ; Mon, 6 Mar 2017 10:04:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.37 X-Spam-Level: X-Spam-Status: No, score=-2.37 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.229, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wvq6ieedkRD9 for ; Mon, 6 Mar 2017 10:04:39 -0800 (PST) Received: from mail-io0-x22e.google.com (mail-io0-x22e.google.com [IPv6:2607:f8b0:4001:c06::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A0D96129491 for ; Mon, 6 Mar 2017 10:04:39 -0800 (PST) Received: by mail-io0-x22e.google.com with SMTP id z13so74745689iof.2 for ; Mon, 06 Mar 2017 10:04:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=wS9JS4iI38DVoEDg5K+FmsIHjXlaFb0EASTaI9z8oHI=; b=rolxD375vQWvWsx1BVTx6uxqw5fjil3cr5ib+ZhDxvTvs83/hlfrVNQ2OvQjPkr/33 H/aLLMvBAnwZistzkJ9GqgBVIn+k0JK6G4VhFDmBghtiwL3RN0UarEl2b9d4nzkUMxIg Mw3jC7zcbCufBmZgvyYfdjtu0NJdw4/z7Wer63ETcCO92hnwFDO65Vcd9hnyAv3IQONR EyGlTdHYPLJVesLYUE8XQ2wtKbxE1c2SNrNeSZ2hGPeXDiKyKmLUjpMFXGEZLbt7ua22 w+iC5eG3VEXftRZ1CYoLghXDUdlUMa/ZWNQoN7ateoMRtFQhrsIxAjg+TwRLPJ/zfor8 6jyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=wS9JS4iI38DVoEDg5K+FmsIHjXlaFb0EASTaI9z8oHI=; b=eGYN07JhuOEFnnrT9TIm9BZ9vbal2ITOV979Pozrd7h7Fv8Cn78602tTFHg7kZBH5S nHDO/pZ1Op2/M/fEUuscWwtv9AmbNNaRAc95sVOjvWmvQgaDbSoC3OATZNk9/mlDkQ2R ut+17wIOGT/Id0WLhfpsUZmhJ2AfU5iaiK7QC5dexFH8n2OD/FSthD+zCP0r08I2KtqQ 3dbr7JIXRntH3Dy9LHa5FhKXAAZyQXiV0bSWQVF4cGrmTOquwS2nAw1vHdKfDX+zM6PK WTrW2/vWR01UWKhSiFkMZ+YCdmzaQROGKJMhLz6c8t0+XFT+WatgXKDJr4pR8Cr0Hfjz 2f8g== X-Gm-Message-State: AMke39l6f4A77C4btotHlhXhYBy/EIRcvMnXJIKtCUjKNR6iXKDh0UQLoCdSzlWAlLNZJ6Ln40uvw6LHnvkw7g== X-Received: by 10.107.129.214 with SMTP id l83mr15561316ioi.168.1488823479062; Mon, 06 Mar 2017 10:04:39 -0800 (PST) MIME-Version: 1.0 Sender: alangley@gmail.com Received: by 10.36.144.4 with HTTP; Mon, 6 Mar 2017 10:04:38 -0800 (PST) In-Reply-To: <20170306155516.GA24925@LK-Perkele-V2.elisa-laajakaista.fi> References: <296debba-b5a5-d063-4e01-59a3f110fe14@gmx.net> <20170306155516.GA24925@LK-Perkele-V2.elisa-laajakaista.fi> From: Adam Langley Date: Mon, 6 Mar 2017 10:04:38 -0800 X-Google-Sender-Auth: LJ53T3a9PrdvfiWqFUd6ZGrpeAQ Message-ID: To: Ilari Liusvaara Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "" Subject: Re: [TLS] TLS 1.3 Record Layer Format X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 18:04:41 -0000 On Mon, Mar 6, 2017 at 7:55 AM, Ilari Liusvaara wrote: >> Sorry if I missed information about the outcome of these deployment >> tests but the current spec version still has the old record layer format. > > Yeah, I haven't seen those results either. We have not yet gotten around to doing those tests and, given the amount of problems that resulted from a test of TLS 1.3 without any record-header changes, we are wondering whether it's worth doing those tests. (We're not yet ready to share details of the deployment problems that we have encountered so far, but I hope to do so in the coming weeks.) Cheers AGL -- Adam Langley agl@imperialviolet.org https://www.imperialviolet.org From nobody Mon Mar 6 10:42:51 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A5C20129963 for ; Mon, 6 Mar 2017 10:42:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q1ZGi2XW71CT for ; Mon, 6 Mar 2017 10:42:49 -0800 (PST) Received: from mail-yw0-x235.google.com (mail-yw0-x235.google.com [IPv6:2607:f8b0:4002:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 06188129960 for ; Mon, 6 Mar 2017 10:42:49 -0800 (PST) Received: by mail-yw0-x235.google.com with SMTP id p77so128212454ywg.1 for ; Mon, 06 Mar 2017 10:42:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=RruE1/FDbxKX7oGYeVsknEgZictrj1M8vhK9eF7mM1o=; b=B9CiTucf3IPMTHdA+aVx78/LyGhzTOJd4Df+5FBApOYDdsHxF1Em9xb7UQcgyYaFmB YYsuAcs/Tfc1dmGq3A5BUKZrdGQLK4kNW1hW5S3WoRBRasBcU1g96z1yoPbMxlBfhckv nkpyjEKl+J+JDyPx9VEEe9T2Pxt4r3QUrQzaGVDBWzhftWnap0nhGYGv3O3WQqXx67s6 K9mYP58x9Bzcin7m48U+4myVkQi/IX2M7MEed8txNZDQvThUPcbo2QH3VwzkMIJv+3YA LmR6RPPG3JyEh4jsFP2PW4gl8JWLF6uAEEJPea/1neC/j5pxcLyghk3pAVyuCKXGMSn7 pSBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=RruE1/FDbxKX7oGYeVsknEgZictrj1M8vhK9eF7mM1o=; b=G34u88KnN9j5keMEFXkQw9bESH4BJF6tNF1ICiF7Mk8y2h5fsh7KPWm11IqltvI3wV zjmP0tUrw0oj8r7q/WcTIDeBWH8mbk7ZOjxt4aipr0zhNP44sYylh1/lHNYIZCxD15ie by2PxyrAOKsi3e9B8pluD/hCjnxcgsd2I844upsXfyJOhBkHa33px/BVZ1oEC5UQX4AC Nw6xZOG3jbzxT5CQ/w8ihhK42o0cDokx+IeZdr9RNvsGmaqoU2O/T/lcydMXag6v4kxb dRCLDJHwSPGQ7QSbDG1tcRl60hK9NTZSa7DbgZxHW2jE6qTx1F9ZjlpOPVCT3qWmcEBE fn1A== X-Gm-Message-State: AMke39m+px6EpxsOtccDBbxYrdFDRYF1Ty+m5e8lak0TGj+d9GHnOUSg3Yy3XoBcW8ojpmyMZ3tx078ZovaMFA== X-Received: by 10.37.173.82 with SMTP id l18mr12920702ybe.107.1488825768088; Mon, 06 Mar 2017 10:42:48 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Mon, 6 Mar 2017 10:42:07 -0800 (PST) In-Reply-To: References: <296debba-b5a5-d063-4e01-59a3f110fe14@gmx.net> <20170306155516.GA24925@LK-Perkele-V2.elisa-laajakaista.fi> From: Eric Rescorla Date: Mon, 6 Mar 2017 10:42:07 -0800 Message-ID: To: Adam Langley Content-Type: multipart/alternative; boundary=f403045eb8ea0a3cc9054a144326 Archived-At: Cc: "" Subject: Re: [TLS] TLS 1.3 Record Layer Format X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 18:42:50 -0000 --f403045eb8ea0a3cc9054a144326 Content-Type: text/plain; charset=UTF-8 We (Firefox) have been running an experiment to measure this, but we don't yet have anything to share about it. I expect by IETF, however. Not saying that these results will be dispositive, but I should have something. -Ekr On Mon, Mar 6, 2017 at 10:04 AM, Adam Langley wrote: > On Mon, Mar 6, 2017 at 7:55 AM, Ilari Liusvaara > wrote: > >> Sorry if I missed information about the outcome of these deployment > >> tests but the current spec version still has the old record layer > format. > > > > Yeah, I haven't seen those results either. > > We have not yet gotten around to doing those tests and, given the > amount of problems that resulted from a test of TLS 1.3 without any > record-header changes, we are wondering whether it's worth doing those > tests. > > (We're not yet ready to share details of the deployment problems that > we have encountered so far, but I hope to do so in the coming weeks.) > > > Cheers > > AGL > > -- > Adam Langley agl@imperialviolet.org https://www.imperialviolet.org > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --f403045eb8ea0a3cc9054a144326 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
We (Firefox) have been running an experiment to measure th= is, but we don't yet have
anything to share about it. I expect by I= ETF, however. Not saying that these results
will be dispositive, = but I should have something.

-Ekr


On Mon,= Mar 6, 2017 at 10:04 AM, Adam Langley <agl@imperialviolet.org>= ; wrote:
On Mon, = Mar 6, 2017 at 7:55 AM, Ilari Liusvaara
<ilariliusvaara@welho.com> wrote:
>> Sorry if I missed information about the outcome of these deploymen= t
>> tests but the current spec version still has the old record layer = format.
>
> Yeah, I haven't seen those results either.

We have not yet gotten around to doing those tests and, given the amount of problems that resulted from a test of TLS 1.3 without any
record-header changes, we are wondering whether it's worth doing those<= br> tests.

(We're not yet ready to share details of the deployment problems that we have encountered so far, but I hope to do so in the coming weeks.)


Cheers

AGL

--
Adam Langley agl@imperialviolet.o= rg https://www.imperialviolet.org

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--f403045eb8ea0a3cc9054a144326-- From nobody Mon Mar 6 13:43:31 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B038E1294E6 for ; Mon, 6 Mar 2017 13:43:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zUwWo0H-rL90 for ; Mon, 6 Mar 2017 13:43:29 -0800 (PST) Received: from mail-pg0-x232.google.com (mail-pg0-x232.google.com [IPv6:2607:f8b0:400e:c05::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CD5AB1294C3 for ; Mon, 6 Mar 2017 13:43:28 -0800 (PST) Received: by mail-pg0-x232.google.com with SMTP id 187so16771076pgb.3 for ; Mon, 06 Mar 2017 13:43:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=faPnl3m7DxbR6jOn7Fxf+YG7wFZ02vJi302PDn9KzTk=; b=ZagagEXP8/VGwL5ZXj1IxVRFb0vZkYzgaIe/iGjY/EtTo+TMPSB2Np5hzb8Cz1mJX/ hz/cgX0z6uSAQx7j/tcLcDYI4m+vBJUHewFWa9oETMuRJcwuSP0S4Uq4uNCac+TN1kAa +dZJ2/Ux2SadHQM2yGGWHA7PKPpXFndT3S+Do= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=faPnl3m7DxbR6jOn7Fxf+YG7wFZ02vJi302PDn9KzTk=; b=Tlzfm3qZxLUl1DP3SRAZ4fn9N4PMSh2jDgFpOuh/RNaG2shCgolKedwpyHgAXwI4I+ eUzKA45LoRT/ylapk4Z/rjYDwoXxfcN/5Q5tecGubz5niD0o43egHhxO7MLCUCTyAodV MfOLd14ckQVKTwgSwBN9Ed1R5fp9Xuzjl+FVDQL5oHaymhAsij2FntCPxzML9cegr0rY gxo1C4msvjuwHv0V8OEZfA4eoGVUPChpXl3l+jfETMS24IIgd9Ly0BqUxOcgyEOScjV5 3+8ZtaVWvb3YvAsXX8NbOBSx7GMFbMxNzUxwgc+rLKKMUmek8BHpn8Rp1ISgrac6+jDu Kejg== X-Gm-Message-State: AMke39nemtY4g14tZZOBItUdku2BPnKrjUCKD8HmP1JPtP2K0V6VoYXprmtC8K3QTht2so5b7BBYyTz5tqkXw46M X-Received: by 10.84.146.140 with SMTP id g12mr29220591pla.70.1488836608171; Mon, 06 Mar 2017 13:43:28 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: David Benjamin Date: Mon, 06 Mar 2017 21:43:17 +0000 Message-ID: To: Martin Thomson , "tls@ietf.org" , Filippo Valsorda Content-Type: multipart/alternative; boundary=94eb2c12fc1a28effb054a16c971 Archived-At: Subject: Re: [TLS] Application Data payload X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 21:43:31 -0000 --94eb2c12fc1a28effb054a16c971 Content-Type: text/plain; charset=UTF-8 To clarify, our interpretation of the spec was that it is the encrypted data, not unencrypted data. Separately, we limit unencrypted data that we skip over, as I mentioned in that thread. These are not the same units as max_early_data_size are currently specified, so we intend to advertise a smaller value in the ticket to compensate for this difference. David On Mon, Mar 6, 2017 at 1:06 AM Martin Thomson wrote: > (Adding Filippo, who wrote the original change.) > > I just did some spelunking of the archives, and poking at boring SSL. > I found that David Benjamin mentions unencrypted data, which seems to > be consistent with what boring implements: > > > > I don't think that this makes sense: the true cost to the server is in > the data it has to store, not process (a client has many better > options for causing the server to expend CPU resources). Any data > that can be ignored is cheap. > > On 6 March 2017 at 11:17, Martin Thomson wrote: > > The section on the maximum early data size says this: > > > > "Only Application Data payload is counted." > > > > I don't know how to interpret that. I can see arguments for counting > > TLSInnerPlaintext.content or all of TLSInnerPlaintext. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --94eb2c12fc1a28effb054a16c971 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
To clarify, our interpretation of the spec was that it is = the encrypted data, not unencrypted data.

Separately, we= limit unencrypted data that we skip over, as I mentioned in that thread. T= hese are not the same units as=C2=A0max_early_data_size are currently speci= fied, so we intend to advertise a smaller value in the ticket to compensate= for this difference.

David

On Mon, Mar 6, 2017 at 1:06 AM Martin Tho= mson <martin.thomson@gmail.c= om> wrote:
(Adding Filippo, = who wrote the original change.)

I just did some spelunking of the archives, and poking at boring SSL.
I found that David Benjamin mentions unencrypted data, which seems to
be consistent with what boring implements:

<https:/= /mailarchive.ietf.org/arch/msg/tls/b5GpGR9QQpBV3tbxCspdHVJs8HU>

I don't think that this makes sense: the true cost to the server is in<= br class=3D"gmail_msg"> the data it has to store, not process (a client has many better
options for causing the server to expend CPU resources).=C2=A0 Any data
that can be ignored is cheap.

On 6 March 2017 at 11:17, Martin Thomson <martin.thomson@gmail.co= m> wrote:
> The section on the maximum early data size says this:
>
> "Only Application Data payload is counted."
>
> I don't know how to interpret that.=C2=A0 I can see arguments for = counting
> TLSInnerPlaintext.content or all of TLSInnerPlaintext.

_______________________________________________
TLS mailing list
TLS@i= etf.org
https://www.ietf.org/mailman/listinfo/t= ls
--94eb2c12fc1a28effb054a16c971-- From nobody Mon Mar 6 14:52:41 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB4B1129A69 for ; Mon, 6 Mar 2017 14:52:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NYCGvUKM5l49 for ; Mon, 6 Mar 2017 14:52:39 -0800 (PST) Received: from mail-qk0-x235.google.com (mail-qk0-x235.google.com [IPv6:2607:f8b0:400d:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D9E22129547 for ; Mon, 6 Mar 2017 14:52:38 -0800 (PST) Received: by mail-qk0-x235.google.com with SMTP id p64so61547482qke.1 for ; Mon, 06 Mar 2017 14:52:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=5yJzGqlS0R/Z82Jrkr++DpqSWddQWoDr6g6LZabqzWY=; b=Hu61EhvM9GGnbc3j1Xvn5y1ZD7PUuz5N9uHoJVTQ/6+c5r6yJeqNrp+SEozWw6jkOm Jx/EvJE3spx3N2nM4+m+PIJ06cKnQr2rAFcNQSQzA1s2Xwl5tk/9b/QZVMpM4kBhNBWS jTcrGEPkFqufAfmraMhWWi+KOmW573mi4aXk9kINlUi+LdunoHq3BqlLLAjN1CtqAFR4 Zu29bjU+BOu/lNhj6v5eOxD1BbP3OOo37E0iLzmPajgJ26P/JX7cDJRdZgYfN+8jnKOy 1XQZltDJD1lmbYGf7NYkT6jziglQEM1eGBBwjRrP8sm1oPyGM77QpOf+c/GZR/hNY7IK 0rzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=5yJzGqlS0R/Z82Jrkr++DpqSWddQWoDr6g6LZabqzWY=; b=OM4lqXJoK/ob/6R42vNhFq+1653tmy0b/WSZWzc4Zu/lEafSclV7FLt5io04Qf5MmT OhyJW4ZUBzUpi9BSKx/+LJ166/2aNogycC+21dG25xFt0iJy13PjPc2gLAhwWSA86Q85 vfYiCXph6u54dsMTgYMYv0R3wN8GRJnQleytxYDTHuDuc45o/JuSGNOaFPicbReVZzRF 7I7dXsCoGbjuDFZRQ39AmfRnJ0UtU0s+abd30wcRjLhuYbpLNEjPXQk0EK+WaWYYBYMz FqSYTVOqze+NSU+lyy5fmRXsLrypeZJwx/XZ1GSVJM79tH2Ln3N+7O4gtqkywagpM5wl wXcQ== X-Gm-Message-State: AMke39kPQ7M5o9KjrlKMEqhtWdWnfqxvDNzmUOgZIN8BuKdJo1gAou2Ncwk6o/2SI2gqiz2ih8vK4gLLdxvHEA== X-Received: by 10.237.41.100 with SMTP id s91mr19453568qtd.143.1488840758028; Mon, 06 Mar 2017 14:52:38 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.19.112 with HTTP; Mon, 6 Mar 2017 14:52:37 -0800 (PST) In-Reply-To: References: From: Martin Thomson Date: Tue, 7 Mar 2017 09:52:37 +1100 Message-ID: To: David Benjamin Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: Filippo Valsorda , "tls@ietf.org" Subject: Re: [TLS] Application Data payload X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 22:52:40 -0000 On 7 March 2017 at 08:43, David Benjamin wrote: > To clarify, our interpretation of the spec was that it is the encrypted > data, not unencrypted data. Well, clearly we disagree. To be clear, I don't mind much if it's the encrypted data, though we'd need to also agree if the count included the authentication tag (yes, probably) and the record header (I don't know). You appear to be conflating two things: 1. The amount of data that a server might have to hold on to when it accepts 0-RTT. The original reason Filippo suggested this feature was so that it would be possible for their servers to hold 0-RTT data until the handshake was complete. 2. Records that do nothing other than waste server time. Into this category we can place records with only padding or very little actual data, extra key updates, CertificateRequest, and - the one you highlight here - early data that is ignored. My interpretation was that the first the only thing that needed tight bounds, the second could be quite fuzzy and could come down to things like current server load and DoS mitigation strategies. We really need to agree on the right answer here. From nobody Mon Mar 6 14:58:20 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CAD3D129A6B for ; Mon, 6 Mar 2017 14:58:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TauGQkrSCX6r for ; Mon, 6 Mar 2017 14:58:13 -0800 (PST) Received: from mail-qk0-x22d.google.com (mail-qk0-x22d.google.com [IPv6:2607:f8b0:400d:c09::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 40419129545 for ; Mon, 6 Mar 2017 14:58:10 -0800 (PST) Received: by mail-qk0-x22d.google.com with SMTP id y76so49099077qkb.0 for ; Mon, 06 Mar 2017 14:58:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=0BcMc9C4GVjQiJdqqPXGV12qLMHlxAhAP+0FwqyXraw=; b=DOnjLTaYTOzJqyjpp4SAUpuCXwiyHHvtoF+1HFVej7LVoYEuJ8SgbK1QAsNZGPFii9 QC5GmliUlyyTHhYAVWcIG+dtmGq+U551qNhBmuGa8l/1GSA89moU+w64uVkIgj6P+pqY t4zncq6p3BCEC2GZRQETNh5g7Dn6aIcrtDSMI/0fhJk0Su5mD02hVHUwlwnb0J4j4hBa yCSQuN7KBmZuOg1/HZhOkB34NcxwQArBuKb1/ikliKwQTLzH1y0zzRjwEj4+sqmjZjFh Xg7/nLKNc8Q/ynH6L0u76zE1R/v/6C6eMZF7egEmEl8QyqfoUh1ibVdkcTMzF1lGIppA SOeg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=0BcMc9C4GVjQiJdqqPXGV12qLMHlxAhAP+0FwqyXraw=; b=i2H9EJIVGvix1sbvHf8nQpFT3iZjyYBx4UCXiwa8bAutq8FZzjWhi5qm0Pieig6vBI lWfYFUJpfawQaBR6jBv+iQEvrAyDM3o3DEnShdS98VGXSrzaHuu1Mg6b2bA8NP6tHfX+ MQ1yyKqgTd8naQLL+04/+ydMZDVLTsI4zAQ8SmMIgeuqoKBQa+pE6MU6wzPvgG+WV1HH Is1SlPBC1oZTdkpWQZ+yDUhXDBToHzEg22xYafhe14y1qMCK9Dohc2yU0ODr4ObdWgLn GyR9aMj+GfNVJV3wHU2rbe0gm5ZOBa9PhUWCX7Rdeoh3FLaE9gz1YbP4/Pcx++KzB8xW UM0w== X-Gm-Message-State: AMke39nH/LV49tvFK86q9RTtb0vAXDEkIUJ8wT0i+I/lBhzcTDSFInNL9osXwVOcWi/rsbt7gyfdj8RtknXd2Tgx X-Received: by 10.200.35.36 with SMTP id a33mr17815593qta.216.1488841089081; Mon, 06 Mar 2017 14:58:09 -0800 (PST) MIME-Version: 1.0 Received: by 10.55.47.4 with HTTP; Mon, 6 Mar 2017 14:58:08 -0800 (PST) From: Victor Vasiliev Date: Mon, 6 Mar 2017 17:58:08 -0500 Message-ID: To: "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a113a7db83e4cfb054a17d438 Archived-At: Subject: [TLS] Certificate compression draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 22:58:15 -0000 --001a113a7db83e4cfb054a17d438 Content-Type: text/plain; charset=UTF-8 Certificate compression has been discussed on this list briefly before, and there was some interest in at least considering a draft for it. The draft now exists (co-authored by Alessandro and myself), and it can be found at: https://datatracker.ietf.org/doc/draft-ghedini-tls-certificate-compression/ [ GitHub repo: https://github.com/ghedo/tls-certificate-compression ] The proposed scheme allows a client and a server to negotiate a compression algorithm for the server certificate message. The scheme is purely opt-in on both sides. The current version of the draft defines zlib and Brotli compression, both of which are well-specified formats with an existing deployment experience. There are multiple motivations to compress certificates. The first one is that the smaller they are, the faster they arrive (both due to the transfer time and a decreased chance of packet loss). The second, and more interesting one, is that having small certificates is important for QUIC in order to achieve 1-RTT handshakes while limiting the opportunities for amplification attacks. Currently, TLS 1.3 over TCP without client auth looks like this: Round trip 1: client sends SYN, server sends SYN ACK Here, the server provides its own random value which client will have to echo in the future. Round trip 2: client sends ACK, ClientHello, server sends ServerHello...Finished Here, ACK confirms to server that the client can receive packets and is not just spoofing its source address. Server can send the entire ServerHello to Finished flight. In QUIC, we are trying to merge those two rounds into one. The problem, however, is that the ClientHello is one packet, and ServerHello...Finished can span multiple packets, meaning that this could be used as an amplification attack vector since the client's address is not yet authenticated at this point. In order to address this, the server has to limit the number of packets it sends during the first flight (i.e. ServerHello...Finished flight). Since certificates make up the majority of data in that flight, making them smaller can push them under the limit and save a round-trip. Cheers, Victor. --001a113a7db83e4cfb054a17d438 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Certificate compression has been discussed on this li= st briefly before, and
there was some interest in at least consid= ering a draft for it.=C2=A0 The draft now
exists (co-authored by = Alessandro and myself), and it can be found at:

https://datatracker.ietf.org/doc/draft-ghedini-tls-certificate-c= ompression/

The proposed scheme allows a= client and a server to negotiate a compression
algorithm for the= server certificate message.=C2=A0 The scheme is purely opt-in on
both sides.=C2=A0 The current version of the draft defines zlib and Brotli=
compression, both of which are well-specified formats with an ex= isting
deployment experience.

There are = multiple motivations to compress certificates.=C2=A0 The first one is that<= /div>
the smaller they are, the faster they arrive (both due to the tra= nsfer time and
a decreased chance of packet loss).

=
The second, and more interesting one, is that having small certi= ficates is
important for QUIC in order to achieve 1-RTT handshake= s while limiting the
opportunities for amplification attacks.=C2= =A0 Currently, TLS 1.3 over TCP without
client auth looks like th= is:

=C2=A0 Round trip 1: client sends SYN, server = sends SYN ACK
=C2=A0 =C2=A0 Here, the server provides its own ran= dom value which client will
=C2=A0 =C2=A0 have to echo in the fut= ure.
=C2=A0 Round trip 2: client sends ACK, ClientHello, server s= ends ServerHello...Finished
=C2=A0 =C2=A0 Here, ACK confirms to s= erver that the client can receive packets and is not
=C2=A0 =C2= =A0 just spoofing its source address.=C2=A0 Server can send the entire Serv= erHello to
=C2=A0 =C2=A0 Finished flight.

In QUIC, we are trying to merge those two rounds into one.=C2=A0 The prob= lem,
however, is that the ClientHello is one packet, and ServerHe= llo...Finished can
span multiple packets, meaning that this could= be used as an amplification
attack vector since the client's= address is not yet authenticated at this point.
In order to addr= ess this, the server has to limit the number of packets it sends
= during the first flight (i.e. ServerHello...Finished flight).=C2=A0 Since
certificates make up the majority of data in that flight, making t= hem smaller
can push them under the limit and save a round-trip.<= /div>

Cheers,
=C2=A0 Victor.
--001a113a7db83e4cfb054a17d438-- From nobody Mon Mar 6 15:06:52 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E92D12896F for ; Mon, 6 Mar 2017 15:06:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6W7AySfDSvlu for ; Mon, 6 Mar 2017 15:06:45 -0800 (PST) Received: from mail-qk0-x235.google.com (mail-qk0-x235.google.com [IPv6:2607:f8b0:400d:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 963F6129810 for ; Mon, 6 Mar 2017 15:06:45 -0800 (PST) Received: by mail-qk0-x235.google.com with SMTP id v125so118108807qkh.2 for ; Mon, 06 Mar 2017 15:06:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=WyErdY0HlEGrVDWSZl6hVRh1/jVdzG3JzOR5QZWN4As=; b=h+2UfAq2jPfs0BkayAlBzcD7rq1Hvf3j1MFvAff+xrx/9pGAwudn8F3IWWCFtjw1ek yEtATpZLZwIDDYulElr/jAJ4u5N7n2KUNE2iSLUTAwh5fvX5DEogUHMAyyjOzgE6uX3x lb5wfPuIF4STABgDBDaOyBmlddkljOK2YQYQQID2sqPmpw+EoggjrkPYgqGegkJ3+9/e YKBF+s7IoZmuKB5RGd8JBTGziIcDwBAgPDhIqMT1OkSDLhhtt0V7E4pnhe9kc3hEXllK E1rMAp+fInM0ds32j0m2GfCzMcSxlbI2B2BnZvVvjGNio6aTapAjjW8NBK9NkpVHnZs6 bP7w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=WyErdY0HlEGrVDWSZl6hVRh1/jVdzG3JzOR5QZWN4As=; b=goPA0YeMAf2/9r4eHwrvI3HzSDk55mnxFq+o4pwCnjHWQGnhNw0CdXjP6P0rHW/pQW 00km8/qjYnr6oG6iscuwiZVkEbdHiJVJBmddIVVkMNZPlBeIg8uzjet53h2LlaTK1q1B Dlg5TmRk0sEoxbwnAfzifw5WV+4nJ85O2TXb7mgdN8A6IS00m/NEDTowwq/uuMVcEUFE pJEJY6M2lQcE3zwwaZF/w8spXUdN9tAXPSIoHTypnTTJL3oMmdb6Tow7eIS+EHNmi9CR rVHFf/a0oaRbW0NhoG7N7mOOXmwkSvqlveqG/DwS3ePNouNsiXEhoyVlL1ypBjD0EzfQ bsPg== X-Gm-Message-State: AMke39lgH08LIw60Z6pAn1psscuysy/uIDkaM2GqsHZI9YESKwtMALlpvW0TmXwArad9HON1kPb+CZkMLXJx3Q== X-Received: by 10.55.151.7 with SMTP id z7mr18326260qkd.316.1488841604765; Mon, 06 Mar 2017 15:06:44 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.19.112 with HTTP; Mon, 6 Mar 2017 15:06:44 -0800 (PST) In-Reply-To: References: From: Martin Thomson Date: Tue, 7 Mar 2017 10:06:44 +1100 Message-ID: To: Victor Vasiliev Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Certificate compression draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 23:06:47 -0000 Hi Victor, Do you have any evidence to suggest that this reduces size in any meaningful way? Certificates tend to include both repetitious values (OIDs), and non-repetitious values (keys). On 7 March 2017 at 09:58, Victor Vasiliev wrote: > Certificate compression has been discussed on this list briefly before, and > there was some interest in at least considering a draft for it. The draft > now > exists (co-authored by Alessandro and myself), and it can be found at: > > https://datatracker.ietf.org/doc/draft-ghedini-tls-certificate-compression/ > [ GitHub repo: https://github.com/ghedo/tls-certificate-compression ] > > The proposed scheme allows a client and a server to negotiate a compression > algorithm for the server certificate message. The scheme is purely opt-in > on > both sides. The current version of the draft defines zlib and Brotli > compression, both of which are well-specified formats with an existing > deployment experience. > > There are multiple motivations to compress certificates. The first one is > that > the smaller they are, the faster they arrive (both due to the transfer time > and > a decreased chance of packet loss). > > The second, and more interesting one, is that having small certificates is > important for QUIC in order to achieve 1-RTT handshakes while limiting the > opportunities for amplification attacks. Currently, TLS 1.3 over TCP > without > client auth looks like this: > > Round trip 1: client sends SYN, server sends SYN ACK > Here, the server provides its own random value which client will > have to echo in the future. > Round trip 2: client sends ACK, ClientHello, server sends > ServerHello...Finished > Here, ACK confirms to server that the client can receive packets and is > not > just spoofing its source address. Server can send the entire > ServerHello to > Finished flight. > > In QUIC, we are trying to merge those two rounds into one. The problem, > however, is that the ClientHello is one packet, and ServerHello...Finished > can > span multiple packets, meaning that this could be used as an amplification > attack vector since the client's address is not yet authenticated at this > point. > In order to address this, the server has to limit the number of packets it > sends > during the first flight (i.e. ServerHello...Finished flight). Since > certificates make up the majority of data in that flight, making them > smaller > can push them under the limit and save a round-trip. > > Cheers, > Victor. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > From nobody Mon Mar 6 15:07:08 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41334129A6F for ; Mon, 6 Mar 2017 15:06:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FWHxvyOu_L39 for ; Mon, 6 Mar 2017 15:06:54 -0800 (PST) Received: from mail-pg0-x22c.google.com (mail-pg0-x22c.google.com [IPv6:2607:f8b0:400e:c05::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D5EA12896F for ; Mon, 6 Mar 2017 15:06:54 -0800 (PST) Received: by mail-pg0-x22c.google.com with SMTP id 25so71417013pgy.0 for ; Mon, 06 Mar 2017 15:06:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=1woRfZVD46OtiKQy++UdEZjheF062hgbUIcwz+/FK2o=; b=OMh2wsaTTG8dqenbmUvhceWvDsGB+o2JjoHkB1oduOve9MgSrjvf2uRYXXKmFfoKVa JtTvIbPLnc+YXQmd1GnMfyq58n9rs8HkXbWJWhm/erozm5uofeaOdzPXbode1rt9ViJc q62Ca2TnSD2EGY4zdvSLVZpikXkO6uaorUxBk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=1woRfZVD46OtiKQy++UdEZjheF062hgbUIcwz+/FK2o=; b=MNOmwGnhkljGr4/Xet6b8DwMQRnPp3XugLawcsFqsJteo4Z9OCqLmJWXnpjPv5ptMa v1AMgPGI8RQK8qkR7ZzNyVKbs7OBBeN8ZEQx2xg0nC7bNxs2J/Qg+6J0uC/c6iAW1yJc u+2kgfAr7oRNVf8fUe0HwDh7jBdgfADxVF0GooXTIWGdhRngj08jvcYWZdBz87PdUtfV 9+pdSt9BDFZFkLqjk1kT1FyEe8FfIGD7FoYU9vutyUf/oppklhG2hmyGdc/c9+Poi+hq L5SG6SuUYXcnK6BwMIm1UhYx8m5Ln+dxUkScgwPojCp2Tri2PYrZJ9hqNoL90ZskKMQi MJew== X-Gm-Message-State: AMke39m20cPXid2e/680irIcETFJ4+yMP1ZlPsEEnu7GVCGmC6g1tCbw0svhgSgG2hJzOsfowa9C1ykGIr6MygWE X-Received: by 10.99.45.3 with SMTP id t3mr24136635pgt.162.1488841613901; Mon, 06 Mar 2017 15:06:53 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: David Benjamin Date: Mon, 06 Mar 2017 23:06:43 +0000 Message-ID: To: Martin Thomson Content-Type: multipart/alternative; boundary=94eb2c114a02867050054a17f345 Archived-At: Cc: Filippo Valsorda , "tls@ietf.org" Subject: Re: [TLS] Application Data payload X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 23:06:59 -0000 --94eb2c114a02867050054a17f345 Content-Type: text/plain; charset=UTF-8 On Mon, Mar 6, 2017 at 5:52 PM Martin Thomson wrote: > On 7 March 2017 at 08:43, David Benjamin wrote: > > To clarify, our interpretation of the spec was that it is the encrypted > > data, not unencrypted data. > > Well, clearly we disagree. To be clear, I don't mind much if it's the > encrypted data, though we'd need to also agree if the count included > the authentication tag (yes, probably) and the record header (I don't > know). > > You appear to be conflating two things: > > 1. The amount of data that a server might have to hold on to when it > accepts 0-RTT. The original reason Filippo suggested this feature was > so that it would be possible for their servers to hold 0-RTT data > until the handshake was complete. > > 2. Records that do nothing other than waste server time. Into this > category we can place records with only padding or very little actual > data, extra key updates, CertificateRequest, and - the one you > highlight here - early data that is ignored. > > My interpretation was that the first the only thing that needed tight > bounds, the second could be quite fuzzy and could come down to things > like current server load and DoS mitigation strategies. > > We really need to agree on the right answer here. > I think we are in agreement and failing to communicate due to the poor choice of terminology. Partway through the thread the interpretation of "encrypted data" switched from "data to be encrypted" to "data that is encrypted". (You first objected that "unencrypted data" matches what BoringSSL implements and now that "encrypted data" matches.) Let's try this again: As the spec is written right now, our interpretation is that max_early_data_size counts the plaintext application data, not including any encryption and record-level overhead. This aligns with (1). Separately, we bound how much data on the wire we will skip over. This is (2). These are not the same units, so we intend to advertise a smaller number as a fuzzy estimate and don't anticipate the fuzziness mattering much. David --94eb2c114a02867050054a17f345 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On Mon, Mar 6,= 2017 at 5:52 PM Martin Thomson <martin.thomson@gmail.com> wrote:
On 7 March 2017 at 08:43, David Benjamin <davidben@chromiu= m.org> wrote:
> To clarify, our interpretation of the spec was that it is the encrypte= d
> data, not unencrypted data.

Well, clearly we disagree.=C2=A0 To be clear, I don't mind much if it&#= 39;s the
encrypted data, though we'd need to also agree if the count included the authentication tag (yes, probably) and the record header (I don't know).

You appear to be conflating two things:

1. The amount of data that a server might have to hold on to when it
accepts 0-RTT.=C2=A0 The original reason Filippo suggested this feature was=
so that it would be possible for their servers to hold 0-RTT data
until the handshake was complete.

2. Records that do nothing other than waste server time.=C2=A0 Into this category we can place records with only padding or very little actual
data, extra key updates, CertificateRequest, and - the one you
highlight here - early data that is ignored.

My interpretation was that the first the only thing that needed tight
bounds, the second could be quite fuzzy and could come down to things
like current server load and DoS mitigation strategies.

We really need to agree on the right answer here.

I think we are in agreement and failing to c= ommunicate due to the poor choice of terminology. Partway through the threa= d the interpretation of "encrypted data" switched from "data= to be encrypted" to "data that is encrypted". (You first ob= jected that "unencrypted data" matches what BoringSSL implements = and now that "encrypted data" matches.)

= Let's try this again:

As the spec is written r= ight now, our interpretation is that max_early_data_size counts the plainte= xt application data, not including any encryption and record-level overhead= . This aligns with (1).

Separately, we bound how m= uch data on the wire we will skip over. This is (2). These are not the same= units, so we intend to advertise a smaller number as a fuzzy estimate and = don't anticipate the fuzziness mattering much.

David
--94eb2c114a02867050054a17f345-- From nobody Mon Mar 6 15:08:56 2017 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A6A6129444; Mon, 6 Mar 2017 15:08:52 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.46.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148884173210.15101.6893420616464856834.idtracker@ietfa.amsl.com> Date: Mon, 06 Mar 2017 15:08:52 -0800 Archived-At: Cc: tls@ietf.org Subject: [TLS] I-D Action: draft-ietf-tls-rfc4492bis-14.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 23:08:52 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Transport Layer Security of the IETF. Title : Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier Authors : Yoav Nir Simon Josefsson Manuel Pegourie-Gonnard Filename : draft-ietf-tls-rfc4492bis-14.txt Pages : 33 Date : 2017-03-06 Abstract: This document describes key exchange algorithms based on Elliptic Curve Cryptography (ECC) for the Transport Layer Security (TLS) protocol. In particular, it specifies the use of Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) key agreement in a TLS handshake and the use of Elliptic Curve Digital Signature Algorithm (ECDSA) and Edwards Digital Signature Algorithm (EdDSA) as authentication mechanisms. This document obsoletes and replaces RFC 4492. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tls-rfc4492bis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-14 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tls-rfc4492bis-14 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Mar 6 15:12:08 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E854129A6F for ; Mon, 6 Mar 2017 15:12:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M6A8Rm_ANkQ1 for ; Mon, 6 Mar 2017 15:12:07 -0800 (PST) Received: from mail-qk0-x234.google.com (mail-qk0-x234.google.com [IPv6:2607:f8b0:400d:c09::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F0E52129A68 for ; Mon, 6 Mar 2017 15:12:06 -0800 (PST) Received: by mail-qk0-x234.google.com with SMTP id v125so118280501qkh.2 for ; Mon, 06 Mar 2017 15:12:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=IqfVlC8PvBuuQedN1VRvekCp0Btgbf6QAje4gPWzf9Y=; b=fm6sR/lZjGyxAV5pujBw1mxUvuWYCX7MJrmsIADI54IFg+W2fF2uSFBZW/Mz3/lWnv iMkglvo5VsFWedJf4IWUE8TXXH3ROO7gNJ650gTioqmFcni60wm06wv74YQFbXqIhFuz PdGJJrh+s78ftJHgK2Ohm4hUVYKAvaxACqqMHxlYniGdfL+oqzMcQSJ95DQR94ne/hNb ObM5P0rmjUos9Dp153Hp/YsciYPS6H/RIQkf/h71SpJBiL7PF3YjPNnae5sXExWe/+up kwv0VjG2re+1MLBBt1mIFZPoXCk8TfK9sHqivnX7A8mxtXKDp1TFrAkrOmWLeUUaNMBm LCLQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=IqfVlC8PvBuuQedN1VRvekCp0Btgbf6QAje4gPWzf9Y=; b=A6Bu9mKmRizorIqJIWltwaTbf5NiMgN87KqFlBqEH1mhI3P7G4TAMiVdkXn+NFgVUP 2DUzhCLLTyEFSjhaiHKYvlfZZJQXSsYUFwrq5w0B7j8SlyvUE4P81HHbm6q4FxZhDBxm aQV/06majvMRAWJolvK4QekhyvYbpuh8wwgGMlUH1L+HdZ9bTBwwx+giv3/OQe08GJQn XGF5qtOySXxioSXHh1GPuuw7p6QYxkcT27s4xlaRoxOSL/ME4v+dnBW3toSi8BlZQKrV eLkNSBdOmzDpdUsr9elXeGebgoeFJYnrBDA5W+HjP4v99RzRTfl6ghzMKl7h1TPS2Tg3 4yIw== X-Gm-Message-State: AMke39lRUn8weIb+DCI1NcOIFIwR81NK9/dXs9ZXwRQ2XK/OwxFkuSsJo3QTKQcSVUDYhmuopPM6CFqd1HHYKQ== X-Received: by 10.237.51.5 with SMTP id u5mr20132811qtd.247.1488841926185; Mon, 06 Mar 2017 15:12:06 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.19.112 with HTTP; Mon, 6 Mar 2017 15:12:05 -0800 (PST) In-Reply-To: References: From: Martin Thomson Date: Tue, 7 Mar 2017 10:12:05 +1100 Message-ID: To: David Benjamin Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: Filippo Valsorda , "tls@ietf.org" Subject: Re: [TLS] Application Data payload X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 23:12:08 -0000 On 7 March 2017 at 10:06, David Benjamin wrote: > As the spec is written right now, our interpretation is that > max_early_data_size counts the plaintext application data, not including any > encryption and record-level overhead. This aligns with (1). > > Separately, we bound how much data on the wire we will skip over. This is > (2). These are not the same units, so we intend to advertise a smaller > number as a fuzzy estimate and don't anticipate the fuzziness mattering > much. Ahh, OK, that happens. I will write a PR to clarify this. From nobody Mon Mar 6 15:23:12 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C279A1294ED for ; Mon, 6 Mar 2017 15:23:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4afsHQrpM6xF for ; Mon, 6 Mar 2017 15:23:08 -0800 (PST) Received: from mail-qk0-x232.google.com (mail-qk0-x232.google.com [IPv6:2607:f8b0:400d:c09::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8E7331294C5 for ; Mon, 6 Mar 2017 15:23:08 -0800 (PST) Received: by mail-qk0-x232.google.com with SMTP id y76so49962447qkb.0 for ; Mon, 06 Mar 2017 15:23:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=njo2tT8i5UbG/2NG9LMDHDD8wRC7d3Jd9u5Vjk7BmI4=; b=lfECXjk8Uk3wNCVG+dfMuRKW5hrLxLN2ch4OZxVAZWC419Ll/JMYryIaTNbrJhvs2D 3S9u/ZCW15PvqpwNLjR6lmwQXBA3w2yUgnxzkPYo1Yd2teIigBFnBHVV6/WJb6TivbNm 85TV7qYxV4W4bu5ElSHbzXWR/FnKnbM2eSs7XmSUOjJ0gdFwLOVGW4xwf29uCoO/IMPo mf/v100vez7PHZS1SP/U01IBOERagX1JDqRriZB8JQnjH5bB/S/eqzE6ijvkw4Y4P0Pj nJpL3kORVwor60olUwdPL1uXFqWpofECNYbGD8yYKPkya7X85BqlJE7h+g7HsKIr9/ay XNIA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=njo2tT8i5UbG/2NG9LMDHDD8wRC7d3Jd9u5Vjk7BmI4=; b=WSBDc0SVCgVRP0CDcQiR8sWqoFWR7YcAa2a22FmFBKvQrcKLMT2Lbn3wXRmRwHVktJ lRozZ/Xu2yX8qL7gKVxiZgYZ+0kwvnlH1L6sNpdpbPLGYvat2QdSOFd5lTA72hHNP0eF bgC9m8PTZCLxlwVPA6YmbSpcH/DnwlZ+KNJrIAFbLGuFWXIOrU52qTEkTArx8rwLyCmV y+27HIJovytEDlKhvq8WwAk/0rUZfF2fMEsNCS9CKZJrhKPsSUBztS6nUGKDH0rhQRkp SZDEjr1YGomwp6XWOH+4PydyxOvAxZrzsBHO9YPFkIoBIA2X5GyFNloYthrkZpO9Dcto gwaw== X-Gm-Message-State: AMke39mUdewOZ6H9GPySjenl9V6ITetpDEAfrbpN30ps3DyQXFVyqT0ExlBUBrICtR3XGBkusV9mqdqWM7qO+C5r X-Received: by 10.237.40.66 with SMTP id r60mr13338528qtd.42.1488842587516; Mon, 06 Mar 2017 15:23:07 -0800 (PST) MIME-Version: 1.0 Received: by 10.55.47.4 with HTTP; Mon, 6 Mar 2017 15:23:07 -0800 (PST) In-Reply-To: References: From: Victor Vasiliev Date: Mon, 6 Mar 2017 18:23:07 -0500 Message-ID: To: Martin Thomson Content-Type: multipart/alternative; boundary=001a1148755a8e7e6e054a182d95 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Certificate compression draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 23:23:11 -0000 --001a1148755a8e7e6e054a182d95 Content-Type: text/plain; charset=UTF-8 Hi Martin, I've measured the effect of compression on a corpus of popular website certificate chains I had lying around (Alexa Top 100k from a few years ago), and the effect seems to be about -30% of size at the median and -48% at 95th percentile (with Brotli, subtract 3-5% for zlib). I think the most dramatic effect from the compression is observed for the certificates with a lot of SNI values, which is not uncommon. -- Victor. On Mon, Mar 6, 2017 at 6:06 PM, Martin Thomson wrote: > Hi Victor, > > Do you have any evidence to suggest that this reduces size in any > meaningful way? Certificates tend to include both repetitious values > (OIDs), and non-repetitious values (keys). > > On 7 March 2017 at 09:58, Victor Vasiliev wrote: > > Certificate compression has been discussed on this list briefly before, > and > > there was some interest in at least considering a draft for it. The > draft > > now > > exists (co-authored by Alessandro and myself), and it can be found at: > > > > https://datatracker.ietf.org/doc/draft-ghedini-tls- > certificate-compression/ > > [ GitHub repo: https://github.com/ghedo/tls-certificate-compression ] > > > > The proposed scheme allows a client and a server to negotiate a > compression > > algorithm for the server certificate message. The scheme is purely > opt-in > > on > > both sides. The current version of the draft defines zlib and Brotli > > compression, both of which are well-specified formats with an existing > > deployment experience. > > > > There are multiple motivations to compress certificates. The first one > is > > that > > the smaller they are, the faster they arrive (both due to the transfer > time > > and > > a decreased chance of packet loss). > > > > The second, and more interesting one, is that having small certificates > is > > important for QUIC in order to achieve 1-RTT handshakes while limiting > the > > opportunities for amplification attacks. Currently, TLS 1.3 over TCP > > without > > client auth looks like this: > > > > Round trip 1: client sends SYN, server sends SYN ACK > > Here, the server provides its own random value which client will > > have to echo in the future. > > Round trip 2: client sends ACK, ClientHello, server sends > > ServerHello...Finished > > Here, ACK confirms to server that the client can receive packets and > is > > not > > just spoofing its source address. Server can send the entire > > ServerHello to > > Finished flight. > > > > In QUIC, we are trying to merge those two rounds into one. The problem, > > however, is that the ClientHello is one packet, and > ServerHello...Finished > > can > > span multiple packets, meaning that this could be used as an > amplification > > attack vector since the client's address is not yet authenticated at this > > point. > > In order to address this, the server has to limit the number of packets > it > > sends > > during the first flight (i.e. ServerHello...Finished flight). Since > > certificates make up the majority of data in that flight, making them > > smaller > > can push them under the limit and save a round-trip. > > > > Cheers, > > Victor. > > > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls > > > --001a1148755a8e7e6e054a182d95 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi Martin,

I've measured the e= ffect of compression on a corpus of popular website
certificate c= hains I had lying around (Alexa Top 100k from a few years ago),
a= nd the effect seems to be about -30% of size at the median and -48% at 95th=
percentile (with Brotli, subtract 3-5% for zlib).

=
I think the most dramatic effect from the compression is observe= d for the
certificates with a lot of SNI values, which is not unc= ommon.

=C2=A0 -- Victor.

On Mon, Mar 6, 2017 at 6:= 06 PM, Martin Thomson <martin.thomson@gmail.com> wrot= e:
Hi Victor,

Do you have any evidence to suggest that this reduces size in any
meaningful way?=C2=A0 Certificates tend to include both repetitious values<= br> (OIDs), and non-repetitious values (keys).

On 7 March 2017 at 09:58, Victor Vasiliev <vasilvv@google.com> wrote:
> Certificate compression has been discussed on this list briefly before= , and
> there was some interest in at least considering a draft for it.=C2=A0 = The draft
> now
> exists (co-authored by Alessandro and myself), and it can be found at:=
>
> https://datatracker.= ietf.org/doc/draft-ghedini-tls-certificate-compression/
>=C2=A0 =C2=A0[ GitHub repo: https://github.c= om/ghedo/tls-certificate-compression ]
>
> The proposed scheme allows a client and a server to negotiate a compre= ssion
> algorithm for the server certificate message.=C2=A0 The scheme is pure= ly opt-in
> on
> both sides.=C2=A0 The current version of the draft defines zlib and Br= otli
> compression, both of which are well-specified formats with an existing=
> deployment experience.
>
> There are multiple motivations to compress certificates.=C2=A0 The fir= st one is
> that
> the smaller they are, the faster they arrive (both due to the transfer= time
> and
> a decreased chance of packet loss).
>
> The second, and more interesting one, is that having small certificate= s is
> important for QUIC in order to achieve 1-RTT handshakes while limiting= the
> opportunities for amplification attacks.=C2=A0 Currently, TLS 1.3 over= TCP
> without
> client auth looks like this:
>
>=C2=A0 =C2=A0Round trip 1: client sends SYN, server sends SYN ACK
>=C2=A0 =C2=A0 =C2=A0Here, the server provides its own random value whic= h client will
>=C2=A0 =C2=A0 =C2=A0have to echo in the future.
>=C2=A0 =C2=A0Round trip 2: client sends ACK, ClientHello, server sends<= br> > ServerHello...Finished
>=C2=A0 =C2=A0 =C2=A0Here, ACK confirms to server that the client can re= ceive packets and is
> not
>=C2=A0 =C2=A0 =C2=A0just spoofing its source address.=C2=A0 Server can = send the entire
> ServerHello to
>=C2=A0 =C2=A0 =C2=A0Finished flight.
>
> In QUIC, we are trying to merge those two rounds into one.=C2=A0 The p= roblem,
> however, is that the ClientHello is one packet, and ServerHello...Fini= shed
> can
> span multiple packets, meaning that this could be used as an amplifica= tion
> attack vector since the client's address is not yet authenticated = at this
> point.
> In order to address this, the server has to limit the number of packet= s it
> sends
> during the first flight (i.e. ServerHello...Finished flight).=C2=A0 Si= nce
> certificates make up the majority of data in that flight, making them<= br> > smaller
> can push them under the limit and save a round-trip.
>
> Cheers,
>=C2=A0 =C2=A0Victor.
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

--001a1148755a8e7e6e054a182d95-- From nobody Mon Mar 6 15:29:29 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 504DE129505 for ; Mon, 6 Mar 2017 15:29:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VjH7jGeOyd9s for ; Mon, 6 Mar 2017 15:29:27 -0800 (PST) Received: from mournblade.imrryr.org (mournblade.imrryr.org [108.5.242.66]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 24A171294ED for ; Mon, 6 Mar 2017 15:29:27 -0800 (PST) Received: from [172.31.30.83] (gzac12-mdf2-1.aoa.twosigma.com [208.77.215.155]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mournblade.imrryr.org (Postfix) with ESMTPSA id 61F607A32D8 for ; Mon, 6 Mar 2017 23:29:26 +0000 (UTC) (envelope-from ietf-dane@dukhovni.org) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Viktor Dukhovni In-Reply-To: Date: Mon, 6 Mar 2017 18:29:25 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <69B63AA2-EA81-4994-9E12-72F8B7945319@dukhovni.org> References: To: "" X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Certificate compression draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: "" List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 23:29:28 -0000 > On Mar 6, 2017, at 6:23 PM, Victor Vasiliev = wrote: >=20 > Hi Martin, >=20 > I've measured the effect of compression on a corpus of popular website > certificate chains I had lying around (Alexa Top 100k from a few years = ago), > and the effect seems to be about -30% of size at the median and -48% = at 95th > percentile (with Brotli, subtract 3-5% for zlib). >=20 > I think the most dramatic effect from the compression is observed for = the > certificates with a lot of SNI values, which is not uncommon. Is 30-50% enough to mitigate concerns about amplification attacks? = Introducing compression increases the attack surface on TLS clients and adds CPU = cost. If the compression is not sufficiently effective, it is not clear that the = benefit outweighs the cost. Wouldn't amplification be better addressed via TCP cookies? With TCP = fast open restricted to cookie-bearing clients? With similar mechanisms for UDP, = ... --=20 Viktor. From nobody Mon Mar 6 15:32:46 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB9E9129545 for ; Mon, 6 Mar 2017 15:32:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cloudflare.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jaBjba20dPzK for ; Mon, 6 Mar 2017 15:32:43 -0800 (PST) Received: from mail-pg0-x236.google.com (mail-pg0-x236.google.com [IPv6:2607:f8b0:400e:c05::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 35A14129539 for ; Mon, 6 Mar 2017 15:32:43 -0800 (PST) Received: by mail-pg0-x236.google.com with SMTP id 187so17637341pgb.3 for ; Mon, 06 Mar 2017 15:32:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=F21UYfzfInyH0mPGhilsPk8rCIRjndyvDWloOu/46Vo=; b=BsmPezPWWRoO5g8ESbgkqTgin4gaI1m8DgqqhpSi5f7MbR3LaNO90KUSq2Tp3g7cIp UVTT1wkTvRFPvxHYeK7QCAkQVy9xbeHjVu3h9MmQ2JXab098WalJUAGvsPC05nAwwhbj QLZTur+tgmrZTyZjIebYv8OIuFfY72p9SAVLg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=F21UYfzfInyH0mPGhilsPk8rCIRjndyvDWloOu/46Vo=; b=ATIJcAYmJrP0gchNU7us06eUnURzSr1RliDI9isOSdEaadBZvM5/M8a+a8mVHt3Jcl Y2Z2cAWcbMSOQY2hCxncpMCmojLqSCV4QsdFWHuMve9awB3L+JRzbk5I0m3vX6bM7Por RcU4BIDolhZZ6Pv4DyiikmYDWpMkBYxLHpaZsRt5wRx1pjs1fKGBLTAn/Sao0oONd3rc 0/0UimPKX16R0033QK+rA4ZIL2acNg80zpZfOwhKRmITnqU93lyXMZ0g5YfKNC//vZ0w dD+6F3uujVIxA5e0c4umirSfSHk+KsJAjo9fT0TOpO2OKJQjIgOp8aJRD+iDqgcYfr6v SxKA== X-Gm-Message-State: AMke39myuITuZl1iPbqqM6+e4GCAz9ShfSHgFiVsw1BV6OlazJNFDeLdrOuAMYX88b9sjopx X-Received: by 10.99.253.5 with SMTP id d5mr23460022pgh.47.1488843162619; Mon, 06 Mar 2017 15:32:42 -0800 (PST) Received: from ?IPv6:2606:4700:ff01:8210:65ea:98d2:4eca:88a7? ([2606:4700:ff01:8210:65ea:98d2:4eca:88a7]) by smtp.gmail.com with ESMTPSA id c195sm41564614pfb.60.2017.03.06.15.32.41 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 06 Mar 2017 15:32:42 -0800 (PST) From: Vlad Krasnov Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_FFC9EE75-DAE5-4B49-AA74-84E7939A89C9" Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Mon, 6 Mar 2017 15:32:41 -0800 In-Reply-To: To: Victor Vasiliev References: X-Mailer: Apple Mail (2.3259) Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Certificate compression draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 23:32:45 -0000 --Apple-Mail=_FFC9EE75-DAE5-4B49-AA74-84E7939A89C9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi Victor, Have you considered creating a common dictionary, similarly to what SPDY = did for header compression? Cheers, Vlad > On Mar 6, 2017, at 3:23 PM, Victor Vasiliev = wrote: >=20 > Hi Martin, >=20 > I've measured the effect of compression on a corpus of popular website > certificate chains I had lying around (Alexa Top 100k from a few years = ago), > and the effect seems to be about -30% of size at the median and -48% = at 95th > percentile (with Brotli, subtract 3-5% for zlib). >=20 > I think the most dramatic effect from the compression is observed for = the > certificates with a lot of SNI values, which is not uncommon. >=20 > -- Victor. >=20 > On Mon, Mar 6, 2017 at 6:06 PM, Martin Thomson = > wrote: > Hi Victor, >=20 > Do you have any evidence to suggest that this reduces size in any > meaningful way? Certificates tend to include both repetitious values > (OIDs), and non-repetitious values (keys). >=20 > On 7 March 2017 at 09:58, Victor Vasiliev > wrote: > > Certificate compression has been discussed on this list briefly = before, and > > there was some interest in at least considering a draft for it. The = draft > > now > > exists (co-authored by Alessandro and myself), and it can be found = at: > > > > = https://datatracker.ietf.org/doc/draft-ghedini-tls-certificate-compression= / = > > [ GitHub repo: = https://github.com/ghedo/tls-certificate-compression = ] > > > > The proposed scheme allows a client and a server to negotiate a = compression > > algorithm for the server certificate message. The scheme is purely = opt-in > > on > > both sides. The current version of the draft defines zlib and = Brotli > > compression, both of which are well-specified formats with an = existing > > deployment experience. > > > > There are multiple motivations to compress certificates. The first = one is > > that > > the smaller they are, the faster they arrive (both due to the = transfer time > > and > > a decreased chance of packet loss). > > > > The second, and more interesting one, is that having small = certificates is > > important for QUIC in order to achieve 1-RTT handshakes while = limiting the > > opportunities for amplification attacks. Currently, TLS 1.3 over = TCP > > without > > client auth looks like this: > > > > Round trip 1: client sends SYN, server sends SYN ACK > > Here, the server provides its own random value which client will > > have to echo in the future. > > Round trip 2: client sends ACK, ClientHello, server sends > > ServerHello...Finished > > Here, ACK confirms to server that the client can receive packets = and is > > not > > just spoofing its source address. Server can send the entire > > ServerHello to > > Finished flight. > > > > In QUIC, we are trying to merge those two rounds into one. The = problem, > > however, is that the ClientHello is one packet, and = ServerHello...Finished > > can > > span multiple packets, meaning that this could be used as an = amplification > > attack vector since the client's address is not yet authenticated at = this > > point. > > In order to address this, the server has to limit the number of = packets it > > sends > > during the first flight (i.e. ServerHello...Finished flight). Since > > certificates make up the majority of data in that flight, making = them > > smaller > > can push them under the limit and save a round-trip. > > > > Cheers, > > Victor. > > > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls = > > >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls --Apple-Mail=_FFC9EE75-DAE5-4B49-AA74-84E7939A89C9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Hi Victor,

Have you considered creating a common dictionary, similarly = to what SPDY did for header compression?

Cheers,
Vlad


On Mar 6, 2017, at 3:23 PM, Victor Vasiliev <vasilvv@google.com> = wrote:

Hi Martin,

I've measured the effect of compression on a = corpus of popular website
certificate chains I had = lying around (Alexa Top 100k from a few years ago),
and the effect seems to be about -30% of size at the median = and -48% at 95th
percentile (with Brotli, subtract = 3-5% for zlib).

I think the most dramatic effect from the compression is = observed for the
certificates with a lot of SNI = values, which is not uncommon.

  -- Victor.

On Mon, = Mar 6, 2017 at 6:06 PM, Martin Thomson <martin.thomson@gmail.com> wrote:
Hi Victor,

Do you have any evidence to suggest that this reduces size in any
meaningful way?  Certificates tend to include both repetitious = values
(OIDs), and non-repetitious values (keys).

On 7 March 2017 at 09:58, Victor Vasiliev <vasilvv@google.com> = wrote:
> Certificate compression has been discussed on this list briefly = before, and
> there was some interest in at least considering a draft for = it.  The draft
> now
> exists (co-authored by Alessandro and myself), and it can be found = at:
>
> https://datatracker.ietf.org/doc/draft-ghedini-tls-certificate-compression/
>   [ GitHub repo: https://github.com/ghedo/tls-certificate-compression ]
>
> The proposed scheme allows a client and a server to negotiate a = compression
> algorithm for the server certificate message.  The scheme is = purely opt-in
> on
> both sides.  The current version of the draft defines zlib and = Brotli
> compression, both of which are well-specified formats with an = existing
> deployment experience.
>
> There are multiple motivations to compress certificates.  The = first one is
> that
> the smaller they are, the faster they arrive (both due to the = transfer time
> and
> a decreased chance of packet loss).
>
> The second, and more interesting one, is that having small = certificates is
> important for QUIC in order to achieve 1-RTT handshakes while = limiting the
> opportunities for amplification attacks.  Currently, TLS 1.3 = over TCP
> without
> client auth looks like this:
>
>   Round trip 1: client sends SYN, server sends SYN ACK
>     Here, the server provides its own random value = which client will
>     have to echo in the future.
>   Round trip 2: client sends ACK, ClientHello, server = sends
> ServerHello...Finished
>     Here, ACK confirms to server that the client can = receive packets and is
> not
>     just spoofing its source address.  Server = can send the entire
> ServerHello to
>     Finished flight.
>
> In QUIC, we are trying to merge those two rounds into one.  = The problem,
> however, is that the ClientHello is one packet, and = ServerHello...Finished
> can
> span multiple packets, meaning that this could be used as an = amplification
> attack vector since the client's address is not yet authenticated = at this
> point.
> In order to address this, the server has to limit the number of = packets it
> sends
> during the first flight (i.e. ServerHello...Finished flight).  = Since
> certificates make up the majority of data in that flight, making = them
> smaller
> can push them under the limit and save a round-trip.
>
> Cheers,
>   Victor.
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

_______________________________________________
TLS = mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

= --Apple-Mail=_FFC9EE75-DAE5-4B49-AA74-84E7939A89C9-- From nobody Mon Mar 6 15:51:29 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4CAD1294AE for ; Mon, 6 Mar 2017 15:51:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id StmAokVeZRDJ for ; Mon, 6 Mar 2017 15:51:26 -0800 (PST) Received: from mail-qk0-x231.google.com (mail-qk0-x231.google.com [IPv6:2607:f8b0:400d:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 800CF12941C for ; Mon, 6 Mar 2017 15:51:26 -0800 (PST) Received: by mail-qk0-x231.google.com with SMTP id v125so119475488qkh.2 for ; Mon, 06 Mar 2017 15:51:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=2Coqih3cakjsPvYfArMmqGaMvwc+XPb7jYCXE8efjg0=; b=LsPgZwLpujvQsSYLK9bedzht9iHhWRLpB9qX3POnYnJP+wo5DinqSeIn6j1PbNAi0U iZQjYod8WwtqwQGmOaN9GRxwQtNE7Zug4WGnFLqBvMtW2syEdptpzaiNdluPU/zRDbzY OEZ1UDQnwoie+If6B1IYwCHEE6FdRigAIIZDLJyXEUjN+Lgn0zm8CX4yRjNIM+RGKgeC W3mppkAOZFEAvT4A0rdgyBih9edA7W1cm33jpZFFQ+mY9LdZZet4RUpyFL6fu6/rmQGU uLfRn3zacdVeMYsTjp0dGSbKaQYIbAikXjfkKP2kIKaupFIC2jQfOQv8mrJNwcaiAjUN /V2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=2Coqih3cakjsPvYfArMmqGaMvwc+XPb7jYCXE8efjg0=; b=IEDVo4XU+Ch6IBnWZyWZCWLGwgX0xZlSI7+zS7gous4/y6WJ8hPVf0CYZxVWG6rfph BDELcRmmmz5od/baE4hN2ViJVmqu7uAQIoRvjTbARWqbV/yp7H1m/pmOdkuhtbAXuk9J zKaPARHV8yiSV+RLOnTswF45E5x53uASCyKNX8qXldFbFx5zG/2ZBbcE9MrcEoroAys4 oesKjgu/eSE1mGZMp/nwFSogAigfL8oHSxW9ULloe66HTjMW9Ce156di4G92jh1t75xP qKWkEWftmiAAxQlQRkVKchp16XNe8dMYGRYIyA3lisvtlT3vNxHF5ha5X6ASp65zGhWy QhCw== X-Gm-Message-State: AMke39luBTcApa3xNecV0OLXpgyK1RkRFrKU8oWqeQZIC3yQz5TBEyVHDrzDrXfo+ghRA0ufZAZQIGce+acSBZLi X-Received: by 10.55.187.66 with SMTP id l63mr17283272qkf.292.1488844285324; Mon, 06 Mar 2017 15:51:25 -0800 (PST) MIME-Version: 1.0 Received: by 10.55.47.4 with HTTP; Mon, 6 Mar 2017 15:51:24 -0800 (PST) In-Reply-To: <69B63AA2-EA81-4994-9E12-72F8B7945319@dukhovni.org> References: <69B63AA2-EA81-4994-9E12-72F8B7945319@dukhovni.org> From: Victor Vasiliev Date: Mon, 6 Mar 2017 18:51:24 -0500 Message-ID: To: "" Content-Type: multipart/alternative; boundary=94eb2c0441acc130cf054a189220 Archived-At: Subject: Re: [TLS] Certificate compression draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 23:51:28 -0000 --94eb2c0441acc130cf054a189220 Content-Type: text/plain; charset=UTF-8 On Mon, Mar 6, 2017 at 6:29 PM, Viktor Dukhovni wrote: > Is 30-50% enough to mitigate concerns about amplification attacks? > Introducing > compression increases the attack surface on TLS clients and adds CPU > cost. If > the compression is not sufficiently effective, it is not clear that the > benefit > outweighs the cost. > It's actually pretty good at this. My relatively back-of-the-envelope calculations show that compression increases number of handshakes that fit into two packets from ~2% to ~54% (for three packets, it goes up from ~52% to ~97%). > Wouldn't amplification be better addressed via TCP cookies? With TCP fast > open > restricted to cookie-bearing clients? With similar mechanisms for UDP, ... The goal here is to reduce the number of round-trips required to connect to a server previously unknown to the client from two to one (otherwise you can just put an equivalent of TCP cookie in the ticket). TCP cookies only work if you've connected to the server before. -- Victor. --94eb2c0441acc130cf054a189220 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On M= on, Mar 6, 2017 at 6:29 PM, Viktor Dukhovni <ietf-dane@dukhovni.org= > wrote:
Is 30-50% enough to mitigate concerns about amplification attacks?=C2=A0 I= ntroducing
compression increases the attack surface on TLS clients and adds CPU cost.= =C2=A0 If
the compression is not sufficiently effective, it is not clear that the ben= efit
outweighs the cost.

It's actua= lly pretty good at this.=C2=A0 My relatively back-of-the-envelope
calculations show that compression increases number of handshakes that fit=
into two packets from ~2% to ~54% (for three packets, it goes up= from ~52% to
~97%).
=C2=A0
Wouldn't amplification be better addressed via TCP cookies?=C2=A0 With = TCP fast open
restricted to cookie-bearing clients?=C2=A0 With similar mechanisms for UDP= , ...

The goal here is to reduce the number= of round-trips required to connect to a
server previously unknow= n to the client from two to one (otherwise you can just
put an eq= uivalent of TCP cookie in the ticket).=C2=A0 TCP cookies only work if
=
you've connected to the server before.
=C2=A0
=C2=A0 -- Victor.
--94eb2c0441acc130cf054a189220-- From nobody Mon Mar 6 16:15:43 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 46BB6129556 for ; Mon, 6 Mar 2017 16:15:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zFhveog49lfF for ; Mon, 6 Mar 2017 16:15:39 -0800 (PST) Received: from mail-qk0-x235.google.com (mail-qk0-x235.google.com [IPv6:2607:f8b0:400d:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 800D412941C for ; Mon, 6 Mar 2017 16:15:39 -0800 (PST) Received: by mail-qk0-x235.google.com with SMTP id y76so51575373qkb.0 for ; Mon, 06 Mar 2017 16:15:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=6WEsx1z4hYaUmwBF9UfuHDQphh8/HuJK8XD+KOm6dvE=; b=XxJuXAza/x3cxA1Z1XY0Tm9r2/r+gX8P5cWX4/+RAErxQuRC5cJWAmx3lY3W1y06tJ 4OfvaqOWOzAdV3SytQ3fQnyi3AxN02CGNISWwxGgFGRHWd83rOAxD/CNSDYXG44kKwrW gDN5x328xsKaICYx/m8yV2nmPi/Vr71WVBaKyp3w06AqVmQC+6E450NVdRAvhCsLD9IV PF//yVQs7hM4Vgl9Zd4iby4aQk+DHFiAr9wHnkkY7pLy/xirXzsRdnQqLxGjJ/ZVRDrS 1GCOti72HN6Ch88s22y00yDbqaw3ViFunvzP0EySXtSIPE6EzCyZUH90SSTxBCK/ay52 KyRA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=6WEsx1z4hYaUmwBF9UfuHDQphh8/HuJK8XD+KOm6dvE=; b=q5+T4o8EPCkWaM6Wo7Gqr1OS5wCRD/f+M3ppbaKaUjwebPxVoexEareJfIlsJ7dH/z uNLu0G9rgNHsjT2zKU5Po/ytUhmQCppBBlGwy8bl/MA12UNvLRNcqlXNbP5YGI2+WjbY yk702y1TrPI+hGX88gAkadJStHXPimjViRp5nw5RtpUO0ASdmM0UIf5ZY3uAXVii/Vwj IwNH682wIdNUkfOdSrwuAkZvUDn0oI1EbXA15WH8jgoO+JQ/yloPTs3e8OeGWkZm794a 0AO67o0Alsi9Dg6CjKBzlQ4Zk1SrxaChAHaSHxnYj1Q0ONqTZIMOr+PXZZtMLon/nKVm 7POw== X-Gm-Message-State: AMke39ngEG88+kVeXZI8rN77AJNEV5ieKbNU5dwQqvVi3AWIJlHN5OS/IPGtncnXgDGk2UunzOj/9Xh0k0xUz+yD X-Received: by 10.200.50.147 with SMTP id z19mr18430322qta.256.1488845738523; Mon, 06 Mar 2017 16:15:38 -0800 (PST) MIME-Version: 1.0 Received: by 10.55.47.4 with HTTP; Mon, 6 Mar 2017 16:15:38 -0800 (PST) In-Reply-To: References: From: Victor Vasiliev Date: Mon, 6 Mar 2017 19:15:38 -0500 Message-ID: To: Vlad Krasnov Content-Type: multipart/alternative; boundary=001a113a1be65f0b11054a18e95d Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Certificate compression draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 00:15:41 -0000 --001a113a1be65f0b11054a18e95d Content-Type: text/plain; charset=UTF-8 Hi Vlad, This is still an open issue: https://github.com/ghedo/tls-certificate-compression/issues/2 The problem here is creating a dictionary that is both neutral with respect to the certificate's issuing authority, and actually has a noticeable effect. So far my personal attempts at making such a dictionary have not been very successful, but this might change. Even if we get a dictionary, I do not expect the effect to be large compared to the effect of just compressing the chain in the first place. -- Victor. On Mon, Mar 6, 2017 at 6:32 PM, Vlad Krasnov wrote: > Hi Victor, > > Have you considered creating a common dictionary, similarly to what SPDY > did for header compression? > > Cheers, > Vlad > > > On Mar 6, 2017, at 3:23 PM, Victor Vasiliev wrote: > > Hi Martin, > > I've measured the effect of compression on a corpus of popular website > certificate chains I had lying around (Alexa Top 100k from a few years > ago), > and the effect seems to be about -30% of size at the median and -48% at > 95th > percentile (with Brotli, subtract 3-5% for zlib). > > I think the most dramatic effect from the compression is observed for the > certificates with a lot of SNI values, which is not uncommon. > > -- Victor. > > On Mon, Mar 6, 2017 at 6:06 PM, Martin Thomson > wrote: > >> Hi Victor, >> >> Do you have any evidence to suggest that this reduces size in any >> meaningful way? Certificates tend to include both repetitious values >> (OIDs), and non-repetitious values (keys). >> >> On 7 March 2017 at 09:58, Victor Vasiliev wrote: >> > Certificate compression has been discussed on this list briefly before, >> and >> > there was some interest in at least considering a draft for it. The >> draft >> > now >> > exists (co-authored by Alessandro and myself), and it can be found at: >> > >> > https://datatracker.ietf.org/doc/draft-ghedini-tls-certifica >> te-compression/ >> > [ GitHub repo: https://github.com/ghedo/tls-certificate-compression ] >> > >> > The proposed scheme allows a client and a server to negotiate a >> compression >> > algorithm for the server certificate message. The scheme is purely >> opt-in >> > on >> > both sides. The current version of the draft defines zlib and Brotli >> > compression, both of which are well-specified formats with an existing >> > deployment experience. >> > >> > There are multiple motivations to compress certificates. The first one >> is >> > that >> > the smaller they are, the faster they arrive (both due to the transfer >> time >> > and >> > a decreased chance of packet loss). >> > >> > The second, and more interesting one, is that having small certificates >> is >> > important for QUIC in order to achieve 1-RTT handshakes while limiting >> the >> > opportunities for amplification attacks. Currently, TLS 1.3 over TCP >> > without >> > client auth looks like this: >> > >> > Round trip 1: client sends SYN, server sends SYN ACK >> > Here, the server provides its own random value which client will >> > have to echo in the future. >> > Round trip 2: client sends ACK, ClientHello, server sends >> > ServerHello...Finished >> > Here, ACK confirms to server that the client can receive packets >> and is >> > not >> > just spoofing its source address. Server can send the entire >> > ServerHello to >> > Finished flight. >> > >> > In QUIC, we are trying to merge those two rounds into one. The problem, >> > however, is that the ClientHello is one packet, and >> ServerHello...Finished >> > can >> > span multiple packets, meaning that this could be used as an >> amplification >> > attack vector since the client's address is not yet authenticated at >> this >> > point. >> > In order to address this, the server has to limit the number of packets >> it >> > sends >> > during the first flight (i.e. ServerHello...Finished flight). Since >> > certificates make up the majority of data in that flight, making them >> > smaller >> > can push them under the limit and save a round-trip. >> > >> > Cheers, >> > Victor. >> > >> > _______________________________________________ >> > TLS mailing list >> > TLS@ietf.org >> > https://www.ietf.org/mailman/listinfo/tls >> > >> > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > > --001a113a1be65f0b11054a18e95d Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi Vlad,

This is still an open issue:= =C2=A0https://github.com/ghedo/tls-certificate-compression/issues/2

The problem here is creating a dictionary that is= both neutral with respect to
the certificate's issuing autho= rity, and actually has a noticeable effect.=C2=A0 So
far my perso= nal attempts at making such a dictionary have not been very
succe= ssful, but this might change.=C2=A0 Even if we get a dictionary, I do not
expect the effect to be large compared to the effect of just compr= essing the
chain in the first place.

=C2=A0 -- Victor.

On Mon, Mar 6, 2017 at 6:32 PM, Vlad Krasnov <vlad@clou= dflare.com> wrote:
Hi Victor,

Have you consider= ed creating a common dictionary, similarly to what SPDY did for header comp= ression?

Cheers,
Vlad


On Ma= r 6, 2017, at 3:23 PM, Victor Vasiliev <vasilvv@google.com> wrote:

Hi Ma= rtin,

I've measured the effect of compression o= n a corpus of popular website
certificate chains I had lying arou= nd (Alexa Top 100k from a few years ago),
and the effect seems to= be about -30% of size at the median and -48% at 95th
percentile = (with Brotli, subtract 3-5% for zlib).

I think the= most dramatic effect from the compression is observed for the
ce= rtificates with a lot of SNI values, which is not uncommon.

=C2=A0 -- Victor.
On Mon, Mar 6, 2017 at 6:06 PM, Martin Thomson = <martin.thomson@gmail.com> wrote:
Hi Victor,

Do you have any evidence to suggest that this reduces size in any
meaningful way?=C2=A0 Certificates tend to include both repetitious values<= br> (OIDs), and non-repetitious values (keys).

On 7 March 2017 at 09:58, Victor Vasiliev <vasilvv@google.com> wrote:
> Certificate compression has been discussed on this list briefly before= , and
> there was some interest in at least considering a draft for it.=C2=A0 = The draft
> now
> exists (co-authored by Alessandro and myself), and it can be found at:=
>
> https://datatracker.= ietf.org/doc/draft-ghedini-tls-certificate-compression/
>=C2=A0 =C2=A0[ GitHub repo: https://github.c= om/ghedo/tls-certificate-compression ]
>
> The proposed scheme allows a client and a server to negotiate a compre= ssion
> algorithm for the server certificate message.=C2=A0 The scheme is pure= ly opt-in
> on
> both sides.=C2=A0 The current version of the draft defines zlib and Br= otli
> compression, both of which are well-specified formats with an existing=
> deployment experience.
>
> There are multiple motivations to compress certificates.=C2=A0 The fir= st one is
> that
> the smaller they are, the faster they arrive (both due to the transfer= time
> and
> a decreased chance of packet loss).
>
> The second, and more interesting one, is that having small certificate= s is
> important for QUIC in order to achieve 1-RTT handshakes while limiting= the
> opportunities for amplification attacks.=C2=A0 Currently, TLS 1.3 over= TCP
> without
> client auth looks like this:
>
>=C2=A0 =C2=A0Round trip 1: client sends SYN, server sends SYN ACK
>=C2=A0 =C2=A0 =C2=A0Here, the server provides its own random value whic= h client will
>=C2=A0 =C2=A0 =C2=A0have to echo in the future.
>=C2=A0 =C2=A0Round trip 2: client sends ACK, ClientHello, server sends<= br> > ServerHello...Finished
>=C2=A0 =C2=A0 =C2=A0Here, ACK confirms to server that the client can re= ceive packets and is
> not
>=C2=A0 =C2=A0 =C2=A0just spoofing its source address.=C2=A0 Server can = send the entire
> ServerHello to
>=C2=A0 =C2=A0 =C2=A0Finished flight.
>
> In QUIC, we are trying to merge those two rounds into one.=C2=A0 The p= roblem,
> however, is that the ClientHello is one packet, and ServerHello...Fini= shed
> can
> span multiple packets, meaning that this could be used as an amplifica= tion
> attack vector since the client's address is not yet authenticated = at this
> point.
> In order to address this, the server has to limit the number of packet= s it
> sends
> during the first flight (i.e. ServerHello...Finished flight).=C2=A0 Si= nce
> certificates make up the majority of data in that flight, making them<= br> > smaller
> can push them under the limit and save a round-trip.
>
> Cheers,
>=C2=A0 =C2=A0Victor.
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

_______________________________________________
TLS mailing listTLS@ietf.org
https:/= /www.ietf.org/mailman/listinfo/tls

--001a113a1be65f0b11054a18e95d-- From nobody Mon Mar 6 16:31:23 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82D42129532 for ; Mon, 6 Mar 2017 16:31:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rhl8pR3c33ii for ; Mon, 6 Mar 2017 16:31:21 -0800 (PST) Received: from mail-yw0-x232.google.com (mail-yw0-x232.google.com [IPv6:2607:f8b0:4002:c05::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0633212941C for ; Mon, 6 Mar 2017 16:31:21 -0800 (PST) Received: by mail-yw0-x232.google.com with SMTP id v76so34754609ywg.0 for ; Mon, 06 Mar 2017 16:31:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=hmkg3Y2GgnuXel01F11pmb+r5P9GwWJyaRyFBZAD6UQ=; b=a6IJ8oWymplIr2M9GplKuS9XfFzBufXm1PSaweIuJL4Cy3JxuqEW2DjnOfO3byiceV jOWJvGFdPpMnuhL1hKbeE7D9BgnOx2X1aYJWCorj4qlACBFpkH3uHZU7ZJ8DoEz5pykx OrXNmXzgsEKr3r8Vjpe4BG7f07943JInGyykn9KLwdbRsDQkflOwCOhUkJuOzZrZKiz8 dmdZ/ix5E5Qb5bEYzOvMEEOV91jTZ6iLssYnl+CSdgBp8RqRIVsncY4WmCMBbKCXvH7i 1Ht3/+uTK2vq5t7/K5Ep0ylAd4ZkTf+PQ7+kUy1TW33tyfDM/iMrzokoxN9tN2+The47 eb6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=hmkg3Y2GgnuXel01F11pmb+r5P9GwWJyaRyFBZAD6UQ=; b=JL4qg81AUnPPRiFuUUNK7Om8d8jrmzfBaaI7Oca8Zr0COJrPoUEcfiK68aMLoorn2p ojiDLGRPL+sQ9ayXnZhL07jwT5LBAei9WcwFONMhdHkLwA4w5xDwPDVMAvY6Ui25uzFl QJ8h3Zz3YfNi/YKfcwsbsBWmGuAbt2FGjHkurPgQjDckqY/Nsll7xo9V/t7Rt1HBvEO5 4LOFKNptKQPidaL/3ldtbXj1GWpQqcRgadb6DmKAuHs1ws8GnBmVUybXFHyeSaGhdd2D mWJWVL0JdC0exj4smJ5PEAKejH0Ja3301kbSstKWg3Jze108GtpUKrL1L9vCSw46vcLu tghg== X-Gm-Message-State: AMke39lvx+DRqKyVxJYJF2YLeCONOa5vBSkVKG3FomHZsl4YfgV91Jhlz7+Uq0JSeCguXYOhxuDvg05jnX95tQ== X-Received: by 10.37.201.196 with SMTP id z187mr13964819ybf.161.1488846680163; Mon, 06 Mar 2017 16:31:20 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Mon, 6 Mar 2017 16:30:39 -0800 (PST) In-Reply-To: References: From: Eric Rescorla Date: Mon, 6 Mar 2017 16:30:39 -0800 Message-ID: To: Martin Thomson Content-Type: multipart/alternative; boundary=001a114d88ea7f107c054a192186 Archived-At: Cc: Filippo Valsorda , "tls@ietf.org" Subject: Re: [TLS] Application Data payload X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 00:31:22 -0000 --001a114d88ea7f107c054a192186 Content-Type: text/plain; charset=UTF-8 https://github.com/tlswg/tls13-spec/commit/2c72e1faa76c3be06e202d1181cf9c0959dea336 On Mon, Mar 6, 2017 at 3:12 PM, Martin Thomson wrote: > On 7 March 2017 at 10:06, David Benjamin wrote: > > As the spec is written right now, our interpretation is that > > max_early_data_size counts the plaintext application data, not including > any > > encryption and record-level overhead. This aligns with (1). > > > > Separately, we bound how much data on the wire we will skip over. This is > > (2). These are not the same units, so we intend to advertise a smaller > > number as a fuzzy estimate and don't anticipate the fuzziness mattering > > much. > > Ahh, OK, that happens. I will write a PR to clarify this. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --001a114d88ea7f107c054a192186 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

On Mon, Mar 6, 2017 at 3:12 PM, = Martin Thomson <martin.thomson@gmail.com> wrote:
<= blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px= #ccc solid;padding-left:1ex">On 7 March 2017 at 10:06, Da= vid Benjamin <davidben@chromium= .org> wrote:
> As the spec is written right now, our interpretation is that
> max_early_data_size counts the plaintext application data, not includi= ng any
> encryption and record-level overhead. This aligns with (1).
>
> Separately, we bound how much data on the wire we will skip over. This= is
> (2). These are not the same units, so we intend to advertise a smaller=
> number as a fuzzy estimate and don't anticipate the fuzziness matt= ering
> much.

Ahh, OK, that happens.=C2=A0 I will write a PR to clarify this.

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--001a114d88ea7f107c054a192186-- From nobody Mon Mar 6 16:38:21 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 935C6129559 for ; Mon, 6 Mar 2017 16:38:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uQbBB34vhdXU for ; Mon, 6 Mar 2017 16:38:16 -0800 (PST) Received: from mail-qk0-x232.google.com (mail-qk0-x232.google.com [IPv6:2607:f8b0:400d:c09::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ADCD112941C for ; Mon, 6 Mar 2017 16:38:16 -0800 (PST) Received: by mail-qk0-x232.google.com with SMTP id 1so183350688qkl.3 for ; Mon, 06 Mar 2017 16:38:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=OlI7x6xZ++JeCO4vMG5G0Dy57IuVXqTcCtRNiJLQY8c=; b=DePz2yvxAJDTdWPccYvDd0nrB8uEX/rxjtPpTDvETcqPjDUUWYm1ZRHBzsiPGaIxXy Srve7SGKhSzvhefdjUKRYme0peAhqctOIaTzvqWxb9NRynF6i4kIva685TzPx+Du0hIB /AdlbSzmbZE65eitTatX0+klajoNL2Wf++bEcRIzfKpvWtzrBaphOK0hP1YaTtb2+Q1F 7knfr0ty74ihMtYa6lqRWBim18audqrBiCFjI0DDUErvn2yvyHfvpsgfcwYP6wHV3aED VZ9tI2oRkrbUngh/S/KY/ae6nVNF6TN5nlG9xcqTYxCYDuuwdJcwexNFdQFyg+e3+F89 Sd4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=OlI7x6xZ++JeCO4vMG5G0Dy57IuVXqTcCtRNiJLQY8c=; b=eMj8TKL87CB3ppTvkk6M5JweHqzr3L0eeb8WdjNZk2YSk4q/2DCuZhPaaWl7iG35qE K3SFRVuIlyvtsvaQSg66ne8vqWfYRmI05gp8fHyVXDmRTHWgHNPyJuAl1VNWA/d0INT1 5BAhRtKNNcpSj0weIzEyKxBgY5HzrJxqiHoYwAjaRn3R0q3z49YMy7PYIbTl773nRUCF 4QsaPiA2p6vDY5kGgBP50Bh6wP5DdXwOj9ScILyBR96IISvJWGElHgh8Nj9dYzGENpK/ txaehUY6szrS0ZQiAHQFDog6HAk7zkVUFiT4SMGjUXRK3uzTFrimilhw+ZReClBE0+5g AcEw== X-Gm-Message-State: AMke39mE/EqEUAmmt8BKRDqDrTXHJjn0knozl2AUOTyU/zD3KzH4UdCf70KSvoVENIT82pVDbuJ/kwc4ZYaM2Q== X-Received: by 10.55.27.219 with SMTP id m88mr16960720qkh.147.1488847095791; Mon, 06 Mar 2017 16:38:15 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.19.112 with HTTP; Mon, 6 Mar 2017 16:38:15 -0800 (PST) In-Reply-To: References: From: Martin Thomson Date: Tue, 7 Mar 2017 11:38:15 +1100 Message-ID: To: Victor Vasiliev Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Certificate compression draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 00:38:18 -0000 Seems like you might get some traction with adding www. .com, some DN fields (CN=, O=, C=), common OIDs, with some OIDs attached to values (like key usage and signature algorithm). Most of that is relatively short though. On 7 March 2017 at 11:15, Victor Vasiliev wrote: > Hi Vlad, > > This is still an open issue: > https://github.com/ghedo/tls-certificate-compression/issues/2 > > The problem here is creating a dictionary that is both neutral with respect > to > the certificate's issuing authority, and actually has a noticeable effect. > So > far my personal attempts at making such a dictionary have not been very > successful, but this might change. Even if we get a dictionary, I do not > expect the effect to be large compared to the effect of just compressing the > chain in the first place. > > -- Victor. > > On Mon, Mar 6, 2017 at 6:32 PM, Vlad Krasnov wrote: >> >> Hi Victor, >> >> Have you considered creating a common dictionary, similarly to what SPDY >> did for header compression? >> >> Cheers, >> Vlad >> >> >> On Mar 6, 2017, at 3:23 PM, Victor Vasiliev wrote: >> >> Hi Martin, >> >> I've measured the effect of compression on a corpus of popular website >> certificate chains I had lying around (Alexa Top 100k from a few years >> ago), >> and the effect seems to be about -30% of size at the median and -48% at >> 95th >> percentile (with Brotli, subtract 3-5% for zlib). >> >> I think the most dramatic effect from the compression is observed for the >> certificates with a lot of SNI values, which is not uncommon. >> >> -- Victor. >> >> On Mon, Mar 6, 2017 at 6:06 PM, Martin Thomson >> wrote: >>> >>> Hi Victor, >>> >>> Do you have any evidence to suggest that this reduces size in any >>> meaningful way? Certificates tend to include both repetitious values >>> (OIDs), and non-repetitious values (keys). >>> >>> On 7 March 2017 at 09:58, Victor Vasiliev wrote: >>> > Certificate compression has been discussed on this list briefly before, >>> > and >>> > there was some interest in at least considering a draft for it. The >>> > draft >>> > now >>> > exists (co-authored by Alessandro and myself), and it can be found at: >>> > >>> > >>> > https://datatracker.ietf.org/doc/draft-ghedini-tls-certificate-compression/ >>> > [ GitHub repo: https://github.com/ghedo/tls-certificate-compression ] >>> > >>> > The proposed scheme allows a client and a server to negotiate a >>> > compression >>> > algorithm for the server certificate message. The scheme is purely >>> > opt-in >>> > on >>> > both sides. The current version of the draft defines zlib and Brotli >>> > compression, both of which are well-specified formats with an existing >>> > deployment experience. >>> > >>> > There are multiple motivations to compress certificates. The first one >>> > is >>> > that >>> > the smaller they are, the faster they arrive (both due to the transfer >>> > time >>> > and >>> > a decreased chance of packet loss). >>> > >>> > The second, and more interesting one, is that having small certificates >>> > is >>> > important for QUIC in order to achieve 1-RTT handshakes while limiting >>> > the >>> > opportunities for amplification attacks. Currently, TLS 1.3 over TCP >>> > without >>> > client auth looks like this: >>> > >>> > Round trip 1: client sends SYN, server sends SYN ACK >>> > Here, the server provides its own random value which client will >>> > have to echo in the future. >>> > Round trip 2: client sends ACK, ClientHello, server sends >>> > ServerHello...Finished >>> > Here, ACK confirms to server that the client can receive packets >>> > and is >>> > not >>> > just spoofing its source address. Server can send the entire >>> > ServerHello to >>> > Finished flight. >>> > >>> > In QUIC, we are trying to merge those two rounds into one. The >>> > problem, >>> > however, is that the ClientHello is one packet, and >>> > ServerHello...Finished >>> > can >>> > span multiple packets, meaning that this could be used as an >>> > amplification >>> > attack vector since the client's address is not yet authenticated at >>> > this >>> > point. >>> > In order to address this, the server has to limit the number of packets >>> > it >>> > sends >>> > during the first flight (i.e. ServerHello...Finished flight). Since >>> > certificates make up the majority of data in that flight, making them >>> > smaller >>> > can push them under the limit and save a round-trip. >>> > >>> > Cheers, >>> > Victor. >>> > >>> > _______________________________________________ >>> > TLS mailing list >>> > TLS@ietf.org >>> > https://www.ietf.org/mailman/listinfo/tls >>> > >> >> >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls >> >> > From nobody Mon Mar 6 17:37:44 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED7F3129632 for ; Mon, 6 Mar 2017 17:37:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cloudflare.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FBM65MgOiX6A for ; Mon, 6 Mar 2017 17:37:39 -0800 (PST) Received: from mail-pf0-x22f.google.com (mail-pf0-x22f.google.com [IPv6:2607:f8b0:400e:c00::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A551A12944D for ; Mon, 6 Mar 2017 17:37:39 -0800 (PST) Received: by mail-pf0-x22f.google.com with SMTP id v190so30791345pfb.1 for ; Mon, 06 Mar 2017 17:37:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=+d0lWXLz8ih0gO4QEwh6Zq+0+7O17RlBRC2yBCEiXd0=; b=oKiPCo6e2KLmTuyvi7sKSEigiB7irSFrSXztN96lixnxwJ42IotW4ttRI2szEjWe4x OFJZn5HW/enRfkvLORhc4f3q6Hss3tzt9Q3x7ofjO+MV2D5xStODW+uOlcCtiOPJYZ8b YbB99qXX2f59pUnpNctAMQAXsTCNYd4EOFA54= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=+d0lWXLz8ih0gO4QEwh6Zq+0+7O17RlBRC2yBCEiXd0=; b=kWaOrPfxLvcUUe7iGBnDCe8jBjBPS8ftGch7CL5cid0amzgLxI4fS1NyhzY96o5g1F 0KxMryVemHNByQGu8VeT2AiIPeoubE6aPA+9vFiWjQaWg/shs9BRiobXUp+R1jQV5aco pZ+F1wVk1eP4cMqAkIY6p17BULuZ4s652SgvA9jZS2in2UrBRGBd87RXZ8bh5swJho1o fQaV/VjEyW2POx51sJdVS4IOPGR1fC2+mF2j94XqnGcmbOwJb3KW1FFY7xiqt7u2+m9Y IYpa3NZiwq2EbqCiKQUKnlr9RmiBF89wHeaoqSPz2BFGiremP58gOhQU63ZDgjklT6u5 mZsg== X-Gm-Message-State: AMke39mxDT8elC9gvF2yyXPDJct18wqWDY4284Mm7lK69nk6F12n8IkGNGXcHgBFZwSycOLG X-Received: by 10.99.163.110 with SMTP id v46mr23600260pgn.171.1488850658968; Mon, 06 Mar 2017 17:37:38 -0800 (PST) Received: from ?IPv6:2601:645:8302:ef30:6cbd:8ca2:3194:4aa7? ([2601:645:8302:ef30:6cbd:8ca2:3194:4aa7]) by smtp.gmail.com with ESMTPSA id a5sm11624269pfh.124.2017.03.06.17.37.38 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 06 Mar 2017 17:37:38 -0800 (PST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Vlad Krasnov X-Mailer: iPhone Mail (14D27) In-Reply-To: Date: Mon, 6 Mar 2017 17:37:37 -0800 Content-Transfer-Encoding: quoted-printable Message-Id: <397C9A5D-BD80-4C58-83DC-02EB66BF0390@cloudflare.com> References: To: Martin Thomson Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Certificate compression draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 01:37:43 -0000 Don't know about neutral dictionary, but simply compressing Cloudflare cert u= sing Google cert, gives an additional 6% using brotli -15. I would rather have a biased dictionary than none at all :) Cheers, Vlad > On Mar 6, 2017, at 4:38 PM, Martin Thomson wrot= e: >=20 > Seems like you might get some traction with adding www. .com, some DN > fields (CN=3D, O=3D, C=3D), common OIDs, with some OIDs attached to values= > (like key usage and signature algorithm). Most of that is relatively > short though. >=20 >> On 7 March 2017 at 11:15, Victor Vasiliev wrote: >> Hi Vlad, >>=20 >> This is still an open issue: >> https://github.com/ghedo/tls-certificate-compression/issues/2 >>=20 >> The problem here is creating a dictionary that is both neutral with respe= ct >> to >> the certificate's issuing authority, and actually has a noticeable effect= . >> So >> far my personal attempts at making such a dictionary have not been very >> successful, but this might change. Even if we get a dictionary, I do not= >> expect the effect to be large compared to the effect of just compressing t= he >> chain in the first place. >>=20 >> -- Victor. >>=20 >>> On Mon, Mar 6, 2017 at 6:32 PM, Vlad Krasnov wrote= : >>>=20 >>> Hi Victor, >>>=20 >>> Have you considered creating a common dictionary, similarly to what SPDY= >>> did for header compression? >>>=20 >>> Cheers, >>> Vlad >>>=20 >>>=20 >>> On Mar 6, 2017, at 3:23 PM, Victor Vasiliev wrote: >>>=20 >>> Hi Martin, >>>=20 >>> I've measured the effect of compression on a corpus of popular website >>> certificate chains I had lying around (Alexa Top 100k from a few years >>> ago), >>> and the effect seems to be about -30% of size at the median and -48% at >>> 95th >>> percentile (with Brotli, subtract 3-5% for zlib). >>>=20 >>> I think the most dramatic effect from the compression is observed for th= e >>> certificates with a lot of SNI values, which is not uncommon. >>>=20 >>> -- Victor. >>>=20 >>> On Mon, Mar 6, 2017 at 6:06 PM, Martin Thomson >>> wrote: >>>>=20 >>>> Hi Victor, >>>>=20 >>>> Do you have any evidence to suggest that this reduces size in any >>>> meaningful way? Certificates tend to include both repetitious values >>>> (OIDs), and non-repetitious values (keys). >>>>=20 >>>>> On 7 March 2017 at 09:58, Victor Vasiliev wrote: >>>>> Certificate compression has been discussed on this list briefly before= , >>>>> and >>>>> there was some interest in at least considering a draft for it. The >>>>> draft >>>>> now >>>>> exists (co-authored by Alessandro and myself), and it can be found at:= >>>>>=20 >>>>>=20 >>>>> https://datatracker.ietf.org/doc/draft-ghedini-tls-certificate-compres= sion/ >>>>> [ GitHub repo: https://github.com/ghedo/tls-certificate-compression ]= >>>>>=20 >>>>> The proposed scheme allows a client and a server to negotiate a >>>>> compression >>>>> algorithm for the server certificate message. The scheme is purely >>>>> opt-in >>>>> on >>>>> both sides. The current version of the draft defines zlib and Brotli >>>>> compression, both of which are well-specified formats with an existing= >>>>> deployment experience. >>>>>=20 >>>>> There are multiple motivations to compress certificates. The first on= e >>>>> is >>>>> that >>>>> the smaller they are, the faster they arrive (both due to the transfer= >>>>> time >>>>> and >>>>> a decreased chance of packet loss). >>>>>=20 >>>>> The second, and more interesting one, is that having small certificate= s >>>>> is >>>>> important for QUIC in order to achieve 1-RTT handshakes while limiting= >>>>> the >>>>> opportunities for amplification attacks. Currently, TLS 1.3 over TCP >>>>> without >>>>> client auth looks like this: >>>>>=20 >>>>> Round trip 1: client sends SYN, server sends SYN ACK >>>>> Here, the server provides its own random value which client will >>>>> have to echo in the future. >>>>> Round trip 2: client sends ACK, ClientHello, server sends >>>>> ServerHello...Finished >>>>> Here, ACK confirms to server that the client can receive packets >>>>> and is >>>>> not >>>>> just spoofing its source address. Server can send the entire >>>>> ServerHello to >>>>> Finished flight. >>>>>=20 >>>>> In QUIC, we are trying to merge those two rounds into one. The >>>>> problem, >>>>> however, is that the ClientHello is one packet, and >>>>> ServerHello...Finished >>>>> can >>>>> span multiple packets, meaning that this could be used as an >>>>> amplification >>>>> attack vector since the client's address is not yet authenticated at >>>>> this >>>>> point. >>>>> In order to address this, the server has to limit the number of packet= s >>>>> it >>>>> sends >>>>> during the first flight (i.e. ServerHello...Finished flight). Since >>>>> certificates make up the majority of data in that flight, making them >>>>> smaller >>>>> can push them under the limit and save a round-trip. >>>>>=20 >>>>> Cheers, >>>>> Victor. >>>>>=20 >>>>> _______________________________________________ >>>>> TLS mailing list >>>>> TLS@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/tls >>>>>=20 >>>=20 >>>=20 >>> _______________________________________________ >>> TLS mailing list >>> TLS@ietf.org >>> https://www.ietf.org/mailman/listinfo/tls >>>=20 >>>=20 >>=20 From nobody Mon Mar 6 18:13:51 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F1661293DB for ; Mon, 6 Mar 2017 18:13:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.499 X-Spam-Level: X-Spam-Status: No, score=-1.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sleevi.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XLASQVdaWywh for ; Mon, 6 Mar 2017 18:13:49 -0800 (PST) Received: from homiemail-a16.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E39B1288B8 for ; Mon, 6 Mar 2017 18:13:49 -0800 (PST) Received: from homiemail-a16.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a16.g.dreamhost.com (Postfix) with ESMTP id 9C5D214004009 for ; Mon, 6 Mar 2017 18:13:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sleevi.com; h=mime-version :in-reply-to:references:from:date:message-id:subject:to:cc :content-type; s=sleevi.com; bh=zpMWjhFqjfDWVvVF+VCbZm8zLmM=; b= A+2erYrkwrWPs11WVvcdsIn8D25DoOs9Aldg0KwvK1CiDGtLsJxaLFyatMRE9eD4 FKUV3N2TWmDB0uivBDsPeUnMsOFrRJzDONd3vR2WBhA8HuAIRNKqFF8BDgeehMx3 H3qhBFe+Dpf5E57lsFo5nfZ296rMniBh4xAoEWnda/w= Received: from mail-lf0-f45.google.com (mail-lf0-f45.google.com [209.85.215.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: ryan@sleevi.com) by homiemail-a16.g.dreamhost.com (Postfix) with ESMTPSA id 66CA61400012B for ; Mon, 6 Mar 2017 18:13:48 -0800 (PST) Received: by mail-lf0-f45.google.com with SMTP id j90so43869798lfk.2 for ; Mon, 06 Mar 2017 18:13:48 -0800 (PST) X-Gm-Message-State: AMke39mTp84UOeXKRDGf3mSvXcuf1YumWIRuQCLY6S7DpbzjWNttvj5cb7BN5/SdxxfGOlHXBwd2nsbtNdrBlg== X-Received: by 10.25.56.72 with SMTP id d8mr5661062lfj.2.1488852826661; Mon, 06 Mar 2017 18:13:46 -0800 (PST) MIME-Version: 1.0 Received: by 10.25.193.197 with HTTP; Mon, 6 Mar 2017 18:13:46 -0800 (PST) In-Reply-To: <397C9A5D-BD80-4C58-83DC-02EB66BF0390@cloudflare.com> References: <397C9A5D-BD80-4C58-83DC-02EB66BF0390@cloudflare.com> From: Ryan Sleevi Date: Mon, 6 Mar 2017 21:13:46 -0500 X-Gmail-Original-Message-ID: Message-ID: To: Vlad Krasnov Content-Type: multipart/alternative; boundary=f403045ea32edb2a55054a1a8f22 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Certificate compression draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 02:13:50 -0000 --f403045ea32edb2a55054a1a8f22 Content-Type: text/plain; charset=UTF-8 On Mon, Mar 6, 2017 at 5:37 PM, Vlad Krasnov wrote: > Don't know about neutral dictionary, but simply compressing Cloudflare > cert using Google cert, gives an additional 6% using brotli -15. > > I would rather have a biased dictionary than none at all :) > > Cheers, > Vlad I can appreciate that sentiment, but you do realize the natural consequence of that - it creates an incentive structure for the larger CAs to get larger, by virtue of the compression benefits afforded to them by such a dictionary making such certificates more desirable. That, in turn, results in more instability and insecurity for the PKI ecosystem and penalizes non-participants of the WebPKI within TLS. While such a desire for improved compression is natural, the external costs should not be underestimated or dismissed. I would rather have no compression than a biased dictionary, given these concerns. --f403045ea32edb2a55054a1a8f22 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Mon, Mar 6, 2017 at 5:37 PM, Vlad Krasnov <vlad@cloudflare.com> wrote:
Don't know about = neutral dictionary, but simply compressing Cloudflare cert using Google cer= t, gives an additional 6% using brotli -15.

I would rather have a biased dictionary than none at all :)

Cheers,
Vlad

I can appreciate that sentiment, but y= ou do realize the natural consequence of that - it creates an incentive str= ucture for the larger CAs to get larger, by virtue of the compression benef= its afforded to them by such a dictionary making such certificates more des= irable. That, in turn, results in more instability and insecurity for the P= KI ecosystem and penalizes non-participants of the WebPKI within TLS.
=

While such a desire for improved compression is natural= , the external costs should not be underestimated or dismissed.
<= br>
I would rather have no compression than a biased dictionary, = given these concerns.
--f403045ea32edb2a55054a1a8f22-- From nobody Mon Mar 6 18:32:22 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 027C8129525 for ; Mon, 6 Mar 2017 18:32:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EAf6nZ4PU0Jm for ; Mon, 6 Mar 2017 18:32:19 -0800 (PST) Received: from mournblade.imrryr.org (mournblade.imrryr.org [108.5.242.66]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8C594129418 for ; Mon, 6 Mar 2017 18:32:19 -0800 (PST) Received: from vpro.lan (cpe-74-71-8-253.nyc.res.rr.com [74.71.8.253]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mournblade.imrryr.org (Postfix) with ESMTPSA id BC7BF7A32D8 for ; Tue, 7 Mar 2017 02:32:18 +0000 (UTC) (envelope-from ietf-dane@dukhovni.org) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Viktor Dukhovni In-Reply-To: Date: Mon, 6 Mar 2017 21:32:16 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: References: <397C9A5D-BD80-4C58-83DC-02EB66BF0390@cloudflare.com> To: "" X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Certificate compression draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: "" List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 02:32:21 -0000 > On Mar 6, 2017, at 9:13 PM, Ryan Sleevi = wrote: >=20 > I can appreciate that sentiment, but you do realize the natural = consequence of that - it creates an incentive structure for the larger = CAs to get larger, by virtue of the compression benefits afforded to = them by such a dictionary making such certificates more desirable. That, = in turn, results in more instability and insecurity for the PKI = ecosystem and penalizes non-participants of the WebPKI within TLS. Fewer WebPKI CAs (which are all trusted) seems like an improvement to = me. Though I doubt that compression efficiency would be a major factor in = such an outcome. If we're ultimately going to use post-quantum certificates = with post-quantum keys and signature algorithms, and those keys and = signatures are noticeably larger than current RSA keys/signatures, then compression = of the rest of the certificate will not matter very much at all. If scalable quantum computing never happens, then EdDSA certs have = sufficiently small keys and signatures for reasonably effective compression. One might also note that 10Gbps+ networks tend to use 9Kbyte ethernet = frames these days, perhaps over time these will become the norm rather than the exception... --=20 Viktor. From nobody Mon Mar 6 19:33:12 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26301129ABA for ; Mon, 6 Mar 2017 19:33:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4gfp6sY393_f for ; Mon, 6 Mar 2017 19:33:10 -0800 (PST) Received: from mail-qk0-x22b.google.com (mail-qk0-x22b.google.com [IPv6:2607:f8b0:400d:c09::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 503FE12956B for ; Mon, 6 Mar 2017 19:33:08 -0800 (PST) Received: by mail-qk0-x22b.google.com with SMTP id v125so125477937qkh.2 for ; Mon, 06 Mar 2017 19:33:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=R7Q34I7OqqcqB8JaF8R4xgILwrJrY52Jzl8QWK63ZHQ=; b=E4sLjAYaR5IlYX2MJJpVa6OO5WLLH98QItuG4kWAAPdDO8Ql1s0WMuaAibIorGv5Fg 56zM3kCgG0J6oInN6YStKOd+QlonTaTuZhDr7xtgowxsocDiIJow+4iYpksCxPX+FeO2 q2DSMaQrrkmfhbVpF+gJH9dis4Vcw/5MwWgalUI+zOx33Av9T+0fJB0zvJOkRX0q5SY1 RiXgXXquZyEWSWqixvszT3sJv8MmRENOsvDfvrjWu3rouet1YgWAlpVixKvGexyAyqmF tMHuoffbg8SvXOBJ8YkE8FWB2BQ3zHjFz9T/BksrVA0aRUuOyluQ+nPtx6H0gbX3NsYq kisA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=R7Q34I7OqqcqB8JaF8R4xgILwrJrY52Jzl8QWK63ZHQ=; b=Syik1KSFnGTYJiVm8OP6shcEQG8DjmpDZPTNieJmf34e3NRIW5Qbi4tJxOhU2fbQKC QQ8AMDOKjXycGNpvUmo1Ypxv4md4pCegtC1p9McrOUSWNhCDMNiYP9LQoWhslgaOYYHv 9BjZ97fs6LmslJR5OYqI4jmWoYmJDW/INpjKw1c+G3IcELUYlA713kZAD0wAfKww0m5b B0RkRrKCFazRg31FT+IN1UgRl2TJqr4QCn3h+GAcuiO56ofbeArh5YuRX3j9pYN70OdP Q2QQzoCzUzmmtyXkQH+fe4f613fOWRzZFGtF8iq6cV71aptE0NCe/IvjkS+3fYVvNytR FDRg== X-Gm-Message-State: AMke39mTRjR2VNeVycKbew99NMs1DXrQN5XcAI2XTAXYahf66V4LmCl3sK8DadJ1Aqk/OrCt11lmj/h8k2MrxA== X-Received: by 10.200.46.208 with SMTP id i16mr19264975qta.13.1488857587447; Mon, 06 Mar 2017 19:33:07 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.19.112 with HTTP; Mon, 6 Mar 2017 19:33:07 -0800 (PST) In-Reply-To: References: <397C9A5D-BD80-4C58-83DC-02EB66BF0390@cloudflare.com> From: Martin Thomson Date: Tue, 7 Mar 2017 14:33:07 +1100 Message-ID: To: "" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] Certificate compression draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 03:33:11 -0000 On 7 March 2017 at 13:32, Viktor Dukhovni wrote: > Fewer WebPKI CAs (which are all trusted) seems like an improvement to me. > Though I doubt that compression efficiency would be a major factor in such > an outcome. Like Ryan, I would rather not create any systemic biases in favour of certain parties, however minor we each subjectively believe those biases might be. From nobody Tue Mar 7 00:15:04 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DEC56128DF6 for ; Tue, 7 Mar 2017 00:15:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xlA96FPojS1x for ; Tue, 7 Mar 2017 00:15:02 -0800 (PST) Received: from mout.gmx.net (mout.gmx.net [212.227.17.22]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 07715127A90 for ; Tue, 7 Mar 2017 00:15:01 -0800 (PST) Received: from [192.168.91.177] ([80.92.114.23]) by mail.gmx.com (mrgmx103 [212.227.17.168]) with ESMTPSA (Nemesis) id 0M8MyE-1cOhOn0jwI-00vyB6; Tue, 07 Mar 2017 09:14:55 +0100 To: Victor Vasiliev , "tls@ietf.org" References: From: Hannes Tschofenig Openpgp: id=071A97A9ECBADCA8E31E678554D9CEEF4D776BC9 Message-ID: <1cf1ff2e-3784-eac0-461f-335c043a8917@gmx.net> Date: Tue, 7 Mar 2017 09:14:53 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="EOmTfn2rCXl4g4OullFUjxvx9mdgBUKbn" X-Provags-ID: V03:K0:YiueBd+2cIoesNRgnx55bRTAu8hc2hBrFbqqzgyQC2mmN5GlVbY ogTm80c3H6h7lish75j48KqIuQ/l3cqUPNWlQQKLZLVNxw0xa74IDmJvEMlMVAw3lErvDeX J4orqIWX4e8YayUQfZErQazn5ed+GF2c/JsBm0eB6e9UZZc6IxLSsFCZ2J+zNFjPS9WtWX8 donY3qyVvgp4qGCOOALwA== X-UI-Out-Filterresults: notjunk:1;V01:K0:YYqI38y/E9A=:1IoLYBF0AA4kXCaqSlr0RZ r4FG9gVyQD1pL9VauA9SwGlDqtBpedFooplhSl3R/iVPE0ZKAUMEdR+k5WDATQHXhKe+wtX8o thA4LBkGGJJ9JrwsWH4pf+7GEG7PNh5CQlSFy48DrZV4/L5gQCPOtq6wuAKxZN0o8CVzVDq+A TuodJY4mIASxzlCDxrlRiYjzdGHNKJfLl2LQAzRGMBbPXFEY8+JwhoqcfoYNj69ah0CiSTbT5 hoCsSwwd64Kyrv6/jgWoyNABmV7NaQ7DJvz1TH4Rt0Pb9TV10XOs0e0IFhvDjbgBQFjSZH6aB TL8gQkyWU250C2FYXwChWXht1gVyAKwb18IXDcziv5BHHEnip+khSfkyDavdT90v36/MNfd/n tfiG9pJ7ecMGcSSGsWES5avJa8Gte6K+3/Pkw0YvfH1XTBxr54dfGYAcek7/69G3D1EECW/ml J+yzY0Pj1o64HEqXZCpu84UfmU//kENcyZq/fGO2Lv7d74a/02D8AJztTX4IljgeLVt2T+g1U ZMOr04G3Io5q22Hz19q/9yRB1Ud99EM8HLqcyYSTP4OCQ62vFSSCpU+58p+U5b5sY+QAUlkco ipTuvi0DszmPx6Qx78DD5cdBadv9cu1ghOQBn0ckTl8JXJntKj+OA/MyhBatEb2CSoDQFUMTS MUA+5YTgyEOBQo6ssSv4QUkoxPB1tYk5gb3G5LpM/0ACNj/NwWgtOlgOLTgwIMLkyoO5N2Xsk oFZQi3U3Sgh7yur0ItStm9bJU/Z9nIfPebT21xQ3r0EYX/zHltpimy7dNIdlctPsZ9DyoqV7g f5+h96awj7F1gU3p3yVqQwB+LpGT2LlkNt/4daUNekLzVdRVH3BzEQs1ZoLqUZQrOkJTEACqQ m/n5GsXmTUwyaljmGz+LVkfyc51eeja6nu+f3no9at2VZ2fIXhhq9XZGdMa8U8f+r8rz+Xmew yZwbRRM+rpwCA6J9XqWzLiO50v4tu56Hkn33sjNexsiLByHxeYx7EUl73B1lWERPD6ctqBa9v 8g== Archived-At: Subject: Re: [TLS] Certificate compression draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 08:15:04 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --EOmTfn2rCXl4g4OullFUjxvx9mdgBUKbn Content-Type: multipart/mixed; boundary="CDojld3sLUKnhqfG4Urq2qjStsXLNK0SC"; protected-headers="v1" From: Hannes Tschofenig To: Victor Vasiliev , "tls@ietf.org" Message-ID: <1cf1ff2e-3784-eac0-461f-335c043a8917@gmx.net> Subject: Re: [TLS] Certificate compression draft References: In-Reply-To: --CDojld3sLUKnhqfG4Urq2qjStsXLNK0SC Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Hi Victor why don't you use RFC 7924: https://tools.ietf.org/html/rfc7924 This provides an even better "compression" ratio. Ciao Hannes On 03/06/2017 11:58 PM, Victor Vasiliev wrote: > Certificate compression has been discussed on this list briefly before,= and > there was some interest in at least considering a draft for it. The > draft now > exists (co-authored by Alessandro and myself), and it can be found at: >=20 > https://datatracker.ietf.org/doc/draft-ghedini-tls-certificate-compress= ion/ > [ GitHub repo: https://github.com/ghedo/tls-certificate-compression ]= >=20 > The proposed scheme allows a client and a server to negotiate a compres= sion > algorithm for the server certificate message. The scheme is purely > opt-in on > both sides. The current version of the draft defines zlib and Brotli > compression, both of which are well-specified formats with an existing > deployment experience. >=20 > There are multiple motivations to compress certificates. The first one= > is that > the smaller they are, the faster they arrive (both due to the transfer > time and > a decreased chance of packet loss). >=20 > The second, and more interesting one, is that having small certificates= is > important for QUIC in order to achieve 1-RTT handshakes while limiting = the > opportunities for amplification attacks. Currently, TLS 1.3 over TCP > without > client auth looks like this: >=20 > Round trip 1: client sends SYN, server sends SYN ACK > Here, the server provides its own random value which client will > have to echo in the future. > Round trip 2: client sends ACK, ClientHello, server sends > ServerHello...Finished > Here, ACK confirms to server that the client can receive packets an= d > is not > just spoofing its source address. Server can send the entire > ServerHello to > Finished flight. >=20 > In QUIC, we are trying to merge those two rounds into one. The problem= , > however, is that the ClientHello is one packet, and > ServerHello...Finished can > span multiple packets, meaning that this could be used as an amplificat= ion > attack vector since the client's address is not yet authenticated at > this point. > In order to address this, the server has to limit the number of packets= > it sends > during the first flight (i.e. ServerHello...Finished flight). Since > certificates make up the majority of data in that flight, making them > smaller > can push them under the limit and save a round-trip. >=20 > Cheers, > Victor. >=20 >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls >=20 --CDojld3sLUKnhqfG4Urq2qjStsXLNK0SC-- --EOmTfn2rCXl4g4OullFUjxvx9mdgBUKbn Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: GPGTools - http://gpgtools.org iQEcBAEBCgAGBQJYvmv9AAoJEGhJURNOOiAtESIH/2e8+QGXcbyyUbjpDbgwXBw5 9BSMmATUmQklJunaHyV9YmDl83HtmV8DNi99CwYS9JvtlXHp2Z0PhrOTW904J4jS 6MYMsd8sekvoBVR/OuNqPE5WYCPUVE36j/36zVVuwb6KlRineeJnEHEILOfSsQZ4 nM/BiB9/LLkFgpYSRc0H9DJ+dgRtCqrj+MBpsmc2XH6Mif/W2qT/TIuie5/H5kLe Fj8qx16+DY8Ild6o6eHnpj+HHuWLm/PUD7JOqDCSOO2GPOi7aPFgFSU7Na/r+C7e V0GJeFI3ad4S6ZfMPtMxlAisMonwa/ZHnDcuNPYVKsBP38ioJPMLruxj18/F+Jg= =Ikf/ -----END PGP SIGNATURE----- --EOmTfn2rCXl4g4OullFUjxvx9mdgBUKbn-- From nobody Tue Mar 7 09:44:51 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D0C71295BF for ; Tue, 7 Mar 2017 09:44:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sqjIFba0IxYx for ; Tue, 7 Mar 2017 09:44:43 -0800 (PST) Received: from asbsmtoutape01.symantec.com (asbsmtoutape01.symantec.com [155.64.138.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B74B91295D0 for ; Tue, 7 Mar 2017 09:44:43 -0800 (PST) Received: from asbsmtmtaapi02.symc.symantec.com (asb1-f5-symc-ext-prd-snat4.net.symantec.com [10.90.75.4]) by asbsmtoutape01.symantec.com (Symantec Messaging Gateway) with SMTP id 2B.FA.36325.A81FEB85; Tue, 7 Mar 2017 17:44:42 +0000 (GMT) X-AuditID: 0a5af819-428639a000008de5-36-58bef18a45a5 Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (asb1-f5-symc-ext-prd-snat5.net.symantec.com [10.90.75.5]) by asbsmtmtaapi02.symc.symantec.com (Symantec Messaging Gateway) with SMTP id 3B.CF.09705.981FEB85; Tue, 7 Mar 2017 17:44:42 +0000 (GMT) Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Tue, 7 Mar 2017 09:44:40 -0800 Received: from NAM02-CY1-obe.outbound.protection.outlook.com (10.44.128.10) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Tue, 7 Mar 2017 09:44:40 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=XF1VuAu2tQUfFP5niE8EMkS2jCq5S1d4blq4oVIFoIE=; b=3i2q8mkkyryuWA4i3eTjODe7yfFs95zVE454E6x/fsHEVyiRQNVEZOwnoTJe3nD3e+xMI4nKjSBdlI89Uatwny5OYrWxH2ZM8PhHLQXzLyZrDMFiDPTjc96eEOrafQd7lKd00/Q00lYBjcHnkWAXfsse7KXmHCODT1z0v4/BdKU= Received: from DM5PR16MB1834.namprd16.prod.outlook.com (10.172.45.9) by DM5PR16MB1835.namprd16.prod.outlook.com (10.172.45.10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.12; Tue, 7 Mar 2017 17:44:39 +0000 Received: from DM5PR16MB1834.namprd16.prod.outlook.com ([10.172.45.9]) by DM5PR16MB1834.namprd16.prod.outlook.com ([10.172.45.9]) with mapi id 15.01.0947.020; Tue, 7 Mar 2017 17:44:39 +0000 From: Roelof Du Toit To: "tls@ietf.org" Thread-Topic: Allow KeyShare in HelloRetry if not advertised in ClientHello? Thread-Index: AQHSl2p+vyKS4/mfNkq7sGwa67WGLQ== Date: Tue, 7 Mar 2017 17:44:39 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=symantec.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [72.23.5.194] x-ms-office365-filtering-correlation-id: a7f9d290-fa56-490a-f2b9-08d46581a123 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:DM5PR16MB1835; x-microsoft-exchange-diagnostics: 1; DM5PR16MB1835; 7:9bs5uCwGQvUbFctV/4yk9T/4G+lnVw+u0c+C6EuYG6SQ2Fh7Vd6mSk0UoUOLBKdpvNMKxcMhwGmL4ty6gN+nTN8pWIG1k5zAflVRPLH4zeeHijnyoLn4/ds4H8SJ4QNpaDPZtBNVgeZi453oStYYpDq4fxa4YcgvO0tp4VovyumeuPOS6bG42vHQ/o6gObxhWaWlWKhkR/dsc6SEtMXgESrwfOPkDx1W7HJ4RDDaOtEYikeyoZ0lU4kwPDzuX9lm+D5yE0VNwMNiur7ffS+jb8GNyS36bLgRT9Fy5yJq38OItzrvGR/Udg2g2Jrq2Zpbb3ru+rFw5ZieWj6a5r+W1Q== x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6041248)(20161123562025)(20161123558025)(20161123564025)(20161123555025)(20161123560025)(6072148); SRVR:DM5PR16MB1835; BCL:0; PCL:0; RULEID:; SRVR:DM5PR16MB1835; x-forefront-prvs: 0239D46DB6 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(7916002)(39450400003)(3846002)(2900100001)(80792005)(189998001)(5660300001)(102836003)(36756003)(6116002)(25786008)(2351001)(7906003)(5640700003)(7736002)(83716003)(1730700003)(66066001)(122556002)(86362001)(81166006)(6916009)(8936002)(3280700002)(82746002)(2906002)(33656002)(2501003)(50986999)(236005)(8676002)(54356999)(10290500002)(54896002)(6512007)(6306002)(3660700001)(6506006)(6436002)(606005)(38730400002)(110136004)(6486002)(77096006)(106116001)(99286003)(53936002)(104396002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR16MB1835; H:DM5PR16MB1834.namprd16.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_B6B302EF68364E50B916D9260C16D25Bsymanteccom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Mar 2017 17:44:39.3350 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR16MB1835 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA02SbUhTURjHO/fezetocZorH02YzpLMd+qDRGhv0Ewloz7YIOo2bynOF7Zp GhKzWbRZS0Sk1FLXMpRM6EVNhrpZkYqspDLFqNRGJfiSpO5D2bx3gl8Ov+f5/87heeDQpKRT EEhn5epYTS6jlgtFlEiZTEWZ5rvTY2+6/OJ/O01oP1JYrW4iDSlF+zJYdVYhq4lJOCvKvD7Z ROZXHi6yNhsoPao9aEK+NOA9UGe4LzQhES3B8wiutI8L1oKJ0UbEB4sIjE6Xt+hDMPO2keCL Hwj6+xq4hMJGEqZ73Nx9Ca4kYKosiLfsCGbLrnGBEMeBu7eSYykOgc4P5T6r7IePQGnrsLef AtUPbATP0TAwa+YcCm+H+qUqtMpinAgPlwY5RngrLA084nwS+8PYVD3BL4HBanOSPG+Bn5P/ BKsDIVyO4LmtB/FBJAyNTHlZBl++D3o5FcYdr4g1Xhia53YGfIOEjr/NXikbzPp+LydDx8AI xUs1BNjH33nGpj1FELxw7+b7ZgEsTI4R/MqB8Pm9EVWgiJp1k/Osgp7aUUENt+lm6L8zRdV4 niJxOLR1xfBKCFSVf/PheSdcrbvrZQX8utcuXO80ILoFBTPac9ocXV6BjslnY+OitcU5qtWD 8fwmVbQqL+cJ4v7TckAnevkmxYEwjeQbxVkT3ekSAVPoMR0IaFIuFYcOe1riDKb4EqvJO6Mp ULNaB9pGU3J/8YyrNV2CLzA6Nptl81nNWkrQvoF6lKjIVofrHg/K6Tl7hcveYj8WWVqCcm2G oltdCfoyfGiDTUx+XPEPm1tsLZYc7TWFyioDL7c9zVHInITrpNBwu+H88TTLnxMQ4bIkvn52 Sr9DxibttUVJM0v0qQHxkk/SsAOnzZv8VIYJi9JiXEmunk5aDnZfHC1sGlN+DZFT2kwmbhep 0TL/AcQGG79LAwAA X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprDKsWRmVeSWpSXmKPExsXCFeXNqtv1cV+EwY153BafzncxOjB6LFny kymAMYrLJiU1J7MstUjfLoEro+PxMuaCSS4VS1Y2szQwznbqYuTkkBAwkXh0cyFjFyMXh5DA N0aJzvPPoJzDjBLvLixkgnBeMEqcPLwALMMi0Mks8Xr/T1aQfiGBSUwST1pkIKoOMkq8b2kD S7AJGEr8PDAJzBYRUJTYcbWbHcQWFnCXaFx7CSruIzFt6R4mCFtP4tT7PrAaFgEVifnfpzCC 2LwC9hLLv58GsxkFxCS+n1oDVs8sIC5x68l8JognBCSW7DnPDGGLSrx8/I8V5CBGgW5Gia17 9jNCJHQkzl5/AmXLS9x/ehrK9pW4c+goE4z9+exHsJ8lBHqYJbb/XQlVlC3R13ASyvaW2H7q OgtE0SwmiYN3LgKdzQHkyEjs/GkMEe9jlfj8+BYTxMtSEnevdDJC2DISL+7sZYV4IVli/+yb rBMY1Wch+WgWktQscAgISpyc+YRlFtAKZgFNifW79CFKFCWmdD9kh7A1JFrnzIWyPSRezdvG hqxmASPHKkaFxOKk4tyS3JLExIJMAyO94srcZBCRCExMyXrJ+bmbGMHJ6bf4DsZzf3wOMQpw MCrx8G64uy9CiDWxDKjyEKM0B4uSOO8Nw00RQgLpiSWp2ampBalF8UWlOanFhxiZODilGhh1 rrWt67yXIbaWm9upQOla7o1yfXbR0G0uqcbNClWM3doBfd1ewvonp07++zBkW3rzBRfZ1k1r XD6J/X0uKHtpt42s9c+8lP+z/aKvH+h6UJ6wr2f9fc6st4H9yTlv6zzZbhqqcQX4l86MOVD0 dY5fjmHB06fSp5LTN/iwsCoJpFUfj29Zp8RSnJFoqMVcVJwIACD8skAvAwAA X-CFilter-Loop: ASB03 Archived-At: Subject: [TLS] Allow KeyShare in HelloRetry if not advertised in ClientHello? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 17:44:50 -0000 --_000_B6B302EF68364E50B916D9260C16D25Bsymanteccom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QWxsLA0KDQpUaGUgY3VycmVudCBsYW5ndWFnZSBpbiBodHRwczovL3Rsc3dnLmdpdGh1Yi5pby90 bHMxMy1zcGVjLyNyZmMuc2VjdGlvbi40LjEuNCBzdGF0ZXM6DQpBcyB3aXRoIFNlcnZlckhlbGxv LCBhIEhlbGxvUmV0cnlSZXF1ZXN0IE1VU1QgTk9UIGNvbnRhaW4gYW55IGV4dGVuc2lvbnMgdGhh dCB3ZXJlIG5vdCBmaXJzdCBvZmZlcmVkIGJ5IHRoZSBjbGllbnQgaW4gaXRzIENsaWVudEhlbGxv LCB3aXRoIHRoZSBleGNlcHRpb24gb2Ygb3B0aW9uYWxseSB0aGUg4oCcY29va2ll4oCdIChzZWUg U2VjdGlvbiA0LjIuMjxodHRwczovL3Rsc3dnLmdpdGh1Yi5pby90bHMxMy1zcGVjLyNjb29raWU+ KSBleHRlbnNpb24uDQoNCkkgYW0gYW5hbHl6aW5nIHRoZSBmb2xsb3dpbmcgbWVzc2FnZSBmbG93 Og0KQ2xpZW50SGVsbG8NCisgZWFybHlfZGF0YQ0KKyBwc2tfa2V5X2V4Y2hhbmdlX21vZGVzID0g cHNrX2tlDQorIHByZV9zaGFyZWRfa2V5IC0tLS0tLS0tLT4NCihFYXJseSBEYXRhKSAtLS0tLS0t LS0+ICpyZWplY3QqDQo8LS0tLS0tLS0tIEhlbGxvUmV0cnlSZXF1ZXN0IChub3QgYWxsb3dlZCB0 byBhZGQga2V5X3NoYXJlKQ0KQ2xpZW50SGVsbG8NCisgc3VwcG9ydGVkX2dyb3Vwcw0KKyBrZXlf c2hhcmUgLS0tLS0tLS0tPiAqbm90IHN1cHBvcnRlZCoNCg0KQXQgdGhhdCBwb2ludCBpbiB0aGUg ZmxvdyB0aGUgc2VydmVyIGlzIG5vdCBhbGxvd2VkIHRvIHNlbmQgYW5vdGhlciBIZWxsb1JldHJ5 UmVxdWVzdC4gIFRvIGF2b2lkIHRoYXQgdGhlIGNsaWVudCB3b3VsZCBuZWVkIHNvbWUgaGludHMg aW4gdGhlIEhlbGxvUmV0cnlSZXF1ZXN0Lg0KV291bGQgaXQgYmUgcG9zc2libGUgdG8gYWxsb3cg YW4gZXhjZXB0aW9uIHRvIHNlbmQga2V5X3NoYXJlIGFuZC9vciBzdXBwb3J0ZWRfZ3JvdXBzIGlu IGEgSGVsbG9SZXRyeVJlcXVlc3QgaWYgbm90IG9mZmVyZWQgaW4gQ2xpZW50SGVsbG8/DQoNClJv ZWxvZiBkdSBUb2l0DQoNCg== --_000_B6B302EF68364E50B916D9260C16D25Bsymanteccom_ Content-Type: text/html; charset="utf-8" Content-ID: <89323E730F67BB4A978EC96A451C3D4D@namprd16.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxuczptdj0iaHR0cDovL21hY1ZtbFNj aGVtYVVyaSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnL1RSL1JFQy1odG1sNDAiPg0KPGhlYWQ+ DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hh cnNldD11dGYtOCI+DQo8bWV0YSBuYW1lPSJUaXRsZSIgY29udGVudD0iIj4NCjxtZXRhIG5hbWU9 IktleXdvcmRzIiBjb250ZW50PSIiPg0KPG1ldGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJN aWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQgbWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9u dCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ291cmllciBOZXci Ow0KCXBhbm9zZS0xOjIgNyAzIDkgMiAyIDUgMiA0IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZh bWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0O30NCkBm b250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIg NCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05v cm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFw dDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7fQ0KYTpsaW5rLCBz cGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6IzA1NjND MTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBl cmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Izk1NEY3MjsN Cgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnNwYW4uRW1haWxTdHlsZTE3DQoJe21zby1z dHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJY29sb3I6d2luZG93 dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglm b250LWZhbWlseTpDYWxpYnJpOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxl MTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtY29tcG9zZTsNCglmb250LWZhbWlseTpDYWxp YnJpOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5tc29JbnMNCgl7bXNvLXN0eWxlLXR5cGU6 ZXhwb3J0LW9ubHk7DQoJbXNvLXN0eWxlLW5hbWU6IiI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVy bGluZTsNCgljb2xvcjp0ZWFsO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4 cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6Q2FsaWJyaTt9DQpA cGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEu MGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7 fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMg djpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjciLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYg Z3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAg djpleHQ9ImVkaXQiIGRhdGE9IjEiLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0t LT4NCjwvaGVhZD4NCjxib2R5IGJnY29sb3I9IndoaXRlIiBsYW5nPSJFTi1VUyIgbGluaz0iIzA1 NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5BbGwsPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5UaGUgY3VycmVudCBsYW5ndWFn ZSBpbiA8YSBocmVmPSJodHRwczovL3Rsc3dnLmdpdGh1Yi5pby90bHMxMy1zcGVjLyNyZmMuc2Vj dGlvbi40LjEuNCI+DQpodHRwczovL3Rsc3dnLmdpdGh1Yi5pby90bHMxMy1zcGVjLyNyZmMuc2Vj dGlvbi40LjEuNDwvYT4gc3RhdGVzOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5BcyB3aXRoIFNlcnZlckhl bGxvLCBhIEhlbGxvUmV0cnlSZXF1ZXN0IE1VU1QgTk9UIGNvbnRhaW4gYW55IGV4dGVuc2lvbnMg dGhhdCB3ZXJlIG5vdCBmaXJzdCBvZmZlcmVkIGJ5IHRoZSBjbGllbnQgaW4gaXRzIENsaWVudEhl bGxvLCB3aXRoIHRoZSBleGNlcHRpb24gb2Ygb3B0aW9uYWxseSB0aGUg4oCcY29va2ll4oCdIChz ZWUmbmJzcDs8YSBocmVmPSJodHRwczovL3Rsc3dnLmdpdGh1Yi5pby90bHMxMy1zcGVjLyNjb29r aWUiPlNlY3Rpb24NCiA0LjIuMjwvYT4pIGV4dGVuc2lvbi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkkgYW0gYW5hbHl6aW5nIHRoZSBmb2xsb3dpbmcgbWVzc2Fn ZSBmbG93OjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7Ij5DbGllbnRIZWxsbzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7Ij4mIzQzOyBlYXJseV9kYXRhPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiYjNDM7IHBza19rZXlfZXhjaGFuZ2VfbW9kZXMg PSBwc2tfa2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90OyI+JiM0MzsgcHJlX3NoYXJlZF9rZXkgLS0tLS0tLS0tJmd0OzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4oRWFybHkgRGF0YSkgLS0tLS0t LS0tJmd0OyAqcmVqZWN0KjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJp ZXIgTmV3JnF1b3Q7Ij4mbHQ7LS0tLS0tLS0tIEhlbGxvUmV0cnlSZXF1ZXN0IChub3QgYWxsb3dl ZCB0byBhZGQga2V5X3NoYXJlKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nv dXJpZXIgTmV3JnF1b3Q7Ij5DbGllbnRIZWxsbzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mIzQzOyBzdXBwb3J0ZWRfZ3JvdXBzPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiYjNDM7IGtleV9z aGFyZSAtLS0tLS0tLS0mZ3Q7ICpub3Qgc3VwcG9ydGVkKjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdCI+QXQgdGhhdCBwb2ludCBpbiB0aGUgZmxvdyB0aGUgc2VydmVy IGlzIG5vdCBhbGxvd2VkIHRvIHNlbmQgYW5vdGhlciBIZWxsb1JldHJ5UmVxdWVzdC4mbmJzcDsg VG8gYXZvaWQgdGhhdCB0aGUgY2xpZW50IHdvdWxkIG5lZWQgc29tZSBoaW50cyBpbiB0aGUgSGVs bG9SZXRyeVJlcXVlc3QuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPldvdWxkIGl0IGJlIHBvc3NpYmxlIHRv IGFsbG93IGFuIGV4Y2VwdGlvbiB0byBzZW5kIGtleV9zaGFyZSBhbmQvb3Igc3VwcG9ydGVkX2dy b3VwcyBpbiBhIEhlbGxvUmV0cnlSZXF1ZXN0IGlmIG5vdCBvZmZlcmVkIGluIENsaWVudEhlbGxv PzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+Um9lbG9mIGR1IFRv aXQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_B6B302EF68364E50B916D9260C16D25Bsymanteccom_-- From nobody Tue Mar 7 09:49:29 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 424CC1295FB for ; Tue, 7 Mar 2017 09:49:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9WYyyOOTVcmO for ; Tue, 7 Mar 2017 09:49:25 -0800 (PST) Received: from mail-ot0-x229.google.com (mail-ot0-x229.google.com [IPv6:2607:f8b0:4003:c0f::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 997341295ED for ; Tue, 7 Mar 2017 09:49:25 -0800 (PST) Received: by mail-ot0-x229.google.com with SMTP id o24so11053455otb.1 for ; Tue, 07 Mar 2017 09:49:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=LJoKQ3GJ1A3LtfS4+NKebG6oyauM5+m0/GOfRBlU9AM=; b=QOrK8l1oSFrn9MKj6WdMvxRQJgo6oOMPp5PsN4MnYDPYy4NSJBSk785zFuJi2gcemr W94cYiMcmXQmY0u8NMz4MINzh60x+BJ0GKdpr+x0+COXVrs6ivNj7oYwDDz5w45ftAwS G5S39L5Nf7MYR/EL+4kdpZt+pY0Xzyij9NNM2LUyIpXIZRprIW07m12KqWDmtvXEEdol D9Ddxj11DhrHedMBJgWy5Xr+zem8q8aAANG5woM7a6GQEAewhju+KQ8ryaU+pBmbYGBo 4zddyEx+yvNWlGNxdU7cneNNbYTD4Y6Om1EX5Layfvva8Iesgzs4bHXiLj0Z8U75APjg VKtQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=LJoKQ3GJ1A3LtfS4+NKebG6oyauM5+m0/GOfRBlU9AM=; b=Jlg+K8WOmZi+OZYSaxHxZZkN4vRFckUnrLGchszrNcjSmmA0BH17uvg0r+1X9fKFVD u2SCzWHL9fIzj8mtm83voZDr3YY6M6Le5Y26JkGDNsHDMUR9UioEWZEvEHO705SLd2tu Bv+q4EDRBetnglJqboOf+Lj+5AFhUuBa9HehV6ehbuGniRHSxDb/Kb5AgpZDfBqDK6rn SUZoG3SE1hwQMgNs5CoVHe3W8iFntcmY4bErdAF1wT1OU1isD/pcU2Sj9yEQZ9UGRL/X qPG6V2YGRRBq42EPwChefCxozi2B0Cisf9V+W/Qu1iGWIfshUYtEYRHR2Vxx56FXmTw7 1eOg== X-Gm-Message-State: AMke39mfC6z/SOH/MsMk2HX3k5F3oBiHQKlTw8akkYhDxgMJeXmz13+el6BqInxGAMlRpcyhYehv/nFFzce52A== X-Received: by 10.129.108.214 with SMTP id h205mr490920ywc.71.1488908965008; Tue, 07 Mar 2017 09:49:25 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Tue, 7 Mar 2017 09:48:44 -0800 (PST) In-Reply-To: References: From: Eric Rescorla Date: Tue, 7 Mar 2017 09:48:44 -0800 Message-ID: To: Roelof Du Toit Content-Type: multipart/alternative; boundary=001a114e81dcf6b37b054a27a1cb Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Allow KeyShare in HelloRetry if not advertised in ClientHello? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 17:49:27 -0000 --001a114e81dcf6b37b054a27a1cb Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Mar 7, 2017 at 9:44 AM, Roelof Du Toit wrote: > All, > > > > The current language in https://tlswg.github.io/tls13- > spec/#rfc.section.4.1.4 states: > > As with ServerHello, a HelloRetryRequest MUST NOT contain any extensions > that were not first offered by the client in its ClientHello, with the > exception of optionally the =E2=80=9Ccookie=E2=80=9D (see Section 4.2.2 > ) extension. > > > > I am analyzing the following message flow: > > ClientHello > > + early_data > > + psk_key_exchange_modes =3D psk_ke > > + pre_shared_key ---------> > > (Early Data) ---------> *reject* > > <--------- HelloRetryRequest (not allowed to add key_share) > > ClientHello > > + supported_groups > > + key_share ---------> *not supported* > > > > At that point in the flow the server is not allowed to send another > HelloRetryRequest. To avoid that the client would need some hints in the > HelloRetryRequest. > > Would it be possible to allow an exception to send key_share and/or > supported_groups in a HelloRetryRequest if not offered in ClientHello? > I would prefer not. If the client is willing to do DH, it should offer KeyShare in its initial ClientHello. -Ekr > > Roelof du Toit > > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > --001a114e81dcf6b37b054a27a1cb Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Tue, Mar 7, 2017 at 9:44 AM, Roelof Du Toit <Roelof_Dutoit= @symantec.com> wrote:

All,<= /span>

=C2=A0

The current languag= e in https://tlswg.github.io/tls13-spec/#rfc.section.4.1.4 states:

As with ServerHello= , a HelloRetryRequest MUST NOT contain any extensions that were not first o= ffered by the client in its ClientHello, with the exception of optionally t= he =E2=80=9Ccookie=E2=80=9D (see=C2=A0Section 4.2.2) extension.

=C2=A0

I am analyzing the = following message flow:

ClientHello

+ early_data

+ psk_key_exchange_modes =3D psk_ke

+ pre_shared_key --------->

(Early Data) ---------> *reject*

<--------- HelloRetryRequest (not allowed to add key_sh= are)

ClientHello

+ supported_groups

+ key_share ---------> *not supported*

=C2=A0

At that point in th= e flow the server is not allowed to send another HelloRetryRequest.=C2=A0 T= o avoid that the client would need some hints in the HelloRetryRequest.<= /u>

Would it be possibl= e to allow an exception to send key_share and/or supported_groups in a Hell= oRetryRequest if not offered in ClientHello?


I would prefer not. If the client is willing to do= DH, it should offer KeyShare in its initial ClientHello.

-Ekr

<= /u>

=C2=A0

Roelof du Toit

=C2=A0


_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--001a114e81dcf6b37b054a27a1cb-- From nobody Tue Mar 7 10:05:43 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 171001294B1 for ; Tue, 7 Mar 2017 10:05:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y-Xu3E5Drd_7 for ; Tue, 7 Mar 2017 10:05:40 -0800 (PST) Received: from mail-pf0-x235.google.com (mail-pf0-x235.google.com [IPv6:2607:f8b0:400e:c00::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A1B28129494 for ; Tue, 7 Mar 2017 10:05:40 -0800 (PST) Received: by mail-pf0-x235.google.com with SMTP id w189so3488864pfb.0 for ; Tue, 07 Mar 2017 10:05:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=1TsFiIyE0p1YBQsid1QKZA+917t+zkxEMKNtEHXb9r0=; b=d2l2PCUaxmc1Iup8+uvL0bANnkEDvThd50grgVymktxO7J0mRfZ6OZ9GN+5nIMI9wQ 0xCr1ZNTod+AoP9L6/LzYOT2LxeGRlv65gcSoinmst4lrXZ4FenfhykilKMzr+y4/COe Ju1vS8TzMq9M82MAroNeCuQSZ0C/6NBPZ/vLo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=1TsFiIyE0p1YBQsid1QKZA+917t+zkxEMKNtEHXb9r0=; b=mAbMMejuzCsDFRsW5V9Iv+/irn1//vC20nn6VlpeYKKqFseAPJgW6sD44hnjc+CoN0 feVZgX7Ws8uj7Gnne+bqM/NI+1KcJsyIQg2QzV1E+TZRmjE24f4V7CTXyngHHOpfeDIv C0fpAMtq4wtJKExFFPTVxSpc6mrvvnxnbm0NK16dlU0Roj5pWIaYp8gfrXTywIjxJaaI nzLBAkPUQWc/t3k8I12BfsJEcJ5F0r9zc+KLDt4KuXPvVxZIeKwSNjLTBTue32XUfo2s iC5asN+v5fHpuwhIOOStbz/KOIGM/wf7T98LtUlAzBtramyzzI2Kz9vl8kO5hR3v7usP USJw== X-Gm-Message-State: AMke39nvhtOeu0b+H7B3hibZ26qTLosYiOxXK/UdqhvmOrpEROHcPRHK8mJkYmAt4u0TqqVllMWs2SCtDW7f4ADD X-Received: by 10.84.234.8 with SMTP id m8mr2213496plk.25.1488909939995; Tue, 07 Mar 2017 10:05:39 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: David Benjamin Date: Tue, 07 Mar 2017 18:05:29 +0000 Message-ID: To: Eric Rescorla , Roelof Du Toit Content-Type: multipart/alternative; boundary=f4030436081013c4a5054a27dc5b Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Allow KeyShare in HelloRetry if not advertised in ClientHello? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 18:05:42 -0000 --f4030436081013c4a5054a27dc5b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Mar 7, 2017 at 12:49 PM Eric Rescorla wrote: > On Tue, Mar 7, 2017 at 9:44 AM, Roelof Du Toit > wrote: > > All, > > > > The current language in > https://tlswg.github.io/tls13-spec/#rfc.section.4.1.4 states: > > As with ServerHello, a HelloRetryRequest MUST NOT contain any extensions > that were not first offered by the client in its ClientHello, with the > exception of optionally the =E2=80=9Ccookie=E2=80=9D (see Section 4.2.2 > ) extension. > > > > I am analyzing the following message flow: > > ClientHello > > + early_data > > + psk_key_exchange_modes =3D psk_ke > > + pre_shared_key ---------> > > (Early Data) ---------> *reject* > > <--------- HelloRetryRequest (not allowed to add key_share) > > ClientHello > > + supported_groups > > + key_share ---------> *not supported* > > > > At that point in the flow the server is not allowed to send another > HelloRetryRequest. To avoid that the client would need some hints in the > HelloRetryRequest. > > Would it be possible to allow an exception to send key_share and/or > supported_groups in a HelloRetryRequest if not offered in ClientHello? > > > I would prefer not. If the client is willing to do DH, it should offer > KeyShare in its initial ClientHello. > In particular, per 4.2.5: "Clients MAY send an empty client_shares vector in order to request group selection from the server at the cost of an additional round trip." David --f4030436081013c4a5054a27dc5b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On Tue, Mar 7,= 2017 at 12:49 PM Eric Rescorla <ekr@rtf= m.com> wrote:
On Tue, Mar 7, 2017 at 9:44 AM, Roelof Du Toit <Roelof_Dutoit@symantec.com= > wrote:

All,

=C2=A0

The current language in https://tlswg.github.io/tls13-spec/#rfc.section.4.1.4 states:

As with ServerHello, a HelloRetryRequest MUST NOT contain any ex= tensions that were not first offered by the client in its ClientHello, with= the exception of optionally the =E2=80=9Ccookie=E2=80=9D (see=C2=A0Section 4.2.2) extension.

=C2=A0

I am analyzing the following message flow:

ClientHello

+ early_data

+ psk_key_exchange_modes =3D= psk_ke

+ pre_shared_key ---------&g= t;

(Early Data) ---------> *= reject*

<--------- HelloRetryRequ= est (not allowed to add key_share)

ClientHello

+ supported_groups

+ key_share ---------> *n= ot supported*<= /p>

=C2=A0

At that point in the flow the server is not allowed to send anot= her HelloRetryRequest.=C2=A0 To avoid that the client would need some hints= in the HelloRetryRequest.

Would it be possible to allow an exception to send key_share and= /or supported_groups in a HelloRetryRequest if not offered in ClientHello?<= /span>


I would prefer not. If the client is willing to do DH, i= t should offer KeyShare in its initial ClientHello.
=

=C2=A0In particular, per 4.2.5:
=
"Clients MAY send an empty client_shares vector in orde= r to request group selection from the server at the cost of an additional r= ound trip."

David
--f4030436081013c4a5054a27dc5b-- From nobody Tue Mar 7 11:35:29 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 93CCA12948F for ; Tue, 7 Mar 2017 11:35:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CMO1LazcVD3L for ; Tue, 7 Mar 2017 11:35:25 -0800 (PST) Received: from tussmtoutape01.symantec.com (Tussmtoutape01.symantec.com [155.64.38.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9E56A12943D for ; Tue, 7 Mar 2017 11:35:25 -0800 (PST) Received: from tussmtmtaapi01.symc.symantec.com (tus3-f5-symc-ext-prd-snat9.net.symantec.com [10.44.130.9]) by tussmtoutape01.symantec.com (Symantec Messaging Gateway) with SMTP id AF.12.30096.D7B0FB85; Tue, 7 Mar 2017 19:35:25 +0000 (GMT) X-AuditID: 0a2c7e31-bbf679a000007590-c7-58bf0b7dd664 Received: from TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (tus3-f5-symc-ext-prd-snat9.net.symantec.com [10.44.130.9]) by tussmtmtaapi01.symc.symantec.com (Symantec Messaging Gateway) with SMTP id F0.90.61790.C7B0FB85; Tue, 7 Mar 2017 19:35:24 +0000 (GMT) Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) by TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (10.44.91.33) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Tue, 7 Mar 2017 11:35:24 -0800 Received: from NAM02-CY1-obe.outbound.protection.outlook.com (10.44.128.1) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Tue, 7 Mar 2017 11:35:23 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=VUxWjjjJqjbM6OAZz1q3WbKclrEA8rdYppavk59809M=; b=PyHjW8I8Mb5TQb1WgClIWxbNI42Noa5ic3VEMHVTNkeT2l1QOgsi2omHd1Bf/61pg/dUsfk4CDmUsPSwqc0lVryhBGIVzXTRmG3gAAvAh+ClBFOHoGG6Vo9GQkzj11H9wZHXL4WcjNWEOlh56+O0gfLsBUzTLEz8yzTjEED358c= Received: from DM5PR16MB1834.namprd16.prod.outlook.com (10.172.45.9) by DM5PR16MB1836.namprd16.prod.outlook.com (10.172.45.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.12; Tue, 7 Mar 2017 19:35:22 +0000 Received: from DM5PR16MB1834.namprd16.prod.outlook.com ([10.172.45.9]) by DM5PR16MB1834.namprd16.prod.outlook.com ([10.172.45.9]) with mapi id 15.01.0947.020; Tue, 7 Mar 2017 19:35:22 +0000 From: Roelof Du Toit To: David Benjamin , Eric Rescorla Thread-Topic: [TLS] Allow KeyShare in HelloRetry if not advertised in ClientHello? Thread-Index: AQHSl2p+vyKS4/mfNkq7sGwa67WGLaGJp0sAgAAEroD//8VQAA== Date: Tue, 7 Mar 2017 19:35:22 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: chromium.org; dkim=none (message not signed) header.d=none;chromium.org; dmarc=none action=none header.from=symantec.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [72.23.5.194] x-microsoft-exchange-diagnostics: 1; DM5PR16MB1836; 7:/m9MpC5YGACqLszkazIypT8/EyAweQbaw6sb0C0LXNUMed1ffJw/9wQDjGfVVEGaGDviZytydYt89x8ExOXRsjIf/um2MOVniV3VLCfi1N9DI1389RtHVEULG/OquQqiBWze3RI7a4RiImvLBkLuLryOYjtzSz8gNTwRgHkDeBp+lhFy2TDwAagimrzsLIGJ97TA2USr5nvXbYVB2EFAb9K+fL9Hgxq9T1++xXjF8Klxa6z69N4sHhItootWFmOVLlVsc2Zw7qaSwig2z/V/ylDSbPxqQq1mOM9fVaXhwPj8KgCavdaZHDOQv3NPJxPVO+IJfOfwC7smRVRIPgt1KA== x-forefront-antispam-report: SFV:SKI; SCL:-1SFV:NSPM; SFS:(10009020)(39450400003)(24454002)(377454003)(3280700002)(80792005)(2906002)(76176999)(189998001)(106116001)(33656002)(54356999)(83716003)(50986999)(2900100001)(66066001)(38730400002)(102836003)(4326008)(53936002)(2950100002)(7906003)(5660300001)(7736002)(6116002)(122556002)(53546006)(10290500002)(3846002)(6246003)(6512007)(3660700001)(6306002)(6506006)(54896002)(25786008)(8936002)(236005)(99286003)(229853002)(86362001)(6436002)(82746002)(36756003)(606005)(77096006)(8676002)(6486002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR16MB1836; H:DM5PR16MB1834.namprd16.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; x-ms-office365-filtering-correlation-id: 24dda46d-a1e1-4545-c57e-08d465911890 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:DM5PR16MB1836; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6041248)(20161123555025)(20161123562025)(20161123564025)(20161123560025)(20161123558025)(6072148); SRVR:DM5PR16MB1836; BCL:0; PCL:0; RULEID:; SRVR:DM5PR16MB1836; x-forefront-prvs: 0239D46DB6 spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_D06DC120231A43499C6951FAB0B1C77Esymanteccom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Mar 2017 19:35:22.1324 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR16MB1836 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrDKsWRmVeSWpSXmKPExsXCpdPEqVvLvT/CYNFKNovdX00tVrw+x27x 6XwXowOzx+yGiyweS5b8ZPKY/LiNOYA5issmJTUnsyy1SN8ugSujae0iloJPyxkrdj1dx97A uHkxYxcjJ4eEgInExcsPmbsYuTiEBD4xSmw+/4cZJrFi5ycmiMR3RonZN69DOYcZJeZ8XATV 8pxR4tCGrYwgDotAJ7PEtw2PocomMUk8OvuVEcI5yCjxr3ENK8hkNgFDiZ8HJoHZIgIeEl82 rGIDsZkFFCXeX5rHAmILCwRLrPw7gRGiJkTi85aVQDUcQLaTxP+zWiBhFgEViXUX7oKN4RWw l9jbfIUFYtdZRoknOz+CzeQUCJR4+H8LO4jNKCAm8f3UGiaIXeISt57MZ4L4VEBiyZ7zUF+L Srx8/I8VZBCjwGRGiXP/V0DDSUfi7PUnULa8xP2np6HsHmaJ1dM5QRokBCaxSpyefAtqkq/E jpYzbDD2xWUHmUA+kBDIlpjaHgkR9pbYfuo6ywRGvVlIboKwkyVOfjzLMgvsOUGJkzOfANkc QHFNifW79GdBg2tK90N2CFtDonXOXCjbQ+Lj4iNsyGoWMHKsYlQoKS0uzi3JLy1JLEg1MNQr rsxNBhGJwBSWrJecn7uJEZzG6gx3MD7a4HOIUYCDUYmHd8mvfRFCrIllQJWHGCU4mJVEeF+z 7o8Q4k1JrKxKLcqPLyrNSS0+xCjNwaIkznv+2doIIYH0xJLU7NTUgtQimCwTB6dUA6ProzdS 9p0X2Kqb/92WY1M3jNwzf56NPfdbvZXK7gqTeM2YZM06nCPLzJ/JGZmW2hk/DNp2S0ZmmdRu j+uGaY9VE7YZTA3envK5b33B5q37Dt+csn2Z0tkVL7taz52cMs1YovRkwTlL0xIvw4oZShz8 3S//JJXLq8qKm807/CT46uIYnyPWOkosxRmJhlrMRcWJAIqSS/pfAwAA X-Brightmail-Tracker: H4sIAAAAAAAAA02Se0hTcRTH+d17t92tBr+W6cECUwxKlu9CLEp60KCiJzIjyLUuKTqTbYpC mJkZPghxRjltiYo6s7V8oPNVLs3UphmZtRhiKiFCMR+JUdru7gL/+fE5h+/5nt85HJqUmHm+ dGKKllGnKJID+CJKJM0R7r256aU89PNSdFTn8r6o+vkRQdTCaAGKIWXl2WOUrKZmlZDppvPI s+Ql0cFrTHJiOqMOORQvSsh5VkWlLtShjI5ZkyAbNVejAiSkAUdCvWWBKEAiWoJXEJR/mfAE rxFUOKtILviOwGpuRWxA4XwSfpmnPbISAr7ZlhEX9CJYu93IY535OAxWX5W42QvLYMncwGeZ xP7w84OBYnkrvgDGv8WI01yExRajS0O7+Ais24LYNIUDwfTe4bYR48PQfecjxfWyIZixON2e QnwOptZbBCwj7A0rQ40E18sH7DNPCG5SDDVdoyTH22Bueo3HGiGsQzCyXu9ZhxRsEzMe9oPJ 2WEPF5Hw9KGQLQBcwoNhnd3jdBrac9/x//NYbS/BTgA4CR7ci+PSJ6FtaILiavUEmFaaEafZ AZbViGIUpN/wV46VMOi0UXr30FtgsGzGxbQrvweed4ToPWssLZwScLwb7lY89rAMnNV9/I2a SkQ3oJ3aNI1GpVVpFYrUxNCwYE2mSsk+CteBKYOVN1RNyH1iR6Ed9fw5ZUWYRgGbxTJbj1zC U6S7lFa0naYCfMSLYU1yCb6u0DJJDJPKqK+o05IZjRURtNA3GxlyDaNe+40xTHhdtF+b5YS0 Nvb8sDXuWOUif7Jz7mpm/Lx9fImg5a3Kcatcn0XMCc7ElEWV0n2BvNwusTxH0m34PdtdXhY3 eMC7N6/qxdfetoq3xx/lR9gH+n9IdQO2jE+xbywGR+At0/1dtUZHeEjyZeSfZi/sn4os2uLI CqA0CYqwIFKtUfwDydIk4kMDAAA= X-CFilter-Loop: TUS04 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Allow KeyShare in HelloRetry if not advertised in ClientHello? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 19:35:27 -0000 --_000_D06DC120231A43499C6951FAB0B1C77Esymanteccom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmsgeW91Lg0KDQpUaGUgZm9sbG93aW5nIHRleHQgaW4gNC4yLjcgcHJvbXB0ZWQgbXkgc2Nl bmFyaW86DQoiIg0KQSBzZXJ2ZXIgd2hpY2ggcmVjZWl2ZXMgYW4g4oCcZWFybHlfZGF0YeKAnSBl eHRlbnNpb24gTVVTVCBiZWhhdmUgaW4gb25lIG9mIHRocmVlIHdheXM6Ig0KLi4NCi0gUmVxdWVz dCB0aGF0IHRoZSBjbGllbnQgc2VuZCBhbm90aGVyIENsaWVudEhlbGxvIGJ5IHJlc3BvbmRpbmcg d2l0aCBhIEhlbGxvUmV0cnlSZXF1ZXN0LiBBIGNsaWVudCBNVVNUIE5PVCBpbmNsdWRlIHRoZSDi gJxlYXJseV9kYXRh4oCdIGV4dGVuc2lvbiBpbiBpdHMgZm9sbG93dXAgQ2xpZW50SGVsbG8uDQoi Ig0KDQpNeSBjb25jbHVzaW9uIGZyb20geW91ciByZXBsaWVzIGlzIHRoYXQgdGhlIGJ1cmRlbiBp cyBvbiB0aGUgY2xpZW50IHRvIGF2b2lkIHRoZSBzY2VuYXJpbyBieSBpbmNsdWRpbmcgYW4gZW1w dHkga2V5X3NoYXJlICh3aXRoIGNvcnJlc3BvbmRpbmcgc2lnYWxncyBhbmQgc3VwcG9ydGVkX2dy b3Vwcykgd2hlbiBzZW5kaW5nIGVhcmx5X2RhdGEgd2l0aCBwc2tfa2UgbW9kZSAodnMgcHNrX2Ro ZV9rZSkuICBJdCBtaWdodCBiZSB3b3J0aCB3YXJuaW5nIGltcGxlbWVudGVycyBhYm91dCB0aGF0 IGluIHRoZSBzcGVjLg0KDQotLVJvZWxvZg0KDQpGcm9tOiBEYXZpZCBCZW5qYW1pbiA8ZGF2aWRi ZW5AY2hyb21pdW0ub3JnPg0KRGF0ZTogVHVlc2RheSwgTWFyY2ggNywgMjAxNyBhdCAxOjA1IFBN DQpUbzogRXJpYyBSZXNjb3JsYSA8ZWtyQHJ0Zm0uY29tPiwgUm9lbG9mIER1IFRvaXQgPFJvZWxv Zl9EdXRvaXRAc3ltYW50ZWMuY29tPg0KQ2M6ICJ0bHNAaWV0Zi5vcmciIDx0bHNAaWV0Zi5vcmc+ DQpTdWJqZWN0OiBSZTogW1RMU10gQWxsb3cgS2V5U2hhcmUgaW4gSGVsbG9SZXRyeSBpZiBub3Qg YWR2ZXJ0aXNlZCBpbiBDbGllbnRIZWxsbz8NCg0KT24gVHVlLCBNYXIgNywgMjAxNyBhdCAxMjo0 OSBQTSBFcmljIFJlc2NvcmxhIDxla3JAcnRmbS5jb208bWFpbHRvOmVrckBydGZtLmNvbT4+IHdy b3RlOg0KT24gVHVlLCBNYXIgNywgMjAxNyBhdCA5OjQ0IEFNLCBSb2Vsb2YgRHUgVG9pdCA8Um9l bG9mX0R1dG9pdEBzeW1hbnRlYy5jb208bWFpbHRvOlJvZWxvZl9EdXRvaXRAc3ltYW50ZWMuY29t Pj4gd3JvdGU6DQpBbGwsDQoNClRoZSBjdXJyZW50IGxhbmd1YWdlIGluIGh0dHBzOi8vdGxzd2cu Z2l0aHViLmlvL3RsczEzLXNwZWMvI3JmYy5zZWN0aW9uLjQuMS40IHN0YXRlczoNCkFzIHdpdGgg U2VydmVySGVsbG8sIGEgSGVsbG9SZXRyeVJlcXVlc3QgTVVTVCBOT1QgY29udGFpbiBhbnkgZXh0 ZW5zaW9ucyB0aGF0IHdlcmUgbm90IGZpcnN0IG9mZmVyZWQgYnkgdGhlIGNsaWVudCBpbiBpdHMg Q2xpZW50SGVsbG8sIHdpdGggdGhlIGV4Y2VwdGlvbiBvZiBvcHRpb25hbGx5IHRoZSDigJxjb29r aWXigJ0gKHNlZSBTZWN0aW9uIDQuMi4yPGh0dHBzOi8vdGxzd2cuZ2l0aHViLmlvL3RsczEzLXNw ZWMvI2Nvb2tpZT4pIGV4dGVuc2lvbi4NCg0KSSBhbSBhbmFseXppbmcgdGhlIGZvbGxvd2luZyBt ZXNzYWdlIGZsb3c6DQpDbGllbnRIZWxsbw0KKyBlYXJseV9kYXRhDQorIHBza19rZXlfZXhjaGFu Z2VfbW9kZXMgPSBwc2tfa2UNCisgcHJlX3NoYXJlZF9rZXkgLS0tLS0tLS0tPg0KKEVhcmx5IERh dGEpIC0tLS0tLS0tLT4gKnJlamVjdCoNCjwtLS0tLS0tLS0gSGVsbG9SZXRyeVJlcXVlc3QgKG5v dCBhbGxvd2VkIHRvIGFkZCBrZXlfc2hhcmUpDQpDbGllbnRIZWxsbw0KKyBzdXBwb3J0ZWRfZ3Jv dXBzDQorIGtleV9zaGFyZSAtLS0tLS0tLS0+ICpub3Qgc3VwcG9ydGVkKg0KDQpBdCB0aGF0IHBv aW50IGluIHRoZSBmbG93IHRoZSBzZXJ2ZXIgaXMgbm90IGFsbG93ZWQgdG8gc2VuZCBhbm90aGVy IEhlbGxvUmV0cnlSZXF1ZXN0LiAgVG8gYXZvaWQgdGhhdCB0aGUgY2xpZW50IHdvdWxkIG5lZWQg c29tZSBoaW50cyBpbiB0aGUgSGVsbG9SZXRyeVJlcXVlc3QuDQpXb3VsZCBpdCBiZSBwb3NzaWJs ZSB0byBhbGxvdyBhbiBleGNlcHRpb24gdG8gc2VuZCBrZXlfc2hhcmUgYW5kL29yIHN1cHBvcnRl ZF9ncm91cHMgaW4gYSBIZWxsb1JldHJ5UmVxdWVzdCBpZiBub3Qgb2ZmZXJlZCBpbiBDbGllbnRI ZWxsbz8NCg0KSSB3b3VsZCBwcmVmZXIgbm90LiBJZiB0aGUgY2xpZW50IGlzIHdpbGxpbmcgdG8g ZG8gREgsIGl0IHNob3VsZCBvZmZlciBLZXlTaGFyZSBpbiBpdHMgaW5pdGlhbCBDbGllbnRIZWxs by4NCg0KIEluIHBhcnRpY3VsYXIsIHBlciA0LjIuNToNCg0KIkNsaWVudHMgTUFZIHNlbmQgYW4g ZW1wdHkgY2xpZW50X3NoYXJlcyB2ZWN0b3IgaW4gb3JkZXIgdG8gcmVxdWVzdCBncm91cCBzZWxl Y3Rpb24gZnJvbSB0aGUgc2VydmVyIGF0IHRoZSBjb3N0IG9mIGFuIGFkZGl0aW9uYWwgcm91bmQg dHJpcC4iDQoNCkRhdmlkDQo= --_000_D06DC120231A43499C6951FAB0B1C77Esymanteccom_ Content-Type: text/html; charset="utf-8" Content-ID: <4212A7DCE452A24BAD58D814201D8B14@namprd16.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCglwYW5vc2UtMToyIDcg MyA5IDIgMiA1IDIgNCA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6V2luZ2RpbmdzOw0K CXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250 LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAz IDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1h bCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsN Cglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCmE6 bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9y OmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNv SHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBs ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnNwYW4uZ21haWxtc2cNCgl7bXNvLXN0 eWxlLW5hbWU6Z21haWxfbXNnO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBl OnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJY29sb3I6d2luZG93dGV4 dDt9DQpzcGFuLm1zb0lucw0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCgltc28tc3R5 bGUtbmFtZToiIjsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lOw0KCWNvbG9yOnRlYWw7fQ0K Lk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXpl OjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFy Z2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpX b3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxp c3QtaWQ6MTI1ODE3Njk4NDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MTYzNDUzMjUyMDt9DQpA bGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6LjVpbjsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCW1zby1hbnNpLWZvbnQt c2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsMg0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6MS4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDb3VyaWVyIE5ldyI7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBS b21hbiI7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNv LWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3Qg bDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIuMGluOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXpl OjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOjIuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250 LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9w OjMuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGlu Z3M7fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuNWluOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFu c2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6 bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOjQuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZh bWlseTpXaW5nZGluZ3M7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2lu LWJvdHRvbTowaW47fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5IGJnY29sb3I9IndoaXRl IiBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJX b3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+VGhhbmsgeW91LjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OkNhbGlicmkiPlRoZSBmb2xsb3dpbmcgdGV4dCBpbiA0LjIuNyBwcm9tcHRlZCBteSBzY2VuYXJp bzo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4mcXVvdDsmcXVvdDs8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj5BIHNlcnZlciB3aGljaCByZWNlaXZl cyBhbiDigJxlYXJseV9kYXRh4oCdIGV4dGVuc2lvbiBNVVNUIGJlaGF2ZSBpbiBvbmUgb2YgdGhy ZWUgd2F5czomcXVvdDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj4uLjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPi0gUmVxdWVzdCB0aGF0IHRoZSBj bGllbnQgc2VuZCBhbm90aGVyIENsaWVudEhlbGxvIGJ5IHJlc3BvbmRpbmcgd2l0aCBhIEhlbGxv UmV0cnlSZXF1ZXN0LiBBIGNsaWVudCBNVVNUIE5PVCBpbmNsdWRlIHRoZSDigJxlYXJseV9kYXRh 4oCdIGV4dGVuc2lvbiBpbiBpdHMgZm9sbG93dXAgQ2xpZW50SGVsbG8uPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+JnF1b3Q7JnF1b3Q7PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2Fs aWJyaSI+TXkgY29uY2x1c2lvbiBmcm9tIHlvdXIgcmVwbGllcyBpcyB0aGF0IHRoZSBidXJkZW4g aXMgb24gdGhlIGNsaWVudCB0byBhdm9pZCB0aGUgc2NlbmFyaW8gYnkgaW5jbHVkaW5nIGFuIGVt cHR5IGtleV9zaGFyZSAod2l0aCBjb3JyZXNwb25kaW5nIHNpZ2FsZ3MgYW5kIHN1cHBvcnRlZF9n cm91cHMpIHdoZW4gc2VuZGluZw0KIGVhcmx5X2RhdGEgd2l0aCBwc2tfa2UgbW9kZSAodnMgcHNr X2RoZV9rZSkuJm5ic3A7IEl0IG1pZ2h0IGJlIHdvcnRoIHdhcm5pbmcgaW1wbGVtZW50ZXJzIGFi b3V0IHRoYXQgaW4gdGhlIHNwZWMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJy aSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+LS1Sb2Vsb2Y8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxpYnJpIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0 REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNh bGlicmk7Y29sb3I6YmxhY2siPkZyb206DQo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj5EYXZpZCBCZW5qYW1pbiAmbHQ7ZGF2aWRiZW5AY2hy b21pdW0ub3JnJmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5UdWVzZGF5LCBNYXJjaCA3LCAyMDE3IGF0 IDE6MDUgUE08YnI+DQo8Yj5UbzogPC9iPkVyaWMgUmVzY29ybGEgJmx0O2VrckBydGZtLmNvbSZn dDssIFJvZWxvZiBEdSBUb2l0ICZsdDtSb2Vsb2ZfRHV0b2l0QHN5bWFudGVjLmNvbSZndDs8YnI+ DQo8Yj5DYzogPC9iPiZxdW90O3Rsc0BpZXRmLm9yZyZxdW90OyAmbHQ7dGxzQGlldGYub3JnJmd0 Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5SZTogW1RMU10gQWxsb3cgS2V5U2hhcmUgaW4gSGVsbG9S ZXRyeSBpZiBub3QgYWR2ZXJ0aXNlZCBpbiBDbGllbnRIZWxsbz88bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5PbiBUdWUs IE1hciA3LCAyMDE3IGF0IDEyOjQ5IFBNIEVyaWMgUmVzY29ybGEgJmx0OzxhIGhyZWY9Im1haWx0 bzpla3JAcnRmbS5jb20iPmVrckBydGZtLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29s aWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQu OHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPk9uIFR1ZSwgTWFyIDcsIDIwMTcgYXQg OTo0NCBBTSwgUm9lbG9mIER1IFRvaXQNCjxzcGFuIGNsYXNzPSJnbWFpbG1zZyI+Jmx0OzxhIGhy ZWY9Im1haWx0bzpSb2Vsb2ZfRHV0b2l0QHN5bWFudGVjLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPlJv ZWxvZl9EdXRvaXRAc3ltYW50ZWMuY29tPC9hPiZndDs8L3NwYW4+IHdyb3RlOjxvOnA+PC9vOnA+ PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICND Q0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDtt YXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gY2xhc3M9ImdtYWlsbXNnIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdCI+QWxsLDwvc3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBjbGFzcz0iZ21haWxtc2ci PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij4mbmJzcDs8L3NwYW4+PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNw YW4gY2xhc3M9ImdtYWlsbXNnIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+VGhlIGN1 cnJlbnQgbGFuZ3VhZ2UgaW4gPGEgaHJlZj0iaHR0cHM6Ly90bHN3Zy5naXRodWIuaW8vdGxzMTMt c3BlYy8jcmZjLnNlY3Rpb24uNC4xLjQiIHRhcmdldD0iX2JsYW5rIj4NCmh0dHBzOi8vdGxzd2cu Z2l0aHViLmlvL3RsczEzLXNwZWMvI3JmYy5zZWN0aW9uLjQuMS40PC9hPiBzdGF0ZXM6PC9zcGFu Pjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDouNWluIj4NCjxzcGFuIGNsYXNzPSJnbWFpbG1zZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQiPkFzIHdpdGggU2VydmVySGVsbG8sIGEgSGVsbG9SZXRyeVJlcXVlc3QgTVVTVCBOT1Qg Y29udGFpbiBhbnkgZXh0ZW5zaW9ucyB0aGF0IHdlcmUgbm90IGZpcnN0IG9mZmVyZWQgYnkgdGhl IGNsaWVudCBpbiBpdHMgQ2xpZW50SGVsbG8sIHdpdGggdGhlIGV4Y2VwdGlvbiBvZiBvcHRpb25h bGx5IHRoZSDigJxjb29raWXigJ0gKHNlZSZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vdGxzd2cuZ2l0 aHViLmlvL3RsczEzLXNwZWMvI2Nvb2tpZSIgdGFyZ2V0PSJfYmxhbmsiPlNlY3Rpb24NCiA0LjIu MjwvYT4pIGV4dGVuc2lvbi48L3NwYW4+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gY2xhc3M9ImdtYWlsbXNnIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxzcGFu IGNsYXNzPSJnbWFpbG1zZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkkgYW0gYW5h bHl6aW5nIHRoZSBmb2xsb3dpbmcgbWVzc2FnZSBmbG93Ojwvc3Bhbj48L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBj bGFzcz0iZ21haWxtc2ciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5DbGllbnRIZWxsbzwvc3Bhbj48L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3Bh biBjbGFzcz0iZ21haWxtc2ciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4mIzQzOyBlYXJseV9kYXRhPC9zcGFuPjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWlu Ij4NCjxzcGFuIGNsYXNzPSJnbWFpbG1zZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmllciBOZXcmcXVvdDsiPiYjNDM7IHBza19rZXlfZXhjaGFu Z2VfbW9kZXMgPSBwc2tfa2U8L3NwYW4+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gY2xhc3M9ImdtYWlsbXNnIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5l dyZxdW90OyI+JiM0MzsgcHJlX3NoYXJlZF9rZXkgLS0tLS0tLS0tJmd0Ozwvc3Bhbj48L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+ DQo8c3BhbiBjbGFzcz0iZ21haWxtc2ciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij4oRWFybHkgRGF0YSkgLS0tLS0tLS0t Jmd0OyAqcmVqZWN0Kjwvc3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBjbGFzcz0iZ21haWxtc2ciPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7Ij4mbHQ7LS0tLS0tLS0tIEhlbGxvUmV0cnlSZXF1ZXN0IChub3QgYWxsb3dlZCB0byBhZGQg a2V5X3NoYXJlKTwvc3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBjbGFzcz0iZ21haWxtc2ciPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7 Ij5DbGllbnRIZWxsbzwvc3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBjbGFzcz0iZ21haWxtc2ciPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1 b3Q7Ij4mIzQzOyBzdXBwb3J0ZWRfZ3JvdXBzPC9zcGFuPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxzcGFuIGNsYXNzPSJn bWFpbG1zZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q291cmllciBOZXcmcXVvdDsiPiYjNDM7IGtleV9zaGFyZSAtLS0tLS0tLS0mZ3Q7ICpub3Qgc3Vw cG9ydGVkKjwvc3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBjbGFzcz0iZ21haWxtc2ciPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0Ij4mbmJzcDs8L3NwYW4+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gY2xhc3M9Imdt YWlsbXNnIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+QXQgdGhhdCBwb2ludCBpbiB0 aGUgZmxvdyB0aGUgc2VydmVyIGlzIG5vdCBhbGxvd2VkIHRvIHNlbmQgYW5vdGhlciBIZWxsb1Jl dHJ5UmVxdWVzdC4mbmJzcDsgVG8gYXZvaWQgdGhhdCB0aGUgY2xpZW50IHdvdWxkIG5lZWQgc29t ZSBoaW50cyBpbiB0aGUgSGVsbG9SZXRyeVJlcXVlc3QuPC9zcGFuPjwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxzcGFuIGNs YXNzPSJnbWFpbG1zZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPldvdWxkIGl0IGJl IHBvc3NpYmxlIHRvIGFsbG93IGFuIGV4Y2VwdGlvbiB0byBzZW5kIGtleV9zaGFyZSBhbmQvb3Ig c3VwcG9ydGVkX2dyb3VwcyBpbiBhIEhlbGxvUmV0cnlSZXF1ZXN0IGlmIG5vdCBvZmZlcmVkIGlu IENsaWVudEhlbGxvPzwvc3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5JIHdvdWxkIHByZWZlciBub3QuIElmIHRoZSBj bGllbnQgaXMgd2lsbGluZyB0byBkbyBESCwgaXQgc2hvdWxkIG9mZmVyIEtleVNoYXJlIGluIGl0 cyBpbml0aWFsIENsaWVudEhlbGxvLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNw O0luIHBhcnRpY3VsYXIsIHBlciA0LjIuNTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4mcXVvdDtDbGllbnRzIE1BWSBzZW5kIGFuIGVtcHR5IGNsaWVudF9z aGFyZXMgdmVjdG9yIGluIG9yZGVyIHRvIHJlcXVlc3QgZ3JvdXAgc2VsZWN0aW9uIGZyb20gdGhl IHNlcnZlciBhdCB0aGUgY29zdCBvZiBhbiBhZGRpdGlvbmFsIHJvdW5kIHRyaXAuJnF1b3Q7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+RGF2aWQ8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1s Pg0K --_000_D06DC120231A43499C6951FAB0B1C77Esymanteccom_-- From nobody Tue Mar 7 11:51:00 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6D8812948D for ; Tue, 7 Mar 2017 11:50:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TOyNfb7v7AcG for ; Tue, 7 Mar 2017 11:50:57 -0800 (PST) Received: from mail-ot0-x22f.google.com (mail-ot0-x22f.google.com [IPv6:2607:f8b0:4003:c0f::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 13860129426 for ; Tue, 7 Mar 2017 11:50:57 -0800 (PST) Received: by mail-ot0-x22f.google.com with SMTP id o24so15233024otb.1 for ; Tue, 07 Mar 2017 11:50:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=QS1walGLVWqAyhiyXpnkPgzXILQybx+I9qHT0tZ3GU4=; b=KaQ0QazxSnh/T+NQXdswZRVAdtAmceeYyJ2dFW+utt1RgFbJZyyrZXXDxY6ymq2f4h Jx5iPGT1Ve30Ar7EYBmMnNUWx/dxFZM28XT44Wo8kRCIwFUkMlQw0/tkEto/1FZPxYe/ AhCaCefi/xCMDGiG3vp3J/cnTqsKMphdh7m4cB/GqaAFNogTGPHB2swjnQH8lDJ4tf9Y 3YRgUtHzCHJ1ZE29+Mz86v1J4Lo+mTPY45I40j08AnAekRMo/96Y2uC5DY3U16ZZB5R3 oX2QwLKck5Hh7WFPikUNcvNSPi4y94IiUpl0C83k4EM/aDp8R0kHssALqnytiTfEQKAV da3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=QS1walGLVWqAyhiyXpnkPgzXILQybx+I9qHT0tZ3GU4=; b=ZBCvjNEs7cFJ/y4a2rMBdxpUG2oqY8FpQFl/iylRXQ5gIO2St5PWa46sA02wn8qIkH 8CWXr9xmSzWXcBGqxrUlyHnYe9yK1gkFyv3gQ7Y02qkFJlx5pSl35b6f0S8psL5q1NRR 13z7hOQ0k92ln572T9rSUlwsLCgsbdEbwpgCZoS7HUa+AMcxwqSVOJCKN6DoSgf77wDI oG2+PJht/7n+ZuDiUDkDkN4whrP4jbxA0HUJ4KJGbnqpE4AEGzDR0XuNj0hwBRp76Idm tiq1d+JNSrU4zQcaRxwzWbShannMQ4GTSvLKIP6dFcgbOIDVa0e2x82NdMbaznNBAuPZ 8Cag== X-Gm-Message-State: AMke39lMBSOiLSLbn3FEBvIdnayk8QNYLcK+zOKYyjpR/W1XBM6gqiGiP10Oga/j8UjAMkMIJpEimJca7nCsow== X-Received: by 10.13.240.196 with SMTP id z187mr558662ywe.337.1488916256355; Tue, 07 Mar 2017 11:50:56 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Tue, 7 Mar 2017 11:50:15 -0800 (PST) In-Reply-To: References: From: Eric Rescorla Date: Tue, 7 Mar 2017 11:50:15 -0800 Message-ID: To: Roelof Du Toit Content-Type: multipart/alternative; boundary=94eb2c034eb08f8db9054a295447 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Allow KeyShare in HelloRetry if not advertised in ClientHello? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 19:50:58 -0000 --94eb2c034eb08f8db9054a295447 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable This appears in https://tlswg.github.io/tls13-spec/#resumption-and-psk "As the server is authenticating via a PSK, it does not send a Certificate or a CertificateVerify message. When a client offers resumption via PSK, it SHOULD also supply a =E2=80=9Ckey_share=E2=80=9D extension to the server to= allow the server to decline resumption and fall back to a full handshake, if needed. = " -Ekr On Tue, Mar 7, 2017 at 11:35 AM, Roelof Du Toit wrote: > Thank you. > > > > The following text in 4.2.7 prompted my scenario: > > "" > > A server which receives an =E2=80=9Cearly_data=E2=80=9D extension MUST be= have in one of > three ways:" > > .. > > - Request that the client send another ClientHello by responding with a > HelloRetryRequest. A client MUST NOT include the =E2=80=9Cearly_data=E2= =80=9D extension in > its followup ClientHello. > > "" > > > > My conclusion from your replies is that the burden is on the client to > avoid the scenario by including an empty key_share (with corresponding > sigalgs and supported_groups) when sending early_data with psk_ke mode (v= s > psk_dhe_ke). It might be worth warning implementers about that in the sp= ec. > > > > --Roelof > > > > *From: *David Benjamin > *Date: *Tuesday, March 7, 2017 at 1:05 PM > *To: *Eric Rescorla , Roelof Du Toit < > Roelof_Dutoit@symantec.com> > *Cc: *"tls@ietf.org" > *Subject: *Re: [TLS] Allow KeyShare in HelloRetry if not advertised in > ClientHello? > > > > On Tue, Mar 7, 2017 at 12:49 PM Eric Rescorla wrote: > > On Tue, Mar 7, 2017 at 9:44 AM, Roelof Du Toit > wrote: > > All, > > > > The current language in https://tlswg.github.io/tls13- > spec/#rfc.section.4.1.4 states: > > As with ServerHello, a HelloRetryRequest MUST NOT contain any extensions > that were not first offered by the client in its ClientHello, with the > exception of optionally the =E2=80=9Ccookie=E2=80=9D (see Section 4.2.2 > ) extension. > > > > I am analyzing the following message flow: > > ClientHello > > + early_data > > + psk_key_exchange_modes =3D psk_ke > > + pre_shared_key ---------> > > (Early Data) ---------> *reject* > > <--------- HelloRetryRequest (not allowed to add key_share) > > ClientHello > > + supported_groups > > + key_share ---------> *not supported* > > > > At that point in the flow the server is not allowed to send another > HelloRetryRequest. To avoid that the client would need some hints in the > HelloRetryRequest. > > Would it be possible to allow an exception to send key_share and/or > supported_groups in a HelloRetryRequest if not offered in ClientHello? > > > > I would prefer not. If the client is willing to do DH, it should offer > KeyShare in its initial ClientHello. > > > > In particular, per 4.2.5: > > > > "Clients MAY send an empty client_shares vector in order to request group > selection from the server at the cost of an additional round trip." > > > > David > --94eb2c034eb08f8db9054a295447 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
This appears in https://tlswg.github.io/tls13-spec/#resumption-and= -psk

"As the server is authenticating via a PSK= , it does not send a=20 Certificate or a CertificateVerify message. When a client offers=20 resumption via PSK, it SHOULD also supply a =E2=80=9Ckey_share=E2=80=9D ext= ension to the server to allow the server to decline resumption and fall back to a=20 full handshake, if needed. "

-Ekr




On Tue, Mar 7, 2017 at 11:35 AM, Roelof Du = Toit <Roelof_Dutoit@symantec.com> wrote:

Thank you.

=C2=A0

The following text in 4.2.7 prompted my scenario:

""

A server which receives an =E2=80=9Cearly_data=E2=80=9D extension MUST beh= ave in one of three ways:"

..

- Request that the client send another ClientHello by responding with a He= lloRetryRequest. A client MUST NOT include the =E2=80=9Cearly_data=E2=80=9D= extension in its followup ClientHello.

""

=C2=A0

My conclusion from your replies is that the burden is on the client to avo= id the scenario by including an empty key_share (with corresponding sigalgs= and supported_groups) when sending early_data with psk_ke mode (vs psk_dhe_ke).=C2=A0 It might be worth warni= ng implementers about that in the spec.

=C2=A0

--Roelof

=C2=A0

From: David Benjamin &= lt;davidben@chro= mium.org>
Date: Tuesday, March 7, 2017 at 1:05 PM
To: Eric Rescorla <ekr@rtfm.com>, Roelof Du Toit <Roelof_Dutoit@symantec.com>
Cc: "tls@ietf= .org" <tls@ie= tf.org>
Subject: Re: [TLS] Allow KeyShare in HelloRetry if not advertised in= ClientHello?

=C2=A0

On Tue, Mar 7, 2017 at 12= :49 PM Eric Rescorla <= ekr@rtfm.com> wrote:

On Tue, Mar 7, 2017 at 9:= 44 AM, Roelof Du Toit <Roelof_Dutoit@symantec.com><= /span> wrote:

All,

=C2=A0

The current language in https://tlswg.github.io/tls13-spec/#rfc.section.4.1.4 states:

As with ServerHello, a HelloRetryRequest MUST NOT contain any extensio= ns that were not first offered by the client in its ClientHello, with the e= xception of optionally the =E2=80=9Ccookie=E2=80=9D (see=C2=A0Section 4.2.2) extension.

=C2=A0

I am analyzing the following message flow:=

ClientHello

+ early_data<= u>

+ psk_key_exchange_modes =3D psk_k= e

+ pre_shared_key --------->

(Early Data) ---------> *reject= *

<--------- HelloRetryRequest (n= ot allowed to add key_share)

ClientHello

+ supported_groups

+ key_share ---------> *not sup= ported*

=C2=A0

At that point in the flow the server is not allowed to send another He= lloRetryRequest.=C2=A0 To avoid that the client would need some hints in th= e HelloRetryRequest.

Would it be possible to allow an exception to send key_share and/or su= pported_groups in a HelloRetryRequest if not offered in ClientHello?=

=C2=A0

I would prefer not. If th= e client is willing to do DH, it should offer KeyShare in its initial Clien= tHello.

=C2=A0

=C2=A0In particular, per = 4.2.5:

=C2=A0

"Clients MAY send an= empty client_shares vector in order to request group selection from the se= rver at the cost of an additional round trip."

=C2=A0

David


--94eb2c034eb08f8db9054a295447-- From nobody Tue Mar 7 12:04:31 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B4CC129569 for ; Tue, 7 Mar 2017 12:04:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.22 X-Spam-Level: X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OrM6aHy-MJ4d for ; Tue, 7 Mar 2017 12:04:28 -0800 (PST) Received: from asbsmtoutape01.symantec.com (asbsmtoutape01.symantec.com [155.64.138.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A61DD129426 for ; Tue, 7 Mar 2017 12:04:28 -0800 (PST) Received: from asbsmtmtaapi02.symc.symantec.com (asb1-f5-symc-ext-prd-snat6.net.symantec.com [10.90.75.6]) by asbsmtoutape01.symantec.com (Symantec Messaging Gateway) with SMTP id D0.1F.36325.B421FB85; Tue, 7 Mar 2017 20:04:27 +0000 (GMT) X-AuditID: 0a5af819-428639a000008de5-8e-58bf124b56d4 Received: from tus3xchcaspin01.SYMC.SYMANTEC.COM (asb1-f5-symc-ext-prd-snat3.net.symantec.com [10.90.75.3]) by asbsmtmtaapi02.symc.symantec.com (Symantec Messaging Gateway) with SMTP id BA.7D.09705.B421FB85; Tue, 7 Mar 2017 20:04:27 +0000 (GMT) Received: from TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (10.44.91.33) by tus3xchcaspin01.SYMC.SYMANTEC.COM (10.44.91.13) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Tue, 7 Mar 2017 12:04:25 -0800 Received: from NAM02-BL2-obe.outbound.protection.outlook.com (10.44.128.9) by TUSXCHMBXWPI01.SYMC.SYMANTEC.COM (10.44.91.33) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Tue, 7 Mar 2017 12:04:25 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=M4WHxHVnUYRZ+NbSOoytCUC+r6MPgV0pliEuTrouUIc=; b=3dPDafF+g9dX3m90GCKkyQIazjURPZd5tKiuAD90Rowu6wx23WjAFaookMlxKie4GXj/uS68JEYkloisRwcFaBfQWqav5U6asnbq59KbXvCu7B8LWIFTCXjHVe278kzlujrgOsCKAkEAqIGmt2obZYt7DAAcyz+tyMyUZmFKwio= Received: from DM5PR16MB1834.namprd16.prod.outlook.com (10.172.45.9) by DM5PR16MB1834.namprd16.prod.outlook.com (10.172.45.9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.12; Tue, 7 Mar 2017 20:04:23 +0000 Received: from DM5PR16MB1834.namprd16.prod.outlook.com ([10.172.45.9]) by DM5PR16MB1834.namprd16.prod.outlook.com ([10.172.45.9]) with mapi id 15.01.0947.020; Tue, 7 Mar 2017 20:04:23 +0000 From: Roelof Du Toit To: Eric Rescorla Thread-Topic: [TLS] Allow KeyShare in HelloRetry if not advertised in ClientHello? Thread-Index: AQHSl2p+vyKS4/mfNkq7sGwa67WGLaGJp0sAgAAEroD//8VQAIAAV/aA//+wIAA= Date: Tue, 7 Mar 2017 20:04:23 +0000 Message-ID: <7C5FFCA0-E33C-4130-8B4E-0102CB40FC5F@symantec.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: rtfm.com; dkim=none (message not signed) header.d=none;rtfm.com; dmarc=none action=none header.from=symantec.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [72.23.5.194] x-microsoft-exchange-diagnostics: 1; DM5PR16MB1834; 7:ve84MRmAPOGjtDsnIj+usug0uWEYSeXlLncryJJez7D3NWEl7XqLB1+bnmkW+AXxBJLezBjZ9/KAaNnqOLAiJXRgO2lPhRc38/IWqE1sg9rb8zi2ZtZYdHe+bVf6u/Fmj/2AzypsJ6Q2CHee0sKe6TesGBCqftCd8HFMJ+sVEC6bhclkJcnQxlFkCAANJ5Viz0HDzcxknIhdDeoKff2vIkqnPQ/l3JHn0wgMqc8f3ygIssR/8X/JMXenIwlEE3oZwsvHtqc3JGXQUmZQnZiDPIGlp+IzFuaW3dRLVnm3o3u2I/tAo3ASOASLXb9fEzWfofsdERHKcZVYhvnT2gENaA== x-forefront-antispam-report: SFV:SKI; SCL:-1SFV:NSPM; SFS:(10009020)(39450400003)(377454003)(24454002)(83716003)(4326008)(6246003)(106116001)(38730400002)(110136004)(82746002)(2950100002)(2900100001)(8676002)(236005)(54906002)(6916009)(77096006)(606005)(25786008)(6436002)(86362001)(7906003)(6486002)(53546006)(10290500002)(80792005)(50986999)(6506006)(6512007)(36756003)(33656002)(54896002)(122556002)(5660300001)(6306002)(66066001)(7736002)(3280700002)(76176999)(54356999)(99286003)(93886004)(8936002)(53936002)(102836003)(3846002)(6116002)(229853002)(2906002)(189998001)(3660700001); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR16MB1834; H:DM5PR16MB1834.namprd16.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; x-ms-office365-filtering-correlation-id: ca9eca03-cb22-4158-665f-08d46595263f x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:DM5PR16MB1834; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6041248)(20161123562025)(20161123564025)(20161123555025)(20161123560025)(20161123558025)(6072148); SRVR:DM5PR16MB1834; BCL:0; PCL:0; RULEID:; SRVR:DM5PR16MB1834; x-forefront-prvs: 0239D46DB6 spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_7C5FFCA0E33C41308B4E0102CB40FC5Fsymanteccom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Mar 2017 20:04:23.0272 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR16MB1834 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA02Se0jTURTHufv9tv1cDW6b5kmJbFiY+IQk/9BKCTIsS8wSQern/JXik00t jWIJCU4Ry8LykXM5UVHUfGKCaYv5yHdqLFLElZQg+cJXRm5Xw38un3O+33PPOZfLUJJPfDsm JiGZUySwcTKBiBaFBwpcAyWdYR7Nzd7e71a9vCvnB4XeS0NqdJ4KKFKN0AHl5Ru8gPzZTOoa FS7yieLiYlI5hfvZ26Lorg0uqXIE3V/cGqBUaLYfqZEVA/g0bFe/FqiRiJHgRQRG3dB/Qbte zCPCGoJhbYnQLEiwHsF0sS0R5hAsNf+2lNM4i4IZVdluyVMeDH1ppEnQheBXl45nrhdgT9h4 /4xvZmvsAJt/emgzU/gStFTMUmaW4hCo2s5DxHMdlpuqBISDYOJzmWUOGjuCxqSx5MX4HBgq ChBp1seDyT5issLB0PL4jaUxwodhra+GR5rZgtFUyiObYijvGKII28DP2b9880UIZyMwNLfu Ci4wMGnafZpjMP2939INcA4Fubp6IQna+ZCrMdLEdQWGM0rRHhtGNnc5FuqNa0LCgdDaN0nn IbfCfVMRlkPbulpQaFnvEPS+MtGFiNnJn4K6dndiOQ7Ps2eEhJ3gSXGJkFgCYCXLb79Fg5hq 5MAqI5XxyYkpyWwS5+HppkyLl5sPdueHyd3kifFvkeWPrR9pQ/qey90IM0h2UPwAd4ZJ+Gzq jrMbAUPJrMXz/J2UOIpNS+cUibcUKXGcshvZM7TMVrzwozZMgu+yyVwsxyVxij2Vx1jZqVCD 78dRRysX9zM100VtC/f0Nqk3NzQTBzKPpkcwoQ66jtARr1xmvm0lJX8sIUSoD5JsScdXg1f8 7lRvRvrlSFeWpwZ7r564UTo145MvfWHvlFTg+/WC1l9tqP0ww49xdn35cCyiqmE88lHLwMXG 8TrdyZYmo3/Gt9E5rW+10JiQJ6OV0aynM6VQsv8A12BnbV8DAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA02Se0hTcRTH+d17t11H1q9VerCXjoqSUteDRKKHkFhm2AMa+6du6/pAXbJr mkgyiwIfiGVULs1pc2gEijVfZaWE1sTHQnQJJaJiWVFaOd+2u5+B//z4fH/ne37nnB+HpRXV Eh82TpfM63VcglIqZ+SaCHpXhOK1OujGhH/wi7/7giu+dcqCJ7qy0WE6/KHBzoSbzdNUeMHQ LTqK1sgPXOIT4lJ4feDBC/LY5mk+qcKOro7PdtAGNNSOspEHC3gvlE0VUdlIziqwE0F3WbFM DCjwWwQDRd4kMIpgwvpLKgoGZ9EwaChdSrlNQZfjGUNEM4Kx5nJKzJdiFUy/uSMReS32hZm5 d4zIND4GtZYhWuQ1+AxUzucj4jkLv59XSgmfhN6eUncfDN4CpmGT+94TH4I2y31Eitko6LMR kwc+BbWZj92FEfYCp+0pRYp5Q/9wCUUmxWB+2UUTXgdfhxYk4kMI5yBos9YtBXZCR9/w0tds hoGRdnc1wLk05JVXy4holECeqZ8hrkjovl6C/nObfWaJ46G63ykjHAF1tj6GJBspsNY2uQTr EhugYXpPPvI3LuuWsBbqp7KlRvfYq+F94TBjdGXQeAdUNQYSix/czRmUEd4ON4uKZcQSDn+y jiy3mBD7BPlywkUhMTkxmeOS4oJ2BwhpiVrx4FwLpg3QXk6sQe4Vm/WuR51zJ1oQZpFyhadh 4ZVaIeFSXM4WtJ5llN6eDlWNWoFjuGQ+nueTeP15/ZUEXmhBFOvhY0DmxdDcqPh7wlHnA6/F jKrTK3tklo6K1smNprpHP1Yprh1v1XBhEebAD9bCnyqvkA5r2GfPrIz9Bu5T6HhBa1N0WqpO GI2xOGrTR7YaSyO3aTStPr25fnHdlpBNQV+az3nIdd8r7SMf1e0DfNZ8boXQHz2ZOZbqaHBq oy3pukElI8RyKn9aL3D/AIq1G5dDAwAA X-CFilter-Loop: ASB02 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Allow KeyShare in HelloRetry if not advertised in ClientHello? X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Mar 2017 20:04:30 -0000 --_000_7C5FFCA0E33C41308B4E0102CB40FC5Fsymanteccom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmsgeW91IEVyaWMNCg0KRnJvbTogRXJpYyBSZXNjb3JsYSA8ZWtyQHJ0Zm0uY29tPg0KRGF0 ZTogVHVlc2RheSwgTWFyY2ggNywgMjAxNyBhdCAyOjUwIFBNDQpUbzogUm9lbG9mIER1IFRvaXQg PFJvZWxvZl9EdXRvaXRAc3ltYW50ZWMuY29tPg0KQ2M6IERhdmlkIEJlbmphbWluIDxkYXZpZGJl bkBjaHJvbWl1bS5vcmc+LCAidGxzQGlldGYub3JnIiA8dGxzQGlldGYub3JnPg0KU3ViamVjdDog UmU6IFtUTFNdIEFsbG93IEtleVNoYXJlIGluIEhlbGxvUmV0cnkgaWYgbm90IGFkdmVydGlzZWQg aW4gQ2xpZW50SGVsbG8/DQoNClRoaXMgYXBwZWFycyBpbiBodHRwczovL3Rsc3dnLmdpdGh1Yi5p by90bHMxMy1zcGVjLyNyZXN1bXB0aW9uLWFuZC1wc2sNCg0KIkFzIHRoZSBzZXJ2ZXIgaXMgYXV0 aGVudGljYXRpbmcgdmlhIGEgUFNLLCBpdCBkb2VzIG5vdCBzZW5kIGEgQ2VydGlmaWNhdGUgb3Ig YSBDZXJ0aWZpY2F0ZVZlcmlmeSBtZXNzYWdlLiBXaGVuIGEgY2xpZW50IG9mZmVycyByZXN1bXB0 aW9uIHZpYSBQU0ssIGl0IFNIT1VMRCBhbHNvIHN1cHBseSBhIOKAnGtleV9zaGFyZeKAnSBleHRl bnNpb24gdG8gdGhlIHNlcnZlciB0byBhbGxvdyB0aGUgc2VydmVyIHRvIGRlY2xpbmUgcmVzdW1w dGlvbiBhbmQgZmFsbCBiYWNrIHRvIGEgZnVsbCBoYW5kc2hha2UsIGlmIG5lZWRlZC4gIg0KDQot RWtyDQoNCg0KDQoNCk9uIFR1ZSwgTWFyIDcsIDIwMTcgYXQgMTE6MzUgQU0sIFJvZWxvZiBEdSBU b2l0IDxSb2Vsb2ZfRHV0b2l0QHN5bWFudGVjLmNvbTxtYWlsdG86Um9lbG9mX0R1dG9pdEBzeW1h bnRlYy5jb20+PiB3cm90ZToNClRoYW5rIHlvdS4NCg0KVGhlIGZvbGxvd2luZyB0ZXh0IGluIDQu Mi43IHByb21wdGVkIG15IHNjZW5hcmlvOg0KIiINCkEgc2VydmVyIHdoaWNoIHJlY2VpdmVzIGFu IOKAnGVhcmx5X2RhdGHigJ0gZXh0ZW5zaW9uIE1VU1QgYmVoYXZlIGluIG9uZSBvZiB0aHJlZSB3 YXlzOiINCi4uDQotIFJlcXVlc3QgdGhhdCB0aGUgY2xpZW50IHNlbmQgYW5vdGhlciBDbGllbnRI ZWxsbyBieSByZXNwb25kaW5nIHdpdGggYSBIZWxsb1JldHJ5UmVxdWVzdC4gQSBjbGllbnQgTVVT VCBOT1QgaW5jbHVkZSB0aGUg4oCcZWFybHlfZGF0YeKAnSBleHRlbnNpb24gaW4gaXRzIGZvbGxv d3VwIENsaWVudEhlbGxvLg0KIiINCg0KTXkgY29uY2x1c2lvbiBmcm9tIHlvdXIgcmVwbGllcyBp cyB0aGF0IHRoZSBidXJkZW4gaXMgb24gdGhlIGNsaWVudCB0byBhdm9pZCB0aGUgc2NlbmFyaW8g YnkgaW5jbHVkaW5nIGFuIGVtcHR5IGtleV9zaGFyZSAod2l0aCBjb3JyZXNwb25kaW5nIHNpZ2Fs Z3MgYW5kIHN1cHBvcnRlZF9ncm91cHMpIHdoZW4gc2VuZGluZyBlYXJseV9kYXRhIHdpdGggcHNr X2tlIG1vZGUgKHZzIHBza19kaGVfa2UpLiAgSXQgbWlnaHQgYmUgd29ydGggd2FybmluZyBpbXBs ZW1lbnRlcnMgYWJvdXQgdGhhdCBpbiB0aGUgc3BlYy4NCg0KLS1Sb2Vsb2YNCg0KRnJvbTogRGF2 aWQgQmVuamFtaW4gPGRhdmlkYmVuQGNocm9taXVtLm9yZzxtYWlsdG86ZGF2aWRiZW5AY2hyb21p dW0ub3JnPj4NCkRhdGU6IFR1ZXNkYXksIE1hcmNoIDcsIDIwMTcgYXQgMTowNSBQTQ0KVG86IEVy aWMgUmVzY29ybGEgPGVrckBydGZtLmNvbTxtYWlsdG86ZWtyQHJ0Zm0uY29tPj4sIFJvZWxvZiBE dSBUb2l0IDxSb2Vsb2ZfRHV0b2l0QHN5bWFudGVjLmNvbTxtYWlsdG86Um9lbG9mX0R1dG9pdEBz eW1hbnRlYy5jb20+Pg0KQ2M6ICJ0bHNAaWV0Zi5vcmc8bWFpbHRvOnRsc0BpZXRmLm9yZz4iIDx0 bHNAaWV0Zi5vcmc8bWFpbHRvOnRsc0BpZXRmLm9yZz4+DQpTdWJqZWN0OiBSZTogW1RMU10gQWxs b3cgS2V5U2hhcmUgaW4gSGVsbG9SZXRyeSBpZiBub3QgYWR2ZXJ0aXNlZCBpbiBDbGllbnRIZWxs bz8NCg0KT24gVHVlLCBNYXIgNywgMjAxNyBhdCAxMjo0OSBQTSBFcmljIFJlc2NvcmxhIDxla3JA cnRmbS5jb208bWFpbHRvOmVrckBydGZtLmNvbT4+IHdyb3RlOg0KT24gVHVlLCBNYXIgNywgMjAx NyBhdCA5OjQ0IEFNLCBSb2Vsb2YgRHUgVG9pdCA8Um9lbG9mX0R1dG9pdEBzeW1hbnRlYy5jb208 bWFpbHRvOlJvZWxvZl9EdXRvaXRAc3ltYW50ZWMuY29tPj4gd3JvdGU6DQpBbGwsDQoNClRoZSBj dXJyZW50IGxhbmd1YWdlIGluIGh0dHBzOi8vdGxzd2cuZ2l0aHViLmlvL3RsczEzLXNwZWMvI3Jm Yy5zZWN0aW9uLjQuMS40IHN0YXRlczoNCkFzIHdpdGggU2VydmVySGVsbG8sIGEgSGVsbG9SZXRy eVJlcXVlc3QgTVVTVCBOT1QgY29udGFpbiBhbnkgZXh0ZW5zaW9ucyB0aGF0IHdlcmUgbm90IGZp cnN0IG9mZmVyZWQgYnkgdGhlIGNsaWVudCBpbiBpdHMgQ2xpZW50SGVsbG8sIHdpdGggdGhlIGV4 Y2VwdGlvbiBvZiBvcHRpb25hbGx5IHRoZSDigJxjb29raWXigJ0gKHNlZSBTZWN0aW9uIDQuMi4y PGh0dHBzOi8vdGxzd2cuZ2l0aHViLmlvL3RsczEzLXNwZWMvI2Nvb2tpZT4pIGV4dGVuc2lvbi4N Cg0KSSBhbSBhbmFseXppbmcgdGhlIGZvbGxvd2luZyBtZXNzYWdlIGZsb3c6DQpDbGllbnRIZWxs bw0KKyBlYXJseV9kYXRhDQorIHBza19rZXlfZXhjaGFuZ2VfbW9kZXMgPSBwc2tfa2UNCisgcHJl X3NoYXJlZF9rZXkgLS0tLS0tLS0tPg0KKEVhcmx5IERhdGEpIC0tLS0tLS0tLT4gKnJlamVjdCoN CjwtLS0tLS0tLS0gSGVsbG9SZXRyeVJlcXVlc3QgKG5vdCBhbGxvd2VkIHRvIGFkZCBrZXlfc2hh cmUpDQpDbGllbnRIZWxsbw0KKyBzdXBwb3J0ZWRfZ3JvdXBzDQorIGtleV9zaGFyZSAtLS0tLS0t LS0+ICpub3Qgc3VwcG9ydGVkKg0KDQpBdCB0aGF0IHBvaW50IGluIHRoZSBmbG93IHRoZSBzZXJ2 ZXIgaXMgbm90IGFsbG93ZWQgdG8gc2VuZCBhbm90aGVyIEhlbGxvUmV0cnlSZXF1ZXN0LiAgVG8g YXZvaWQgdGhhdCB0aGUgY2xpZW50IHdvdWxkIG5lZWQgc29tZSBoaW50cyBpbiB0aGUgSGVsbG9S ZXRyeVJlcXVlc3QuDQpXb3VsZCBpdCBiZSBwb3NzaWJsZSB0byBhbGxvdyBhbiBleGNlcHRpb24g dG8gc2VuZCBrZXlfc2hhcmUgYW5kL29yIHN1cHBvcnRlZF9ncm91cHMgaW4gYSBIZWxsb1JldHJ5 UmVxdWVzdCBpZiBub3Qgb2ZmZXJlZCBpbiBDbGllbnRIZWxsbz8NCg0KSSB3b3VsZCBwcmVmZXIg bm90LiBJZiB0aGUgY2xpZW50IGlzIHdpbGxpbmcgdG8gZG8gREgsIGl0IHNob3VsZCBvZmZlciBL ZXlTaGFyZSBpbiBpdHMgaW5pdGlhbCBDbGllbnRIZWxsby4NCg0KIEluIHBhcnRpY3VsYXIsIHBl ciA0LjIuNToNCg0KIkNsaWVudHMgTUFZIHNlbmQgYW4gZW1wdHkgY2xpZW50X3NoYXJlcyB2ZWN0 b3IgaW4gb3JkZXIgdG8gcmVxdWVzdCBncm91cCBzZWxlY3Rpb24gZnJvbSB0aGUgc2VydmVyIGF0 IHRoZSBjb3N0IG9mIGFuIGFkZGl0aW9uYWwgcm91bmQgdHJpcC4iDQoNCkRhdmlkDQoNCg== --_000_7C5FFCA0E33C41308B4E0102CB40FC5Fsymanteccom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCglwYW5vc2UtMToyIDcg MyA5IDIgMiA1IDIgNCA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0 aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5 bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3Jt YWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEy LjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQphOmxpbmssIHNwYW4uTXNv SHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQt ZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxv d2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNv cmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLm0tNjQyODY3Nzc3MTY2MDg1NTc0OGdtYWlsbXNnDQoJ e21zby1zdHlsZS1uYW1lOm1fLTY0Mjg2Nzc3NzE2NjA4NTU3NDhnbWFpbG1zZzt9DQpzcGFuLkVt YWlsU3R5bGUxOA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWls eTpDYWxpYnJpOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5tc29JbnMNCgl7bXNvLXN0eWxl LXR5cGU6ZXhwb3J0LW9ubHk7DQoJbXNvLXN0eWxlLW5hbWU6IiI7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTsNCgljb2xvcjp0ZWFsO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10 eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24x DQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9 DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8 L2hlYWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZs aW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmki PlRoYW5rIHlvdSBFcmljPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxiPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNrIj5Gcm9tOg0KPC9zcGFuPjwvYj48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6Q2FsaWJyaTtjb2xvcjpibGFjayI+RXJpYyBSZXNjb3JsYSAm bHQ7ZWtyQHJ0Zm0uY29tJmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5UdWVzZGF5LCBNYXJjaCA3LCAy MDE3IGF0IDI6NTAgUE08YnI+DQo8Yj5UbzogPC9iPlJvZWxvZiBEdSBUb2l0ICZsdDtSb2Vsb2Zf RHV0b2l0QHN5bWFudGVjLmNvbSZndDs8YnI+DQo8Yj5DYzogPC9iPkRhdmlkIEJlbmphbWluICZs dDtkYXZpZGJlbkBjaHJvbWl1bS5vcmcmZ3Q7LCAmcXVvdDt0bHNAaWV0Zi5vcmcmcXVvdDsgJmx0 O3Rsc0BpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OiA8L2I+UmU6IFtUTFNdIEFsbG93IEtl eVNoYXJlIGluIEhlbGxvUmV0cnkgaWYgbm90IGFkdmVydGlzZWQgaW4gQ2xpZW50SGVsbG8/PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPlRoaXMg YXBwZWFycyBpbiA8YSBocmVmPSJodHRwczovL3Rsc3dnLmdpdGh1Yi5pby90bHMxMy1zcGVjLyNy ZXN1bXB0aW9uLWFuZC1wc2siPg0KaHR0cHM6Ly90bHN3Zy5naXRodWIuaW8vdGxzMTMtc3BlYy8j cmVzdW1wdGlvbi1hbmQtcHNrPC9hPiA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+JnF1b3Q7QXMgdGhlIHNlcnZlciBpcyBhdXRoZW50aWNhdGluZyB2aWEgYSBQU0ssIGl0 IGRvZXMgbm90IHNlbmQgYSBDZXJ0aWZpY2F0ZSBvciBhIENlcnRpZmljYXRlVmVyaWZ5IG1lc3Nh Z2UuIFdoZW4gYSBjbGllbnQgb2ZmZXJzIHJlc3VtcHRpb24gdmlhIFBTSywgaXQgU0hPVUxEIGFs c28gc3VwcGx5IGEg4oCca2V5X3NoYXJl4oCdIGV4dGVuc2lvbiB0byB0aGUgc2VydmVyIHRvDQog YWxsb3cgdGhlIHNlcnZlciB0byBkZWNsaW5lIHJlc3VtcHRpb24gYW5kIGZhbGwgYmFjayB0byBh IGZ1bGwgaGFuZHNoYWtlLCBpZiBuZWVkZWQuICZxdW90OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPi1Fa3I8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5PbiBUdWUsIE1hciA3 LCAyMDE3IGF0IDExOjM1IEFNLCBSb2Vsb2YgRHUgVG9pdCAmbHQ7PGEgaHJlZj0ibWFpbHRvOlJv ZWxvZl9EdXRvaXRAc3ltYW50ZWMuY29tIiB0YXJnZXQ9Il9ibGFuayI+Um9lbG9mX0R1dG9pdEBz eW1hbnRlYy5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6 MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPlRoYW5rIHlv dS48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxl ZnQ6LjVpbiI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpDYWxp YnJpIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTpDYWxpYnJpIj5UaGUgZm9sbG93aW5nIHRleHQgaW4gNC4yLjcgcHJvbXB0ZWQgbXkgc2Nl bmFyaW86PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdp bi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 Q2FsaWJyaSI+JnF1b3Q7JnF1b3Q7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+QSBzZXJ2ZXIgd2hpY2ggcmVjZWl2ZXMgYW4g4oCcZWFy bHlfZGF0YeKAnSBleHRlbnNpb24gTVVTVCBiZWhhdmUgaW4gb25lIG9mIHRocmVlIHdheXM6JnF1 b3Q7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2Fs aWJyaSI+Li48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFy Z2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTpDYWxpYnJpIj4tIFJlcXVlc3QgdGhhdCB0aGUgY2xpZW50IHNlbmQgYW5vdGhlciBDbGllbnRI ZWxsbyBieSByZXNwb25kaW5nIHdpdGggYSBIZWxsb1JldHJ5UmVxdWVzdC4gQSBjbGllbnQgTVVT VCBOT1QgaW5jbHVkZSB0aGUg4oCcZWFybHlfZGF0YeKAnSBleHRlbnNpb24gaW4gaXRzIGZvbGxv d3VwIENsaWVudEhlbGxvLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPiZxdW90OyZxdW90Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPk15IGNvbmNsdXNpb24g ZnJvbSB5b3VyIHJlcGxpZXMgaXMgdGhhdCB0aGUgYnVyZGVuIGlzIG9uIHRoZSBjbGllbnQgdG8g YXZvaWQgdGhlIHNjZW5hcmlvIGJ5IGluY2x1ZGluZyBhbiBlbXB0eSBrZXlfc2hhcmUgKHdpdGgg Y29ycmVzcG9uZGluZyBzaWdhbGdzIGFuZCBzdXBwb3J0ZWRfZ3JvdXBzKSB3aGVuIHNlbmRpbmcg ZWFybHlfZGF0YSB3aXRoIHBza19rZQ0KIG1vZGUgKHZzIHBza19kaGVfa2UpLiZuYnNwOyBJdCBt aWdodCBiZSB3b3J0aCB3YXJuaW5nIGltcGxlbWVudGVycyBhYm91dCB0aGF0IGluIHRoZSBzcGVj Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDouNWluIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGli cmkiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDouNWluIj4NCjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmkiPi0tUm9lbG9mPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRp diBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRp bmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0 OjEuMGluIj4NCjxiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDYWxpYnJpO2NvbG9yOmJsYWNr Ij5Gcm9tOiA8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDYWxpYnJpO2NvbG9y OmJsYWNrIj5EYXZpZCBCZW5qYW1pbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRhdmlkYmVuQGNocm9t aXVtLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmRhdmlkYmVuQGNocm9taXVtLm9yZzwvYT4mZ3Q7PGJy Pg0KPGI+RGF0ZTogPC9iPlR1ZXNkYXksIE1hcmNoIDcsIDIwMTcgYXQgMTowNSBQTTxicj4NCjxi PlRvOiA8L2I+RXJpYyBSZXNjb3JsYSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmVrckBydGZtLmNvbSIg dGFyZ2V0PSJfYmxhbmsiPmVrckBydGZtLmNvbTwvYT4mZ3Q7LCBSb2Vsb2YgRHUgVG9pdCAmbHQ7 PGEgaHJlZj0ibWFpbHRvOlJvZWxvZl9EdXRvaXRAc3ltYW50ZWMuY29tIiB0YXJnZXQ9Il9ibGFu ayI+Um9lbG9mX0R1dG9pdEBzeW1hbnRlYy5jb208L2E+Jmd0Ozxicj4NCjxiPkNjOiA8L2I+JnF1 b3Q7PGEgaHJlZj0ibWFpbHRvOnRsc0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPnRsc0BpZXRm Lm9yZzwvYT4mcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzp0bHNAaWV0Zi5vcmciIHRhcmdldD0i X2JsYW5rIj50bHNAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwvYj5SZTogW1RM U10gQWxsb3cgS2V5U2hhcmUgaW4gSGVsbG9SZXRyeSBpZiBub3QgYWR2ZXJ0aXNlZCBpbiBDbGll bnRIZWxsbz88L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCk9uIFR1ZSwgTWFyIDcsIDIwMTcgYXQgMTI6NDkg UE0gRXJpYyBSZXNjb3JsYSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmVrckBydGZtLmNvbSIgdGFyZ2V0 PSJfYmxhbmsiPmVrckBydGZtLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0ND Q0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21h cmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBp biI+DQpPbiBUdWUsIE1hciA3LCAyMDE3IGF0IDk6NDQgQU0sIFJvZWxvZiBEdSBUb2l0IDxzcGFu IGNsYXNzPSJtLTY0Mjg2Nzc3NzE2NjA4NTU3NDhnbWFpbG1zZyI+DQombHQ7PGEgaHJlZj0ibWFp bHRvOlJvZWxvZl9EdXRvaXRAc3ltYW50ZWMuY29tIiB0YXJnZXQ9Il9ibGFuayI+Um9lbG9mX0R1 dG9pdEBzeW1hbnRlYy5jb208L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PG86cD48L286cD48L3A+DQo8 YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAx LjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10 b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGNs YXNzPSJtLTY0Mjg2Nzc3NzE2NjA4NTU3NDhnbWFpbG1zZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQiPkFsbCw8L3NwYW4+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGNsYXNzPSJtLTY0Mjg2Nzc3NzE2 NjA4NTU3NDhnbWFpbG1zZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPiZuYnNwOzwv c3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2lu LWxlZnQ6MS4waW4iPg0KPHNwYW4gY2xhc3M9Im0tNjQyODY3Nzc3MTY2MDg1NTc0OGdtYWlsbXNn Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+VGhlIGN1cnJlbnQgbGFuZ3VhZ2UgaW4N CjxhIGhyZWY9Imh0dHBzOi8vdGxzd2cuZ2l0aHViLmlvL3RsczEzLXNwZWMvI3JmYy5zZWN0aW9u LjQuMS40IiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly90bHN3Zy5naXRodWIuaW8vdGxzMTMtc3Bl Yy8jcmZjLnNlY3Rpb24uNC4xLjQ8L2E+IHN0YXRlczo8L3NwYW4+PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGNs YXNzPSJtLTY0Mjg2Nzc3NzE2NjA4NTU3NDhnbWFpbG1zZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQiPkFzIHdpdGggU2VydmVySGVsbG8sIGEgSGVsbG9SZXRyeVJlcXVlc3QgTVVTVCBO T1QgY29udGFpbiBhbnkgZXh0ZW5zaW9ucyB0aGF0IHdlcmUgbm90IGZpcnN0IG9mZmVyZWQgYnkg dGhlIGNsaWVudCBpbiBpdHMgQ2xpZW50SGVsbG8sIHdpdGggdGhlIGV4Y2VwdGlvbiBvZiBvcHRp b25hbGx5IHRoZSDigJxjb29raWXigJ0gKHNlZSZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vdGxzd2cu Z2l0aHViLmlvL3RsczEzLXNwZWMvI2Nvb2tpZSIgdGFyZ2V0PSJfYmxhbmsiPlNlY3Rpb24NCiA0 LjIuMjwvYT4pIGV4dGVuc2lvbi48L3NwYW4+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGNsYXNzPSJtLTY0Mjg2 Nzc3NzE2NjA4NTU3NDhnbWFpbG1zZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPiZu YnNwOzwvc3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gY2xhc3M9Im0tNjQyODY3Nzc3MTY2MDg1NTc0OGdt YWlsbXNnIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+SSBhbSBhbmFseXppbmcgdGhl IGZvbGxvd2luZyBtZXNzYWdlIGZsb3c6PC9zcGFuPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBjbGFzcz0ibS02 NDI4Njc3NzcxNjYwODU1NzQ4Z21haWxtc2ciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5DbGllbnRIZWxsbzwvc3Bhbj48 L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 MS4waW4iPg0KPHNwYW4gY2xhc3M9Im0tNjQyODY3Nzc3MTY2MDg1NTc0OGdtYWlsbXNnIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZx dW90OyI+JiM0MzsgZWFybHlfZGF0YTwvc3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gY2xhc3M9Im0tNjQy ODY3Nzc3MTY2MDg1NTc0OGdtYWlsbXNnIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+JiM0MzsgcHNrX2tleV9leGNoYW5n ZV9tb2RlcyA9IHBza19rZTwvc3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gY2xhc3M9Im0tNjQyODY3Nzc3 MTY2MDg1NTc0OGdtYWlsbXNnIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+JiM0MzsgcHJlX3NoYXJlZF9rZXkgLS0tLS0t LS0tJmd0Ozwvc3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gY2xhc3M9Im0tNjQyODY3Nzc3MTY2MDg1NTc0 OGdtYWlsbXNnIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDb3VyaWVyIE5ldyZxdW90OyI+KEVhcmx5IERhdGEpIC0tLS0tLS0tLSZndDsgKnJlamVjdCo8 L3NwYW4+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdp bi1sZWZ0OjEuMGluIj4NCjxzcGFuIGNsYXNzPSJtLTY0Mjg2Nzc3NzE2NjA4NTU3NDhnbWFpbG1z ZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q291cmll ciBOZXcmcXVvdDsiPiZsdDstLS0tLS0tLS0gSGVsbG9SZXRyeVJlcXVlc3QgKG5vdCBhbGxvd2Vk IHRvIGFkZCBrZXlfc2hhcmUpPC9zcGFuPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBjbGFzcz0ibS02NDI4Njc3 NzcxNjYwODU1NzQ4Z21haWxtc2ciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NvdXJpZXIgTmV3JnF1b3Q7Ij5DbGllbnRIZWxsbzwvc3Bhbj48L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4i Pg0KPHNwYW4gY2xhc3M9Im0tNjQyODY3Nzc3MTY2MDg1NTc0OGdtYWlsbXNnIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+ JiM0Mzsgc3VwcG9ydGVkX2dyb3Vwczwvc3Bhbj48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNwYW4gY2xhc3M9Im0tNjQy ODY3Nzc3MTY2MDg1NTc0OGdtYWlsbXNnIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDb3VyaWVyIE5ldyZxdW90OyI+JiM0Mzsga2V5X3NoYXJlIC0tLS0t LS0tLSZndDsgKm5vdCBzdXBwb3J0ZWQqPC9zcGFuPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQo8c3BhbiBjbGFzcz0ibS02 NDI4Njc3NzcxNjYwODU1NzQ4Z21haWxtc2ciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 Ij4mbmJzcDs8L3NwYW4+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCjxzcGFuIGNsYXNzPSJtLTY0Mjg2Nzc3NzE2NjA4NTU3 NDhnbWFpbG1zZyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkF0IHRoYXQgcG9pbnQg aW4gdGhlIGZsb3cgdGhlIHNlcnZlciBpcyBub3QgYWxsb3dlZCB0byBzZW5kIGFub3RoZXIgSGVs bG9SZXRyeVJlcXVlc3QuJm5ic3A7IFRvIGF2b2lkIHRoYXQgdGhlIGNsaWVudCB3b3VsZCBuZWVk IHNvbWUgaGludHMgaW4gdGhlIEhlbGxvUmV0cnlSZXF1ZXN0Ljwvc3Bhbj48L3NwYW4+PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KPHNw YW4gY2xhc3M9Im0tNjQyODY3Nzc3MTY2MDg1NTc0OGdtYWlsbXNnIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdCI+V291bGQgaXQgYmUgcG9zc2libGUgdG8gYWxsb3cgYW4gZXhjZXB0aW9u IHRvIHNlbmQga2V5X3NoYXJlIGFuZC9vciBzdXBwb3J0ZWRfZ3JvdXBzIGluIGEgSGVsbG9SZXRy eVJlcXVlc3QgaWYgbm90IG9mZmVyZWQgaW4gQ2xpZW50SGVsbG8/PC9zcGFuPjwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCkkgd291bGQg cHJlZmVyIG5vdC4gSWYgdGhlIGNsaWVudCBpcyB3aWxsaW5nIHRvIGRvIERILCBpdCBzaG91bGQg b2ZmZXIgS2V5U2hhcmUgaW4gaXRzIGluaXRpYWwgQ2xpZW50SGVsbG8uPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6MS4waW4iPg0KJm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6 MS4waW4iPg0KJm5ic3A7SW4gcGFydGljdWxhciwgcGVyIDQuMi41OjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluIj4N CiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvO21hcmdpbi1sZWZ0OjEuMGluIj4NCiZxdW90O0NsaWVudHMgTUFZIHNlbmQgYW4gZW1wdHkg Y2xpZW50X3NoYXJlcyB2ZWN0b3IgaW4gb3JkZXIgdG8gcmVxdWVzdCBncm91cCBzZWxlY3Rpb24g ZnJvbSB0aGUgc2VydmVyIGF0IHRoZSBjb3N0IG9mIGFuIGFkZGl0aW9uYWwgcm91bmQgdHJpcC4m cXVvdDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDoxLjBpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbiI+DQpEYXZpZDxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_7C5FFCA0E33C41308B4E0102CB40FC5Fsymanteccom_-- From nobody Wed Mar 8 02:25:42 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 378EE1270B4 for ; Wed, 8 Mar 2017 02:25:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.602 X-Spam-Level: X-Spam-Status: No, score=-2.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SZnv6AgzrwEA for ; Wed, 8 Mar 2017 02:25:39 -0800 (PST) Received: from mout.gmx.net (mout.gmx.net [212.227.15.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 54E68127071 for ; Wed, 8 Mar 2017 02:25:38 -0800 (PST) Received: from [192.168.91.177] ([80.92.114.23]) by mail.gmx.com (mrgmx001 [212.227.17.190]) with ESMTPSA (Nemesis) id 0MDymt-1cUFAl1SFr-00HSQz; Wed, 08 Mar 2017 11:25:28 +0100 To: Ilari Liusvaara References: <296debba-b5a5-d063-4e01-59a3f110fe14@gmx.net> <20170306155516.GA24925@LK-Perkele-V2.elisa-laajakaista.fi> From: Hannes Tschofenig Openpgp: id=071A97A9ECBADCA8E31E678554D9CEEF4D776BC9 Message-ID: Date: Wed, 8 Mar 2017 11:25:26 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: <20170306155516.GA24925@LK-Perkele-V2.elisa-laajakaista.fi> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="HJBgFXF3MmWW5KoWCJxOtjCVwNpBgMmC8" X-Provags-ID: V03:K0:QZ7bCCE6N1D/zzcGcUzXF05uWRCsAT+w8hOoJUm7tcwVIxHyOzF 96caeF8ewz8Gfs5EAN2K2XnUFhRC7CtFmHjfaJ8pEgSL/cKxPbsX+5onKSanckEqmG/BZlq iPS00dBgRtdUV4S0n7nejbDvr/vr4U2xykB40/Y6TpkJ2a0LtYv1fLDM4fm0Kri1hLTTJSw nm9aYmotQljq8gPv9lRow== X-UI-Out-Filterresults: notjunk:1;V01:K0:6fjefJxw2tw=:DCGvjqrbKeQzJCIlSMKYit TZcSVcyE1cms8sfhG39deztFm/nvLo6kKkU1N/3CuNIUqnAnu5vefCG/5t+Htng2qcTx1REuc GGqI+rj9ez1VDCnkDeukqSK1nlsxFqIP777rBZOyjaniaOB5Qkx3nIY1DW9F7NNziVjgCos3E JahHyha49FXl+lgB7uDvcbsa1RIXs94yEP3l/TrgLpwi/Gpg9OKl0nkhWaG+KY46XCgSSpYVn QFWmGkC5EMwynSH5E4UGUO7gtcTia8DJi0mozCCU6Dvz+KqKLaMgR+TIE9drqHiipbWiz7X+x zwCowGNvtfP1A22TndlHuV7bieTx5Y95OcjCeQnTYcqXXVnkG8bIZB7VzFAVDRN3BSdYaQdZD 25wFZMXUzZV41JMsZxGf7HHv6Nw68i2f6zZnHVCmnpJnXsXqk3GIE7jCcAxyU/znhZfLY1tvA QKcgTfJ4Mi82umqyvQer+jYJQh7QfnhHD53yL5wWijxN51LQHt6Qr4xDb9Uvtzd61EHHG/UDI Bh5YG0HldhtbM4dOFpn0j8EzMMmRcaIcHAjU9rkvIVB3YNYiAAHG9IKdD5wIs8GUH/1NRif/U j6YjKs4fO3vHMCA4ySdWY3S1nlUe2CqrTyUoa65dq2WqOLKzONXemcpFyDTgmNxwBP8k71/CX GJrifL39LDaMLqzwFn2nt/G6xxyyLkjglDIlfd2AJJOPxB9P3DAdAgx7n/TDb9KuQM8H6PKVf d9818Zj47WHfHeu6R+cS73D/ON+wvpl4EvFH4jcDQhP+dY92VLOZ7mC0M4U= Archived-At: Cc: "" Subject: Re: [TLS] TLS 1.3 Record Layer Format X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Mar 2017 10:25:41 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --HJBgFXF3MmWW5KoWCJxOtjCVwNpBgMmC8 Content-Type: multipart/mixed; boundary="rvqwJOtuKgiCnPw1FKvsAjPi9CnmoHDRH"; protected-headers="v1" From: Hannes Tschofenig To: Ilari Liusvaara Cc: "" Message-ID: Subject: Re: [TLS] TLS 1.3 Record Layer Format References: <296debba-b5a5-d063-4e01-59a3f110fe14@gmx.net> <20170306155516.GA24925@LK-Perkele-V2.elisa-laajakaista.fi> In-Reply-To: <20170306155516.GA24925@LK-Perkele-V2.elisa-laajakaista.fi> --rvqwJOtuKgiCnPw1FKvsAjPi9CnmoHDRH Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Ilari, yes, I am exactly talking about these bytes that are useless to send around in some deployment environments. I would expect to at least provide the option of not sending the data in some cases would be useful. Ciao Hannes On 03/06/2017 04:55 PM, Ilari Liusvaara wrote: > On Mon, Mar 06, 2017 at 10:11:58AM +0100, Hannes Tschofenig wrote: >> Hi all, >> >> at the Seoul IETF meeting it was mentioned that the record layer forma= t >> may be simplified (by removing unused fields) if deployment tests real= >> no problems. >> >> Sorry if I missed information about the outcome of these deployment >> tests but the current spec version still has the old record layer form= at. >=20 > Yeah, I haven't seen those results either. > =20 >> As I mentioned in previous meetings I believe that such a record layer= >> simplification would be quite useful for environments where link layer= >> technologies provide very small MTU sizes. >=20 > AFAIK, one can save 3 bytes from the header for encrypted records > in TLS 1.3. Won't go well with SRTP mux tho. >=20 > (2 octet encoding for such record headers: >=20 > +-+---------------+ > |1|Length(15 bits)| > +-+---------------+ >=20 > These won't overlap with other TLS 1.3 records, as all others > always have MSB of first octet clear). >=20 >=20 >=20 > -Ilari >=20 --rvqwJOtuKgiCnPw1FKvsAjPi9CnmoHDRH-- --HJBgFXF3MmWW5KoWCJxOtjCVwNpBgMmC8 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: GPGTools - http://gpgtools.org iQEcBAEBCgAGBQJYv9wXAAoJEGhJURNOOiAtEcIH/3F+yk6D9csznb8v2QvZqzhv qYxBlZ9LjExqZN15FIUBrYyPYe+qpAggQIA8R/5og5Uy3ePj5sqrfLo6a8ki1H6x C0zIXuMoeRrrYqzu6YtjhkDt2LZ6yqF2gRVWN7YA2lkkKT+ABykxO1bNycyyptFN FMhwAamz3rxdkfAuqk5vv6EMFoPqrqBSWSSfwmL4EW01sqNbHJQgiLRE68GpEYKz 7zFPhPQIdjKP1BCHhirsOmT+vxg5OiW3kx3jMq7zruNDi8uVWSubCM3fxL1Biapj o+JT59zCNXBKkY+pVvXDiTszBuxpUsMYUska9xVZ7XIxJFAXbNDrg3sjXBtTCiw= =ouy7 -----END PGP SIGNATURE----- --HJBgFXF3MmWW5KoWCJxOtjCVwNpBgMmC8-- From nobody Wed Mar 8 13:20:44 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE57D129555 for ; Wed, 8 Mar 2017 13:20:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=salowey-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gPz4y7_t6MAc for ; Wed, 8 Mar 2017 13:20:41 -0800 (PST) Received: from mail-pg0-x234.google.com (mail-pg0-x234.google.com [IPv6:2607:f8b0:400e:c05::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D5CFD1294D7 for ; Wed, 8 Mar 2017 13:20:41 -0800 (PST) Received: by mail-pg0-x234.google.com with SMTP id 25so17606596pgy.0 for ; Wed, 08 Mar 2017 13:20:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=salowey-net.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=+p471wLgRRBoYtBBSFvujuEDtfuzLpYpBpkf4O+Mth0=; b=1y4vN9nNUmdDxuBCL8bthreIHI5t/tUwZXXmuy+vQOfiHxTq3E/fez57PmW0CXN2DS TNh47xbd9uOx3tgIXvrHp3FWmQf7A/0Fz2EfeODD40rUkLtr8vdWkUf2izqkOVcubYMR 7/M41bOAg8U2aWLMcw05BZMZVG7FiFvGuSS+ymYspd9vqv8rzaMfuoPe12iV84CaZvOr cVzZxmAm+uhcV5uSPVx6fwHhcrnswfryLj0RIrJuH2R/zmoEPnWZvFxvtvx/Sr+AME++ Mispifq/JohpUYmDp5+yD9oYyfnm8HnEO0fIJaymVzVaO+EErWnknUZ4O7c58hSw2RmB +NLg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=+p471wLgRRBoYtBBSFvujuEDtfuzLpYpBpkf4O+Mth0=; b=r0HrNQj+s30YOvCokoNjifmcc7BviI8y3YcHadmqGN9D2fqyncTQdgvy9d9YukYIeJ 7pdsPq82sHy8cQ3tJ1MZOk18vvbmOasvWEYveUaoiIaoNYkDyfraivsJlFuV4Q5Z7m5l 9vuRAcxvzhkxWa+VDhL4KVDb23lND8P2x+wRDseMBjSxsRAcukM1Vx1RmPSUFKItqb0N Z59TqD9Oj/iSLt/IHxGzQ4YHYg8O//No86HtlgqmBAR3a39EiCThkCThVwnp7bHSPM7v kpUT9fZymeJo5RaSO/yjqyOskogeDyB/WO2PO7vG589rk5LH7BZP95/pnO3RKfO+pKTi ahig== X-Gm-Message-State: AMke39mTwWtZAl1DMLQxeCue8y0YCx+0vdlHJ5D+QhyaI+Y7Es5673+rNuBkXYPXjiCQhJao5uLcV/t0x4dj0w== X-Received: by 10.99.94.195 with SMTP id s186mr9675932pgb.197.1489008041279; Wed, 08 Mar 2017 13:20:41 -0800 (PST) MIME-Version: 1.0 Received: by 10.100.163.70 with HTTP; Wed, 8 Mar 2017 13:20:20 -0800 (PST) From: Joseph Salowey Date: Wed, 8 Mar 2017 13:20:20 -0800 Message-ID: To: "tls@ietf.org" Content-Type: multipart/alternative; boundary=94eb2c186d305e577e054a3eb38f Archived-At: Subject: [TLS] Agenda items for TLS at IETF-98 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Mar 2017 21:20:42 -0000 --94eb2c186d305e577e054a3eb38f Content-Type: text/plain; charset=UTF-8 The TLS WG is scheduled to meet at 9:00-11:30 in the Tuesday Morning session. Please send in requests for agenda time to the chairs. We will be giving priority to any remaining open TLS 1.3 issues and drafts discussed on the list. Cheers, J&S --94eb2c186d305e577e054a3eb38f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
The TLS WG is scheduled to meet at 9:00-11:30 in the Tuesday Morning session. =C2=A0 Please = send in requests for agenda time to the chairs.=C2=A0 We will be giving pri= ority to any remaining open TLS 1.3 issues and drafts discussed on the list= . =C2=A0

Cheers,

J&S

--94eb2c186d305e577e054a3eb38f-- From nobody Wed Mar 8 13:27:57 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9EBB5129555 for ; Wed, 8 Mar 2017 13:27:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IFSh1DEz8KrQ for ; Wed, 8 Mar 2017 13:27:49 -0800 (PST) Received: from prod-mail-xrelay07.akamai.com (prod-mail-xrelay07.akamai.com [23.79.238.175]) by ietfa.amsl.com (Postfix) with ESMTP id B14F11295EB for ; Wed, 8 Mar 2017 13:27:49 -0800 (PST) Received: from prod-mail-xrelay07.akamai.com (localhost.localdomain [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id 3D5C6433433; Wed, 8 Mar 2017 21:27:49 +0000 (GMT) Received: from prod-mail-relay10.akamai.com (prod-mail-relay10.akamai.com [172.27.118.251]) by prod-mail-xrelay07.akamai.com (Postfix) with ESMTP id 260FE433409; Wed, 8 Mar 2017 21:27:49 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; s=a1; t=1489008469; bh=QuY78cs+sZr7xS609ccqydUJTby0Pf/BievwtBK4Oso=; l=1622; h=To:References:Cc:From:Date:In-Reply-To:From; b=IB43KMlDjOUOqX55jrHgyv0Rr2Y7ZAi5tA9uXh+GQvb6KF/zo0S4gGK3w2NLZAa9+ DyIGUD7G5b1bx5UZos6YV/TC3kfJy1pXTkQSVS663h8Qrw65aH7Sre7B3wqb2rVrsC Y7DJzaTn8pTBynpHR/25PSRB0tqRDMnpCfNjWTFA= Received: from [172.19.17.86] (bos-lpczi.kendall.corp.akamai.com [172.19.17.86]) by prod-mail-relay10.akamai.com (Postfix) with ESMTP id EDC141FC8D; Wed, 8 Mar 2017 21:27:48 +0000 (GMT) To: Hannes Tschofenig References: <296debba-b5a5-d063-4e01-59a3f110fe14@gmx.net> <20170306155516.GA24925@LK-Perkele-V2.elisa-laajakaista.fi> From: Benjamin Kaduk Message-ID: <920ab06c-f0f1-2d43-52d8-d76d718b3121@akamai.com> Date: Wed, 8 Mar 2017 15:27:48 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------ACBD7766E3164EA29B8AF49A" Archived-At: Cc: "" Subject: Re: [TLS] TLS 1.3 Record Layer Format X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Mar 2017 21:27:52 -0000 This is a multi-part message in MIME format. --------------ACBD7766E3164EA29B8AF49A Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit On 03/08/2017 04:25 AM, Hannes Tschofenig wrote: > Hi Ilari, > > yes, I am exactly talking about these bytes that are useless to send > around in some deployment environments. > > I would expect to at least provide the option of not sending the data in > some cases would be useful. > I would not expect us to provide that option. The cost of introducing a negotiation mechanism and interop headaches does not seem worth the gain of three octets per encrypted record. -Ben --------------ACBD7766E3164EA29B8AF49A Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit On 03/08/2017 04:25 AM, Hannes Tschofenig wrote:
Hi Ilari,

yes, I am exactly talking about these bytes that are useless to send
around in some deployment environments.

I would expect to at least provide the option of not sending the data in
some cases would be useful.

I would not expect us to provide that option.  The cost of introducing a negotiation mechanism and interop headaches does not seem worth the gain of three octets per encrypted record.

-Ben
--------------ACBD7766E3164EA29B8AF49A-- From nobody Wed Mar 8 13:47:28 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 97D301295D4 for ; Wed, 8 Mar 2017 13:47:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CweosNZHsU8k for ; Wed, 8 Mar 2017 13:47:25 -0800 (PST) Received: from mail-ua0-x22f.google.com (mail-ua0-x22f.google.com [IPv6:2607:f8b0:400c:c08::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 125C21295D2 for ; Wed, 8 Mar 2017 13:47:25 -0800 (PST) Received: by mail-ua0-x22f.google.com with SMTP id f54so53994878uaa.1 for ; Wed, 08 Mar 2017 13:47:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=DccLKPufkz8l2d8W3wir57o0s01wgIbPinbf0hE9VB8=; b=imR4nixyabhrINq4MzPIvv0qypPaO8EKp15dX/aVzpqxCRA7H0dhMfFzUL3CTTEmmf tYgD7kcIlklJEjbHa9jQBa8vyfGAOGAHDG409wKiRNB+DPYAjkUDcYDledpBbnH+MNwY 1qUQLVP+3uov3BTV9m01Z9WwdaFZq9cHebn92j1qnzGL2Yj9IqE+eWjsvLciNUckG2vM L00TRDxyUfzH4HascQRYP0/vJxoFQwhidiwssxnwXMWsD2aqHp29TypPwdr6iUBPtiTC L0ZRZ5zOOTeeVOZPjgLfPzJhlUhQMkIkfN+3NTnEgthKJU2m86XyPemwOqdZxfSRyEd0 eXXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=DccLKPufkz8l2d8W3wir57o0s01wgIbPinbf0hE9VB8=; b=Jgoh9h397nc2lQ91moGZpnnamJRQnMNv1LCCW26sXyfJWKWB+BtKxkToiPq47S9BGu oA5jFO/QGMjZVy9a3grE5Gm07k2nDshxrzCWgwQN5qwfWFvEGpF2V3IytPkG0b9k8mki IfaZypM1xlUrtkrmexEBWRomOcVesyW4bK3qY8rvGFo4sVqqdXoHq2UoBL8z7lO+IoEd XKB+8fBhrJoCmOVux0zQmaeuSH7UG3/JTcOKbt2HVzNjSWK4/t2DLs4Uvii+zOAqT76/ zt1w1wWr5FFQt3RcQbOPPlCCbwTIZbp7MyQV8qITL436um2QCnR6JTy61+XQUNe6wDAD HRYQ== X-Gm-Message-State: AMke39nN6biEnJt94trsfwvi9Kugw2hOPFLXuPVjtErhOtMYUdsyjWVnb5XEpvhil+6wsNS0arvTQr2yxdKipg== X-Received: by 10.37.53.138 with SMTP id c132mr2273848yba.105.1489009643997; Wed, 08 Mar 2017 13:47:23 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Wed, 8 Mar 2017 13:46:43 -0800 (PST) In-Reply-To: <920ab06c-f0f1-2d43-52d8-d76d718b3121@akamai.com> References: <296debba-b5a5-d063-4e01-59a3f110fe14@gmx.net> <20170306155516.GA24925@LK-Perkele-V2.elisa-laajakaista.fi> <920ab06c-f0f1-2d43-52d8-d76d718b3121@akamai.com> From: Eric Rescorla Date: Wed, 8 Mar 2017 13:46:43 -0800 Message-ID: To: Benjamin Kaduk Content-Type: multipart/alternative; boundary=001a114bbb32e63b53054a3f125e Archived-At: Cc: "" Subject: Re: [TLS] TLS 1.3 Record Layer Format X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Mar 2017 21:47:27 -0000 --001a114bbb32e63b53054a3f125e Content-Type: text/plain; charset=UTF-8 FWIW, I think DTLS 1.3 should just do this (and other header shortening stuff). I don't know of any evidence that there are policy enforcement boxes for DTLS -Ekr On Wed, Mar 8, 2017 at 1:27 PM, Benjamin Kaduk wrote: > On 03/08/2017 04:25 AM, Hannes Tschofenig wrote: > > Hi Ilari, > > yes, I am exactly talking about these bytes that are useless to send > around in some deployment environments. > > I would expect to at least provide the option of not sending the data in > some cases would be useful. > > > > I would not expect us to provide that option. The cost of introducing a > negotiation mechanism and interop headaches does not seem worth the gain of > three octets per encrypted record. > > -Ben > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > --001a114bbb32e63b53054a3f125e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
FWIW, I think DTLS 1.3 should just do this (and other head= er shortening stuff).
I don't know of any evidence that there are p= olicy enforcement boxes for DTLS

-Ekr


On = Wed, Mar 8, 2017 at 1:27 PM, Benjamin Kaduk <bkaduk@akamai.com> wrote:
=20 =20 =20
On 03/08/2017 04:25 AM, Hannes Tschofenig wrote:
Hi Ilari,

yes, I am exactly talking about these bytes that are useless to send
around in some deployment environments.

I would expect to at least provide the option of not sending the data in
some cases would be useful.

I would not expect us to provide that option.=C2=A0 The cost of introducing a negotiation mechanism and interop headaches does not seem worth the gain of three octets per encrypted record.

-Ben

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--001a114bbb32e63b53054a3f125e-- From nobody Wed Mar 8 13:50:29 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1BE6B12961B for ; Wed, 8 Mar 2017 13:50:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cHtsQ54AXx0Y for ; Wed, 8 Mar 2017 13:50:27 -0800 (PST) Received: from mail-qk0-x230.google.com (mail-qk0-x230.google.com [IPv6:2607:f8b0:400d:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 585671296FF for ; Wed, 8 Mar 2017 13:50:25 -0800 (PST) Received: by mail-qk0-x230.google.com with SMTP id y76so90056838qkb.0 for ; Wed, 08 Mar 2017 13:50:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=T9qMUe1ar3MdXSeI2R97GOt6z2VK7s7b1dAJ2HzZduI=; b=ENj7p+8XtMuI8+jJDFyvWVO4v5kbSm3FPZru3ssuwzJc2yVPkmBeuWWhwsnM8xCI1Z KU96sqpWhDEmUYx+1r4FRZvTnF15bqrhCpeHULrRX8b/jPkmqGeyG1DbW/HHiBi7NSEv JF+8zJy4YNJ9hPpsleG4Ym634Np3WdlKnG8CY7K4OA+tiBR+IVircPZTqdJwM+SdSi49 AsW2kLpLyKv2UG8nDrPPuxpQxEEpOrrPyal+qg88zxLYNHmGyeuHPXNrB44HIxwkG7gb S4bbBnP1Nksh9lh2ZL7hJH07hnslITcpJkRK1OJxlX1V5PnrRuqDXmt8TxufmZNxIw8t fsqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=T9qMUe1ar3MdXSeI2R97GOt6z2VK7s7b1dAJ2HzZduI=; b=SmQiYYrZc9Mv+S0YnJOOuWTpE386IDKIrjzDuo60gGikfOLpqiQNLl9ELPsrZLOqhM /IwbvB/T4iwa52afzQ+Ju0L/6if7RKCXxFFRtxXv/haWk7c5L8Vzn/Oszh76woDY0cLx iTw4cqukqQcvV1cC8UNtKFus4JDzJuyqyjcHDzjekR4j5VImIb+szsz0P+fmbxrsPhjk g399hh9/svqlEdpbLuG7Wyev3tw6SwteJvvhCZEPgCzUFhMkllr47RjvMsUDgoIlSqx+ 8WgfleObbk7AsF7YeGPG9s+q7FtkshxEwPpa3iLUg/bk6x6Ce1sQf/CBjGVCQRF0gt9y +PJQ== X-Gm-Message-State: AFeK/H0KYcjpm2coBQ1aaYrggC/WEAA8W8oanHrW5hoyTBXrWcLcOspiaBh3Ge1EgOR2t7I3wHiKH061gd/1rQ== X-Received: by 10.55.5.146 with SMTP id 140mr9533981qkf.202.1489009824514; Wed, 08 Mar 2017 13:50:24 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.19.112 with HTTP; Wed, 8 Mar 2017 13:50:23 -0800 (PST) In-Reply-To: References: <296debba-b5a5-d063-4e01-59a3f110fe14@gmx.net> <20170306155516.GA24925@LK-Perkele-V2.elisa-laajakaista.fi> <920ab06c-f0f1-2d43-52d8-d76d718b3121@akamai.com> From: Martin Thomson Date: Thu, 9 Mar 2017 08:50:23 +1100 Message-ID: To: Eric Rescorla Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "" Subject: Re: [TLS] TLS 1.3 Record Layer Format X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Mar 2017 21:50:28 -0000 On 9 March 2017 at 08:46, Eric Rescorla wrote: > FWIW, I think DTLS 1.3 should just do this (and other header shortening > stuff). > I don't know of any evidence that there are policy enforcement boxes for > DTLS Definitely. I also think that DTLS 1.3 could stand to lose a few sequence number and epoch octets at the same time. We have some lessons from QUIC that will help there (for instance, we only need to signal three epoch values, and two octets of sequence number space is probably too lean). From nobody Wed Mar 8 17:29:49 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7664D12953C for ; Wed, 8 Mar 2017 17:29:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M7SbTYLRWar3 for ; Wed, 8 Mar 2017 17:29:46 -0800 (PST) Received: from mail-yw0-x235.google.com (mail-yw0-x235.google.com [IPv6:2607:f8b0:4002:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D66331295D3 for ; Wed, 8 Mar 2017 17:29:45 -0800 (PST) Received: by mail-yw0-x235.google.com with SMTP id o4so1463451ywd.3 for ; Wed, 08 Mar 2017 17:29:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=8nHIoUhWVVm8LtDZCDGNkOcUxFricNV2onfLxWLqOtQ=; b=HZNdjYaBSdBgbYypaLyaVw3vuXYZ6Giu0Q3lQTaDpuzX8IOa7WuX/IMBTJ8Jf+V9DR xT1+24MQuLVtCkZJQ55Lbe9SN2yRXVoeQps6kT+R1dCbCbyvDcss/qiHhddF8upSKgbj 5vER9fZxMxbWo4aRoWO2ZYWOckOWrYplkJwioefdGtYNQzC1ZhuXvVZpe2i2BYsNaL+G dzEeiumeHWOzR0o9E3zPI5RgOsGA0I4LDdeuFU3peOgNeHbL6Gv2XXamv5f9Ee2kN0qh 5Ve/lPF+yh+jPWmUmk9XtpseBmVdqRnitKGIL95Wz76XM7WGHY9guwZCZ/1Mh6JjOiIh S7Gg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=8nHIoUhWVVm8LtDZCDGNkOcUxFricNV2onfLxWLqOtQ=; b=IPqLc/Z5KSZXTMxJyuCxI+YW8R9b97LM8tr5I4+edeWBAuD6RoLmb3BK9hLvlE6qNk KK0oi2qe7Y5KiHilaJ3v4VfkhV7UvXr1VdQEk3jT62k5FuqPIEp23gWhrVo3oXmxUw5F Cvhm2P2rZY48CAqNnFRWjIbA0V4ZHQzNsi+nrfPeehoUe+pqTuyUCSHMLhM0Nzp8V2G9 TakxMra0dMDNMTMhcXbdZ+2KNZ7PIepNXZLHCViLt2bgigaPdrKyOBKFnZV0mmk9jdx1 A+5/zSuj+V/yWSNQMMp0sW0xjJuqGXX3DUqY6jBjgFzz80HFWHyL5lXBqU6X5U2eQ9kt 3Www== X-Gm-Message-State: AMke39mSxZk9Wys15lqzyNtaAAijEXB9hAoZxcNMK16OizhHUA977oqYjveel4EXfRuk08Pj3n/CYKVHj98SIw== X-Received: by 10.129.125.5 with SMTP id y5mr2317723ywc.120.1489022984781; Wed, 08 Mar 2017 17:29:44 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Wed, 8 Mar 2017 17:29:04 -0800 (PST) In-Reply-To: References: From: Eric Rescorla Date: Wed, 8 Mar 2017 17:29:04 -0800 Message-ID: To: "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a11493644122545054a422e7a Archived-At: Subject: Re: [TLS] (no subject) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 01:29:48 -0000 --001a11493644122545054a422e7a Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Based on people's seeming mild preference for option #1, I have produced: https://github.com/tlswg/tls13-spec/pull/901 I'll merge this tomorrow absent some loud screaming. -Ekr On Thu, Feb 9, 2017 at 1:17 PM, Eric Rescorla wrote: > Hi folks, > > We need to close on an issue about the size of the > state in the HelloRetryRequest. Because we continue the transcript > after HRR, if you want a stateless HRR the server needs to incorporate > the hash state into the cookie. However, this has two issues: > > 1. The "API" for conventional hashes isn't designed to be checkpointed > at arbitrary points (though PKCS#11 at least does have support > for this.) > 2. The state is bigger than you would like b/c you need to store both > the compression function and the "remainder" of bytes that don't > fit in [0] > > Opinions differ about how severe all this is, but it's certainly > unaesthetic, and it would be nice if the state that was stored in > the HRR cookie was just a hash output. There seem to be three > major approaches for this (aside from "do nothing"). > > 1. Special case HRR and say that the transcript is either > > CH || SH .... (no HRR) > > or > > Hash(CH1) || HRR || CH ... (HRR) [1] > > > 2. Pre-hash the messages, so that the handshake hash > becomes: > > Handshake_hash_N =3D Hash(Hash(msg_1) || Hash(msg_2) > ... Hash(msg_N)) > > 3. Recursively hash, so that the handshake hash becomes: > > Handshake_hash_N=3D Hash(Handshake_hash_N-1 || msg_N) > > [As Antoine Delignat-Lavaud points out, this is basically making > a new Merkle-Damgard hash with H as the compression function.] > > > I've posted PR#876, which implements version #2, but we could do any one > of the three. > and they all have the same state size. The argument for #1 seems to be > that it's the minimal change, and also the minimal overhead, and the > argument against is that it's non-uniform because CH1 is treated > differently. We might imagine making it seem more uniform by also > hashing HRR but that doesn't make the code any simpler. Versions #2 > and #3 both are more uniform but also more complicated changes. > > The arguments for #2 versus #3 are that #3 is somewhat faster > (consider the case where you have a short message to add, #2 always > needs to run the compression function twice whereas #3 can run it > once). However, with #3 it is possible to take a hash for an unknown > transcript and create a new hash that matches that unknown transcript > plus an arbitrary suffix. This is already a property of the M-D > hashes we are using but it's worse here because those hashes add > padding and length at the end before finalizing, so an extension > wouldn't generally reflect a valid handshake transcript, whereas in > this case you get to append a valid message, because the padding is > added with every finalization stage. I don't know of any reason > why this would be a security issue, but I don't have any proof it's > not, either. > > I'd like to get the WG's thoughts on how to resolve this issue over the > next > week or so so we can close this out. > > -Ekr > > [0] The worst-case overhead for SHA-256 is > 64 bytes and for SHA-512 > it=E2=80=99s > 128 bytes. The average is half that. > > [1] We actually need to do something to make it injective, because > H(CH1) might look like a handshake message, but that should be easy. > > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > --001a11493644122545054a422e7a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Based on people's seeming mild preference for option #= 1, I have produced:

I'll merge this tomorrow absent some loud screaming.

-Ekr

<= br>
On Thu, Feb 9, 2017 at 1:17 PM, Eric Rescorla= <ek= r@rtfm.com> wrote:
Hi folks,

We need to close on an iss= ue about the size of the
state in the HelloRetryRequest. Because = we continue the transcript
after HRR, if you want a stateless HRR= the server needs to incorporate
the hash state into the cookie. = However, this has two issues:

1. The "API&quo= t; for conventional hashes isn't designed to be checkpointed
= =C2=A0 =C2=A0at arbitrary points (though PKCS#11 at least does have support=
=C2=A0 =C2=A0for this.)
2. The state is bigger than yo= u would like b/c you need to store both
=C2=A0 =C2=A0the compress= ion function and the "remainder" of bytes that don't
=C2=A0 =C2=A0fit in [0]

Opinions differ about ho= w severe all this is, but it's certainly
unaesthetic, and it = would be nice if the state that was stored in
the HRR cookie was = just a hash output. There seem to be three
major approaches for t= his (aside from "do nothing").

1. Specia= l case HRR and say that the transcript is either

= =C2=A0 =C2=A0CH || SH .... =C2=A0 (no HRR)
=C2=A0 =C2=A0
=C2=A0 =C2=A0 =C2=A0or
=C2=A0 =C2=A0 =C2=A0
=C2=A0 = =C2=A0Hash(CH1) || HRR || CH ... (HRR) =C2=A0[1]

<= br>
2. Pre-hash the messages, so that the handshake hash
=C2=A0 =C2=A0becomes:

=C2=A0 =C2=A0Handshake_has= h_N =3D Hash(Hash(msg_1) || Hash(msg_2)
=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0..= . Hash(msg_N))

3. Recursively hash, so that the ha= ndshake hash becomes:

=C2=A0 =C2=A0Handshake_hash_= N=3D Hash(Handshake_hash_N-1 || msg_N)

[As Antoine= Delignat-Lavaud points out, this is basically making
a new Merkl= e-Damgard hash with H as the compression function.]


I've posted PR#876, which implements version #2, but w= e could do any one of the three.
and they all have the same state= size. The argument for #1 seems to be
that it's the minimal = change, and also the minimal overhead, and the
argument against i= s that it's non-uniform because CH1 is treated
differently.= =C2=A0 We might imagine making it seem more uniform by also
hashi= ng HRR but that doesn't make the code any simpler. Versions #2
and #3 both are more uniform but also more complicated changes.
The arguments for #2 versus #3 are that #3 is somewhat fast= er
(consider the case where you have a short message to add, #2 a= lways
needs to run the compression function twice whereas #3 can = run it
once). However, with #3 it is possible to take a hash for = an unknown
transcript and create a new hash that matches that unk= nown transcript
plus an arbitrary suffix.=C2=A0 This is already a= property of the M-D
hashes we are using but it's worse here = because those hashes add
padding and length at the end before fin= alizing, so an extension
wouldn't generally reflect a valid h= andshake transcript, whereas in
this case you get to append a val= id message, because the padding is
added with every finalization = stage. I don't know of any reason
why this would be a securit= y issue, but I don't have any proof it's
not, either.

I'd like to get the WG's thoughts on how to r= esolve this issue over the next
week or so so we can close this o= ut.

-Ekr

[0] The wor= st-case overhead for SHA-256 is > 64 bytes and for SHA-512
it= =E2=80=99s > 128 bytes. The average is half that.

[1] We actually need to do something to make it injective, because
=
H(CH1) might look like a handshake message, but that should be easy.



_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--001a11493644122545054a422e7a-- From nobody Wed Mar 8 23:46:46 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 08440128E18 for ; Wed, 8 Mar 2017 23:46:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D4YwbGCHezYM for ; Wed, 8 Mar 2017 23:46:42 -0800 (PST) Received: from mail-wr0-x22a.google.com (mail-wr0-x22a.google.com [IPv6:2a00:1450:400c:c0c::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A27A11204D9 for ; Wed, 8 Mar 2017 23:46:41 -0800 (PST) Received: by mail-wr0-x22a.google.com with SMTP id l37so39038813wrc.1 for ; Wed, 08 Mar 2017 23:46:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:date:references:cc:to:message-id; bh=/mwn2UjE+gDKoaaV6jSfRg4LnCV9XwWRT3VEg4b5INs=; b=G3Ory0ncOm8aNIyHvmdNy+nE4zMr8jHkyvlrBPPsZd/c6iLBP1kyY+duGnlbjtXtfN GzvtH1R+ST3rAo6vI3rmAd36MxsQDBFLv/AqdnYjRzmOM8F4eLf6fR6/+PQShSIm1w+W dItEPd/DuGYZLiEwDlsiFV7qgZfjdsmP1hkA4WVF5tN8xsGfPxyMU/TBwXkgXCGVPxnR AQ2s8F+vMadj3HCrgz0//cRLNUMM6URfe1ZlIYlHzRYvU+yIC+PW/9vYbtQGtwfXEvK9 uteluO+E2RiE3StTIe8Ugxs2yFkRZs99xR5TeAY3E9f5DcYtNRCoT3dhqcCRCbIXEm7z vvhA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:cc:to :message-id; bh=/mwn2UjE+gDKoaaV6jSfRg4LnCV9XwWRT3VEg4b5INs=; b=Vlu72+T7ieCVKovc/JyMDVZ45aVYswU3DHnKJk1Y3Ajcr6cltuck9oCkvZUQarh47W n3fN+MU1PYNzfqkc1/aEX3SBFXkJyMQw7H3GlNMORytc3xwCkqT/JufqTT8IXOMsARso edqSexI3GsoQ/MYeVV80WBYNAR3OEVV8bXdHTtirNf26bMAG60OIzGrAcCaVGwL97C+J 2xrT8k9XU8kj0h+T4hEpaRqpOnNjFI5Xed3QyO0pJYatAiEmEEUMCvWEBe7IbbuUKA6e Ibf2QyR8V/8bDqLHT+0rhqsyksLuzGRN3kzIGuA5QXLneGN8Ynq7R90DWcLXdRAedYVc OMpQ== X-Gm-Message-State: AMke39mmMTHPuuqKTmBD2OS+P9hYyMFC9e+Zx23DkSpyFMbpSlZK+HNT7/Q/DHML7doZsQ== X-Received: by 10.223.134.157 with SMTP id 29mr8927793wrx.33.1489045599957; Wed, 08 Mar 2017 23:46:39 -0800 (PST) Received: from [172.24.250.100] (dyn32-131.checkpoint.com. [194.29.32.131]) by smtp.gmail.com with ESMTPSA id x1sm7098267wrd.63.2017.03.08.23.46.38 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 08 Mar 2017 23:46:39 -0800 (PST) From: Yoav Nir Content-Type: multipart/signed; boundary="Apple-Mail=_56674AF9-AE30-4DD9-BB79-27BD12DFC342"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Thu, 9 Mar 2017 09:46:35 +0200 References: To: "tls@ietf.org list" Message-Id: <82B83730-04EC-4BED-BB9E-4A8C56B52948@gmail.com> X-Mailer: Apple Mail (2.3259) Archived-At: Cc: Bert Wijnen Subject: [TLS] Fwd: OPS-DIR review of draft-ietf-tls-rfc4492bis-14 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 07:46:44 -0000 --Apple-Mail=_56674AF9-AE30-4DD9-BB79-27BD12DFC342 Content-Type: multipart/alternative; boundary="Apple-Mail=_7ADA0694-74AC-45DF-AD94-CC48B01834AF" --Apple-Mail=_7ADA0694-74AC-45DF-AD94-CC48B01834AF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Also forwarding to TLS I have created https://github.com/tlswg/rfc4492bis/pull/34 = I=E2=80=99ll merge this if there are no objections just before the = submission cut-off and submit a new version. Yoav > Begin forwarded message: >=20 > From: Yoav Nir > Subject: Re: OPS-DIR review of draft-ietf-tls-rfc4492bis-14 > Date: 9 March 2017 at 8:34:13 GMT+2 > To: "Bert Wijnen (IETF)" > Cc: draft-ietf-tls-rfc4492bis.all@ietf.org, "ops-dir@ietf.org" = >=20 > Hi, Bert. >=20 > Thanks for the review. See below >=20 > On 8 Mar 2017, at 20:14, Bert Wijnen (IETF) > wrote: >=20 >> I did the OPS Directorate review for draft-ietf-tls-rfc4492bis-14 >>=20 >> Summary:ready for publication >>=20 >> As far as I can tell, this document describes a number of ecc >> cipher suites that can be used by TLS servers and clients. It = describes >> the interaction btween the client and server for the various cipher >> suites used. >>=20 >> So for all I can tell, this has no operational or network management >> impacts on the internet. >>=20 >>=20 >> NITS: >> - abstract states: >>=20 >> protocol. In particular, it specifies the use of Ephemeral = Elliptic >> Curve Diffie-Hellman (ECDHE).... >>=20 >> I would have expected the acronym to be EECDH ??? >=20 > Well, yes. But this was the initialism used in the original RFC 4492 = in 2006, and now it=E2=80=99s used everywhere including in ciphersuite = names and in codebases everywhere. > Nor was this invented for 4492. Finite field Ephemeral Diffie-Hellman = has been referred to as DHE at least as far back as the TLS 1.0 RFC (RFC = 2246) from 1999. Probably earlier. >=20 >> in fact the text in section 2: >>=20 >> All of them use Ephemeral ECDH (ECDHE).... >> makes me think that indeed EECDH is a much better acronym or = abbreviation >> But you can ignore this, it is probably just my preference how I = would >> abbreviate. >=20 > I agree. But the term is used in codebases everywhere. We=E2=80=99re = probably as stuck with it as we are with the referer field: = https://tools.ietf.org/html/rfc7231#section-5.5.2 = >=20 > Another issue that came up in the discussion is in section 2.3: = ECDH_anon uses an ephemeral EC key, so it should have been ECDHE_anon. = This also follows the naming of the anonymous finite-field diffie = hellman in 2246: DH_anon. We decided not to change that. >=20 >> - Introdiuction states: >>=20 >> o the use of the Elliptic Curve Diffie-Hellman key agreement scheme = with ephemeral keys to establish the TLS premaster secret, and o the use = of ECDSA certificates for authentication of TLS peers. >>=20 >> Why do you use the full text (not acronym) in the first bullet and = only an acronym in the 2nd bullet? Bert >=20 > Good point. Since these are expanded in the abstract, I guess I can = just use the initialism in there. But I definitely should mention EdDSA = in the second bullet. >=20 > Yoav --Apple-Mail=_7ADA0694-74AC-45DF-AD94-CC48B01834AF Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Also forwarding to TLS

I have created https://github.com/tlswg/rfc4492bis/pull/34

I=E2=80=99ll merge this = if there are no objections just before the submission cut-off and submit = a new version.

Yoav

Begin forwarded = message:

From: = Yoav Nir <ynir.ietf@gmail.com>
Subject: = Re: OPS-DIR = review of draft-ietf-tls-rfc4492bis-14
Date: = 9 March 2017 at 8:34:13 = GMT+2
To: = "Bert Wijnen (IETF)" <bwietf@bwijnen.net>
Cc: draft-ietf-tls-rfc4492bis.all@ietf.org, "ops-dir@ietf.org" <ops-dir@ietf.org>

Hi, Bert.

Thanks for the review.  See = below

On 8 Mar 2017, at 20:14, Bert Wijnen (IETF) = <bwietf@bwijnen.net> wrote:

I did the OPS Directorate review for = draft-ietf-tls-rfc4492bis-14

Summary:ready = for publication

As far as I can tell, this = document describes a number of ecc
cipher suites that can = be used by TLS servers and clients. It describes
the = interaction btween the client and server for the various cipher
suites used.

So for all I can = tell, this has no operational or network management
impacts = on the internet.


NITS:
- abstract states:

  protocol.  In particular, it specifies the = use of Ephemeral Elliptic
  Curve Diffie-Hellman = (ECDHE)....

 I would have expected the = acronym to be EECDH ???

Well, yes. But this was the initialism = used in the original RFC 4492 in 2006, and now it=E2=80=99s used = everywhere including in ciphersuite names and in codebases = everywhere.
Nor was this invented for 4492. Finite = field Ephemeral Diffie-Hellman has been referred to as DHE at least as = far back as the TLS 1.0 RFC (RFC 2246) from 1999. Probably = earlier.

 in fact the text in = section 2:

   All of them = use Ephemeral ECDH (ECDHE)....
  makes me think = that indeed EECDH is a much better acronym or abbreviation
 But you can ignore this, it is probably just my = preference how I would
 abbreviate.

I= agree. But the term is used in codebases everywhere. We=E2=80=99re = probably as stuck with it as we are with the referer field: https://tools.ietf.org/html/rfc7231#section-5.5.2

Another issue that came = up in the discussion is in section 2.3: ECDH_anon uses an ephemeral EC = key, so it should have been ECDHE_anon.  This also follows the = naming of the anonymous finite-field diffie hellman in 2246: DH_anon. =  We decided not to change that.

- Introdiuction states:

o the = use of the Elliptic Curve Diffie-Hellman key agreement scheme with = ephemeral keys to establish the TLS premaster secret, and o the use of = ECDSA certificates for authentication of TLS peers.

Why do you use the full text (not acronym) in the first = bullet and only an acronym in the 2nd bullet? Bert

Good point. Since these are expanded in the abstract, I guess = I can just use the initialism in there.  But I definitely should = mention EdDSA in the second bullet.

Yoav

= --Apple-Mail=_7ADA0694-74AC-45DF-AD94-CC48B01834AF-- --Apple-Mail=_56674AF9-AE30-4DD9-BB79-27BD12DFC342 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYwQhcAAoJELhJCxUKWMyZTe8H/2cKrBv3CgpGhJxMYDSZRiVr Lbabtx3NKGKQcVVpgLpyx5tOE3ZjdMH4ZOJDFH1niuIN3d4752tkftAzGZKa1uRO eT/SUDd3Rp7xRBE/PqqWfJeA0VBO+5LBcWhW+KUw7/hXzCXCN8hftt5upfXjmjbr sJewRqv5KVANyzoraJLF0Jd0v+vKMo4Mcxo2n/ZY1M0/D/QeAh4cz5QQyfk/RISx /HmRGqALpnoFQUtwlAqZCvDIRdshQRp0Yw6Rb4/+qTnaLDexBINmdCthQ2QvcBft VQ5m8LA1WHSxNIqn/E9f6XbRUXj0pJ8wMZ8Ajs7/mfnBNDRtN5ifxA4imfVL7/A= =x2dJ -----END PGP SIGNATURE----- --Apple-Mail=_56674AF9-AE30-4DD9-BB79-27BD12DFC342-- From nobody Thu Mar 9 02:52:12 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C34212943F for ; Thu, 9 Mar 2017 02:52:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.922 X-Spam-Level: X-Spam-Status: No, score=-6.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XRdUO9FPAZwC for ; Thu, 9 Mar 2017 02:52:10 -0800 (PST) Received: from smtpde01.smtp.sap-ag.de (smtpde01.smtp.sap-ag.de [155.56.68.170]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 438881294FD for ; Thu, 9 Mar 2017 02:52:10 -0800 (PST) Received: from mail07.wdf.sap.corp (mail04.sap.corp [194.39.131.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtpde01.smtp.sap-ag.de (Postfix) with ESMTPS id 3vf6fJ0mbNz1J3m; Thu, 9 Mar 2017 11:52:08 +0100 (CET) X-purgate-ID: 152705::1489056728-0000521C-3B25422C/0/0 X-purgate-size: 1000 X-purgate: clean X-purgate: This mail is considered clean (visit http://www.eleven.de for further information) X-purgate-Ad: Categorized by eleven eXpurgate (R) http://www.eleven.de X-purgate-type: clean X-SAP-SPAM-Status: clean Received: from ld9781.wdf.sap.corp (ld9781.wdf.sap.corp [10.21.82.193]) by mail07.wdf.sap.corp (Postfix) with ESMTP id 3vf6fH5HVBzGpGB; Thu, 9 Mar 2017 11:52:07 +0100 (CET) Received: by ld9781.wdf.sap.corp (Postfix, from userid 10159) id A93041A63F; Thu, 9 Mar 2017 11:52:07 +0100 (CET) In-Reply-To: To: Ben Schwartz Date: Thu, 9 Mar 2017 11:52:07 +0100 (CET) X-Mailer: ELM [version 2.4ME+ PL125 (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="US-ASCII" Message-Id: <20170309105207.A93041A63F@ld9781.wdf.sap.corp> From: mrex@sap.com (Martin Rex) Archived-At: Cc: tls@ietf.org Subject: Re: [TLS] New Draft: Using DNS to set the SNI explicitly X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: mrex@sap.com List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 10:52:12 -0000 Ben Schwartz wrote: > > Like a lot of people here, I'm very interested in ways to reduce the > leakage of users' destinations in the ClientHello's cleartext SNI. It > seems like the past and current proposals to fix the leak are pretty > difficult, involving a lot of careful cryptography and changes to clients > and servers. It is formally provable that there is no solution to the problem that you're describing. While you can come up with all kinds of fancy and complicated schemes that are sufficient to provide you the illusion that you're looking for, the best you can come up with, will *be* an illusion. But some of those illusions will cause lots of pain for implementors and make the whole thing fragile and cause interop problems. The situation is pretty similar for the hiding of the ContentType in TLSv1.3 records. It is formally provable that this can not provide value, but it make implementations harder and reliably break some existing stuff. -Martin From nobody Thu Mar 9 03:50:07 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B430C129558 for ; Thu, 9 Mar 2017 03:50:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.903 X-Spam-Level: X-Spam-Status: No, score=-6.903 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1kZtDfPFEAbC for ; Thu, 9 Mar 2017 03:50:05 -0800 (PST) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 41E0C129550 for ; Thu, 9 Mar 2017 03:50:05 -0800 (PST) Received: from smtp.corp.redhat.com (int-mx16.intmail.prod.int.phx2.redhat.com [10.5.11.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id D4A0B61D1E; Thu, 9 Mar 2017 11:50:05 +0000 (UTC) Received: from pintsize.usersys.redhat.com (dhcp-0-115.brq.redhat.com [10.34.0.115]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 9A3E02DB42; Thu, 9 Mar 2017 11:50:05 +0000 (UTC) From: Hubert Kario To: tls@ietf.org Date: Thu, 09 Mar 2017 12:50:03 +0100 Message-ID: <30393367.Vf37kWhi1s@pintsize.usersys.redhat.com> In-Reply-To: References: MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart1845002.JjO4mzHfmc"; micalg="pgp-sha512"; protocol="application/pgp-signature" X-Scanned-By: MIMEDefang 2.74 on 10.5.11.28 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Thu, 09 Mar 2017 11:50:05 +0000 (UTC) Archived-At: Subject: Re: [TLS] (no subject) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 11:50:06 -0000 --nextPart1845002.JjO4mzHfmc Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" On Thursday, 9 February 2017 22:17:33 CET Eric Rescorla wrote: > Hi folks, >=20 > We need to close on an issue about the size of the > state in the HelloRetryRequest. Because we continue the transcript > after HRR, if you want a stateless HRR the server needs to incorporate > the hash state into the cookie. However, this has two issues: Isn't the whole CH2 supposed to be deterministically created from CH1 and H= RR? So you should be able (as the server) to recreate the CH1 given the hash (o= r=20 better yet, keyed HMAC) of the CH1 fairly easily? Bonus point: you=20 automatically reject technically malformed CH2 messages (ones with more=20 changes than prescribed) as you won't be able to create a CH1 that creates = the=20 matching HMAC. I do not think that stateless HRR is special enough to mess around with=20 message transcript hash... =2D-=20 Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purky=C5=88ova 99/71, 612 45, Brno, Czech Republic --nextPart1845002.JjO4mzHfmc Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAABCgAGBQJYwUFrAAoJEJKo0bgB0vX191sP/0USCORIF8yTXS/id1KbHguv NT91zaIVBTLzr9J1uMaQbFaMEuALB2XxjsoM+gXYnM/NhJKPbzDxrHqAYFkY1Cns AejLWCXTRg3g1X5xpd2dFwl8R9GtSMbxKT7Qsb64osm9Ijb3HaE8dWmpK/Erz4uf shvQrXn1ilB9jyQedK1hNMw5BksofuOEYYaLLeUN2jXapQ/ik4DKrpLvoHkvBw+J B7oVLeYAZYuQhgINyBSAw6od37MHN/EsYKb76r8KOFhtfvMUABGIOc8tgbdOWmIq wggoKmGf1+Tc7b9wgE+iMkxxl/YI3TaSXeiOxYiW+USR4SJfULF3B19UVmHp7VnN 207L4szr9n+B1dUHXG8XbCx5OaR3WnU2yHSqofkVITMedWXt58Tkf7HoPYvWq/02 qHDJlBqsq8sOgiY7yZTaIluzsCnZ1cT0MtwAAGB4/2ZmVIq69VB9z2+CLEZBP0u2 LPGHzLaeUokNbo11O3u2HBE7ukATrU8OYmzZHBNHwI3+N3RPnouKjSng68tDrbLP yxsVlSvBQ01a3FrNPnQ77eLHJf27PZNDXVcw4bK5K7HnlSZ1pOl9pBzIsmVKO7xW yIkAjaoLmR2fxGm2kouom2ZXLcj87fVWybmrKX6bOn4NE+IWLouJR6BpVwhrvi3c jzkILsLj5garWZk+e07S =Ogca -----END PGP SIGNATURE----- --nextPart1845002.JjO4mzHfmc-- From nobody Thu Mar 9 03:55:51 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EEE13129564 for ; Thu, 9 Mar 2017 03:55:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kJuKp35u4OtN for ; Thu, 9 Mar 2017 03:55:46 -0800 (PST) Received: from rmdccgokm1.reyn.mcr.dc.comodo.net (sgomail.comodogroup.com [IPv6:2a02:1788:402:430::9708:41f4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E280112953A for ; Thu, 9 Mar 2017 03:55:45 -0800 (PST) Received: (korumail 29034 invoked from network); 9 Mar 2017 11:55:43 -0000 Received: from unknown (HELO maileu.comodo.net) () by 0 with SMTP; 9 Mar 2017 11:55:43 -0000 Received: from [192.168.0.58] ([192.168.0.58]) by maileu.comodo.net (IceWarp 11.4.5.0 DEB8 x64) with ASMTP (SSL) id 201703091155438164; Thu, 09 Mar 2017 11:55:43 +0000 To: Hannes Tschofenig References: <1cf1ff2e-3784-eac0-461f-335c043a8917@gmx.net> From: Rob Stradling Message-ID: <6d6ca0f7-9376-12f6-f4fc-b86484d06db1@comodo.com> Date: Thu, 9 Mar 2017 11:55:43 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: <1cf1ff2e-3784-eac0-461f-335c043a8917@gmx.net> X-SMTP-Filter: Korumail SMTP Filter Engine Korumail 6.5 X-KORUMAIL-Result: Clean (Content eval: 0.000000 points) X-KORUMAIL-Reason: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Certificate compression draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 11:55:51 -0000 Hi Hannes. Cached-Info is useful, but it can only "compress" if the client has previously seen and cached the server's certificate. AIUI, the purpose of draft-ghedini-tls-certificate-compression is to enable compression even in cases where the client hasn't yet seen the server's certificate. On 07/03/17 08:14, Hannes Tschofenig wrote: > Hi Victor > > why don't you use RFC 7924: > https://tools.ietf.org/html/rfc7924 > > This provides an even better "compression" ratio. > > Ciao > Hannes > > > On 03/06/2017 11:58 PM, Victor Vasiliev wrote: >> Certificate compression has been discussed on this list briefly before, and >> there was some interest in at least considering a draft for it. The >> draft now >> exists (co-authored by Alessandro and myself), and it can be found at: >> >> https://datatracker.ietf.org/doc/draft-ghedini-tls-certificate-compression/ >> [ GitHub repo: https://github.com/ghedo/tls-certificate-compression ] >> >> The proposed scheme allows a client and a server to negotiate a compression >> algorithm for the server certificate message. The scheme is purely >> opt-in on >> both sides. The current version of the draft defines zlib and Brotli >> compression, both of which are well-specified formats with an existing >> deployment experience. >> >> There are multiple motivations to compress certificates. The first one >> is that >> the smaller they are, the faster they arrive (both due to the transfer >> time and >> a decreased chance of packet loss). >> >> The second, and more interesting one, is that having small certificates is >> important for QUIC in order to achieve 1-RTT handshakes while limiting the >> opportunities for amplification attacks. Currently, TLS 1.3 over TCP >> without >> client auth looks like this: >> >> Round trip 1: client sends SYN, server sends SYN ACK >> Here, the server provides its own random value which client will >> have to echo in the future. >> Round trip 2: client sends ACK, ClientHello, server sends >> ServerHello...Finished >> Here, ACK confirms to server that the client can receive packets and >> is not >> just spoofing its source address. Server can send the entire >> ServerHello to >> Finished flight. >> >> In QUIC, we are trying to merge those two rounds into one. The problem, >> however, is that the ClientHello is one packet, and >> ServerHello...Finished can >> span multiple packets, meaning that this could be used as an amplification >> attack vector since the client's address is not yet authenticated at >> this point. >> In order to address this, the server has to limit the number of packets >> it sends >> during the first flight (i.e. ServerHello...Finished flight). Since >> certificates make up the majority of data in that flight, making them >> smaller >> can push them under the limit and save a round-trip. >> >> Cheers, >> Victor. -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From nobody Thu Mar 9 04:50:02 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7CA6F129526 for ; Thu, 9 Mar 2017 04:50:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ty4Z9q3bm6jd for ; Thu, 9 Mar 2017 04:50:00 -0800 (PST) Received: from welho-filter1.welho.com (welho-filter1.welho.com [83.102.41.23]) by ietfa.amsl.com (Postfix) with ESMTP id B0C8812957B for ; Thu, 9 Mar 2017 04:41:17 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by welho-filter1.welho.com (Postfix) with ESMTP id F14071F33F; Thu, 9 Mar 2017 14:41:14 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp2.welho.com ([IPv6:::ffff:83.102.41.85]) by localhost (welho-filter1.welho.com [::ffff:83.102.41.23]) (amavisd-new, port 10024) with ESMTP id o2EfCiR1Qtkz; Thu, 9 Mar 2017 14:41:14 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp2.welho.com (Postfix) with ESMTPSA id BF05521C; Thu, 9 Mar 2017 14:41:14 +0200 (EET) Date: Thu, 9 Mar 2017 14:41:08 +0200 From: Ilari Liusvaara To: Hubert Kario Message-ID: <20170309124108.GA31263@LK-Perkele-V2.elisa-laajakaista.fi> References: <30393367.Vf37kWhi1s@pintsize.usersys.redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <30393367.Vf37kWhi1s@pintsize.usersys.redhat.com> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Cc: tls@ietf.org Subject: Re: [TLS] (no subject) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 12:50:01 -0000 On Thu, Mar 09, 2017 at 12:50:03PM +0100, Hubert Kario wrote: > On Thursday, 9 February 2017 22:17:33 CET Eric Rescorla wrote: > > Hi folks, > > > > We need to close on an issue about the size of the > > state in the HelloRetryRequest. Because we continue the transcript > > after HRR, if you want a stateless HRR the server needs to incorporate > > the hash state into the cookie. However, this has two issues: > > Isn't the whole CH2 supposed to be deterministically created from CH1 and HRR? No. Neither CH1 nor CH2 are deterministic w.r.t. one another. > So you should be able (as the server) to recreate the CH1 given the hash (or > better yet, keyed HMAC) of the CH1 fairly easily? Bonus point: you > automatically reject technically malformed CH2 messages (ones with more > changes than prescribed) as you won't be able to create a CH1 that creates the > matching HMAC. Actually, you can't create CH1 from just CH2. Back some versions it was merely very annoying to do so, now (as in -18), you can't do it at all. -Ilari From nobody Thu Mar 9 08:50:31 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 37EB2129408 for ; Thu, 9 Mar 2017 08:50:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.639 X-Spam-Level: X-Spam-Status: No, score=-1.639 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, KHOP_DYNAMIC=1.08, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fb.com header.b=Dh0xP1MO; dkim=pass (1024-bit key) header.d=fb.onmicrosoft.com header.b=kmcH8y2+ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aFj60qL6D6-Y for ; Thu, 9 Mar 2017 08:50:29 -0800 (PST) Received: from mx0a-00082601.pphosted.com (mx0a-00082601.pphosted.com [67.231.145.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1FEE3128B44 for ; Thu, 9 Mar 2017 08:50:29 -0800 (PST) Received: from pps.filterd (m0044012.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v29GeLwS016860 for ; Thu, 9 Mar 2017 08:50:26 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.com; h=from : to : subject : date : message-id : content-type : mime-version; s=facebook; bh=cfcX/BRP3O79okytBoXAYDZu2RFfUsMXSFcsdieOwlM=; b=Dh0xP1MOvCthSRNsspsU7CysO+ofhPROyPcxoYVQSZD+r8vvIFF3rSvvrxs7gn/BFqcW bR/HWhBNOYauA2c2E+/YQIEO490E5C3/nB955h6BRePvRbfbNztHtBtQgmwJpMI9jeG6 uYiXjj/q2c20DiDLQqli36dEv/b+PboeFlI= Received: from maileast.thefacebook.com ([199.201.65.23]) by mx0a-00082601.pphosted.com with ESMTP id 29398p8dxa-1 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Thu, 09 Mar 2017 08:50:26 -0800 Received: from NAM02-CY1-obe.outbound.protection.outlook.com (192.168.183.28) by o365-in.thefacebook.com (192.168.177.23) with Microsoft SMTP Server (TLS) id 14.3.319.2; Thu, 9 Mar 2017 11:50:25 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.onmicrosoft.com; s=selector1-fb-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=cfcX/BRP3O79okytBoXAYDZu2RFfUsMXSFcsdieOwlM=; b=kmcH8y2+jaN5/tlVxlUobz99Bwr62d0CoMi/OshkrG0lu6XWiIk8gLP/0gSyFiDumVsYCtcQ4v1LNqQuCTc+Z7dsVv87Reo5eCfni6Zc5BaLXd38U8b1anlDdh1IxlXKsshfr1c8nSw0Ke3W4nN6GbmwUHSa4YDao/7HCy0Shis= Received: from MWHPR15MB1455.namprd15.prod.outlook.com (10.173.234.145) by MWHPR15MB1456.namprd15.prod.outlook.com (10.173.234.146) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.947.12; Thu, 9 Mar 2017 16:50:24 +0000 Received: from MWHPR15MB1455.namprd15.prod.outlook.com ([10.173.234.145]) by MWHPR15MB1455.namprd15.prod.outlook.com ([10.173.234.145]) with mapi id 15.01.0947.020; Thu, 9 Mar 2017 16:50:24 +0000 From: Subodh Iyengar To: "tls@ietf.org" Thread-Topic: New version of delegated credentials draft Thread-Index: AQHSmPP/FIWgELXdr0yTfDplvTVEBg== Date: Thu, 9 Mar 2017 16:50:24 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=fb.com; x-originating-ip: [25.173.47.4] x-ms-office365-filtering-correlation-id: 86b4f827-fe9b-4a57-06ee-08d4670c61fe x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:MWHPR15MB1456; x-microsoft-exchange-diagnostics: 1; MWHPR15MB1456; 7:Pi7X1SCsjZuUG/OeV/OxICSdiJIdcxx2ooi21Npmyq2tUk6inF98HHvzZ2faxXKs1M/yNrKufPuHKNZZ0Hx07qFAWB5EwP3WmfkGZGTzM06cfWC5DxK9VUWFrIeabCBMb8ER4L3ivKOdmvgG+4NEUFazUDP3cMQLIOlhI6ckQ9grBcImtKts9ZzDXYWeOpDbLxeA/9GxGMN9ySl1O//Jx4dSlYKb+PyWfVX4mqkjbNa8SvnKoGLZ6AJoBoY/e83LksRE4bHUQRPzrJutvAwX9Pt3LfRFIRdhYLfw2lIQfz/jbiX7VxQz/BOZMoUC+AXxhAjLRCnpJjUySZIoFrHT7A==; 20:TmFaSkFR+F+/suZkbmTQPL9BrQK9XjMJuFv5drA9jD6F/Ocpb10fp7j3DAJRcgbxQaiFlb3EOMjHciVbBJv4Czq/Z9qyYfadAsZNwMoCVesNhy0nIvlcqTXwTROC/lVdw9bGh/yYPInUn/rpOCXcZjjhfF1c338uHTGKJMpnsRM= x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6041248)(20161123555025)(20161123560025)(20161123562025)(20161123564025)(20161123558025)(6072148); SRVR:MWHPR15MB1456; BCL:0; PCL:0; RULEID:; SRVR:MWHPR15MB1456; x-forefront-prvs: 0241D5F98C x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39410400002)(39450400003)(39830400002)(6116002)(53936002)(102836003)(3846002)(2900100001)(6916009)(9686003)(7696004)(6506006)(99286003)(6606003)(189998001)(236005)(7906003)(2501003)(50986999)(86362001)(5660300001)(7736002)(74316002)(54356999)(2906002)(606005)(106116001)(19627405001)(3280700002)(8676002)(66066001)(1730700003)(2351001)(77096006)(6436002)(5640700003)(3660700001)(8936002)(110136004)(6306002)(25786008)(38730400002)(33656002)(122556002)(81166006)(54896002)(55016002); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR15MB1456; H:MWHPR15MB1455.namprd15.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_MWHPR15MB1455DAA6FD1AD0FE7D002F00B6210MWHPR15MB1455namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Mar 2017 16:50:24.5267 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR15MB1456 X-OriginatorOrg: fb.com X-Proofpoint-Spam-Reason: safe X-FB-Internal: Safe X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-09_13:, , signatures=0 Archived-At: Subject: [TLS] New version of delegated credentials draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 16:50:30 -0000 --_000_MWHPR15MB1455DAA6FD1AD0FE7D002F00B6210MWHPR15MB1455namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Based on the comments during the last TLS WG meeting and the comments on th= e list, we've revised and submitted a new version of delegated credentials = https://www.ietf.org/id/draft-rescorla-tls-subcerts-01.txt. This has several salient changes from the previous version: * We trimmed the fat in the custom structure. The only fields that remain a= re a time and a public key, the necessities. * We changed the signature algorithm to sign not only the delegated structu= re, but also signs the EE certificate that issued it as well the TLS versio= n that was negotiated. This has some advantages over proxy certificates and= we describe these. * In the previous draft we described several alternatives. At the last WG m= eeting no one seemed particularly thrilled about using Name constrained cer= ts directly, but there was some enthusiasm around either the custom structu= re or proxy certificates. With the changes to signing in this draft, the cu= stom structure has some clear advantages, so we cleaned up the draft to rem= ove all the alternatives except the custom structure. * Required the presence of an extension in the EE certificate to allow the = use of delegated credentials. * Clarified the behavior of TLS 1.3 and TLS 1.2 clients and servers. I hope that the cleanup in this draft should make it much easier to discuss= going forward. Subodh --_000_MWHPR15MB1455DAA6FD1AD0FE7D002F00B6210MWHPR15MB1455namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Based on the comments during the last TLS WG meeting and the comments on= the list, we've revised and submitted a new version of delegated cred= entials  = https://www.ietf.org/id/draft-rescorla-tls-subcerts-01.txt.

This has several salient changes from the previous version:

* We trimmed the fat in the custom structure. The only fields that rem= ain are a time and a public key, the necessities.

* We changed the signature algorithm to sign not only the delegated st= ructure, but also signs the EE certificate that issued it as well the TLS v= ersion that was negotiated. This has some advantages over proxy certificate= s and we describe these.

* In the previous draft we described several alternatives. At the l= ast WG meeting no one seemed particularly thrilled about using Name co= nstrained certs directly, but there was some enthusiasm around either&= nbsp;the custom structure or proxy certificates. With the changes to signing in this draft, the custom structure&= nbsp;has some clear advantages, so we cleaned up the draft to rem= ove all the alternatives except the custom structure. 

* Required the presence of an extension in the EE certificate to allow= the use of delegated credentials.

* Clarified the behavior of TLS 1.3 and TLS 1.2 clients and servers.

I hope that the cleanup in this draft should make it much easier to di= scuss going forward.


Subodh

--_000_MWHPR15MB1455DAA6FD1AD0FE7D002F00B6210MWHPR15MB1455namp_-- From nobody Thu Mar 9 11:08:41 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D62DF1297D6 for ; Thu, 9 Mar 2017 11:08:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 17X8iDx3ZWkG for ; Thu, 9 Mar 2017 11:08:37 -0800 (PST) Received: from welho-filter4.welho.com (welho-filter4.welho.com [83.102.41.26]) by ietfa.amsl.com (Postfix) with ESMTP id 73B9B128824 for ; Thu, 9 Mar 2017 11:08:36 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by welho-filter4.welho.com (Postfix) with ESMTP id CDC352596E; Thu, 9 Mar 2017 21:08:34 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp2.welho.com ([IPv6:::ffff:83.102.41.85]) by localhost (welho-filter4.welho.com [::ffff:83.102.41.26]) (amavisd-new, port 10024) with ESMTP id SQGSKtOdBKFI; Thu, 9 Mar 2017 21:08:34 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp2.welho.com (Postfix) with ESMTPSA id 574FE27B; Thu, 9 Mar 2017 21:08:34 +0200 (EET) Date: Thu, 9 Mar 2017 21:08:28 +0200 From: Ilari Liusvaara To: Subodh Iyengar Message-ID: <20170309190828.GA31816@LK-Perkele-V2.elisa-laajakaista.fi> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] New version of delegated credentials draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 19:08:40 -0000 On Thu, Mar 09, 2017 at 04:50:24PM +0000, Subodh Iyengar wrote: > Based on the comments during the last TLS WG meeting and the > comments on the list, we've revised and submitted a new version > of delegated credentials https://www.ietf.org/id/draft-rescorla-tls-subcerts-01.txt. > > This has several salient changes from the previous version: > > * In the previous draft we described several alternatives. > At the last WG meeting no one seemed particularly thrilled > about using Name constrained certs directly, but there was > some enthusiasm around either the custom structure or proxy > certificates. With the changes to signing in this draft, the > custom structure has some clear advantages, so we cleaned up > the draft to remove all the alternatives except the custom > structure. On name constraints, name-constraining a wildcard certificate (e.g. to "redact" data from CT) could be useful to avoid default-vhost attacks against HTTP servers (there are lots of servers that are misconfigured). Especially in HTTP/2. > * Required the presence of an extension in the EE certificate > to allow the use of delegated credentials. I think this is going to be a major deployment problem. Basically, CAs move pretty much glacially. It is going to be much easier getting ECDSA certs (which are infamous for being difficult to get[1]). It seems that the only problematic SPKI OID is the general-purpose RSA one: 1.2.840.113549.1.1.1. One idea would be to restrict the extension OID to just those. Would likely make those wanting delegated certs to reach out for ECDSA, but it seems that most of the use of RSA when operator is actually able to make "choice" is because of "compatiblity"[2]. And compatiblity with ECDSA is of course no concern once subcerts are involved. > * Clarified the behavior of TLS 1.3 and TLS 1.2 clients and > servers. > > I hope that the cleanup in this draft should make it much > easier to discuss going forward. [1] Might not be actually true, but certainly ECDSA certs are more difficult to get than ECDSA ones. [2] The client support for ECDSA should be good enough already, unless you explicitly need to (and this is extremely rare) support very old clients. -Ilari From nobody Thu Mar 9 11:26:28 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EADB11297F0 for ; Thu, 9 Mar 2017 11:26:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, URI_TRY_3LD=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KqCx-MPIde8h for ; Thu, 9 Mar 2017 11:26:15 -0800 (PST) Received: from mail-it0-x22e.google.com (mail-it0-x22e.google.com [IPv6:2607:f8b0:4001:c0b::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CA6E212984B for ; Thu, 9 Mar 2017 11:26:14 -0800 (PST) Received: by mail-it0-x22e.google.com with SMTP id g138so73207532itb.0 for ; Thu, 09 Mar 2017 11:26:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=G42lMionbCDfUO7pfmgDMTHvSb+MwlOIj5MWJuNgs1s=; b=VDYzYvbJNPtxMbQfFoYMHjYE+DkFiAykGkdhKFDutDe8e4VszwTbjlk/xtK8ILpJoD SbqGY72/SsbRgs/egP7bwitCPQxrfZ7OO9tqcjuBfIn3IVAyqPpu93vUAVNpU4roZTZG 7tqAdcqH04gEWstmKj4lmg0lbXnJcdZZeyAte+y7xkIsfpEbiGQhMgPbfpNJxdnIuSAU sin6exF4YbK7HbFe95/0q8pdtd2aRSctTZXpoK6uKyH12os9C0Q+JbnhcAeUHGX01tW0 qVX0rQ7Cm8bx0D/lGpFoJqSTPkaTQhcal/fonG3OP9UMULfBqoeXxQdsZXyyhmeEIwuF aDPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=G42lMionbCDfUO7pfmgDMTHvSb+MwlOIj5MWJuNgs1s=; b=Al53q3GMYuRkrFEjjNAl2eC6C1ifn3Zd1buoW/Q+kH4VhFXNFem6LeefTBZLBy1nbs 6OLFTxBD8iZneCKQhKKYkiDW4naWDKTPxA1yU0+w6w/Zbj3bc1nxBJHFe5smblVq06Ju RvUdazE/V1j6I8Qir8nkTre2cBMvlnhUVs7kBM8T9wZCfRc/UV281EMojYZE1An3PM1b 442vXQcQRW2F6hHQ1xhjw4rYtdTU2ZaRun4BnNl2RpkZfAIS7md6VpzGcuEyINL2tJ20 RQPKanuC4XDkseA/KEGv5Y5bVkhS/jl5r7SeMq/wux994/xyl9p/p8xt4yjx703YRFsR zEAQ== X-Gm-Message-State: AMke39kji1VvXPbSuKDFPXiA7CTVwo+vRACMAob5CIPmGcQ/Xx/2/lSqUyjt7uuIOdcpOWWporMM+dMBhT1E2WVt X-Received: by 10.36.9.202 with SMTP id 193mr13514511itm.98.1489087574067; Thu, 09 Mar 2017 11:26:14 -0800 (PST) MIME-Version: 1.0 Received: by 10.107.7.207 with HTTP; Thu, 9 Mar 2017 11:26:13 -0800 (PST) In-Reply-To: <20170309105207.A93041A63F@ld9781.wdf.sap.corp> References: <20170309105207.A93041A63F@ld9781.wdf.sap.corp> From: Ben Schwartz Date: Thu, 9 Mar 2017 20:26:13 +0100 Message-ID: To: mrex@sap.com Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="001a11375fbee85b6f054a5137d2" Archived-At: Cc: "" Subject: Re: [TLS] New Draft: Using DNS to set the SNI explicitly X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 19:26:27 -0000 --001a11375fbee85b6f054a5137d2 Content-Type: multipart/alternative; boundary=001a11375fbee4a671054a5137b1 --001a11375fbee4a671054a5137b1 Content-Type: text/plain; charset=UTF-8 On Thu, Mar 9, 2017 at 11:52 AM, Martin Rex wrote: > Ben Schwartz wrote: > > > > Like a lot of people here, I'm very interested in ways to reduce the > > leakage of users' destinations in the ClientHello's cleartext SNI. It > > seems like the past and current proposals to fix the leak are pretty > > difficult, involving a lot of careful cryptography and changes to clients > > and servers. > > It is formally provable that there is no solution to the problem > that you're describing. > Perhaps I'm not trying to solve the problem that you're thinking of? Here's an example: Wordpress.com uses HTTPS, with a wildcard certificate (*.wordpress.com) for all its hosted blogs, which have domains of the form myblogname.wordpress.com. A passive adversary watching traffic to Wordpress.com can currently determine which blog each client IP address is accessing by observing the IP source address and the TLS SNI in the ClientHello message. With this proposal, if Wordpress were to set an SNI DNS record on each subdomain, with empty RDATA, compliant clients would omit SNI when contacting the Wordpress server. Connections would still work fine, but the passive adversary would no longer know which client is accessing which blog. Is there something wrong with this example that I am missing? While you can come up with all kinds of fancy and complicated schemes > that are sufficient to provide you the illusion that you're looking for, > the best you can come up with, will *be* an illusion. But some of > those illusions will cause lots of pain for implementors and make > the whole thing fragile and cause interop problems. > > The situation is pretty similar for the hiding of the ContentType > in TLSv1.3 records. It is formally provable that this can not provide > value, but it make implementations harder and reliably break some > existing stuff. > > -Martin > --001a11375fbee4a671054a5137b1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On T= hu, Mar 9, 2017 at 11:52 AM, Martin Rex <mrex@sap.com> wrote:
=
Ben Schwartz wrote:
>
> Like a lot of people here, I'm very interested in ways to reduce t= he
> leakage of users' destinations in the ClientHello's cleartext = SNI.=C2=A0 It
> seems like the past and current proposals to fix the leak are pretty > difficult, involving a lot of careful cryptography and changes to clie= nts
> and servers.

It is formally provable that there is no solution to the problem
that you're describing.

Perhaps I&#= 39;m not trying to solve the problem that you're thinking of?

Here's an example:
Wordpress.com uses HTTPS, = with a wildcard certificate (*.wordpress.c= om) for all its hosted blogs, which have domains of the form myblogname.wordpress.com.=C2=A0 A pas= sive adversary watching traffic to Wordpress.com can currently determine wh= ich blog each client IP address is accessing by observing the IP source add= ress and the TLS SNI in the ClientHello message.

W= ith this proposal, if Wordpress were to set an SNI DNS record on each subdo= main, with empty RDATA, compliant clients would omit SNI when contacting th= e Wordpress server.=C2=A0 Connections would still work fine, but the passiv= e adversary would no longer know which client is accessing which blog.

Is there something wrong with this example that I am m= issing?

While you can come up with all kinds of fancy and complicated schemes
that are sufficient to provide you the illusion that you're looking for= ,
the best you can come up with, will *be* an illusion.=C2=A0 But some of
those illusions will cause lots of pain for implementors and make
the whole thing fragile and cause interop problems.

The situation is pretty similar for the hiding of the ContentType
in TLSv1.3 records.=C2=A0 It is formally provable that this can not provide=
value, but it make implementations harder and reliably break some
existing stuff.

-Martin

--001a11375fbee4a671054a5137b1-- --001a11375fbee85b6f054a5137d2 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMdhJKC5aeSlGRk8YNMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE3MDIxNjE4MDA1NVoXDTE3MDgx NTE4MDA1NVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQC8JMN/Ya86Mmyv36dxJwPZXCrBZx8Hi0G6muYM3u+QThV/mu6B MpT3gEisJW8pU6iVPzxumyU7mDMwW8eshDTny91C+hTAP+cu1t4eIAmAZuNvXNd//DdmXOHvQvOU 2rH7+wTEYN0lvlSFydes0gud9VWl2hMTayncmyloIefNk/6lc2LRqw2geNw50jN1VqFpNMoxBOAp R+qJHuzxnanR4m3K1ujYUIeOUjLMFE4VxsOBtuF1FDx+SoXj18NpQyfioGPDXAgOIIE6PS244eZE 0De/SF3kvRf0AyCSrX102ZNu7i0L6Bb7P3bIDA0NB5uV5UNa2bBpuXq69gX07F/pAgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFB6zCsWx7DJYdsxPym0ajAsc2DNCMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQAckYJsVmfrg36lwFYD oepVYSEb0nhq9Y2/3T+cTKK/MCaU1oIRZ7LjmeFxkmA27jTy29y8+X+k5w9+I2E5vDI4D52vlKT+ FaouZnHGy1/oKZtUhMqjVn+DyEFdo1vOkir5R7cbxCK2QukpLQOb+RvzU5mOAYvwLgqn21yrcqBc 3pcYh4NlREjPe455gpwJl0d5TvYSCXEDUBXcWV7Bic7oVuPR0zXGsHQRQN7hkQsuEpwH0RhmaB/a GVYPktJvahNnk7JYoU8eRu7xwwA35VaXbUAuJCMq3UxAgBB59guHTeLZK9PSn0FqFo4sN12g4lsv ivmunuxPsD/Ozdn6yxtfMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMdhJKC5ae SlGRk8YNMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCB7/BDVBvhjeGW7qmpF3XHg vWXyOlSyQ0OcsuaaHNHHPjAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xNzAzMDkxOTI2MTRaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAc6eDhrmViF0QgQFcA7gkzzlhIcMlF4gaEYZHTAgR gWCzIas/3c3aZvUZV1UD/F8vzD1akmblCSQZD2dUbnVfiVczEureUYJnTtJd0yyePHbw5790AqIw hIVBqiBNNaF3XP0Q7DdtP75f45ILoT1aGR6ruPIGGJIc01iMRdJzKacpx79MbBRL9fY4B7sYDiw1 7PAiF74ULA7DkL2h+W9w3uuUd5QVwxDqzStX36IwqGe8y9Mj/c3kRK9denE7dRvsTb5DsXQWohOm gVd4OJ3tUnKWVJHQtNTH8jY+hSXdiwqzd8aTYiLzSkHNEe3kd2Z6kuvFr9jjDNDJSzjU6A8Saw== --001a11375fbee85b6f054a5137d2-- From nobody Thu Mar 9 11:45:16 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8247D129471 for ; Thu, 9 Mar 2017 11:45:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.499 X-Spam-Level: X-Spam-Status: No, score=-1.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_SORBS_SPAM=0.5, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sleevi.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y7Ct6EwFA3O0 for ; Thu, 9 Mar 2017 11:45:13 -0800 (PST) Received: from homiemail-a88.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B299012944E for ; Thu, 9 Mar 2017 11:45:13 -0800 (PST) Received: from homiemail-a88.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a88.g.dreamhost.com (Postfix) with ESMTP id 3D26AA003A0E for ; Thu, 9 Mar 2017 11:45:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sleevi.com; h=mime-version :in-reply-to:references:from:date:message-id:subject:to:cc :content-type; s=sleevi.com; bh=UBA/NoicBiwm9qlV96jPfebuoIA=; b= fHtceqXAd4cr0Rlk6Wky/g9o9NYLRg9XFIU/gWS4s2XzTkShHyjF8EA8KRKdUcyo CogXoogpvd/tJdlJvpZt1kt8YqztM+MwylIjTD6ysrhOrhJ+IE4VYsfE7mkpG5K9 ooA6uRAkTndP/91cPyUI9mQe92WxfI8b4orX79m5wnI= Received: from mail-lf0-f49.google.com (mail-lf0-f49.google.com [209.85.215.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: ryan@sleevi.com) by homiemail-a88.g.dreamhost.com (Postfix) with ESMTPSA id 05579A00012B for ; Thu, 9 Mar 2017 11:45:13 -0800 (PST) Received: by mail-lf0-f49.google.com with SMTP id z15so10595364lfd.1 for ; Thu, 09 Mar 2017 11:45:12 -0800 (PST) X-Gm-Message-State: AMke39nxaBByi8JjjqmLmvGoJN5AYsZEp5SCcGX342B0x2dNhhRipZvgF6e1SCnq7qBDygwTexmwPOAKo6U4RQ== X-Received: by 10.25.56.72 with SMTP id d8mr3719016lfj.2.1489088711070; Thu, 09 Mar 2017 11:45:11 -0800 (PST) MIME-Version: 1.0 Received: by 10.25.193.197 with HTTP; Thu, 9 Mar 2017 11:45:10 -0800 (PST) In-Reply-To: <20170309190828.GA31816@LK-Perkele-V2.elisa-laajakaista.fi> References: <20170309190828.GA31816@LK-Perkele-V2.elisa-laajakaista.fi> From: Ryan Sleevi Date: Thu, 9 Mar 2017 14:45:10 -0500 X-Gmail-Original-Message-ID: Message-ID: To: Ilari Liusvaara Content-Type: multipart/alternative; boundary=f403045ea32ea99c20054a517b8c Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] New version of delegated credentials draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Mar 2017 19:45:14 -0000 --f403045ea32ea99c20054a517b8c Content-Type: text/plain; charset=UTF-8 On Thu, Mar 9, 2017 at 2:08 PM, Ilari Liusvaara wrote: > On name constraints, name-constraining a wildcard certificate (e.g. > to "redact" data from CT) could be useful to avoid default-vhost > attacks against HTTP servers (there are lots of servers that > are misconfigured). Especially in HTTP/2. > Of course, no CT supporting clients support that method, and it's been migrated to a (currently non-WG adopted) document in 6962-bis while things are sorted. So if the argument is name-constraining is expected to prevalent for case X (where X == redaction), I don't think that's the case. > > * Required the presence of an extension in the EE certificate > > to allow the use of delegated credentials. > > I think this is going to be a major deployment problem. Basically, > CAs move pretty much glacially. > I'm going to push back on this assertion, because it came up during previous discussions. The CA/Browser Forum's Baseline Requirements already permit CAs to include additional X.509v3 extensions - specifically, Section 7.1.2.4 of the Baseline Requirements - provided that the semantics that, if included, will not mislead a relying party about the certificate information verified by the CA. As proposed, this (and the previous discussion) meet this definition, and so without any change to policies, CAs can adopt this. As a site operator with a business relationship with a given CA, you can use that business relationship to request these extensions. Plenty of CAs can and do respond to their customers' needs in a timely fashion, and/or actively work to standardize them prior to immediately implementing. I could name off examples for you, but I don't know if they need the free advertising. The point being is that this doesn't require _all_ CAs to change, it just requires "your" CA to change, and "your" CA is not going to be constrained by any policies that prevent them from doing this. If this were adopted, it might take time for the CA/Browser Forum to normalize the policies around saying "Yes, this is OK" - and on that, I agree, it's glacially slow (but about as quick as the full IETF process, from chartering to publication, all things considered) - but again, you don't need that. > It is going to be much easier getting ECDSA certs (which are infamous > for being difficult to get[1]). > It's not actually true anymore and hasn't been for some time, but I also appreciate this is a subjective statement, so I understand that in the absence of concrete data, your impressions may differ from my impressions. --f403045ea32ea99c20054a517b8c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Thu, Mar 9, 2017 at 2:08 PM, Ilari Liusvaara <<= a href=3D"mailto:ilariliusvaara@welho.com" target=3D"_blank">ilariliusvaara= @welho.com> wrote:
On name = constraints, name-constraining a wildcard certificate (e.g.
to "redact" data from CT) could be useful to avoid default-vhost<= br> attacks against HTTP servers (there are lots of servers that
are misconfigured). Especially in HTTP/2.

Of course, no CT supporting clients support that method, and it's be= en migrated to a (currently non-WG adopted) document in 6962-bis while thin= gs are sorted. So if the argument is name-constraining is expected to preva= lent for case X (where X =3D=3D redaction), I don't think that's th= e case.
=C2=A0
> * Required the presence of an extension in the EE certificate
> to allow the use of delegated credentials.

I think this is going to be a major deployment problem. Basically, CAs move pretty much glacially.

I'm= going to push back on this assertion, because it came up during previous d= iscussions. The CA/Browser Forum's Baseline Requirements already permit= CAs to include additional X.509v3 extensions - specifically, Section 7.1.2= .4 of the Baseline Requirements - provided that the semantics that, if incl= uded, will not mislead a relying party about the certificate information ve= rified by the CA.

As proposed, this (and the previ= ous discussion) meet this definition, and so without any change to policies= , CAs can adopt this.

As a site operator with a bu= siness relationship with a given CA, you can use that business relationship= to request these extensions. Plenty of CAs can and do respond to their cus= tomers' needs in a timely fashion, and/or actively work to standardize = them prior to immediately implementing. I could name off examples for you, = but I don't know if they need the free advertising. The point being is = that this doesn't require _all_ CAs to change, it just requires "y= our" CA to change, and "your" CA is not going to be constrai= ned by any policies that prevent them from doing this.

=
If this were adopted, it might take time for the CA/Browser Forum to n= ormalize the policies around saying "Yes, this is OK" - and on th= at, I agree, it's glacially slow (but about as quick as the full IETF p= rocess, from chartering to publication, all things considered) - but again,= you don't need that.
=C2=A0
It is going to be much easier getting ECDSA certs (which are infamous
for being difficult to get[1]).

It'= s not actually true anymore and hasn't been for some time, but I also a= ppreciate this is a subjective statement, so I understand that in the absen= ce of concrete data, your impressions may differ from my impressions.
=
--f403045ea32ea99c20054a517b8c-- From nobody Thu Mar 9 18:24:55 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A78A128AB0 for ; Thu, 9 Mar 2017 18:24:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sGA6g9rim_2S for ; Thu, 9 Mar 2017 18:24:51 -0800 (PST) Received: from mail-qk0-x230.google.com (mail-qk0-x230.google.com [IPv6:2607:f8b0:400d:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9523512944B for ; Thu, 9 Mar 2017 18:24:44 -0800 (PST) Received: by mail-qk0-x230.google.com with SMTP id y76so149372710qkb.0 for ; Thu, 09 Mar 2017 18:24:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=U6LBCog31s4ivf+Z+ydpGgC6wr1LlEd0L6pWB1eUjTU=; b=Cwx3XJbL9usQaMUgxu5mXoao7sr8ZMe2PJhWLp4KJK5xp65aDPgIUVfezpiyzA8Eru iClY2HiWo5lSt7pxs1oKPJdjOmZXMu2XHISPf5YKO+wpdt7NUifPhNovQ1TQgkXkpjlW NAm0YAGFg2WyirS4X+bT5B+408fkFggdndMZw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=U6LBCog31s4ivf+Z+ydpGgC6wr1LlEd0L6pWB1eUjTU=; b=XciftpUi36gR3oUBkXb9J3Nl1Den/yNPVg+rah1WaclcGtbCiQL0z5A9ZpgD0hkDFP XNWH8u32PSjeH3bvdt8AxNMG3LqvDMEIXetSy6Xc9W6FvZlqpskOWhbibN2Q9bLWnRbp uMGQrDAvpWzeGJaGF2Z624foPX/kUxjCgDJglIPGzPkBuROvKKQhCaUpSLCN1SMgQefo lhuNoelZRyLjkuSZI74qZJe7kWJzRhp2AGWjilI/hU33MWdEH7X3T5wAKVVpEzRb7tqd GH4i5G5K1FpDNJKs61euG9Dd9RJ4JuHXuyKMtumKyUTspTEINqe0/qjJ0M4DHAQmryXL wxNQ== X-Gm-Message-State: AFeK/H2vBHyimHzwzTWfkhwGWJbhfapk1mBq8XAUzCmcbGGP4ZuqA0lyIgHDSwSDRFnyXQ== X-Received: by 10.55.185.70 with SMTP id j67mr18117091qkf.4.1489112319996; Thu, 09 Mar 2017 18:18:39 -0800 (PST) Received: from [172.16.0.18] ([96.231.228.203]) by smtp.gmail.com with ESMTPSA id f21sm5546309qtg.3.2017.03.09.18.18.38 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 09 Mar 2017 18:18:39 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Sean Turner In-Reply-To: <352D31A3-5A8B-4790-9473-195C256DEEC8@sn3rd.com> Date: Thu, 9 Mar 2017 21:18:37 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: References: <352D31A3-5A8B-4790-9473-195C256DEEC8@sn3rd.com> To: "" X-Mailer: Apple Mail (2.3259) Archived-At: Cc: IRTF CFRG Subject: Re: [TLS] Closing out tls1.3 "Limits on key usage" PRs (#765/#769) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 02:24:54 -0000 After many emails about the wording for s5.5 Limits on Key Usage, it=E2=80= =99s time to judge consensus on whether or not to make any changes to = that section. The important thing is that the SHOULD implement the key = update from s4.5.3 was never in question. There was no consensus to = change the actual GCM limits on key usage; again the text related to = ChaCha20/Poly1305 never really was in question. The discussion has = wound down to whether it was better to count records or bytes/blocks for = the GCM limit calculation. We didn=E2=80=99t see any strong consensus = to change this description. Therefore, we see no consensus to change = the text in s5.5. ekr please close PR#765 and PR#769. J&S > On Feb 10, 2017, at 12:07 AM, Sean Turner wrote: >=20 > All, >=20 > We=E2=80=99ve got two outstanding PRs that propose changes to = draft-ietf-tls-tls13 Section 5.5 =E2=80=9CLimits on Key Usage=E2=80=9D. = As it relates to rekeying, these limits have been discussed a couple of = times and we need to resolve once and for all whether the TLS WG wants = to: >=20 > a) Close these two PRs and go with the existing text [0] > b) Adopt PR#765 [1] > c) Adopt PR#769 [2] >=20 > Please indicate you preference to the TLS mailing list before Feb 17. = Note that unless there=E2=80=99s clear consensus to change the text will = remain as is (i.e., option a). >=20 > J&S >=20 > [0] https://tlswg.github.io/tls13-spec/#rfc.section.5.5 > [1] https://github.com/tlswg/tls13-spec/pull/765 > [2] https://github.com/tlswg/tls13-spec/pull/769 From nobody Thu Mar 9 18:29:14 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 57E671294CE for ; Thu, 9 Mar 2017 18:29:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gfljgQvR4yE5 for ; Thu, 9 Mar 2017 18:28:59 -0800 (PST) Received: from mail-yw0-x22a.google.com (mail-yw0-x22a.google.com [IPv6:2607:f8b0:4002:c05::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BF57C129477 for ; Thu, 9 Mar 2017 18:28:59 -0800 (PST) Received: by mail-yw0-x22a.google.com with SMTP id v76so16183715ywg.0 for ; Thu, 09 Mar 2017 18:28:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=+M3DnXEaRdmC4qxmUHX+dfSYoq6TyJKixprMp1mD3YI=; b=wTP7cy0JSSCluzOvHztBZGG2caY0mI5gFTTmt5C+PfxvKB5GfLY3xiZthKpqQmwxQ8 a+Q9eIKQW9oTicsEzsW0GRRK+CXFQuSrS75n/yMkeT4KDk/GXpT4J/qBfagKL43cnnQG /aIgXXmrD/jmVM9CDOFyYJ7MB1JQCnm2jA7YwZvkZ/SEntSevB52FQwzKetJNlrWc1ol 1hw4+3yKPGGGqxt3ezvuU2DRWQezehIquaD6k9xwTWR2Gvh0igfUGDm44Naqj64bSYoj mlrPJXFz7RsNsjiTnfcX1jDggxiip6Te0ued7J0sS+rsB6tKAnzFPlwRQb2oasL7UTjT 0GrA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=+M3DnXEaRdmC4qxmUHX+dfSYoq6TyJKixprMp1mD3YI=; b=TIkl1K6ZSIrGE+7ymrC1TnQAA0cwO3r86u4QeRZRAyRJWO5o68U/nCf2U52LDlqwSy SVWOR2+jr59Tfh2UOHOiVV37akEDiX6MqT3vMwINt63aHLxEmbqFdsM1W217AHQvbElR tEvzXU8+PrvP0V9edscM67s+kfIIf4XPu6yFK5/Aqv7cwDlNh3lboszr9y0RQ4d17gxX 51S44r5JOfF0P5VFa1lqgnHOR2N9EWhkM2X/xtF8SD5Z4Pnr69muupCiEoG+sO01YcHi A8urBU4EPY5utDvThbsQQ2Qvv5xD5rb3T4Uzze10P+o5hrFEqs0GLWsdK3rzOBqsvzvh jImA== X-Gm-Message-State: AMke39lvAo+KG8YXSWtYg9JIV5czlQpDCsMG0agFNMhOI7ynfOByOEWIKg2Nfe81SFx2SmmkFO7IdzFflgauLg== X-Received: by 10.129.177.8 with SMTP id p8mr6188444ywh.327.1489106639601; Thu, 09 Mar 2017 16:43:59 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Thu, 9 Mar 2017 16:43:19 -0800 (PST) From: Eric Rescorla Date: Thu, 9 Mar 2017 16:43:19 -0800 Message-ID: To: "tls@ietf.org" Content-Type: multipart/alternative; boundary=94eb2c13ce38495a74054a55a834 Archived-At: Subject: [TLS] Updating for non-X.509 certificate types X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 02:29:08 -0000 --94eb2c13ce38495a74054a55a834 Content-Type: text/plain; charset=UTF-8 As noted in https://github.com/tlswg/tls13-spec/issues/722, the new fancy TLS 1.3 Certificate structure doesn't map well to the various non-X.509 cert structures we have defined, specifically: - Raw Public Keys - Cached Info - OpenPGP Probably mapping each of these to 1.3 is relatively straightforward (Raw public keys == a list with one key, Cached info == the hash of each cert + its extensions, and so on), but I tend to think that given the modest/specialized deployment of these extensions, it's better to do a set of small bis RFCs to define each of these, rather than add a bunch of clutter to TLS 1.3 proper. Does anyone object to this? Volunteers. -Ekr --94eb2c13ce38495a74054a55a834 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
As noted in=C2=A0https://github.com/tlswg/tls13-spec/issues/722, the n= ew fancy
TLS 1.3 Certificate structure doesn't map well to the vari= ous non-X.509
cert structures we have defined, specifically:

- Raw Public Keys
- Cached Info
- = OpenPGP

Probably mapping each of these to 1.3 is r= elatively straightforward
(Raw public keys =3D=3D a list with one= key, Cached info =3D=3D the hash of
each cert + its extensions, = and so on), but I tend to think that given the
modest/special= ized deployment of these extensions, it's better to do a
set = of small bis RFCs to define each of these, rather than add a bunch
of clutter to TLS 1.3 proper.

Does anyone object= to this? Volunteers.

-Ekr

--94eb2c13ce38495a74054a55a834-- From nobody Thu Mar 9 18:55:06 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 306FE1294E6 for ; Thu, 9 Mar 2017 18:55:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rO9lc8Rf4j3p for ; Thu, 9 Mar 2017 18:55:01 -0800 (PST) Received: from mail-yw0-x231.google.com (mail-yw0-x231.google.com [IPv6:2607:f8b0:4002:c05::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB9C612947E for ; Thu, 9 Mar 2017 18:55:00 -0800 (PST) Received: by mail-yw0-x231.google.com with SMTP id v198so16402825ywc.2 for ; Thu, 09 Mar 2017 18:55:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=8MFeBLg5JVuh+3Itth8YmhtK+fTHOm811Jrk8TbArtY=; b=t0IkIqLDw+0w0rdn2Pm9sIoHodTDaV+2zT3w8/Dk5/A4YqHPVroTyGFBD5o44hPu1s fNSlHLgPWWcYhuY3te91XTOMFuRE3+CWPIPRt5bQzdaxmkN/WA5/NidiZEp91tGGCRDy 46uzyk8q3b4SVKbfZ+kHhSvYXG4CtsU8bF5OvIAmgU+BoDeG9s7wN/uAk6Y+N5bsXar6 XvgDXjcCcJOLViTL/LOqrYr1fxGTGhwxFN5i1cjkkYPPUQ00/Ou+WNrvMTztXEUcNWqP IXyh+2U/AntpzlRnuKy860ug/au0vE4igeQ3Sbt68F8BIcegzIleQnTKrRryaan5rFJB SSMQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=8MFeBLg5JVuh+3Itth8YmhtK+fTHOm811Jrk8TbArtY=; b=KUI6QeNlhNVKHivrELpI2jKAEAjioqb7aqsn8UpvqwWIf0GVqiURJVTaqyFaBDAKuJ G6voLs7z7YHhi6W2d5SWP2E/9RnBVpWEuurwLnqooDM3POWCluRXlo+KG3LxNKiWnO/4 euW5axwV81C9gqxNPmTcwfddIK6OZ0ajNfHuiasTjaMpAZNz0iIYxFvmR1b562hBl/dY MkjkdA0Wcfcpbw+sJeFEuDbrn79kwx2jA/7AS3TBpH6RKzyekNVYArIYCE+d5k18dzA9 H2UEuThapSyHa09PSVqY7xLb+cURy8ARYdVkXsoEuYu8UU5ETDGXEM8EHONBc90FRcnC 24BQ== X-Gm-Message-State: AMke39mmzi/OKILm9KcpIRWf4/7TjLD+bAFih1w8se49g5JEsAJShY08YTIVuIKMn9JZcqvlQaPy3eDdU+zr2w== X-Received: by 10.37.171.66 with SMTP id u60mr6032896ybi.64.1489107579883; Thu, 09 Mar 2017 16:59:39 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Thu, 9 Mar 2017 16:58:59 -0800 (PST) In-Reply-To: <20170309124108.GA31263@LK-Perkele-V2.elisa-laajakaista.fi> References: <30393367.Vf37kWhi1s@pintsize.usersys.redhat.com> <20170309124108.GA31263@LK-Perkele-V2.elisa-laajakaista.fi> From: Eric Rescorla Date: Thu, 9 Mar 2017 16:58:59 -0800 Message-ID: To: Ilari Liusvaara Content-Type: multipart/alternative; boundary=94eb2c0c30f0551052054a55e0aa Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] (no subject) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 02:55:04 -0000 --94eb2c0c30f0551052054a55e0aa Content-Type: text/plain; charset=UTF-8 Landed. Also, see the follow up PR to make implementation easier: https://github.com/tlswg/tls13-spec/pull/904 On Thu, Mar 9, 2017 at 4:41 AM, Ilari Liusvaara wrote: > On Thu, Mar 09, 2017 at 12:50:03PM +0100, Hubert Kario wrote: > > On Thursday, 9 February 2017 22:17:33 CET Eric Rescorla wrote: > > > Hi folks, > > > > > > We need to close on an issue about the size of the > > > state in the HelloRetryRequest. Because we continue the transcript > > > after HRR, if you want a stateless HRR the server needs to incorporate > > > the hash state into the cookie. However, this has two issues: > > > > Isn't the whole CH2 supposed to be deterministically created from CH1 > and HRR? > > No. > > Neither CH1 nor CH2 are deterministic w.r.t. one another. > > > So you should be able (as the server) to recreate the CH1 given the hash > (or > > better yet, keyed HMAC) of the CH1 fairly easily? Bonus point: you > > automatically reject technically malformed CH2 messages (ones with more > > changes than prescribed) as you won't be able to create a CH1 that > creates the > > matching HMAC. > > Actually, you can't create CH1 from just CH2. Back some versions it was > merely very annoying to do so, now (as in -18), you can't do it at all. > > > -Ilari > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --94eb2c0c30f0551052054a55e0aa Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Landed.

Also, see the follow up PR to m= ake implementation easier:

On Thu, Mar 9, 2017 at 4:41 AM, Ilari Liusvaara <= ;ilariliusvaa= ra@welho.com> wrote:
On Thu, Mar 09, 2017 at 12:50:03PM +0100, Hubert Kario wrote: > On Thursday, 9 February 2017 22:17:33 CET Eric Rescorla wrote:
> > Hi folks,
> >
> > We need to close on an issue about the size of the
> > state in the HelloRetryRequest. Because we continue the transcrip= t
> > after HRR, if you want a stateless HRR the server needs to incorp= orate
> > the hash state into the cookie. However, this has two issues:
>
> Isn't the whole CH2 supposed to be deterministically created from = CH1 and HRR?

No.

Neither CH1 nor CH2 are deterministic w.r.t. one another.

> So you should be able (as the server) to recreate the CH1 given the ha= sh (or
> better yet, keyed HMAC) of the CH1 fairly easily? Bonus point: you
> automatically reject technically malformed CH2 messages (ones with mor= e
> changes than prescribed) as you won't be able to create a CH1 that= creates the
> matching HMAC.

Actually, you can't create CH1 from just CH2. Back some versions= it was
merely very annoying to do so, now (as in -18), you can't do it at all.=


-Ilari

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--94eb2c0c30f0551052054a55e0aa-- From nobody Thu Mar 9 19:06:26 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E533129549 for ; Thu, 9 Mar 2017 19:06:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PoojiTVaPyOk for ; Thu, 9 Mar 2017 19:06:20 -0800 (PST) Received: from mail-qk0-x233.google.com (mail-qk0-x233.google.com [IPv6:2607:f8b0:400d:c09::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8CEFF12951B for ; Thu, 9 Mar 2017 19:06:20 -0800 (PST) Received: by mail-qk0-x233.google.com with SMTP id p64so150418878qke.1 for ; Thu, 09 Mar 2017 19:06:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=gAJyiaLnre9CwfJzrIOokhtbqJUTIJPmI/M3cmIjJqg=; b=bzXH6ltAbTeNqNyxgjNDlQtP36dUIEz8j+pR6XJj0W9yb03jYnw1MXV4URC5T7lYxW KAYciTfeDgMmNw65Z/QQPdjfRDwsmgWHBKi+RUGbgQOWxu9INCsQIJO/1ULNdRpvOkeZ 3w+tiSSByTuqSsbY9mCipYFgnjYxbTnCzxY8rcEk0RxlkyXFiiJEZJKKFUOgPl/PSz9t ur3u8dYUYxC6HYSP5sJwyMU40WN/lxXmR12ITsIvQ/+2e5A+ZSeeaOGK/LdDHbqIB9eZ SsUqGcjgt7z1+BypdPWHJgAmt7jRnoridpxUbF6r5af58F/GlM2w69vl7tAumSsSc0m+ g7Lw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=gAJyiaLnre9CwfJzrIOokhtbqJUTIJPmI/M3cmIjJqg=; b=QRyEENwB8W5k4BsFRx0IW5+JghCASb0GJs1HWqya3fhZsLKyWq/C9MO7viywdzfI1F g3LjzOkaYrssjDABJn7FUtlwlo0la1SNKwH3ZQk43dia5Z2nGAezwD9uCuUa3aBT71TC bVEoVQ36Qc0hfDBHiY2NzEU802C6unc8z/CHsnqkhxIba9TpFGC9oONdXlhze2OOcVmB sVRjRwApaDxBfG0NtGB9gn2mBEHCsFnnQAVyvFi+CucuGR+RvjLDzyhNAuVM8uMV3ZIP 93boKPPo8v/21xiFOeILc/Zui8Qt+zLMqFvadrI74DrsO2XaNnocosuDVLFR11OCLYzp XSnA== X-Gm-Message-State: AMke39lS/TSBzAJhRaKfWAC+P42B8UGXdIi8uBYHBykhGZcSlikBeWlccc2xFG/iSlCEkmbiujTgC7Snd7lzqg== X-Received: by 10.200.33.210 with SMTP id 18mr17526010qtz.159.1489115179749; Thu, 09 Mar 2017 19:06:19 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.19.112 with HTTP; Thu, 9 Mar 2017 19:06:19 -0800 (PST) In-Reply-To: References: From: Martin Thomson Date: Fri, 10 Mar 2017 14:06:19 +1100 Message-ID: To: Eric Rescorla Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Updating for non-X.509 certificate types X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 03:06:24 -0000 It seems like the minimum thing TLS 1.3 can do is observe that these extensions exist and that they can't be used with TLS 1.3 (yet). On 10 March 2017 at 11:43, Eric Rescorla wrote: > As noted in https://github.com/tlswg/tls13-spec/issues/722, the new fancy > TLS 1.3 Certificate structure doesn't map well to the various non-X.509 > cert structures we have defined, specifically: > > - Raw Public Keys > - Cached Info > - OpenPGP > > Probably mapping each of these to 1.3 is relatively straightforward > (Raw public keys == a list with one key, Cached info == the hash of > each cert + its extensions, and so on), but I tend to think that given the > modest/specialized deployment of these extensions, it's better to do a > set of small bis RFCs to define each of these, rather than add a bunch > of clutter to TLS 1.3 proper. > > Does anyone object to this? Volunteers. > > -Ekr > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > From nobody Thu Mar 9 19:13:19 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 483E3129552 for ; Thu, 9 Mar 2017 19:13:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v61SgoENChhN for ; Thu, 9 Mar 2017 19:13:13 -0800 (PST) Received: from mail-yw0-x232.google.com (mail-yw0-x232.google.com [IPv6:2607:f8b0:4002:c05::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B47E9129530 for ; Thu, 9 Mar 2017 19:13:13 -0800 (PST) Received: by mail-yw0-x232.google.com with SMTP id p77so16595798ywg.1 for ; Thu, 09 Mar 2017 19:13:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=MBryZPfHqxw2xYm2FxsHAdJBbFh8GT6V2jPPrlmIHmk=; b=Ygz/B9FLDraSKt4iKRSrSkIy6jpxvQhtx/9/ipxwWvzg9oh7klj68pdmMY9FR2Ind/ Ca6QHVE2v8zTbGiuHMZ151+HIIYUgPPJBkYc8BXT4uM8zYHo7gjaqi2niBanl/KBsPL1 SRjLBrLQj49rowNMYxBPIwPiWUulbe5XWOS0glmwdyZ+DwHanAep4rGRsNiRYJxIzXzJ tNbozNdeT+admLEMBN0/ReGpcteQTDf0FagvRfEhoCSaoIxlCcthTU7fBq3nYCbYpdIi 0FZ7Ru5Pgm07mr9X+VC0a28q57LfVwIRiisuBHa8jJ9kfwTB5VpFoXjQ2jZsqPRevJ4G A6BA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=MBryZPfHqxw2xYm2FxsHAdJBbFh8GT6V2jPPrlmIHmk=; b=nL30dBxwI4IFwcjBOiOivAIkMivNYnWS4wXbLYdcEgNAIgN9dFRV+3hk2QwQYpLKAi jWiSJgUftqjvOuCB4i/oK1tsVo+xkdvmF+D0aUawtRlbb5jnFeCOa/pFGA2RNuLFkGhh RhysNiBG9Hu9UYPO9yKJi3XtCDmNUjLAbCf1uCoZyV2qEvSw/NIkgAKTAeOqwEmcimbr lMOVCGyQQDHqjz2ynRsPNh8bBv/nFPzYyXfT7aMsLJvKsHIBQqkuHEOvUUgFdLjqXRsw vdb6Q6RguYUVq3ndmuTu/5Ai4Ipbg7dO2k9fkvmjt1+6K8go5lnehO+IbkronjTzb5Hy 0iSA== X-Gm-Message-State: AMke39k1pcsicXYZVjhu/dW+MosRVUI5ZvujpIo6hbUGVEDCJfyhe6NnxvKXLamJCIz91WaHU3xoYISpbW+KIQ== X-Received: by 10.129.108.214 with SMTP id h205mr6457598ywc.71.1489115593037; Thu, 09 Mar 2017 19:13:13 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Thu, 9 Mar 2017 19:12:32 -0800 (PST) In-Reply-To: References: From: Eric Rescorla Date: Thu, 9 Mar 2017 19:12:32 -0800 Message-ID: To: Martin Thomson Content-Type: multipart/alternative; boundary=001a114e81dcf43a44054a57bd6c Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Updating for non-X.509 certificate types X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 03:13:17 -0000 --001a114e81dcf43a44054a57bd6c Content-Type: text/plain; charset=UTF-8 Yes, assuming that people agree with my plan above, I will do so. On Thu, Mar 9, 2017 at 7:06 PM, Martin Thomson wrote: > It seems like the minimum thing TLS 1.3 can do is observe that these > extensions exist and that they can't be used with TLS 1.3 (yet). > > On 10 March 2017 at 11:43, Eric Rescorla wrote: > > As noted in https://github.com/tlswg/tls13-spec/issues/722, the new > fancy > > TLS 1.3 Certificate structure doesn't map well to the various non-X.509 > > cert structures we have defined, specifically: > > > > - Raw Public Keys > > - Cached Info > > - OpenPGP > > > > Probably mapping each of these to 1.3 is relatively straightforward > > (Raw public keys == a list with one key, Cached info == the hash of > > each cert + its extensions, and so on), but I tend to think that given > the > > modest/specialized deployment of these extensions, it's better to do a > > set of small bis RFCs to define each of these, rather than add a bunch > > of clutter to TLS 1.3 proper. > > > > Does anyone object to this? Volunteers. > > > > -Ekr > > > > > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls > > > --001a114e81dcf43a44054a57bd6c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Yes, assuming that people agree with my plan above, I will= do so.

On Thu, Ma= r 9, 2017 at 7:06 PM, Martin Thomson <martin.thomson@gmail.com&= gt; wrote:
It seems like the minim= um thing TLS 1.3 can do is observe that these
extensions exist and that they can't be used with TLS 1.3 (yet).

On 10 March 2017 at 11:43, Eric Rescorla <ekr@rtfm.com> wrote:
> As noted in https://github.com/tlswg/tls13-s= pec/issues/722, the new fancy
> TLS 1.3 Certificate structure doesn't map well to the various non-= X.509
> cert structures we have defined, specifically:
>
> - Raw Public Keys
> - Cached Info
> - OpenPGP
>
> Probably mapping each of these to 1.3 is relatively straightforward > (Raw public keys =3D=3D a list with one key, Cached info =3D=3D the ha= sh of
> each cert + its extensions, and so on), but I tend to think that given= the
> modest/specialized deployment of these extensions, it's better to = do a
> set of small bis RFCs to define each of these, rather than add a bunch=
> of clutter to TLS 1.3 proper.
>
> Does anyone object to this? Volunteers.
>
> -Ekr
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

--001a114e81dcf43a44054a57bd6c-- From nobody Fri Mar 10 00:25:46 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 56D701294FA for ; Fri, 10 Mar 2017 00:25:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.921 X-Spam-Level: X-Spam-Status: No, score=-6.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URI_TRY_3LD=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ymVg3qaIIpjz for ; Fri, 10 Mar 2017 00:25:43 -0800 (PST) Received: from smtpde02.smtp.sap-ag.de (smtpde02.smtp.sap-ag.de [155.56.68.140]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7DDAC1293D9 for ; Fri, 10 Mar 2017 00:25:43 -0800 (PST) Received: from mail07.wdf.sap.corp (mail04.sap.corp [194.39.131.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtpde02.smtp.sap-ag.de (Postfix) with ESMTPS id 3vfgLs4bJDz264p; Fri, 10 Mar 2017 09:25:41 +0100 (CET) X-purgate-ID: 152705::1489134341-00002B31-0EE1FE8F/0/0 X-purgate-size: 2766 X-purgate: clean X-purgate: This mail is considered clean (visit http://www.eleven.de for further information) X-purgate-Ad: Categorized by eleven eXpurgate (R) http://www.eleven.de X-purgate-type: clean X-SAP-SPAM-Status: clean Received: from ld9781.wdf.sap.corp (ld9781.wdf.sap.corp [10.21.82.193]) by mail07.wdf.sap.corp (Postfix) with ESMTP id 3vfgLs2DyRzGnwL; Fri, 10 Mar 2017 09:25:41 +0100 (CET) Received: by ld9781.wdf.sap.corp (Postfix, from userid 10159) id 4112D1A63F; Fri, 10 Mar 2017 09:25:41 +0100 (CET) In-Reply-To: To: Ben Schwartz Date: Fri, 10 Mar 2017 09:25:41 +0100 (CET) X-Mailer: ELM [version 2.4ME+ PL125 (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="US-ASCII" Message-Id: <20170310082541.4112D1A63F@ld9781.wdf.sap.corp> From: mrex@sap.com (Martin Rex) Archived-At: Cc: "" Subject: Re: [TLS] New Draft: Using DNS to set the SNI explicitly X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: mrex@sap.com List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 08:25:45 -0000 Ben Schwartz wrote: > Martin Rex wrote: > >>Ben Schwartz wrote: >>> >>> Like a lot of people here, I'm very interested in ways to reduce the >>> leakage of users' destinations in the ClientHello's cleartext SNI. It >>> seems like the past and current proposals to fix the leak are pretty >>> difficult, involving a lot of careful cryptography and changes to clients >>> and servers. >> >> It is formally provable that there is no solution to the problem >> that you're describing. > > Perhaps I'm not trying to solve the problem that you're thinking of? > > Here's an example: > Wordpress.com uses HTTPS, with a wildcard certificate (*.wordpress.com) for > all its hosted blogs, which have domains of the form > myblogname.wordpress.com. A passive adversary watching traffic to > Wordpress.com can currently determine which blog each client IP address is > accessing by observing the IP source address and the TLS SNI in the > ClientHello message. > > With this proposal, if Wordpress were to set an SNI DNS record on each > subdomain, with empty RDATA, compliant clients would omit SNI when > contacting the Wordpress server. Connections would still work fine, but > the passive adversary would no longer know which client is accessing which > blog. > > Is there something wrong with this example that I am missing? You don't understand the purpose of SNI and how the (already weak) rfc2818 section 3.1 server endpoint identification and CABrowser Forum public CA Domain validation has been designed to work. Wordpress.com isn't using SNI at all, so the ultimate solution would be for the client to entirely omit SNI from ClientHello. wordpress itself could achieve just the same by using URLs of the kind blogs.wordpress.com/blogname with a cert issued to blogs.wordpress.com rather than blogname.wordpress.com with a cert issued to *.wordpress.com You might want eventually want to check with the logging functionality of Adblockers (such as uBlock) or browser plugins like "Collusion", to how many different servers & domains a typical server (including *.wordpress.com) publishes (HTTP-Referer) where the user just went. The decision to register a distinct & seperate name in DNS is an explicit and obvious desire to **PUBLISH** this information. If you do not want to publish information, DO NOT REGISTER it in the DNS, so that it will and it will never appear in SNI, in DNS lookups, or in DV-validation request for obtaining a TLS server cert from a public CA. Btw. your adversary will see the cleartext DNS lookup prior to the TLS handshake, and tell accesses to multiple different blogs apart by looking at the size of the responses. -Martin From nobody Fri Mar 10 03:24:26 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A733412988D for ; Fri, 10 Mar 2017 03:24:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AzrDPIGLXsNP for ; Fri, 10 Mar 2017 03:24:23 -0800 (PST) Received: from welho-filter4.welho.com (welho-filter4.welho.com [83.102.41.26]) by ietfa.amsl.com (Postfix) with ESMTP id ABD47129890 for ; Fri, 10 Mar 2017 03:24:23 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by welho-filter4.welho.com (Postfix) with ESMTP id 0535E22EFC; Fri, 10 Mar 2017 13:24:21 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp1.welho.com ([IPv6:::ffff:83.102.41.84]) by localhost (welho-filter4.welho.com [::ffff:83.102.41.26]) (amavisd-new, port 10024) with ESMTP id dTiRCIhxwhPP; Fri, 10 Mar 2017 13:24:19 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp1.welho.com (Postfix) with ESMTPSA id 6B66FC4; Fri, 10 Mar 2017 13:17:39 +0200 (EET) Date: Fri, 10 Mar 2017 13:17:32 +0200 From: Ilari Liusvaara To: Martin Rex Message-ID: <20170310111732.GA825@LK-Perkele-V2.elisa-laajakaista.fi> References: <20170310082541.4112D1A63F@ld9781.wdf.sap.corp> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20170310082541.4112D1A63F@ld9781.wdf.sap.corp> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Cc: "" Subject: Re: [TLS] New Draft: Using DNS to set the SNI explicitly X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 11:24:26 -0000 On Fri, Mar 10, 2017 at 09:25:41AM +0100, Martin Rex wrote: > > You don't understand the purpose of SNI and how the (already weak) > rfc2818 section 3.1 server endpoint identification and CABrowser Forum > public CA Domain validation has been designed to work. SNI has extremely little to do with public CA domain validation, except for special validation certificate selection in some methods. Out of 10 standard methods, only 2 would encounter any problems at all if SNI didn't work (test certificate and random value via certificate). And methods using these two presumably both use SNI and don't map it. Certainly, the only known instantiations of "random value via certificate", which are the TLS-SNI validations from ACME specify SNI to be sent. And the values it sends are permanently NXDOMAIN in DNS. And RFC2818 preceedes SNI by about three years, so it can not have been designed to rely on SNI. > Wordpress.com isn't using SNI at all, so the ultimate solution > would be for the client to entirely omit SNI from ClientHello. > > wordpress itself could achieve just the same by using URLs > of the kind > > blogs.wordpress.com/blogname with a cert issued to blogs.wordpress.com > > rather than > > blogname.wordpress.com with a cert issued to *.wordpress.com Nope. That proveds no isolation between blogs. So any way to compromise one would compromise them all. With separate host per blog, you at least avoid the undefendable cross- blog exploits. You still have the cookie exploits, but those can be defended against. And if one adds the base domain to PSL (e.g. like Blogspot (Google)) one doesn't have cookie exploits either. > Btw. your adversary will see the cleartext DNS lookup prior to the > TLS handshake, and tell accesses to multiple different blogs apart by > looking at the size of the responses. DNS over TLS (TCP/853). EDNS0 padding. Both have PS RFCs. -Ilari From nobody Fri Mar 10 04:33:19 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE57B1298D9 for ; Fri, 10 Mar 2017 04:33:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.922 X-Spam-Level: X-Spam-Status: No, score=-6.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gS1IgRwg0hWk for ; Fri, 10 Mar 2017 04:33:17 -0800 (PST) Received: from smtpde01.smtp.sap-ag.de (smtpde01.smtp.sap-ag.de [155.56.68.170]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 105F51298C7 for ; Fri, 10 Mar 2017 04:33:17 -0800 (PST) Received: from mail07.wdf.sap.corp (mail04.sap.corp [194.39.131.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtpde01.smtp.sap-ag.de (Postfix) with ESMTPS id 3vfmrW2Bgzz1JLY; Fri, 10 Mar 2017 13:33:15 +0100 (CET) X-purgate-ID: 152705::1489149195-0000521C-5D3DEAB4/0/0 X-purgate-size: 1087 X-purgate: clean X-purgate: This mail is considered clean (visit http://www.eleven.de for further information) X-purgate-Ad: Categorized by eleven eXpurgate (R) http://www.eleven.de X-purgate-type: clean X-SAP-SPAM-Status: clean Received: from ld9781.wdf.sap.corp (ld9781.wdf.sap.corp [10.21.82.193]) by mail07.wdf.sap.corp (Postfix) with ESMTP id 3vfmrW09dqzGpC3; Fri, 10 Mar 2017 13:33:15 +0100 (CET) Received: by ld9781.wdf.sap.corp (Postfix, from userid 10159) id 000591A63F; Fri, 10 Mar 2017 13:33:14 +0100 (CET) In-Reply-To: <20170310111732.GA825@LK-Perkele-V2.elisa-laajakaista.fi> To: Ilari Liusvaara Date: Fri, 10 Mar 2017 13:33:14 +0100 (CET) X-Mailer: ELM [version 2.4ME+ PL125 (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="US-ASCII" Message-Id: <20170310123315.000591A63F@ld9781.wdf.sap.corp> From: mrex@sap.com (Martin Rex) Archived-At: Cc: "" Subject: Re: [TLS] New Draft: Using DNS to set the SNI explicitly X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: mrex@sap.com List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 12:33:19 -0000 Ilari Liusvaara wrote: > On Fri, Mar 10, 2017 at 09:25:41AM +0100, Martin Rex wrote: >> >> You don't understand the purpose of SNI and how the (already weak) >> rfc2818 section 3.1 server endpoint identification and CABrowser Forum >> public CA Domain validation has been designed to work. > > SNI has extremely little to do with public CA domain validation, > except for special validation certificate selection in some > methods. SNI is the TLS-standard for clients to tell the server "This is the DNS-Hostname, which I will use for rfc2818 section 3.1 server endpoint identification. If you have multiple server certificates to choose from, you may want to consider this SNI value for choosing the server certificate to use for this TLS handshake". CABrowser-Forum defines the rules which browsers implemenent on top of rfc2818 section 3.1 server endpoint identity checks of server certificates. btw. SNI explicitly excludes IPv4 and IPv6 address matching that is defined in rfc2818 section 3.1 as alternatives to DNS Hostname matching. -Martin From nobody Fri Mar 10 04:40:31 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B64F12995F for ; Fri, 10 Mar 2017 04:40:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1z5rc9DBY2pD for ; Fri, 10 Mar 2017 04:40:24 -0800 (PST) Received: from welho-filter2.welho.com (welho-filter2.welho.com [83.102.41.24]) by ietfa.amsl.com (Postfix) with ESMTP id D105012995D for ; Fri, 10 Mar 2017 04:40:23 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by welho-filter2.welho.com (Postfix) with ESMTP id 7DA791DC94; Fri, 10 Mar 2017 14:40:21 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp3.welho.com ([IPv6:::ffff:83.102.41.86]) by localhost (welho-filter2.welho.com [::ffff:83.102.41.24]) (amavisd-new, port 10024) with ESMTP id rMjyFDWQQFWm; Fri, 10 Mar 2017 14:40:19 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp3.welho.com (Postfix) with ESMTPSA id 490452310; Fri, 10 Mar 2017 14:40:19 +0200 (EET) Date: Fri, 10 Mar 2017 14:40:13 +0200 From: Ilari Liusvaara To: Eric Rescorla Message-ID: <20170310124013.GA1197@LK-Perkele-V2.elisa-laajakaista.fi> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Updating for non-X.509 certificate types X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 12:40:29 -0000 On Thu, Mar 09, 2017 at 04:43:19PM -0800, Eric Rescorla wrote: > As noted in https://github.com/tlswg/tls13-spec/issues/722, the new fancy > TLS 1.3 Certificate structure doesn't map well to the various non-X.509 > cert structures we have defined, specifically: > > - Raw Public Keys > - Cached Info > - OpenPGP > > Probably mapping each of these to 1.3 is relatively straightforward > (Raw public keys == a list with one key, Cached info == the hash of > each cert + its extensions, and so on), but I tend to think that given the > modest/specialized deployment of these extensions, it's better to do a > set of small bis RFCs to define each of these, rather than add a bunch > of clutter to TLS 1.3 proper. > > Does anyone object to this? Volunteers. Ugh, the situation is way worse than what I thought. Basically, all three assume they have full control of certificate message, worst of all being OpenPGP, which modifies it in more complex ways (it isn't a pure element or list anymore). And even with RPK, which appiles least severe modifications, still modifies the structure in ways that are not obvious in implications w.r.t. TLS 1.3. Oh, and turns out I had implemented RPK in TLS 1.2 wrong by assuming that it doesn't actually modify the certificate message format. Which turned out to be wrong assumption (I fixed this after discovering the format changes). And then certificate types don't currently work sanely for client certs, even if you knew how those map to Certificate message. Client_certificate_type and server_certificate type aren't the only problematic extensions w.r.t. TLS 1.3. The table of extensions has the following too (all marked as allowed, I added short reason I think those are problematic): - client_certificate_url: Replaces certificate message. Hardcodes SHA-1 (which is now provably broken). - user_mapping: Has extra handshake message. - cert_type: All the problems of CCertT and SCertT, combined with fixing both to be the same. With user_mapping, applying similar trick as in status_request is not completely trivial because extensions that are answered in client Certificate are offered in CertificateRequest. Okay, except that extension is not an answer to ClientHello extensions, and the extension assumes offer-answer relationship between client and server extensions. Might need some special-casing. Could be useful to have explicit list of extensions (no registry, since this list can be never updated) that lists extensions that are deprecated in TLS 1.3. That is, only allowed in ClientHello and only if also advertising prior versions. AFAICT, the list would be: - client_certificate_url? - trusted_ca_keys - truncated_hmac - client_authz - server_authz - cert_type? - srp - status_request_v2 - client_certificate_type? - server_certificate_type? - encrypt_then_mac - extended_master_secret - cached_info? - SessionTicket TLS (don't ask why it is written like this) - renegotiation_info -Ilari From nobody Fri Mar 10 05:15:41 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D14812956F for ; Fri, 10 Mar 2017 05:15:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.499 X-Spam-Level: X-Spam-Status: No, score=-1.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_SORBS_SPAM=0.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sleevi.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F3bXEG2MU_1w for ; Fri, 10 Mar 2017 05:15:39 -0800 (PST) Received: from homiemail-a55.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A459312957C for ; Fri, 10 Mar 2017 05:15:39 -0800 (PST) Received: from homiemail-a55.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a55.g.dreamhost.com (Postfix) with ESMTP id 3061268003C28 for ; Fri, 10 Mar 2017 05:15:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sleevi.com; h=mime-version :references:in-reply-to:from:date:message-id:subject:to:cc :content-type; s=sleevi.com; bh=P7iRL0M3N6DEMeaxNDfilgYseM0=; b= ZG6phLf0YpFvT/BT+mKSOyJzrv5T8n7cG2A7w/jcSerzuEzEkFxq8qAUPE/ZPbUi 8DTp37NBBSiB/xMX2SdKwN/HmF+wFob4EiTUJ8oTHMY3xc03hga7SEBExQwiXbaD a7+cTkzJMiunjsrystP6z3l9Es5l5we1WQzxeO7Ab0s= Received: from mail-lf0-f53.google.com (mail-lf0-f53.google.com [209.85.215.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: ryan@sleevi.com) by homiemail-a55.g.dreamhost.com (Postfix) with ESMTPSA id D994F68003C29 for ; Fri, 10 Mar 2017 05:15:38 -0800 (PST) Received: by mail-lf0-f53.google.com with SMTP id y193so40688605lfd.3 for ; Fri, 10 Mar 2017 05:15:38 -0800 (PST) X-Gm-Message-State: AMke39mlqhERHq/hJ5sNHmGjmcIth8hDOlB31BHqJgVvsDYlwbTmFtKLtrCx7G3NtZfTUEI2ckbasAm2V+zPxQ== X-Received: by 10.25.157.65 with SMTP id g62mr5062164lfe.29.1489151737018; Fri, 10 Mar 2017 05:15:37 -0800 (PST) MIME-Version: 1.0 References: <20170310111732.GA825@LK-Perkele-V2.elisa-laajakaista.fi> <20170310123315.000591A63F@ld9781.wdf.sap.corp> In-Reply-To: <20170310123315.000591A63F@ld9781.wdf.sap.corp> From: Ryan Sleevi Date: Fri, 10 Mar 2017 13:15:26 +0000 X-Gmail-Original-Message-ID: Message-ID: To: Ilari Liusvaara , mrex@sap.com Content-Type: multipart/alternative; boundary=001a11411ca24d438a054a60284f Archived-At: Cc: "" Subject: Re: [TLS] New Draft: Using DNS to set the SNI explicitly X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 13:15:40 -0000 --001a11411ca24d438a054a60284f Content-Type: text/plain; charset=UTF-8 On Fri, Mar 10, 2017 at 7:33 AM Martin Rex wrote: > CABrowser-Forum defines the rules which browsers implemenent on > top of rfc2818 section 3.1 server endpoint identity checks > of server certificates. This is neither accurate nor correct. The CA/Browser Forum neither describes nor dictates browser behaviour. Perhaps you are thinking RFC 6125, but since you've stated this multiple times, I can only believe this is an honest mistake, but one that deserves calling out. btw. SNI explicitly excludes IPv4 and IPv6 address matching that > is defined in rfc2818 section 3.1 as alternatives to DNS Hostname > matching. Could you clarify the relevance of this to the discussion? While it serves as a useful reminder for those who may have forgotten, I'm at a loss as to how this has any relevance or impact to the conversation thus far or the discussion of tradeoffs, so I must be missing something quite basic. > > --001a11411ca24d438a054a60284f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

On Fri, Mar 10, 2017 at 7:33 AM Ma= rtin Rex <mrex@sap.com> wrote:=C2= =A0
CABrowser-Forum defines the rules which browsers implemenent on
top of rfc2818 section 3.1 server endpoint identity checks
of server certificates.

This is neither acc= urate nor correct. The CA/Browser Forum neither describes nor dictates brow= ser behaviour.

Perhaps you are thinking RFC 6125, = but since you've stated this multiple times, I can only believe this is= an honest mistake, but one that deserves calling out.

=
btw. SNI explicitly excludes IPv4 and IPv6 address matching that
is defined in rfc2818 section 3.1 as alternatives to DNS Hostname
matching.

Could you clarify the relevance o= f this to the discussion? While it serves as a useful reminder for those wh= o may have forgotten, I'm at a loss as to how this has any relevance or= impact to the conversation thus far or the discussion of tradeoffs, so I m= ust be missing something quite basic.
<= br class=3D"gmail_msg">
--001a11411ca24d438a054a60284f-- From nobody Fri Mar 10 05:27:55 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A55B112956F for ; Fri, 10 Mar 2017 05:27:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B4lvCvOi1fS5 for ; Fri, 10 Mar 2017 05:27:51 -0800 (PST) Received: from welho-filter1.welho.com (welho-filter1.welho.com [83.102.41.23]) by ietfa.amsl.com (Postfix) with ESMTP id E0C2312956A for ; Fri, 10 Mar 2017 05:27:50 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by welho-filter1.welho.com (Postfix) with ESMTP id A9FA21C98B; Fri, 10 Mar 2017 15:27:48 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp2.welho.com ([IPv6:::ffff:83.102.41.85]) by localhost (welho-filter1.welho.com [::ffff:83.102.41.23]) (amavisd-new, port 10024) with ESMTP id XRRBJ2I_eWbe; Fri, 10 Mar 2017 15:27:48 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp2.welho.com (Postfix) with ESMTPSA id 57A1321C; Fri, 10 Mar 2017 15:27:48 +0200 (EET) Date: Fri, 10 Mar 2017 15:27:42 +0200 From: Ilari Liusvaara To: Ben Schwartz Message-ID: <20170310132742.GA1457@LK-Perkele-V2.elisa-laajakaista.fi> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Cc: tls@ietf.org Subject: Re: [TLS] New Draft: Using DNS to set the SNI explicitly X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 13:27:53 -0000 On Tue, Feb 07, 2017 at 11:12:12AM -0500, Ben Schwartz wrote: > Hi TLS, > > Like a lot of people here, I'm very interested in ways to reduce the > leakage of users' destinations in the ClientHello's cleartext SNI. It > seems like the past and current proposals to fix the leak are pretty > difficult, involving a lot of careful cryptography and changes to clients > and servers. > > While we're trying to figure that out, I think there's a simple trick that > could help a lot: just let domain owners tell users an alternate SNI in a > DNS entry. Stumbled upon the following potential problem: Suppose a server has certificate that is wider than what it needs (wildcards anyone?) and it thinks SNI values are more trustworthy than :authority/host (which this document seems to imply), then: DNS spoof can point the A/AAAA records of some name certificate is valid for to that server and set SNI records to some name that this server accepts. Then visitor can open connection (since SNI check and certificate check passes). And then server can respond to queries for unknown vhost in rather dangerous ways. E.g. Suppose victim.example.org has wildcard cert. victim.example.org IN AAAA 2001:db8:1234:5678::ABCD Attacker spoofs: dangerous.example.org IN AAAA 2001:db8:1234:5678::ABCD _443._tcp.dangerous.example.org IN SNI victim.example.org Now if someone visits https://dangerous.example.org/, victim.example.org will see SNI for itself, so it accepts the connection. The client sees the *.example.org name, so it doesn't complain and sends the request automatically. And then the first request will be for https://dangerous.example.org/. Which can trigger unexpected behaviour, potentially exploitable (the web security model is real fragile). -Ilari From nobody Fri Mar 10 07:03:09 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC5E412996F for ; Fri, 10 Mar 2017 07:03:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5qyqdHumEW-X for ; Fri, 10 Mar 2017 07:03:04 -0800 (PST) Received: from mail-yw0-x234.google.com (mail-yw0-x234.google.com [IPv6:2607:f8b0:4002:c05::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D1D7D12960B for ; Fri, 10 Mar 2017 07:03:03 -0800 (PST) Received: by mail-yw0-x234.google.com with SMTP id v76so25235876ywg.0 for ; Fri, 10 Mar 2017 07:03:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=wkeKmsubf3VpuXOtTOJptYXNCz1KB+R68gufGePDhCk=; b=R7FIG8UuOWhgy708+wYJQ983kNPia87ZpOKfSifIgjR1rppSARniIfyCaGIV99NgLc N5TqyEmC9IM6oXBJQMrccBqls5NGroHpdrH75/zvJqOdCfXWNJoli9+BqNLuKoqbr1ub vNfJ/lHObMpu1T6Sn/bhtdP8j/leO7imyAZx+aVBD67kzPDtIYRosHAYjY61kRM9tLuV DqRMTqyzyddqevTDJY4j52WDk8XY66VEGc/FPXoB6qxfJWZgPEvHZAOtlFW9NZbvcC/Q iLfIhVZnrxg3ElAtLrQYXrqn+3M9LwdHpqgj2OqpzLO8ZOzhfnAL7iGT1gmQbFA+res2 vSTA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=wkeKmsubf3VpuXOtTOJptYXNCz1KB+R68gufGePDhCk=; b=VIP7s9/D2nqUwTrek4AD14cJU+6uNC6EaS07zxPIAC99NFABzCyxqOslK6XBpnfe6v CBARzrIq/SZocgWIZ3iNJBsBzO6rLj3joxsZPBw9/zfWOM2vRMEbhITpkfWOFZV0hoZt 5G7TvLTGbQiVGj9koUC4YtcwxQizHbLWVKfHvYvFjAkqWV50YhkBkVR7wXz6uNqdwpuE sxU2jWajzbXscWkfiwgsRiRECVDf0z/DJCHqOtPvBo0GxglRlcpzUvLaaKMfEpNDGe7w 49FrDc0EHyg1AsVZs8FRdjVNOoUjiXSP5Z/3xvH2/NdTdgx4ubupH1RPaUguYagPqynT BrLA== X-Gm-Message-State: AMke39nWtpak/21FWodDAqnbNtYSUK+eU5XlJd6o7P5BKiNIxXUb649GXPE4RAMVnwE4v9c5APlXNh6fQ83BPg== X-Received: by 10.37.78.195 with SMTP id c186mr8046830ybb.180.1489158182949; Fri, 10 Mar 2017 07:03:02 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Fri, 10 Mar 2017 07:02:22 -0800 (PST) In-Reply-To: <20170310124013.GA1197@LK-Perkele-V2.elisa-laajakaista.fi> References: <20170310124013.GA1197@LK-Perkele-V2.elisa-laajakaista.fi> From: Eric Rescorla Date: Fri, 10 Mar 2017 07:02:22 -0800 Message-ID: To: Ilari Liusvaara Content-Type: multipart/alternative; boundary=001a113e88fa827bc4054a61a893 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Updating for non-X.509 certificate types X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 15:03:07 -0000 --001a113e88fa827bc4054a61a893 Content-Type: text/plain; charset=UTF-8 On Fri, Mar 10, 2017 at 4:40 AM, Ilari Liusvaara wrote: > On Thu, Mar 09, 2017 at 04:43:19PM -0800, Eric Rescorla wrote: > > As noted in https://github.com/tlswg/tls13-spec/issues/722, the new > fancy > > TLS 1.3 Certificate structure doesn't map well to the various non-X.509 > > cert structures we have defined, specifically: > > > > - Raw Public Keys > > - Cached Info > > - OpenPGP > > > > Probably mapping each of these to 1.3 is relatively straightforward > > (Raw public keys == a list with one key, Cached info == the hash of > > each cert + its extensions, and so on), but I tend to think that given > the > > modest/specialized deployment of these extensions, it's better to do a > > set of small bis RFCs to define each of these, rather than add a bunch > > of clutter to TLS 1.3 proper. > > > > Does anyone object to this? Volunteers. > > Ugh, the situation is way worse than what I thought. > That makes it an opportunity! Basically, all three assume they have full control of certificate > message, worst of all being OpenPGP, which modifies it in more > complex ways (it isn't a pure element or list anymore). > > And even with RPK, which appiles least severe modifications, > still modifies the structure in ways that are not obvious in > implications w.r.t. TLS 1.3. > > Oh, and turns out I had implemented RPK in TLS 1.2 wrong by assuming > that it doesn't actually modify the certificate message format. > Which turned out to be wrong assumption (I fixed this after > discovering the format changes). > > > And then certificate types don't currently work sanely for client > certs, even if you knew how those map to Certificate message. > > > Client_certificate_type and server_certificate type aren't the > only problematic extensions w.r.t. TLS 1.3. The table of > extensions has the following too (all marked as allowed, I > added short reason I think those are problematic): > > - client_certificate_url: Replaces certificate message. Hardcodes > SHA-1 (which is now provably broken). > So that's an easy fix :) > - user_mapping: Has extra handshake message. > - cert_type: All the problems of CCertT and SCertT, combined with > fixing both to be the same. > Does anyone use this? > > With user_mapping, applying similar trick as in status_request is > not completely trivial because extensions that are answered in client > Certificate are offered in CertificateRequest. Okay, except that > extension is not an answer to ClientHello extensions, and the > extension assumes offer-answer relationship between client and server > extensions. Might need some special-casing. > Yeah, I think we should probably just consider banning user_mapping, at least until someone comes up with a way to use it here. Could be useful to have explicit list of extensions (no registry, since > this list can be never updated) that lists extensions that are > deprecated in TLS 1.3. > Currently this is by exclusion. I.e., these aren't listed as usable with 1.3. It does seem to me that we shouldn't ban cached_info and the cert type ones, because if/when they become usable with 1.3 then they should be permissible. So I think I would rather say "don't advertise these with 1.3 unless you're willing to do them with 1.3" -Ekr That is, only allowed in ClientHello and only if also advertising > prior versions. > > AFAICT, the list would be: > > - client_certificate_url? > - trusted_ca_keys > - truncated_hmac > - client_authz > - server_authz > - cert_type? > - srp > - status_request_v2 > - client_certificate_type? > - server_certificate_type? > - encrypt_then_mac > - extended_master_secret > - cached_info? > - SessionTicket TLS (don't ask why it is written like this) > - renegotiation_info > > > > -Ilari > --001a113e88fa827bc4054a61a893 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Fri, Mar 10, 2017 at 4:40 AM, Ilari Liusvaara <= ilariliusvaar= a@welho.com> wrote:
On Thu, Mar 09, 2017 at 04:43:19PM -0800, Eric Rescorla wrote: > As noted in https://github.com/tlswg/tls13-s= pec/issues/722, the new fancy
> TLS 1.3 Certificate structure doesn't map well to the various non-= X.509
> cert structures we have defined, specifically:
>
> - Raw Public Keys
> - Cached Info
> - OpenPGP
>
> Probably mapping each of these to 1.3 is relatively straightforward > (Raw public keys =3D=3D a list with one key, Cached info =3D=3D the ha= sh of
> each cert + its extensions, and so on), but I tend to think that given= the
> modest/specialized deployment of these extensions, it's better to = do a
> set of small bis RFCs to define each of these, rather than add a bunch=
> of clutter to TLS 1.3 proper.
>
> Does anyone object to this? Volunteers.

Ugh, the situation is way worse than what I thought.

That makes it an opportunity!


Basically, all three assume they have full control of certificate
message, worst of all being OpenPGP, which modifies it in more
complex ways (it isn't a pure element or list anymore).

And even with RPK, which appiles least severe modifications,
still modifies the structure in ways that are not obvious in
implications w.r.t. TLS 1.3.

Oh, and turns out I had implemented RPK in TLS 1.2 wrong by assuming
that it doesn't actually modify the certificate message format.
Which turned out to be wrong assumption (I fixed this after
discovering the format changes).


And then certificate types don't currently work sanely for client
certs, even if you knew how those map to Certificate message.


Client_certificate_type and server_certificate type aren't the
only problematic extensions w.r.t. TLS 1.3. The table of
extensions has the following too (all marked as allowed, I
added short reason I think those are problematic):

- client_certificate_url: Replaces certificate message. Hardcodes
=C2=A0 SHA-1 (which is now provably broken).

So that's an easy fix :)

=C2=A0
- user_mapping: Has extra handshake message.
- cert_type: All the problems of CCertT and SCertT, combined with
=C2=A0 fixing both to be the same.

Does= anyone use this?
=C2=A0

With user_mapping, applying similar trick as in status_request is
not completely trivial because extensions that are answered in client
Certificate are offered in CertificateRequest. Okay, except that
extension is not an answer to ClientHello extensions, and the
extension assumes offer-answer relationship between client and server
extensions. Might need some special-casing.

=
Yeah, I think we should probably just consider banning user_mapping,
at least until someone comes up with a way to use it here.


Could be useful to have explicit list of extensions (no registry, since
this list can be never updated) that lists extensions that are
deprecated in TLS 1.3.

Currently this i= s by exclusion. I.e., these aren't listed as usable with
1.3.= It does seem to me that we shouldn't ban cached_info and
the= cert type ones, because if/when they become usable with 1.3
then= they should be permissible. So I think I would rather say
"= don't advertise these with 1.3 unless you're willing to do them
with 1.3"=C2=A0

-Ekr




That is, only allowed in ClientHello and only if also advertising
prior versions.

AFAICT, the list would be:

- client_certificate_url?
- trusted_ca_keys
- truncated_hmac
- client_authz
- server_authz
- cert_type?
- srp
- status_request_v2
- client_certificate_type?
- server_certificate_type?
- encrypt_then_mac
- extended_master_secret
- cached_info?
- SessionTicket TLS (don't ask why it is written like this)
- renegotiation_info



-Ilari

--001a113e88fa827bc4054a61a893-- From nobody Fri Mar 10 07:29:34 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71B8D129624 for ; Fri, 10 Mar 2017 07:29:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T8sK3UZ0RyJl for ; Fri, 10 Mar 2017 07:29:31 -0800 (PST) Received: from mournblade.imrryr.org (mournblade.imrryr.org [108.5.242.66]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A51C1295F1 for ; Fri, 10 Mar 2017 07:29:31 -0800 (PST) Received: from vpro.lan (cpe-74-71-8-253.nyc.res.rr.com [74.71.8.253]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mournblade.imrryr.org (Postfix) with ESMTPSA id 964BF7A32D8 for ; Fri, 10 Mar 2017 15:29:30 +0000 (UTC) (envelope-from ietf-dane@dukhovni.org) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Viktor Dukhovni In-Reply-To: Date: Fri, 10 Mar 2017 10:29:30 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <1F223FC8-32BC-4203-B2C8-E71D5CC47764@dukhovni.org> References: To: "" X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] New Draft: Using DNS to set the SNI explicitly X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: "" List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 15:29:33 -0000 > On Feb 7, 2017, at 11:12 AM, Ben Schwartz wrote: >=20 > Like a lot of people here, I'm very interested in ways to reduce the = leakage of users' destinations in the ClientHello's cleartext SNI. It = seems like the past and current proposals to fix the leak are pretty = difficult, involving a lot of careful cryptography and changes to = clients and servers. >=20 > While we're trying to figure that out, I think there's a simple trick = that could help a lot: just let domain owners tell users an alternate = SNI in a DNS entry. >=20 > Here's the full draft: > https://tools.ietf.org/html/draft-schwartz-dns-sni-00 >=20 > If you just want to glance at it, I recommend Figure 2. >=20 > Please read and critique! This is a starting point; the contents will = change based on your input. Instead of looking for a kludgey replacement SNI in DNS (that won't get = deployed, and provides rather weak obfuscation) it seems more sensible to publish = keys in DNS that make it possible to encrypt the entire client HELLO, SNI and = all. I do not think that the proposed SNI in DNS is worth doing. --=20 Viktor. From nobody Fri Mar 10 07:42:19 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE68E129649 for ; Fri, 10 Mar 2017 07:42:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tvw89rM3_yvQ for ; Fri, 10 Mar 2017 07:42:10 -0800 (PST) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BEABE12963C for ; Fri, 10 Mar 2017 07:42:10 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 2E9F33004AE for ; Fri, 10 Mar 2017 10:42:10 -0500 (EST) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id gYRxQREydrhG for ; Fri, 10 Mar 2017 10:42:09 -0500 (EST) Received: from [10.5.245.234] (wsip-98-172-24-238.dc.dc.cox.net [98.172.24.238]) by mail.smeinc.net (Postfix) with ESMTPSA id 06B09300267; Fri, 10 Mar 2017 10:42:08 -0500 (EST) From: Russ Housley Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Fri, 10 Mar 2017 10:42:08 -0500 References: <352D31A3-5A8B-4790-9473-195C256DEEC8@sn3rd.com> To: IETF TLS , IRTF CFRG In-Reply-To: Message-Id: X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] [Cfrg] Closing out tls1.3 "Limits on key usage" PRs (#765/#769) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 15:42:13 -0000 Thanks. I agree. I think that the existing text is more helpful to the = implementer. If the details of the analysis do in the document, it = should be in the security considerations. Russ > On Mar 9, 2017, at 9:18 PM, Sean Turner wrote: >=20 > After many emails about the wording for s5.5 Limits on Key Usage, = it=E2=80=99s time to judge consensus on whether or not to make any = changes to that section. The important thing is that the SHOULD = implement the key update from s4.5.3 was never in question. There was = no consensus to change the actual GCM limits on key usage; again the = text related to ChaCha20/Poly1305 never really was in question. The = discussion has wound down to whether it was better to count records or = bytes/blocks for the GCM limit calculation. We didn=E2=80=99t see any = strong consensus to change this description. Therefore, we see no = consensus to change the text in s5.5. ekr please close PR#765 and = PR#769. >=20 > J&S >=20 >> On Feb 10, 2017, at 12:07 AM, Sean Turner wrote: >>=20 >> All, >>=20 >> We=E2=80=99ve got two outstanding PRs that propose changes to = draft-ietf-tls-tls13 Section 5.5 =E2=80=9CLimits on Key Usage=E2=80=9D. = As it relates to rekeying, these limits have been discussed a couple of = times and we need to resolve once and for all whether the TLS WG wants = to: >>=20 >> a) Close these two PRs and go with the existing text [0] >> b) Adopt PR#765 [1] >> c) Adopt PR#769 [2] >>=20 >> Please indicate you preference to the TLS mailing list before Feb 17. = Note that unless there=E2=80=99s clear consensus to change the text = will remain as is (i.e., option a). >>=20 >> J&S >>=20 >> [0] https://tlswg.github.io/tls13-spec/#rfc.section.5.5 >> [1] https://github.com/tlswg/tls13-spec/pull/765 >> [2] https://github.com/tlswg/tls13-spec/pull/769 From nobody Fri Mar 10 08:37:50 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4194E128B38 for ; Fri, 10 Mar 2017 08:37:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6pqP1ASHB_lL for ; Fri, 10 Mar 2017 08:37:47 -0800 (PST) Received: from welho-filter2.welho.com (welho-filter2.welho.com [83.102.41.24]) by ietfa.amsl.com (Postfix) with ESMTP id 20E6A12940A for ; Fri, 10 Mar 2017 08:37:47 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by welho-filter2.welho.com (Postfix) with ESMTP id 03ED21F316; Fri, 10 Mar 2017 18:37:46 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp3.welho.com ([IPv6:::ffff:83.102.41.86]) by localhost (welho-filter2.welho.com [::ffff:83.102.41.24]) (amavisd-new, port 10024) with ESMTP id qwz-WKlTOZ-L; Fri, 10 Mar 2017 18:37:45 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp3.welho.com (Postfix) with ESMTPSA id A701A2310; Fri, 10 Mar 2017 18:37:45 +0200 (EET) Date: Fri, 10 Mar 2017 18:37:38 +0200 From: Ilari Liusvaara To: Eric Rescorla Message-ID: <20170310163738.GA1636@LK-Perkele-V2.elisa-laajakaista.fi> References: <20170310124013.GA1197@LK-Perkele-V2.elisa-laajakaista.fi> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Updating for non-X.509 certificate types X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 16:37:49 -0000 On Fri, Mar 10, 2017 at 07:02:22AM -0800, Eric Rescorla wrote: > On Fri, Mar 10, 2017 at 4:40 AM, Ilari Liusvaara > wrote: > > > - user_mapping: Has extra handshake message. > > - cert_type: All the problems of CCertT and SCertT, combined with > > fixing both to be the same. > > > > Does anyone use this? I don't think anyone uses it. cert_type was defined in order to use OpenPGP certs (RPK has SCertT and CCertT, altough in theory one could use cert_type). Nobody uses OpenPGP. Even the most notable TLS library supporting those (GnuTLS) is deprecating it. > > With user_mapping, applying similar trick as in status_request is > > not completely trivial because extensions that are answered in client > > Certificate are offered in CertificateRequest. Okay, except that > > extension is not an answer to ClientHello extensions, and the > > extension assumes offer-answer relationship between client and server > > extensions. Might need some special-casing. > > Yeah, I think we should probably just consider banning user_mapping, > at least until someone comes up with a way to use it here. IIRC, you asked "does anyone use this" before and some MS guys said yes, they use it. Or at least I remember some guys saying that they use it. > Could be useful to have explicit list of extensions (no registry, since > > this list can be never updated) that lists extensions that are > > deprecated in TLS 1.3. > > > > Currently this is by exclusion. I.e., these aren't listed as usable with > 1.3. It does seem to me that we shouldn't ban cached_info and > the cert type ones, because if/when they become usable with 1.3 > then they should be permissible. So I think I would rather say > "don't advertise these with 1.3 unless you're willing to do them > with 1.3" The problem here is, one can't do that with TLS 1.2+1.3 dual-version either. If client doesn't know what extension X means in TLS 1.3 (but does know it for TLS 1.2), if it advertises it, it runs the risk that server does in fact know what X does in TLS 1.3, and then blows up when server acts accordingly. -Ilari From nobody Fri Mar 10 08:43:22 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B63DD12949E for ; Fri, 10 Mar 2017 08:43:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9jG5ZGma9a9q for ; Fri, 10 Mar 2017 08:43:19 -0800 (PST) Received: from mail-yw0-x229.google.com (mail-yw0-x229.google.com [IPv6:2607:f8b0:4002:c05::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50915128B38 for ; Fri, 10 Mar 2017 08:43:19 -0800 (PST) Received: by mail-yw0-x229.google.com with SMTP id o4so27172042ywd.3 for ; Fri, 10 Mar 2017 08:43:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=kD0BzwQWnqAdZBXmqtMlIV8gS8/YSJE3hfPncG3TXLw=; b=zOGvanRnqSSR5MbcUeYDBG7b1l0UJgcNrOOr5micd9ElC6iAjXWv0a6BO9sxxZ9ts7 nNGiTlfNxt6HaBsW80CvBolB7pPWDL52L1GtRSAByyHbSrP0N2pBwRzTCYwqqjPcM1H1 5qKFKPGjchEouCnEBNdMR9pGuEQ9AYe57NNFvOVbldPNkgujUcoxMigBeil/hS77Xu5v S/vASFJLiX9bfhTBni9Kf389rfjNMu+WAsrK8afYmacdmv/lsuJDbK5saS2ijG29d85P orIox/j9pVwTYU77Wx3W++f7dQMAQF8IbaO/rhkGTXKBIsvGGv7/Ub7z0DH1PStXf/ah w36Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=kD0BzwQWnqAdZBXmqtMlIV8gS8/YSJE3hfPncG3TXLw=; b=iwdFqETNJ8YGDNSiL/yXYx0Gqj1VAPum8FBl4ymdTz8ir9/tCBl7ETjN+q4Igx1z8O HOyrogZyJVjICueMyxJ3N7amJ4RM3kZpUExD7ThqcNhbE5OQTj8QrMVDJyfs/9dFR/EJ vKbW108xRPWuuDTBewFsuL4KIHBnsm68BeviMaK/nikJQYiAZNNu/RE+zHhoZ4zCR6PR +8vunM85QKFf5qHMsteO/FqxqJE+RznkHmPxoLMmClh6ipWhZgK7hUaDqiGGtxTuLqdx 1pu/HSbn3eEIJgoW7hF2WK4n3GljBYF68JIlgP6Z6CgrTK9YlOwL9qnjV9uHgbgdTjFx p/Ng== X-Gm-Message-State: AMke39n+tmGfW6FlG3NuDQ3MmHqTwP8eJod38JvtjAxoV1s18WlNlaFF6+ugLO/XE2yUM+sgtecCsBKF/mGBSA== X-Received: by 10.129.177.8 with SMTP id p8mr8935358ywh.327.1489164198579; Fri, 10 Mar 2017 08:43:18 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Fri, 10 Mar 2017 08:42:38 -0800 (PST) In-Reply-To: <20170310163738.GA1636@LK-Perkele-V2.elisa-laajakaista.fi> References: <20170310124013.GA1197@LK-Perkele-V2.elisa-laajakaista.fi> <20170310163738.GA1636@LK-Perkele-V2.elisa-laajakaista.fi> From: Eric Rescorla Date: Fri, 10 Mar 2017 08:42:38 -0800 Message-ID: To: Ilari Liusvaara Content-Type: multipart/alternative; boundary=94eb2c13ce3811b0e2054a630f55 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Updating for non-X.509 certificate types X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 16:43:20 -0000 --94eb2c13ce3811b0e2054a630f55 Content-Type: text/plain; charset=UTF-8 On Fri, Mar 10, 2017 at 8:37 AM, Ilari Liusvaara wrote: > On Fri, Mar 10, 2017 at 07:02:22AM -0800, Eric Rescorla wrote: > > On Fri, Mar 10, 2017 at 4:40 AM, Ilari Liusvaara < > ilariliusvaara@welho.com> > > wrote: > > > > > - user_mapping: Has extra handshake message. > > > - cert_type: All the problems of CCertT and SCertT, combined with > > > fixing both to be the same. > > > > > > > Does anyone use this? > > I don't think anyone uses it. cert_type was defined in order to use > OpenPGP certs (RPK has SCertT and CCertT, altough in theory one could > use cert_type). Nobody uses OpenPGP. Even the most notable TLS library > supporting those (GnuTLS) is deprecating it. > > > > With user_mapping, applying similar trick as in status_request is > > > not completely trivial because extensions that are answered in client > > > Certificate are offered in CertificateRequest. Okay, except that > > > extension is not an answer to ClientHello extensions, and the > > > extension assumes offer-answer relationship between client and server > > > extensions. Might need some special-casing. > > > > Yeah, I think we should probably just consider banning user_mapping, > > at least until someone comes up with a way to use it here. > > IIRC, you asked "does anyone use this" before and some MS guys said > yes, they use it. > > Or at least I remember some guys saying that they use it. > > > Could be useful to have explicit list of extensions (no registry, since > > > this list can be never updated) that lists extensions that are > > > deprecated in TLS 1.3. > > > > > > > Currently this is by exclusion. I.e., these aren't listed as usable with > > 1.3. It does seem to me that we shouldn't ban cached_info and > > the cert type ones, because if/when they become usable with 1.3 > > then they should be permissible. So I think I would rather say > > "don't advertise these with 1.3 unless you're willing to do them > > with 1.3" > > The problem here is, one can't do that with TLS 1.2+1.3 dual-version > either. If client doesn't know what extension X means in TLS 1.3 > (but does know it for TLS 1.2), if it advertises it, it runs the > risk that server does in fact know what X does in TLS 1.3, and then > blows up when server acts accordingly. > Right. I am saying that you must not offer these and 1.3 simultaneously unless you implement whatever 1.3 thingy we finally define for it. -Ekr > > > -Ilari > > > --94eb2c13ce3811b0e2054a630f55 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Fri, Mar 10, 2017 at 8:37 AM, Ilari Liusvaara <= ilariliusvaar= a@welho.com> wrote:
On Fri, Mar 10, 2017 at 07:02:22AM -0800, Eric Rescorla wrote: > On Fri, Mar 10, 2017 at 4:40 AM, Ilari Liusvaara <ilariliusvaara@welho.com>
> wrote:
>
> > - user_mapping: Has extra handshake messa= ge.
> > - cert_type: All the problems of CCertT and SCertT, combined with=
> >=C2=A0 =C2=A0fixing both to be the same.
> >
>
> Does anyone use this?

I don't think anyone uses it. cert_type was defined in order to = use
OpenPGP certs (RPK has SCertT and CCertT, altough in theory one could
use cert_type). Nobody uses OpenPGP. Even the most notable TLS library
supporting those (GnuTLS) is deprecating it.

> > With user_mapping, applying similar trick as in status_request is=
> > not completely trivial because extensions that are answered in cl= ient
> > Certificate are offered in CertificateRequest. Okay, except that<= br> > > extension is not an answer to ClientHello extensions, and the
> > extension assumes offer-answer relationship between client and se= rver
> > extensions. Might need some special-casing.
>
> Yeah, I think we should probably just consider banning user_mapping, > at least until someone comes up with a way to use it here.

IIRC, you asked "does anyone use this" before and some MS = guys said
yes, they use it.

Or at least I remember some guys saying that they use it.

> Could be useful to have explicit list of extensions (no registry, sinc= e
> > this list can be never updated) that lists extensions that are > > deprecated in TLS 1.3.
> >
>
> Currently this is by exclusion. I.e., these aren't listed as usabl= e with
> 1.3. It does seem to me that we shouldn't ban cached_info and
> the cert type ones, because if/when they become usable with 1.3
> then they should be permissible. So I think I would rather say
> "don't advertise these with 1.3 unless you're willing to = do them
> with 1.3"

The problem here is, one can't do that with TLS 1.2+1.3 dual-ver= sion
either. If client doesn't know what extension X means in TLS 1.3
(but does know it for TLS 1.2), if it advertises it, it runs the
risk that server does in fact know what X does in TLS 1.3, and then
blows up when server acts accordingly.

= Right. I am saying that you must not offer these and 1.3 simultaneously
unless you implement whatever 1.3 thingy we finally define for it.

-Ekr
=C2=A0


-Ilari



--94eb2c13ce3811b0e2054a630f55-- From nobody Fri Mar 10 09:24:35 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD6CD1299D2 for ; Fri, 10 Mar 2017 09:24:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4NsejL3vt1np for ; Fri, 10 Mar 2017 09:24:20 -0800 (PST) Received: from welho-filter3.welho.com (welho-filter3.welho.com [83.102.41.25]) by ietfa.amsl.com (Postfix) with ESMTP id 2A0F912999D for ; Fri, 10 Mar 2017 09:23:57 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by welho-filter3.welho.com (Postfix) with ESMTP id E63941F03A; Fri, 10 Mar 2017 19:23:55 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp2.welho.com ([IPv6:::ffff:83.102.41.85]) by localhost (welho-filter3.welho.com [::ffff:83.102.41.25]) (amavisd-new, port 10024) with ESMTP id oVN4uvp22Ztb; Fri, 10 Mar 2017 19:23:55 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp2.welho.com (Postfix) with ESMTPSA id AE7CB21C; Fri, 10 Mar 2017 19:23:55 +0200 (EET) Date: Fri, 10 Mar 2017 19:23:49 +0200 From: Ilari Liusvaara To: Eric Rescorla Message-ID: <20170310172349.GC1636@LK-Perkele-V2.elisa-laajakaista.fi> References: <20170310124013.GA1197@LK-Perkele-V2.elisa-laajakaista.fi> <20170310163738.GA1636@LK-Perkele-V2.elisa-laajakaista.fi> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Updating for non-X.509 certificate types X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 17:24:29 -0000 On Fri, Mar 10, 2017 at 08:42:38AM -0800, Eric Rescorla wrote: > On Fri, Mar 10, 2017 at 8:37 AM, Ilari Liusvaara > wrote: > > > The problem here is, one can't do that with TLS 1.2+1.3 dual-version > > either. If client doesn't know what extension X means in TLS 1.3 > > (but does know it for TLS 1.2), if it advertises it, it runs the > > risk that server does in fact know what X does in TLS 1.3, and then > > blows up when server acts accordingly. > > > > Right. I am saying that you must not offer these and 1.3 simultaneously > unless you implement whatever 1.3 thingy we finally define for it. I think that is a bad idea. And after all, all the currently deprecated extensions are allowed in multi-version TLS 1.3 ClientHello. And sometimes that is rather important, given that this list contains security fix extensions like extended_master_secret and renegotiation_info. Also, I think that the definition of certificate types is so bad that making the thing work in TLS 1.3 is not going to be feasible. Which impiles replicating the functions with new extensions with completely new semantics. The reason is, cert_types see fit to completely redefine the certficate message in all sorts of ways. And mapping those ways to standard TLS 1.3 Certificate message structure is too hard. cached_info is much much easier. Basically if its extension is moved to EE, but everything else held constant, it will AFAICT work in TLS 1.3 just fine, including in dual-version cases. If you get the version wrong, things still work (smooth fallback) because of hash check. -Ilari From nobody Fri Mar 10 09:43:05 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E7AB129449 for ; Fri, 10 Mar 2017 09:43:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JmRPD5VTzvh7 for ; Fri, 10 Mar 2017 09:43:03 -0800 (PST) Received: from mail-yw0-x230.google.com (mail-yw0-x230.google.com [IPv6:2607:f8b0:4002:c05::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB6DA127077 for ; Fri, 10 Mar 2017 09:43:02 -0800 (PST) Received: by mail-yw0-x230.google.com with SMTP id v76so28227292ywg.0 for ; Fri, 10 Mar 2017 09:43:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=tEsLkUjdqNudOS1dXhMhGx6Xhh9Y86rzhmPHolrJkro=; b=GOMJytjbdfXcMfLQoPwow/86DwzrN0QlwqEAJEPzpPRgtKPSdoWO+K1DQynL7DYtlu 30UjcueO+Lp4253YuPKfBaXE1yCXaWoG2J+S3vYGJLbZ/Y9Z7Ps17SRKWmhpVLyEkXGD XPMOPbFb0DR6HSNzspkW7mbZflaErCnEwUF4N5TDKn2SHktSMn2YvIseJ9Opt58Xuxo7 Ho4QPjvwzY1cLl5ovE/S+YuhwghfWEUDyC3DTwKg/AZXJT4crV84Teu21TxOJ/+nJsj7 qxo232Fm73daosuBin8caH+fuLaxbOsst33xegIi4oUt9QXH8hZBpWpElkBKB0ZzavPH JdeA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=tEsLkUjdqNudOS1dXhMhGx6Xhh9Y86rzhmPHolrJkro=; b=evDDwluzc1TkaV671fdLNhtPYzi2DeZqAT0Y+4+3tPI6QFnFznswpL34vlyXIIBf2s 3PisHQA9ogOKMJ7T4aSEiF8ih0SV+NDZQEXC0SVrsXKZq4VzUK2k2c1SGo8MpSIhicSH X34oMgYFRn+GVu/PYoOTkp4DoBcBXqBjGNyiiqsErB8kPO+fn6ienUfY/BaLIKVy/eRf aXUi9usmdD7NmrUrlV6zuyPmPBHx7J1o+YwbQlWUbL8SRjQfnK3aQ6hfoE/Q7sGAP/vf OUemkBzMwwc9oB3soXuF7jn8QWSy/eTAhr48+fIS9bDgTFWjejrxbUTjJCQGis3XLW6h Gi6Q== X-Gm-Message-State: AMke39ka/CbibaQyl8EjO9d2HilgdITtO9uV6p0qSq9nXfrmvTa1zYr//7PotzHqOMu5YDsrlXpBFWUPziQXQw== X-Received: by 10.129.92.2 with SMTP id q2mr8965799ywb.87.1489167782111; Fri, 10 Mar 2017 09:43:02 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Fri, 10 Mar 2017 09:42:21 -0800 (PST) In-Reply-To: <20170310172349.GC1636@LK-Perkele-V2.elisa-laajakaista.fi> References: <20170310124013.GA1197@LK-Perkele-V2.elisa-laajakaista.fi> <20170310163738.GA1636@LK-Perkele-V2.elisa-laajakaista.fi> <20170310172349.GC1636@LK-Perkele-V2.elisa-laajakaista.fi> From: Eric Rescorla Date: Fri, 10 Mar 2017 09:42:21 -0800 Message-ID: To: Ilari Liusvaara Content-Type: multipart/alternative; boundary=001a114d6f16aa4256054a63e463 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Updating for non-X.509 certificate types X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 17:43:04 -0000 --001a114d6f16aa4256054a63e463 Content-Type: text/plain; charset=UTF-8 On Fri, Mar 10, 2017 at 9:23 AM, Ilari Liusvaara wrote: > On Fri, Mar 10, 2017 at 08:42:38AM -0800, Eric Rescorla wrote: > > On Fri, Mar 10, 2017 at 8:37 AM, Ilari Liusvaara < > ilariliusvaara@welho.com> > > wrote: > > > > > > The problem here is, one can't do that with TLS 1.2+1.3 dual-version > > > either. If client doesn't know what extension X means in TLS 1.3 > > > (but does know it for TLS 1.2), if it advertises it, it runs the > > > risk that server does in fact know what X does in TLS 1.3, and then > > > blows up when server acts accordingly. > > > > > > > Right. I am saying that you must not offer these and 1.3 simultaneously > > unless you implement whatever 1.3 thingy we finally define for it. > > I think that is a bad idea. > > And after all, all the currently deprecated extensions are allowed in > multi-version TLS 1.3 ClientHello. And sometimes that is rather > important, given that this list contains security fix extensions like > extended_master_secret and renegotiation_info. > Well, those are different: those are extensions which we know will never work for 1.3, not which have not been defined for 1.3. Also, I think that the definition of certificate types is so bad that > making the thing work in TLS 1.3 is not going to be feasible. Which > impiles replicating the functions with new extensions with completely > new semantics. I could also live with this. -Ekr > The reason is, cert_types see fit to completely redefine the certficate > message in all sorts of ways. And mapping those ways to standard TLS > 1.3 Certificate message structure is too hard. > > > > cached_info is much much easier. Basically if its extension is moved > to EE, but everything else held constant, it will AFAICT work in > TLS 1.3 just fine, including in dual-version cases. If you get > the version wrong, things still work (smooth fallback) because of > hash check. > > > > > > -Ilari > --001a114d6f16aa4256054a63e463 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Fri, Mar 10, 2017 at 9:23 AM, Ilari Liusvaara <= ilariliusvaar= a@welho.com> wrote:
On Fri, Mar 10, 2017 at 08:42:38AM -0800, Eric Rescorla wrote: > On Fri, Mar 10, 2017 at 8:37 AM, Ilari Liusvaara <ilariliusvaara@welho.com>
> wrote:
>

> > The problem here is, one can't do tha= t with TLS 1.2+1.3 dual-version
> > either. If client doesn't know what extension X means in TLS = 1.3
> > (but does know it for TLS 1.2), if it advertises it, it runs the<= br> > > risk that server does in fact know what X does in TLS 1.3, and th= en
> > blows up when server acts accordingly.
> >
>
> Right. I am saying that you must not offer these and 1.3 simultaneousl= y
> unless you implement whatever 1.3 thingy we finally define for it.

I think that is a bad idea.

And after all, all the currently deprecated extensions are allowed in
multi-version TLS 1.3 ClientHello. And sometimes that is rather
important, given that this list contains security fix extensions like
extended_master_secret and renegotiation_info.

Well, those are different: those are extensions which we know will<= /div>
never work for 1.3, not which have not been defined for 1.3.


Also, I think that the definition of certificate types is so bad that
making the thing work in TLS 1.3 is not going to be feasible. Which
impiles replicating the functions with new extensions with completely
new semantics.

I could also live with this.=

-Ekr


=C2= =A0
The reason is, cert_types see fit to completely redefine the certficate
message in all sorts of ways. And mapping those ways to standard TLS
1.3 Certificate message structure is too hard.



cached_info is much much easier. Basically if its extension is moved
to EE, but everything else held constant, it will AFAICT work in
TLS 1.3 just fine, including in dual-version cases. If you get
the version wrong, things still work (smooth fallback) because of
hash check.







-Ilari

--001a114d6f16aa4256054a63e463-- From nobody Fri Mar 10 10:04:59 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4AC41294C7 for ; Fri, 10 Mar 2017 10:04:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yg9vYUc1YWqw for ; Fri, 10 Mar 2017 10:04:56 -0800 (PST) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0124.outbound.protection.outlook.com [104.47.38.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 852611293D6 for ; Fri, 10 Mar 2017 10:04:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=qZ34/g22MZDgwy1UChoQwJs6PHKoHz/svqGiLoFqgR4=; b=nwJi9XI3HYGr48i6YTxpNWhRjBRB1iwBLvudZBW4KCXQgHwNXdrk614WaFiL0Ou3CXGuqc0o/iueOt1yG4+thLCbvTOwU5sm4t8v/I0pZoXNUgaiFaUZHP7OSSOErYZQRaM62d75WqsfsnyiWJhJ2IT/pxJHGmt1MpeN9oX18c4= Received: from DM2PR21MB0091.namprd21.prod.outlook.com (10.161.141.14) by DM2PR21MB0089.namprd21.prod.outlook.com (10.161.141.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.977.2; Fri, 10 Mar 2017 18:04:54 +0000 Received: from DM2PR21MB0091.namprd21.prod.outlook.com ([10.161.141.14]) by DM2PR21MB0091.namprd21.prod.outlook.com ([10.161.141.14]) with mapi id 15.01.0977.006; Fri, 10 Mar 2017 18:04:54 +0000 From: Andrei Popov To: Eric Rescorla , Ilari Liusvaara Thread-Topic: [TLS] Updating for non-X.509 certificate types Thread-Index: AQHSmUYgLR+P/8VK8EmBfveqy8TqsqGOBGCAgAAntwCAABqeAIAAAWYAgAAV3vA= Date: Fri, 10 Mar 2017 18:04:54 +0000 Message-ID: References: <20170310124013.GA1197@LK-Perkele-V2.elisa-laajakaista.fi> <20170310163738.GA1636@LK-Perkele-V2.elisa-laajakaista.fi> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: rtfm.com; dkim=none (message not signed) header.d=none;rtfm.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:5::1d2] x-microsoft-exchange-diagnostics: 1; DM2PR21MB0089; 7:M7C+B/9P9GBkZblxqsWDmUF6dCnOlE1mLCzpa6XaAFRus07ErBqXrA5agKlTrW9OHopzCOg1jP5h+J9J1zZtiGJzVpjjQQtLnQTEnW5bQ9Y1HuP0Wpt7ArLqTf6Y3HqtqY4nAGneXh+1udo5u2chf2RjQe6QaC4EqVAejFpTKGoo5WjKo5wEnl45Rs46jU0ZQ4n2pVchRSzGivPqKsXpcK4CErkwuunTTAOwVuSxeWMNwmLUNHtPl65uyGWjv6XM0kNIL9W8UMsE/+BCZZZkwErQr9o20UVwHHoECWmGlKZJzuXmz2xIhdM6YJAG0VRHCCFJgI9xhE6vUethyUYpmv/VeIVx6feiLc6YwJkGn+E= x-ms-office365-filtering-correlation-id: 3c01c510-f6d1-4e40-c89e-08d467dff485 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:DM2PR21MB0089; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123560025)(20161123564025)(20161123562025)(20161123558025)(6072148); SRVR:DM2PR21MB0089; BCL:0; PCL:0; RULEID:; SRVR:DM2PR21MB0089; x-forefront-prvs: 02426D11FE x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(39450400003)(39840400002)(39850400002)(39860400002)(39410400002)(3280700002)(74316002)(5005710100001)(99286003)(6116002)(102836003)(54896002)(6306002)(54356999)(3660700001)(76176999)(86612001)(77096006)(50986999)(790700001)(7736002)(53936002)(6506006)(2906002)(2900100001)(55016002)(9686003)(6246003)(8676002)(5660300001)(106116001)(10290500002)(558084003)(2950100002)(4326008)(81166006)(33656002)(93886004)(38730400002)(122556002)(8936002)(7696004)(86362001)(229853002)(25786008)(6436002)(10090500001)(189998001); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR21MB0089; H:DM2PR21MB0091.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM2PR21MB00914AC3F20BF3D8E266F0768C200DM2PR21MB0091namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Mar 2017 18:04:54.1556 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR21MB0089 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Updating for non-X.509 certificate types X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 18:04:58 -0000 --_000_DM2PR21MB00914AC3F20BF3D8E266F0768C200DM2PR21MB0091namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 w5ggIERvZXMgYW55b25lIHVzZSB0aGlzPw0KDQrDmCAgSSBkb24ndCB0aGluayBhbnlvbmUgdXNl cyBpdC4NCg0KQXUgY29udHJhaXJlOiBXaW5kb3dzIFRMUyBzdGFjayBzdXBwb3J0cyB1c2VyX21h cHBpbmcgYW5kIHRoaXMgbWVjaGFuaXNtIGFwcGVhcnMgdG8gYmUgc29tZXdoYXQgaW4gdXNlLiBI b3dldmVyLCBJIGFncmVlIHRoYXQgdGhpcyBmYWxscyBpbnRvIHRoZSBjYXRlZ29yeSBvZiBleHRl bnNpb25zIHRoYXQgbmVlZCB0byBiZSBlaXRoZXIgZGVwcmVjYXRlZCBvciByZWRlZmluZWQgZm9y IFRMUyAxLjMuDQoNCkNoZWVycywNCg0KQW5kcmVpDQo= --_000_DM2PR21MB00914AC3F20BF3D8E266F0768C200DM2PR21MB0091namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNv TGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgN Cgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIixzZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29u b3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0K CW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1l cyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uaG9lbnpiDQoJe21zby1zdHlsZS1uYW1lOmhvZW56 Yjt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsN Cglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30N Ci5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjgu NWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRT ZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpA bGlzdCBsMA0KCXttc28tbGlzdC1pZDoxMTAzNjg1MTA7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7 DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi03Nzc0NjM1NDQgODQ3NTQxNDMwIDY3Njk4NjkxIDY3 Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4 NjkzO30NCkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6MjsNCgltc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674OYOw0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCW1zby1mYXJlYXN0LWZv bnQtZmFtaWx5OkNhbGlicmk7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21h biI7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1p bHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDUN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBs aXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2lu Z2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9u dC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRl eHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0Kb2wNCgl7bWFyZ2lu LWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+PC9zdHlsZT48IS0t W2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRt YXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4N CjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRh PSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJv ZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0i V29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1p bmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj48IVtpZiAhc3VwcG9ydExpc3Rz XT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpXaW5nZGluZ3MiPjxz cGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPsOYPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1 b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwh W2VuZGlmXT5Eb2VzIGFueW9uZSB1c2UgdGhpcz88c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRl bnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj48IVtpZiAhc3VwcG9ydExpc3RzXT48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpXaW5nZGluZ3MiPjxzcGFu IHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPsOYPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7 VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2Vu ZGlmXT5JIGRvbid0IHRoaW5rIGFueW9uZSB1c2VzIGl0LjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPkF1IGNvbnRyYWlyZTogV2luZG93cyBUTFMgc3RhY2sgc3VwcG9ydHMgdXNlcl9t YXBwaW5nIGFuZCB0aGlzIG1lY2hhbmlzbSBhcHBlYXJzIHRvIGJlIHNvbWV3aGF0IGluIHVzZS4g SG93ZXZlciwgSSBhZ3JlZSB0aGF0IHRoaXMgZmFsbHMgaW50byB0aGUgY2F0ZWdvcnkgb2YgZXh0 ZW5zaW9ucyB0aGF0DQogbmVlZCB0byBiZSBlaXRoZXIgZGVwcmVjYXRlZCBvciByZWRlZmluZWQg Zm9yIFRMUyAxLjMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZx dW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkNoZWVycyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+QW5kcmVp PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_DM2PR21MB00914AC3F20BF3D8E266F0768C200DM2PR21MB0091namp_-- From nobody Fri Mar 10 10:42:56 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB87112952C for ; Fri, 10 Mar 2017 10:42:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WbEpAM07wTyn for ; Fri, 10 Mar 2017 10:42:51 -0800 (PST) Received: from welho-filter2.welho.com (welho-filter2.welho.com [83.102.41.24]) by ietfa.amsl.com (Postfix) with ESMTP id 8E2DA12942F for ; Fri, 10 Mar 2017 10:42:50 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by welho-filter2.welho.com (Postfix) with ESMTP id AFAFB1B04D; Fri, 10 Mar 2017 20:42:47 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp3.welho.com ([IPv6:::ffff:83.102.41.86]) by localhost (welho-filter2.welho.com [::ffff:83.102.41.24]) (amavisd-new, port 10024) with ESMTP id axUnDy8d-bbK; Fri, 10 Mar 2017 20:42:47 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp3.welho.com (Postfix) with ESMTPSA id 73DF22310; Fri, 10 Mar 2017 20:42:47 +0200 (EET) Date: Fri, 10 Mar 2017 20:42:41 +0200 From: Ilari Liusvaara To: Andrei Popov Message-ID: <20170310184241.GA5016@LK-Perkele-V2.elisa-laajakaista.fi> References: <20170310124013.GA1197@LK-Perkele-V2.elisa-laajakaista.fi> <20170310163738.GA1636@LK-Perkele-V2.elisa-laajakaista.fi> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Updating for non-X.509 certificate types X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 18:42:54 -0000 On Fri, Mar 10, 2017 at 06:04:54PM +0000, Andrei Popov wrote: > Ø Does anyone use this? > > Ø I don't think anyone uses it. > > Au contraire: Windows TLS stack supports user_mapping and this > mechanism appears to be somewhat in use. However, I agree that > this falls into the category of extensions that need to be either > deprecated or redefined for TLS 1.3. Oh, sorry, quoting context fail: I meant that nobody uses cert_type, not that nobody uses user_mapping. -Ilari From nobody Fri Mar 10 10:53:06 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 299BA1295B2 for ; Fri, 10 Mar 2017 10:53:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.022 X-Spam-Level: X-Spam-Status: No, score=-2.022 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nE2bBI73N0IX for ; Fri, 10 Mar 2017 10:53:03 -0800 (PST) Received: from NAM01-SN1-obe.outbound.protection.outlook.com (mail-sn1nam01on0096.outbound.protection.outlook.com [104.47.32.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4BCBA12952C for ; Fri, 10 Mar 2017 10:53:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=0yGgv0eRO8BqIG3Y6H7K7FI21QEYh+XyhfID/en7tUI=; b=RMt4GC/NPeSTV0nKwsIgJRSsRuhDG4xqZ408OzfpxwkycVk0f2Xuh1PsKuwj1188HHxD76Yaq51lCowogU3cuHUrMWT4Flyujb5C7GIt1gdxAfpe3/EBm3PQrWXan9gwhXrCVQNahZQCC67N5tvRG2Div48AG85Y7RPRsGRlEj0= Received: from DM2PR21MB0091.namprd21.prod.outlook.com (10.161.141.14) by DM2PR21MB0090.namprd21.prod.outlook.com (10.161.141.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.977.2; Fri, 10 Mar 2017 18:53:01 +0000 Received: from DM2PR21MB0091.namprd21.prod.outlook.com ([10.161.141.14]) by DM2PR21MB0091.namprd21.prod.outlook.com ([10.161.141.14]) with mapi id 15.01.0977.006; Fri, 10 Mar 2017 18:53:01 +0000 From: Andrei Popov To: "ilariliusvaara@welho.com" Thread-Topic: [TLS] Updating for non-X.509 certificate types Thread-Index: AQHSmUYgLR+P/8VK8EmBfveqy8TqsqGOBGCAgAAntwCAABqeAIAAAWYAgAAV3vCAAAusgIAAAPvw Date: Fri, 10 Mar 2017 18:53:01 +0000 Message-ID: References: <20170310124013.GA1197@LK-Perkele-V2.elisa-laajakaista.fi> <20170310163738.GA1636@LK-Perkele-V2.elisa-laajakaista.fi> <20170310184241.GA5016@LK-Perkele-V2.elisa-laajakaista.fi> In-Reply-To: <20170310184241.GA5016@LK-Perkele-V2.elisa-laajakaista.fi> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: welho.com; dkim=none (message not signed) header.d=none;welho.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:5::1d2] x-microsoft-exchange-diagnostics: 1; DM2PR21MB0090; 7:y9lFPyD/A3cVc0h86kMkh87tqt1Si5/CkuIVwCWNiyW1HAm0F0wxCSz0n1m5HJEcGazeI+hDeAMs5fYt3r+QdVfGMSpT9aQyCHV7TyE9IcHNILlzcebhBeD0y2dVEX0Zl8gO5ceUautnwJ1HyoaM/WpYoTCz4+/IqClD52ZdMtxYoGperUnRj48sUq3lzmJtBqal6uxvEc5aVw9ebezGKlhUQ5tIQs7ANU5VBUws5JE9zF3dQeDr4wzWskbfUtGCa+n5mXR3s5+SblfBm4+C0P+cAs6E5X95f6vQ0bwZmpwswIS1Iayk6PNICwIaP9gaAo974wzVvj6Jx/sd0JEvjkwIrsSRMH8Uk7UrH5Ji0DI= x-ms-office365-filtering-correlation-id: 18e7fefe-eb9e-40d4-5a3c-08d467e6ad8e x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:DM2PR21MB0090; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123560025)(20161123558025)(20161123562025)(20161123564025)(6072148); SRVR:DM2PR21MB0090; BCL:0; PCL:0; RULEID:; SRVR:DM2PR21MB0090; x-forefront-prvs: 02426D11FE x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(979002)(6009001)(39850400002)(39860400002)(39840400002)(39450400003)(39410400002)(377454003)(13464003)(24454002)(122556002)(8990500004)(5005710100001)(6116002)(189998001)(33656002)(2906002)(102836003)(50986999)(54356999)(76176999)(53546006)(38730400002)(2351001)(110136004)(6246003)(53936002)(4326008)(81166006)(2501003)(10290500002)(8936002)(1730700003)(8676002)(3280700002)(6436002)(25786008)(5640700003)(229853002)(106116001)(77096006)(3660700001)(6506006)(7736002)(10090500001)(2900100001)(305945005)(93886004)(9686003)(54906002)(55016002)(99286003)(86612001)(6916009)(86362001)(2950100002)(5660300001)(74316002)(7696004)(969003)(989001)(999001)(1009001)(1019001); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR21MB0090; H:DM2PR21MB0091.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Mar 2017 18:53:01.5747 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR21MB0090 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Updating for non-X.509 certificate types X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 18:53:05 -0000 V2VsbCwgYWRtaXR0ZWRseSBuZWl0aGVyIHVzZXJfbWFwcGluZywgbm9yIGNlcnRfdHlwZSBpcyBo dWdlbHkgcG9wdWxhci4gDQpJdCB3b3VsZCBub3QgbWFrZSBzZW5zZSBmb3IgdGhlIFRMUyAxLjMg c3BlYyB0byBiZSBvbiBob2xkIHVudGlsIHRoZXNlIGV4dGVuc2lvbnMgYXJlIHJlY29uY2lsZWQg d2l0aCBpdC4NCg0KSG93ZXZlciwgSSBkbyB0aGluayB0aGF0IGEgVExTIDEuMyBDbGllbnRIZWxs byBzaG91bGQgYmUgYWJsZSB0byBhZHZlcnRpc2UgZXh0ZW5zaW9ucyB0aGF0IGFyZSBub3QgZGVm aW5lZCBmb3IgVExTIDEuMywgd2hlbiB0aGUgY2xpZW50IGlzIHdpbGxpbmcgdG8gYWNjZXB0IFRM Uzw9MS4yLg0KDQpDaGVlcnMsDQoNCkFuZHJlaQ0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0t LQ0KRnJvbTogaWxhcmlsaXVzdmFhcmFAd2VsaG8uY29tIFttYWlsdG86aWxhcmlsaXVzdmFhcmFA d2VsaG8uY29tXSANClNlbnQ6IEZyaWRheSwgTWFyY2ggMTAsIDIwMTcgMTA6NDMgQU0NClRvOiBB bmRyZWkgUG9wb3YgPEFuZHJlaS5Qb3BvdkBtaWNyb3NvZnQuY29tPg0KQ2M6IEVyaWMgUmVzY29y bGEgPGVrckBydGZtLmNvbT47IHRsc0BpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtUTFNdIFVwZGF0 aW5nIGZvciBub24tWC41MDkgY2VydGlmaWNhdGUgdHlwZXMNCg0KT24gRnJpLCBNYXIgMTAsIDIw MTcgYXQgMDY6MDQ6NTRQTSArMDAwMCwgQW5kcmVpIFBvcG92IHdyb3RlOg0KPiDDmCAgRG9lcyBh bnlvbmUgdXNlIHRoaXM/DQo+IA0KPiDDmCAgSSBkb24ndCB0aGluayBhbnlvbmUgdXNlcyBpdC4N Cj4gDQo+IEF1IGNvbnRyYWlyZTogV2luZG93cyBUTFMgc3RhY2sgc3VwcG9ydHMgdXNlcl9tYXBw aW5nIGFuZCB0aGlzIA0KPiBtZWNoYW5pc20gYXBwZWFycyB0byBiZSBzb21ld2hhdCBpbiB1c2Uu IEhvd2V2ZXIsIEkgYWdyZWUgdGhhdCB0aGlzIA0KPiBmYWxscyBpbnRvIHRoZSBjYXRlZ29yeSBv ZiBleHRlbnNpb25zIHRoYXQgbmVlZCB0byBiZSBlaXRoZXIgDQo+IGRlcHJlY2F0ZWQgb3IgcmVk ZWZpbmVkIGZvciBUTFMgMS4zLg0KDQpPaCwgc29ycnksIHF1b3RpbmcgY29udGV4dCBmYWlsOiBJ IG1lYW50IHRoYXQgbm9ib2R5IHVzZXMgY2VydF90eXBlLCBub3QgdGhhdCBub2JvZHkgdXNlcyB1 c2VyX21hcHBpbmcuDQoNCg0KLUlsYXJpDQo= From nobody Fri Mar 10 10:53:31 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F32B1296CA for ; Fri, 10 Mar 2017 10:53:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9GzchBPylxD0 for ; Fri, 10 Mar 2017 10:53:28 -0800 (PST) Received: from mail-yw0-x232.google.com (mail-yw0-x232.google.com [IPv6:2607:f8b0:4002:c05::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 29B97129595 for ; Fri, 10 Mar 2017 10:53:28 -0800 (PST) Received: by mail-yw0-x232.google.com with SMTP id o4so29413656ywd.3 for ; Fri, 10 Mar 2017 10:53:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=wILDW39mhEm38u9Cf6Vp0umdMtZS0ItpQ5MkV7RTsVg=; b=RMvBy/mIQwYneV4wsSdmjswBl991fuhVSm2FlJOZUEHu8Air1eFv99fcFb/7JiVEDY TXbu3syLw2L6Zs38v6cj9UBCSqzCSkDlGzY1JGpLsNKcJba6XmDIYOjhGMK4as/bIziF cVHCtNqu+yHa4gJtbgt6C0Cb69u4b2K1TZshG4OKaefm1JghIP9/r3E9iTYlIi0/KxU9 d/287s9x8vSbv71VrxRTFSdVSB5dINFRoX4/8uvjnLyMvYpHBmIJtFzodKTkWF0LlOm7 3pQYAnzj9GjLneyI09pTX6CVog0Cx/FmQjDo98MG86bbM7WT/9iRjDgjrxYfi5ARkZe1 7uqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=wILDW39mhEm38u9Cf6Vp0umdMtZS0ItpQ5MkV7RTsVg=; b=Oc8aLT9IaUG5XeOQfiBISiz+fBjXHwnThlEHBoU0gQczw3f3LZm/EhXYfMUVUtBbqZ /JsH6QVm5EdGRodpI26R/r/jGipe5dHr3VQ/ae9tn6pCHnhLqAQq8qsW2gkbbGZpA2qR AE1JtO57uCpBHFYdapgrzFg7zeVgki6BOqAwhqDrxMJTrHmIIaLT1cr9BhWxgv0ERapL pIG1klcZR6SiGloMCHZZDB/qce8Hs/7VuVpSGUHXC22GJmP+QKslmR7tq8+a4I8PcUt/ wLiZKY3CnbKxt/r9++OIiz7VLjJJzbbfylMP1qsxTgPZ9c2cKNYBPQCuHaLoDpeBZr9D AqYA== X-Gm-Message-State: AMke39l0+k5nCyvVgIP8bNyn06YJyj3W+yiuIsbc2FK46mTQRbADWdB2hl1SVtShC400aB5j/TkNk3GzZdQgjg== X-Received: by 10.129.108.214 with SMTP id h205mr8992746ywc.71.1489172007437; Fri, 10 Mar 2017 10:53:27 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Fri, 10 Mar 2017 10:52:46 -0800 (PST) In-Reply-To: References: <20170310124013.GA1197@LK-Perkele-V2.elisa-laajakaista.fi> <20170310163738.GA1636@LK-Perkele-V2.elisa-laajakaista.fi> From: Eric Rescorla Date: Fri, 10 Mar 2017 10:52:46 -0800 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=001a114e81dc8357d5054a64e027 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Updating for non-X.509 certificate types X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 18:53:29 -0000 --001a114e81dc8357d5054a64e027 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Fri, Mar 10, 2017 at 10:04 AM, Andrei Popov wrote: > =C3=98 Does anyone use this? > > =C3=98 I don't think anyone uses it. > > > > Au contraire: Windows TLS stack supports user_mapping and this mechanism > appears to be somewhat in use. However, I agree that this falls into the > category of extensions that need to be either deprecated or redefined for > TLS 1.3. > Are you OK with deprecated followed by redefined with a new code point? -Ekr > > > Cheers, > > > > Andrei > --001a114e81dc8357d5054a64e027 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Fri, Mar 10, 2017 at 10:04 AM, Andrei Popov <Andrei.Popov@= microsoft.com> wrote:

=C3=98=C2=A0 Does anyone use this?

=C3=98=C2=A0 I don't think anyone uses it.

=C2=A0

Au contraire: Windows TLS stack supports user_mappi= ng and this mechanism appears to be somewhat in use. However, I agree that = this falls into the category of extensions that need to be either deprecated or redefined for TLS 1.3.


Are you OK with deprecated followed by = redefined with a new code point?

-Ekr
= =C2=A0

=C2=A0

Cheers,

=C2=A0

Andrei


--001a114e81dc8357d5054a64e027-- From nobody Fri Mar 10 11:26:57 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E166A1296F5 for ; Fri, 10 Mar 2017 11:26:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.021 X-Spam-Level: X-Spam-Status: No, score=-2.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J5bCWPJdmwrM for ; Fri, 10 Mar 2017 11:26:54 -0800 (PST) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0112.outbound.protection.outlook.com [104.47.41.112]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4F5FB1296F2 for ; Fri, 10 Mar 2017 11:26:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=N4sUOlHiMJDat2XCjb39SYw73JsWjLhuQKezDsB+FwA=; b=hLAAh5nDLxaf8zYRslCJ46nqgUCEuahv4PCZLyY4Jtp6ruMM1OZ3jkwVnDz4g45SCvdE490VRmuvA5kGyfos9sgEWJYPgkGgwYAi27EEUiPMnxRFXAHBqXG0Rx3/omZV+ef6bQN1ywoHTSLywYEchmbA0VlEXU+3zaLeMaAZL18= Received: from DM2PR21MB0091.namprd21.prod.outlook.com (10.161.141.14) by DM2PR21MB0089.namprd21.prod.outlook.com (10.161.141.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.977.2; Fri, 10 Mar 2017 19:26:49 +0000 Received: from DM2PR21MB0091.namprd21.prod.outlook.com ([10.161.141.14]) by DM2PR21MB0091.namprd21.prod.outlook.com ([10.161.141.14]) with mapi id 15.01.0977.006; Fri, 10 Mar 2017 19:26:49 +0000 From: Andrei Popov To: Eric Rescorla Thread-Topic: [TLS] Updating for non-X.509 certificate types Thread-Index: AQHSmUYgLR+P/8VK8EmBfveqy8TqsqGOBGCAgAAntwCAABqeAIAAAWYAgAAV3vCAAA5+AIAAAG2A Date: Fri, 10 Mar 2017 19:26:49 +0000 Message-ID: References: <20170310124013.GA1197@LK-Perkele-V2.elisa-laajakaista.fi> <20170310163738.GA1636@LK-Perkele-V2.elisa-laajakaista.fi> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: rtfm.com; dkim=none (message not signed) header.d=none;rtfm.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:5::1d2] x-microsoft-exchange-diagnostics: 1; DM2PR21MB0089; 7:zJlcMUuaiuXvYNTJtjnSJI+BgGmKMmCyRB9ppRMobjb+4sw0oU3WYvulNxA6o2tAk7225/D/UKV40TLxZfyqlF9tvZjMszpZScVlJ18FII6Cjx2aqHLIOXijp0n6BUjbTNG8ZgV+Bm/huYLTSxHLfm2yGDlyI7K0I/nfObKgx0T5CABraqKg1nS6LPJlJRBVSdEt55gdeZbkR6CVKXX59XTEEQusBkoOdbtb7iHaW0XdNqMBeH3zpVT8KK4XAc+7P0aFwEP3l4A/vu4x6SOzKmoeV+LF+rHn0JnZiGHpOifqht6yK9+GJvS2Cwm/K6IrcJjfHWoTqWmp7294mkGo0d06JM3qQtH6taGMLQYfi5U= x-ms-office365-filtering-correlation-id: e7d69023-bf48-4f77-4422-08d467eb6613 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(48565401081); SRVR:DM2PR21MB0089; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040375)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123560025)(20161123558025)(20161123562025)(20161123564025)(6072148); SRVR:DM2PR21MB0089; BCL:0; PCL:0; RULEID:; SRVR:DM2PR21MB0089; x-forefront-prvs: 02426D11FE x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39410400002)(39850400002)(39840400002)(39860400002)(39450400003)(377454003)(24454002)(33656002)(81166006)(4326008)(122556002)(38730400002)(93886004)(110136004)(6916009)(2950100002)(10090500001)(19609705001)(189998001)(86362001)(7696004)(8936002)(6436002)(25786008)(229853002)(6306002)(3660700001)(76176999)(54356999)(86612001)(8990500004)(54896002)(53546006)(77096006)(99286003)(5005710100001)(74316002)(236005)(6116002)(3280700002)(102836003)(54906002)(9686003)(6246003)(2906002)(55016002)(10290500002)(106116001)(2900100001)(8676002)(5660300001)(50986999)(6506006)(7736002)(53936002)(790700001); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR21MB0089; H:DM2PR21MB0091.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM2PR21MB0091397060AD9FD8568F551F8C200DM2PR21MB0091namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Mar 2017 19:26:49.2075 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR21MB0089 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Updating for non-X.509 certificate types X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 19:26:56 -0000 --_000_DM2PR21MB0091397060AD9FD8568F551F8C200DM2PR21MB0091namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SXQgd2lsbCBiZSBpbmVsZWdhbnQgdG8gaGF2ZSB0d28gY29kZSBwb2ludHMgZm9yIHdoYXQgaXMg Y29uY2VwdHVhbGx5IHRoZSBzYW1lIHRoaW5nLCBidXQgSSB0aGluayB0aGlzIGlzIHRoZSBiZXN0 IG9wdGlvbiwgdW5kZXIgdGhlIGNpcmN1bXN0YW5jZXMuDQoNCkNoZWVycywNCg0KQW5kcmVpDQoN CkZyb206IEVyaWMgUmVzY29ybGEgW21haWx0bzpla3JAcnRmbS5jb21dDQpTZW50OiBGcmlkYXks IE1hcmNoIDEwLCAyMDE3IDEwOjUzIEFNDQpUbzogQW5kcmVpIFBvcG92IDxBbmRyZWkuUG9wb3ZA bWljcm9zb2Z0LmNvbT4NCkNjOiBJbGFyaSBMaXVzdmFhcmEgPGlsYXJpbGl1c3ZhYXJhQHdlbGhv LmNvbT47IHRsc0BpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtUTFNdIFVwZGF0aW5nIGZvciBub24t WC41MDkgY2VydGlmaWNhdGUgdHlwZXMNCg0KDQoNCk9uIEZyaSwgTWFyIDEwLCAyMDE3IGF0IDEw OjA0IEFNLCBBbmRyZWkgUG9wb3YgPEFuZHJlaS5Qb3BvdkBtaWNyb3NvZnQuY29tPG1haWx0bzpB bmRyZWkuUG9wb3ZAbWljcm9zb2Z0LmNvbT4+IHdyb3RlOg0KDQo+ICBEb2VzIGFueW9uZSB1c2Ug dGhpcz8NCg0KPiAgSSBkb24ndCB0aGluayBhbnlvbmUgdXNlcyBpdC4NCg0KQXUgY29udHJhaXJl OiBXaW5kb3dzIFRMUyBzdGFjayBzdXBwb3J0cyB1c2VyX21hcHBpbmcgYW5kIHRoaXMgbWVjaGFu aXNtIGFwcGVhcnMgdG8gYmUgc29tZXdoYXQgaW4gdXNlLiBIb3dldmVyLCBJIGFncmVlIHRoYXQg dGhpcyBmYWxscyBpbnRvIHRoZSBjYXRlZ29yeSBvZiBleHRlbnNpb25zIHRoYXQgbmVlZCB0byBi ZSBlaXRoZXIgZGVwcmVjYXRlZCBvciByZWRlZmluZWQgZm9yIFRMUyAxLjMuDQoNCkFyZSB5b3Ug T0sgd2l0aCBkZXByZWNhdGVkIGZvbGxvd2VkIGJ5IHJlZGVmaW5lZCB3aXRoIGEgbmV3IGNvZGUg cG9pbnQ/DQoNCi1Fa3INCg0KDQpDaGVlcnMsDQoNCkFuZHJlaQ0KDQo= --_000_DM2PR21MB0091397060AD9FD8568F551F8C200DM2PR21MB0091namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNv bm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6 bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQt c2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0KcC5t LTE1MjUxOTUwNDQyODQ3NDQ5NjZtc29saXN0cGFyYWdyYXBoLCBsaS5tLTE1MjUxOTUwNDQyODQ3 NDQ5NjZtc29saXN0cGFyYWdyYXBoLCBkaXYubS0xNTI1MTk1MDQ0Mjg0NzQ0OTY2bXNvbGlzdHBh cmFncmFwaA0KCXttc28tc3R5bGUtbmFtZTptXy0xNTI1MTk1MDQ0Mjg0NzQ0OTY2bXNvbGlzdHBh cmFncmFwaDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0K CW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNp emU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4u aG9lbnpiDQoJe21zby1zdHlsZS1uYW1lOmhvZW56Yjt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXtt c28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fu cy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHls ZS10eXBlOmV4cG9ydC1vbmx5O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDEx LjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9u MQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48 eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwv eG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQg djpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hh cGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIg bGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5JdCB3aWxsIGJlIGluZWxlZ2Fu dCB0byBoYXZlIHR3byBjb2RlIHBvaW50cyBmb3Igd2hhdCBpcyBjb25jZXB0dWFsbHkgdGhlIHNh bWUgdGhpbmcsIGJ1dCBJIHRoaW5rIHRoaXMgaXMgdGhlIGJlc3Qgb3B0aW9uLCB1bmRlciB0aGUg Y2lyY3Vtc3RhbmNlcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Q2hlZXJzLDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5BbmRy ZWk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IEVy aWMgUmVzY29ybGEgW21haWx0bzpla3JAcnRmbS5jb21dDQo8YnI+DQo8Yj5TZW50OjwvYj4gRnJp ZGF5LCBNYXJjaCAxMCwgMjAxNyAxMDo1MyBBTTxicj4NCjxiPlRvOjwvYj4gQW5kcmVpIFBvcG92 ICZsdDtBbmRyZWkuUG9wb3ZAbWljcm9zb2Z0LmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+IElsYXJp IExpdXN2YWFyYSAmbHQ7aWxhcmlsaXVzdmFhcmFAd2VsaG8uY29tJmd0OzsgdGxzQGlldGYub3Jn PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbVExTXSBVcGRhdGluZyBmb3Igbm9uLVguNTA5IGNl cnRpZmljYXRlIHR5cGVzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gRnJpLCBNYXIgMTAs IDIwMTcgYXQgMTA6MDQgQU0sIEFuZHJlaSBQb3BvdiAmbHQ7PGEgaHJlZj0ibWFpbHRvOkFuZHJl aS5Qb3BvdkBtaWNyb3NvZnQuY29tIiB0YXJnZXQ9Il9ibGFuayI+QW5kcmVpLlBvcG92QG1pY3Jv c29mdC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxl PSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGlu IDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJtLTE1MjUxOTUwNDQyODQ3NDQ5NjZtc29saXN0cGFyYWdyYXBo Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpXaW5nZGluZ3MiPsOY PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny4wcHQiPiZuYnNwOw0KPC9zcGFuPkRvZXMg YW55b25lIHVzZSB0aGlzPzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Im0tMTUyNTE5NTA0NDI4 NDc0NDk2Nm1zb2xpc3RwYXJhZ3JhcGgiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OldpbmdkaW5ncyI+w5g8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo3LjBw dCI+Jm5ic3A7DQo8L3NwYW4+SSBkb24ndCB0aGluayBhbnlvbmUgdXNlcyBpdC48bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+QXUgY29udHJhaXJlOiBXaW5kb3dzIFRMUyBzdGFjayBzdXBwb3J0cyB1c2VyX21hcHBpbmcg YW5kIHRoaXMgbWVjaGFuaXNtIGFwcGVhcnMgdG8gYmUgc29tZXdoYXQgaW4gdXNlLiBIb3dldmVy LA0KIEkgYWdyZWUgdGhhdCB0aGlzIGZhbGxzIGludG8gdGhlIGNhdGVnb3J5IG9mIGV4dGVuc2lv bnMgdGhhdCBuZWVkIHRvIGJlIGVpdGhlciBkZXByZWNhdGVkIG9yIHJlZGVmaW5lZCBmb3IgVExT IDEuMy48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3Rl Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QXJlIHlvdSBPSyB3aXRoIGRlcHJlY2F0 ZWQgZm9sbG93ZWQgYnkgcmVkZWZpbmVkIHdpdGggYSBuZXcgY29kZSBwb2ludD88bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LUVrcjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt bGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2lu LWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+Q2hlZXJzLDwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOiM4ODg4ODgiPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6Izg4ODg4OCI+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6Izg4ODg4OCI+QW5kcmVpPC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjojODg4ODg4 Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_DM2PR21MB0091397060AD9FD8568F551F8C200DM2PR21MB0091namp_-- From nobody Fri Mar 10 11:29:35 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A6761296FB for ; Fri, 10 Mar 2017 11:29:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DX5YiBTavloB for ; Fri, 10 Mar 2017 11:29:33 -0800 (PST) Received: from mail-yw0-x236.google.com (mail-yw0-x236.google.com [IPv6:2607:f8b0:4002:c05::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E93161296F5 for ; Fri, 10 Mar 2017 11:29:32 -0800 (PST) Received: by mail-yw0-x236.google.com with SMTP id v198so29934936ywc.2 for ; Fri, 10 Mar 2017 11:29:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=NWEpb3ljc/q/3ACxYSgPwRAaehTHO2TfPtnMdZsuRs4=; b=deypajJl4w17eV91tZkFu6rozmFyUdJFjudoaY8EhxNnyScXX74GEjHXGi6YRnjP95 EK8HbZWOxTAydEkzAIt6vwymxxXJR7cM4vw/RE64FfD0BAPlxApx39AvFwmZiz1Y+4Zt s5dokvHvW0cgHO1hLeYGvu19FAtd1OxHZItRMxStxdV37nLPckwaZfIqN7d5RfpYNGl+ h920UhJvAfHf4Yit31ad1GTg/2al0CbBwxDfbSBW3M8k269e+8SRFHkixy9mdk8/Erag 2qWyjlB3uCwlba+hee9iqnQHfKA2GnUbDiofaQSU2JdyT9w11r1RFExTClIpz6NLxgDY AJTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=NWEpb3ljc/q/3ACxYSgPwRAaehTHO2TfPtnMdZsuRs4=; b=HX4ivE7rnMn/YpcWmsH00xlrzSREPLcChp/Z9VU0KHTz/2XSA6btLOToXIhp5oh634 IVoZF/ga+4hbL0YoMWW6WZEqzm9Tf5m0+ZxaunPCYyRe9MOOqlKGdvJ5DsPFNTI+NQWG m6U8J/TQ6n/MuY1t82xicDIulnQnQhCay9knZP/NZp9WtQiiv7PHWVWuQ6o5wAU08UNY N/tUDWK2iHq5lMgkzZE4PNVYQXmugApi3pkxbtupK2tFzId0gUCbh4QiQyxuQz3zJolZ f0fMNxepOx9CYHB50xSr/LTvvGJQM5cbzoEuPnHB3E4YnZjbo7vgTJfUKoZj6HS6utVk g5zg== X-Gm-Message-State: AMke39nbtmQmdD4pLpIqTDtv0qD6PnUTEOwY3hIvHrSqNzvbHNISWR8cgiELAJW+VNe2tN7yKKymgNwWIU5ehQ== X-Received: by 10.37.97.210 with SMTP id v201mr8785809ybb.65.1489174171982; Fri, 10 Mar 2017 11:29:31 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Fri, 10 Mar 2017 11:28:51 -0800 (PST) In-Reply-To: References: <20170310124013.GA1197@LK-Perkele-V2.elisa-laajakaista.fi> <20170310163738.GA1636@LK-Perkele-V2.elisa-laajakaista.fi> From: Eric Rescorla Date: Fri, 10 Mar 2017 11:28:51 -0800 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=001a1142ed0488258a054a6561a9 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Updating for non-X.509 certificate types X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 19:29:34 -0000 --001a1142ed0488258a054a6561a9 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Thanks On Fri, Mar 10, 2017 at 11:26 AM, Andrei Popov wrote: > It will be inelegant to have two code points for what is conceptually the > same thing, but I think this is the best option, under the circumstances. > > > > Cheers, > > > > Andrei > > > > *From:* Eric Rescorla [mailto:ekr@rtfm.com] > *Sent:* Friday, March 10, 2017 10:53 AM > *To:* Andrei Popov > *Cc:* Ilari Liusvaara ; tls@ietf.org > *Subject:* Re: [TLS] Updating for non-X.509 certificate types > > > > > > > > On Fri, Mar 10, 2017 at 10:04 AM, Andrei Popov > wrote: > > =C3=98 Does anyone use this? > > =C3=98 I don't think anyone uses it. > > > > Au contraire: Windows TLS stack supports user_mapping and this mechanism > appears to be somewhat in use. However, I agree that this falls into the > category of extensions that need to be either deprecated or redefined for > TLS 1.3. > > > > Are you OK with deprecated followed by redefined with a new code point? > > > > -Ekr > > > > > > Cheers, > > > > Andrei > > > --001a1142ed0488258a054a6561a9 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Thanks

On Fri, Mar 10, 2017 at 11:26 AM, Andrei Popov <Andre= i.Popov@microsoft.com> wrote:

It will be inelegant to have two code points for wh= at is conceptually the same thing, but I think this is the best option, und= er the circumstances.

=C2=A0

Cheers,

=C2=A0

Andrei

=C2=A0

From: Eric Rescorla [mailto:ekr@rtfm.com]
Sent: Friday, March 10, 2017 10:53 AM
To: Andrei Popov <Andrei.Popov@microsoft.com>
Cc: Ilari Liusvaara <ilariliusvaara@welho.com>; tls@ietf.org
Subject: Re: [TLS] Updating for non-X.509 certificate types

=C2=A0

=C2=A0

=C2=A0

On Fri, Mar 10, 2017 at 10:04 AM, Andrei Popov <<= a href=3D"mailto:Andrei.Popov@microsoft.com" target=3D"_blank">Andrei.Popov= @microsoft.com> wrote:

=C3=98=C2=A0 Does anyone use this?

=C3=98=C2=A0 I don't think anyone uses it.

=C2=A0

Au contraire: Windows TLS stack supports user_mappi= ng and this mechanism appears to be somewhat in use. However, I agree that this falls into the category of extensions that need to be ei= ther deprecated or redefined for TLS 1.3.

=C2=A0

Are you OK with deprecated followed by redefined wit= h a new code point?

=C2=A0

-Ekr

=C2=A0

=C2=A0

Cheers,

=C2=A0

Andrei

=C2=A0


--001a1142ed0488258a054a6561a9-- From nobody Fri Mar 10 15:09:42 2017 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 1647B12944E; Fri, 10 Mar 2017 15:09:37 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.47.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148918737706.3013.16430797846018636315@ietfa.amsl.com> Date: Fri, 10 Mar 2017 15:09:37 -0800 Archived-At: Cc: tls@ietf.org Subject: [TLS] I-D Action: draft-ietf-tls-tls13-19.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 23:09:37 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Transport Layer Security of the IETF. Title : The Transport Layer Security (TLS) Protocol Version 1.3 Author : Eric Rescorla Filename : draft-ietf-tls-tls13-19.txt Pages : 127 Date : 2017-03-10 Abstract: This document specifies version 1.3 of the Transport Layer Security (TLS) protocol. TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tls-tls13/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-tls-tls13-19 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tls-tls13-19 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Mar 10 15:35:23 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C881A129462 for ; Fri, 10 Mar 2017 15:35:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G7nIYt0IWgwF for ; Fri, 10 Mar 2017 15:35:21 -0800 (PST) Received: from mail-yw0-x230.google.com (mail-yw0-x230.google.com [IPv6:2607:f8b0:4002:c05::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E1A3127A91 for ; Fri, 10 Mar 2017 15:35:21 -0800 (PST) Received: by mail-yw0-x230.google.com with SMTP id v76so33174967ywg.0 for ; Fri, 10 Mar 2017 15:35:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=BFkq6Zu5D5tyD7695ddN2JyWRcdlkDIMj4zq6Ki9wnk=; b=k1lxbeeNtWz9F5THd6MZ83EPU7aDuiXOpwtVd8JArtwA1EcV88CwFIMtZg5LTgvcWM PSDNf1NxIuAEMhLmdtNi5eZNtovH9Dx/eMyPycBPfbEE3/kYA94/YZm5it3b5POaENiS 4gRzM6U70OI8mVk8CqOsrPxoBeSOUI567vCstPGtQMxTbdOs0z/C2TKTYuSKHVwuWFPs PrW/dGpgVOH6qlTC9CiKqP0UyQmzfIanRbYEB5740VhMeOp5duXRyUvco90iBA//Npsc /e5Y5BwYRDVM4YF30D7+xGbc/pk7rncDvR5WakxrZccY1HQL6zO7jZP4VP5zjcg6HaJ7 ym+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=BFkq6Zu5D5tyD7695ddN2JyWRcdlkDIMj4zq6Ki9wnk=; b=NbDq5NO7RnMgCdiiWv2QNRIFgiJD5Xw7hY1qOxKvKE43inyugdJHflLwTVJzKrO+fS /lKT6v0/ipkA9bDN76qUN06HBeW+LgzPRNUPS5iiuwqr5bKpanNhtc1kLbny6bLL9pAi yu87oSJswqSFQOIBq9fXfEz3O+KS3xaH/BtEyu6XXYAaAR3M5zfZ8/CK9Sw0U88Gxv9J kG8JSAXpBQTa1DYxrf7aXjAXtX3yhd0/4FaGycVmYnZ35H0xnBxWasKwCT3FVOD/HnVS wA4F+m6LYjCs5UywNkV5SOVuBDQ0WE1TTIsp+nFGuk0/APzeXRc7PDvYexigCycuRNeI Ngug== X-Gm-Message-State: AMke39ks786pvZp5yIvYxz6tOlFQnggjldzeJOFz7nF+SoNnQNoYMGUwGctGlUpxuP5/vKnEDwCem90wXuAxqQ== X-Received: by 10.129.125.5 with SMTP id y5mr9385238ywc.120.1489188919925; Fri, 10 Mar 2017 15:35:19 -0800 (PST) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Fri, 10 Mar 2017 15:34:39 -0800 (PST) From: Eric Rescorla Date: Fri, 10 Mar 2017 15:34:39 -0800 Message-ID: To: "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a11493644939eb5054a68d038 Archived-At: Subject: [TLS] draft-ietf-tls-tls13-19 posted X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Mar 2017 23:35:23 -0000 --001a11493644939eb5054a68d038 Content-Type: text/plain; charset=UTF-8 I just posted draft-19 at: https://tools.ietf.org/html/draft-ietf-tls-tls13-19 This draft includes all the outstanding wire format changes that I believe we are going to make before publication (changelog below). There are three remaining issues that we need to address somehow. I've listed them and proposed resolutions. 1. DH Key Reuse Considerations (https://github.com/tlswg/tls13-spec/pull/768 ) I'm not entirely confident of the analysis here and I'm not that excited about encouraging people to re-use, so I propose that we simply drop this PR. 2. Short headers (https://github.com/tlswg/tls13-spec/pull/762) Both the Chrome team and the Firefox team have concerns about the middlebox compatibility impact of this change, and I believe if necessary we can add it as an extension later. Thus, I propose we defer it. We can make this change directly in DTLS 1.3, however. 3. The various non-X509 cert RFCs (no PR). As Ilari points out, there is significant incompatibility between these RFCs and TLS 1.3, so we'll probably need new versions of them if people want this functionality. Absent objection, I'll pull them out of the "usable with TLS 1.3 list" in S 4.2 and then add some handwaving about how we can support them with new drafts (though, as Ilari indicates, we may be able to keep cached-info with some small text changes here). In terms of implementation, we will probably try to have something for NSS by IETF, but I doubt it will be actually in Firefox. As usual, comments welcome, including anything I missed. -Ekr ChangeLog: - Hash context_value input to Exporters (*) - Add an additional Derive-Secret stage to Exporters (*). - Hash ClientHello1 in the transcript when HRR is used. This reduces the state that needs to be carried in cookies. (*) - Restructure CertificateRequest to have the selectors in extensions. This also allowed defining a "certificate_authorities" extension which can be used by the client instead of trusted_ca_keys (*). - Tighten record framing requirements and require checking of them (*). - Consolidate "ticket_early_data_info" and "early_data" into a single extension (*). - Change end_of_early_data to be a handshake message (*). - Add pre-extract Derive-Secret stages to key schedule (*). - Remove spurious requirement to implement "pre_shared_key". - Clarify location of "early_data" from server (it goes in EE, as indicated by the table in S 10). - Require peer public key validation - Add state machine diagram. --001a11493644939eb5054a68d038 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I just posted draft-19 at:


This draft includes all the outstanding wire format c= hanges that I believe we are going
to make before publicati= on (changelog below). There are three remaining issues that
we ne= ed to address somehow. I've listed them and proposed resolutions.
=

1. DH Key Reuse Considerations (https://github.com/tlsw= g/tls13-spec/pull/768)
I'm not entirely confident of= the analysis here and I'm not that excited about encouraging
=
people to re-use, so I propose that we simply drop this PR.
=
Both the Chrome team and the Firefox team have c= oncerns about the middlebox
compatibility impact of this chan= ge, and I believe if necessary we can add it as
an extension late= r. Thus, I propose we defer it. We can make this change directly
= in DTLS 1.3, however.

3. The various non-X509 cert= RFCs (no PR).
As Ilari points out, there is significant incompat= ibility between these RFCs and
TLS 1.3, so we'll probably nee= d new versions of them if people want this functionality.
Absent = objection, I'll pull them out of the "usable with TLS 1.3 list&quo= t; in S 4.2
and then add some handwaving about how we can support= them with new
drafts (though, as Ilari indicates, we may be able= to keep cached-info with some
small text changes here).

In terms of implementation, we will probably try to have s= omething for NSS
by IETF, but I doubt it will be actually in Fire= fox.

As usual, comments welcome, including anythin= g I missed.
-Ekr


ChangeLo= g:
=C2=A0 =C2=A0- =C2=A0Hash context_value input to Expo= rters (*)

=C2=A0 =C2=A0- =C2=A0Add an additional D= erive-Secret stage to Exporters (*).

=C2=A0 =C2=A0= - =C2=A0Hash ClientHello1 in the transcript when HRR is used.=C2=A0 This
=C2=A0 =C2=A0 =C2=A0 reduces the state that needs to be carried in = cookies. (*)

=C2=A0 =C2=A0- =C2=A0Restructure Cert= ificateRequest to have the selectors in
=C2=A0 =C2=A0 =C2=A0 exte= nsions.=C2=A0 This also allowed defining a
=C2=A0 =C2=A0 =C2=A0 &= quot;certificate_authorities" extension which can be used by the
=
=C2=A0 =C2=A0 =C2=A0 client instead of trusted_ca_keys (*).
=
=C2=A0 =C2=A0- =C2=A0Tighten record framing requirements and= require checking of them
=C2=A0 =C2=A0 =C2=A0 (*).
=C2=A0 =C2=A0- =C2=A0Consolidate "ticket_early_data_info&q= uot; and "early_data" into a
=C2=A0 =C2=A0 =C2=A0 singl= e extension (*).

=C2=A0 =C2=A0- =C2=A0Change end_o= f_early_data to be a handshake message (*).

=C2=A0= =C2=A0- =C2=A0Add pre-extract Derive-Secret stages to key schedule (*).

=C2=A0 =C2=A0- =C2=A0Remove spurious requirement to = implement "pre_shared_key".

=C2=A0 =C2= =A0- =C2=A0Clarify location of "early_data" from server (it goes = in EE, as
=C2=A0 =C2=A0 =C2=A0 indicated by the table in S 10).

=C2=A0 =C2=A0- =C2=A0Require peer public key valida= tion

=C2=A0 =C2=A0- =C2=A0Add state machine diagra= m.




<= div>
--001a11493644939eb5054a68d038-- From nobody Sat Mar 11 11:28:26 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50080126FDC for ; Sat, 11 Mar 2017 11:28:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lJBjs8KZERaP for ; Sat, 11 Mar 2017 11:28:23 -0800 (PST) Received: from welho-filter2.welho.com (welho-filter2.welho.com [83.102.41.24]) by ietfa.amsl.com (Postfix) with ESMTP id BA2EF129511 for ; Sat, 11 Mar 2017 11:28:22 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by welho-filter2.welho.com (Postfix) with ESMTP id 98A501F13E; Sat, 11 Mar 2017 21:28:20 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp1.welho.com ([IPv6:::ffff:83.102.41.84]) by localhost (welho-filter2.welho.com [::ffff:83.102.41.24]) (amavisd-new, port 10024) with ESMTP id yXJ-5QjsyXXX; Sat, 11 Mar 2017 21:28:19 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp1.welho.com (Postfix) with ESMTPSA id 8013AC4; Sat, 11 Mar 2017 21:28:19 +0200 (EET) Date: Sat, 11 Mar 2017 21:28:12 +0200 From: Ilari Liusvaara To: Eric Rescorla Message-ID: <20170311192812.GA8701@LK-Perkele-V2.elisa-laajakaista.fi> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] draft-ietf-tls-tls13-19 posted X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Mar 2017 19:28:25 -0000 On Fri, Mar 10, 2017 at 03:34:39PM -0800, Eric Rescorla wrote: > I just posted draft-19 at: > > https://tools.ietf.org/html/draft-ietf-tls-tls13-19 > > This draft includes all the outstanding wire format changes that I believe > we are going > to make before publication (changelog below). There are three remaining > issues that > we need to address somehow. I've listed them and proposed resolutions. Did a preliminary implementation. Need to wait for other implementations in order to interop-test. Of course, doesn't imlplement most besides the basics (especially most of the subtler stuff is not implemented). I did a review, lookinge especially for text (other than the known issues) that: - I think is technically unworkable. - I am not entierley sure of proper interpretation. - I think is problematic w.r.t. security or interop. - I think is internally inconsistent. - I think references something that should not be referenced in that context, due to problematic interpretations of applying whatever is referenced there, or reference going seemingly to nowhere. - I think is some potential process mumbo-jumbo. ------------------------------------------------------------------------ Header: - Do you also need to update RFC6962? The data transport for it is redefined. Section 2.3: - If client TLS library does not get explicit ACK from client application to exit 0-RTT mode, you have a race condition that can cause 0-RTT data to appear as 1-RTT data. Attacker may be able to affect this race, and key changes do not help. Section 4.2.3: - This section talks about dsa_sha1 and ecdsa_sha1, but does not define either in listing of values it has. Section 4.2.3.1: - What is the exact payload of DistinguishedName? ASN.1 DER encoding of Name structure from RFC5280, bit-to-bit identical as it appears in the certificate subject, including the top-level SEQUENCE header and length? Section 4.3.2.1: - What is the format of OIDs in oid filters? Does it include the leading 0x06 and length byte (or two length bytes)? - What is the format of values? DER encoding of whatever structure goes into value of extnValue field, including whatever top-level header (usually SEQUENCE, but e.g. KeyUsage has BIT STRING) it happens to have? One idea would be to make the match data abstract, and define that the match data for KeyUsage is ASN.1 DER encoding of KeyUsage structure from RFC5280, including the BIT STRING header, and match data for ExtendedKeyUsage is ASN.1 DER encoding of ExtendedKeyUsage structure from RFC5280, including the SEQUENCE header. Also, matcher for SubjectAlternativeName could be useful. Could e.g. carry DER encoding of RFC5280 SubjectAlternativeName structure, and match certificates that match all the listed names (including via wildcard match). Section 4.4.2.2: - RFC5081 is quite bad example, given that it does not work with TLS 1.3, and likely nothing like that ever will, given that there is no interest in OpenPGP certs for TLS. - Should EdDSA added to list of authentication algorithms (alongside RSA and ECDSA)? Section 4.4.2.3: - Again uses RFC5081 as an example. Section 4.4.2.4: - This section does talks about any certificate using MD5 or SHA-1, when it probably should talk about any non-self-signed certificate using MD5 or SHA-1. There are enormous amount of CA certs with SHA-1 self-sigs. Section 4.4.3: - There is exception allowing unsupported algorithms if no chain can be produced. This can't work at all. The CertificateVerify must be verfied and it for sure can't be if the algorithm is unsupported. Exceptions might work with certificate chains (the chain might end in trust anchor before problematic signature is reached), but not here. Section 5.1: - There is funky corner-case in initial enabling of encryption: If client chokes on ServerHello, the alert it sends will be unencrypted, despite next data from ServerHello being encrypted. And if client chokes on any other server handshake message, the alert will be encrypted. Section C.6: - Talks about RFC7250, despite that not going to work. - This section essentially has a FIXME regarding channel bindings. ------------------------------------------------------------------------ . -Ilari From nobody Sat Mar 11 12:37:35 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 18F74129497 for ; Sat, 11 Mar 2017 12:37:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.419 X-Spam-Level: X-Spam-Status: No, score=-1.419 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_SPAM=0.5, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tIvtAWpXX0FX for ; Sat, 11 Mar 2017 12:37:32 -0800 (PST) Received: from mx496502.smtp-engine.com (mx496502.smtp-engine.com [217.160.92.157]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 99022129442 for ; Sat, 11 Mar 2017 12:37:32 -0800 (PST) Received: from mail-io0-f169.google.com (mail-io0-f169.google.com [209.85.223.169]) by mx496502.smtp-engine.com (Postfix) with ESMTPSA id D1111243 for ; Sat, 11 Mar 2017 20:37:30 +0000 (GMT) Received: by mail-io0-f169.google.com with SMTP id z13so66374270iof.2 for ; Sat, 11 Mar 2017 12:37:30 -0800 (PST) X-Gm-Message-State: AMke39niQhvXn3nezvT4iA+B14ifwK6Mqwwl+idXNzQDIdA5aKmKqxP4lMyvf4ETvCjObD6XxTA0PecjtN2hdg== X-Received: by 10.107.142.136 with SMTP id q130mr21666618iod.31.1489264649327; Sat, 11 Mar 2017 12:37:29 -0800 (PST) MIME-Version: 1.0 Received: by 10.79.147.155 with HTTP; Sat, 11 Mar 2017 12:37:28 -0800 (PST) In-Reply-To: <20170311192812.GA8701@LK-Perkele-V2.elisa-laajakaista.fi> References: <20170311192812.GA8701@LK-Perkele-V2.elisa-laajakaista.fi> From: Matt Caswell Date: Sat, 11 Mar 2017 20:37:28 +0000 X-Gmail-Original-Message-ID: Message-ID: To: Ilari Liusvaara Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] draft-ietf-tls-tls13-19 posted X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Mar 2017 20:37:34 -0000 On 11 March 2017 at 19:28, Ilari Liusvaara wrote: > On Fri, Mar 10, 2017 at 03:34:39PM -0800, Eric Rescorla wrote: >> I just posted draft-19 at: >> >> https://tools.ietf.org/html/draft-ietf-tls-tls13-19 >> >> This draft includes all the outstanding wire format changes that I believe >> we are going >> to make before publication (changelog below). There are three remaining >> issues that >> we need to address somehow. I've listed them and proposed resolutions. > > Did a preliminary implementation. Need to wait for other implementations > in order to interop-test. Of course, doesn't imlplement most besides > the basics (especially most of the subtler stuff is not implemented). > I have a preliminary OpenSSL implementation here: https://github.com/openssl/openssl/pull/2895 I haven't done the latest HRR changes yet, and it also doesn't cover the Certificate Request changes yet either. Matt From nobody Sun Mar 12 15:23:57 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C91F1129487 for ; Sun, 12 Mar 2017 15:23:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0OqT47Ngg-Cm for ; Sun, 12 Mar 2017 15:23:54 -0700 (PDT) Received: from mail-it0-x236.google.com (mail-it0-x236.google.com [IPv6:2607:f8b0:4001:c0b::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A0EE4129467 for ; Sun, 12 Mar 2017 15:23:54 -0700 (PDT) Received: by mail-it0-x236.google.com with SMTP id m27so22354100iti.1 for ; Sun, 12 Mar 2017 15:23:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=IwGopiv1mzptUWD4cUqpSaQsUwozUbRpqO/R+GqwYYg=; b=aljogpQvA1itWIjY9EsG1vYnNxTC5YKMldmRGv2kmvJIU1fi/4LPgxtk3uwZJ1LAaY ltzyv80TX1qALv6j0+xJr0o2SHyUn5oDjYwGAiorFDNeiJymk17NvsvCjoGYEbz8YJAN 5gmoVhQDPA0apz3WivZECAl7wGY2t51vvFk415YKvRJUOq1QU7qIiReLY+3XzFWAfk1G 5vJn+yCLKaFjoy9Y3eTE/H4BFcMH7SPJ1pPcNUUzXk+Oaz+peST+p8k/yfwbm4Xh+rm5 uGZSYPYZ9DD3v3KhZRoWnNGQ1EGYM2JdLs79uwYJZa7ghgupdxzDMAQF1OGrl6JR+y31 sWYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=IwGopiv1mzptUWD4cUqpSaQsUwozUbRpqO/R+GqwYYg=; b=SqQl1mvMRuqTxaHGVbUZuYBZhIk77exiuJLtqPJWA4ru7wrSX2333S0MfuK3Qqt0g/ anCp+C0tzrVIc1Tm7KE2YI3qGzJc08a3pzM8KXOE71faUIDnHGvRQH8VLpn1N9HqYYvt hBeARZrIXUMJLyrDpZu3ojTPPVQfgqzr3D5LsdemxKU6xQWbjkBIn+VFAk7/x+Acjxhk F9aF88ktCz8zjVhTr/OVuLi1qeuFZ4JxZiSlaRq6F/khcpZCO2Cy4CNAF5sdA9nCz6OH SdZ6USV+IRqI824P3NczFFkHNjz4grO0h016DFeup9/PAK2akP9OCrZS8KXKNj+w64ZP bzGA== X-Gm-Message-State: AFeK/H24R6FRiWl8ZzHRPpotWr8Ns3aFOWh7o4DgRFcSJ7fvnhZ/Ta3f6swcP1GEWAUHHH+TRq+s3mY+YjmQVA== X-Received: by 10.36.76.205 with SMTP id a196mr8371398itb.52.1489357433908; Sun, 12 Mar 2017 15:23:53 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.62.69 with HTTP; Sun, 12 Mar 2017 15:23:53 -0700 (PDT) From: Ivan Ristic Date: Sun, 12 Mar 2017 15:23:53 -0700 Message-ID: To: "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a11431eb6cab761054a900c9b Archived-At: Subject: [TLS] Comments on the session ticket format in TLS 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 12 Mar 2017 22:23:55 -0000 --001a11431eb6cab761054a900c9b Content-Type: text/plain; charset=UTF-8 The "ticket" field in NewSessionTicket is opaque and can hold an identifier or an actual encrypted ticket. I think this is problematic, for a couple of reasons: - Field and meaning overloading/reuse is a bad practice in general and leads to programming errors. I feel that protocol design should encourage good practices, not the other way round. Implementations that decide to support both behaviours (IDs and tickets) will have to use an indicator to differentiate between the two. In that light, I think it would be less error prone to provide more detail at the protocol level. - The opaque nature of this field also makes connection auditing more difficult. For example, I'd like to know if session tickets are used to resume for a particular connection. Perhaps more importantly, it would be useful to identify specific ticket keys (to track their usage, rotation, etc), age, encryption algorithm, and their strength. - As a matter of approach, I think the protocol shouldn't leave design decisions to implementors. These decisions (session ID/ticket usage, ticket keys, ticket formats, and so on) will need to be made, and I think it's better to make them part of the protocol, where they can be audited, etc. - Finally, I feel that the effective removal of (visible) session IDs is a regression. Being able to track sessions and resumption is useful to understand traffic patterns. So, I'd prefer to bring session IDs back, and to arrange things so that they're always server-generated. I know these are not big problems (especially given the improvements made to session tickets), but whatever is specified now will be used for a very long time, and it would be a shame to leave these around. -- Ivan --001a11431eb6cab761054a900c9b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
The "ticket" field in NewSessionTicket is o= paque and can hold an identifier or an actual encrypted ticket. I think thi= s is problematic, for a couple of reasons:

- F= ield and meaning overloading/reuse is a bad practice in general and leads t= o programming errors. I feel that protocol design should encourage good pra= ctices, not the other way round. Implementations that decide to support bot= h behaviours (IDs and tickets) will have to use an indicator to differentia= te between the two. In that light, I think it would be less error prone to = provide more detail at the protocol level.

- The o= paque nature of this field also makes connection auditing more difficult. F= or example, I'd like to know if session tickets are used to resume for = a particular connection. Perhaps more importantly, it would be useful to id= entify specific ticket keys (to track their usage, rotation, etc), age, enc= ryption algorithm, and their strength.

- As a matt= er of approach, I think the protocol shouldn't leave design decisions t= o implementors. These decisions (session ID/ticket usage, ticket keys, tick= et formats, and so on) will need to be made, and I think it's better to= make them part of the protocol, where they can be audited, etc.
=
- Finally, I feel that the effective removal of (visible) se= ssion IDs is a regression. Being able to track sessions and resumption is u= seful to understand traffic patterns. So, I'd prefer to bring session I= Ds back, and to arrange things so that they're always server-generated.=

I know these are not big problems (especially giv= en the improvements made to session tickets), but whatever is specified now= will be used for a very long time, and it would be a shame to leave these = around.

--
Ivan=
--001a11431eb6cab761054a900c9b-- From nobody Sun Mar 12 15:45:03 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 04D421293E3 for ; Sun, 12 Mar 2017 15:45:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QW72MAt7urro for ; Sun, 12 Mar 2017 15:45:00 -0700 (PDT) Received: from mail-qk0-x233.google.com (mail-qk0-x233.google.com [IPv6:2607:f8b0:400d:c09::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 71084126D74 for ; Sun, 12 Mar 2017 15:45:00 -0700 (PDT) Received: by mail-qk0-x233.google.com with SMTP id y76so211464886qkb.0 for ; Sun, 12 Mar 2017 15:45:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=w6RPOdTfTK3HRfKxkE6RwQhMPLiTOGM+GZIMI3xoutQ=; b=nZKLG/sf5s56a6+7cKKeV6mWiVDhVrfbChR+pDd7Baq8eHBuXlxPFST0V70MXOajiP NQcNG7IHSmLTxQpDK+dEZghb0M/528cSoJTEENEkBEE8j+D6rH5mYSkg26EIvHoak3KN 7nXamdDPwIoEi4IhHNuBfAHbyqDLjnFnnWVaQ3Shxh669J/DmocliZ1FpVg1NBoOmCLh UQAWeLprG7BLnl8YW1taLQb07lKZpVetKaZp8ou9gKTH+lcjcVfjCg0tNEP2QDvqv/t/ IoYpXV41XBmho+AFbitkmYCO1L8BvaAyJ778kT6FzoTCj+m092+A/gAGh6CnoxsHOfvu 5gEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=w6RPOdTfTK3HRfKxkE6RwQhMPLiTOGM+GZIMI3xoutQ=; b=CeczdAk3uFc7w1qIWMEVBQqOw7e3WSeHJH3On2221FNpyiHWRi2fFpLtdPW/QoAp8B nY0cF0CGl7C93+un5WMMKbxF7d+TzMdiqsCiMnvaAGWS/XUJEYURom50WchkA7dOOU5w PFYLqBtaRZZ9Crp1iLN6pjAqXmBK2thksBEfUCql+9xU0OnMGCT9oztfoGFwirVvu+mT GUQ4ehCh5TRhiVCt3j3Z1Ab7iO4/rITQIGW2P40yDTR3tWdzVcjlyCdoPXEV2Hv9aGWU 0bmU+0z4H52fV581H0uyyszeb5KqrOUiejc4pQPzZ33Sd3MP50hphaCJKjQZ0iS5jxWd 59Kw== X-Gm-Message-State: AMke39mp8seSQVKDQeEKxn3qqPyVHt2xsgARgSFHpxcS03MWW/z5hRreqEuFxOpFN2QtcXgJ++tLQ8KFtEP9oA== X-Received: by 10.233.216.68 with SMTP id u65mr28452204qkf.68.1489358699600; Sun, 12 Mar 2017 15:44:59 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Sun, 12 Mar 2017 15:44:59 -0700 (PDT) In-Reply-To: References: From: Martin Thomson Date: Mon, 13 Mar 2017 09:44:59 +1100 Message-ID: To: Ivan Ristic Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Comments on the session ticket format in TLS 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 12 Mar 2017 22:45:02 -0000 On 13 March 2017 at 09:23, Ivan Ristic wrote: > - Finally, I feel that the effective removal of (visible) session IDs is a > regression. Being able to track sessions and resumption is useful to > understand traffic patterns. So, I'd prefer to bring session IDs back, and > to arrange things so that they're always server-generated. For some people, tracking is an anti-feature. From nobody Sun Mar 12 16:23:07 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84170129471 for ; Sun, 12 Mar 2017 16:23:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lj9Vy-c2LAdF for ; Sun, 12 Mar 2017 16:23:04 -0700 (PDT) Received: from mail-io0-x22b.google.com (mail-io0-x22b.google.com [IPv6:2607:f8b0:4001:c06::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 286C9129435 for ; Sun, 12 Mar 2017 16:23:04 -0700 (PDT) Received: by mail-io0-x22b.google.com with SMTP id f84so73786951ioj.0 for ; Sun, 12 Mar 2017 16:23:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=mbWwOGrYYiiEauPvu4L78umqh8U6Es6QRLUz9Hj7WLE=; b=Xc1J2SnfBTyrcT18SLL9IS+6s3LWao4GjCJEuTS8m4QO06aIqnbFte/0oiJrUQE7cg vkD4qJuu4nzxjNUZyRTmMKaVmSGzhbyWIYhTGgRWgQsSnFk8w2Xdorj5rGCcR6vTYYvC vynuVOP9kdh0rdNW5UKMRf8KTxoXrTDXTR7uSQ3jhuZmm8AJIf4HHlPhr16CSVXxqaqo Y4u8FC/TgVLV2RJwBKolq7bNeHW7iWSqqqPsG7mtQfXAmZGdvrNUPJX5VXJqMUBO6CtL c54JQTyVy1x2zXVFYV/r9ZOBhTk/5OjlOHmefiMRDuCYhMN6uz7BjBjD9vr84eRh+rUt qf3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=mbWwOGrYYiiEauPvu4L78umqh8U6Es6QRLUz9Hj7WLE=; b=Tgib7A5NcTFdYAyQJgd4UnrJULLQYBqfQd3OY1YywuXbMsa/YzMEI6JzSF16IDkqq3 EquSG9447aUP21vQjWmUgxag7atPPB5ScN7z58FdFso2mHYWGi5bQANFUxSxUHXwLkcG QMIPUTsk6UD7hOhr2d9N5CFXNyTsK2Yo5VbZ/hl8DnuS6Cln3Y4SUcEyY4BNhF1PYONQ L7Mq4aZjx67Evez/yQ/mpTolcr1v8qPDcUNpKTeJgA7We/cIuFwGm9oFPCryaEvJlJ47 cKF56j4bzWm/vWOJ15OVC8Znpr/7S9i3OS/GM/j10F7+Zesgfjco3IIjfROcK93/mmRJ Mfog== X-Gm-Message-State: AMke39mm+YtnGo/5zYm7riGVO9/JJxjfZQHfJpusUOMYDAfveilN6fKVMbdgCBsoCgLI7Grz2+sgNVPwSEQq+A== X-Received: by 10.107.2.201 with SMTP id 192mr25059753ioc.81.1489360983506; Sun, 12 Mar 2017 16:23:03 -0700 (PDT) MIME-Version: 1.0 Received: by 10.107.62.69 with HTTP; Sun, 12 Mar 2017 16:23:03 -0700 (PDT) In-Reply-To: References: From: Ivan Ristic Date: Sun, 12 Mar 2017 16:23:03 -0700 Message-ID: To: Martin Thomson Content-Type: multipart/alternative; boundary=001a1139d8605d495f054a90e041 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Comments on the session ticket format in TLS 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 12 Mar 2017 23:23:05 -0000 --001a1139d8605d495f054a90e041 Content-Type: text/plain; charset=UTF-8 On Sun, Mar 12, 2017 at 3:44 PM, Martin Thomson wrote: > On 13 March 2017 at 09:23, Ivan Ristic wrote: > > - Finally, I feel that the effective removal of (visible) session IDs is > a > > regression. Being able to track sessions and resumption is useful to > > understand traffic patterns. So, I'd prefer to bring session IDs back, > and > > to arrange things so that they're always server-generated. > > For some people, tracking is an anti-feature. > Sure, but the current session ticket design doesn't prevent tracking. At best, it only makes it somewhat more expensive because trackers need to construct their own session IDs from available connection data. Another example, perhaps relevant: load balancers can often be configured to use sticky sessions based on TLS session IDs. It's a useful feature given that web servers typically don't have a good story for distributed server-side TLS session storage. Without an explicit ID, they too would need to make their own. -- Ivan --001a1139d8605d495f054a90e041 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On S= un, Mar 12, 2017 at 3:44 PM, Martin Thomson <martin.thomson@gmail= .com> wrote:
On 13 March 2017 at 09:23, Ivan Ristic <ivan.ristic@gmail.com> wrote:
> - Finally, I feel that the effective removal of (visible) session IDs = is a
> regression. Being able to track sessions and resumption is useful to > understand traffic patterns. So, I'd prefer to bring session IDs b= ack, and
> to arrange things so that they're always server-generated.

For some people, tracking is an anti-feature.

Sure, but the current session ticket design doesn= 9;t prevent tracking. At best, it only makes it somewhat more expensive bec= ause trackers need to construct their own session IDs from available connec= tion data.

Another example, perhaps relevant: load balancers can often be configu= red to use sticky sessions based on TLS session IDs. It's a useful feat= ure given that web servers typically don't have a good story for distri= buted server-side TLS session storage. Without an explicit ID, they too wou= ld need to make their own.

--
Ivan
--001a1139d8605d495f054a90e041-- From nobody Sun Mar 12 16:48:47 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7CF0D12940C for ; Sun, 12 Mar 2017 16:48:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MP9WVY8UVDXS for ; Sun, 12 Mar 2017 16:48:45 -0700 (PDT) Received: from mournblade.imrryr.org (mournblade.imrryr.org [108.5.242.66]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2DD4A126D74 for ; Sun, 12 Mar 2017 16:48:45 -0700 (PDT) Received: from vpro.lan (cpe-74-71-8-253.nyc.res.rr.com [74.71.8.253]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mournblade.imrryr.org (Postfix) with ESMTPSA id 4F6697A32F1 for ; Sun, 12 Mar 2017 23:48:44 +0000 (UTC) (envelope-from ietf-dane@dukhovni.org) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Viktor Dukhovni In-Reply-To: Date: Sun, 12 Mar 2017 19:48:42 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <36717367-120F-4259-A692-638243647071@dukhovni.org> References: To: "" X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Comments on the session ticket format in TLS 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: "" List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 12 Mar 2017 23:48:46 -0000 > On Mar 12, 2017, at 7:23 PM, Ivan Ristic = wrote: >=20 > Another example, perhaps relevant: load balancers can often be = configured to use sticky sessions based on TLS session IDs. It's a = useful feature given that web servers typically don't have a good story = for distributed server-side TLS session storage. Without an explicit ID, = they too would need to make their own. With session tickets, there's no need for server-side TLS session = storage, and no need for load-balancers to direct resuming TLS clients to the = same server. All that's required is proper coordination of the distribution and rotation of the short-term session ticket encryption keys. This improves the effectiveness of the load-balancer when some clients are responsible for a large fraction of the load. Opaque session tickets are just fine, and one can tell which connections are reused by observing abbreviated handshakes. For example, Gmail's SMTP servers all share the same session ticket = encryption keys, and any server can resume a session initiated by a different = server. Here's an example, in which an SMTP TLS client reuses a session with a second Gmail SMTP server (w51si13238472qtb.292) 10 seconds after the session is created with a first SMTP server (r3si13266009qkb.62): $ posttls-finger -lmay -Lcache,summary -m 3 -r 10 gmail.com posttls-finger: Connected to = gmail-smtp-in.l.google.com[209.85.144.27]:25 posttls-finger: < 220 mx.google.com ESMTP r3si13266009qkb.62 - gsmtp posttls-finger: > EHLO straasha.imrryr.org posttls-finger: < 250-mx.google.com at your service, [108.21.89.116] ... posttls-finger: > STARTTLS posttls-finger: < 220 2.0.0 Ready to start TLS posttls-finger: looking for session = [209.85.144.27]:25&8A8ACB9F076F21BB0182A29964626E9B9E564450364F42705D32485= 94EF24C16 in memory cache posttls-finger: save session = [209.85.144.27]:25&8A8ACB9F076F21BB0182A29964626E9B9E564450364F42705D32485= 94EF24C16 to memory cache posttls-finger: Untrusted TLS connection established to = gmail-smtp-in.l.google.com[209.85.144.27]:25: TLSv1.2 with cipher = ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits) posttls-finger: > EHLO straasha.imrryr.org posttls-finger: < 250-mx.google.com at your service, [108.21.89.116] ... posttls-finger: > QUIT posttls-finger: < 221 2.0.0 closing connection r3si13266009qkb.62 - = gsmtp posttls-finger: Reconnecting after 10 seconds <...10 second delay...> posttls-finger: < 220 mx.google.com ESMTP w51si13238472qtb.292 - gsmtp posttls-finger: looking for session = [209.85.144.27]:25&8A8ACB9F076F21BB0182A29964626E9B9E564450364F42705D32485= 94EF24C16 in memory cache posttls-finger: reloaded session = [209.85.144.27]:25&8A8ACB9F076F21BB0182A29964626E9B9E564450364F42705D32485= 94EF24C16 from memory cache posttls-finger: gmail-smtp-in.l.google.com[209.85.144.27]:25: Reusing = old session posttls-finger: Untrusted TLS connection established to = gmail-smtp-in.l.google.com[209.85.144.27]:25: TLSv1.2 with cipher = ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits) posttls-finger: > QUIT posttls-finger: < 221 2.0.0 closing connection w51si13238472qtb.292 - = gsmtp posttls-finger: Found a previously used server. Done reconnecting. --=20 --=20 Viktor. From nobody Sun Mar 12 16:55:12 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4E7D129426 for ; Sun, 12 Mar 2017 16:55:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=briansmith-org.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q4zC-QVu-rnY for ; Sun, 12 Mar 2017 16:55:09 -0700 (PDT) Received: from mail-it0-x232.google.com (mail-it0-x232.google.com [IPv6:2607:f8b0:4001:c0b::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5C60512940C for ; Sun, 12 Mar 2017 16:55:09 -0700 (PDT) Received: by mail-it0-x232.google.com with SMTP id m27so20832368iti.0 for ; Sun, 12 Mar 2017 16:55:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=briansmith-org.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=oJedbwhPWyNTIcWAWSNt0qpgUJiaoUz7eGw6wPQJ7dM=; b=dYzDIzJHsKhrUrXAgMK3KR3+ek0DPMqqjwUcAwrWKjGbKT3m1hM52PNQ2gILKUx3Lm uCT/ftnuFHIKFs4ovmVDWt14H5Xwf0ri9jXe72bOuNDZfoxwupTk0qozCkiFkAEm18jC +Tt4godyDDIYxJspNHzXTXyDD8f1GkB+ACjL7kX2z0w0pY4WiI0Xf8jTuPTqdqcH+xkO GIHpH4FXtXc0QwY1684Y+1lCSDmxhtogNdiaHAdEGBeRo+rYoRlgrsrDGE0PG80VGgkC DT7buC2oSnPwtnX8ohB8tVq/q8ZeAbwAGTfezV0/ifEEUbPyJv22uQeYfa2H8FKll/Da u/Sw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=oJedbwhPWyNTIcWAWSNt0qpgUJiaoUz7eGw6wPQJ7dM=; b=KynVW8p/GxUAIYl1x9G0xHAy3sc2QWKBFJglGUWumLhcrYkG2Urxh9/70HiF7e8B5S KISM9odxf9EYlurgOkDAUCKKf7J+OeB+jmfv4z8AHEt4OdO+DJdJpNNxYV79g7pVOEIZ OuVDDtwmTtaMjeQc8bMN89lAMRn2a0zCCU3nIvEUOj5YtrqHLrr5Hi5OJ7SCuc22mK3P U+0cdKJSwKHTyyyxYdIc7hZvguNVx6cystRscCwrF2KS6q7ST7JU7Pwp1aD9err51TU8 PKstq648Zlc6+psReTmGrN4Am0ffaQtA4E3o6ix6S5wcwGsM66Pr1Vx8d3Vk5KAC3/pO wi6w== X-Gm-Message-State: AFeK/H1vG60FGWBxTJerOTgLCz72BYurmwlGwWw5fiI9RWQEMHk8h/8A2cQVFvuNA/pN8F/GqjCdFBxGyI0qVQ== X-Received: by 10.36.60.211 with SMTP id m202mr7930616ita.58.1489362908599; Sun, 12 Mar 2017 16:55:08 -0700 (PDT) MIME-Version: 1.0 Received: by 10.36.87.82 with HTTP; Sun, 12 Mar 2017 16:55:08 -0700 (PDT) In-Reply-To: References: From: Brian Smith Date: Sun, 12 Mar 2017 13:55:08 -1000 Message-ID: To: Ivan Ristic Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Comments on the session ticket format in TLS 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 12 Mar 2017 23:55:11 -0000 Ivan Ristic wrote: > - The opaque nature of this field also makes connection auditing more > difficult. This is intentional. > For example, I'd like to know if session tickets are used to > resume for a particular connection. Perhaps more importantly, it would be > useful to identify specific ticket keys (to track their usage, rotation, > etc), age, encryption algorithm, and their strength. The server knows this information. if it wants you to know it, then it can share it with you. If it doesn't, then you shouldn't be able to know it, ideally. > - Finally, I feel that the effective removal of (visible) session IDs is a > regression. Being able to track sessions and resumption is useful to > understand traffic patterns. This is an attack on the client and server, which the protocol ideally should prevent. In fact, I know at least one implementation is doing extra work specifically to frustrate this kind of attack. Also the charter says "Develop a mode that encrypts as much of the handshake as is possible to reduce the amount of observable data to both passive and active attackers." > So, I'd prefer to bring session IDs back, and > to arrange things so that they're always server-generated. Even in earlier versions, session IDs were not required with resumption using tickets. The server sends an empty session ID and the client may (should, IMO) send an empty session ID in the resumption hello. > I know these are not big problems (especially given the improvements made to > session tickets), but whatever is specified now will be used for a very long > time, and it would be a shame to leave these around. This I agree with, except I think it's worth spending extra effort to standardize the methods for preventing the thing you are asking for. BTW, I understand you are asking for this for diagnostic reasons, not for malicious reasons. Cheers, Brian -- https://briansmith.org/ From nobody Sun Mar 12 17:09:27 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 129501293E8 for ; Sun, 12 Mar 2017 17:09:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GkxDRXvO2Ei9 for ; Sun, 12 Mar 2017 17:09:24 -0700 (PDT) Received: from mail-qk0-x230.google.com (mail-qk0-x230.google.com [IPv6:2607:f8b0:400d:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F643126D74 for ; Sun, 12 Mar 2017 17:09:24 -0700 (PDT) Received: by mail-qk0-x230.google.com with SMTP id y76so212165967qkb.0 for ; Sun, 12 Mar 2017 17:09:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=g4T9MT6DArm9YiuKrGbb84mUwZ4Y9Gp4bslaxuBe00k=; b=gXdTKw8h180HtmQDez12+jEOJ6fD5qJdWcR7EhHQpVpyv8l4kPyZAHIlOH54gAVr8d H9XCa8FF/WJfLxedh/WFdRDg5WRrgXn+1WLaVwZUL/NQLsG/KI5xhuBUMrnBq0iiIDEo HAkk/EM79hXVoiJNlmP3374+HPD3x/XTGko5IWlKRr91vVvO0gLxWXnfndCvsO/qt7IJ ADsw0FVnJKKQIjE3fbPvJyZntlMOkH0MS//O4CGoT8Mqqyp1qSKdh0y1TxiYogDEYRMB ra+cBkUWc2QfPhBlnnJBps4fAFG3HYnt4mYJdsbG4HjMCS2sbqZgVjxwgKfbEbyXxmCb N86w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=g4T9MT6DArm9YiuKrGbb84mUwZ4Y9Gp4bslaxuBe00k=; b=tUJUyaYv0fkZBnnJwJhVO+KfzWxMfcXvM6kkyY+3lOajIw1pgYg2+EAaTxuYIdu7h8 4SjIe9WBnL0+y0UQxx1GwekvuEKLHxGQlYKTIzF2gmU8VDQgWpqQUMViSmkF8m9P2Xvi 1tesz9iT4OoUl9NGBO3q+pA4UzbCtVkV0Enzrs9sUgexRQIfBPEyUQP2IcGEhd6W2POc UTtmQvqjEuRw56iP+LFfDyBWOhBEDMt0ewrfBCdPWK8Lo85SEcBnzS7fy+i5lnBXbfCH jl3lxaeFn52toezfVVZG1RRG4gok+ezwOEAahlM8osPLTuoFwJhL4zB3GbUK78jwwQpP d4Uw== X-Gm-Message-State: AMke39l9b0GMgT3Kgz0nb+4cHKYrMUX0w4G00DYGIUTEW6Z+j+J0ACVm27t7bZntIjUtrI/imLe2CgYEa1FKpg== X-Received: by 10.233.216.68 with SMTP id u65mr28646474qkf.68.1489363763585; Sun, 12 Mar 2017 17:09:23 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Sun, 12 Mar 2017 17:09:23 -0700 (PDT) In-Reply-To: References: From: Martin Thomson Date: Mon, 13 Mar 2017 11:09:23 +1100 Message-ID: To: Brian Smith Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Comments on the session ticket format in TLS 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Mar 2017 00:09:26 -0000 On 13 March 2017 at 10:55, Brian Smith wrote: >> So, I'd prefer to bring session IDs back, and >> to arrange things so that they're always server-generated. > > Even in earlier versions, session IDs were not required with > resumption using tickets. The server sends an empty session ID and the > client may (should, IMO) send an empty session ID in the resumption > hello. This is true, but I believe that there are compatibility reasons to send the session ID anyway. I don't know the details, but it probably comes down to the load balancing thing that Ivan is asking about. All told, this was a mess in previous versions. Now we at least have a hope of maintaining unlinkability. From nobody Sun Mar 12 17:17:44 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF25A129404 for ; Sun, 12 Mar 2017 17:17:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dCK9acO1bwIb for ; Sun, 12 Mar 2017 17:17:42 -0700 (PDT) Received: from mail-yw0-x22f.google.com (mail-yw0-x22f.google.com [IPv6:2607:f8b0:4002:c05::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 33D231293E8 for ; Sun, 12 Mar 2017 17:17:42 -0700 (PDT) Received: by mail-yw0-x22f.google.com with SMTP id p77so50463099ywg.1 for ; Sun, 12 Mar 2017 17:17:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=ttOOJ0bx0N3KA+5yx7pMt1+NCp0NIcz5UCOhhiITjlo=; b=BAnSuZGDiTNauQAq2Nkk+Ar2P9dCr1XPlsAmgV//5qK8+Oyp8lksCO+23tlBzX3+yl 9KanyX6vG0GG1qRYcGe6TMVy29ei/GnL6NXOyNAvObyHi6wDfvv5ynzaW4qQB6MEfwNM gCU/dWPxR0uktODAifmZQ5MbBbT2XqDvsaJ01zN0ULrkjmpukG6Lz4YB3ZcDYmPbXWX8 JulOFYDZBs82i+um31b9qxXqFuRpJ/yBq4h6rWaAan1gI91FRVlYLY3fcgLm1a+jfokI +5UGCPY7STaQBTPM9ZSwr662jtRP8I03lb3zEpmW2pydxZvkORwf6ggBIz/faXVFSgqO uD2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=ttOOJ0bx0N3KA+5yx7pMt1+NCp0NIcz5UCOhhiITjlo=; b=krUCrIfvgX+f/Bf+ZJ0fkPGf3aZdV7lwfFWhHLVrSqinomyf2jsOb5vqsc8AeTnRRL KE7N8cRzFOtoQ85Jxh4nZzGcLgKsXpP1+uklslngGX00D3Fhfwh/4ZTylabBr8KXT4UL Kf3sLNPe7NzD+yrvVf9qLH7LKrvS0VNhLFz3/vzD14/6Ob58sTI2BrUJERV7QZX8/Lrs kEYhQrL4sOTIain+b6iGKsOxKYyAjtL7Ieku7RfRDsbIy2xXhk7Tqo0lLFneF8sO9Fj6 zGfqmVVJehDbgy69/YaSqbBfQdEtsbpKqyldXdtwhLF00c6I4WgCKjjwXV73bcKmg/MQ pECQ== X-Gm-Message-State: AMke39mKJeeuH2KAJa9Vds6Y60w6jywI8qBLktGHfuCMSkEsItXz0zne9/p/PDEsEMFS2E9146nP/k3h0NRK/w== X-Received: by 10.129.108.214 with SMTP id h205mr16000684ywc.71.1489364261163; Sun, 12 Mar 2017 17:17:41 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Sun, 12 Mar 2017 17:17:00 -0700 (PDT) In-Reply-To: References: From: Eric Rescorla Date: Sun, 12 Mar 2017 17:17:00 -0700 Message-ID: To: Brian Smith Content-Type: multipart/alternative; boundary=001a114e81dcba7078054a91a301 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Comments on the session ticket format in TLS 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Mar 2017 00:17:43 -0000 --001a114e81dcba7078054a91a301 Content-Type: text/plain; charset=UTF-8 I more or less concur with Brian and Martin. I do think it would be worthwhile for someone to document a ticket construction that's more modern than the one in RFC 5705, but I don't think implementations should be required to implement any particular format. -Ekr On Sun, Mar 12, 2017 at 4:55 PM, Brian Smith wrote: > Ivan Ristic wrote: > > - The opaque nature of this field also makes connection auditing more > > difficult. > > This is intentional. > > > For example, I'd like to know if session tickets are used to > > resume for a particular connection. Perhaps more importantly, it would be > > useful to identify specific ticket keys (to track their usage, rotation, > > etc), age, encryption algorithm, and their strength. > > The server knows this information. if it wants you to know it, then it > can share it with you. If it doesn't, then you shouldn't be able to > know it, ideally. > > > - Finally, I feel that the effective removal of (visible) session IDs is > a > > regression. Being able to track sessions and resumption is useful to > > understand traffic patterns. > > This is an attack on the client and server, which the protocol ideally > should prevent. In fact, I know at least one implementation is doing > extra work specifically to frustrate this kind of attack. Also the > charter says "Develop a mode that encrypts as much of the handshake as > is possible to reduce the amount of observable data to both passive > and active attackers." > > > So, I'd prefer to bring session IDs back, and > > to arrange things so that they're always server-generated. > > Even in earlier versions, session IDs were not required with > resumption using tickets. The server sends an empty session ID and the > client may (should, IMO) send an empty session ID in the resumption > hello. > > > I know these are not big problems (especially given the improvements > made to > > session tickets), but whatever is specified now will be used for a very > long > > time, and it would be a shame to leave these around. > > This I agree with, except I think it's worth spending extra effort to > standardize the methods for preventing the thing you are asking for. > > BTW, I understand you are asking for this for diagnostic reasons, not > for malicious reasons. > > Cheers, > Brian > -- > https://briansmith.org/ > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --001a114e81dcba7078054a91a301 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I more or less concur with Brian and Martin.

I do think it would be worthwhile for someone to document a ticket co= nstruction that's more
modern than the one in RFC 5705, but I= don't think implementations should be required
to implement = any particular format.

-Ekr


On Sun, M= ar 12, 2017 at 4:55 PM, Brian Smith <brian@briansmith.org> wrote:
Ivan Ristic <= ;ivan.ristic@gmail.com> wro= te:
> - The opaque nature of this field also makes connection auditing more<= br> > difficult.

This is intentional.

> For example, I'd like to know if session tickets are used to
> resume for a particular connection. Perhaps more importantly, it would= be
> useful to identify specific ticket keys (to track their usage, rotatio= n,
> etc), age, encryption algorithm, and their strength.

The server knows this information. if it wants you to know it, then = it
can share it with you. If it doesn't, then you shouldn't be able to=
know it, ideally.

> - Finally, I feel that the effective removal of (visible) session IDs = is a
> regression. Being able to track sessions and resumption is useful to > understand traffic patterns.

This is an attack on the client and server, which the protocol ideal= ly
should prevent. In fact, I know at least one implementation is doing
extra work specifically to frustrate this kind of attack. Also the
charter says "Develop a mode that encrypts as much of the handshake as=
is possible to reduce the amount of observable data to both passive
and active attackers."

> So, I'd prefer to bring session IDs back, and
> to arrange things so that they're always server-generated.

Even in earlier versions, session IDs were not required with
resumption using tickets. The server sends an empty session ID and the
client may (should, IMO) send an empty session ID in the resumption
hello.

> I know these are not big problems (especially given the improvements m= ade to
> session tickets), but whatever is specified now will be used for a ver= y long
> time, and it would be a shame to leave these around.

This I agree with, except I think it's worth spending extra effo= rt to
standardize the methods for preventing the thing you are asking for.

BTW, I understand you are asking for this for diagnostic reasons, not
for malicious reasons.

Cheers,
Brian
--
ht= tps://briansmith.org/

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--001a114e81dcba7078054a91a301-- From nobody Sun Mar 12 18:21:35 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B77161293EE for ; Sun, 12 Mar 2017 18:21:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CLl7uZMwgJkr for ; Sun, 12 Mar 2017 18:21:33 -0700 (PDT) Received: from mail-pg0-x233.google.com (mail-pg0-x233.google.com [IPv6:2607:f8b0:400e:c05::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5DEFC127A91 for ; Sun, 12 Mar 2017 18:21:33 -0700 (PDT) Received: by mail-pg0-x233.google.com with SMTP id b129so57670759pgc.2 for ; Sun, 12 Mar 2017 18:21:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=uejsq0Ye0u3f+PiSlkhUUabgjutfYLUyCwPHaUKwNB8=; b=MwVrtiOSJKXLA3pHWuMtHFOG1m1/TviNmNa7fdAHXnNUmhSYFMxPjEWqj/+mOK+d66 aK27lvr25YIpYrrTvoTyLc0C2T8OguKadNsq0oqHdoFD2fRkwIXJbtUkMlQu8Vvc1DT2 xKwczgByVxtluutrgHKQIGoPQeriuyt7tC1CY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=uejsq0Ye0u3f+PiSlkhUUabgjutfYLUyCwPHaUKwNB8=; b=DROrjn9AW7K4uxZQCi2bkC2Hf9+WSfVmJjRraGtRwl8Z88e352Z8eGsTKI8OB9S/1y eEwDyLMjiQamsX4COHNpJTJs9sRjNoPKU3ljkyAMCR7qQmUYrjLzJdtazlOecjVF6cfw 0sdLjmmfYf1r92AlBs/0RnFtIgFXD53pCbns3Gl9FN3rb0e7X3NNlRn6D6YZ+tkbE0gQ 68+hqteUh67PDd2MQSST2w87Q6+jbous+w9yfxyCz1dIGohetUVjAOtDpRfDaGUbR84t pWbbjvmUU9qovtzSwYdvyWp1zd4y49iYCc1+DV/nw34IRsCVGuKs1DhXiXjWEzMhYHwK onww== X-Gm-Message-State: AMke39lR5tVY9W1bLJwB+fckq9gae19nFM7nop/KQqJyF7fcTD8BB3TihP2k7dornpSk7S477ygoHJTDyWLKGaPR X-Received: by 10.84.210.167 with SMTP id a36mr44181875pli.40.1489368092593; Sun, 12 Mar 2017 18:21:32 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: David Benjamin Date: Mon, 13 Mar 2017 01:21:21 +0000 Message-ID: To: Martin Thomson , Brian Smith Content-Type: multipart/alternative; boundary=94eb2c1aaab8199e30054a928873 Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] Comments on the session ticket format in TLS 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Mar 2017 01:21:34 -0000 --94eb2c1aaab8199e30054a928873 Content-Type: text/plain; charset=UTF-8 On Sun, Mar 12, 2017 at 8:09 PM Martin Thomson wrote: > On 13 March 2017 at 10:55, Brian Smith wrote: > >> So, I'd prefer to bring session IDs back, and > >> to arrange things so that they're always server-generated. > > > > Even in earlier versions, session IDs were not required with > > resumption using tickets. The server sends an empty session ID and the > > client may (should, IMO) send an empty session ID in the resumption > > hello. > > This is true, but I believe that there are compatibility reasons to > send the session ID anyway. I don't know the details, but it probably > comes down to the load balancing thing that Ivan is asking about. > > All told, this was a mess in previous versions. Now we at least have > a hope of maintaining unlinkability. > Clients send session IDs in TLS 1.2 because that is how the server indicates a resumption. It echoes the client-sent ID back. Otherwise that value has no meaning. (Go's implementation will just pick a random value each time. OpenSSL derivatives hash the ticket.) RFC 5077 does allow a client to leave it empty, but this is a mistake and should not have been in the specification. That means a client must peek ahead for ChangeCipherSpec to determine resumption. This is a huge source of complexity (handshake/CCS synchronization is tricky as it is) and does not work with DTLS. David --94eb2c1aaab8199e30054a928873 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On Sun, Mar 12= , 2017 at 8:09 PM Martin Thomson <martin.thomson@gmail.com> wrote:
On 13 March 2017 at 10:55, Brian Smith <brian@briansmith.o= rg> wrote:
>> So, I'd prefer to bring session IDs back, and
>> to arrange things so that they're always server-generated.
>
> Even in earlier versions, session IDs were not required with
> resumption using tickets. The server sends an empty session ID and the=
> client may (should, IMO) send an empty session ID in the resumption > hello.

This is true, but I believe that there are compatibility reasons to
send the session ID anyway.=C2=A0 I don't know the details, but it prob= ably
comes down to the load balancing thing that Ivan is asking about.

All told, this was a mess in previous versions.=C2=A0 Now we at least have<= br class=3D"gmail_msg"> a hope of maintaining unlinkability.

Clients send session IDs in TLS 1.2 because that is how t= he server indicates a resumption. It echoes the client-sent ID back. Otherw= ise that value has no meaning. (Go's implementation will just pick a ra= ndom value each time. OpenSSL derivatives hash the ticket.)

<= /div>
RFC 5077 does allow a client to leave it empty, but this is a mis= take and should not have been in the specification. That means a client mus= t peek ahead for ChangeCipherSpec to determine resumption. This is a huge s= ource of complexity (handshake/CCS synchronization is tricky as it is) and = does not work with DTLS.

David
--94eb2c1aaab8199e30054a928873-- From nobody Sun Mar 12 21:26:04 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A1381294E7 for ; Sun, 12 Mar 2017 21:26:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=iij.ad.jp Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4HUtexILDGK4 for ; Sun, 12 Mar 2017 21:26:02 -0700 (PDT) Received: from omgo.iij.ad.jp (mo900.iij.ad.jp [202.232.31.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 194AD1294A1 for ; Sun, 12 Mar 2017 21:26:01 -0700 (PDT) DKIM-Signature: v=1;a=rsa-sha256;c=relaxed/simple;d=iij.ad.jp;h=Date: Message-Id:To:Subject:From:In-Reply-To:References:Mime-Version:Content-Type: Content-Transfer-Encoding; i=kazu@iij.ad.jp; s=omgo2; t=1489379160; x=1490588760; bh=P+XAEu7Fo+8vShznFgtw7xbSY/f7qk2hUq2CbQbQiQk=; b=kkGAK7Qb+6XLbgxNtj2M7Gso53t ASyQq24af4uDXg7tUHSfKgj+O31bN/VGIWKpQgvhJNHvox9CjfMYNFi88bP67EoAQnvCS82vw+/WN q9iWci0zHRYNeK3zDu63mKd84Gw6qcYwIePp99FkSxKCMJHIy9o77UOKuBTGAkF4shi7F31ZIC7US uiai/LfIA/7RXfeGTD2DQdWykXUZVbFoMjKW1IOZhjh986MoW2+Yw2f3NVv7miDbWbavTspYLiMp1 t89djdptbpNyXYb+Bj1jVd8hv3Mr/8KmcqAcIAiITyA4qV3og3SxyekgiainqtwiqN91SkI7RHyUH lggLgOQ==; Received: by omgo.iij.ad.jp (mo900) id v2D4Q03Z001758; Mon, 13 Mar 2017 13:26:00 +0900 X-MXL-Hash: 58c61f583dfcdd07-f4df39d808f660154f00bb382d61614462ea738f Date: Mon, 13 Mar 2017 13:25:59 +0900 (JST) Message-Id: <20170313.132559.1910222276064948166.kazu@iij.ad.jp> To: tls@ietf.org From: Kazu Yamamoto (=?iso-2022-jp?B?GyRCOzNLXE9CSScbKEI=?=) In-Reply-To: References: X-Mailer: Mew version 6.7 on Emacs 25.1 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [TLS] New IETF 95 Hackathon technology: TLS 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Mar 2017 04:26:03 -0000 Hi Nick, > At the TRON workshop at NDSS there was interest in a hackathon project to > work on TLS 1.3 implementations and to test interoperability. I have added > this as a topic for the IETF 95 Hackathon. If you are interested in > participating, please sign up here: Which is this hackathon based on, ID 18 or 19? I will not join IETF. But I would like to prepare a test server and a client tool in Haskell before the hackathon so that hackathon people can test with them. --Kazu From nobody Mon Mar 13 10:31:13 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C78DE12995D for ; Mon, 13 Mar 2017 10:31:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9HbrovJLq1hN for ; Mon, 13 Mar 2017 10:30:48 -0700 (PDT) Received: from mail-qk0-x232.google.com (mail-qk0-x232.google.com [IPv6:2607:f8b0:400d:c09::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B678312996C for ; Mon, 13 Mar 2017 10:30:47 -0700 (PDT) Received: by mail-qk0-x232.google.com with SMTP id p64so228553465qke.1 for ; Mon, 13 Mar 2017 10:30:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:subject:message-id:date:to :mime-version; bh=TbZ+Rir1Y+4dojRFrNExHuBFItUZv9VgcpAdYPPZnp0=; b=IrcAqPB5cn3aS/jP5QdgLktvkjv1zEEwWtNY39SNIs8XK/YwoUFfQFcqYc6KWBJRqq sSXd64MmmK9cZNNYf355y6uibD1TnyfahF4iKktwjzNPNkV2gkkZq4hY1qa7GBr6Lg05 /5Buy+B4zH8CEKxSYWqyjR5puR5oE2Bm9lGcs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:subject :message-id:date:to:mime-version; bh=TbZ+Rir1Y+4dojRFrNExHuBFItUZv9VgcpAdYPPZnp0=; b=cp10YBPkJsDTHmsJYPh0XbXh3RT0NsNHg/Fw68QGi2jWKCSkYopMsJtNO1GaNLySLF NUGKfOmfYtRecLEx4+REk6jSBcV9kECO+Igzaot4e2QnNOj3/Fgec9vKI2E/0NqYqZMv tXJJ9NfgiqzbfiDxeu3Xmk195jagy/bzalIDv+lYD98JkfhjxBxFzs+gif4pCiUTmDD3 M11t6Jdm+leAJKpvNfcq8ulL6oNfqWrrPgV0fzQdvNcWibr9MEwTLvIw1DKiFbHqhhw9 /cHcMmsr1yM8P5b7JHeBTx/o7vDynF8Ju8qZzOjysOuyhBNr1lPp11CmhsLHiyo4xohR h36Q== X-Gm-Message-State: AFeK/H0GjOFQJLGhxkeEfVwaQo1MwjS+0WXmUz81jiniQskY8K6xKeT3XylMCVwC7dppbA== X-Received: by 10.55.24.42 with SMTP id j42mr24026942qkh.145.1489426246529; Mon, 13 Mar 2017 10:30:46 -0700 (PDT) Received: from [172.16.0.92] ([96.231.228.203]) by smtp.gmail.com with ESMTPSA id w184sm12610236qkc.6.2017.03.13.10.30.45 for (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 13 Mar 2017 10:30:45 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Message-Id: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> Date: Mon, 13 Mar 2017 13:30:44 -0400 To: "" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) Archived-At: Subject: [TLS] WGLC: draft-ietf-tls-tls13-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Mar 2017 17:31:11 -0000 This is a working group last call announcement for = draft-ietf-tls-tls13-19, to run through March 27. Please send your = reviews to the list as soon as possible so we can prepare for any = discussion of open issues at IETF 98 in Chicago. =20 Thanks, J&S= From nobody Mon Mar 13 10:35:31 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5FF2129882 for ; Mon, 13 Mar 2017 10:35:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MG1228Y3Db8L for ; Mon, 13 Mar 2017 10:35:29 -0700 (PDT) Received: from mail-yw0-x232.google.com (mail-yw0-x232.google.com [IPv6:2607:f8b0:4002:c05::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7FE7E129705 for ; Mon, 13 Mar 2017 10:35:29 -0700 (PDT) Received: by mail-yw0-x232.google.com with SMTP id v76so63701712ywg.0 for ; Mon, 13 Mar 2017 10:35:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=alUjrl+Z9j9bBJTbMNMNLQGmE/SDflTFAX0WJfe2y7M=; b=PV5jYimwEiHKWVJn+Wu+RC6Y+wniQ0uOPb/5YjjxudDDQcIHExV+m+ve/xny0iK7fd 30L3yC5RPp0OOrPvpY187jOnAT1uOB4l9AYdQkUQuH9V6M5bgSWA4b5JuiUH0JdSeOMb 1yUCq4yCnO+M1It0sluQwAUiu2yqNIRhAJVZwJyr+ccmsS4yW+WFZwOtMoG7CcmlS9+N DSBoTl2qEen81Qb0LGEgIccGolo9HOedS6WLvVjZI+MXvjZgbBXXthjwVGBjOw1m9Nvr lKu+gSKyZISySfgr2J/2YC+NWPFBBG8jR4Z2aKaIAlWHFehJ+EZtu2nI9J858byeEbUO 3GzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=alUjrl+Z9j9bBJTbMNMNLQGmE/SDflTFAX0WJfe2y7M=; b=JOspUMlYy/JkAvJt1wzMZoVMZzyq1qAi6PS2H8XhGXjbNe2kVeYhcweyZLxBD29Dqt JTvntnsEQcnptfbEpKTv/kXH8TMdPjwDGdvM6yVUkWc/v0e2h3o+Mv7NSqMCJszkbJhw 0zNvq6oJZygfidIqT85W6wNDPYacI7oIAkg41u48GvvRuK/ySA549mUu7oyyjK3nFXsQ qe5ihZQEeS5L8gWDKtxDruEmH8fknlSrD1hpfQ90IxXhQx9Yh9DUeuscYsJDjnBHMdbq GyH6qOqQkLRqfHeo1QHygdXfMIRg3eLwdjutOVKmmZ2EVDYcZBtxDGj9HoZX6/Qc2Hg2 ienQ== X-Gm-Message-State: AMke39nEmip7RTRRGbi1S2pFv/1yzKEWO6rfvqq/wJcxGIeLwQeT4tFJZmZGenslyGbkx8UrsRfsKRuyzNxZvA== X-Received: by 10.129.108.214 with SMTP id h205mr18730499ywc.71.1489426528704; Mon, 13 Mar 2017 10:35:28 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Mon, 13 Mar 2017 10:34:48 -0700 (PDT) In-Reply-To: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> References: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> From: Eric Rescorla Date: Mon, 13 Mar 2017 10:34:48 -0700 Message-ID: To: Sean Turner Content-Type: multipart/alternative; boundary=001a114e81dc29d4c1054aa0235b Archived-At: Cc: "" Subject: Re: [TLS] WGLC: draft-ietf-tls-tls13-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Mar 2017 17:35:31 -0000 --001a114e81dc29d4c1054aa0235b Content-Type: text/plain; charset=UTF-8 Note to Ilari: I have already taken your email as WGLC comments, so no need to re-send. -Ekr On Mon, Mar 13, 2017 at 10:30 AM, Sean Turner wrote: > This is a working group last call announcement for > draft-ietf-tls-tls13-19, to run through March 27. Please send your reviews > to the list as soon as possible so we can prepare for any discussion of > open issues at IETF 98 in Chicago. > > Thanks, > J&S > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --001a114e81dc29d4c1054aa0235b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Note to Ilari: I have already taken your email as WGLC com= ments, so no need to
re-send.

-Ekr
<= br>

On= Mon, Mar 13, 2017 at 10:30 AM, Sean Turner <sean@sn3rd.com> = wrote:
This is a working group last call = announcement for draft-ietf-tls-tls13-19, to run through March 27.=C2=A0 Pl= ease send your reviews to the list as soon as possible so we can prepare fo= r any discussion of open issues at IETF 98 in Chicago.

Thanks,
J&S
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--001a114e81dc29d4c1054aa0235b-- From nobody Mon Mar 13 12:49:52 2017 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E68C9129AC4; Mon, 13 Mar 2017 12:49:45 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.47.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148943458591.20353.5083339476703411003@ietfa.amsl.com> Date: Mon, 13 Mar 2017 12:49:45 -0700 Archived-At: Cc: tls@ietf.org Subject: [TLS] I-D Action: draft-ietf-tls-rfc4492bis-15.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Mar 2017 19:49:46 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Transport Layer Security of the IETF. Title : Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier Authors : Yoav Nir Simon Josefsson Manuel Pegourie-Gonnard Filename : draft-ietf-tls-rfc4492bis-15.txt Pages : 33 Date : 2017-03-13 Abstract: This document describes key exchange algorithms based on Elliptic Curve Cryptography (ECC) for the Transport Layer Security (TLS) protocol. In particular, it specifies the use of Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) key agreement in a TLS handshake and the use of Elliptic Curve Digital Signature Algorithm (ECDSA) and Edwards Digital Signature Algorithm (EdDSA) as authentication mechanisms. This document obsoletes and replaces RFC 4492. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tls-rfc4492bis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-15 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tls-rfc4492bis-15 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Mar 13 16:42:36 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 12108129721 for ; Mon, 13 Mar 2017 16:42:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vKP7HPWZy2Sf for ; Mon, 13 Mar 2017 16:42:34 -0700 (PDT) Received: from mail-yw0-x230.google.com (mail-yw0-x230.google.com [IPv6:2607:f8b0:4002:c05::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A26E129951 for ; Mon, 13 Mar 2017 16:42:33 -0700 (PDT) Received: by mail-yw0-x230.google.com with SMTP id o4so69504203ywd.3 for ; Mon, 13 Mar 2017 16:42:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=++bAoGvMrn+0weQgpu10k9oA2mz//lw9mjG6cKnmQvI=; b=BONYixFO/w3eFn7Cfd8sfbjmGGpvzvlhiDauLpekoWyt+jPth4ZGXnKSbMzf0aVjmE esCW+wdpgNB927bGbaFY6sCx+emHxXQz0eVFFAhXRUwxPea7Ih2ibxCaKqBBBnHdqWzL 15ot0xfOJI2GLwS4Bq8xfIubHKivf0qb5YxmcV6Tx8yklQNcHVGrY37TcqwsSq7DJdXa kY79ZdPQHO2AmKVdPtbmw4vxpo3aR4Ddd1hEfAnq9+OnEq0mcjO0zsxeXbaYTekUJazm 0oc2ijRFhoGC4mh18gnFo6gOifF2O/PF+bMqawwfJTVnVqI7B/DD33oGLg6PF7uKa9N7 4oWA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=++bAoGvMrn+0weQgpu10k9oA2mz//lw9mjG6cKnmQvI=; b=XHkJns7M4xQi9poraDc8cdJuHRsrP0LgDKoH46gN7qNDrHysV6lr2/9SECwENFuvcD aff3g1xWU4B8S8vv8cK0SRbRiQOzJwH8BOC8iVU0ClqkEjweOr/MzVvh8usAa0itW6c6 H2pNmXcV1x7IQvPWzJazFoSV2m4OTPv9zgzqoVeOcee9b00VCdTaEbFZ8rgR5sEFHQZp GtctYM0C7bX9Igoiwvj3Vv0dJjRFIt97Bm3NhOBbPGkifIC9+Wzx7KB4J0sefJNda+CS moPZHBIMituWH2ZbPlZEiuASubJRI6PWfyFkKxyWFQdb2cI76/rba0YKajTWAy0kl1w6 p2+g== X-Gm-Message-State: AMke39n6iGtM9pUBBWToCqHmsQaNi7dFyG9dWrYFPoTww67ZWbbP/Sq9R+OtidR69IvKDXf7detZmLG1DIXHsg== X-Received: by 10.129.177.8 with SMTP id p8mr21048816ywh.327.1489448552785; Mon, 13 Mar 2017 16:42:32 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Mon, 13 Mar 2017 16:41:52 -0700 (PDT) From: Eric Rescorla Date: Mon, 13 Mar 2017 16:41:52 -0700 Message-ID: To: "tls@ietf.org" Content-Type: multipart/alternative; boundary=94eb2c13ce38e68089054aa543e9 Archived-At: Subject: [TLS] Updated DTLS draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Mar 2017 23:42:35 -0000 --94eb2c13ce38e68089054aa543e9 Content-Type: text/plain; charset=UTF-8 I have just posted a new version of the DTLS 1.3 draft, updated for draft-19. It's still very rough with a lot of open issues (some of which are even noted in the draft), and no doubt contains egregious errors. https://tools.ietf.org/html/draft-rescorla-tls-dtls13-01 As usual, comments welcome. -Ekr --94eb2c13ce38e68089054aa543e9 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I have just posted a new version of the DTLS 1.3 draft, up= dated for draft-19.
It's still very rough with a lot of open issues= (some of which are even noted
in the draft), and no doubt contai= ns egregious errors.


As usual, comments w= elcome.

-Ekr



--94eb2c13ce38e68089054aa543e9-- From nobody Mon Mar 13 18:00:36 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5EFE7129968 for ; Mon, 13 Mar 2017 18:00:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z4JV_xZmuJcS for ; Mon, 13 Mar 2017 18:00:33 -0700 (PDT) Received: from mail-vk0-x22b.google.com (mail-vk0-x22b.google.com [IPv6:2607:f8b0:400c:c05::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 956051298D3 for ; Mon, 13 Mar 2017 18:00:33 -0700 (PDT) Received: by mail-vk0-x22b.google.com with SMTP id d188so44478399vka.0 for ; Mon, 13 Mar 2017 18:00:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=h1J7uuu3CTEiBCJVbqwnNEUsW8rLvX/mEaW7+B4s8cg=; b=JseWpGRIMwTBI80Td6/7f+Z+zxzRvHHjQdvmK7ed7wQS2jr7hy4qWJpcAqGqTHrsGO RPPJRKZPq4js6ytQyv7e1hfqUdlWuWKL+u78/xjhq1Sy6oLNSpTG7y/oYPSJ91KFpoiF YRV2P2mNSV0X+WdepsyMVfOL8t12z6oNSwFFO0AY0XuNhk2wq3hYnBxaYRuRNRADHlAd xN3v/eWsPCeQ1+vNHzRsOc3wU84S5tvyAulrhqviNlEHGzJ1voqHALX1OBi05CBDdUvo ejuZsljJBleGDQFkBrTNHHkWUZWsaEdB7E5Gbm5JeXRv7mEGcX4kgPqUF4TFseOm4o2j Mz1A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=h1J7uuu3CTEiBCJVbqwnNEUsW8rLvX/mEaW7+B4s8cg=; b=UsuT7FbzzCTvEASXAhZi0SkgUk9BhvjpVJzHbl3TX0tu/olUzh69ZZqsOrGEG42no7 eKFqoEZ6qM9BUgV9POQG8I55kPMubhhLUBgwbsKqyPCGi3cr3GLMrEQqirZcfKrLfsSd BFx8MKXGQXx6NsfXjX1wIM10rmvYLySCsXp23WLNt9WaFGFLXH3bU7jl2Y2K4n96JQWy rUg187ueR/XRAxMBswqrfTyyoKbH2hHcVVyqj6j8mRRfNE8E3i934nayyszHdzSZUZGG d8prFPkISK5636qZ8+KuE01ur3357zjlbDs/RGPEvbLGTZGyaoqFaEj76Bm5nbyD3Sus lbDA== X-Gm-Message-State: AMke39nnpY4OYeLYdnt3QTFusl6/g72lqs3aUI8qFOsTox/dOuBTPlQRKlz06m5l4i/sOsRc1nznjzKMAQvlkA== X-Received: by 10.31.97.197 with SMTP id v188mr16643135vkb.172.1489453232695; Mon, 13 Mar 2017 18:00:32 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Nick Sullivan Date: Tue, 14 Mar 2017 01:00:22 +0000 Message-ID: To: Joseph Salowey , "tls@ietf.org" Content-Type: multipart/alternative; boundary=94eb2c0944a4d82f55054aa65ac0 Archived-At: Subject: Re: [TLS] Interest in draft-sullivan-tls-exported-authentication X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Mar 2017 01:00:35 -0000 --94eb2c0944a4d82f55054aa65ac0 Content-Type: text/plain; charset=UTF-8 All, I have updated the draft in preparation for the IETF 98: https://tools.ietf.org/html/draft-sullivan-tls-exported-authenticator-01 The details of the protocol haven't changed, but I've included some security considerations after speaking with Karthikeyan Bhargavan and others about the cryptographic soundness of the construction. Nick On Tue, Jan 3, 2017 at 8:59 PM Joseph Salowey wrote: > There seemed to be support for draft-sullivan-tls-exported-authentication > (https://tools.ietf.org/html/draft-sullivan-tls-exported-authenticator-00) > in Seoul. Since there has not been much discussion of this draft on the > list we are giving the working group a chance to review the draft before > calling for adoption later this month. > > Cheers, > > J&S > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --94eb2c0944a4d82f55054aa65ac0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
All,

I have updated the draft in prepara= tion for the IETF 98: https://tools.ietf.org/html/draft-sullivan-= tls-exported-authenticator-01

The details of the= protocol haven't changed, but I've included some security consider= ations after speaking with Karthikeyan Bhargavan and others about the crypt= ographic soundness of the construction.

Nick

On Tue, Jan 3, 2017= at 8:59 PM Joseph Salowey <joe@salow= ey.net> wrote:
There seemed to be support for=C2=A0draft-sullivan-tls-exported-authentication (<= a href=3D"https://tools.ietf.org/html/draft-sullivan-tls-exported-authentic= ator-00" style=3D"font-size:12.8px" class=3D"gmail_msg" target=3D"_blank">h= ttps://tools.ietf.org/html/draft-sullivan-tls-exported-authenticator-00= ) in Seoul. =C2=A0 Sin= ce there has not been much discussion of this draft on the list we are givi= ng the working group a chance to review the draft before calling for adopti= on later this month. =C2=A0=C2=A0

Cheers,

J&S
_______________________________________________
TLS mailing list
TLS@i= etf.org
https://www.ietf.org/mailman/listinfo/t= ls
--94eb2c0944a4d82f55054aa65ac0-- From nobody Mon Mar 13 20:13:59 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81E1D129A6A for ; Mon, 13 Mar 2017 20:13:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.702 X-Spam-Level: X-Spam-Status: No, score=-2.702 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ih0fkVEFo8X5 for ; Mon, 13 Mar 2017 20:13:57 -0700 (PDT) Received: from prod-mail-xrelay07.akamai.com (prod-mail-xrelay07.akamai.com [23.79.238.175]) by ietfa.amsl.com (Postfix) with ESMTP id DBD3F129BBD for ; Mon, 13 Mar 2017 20:13:56 -0700 (PDT) Received: from prod-mail-xrelay07.akamai.com (localhost.localdomain [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id F22E1433404; Tue, 14 Mar 2017 03:13:55 +0000 (GMT) Received: from prod-mail-relay10.akamai.com (prod-mail-relay10.akamai.com [172.27.118.251]) by prod-mail-xrelay07.akamai.com (Postfix) with ESMTP id D4ECC433401; Tue, 14 Mar 2017 03:13:55 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; s=a1; t=1489461235; bh=dy7D3kTXSZdy6cUdb+RFDFI7QTi7oyEmu0DcvXGeKBw=; l=2045; h=From:To:In-Reply-To:References:Date:From; b=MOXH4EvH0BZjN+5L7TS2/mRbPKVBqKR4VIpV5TeFAuqGomjBNhtTN4xL5a9NHcVSO BdpyTRWg9TLNZc6EVkaFFTp7i3uR+XVJeZFJqsV4Fl3a+LzmDLjHBz2Hv5WtPCBDHr WiU1hZSgN1aAuskbDuIajmEni8GsRYSfUn2Oz0WE= Received: from Tereva.local (unknown [172.19.32.212]) by prod-mail-relay10.akamai.com (Postfix) with ESMTP id A842D1FC86; Tue, 14 Mar 2017 03:13:55 +0000 (GMT) From: Brian Sniffen To: Nick Sullivan , Joseph Salowey , "tls\@ietf.org" In-Reply-To: References: Date: Mon, 13 Mar 2017 23:13:55 -0400 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: Re: [TLS] Interest in draft-sullivan-tls-exported-authentication X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Mar 2017 03:13:58 -0000 Can you help me understand what this means? servers that are authoritative for multiple domains the same connection but do not have a certificate that is simultaneously authoritative for all of them I'm sure there's a word or two missing between "domains" and "the" in the first line, but I'm not sure what they are. More generally, it's great to see a replacement for renegotiation. Can you expand (maybe just here?) on the last paragraph of the security considerations? I think you mean that the sender of an authenticator can't tell when it was received & understood. But I'm not sure the receiver can tell when it was sent---say, in the case of a smartcard insertion, or access to a key from satisfying some local attestation scheme, whether that key access precedes or follows the sending of a request. -Brian Nick Sullivan writes: > All, > > I have updated the draft in preparation for the IETF 98: > https://tools.ietf.org/html/draft-sullivan-tls-exported-authenticator-01 > > The details of the protocol haven't changed, but I've included some > security considerations after speaking with Karthikeyan Bhargavan and > others about the cryptographic soundness of the construction. > > Nick > > On Tue, Jan 3, 2017 at 8:59 PM Joseph Salowey wrote: > >> There seemed to be support for draft-sullivan-tls-exported-authentication >> (https://tools.ietf.org/html/draft-sullivan-tls-exported-authenticator-00) >> in Seoul. Since there has not been much discussion of this draft on the >> list we are giving the working group a chance to review the draft before >> calling for adoption later this month. >> >> Cheers, >> >> J&S >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls >> > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls -- Brian Sniffen Akamai Technologies From nobody Mon Mar 13 20:38:18 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D3B7129C15 for ; Mon, 13 Mar 2017 20:38:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BnhWWPL_RGzs for ; Mon, 13 Mar 2017 20:38:15 -0700 (PDT) Received: from mail-qk0-x233.google.com (mail-qk0-x233.google.com [IPv6:2607:f8b0:400d:c09::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F2D11293F5 for ; Mon, 13 Mar 2017 20:38:15 -0700 (PDT) Received: by mail-qk0-x233.google.com with SMTP id v125so234021816qkh.2 for ; Mon, 13 Mar 2017 20:38:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=4UUyhfu9Rc1YHs58tl5qQ8aS2A4BGoTPKK5Vo5GVrTE=; b=KdekpUVKX3DlHuYtDFU8h6jWzIlCUVajBLspbXnzrF5ZshX+bR54Du1OrhHg7j4QDr LkwBobz8O4Fs5bsQ6y2Qo1RlJufXxFolVUn6Chb2NTIEOjaFLfMGPIb3h0NA8t9L97Fz d9FviXmiyUIEliNPb4deRJFalQ2v5PTYcYl3eLE4LvuN508+01NzdmsaXpBIhBelqIlv RvQcsi5RP1xA/kyVxa4VccdzbIBsNpOhHIX2cde8OQGiZEss2Oli7Qz1/fgT3rqyK3jn SA1bMPmxycI7tlE2oV+7aEUVgbPL8eB2tJqngjm6EdUnlOQcgUqPL8qVLbRcgDTp08V0 QIAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=4UUyhfu9Rc1YHs58tl5qQ8aS2A4BGoTPKK5Vo5GVrTE=; b=R74fhaMB2WFo5CSCq4G6Ug/Gu2fz6lXRjUXgAlhzjTNqVD6wSjEbyqOtGctkghST8w zDXQRPvymZhjmtf0/kAC9JKPoIasqWB+QRUw3l7nA4Hh++vfkk7nv8seQm+qC6oigK22 JJfy7eKNOa2Z6HIa+WLkFcXph0ZWQP8FEl55QYzl6fhBC1yor8nt2UqUXs9GL7qnY6SQ luZH+fGxB0j1AiI//FtZ/iQyHl+5pO6f9SuSNI7QguwWUu+gN7vKsnTKxGeriJq6U6Mt ZdtsmKnDyiD6S6DLGe85VI91TkRSNuecL6hIQNRMJH2/22AxFmteRhMw6xZ0lHWZnuK2 EDcQ== X-Gm-Message-State: AFeK/H0WFzS5+ngwLqzoD/utymeVmj7oPmcYnJ7NCaP5D9Pv3H7bM1tCMUC4vYgMxEbr5q49UZ37XCmhYvYLZw== X-Received: by 10.55.18.144 with SMTP id 16mr35612398qks.5.1489462694431; Mon, 13 Mar 2017 20:38:14 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Mon, 13 Mar 2017 20:38:14 -0700 (PDT) From: Martin Thomson Date: Tue, 14 Mar 2017 14:38:14 +1100 Message-ID: To: "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: [TLS] TLS 1.3 and max_fragment_length X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Mar 2017 03:38:16 -0000 When we added padding to TLS 1.3, we created an ambiguity with the max_fragment_length extension. Does the limit apply to len(TLSInnerPlaintext) or does it apply to len(TLSInnerPlaintext.content) (i.e., TLSPlaintext.length)? That is, does is include the padding and content type, or not? Including the padding would recognize the limitations apply to handling large blobs of encrypted data (see earlier email from Thomas Pornin). That would be my preference. I think that we need to say that though. I guess the second-order question is whether to roll RFC6066-bis or patch these things in TLS 1.3 directly. (BTW, RFC 6066 is quite poor. It's not very precise in identifying what it is talking about, it also describes a negotiation design unlike anything else in TLS, one that can't be extended ever.) From nobody Tue Mar 14 00:34:31 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 25176127601 for ; Tue, 14 Mar 2017 00:34:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZZwn-RUlr9uN for ; Tue, 14 Mar 2017 00:34:29 -0700 (PDT) Received: from mail-qk0-x243.google.com (mail-qk0-x243.google.com [IPv6:2607:f8b0:400d:c09::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C358126CD8 for ; Tue, 14 Mar 2017 00:34:29 -0700 (PDT) Received: by mail-qk0-x243.google.com with SMTP id n141so40110364qke.3 for ; Tue, 14 Mar 2017 00:34:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:user-agent:cc:references:in-reply-to :mime-version:content-transfer-encoding:message-id; bh=FjTq75eSwzTt8RprgAAbgiVIy/8w8gTjje6QjsyLY1c=; b=DPwKqLvCSGGobOD3bWDrPNTMR/g05NHCQFxXCzPosE+f+L8MHf+KlAIrk0xhnZ3HBe KkhMBrC5fliF0hhra+kaYEy8yOaYb6FC9E0B9sQstfWalNLjEm1+ej5cfdkRRwcXeVYi xQUWgsR4JxIcyQOcNOE/+uLS14l8xAUKVZ5GGVPB1zsPZ+V64eBG4MjzYoovSIpCWu1e 6wGGocrfIqoj7QlbGYuxRqgWGFVWiwFx1mvRjauxE7CBz1U1ZBfHJxpk3k0Lb0xFWDIK qYpWgY4852a3F5qiAFCuUIrGpaJuF+CY8Iu1mtb94UNTC6nBgkf58Py3HZfKb92sdsIU TADA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:user-agent:cc:references :in-reply-to:mime-version:content-transfer-encoding:message-id; bh=FjTq75eSwzTt8RprgAAbgiVIy/8w8gTjje6QjsyLY1c=; b=BVgxog58SsuyBrz4mP5lmeVGhh2iXkFK91eLUO+eQSv48lnYP3yS7oBvhYyFMUDUrc FoXNhxOifqwxQz+oUwm13JgTELqyzhJNL7ybl8KBdX4IHDzfDylOklmlimSV4jHk15bG MhFo1k11Ymaw0AyK3FraBKLNPG5QCyMakJ4ULnqcrlQaIpyVdLYspUP83iR8dfMSl3wJ GpwJPiscdqLCBqGboYcC7gLzQRKDtBGFNnFzu14WDJsInJicGRlMmklMKjlrOg0WQ1OG YG2I18vzd9cfeajWr9ZObsgjgjjJmTY/EjmjK//86aNbptKRgY0lV8oxckyYSzfHTA8a C2Rw== X-Gm-Message-State: AFeK/H3/BftY7AhwbZAPpXvcpLnUuMTaBzG6J1uc72/TsQR98r4THhrRyUO7273vsRXmKw== X-Received: by 10.55.190.69 with SMTP id o66mr34288214qkf.0.1489476868381; Tue, 14 Mar 2017 00:34:28 -0700 (PDT) Received: from dave-laptop.localnet (pool-71-175-27-43.phlapa.fios.verizon.net. [71.175.27.43]) by smtp.gmail.com with ESMTPSA id h27sm13914248qtf.24.2017.03.14.00.34.27 (version=TLS1 cipher=AES128-SHA bits=128/128); Tue, 14 Mar 2017 00:34:27 -0700 (PDT) From: Dave Garrett To: tls@ietf.org Date: Tue, 14 Mar 2017 03:34:25 -0400 User-Agent: KMail/1.13.5 (Linux/2.6.32-74-generic-pae; KDE/4.4.5; i686; ; ) References: <1F223FC8-32BC-4203-B2C8-E71D5CC47764@dukhovni.org> In-Reply-To: <1F223FC8-32BC-4203-B2C8-E71D5CC47764@dukhovni.org> MIME-Version: 1.0 Content-Type: Text/Plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Message-Id: <201703140334.26225.davemgarrett@gmail.com> Archived-At: Subject: Re: [TLS] New Draft: Using DNS to set the SNI explicitly X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Mar 2017 07:34:31 -0000 On Friday, March 10, 2017 10:29:30 am Viktor Dukhovni wrote: > Instead of looking for a kludgey replacement SNI in DNS (that won't get deployed, > and provides rather weak obfuscation) it seems more sensible to publish keys in > DNS that make it possible to encrypt the entire client HELLO, SNI and all. +1 From nobody Tue Mar 14 01:06:21 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6ECCA1288B8 for ; Tue, 14 Mar 2017 01:06:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ztM9c8nCQdLX for ; Tue, 14 Mar 2017 01:06:17 -0700 (PDT) Received: from welho-filter1.welho.com (welho-filter1.welho.com [83.102.41.23]) by ietfa.amsl.com (Postfix) with ESMTP id 37938120725 for ; Tue, 14 Mar 2017 01:06:17 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter1.welho.com (Postfix) with ESMTP id 602001EF1D; Tue, 14 Mar 2017 10:06:15 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp1.welho.com ([IPv6:::ffff:83.102.41.84]) by localhost (welho-filter1.welho.com [::ffff:83.102.41.23]) (amavisd-new, port 10024) with ESMTP id 7T9Sxd4AHuc1; Tue, 14 Mar 2017 10:06:15 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp1.welho.com (Postfix) with ESMTPSA id 28C87C4; Tue, 14 Mar 2017 10:06:15 +0200 (EET) Date: Tue, 14 Mar 2017 10:06:07 +0200 From: Ilari Liusvaara To: Martin Thomson Message-ID: <20170314080607.GA18882@LK-Perkele-V2.elisa-laajakaista.fi> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] TLS 1.3 and max_fragment_length X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Mar 2017 08:06:19 -0000 On Tue, Mar 14, 2017 at 02:38:14PM +1100, Martin Thomson wrote: > When we added padding to TLS 1.3, we created an ambiguity with the > max_fragment_length extension. > > Does the limit apply to len(TLSInnerPlaintext) or does it apply to > len(TLSInnerPlaintext.content) (i.e., TLSPlaintext.length)? That is, > does is include the padding and content type, or not? > > Including the padding would recognize the limitations apply to > handling large blobs of encrypted data (see earlier email from Thomas > Pornin). That would be my preference. I think that we need to say > that though. I guess the second-order question is whether to roll > RFC6066-bis or patch these things in TLS 1.3 directly. I would think it would include the padding, because otherwise you can not limit the size of buffers to store a record. And if you have an encrypted record, you can decrypt it in-place anyway, so limits on plaintext size post-depadding are not useful. Furthermore, there is edge case in how max_fragement_length is currently defined in TLS 1.3 (it isn't available when parsing ServerHello, but ServerHello is also limited by it). Fortunately, that edge case is very unlikely to be hit, as ServerHello is highly likely to be under the limit[1], and ServerHello can't be coalesced with anything (since it has flight or key boundaries on both sides). [1] Base ServerHello is 42 bytes, pre_shared_key gives you 6. And key_share gives you 8+size_of_share. So at maximum you have 56+ size_of_share. The minimum limit is 512, and to reach that you need 456 byte share. The only things that have shares of that size are groups 258, 259 and 260. And none of those would seem to be likely implemented by any device that uses max_fragment_length. For 1024-byte limit, you have 968 bytes, which is only exceeded by group 260. And for higher 2048 and 4096 byte limits, no current group is big enough to blow the size limits. -Ilari From nobody Tue Mar 14 02:11:01 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD394129512 for ; Tue, 14 Mar 2017 02:10:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yXdAqsjxNoTg for ; Tue, 14 Mar 2017 02:10:58 -0700 (PDT) Received: from mail-wr0-x231.google.com (mail-wr0-x231.google.com [IPv6:2a00:1450:400c:c0c::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA5AF1293F2 for ; Tue, 14 Mar 2017 02:10:57 -0700 (PDT) Received: by mail-wr0-x231.google.com with SMTP id l37so119533982wrc.1 for ; Tue, 14 Mar 2017 02:10:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=+Wq7Olg7YO8q4nZBymN7Dravd0162JmHFaG+dc8GJsg=; b=MPzCtptcB6r7NjpBrSCDwp4gkEMRnYLdxmPkpHbIypq7lSFjjF2Bs958mOWfpRVI9f nhVo9WmS2kVK/rCjXGcz8qln3UmW5B3Kq8oNLsjJ6VikdNNS+hThoZjl8/2WGrGzlkKr t+gNx2G9kfEhahjnAJOpDEGGC+kFZ61DA0DJ9OKiDJ4wsL9yMNIUV+tBBC8OlbjM5+gl zjDYjiw9mBGPZ4dizthmg9k2Y8ZmGYBBsinrX8fR4sENMiq+ZaR3VhEaXLL3G2ilDKQL WnpLTDneaVCUAxhaW0K7xuEnabFth7W/gieu6d5hrZ6aV/+vPmmYAQWw+jPSmQKbb8dP CvaQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=+Wq7Olg7YO8q4nZBymN7Dravd0162JmHFaG+dc8GJsg=; b=f7AxUOqhYO8zbvO/sWyYBSigNJejtZajLbX2xR1E1SzOfQsJJfa8y5AzMQFIauYqV9 7JrT0Y81vHVYl2WfXIFkvN3606dgnIkhvDV17D5dJPJ9Crs+kVNHrBRqyr/pLhXksdSA NOFsbGsOFGqP0hiY1pgxg7t8opNdXsMRXNGH82E6tB/D0IkfJf5DqkBuFYczBQWuymxA biiwQCNZwZTLF2KT0M8U8Y5K+nyVJkWHSV/C3g4fxsjpwjSw0afjYMQGjDNZWF/RmeRp dfo1NVhyvsQxQLmUAf3JyxAqB+TWv8ozE6TMOvVsIuZoWzbpj/U8dgXN50a5XRJOSvCT OGbQ== X-Gm-Message-State: AMke39ngsRc6r+mePGHTdx1/dFf4FzbNnTGMmZn6UCgA6LSl3MYTMaB+SCtUEoL1WIBcfQ== X-Received: by 10.223.136.182 with SMTP id f51mr29714933wrf.90.1489482656400; Tue, 14 Mar 2017 02:10:56 -0700 (PDT) Received: from [172.24.251.163] (dyn32-131.checkpoint.com. [194.29.32.131]) by smtp.gmail.com with ESMTPSA id q5sm28528586wrd.32.2017.03.14.02.10.55 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 14 Mar 2017 02:10:55 -0700 (PDT) From: Yoav Nir Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_9593A4BB-B3C3-45FC-ACEF-3768821DF4AB"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Tue, 14 Mar 2017 11:10:54 +0200 In-Reply-To: To: Martin Thomson References: X-Mailer: Apple Mail (2.3259) Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] TLS 1.3 and max_fragment_length X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Mar 2017 09:11:00 -0000 --Apple-Mail=_9593A4BB-B3C3-45FC-ACEF-3768821DF4AB Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 14 Mar 2017, at 5:38, Martin Thomson = wrote: >=20 > When we added padding to TLS 1.3, we created an ambiguity with the > max_fragment_length extension. >=20 > Does the limit apply to len(TLSInnerPlaintext) or does it apply to > len(TLSInnerPlaintext.content) (i.e., TLSPlaintext.length)? That is, > does is include the padding and content type, or not? >=20 > Including the padding would recognize the limitations apply to > handling large blobs of encrypted data (see earlier email from Thomas > Pornin). That would be my preference. I think that we need to say > that though. I guess the second-order question is whether to roll > RFC6066-bis or patch these things in TLS 1.3 directly. >=20 > (BTW, RFC 6066 is quite poor. It's not very precise in identifying > what it is talking about, it also describes a negotiation design > unlike anything else in TLS, one that can't be extended ever.) Well, I can=E2=80=99t think of a single rational argument in favor of it = *not* including the padding, so I guess I agree that it does. If it didn=E2=80=99t include the padding, then any record with length = greater than the max_fragment_length would be obviously padded. Why leak = that? Yoav --Apple-Mail=_9593A4BB-B3C3-45FC-ACEF-3768821DF4AB Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYx7OeAAoJELhJCxUKWMyZLJcH/3Gl3tKfGfnsB7EbVe4EeWmE 8C8asqfZVURAPf+c+bkN7gr/T2sU4mf25+UWy21s/JZGH6NM546+fFKfviSftun3 ekp3VE9arQmaN8iqMc7uZXw+i+XhwaGMbCdEGbdhA2lXMTLEAFvZ80QoP34cVcFr dA17PU+avkaTJrCI648QbrZ/iVj3PodGq/OOp2P3J77895RXLp2K9gAUpsoaqnRY qLI6nJl6e1Cth4DGUmNCAuPxVebmO6xvxi8RwKepuduCcxxQk3reEQ2Abaj8HMl9 mXHNtgSsnonECoVos9jCQMe4nAaQH44rQKxbs7gSsFO/hem6+G1bL9H/3hWcZ8E= =Zobu -----END PGP SIGNATURE----- --Apple-Mail=_9593A4BB-B3C3-45FC-ACEF-3768821DF4AB-- From nobody Tue Mar 14 02:31:28 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61C541294E0 for ; Tue, 14 Mar 2017 02:31:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dawqLtCH3QGU for ; Tue, 14 Mar 2017 02:31:23 -0700 (PDT) Received: from mail-wm0-x22e.google.com (mail-wm0-x22e.google.com [IPv6:2a00:1450:400c:c09::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B4F7129532 for ; Tue, 14 Mar 2017 02:31:23 -0700 (PDT) Received: by mail-wm0-x22e.google.com with SMTP id v186so59038625wmd.0 for ; Tue, 14 Mar 2017 02:31:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=7YAaIALmK+sLyQdOrF0NvVDaAIN0ik2dcJGzGuedSXU=; b=RyikXZDheZPlaH6eHG/IVVAUwsa0St/3uJRVzzALsv4AWVmHUudLDPJBxz87uwyC7K gR/WF5YakexndqfuPGwXmF1RXbd9cq4mevLeik49/HcF//6ur/GJC5vgH3u/NnRDXGMg x61dhTnccVwF9xSptEVb0IL9ajdnyk+mrc9jW7e/1Nls670jdmd/17xv3z6twwWN9Qak RTVo9Ljf2e//nGKgtdo/xqmu5FMb1aGD7hUgrZA+H4LiMAW2rCwspBlc1oA7bb9lEvPJ 7RgjTNlszxSUfL8RsgDvQ8D6tplXjY3yMHmpMCzJH37WiI7I6NN4eG8tc3fST58AACX3 D2Tg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=7YAaIALmK+sLyQdOrF0NvVDaAIN0ik2dcJGzGuedSXU=; b=rWuYe80CrltRV1vaHCGg0Ki6sZT23dhwBF9jqSRl/sHf/j8PnZHMyPn7l5PuRueMGR N7AINhsNw6ofVTCv7wsI2GHax/6mqiuHxEYqhdKmW8QqfT8o41dIfB6Hu5BXjxLPOA2U Se/KgKBxjeEm9Ff1+hDFDMXXkpwn/MFzf1nlQS5pKg+XbJyErs7Kvx1aTRcCvKTqK5n+ 60lgegdeDM9C6vJB5DwRjERnFmhtE5D/zZWpWUilbSxypzkkx6znk1DsxtbtT9K5VIMA ZZkAqwaiLTNaWKjujESj+0x2DR8dt5NYEz0W5MF7uMN6MOybU+YgcxOsJqejIMXluKaL ulrQ== X-Gm-Message-State: AFeK/H0lkHaI8+tgAVS9CkNWZs6oIo54WoI9YYce5gzPye7JswhwWFvfgfofd1w7pqI9Sg== X-Received: by 10.28.72.193 with SMTP id v184mr14075306wma.105.1489483881864; Tue, 14 Mar 2017 02:31:21 -0700 (PDT) Received: from [172.24.251.163] (dyn32-131.checkpoint.com. [194.29.32.131]) by smtp.gmail.com with ESMTPSA id w17sm28454553wra.28.2017.03.14.02.31.20 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 14 Mar 2017 02:31:20 -0700 (PDT) From: Yoav Nir Message-Id: <18C5AB7E-5AE6-4FB9-ADEC-7D45D2717F44@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_DF398C7E-8DAF-4B90-A470-88E0D2D47CCE"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Tue, 14 Mar 2017 11:31:18 +0200 In-Reply-To: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> To: Sean Turner References: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> X-Mailer: Apple Mail (2.3259) Archived-At: Cc: "" Subject: Re: [TLS] WGLC: draft-ietf-tls-tls13-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Mar 2017 09:31:25 -0000 --Apple-Mail=_DF398C7E-8DAF-4B90-A470-88E0D2D47CCE Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi. I will give the entire document a more thorough read, but I wanted to = comment on section 1.2 earlier. Its title is =E2=80=9CMajor differences = from TLS 1.2=E2=80=9D, but the content is a change-log. The kind of = change-log that usually gets deleted by the RFC editor. I hope we don=E2=80=99t plan to publish with sentences like =E2=80=9CAllow= cookies to be longer=E2=80=9D. OTOH I think it will be useful to have = an actual =E2=80=9Cmajor differences from TLS 1.2=E2=80=9D section, but = AFAICT it=E2=80=99s not yet written. Yoav > On 13 Mar 2017, at 19:30, Sean Turner wrote: >=20 > This is a working group last call announcement for = draft-ietf-tls-tls13-19, to run through March 27. Please send your = reviews to the list as soon as possible so we can prepare for any = discussion of open issues at IETF 98 in Chicago. >=20 > Thanks, > J&S > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls --Apple-Mail=_DF398C7E-8DAF-4B90-A470-88E0D2D47CCE Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYx7hmAAoJELhJCxUKWMyZ/SEH/13ttMv4wltKdJxymi69btZn HawodnYtgCLPKj7mhk5aexrvn/Qzy9dGDbIeayvV8BRVtujY/82150M7xBb5KSdx npYUHUGg+NLt0WPncOhT1XGPxkl39XJ5FZfdveh9tnDFO9bXUCaYIMqMWTry2IP+ BQ4colkjgRV+BabRF6FnS8EZpTs4qtzBONIYewngw05W7C25MkN+I6vRA6Vm/OPQ y5LdTWbwwoQ6V2+dIEnw8kwv9p3txviPM1w3HADxFcD7k0P4OiFyE0KB7QXWxXGz KlNc4W8bx/WynDw7d2nGN5+jxBtxAiFXk6rzBss2Z+s3ejtByliyjPPJJgU+t2E= =aLUj -----END PGP SIGNATURE----- --Apple-Mail=_DF398C7E-8DAF-4B90-A470-88E0D2D47CCE-- From nobody Tue Mar 14 04:04:56 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C9F812954C for ; Tue, 14 Mar 2017 04:04:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uSRoihNAP0yI for ; Tue, 14 Mar 2017 04:04:54 -0700 (PDT) Received: from welho-filter2.welho.com (welho-filter2.welho.com [83.102.41.24]) by ietfa.amsl.com (Postfix) with ESMTP id D0C5D12953D for ; Tue, 14 Mar 2017 04:04:53 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter2.welho.com (Postfix) with ESMTP id 12FE01ED83; Tue, 14 Mar 2017 13:04:51 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp1.welho.com ([IPv6:::ffff:83.102.41.84]) by localhost (welho-filter2.welho.com [::ffff:83.102.41.24]) (amavisd-new, port 10024) with ESMTP id u0QcfMzx-HMk; Tue, 14 Mar 2017 13:04:50 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp1.welho.com (Postfix) with ESMTPSA id B178FC4; Tue, 14 Mar 2017 13:04:50 +0200 (EET) Date: Tue, 14 Mar 2017 13:04:44 +0200 From: Ilari Liusvaara To: Yoav Nir Message-ID: <20170314110443.GB18882@LK-Perkele-V2.elisa-laajakaista.fi> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] TLS 1.3 and max_fragment_length X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Mar 2017 11:04:56 -0000 On Tue, Mar 14, 2017 at 11:10:54AM +0200, Yoav Nir wrote: > > > On 14 Mar 2017, at 5:38, Martin Thomson wrote: > > > > When we added padding to TLS 1.3, we created an ambiguity with the > > max_fragment_length extension. > > > > Does the limit apply to len(TLSInnerPlaintext) or does it apply to > > len(TLSInnerPlaintext.content) (i.e., TLSPlaintext.length)? That is, > > does is include the padding and content type, or not? > > > > Including the padding would recognize the limitations apply to > > handling large blobs of encrypted data (see earlier email from Thomas > > Pornin). That would be my preference. I think that we need to say > > that though. I guess the second-order question is whether to roll > > RFC6066-bis or patch these things in TLS 1.3 directly. > > > > (BTW, RFC 6066 is quite poor. It's not very precise in identifying > > what it is talking about, it also describes a negotiation design > > unlike anything else in TLS, one that can't be extended ever.) > > Well, I can’t think of a single rational argument in favor of it > *not* including the padding, so I guess I agree that it does. > > If it didn’t include the padding, then any record with length > greater than the max_fragment_length would be obviously padded. > Why leak that? Actually, even worse, then the padding would require extra memory, which the endpoint presumably does not have. If you limit padded plaintext length to 513 bytes (the minimum needed for 512 byte plaintext), with current ciphers, the record payload is at most 529 bytes (16 byte tag is added). Thus, you can receive the record into 529 byte buffer and decrypt in place. -Ilari From nobody Tue Mar 14 04:26:28 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D420129535 for ; Tue, 14 Mar 2017 04:26:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K4KhPZpKCiOI for ; Tue, 14 Mar 2017 04:26:25 -0700 (PDT) Received: from mail-wr0-x22f.google.com (mail-wr0-x22f.google.com [IPv6:2a00:1450:400c:c0c::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B764712943B for ; Tue, 14 Mar 2017 04:26:24 -0700 (PDT) Received: by mail-wr0-x22f.google.com with SMTP id g10so121921928wrg.2 for ; Tue, 14 Mar 2017 04:26:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=cvhLhbXi66h6s2dGHnUrRUlg9jIw5BXpnLe1fbAuQ2s=; b=CJiQFuQJd3RtMhPFS2108wi/0Ln7V6wcsrfSYomUC/ulSgsDyq+6oiqnJ/wF4eLycz Gw+c+Qud+1WTtBJSUF63Y9cy0vcAGih/BS/lrP6IPfejDCkKHaWqJOxb7bQpANzZWqY7 8onxAmXahETlbCCW2L2bTNXj5BPFgNr1i9Hl2PefDfWs079NMiq8+ZtZSfdSmFnMLpvC aHKqaw2zPG+BTrB715Aw48Shcec4O0Ja6+5bP1aSOKV8nboWmw4ptkgSSgrLVIwPEm2g 2TxxFXzBEexDO3tOcMefYmPYAgusy1G2hHrry8x54VZwITpzvlr3ga/i1t6fUYsEaQSC +7gA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=cvhLhbXi66h6s2dGHnUrRUlg9jIw5BXpnLe1fbAuQ2s=; b=H0pXq2yEWBJoTfFE2NK0NBWPm0qWNJFAFk5HZB7JFZ8z9XsPR8p3ewtzIMjSoHIuDR Kx6XW3AxVqAw6iBzIUU+UdzEMrZr7P81CKbFoCSBZicE+uPYqejbyTYYnv96qtC5y9S2 /wakQM1yhfoU+HUH7EubIx5fU1pvf17w7OBwtk4LFnm9InYPDREHOF9Vuxh97U2owiwI aGJpxvSEsU56k5hSdIxU9z7IefZGMt62kN5eMz+BK+V7r9IK0xV0DznlIcykrARdPYvc hCaY7g5piPUTtVw0824zwL9yKnyAcv/dhwar5cf2hZBIfUQv5ULHYpkVOIswVdrXfpWf HBsw== X-Gm-Message-State: AMke39n7jc3RHuqc3rJ1XSbOAfACbSO6wJUG4XybAasqwyBkLYpYEHSqQ8hCI1SHotDL9A== X-Received: by 10.223.140.25 with SMTP id z25mr33067919wra.101.1489490783274; Tue, 14 Mar 2017 04:26:23 -0700 (PDT) Received: from [172.24.251.163] (dyn32-131.checkpoint.com. [194.29.32.131]) by smtp.gmail.com with ESMTPSA id b199sm15069906wmb.13.2017.03.14.04.26.21 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 14 Mar 2017 04:26:22 -0700 (PDT) From: Yoav Nir Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_0EDD180E-7E06-487D-94E8-79BD41D46302"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Tue, 14 Mar 2017 13:26:19 +0200 In-Reply-To: <20170314110443.GB18882@LK-Perkele-V2.elisa-laajakaista.fi> To: Ilari Liusvaara References: <20170314110443.GB18882@LK-Perkele-V2.elisa-laajakaista.fi> X-Mailer: Apple Mail (2.3259) Archived-At: Cc: "tls@ietf.org" Subject: Re: [TLS] TLS 1.3 and max_fragment_length X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Mar 2017 11:26:27 -0000 --Apple-Mail=_0EDD180E-7E06-487D-94E8-79BD41D46302 Content-Type: multipart/alternative; boundary="Apple-Mail=_B14D9FBB-5515-4AAB-B51C-D29FEA99084A" --Apple-Mail=_B14D9FBB-5515-4AAB-B51C-D29FEA99084A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On 14 Mar 2017, at 13:04, Ilari Liusvaara = wrote: > On Tue, Mar 14, 2017 at 11:10:54AM +0200, Yoav Nir wrote: >>=20 >>> On 14 Mar 2017, at 5:38, Martin Thomson = wrote: >>>=20 >>> When we added padding to TLS 1.3, we created an ambiguity with the >>> max_fragment_length extension. >>>=20 >>> Does the limit apply to len(TLSInnerPlaintext) or does it apply to >>> len(TLSInnerPlaintext.content) (i.e., TLSPlaintext.length)? That = is, >>> does is include the padding and content type, or not? >>>=20 >>> Including the padding would recognize the limitations apply to >>> handling large blobs of encrypted data (see earlier email from = Thomas >>> Pornin). That would be my preference. I think that we need to say >>> that though. I guess the second-order question is whether to roll >>> RFC6066-bis or patch these things in TLS 1.3 directly. >>>=20 >>> (BTW, RFC 6066 is quite poor. It's not very precise in identifying >>> what it is talking about, it also describes a negotiation design >>> unlike anything else in TLS, one that can't be extended ever.) >>=20 >> Well, I can=E2=80=99t think of a single rational argument in favor of = it >> *not* including the padding, so I guess I agree that it does. >>=20 >> If it didn=E2=80=99t include the padding, then any record with length >> greater than the max_fragment_length would be obviously padded. >> Why leak that? >=20 > Actually, even worse, then the padding would require extra memory, > which the endpoint presumably does not have. >=20 > If you limit padded plaintext length to 513 bytes (the minimum > needed for 512 byte plaintext), with current ciphers, the record > payload is at most 529 bytes (16 byte tag is added). Thus, you > can receive the record into 529 byte buffer and decrypt in > place. >=20 Seems we=E2=80=99re in agreement. So how about modifying the sixth = paragraph in section 5.4? OLD: The presence of padding does not change the overall record size limitations - the full fragment plaintext may not exceed 2^14 octets. NEW: The presence of padding does not change the overall record size limitations - the full fragment plaintext may not exceed 2^14 octets. = If the maximum fragment length is reduced by the presence of the max_fragment_length extension from [RFC6066] then the reduced limit applies to the full plaintext, including the padding. Yoav --Apple-Mail=_B14D9FBB-5515-4AAB-B51C-D29FEA99084A Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On 14 Mar 2017, at 13:04, = Ilari Liusvaara <ilariliusvaara@welho.com> wrote:

On Tue, Mar 14, 2017 at 11:10:54AM +0200, = Yoav Nir wrote:

On 14 Mar 2017, at 5:38, Martin Thomson <martin.thomson@gmail.com> wrote:

When we added padding to TLS 1.3, we created an ambiguity = with the
max_fragment_length extension.

Does the limit apply to len(TLSInnerPlaintext) or does it = apply to
len(TLSInnerPlaintext.content) (i.e., = TLSPlaintext.length)?  That is,
does is include the = padding and content type, or not?

Including = the padding would recognize the limitations apply to
handling large blobs of encrypted data (see earlier email = from Thomas
Pornin).  That would be my preference. =  I think that we need to say
that though.  I = guess the second-order question is whether to roll
RFC6066-bis or patch these things in TLS 1.3 directly.

(BTW, RFC 6066 is quite poor.  It's not = very precise in identifying
what it is talking about, it = also describes a negotiation design
unlike anything else = in TLS, one that can't be extended ever.)

Well, I can=E2=80=99t think of a single rational argument in = favor of it
*not* including the padding, so I guess I = agree that it does.

If it didn=E2=80=99t = include the padding, then any record with length
greater = than the max_fragment_length would be obviously padded.
Why = leak that?

Actually, even worse, then the padding = would require extra memory,
which the endpoint presumably does not = have.

If you limit padded = plaintext length to 513 bytes (the minimum
needed for 512 byte plaintext), with = current ciphers, the record
payload is at most 529 bytes (16 byte tag = is added). Thus, you
can receive the record into 529 byte = buffer and decrypt in
place.


Seems = we=E2=80=99re in agreement. So how about modifying the sixth paragraph = in section 5.4?

OLD:
   The presence of =
padding does not change the overall record size
   limitations - the full fragment plaintext may not exceed 2^14 =
octets.

NEW:
   The presence of =
padding does not change the overall record size
   limitations - the full fragment plaintext may not exceed 2^14 octets. =
If
   the =
maximum fragment length is reduced by the presence of =
the 
   max_fragment_length extension from =
[RFC6066] then the reduced limit 
   applies to the full =
plaintext, including the padding.


Yoav
= --Apple-Mail=_B14D9FBB-5515-4AAB-B51C-D29FEA99084A-- --Apple-Mail=_0EDD180E-7E06-487D-94E8-79BD41D46302 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYx9NcAAoJELhJCxUKWMyZiOIH/1jAK4PHuQ6N0A6iH7flaIIa BA7Ntpwr+tIb1XDpDXjL51lm9Q6xef4uLHRh1hvyBdVgCKSCtQ5NPsoXfc/t3+R6 Gxn9vdWj1EPnmUuXbw2B/N+yieiRSwD4zdU1CZ86FT5zwsg48EIyXtxTPSLzmlqS /l75Iz4f/4WUVgFZq8YYEpfxSzI6ZP/Qe5rEFUn9TbwhOog6Fx3rsgm24Qd3gRCa X/zBw+80XJeyp1kjUYozGzvgCyxBgjkWcw4ssDnheod6AP1c96xIrrS+isug8EgT 5b0gH3ZdnO47MnfOqvBsO67a09QUATpu5LPJur8sqXDA2tJJAFHyeY2+16BNuK8= =j8Zn -----END PGP SIGNATURE----- --Apple-Mail=_0EDD180E-7E06-487D-94E8-79BD41D46302-- From nobody Tue Mar 14 13:40:32 2017 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 42BD4129B08; Tue, 14 Mar 2017 13:40:24 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Kathleen Moriarty To: "The IESG" Cc: draft-ietf-tls-rfc4492bis@ietf.org, Sean Turner , tls-chairs@ietf.org, sean@sn3rd.com, tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.47.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148952402426.24274.4020884632180640309.idtracker@ietfa.amsl.com> Date: Tue, 14 Mar 2017 13:40:24 -0700 Archived-At: Subject: [TLS] Kathleen Moriarty's Yes on draft-ietf-tls-rfc4492bis-15: (with COMMENT) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Mar 2017 20:40:24 -0000 Kathleen Moriarty has entered the following ballot position for draft-ietf-tls-rfc4492bis-15: Yes When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-tls-rfc4492bis/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- Thanks for your work on this draft. I just have one question: In section 5.10, I see the following text: The default hash function is SHA-1 [FIPS.180-2], and sha_size (see Section 5.4 and Section 5.8) is 20. However, an alternative hash function, such as one of the new SHA hash functions specified in FIPS 180-2 [FIPS.180-2], SHOULD be used instead. Why are you setting the default to SHA-1 and then recommending that something else should be used? Why not just start with a different SHA hash function as the default or at least for TLS 1.2? I do see the prior text about TLS 1.0 and 1.1 using MD5 and SHA-1, but most have recommended to go right to TLS 1.2 with the SSLv3 deprecation. As such, I'm not clear on why the SHA-1 default. From nobody Tue Mar 14 13:44:08 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D59A31314D0 for ; Tue, 14 Mar 2017 13:44:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.801 X-Spam-Level: X-Spam-Status: No, score=-0.801 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9ei4wA7VYwyf for ; Tue, 14 Mar 2017 13:44:05 -0700 (PDT) Received: from prod-mail-xrelay06.akamai.com (prod-mail-xrelay06.akamai.com [96.6.114.98]) by ietfa.amsl.com (Postfix) with ESMTP id 1CB7E1314CF for ; Tue, 14 Mar 2017 13:44:05 -0700 (PDT) Received: from prod-mail-xrelay06.akamai.com (localhost.localdomain [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id 889A9496C0E; Tue, 14 Mar 2017 20:44:04 +0000 (GMT) Received: from prod-mail-relay08.akamai.com (prod-mail-relay08.akamai.com [172.27.22.71]) by prod-mail-xrelay06.akamai.com (Postfix) with ESMTP id 5EE7E496C0B; Tue, 14 Mar 2017 20:44:04 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; s=a1; t=1489524244; bh=z0NY+wXD4AumiBueq9Ow6QBcjJcwQ1HscZ9/R1It2nE=; l=4234; h=To:References:Cc:From:Date:In-Reply-To:From; b=INlAaXNzUJM/Mtr+dTNjWN7zD8o9PA3gPvLJUJaeflT41DfWvXWYX1Yo6jNSB+niH fuitAYz+GSKcKU520ciJLWlCexwIYVEs7AwO7s9LyvFh0QdrfPwha2/idem0Pf1+jS lCwULJEqyNPSRNu3Sly2v2iuxuWxvr5L7q3mtyRg= Received: from [172.19.17.86] (bos-lpczi.kendall.corp.akamai.com [172.19.17.86]) by prod-mail-relay08.akamai.com (Postfix) with ESMTP id EC58898082; Tue, 14 Mar 2017 20:44:03 +0000 (GMT) To: Yoav Nir , Ilari Liusvaara References: <20170314110443.GB18882@LK-Perkele-V2.elisa-laajakaista.fi> Cc: "tls@ietf.org" From: Benjamin Kaduk Message-ID: <9bb67da0-5810-0dd3-a8b7-53fe3e66c6ee@akamai.com> Date: Tue, 14 Mar 2017 15:44:03 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------C5377E4A0F537E757E3BEAE0" Archived-At: Subject: Re: [TLS] TLS 1.3 and max_fragment_length X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Mar 2017 20:44:07 -0000 This is a multi-part message in MIME format. --------------C5377E4A0F537E757E3BEAE0 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit On 03/14/2017 06:26 AM, Yoav Nir wrote: > > > Seems we’re in agreement. So how about modifying the sixth paragraph > in section 5.4? > > OLD: > The presence of padding does not change the overall record size > limitations - the full fragment plaintext may not exceed 2^14 octets. > > NEW: > The presence of padding does not change the overall record size > limitations - the full fragment plaintext may not exceed 2^14 octets. If > the maximum fragment length is reduced by the presence of the > max_fragment_length extension from [RFC6066] then the reduced limit > applies to the full plaintext, including the padding. > That's probably fine, but maybe this one is better: NEW: The presence of padding does not change the overall record size limitations - the full fragment plaintext may not exceed 2^14 octets. If the maximum fragment length is reduced, such as by the max_fragment_length extension from [RFC6066], then the reduced limit applies to the full plaintext, including the padding. -Ben --------------C5377E4A0F537E757E3BEAE0 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit On 03/14/2017 06:26 AM, Yoav Nir wrote:


Seems we’re in agreement. So how about modifying the sixth paragraph in section 5.4?

OLD:
   The presence of padding does not change the overall record size
   limitations - the full fragment plaintext may not exceed 2^14 octets.

NEW:
   The presence of padding does not change the overall record size
   limitations - the full fragment plaintext may not exceed 2^14 octets. If
   the maximum fragment length is reduced by the presence of the 
   max_fragment_length extension from [RFC6066] then the reduced limit 
   applies to the full plaintext, including the padding.


That's probably fine, but maybe this one is better:

NEW:
   The presence of padding does not change the overall record size
   limitations - the full fragment plaintext may not exceed 2^14 octets. If
   the maximum fragment length is reduced, such as by the 
   max_fragment_length extension from [RFC6066], then the reduced limit 
   applies to the full plaintext, including the padding.

-Ben
--------------C5377E4A0F537E757E3BEAE0-- From nobody Tue Mar 14 14:26:32 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D58DC13155F; Tue, 14 Mar 2017 14:26:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.099 X-Spam-Level: X-Spam-Status: No, score=-0.099 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LHGdIwYneBiL; Tue, 14 Mar 2017 14:26:29 -0700 (PDT) Received: from mail-wm0-x243.google.com (mail-wm0-x243.google.com [IPv6:2a00:1450:400c:c09::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F419C129AE8; Tue, 14 Mar 2017 14:26:28 -0700 (PDT) Received: by mail-wm0-x243.google.com with SMTP id v190so1829059wme.3; Tue, 14 Mar 2017 14:26:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=BG7SkCdJ+2E0OPCgar7Puc/rCJIXdVJzdTAVkRmcwV8=; b=LHausIWZlKBhJmFfGNB/61iiAY51oSmdk9MRAEUA3Db96zIru5IW4nNm/WCevXfm47 V11IH7kKsNVqm15TBdeIv52ufU16PK/YrgKOs/VUPzU50qXkqQMSLmQ9ZsBIT1a/cqQO ic5iADW6OAp5z/RbrjzHhf1poIJtnqlxYy9eXaUqSzc+NwdoGHRMS1gjCdpFOUDKiYjQ QdRQmJbYH/cXjdbWbp/9rXalR8pKXXQ+KJBKdxSZxfGjzDkciZ/uZSWJYSD5gAYfAVIG ddDUUolSqYY8+4T76WtcI1YEJheKcUcnrARTKwQOB8NKvdDwmwjD85gO7Hc7zv5xyn16 oxyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=BG7SkCdJ+2E0OPCgar7Puc/rCJIXdVJzdTAVkRmcwV8=; b=nX1eqLQSQ4E4M4hZZ+vDiAMjp6AXXkdJYSUukd6LhyjKk4s4UOlcWSMNiMNA8X0uNr +3u29i0jBCcp6NuIJT3PAF/F9B2QVfOkkQaAypciCHrlzbjQVa61JKhc5zq8NsIXSsnF Lt3qXTRH4YSbYLEOhopqJqgEW7UHuGrJPndGsQua4p15tnrsD8cxizqVtmVRruwnZRLv SZiFL7H6omrbeKLjQ1HC94y/nbo0GUuj97uT2BMJjVICJ1DylNXRjOt0fTXBYfhDxeYX mMna4p6jlU3w/zBdYDKPkeRGDjPBeLJNQabph9ZeULCRr/dmScjwx3pnrMzbd85/Cny1 fRSQ== X-Gm-Message-State: AFeK/H0BgD5UtJNpAB8LUHqa3Z/cCdFc/RoaYyPOuNbyqWaX7vSetRAwIyIcy2I4hIwrJg== X-Received: by 10.28.47.7 with SMTP id v7mr16005099wmv.138.1489526787519; Tue, 14 Mar 2017 14:26:27 -0700 (PDT) Received: from [192.168.1.18] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id u11sm30731463wrb.45.2017.03.14.14.26.25 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 14 Mar 2017 14:26:26 -0700 (PDT) From: Yoav Nir Message-Id: <26D48307-948B-4CBE-AD4A-7C53D70BF8F0@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_E98C0D0A-A031-452B-9D40-333830EEC8F8"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Tue, 14 Mar 2017 23:26:23 +0200 In-Reply-To: <148952402426.24274.4020884632180640309.idtracker@ietfa.amsl.com> Cc: The IESG , draft-ietf-tls-rfc4492bis@ietf.org, Sean Turner , tls-chairs@ietf.org, tls@ietf.org To: Kathleen Moriarty References: <148952402426.24274.4020884632180640309.idtracker@ietfa.amsl.com> X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Kathleen Moriarty's Yes on draft-ietf-tls-rfc4492bis-15: (with COMMENT) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Mar 2017 21:26:31 -0000 --Apple-Mail=_E98C0D0A-A031-452B-9D40-333830EEC8F8 Content-Type: multipart/alternative; boundary="Apple-Mail=_56D3EA52-BDC7-4AE4-973D-37099F56D409" --Apple-Mail=_56D3EA52-BDC7-4AE4-973D-37099F56D409 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi, Kathleen. See inline. > On 14 Mar 2017, at 22:40, Kathleen Moriarty = wrote: >=20 > Kathleen Moriarty has entered the following ballot position for > draft-ietf-tls-rfc4492bis-15: Yes >=20 > When responding, please keep the subject line intact and reply to all > email addresses included in the To and CC lines. (Feel free to cut = this > introductory paragraph, however.) >=20 >=20 > Please refer to = https://www.ietf.org/iesg/statement/discuss-criteria.html > for more information about IESG DISCUSS and COMMENT positions. >=20 >=20 > The document, along with other ballot positions, can be found here: > https://datatracker.ietf.org/doc/draft-ietf-tls-rfc4492bis/ >=20 >=20 >=20 > ---------------------------------------------------------------------- > COMMENT: > ---------------------------------------------------------------------- >=20 > Thanks for your work on this draft. I just have one question: >=20 > In section 5.10, I see the following text: > The default hash function is SHA-1 [FIPS.180-2], and sha_size (see > Section 5.4 and Section 5.8) is 20. However, an alternative hash > function, such as one of the new SHA hash functions specified in > FIPS > 180-2 [FIPS.180-2], SHOULD be used instead. If we add the three lines before the ones you quoted, they say this: All ECDSA computations MUST be performed according to ANSI X9.62 or its successors. Data to be signed/verified is hashed, and the result run directly through the ECDSA algorithm with no additional hashing. The default of using SHA-1 is from X9.62: = https://www.security-audit.com/files/x9-62-09-20-98.pdf = That is the document that was referenced by RFC 4492 and it=E2=80=99s = from 1998. It doesn=E2=80=99t mention any hash function other than = SHA-1. RFC 4492 said that other hash functions may be used. We=E2=80=99ve = upgraded it to a SHOULD. >=20 > Why are you setting the default to SHA-1 and then recommending that > something else should be used? Why not just start with a different = SHA > hash function as the default or at least for TLS 1.2? I do see the = prior > text about TLS 1.0 and 1.1 using MD5 and SHA-1, but most have = recommended > to go right to TLS 1.2 with the SSLv3 deprecation. As such, I'm not > clear on why the SHA-1 default. >=20 >=20 --Apple-Mail=_56D3EA52-BDC7-4AE4-973D-37099F56D409 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi, Kathleen.  See inline.

On = 14 Mar 2017, at 22:40, Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> wrote:

Kathleen Moriarty has entered the following ballot position = for
draft-ietf-tls-rfc4492bis-15: Yes

When responding, please keep the subject line intact and = reply to all
email addresses included in the To and CC = lines. (Feel free to cut this
introductory paragraph, = however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.htmlfor more information about IESG DISCUSS and COMMENT = positions.


The document, = along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-tls-rfc4492bis/=



---------------------------------------------------------------= -------
COMMENT:
---------------------------------------------------------------= -------

Thanks for your work on this draft. =  I just have one question:

In section = 5.10, I see the following text:
  The default = hash function is SHA-1 [FIPS.180-2], and sha_size (see
=   Section 5.4 and Section 5.8) is 20.  However, an = alternative hash
  function, such as one of the = new SHA hash functions specified in
FIPS
=   180-2 [FIPS.180-2], SHOULD be used instead.

If we add = the three lines before the ones you quoted, they say = this:
   All ECDSA computations MUST be performed =
according to ANSI X9.62 or
   its successors.  Data to be signed/verified is hashed, and the result
   run directly through the ECDSA algorithm with no additional =
hashing.

The = default of using SHA-1 is from X9.62: https://www.security-audit.com/files/x9-62-09-20-98.pdf
That is the document that was referenced by RFC 4492 = and it=E2=80=99s from 1998. It doesn=E2=80=99t mention any hash function = other than SHA-1.

RFC 4492 said that other hash functions may be used. We=E2=80=99= ve upgraded it to a SHOULD.


Why are you setting the default to SHA-1 and then = recommending that
something else should be used?  Why = not just start with a different SHA
hash function as the = default or at least for TLS 1.2?  I do see the prior
text about TLS 1.0 and 1.1 using MD5 and SHA-1, but most have = recommended
to go right to TLS 1.2 with the SSLv3 = deprecation.  As such, I'm not
clear on why the SHA-1 = default.



= --Apple-Mail=_56D3EA52-BDC7-4AE4-973D-37099F56D409-- --Apple-Mail=_E98C0D0A-A031-452B-9D40-333830EEC8F8 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYyF//AAoJELhJCxUKWMyZk4EH/1KAKujKJpmZOXarQejPaRMc cre+mhlzYVu8oKTKwBjGiXLr6sahOT+KkaKiqvcGZ7hSYnW6W8KSbz15KgBAeB2e +AA6Ucliwbbu9akVHEiod9Cit/If5fS+R0/j0t9XoRaIxKMJYuiL28mPOBuAJQuZ EjhzxTP5cQtkR+MNayBzTfOSfRcMBEVUVJPkhw3j0BMB+HG7a/EJrNDnex0NAYiW W9FRARjNymMqjhftuEdWs4wdPL1n+/LZRHwXhCoy+NuMImjflmZlvkQrTIYXOZW0 ZldHJ4VzalAVMkcPpTn9cf2FeJsUzS9O4ffqXfv5Avxy8+RLK4LkdVZJJAc7w1c= =sBTD -----END PGP SIGNATURE----- --Apple-Mail=_E98C0D0A-A031-452B-9D40-333830EEC8F8-- From nobody Tue Mar 14 14:27:46 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 74C2B1294A5 for ; Tue, 14 Mar 2017 14:27:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.8 X-Spam-Level: X-Spam-Status: No, score=-0.8 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TielPi1PmGWF for ; Tue, 14 Mar 2017 14:27:43 -0700 (PDT) Received: from mail-qk0-x22f.google.com (mail-qk0-x22f.google.com [IPv6:2607:f8b0:400d:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DAC141294C8 for ; Tue, 14 Mar 2017 14:27:42 -0700 (PDT) Received: by mail-qk0-x22f.google.com with SMTP id v127so2621990qkb.2 for ; Tue, 14 Mar 2017 14:27:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=3FmgqIqukyXtGyJkZ4sNPeznfwD+NF1tIe8GOnBbai4=; b=PfcJpb+ExewRcwsb6d25fZm02+xXUkncFS2qd7NGKjtXmhS/D9oO2AJViJlQB19RxR 01spX2qjvjWSyuwcu2yNGOVBDCycgnOF1gvJFh4FalgTGNlFHGXH+uQYwBkfNdWKevC+ KRu0EM5hYjQDqR0KfhqzoA5CD9QdkItKhTsL59sgLJBql7nvs4/gg2TC6qvv+Ly7B5pG RcOC4h+Jb6Usw6hc7mBlo7zAsSdKRaBHQFbcIEHNFIr728S7Iutt1iX6IMzA05iGJcRx 30MsGKfc6kq1u2m6eHFxLcenxM4OLXamARS+CNNGkt9Jetx2+SkTPkKa9FnFuUV8+M19 ta9w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=3FmgqIqukyXtGyJkZ4sNPeznfwD+NF1tIe8GOnBbai4=; b=Ow1/ARWpGeDp0RHbf7vzxduJrCZ2eL0CTwaQJ9XGLL/5B3aJ9qEFY8fdXbiybO6byG C2epRCteA0v1b5aKgS6Z2/EqrXsaJj7jlrJJFSDBYz/pea6GWCVK8dHhqDLmxkGjBouO pI/wI5gdMgNHoaiS/eGDHXoYg1BaT3qTePMWpVKJctwASYQl6IZzWFG9u8dBX/lXgdb5 Xy80JDlvkq/mk6zkAGAc80NRIb1zf5BJC8yEp2jxRr2IficaLdmQQ4aXlY3UWMTt+OFM cwt0QgtNHer/Wwbx9cwETJibnPu39Jin6JgBanQNExqrLLBQ+lgf/sEyMK/NnqAC18x4 353g== X-Gm-Message-State: AFeK/H0DAcA/AQcqKQjdrcoA5gj9NYmd1+61nxVHKZS6HZ4OmSXkoP96l0mjXGb+gF4CE+4fIXefj0nQekHgXg== X-Received: by 10.55.5.146 with SMTP id 140mr40477094qkf.202.1489526862071; Tue, 14 Mar 2017 14:27:42 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Tue, 14 Mar 2017 14:27:41 -0700 (PDT) In-Reply-To: <9bb67da0-5810-0dd3-a8b7-53fe3e66c6ee@akamai.com> References: <20170314110443.GB18882@LK-Perkele-V2.elisa-laajakaista.fi> <9bb67da0-5810-0dd3-a8b7-53fe3e66c6ee@akamai.com> From: Martin Thomson Date: Wed, 15 Mar 2017 08:27:41 +1100 Message-ID: To: Benjamin Kaduk Cc: Yoav Nir , Ilari Liusvaara , "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] TLS 1.3 and max_fragment_length X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Mar 2017 21:27:44 -0000 On 15 March 2017 at 07:44, Benjamin Kaduk wrote: > The presence of padding does not change the overall record size > limitations - the full fragment plaintext may not exceed 2^14 octets. If > > the maximum fragment length is reduced, such as by the > > max_fragment_length extension from [RFC6066], then the reduced limit > > applies to the full plaintext, including the padding. Sounds good, I've created a PR. I also changed the "may" to a "MUST" on the basis that this is an interoperability requirement. https://github.com/tlswg/tls13-spec/pull/909 From nobody Tue Mar 14 14:29:09 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A113126DC2; Tue, 14 Mar 2017 14:29:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.8 X-Spam-Level: X-Spam-Status: No, score=-0.8 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BK6HJk4Ibx9h; Tue, 14 Mar 2017 14:29:03 -0700 (PDT) Received: from mail-qt0-x235.google.com (mail-qt0-x235.google.com [IPv6:2607:f8b0:400d:c0d::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B8CD7129AE9; Tue, 14 Mar 2017 14:29:03 -0700 (PDT) Received: by mail-qt0-x235.google.com with SMTP id i34so66295153qtc.0; Tue, 14 Mar 2017 14:29:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=EVFJsy/jelcERJFfUNI19q16vtyOF9zvRAr7Z+OX+7I=; b=sgbkTSLroUGgFy0tevLH1VV7JGMILsnvXKenalgX8wIZOvHDBJErcRsvNsmEl4fbVQ XS37qTijmtowKpoEv1ygB3Ix4+z3pR5ua5GpHe4m7yUyV5G0qSw7D02uHcUjEK0Qr9EE 0EuRWXHjk0CnZqlbv4+VK0Sl07rH1foJ7ooH4MCHl0TGefJ4NwIoaKV6WkJo7VkNIK/H GfPOY4dBuTP0FqadSZwWWY/+LjnlkYbRpnH0hGumwcZivzxLgXFzzph388kfHGKw9XJp l1jX8bjx1SmaFpOlyQy2cGW35McDyLAmCPrfy37DiDHT13j72pFGEAiFNKLYGhCHLcVD he3A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=EVFJsy/jelcERJFfUNI19q16vtyOF9zvRAr7Z+OX+7I=; b=CT9z04M9fU02qrXtzFr53xf0VRGmRNisM1WkH1NKtkEBnn5ZigPj0G14ebTtHHzHOf kgQJ+wrmbI0WPHOTcgh2lpg5G4HiIOFnTZhVswwcficPjfdD/pOD78K5+RYoB1QjqxeA ScOX3jNLjeVBZ2lW7CBU2CYZJoq3jv17g3bV3TA8jZSA2fZa1qmJWsyJh2qMSTMNNgod B+Waxwdfp4Yzkvp3YxAQ4Y4onmYj0yfhKne46W1qbFxiZHFeYPFKAMvZ8ANwz2E25xqr LmLaHwtSMWwOl0V9FgeYgF0uhbPlYLjfflXiKqcH4adPk35U/vyJ7eoCRUQRQokKiQFx kmyg== X-Gm-Message-State: AMke39ls4sGBsHnnKF+WpEtcjaoU2/mbEbMtB8KEkE2mUaj040qIJ6Yl7+IQibxsUvlDkhhqrhEsQJqsGLBc3Q== X-Received: by 10.200.46.208 with SMTP id i16mr40530653qta.13.1489526942943; Tue, 14 Mar 2017 14:29:02 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Tue, 14 Mar 2017 14:29:02 -0700 (PDT) In-Reply-To: <26D48307-948B-4CBE-AD4A-7C53D70BF8F0@gmail.com> References: <148952402426.24274.4020884632180640309.idtracker@ietfa.amsl.com> <26D48307-948B-4CBE-AD4A-7C53D70BF8F0@gmail.com> From: Martin Thomson Date: Wed, 15 Mar 2017 08:29:02 +1100 Message-ID: To: Yoav Nir Cc: Kathleen Moriarty , "tls@ietf.org" , tls-chairs , The IESG , draft-ietf-tls-rfc4492bis@ietf.org Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [TLS] Kathleen Moriarty's Yes on draft-ietf-tls-rfc4492bis-15: (with COMMENT) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Mar 2017 21:29:08 -0000 On 15 March 2017 at 08:26, Yoav Nir wrote: > That is the document that was referenced by RFC 4492 and it=E2=80=99s fro= m 1998. It > doesn=E2=80=99t mention any hash function other than SHA-1. > > RFC 4492 said that other hash functions may be used. We=E2=80=99ve upgrad= ed it to a > SHOULD. In light of recent developments, is there any reason we couldn't further upgrade this advice? From nobody Tue Mar 14 15:05:35 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB0DC129BA1; Tue, 14 Mar 2017 15:05:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.099 X-Spam-Level: X-Spam-Status: No, score=-0.099 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QYwvM216UF8u; Tue, 14 Mar 2017 15:05:32 -0700 (PDT) Received: from mail-wm0-x243.google.com (mail-wm0-x243.google.com [IPv6:2a00:1450:400c:c09::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9C1B1300E8; Tue, 14 Mar 2017 15:05:31 -0700 (PDT) Received: by mail-wm0-x243.google.com with SMTP id z63so1962319wmg.2; Tue, 14 Mar 2017 15:05:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=YZVNnT1Hq3L5yAvXcy4mRw0zwU3HqNxK0Q/lMhnNK4k=; b=VDIDaFLLrzonlemn6rlQCDIqsAYuks+/8bzuCPUTp7xSTyxfa8ilAIGLJAsAAiN9hy F/X2IRbxlYgh/CMaJfgkU6sMRVkDeBkXm7CqoPTdIL+dzVf6s2svKhbSsOfQtJ23FIoq v4sBjHvp7NfxUnop1IV6zl+vrkIH0oOaXfDu3cNn2iHnFcr8xos17CCpSVvj6tl7l0ei Kyh8AWLNwQ7b8Uds34OxOc5cV2IJ9SBzraGI8rFXR18d8i5r+qaKmLpSXzpbJdlP868z F7G72Z7EwKhSE/x0Wq8JfYVmXPy96fy0j9jDF1sspAlEbUgLauvgfZJC/14EIwawF+JO YZmQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=YZVNnT1Hq3L5yAvXcy4mRw0zwU3HqNxK0Q/lMhnNK4k=; b=bsqRbmZxttu4FMczyYKyqHov1aBW5QVvXHqcCghc7pY5EE+pfjlCzNG2xhsfbJ8m1T YJJL6dyaONRkA3qf8zbeMQYh0HXZwy3zMpJDzFRS2uRGwvxR4cKfrTKleZmEZZQxkFRU QE6BKZIJAeL778CMlhcZ/1XMdIsVTDVdAKf8MyOI2d04kpM5BO0l9507hcBRv7geShNs dslSk6G+l8/jvXq1pqfVqcFByipKuxWacBUktQxQvECboN4qLe4BP0HMOCxSOY6/5NRr D7jm4BxjhCVED0hWgpGfye5KfMdD/fc2ZMtdKpZWptnGMoccaBdzfrwiZosghrX1A8vv g0oQ== X-Gm-Message-State: AFeK/H3FhmzKtvhUgUTqVC0FaibvBHEkusmG/3T0MwafrXhVte2KHXk7EwGe1+bJL42JpQ== X-Received: by 10.28.152.212 with SMTP id a203mr1600425wme.36.1489529130480; Tue, 14 Mar 2017 15:05:30 -0700 (PDT) Received: from [192.168.1.18] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id k43sm30685060wrk.42.2017.03.14.15.05.28 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 14 Mar 2017 15:05:29 -0700 (PDT) From: Yoav Nir Message-Id: <897DE78D-E918-415C-8716-9C0EA637274F@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_1D62CD8F-1DBC-4FA1-9063-009EE56330F2"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Wed, 15 Mar 2017 00:05:26 +0200 In-Reply-To: Cc: Kathleen Moriarty , "tls@ietf.org" , tls-chairs , The IESG , draft-ietf-tls-rfc4492bis@ietf.org To: Martin Thomson References: <148952402426.24274.4020884632180640309.idtracker@ietfa.amsl.com> <26D48307-948B-4CBE-AD4A-7C53D70BF8F0@gmail.com> X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Kathleen Moriarty's Yes on draft-ietf-tls-rfc4492bis-15: (with COMMENT) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Mar 2017 22:05:34 -0000 --Apple-Mail=_1D62CD8F-1DBC-4FA1-9063-009EE56330F2 Content-Type: multipart/alternative; boundary="Apple-Mail=_3BED1944-9638-4BAC-B9F9-6CB814DB43CD" --Apple-Mail=_3BED1944-9638-4BAC-B9F9-6CB814DB43CD Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 14 Mar 2017, at 23:29, Martin Thomson = wrote: >=20 > On 15 March 2017 at 08:26, Yoav Nir wrote: >> That is the document that was referenced by RFC 4492 and it=E2=80=99s = from 1998. It >> doesn=E2=80=99t mention any hash function other than SHA-1. >>=20 >> RFC 4492 said that other hash functions may be used. We=E2=80=99ve = upgraded it to a >> SHOULD. >=20 > In light of recent developments, is there any reason we couldn't > further upgrade this advice? It might be better to rephrase the whole thing and eliminate the thing = about a default. X9.62 has been revised in 2005. This newer version does = mention the SHA-2 family in addition to SHA-1, so I don=E2=80=99t know = it that is in any sense of the word still =E2=80=9Cthe default=E2=80=9D. = I=E2=80=99d look it up, but as an ANSI standard, it=E2=80=99s behind a = paywall. We might just say: OLD All ECDSA computations MUST be performed according to ANSI X9.62 or its successors. Data to be signed/verified is hashed, and the result run directly through the ECDSA algorithm with no additional hashing. The default hash function is SHA-1 [FIPS.180-2 = ]= , and sha_size (see Section 5.4 = = and Section 5.8 = ) = is 20. However, an alternative hash function, such as one of the new SHA hash functions specified in FIPS 180-2 [FIPS.180-2 = ]= , SHOULD be used instead. NEW All ECDSA computations MUST be performed according to ANSI X9.62 or its successors. Data to be signed/verified is hashed, and the result run directly through the ECDSA algorithm with no additional hashing. A secure hash function such as the SHA-256, SHA-384, and SHA-512 [FIPS.180-4] MUST be used. --Apple-Mail=_3BED1944-9638-4BAC-B9F9-6CB814DB43CD Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On 14 Mar 2017, at 23:29, Martin Thomson <martin.thomson@gmail.com> wrote:

On = 15 March 2017 at 08:26, Yoav Nir <ynir.ietf@gmail.com>= wrote:
That is the = document that was referenced by RFC 4492 and it=E2=80=99s from 1998. = It
doesn=E2=80=99t mention any hash function other than = SHA-1.

RFC 4492 said that other hash = functions may be used. We=E2=80=99ve upgraded it to a
SHOULD.

In light of = recent developments, is there any reason we couldn't
further= upgrade this advice?

It might be better to rephrase the whole = thing and eliminate the thing about a default. X9.62 has been revised in = 2005. This newer version does mention the SHA-2 family in addition to = SHA-1, so I don=E2=80=99t know it that is in any sense of the word still = =E2=80=9Cthe default=E2=80=9D. I=E2=80=99d look it up, but as an ANSI = standard, it=E2=80=99s behind a paywall.

We might just say:

OLD
   All ECDSA computations MUST be performed =
according to ANSI X9.62 or
   its successors.  Data to be signed/verified is hashed, and the result
   run directly through the ECDSA algorithm with no additional =
hashing.
   The default hash =
function is SHA-1 [FIPS.180-2], and sha_size (see
   Section 5.4 and Section 5.8) is 20.  However, an alternative hash
   function, such as one of the new SHA hash functions specified in FIPS
   180-2 [FIPS.180-2], SHOULD be used instead.

NEW
   All ECDSA computations MUST be performed according to ANSI =
X9.62 or
   its successors.  Data to be signed/verified is hashed, and the result
   run directly through the ECDSA algorithm with no additional =
hashing.
   A secure hash function such as the SHA-256, SHA-384, and =
SHA-512 
   [FIPS.180-4] MUST be =
used.


= --Apple-Mail=_3BED1944-9638-4BAC-B9F9-6CB814DB43CD-- --Apple-Mail=_1D62CD8F-1DBC-4FA1-9063-009EE56330F2 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYyGknAAoJELhJCxUKWMyZGKEH/RGZEe2WqrwSFkB3eztvNFxQ Dzoz31lCRxjCdOAF3t8tGT1VpRNqNNVjhOFxrz4SNRSMV13Nm/4OxfWRj5aVfiIS xtYWxzg8oBCY5Tkk3BJTOrbRko6Mj8UwIwNJeDmcUjBQe9hRuWINCXBqVxIU50Oh wOy6w2oPLtAHSv1we+g1NA/2qROPNvGDxNV6cVn+GMiXQXiMD1bK7SMSJFXbxB74 vXmpmMRJ1ZTLEnJtLy5LnT9qr3j0x/eksLsSyfBBHib2/MI5Zb5Q+kjbi7DukLtt PvQPNcp22zLv8SDKscCKUg5uJElLdIJxawyVHFkEBTXGbjPBk4dg2YhfggMgias= =ujNb -----END PGP SIGNATURE----- --Apple-Mail=_1D62CD8F-1DBC-4FA1-9063-009EE56330F2-- From nobody Tue Mar 14 15:57:58 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EAF7A129440; Tue, 14 Mar 2017 15:57:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.8 X-Spam-Level: X-Spam-Status: No, score=-0.8 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hjcV4zR4FPJQ; Tue, 14 Mar 2017 15:57:55 -0700 (PDT) Received: from mail-qk0-x233.google.com (mail-qk0-x233.google.com [IPv6:2607:f8b0:400d:c09::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AB52E129B4C; Tue, 14 Mar 2017 15:57:55 -0700 (PDT) Received: by mail-qk0-x233.google.com with SMTP id 1so478966qkl.3; Tue, 14 Mar 2017 15:57:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=MxStJF5glb5NTx43eDputsY2G6wFL9t129+wOzFRkPw=; b=Q9+Ts1X25gzpxDbD+yFkpWcbS1jpJ+j5z9VaShS42ijv3mqS0W2/yq0r8tal9Xx4zP RyvUiBzMPp6QD1nUJjgUZPl+L1mXOh3n1nsKgIlwgTNVLRUUPnUcVQlJIUp3KC8funcy K9VrZvJ/qO4pxQxvkmb/vgaIf5ZkiNgNVYEglUIDro+FVE4jYzdLf1Zu6XQgz73DuYa2 y1goGm1zWYVt5Cc6fD2dLX55S8tb9UoKCwu5FI1JwtV9BFgENbt4y87AENXneOZ/FZet +Q98Vry4KdJOM9mI7Ypssuw1NODV0w3xabWx3y691ZT7bX35r+hPjS0D61k80AARCxzy XZ3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=MxStJF5glb5NTx43eDputsY2G6wFL9t129+wOzFRkPw=; b=cWEfXSaKp4YSXMs99z6mO7I9yjujbNLuXbH+OEfCICmc1L33SaG5QjDIjdC0zwtY/n ZjryamkwJoiA/AZxvCpvmqaQl+TSG+vnuQSM+Sv1PC+BDnIdbV0GHIQdWkVLBoAs6w6L 0sM/5EKigUkXpMU6XeiUzJgcMXhl8KSYbAYOmIlOaMtXseEq7e45vgbXthiK9Qw4UUd6 d1igmcnnfK/3vkX+Tejx8QbMCIe2tL8sB2tUEElaudCHQzlx6vHUwOjErghOugi8KSgD NmxVpNOYvR0ic2oKXsUnZWeLegc08wsmpOXa3BhTl5q4qiHKbrmw5xZFM3v1vZKSEuj8 k3Zg== X-Gm-Message-State: AFeK/H28CDuhdmCO6TKRZTJVW0mMZUrFJOfnBc/Qb0VwJPpOo/wurP+lY8plGuJDL+OtwQ6Qs0isCiGRxE6T1Q== X-Received: by 10.55.18.144 with SMTP id 16mr105993qks.5.1489532274920; Tue, 14 Mar 2017 15:57:54 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Tue, 14 Mar 2017 15:57:54 -0700 (PDT) In-Reply-To: <897DE78D-E918-415C-8716-9C0EA637274F@gmail.com> References: <148952402426.24274.4020884632180640309.idtracker@ietfa.amsl.com> <26D48307-948B-4CBE-AD4A-7C53D70BF8F0@gmail.com> <897DE78D-E918-415C-8716-9C0EA637274F@gmail.com> From: Martin Thomson Date: Wed, 15 Mar 2017 09:57:54 +1100 Message-ID: To: Yoav Nir Cc: Kathleen Moriarty , "tls@ietf.org" , tls-chairs , The IESG , draft-ietf-tls-rfc4492bis@ietf.org Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] Kathleen Moriarty's Yes on draft-ietf-tls-rfc4492bis-15: (with COMMENT) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Mar 2017 22:57:57 -0000 On 15 March 2017 at 09:05, Yoav Nir wrote: > A secure hash function such as the SHA-256, SHA-384, and SHA-512 > > [FIPS.180-4] MUST be used. SGTM From nobody Tue Mar 14 17:08:33 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9442129BF6; Tue, 14 Mar 2017 17:08:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9_ShkWfJcTLO; Tue, 14 Mar 2017 17:08:23 -0700 (PDT) Received: from mail-qt0-x234.google.com (mail-qt0-x234.google.com [IPv6:2607:f8b0:400d:c0d::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 856791293E3; Tue, 14 Mar 2017 17:08:23 -0700 (PDT) Received: by mail-qt0-x234.google.com with SMTP id n21so1377681qta.1; Tue, 14 Mar 2017 17:08:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=EdO+2ivmBtPueWJQPnmVWszsEjw577zeGYYHVsoO3lc=; b=DQkLbLzlxH4kfKB++zpj0diyECH8iw+iWfIbw0qj98Xa+lAmAS8yOToLbOFJHKxqYE jis6HN3oQNc0IDYN5TQhOw/TTDw9PfXqPGL2GirWmB4qsdutHdZdtyqyU4ZsZUddZ/Yi L+lVVD7lUrwMVzMvCa4/COSS/Ds2P62ATTiwmgbqBkeE5zGsqDxLGO9/GLETUW4hk/K3 8Oy1Ndf9hsGNmXnP4/xAjjNTxhi0zLCl361u3lM+Nh2pt8XhrmH4E5iHSueLd977QPwe zfhzUNPuuL++0oKx5BQhXfNDFxgaCgeiflWvvgWPcqOUzzXToCnbq/DfsT1XntJ94hBJ FADg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=EdO+2ivmBtPueWJQPnmVWszsEjw577zeGYYHVsoO3lc=; b=k+1WTlnyTlk6Qc/F2jvBri46zRrhBCM4y7jHL0EMwLiNZpgu0koExZX04gDLaTfrlA jiJDzKlsjjFpBwY40pbF2npuTbMdmyZWr7vV9ILkOKf2yNFOJFaywW8jd0KiJ2s1EtgL 6EJMB/gkyceoFI9tC/AY/g7AzYEpfSMW7rn2r16PsPSMhdOvXZ7OB8yGvNy269Fj8HBJ n9oi3e6CJiPOVnARi+/Rn03nkX1wUdAlxLFAv+dDY8hvWebkNvXNOD/tioVcacSQ6QBh orE4qrgcM2w9olXYPSa0IQgkJa6oVU95SCDc3D2Vw6lCAHsNtuGBSGJLMOcrx040UDqX /cUA== X-Gm-Message-State: AFeK/H1haO70a0SkNvZoE4ZgettdV5KruExHiH/BOA1T5JRrWoLrQTb3JHoVCnzY23rqDg== X-Received: by 10.200.44.36 with SMTP id d33mr379117qta.198.1489536502716; Tue, 14 Mar 2017 17:08:22 -0700 (PDT) Received: from [10.132.111.189] (mobile-166-172-062-104.mycingular.net. [166.172.62.104]) by smtp.gmail.com with ESMTPSA id k65sm168317qkf.18.2017.03.14.17.08.21 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 14 Mar 2017 17:08:21 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: kathleen.moriarty.ietf@gmail.com X-Mailer: iPhone Mail (14D27) In-Reply-To: Date: Tue, 14 Mar 2017 20:08:21 -0400 Cc: Yoav Nir , "tls@ietf.org" , tls-chairs , The IESG , draft-ietf-tls-rfc4492bis@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <148952402426.24274.4020884632180640309.idtracker@ietfa.amsl.com> <26D48307-948B-4CBE-AD4A-7C53D70BF8F0@gmail.com> <897DE78D-E918-415C-8716-9C0EA637274F@gmail.com> To: Martin Thomson Archived-At: Subject: Re: [TLS] Kathleen Moriarty's Yes on draft-ietf-tls-rfc4492bis-15: (with COMMENT) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 00:08:25 -0000 Please excuse typos, sent from handheld device=20 > On Mar 14, 2017, at 6:57 PM, Martin Thomson wro= te: >=20 >> On 15 March 2017 at 09:05, Yoav Nir wrote: >> A secure hash function such as the SHA-256, SHA-384, and SHA-512 >>=20 >> [FIPS.180-4] MUST be used. >=20 > SGTM The new text is much better, thank you!= From nobody Tue Mar 14 18:07:48 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA24E13177F for ; Tue, 14 Mar 2017 18:07:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qNZcohwDIr9c for ; Tue, 14 Mar 2017 18:07:42 -0700 (PDT) Received: from mail-qt0-x22e.google.com (mail-qt0-x22e.google.com [IPv6:2607:f8b0:400d:c0d::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7361E129468 for ; Tue, 14 Mar 2017 18:07:40 -0700 (PDT) Received: by mail-qt0-x22e.google.com with SMTP id x35so2065856qtc.2 for ; Tue, 14 Mar 2017 18:07:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=B0JhuLqvSZnzVloalTkRylPT7AFRILN5s91LU9FCrQM=; b=NpezJ5xuY/s7UhsJirluqf0aWLXJHW/EpoFHxeoPXb0u36va6NDXWgADDdOG5afce9 IqbK08t8YDRGm3V791qQo04+ecAKfRR8XKp5UsDZKRrqhUQqR/rfPNqLnkuIHOc+moYA XXr+pjvDkGd/xbif5IAg95IZdO/PTfFB7tBxk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=B0JhuLqvSZnzVloalTkRylPT7AFRILN5s91LU9FCrQM=; b=Fs8XHg9c6WuyeC1J253yzr2QsVyoVbb2jlxDQYYt13yismwCtpNYKKFTS2kC2cB6+Q SQFmnWlXUz3KCYat94SboImk8Ss8e5HvEmhumqHQRysFih7TocoQxfeICp1I7tdh5Sbd /5rRCv9WwZmelaGvKDTOPVn+erzRr6i1gtZ/oa9z1bvsH+1Gxf0z6ZacsxOt9s9gUi6b /Ov6Slw1cQ2uhzYUOHU5Bhb7fSb9fw/NELDlrIYzS6H9q5KW/uON3rkDOSDJJfCvA+Rc gG1W59bsOJwcscTpEwCqxeMPhctz/EghR6mdcCBCqIAtNcMg4rzP4a5bDmz94IMWuMGe JaSg== X-Gm-Message-State: AFeK/H1jA0xbSKxOsx05hPP/PwlVOUoY/7qVhUcxGfO8kBYB9l/d6IpSaGMgDro/Z9lXog== X-Received: by 10.200.51.84 with SMTP id u20mr540767qta.133.1489540059646; Tue, 14 Mar 2017 18:07:39 -0700 (PDT) Received: from [172.16.0.18] ([96.231.228.203]) by smtp.gmail.com with ESMTPSA id q123sm235452qkb.63.2017.03.14.18.07.38 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 14 Mar 2017 18:07:38 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Sean Turner In-Reply-To: Date: Tue, 14 Mar 2017 21:07:37 -0400 Cc: Yoav Nir , "tls@ietf.org" , tls-chairs , The IESG , draft-ietf-tls-rfc4492bis@ietf.org, Martin Thomson Content-Transfer-Encoding: 7bit Message-Id: <27C0A71F-98C9-4003-994D-BF9A16319C16@sn3rd.com> References: <148952402426.24274.4020884632180640309.idtracker@ietfa.amsl.com> <26D48307-948B-4CBE-AD4A-7C53D70BF8F0@gmail.com> <897DE78D-E918-415C-8716-9C0EA637274F@gmail.com> To: Kathleen Moriarty X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Kathleen Moriarty's Yes on draft-ietf-tls-rfc4492bis-15: (with COMMENT) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 01:07:43 -0000 > On Mar 14, 2017, at 18:57, Martin Thomson wrote: > > On 15 March 2017 at 09:05, Yoav Nir wrote: >> A secure hash function such as the SHA-256, SHA-384, and SHA-512 >> >> [FIPS.180-4] MUST be used. > > SGTM +1 spt From nobody Tue Mar 14 23:41:27 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 03F7412957D; Tue, 14 Mar 2017 23:41:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s3ZsCq7mRq6D; Tue, 14 Mar 2017 23:41:24 -0700 (PDT) Received: from mail-wr0-x242.google.com (mail-wr0-x242.google.com [IPv6:2a00:1450:400c:c0c::242]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 126DD12956D; Tue, 14 Mar 2017 23:41:24 -0700 (PDT) Received: by mail-wr0-x242.google.com with SMTP id u48so812818wrc.1; Tue, 14 Mar 2017 23:41:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=qQ7R9z/ltVmAoEWExpgobEc7gtzE34DKTQQdELgjNuQ=; b=iDB7c5defLC7JeTTUDy0m2H7ws9aHEkjLSZdUrlVaMQZpF+c/zsoQdbb9nPjsgRyHv CnFvbfSBGqfBX4PdrwygMmm7zIhMcw5guLh40wmVY2C46AfUmMOhraUPG864CpORVONY s/5PIFj5oR6YwPJjHKyjW4NCVtTs/xUv7V8Jw83VAYJ177p1Mmw6f34Y1io2zF948nmX 5Oai2ywAyt6n/fptzZUvjnieEOEdEEzjlveKfHMWsg1N5bgr+BLiWHzNTovDL7/vTrcV 50SJQ9RNGkN1ogMSe0CS0lIoilSV1EkMO4/wHN4jT9/5O25dOzusuVtbb0H+LyoWyeZn bICQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=qQ7R9z/ltVmAoEWExpgobEc7gtzE34DKTQQdELgjNuQ=; b=q52ryXrIBrDNUbFhg2Uztn/T9FXrr7RMMYN5EoAlf2d7jehY+IinQ7Q4+UWXL87VMI WFOHl1LwJe4/8+55QKFXP8UM4eAEcRlwzB5mjBcIdWtX+qO5eW3yzNyvGZIZV/BpJjhP DDCEYR+xMnv/uD2ywDjqdK+eqGQzjLPnGBRHrK0Sjc5GGssPBZRMFi8pa5YRREr0XSyH Il7djLhnZpaANwoWM/xKN+cBv0z3m6aWgrm1rifXALSwBLD0cPPNPBk8GgcV5rQ0DewO bjgxBV+8WPZ4wYGKy1K5rcu1P5D/M7RUIIv0etRxSwzzIPzGPamPpKb9mP1EWLCAUfx9 TxKg== X-Gm-Message-State: AFeK/H1mx5bqM3Yyyu7M+mzaq25Y5d5QBZOFRd5HRwt50LQjfAyOnm+ZHYiwdogSevd52Q== X-Received: by 10.223.134.157 with SMTP id 29mr1288263wrx.33.1489560082642; Tue, 14 Mar 2017 23:41:22 -0700 (PDT) Received: from [192.168.137.86] ([109.253.147.134]) by smtp.gmail.com with ESMTPSA id x1sm1062775wrd.63.2017.03.14.23.41.20 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 14 Mar 2017 23:41:21 -0700 (PDT) From: Yoav Nir Message-Id: <20BC9135-7422-40E2-AE12-8CE1DE646224@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_A44306F5-4973-4C36-AE3F-0BA9E14EB38B"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Wed, 15 Mar 2017 08:41:16 +0200 In-Reply-To: <27C0A71F-98C9-4003-994D-BF9A16319C16@sn3rd.com> Cc: Kathleen Moriarty , "tls@ietf.org" , tls-chairs , The IESG , draft-ietf-tls-rfc4492bis@ietf.org, Martin Thomson To: Sean Turner References: <148952402426.24274.4020884632180640309.idtracker@ietfa.amsl.com> <26D48307-948B-4CBE-AD4A-7C53D70BF8F0@gmail.com> <897DE78D-E918-415C-8716-9C0EA637274F@gmail.com> <27C0A71F-98C9-4003-994D-BF9A16319C16@sn3rd.com> X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Kathleen Moriarty's Yes on draft-ietf-tls-rfc4492bis-15: (with COMMENT) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 06:41:26 -0000 --Apple-Mail=_A44306F5-4973-4C36-AE3F-0BA9E14EB38B Content-Type: multipart/alternative; boundary="Apple-Mail=_E18D64E3-F582-4C20-9D4B-4D410D404BEA" --Apple-Mail=_E18D64E3-F582-4C20-9D4B-4D410D404BEA Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On 15 Mar 2017, at 3:07, Sean Turner wrote: >=20 >=20 >> On Mar 14, 2017, at 18:57, Martin Thomson = wrote: >>=20 >> On 15 March 2017 at 09:05, Yoav Nir wrote: >>> A secure hash function such as the SHA-256, SHA-384, and SHA-512 >>>=20 >>> [FIPS.180-4] MUST be used. >>=20 >> SGTM >=20 > +1 >=20 > spt And now it is in PR form: https://github.com/tlswg/rfc4492bis/pull/35 = --Apple-Mail=_E18D64E3-F582-4C20-9D4B-4D410D404BEA Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii
On 15 Mar 2017, at 3:07, Sean Turner <sean@sn3rd.com> = wrote:


On Mar = 14, 2017, at 18:57, Martin Thomson <martin.thomson@gmail.com> wrote:

On 15 March 2017 at 09:05, Yoav Nir <ynir.ietf@gmail.com>= wrote:
 A = secure hash function such as the SHA-256, SHA-384, and SHA-512

 [FIPS.180-4] MUST be used.

SGTM
+1

spt


And now it is in PR = form:

https://github.com/tlswg/rfc4492bis/pull/35

= --Apple-Mail=_E18D64E3-F582-4C20-9D4B-4D410D404BEA-- --Apple-Mail=_A44306F5-4973-4C36-AE3F-0BA9E14EB38B Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYyOINAAoJELhJCxUKWMyZhfsIAMpIJ3x1C+aBd5mum7MSULO6 vZ8jJqK6Q06fWjSDHNwDFbFYLDAT9UHmZRoNl7a9R78qMfaLT2OLQBY0ZpquWefX v59pkWTBlptQmlOxofQ6EcvJRL2E/j698O/3L068yNuUEPok8M1+PVcowZS4DYP+ OpSA/FOGLoQDuIMbBiLNxOKZZKc3YzDmUy8BRAuFbTf7YJhrJCMoKxiOYXO6r38g MyR8TEk5vzcPOmzxS4Rv5yrNCdO6qSgebj4imvgraPNuuxFr17rGidNP/YCiD+WG QRTokKN+IXeCvkpL2hivN6R1XyUl4qp/yXD877jah+je3axfv2s9w7wsw4qs+2I= =5lyH -----END PGP SIGNATURE----- --Apple-Mail=_A44306F5-4973-4C36-AE3F-0BA9E14EB38B-- From nobody Wed Mar 15 07:53:46 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 497111315BD for ; Wed, 15 Mar 2017 07:53:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ogcbfVc1cUIG for ; Wed, 15 Mar 2017 07:53:43 -0700 (PDT) Received: from mail-yw0-x229.google.com (mail-yw0-x229.google.com [IPv6:2607:f8b0:4002:c05::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 55CD11315AE for ; Wed, 15 Mar 2017 07:45:33 -0700 (PDT) Received: by mail-yw0-x229.google.com with SMTP id v198so11882449ywc.2 for ; Wed, 15 Mar 2017 07:45:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=/7A60iwNzjyP1SfygigRcpN3UdmOyIjAu+SE7x+eO7c=; b=wkX19lQhb3LKQhCOFgz3z4jxDOPJpg4khHm+gvYiHL74bJfO91UPatl7JJZGAQgDKU MqYCSQtmPbLL5BhjTXbISrnvqxW4/4j52XR/CFpd3LywIPTLAwnI3VpS6HmMJN3LED5w PTTXL7pawQj37Oq/5AMAA9YfozaE5MQvYrwUqUIK1Or5v7g6pTVNKNH7Bu/x0ZkH+SXf T234WhbTyu4kIWU3QaLzPE6BWr9isZwnoHGVWT8lZW6NEQbZ2i7y3OXm3WXV+pw/JDtL b1mfcxUdfPsRsIWowCqRRaz0YTRTLhco03z33ynBkJk2THLOSh2QOkkAnKhKVfKJLpgj TYlw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=/7A60iwNzjyP1SfygigRcpN3UdmOyIjAu+SE7x+eO7c=; b=OdUm163XGXJoO2fcDleca3r/QruHrbfUx+LrkfEHIXKanW+ysrvrFoXdFzw9rQ4QWs kBVWF5QJ79jkg41ZzIq/f0cyDOwHMM55NmatmtuxnDI1TAiOR+X6QasiAAaxHcQwdT/t Y8ysv5TBqOWNzJ3/xIucCYaftQrJC7g+wRRsWzjNVjmqVrOaxz2NAJEjh1e//Kbr2+gt 2Qk2JE3ucXZBtHMopFL1jMEbzgbunfnB3ovYTj+jZ9olyQbLKnfWuoGXXqxgDdO0FmES ePnBkBFPR1cGWf03hoooZSw1a2gB5QME3tJvk/+yoTkfuP4VKHgJrDWrZtEMRpWQXCVB mzGg== X-Gm-Message-State: AFeK/H1M3Z1YWOSErRloAw+VVPyll4WuVXQA4TtyRcAtdZiDHJLdegHMSU6XbRzQ9fPoqnr5Qg/8LEtZ1HeOfg== X-Received: by 10.129.125.5 with SMTP id y5mr2739066ywc.120.1489589132151; Wed, 15 Mar 2017 07:45:32 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Wed, 15 Mar 2017 07:44:51 -0700 (PDT) From: Eric Rescorla Date: Wed, 15 Mar 2017 07:44:51 -0700 Message-ID: To: "tls@ietf.org" , IESG Content-Type: multipart/alternative; boundary=001a1149364415722a054ac5ffb9 Archived-At: Subject: [TLS] Review of draft-ietf-tls-rfc4492bis-15 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 14:53:45 -0000 --001a1149364415722a054ac5ffb9 Content-Type: text/plain; charset=UTF-8 Sorry for the late review of this document. I just got to it this week. I'm sending this as comments rather than issues/PR due to how late it is in the proces. I have two high-level comments: - This document seems to still have a bunch of material about static DH (especially static DH authentication). I thought we had agreed to remove that. - You are inconsistent about using capital 2119 language and I expect you want to be consistent. DETAILED S 2. All of these key exchange algorithms provide forward secrecy. This is actually only true if each side generates fresh ephemerals which does not seem to be required by the spec. Do we really want to promote ECDH_anon to standards track? Nit: you want a line break between the last line of Figure 1 and the legend explaining the message types. S 2.3. This specification does not impose restrictions on signature schemes used anywhere in the certificate chain. The previous version of this document required the signatures to match, but this restriction, originating in previous TLS versions is lifted here as it had been in RFC 5246. This section is about ECDH_anon, so maybe this text belongs in S 2.1 or 2.2.? S 3. You have a bunch of lower case 2119 key words here. If these conditions are not met, the client should send a client Certificate message containing no certificates. In this case, the ClientKeyExchange should be sent as described in Section 2, and the CertificateVerify should not be sent. If the server requires client authentication, it may respond with a fatal handshake failure alert. Actually, this "should not be sent" is a MUST NOT, because if you send an empty certificate, you're forbidden to send CertificateVerify. S 4. choice of curves and compression techniques specified by the client. s/compression techniques/point formats/? S 5.1.1. Do you want to rename elliptic_curve_list to named_curve_list? S 5.1.2. Three point formats were included in the definition of ECPointFormat above. This specification deprecates all but the uncompressed point format. Implementations of this document MUST support the uncompressed format for all of their supported curves, and MUST NOT support other formats for curves defined in this specification. For backwards compatibility purposes, the point format list extension MUST still be included, and contain exactly one value: the uncompressed point format (0). This implies that you have to send supported point formats, but in S 5.1, this is a SHOULD. I believe what you may be trying to say here is that if you send the extension, it must be non-empty. Also, maybe I'm missing it, but where do you say that the default is to assume that the other side supports uncompressed if it doesn't do so. This is a backwards compat issue. S 5.3. You don't define what "authorized for signatures" is, but I suspect you're talking about KeyUsage, etc.? If so, don't you need to say this about ECDHE_ECDSA as well. S 5.4. The value named_curve indicates that a named curve is used. This option SHOULD be used when applicable. When would you not? S 5.5. This defines: rsa_fixed_ecdh(65), ecdsa_fixed_ecdh(66), But the specification doesn't actually support this. Note that the fixed_DH authentication mechanism are specified as having the client's cert be on the same curve as the long-term ECDH key, but you've deprecated those KE mechanisms, so as far as I can tell, static DH auth is impossible Also: 1. Why isn't the ECDSA cert required to be signing capable. 2. You probably should standardize on ECDSA_sign or ecdsa_sign. S 5.7. More text about static DH auth. Also "implicit" can probably go away. The client selects an ephemeral ECDH public key corresponding to the parameters it received from the server according to the ECKAS-DH1 scheme from IEEE 1363. It conveys this information to the client in the ClientKeyExchange message using the format defined above. I don't understand what this means. S 5.8. This message is sent when the client sends a client certificate containing a public key usable for digital signatures, e.g., when the client is authenticated using the ECDSA_sign mechanism. This is the only way that things can work now. S 5.1.1. Failing to do so allows attackers to gain information about the private key, to the point that they may recover the entire private key in a few requests, if that key is not really ephemeral. To the best of my knowledge, this only applies to DH, not signature verification. S 6. Do we really want to promote NULL and 3DES to ST? -Ekr --001a1149364415722a054ac5ffb9 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Sorry for the late review of this document. I just go= t to it this
week. I'm sending this as comments rather than i= ssues/PR due to
how late it is in the proces.

I have two high-level comments:

- This docum= ent seems to still have a bunch of material about
=C2=A0 static D= H (especially static DH authentication). I thought we
=C2=A0 had = agreed to remove that.

- You are inconsistent abou= t using capital 2119 language
=C2=A0 and I expect you want to be = consistent.


DETAILED
S 2.=
=C2=A0 =C2=A0All of these key exchange algorithms provide forwar= d secrecy.

This is actually only true if each side= generates fresh ephemerals
which does not seem to be required by= the spec.

Do we really want to promote ECDH_anon = to standards track?


Nit: you want a= line break between the last line of Figure 1
and the legend expl= aining the message types.


S 2.3.
=C2=A0 =C2=A0This specification does not impose restrictions on sig= nature schemes
=C2=A0 =C2=A0used anywhere in the certificate chai= n.=C2=A0 The previous version of this
=C2=A0 =C2=A0document requi= red the signatures to match, but this restriction,
=C2=A0 =C2=A0o= riginating in previous TLS versions is lifted here as it had been in
<= div>=C2=A0 =C2=A0RFC 5246.

This section is about E= CDH_anon, so maybe this text belongs in S 2.1 or 2.2.?

=

S 3.
You have a bunch of lower case 2119 key = words here.

=C2=A0 =C2=A0If these conditions are n= ot met, the client should send a client
=C2=A0 =C2=A0Certificate = message containing no certificates.=C2=A0 In this case, the
=C2= =A0 =C2=A0ClientKeyExchange should be sent as described in Section 2, and t= he
=C2=A0 =C2=A0CertificateVerify should not be sent.=C2=A0 If th= e server requires client
=C2=A0 =C2=A0authentication, it may resp= ond with a fatal handshake failure alert.

Actually= , this "should not be sent" is a MUST NOT, because if you send
an empty certificate, you're forbidden to send CertificateVerif= y.


S 4.
=C2=A0 =C2=A0choi= ce of curves and compression techniques specified by the client.
=
s/compression techniques/point formats/?


S 5.1.1.
Do you want to rename elliptic_curv= e_list to named_curve_list?


S 5.1.2= .

=C2=A0 =C2=A0Three point formats were included i= n the definition of ECPointFormat
=C2=A0 =C2=A0above.=C2=A0 This = specification deprecates all but the uncompressed point
=C2=A0 = =C2=A0format.=C2=A0 Implementations of this document MUST support the
=
=C2=A0 =C2=A0uncompressed format for all of their supported curves, an= d MUST NOT
=C2=A0 =C2=A0support other formats for curves defined = in this specification.=C2=A0 For
=C2=A0 =C2=A0backwards compatibi= lity purposes, the point format list extension
=C2=A0 =C2=A0MUST = still be included, and contain exactly one value: the
=C2=A0 =C2= =A0uncompressed point format (0).

This implies tha= t you have to send supported point formats, but in
S 5.1, this is= a SHOULD. I believe what you may be trying to say
here is that i= f you send the extension, it must be non-empty.

Al= so, maybe I'm missing it, but where do you say that the default
is to assume that the other side supports uncompressed if it doesn't=
do so. This is a backwards compat issue.


S 5.3.
You don't define what "authorize= d for signatures" is, but I suspect
you're talking about= KeyUsage, etc.? If so, don't you need to say
this about ECDH= E_ECDSA as well.

S 5.4.
=C2=A0 =C2=A0The= value named_curve indicates that a named curve is used.=C2=A0 This
=C2=A0 =C2=A0option SHOULD be used when applicable.

=
When would you not?

S 5.5.
This def= ines:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0rsa_fixed_e= cdh(65),
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ecdsa_fi= xed_ecdh(66),

But the specification doesn't ac= tually support this. Note that
the fixed_DH authentication mechan= ism are specified as having
the client's cert be on the same = curve as the long-term
ECDH key, but you've deprecated those = KE mechanisms, so as far
as I can tell, static DH auth is impossi= ble

Also:
1. Why isn't the ECDSA cer= t required to be signing capable.
2. You probably should standard= ize on ECDSA_sign or ecdsa_sign.

S 5.7.
= More text about static DH auth. Also "implicit" can probably go a= way.

=C2=A0 =C2=A0The client selects an ephemeral = ECDH public key corresponding to the
=C2=A0 =C2=A0parameters it r= eceived from the server according to the ECKAS-DH1
=C2=A0 =C2=A0s= cheme from IEEE 1363.=C2=A0 It conveys this information to the client in
=C2=A0 =C2=A0the ClientKeyExchange message using the format defined= above.

I don't understand what this means.


S 5.8.
=C2=A0 =C2=A0This me= ssage is sent when the client sends a client certificate
=C2=A0 = =C2=A0containing a public key usable for digital signatures, e.g., when the=
=C2=A0 =C2=A0client is authenticated using the ECDSA_sign mechan= ism.

This is the only way that things can work now= .


S 5.1.1.
=C2=A0 =C2=A0F= ailing to
=C2=A0 =C2=A0do so allows attackers to gain information= about the private key, to
=C2=A0 =C2=A0the point that they may r= ecover the entire private key in a few
=C2=A0 =C2=A0requests, if = that key is not really ephemeral.

To the best of m= y knowledge, this only applies to DH, not signature
verification.=

S 6.
Do we really want to promote NULL = and 3DES to ST?

-Ekr

--001a1149364415722a054ac5ffb9-- From nobody Wed Mar 15 08:07:18 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96D1313162B; Wed, 15 Mar 2017 08:07:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B30DIquWdn_W; Wed, 15 Mar 2017 08:07:14 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC2B1131610; Wed, 15 Mar 2017 08:07:14 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id CBDEDBE39; Wed, 15 Mar 2017 15:07:11 +0000 (GMT) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HeqYeGQwofr9; Wed, 15 Mar 2017 15:07:11 +0000 (GMT) Received: from [134.226.36.93] (bilbo.dsg.cs.tcd.ie [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 23197BE2F; Wed, 15 Mar 2017 15:07:11 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1489590431; bh=mqArW1VZZEcI9N3Gtu4nN3hDaNMjjkKNHGk/GTaPR10=; h=Subject:To:References:From:Date:In-Reply-To:From; b=MLqkDSJqk6bNm82K7LzmjEb5MvOClMNddPFTlvpJsOimj54L7shH4ox5PEIHTj6TA J6m3EGj/I7eKqYB6u8Y+I9/oXExdxUbHOFraUuWBIJ5A80BXYGLoN3K6tHBZEt9RY9 q7j8mlcSK94cdGxMeLsrlzJat2TpG95Lk/bP+COA= To: Eric Rescorla , "tls@ietf.org" , IESG References: From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: <77ef8038-32ae-affa-341e-b104fc28a343@cs.tcd.ie> Date: Wed, 15 Mar 2017 15:07:10 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="dpWIsnh6UuieFkbNcQX2eMpxDDL0vff1I" Archived-At: Subject: Re: [TLS] Review of draft-ietf-tls-rfc4492bis-15 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 15:07:18 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --dpWIsnh6UuieFkbNcQX2eMpxDDL0vff1I Content-Type: multipart/mixed; boundary="TpxNfDSOsF7w0PqmM1KuwFto38leDEGOF"; protected-headers="v1" From: Stephen Farrell To: Eric Rescorla , "tls@ietf.org" , IESG Message-ID: <77ef8038-32ae-affa-341e-b104fc28a343@cs.tcd.ie> Subject: Re: [TLS] Review of draft-ietf-tls-rfc4492bis-15 References: In-Reply-To: --TpxNfDSOsF7w0PqmM1KuwFto38leDEGOF Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Thanks Eric, Let's see what folks say in response to this and I can post anything not immediately resolved as a DISCUSS ballot. We can then process that in the coming week or two, and you can take over the DISCUSS for whatever's not resolved by the swap-over in Chicago. Or if someone else wants to make some or all of Eric's comments a DISCUSS that'd work too, but I'm fine with taking it. Cheers, S. On 15/03/17 14:44, Eric Rescorla wrote: > Sorry for the late review of this document. I just got to it this > week. I'm sending this as comments rather than issues/PR due to > how late it is in the proces. >=20 > I have two high-level comments: >=20 > - This document seems to still have a bunch of material about > static DH (especially static DH authentication). I thought we > had agreed to remove that. >=20 > - You are inconsistent about using capital 2119 language > and I expect you want to be consistent. >=20 >=20 > DETAILED > S 2. > All of these key exchange algorithms provide forward secrecy. >=20 > This is actually only true if each side generates fresh ephemerals > which does not seem to be required by the spec. >=20 > Do we really want to promote ECDH_anon to standards track? >=20 >=20 > Nit: you want a line break between the last line of Figure 1 > and the legend explaining the message types. >=20 >=20 > S 2.3. > This specification does not impose restrictions on signature schemes= > used anywhere in the certificate chain. The previous version of thi= s > document required the signatures to match, but this restriction, > originating in previous TLS versions is lifted here as it had been i= n > RFC 5246. >=20 > This section is about ECDH_anon, so maybe this text belongs in S 2.1 or= > 2.2.? >=20 >=20 > S 3. > You have a bunch of lower case 2119 key words here. >=20 > If these conditions are not met, the client should send a client > Certificate message containing no certificates. In this case, the > ClientKeyExchange should be sent as described in Section 2, and the > CertificateVerify should not be sent. If the server requires client= > authentication, it may respond with a fatal handshake failure alert.= >=20 > Actually, this "should not be sent" is a MUST NOT, because if you send > an empty certificate, you're forbidden to send CertificateVerify. >=20 >=20 > S 4. > choice of curves and compression techniques specified by the client.= >=20 > s/compression techniques/point formats/? >=20 >=20 > S 5.1.1. > Do you want to rename elliptic_curve_list to named_curve_list? >=20 >=20 > S 5.1.2. >=20 > Three point formats were included in the definition of ECPointFormat= > above. This specification deprecates all but the uncompressed point= > format. Implementations of this document MUST support the > uncompressed format for all of their supported curves, and MUST NOT > support other formats for curves defined in this specification. For= > backwards compatibility purposes, the point format list extension > MUST still be included, and contain exactly one value: the > uncompressed point format (0). >=20 > This implies that you have to send supported point formats, but in > S 5.1, this is a SHOULD. I believe what you may be trying to say > here is that if you send the extension, it must be non-empty. >=20 > Also, maybe I'm missing it, but where do you say that the default > is to assume that the other side supports uncompressed if it doesn't > do so. This is a backwards compat issue. >=20 >=20 > S 5.3. > You don't define what "authorized for signatures" is, but I suspect > you're talking about KeyUsage, etc.? If so, don't you need to say > this about ECDHE_ECDSA as well. >=20 > S 5.4. > The value named_curve indicates that a named curve is used. This > option SHOULD be used when applicable. >=20 > When would you not? >=20 > S 5.5. > This defines: > rsa_fixed_ecdh(65), > ecdsa_fixed_ecdh(66), >=20 > But the specification doesn't actually support this. Note that > the fixed_DH authentication mechanism are specified as having > the client's cert be on the same curve as the long-term > ECDH key, but you've deprecated those KE mechanisms, so as far > as I can tell, static DH auth is impossible >=20 > Also: > 1. Why isn't the ECDSA cert required to be signing capable. > 2. You probably should standardize on ECDSA_sign or ecdsa_sign. >=20 > S 5.7. > More text about static DH auth. Also "implicit" can probably go away. >=20 > The client selects an ephemeral ECDH public key corresponding to the= > parameters it received from the server according to the ECKAS-DH1 > scheme from IEEE 1363. It conveys this information to the client in= > the ClientKeyExchange message using the format defined above. >=20 > I don't understand what this means. >=20 >=20 > S 5.8. > This message is sent when the client sends a client certificate > containing a public key usable for digital signatures, e.g., when th= e > client is authenticated using the ECDSA_sign mechanism. >=20 > This is the only way that things can work now. >=20 >=20 > S 5.1.1. > Failing to > do so allows attackers to gain information about the private key, to= > the point that they may recover the entire private key in a few > requests, if that key is not really ephemeral. >=20 > To the best of my knowledge, this only applies to DH, not signature > verification. >=20 > S 6. > Do we really want to promote NULL and 3DES to ST? >=20 > -Ekr >=20 >=20 >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls >=20 --TpxNfDSOsF7w0PqmM1KuwFto38leDEGOF-- --dpWIsnh6UuieFkbNcQX2eMpxDDL0vff1I Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCAAGBQJYyVieAAoJEC88hzaAX42iOCMH/j/jh+PlHsPihjCO1i5AFncg 6KIEATxS7/JkUfovkCbPJ7VGaEC1OuRPET2DHqgxPV/yI6yQ6mnnWMjZZ1zASKow fJtWdVD3DdQyZ7NkrNc8DbHJlNFChprYV9irmHqvewxDUjvKWZy/2vCN4ycaSv0K X5d/Le1vIEikCSyFmG57lcS1mdWD+0kCZZHod/lF5L7xLFgD16Qbq8HGsv5DnJzS 3nxBlRzLnR/ed5Mm20u6tXqGH7hTerJVXs1LvaRay6GKPHd1dy9Lem257Kz+mYNy U8gtCfHb46lE5ppdqyCu/290uPYAVm0JHD/FHxYvSlOqc62bTRYQ9KZp+V1F7fQ= =hZAq -----END PGP SIGNATURE----- --dpWIsnh6UuieFkbNcQX2eMpxDDL0vff1I-- From nobody Wed Mar 15 08:22:33 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40BCB13167A for ; Wed, 15 Mar 2017 08:22:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LfM5IwADukRf for ; Wed, 15 Mar 2017 08:22:30 -0700 (PDT) Received: from mail-yw0-x236.google.com (mail-yw0-x236.google.com [IPv6:2607:f8b0:4002:c05::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 27AB013166D for ; Wed, 15 Mar 2017 08:22:30 -0700 (PDT) Received: by mail-yw0-x236.google.com with SMTP id p77so12715622ywg.1 for ; Wed, 15 Mar 2017 08:22:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=RoM1fmAUjg0ScRI38dcINn6iAP1FKUfyzXQKmcQSPgQ=; b=NpRIpCFvjfAVQUTMzwAI2Zz+EwDj+Kt5MyA4+LUttwNBwIV43ReNqtQM4McBBjs15R jkC1h2O+z+du76JRDdtB6sgPYizJgBSi9ZXxI0tGQnvBv9mv0HW/Bv5KNdx8SuhGertu TdJ/cX6lmQa7hn/euuURPjW50G1cP6eXAf0N73WOLw2o+mG5k/bXOB82Ct0kK5R+bBG8 W7czOGbnyNPqHUHrqom+3JigZhtug/rN2RU0x3PD4Ue9N+/pvA/eyqGSGz/0Ke22KfPa xF+xt05I4sfAV8P2l6BYAXCBm6PiBJj8YZNEjxmJO29Ku/nwIT70DubcNffpkX4RG2cH hvKg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=RoM1fmAUjg0ScRI38dcINn6iAP1FKUfyzXQKmcQSPgQ=; b=unB/PCfzzdni5hN/WDbwWtxwr4/qh2666JYL/er9KkKYqfKchRTPxYnAHHre9F3dG9 S3fq2rCqLkxOg+2U7eyphNTAtjP35Qun5pLLb5H1QL9NqYGInFHp0eMEbaq26wXdrRxG tD83KvQ5lgx+3B1jx+wYm0cDQPUBpZrr7HtsQ2Uze5cKx4S8/fyOMaxh7f0pwWl4sTDY O/MxEmLpLXJ3xuscGmTJG9QgN2UUCOLtjp8vOE7Adv9GD62pYTZOFIRQObdAbS1pzMxs ILjDMN9krwDlyoRvfj94VG8ta+2dnvRWYoBzAuyHI0LaP7W/CCc6e8oedDQuDJgKbGGf czuw== X-Gm-Message-State: AFeK/H3lGa0dwY3ve283mXEI3wiWvSdlSS5zt7r1iwTzVqo0Ga6G2ydtfCPNID8MI4oZT51cZCyxtBU5qEQrSQ== X-Received: by 10.37.224.81 with SMTP id x78mr2771088ybg.80.1489591349281; Wed, 15 Mar 2017 08:22:29 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Wed, 15 Mar 2017 08:21:48 -0700 (PDT) In-Reply-To: <77ef8038-32ae-affa-341e-b104fc28a343@cs.tcd.ie> References: <77ef8038-32ae-affa-341e-b104fc28a343@cs.tcd.ie> From: Eric Rescorla Date: Wed, 15 Mar 2017 08:21:48 -0700 Message-ID: To: Stephen Farrell Cc: "tls@ietf.org" , IESG Content-Type: multipart/alternative; boundary=94eb2c0873583c1f60054ac6835b Archived-At: Subject: Re: [TLS] Review of draft-ietf-tls-rfc4492bis-15 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 15:22:32 -0000 --94eb2c0873583c1f60054ac6835b Content-Type: text/plain; charset=UTF-8 FWIW, there's a lot here, but I think it's all essentially editorial, so it shouldn't be that hard to clean up. -Ekr On Wed, Mar 15, 2017 at 8:07 AM, Stephen Farrell wrote: > > Thanks Eric, > > Let's see what folks say in response to this and I can post > anything not immediately resolved as a DISCUSS ballot. We > can then process that in the coming week or two, and you > can take over the DISCUSS for whatever's not resolved by > the swap-over in Chicago. Or if someone else wants to > make some or all of Eric's comments a DISCUSS that'd work > too, but I'm fine with taking it. > > Cheers, > S. > > On 15/03/17 14:44, Eric Rescorla wrote: > > Sorry for the late review of this document. I just got to it this > > week. I'm sending this as comments rather than issues/PR due to > > how late it is in the proces. > > > > I have two high-level comments: > > > > - This document seems to still have a bunch of material about > > static DH (especially static DH authentication). I thought we > > had agreed to remove that. > > > > - You are inconsistent about using capital 2119 language > > and I expect you want to be consistent. > > > > > > DETAILED > > S 2. > > All of these key exchange algorithms provide forward secrecy. > > > > This is actually only true if each side generates fresh ephemerals > > which does not seem to be required by the spec. > > > > Do we really want to promote ECDH_anon to standards track? > > > > > > Nit: you want a line break between the last line of Figure 1 > > and the legend explaining the message types. > > > > > > S 2.3. > > This specification does not impose restrictions on signature schemes > > used anywhere in the certificate chain. The previous version of this > > document required the signatures to match, but this restriction, > > originating in previous TLS versions is lifted here as it had been in > > RFC 5246. > > > > This section is about ECDH_anon, so maybe this text belongs in S 2.1 or > > 2.2.? > > > > > > S 3. > > You have a bunch of lower case 2119 key words here. > > > > If these conditions are not met, the client should send a client > > Certificate message containing no certificates. In this case, the > > ClientKeyExchange should be sent as described in Section 2, and the > > CertificateVerify should not be sent. If the server requires client > > authentication, it may respond with a fatal handshake failure alert. > > > > Actually, this "should not be sent" is a MUST NOT, because if you send > > an empty certificate, you're forbidden to send CertificateVerify. > > > > > > S 4. > > choice of curves and compression techniques specified by the client. > > > > s/compression techniques/point formats/? > > > > > > S 5.1.1. > > Do you want to rename elliptic_curve_list to named_curve_list? > > > > > > S 5.1.2. > > > > Three point formats were included in the definition of ECPointFormat > > above. This specification deprecates all but the uncompressed point > > format. Implementations of this document MUST support the > > uncompressed format for all of their supported curves, and MUST NOT > > support other formats for curves defined in this specification. For > > backwards compatibility purposes, the point format list extension > > MUST still be included, and contain exactly one value: the > > uncompressed point format (0). > > > > This implies that you have to send supported point formats, but in > > S 5.1, this is a SHOULD. I believe what you may be trying to say > > here is that if you send the extension, it must be non-empty. > > > > Also, maybe I'm missing it, but where do you say that the default > > is to assume that the other side supports uncompressed if it doesn't > > do so. This is a backwards compat issue. > > > > > > S 5.3. > > You don't define what "authorized for signatures" is, but I suspect > > you're talking about KeyUsage, etc.? If so, don't you need to say > > this about ECDHE_ECDSA as well. > > > > S 5.4. > > The value named_curve indicates that a named curve is used. This > > option SHOULD be used when applicable. > > > > When would you not? > > > > S 5.5. > > This defines: > > rsa_fixed_ecdh(65), > > ecdsa_fixed_ecdh(66), > > > > But the specification doesn't actually support this. Note that > > the fixed_DH authentication mechanism are specified as having > > the client's cert be on the same curve as the long-term > > ECDH key, but you've deprecated those KE mechanisms, so as far > > as I can tell, static DH auth is impossible > > > > Also: > > 1. Why isn't the ECDSA cert required to be signing capable. > > 2. You probably should standardize on ECDSA_sign or ecdsa_sign. > > > > S 5.7. > > More text about static DH auth. Also "implicit" can probably go away. > > > > The client selects an ephemeral ECDH public key corresponding to the > > parameters it received from the server according to the ECKAS-DH1 > > scheme from IEEE 1363. It conveys this information to the client in > > the ClientKeyExchange message using the format defined above. > > > > I don't understand what this means. > > > > > > S 5.8. > > This message is sent when the client sends a client certificate > > containing a public key usable for digital signatures, e.g., when the > > client is authenticated using the ECDSA_sign mechanism. > > > > This is the only way that things can work now. > > > > > > S 5.1.1. > > Failing to > > do so allows attackers to gain information about the private key, to > > the point that they may recover the entire private key in a few > > requests, if that key is not really ephemeral. > > > > To the best of my knowledge, this only applies to DH, not signature > > verification. > > > > S 6. > > Do we really want to promote NULL and 3DES to ST? > > > > -Ekr > > > > > > > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls > > > > --94eb2c0873583c1f60054ac6835b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
FWIW, there's a lot here, but I think it's all ess= entially editorial, so it shouldn't
be that hard to clean up.

-Ekr


On Wed, Mar 15, 2017 at 8:07 AM, Step= hen Farrell <stephen.farrell@cs.tcd.ie> wrote:

Thanks Eric,

Let's see what folks say in response to this and I can post
anything not immediately resolved as a DISCUSS ballot. We
can then process that in the coming week or two, and you
can take over the DISCUSS for whatever's not resolved by
the swap-over in Chicago. Or if someone else wants to
make some or all of Eric's comments a DISCUSS that'd work
too, but I'm fine with taking it.

Cheers,
S.

On 15/03/17 14:44, Eric Rescorla wrote:
> Sorry for the late review of this document. I just got to it this
> week. I'm sending this as comments rather than issues/PR due to > how late it is in the proces.
>
> I have two high-level comments:
>
> - This document seems to still have a bunch of material about
>=C2=A0 =C2=A0static DH (especially static DH authentication). I thought= we
>=C2=A0 =C2=A0had agreed to remove that.
>
> - You are inconsistent about using capital 2119 language
>=C2=A0 =C2=A0and I expect you want to be consistent.
>
>
> DETAILED
> S 2.
>=C2=A0 =C2=A0 All of these key exchange algorithms provide forward secr= ecy.
>
> This is actually only true if each side generates fresh ephemerals
> which does not seem to be required by the spec.
>
> Do we really want to promote ECDH_anon to standards track?
>
>
> Nit: you want a line break between the last line of Figure 1
> and the legend explaining the message types.
>
>
> S 2.3.
>=C2=A0 =C2=A0 This specification does not impose restrictions on signat= ure schemes
>=C2=A0 =C2=A0 used anywhere in the certificate chain.=C2=A0 The previou= s version of this
>=C2=A0 =C2=A0 document required the signatures to match, but this restr= iction,
>=C2=A0 =C2=A0 originating in previous TLS versions is lifted here as it= had been in
>=C2=A0 =C2=A0 RFC 5246.
>
> This section is about ECDH_anon, so maybe this text belongs in S 2.1 o= r
> 2.2.?
>
>
> S 3.
> You have a bunch of lower case 2119 key words here.
>
>=C2=A0 =C2=A0 If these conditions are not met, the client should send a= client
>=C2=A0 =C2=A0 Certificate message containing no certificates.=C2=A0 In = this case, the
>=C2=A0 =C2=A0 ClientKeyExchange should be sent as described in Section = 2, and the
>=C2=A0 =C2=A0 CertificateVerify should not be sent.=C2=A0 If the server= requires client
>=C2=A0 =C2=A0 authentication, it may respond with a fatal handshake fai= lure alert.
>
> Actually, this "should not be sent" is a MUST NOT, because i= f you send
> an empty certificate, you're forbidden to send CertificateVerify.<= br> >
>
> S 4.
>=C2=A0 =C2=A0 choice of curves and compression techniques specified by = the client.
>
> s/compression techniques/point formats/?
>
>
> S 5.1.1.
> Do you want to rename elliptic_curve_list to named_curve_list?
>
>
> S 5.1.2.
>
>=C2=A0 =C2=A0 Three point formats were included in the definition of EC= PointFormat
>=C2=A0 =C2=A0 above.=C2=A0 This specification deprecates all but the un= compressed point
>=C2=A0 =C2=A0 format.=C2=A0 Implementations of this document MUST suppo= rt the
>=C2=A0 =C2=A0 uncompressed format for all of their supported curves, an= d MUST NOT
>=C2=A0 =C2=A0 support other formats for curves defined in this specific= ation.=C2=A0 For
>=C2=A0 =C2=A0 backwards compatibility purposes, the point format list e= xtension
>=C2=A0 =C2=A0 MUST still be included, and contain exactly one value: th= e
>=C2=A0 =C2=A0 uncompressed point format (0).
>
> This implies that you have to send supported point formats, but in
> S 5.1, this is a SHOULD. I believe what you may be trying to say
> here is that if you send the extension, it must be non-empty.
>
> Also, maybe I'm missing it, but where do you say that the default<= br> > is to assume that the other side supports uncompressed if it doesn'= ;t
> do so. This is a backwards compat issue.
>
>
> S 5.3.
> You don't define what "authorized for signatures" is, bu= t I suspect
> you're talking about KeyUsage, etc.? If so, don't you need to = say
> this about ECDHE_ECDSA as well.
>
> S 5.4.
>=C2=A0 =C2=A0 The value named_curve indicates that a named curve is use= d.=C2=A0 This
>=C2=A0 =C2=A0 option SHOULD be used when applicable.
>
> When would you not?
>
> S 5.5.
> This defines:
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 rsa_fixed_ecdh(65), >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ecdsa_fixed_ecdh(66),<= br> >
> But the specification doesn't actually support this. Note that
> the fixed_DH authentication mechanism are specified as having
> the client's cert be on the same curve as the long-term
> ECDH key, but you've deprecated those KE mechanisms, so as far
> as I can tell, static DH auth is impossible
>
> Also:
> 1. Why isn't the ECDSA cert required to be signing capable.
> 2. You probably should standardize on ECDSA_sign or ecdsa_sign.
>
> S 5.7.
> More text about static DH auth. Also "implicit" can probably= go away.
>
>=C2=A0 =C2=A0 The client selects an ephemeral ECDH public key correspon= ding to the
>=C2=A0 =C2=A0 parameters it received from the server according to the E= CKAS-DH1
>=C2=A0 =C2=A0 scheme from IEEE 1363.=C2=A0 It conveys this information = to the client in
>=C2=A0 =C2=A0 the ClientKeyExchange message using the format defined ab= ove.
>
> I don't understand what this means.
>
>
> S 5.8.
>=C2=A0 =C2=A0 This message is sent when the client sends a client certi= ficate
>=C2=A0 =C2=A0 containing a public key usable for digital signatures, e.= g., when the
>=C2=A0 =C2=A0 client is authenticated using the ECDSA_sign mechanism. >
> This is the only way that things can work now.
>
>
> S 5.1.1.
>=C2=A0 =C2=A0 Failing to
>=C2=A0 =C2=A0 do so allows attackers to gain information about the priv= ate key, to
>=C2=A0 =C2=A0 the point that they may recover the entire private key in= a few
>=C2=A0 =C2=A0 requests, if that key is not really ephemeral.
>
> To the best of my knowledge, this only applies to DH, not signature > verification.
>
> S 6.
> Do we really want to promote NULL and 3DES to ST?
>
> -Ekr
>
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>


--94eb2c0873583c1f60054ac6835b-- From nobody Wed Mar 15 10:20:48 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6451A13172C for ; Wed, 15 Mar 2017 10:20:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nBXjUc1vYvp1 for ; Wed, 15 Mar 2017 10:20:44 -0700 (PDT) Received: from mail-pf0-x229.google.com (mail-pf0-x229.google.com [IPv6:2607:f8b0:400e:c00::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BEBB213172A for ; Wed, 15 Mar 2017 10:20:44 -0700 (PDT) Received: by mail-pf0-x229.google.com with SMTP id o126so11689709pfb.3 for ; Wed, 15 Mar 2017 10:20:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=/dRWlzLbRmFpC/i/LLOuXQMO0tjIDtk/XIDNG07xGiA=; b=Rne9TwusUjn0A1QOLbeIOtQH+p1pS4coTK+WsHSgo6F+ecvMuXRjyLhItawdTVfcsz 7wyX+xhlWQAtZnPZkRH8hvjpMqbIheGTBEKtyaTYLeK3mbTn3qxQqR59KAcW6momQYCa UEuApXDNm+fV9UWPJGBuLtMFKIXIKLu8Bdr3E= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=/dRWlzLbRmFpC/i/LLOuXQMO0tjIDtk/XIDNG07xGiA=; b=NNxCRiuzlGEysOZz31Uj8ZE95gjrrPUE85XeLv2SU9QhYPM2hWRFCsFvrUkGwU0dYu idOghl38k87RuSeGBe8JxLg9gDq1TnQaABeU3mUjzYzFOIhCMYd6kXYqTn0TiRfvKPmm 5XL5M4IRnYWB2FPZ2FljzWa60bUk1tJa6eWocthBt42Y82UEzO2Dr0tRYN7qxg2mMbpn lIlM9PXgI5c/nczmZeIrm/L0wZyzmUIXiZlhexB8dRRyUf4KUUfWJ9xzb10QSihx7gmD h92WdMan+66nOadYv4/jLmcrco8JaO4urBNHpne/z2LQ0PgwhDJcRjevCKiatp4NREa/ kq/A== X-Gm-Message-State: AFeK/H22zwQr0/eEIT6AklzxXCAo4bsvPa84eXhQejrJpgbrloWAj5e6gVSQ/vkPcisf3khcbUDpaK2dQoj9PGQz X-Received: by 10.99.137.66 with SMTP id v63mr4721991pgd.207.1489598444168; Wed, 15 Mar 2017 10:20:44 -0700 (PDT) MIME-Version: 1.0 References: <77ef8038-32ae-affa-341e-b104fc28a343@cs.tcd.ie> In-Reply-To: From: David Benjamin Date: Wed, 15 Mar 2017 17:20:33 +0000 Message-ID: To: Eric Rescorla , Stephen Farrell Cc: "tls@ietf.org" , IESG Content-Type: multipart/alternative; boundary=94eb2c116eac1fbd2a054ac82a44 Archived-At: Subject: Re: [TLS] Review of draft-ietf-tls-rfc4492bis-15 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 17:20:47 -0000 --94eb2c116eac1fbd2a054ac82a44 Content-Type: text/plain; charset=UTF-8 If there's to be a respin anyway, I have another small editorial comment: https://github.com/tlswg/rfc4492bis/issues/36 On Wed, Mar 15, 2017 at 11:22 AM Eric Rescorla wrote: > FWIW, there's a lot here, but I think it's all essentially editorial, so > it shouldn't > be that hard to clean up. > > -Ekr > > > On Wed, Mar 15, 2017 at 8:07 AM, Stephen Farrell < > stephen.farrell@cs.tcd.ie> wrote: > > > Thanks Eric, > > Let's see what folks say in response to this and I can post > anything not immediately resolved as a DISCUSS ballot. We > can then process that in the coming week or two, and you > can take over the DISCUSS for whatever's not resolved by > the swap-over in Chicago. Or if someone else wants to > make some or all of Eric's comments a DISCUSS that'd work > too, but I'm fine with taking it. > > Cheers, > S. > > On 15/03/17 14:44, Eric Rescorla wrote: > > Sorry for the late review of this document. I just got to it this > > week. I'm sending this as comments rather than issues/PR due to > > how late it is in the proces. > > > > I have two high-level comments: > > > > - This document seems to still have a bunch of material about > > static DH (especially static DH authentication). I thought we > > had agreed to remove that. > > > > - You are inconsistent about using capital 2119 language > > and I expect you want to be consistent. > > > > > > DETAILED > > S 2. > > All of these key exchange algorithms provide forward secrecy. > > > > This is actually only true if each side generates fresh ephemerals > > which does not seem to be required by the spec. > > > > Do we really want to promote ECDH_anon to standards track? > > > > > > Nit: you want a line break between the last line of Figure 1 > > and the legend explaining the message types. > > > > > > S 2.3. > > This specification does not impose restrictions on signature schemes > > used anywhere in the certificate chain. The previous version of this > > document required the signatures to match, but this restriction, > > originating in previous TLS versions is lifted here as it had been in > > RFC 5246. > > > > This section is about ECDH_anon, so maybe this text belongs in S 2.1 or > > 2.2.? > > > > > > S 3. > > You have a bunch of lower case 2119 key words here. > > > > If these conditions are not met, the client should send a client > > Certificate message containing no certificates. In this case, the > > ClientKeyExchange should be sent as described in Section 2, and the > > CertificateVerify should not be sent. If the server requires client > > authentication, it may respond with a fatal handshake failure alert. > > > > Actually, this "should not be sent" is a MUST NOT, because if you send > > an empty certificate, you're forbidden to send CertificateVerify. > > > > > > S 4. > > choice of curves and compression techniques specified by the client. > > > > s/compression techniques/point formats/? > > > > > > S 5.1.1. > > Do you want to rename elliptic_curve_list to named_curve_list? > > > > > > S 5.1.2. > > > > Three point formats were included in the definition of ECPointFormat > > above. This specification deprecates all but the uncompressed point > > format. Implementations of this document MUST support the > > uncompressed format for all of their supported curves, and MUST NOT > > support other formats for curves defined in this specification. For > > backwards compatibility purposes, the point format list extension > > MUST still be included, and contain exactly one value: the > > uncompressed point format (0). > > > > This implies that you have to send supported point formats, but in > > S 5.1, this is a SHOULD. I believe what you may be trying to say > > here is that if you send the extension, it must be non-empty. > > > > Also, maybe I'm missing it, but where do you say that the default > > is to assume that the other side supports uncompressed if it doesn't > > do so. This is a backwards compat issue. > > > > > > S 5.3. > > You don't define what "authorized for signatures" is, but I suspect > > you're talking about KeyUsage, etc.? If so, don't you need to say > > this about ECDHE_ECDSA as well. > > > > S 5.4. > > The value named_curve indicates that a named curve is used. This > > option SHOULD be used when applicable. > > > > When would you not? > > > > S 5.5. > > This defines: > > rsa_fixed_ecdh(65), > > ecdsa_fixed_ecdh(66), > > > > But the specification doesn't actually support this. Note that > > the fixed_DH authentication mechanism are specified as having > > the client's cert be on the same curve as the long-term > > ECDH key, but you've deprecated those KE mechanisms, so as far > > as I can tell, static DH auth is impossible > > > > Also: > > 1. Why isn't the ECDSA cert required to be signing capable. > > 2. You probably should standardize on ECDSA_sign or ecdsa_sign. > > > > S 5.7. > > More text about static DH auth. Also "implicit" can probably go away. > > > > The client selects an ephemeral ECDH public key corresponding to the > > parameters it received from the server according to the ECKAS-DH1 > > scheme from IEEE 1363. It conveys this information to the client in > > the ClientKeyExchange message using the format defined above. > > > > I don't understand what this means. > > > > > > S 5.8. > > This message is sent when the client sends a client certificate > > containing a public key usable for digital signatures, e.g., when the > > client is authenticated using the ECDSA_sign mechanism. > > > > This is the only way that things can work now. > > > > > > S 5.1.1. > > Failing to > > do so allows attackers to gain information about the private key, to > > the point that they may recover the entire private key in a few > > requests, if that key is not really ephemeral. > > > > To the best of my knowledge, this only applies to DH, not signature > > verification. > > > > S 6. > > Do we really want to promote NULL and 3DES to ST? > > > > -Ekr > > > > > > > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls > > > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --94eb2c116eac1fbd2a054ac82a44 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
If there's to be a respin anyway, I have another small= editorial comment:
https://github.com/tlswg/rfc4492bis/issues/36

On Wed, Mar 15, 2017 at 11:22 AM Eric Res= corla <ekr@rtfm.com> wrote:
FWI= W, there's a lot here, but I think it's all essentially editorial, = so it shouldn't
be that hard to clean up.

-Ekr


On Wed, Mar 15, 2017 at 8:0= 7 AM, Stephen Farrell <ste= phen.farrell@cs.tcd.ie> wrote:

Thanks Eric,

Let's see what folks say in response to this and I can post
anything not immediately resolved as a DISCUSS ballot. We
can then process that in the coming week or two, and you
can take over the DISCUSS for whatever's not resolved by
the swap-over in Chicago. Or if someone else wants to
make some or all of Eric's comments a DISCUSS that'd work
too, but I'm fine with taking it.

Cheers,
S.
=
On 15/03/17 14:44, Eric Rescorla wrote:
> Sorry for the late review of this document. I just got to it this
> week. I'm sending this as comments rather than issues/PR due to > how late it is in the proces.
>
> I have two high-level comments:
>
> - This document seems to still have a bunch of material about
>=C2=A0 =C2=A0static DH (especially static DH authentication). I thought= we
>=C2=A0 =C2=A0had agreed to remove that.
>
> - You are inconsistent about using capital 2119 language
>=C2=A0 =C2=A0and I expect you want to be consistent.
>
>
> DETAILED
> S 2.
>=C2=A0 =C2=A0 All of these key exchange algorithms provide forward secr= ecy.
>
> This is actually only true if each side generates fresh ephemerals
> which does not seem to be required by the spec.
>
> Do we really want to promote ECDH_anon to standards track?
>
>
> Nit: you want a line break between the last line of Figure 1
> and the legend explaining the message types.
>
>
> S 2.3.
>=C2=A0 =C2=A0 This specification does not impose restrictions on signat= ure schemes
>=C2=A0 =C2=A0 used anywhere in the certificate chain.=C2=A0 The previou= s version of this
>=C2=A0 =C2=A0 document required the signatures to match, but this restr= iction,
>=C2=A0 =C2=A0 originating in previous TLS versions is lifted here as it= had been in
>=C2=A0 =C2=A0 RFC 5246.
>
> This section is about ECDH_anon, so maybe this text belongs in S 2.1 o= r
> 2.2.?
>
>
> S 3.
> You have a bunch of lower case 2119 key words here.
>
>=C2=A0 =C2=A0 If these conditions are not met, the client should send a= client
>=C2=A0 =C2=A0 Certificate message containing no certificates.=C2=A0 In = this case, the
>=C2=A0 =C2=A0 ClientKeyExchange should be sent as described in Section = 2, and the
>=C2=A0 =C2=A0 CertificateVerify should not be sent.=C2=A0 If the server= requires client
>=C2=A0 =C2=A0 authentication, it may respond with a fatal handshake fai= lure alert.
>
> Actually, this "should not be sent" is a MUST NOT, because i= f you send
> an empty certificate, you're forbidden to send CertificateVerify.<= br class=3D"gmail_msg"> >
>
> S 4.
>=C2=A0 =C2=A0 choice of curves and compression techniques specified by = the client.
>
> s/compression techniques/point formats/?
>
>
> S 5.1.1.
> Do you want to rename elliptic_curve_list to named_curve_list?
>
>
> S 5.1.2.
>
>=C2=A0 =C2=A0 Three point formats were included in the definition of EC= PointFormat
>=C2=A0 =C2=A0 above.=C2=A0 This specification deprecates all but the un= compressed point
>=C2=A0 =C2=A0 format.=C2=A0 Implementations of this document MUST suppo= rt the
>=C2=A0 =C2=A0 uncompressed format for all of their supported curves, an= d MUST NOT
>=C2=A0 =C2=A0 support other formats for curves defined in this specific= ation.=C2=A0 For
>=C2=A0 =C2=A0 backwards compatibility purposes, the point format list e= xtension
>=C2=A0 =C2=A0 MUST still be included, and contain exactly one value: th= e
>=C2=A0 =C2=A0 uncompressed point format (0).
>
> This implies that you have to send supported point formats, but in
> S 5.1, this is a SHOULD. I believe what you may be trying to say
> here is that if you send the extension, it must be non-empty.
>
> Also, maybe I'm missing it, but where do you say that the default<= br class=3D"gmail_msg"> > is to assume that the other side supports uncompressed if it doesn'= ;t
> do so. This is a backwards compat issue.
>
>
> S 5.3.
> You don't define what "authorized for signatures" is, bu= t I suspect
> you're talking about KeyUsage, etc.? If so, don't you need to = say
> this about ECDHE_ECDSA as well.
>
> S 5.4.
>=C2=A0 =C2=A0 The value named_curve indicates that a named curve is use= d.=C2=A0 This
>=C2=A0 =C2=A0 option SHOULD be used when applicable.
>
> When would you not?
>
> S 5.5.
> This defines:
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 rsa_fixed_ecdh(65), >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ecdsa_fixed_ecdh(66),<= br class=3D"gmail_msg"> >
> But the specification doesn't actually support this. Note that
> the fixed_DH authentication mechanism are specified as having
> the client's cert be on the same curve as the long-term
> ECDH key, but you've deprecated those KE mechanisms, so as far
> as I can tell, static DH auth is impossible
>
> Also:
> 1. Why isn't the ECDSA cert required to be signing capable.
> 2. You probably should standardize on ECDSA_sign or ecdsa_sign.
>
> S 5.7.
> More text about static DH auth. Also "implicit" can probably= go away.
>
>=C2=A0 =C2=A0 The client selects an ephemeral ECDH public key correspon= ding to the
>=C2=A0 =C2=A0 parameters it received from the server according to the E= CKAS-DH1
>=C2=A0 =C2=A0 scheme from IEEE 1363.=C2=A0 It conveys this information = to the client in
>=C2=A0 =C2=A0 the ClientKeyExchange message using the format defined ab= ove.
>
> I don't understand what this means.
>
>
> S 5.8.
>=C2=A0 =C2=A0 This message is sent when the client sends a client certi= ficate
>=C2=A0 =C2=A0 containing a public key usable for digital signatures, e.= g., when the
>=C2=A0 =C2=A0 client is authenticated using the ECDSA_sign mechanism. >
> This is the only way that things can work now.
>
>
> S 5.1.1.
>=C2=A0 =C2=A0 Failing to
>=C2=A0 =C2=A0 do so allows attackers to gain information about the priv= ate key, to
>=C2=A0 =C2=A0 the point that they may recover the entire private key in= a few
>=C2=A0 =C2=A0 requests, if that key is not really ephemeral.
>
> To the best of my knowledge, this only applies to DH, not signature > verification.
>
> S 6.
> Do we really want to promote NULL and 3DES to ST?
>
> -Ekr
>
>
>
> _______________________________________________
> TLS mailing list
> = TLS@ietf.org
> https://www.ietf.org/mailman/listi= nfo/tls
>


_______________________________________________
TLS mailing list
TLS@i= etf.org
https://www.ietf.org/mailman/listinfo/t= ls
--94eb2c116eac1fbd2a054ac82a44-- From nobody Wed Mar 15 11:45:09 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 42CFC1317B7; Wed, 15 Mar 2017 11:45:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.698 X-Spam-Level: X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uERUF1KB7w7v; Wed, 15 Mar 2017 11:45:04 -0700 (PDT) Received: from mail-wm0-x229.google.com (mail-wm0-x229.google.com [IPv6:2a00:1450:400c:c09::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D54981317B0; Wed, 15 Mar 2017 11:45:03 -0700 (PDT) Received: by mail-wm0-x229.google.com with SMTP id t189so30420436wmt.1; Wed, 15 Mar 2017 11:45:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=o2Mpb/RWnVe8EVEx4GOC/GoINHIeoU/GBxjja9u89m4=; b=SqFHUV6pdF0/AWokNxQ3zCnVz4F1HFQ2nOIH1s6dnl/2nflQ4bbsHRV3QcHed+P9uW ezQndZKgmPgXmejXFJruoB0quvDdy3XYDh5jH62vNCZrYJ6w+kc0YhhEtW8OKQjQyYTY JbExOhKIBZ82Ws1s9xE2lTPMLPhYTbap41C4herhJ34M93n4H+iZYt+/ug6E4NTlR2Ar 5YGWa+CxgP/p+tC4gVbd2CnKPbRn3UoWpq+ZgHTc/HBgkGNi2SNq2/AwE5oo1Tx3zfWT Be3rvyrssasL4txCqZzvRcRhxFdDRFEiFPT6nCirk94ZLj6Fzj7usjURDAQAoIajtRFE yy0Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=o2Mpb/RWnVe8EVEx4GOC/GoINHIeoU/GBxjja9u89m4=; b=GCtjChxjBJqgCKs60U5Qf2Ufb0OtOgs1xMfN+mAt0ccB+lhm4fn5PU7Vvtx1BSSOH+ PdASFbPDO2ENHAXLLFzL5QLJ8pOnM+XMENrkM3mwc4fV7nrsC5JaJKrInk89ncgeBboO 4drnVywybkBIHEJ1Vk9OUnvsUBuxLL1YrD54CLkZR3dOrC79nQmOGmrXtQvFEIBUy+pd iYPPsAMhkm9UaEyq8d1oEh6QZD5g/PyauqzfRFzcdyoggeX+F6pkb00qwszDkI33KjUG Yuq0vZG6DOniYDuVGcZrWwg4OJZ52Du2kzpnnkEaD91DEEL8OPv+iF6Lxuorqi31nIvh zhUQ== X-Gm-Message-State: AFeK/H3HFXd621mcu2rN0tpFiv/Tzdrs5bZSBiHjfvLV2sTArX7XUXXIZpqY6aEtW24/gA== X-Received: by 10.28.165.70 with SMTP id o67mr5643923wme.11.1489603502288; Wed, 15 Mar 2017 11:45:02 -0700 (PDT) Received: from [192.168.1.18] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id j74sm3350437wrj.21.2017.03.15.11.45.00 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 15 Mar 2017 11:45:01 -0700 (PDT) From: Yoav Nir Message-Id: <13268B67-A6EA-4B4C-9D16-C982A6EE92AA@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_5C1C4EE0-D367-4D05-B300-4E9BAED44391"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Wed, 15 Mar 2017 20:44:59 +0200 In-Reply-To: Cc: Eric Rescorla , Stephen Farrell , "tls@ietf.org" , IESG To: David Benjamin References: <77ef8038-32ae-affa-341e-b104fc28a343@cs.tcd.ie> X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Review of draft-ietf-tls-rfc4492bis-15 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 18:45:07 -0000 --Apple-Mail=_5C1C4EE0-D367-4D05-B300-4E9BAED44391 Content-Type: multipart/alternative; boundary="Apple-Mail=_64D58B19-A790-4400-A0F8-E7D66EABCFD8" --Apple-Mail=_64D58B19-A790-4400-A0F8-E7D66EABCFD8 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii There is (going to be a re-spin). There already is a PR there. If you can make a PR to solve your issue, that would be great. > On 15 Mar 2017, at 19:20, David Benjamin = wrote: >=20 > If there's to be a respin anyway, I have another small editorial = comment: > https://github.com/tlswg/rfc4492bis/issues/36 = >=20 > On Wed, Mar 15, 2017 at 11:22 AM Eric Rescorla > wrote: > FWIW, there's a lot here, but I think it's all essentially editorial, = so it shouldn't > be that hard to clean up. >=20 > -Ekr >=20 >=20 > On Wed, Mar 15, 2017 at 8:07 AM, Stephen Farrell = > wrote: >=20 > Thanks Eric, >=20 > Let's see what folks say in response to this and I can post > anything not immediately resolved as a DISCUSS ballot. We > can then process that in the coming week or two, and you > can take over the DISCUSS for whatever's not resolved by > the swap-over in Chicago. Or if someone else wants to > make some or all of Eric's comments a DISCUSS that'd work > too, but I'm fine with taking it. >=20 > Cheers, > S. >=20 > On 15/03/17 14:44, Eric Rescorla wrote: > > Sorry for the late review of this document. I just got to it this > > week. I'm sending this as comments rather than issues/PR due to > > how late it is in the proces. > > > > I have two high-level comments: > > > > - This document seems to still have a bunch of material about > > static DH (especially static DH authentication). I thought we > > had agreed to remove that. > > > > - You are inconsistent about using capital 2119 language > > and I expect you want to be consistent. > > > > > > DETAILED > > S 2. > > All of these key exchange algorithms provide forward secrecy. > > > > This is actually only true if each side generates fresh ephemerals > > which does not seem to be required by the spec. > > > > Do we really want to promote ECDH_anon to standards track? > > > > > > Nit: you want a line break between the last line of Figure 1 > > and the legend explaining the message types. > > > > > > S 2.3. > > This specification does not impose restrictions on signature = schemes > > used anywhere in the certificate chain. The previous version of = this > > document required the signatures to match, but this restriction, > > originating in previous TLS versions is lifted here as it had = been in > > RFC 5246. > > > > This section is about ECDH_anon, so maybe this text belongs in S 2.1 = or > > 2.2.? > > > > > > S 3. > > You have a bunch of lower case 2119 key words here. > > > > If these conditions are not met, the client should send a client > > Certificate message containing no certificates. In this case, = the > > ClientKeyExchange should be sent as described in Section 2, and = the > > CertificateVerify should not be sent. If the server requires = client > > authentication, it may respond with a fatal handshake failure = alert. > > > > Actually, this "should not be sent" is a MUST NOT, because if you = send > > an empty certificate, you're forbidden to send CertificateVerify. > > > > > > S 4. > > choice of curves and compression techniques specified by the = client. > > > > s/compression techniques/point formats/? > > > > > > S 5.1.1. > > Do you want to rename elliptic_curve_list to named_curve_list? > > > > > > S 5.1.2. > > > > Three point formats were included in the definition of = ECPointFormat > > above. This specification deprecates all but the uncompressed = point > > format. Implementations of this document MUST support the > > uncompressed format for all of their supported curves, and MUST = NOT > > support other formats for curves defined in this specification. = For > > backwards compatibility purposes, the point format list extension > > MUST still be included, and contain exactly one value: the > > uncompressed point format (0). > > > > This implies that you have to send supported point formats, but in > > S 5.1, this is a SHOULD. I believe what you may be trying to say > > here is that if you send the extension, it must be non-empty. > > > > Also, maybe I'm missing it, but where do you say that the default > > is to assume that the other side supports uncompressed if it doesn't > > do so. This is a backwards compat issue. > > > > > > S 5.3. > > You don't define what "authorized for signatures" is, but I suspect > > you're talking about KeyUsage, etc.? If so, don't you need to say > > this about ECDHE_ECDSA as well. > > > > S 5.4. > > The value named_curve indicates that a named curve is used. This > > option SHOULD be used when applicable. > > > > When would you not? > > > > S 5.5. > > This defines: > > rsa_fixed_ecdh(65), > > ecdsa_fixed_ecdh(66), > > > > But the specification doesn't actually support this. Note that > > the fixed_DH authentication mechanism are specified as having > > the client's cert be on the same curve as the long-term > > ECDH key, but you've deprecated those KE mechanisms, so as far > > as I can tell, static DH auth is impossible > > > > Also: > > 1. Why isn't the ECDSA cert required to be signing capable. > > 2. You probably should standardize on ECDSA_sign or ecdsa_sign. > > > > S 5.7. > > More text about static DH auth. Also "implicit" can probably go = away. > > > > The client selects an ephemeral ECDH public key corresponding to = the > > parameters it received from the server according to the ECKAS-DH1 > > scheme from IEEE 1363. It conveys this information to the client = in > > the ClientKeyExchange message using the format defined above. > > > > I don't understand what this means. > > > > > > S 5.8. > > This message is sent when the client sends a client certificate > > containing a public key usable for digital signatures, e.g., when = the > > client is authenticated using the ECDSA_sign mechanism. > > > > This is the only way that things can work now. > > > > > > S 5.1.1. > > Failing to > > do so allows attackers to gain information about the private key, = to > > the point that they may recover the entire private key in a few > > requests, if that key is not really ephemeral. > > > > To the best of my knowledge, this only applies to DH, not signature > > verification. > > > > S 6. > > Do we really want to promote NULL and 3DES to ST? > > > > -Ekr > > > > > > > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls = > > >=20 >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls = > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls --Apple-Mail=_64D58B19-A790-4400-A0F8-E7D66EABCFD8 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii There is (going to be a re-spin). There already is a PR = there.

If you can = make a PR to solve your issue, that would be great.

On 15 Mar 2017, at 19:20, David Benjamin <davidben@chromium.org> wrote:

If there's to be a respin anyway, I have another small = editorial comment:
https://github.com/tlswg/rfc4492bis/issues/36

On Wed, Mar 15, 2017 at 11:22 AM Eric Rescorla <ekr@rtfm.com> wrote:
FWIW, there's a lot here, but I think it's all = essentially editorial, so it shouldn't
be that = hard to clean up.

-Ekr


On Wed, Mar 15, 2017 at 8:07 AM, Stephen = Farrell <stephen.farrell@cs.tcd.ie> wrote:

Thanks Eric,

Let's see what folks say in response to this and I can post
anything not immediately resolved as a DISCUSS ballot. We
can then process that in the coming week or two, and you
can take over the DISCUSS for whatever's not resolved by
the swap-over in Chicago. Or if someone else wants to
make some or all of Eric's comments a DISCUSS that'd work
too, but I'm fine with taking it.

Cheers,
S.

On 15/03/17 14:44, Eric Rescorla wrote:
> Sorry for the late review of this document. I just got to it = this
> week. I'm sending this as comments rather than issues/PR due to
> how late it is in the proces.
>
> I have two high-level comments:
>
> - This document seems to still have a bunch of material about
>   static DH (especially static DH authentication). I = thought we
>   had agreed to remove that.
>
> - You are inconsistent about using capital 2119 language
>   and I expect you want to be consistent.
>
>
> DETAILED
> S 2.
>    All of these key exchange algorithms provide forward = secrecy.
>
> This is actually only true if each side generates fresh = ephemerals
> which does not seem to be required by the spec.
>
> Do we really want to promote ECDH_anon to standards track?
>
>
> Nit: you want a line break between the last line of Figure 1
> and the legend explaining the message types.
>
>
> S 2.3.
>    This specification does not impose restrictions on = signature schemes
>    used anywhere in the certificate chain.  The = previous version of this
>    document required the signatures to match, but this = restriction,
>    originating in previous TLS versions is lifted here as = it had been in
>    RFC 5246.
>
> This section is about ECDH_anon, so maybe this text belongs in S = 2.1 or
> 2.2.?
>
>
> S 3.
> You have a bunch of lower case 2119 key words here.
>
>    If these conditions are not met, the client should = send a client
>    Certificate message containing no certificates.  = In this case, the
>    ClientKeyExchange should be sent as described in = Section 2, and the
>    CertificateVerify should not be sent.  If the = server requires client
>    authentication, it may respond with a fatal handshake = failure alert.
>
> Actually, this "should not be sent" is a MUST NOT, because if you = send
> an empty certificate, you're forbidden to send = CertificateVerify.
>
>
> S 4.
>    choice of curves and compression techniques specified = by the client.
>
> s/compression techniques/point formats/?
>
>
> S 5.1.1.
> Do you want to rename elliptic_curve_list to named_curve_list?
>
>
> S 5.1.2.
>
>    Three point formats were included in the definition of = ECPointFormat
>    above.  This specification deprecates all but the = uncompressed point
>    format.  Implementations of this document MUST = support the
>    uncompressed format for all of their supported curves, = and MUST NOT
>    support other formats for curves defined in this = specification.  For
>    backwards compatibility purposes, the point format = list extension
>    MUST still be included, and contain exactly one value: = the
>    uncompressed point format (0).
>
> This implies that you have to send supported point formats, but = in
> S 5.1, this is a SHOULD. I believe what you may be trying to say
> here is that if you send the extension, it must be non-empty.
>
> Also, maybe I'm missing it, but where do you say that the = default
> is to assume that the other side supports uncompressed if it = doesn't
> do so. This is a backwards compat issue.
>
>
> S 5.3.
> You don't define what "authorized for signatures" is, but I = suspect
> you're talking about KeyUsage, etc.? If so, don't you need to = say
> this about ECDHE_ECDSA as well.
>
> S 5.4.
>    The value named_curve indicates that a named curve is = used.  This
>    option SHOULD be used when applicable.
>
> When would you not?
>
> S 5.5.
> This defines:
>              = rsa_fixed_ecdh(65),
>              = ecdsa_fixed_ecdh(66),
>
> But the specification doesn't actually support this. Note that
> the fixed_DH authentication mechanism are specified as having
> the client's cert be on the same curve as the long-term
> ECDH key, but you've deprecated those KE mechanisms, so as far
> as I can tell, static DH auth is impossible
>
> Also:
> 1. Why isn't the ECDSA cert required to be signing capable.
> 2. You probably should standardize on ECDSA_sign or ecdsa_sign.
>
> S 5.7.
> More text about static DH auth. Also "implicit" can probably go = away.
>
>    The client selects an ephemeral ECDH public key = corresponding to the
>    parameters it received from the server according to = the ECKAS-DH1
>    scheme from IEEE 1363.  It conveys this = information to the client in
>    the ClientKeyExchange message using the format defined = above.
>
> I don't understand what this means.
>
>
> S 5.8.
>    This message is sent when the client sends a client = certificate
>    containing a public key usable for digital signatures, = e.g., when the
>    client is authenticated using the ECDSA_sign = mechanism.
>
> This is the only way that things can work now.
>
>
> S 5.1.1.
>    Failing to
>    do so allows attackers to gain information about the = private key, to
>    the point that they may recover the entire private key = in a few
>    requests, if that key is not really ephemeral.
>
> To the best of my knowledge, this only applies to DH, not = signature
> verification.
>
> S 6.
> Do we really want to promote NULL and 3DES to ST?
>
> -Ekr
>
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>


_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
_______________________________________________
TLS = mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

= --Apple-Mail=_64D58B19-A790-4400-A0F8-E7D66EABCFD8-- --Apple-Mail=_5C1C4EE0-D367-4D05-B300-4E9BAED44391 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYyYurAAoJELhJCxUKWMyZIhkH/3fNXLxby9EVn+AVLnIVMJEN V+psFiLI/ClW4X4ui1+JfxOzweHQJsHNtStWFh5jtttfbtzS56AzM8LpJMgJNoiS d/WMfNXKoMMVpjxF0MD7S245m1LCuVX5vWKulbWyVfW+xI3NC5vEbLbk+OOrwpYP dif7IVZomk/oGXAqhlJhtwdR5jcyMLO6+es5k6KIDJXdgnf38CYldtk0AdPHbIKZ BBsCYFnxWiLVfcr1ImIgf6JIrOOKYykGmyVssKa7gwmOl8RK1BLVzVT+rjCunhfQ EC/f7S46UactW7z/I1CNh1FBB0bx+/XAj2Zqi68D/Ra6WddKhyACZyD2qPK9JUk= =06ro -----END PGP SIGNATURE----- --Apple-Mail=_5C1C4EE0-D367-4D05-B300-4E9BAED44391-- From nobody Wed Mar 15 12:32:30 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 019C51317E6 for ; Wed, 15 Mar 2017 12:32:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4G67_IicOTse for ; Wed, 15 Mar 2017 12:32:27 -0700 (PDT) Received: from mail-pf0-x22c.google.com (mail-pf0-x22c.google.com [IPv6:2607:f8b0:400e:c00::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC4DE1317E1 for ; Wed, 15 Mar 2017 12:32:27 -0700 (PDT) Received: by mail-pf0-x22c.google.com with SMTP id x63so7719583pfx.2 for ; Wed, 15 Mar 2017 12:32:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=2nJS7sv7TN73YCK1hb10saZlJPeH1vprL4oVw7rrcbU=; b=NphJ+dMNkj6pP/B823jPIlDlH19vQEiv21hndpThpYwXCwBU1uv7bn3EJ+JbdnyO8A 4KMIdeMT3AM1hzjBnoujzNzfGTvI7XzRQjJrIWEgX5rB/ALi/v/2HyC8j6eHwQ5a2z/C cFKZbkS89hdrRXVl0iUr0cYdSQpyq6dPJbxT8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=2nJS7sv7TN73YCK1hb10saZlJPeH1vprL4oVw7rrcbU=; b=NsTtHwit2+H8rBlx7VMEnD25YD8gnaa7v1RMgcC24mSTwAU4aQ53li2U0gcOOGnvEM TQ0zeVzniw+nnvtcjxJkViSDw0b4T5n+3erqcDposRW5rY5bXeRFSqq3jRD9ERCd0hVj dq9W0aPIDjPm5uCPLv9JR6gUWr+4qDLf3PDDG+Fp7NyTa8VQchWeqSP2oRQiJF1HllFc FBE32UKo/40ijiRj9ymLwm2DD9pcPRuZc3/EnvxXEuWpgNjFvvvNjuinnmKxqkGRjgAa E6feHXfU5FdRlmp2b2+ZisBhxw+trsrf6Ryw6H7fH6xiYG8vbfqimvekFIGGJuo0koIq s/sw== X-Gm-Message-State: AFeK/H3xD2rMf2cAx0dg3tMft6hb3E6ywuUgMMQp4YNlZLISUUm/lP2NYy2YXj73rXdNDtrYZihBPaFWk5uG7TXC X-Received: by 10.99.102.135 with SMTP id a129mr5472707pgc.220.1489606347097; Wed, 15 Mar 2017 12:32:27 -0700 (PDT) MIME-Version: 1.0 References: <77ef8038-32ae-affa-341e-b104fc28a343@cs.tcd.ie> <13268B67-A6EA-4B4C-9D16-C982A6EE92AA@gmail.com> In-Reply-To: <13268B67-A6EA-4B4C-9D16-C982A6EE92AA@gmail.com> From: David Benjamin Date: Wed, 15 Mar 2017 19:32:16 +0000 Message-ID: To: Yoav Nir Cc: Eric Rescorla , Stephen Farrell , "tls@ietf.org" , IESG Content-Type: multipart/alternative; boundary=94eb2c0eee902cdf0c054aca0129 Archived-At: Subject: Re: [TLS] Review of draft-ietf-tls-rfc4492bis-15 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 19:32:30 -0000 --94eb2c0eee902cdf0c054aca0129 Content-Type: text/plain; charset=UTF-8 How's this look? https://github.com/tlswg/rfc4492bis/pull/37 On Wed, Mar 15, 2017 at 2:45 PM Yoav Nir wrote: > There is (going to be a re-spin). There already is a PR there. > > If you can make a PR to solve your issue, that would be great. > > On 15 Mar 2017, at 19:20, David Benjamin wrote: > > If there's to be a respin anyway, I have another small editorial comment: > https://github.com/tlswg/rfc4492bis/issues/36 > > On Wed, Mar 15, 2017 at 11:22 AM Eric Rescorla wrote: > > FWIW, there's a lot here, but I think it's all essentially editorial, so > it shouldn't > be that hard to clean up. > > -Ekr > > > On Wed, Mar 15, 2017 at 8:07 AM, Stephen Farrell < > stephen.farrell@cs.tcd.ie> wrote: > > > Thanks Eric, > > Let's see what folks say in response to this and I can post > anything not immediately resolved as a DISCUSS ballot. We > can then process that in the coming week or two, and you > can take over the DISCUSS for whatever's not resolved by > the swap-over in Chicago. Or if someone else wants to > make some or all of Eric's comments a DISCUSS that'd work > too, but I'm fine with taking it. > > Cheers, > S. > > On 15/03/17 14:44, Eric Rescorla wrote: > > Sorry for the late review of this document. I just got to it this > > week. I'm sending this as comments rather than issues/PR due to > > how late it is in the proces. > > > > I have two high-level comments: > > > > - This document seems to still have a bunch of material about > > static DH (especially static DH authentication). I thought we > > had agreed to remove that. > > > > - You are inconsistent about using capital 2119 language > > and I expect you want to be consistent. > > > > > > DETAILED > > S 2. > > All of these key exchange algorithms provide forward secrecy. > > > > This is actually only true if each side generates fresh ephemerals > > which does not seem to be required by the spec. > > > > Do we really want to promote ECDH_anon to standards track? > > > > > > Nit: you want a line break between the last line of Figure 1 > > and the legend explaining the message types. > > > > > > S 2.3. > > This specification does not impose restrictions on signature schemes > > used anywhere in the certificate chain. The previous version of this > > document required the signatures to match, but this restriction, > > originating in previous TLS versions is lifted here as it had been in > > RFC 5246. > > > > This section is about ECDH_anon, so maybe this text belongs in S 2.1 or > > 2.2.? > > > > > > S 3. > > You have a bunch of lower case 2119 key words here. > > > > If these conditions are not met, the client should send a client > > Certificate message containing no certificates. In this case, the > > ClientKeyExchange should be sent as described in Section 2, and the > > CertificateVerify should not be sent. If the server requires client > > authentication, it may respond with a fatal handshake failure alert. > > > > Actually, this "should not be sent" is a MUST NOT, because if you send > > an empty certificate, you're forbidden to send CertificateVerify. > > > > > > S 4. > > choice of curves and compression techniques specified by the client. > > > > s/compression techniques/point formats/? > > > > > > S 5.1.1. > > Do you want to rename elliptic_curve_list to named_curve_list? > > > > > > S 5.1.2. > > > > Three point formats were included in the definition of ECPointFormat > > above. This specification deprecates all but the uncompressed point > > format. Implementations of this document MUST support the > > uncompressed format for all of their supported curves, and MUST NOT > > support other formats for curves defined in this specification. For > > backwards compatibility purposes, the point format list extension > > MUST still be included, and contain exactly one value: the > > uncompressed point format (0). > > > > This implies that you have to send supported point formats, but in > > S 5.1, this is a SHOULD. I believe what you may be trying to say > > here is that if you send the extension, it must be non-empty. > > > > Also, maybe I'm missing it, but where do you say that the default > > is to assume that the other side supports uncompressed if it doesn't > > do so. This is a backwards compat issue. > > > > > > S 5.3. > > You don't define what "authorized for signatures" is, but I suspect > > you're talking about KeyUsage, etc.? If so, don't you need to say > > this about ECDHE_ECDSA as well. > > > > S 5.4. > > The value named_curve indicates that a named curve is used. This > > option SHOULD be used when applicable. > > > > When would you not? > > > > S 5.5. > > This defines: > > rsa_fixed_ecdh(65), > > ecdsa_fixed_ecdh(66), > > > > But the specification doesn't actually support this. Note that > > the fixed_DH authentication mechanism are specified as having > > the client's cert be on the same curve as the long-term > > ECDH key, but you've deprecated those KE mechanisms, so as far > > as I can tell, static DH auth is impossible > > > > Also: > > 1. Why isn't the ECDSA cert required to be signing capable. > > 2. You probably should standardize on ECDSA_sign or ecdsa_sign. > > > > S 5.7. > > More text about static DH auth. Also "implicit" can probably go away. > > > > The client selects an ephemeral ECDH public key corresponding to the > > parameters it received from the server according to the ECKAS-DH1 > > scheme from IEEE 1363. It conveys this information to the client in > > the ClientKeyExchange message using the format defined above. > > > > I don't understand what this means. > > > > > > S 5.8. > > This message is sent when the client sends a client certificate > > containing a public key usable for digital signatures, e.g., when the > > client is authenticated using the ECDSA_sign mechanism. > > > > This is the only way that things can work now. > > > > > > S 5.1.1. > > Failing to > > do so allows attackers to gain information about the private key, to > > the point that they may recover the entire private key in a few > > requests, if that key is not really ephemeral. > > > > To the best of my knowledge, this only applies to DH, not signature > > verification. > > > > S 6. > > Do we really want to promote NULL and 3DES to ST? > > > > -Ekr > > > > > > > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls > > > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > > --94eb2c0eee902cdf0c054aca0129 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
How's this look? https://github.com/tlswg/rfc4492bis/pull/37

<= div class=3D"gmail_quote">
On Wed, Mar 15, 2017 at 2:45 PM = Yoav Nir <ynir.ietf@gmail.com= > wrote:
There is (going to be a re-spin). There al= ready is a PR there.

=
If you can make a PR to solve your issue, that wou= ld be great.

= On 15 Mar 2017, at 19:20, David Benjamin <davidben@chromium.org&= gt; wrote:

= If there's to be a respin anyway, I have another small editorial commen= t:
https://github.com/tlswg/rf= c4492bis/issues/36

On Wed= , Mar 15, 2017 at 11:22 AM Eric Rescorla <ekr@rtfm.com> wrote:
FWIW, there's a lot here, but I think it's= all essentially editorial, so it shouldn't
be = that hard to clean up.

-Ekr


On Wed, Mar 15, 2017 at 8:07 AM, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:<= br class=3D"gmail_msg">

Thanks Eric,

Let's see what folks say in response to this and I can post
anything not immediately resolved as a DISCUSS ballot. We
can then process that in the coming week or two, and you
can take over the DISCUSS for whatever's not resolved by
the swap-over in Chicago. Or if someone else wants to
make some or all of Eric's comments a DISCUSS that'd work
too, but I'm fine with taking it.

Cheers,
S.

On 15/03/17 14:44, Eric Rescorla wrote:
> Sorry for the late review of this document. I just got to it this
> week. I'm sending this as comments rather than issues/PR due to > how late it is in the proces.
>
> I have two high-level comments:
>
> - This document seems to still have a bunch of material about
>=C2=A0 =C2=A0static DH (especially static DH authentication). I thought= we
>=C2=A0 =C2=A0had agreed to remove that.
>
> - You are inconsistent about using capital 2119 language
>=C2=A0 =C2=A0and I expect you want to be consistent.
>
>
> DETAILED
> S 2.
>=C2=A0 =C2=A0 All of these key exchange algorithms provide forward secr= ecy.
>
> This is actually only true if each side generates fresh ephemerals
> which does not seem to be required by the spec.
>
> Do we really want to promote ECDH_anon to standards track?
>
>
> Nit: you want a line break between the last line of Figure 1
> and the legend explaining the message types.
>
>
> S 2.3.
>=C2=A0 =C2=A0 This specification does not impose restrictions on signat= ure schemes
>=C2=A0 =C2=A0 used anywhere in the certificate chain.=C2=A0 The previou= s version of this
>=C2=A0 =C2=A0 document required the signatures to match, but this restr= iction,
>=C2=A0 =C2=A0 originating in previous TLS versions is lifted here as it= had been in
>=C2=A0 =C2=A0 RFC 5246.
>
> This section is about ECDH_anon, so maybe this text belongs in S 2.1 o= r
> 2.2.?
>
>
> S 3.
> You have a bunch of lower case 2119 key words here.
>
>=C2=A0 =C2=A0 If these conditions are not met, the client should send a= client
>=C2=A0 =C2=A0 Certificate message containing no certificates.=C2=A0 In = this case, the
>=C2=A0 =C2=A0 ClientKeyExchange should be sent as described in Section = 2, and the
>=C2=A0 =C2=A0 CertificateVerify should not be sent.=C2=A0 If the server= requires client
>=C2=A0 =C2=A0 authentication, it may respond with a fatal handshake fai= lure alert.
>
> Actually, this "should not be sent" is a MUST NOT, because i= f you send
> an empty certificate, you're forbidden to send CertificateVerify.<= br class=3D"gmail_msg"> >
>
> S 4.
>=C2=A0 =C2=A0 choice of curves and compression techniques specified by = the client.
>
> s/compression techniques/point formats/?
>
>
> S 5.1.1.
> Do you want to rename elliptic_curve_list to named_curve_list?
>
>
> S 5.1.2.
>
>=C2=A0 =C2=A0 Three point formats were included in the definition of EC= PointFormat
>=C2=A0 =C2=A0 above.=C2=A0 This specification deprecates all but the un= compressed point
>=C2=A0 =C2=A0 format.=C2=A0 Implementations of this document MUST suppo= rt the
>=C2=A0 =C2=A0 uncompressed format for all of their supported curves, an= d MUST NOT
>=C2=A0 =C2=A0 support other formats for curves defined in this specific= ation.=C2=A0 For
>=C2=A0 =C2=A0 backwards compatibility purposes, the point format list e= xtension
>=C2=A0 =C2=A0 MUST still be included, and contain exactly one value: th= e
>=C2=A0 =C2=A0 uncompressed point format (0).
>
> This implies that you have to send supported point formats, but in
> S 5.1, this is a SHOULD. I believe what you may be trying to say
> here is that if you send the extension, it must be non-empty.
>
> Also, maybe I'm missing it, but where do you say that the default<= br class=3D"gmail_msg"> > is to assume that the other side supports uncompressed if it doesn'= ;t
> do so. This is a backwards compat issue.
>
>
> S 5.3.
> You don't define what "authorized for signatures" is, bu= t I suspect
> you're talking about KeyUsage, etc.? If so, don't you need to = say
> this about ECDHE_ECDSA as well.
>
> S 5.4.
>=C2=A0 =C2=A0 The value named_curve indicates that a named curve is use= d.=C2=A0 This
>=C2=A0 =C2=A0 option SHOULD be used when applicable.
>
> When would you not?
>
> S 5.5.
> This defines:
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 rsa_fixed_ecdh(65), >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ecdsa_fixed_ecdh(66),<= br class=3D"gmail_msg"> >
> But the specification doesn't actually support this. Note that
> the fixed_DH authentication mechanism are specified as having
> the client's cert be on the same curve as the long-term
> ECDH key, but you've deprecated those KE mechanisms, so as far
> as I can tell, static DH auth is impossible
>
> Also:
> 1. Why isn't the ECDSA cert required to be signing capable.
> 2. You probably should standardize on ECDSA_sign or ecdsa_sign.
>
> S 5.7.
> More text about static DH auth. Also "implicit" can probably= go away.
>
>=C2=A0 =C2=A0 The client selects an ephemeral ECDH public key correspon= ding to the
>=C2=A0 =C2=A0 parameters it received from the server according to the E= CKAS-DH1
>=C2=A0 =C2=A0 scheme from IEEE 1363.=C2=A0 It conveys this information = to the client in
>=C2=A0 =C2=A0 the ClientKeyExchange message using the format defined ab= ove.
>
> I don't understand what this means.
>
>
> S 5.8.
>=C2=A0 =C2=A0 This message is sent when the client sends a client certi= ficate
>=C2=A0 =C2=A0 containing a public key usable for digital signatures, e.= g., when the
>=C2=A0 =C2=A0 client is authenticated using the ECDSA_sign mechanism. >
> This is the only way that things can work now.
>
>
> S 5.1.1.
>=C2=A0 =C2=A0 Failing to
>=C2=A0 =C2=A0 do so allows attackers to gain information about the priv= ate key, to
>=C2=A0 =C2=A0 the point that they may recover the entire private key in= a few
>=C2=A0 =C2=A0 requests, if that key is not really ephemeral.
>
> To the best of my knowledge, this only applies to DH, not signature > verification.
>
> S 6.
> Do we really want to promote NULL and 3DES to ST?
>
> -Ekr
>
>
>
> _______________________________________________
> TLS mailing list
> = TLS@ietf.org
> https://www.ietf.org/mailman/listi= nfo/tls
>


_______________________________________________
TLS mailing list
TLS@i= etf.org
https://www.ietf.org/mailman/listinfo/t= ls
_______________________________________________
TLS = mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--94eb2c0eee902cdf0c054aca0129-- From nobody Wed Mar 15 12:39:02 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F32B9131752; Wed, 15 Mar 2017 12:39:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.698 X-Spam-Level: X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GiUjJJrvTz13; Wed, 15 Mar 2017 12:38:58 -0700 (PDT) Received: from mail-wm0-x22b.google.com (mail-wm0-x22b.google.com [IPv6:2a00:1450:400c:c09::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C036C13171B; Wed, 15 Mar 2017 12:38:57 -0700 (PDT) Received: by mail-wm0-x22b.google.com with SMTP id n11so31467813wma.0; Wed, 15 Mar 2017 12:38:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=Fi2BtyXxl19H//bPc/M3pdb2OBS99fYhXwClqTOJ7XE=; b=CZOUMuwNsumKee8q7vMBbDb7jao0BfOpOh336eZDzYHSstdnyd+S7xVx8fhPmNVzf6 hYABOv8apvwDaLmOgydbqGQ1zLru70OkK+dsuOfO1G0nw1qvDhpfra5SGGEqNKrkdPRq jF6maay913ZhvaHf6ImIafulidEbvII1eYBmmbttFLaYvlJhsRSSVjFztqUK933aF8es 0d9gpGjsmtgAo4zOQIYU4Fn/p3T02KJIq4J4P45kg93GjsSBeVWJknvhoNK5XNvYj5AU bEwewyrSC1qdPHeYPNReLUzwKp9g5JUPOQV9YrEEPkQAUtNgwZzlf7Lct/fguLvLtqEP gxLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=Fi2BtyXxl19H//bPc/M3pdb2OBS99fYhXwClqTOJ7XE=; b=MEo6+2ok1r+LRxmqj++ajs9pcHRY11m852eS7d0+yjSWl7S3b/TOcHsip8Jkz+0vw+ FH0LEWCgUhY/crhRr4Xgzb2YCE6RBgihIInS3JVruBAsV8w0I41zN28LNKSJGMQux+pX xfgbWmvFJUZXniDPBhjcRAbB9wWvoHzr7akHAnUeh7p1lfvwqvDWlfjqjH/DP9HTf/CQ lAEMzsi60gOg0MosXS9H3Zuz5KDUkPbysF3Rez2J2POHCfyBj9VxcymzPrLVpcul4tme CPJDDJRVikLSC5afF9wLttudYV5opRDMzhzW+E4J8okn4z2/JR+78WxSX2gkS+jpCxzp Vs3Q== X-Gm-Message-State: AFeK/H3Wz9P3Tyb3AVx+uyVszkyNbfCpdPdINxOPZqOJ4xwBz7ejMOtygj4AXdafbfWjcA== X-Received: by 10.28.216.141 with SMTP id p135mr22192561wmg.71.1489606736238; Wed, 15 Mar 2017 12:38:56 -0700 (PDT) Received: from [192.168.1.18] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id o63sm1568470wmo.30.2017.03.15.12.38.54 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 15 Mar 2017 12:38:55 -0700 (PDT) From: Yoav Nir Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_963FAB8A-BC0D-486E-A536-6EF45A67792E"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Wed, 15 Mar 2017 21:38:52 +0200 In-Reply-To: Cc: Eric Rescorla , Stephen Farrell , "tls@ietf.org" , IESG To: David Benjamin References: <77ef8038-32ae-affa-341e-b104fc28a343@cs.tcd.ie> <13268B67-A6EA-4B4C-9D16-C982A6EE92AA@gmail.com> X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Review of draft-ietf-tls-rfc4492bis-15 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 19:39:01 -0000 --Apple-Mail=_963FAB8A-BC0D-486E-A536-6EF45A67792E Content-Type: multipart/alternative; boundary="Apple-Mail=_F4FCB91B-9460-43F3-A15B-889F168AE659" --Apple-Mail=_F4FCB91B-9460-43F3-A15B-889F168AE659 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii LGTM > On 15 Mar 2017, at 21:32, David Benjamin = wrote: >=20 > How's this look? https://github.com/tlswg/rfc4492bis/pull/37 = >=20 > On Wed, Mar 15, 2017 at 2:45 PM Yoav Nir > wrote: > There is (going to be a re-spin). There already is a PR there. >=20 > If you can make a PR to solve your issue, that would be great. >=20 >> On 15 Mar 2017, at 19:20, David Benjamin > wrote: >>=20 >> If there's to be a respin anyway, I have another small editorial = comment: >> https://github.com/tlswg/rfc4492bis/issues/36 = >>=20 >> On Wed, Mar 15, 2017 at 11:22 AM Eric Rescorla > wrote: >> FWIW, there's a lot here, but I think it's all essentially editorial, = so it shouldn't >> be that hard to clean up. >>=20 >> -Ekr >>=20 >>=20 >> On Wed, Mar 15, 2017 at 8:07 AM, Stephen Farrell = > wrote: >>=20 >> Thanks Eric, >>=20 >> Let's see what folks say in response to this and I can post >> anything not immediately resolved as a DISCUSS ballot. We >> can then process that in the coming week or two, and you >> can take over the DISCUSS for whatever's not resolved by >> the swap-over in Chicago. Or if someone else wants to >> make some or all of Eric's comments a DISCUSS that'd work >> too, but I'm fine with taking it. >>=20 >> Cheers, >> S. >>=20 >> On 15/03/17 14:44, Eric Rescorla wrote: >> > Sorry for the late review of this document. I just got to it this >> > week. I'm sending this as comments rather than issues/PR due to >> > how late it is in the proces. >> > >> > I have two high-level comments: >> > >> > - This document seems to still have a bunch of material about >> > static DH (especially static DH authentication). I thought we >> > had agreed to remove that. >> > >> > - You are inconsistent about using capital 2119 language >> > and I expect you want to be consistent. >> > >> > >> > DETAILED >> > S 2. >> > All of these key exchange algorithms provide forward secrecy. >> > >> > This is actually only true if each side generates fresh ephemerals >> > which does not seem to be required by the spec. >> > >> > Do we really want to promote ECDH_anon to standards track? >> > >> > >> > Nit: you want a line break between the last line of Figure 1 >> > and the legend explaining the message types. >> > >> > >> > S 2.3. >> > This specification does not impose restrictions on signature = schemes >> > used anywhere in the certificate chain. The previous version of = this >> > document required the signatures to match, but this restriction, >> > originating in previous TLS versions is lifted here as it had = been in >> > RFC 5246. >> > >> > This section is about ECDH_anon, so maybe this text belongs in S = 2.1 or >> > 2.2.? >> > >> > >> > S 3. >> > You have a bunch of lower case 2119 key words here. >> > >> > If these conditions are not met, the client should send a client >> > Certificate message containing no certificates. In this case, = the >> > ClientKeyExchange should be sent as described in Section 2, and = the >> > CertificateVerify should not be sent. If the server requires = client >> > authentication, it may respond with a fatal handshake failure = alert. >> > >> > Actually, this "should not be sent" is a MUST NOT, because if you = send >> > an empty certificate, you're forbidden to send CertificateVerify. >> > >> > >> > S 4. >> > choice of curves and compression techniques specified by the = client. >> > >> > s/compression techniques/point formats/? >> > >> > >> > S 5.1.1. >> > Do you want to rename elliptic_curve_list to named_curve_list? >> > >> > >> > S 5.1.2. >> > >> > Three point formats were included in the definition of = ECPointFormat >> > above. This specification deprecates all but the uncompressed = point >> > format. Implementations of this document MUST support the >> > uncompressed format for all of their supported curves, and MUST = NOT >> > support other formats for curves defined in this specification. = For >> > backwards compatibility purposes, the point format list = extension >> > MUST still be included, and contain exactly one value: the >> > uncompressed point format (0). >> > >> > This implies that you have to send supported point formats, but in >> > S 5.1, this is a SHOULD. I believe what you may be trying to say >> > here is that if you send the extension, it must be non-empty. >> > >> > Also, maybe I'm missing it, but where do you say that the default >> > is to assume that the other side supports uncompressed if it = doesn't >> > do so. This is a backwards compat issue. >> > >> > >> > S 5.3. >> > You don't define what "authorized for signatures" is, but I suspect >> > you're talking about KeyUsage, etc.? If so, don't you need to say >> > this about ECDHE_ECDSA as well. >> > >> > S 5.4. >> > The value named_curve indicates that a named curve is used. = This >> > option SHOULD be used when applicable. >> > >> > When would you not? >> > >> > S 5.5. >> > This defines: >> > rsa_fixed_ecdh(65), >> > ecdsa_fixed_ecdh(66), >> > >> > But the specification doesn't actually support this. Note that >> > the fixed_DH authentication mechanism are specified as having >> > the client's cert be on the same curve as the long-term >> > ECDH key, but you've deprecated those KE mechanisms, so as far >> > as I can tell, static DH auth is impossible >> > >> > Also: >> > 1. Why isn't the ECDSA cert required to be signing capable. >> > 2. You probably should standardize on ECDSA_sign or ecdsa_sign. >> > >> > S 5.7. >> > More text about static DH auth. Also "implicit" can probably go = away. >> > >> > The client selects an ephemeral ECDH public key corresponding to = the >> > parameters it received from the server according to the = ECKAS-DH1 >> > scheme from IEEE 1363. It conveys this information to the = client in >> > the ClientKeyExchange message using the format defined above. >> > >> > I don't understand what this means. >> > >> > >> > S 5.8. >> > This message is sent when the client sends a client certificate >> > containing a public key usable for digital signatures, e.g., = when the >> > client is authenticated using the ECDSA_sign mechanism. >> > >> > This is the only way that things can work now. >> > >> > >> > S 5.1.1. >> > Failing to >> > do so allows attackers to gain information about the private = key, to >> > the point that they may recover the entire private key in a few >> > requests, if that key is not really ephemeral. >> > >> > To the best of my knowledge, this only applies to DH, not signature >> > verification. >> > >> > S 6. >> > Do we really want to promote NULL and 3DES to ST? >> > >> > -Ekr >> > >> > >> > >> > _______________________________________________ >> > TLS mailing list >> > TLS@ietf.org >> > https://www.ietf.org/mailman/listinfo/tls = >> > >>=20 >>=20 >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls = >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls = >=20 --Apple-Mail=_F4FCB91B-9460-43F3-A15B-889F168AE659 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii LGTM

On 15 Mar 2017, at 21:32, David = Benjamin <davidben@chromium.org> wrote:

How's this look? https://github.com/tlswg/rfc4492bis/pull/37

On Wed, Mar 15, 2017 at 2:45 PM Yoav Nir <ynir.ietf@gmail.com>= wrote:
There is (going to be a re-spin). There already is a = PR there.

If you can make a PR to solve your issue, that would = be great.

On 15 Mar 2017, at 19:20, David Benjamin <davidben@chromium.org> wrote:

If there's to = be a respin anyway, I have another small editorial comment:
https://github.com/tlswg/rfc4492bis/issues/36

On Wed, Mar 15, 2017 at = 11:22 AM Eric Rescorla <ekr@rtfm.com> wrote:
FWIW, = there's a lot here, but I think it's all essentially editorial, so it = shouldn't
be that hard to clean up.

-Ekr


On Wed, Mar 15, 2017 at 8:07 AM, Stephen = Farrell <stephen.farrell@cs.tcd.ie> wrote:

Thanks Eric,

Let's see what folks say in response to this and I can post
anything not immediately resolved as a DISCUSS ballot. We
can then process that in the coming week or two, and you
can take over the DISCUSS for whatever's not resolved by
the swap-over in Chicago. Or if someone else wants to
make some or all of Eric's comments a DISCUSS that'd work
too, but I'm fine with taking it.

Cheers,
S.

On 15/03/17 14:44, Eric Rescorla wrote:
> Sorry for the late review of this document. I just got to it = this
> week. I'm sending this as comments rather than issues/PR due to
> how late it is in the proces.
>
> I have two high-level comments:
>
> - This document seems to still have a bunch of material about
>   static DH (especially static DH authentication). I = thought we
>   had agreed to remove that.
>
> - You are inconsistent about using capital 2119 language
>   and I expect you want to be consistent.
>
>
> DETAILED
> S 2.
>    All of these key exchange algorithms provide forward = secrecy.
>
> This is actually only true if each side generates fresh = ephemerals
> which does not seem to be required by the spec.
>
> Do we really want to promote ECDH_anon to standards track?
>
>
> Nit: you want a line break between the last line of Figure 1
> and the legend explaining the message types.
>
>
> S 2.3.
>    This specification does not impose restrictions on = signature schemes
>    used anywhere in the certificate chain.  The = previous version of this
>    document required the signatures to match, but this = restriction,
>    originating in previous TLS versions is lifted here as = it had been in
>    RFC 5246.
>
> This section is about ECDH_anon, so maybe this text belongs in S = 2.1 or
> 2.2.?
>
>
> S 3.
> You have a bunch of lower case 2119 key words here.
>
>    If these conditions are not met, the client should = send a client
>    Certificate message containing no certificates.  = In this case, the
>    ClientKeyExchange should be sent as described in = Section 2, and the
>    CertificateVerify should not be sent.  If the = server requires client
>    authentication, it may respond with a fatal handshake = failure alert.
>
> Actually, this "should not be sent" is a MUST NOT, because if you = send
> an empty certificate, you're forbidden to send = CertificateVerify.
>
>
> S 4.
>    choice of curves and compression techniques specified = by the client.
>
> s/compression techniques/point formats/?
>
>
> S 5.1.1.
> Do you want to rename elliptic_curve_list to named_curve_list?
>
>
> S 5.1.2.
>
>    Three point formats were included in the definition of = ECPointFormat
>    above.  This specification deprecates all but the = uncompressed point
>    format.  Implementations of this document MUST = support the
>    uncompressed format for all of their supported curves, = and MUST NOT
>    support other formats for curves defined in this = specification.  For
>    backwards compatibility purposes, the point format = list extension
>    MUST still be included, and contain exactly one value: = the
>    uncompressed point format (0).
>
> This implies that you have to send supported point formats, but = in
> S 5.1, this is a SHOULD. I believe what you may be trying to say
> here is that if you send the extension, it must be non-empty.
>
> Also, maybe I'm missing it, but where do you say that the = default
> is to assume that the other side supports uncompressed if it = doesn't
> do so. This is a backwards compat issue.
>
>
> S 5.3.
> You don't define what "authorized for signatures" is, but I = suspect
> you're talking about KeyUsage, etc.? If so, don't you need to = say
> this about ECDHE_ECDSA as well.
>
> S 5.4.
>    The value named_curve indicates that a named curve is = used.  This
>    option SHOULD be used when applicable.
>
> When would you not?
>
> S 5.5.
> This defines:
>              = rsa_fixed_ecdh(65),
>              = ecdsa_fixed_ecdh(66),
>
> But the specification doesn't actually support this. Note that
> the fixed_DH authentication mechanism are specified as having
> the client's cert be on the same curve as the long-term
> ECDH key, but you've deprecated those KE mechanisms, so as far
> as I can tell, static DH auth is impossible
>
> Also:
> 1. Why isn't the ECDSA cert required to be signing capable.
> 2. You probably should standardize on ECDSA_sign or ecdsa_sign.
>
> S 5.7.
> More text about static DH auth. Also "implicit" can probably go = away.
>
>    The client selects an ephemeral ECDH public key = corresponding to the
>    parameters it received from the server according to = the ECKAS-DH1
>    scheme from IEEE 1363.  It conveys this = information to the client in
>    the ClientKeyExchange message using the format defined = above.
>
> I don't understand what this means.
>
>
> S 5.8.
>    This message is sent when the client sends a client = certificate
>    containing a public key usable for digital signatures, = e.g., when the
>    client is authenticated using the ECDSA_sign = mechanism.
>
> This is the only way that things can work now.
>
>
> S 5.1.1.
>    Failing to
>    do so allows attackers to gain information about the = private key, to
>    the point that they may recover the entire private key = in a few
>    requests, if that key is not really ephemeral.
>
> To the best of my knowledge, this only applies to DH, not = signature
> verification.
>
> S 6.
> Do we really want to promote NULL and 3DES to ST?
>
> -Ekr
>
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>


_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
_______________________________________________
TLS= mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


= --Apple-Mail=_F4FCB91B-9460-43F3-A15B-889F168AE659-- --Apple-Mail=_963FAB8A-BC0D-486E-A536-6EF45A67792E Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYyZhNAAoJELhJCxUKWMyZqRYH/AjcaOykprywFE5Y2uSFZvY+ nXHOHEC9/AUAqS3c5ZgJ5i3F4vUn1yyN/DWm3d5As5Cc5KaCDmdutj5JhnK7Lurg gFxUp1BO44nIi2woPEROMV7EKotJQ6xK7jGn88QGY4QhX4Nj9TC7P1tu4EzHlllA 3G7q3nWACk2RC7tvYVLuAfPCc0wY3Tlr0EicScXFlv0Nq4iYXVeDBcOoEcAuPpOr C+cC2x/8YG0nCDz4MCbAQzDmtaGAys3bQ20/SH1BfV+uTKtT9Dx/smKMHSE+e/O/ 6M4siEm7L0nU/e7c6jGPOoDMtBNMN6RggXlI4PfLPqx+Ec3WVYWkpl84oyhiq0w= =CPl2 -----END PGP SIGNATURE----- --Apple-Mail=_963FAB8A-BC0D-486E-A536-6EF45A67792E-- From nobody Wed Mar 15 12:57:38 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A936D1317F5 for ; Wed, 15 Mar 2017 12:57:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ukda3uVdVYWA for ; Wed, 15 Mar 2017 12:57:34 -0700 (PDT) Received: from mail-ua0-x22d.google.com (mail-ua0-x22d.google.com [IPv6:2607:f8b0:400c:c08::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4E09F1317D9 for ; Wed, 15 Mar 2017 12:57:34 -0700 (PDT) Received: by mail-ua0-x22d.google.com with SMTP id q7so14834574uaf.2 for ; Wed, 15 Mar 2017 12:57:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=D+EqsXtIcQQjVmDVhIEA1xVoKZjo+Ly4KPeZt0DzGF0=; b=FWWRKCa+1DKaKlxQCJentXEl/8PB3pJzKlusXbtccLmNDf7LbJpCtMHpFyD6mnggVT 3qqehFWLnAHsbKaqG54Pw6Sfcrh/qoK/g99B5JhaayX4r2pX883mfi7Eib3DbQOzlgcB GR/u57I8VAJSHxhUWU6VzfEzxRl3k2oya0Dd8pXAI5fuhAxhM8GH0o21xjoamVgWae50 5qxkjGPXNHk6FjNWRYDhC+5cjTE7HpOvuD5rTLxHYMQWhIf/KDKAgfDhKGb2EqchJnx7 ueB6NpAhi90yju7CZRsDsPn9pnEn/QGldR/NhbLBJAndS3ErGzEfqW8ty4x6grwKKwQx RSSQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=D+EqsXtIcQQjVmDVhIEA1xVoKZjo+Ly4KPeZt0DzGF0=; b=ro+1vXsTKrEADrnk6QjHnc8Ul/3mFRkb2N/p+F9apfNPrLeE7JAABRi2EMxiGz2lbP 9UjCqnMymzMb6JllWvPTKYEld4fwDwg2wmugiM1jQnJGqTTLLIj96fYCmjxnbfs6EL2Y VzXyTu+ScZTZ8x3DMPOK+bxJgab0Y/Gu8zPbrNSUaxdjtUh8vLioRr0m7xpbtoUNbveR 0wDAgQrMVHZ0IhKRZId9Q7PdO8v3SD+qfru0Y2D/Kf4MGkONHhBH/lvrc2LobXm9f1ZZ E59tRbJl5PfmZqlLFNmqQqjy9hgyzoidMliqQtC03mG1NtsJI2rRnFO3dtxCbhEtWyDA DRcg== X-Gm-Message-State: AFeK/H3ymaLnPMVTGq0SomhdvUzYzMzSULLIJNBjFcE+Np3GapyG23EtJqm25EAb669ewH94DGYlp5R6QicIDg== X-Received: by 10.176.84.213 with SMTP id q21mr2267707uaa.24.1489607853301; Wed, 15 Mar 2017 12:57:33 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Nick Sullivan Date: Wed, 15 Mar 2017 19:57:22 +0000 Message-ID: To: Brian Sniffen , Joseph Salowey , "tls@ietf.org" Content-Type: multipart/alternative; boundary=94eb2c1b0f74f3674d054aca5af4 Archived-At: Subject: Re: [TLS] Interest in draft-sullivan-tls-exported-authentication X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 19:57:37 -0000 --94eb2c1b0f74f3674d054aca5af4 Content-Type: text/plain; charset=UTF-8 Hi Brian, Thanks for your comments. Answers inline. On Mon, Mar 13, 2017 at 8:13 PM Brian Sniffen wrote: > Can you help me understand what this means? > > servers that are authoritative for multiple domains the same > connection but do not have a certificate that is simultaneously > authoritative for all of them > > I'm sure there's a word or two missing between "domains" and "the" in > the first line, but I'm not sure what they are. > This should be: servers that are authoritative for multiple domains but do not have a certificate that is simultaneously authoritative for all of them A common example is an HTTPS reverse proxy that sits in front of domain1 and domain2, has a certificate for each, but not a single certificate that covers both. > > More generally, it's great to see a replacement for renegotiation. Can > you expand (maybe just here?) on the last paragraph of the security > considerations? I think you mean that the sender of an authenticator > can't tell when it was received & understood. But I'm not sure the > receiver can tell when it was sent---say, in the case of a smartcard > insertion, or access to a key from satisfying some local attestation > scheme, whether that key access precedes or follows the sending of a > request. > The application protocol can and should do the accounting for which exported authenticators are created and when they are accepted. The authenticating application can choose its own context id when creating the authenticator and the reciever can use it to map the opaque blob back to the same context id. Here's a simple example: - Party 1 creates an authenticator A1 = authenticate(id1, cert chain, key) - Party 1 sends A1 to Party 2 as part of the application protocol (say as an H2 frame) - Party 2 receives and validates A1, obtaining id1 and cert chain - Party 2 sends back an ACK message such as (id1, valid) at the Application layer. At this point, both parties know the authentication status of the connection and the TLS layer does not. The application keeps track of the accounting, the TLS layer just mints and validates authenticators. This enables applications like HTTP/2 to use TLS certificates for features that would have previously used renegotiation. Nick > -Brian > > Nick Sullivan writes: > > > All, > > > > I have updated the draft in preparation for the IETF 98: > > https://tools.ietf.org/html/draft-sullivan-tls-exported-authenticator-01 > > > > The details of the protocol haven't changed, but I've included some > > security considerations after speaking with Karthikeyan Bhargavan and > > others about the cryptographic soundness of the construction. > > > > Nick > > > > On Tue, Jan 3, 2017 at 8:59 PM Joseph Salowey wrote: > > > >> There seemed to be support for > draft-sullivan-tls-exported-authentication > >> ( > https://tools.ietf.org/html/draft-sullivan-tls-exported-authenticator-00) > >> in Seoul. Since there has not been much discussion of this draft on > the > >> list we are giving the working group a chance to review the draft before > >> calling for adoption later this month. > >> > >> Cheers, > >> > >> J&S > >> _______________________________________________ > >> TLS mailing list > >> TLS@ietf.org > >> https://www.ietf.org/mailman/listinfo/tls > >> > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls > > -- > Brian Sniffen > Akamai Technologies > --94eb2c1b0f74f3674d054aca5af4 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi Brian,

Thanks for your comments.= Answers inline.

On Mon, Mar 13, 2017 at 8:13 PM Brian Sniffen <bsniffen@akamai.com> wrote:
Can you help me understand what this means?

=C2=A0 =C2=A0 =C2=A0 servers that are authoritative for multiple domains th= e same
=C2=A0 =C2=A0 =C2=A0 connection but do not have a certificate that is simul= taneously
=C2=A0 =C2=A0 =C2=A0 authoritative for all of them

I'm sure there's a word or two missing between "domains" = and "the" in
the first line, but I'm not sure what they are.
=

This should be:
servers that are author= itative for multiple domains but do not
have a certificate that is simul= taneously authoritative for all of them
=C2=A0
A common exampl= e is an HTTPS reverse proxy that sits in front of
domain1 and domain2, h= as a certificate for each, but not a single certificate
that = covers both.



More generally, it's great to see a replacement for renegotiation.=C2= =A0 Can
you expand (maybe just here?) on the last paragraph of the security
considerations?=C2=A0 I think you mean that the sender of an authenticator<= br class=3D"gmail_msg"> can't tell when it was received & understood.=C2=A0 But I'm not= sure the
receiver can tell when it was sent---say, in the case of a smartcard
insertion, or access to a key from satisfying some local attestation
scheme, whether that key access precedes or follows the sending of a
request.

The applic= ation protocol can and should do the accounting for which
exported authe= nticators are created and when they are accepted.
The authenticating app= lication can choose its own context id when
creating the authenticator a= nd the reciever can use it to map the opaque
blob back to the same conte= xt id.

Here's a simple example:
- Party= 1 creates an authenticator A1 =3D authenticate(id1, cert chain, key)
- = Party 1 sends A1 to Party 2 as part of the application protocol (say as an = H2 frame)
- Party 2 receives and validates A1, obtaining id1 = and cert chain
- Party 2 sends back an ACK message such as (id1, valid) = at the Application layer.

At this point, both parties kno= w the authentication status of the connection and the TLS layer does not. T= he application keeps track of the accounting, the TLS layer just mints and = validates
authenticators. This enables applications like HTTP= /2 to use TLS certificates for
features that would have previ= ously used renegotiation.

Nick


-Brian

Nick Sullivan <nicholas.sullivan@gmail.com> writes:

> All,
>
> I have updated the draft in preparation for the IETF 98:
> htt= ps://tools.ietf.org/html/draft-sullivan-tls-exported-authenticator-01 >
> The details of the protocol haven't changed, but I've included= some
> security considerations after speaking with Karthikeyan Bhargavan and<= br class=3D"gmail_msg"> > others about the cryptographic soundness of the construction.
>
> Nick
>
> On Tue, Jan 3, 2017 at 8:59 PM Joseph Salowey <joe@salowey.net>= ; wrote:
>
>> There seemed to be support for draft-sullivan-tls-exported-authent= ication
>> (https://tools.ietf.org/html/draft-sullivan-tls-exported-authenticator-00<= /a>)
>> in Seoul.=C2=A0 =C2=A0Since there has not been much discussion of = this draft on the
>> list we are giving the working group a chance to review the draft = before
>> calling for adoption later this month.
>>
>> Cheers,
>>
>> J&S
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org
>> https://www.ietf.org/mailman/l= istinfo/tls
>>
> _______________________________________________
> TLS mailing list
> = TLS@ietf.org
> https://www.ietf.org/mailman/listi= nfo/tls

--
Brian Sniffen
Akamai Technologies
--94eb2c1b0f74f3674d054aca5af4-- From nobody Wed Mar 15 13:25:49 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D1F7113181A for ; Wed, 15 Mar 2017 13:25:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GAgv0vFn0p-3 for ; Wed, 15 Mar 2017 13:25:46 -0700 (PDT) Received: from mail-pf0-x229.google.com (mail-pf0-x229.google.com [IPv6:2607:f8b0:400e:c00::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB36B1317F9 for ; Wed, 15 Mar 2017 13:25:45 -0700 (PDT) Received: by mail-pf0-x229.google.com with SMTP id x63so8270572pfx.2 for ; Wed, 15 Mar 2017 13:25:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:from:date:message-id:subject:to; bh=oeh/hIXCANxcYQO9t/g7TYXJd9k6VTzFXx9T2NuyJU0=; b=QPQmQ3gm8sDLaBufPgrp98Cz7tTpQWznnpqerdZYjpbtvkRT4GJrOj5+g1fjG44L7+ JGlICE1xcQfnAdm60zDyAk3cun92GIg2mrhIOt7QR2F7gMXoDj9SoaxZRsIhAik7ZXX9 +FG3Tn0bbR57iIkCNEMkSZI6XCAla3gfBZG2k= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=oeh/hIXCANxcYQO9t/g7TYXJd9k6VTzFXx9T2NuyJU0=; b=NTn2ffEXVdZ+WZOE4MzSsbeVWwkMgHyh9pLVPm6jP3iQoV7zymAQig1xKLsssKkGva 6ZC5ErBgyOVXAh87FAU+imj9wcnXEPKvIP3LTbz+BxZWILt8pfcDuBvGyTmKuLfs7J/b VtEbZaIh+DoaaJbj4YQWjrQ/My5pMRNzb5Wc5vbsLviHHAKQ0ASQYLs0D9Kq95eIJFdM HJhTvoPukinFp2PW+Rred+JuSrc1lDdlD2WniTFl0wup+dK/1p5tOftovYq25171Ehr1 sYRXWSw3037XFyV0262T7KJtqUjf0TiLL2IDFWMaKQ+f2DJ4lKOCLQmFotUqiLYiFT1o RFtA== X-Gm-Message-State: AFeK/H154ocnz6lU1HuH3Hf1XnYJ7kJcc2GN4raxExTEEwn3oaeUMOGwYl8Fyd5x0ThWNVSnPq5rxiXCkeaITnG0 X-Received: by 10.84.232.198 with SMTP id x6mr7014255plm.74.1489609545230; Wed, 15 Mar 2017 13:25:45 -0700 (PDT) MIME-Version: 1.0 From: David Benjamin Date: Wed, 15 Mar 2017 20:25:34 +0000 Message-ID: To: "tls@ietf.org" Content-Type: multipart/alternative; boundary=f403043621c8cc7290054acabf99 Archived-At: Subject: [TLS] draft-ietf-tls-rfc4492bis-15 and the X25519 significant bit. X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 20:25:48 -0000 --f403043621c8cc7290054acabf99 Content-Type: text/plain; charset=UTF-8 draft-ietf-tls-rfc4492bis-15, section 5.11, contains the following text: Since there are some implementation of the X25519 function that impose this restriction on their input and others that don't, implementations of X25519 in TLS SHOULD reject public keys when the high-order bit of the final byte is set (in other words, when the value of the rightmost byte is greater than 0x7F) in order to prevent implementation fingerprinting. Note that this deviates from RFC 7748 which suggests that This value be masked. https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-15#section-5.11 There was a thread about this way back, but it seems not to have come to a clear conclusion: https://www.ietf.org/mail-archive/web/tls/current/msg18821.html Since then, RFC 7748 has been published and X25519 in TLS has been shipped by several implementations. From my testing, none of BoringSSL, Cloudflare servers (tls-tris?), Go, NSS, or OpenSSL implement this check. They all mask off that bit, as RFC 7748 prescribes. (These were all the implementations I tested.) RFC 7748 provides a function on bytes, so, barring strong reasons not to, I think it is best for TLS to simply reference RFC 7748 as-is. The stated motivation is preventing implementation fingerprinting, yet all the implementations listed mask. This paragraph also does not align with the current TLS 1.3 draft. Thus, I would suggest the paragraph be removed from the document. It would then prescribe RFC 7748's behavior which is to mask off that bit. Do others agree? David --f403043621c8cc7290054acabf99 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
draft-ietf-tls-rfc449= 2bis-15, section 5.11, contains the following text:
=

=C2=A0 =C2=A0Since there are some implementat= ion of the X25519 function that
=C2=A0 =C2=A0= impose this restriction on their input and others that don't,
=C2=A0 =C2=A0implementations of X25519 in TLS SHOULD r= eject public keys when the
=C2=A0 =C2=A0high-= order bit of the final byte is set (in other words, when the
=C2=A0 =C2=A0value of the rightmost byte is greater than 0x= 7F) in order to prevent
=C2=A0 =C2=A0implemen= tation fingerprinting.=C2=A0 Note that this deviates from RFC 7748
=C2=A0 =C2=A0which suggests that This value be masked= .


There was a thread about this way back, but it seems n= ot to have come to a clear conclusion:
https://www.ietf.org/mail-archive/web/tls/= current/msg18821.html

Since then, RFC 7748 has been published= and X25519 in TLS has been shipped by several implementations. From my tes= ting, none of BoringSSL, Cloudflare servers (tls-tris?), Go, NSS, or OpenSS= L implement this check. They all mask off that bit, as RFC 7748 prescribes.= (These were all the implementations I tested.)

RFC 7748 provides= a function on bytes, so, barring strong reasons not to, I think it is best= for TLS to simply reference RFC 7748 as-is. The stated motivation is preve= nting implementation fingerprinting, yet all the implementations listed mas= k. This paragraph also does not align with the current TLS 1.3 draft.
=

Thus, I would suggest the paragraph be removed from the document. It w= ould then prescribe RFC 7748's behavior which is to mask off that bit. = Do others agree?

David
--f403043621c8cc7290054acabf99-- From nobody Wed Mar 15 13:29:57 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A21A5131830 for ; Wed, 15 Mar 2017 13:29:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zcqb8gLlb4MF for ; Wed, 15 Mar 2017 13:29:53 -0700 (PDT) Received: from mail-yw0-x22b.google.com (mail-yw0-x22b.google.com [IPv6:2607:f8b0:4002:c05::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A471A1317F9 for ; Wed, 15 Mar 2017 13:29:53 -0700 (PDT) Received: by mail-yw0-x22b.google.com with SMTP id v198so18677728ywc.2 for ; Wed, 15 Mar 2017 13:29:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Rf63PTh+8U0yM63Wd/QD8Da6svpY/w0lg924dMMgY50=; b=ktaId5XgQXPJvzg4LbY55Uh7IY20faVmaXMGf+08nR5eUrKW/MvR7vQ+/TUIK3tnNz aL1OX7owlaVZ5xrsn47z6fr7eXshKWOwU72yxz+PgPYNZu8GBJkveuqzho7XjS7y6C3P wiBShOdbPjlTf7R2Xf1khpZtMznDGFMW3Xq4govGXseJ8e34Fg/dLPGQKB28BHIS6qKd HqoqADL6myDPkiN+JX6kzFNwvDQUmXeyiWM/xkpxDiEBr4dy86rcnz4Ykh/ZQJK6bkrT U8iDwa2gfbHWKrWwRBtTKheEf2dJ1Op5TcfHWgY2oCvyUM9w8fth366gPOJ6h4locFJv qh9Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Rf63PTh+8U0yM63Wd/QD8Da6svpY/w0lg924dMMgY50=; b=dgwt0BJmhg2l4QjzM7HBkQ7vpGZG4fNEozOtmMxXy3OJAQve/X7CE11JsxxhH9V910 byv+0f8eGGVB9tkq5V7wZXsHvwzFq9y9FtnW1KqPld4LjoJwvKSqZqgUHonJWr86wXOk dV3kxgShedM0s5MEu3XUcTTkVuIBd5eL6aicwa1wCmAt58EdbDNmosAmpc6TJyebve1c YS7zRGOqIEUgw6i+3U1oRn0Qx0uMcS3hB+Oq9PPaTnA1r7kng+R3xGY9qb5H2sZazRd/ CJRNDfIuaClnGzRFmcr0ZQHmR+yk/enmmFfMDQKY7Mr/i2xKnjbMP4QrhG8kdhWbRBSz 1qhA== X-Gm-Message-State: AFeK/H3gO2h+Kpcy+UinvQxwreP7RGXsJYtdral95abRJW3VYkLpx7/zf7YMrxz0vEv06VH8kuPJW4DQJBLlZA== X-Received: by 10.129.152.22 with SMTP id p22mr4414291ywg.276.1489609792757; Wed, 15 Mar 2017 13:29:52 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Wed, 15 Mar 2017 13:29:12 -0700 (PDT) In-Reply-To: References: From: Eric Rescorla Date: Wed, 15 Mar 2017 13:29:12 -0700 Message-ID: To: David Benjamin Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary=94eb2c0b8fb48d69e5054acacec9 Archived-At: Subject: Re: [TLS] draft-ietf-tls-rfc4492bis-15 and the X25519 significant bit. X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 20:29:56 -0000 --94eb2c0b8fb48d69e5054acacec9 Content-Type: text/plain; charset=UTF-8 This seems like compelling logic. The fingerprinting concern doesn't seem that serious in any case. -Ekr On Wed, Mar 15, 2017 at 1:25 PM, David Benjamin wrote: > draft-ietf-tls-rfc4492bis-15, section 5.11, contains the following text: > > Since there are some implementation of the X25519 function that > impose this restriction on their input and others that don't, > implementations of X25519 in TLS SHOULD reject public keys when the > high-order bit of the final byte is set (in other words, when the > value of the rightmost byte is greater than 0x7F) in order to prevent > implementation fingerprinting. Note that this deviates from RFC 7748 > which suggests that This value be masked. > > https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-15#section-5.11 > > There was a thread about this way back, but it seems not to have come to a > clear conclusion: > https://www.ietf.org/mail-archive/web/tls/current/msg18821.html > > Since then, RFC 7748 has been published and X25519 in TLS has been shipped > by several implementations. From my testing, none of BoringSSL, Cloudflare > servers (tls-tris?), Go, NSS, or OpenSSL implement this check. They all > mask off that bit, as RFC 7748 prescribes. (These were all the > implementations I tested.) > > RFC 7748 provides a function on bytes, so, barring strong reasons not to, > I think it is best for TLS to simply reference RFC 7748 as-is. The stated > motivation is preventing implementation fingerprinting, yet all the > implementations listed mask. This paragraph also does not align with the > current TLS 1.3 draft. > > Thus, I would suggest the paragraph be removed from the document. It would > then prescribe RFC 7748's behavior which is to mask off that bit. Do others > agree? > > David > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > --94eb2c0b8fb48d69e5054acacec9 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
This seems like compelling logic. The fingerprinting conce= rn doesn't seem that serious in any case.

-Ekr
=


On Wed, Mar 15, 2017 at 1:25 PM, David Benjamin <<= a href=3D"mailto:davidben@chromium.org" target=3D"_blank">davidben@chromium= .org> wrote:
draft-ietf-tls= -rfc4492bis-15, section 5.11, contains the following text:
<= br class=3D"m_1135032129247713533gmail_msg">
=C2=A0 = =C2=A0Since there are some implementation of the X25519 function that
=
=C2=A0 =C2=A0impose this rest= riction on their input and others that don't,
=C2=A0 =C2=A0implementations of X25519 in TLS SHO= ULD reject public keys when the
=C2=A0 =C2=A0high-order bit of the final byte is set (in other word= s, when the
=C2=A0 =C2= =A0value of the rightmost byte is greater than 0x7F) in order to prevent
=C2=A0 =C2=A0implementatio= n fingerprinting.=C2=A0 Note that this deviates from RFC 7748
=C2=A0 =C2=A0which suggests that This= value be masked.
=
https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-15#= section-5.11

There was = a thread about this way back, but it seems not to have come to a clear conc= lusion:
https://www.ietf.org/mail-= archive/web/tls/current/msg18821.html

<= div class=3D"m_1135032129247713533gmail_msg">Since then, RFC 7748 has been = published and X25519 in TLS has been shipped by several implementations. Fr= om my testing, none of BoringSSL, Cloudflare servers (tls-tris?), Go, NSS, = or OpenSSL implement this check. They all mask off that bit, as RFC 7748 pr= escribes. (These were all the implementations I tested.)

RFC 7748 provides a = function on bytes, so, barring strong reasons not to, I think it is best fo= r TLS to simply reference RFC 7748 as-is. The stated motivation is preventi= ng implementation fingerprinting, yet all the implementations listed mask. = This paragraph also does not align with the current TLS 1.3 draft.

Thus, I wo= uld suggest the paragraph be removed from the document. It would then presc= ribe RFC 7748's behavior which is to mask off that bit. Do others agree= ?
<= div class=3D"m_1135032129247713533gmail_msg">
David

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--94eb2c0b8fb48d69e5054acacec9-- From nobody Wed Mar 15 13:47:54 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CED60131828 for ; Wed, 15 Mar 2017 13:47:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GEmpi4NrFv6T for ; Wed, 15 Mar 2017 13:47:51 -0700 (PDT) Received: from mail-pg0-x22e.google.com (mail-pg0-x22e.google.com [IPv6:2607:f8b0:400e:c05::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 00ED61315A7 for ; Wed, 15 Mar 2017 13:47:50 -0700 (PDT) Received: by mail-pg0-x22e.google.com with SMTP id b129so14295461pgc.2 for ; Wed, 15 Mar 2017 13:47:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=MCFEWRsfiQvV+duQ6NUvxz4upJO0aWfv4HjIr/i6ioI=; b=B0yrYN2iXPyYEbdFQBr+XRcMkceRoN01cCvOsmyZNb+ZvG2bz7tD0oeWGA5bl08nUY tfOyPT8ToQAwBU16BNuTr8tMBitKI29OWk0YOlGRsSkJ2q/F2dKaeP5yARBMKJkpt969 IR1Ir6je9u88hbmOjI3wDqlmzHGLKwG6yVNyg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=MCFEWRsfiQvV+duQ6NUvxz4upJO0aWfv4HjIr/i6ioI=; b=P6EqTN8v6kUOwF3PMNnJJwvI28YQZWytV6CC/8GtdhfUn7pN1rkz39ODDXise/KJ4D cVsfaep/hvR14J0QnG3Gb05s2J0yYnLvbHUawl7C0b4E14JvknDxa3YK59jDnigfHqhz xUqkFx9GZYACUPmRD+pYkE5YO0HPyAUV3Hnn9puDI8ndjWvOKDTjjtF3c2FAofpJsNDr vGQhz/GV5JEQOP4lG1vdSrrtFX2QAs9C2dOT+/R0bk8uaPh2swjBTbrDW/O0Y7ca1gSC nhXN1P5pqxFzPLvJDtcm3VvSaFO4EFwr/NktNL1fOu3/mxuZdBsElDK7RRqx75gHIowZ 1kVw== X-Gm-Message-State: AFeK/H06k6wpTizu8r44wGCjiZrdVsQ4UaYc2uoVUdiu3iMtEHBAm1OBnXX/adUb6StwT12ySL1vJHA0sd8vwNw+ X-Received: by 10.84.210.167 with SMTP id a36mr7307269pli.40.1489610870497; Wed, 15 Mar 2017 13:47:50 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: David Benjamin Date: Wed, 15 Mar 2017 20:47:39 +0000 Message-ID: To: Eric Rescorla Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary=94eb2c1aaab8ca6dec054acb0e54 Archived-At: Subject: Re: [TLS] draft-ietf-tls-rfc4492bis-15 and the X25519 significant bit. X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 20:47:53 -0000 --94eb2c1aaab8ca6dec054acb0e54 Content-Type: text/plain; charset=UTF-8 The change was slightly more involved than just striking the paragraph, so I've put together a PR here. It makes that section much shorter: https://github.com/tlswg/rfc4492bis/pull/38 On Wed, Mar 15, 2017 at 4:29 PM Eric Rescorla wrote: > This seems like compelling logic. The fingerprinting concern doesn't seem > that serious in any case. > > -Ekr > > > On Wed, Mar 15, 2017 at 1:25 PM, David Benjamin > wrote: > > draft-ietf-tls-rfc4492bis-15, section 5.11, contains the following text: > > Since there are some implementation of the X25519 function that > impose this restriction on their input and others that don't, > implementations of X25519 in TLS SHOULD reject public keys when the > high-order bit of the final byte is set (in other words, when the > value of the rightmost byte is greater than 0x7F) in order to prevent > implementation fingerprinting. Note that this deviates from RFC 7748 > which suggests that This value be masked. > > https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-15#section-5.11 > > There was a thread about this way back, but it seems not to have come to a > clear conclusion: > https://www.ietf.org/mail-archive/web/tls/current/msg18821.html > > Since then, RFC 7748 has been published and X25519 in TLS has been shipped > by several implementations. From my testing, none of BoringSSL, Cloudflare > servers (tls-tris?), Go, NSS, or OpenSSL implement this check. They all > mask off that bit, as RFC 7748 prescribes. (These were all the > implementations I tested.) > > RFC 7748 provides a function on bytes, so, barring strong reasons not to, > I think it is best for TLS to simply reference RFC 7748 as-is. The stated > motivation is preventing implementation fingerprinting, yet all the > implementations listed mask. This paragraph also does not align with the > current TLS 1.3 draft. > > Thus, I would suggest the paragraph be removed from the document. It would > then prescribe RFC 7748's behavior which is to mask off that bit. Do others > agree? > > David > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > > --94eb2c1aaab8ca6dec054acb0e54 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
The change was slightly more involved than just striking t= he paragraph, so I've put together a PR here. It makes that section muc= h shorter:

On Wed, Mar 15, 2017 at 4:29 PM Eric Rescorla &= lt;ekr@rtfm.com> wrote:
This seems= like compelling logic. The fingerprinting concern doesn't seem that se= rious in any case.

-Ekr


On Wed, Mar 15, 2017 a= t 1:25 PM, David Benjamin <dav= idben@chromium.org> wrote:
=
draft-ietf-tls-rfc4492bis-15, section 5.11, contains the f= ollowing text:

=C2=A0 =C2=A0Since there are some implementatio= n of the X25519 function that
=C2=A0 =C2=A0impose this restriction o= n their input and others that don't,
=C2=A0 =C2=A0implementation= s of X25519 in TLS SHOULD reject public keys when the
=C2=A0 =C2=A0h= igh-order bit of the final byte is set (in other words, when the
=C2= =A0 =C2=A0value of the rightmost byte is greater than 0x7F) in order to pre= vent
=C2=A0 =C2=A0implementation fingerprinting.=C2=A0 Note that thi= s deviates from RFC 7748
=C2=A0 =C2=A0which suggests that This value= be masked.

https://tools.ietf.= org/html/draft-ietf-tls-rfc4492bis-15#section-5.11

The= re was a thread about this way back, but it seems not to have come to a cle= ar conclusion:
https://www.ietf.org/mail-archive/web= /tls/current/msg18821.html

Since then, RFC 7748 has bee= n published and X25519 in TLS has been shipped by several implementations. = >From my testing, none of BoringSSL, Cloudflare servers (tls-tris?), Go, NSS= , or OpenSSL implement this check. They all mask off that bit, as RFC 7748 = prescribes. (These were all the implementations I tested.)

<= div class=3D"m_4231351718791915107m_1135032129247713533gmail_msg gmail_msg"= >RFC 7748 provides a function on bytes, so, barring strong reasons not to, = I think it is best for TLS to simply reference RFC 7748 as-is. The stated m= otivation is preventing implementation fingerprinting, yet all the implemen= tations listed mask. This paragraph also does not align with the current TL= S 1.3 draft.

Thus, I would suggest the paragraph be removed= from the document. It would then prescribe RFC 7748's behavior which i= s to mask off that bit. Do others agree?

David
<= /div>

_______________________________________________
TLS mailing list
TLS@i= etf.org
https://www.ietf.org/mailman/listinfo/t= ls


--94eb2c1aaab8ca6dec054acb0e54-- From nobody Wed Mar 15 14:12:45 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B9B013184F for ; Wed, 15 Mar 2017 14:12:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9BAfyNMyomjg for ; Wed, 15 Mar 2017 14:12:41 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [IPv6:2620:100:9005:57f::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CADF113184B for ; Wed, 15 Mar 2017 14:12:40 -0700 (PDT) Received: from pps.filterd (m0050102.ppops.net [127.0.0.1]) by m0050102.ppops.net-00190b01. (8.16.0.20/8.16.0.20) with SMTP id v2FLCA5L028555; Wed, 15 Mar 2017 21:12:39 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-transfer-encoding : mime-version; s=jan2016.eng; bh=1l1vw2McyPNZyIbQaOOlPmhoQ2tUad7OPSfi9NxPypI=; b=M27154+XTCM/pk2afne8Ho9HuE8RfKzQ3JtdG0IxFprVOPQsHSELGLj7CCNFPThlPBjJ /P+VMs9MrfMWCnghvRD1N00wVttPpBYXZt1CN3Q7FsS+/DZE3HDv4EodgtZlsMTr3so2 ZrsZyW/PUUgoW8VXBfzKdIy9p/mPBhJoOJYbDFQ7JSP/e3lxjHzhnxj1u51N/8CpjnqL AxUOzBYrvSh8KyxRvJsYkRmshkNeBGNlO4/UyoZFbQvlBcifJ6x4KUJuHvX5dR6nQvRD Euq7q3tGA8bng6Trhe01AKtZkAMqafQ9pWSLr/BEEHUkeKzbvZ9ZQS9X52e3M4oCrU/Y gQ== Received: from prod-mail-ppoint2 (a184-51-33-19.deploy.static.akamaitechnologies.com [184.51.33.19] (may be forged)) by m0050102.ppops.net-00190b01. with ESMTP id 29713m3rvy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 15 Mar 2017 21:12:38 +0000 Received: from pps.filterd (prod-mail-ppoint2.akamai.com [127.0.0.1]) by prod-mail-ppoint2.akamai.com (8.16.0.17/8.16.0.17) with SMTP id v2FLBLWN009344; Wed, 15 Mar 2017 17:12:38 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.30]) by prod-mail-ppoint2.akamai.com with ESMTP id 294dey9dnq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Wed, 15 Mar 2017 17:12:38 -0400 Received: from USMA1EX-EXJRNL1.msg.corp.akamai.com (172.27.123.99) by usma1ex-dag1mb4.msg.corp.akamai.com (172.27.123.104) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Wed, 15 Mar 2017 17:12:37 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by USMA1EX-EXJRNL1.msg.corp.akamai.com (172.27.123.99) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Wed, 15 Mar 2017 17:12:37 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1178.000; Wed, 15 Mar 2017 17:12:37 -0400 From: "Salz, Rich" To: David Benjamin , "tls@ietf.org" Thread-Topic: [TLS] draft-ietf-tls-rfc4492bis-15 and the X25519 significant bit. Thread-Index: AQHSncpY3dq6phOYPECa64YWkXsaj6GWZhpA Date: Wed, 15 Mar 2017 21:12:37 +0000 Message-ID: <8cd5020569e145d5bc43ef11d97fa0c1@usma1ex-dag1mb1.msg.corp.akamai.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.32.197] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-15_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703150160 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-15_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703150160 Archived-At: Subject: Re: [TLS] draft-ietf-tls-rfc4492bis-15 and the X25519 significant bit. X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 21:12:42 -0000 PiBUaHVzLCBJIHdvdWxkIHN1Z2dlc3QgdGhlIHBhcmFncmFwaCBiZSByZW1vdmVkIGZyb20gdGhl IGRvY3VtZW50LiBJdCB3b3VsZCB0aGVuIHByZXNjcmliZSBSRkMgNzc0OCdzIGJlaGF2aW9yIHdo aWNoIGlzIHRvIG1hc2sgb2ZmIHRoYXQgYml0LiBEbyBvdGhlcnMgYWdyZWU/DQoNClllcy4NCg== From nobody Wed Mar 15 14:33:27 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 982EE131850 for ; Wed, 15 Mar 2017 14:33:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=briansmith-org.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4evYjc-D87jD for ; Wed, 15 Mar 2017 14:33:23 -0700 (PDT) Received: from mail-it0-x234.google.com (mail-it0-x234.google.com [IPv6:2607:f8b0:4001:c0b::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9D31A129C1C for ; Wed, 15 Mar 2017 14:32:48 -0700 (PDT) Received: by mail-it0-x234.google.com with SMTP id w124so57908004itb.1 for ; Wed, 15 Mar 2017 14:32:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=briansmith-org.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=iA57KLm/JCY/1ipDynwqVpZ+8yPAiScq9PZHO/plcoU=; b=MADCHeSf966Fta409TEPbx+Kw3Fpo/MZZhRykTMMcWsIREmdvArkES8gdlCgW6jVDD oR/173SGa4qPiPdAnecIseOgKgrwmME9oK2MUpHEwfFto1N88h/EYVNmIH7GszYPyxET kz6+bM8v0Lix/Cg7WC30B2rVODdS0nLZwMwa8n5KrjmcsSFhmipCR/Je53u47SOU8nz1 dve8Doc2If9JTQpNKGh70/YWK+YuV+iPhORTh6PNBqqB/7TzNLGhF01/6sH2hB5SqAPK S5PxLQBXOmTajnp0H+Ux+0kNc5oGA2lYiWtD69tfIEjxx7JTFlY3eDlPK/L8yXrUtN/I Z2AQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=iA57KLm/JCY/1ipDynwqVpZ+8yPAiScq9PZHO/plcoU=; b=g+f0LPJwWG1ZLVviXPicksQDdV/kU7SIM6iBasojPjVCFG0Rh4ULXNBT4hmA1IERqT QB8HxFCF9wDIp5SR97Ik3jm2OS6yy5EhJsyUWmHBun/4vyPATNHAZkjv1wEf9J//8WjK KW29inYfZ/Gl+wIemHgBIPPFdFcO+X/on6kyuFIsOyEBlfhnkjhy7yDnsW8WZVtphK8I vLjG2ldc9+YMcYGCU4l01qvKm3i2Es9FHpQwfUy+7eToToWqRdp9hgetcNF3IL1aadF4 ZqLdUxuChSD1MepuW+7gV28t1KAYU6WPhPfWqEVmGiq0ClEjf6hfYXRLUsykpjVRjzKB LYuw== X-Gm-Message-State: AFeK/H1GFbXsGM3NCQ406ou8Ca6dmoRXjJRs1r8Hy4kW83EdilvdpACGyLnDgUkmiurccVhPtr1h8+26auZLew== X-Received: by 10.36.22.209 with SMTP id a200mr7036279ita.117.1489613568052; Wed, 15 Mar 2017 14:32:48 -0700 (PDT) MIME-Version: 1.0 Received: by 10.36.107.142 with HTTP; Wed, 15 Mar 2017 14:32:47 -0700 (PDT) In-Reply-To: References: From: Brian Smith Date: Wed, 15 Mar 2017 11:32:47 -1000 Message-ID: To: David Benjamin Cc: "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] draft-ietf-tls-rfc4492bis-15 and the X25519 significant bit. X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 21:33:25 -0000 David Benjamin wrote: > draft-ietf-tls-rfc4492bis-15, section 5.11, contains the following text: > > Since there are some implementation of the X25519 function that > impose this restriction on their input and others that don't, > implementations of X25519 in TLS SHOULD reject public keys when the > high-order bit of the final byte is set (in other words, when the > value of the rightmost byte is greater than 0x7F) in order to prevent > implementation fingerprinting. Note that this deviates from RFC 7748 > which suggests that This value be masked. > > https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-15#section-5.11 > > There was a thread about this way back, but it seems not to have come to a > clear conclusion: > https://www.ietf.org/mail-archive/web/tls/current/msg18821.html Although I argued in favor of a different alternative in that previous thread, given how RFC 7748 ended up, I agree with your suggested change, to align with RFC 7748. Cheers, Brian -- https://briansmith.org/ From nobody Wed Mar 15 16:22:42 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E6E6D12D0C3 for ; Wed, 15 Mar 2017 16:22:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nD9MawbR2gg1 for ; Wed, 15 Mar 2017 16:22:39 -0700 (PDT) Received: from mail-qt0-x232.google.com (mail-qt0-x232.google.com [IPv6:2607:f8b0:400d:c0d::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C906129C2B for ; Wed, 15 Mar 2017 16:22:39 -0700 (PDT) Received: by mail-qt0-x232.google.com with SMTP id x35so25206372qtc.2 for ; Wed, 15 Mar 2017 16:22:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=l4wp0q52LtqhNn38wcLKC886wdTtBWisL7RhfZJaPak=; b=fJBQ7bc1EOk3JMaazjV+p3yHwiOXlVxYy7OTzIDtLE/FgXwX4M3jFD3J0LhZm3xlID eGwWjKc4U54foKntyH/rtYZAMzc0rVEZ0mwMLMp4Qzf1DpqmrCZ3zlyQpl1ujXk5CNAH MLID7HPPWJxfOXDBuwMxCbt22upXD0UlAdoDM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=l4wp0q52LtqhNn38wcLKC886wdTtBWisL7RhfZJaPak=; b=sIy1tz8MuWjO+LIYGBO3FfFyXj/Aix23v5EXzUX/PDh0Kw4YPsvsI7v4HBzl4uemoq EW2ZKCTkutZxzLQDhZJWyO0No6whIo74uLb7LGzZB4pYM/rfqHulWZR+Yp1hoJ7HUijz PSg3vd4wvF2o1KWohFGYnKC6NXUhdVRZb1dyea0nc3H4SREgZVo9WPcTECKdYnEj1xfv WbvdNC2gup/mZ9K6aYNxUqaS1dTi4n5YNpN2Qlt1faF281+olaCq7GOYvLB4pdFwo/Xp +hKIpP6l1dVLv9UC+wgaPyoB1nVNJ0u0Eq4NRlVJHhcraGVYqF7tjqn2hr7IuIq1TgNz ii+w== X-Gm-Message-State: AFeK/H1vq7GoZPhEBnqwyeA/J+Ng1kRMfnhs7NoEHsjAZAt9YRDG5911wna2oPnJV4mABw== X-Received: by 10.200.46.155 with SMTP id h27mr5980165qta.158.1489620158231; Wed, 15 Mar 2017 16:22:38 -0700 (PDT) Received: from [172.16.0.18] ([96.231.230.131]) by smtp.gmail.com with ESMTPSA id 27sm2391561qkx.3.2017.03.15.16.22.37 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 15 Mar 2017 16:22:37 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Message-Id: Date: Wed, 15 Mar 2017 19:22:36 -0400 To: "" X-Mailer: Apple Mail (2.3259) Archived-At: Subject: [TLS] IETF 98 Agenda Uploaded X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2017 23:22:41 -0000 Please note that I=E2=80=99ve uploaded the TLS session=E2=80=99s agenda: https://www.ietf.org/proceedings/98/agenda/agenda-98-tls-01 spt= From nobody Wed Mar 15 23:20:24 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0938A1243F6 for ; Wed, 15 Mar 2017 23:20:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id olwwyTcGxiGF for ; Wed, 15 Mar 2017 23:20:18 -0700 (PDT) Received: from mail-wr0-x22a.google.com (mail-wr0-x22a.google.com [IPv6:2a00:1450:400c:c0c::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 54BA31204DA for ; Wed, 15 Mar 2017 23:20:18 -0700 (PDT) Received: by mail-wr0-x22a.google.com with SMTP id l37so24778893wrc.1 for ; Wed, 15 Mar 2017 23:20:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:message-id:date:to; bh=ZmzS5bGLv4AmIG8mMqnoNro6KkO06MasXv1c1UjNwn0=; b=DMZnnctZVpyKgO83tTs7zCq8JLCYp4NeHe6pPaqSmLRcQx1IixtZ8KWXAOFzkKP7Wz 5w9ONUWpm7Jhq8gLVHNYGSlJmAIjNo7fv4XbWW9X3AsN9lWbbr35tpsTni4i0zTlsA5F uANsekHY2O/cdZgyc2kKlYPKWtnK78kVAJOOcgH4kYbKoFZQ7n4EzfPHCYx0SEXMU3uE OKFAYL3yt5cMFONYeNusxgHga4oIThf3ssB2oGD5VjtNeSwin/rjtIZTMWKSSzsO8YuO 5/hX+DM749rQoFCB8bvZ2uSG0fjbNGlyeW8jYM2VxdL1e53oHDMAPUG4zfnCAEFxBGIa tx1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:message-id:date:to; bh=ZmzS5bGLv4AmIG8mMqnoNro6KkO06MasXv1c1UjNwn0=; b=OTkBx7f6A6N4rJHk/EUxLfVI98zOwAduPETLwADPbv003tS2CGrqhyWcUGcit5D/88 tepTd/LOFuMilm7E0fI+y4eD+Ayhvb4LBdynzvnnmHZr0XQIdFAtGNrT2SsH8SUGYXFf hVpCC6sAwsN3nEORzatq4xir1OaWd/dQ+ibcwUVzUFYw3Kgde885u4Mhs7it2NtHTSus V03YRmpi/2c1CAipNAwkOwIBZanTTBpBevtWSgDbVXhVFiUzBYrLQ1PF96zLYyZvSfy1 KD/GAWqdfLKJhhgJbKD38i4sTdux37/qd3iBJYi2qZrRII9OwouPdbLGRseDNKhm4JqK 2PXg== X-Gm-Message-State: AFeK/H1WY9wHLfgC4SCPwitqT+4gByl60/P7zwtcZn5RH/AdrAG2NkPqFpgaOKqj3hIEJw== X-Received: by 10.223.132.163 with SMTP id 32mr6397420wrg.147.1489645216588; Wed, 15 Mar 2017 23:20:16 -0700 (PDT) Received: from [192.168.137.86] ([109.253.244.78]) by smtp.gmail.com with ESMTPSA id m186sm2995330wmd.21.2017.03.15.23.20.14 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 15 Mar 2017 23:20:15 -0700 (PDT) From: Yoav Nir Content-Type: multipart/signed; boundary="Apple-Mail=_6DD8C553-26C8-4385-AAA4-1E7791D54EDC"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Message-Id: Date: Thu, 16 Mar 2017 08:20:11 +0200 To: "tls@ietf.org list" X-Mailer: Apple Mail (2.3259) Archived-At: Subject: [TLS] RFC4492bis next steps X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 06:20:23 -0000 --Apple-Mail=_6DD8C553-26C8-4385-AAA4-1E7791D54EDC Content-Type: multipart/alternative; boundary="Apple-Mail=_842F223B-691D-40A3-A72F-780FCE404B29" --Apple-Mail=_842F223B-691D-40A3-A72F-780FCE404B29 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi. There are now three PRs pending for this draft: https://github.com/tlswg/rfc4492bis/pulls = These all look fine to me. There is also ekr=E2=80=99s review that requires some more changes: https://www.ietf.org/mail-archive/web/tls/current/msg22628.html = So unless there are objections, I will merge the three PRs over the = weekend so I can make the remaining changes without causing a bunch of = conflicts. Hopefully I=E2=80=99ll be all done and ready to submit a new version as = soon as submissions are re-opened on the 27th. Yoav --Apple-Mail=_842F223B-691D-40A3-A72F-780FCE404B29 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi.

There = are now three PRs pending for this draft:
https://github.com/tlswg/rfc4492bis/pulls

These all look fine to = me.

There is = also ekr=E2=80=99s review that requires some more changes:
https://www.ietf.org/mail-archive/web/tls/current/msg22628.html=

So unless = there are objections, I will merge the three PRs over the weekend so I = can make the remaining changes without causing a bunch of = conflicts.

Hopefully I=E2=80=99ll be all done and ready to submit a new = version as soon as submissions are re-opened on the 27th.

Yoav

= --Apple-Mail=_842F223B-691D-40A3-A72F-780FCE404B29-- --Apple-Mail=_6DD8C553-26C8-4385-AAA4-1E7791D54EDC Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYyi6cAAoJELhJCxUKWMyZPEUH/1zi19B1QGLp8SNj94rc9GBG N0z+Z2BKBammAvZDHacO2rR9pmVOfeAXSrc/mpLILzktD/CSDkm480lekrgJe6ra UepJOCJjQb7RQN3YK0DG3/BGkobUGjpga4zzhgtpQcp6xt7BXuZ50gk9w0hamb9m n8tCV3XKQ/r92XDpCPDT1E5AwVVdPn58lYouU7g7mw+N+sQEOlWbs0efd0sGPX4t neYC63U7gJiIYOLMKeVwio419doQNx0T2fvbGN4LmptvySVwMimZFJ+OpOgrvxpL iJ8kMMpd52C21CORYqFCf1DG2RrxfJGTjlHUiR5/7cdyYZJz7owXo1aouojdjDo= =AsCm -----END PGP SIGNATURE----- --Apple-Mail=_6DD8C553-26C8-4385-AAA4-1E7791D54EDC-- From nobody Thu Mar 16 05:33:49 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24AC5127201 for ; Thu, 16 Mar 2017 05:33:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ewxdI35-hPym for ; Thu, 16 Mar 2017 05:33:46 -0700 (PDT) Received: from mail-qt0-x22e.google.com (mail-qt0-x22e.google.com [IPv6:2607:f8b0:400d:c0d::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 27C59129473 for ; Thu, 16 Mar 2017 05:33:46 -0700 (PDT) Received: by mail-qt0-x22e.google.com with SMTP id r45so35847272qte.3 for ; Thu, 16 Mar 2017 05:33:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=/Fs1jgerpYdpRWzf/qxYImSWVuxhUpHBxru8hFiHNMM=; b=Ud91dyX9JQxNgB+xqC/tsDZymRGArN4TzyVI8wArEWw0JlZHQx+0zMlLuyC3Yl2B7S L5rwyZd29Wkspfc/5RJZusFX7CvJg1G+5LlCY1DF3DZ95KrUEJgzsQHmFAT1hzL3Q6sk GANwfDe6tAMe/GSw+HU5HulMmWgetKzseS2MM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=/Fs1jgerpYdpRWzf/qxYImSWVuxhUpHBxru8hFiHNMM=; b=aXPswsZZy2yPpEVbZmpLD42UO3PvY+Prayp46Okhf+M1LysCW6VQBRK79dWmKt9fcA LZ7yEjqC+oaGBqymmwS1pGgTglJZWVMtwEVLUQMrmRhCzFakiglkftJ4/kJQPGF4HUxE IBEfYOLPdbaRnlI0EthgAP0i5eOEi0v32Zx1QBUe5kt1NhOiIyO0BCiqIJsI5WxtzIx4 D0LOW3RuPdx7EVAWsNSUzckyyvjQj1tQEXPNf3jFQiLAzvQryAcWCLTpX4yn4A8LhNys 1Eymr/PadP41Hs5nG8AjXuc/UJNK6xzQqMSlZrINr0+Z47bWnX7T42j5df8EQDxdwWtF KGIA== X-Gm-Message-State: AFeK/H3vqDkJuv8JJHyjNo7cuJ9rWov+59cXEiXSonhL/KSqnr2t/iRjVRym49lB2KpIfQ== X-Received: by 10.237.59.213 with SMTP id s21mr7690660qte.146.1489667625181; Thu, 16 Mar 2017 05:33:45 -0700 (PDT) Received: from [172.16.0.18] ([96.231.230.131]) by smtp.gmail.com with ESMTPSA id s5sm3525107qkd.33.2017.03.16.05.33.43 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Mar 2017 05:33:44 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Sean Turner In-Reply-To: Date: Thu, 16 Mar 2017 08:33:43 -0400 Cc: "tls@ietf.org list" Content-Transfer-Encoding: quoted-printable Message-Id: References: To: Yoav Nir X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] RFC4492bis next steps X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 12:33:48 -0000 Thanks Yoav! spt > On Mar 16, 2017, at 02:20, Yoav Nir wrote: >=20 > Hi. >=20 > There are now three PRs pending for this draft: > https://github.com/tlswg/rfc4492bis/pulls >=20 > These all look fine to me. >=20 > There is also ekr=E2=80=99s review that requires some more changes: > https://www.ietf.org/mail-archive/web/tls/current/msg22628.html >=20 > So unless there are objections, I will merge the three PRs over the = weekend so I can make the remaining changes without causing a bunch of = conflicts. >=20 > Hopefully I=E2=80=99ll be all done and ready to submit a new version = as soon as submissions are re-opened on the 27th. >=20 > Yoav >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls From nobody Thu Mar 16 05:41:46 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 48D0F12948A for ; Thu, 16 Mar 2017 05:41:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.302 X-Spam-Level: X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q0yTGpjghr16 for ; Thu, 16 Mar 2017 05:41:41 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A895F12949D for ; Thu, 16 Mar 2017 05:41:25 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id ACF39BE3E; Thu, 16 Mar 2017 12:41:23 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d750nnJGFgME; Thu, 16 Mar 2017 12:41:22 +0000 (GMT) Received: from [10.87.48.75] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 3F42ABDF9; Thu, 16 Mar 2017 12:41:22 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1489668082; bh=HGuDLp7pB37z/Lj64uS4e2ZpH/G+1LGVhSDunBP0uWQ=; h=Subject:To:References:From:Date:In-Reply-To:From; b=FTtj9Fjws7ssg8mkfYic7k2QOu8iWfHaZIKCrQWDJyMjAPEnuEdTRGlmB1nhpd28T hx+z9shiZ1PHjKEKrwmdplVSyH5wzUzhdgPx9bSepYGjmYFWwBn4MybobAOHU/fA6m nXwTIuJFyC3J+5b+2ykqz7hpz22mcliOdGHK4mOA= To: Yoav Nir , "tls@ietf.org list" References: From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: <44eec6fe-7f9f-ae73-558a-74e20c8029e4@cs.tcd.ie> Date: Thu, 16 Mar 2017 12:41:21 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="49vuc7SvoKrluHUbWOvKbcjm0FD4a61kO" Archived-At: Subject: Re: [TLS] RFC4492bis next steps X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 12:41:44 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --49vuc7SvoKrluHUbWOvKbcjm0FD4a61kO Content-Type: multipart/mixed; boundary="MKAFof5bvWVfpUVDe8daIXiS0mKTmsqp6"; protected-headers="v1" From: Stephen Farrell To: Yoav Nir , "tls@ietf.org list" Message-ID: <44eec6fe-7f9f-ae73-558a-74e20c8029e4@cs.tcd.ie> Subject: Re: [TLS] RFC4492bis next steps References: In-Reply-To: --MKAFof5bvWVfpUVDe8daIXiS0mKTmsqp6 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 16/03/17 06:20, Yoav Nir wrote: > Hopefully I=E2=80=99ll be all done and ready to submit a new version as= soon > as submissions are re-opened on the 27th. If we're ready sooner, I'd prefer try get that out of the way next week. I can tell to secretariat to accept updates for this draft. (I'll likely do that after the IESG telechat this afternoon) Cheers, S. --MKAFof5bvWVfpUVDe8daIXiS0mKTmsqp6-- --49vuc7SvoKrluHUbWOvKbcjm0FD4a61kO Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCAAGBQJYyofxAAoJEC88hzaAX42iVh8H/2nVPVvn3L8+UBaXHC8Pr5Ri qz6is6vvkORh4pgyLrrVXzqXyX9kNdpSGoHyS2qo3JBYQkNRLawPtp36Qbjj+hST uI/hYcJbsRgG2bOGTR4WNQP8gTphWWt9GuMBd0I1wZjO+dGChMbpGcK4W45OMVQ4 dq9DGIy2UbbmN9AvpyhAFmHpORXgk7iAeIYS3pDV5EaSsUanq28ZfLRIOULYuLV2 tjLm4ELXekr+ITY+pbGU+NeHcyQ8V3TnTgZ58fBchmLtHouAfmUb+Vghqt6byJ8t xz1DPz4QKx2TBh8kvqFmNnT3H/YIN5EJDwwr5n3wAUGNP489ltqrGxJjUJkjK8E= =HxPn -----END PGP SIGNATURE----- --49vuc7SvoKrluHUbWOvKbcjm0FD4a61kO-- From nobody Thu Mar 16 05:53:09 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EFD0A129487 for ; Thu, 16 Mar 2017 05:53:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jukrya00fCC2 for ; Thu, 16 Mar 2017 05:53:05 -0700 (PDT) Received: from mail-wr0-x22a.google.com (mail-wr0-x22a.google.com [IPv6:2a00:1450:400c:c0c::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 01F8B127201 for ; Thu, 16 Mar 2017 05:53:04 -0700 (PDT) Received: by mail-wr0-x22a.google.com with SMTP id l37so31365597wrc.1 for ; Thu, 16 Mar 2017 05:53:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=CmhemD8hVt/o0AxgBOVJuSXpHb1jUMorJX4GOhn9jyU=; b=TvpIykZdn/QFazakK+MjMkAaoIYdiMMyTnhBQ7cOUmNFhe9jCOE1yQqV01uNaZ/XKO p8SIYQSBoe5+T7vV2/4CSNeSEK4jY2UHvXUALgh3UPxVNL037OMRCzNsRHVMBSbGBbdw 57mznpgMmiFT0cmrgQgHDdoFpAnCAJlalNDHpHKwMHwmH7TS1ZyY1ghfRWkkDP5GTD5I YOcsU6176kirmfC4/x7G83d6d/Hnzo0/+9lL/0nGgjwpCVTSCLbrl1v4WBAHLIOGfxIy x0Fy1MDbWveHDza6xh/LitmSarxggQcXPBWNRu8/XQ62OZL6aRCl90nMlT47+JKCHN0C v55A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=CmhemD8hVt/o0AxgBOVJuSXpHb1jUMorJX4GOhn9jyU=; b=isD1gJQRD5V0VEPz0YMvuKC6hvMS3bXwp+5sW8Y5qjpnmY7HQlxAXqYoXl/oMlm4dD g5SPEDLF0Ac0SNJyEnTFsjrjQRaYGQ40wc1m6EDzSD/hS0sa/ubYtlYK+SqAurucqCtU 5eFj5h0+9rNFKKL3uy66gCrDFYPtTllWsFHLcE9Fc4PrnSY670zixK1AC0PC21mOeWaA su7yoA1hQLqG2xDhwjTL/RbluLS4vZVpQP+LPbMF4LFpnDh1S5vUTB81tcTCFpPbLsVG lA7dfQVEug2M4EKHH5kW+5CcON6kQGy9OX7JnD1HEjNa6TgaX2NUL80bAFkOXpq8M4b5 Vfbw== X-Gm-Message-State: AFeK/H057AeLlGXArdBkRcCkF9rVWfuMYeGaBcdiz02LWwsjNf3XPuWCTtr1OFegEHsnFQ== X-Received: by 10.223.160.231 with SMTP id n36mr9081165wrn.167.1489668783418; Thu, 16 Mar 2017 05:53:03 -0700 (PDT) Received: from [172.24.251.163] (dyn32-131.checkpoint.com. [194.29.32.131]) by smtp.gmail.com with ESMTPSA id h65sm4485296wrh.32.2017.03.16.05.53.02 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Mar 2017 05:53:02 -0700 (PDT) From: Yoav Nir Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_70179B9B-8A07-425C-934B-AA38AD265433"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Thu, 16 Mar 2017 14:52:59 +0200 In-Reply-To: <44eec6fe-7f9f-ae73-558a-74e20c8029e4@cs.tcd.ie> Cc: "tls@ietf.org list" To: Stephen Farrell References: <44eec6fe-7f9f-ae73-558a-74e20c8029e4@cs.tcd.ie> X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] RFC4492bis next steps X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 12:53:07 -0000 --Apple-Mail=_70179B9B-8A07-425C-934B-AA38AD265433 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 OK, so I=E2=80=99ll merge the PRs tomorrow morning and start working on = ekr=E2=80=99s comments over the weekend. Yoav > On 16 Mar 2017, at 14:41, Stephen Farrell = wrote: >=20 >=20 >=20 > On 16/03/17 06:20, Yoav Nir wrote: >> Hopefully I=E2=80=99ll be all done and ready to submit a new version = as soon >> as submissions are re-opened on the 27th. >=20 > If we're ready sooner, I'd prefer try get that > out of the way next week. I can tell to secretariat > to accept updates for this draft. (I'll likely > do that after the IESG telechat this afternoon) >=20 > Cheers, > S. >=20 --Apple-Mail=_70179B9B-8A07-425C-934B-AA38AD265433 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYyoqsAAoJELhJCxUKWMyZWsoH/1Mjjrj1MnCIDGUXELm+GmXp L8uXpBMJ0qIuu5Pr9Zlm548Phc3SOaqqT2r4P71oI6oPNAZMfDcA6xufLzab0gGR NeJSsgcXzO7dG40/nIqsPMtcEzZgKUEfjfmcbozZ9UN1MnjGW2PnguCWD+qpS0N9 odVGS3YqoRKOQi2gc+IXZd0zaIlyf51fTzkN7Xcf1cfyLjmQM4lKj/tOiBNNipJ4 YHM26840IwRf22OwOVf+EubODM1XGpjh1r5UerYVIHRKskeYt4ECjbevBg9bhIa4 DCe5sZGBHzBbeFuu4DZrtL1oF9QtUO/+QwRqKY7UKJQsQChM233WU+etDZ1GfA4= =AgW/ -----END PGP SIGNATURE----- --Apple-Mail=_70179B9B-8A07-425C-934B-AA38AD265433-- From nobody Thu Mar 16 05:54:46 2017 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id EC5A0129464; Thu, 16 Mar 2017 05:54:36 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Alexey Melnikov To: "The IESG" Cc: draft-ietf-tls-rfc4492bis@ietf.org, Sean Turner , tls-chairs@ietf.org, sean@sn3rd.com, tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.47.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <148966887696.14121.6360719147485530250.idtracker@ietfa.amsl.com> Date: Thu, 16 Mar 2017 05:54:36 -0700 Archived-At: Subject: [TLS] Alexey Melnikov's No Objection on draft-ietf-tls-rfc4492bis-15: (with COMMENT) X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 12:54:37 -0000 Alexey Melnikov has entered the following ballot position for draft-ietf-tls-rfc4492bis-15: No Objection When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: https://datatracker.ietf.org/doc/draft-ietf-tls-rfc4492bis/ ---------------------------------------------------------------------- COMMENT: ---------------------------------------------------------------------- I would like to vote Yes on this document, but there are some minor issues with this document which prevent me from doing so: 0) There is some general awkwardness in text talking about allowed points formats, considering that only uncompressed form is now allowed. I don't have recommendations about improving text, other than the following: If no future formats are expected, it feels almost better to recommend against inclusion of the Point formats extension, as lack of it means uncompressed format anyway. 1) In Section 2.3, last paragraph: Does this paragraph apply only to 2.3 or does it also apply to 2.1 and 2.2? If the latter, then it needs to be moved to section 2. 2) In Section 6: Server implementations SHOULD support all of the following cipher suites, and client implementations SHOULD support at least one of them: o TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 o TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA o TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 o TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 GCM ciphers are not listed in the table earlier in the same section. They are defined in RFC 5289. This document doesn't have any reference to RFC 5289 and GCM ciphers are not discussed anywhere else in the document. From nobody Thu Mar 16 05:55:45 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5DAAE129496 for ; Thu, 16 Mar 2017 05:55:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.302 X-Spam-Level: X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x9xIfmCefITP for ; Thu, 16 Mar 2017 05:55:41 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 725A412948D for ; Thu, 16 Mar 2017 05:55:40 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id F36A2BE2F; Thu, 16 Mar 2017 12:55:38 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bA15lSAseQ8P; Thu, 16 Mar 2017 12:55:37 +0000 (GMT) Received: from [10.87.48.75] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 607A2BE3E; Thu, 16 Mar 2017 12:55:37 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1489668937; bh=dPJy4Mz8otzXtGElEqRqZ1d5H6rArg1V6BL1mhYKPlI=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=CJquOYt3aCKqWEpU2nUdM+nMYyW4mt8xDMVAhhxJMomQcSnCK5J2klrresplr7bAN GtCCKxLA0zK9OCQ0QPT+1nYJ2PVPco9ZHCT8FwZksY/3xWxtmowUu4VqDvrGNgNHWb n4HBDzc4XANyYfvjI581cbTseB2gTQIKvQzZx9XM= To: Yoav Nir References: <44eec6fe-7f9f-ae73-558a-74e20c8029e4@cs.tcd.ie> Cc: "tls@ietf.org list" From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: <206ffc40-8ae6-9b46-44c5-1470c52a21c3@cs.tcd.ie> Date: Thu, 16 Mar 2017 12:55:36 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="jcwvFwDSlpucEmHJok8vswOlcBTlfqe4D" Archived-At: Subject: Re: [TLS] RFC4492bis next steps X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 12:55:43 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --jcwvFwDSlpucEmHJok8vswOlcBTlfqe4D Content-Type: multipart/mixed; boundary="uf8EMXO1EDfXc9md7Dk2DadjeHnkVUwR1"; protected-headers="v1" From: Stephen Farrell To: Yoav Nir Cc: "tls@ietf.org list" Message-ID: <206ffc40-8ae6-9b46-44c5-1470c52a21c3@cs.tcd.ie> Subject: Re: [TLS] RFC4492bis next steps References: <44eec6fe-7f9f-ae73-558a-74e20c8029e4@cs.tcd.ie> In-Reply-To: --uf8EMXO1EDfXc9md7Dk2DadjeHnkVUwR1 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 16/03/17 12:52, Yoav Nir wrote: > OK, so I=E2=80=99ll merge the PRs tomorrow morning and start working on= ekr=E2=80=99s > comments over the weekend. Excellent, thanks, S >=20 > Yoav >=20 >> On 16 Mar 2017, at 14:41, Stephen Farrell >> wrote: >>=20 >>=20 >>=20 >> On 16/03/17 06:20, Yoav Nir wrote: >>> Hopefully I=E2=80=99ll be all done and ready to submit a new version = as >>> soon as submissions are re-opened on the 27th. >>=20 >> If we're ready sooner, I'd prefer try get that out of the way next >> week. I can tell to secretariat to accept updates for this draft. >> (I'll likely do that after the IESG telechat this afternoon) >>=20 >> Cheers, S. >>=20 >=20 --uf8EMXO1EDfXc9md7Dk2DadjeHnkVUwR1-- --jcwvFwDSlpucEmHJok8vswOlcBTlfqe4D Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCAAGBQJYyotIAAoJEC88hzaAX42ix+sIAKlfv4VAPdkFRHv5m9GFjZkn hQEcpq0shLa7RbXGncitWSlvU8caeBngEayTjJaQXDOkRUbZ6nI+JkeFKbl+7fwm 4PZ0w0+ZjZ8P44MEq0ityCjl4UdzqmxKCsgnzLSDjpuOCZgJw52IF+hrOMZSsILJ M2tDKc/mbNNBeIbu/kUz3smpq5T7GQhSBi6i8JENf3XA8y1SopiuF6HrV6iZ2An9 tCBWRkcWm4rrVwVanstiFOrxjo3/BAADmdN9aKsZEvMpIWx32YfAp1qqrX8wv/cm 0S9TpQAy086Un1wkSwZOjk2d4ezhTBuhimQ2doDQi0UrjE2HLJ2xTV1dmdMexM0= =hC96 -----END PGP SIGNATURE----- --jcwvFwDSlpucEmHJok8vswOlcBTlfqe4D-- From nobody Thu Mar 16 08:18:29 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CC6B1295E3 for ; Thu, 16 Mar 2017 08:18:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PUINOFDICAsm for ; Thu, 16 Mar 2017 08:18:27 -0700 (PDT) Received: from mail-yw0-x22d.google.com (mail-yw0-x22d.google.com [IPv6:2607:f8b0:4002:c05::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 16DE7129618 for ; Thu, 16 Mar 2017 08:18:09 -0700 (PDT) Received: by mail-yw0-x22d.google.com with SMTP id v76so34504505ywg.0 for ; Thu, 16 Mar 2017 08:18:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=xwE8JGdnsQMKs4ynXvwP34QYkxgJXzsG7rN3wnNSsSc=; b=eP614eoEKoh1J1jGXKgUTfHuMxtgKM7NBwgQFhKtA7TgH9yTDD+t4ehip+fhTyLJlp TdEn72K6cftLcw3T9Y2DLB3Xi0mO/b8NOGl0ChgWE+2QLuBWYVxXbZ8pptYi2eswNypn 4Gxcm7LkGwLc3xNGOWf8gXK54y5Z/+x5zav9I1hLszDUEXZmtbLuCgeC2+ZT6v+ZQvWP eeL4bwyd8xSLnz/eSygSV6AADRRDVgoTP1qy6/x5MhvvHOeifQAlnO+f1LdB5LOQjpRr uwlqYtbaM/eix3wQBwXn4fyZpudR+dt+LIU2ABkw/IqBdjleZdh91mdDgpvU5xlRR5Eh x7jg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=xwE8JGdnsQMKs4ynXvwP34QYkxgJXzsG7rN3wnNSsSc=; b=OZcyXyTGWQloS8fjhraJXlYxIuY17o1Ma5Qlt0lykZhgrgBTfO7938seksB0jrS8S1 xA7fcpFfhR75HzBcShbCTHdk0Dc5YC28w+g+5XfxertdyXpOUVR0s7roQxQj9YvDV7v5 IBXT8QR5YtgqBVg9j1wThzhi4SKjzIqPwCNPyURCAy2kH34KCC3aNxV5XHflkuvS17IG iLm6GYl2/PavtojhAHybGcf5Uw12yPxu9bIDdaKOcAj6nFmm/xq/wkjVemz7Zy8LjAc/ yKyK6wYT+WHvAkeygS5JYAZS2kjozkR4tUuaogzVnmvPsrpS9/6kzp8u6irX2Sb2i2+0 668w== X-Gm-Message-State: AFeK/H0QGiHllPQ3XpBa9wSuo6gFTQch+X0VzB00KAuCseE64ZBvhl06pUsT61+RiSIxT4d+IqjAK42+8KKPOA== X-Received: by 10.129.177.8 with SMTP id p8mr7669665ywh.327.1489677487923; Thu, 16 Mar 2017 08:18:07 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Thu, 16 Mar 2017 08:17:27 -0700 (PDT) From: Eric Rescorla Date: Thu, 16 Mar 2017 08:17:27 -0700 Message-ID: To: "tls@ietf.org" Content-Type: multipart/alternative; boundary=94eb2c13ce387f828f054ada913d Archived-At: Subject: [TLS] Uplifting 5289 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 15:18:29 -0000 --94eb2c13ce387f828f054ada913d Content-Type: text/plain; charset=UTF-8 Hi folks I note that we are proposing to uplift RFC 5289 to PS, despite the fact that it standardizes some CBC cipher suites, which the WG is looking to move away from. I recognize that these are the only cipher suites you can use in TLS 1.0 and 1.1, but we also want people to move away from them. This problem is probably solvable by marking the registry as Not Recommended, but I wondered if anyone had other thoughts on this topic? -Ekr --94eb2c13ce387f828f054ada913d Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi folks

I note that we are proposing t= o uplift RFC 5289 to PS, despite the fact that it
standardizes so= me CBC cipher suites, which the WG is looking to move away
from. = I recognize that these are the only cipher suites you can use in TLS 1.0
and 1.1, but we also want people to move away from them.
=
This problem is probably solvable by marking the registry as= Not Recommended, but I wondered if anyone had other thoughts on this topic= ?

-Ekr

--94eb2c13ce387f828f054ada913d-- From nobody Thu Mar 16 08:35:25 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA4781295EA for ; Thu, 16 Mar 2017 08:35:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dsBlvT8VP_bN for ; Thu, 16 Mar 2017 08:35:23 -0700 (PDT) Received: from mail-qt0-x22e.google.com (mail-qt0-x22e.google.com [IPv6:2607:f8b0:400d:c0d::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C3C8912956D for ; Thu, 16 Mar 2017 08:35:22 -0700 (PDT) Received: by mail-qt0-x22e.google.com with SMTP id x35so40701587qtc.2 for ; Thu, 16 Mar 2017 08:35:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=gA/4at2TMqMzAPVeedReKGc7cY/5pjihyuBCJ2pfouU=; b=atjCmw5TSs/DU7+p802VQTbPpmh/4Z0Z2NDZ/2/i+N4J7LP1x/y94MKTCjvTJDEvNN GRN8YS9L6GLVQ9RFz7RWpm06aun76ifpijEVJgXnJFSEpEMiy7aIseCgZ13VUVKZB0i5 FlT3R4z9fIq3wSMIVTUbR4M9CNcvAa30m/8y8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=gA/4at2TMqMzAPVeedReKGc7cY/5pjihyuBCJ2pfouU=; b=YdGLS2bdweib5rfpYGEDyTcejJnI2TU2ZaPV4+lFgG+infO5zclMMCzsBN9pl98hTL +ZEbZO/g5VAsGPflk21/VFwkkQsmsMbW30qzK+z0B/+qfj5qj8IX6KR1lfrmCZ7p12VO 3FKRVF6KqRpWYgPRYgF0KzwXK8zq9A5m78ZGOEcqRRoelUTfBdF43mfcTMTf/ReKZQqf +VKtg/nZxMVIhXj2sIPKvMJEBblIgeyY0ykZtkeANZFd+rT8qxAJTfXirGOpgiV/Mm1+ GLvc/QKB0YAWMC1afBqMfJA/1yWvW6GLumokbzDzWclz6l7SRnzVBrHaVyzl47uzDSho l4vg== X-Gm-Message-State: AFeK/H15N/NfGnZG0J0wvpIXAtHaasQesqIfmNJBHlL7jL9uA9QCWdGyhoH9lEuCHovb/g== X-Received: by 10.200.58.163 with SMTP id x32mr9555010qte.123.1489678521823; Thu, 16 Mar 2017 08:35:21 -0700 (PDT) Received: from [172.16.0.18] ([96.231.230.131]) by smtp.gmail.com with ESMTPSA id j11sm3856734qta.39.2017.03.16.08.35.20 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Mar 2017 08:35:20 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Sean Turner In-Reply-To: Date: Thu, 16 Mar 2017 11:35:19 -0400 Cc: "tls@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <3ACF0F8C-2324-4605-AC5C-E5885715E2B9@sn3rd.com> References: To: Eric Rescorla X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Uplifting 5289 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 15:35:25 -0000 ekr, While we=E2=80=99re moving the entire document to PS, we=E2=80=99re also = following it with = https://datatracker.ietf.org/doc/draft-ietf-tls-iana-registry-updates/ = that adds a =E2=80=9CRecommended" column that is not (see s6) going to = include marking =E2=80=9CY=E2=80=9D for any of the CBC algorithms. So, = I think we=E2=80=99re okay. spt > On Mar 16, 2017, at 11:17, Eric Rescorla wrote: >=20 > Hi folks >=20 > I note that we are proposing to uplift RFC 5289 to PS, despite the = fact that it > standardizes some CBC cipher suites, which the WG is looking to move = away > from. I recognize that these are the only cipher suites you can use in = TLS 1.0 > and 1.1, but we also want people to move away from them. >=20 > This problem is probably solvable by marking the registry as Not = Recommended, but I wondered if anyone had other thoughts on this topic? >=20 > -Ekr >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls From nobody Thu Mar 16 08:37:53 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6B86E12963D for ; Thu, 16 Mar 2017 08:37:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g4jhx44HAC1U for ; Thu, 16 Mar 2017 08:37:50 -0700 (PDT) Received: from mail-wr0-x22b.google.com (mail-wr0-x22b.google.com [IPv6:2a00:1450:400c:c0c::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 149BA129636 for ; Thu, 16 Mar 2017 08:37:50 -0700 (PDT) Received: by mail-wr0-x22b.google.com with SMTP id l37so34804170wrc.1 for ; Thu, 16 Mar 2017 08:37:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=MRIFXWVYVxpFPG8EXOsXZlPV7znxbuV1aRJCndV66UM=; b=UtmNhQoTiRJL4hv/BJAqg2cDdN2YfPo4iSo7kSIpT1uFsDlW3eXIgwskUqqGu6jzrN UDxww3GrE3x+9yy0u5V/ajMO1M8l8P5bqhCThEuhADDKu0HvzndyDq3hTY/XKqiUtWoB CQvG5RaREr3BxV+AG81WwCQirJkqqIB0tNZuTiSykEDhHp5TGi6aapqg3VkYPcZeQmzN yo6MDkqhCATILWqwhhvFOIrGgQktnGXNzhYBk+18k7MaKxZSyPY6q3QKk4S5szXjDV8I KMObUYrHZnS5gxzYgagW8wPNhShXLP9DFcBBO2b6MQAldm09gkSQtbZjUdXsuKFkljbU ANyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=MRIFXWVYVxpFPG8EXOsXZlPV7znxbuV1aRJCndV66UM=; b=Kij3HCo3llPpf0QqRG8SOpd6ls5cxwts8UNMQIvCI5YAvKmd9QY8T3bSPM/xkSgi4A AyhNzs4rGx0i8N3kjwfW6HOfGjc+xGuIkFLX0cUJkpDTI4JS5I6vjuNI8x/S7sT0WKhh zz1AOJgj7FmOK89KQTTxX9eW2003FsvwNbvhzm7sVuufKcdOi614sOsqgBnBhv0VfWnU L2d4aQA2Mb0OIiWjkzPHT4aTITZ/anEPZHoHqntiJwo579Fo8KHQFSMMlxbPdn5eAcIO aZOEQnwHDMVo1Nrq4Oin3XPeB/nq1nSY+VHjl5tQ+iydVSCskY1UZ95SomriJbAFw/e4 9UYA== X-Gm-Message-State: AFeK/H2p3Xg/mjvjXeMHQMLKqVmFi2co3VRrvl/vxUI1lobhwIlrn+nbxspYl29STpozNw== X-Received: by 10.223.182.133 with SMTP id j5mr9751781wre.19.1489678668620; Thu, 16 Mar 2017 08:37:48 -0700 (PDT) Received: from [172.24.251.163] (dyn32-131.checkpoint.com. [194.29.32.131]) by smtp.gmail.com with ESMTPSA id w97sm6601010wrc.20.2017.03.16.08.37.47 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Mar 2017 08:37:48 -0700 (PDT) From: Yoav Nir Message-Id: <9D719372-7B07-406B-8C8B-2AC762BDB5F2@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_FFAE3E80-422A-4289-990F-86D4ACFA53A9"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Thu, 16 Mar 2017 17:37:43 +0200 In-Reply-To: Cc: "tls@ietf.org" To: Eric Rescorla References: X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Uplifting 5289 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 15:37:51 -0000 --Apple-Mail=_FFAE3E80-422A-4289-990F-86D4ACFA53A9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 16 Mar 2017, at 17:17, Eric Rescorla wrote: >=20 > Hi folks >=20 > I note that we are proposing to uplift RFC 5289 to PS, despite the = fact that it > standardizes some CBC cipher suites, which the WG is looking to move = away > from. I recognize that these are the only cipher suites you can use in = TLS 1.0 > and 1.1, but we also want people to move away from them. >=20 > This problem is probably solvable by marking the registry as Not = Recommended, but I wondered if anyone had other thoughts on this topic? >=20 5289 applies to TLS 1.0, 1.1, and 1.2. It seems strange to uplift a = bunch of ciphersuites for 1.2 just as we=E2=80=99re publishing TLS 1.3 = which obsoletes 5246. Yoav --Apple-Mail=_FFAE3E80-422A-4289-990F-86D4ACFA53A9 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYyrFHAAoJELhJCxUKWMyZl+wIALoLCgpmzC7rP2F2cJe3ItSI 9nz9uOyQ15lrKuDu7Kd40p8j1qzztHL9T0qw1j2gUyr8ZkR9pHOldmzoZpivvdXn u8tdcss3a3+iiLnFdM1trMnY14MP5iVJVfGJthY/YY8bzl1JMEvEVIuyiNHSiNR0 Xmzd0aD1fIx05/AIKR6228xDzYUPSwam1VNJi2+chIwQV/f8sSQ+H9TCF19FUd98 9bLGU43kuoLxuVQvf7zKwoW2XU3/IPqDCD6vyHk9ZxU/FIHI1W7IwYJyf9bJoFzX YfvmtURZ9inJis57rwlsp1EaW0MGjPKuN07EpPUS/y7mHgQOWf2E9Jbsp9VUjCY= =mgW/ -----END PGP SIGNATURE----- --Apple-Mail=_FFAE3E80-422A-4289-990F-86D4ACFA53A9-- From nobody Thu Mar 16 12:01:52 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EAB3B1299C3 for ; Thu, 16 Mar 2017 12:01:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9IEN7DpKCtyC for ; Thu, 16 Mar 2017 12:01:50 -0700 (PDT) Received: from mail-qt0-x235.google.com (mail-qt0-x235.google.com [IPv6:2607:f8b0:400d:c0d::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3BA331299C1 for ; Thu, 16 Mar 2017 12:01:36 -0700 (PDT) Received: by mail-qt0-x235.google.com with SMTP id r45so45900186qte.3 for ; Thu, 16 Mar 2017 12:01:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=PJYFEuCEijnTtyBUwJt2MJYo/5qoUvGBmNeVRtT+GJA=; b=SHbJi/qngWtye8PIHPRWBUFd/aPD4qoV+BqWV2mW5Gp00MQQzvETYAD5IT3NXny2/W dYGf1glji/Eb/YyTbAkj05KelCtfB+HXVF+ks0p/W88MeijCKjAyG2YkMcfdOiNOy4l3 n7Wm3b+n1uQxnjpM3NeYuha1ZbeXsl1bDs8b98zLxXoepv4ff2FCxvtrgtFaTONE/0s3 nI/vMxIZCTwBJGJXAGkZq3JMKayh6WvJbYq2GeL9Zvkfq6lOf9fsMuPxMQZRKQIdpwg+ XfmMXg0nLA4qGgZqghvwE0ax0bvkkEKLvKEhUG1WjBdcN5W8E8PiaFIsrH6d4TbUr3n2 OXdQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=PJYFEuCEijnTtyBUwJt2MJYo/5qoUvGBmNeVRtT+GJA=; b=ZzAU8tMCkkRwW4dj78OhdCieUivUSCQDTzayoydpL5m9HEavO0HSKuotu1LB0p9LcG 84IWyLXtvCaLJZnzKwOjtHw7GJ1HRCTvedeubwNQcIRXA1D+zDvWl3il7jfDqGNq/UBz l4Wqk3VOP/aiuMKXQPObUGjsDWhcO8oDVdQadbx8ewwslOs5iGXD28WO2ttXZ8C+PyME A1XUo3SmVj1qiiQT1N8bbIJM7jGg1MA6ntbxcnQsgYieAIbAQqtIEC1yFyFLzkffGXny MQMstPPFQld9vALNC82ktmonfDeJ6ZCtDijYTtjB9YXIbDMpm/PrwcCaUrZHrCAPXQB3 0umw== X-Gm-Message-State: AFeK/H1XdMyCSjGi9yfs93nAvN+6+YEJGK+OfZwyTqz+FbZw2jroDvapTTqtydLgdx1sLQ== X-Received: by 10.237.34.8 with SMTP id n8mr10609985qtc.98.1489690895351; Thu, 16 Mar 2017 12:01:35 -0700 (PDT) Received: from [10.132.111.189] (mobile-166-172-062-104.mycingular.net. [166.172.62.104]) by smtp.gmail.com with ESMTPSA id t2sm4271089qkh.0.2017.03.16.12.01.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Mar 2017 12:01:34 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: kathleen.moriarty.ietf@gmail.com X-Mailer: iPhone Mail (14D27) In-Reply-To: <9D719372-7B07-406B-8C8B-2AC762BDB5F2@gmail.com> Date: Thu, 16 Mar 2017 15:01:33 -0400 Cc: Eric Rescorla , "tls@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <9AF98D89-9183-49F6-A30A-8A2E3301F81E@gmail.com> References: <9D719372-7B07-406B-8C8B-2AC762BDB5F2@gmail.com> To: Yoav Nir Archived-At: Subject: Re: [TLS] Uplifting 5289 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 19:01:52 -0000 Please excuse typos, sent from handheld device=20 > On Mar 16, 2017, at 11:37 AM, Yoav Nir wrote: >=20 >=20 >> On 16 Mar 2017, at 17:17, Eric Rescorla wrote: >>=20 >> Hi folks >>=20 >> I note that we are proposing to uplift RFC 5289 to PS, despite the fact t= hat it >> standardizes some CBC cipher suites, which the WG is looking to move away= >> from. I recognize that these are the only cipher suites you can use in TL= S 1.0 >> and 1.1, but we also want people to move away from them. >>=20 >> This problem is probably solvable by marking the registry as Not Recommen= ded, but I wondered if anyone had other thoughts on this topic? >>=20 >=20 > 5289 applies to TLS 1.0, 1.1, and 1.2. It seems strange to uplift a bunch= of ciphersuites for 1.2 just as we=E2=80=99re publishing TLS 1.3 which obso= letes 5246. TLS 1.2 will be in use for a while unless major problems are found, so it's w= orthwhile IMO. Kathleen=20 >=20 > Yoav >=20 >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls From nobody Thu Mar 16 12:16:51 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B1C161299EB for ; Thu, 16 Mar 2017 12:16:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q0Qz14t4RTWJ for ; Thu, 16 Mar 2017 12:16:48 -0700 (PDT) Received: from mail-wm0-x242.google.com (mail-wm0-x242.google.com [IPv6:2a00:1450:400c:c09::242]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E50B412996E for ; Thu, 16 Mar 2017 12:16:47 -0700 (PDT) Received: by mail-wm0-x242.google.com with SMTP id z133so4492452wmb.2 for ; Thu, 16 Mar 2017 12:16:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=scJAexGMppZXuxA/pBKh/tuobp0tQo+fHCutI9SH7BI=; b=XY+EAGvO7aGW7thKD2uy4bkg8fy/1FgTDm0MLetE2fUWzOl7b8QCiAviOhN5yfJ/3P u6KD5yUw/59s60geJtsK9lTIQ5kM3sYNqz/tE1949F/zitqJhNw7SUwGwlE5Jwmss8+p P3oVRfeoK9LjL+n7C3rf/cnBHCzMmTazEF36Ab8rROQrZEP94rfsMnGsVpw25odm+ef3 KWlGRHNFoXYvjCKq3XVc5hoHggi7VW+WEFQt9B9C0wZvq/dyQcyHr0wezH/OXlbyR7UG NZ4acvcwOlwB8g+hvDTp5sjqU6myhtE25N0LQsx+G/kPGgj0gB31wL7HYyjs9gc1f1NE H2qg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=scJAexGMppZXuxA/pBKh/tuobp0tQo+fHCutI9SH7BI=; b=lKnm5C5za+dd7+y8Zpl6W+9PTA5B0/0gnswsXDLSiUIY8r4HdZjVBu13s3UoPOwS51 Az1107c85+NiCgwuuaXc6RSnF4msn5aEDjL+4ay2/iZ2bK46Pge9+M+ktnBVlUn30gAQ RYqJGgdjLQOhrmsBMyHhkPLYnd/U464mFRcC8o/8cJcaR8Pg9K704If/52eo+kQKH5Cx Mj0BOQ2r4rGVtong52FZWIN1+GjSylHNlDxIEWtoklWOCzPYJq+hdvKyWCM6C9dfmBEU ZdssTYVecIYYTLLodQWlSKC7DvvquH4Y6e85BplP+t0L+6KoCblvTN65KSpJIB3WOYl1 S/6Q== X-Gm-Message-State: AFeK/H0ktzyYo1vGIgP3zn56Oqccho/bfc2irLfuhpV9nXXpj+UOOLvfRBZBzNI5Er9IHw== X-Received: by 10.28.183.4 with SMTP id h4mr4304867wmf.32.1489691806322; Thu, 16 Mar 2017 12:16:46 -0700 (PDT) Received: from [192.168.1.18] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id t103sm7279458wrc.43.2017.03.16.12.16.44 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Mar 2017 12:16:45 -0700 (PDT) From: Yoav Nir Message-Id: <5EF7EC11-B453-4FBE-82CB-B3BFB6D9C546@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_332E2D29-16D5-4EF7-807A-DE08C5F201DA"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Thu, 16 Mar 2017 21:16:42 +0200 In-Reply-To: <9AF98D89-9183-49F6-A30A-8A2E3301F81E@gmail.com> Cc: Eric Rescorla , "tls@ietf.org" To: Kathleen.Moriarty.ietf@gmail.com References: <9D719372-7B07-406B-8C8B-2AC762BDB5F2@gmail.com> <9AF98D89-9183-49F6-A30A-8A2E3301F81E@gmail.com> X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Uplifting 5289 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 19:16:50 -0000 --Apple-Mail=_332E2D29-16D5-4EF7-807A-DE08C5F201DA Content-Type: multipart/alternative; boundary="Apple-Mail=_C3749F32-E51D-4B2A-AF7B-F634B3D3505D" --Apple-Mail=_C3749F32-E51D-4B2A-AF7B-F634B3D3505D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 16 Mar 2017, at 21:01, Kathleen.Moriarty.ietf@gmail.com wrote: >=20 >=20 >=20 > Please excuse typos, sent from handheld device >=20 >> On Mar 16, 2017, at 11:37 AM, Yoav Nir wrote: >>=20 >>=20 >>> On 16 Mar 2017, at 17:17, Eric Rescorla wrote: >>>=20 >>> Hi folks >>>=20 >>> I note that we are proposing to uplift RFC 5289 to PS, despite the = fact that it >>> standardizes some CBC cipher suites, which the WG is looking to move = away >>> from. I recognize that these are the only cipher suites you can use = in TLS 1.0 >>> and 1.1, but we also want people to move away from them. >>>=20 >>> This problem is probably solvable by marking the registry as Not = Recommended, but I wondered if anyone had other thoughts on this topic? >>>=20 >>=20 >> 5289 applies to TLS 1.0, 1.1, and 1.2. It seems strange to uplift a = bunch of ciphersuites for 1.2 just as we=E2=80=99re publishing TLS 1.3 = which obsoletes 5246. >=20 > TLS 1.2 will be in use for a while unless major problems are found, so = it's worthwhile IMO. I understand that. I=E2=80=99m wondering what message we are trying to = convey by publishing or uplifting a full standard for a now-obsolete = protocol. The Internet works just fine on proposed standards (or even Internet = Drafts) Yoav --Apple-Mail=_C3749F32-E51D-4B2A-AF7B-F634B3D3505D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On 16 Mar 2017, at 21:01, Kathleen.Moriarty.ietf@gmail.com wrote:



Please excuse typos, sent from handheld = device 

On Mar 16, 2017, at 11:37 = AM, Yoav Nir <ynir.ietf@gmail.com> wrote:


On 16 Mar = 2017, at 17:17, Eric Rescorla <ekr@rtfm.com> wrote:

Hi = folks

I note that we are proposing to = uplift RFC 5289 to PS, despite the fact that it
standardizes= some CBC cipher suites, which the WG is looking to move away
from. I recognize that these are the only cipher suites you = can use in TLS 1.0
and 1.1, but we also want people to = move away from them.

This problem is = probably solvable by marking the registry as Not Recommended, but I = wondered if anyone had other thoughts on this topic?


5289 applies to TLS 1.0, 1.1, and = 1.2.  It seems strange to uplift a bunch of ciphersuites for 1.2 = just as we=E2=80=99re publishing TLS 1.3 which obsoletes 5246.

TLS 1.2 will be in use for a while unless major = problems are found, so it's worthwhile IMO.

I understand that. I=E2=80=99m wondering what = message we are trying to convey by publishing or uplifting a full = standard for a now-obsolete protocol. 

The Internet works just fine on = proposed standards (or even Internet Drafts)

Yoav

= --Apple-Mail=_C3749F32-E51D-4B2A-AF7B-F634B3D3505D-- --Apple-Mail=_332E2D29-16D5-4EF7-807A-DE08C5F201DA Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYyuSbAAoJELhJCxUKWMyZhhAH/28VBqoMgTG52djh0hh2Bbv5 k/GZg2kV34TFGpT3rZwbhKPvglAc/B9GrKtS3lCqBpU//x8odFDvSKU8qWRA0lnZ LPRHGbjUI6xBZCZN5jKxhz8hhNuSqmpQ7BU7lUIBSIpW3/xS9Dg9nwMb5sw/PEbk /gWTlfO2Z3Gwi7rszCSkO4GzLVQiTcE3Ogqjlz/7kXh7kPXGNj9AiEmtRxH9kolE 76nqAtSiUKMx5w6vszzC+eZpMwqP1OxNx2DMBsiFlbkJk0STTMszK4Y0BvshLcxd qM8bL+WRP2zEum4xy1otMTDPE0ae4DJSYaSUplFgvsgGl28fCqLGo4k8iLMo9Ss= =lWzP -----END PGP SIGNATURE----- --Apple-Mail=_332E2D29-16D5-4EF7-807A-DE08C5F201DA-- From nobody Thu Mar 16 12:24:04 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F1A4D1299E6 for ; Thu, 16 Mar 2017 12:24:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TA5rVz2W9_Xi for ; Thu, 16 Mar 2017 12:24:01 -0700 (PDT) Received: from mail-yw0-x230.google.com (mail-yw0-x230.google.com [IPv6:2607:f8b0:4002:c05::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 05463129A0D for ; Thu, 16 Mar 2017 12:24:01 -0700 (PDT) Received: by mail-yw0-x230.google.com with SMTP id v198so39749492ywc.2 for ; Thu, 16 Mar 2017 12:24:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=9KsClUjySn8Azm5sDkOBx1r1v/2yJbSvowWuJawOrY4=; b=kROLF8wIjZ8korDAhB6RJA1ATHS8dqqxeDGXy7sS6GAPTfy7udTtT+YCmLCksYcvox JUpIN/LYnR1Z01FtN3QeF1DpbLSjIufocPGPgbYOZUH6DMK70H15d03r/bOwi1UCGaqk Rz4vIEJqb2VqoD2+udl/4VWZxARnI/lVwwjp6i5tDxNgNJabPbu36UoYSf/EfKLz45Y8 2kVx8IpH5SVkOqGSJXSgWwP5gOqf5Oro4ZhORYzyLvX2fL0A85Im+YW0JkDixKpT5Bm7 nsMSTBFtvSdPMYS1J08+TT4PrrWVWE2NKUBuqBOy1rFKpnqesPo4zAzsfhcAfIzVQ4zv GLJw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=9KsClUjySn8Azm5sDkOBx1r1v/2yJbSvowWuJawOrY4=; b=nSDijCpR8xrIyopN7fCqcNiyA2Jl4IcAKwHbAlJz7RnkVKYz9ERIxC/cX4Ee4h7Di3 Ofb4ibfeyzhydaeOnPjLw9+Y3Sk2HUkUAdXAt3xq6ctpNk5mW3uRx59t8zl9X9Homs6r XxYto0d5E6zPcFakPQYZXi9RVli2uC5gd4tUiAMueDFa4cl8IhMkrfnCXI2TFYaabb0P 6fCcpOZx32FmbvHsNIfiY5AnxXQPS4s3/HipJFWlN51NBinkJxT8Fqlvkpw+pC03y8xu TOcisUePSKLN7RvpiYlGqIWs9bwaxEMpoW6+ncpR2ct1bRsoVI5K78RSglswJOt8j36p MUIg== X-Gm-Message-State: AFeK/H2TgXspw03gqLRDN9ONhu9232lvKftyYfHpvo5ZlnSK3JkRE4knhDhOYyQGEJWJ2V1Qtumxz3OI2Q4P0Q== X-Received: by 10.129.92.84 with SMTP id q81mr4797368ywb.87.1489692240219; Thu, 16 Mar 2017 12:24:00 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Thu, 16 Mar 2017 12:23:19 -0700 (PDT) In-Reply-To: <5EF7EC11-B453-4FBE-82CB-B3BFB6D9C546@gmail.com> References: <9D719372-7B07-406B-8C8B-2AC762BDB5F2@gmail.com> <9AF98D89-9183-49F6-A30A-8A2E3301F81E@gmail.com> <5EF7EC11-B453-4FBE-82CB-B3BFB6D9C546@gmail.com> From: Eric Rescorla Date: Thu, 16 Mar 2017 12:23:19 -0700 Message-ID: To: Yoav Nir Cc: Kathleen Moriarty , "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a114d8570cda632054ade0089 Archived-At: Subject: Re: [TLS] Uplifting 5289 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 19:24:03 -0000 --001a114d8570cda632054ade0089 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable This is actually uplift to PS. On Thu, Mar 16, 2017 at 12:16 PM, Yoav Nir wrote: > > On 16 Mar 2017, at 21:01, Kathleen.Moriarty.ietf@gmail.com wrote: > > > > Please excuse typos, sent from handheld device > > On Mar 16, 2017, at 11:37 AM, Yoav Nir wrote: > > > On 16 Mar 2017, at 17:17, Eric Rescorla wrote: > > Hi folks > > I note that we are proposing to uplift RFC 5289 to PS, despite the fact > that it > standardizes some CBC cipher suites, which the WG is looking to move away > from. I recognize that these are the only cipher suites you can use in TL= S > 1.0 > and 1.1, but we also want people to move away from them. > > This problem is probably solvable by marking the registry as Not > Recommended, but I wondered if anyone had other thoughts on this topic? > > > 5289 applies to TLS 1.0, 1.1, and 1.2. It seems strange to uplift a bunc= h > of ciphersuites for 1.2 just as we=E2=80=99re publishing TLS 1.3 which ob= soletes > 5246. > > > TLS 1.2 will be in use for a while unless major problems are found, so > it's worthwhile IMO. > > > I understand that. I=E2=80=99m wondering what message we are trying to co= nvey by > publishing or uplifting a full standard for a now-obsolete protocol. > > The Internet works just fine on proposed standards (or even Internet > Drafts) > > Yoav > > --001a114d8570cda632054ade0089 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
This is actually uplift to PS.

On Thu, Mar 16, 2017 at 12:16 PM, Yoav = Nir <ynir.ietf@gmail.com> wrote:

On 16 Mar 2017, at 21:01, Kathleen.Moriarty.ietf@gmai= l.com wrote:



Please excuse typos, = sent from handheld device=C2=A0

On Mar 16, 2017, at 11:37 = AM, Yoav Nir <y= nir.ietf@gmail.com> wrote:


On 1= 6 Mar 2017, at 17:17, Eric Rescorla <ekr@rtfm.com> wrote:

Hi folks

I note th= at we are proposing to uplift RFC 5289 to PS, despite the fact that it
s= tandardizes some CBC cipher suites, which the WG is looking to move awayfrom. I recognize that these are the only cipher suites you can use in TLS= 1.0
and 1.1, but we also want people to move away from them.

Thi= s problem is probably solvable by marking the registry as Not Recommended, = but I wondered if anyone had other thoughts on this topic?


5289 applies to TLS 1.0, 1.1, and 1.2.=C2=A0 It seems strange to up= lift a bunch of ciphersuites for 1.2 just as we=E2=80=99re publishing TLS 1= .3 which obsoletes 5246.


I unde= rstand that. I=E2=80=99m wondering what message we are trying to convey by = publishing or uplifting a full standard for a now-obsolete protocol.=C2=A0<= /div>

The Internet works just fine on proposed standards= (or even Internet Drafts)

Yoav


--001a114d8570cda632054ade0089-- From nobody Thu Mar 16 13:33:27 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1CC35129A64 for ; Thu, 16 Mar 2017 13:33:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.699 X-Spam-Level: X-Spam-Status: No, score=-1.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FREEMAIL_REPLY=1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9k0Wh9Q0ukMG for ; Thu, 16 Mar 2017 13:33:24 -0700 (PDT) Received: from mail-wm0-x22a.google.com (mail-wm0-x22a.google.com [IPv6:2a00:1450:400c:c09::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6551F129A58 for ; Thu, 16 Mar 2017 13:33:24 -0700 (PDT) Received: by mail-wm0-x22a.google.com with SMTP id n11so1302506wma.0 for ; Thu, 16 Mar 2017 13:33:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=XIwNhSCWRmh1xtjww+8d5xJs4sBkswAw88eglsTtLso=; b=C0wV0BrhsRzADBR63b6hTBoWKQ2TIAsHmiG78StFFukMuHFiBov5cM+VcRGf42PAPo pu72d/ublmITWmGCTV+H3+I3SaZGX0vN5MVh+BYHz6wMWGEIZm2rolU4cm3mw5AbJse7 TC1TUFI0O1yLLlcSnFJ1xLdlOlHz0KzQjKKN3AYKD2MLFGZCUOm2c6MngUOl18lMEhik NzcQdrE3S+Mo3/glD6ohRdqFa34PmjbnpMgwoHanr6Jgled50OCOihersRnqduaR3W65 uRPXEYPBcwgGnOqS7edSFYlz01fw3QTuj4nBTmoJ1fgdm6WeDgB6nFkOzltK+6+RCghr 0osQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=XIwNhSCWRmh1xtjww+8d5xJs4sBkswAw88eglsTtLso=; b=JEbVh/x2vWK0FOaTaxpxc7vMn6SttvnXRN/Z1e/ADjZWfluQaC9PMYgEaoDcF9CWtV bqbT4V7pBzfpLOhBf9rrImvhsd8yjgKe+bqvBobbz0OXVtJ7EcOel/AkrzkQ1kADkxHX KX8eeRG227FZy4MWNLNVTZzzGuMxa956gkreRZxBh3hO1ahs1TU0YnAWuwqYhu5hmLS5 lh/yBJb7EycFjEsTwPPw4ar6chxPMxs1vbiEcVHqxaB6hDZnkVrYiy1QlKrZO67+A3jn veNezo0SxvlxdfeVR6FcHvZpmHXVC19j8tLENhKL6xdYsVfpnoIGxNsMJsmNESWdO367 NRGg== X-Gm-Message-State: AFeK/H0IkAEp/nDoSumFbuJE5Q6PD3K5GXXffnnl2MzniAtAO59IJTFLPAmnma60xS0N2Q== X-Received: by 10.28.107.13 with SMTP id g13mr10884820wmc.105.1489696402924; Thu, 16 Mar 2017 13:33:22 -0700 (PDT) Received: from [192.168.1.18] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id h65sm5838440wrh.32.2017.03.16.13.33.21 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Mar 2017 13:33:22 -0700 (PDT) From: Yoav Nir Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_AF782F2A-F9E7-48A1-8426-033A753FC61B"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Thu, 16 Mar 2017 22:33:19 +0200 In-Reply-To: Cc: Kathleen Moriarty , "tls@ietf.org" To: Eric Rescorla References: <9D719372-7B07-406B-8C8B-2AC762BDB5F2@gmail.com> <9AF98D89-9183-49F6-A30A-8A2E3301F81E@gmail.com> <5EF7EC11-B453-4FBE-82CB-B3BFB6D9C546@gmail.com> X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Uplifting 5289 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 20:33:26 -0000 --Apple-Mail=_AF782F2A-F9E7-48A1-8426-033A753FC61B Content-Type: multipart/alternative; boundary="Apple-Mail=_37C6D359-DFFC-4245-92B9-4FC43925153C" --Apple-Mail=_37C6D359-DFFC-4245-92B9-4FC43925153C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Oh, sorry. I missed that it was Informational. In that case there=E2=80=99s just the issue that it has ECDH = ciphersuites at a time where 4492bis is deprecating all the other ones. = But some of the ciphersuites in there are in wide enough use that it = shouldn=E2=80=99t remain Informational. Yes, it should be uplifted then. Yoav > On 16 Mar 2017, at 21:23, Eric Rescorla wrote: >=20 > This is actually uplift to PS. >=20 > On Thu, Mar 16, 2017 at 12:16 PM, Yoav Nir > wrote: >=20 >> On 16 Mar 2017, at 21:01, Kathleen.Moriarty.ietf@gmail.com = wrote: >>=20 >>=20 >>=20 >> Please excuse typos, sent from handheld device >>=20 >>> On Mar 16, 2017, at 11:37 AM, Yoav Nir > wrote: >>>=20 >>>=20 >>>> On 16 Mar 2017, at 17:17, Eric Rescorla > wrote: >>>>=20 >>>> Hi folks >>>>=20 >>>> I note that we are proposing to uplift RFC 5289 to PS, despite the = fact that it >>>> standardizes some CBC cipher suites, which the WG is looking to = move away >>>> from. I recognize that these are the only cipher suites you can use = in TLS 1.0 >>>> and 1.1, but we also want people to move away from them. >>>>=20 >>>> This problem is probably solvable by marking the registry as Not = Recommended, but I wondered if anyone had other thoughts on this topic? >>>>=20 >>>=20 >>> 5289 applies to TLS 1.0, 1.1, and 1.2. It seems strange to uplift a = bunch of ciphersuites for 1.2 just as we=E2=80=99re publishing TLS 1.3 = which obsoletes 5246. >>=20 >> TLS 1.2 will be in use for a while unless major problems are found, = so it's worthwhile IMO. >=20 > I understand that. I=E2=80=99m wondering what message we are trying to = convey by publishing or uplifting a full standard for a now-obsolete = protocol. >=20 > The Internet works just fine on proposed standards (or even Internet = Drafts) >=20 > Yoav >=20 >=20 --Apple-Mail=_37C6D359-DFFC-4245-92B9-4FC43925153C Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Oh, sorry. I missed that it was Informational.

In that case there=E2=80=99= s just the issue that it has ECDH ciphersuites at a time where 4492bis = is deprecating all the other ones.  But some of the ciphersuites in = there are in wide enough use that it shouldn=E2=80=99t remain = Informational. 

Yes, it should be uplifted then.

Yoav

On = 16 Mar 2017, at 21:23, Eric Rescorla <ekr@rtfm.com> wrote:

This is actually uplift to PS.

On Thu, = Mar 16, 2017 at 12:16 PM, Yoav Nir <ynir.ietf@gmail.com> wrote:

On 16 Mar 2017, at 21:01, Kathleen.Moriarty.ietf@gmail.com = wrote:



Please excuse typos, sent = from handheld device =

On Mar 16, 2017, at 11:37 AM, Yoav Nir <ynir.ietf@gmail.com> wrote:


On 16 Mar = 2017, at 17:17, Eric Rescorla <ekr@rtfm.com> wrote:
Hi folks

I note that we are = proposing to uplift RFC 5289 to PS, despite the fact that it
standardizes some CBC cipher suites, which the WG is looking = to move away
from. I recognize that these are the only = cipher suites you can use in TLS 1.0
and 1.1, but we also = want people to move away from them.

This = problem is probably solvable by marking the registry as Not Recommended, = but I wondered if anyone had other thoughts on this topic?


5289 applies to = TLS 1.0, 1.1, and 1.2.  It seems strange to uplift a bunch of = ciphersuites for 1.2 just as we=E2=80=99re publishing TLS 1.3 which = obsoletes 5246.

TLS 1.2 will be in use for = a while unless major problems are found, so it's worthwhile = IMO.

I understand that. I=E2=80=99m wondering what message we are = trying to convey by publishing or uplifting a full standard for a = now-obsolete protocol. 

The Internet works just fine on = proposed standards (or even Internet Drafts)

Yoav



= --Apple-Mail=_37C6D359-DFFC-4245-92B9-4FC43925153C-- --Apple-Mail=_AF782F2A-F9E7-48A1-8426-033A753FC61B Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYyvaQAAoJELhJCxUKWMyZ59UH/1aRI0kGR7UdwUS6gOpqmmj0 UHBzFi8//3SFvRWVc2JvqhbHu4vLEjrgVTyLuSy+s821ziAIFL/WfITmRLRo/tot 7PAfpwxs0Cl2F9K+AJisyIjTBG1o8WbLCDqw6eLJOdw+HUJvs74pl4gtl762pOza ZX5a9ZVtF07salQnq8C4Vio1B3V2337PEcxrbo/I3pjCdEvkan5m8iCU7qm47WSH ADrjM96pQBZ6HdFZc7HlQsi2HenCUO2exruVg7+GY+LFiYIoBhM/nEVFf8vnKgeO /9foifSBZHGbNZMh14UWHZXSTZNBAHDeOgkvru9J3/dHhvaRLJoXDuzb55vtsnA= =iih2 -----END PGP SIGNATURE----- --Apple-Mail=_AF782F2A-F9E7-48A1-8426-033A753FC61B-- From nitin.shrivastav@broadcom.com Thu Mar 16 12:12:24 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7320B12995A for ; Thu, 16 Mar 2017 12:12:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=broadcom.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MatR2fAfmuPH for ; Thu, 16 Mar 2017 12:12:22 -0700 (PDT) Received: from mail-wr0-x22f.google.com (mail-wr0-x22f.google.com [IPv6:2a00:1450:400c:c0c::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9FFAD1296D4 for ; Thu, 16 Mar 2017 12:12:22 -0700 (PDT) Received: by mail-wr0-x22f.google.com with SMTP id u108so38600976wrb.3 for ; Thu, 16 Mar 2017 12:12:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=mime-version:from:date:message-id:subject:to; bh=vstKTLPyWKifEzSmzm7znCvSgMBQt96y6MRmu/V/3D0=; b=dd3nqID0NifDlxDRdm8Yb6VqfL2OBzaBoyz2hH904b2bfr0HcBFV5ULoclNCvx2h5f FoEsqQgdJj3EmSBNuB3Ws+RWJxyQ2TG1tnNwQA9grGJ8xgkI3rhuCTeeLhCOyeXAlLr6 VnbHa7N+DAFsZaH2ic1kn9/G+bIm4cz3sfVWA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=vstKTLPyWKifEzSmzm7znCvSgMBQt96y6MRmu/V/3D0=; b=P8wEIZCXD9IXLUGw/ptTxj4RrsPiZVlwnAtyEmVBJ96HTy35f+q5/BIsmRLVAzo5vI VxkhYESysi9p555G3wLjGaBECzqU3yc0UxuTLWGrcUCHT5jrI9fduki70exK6hi3azDt HV2+rgFL+amyRRqutZc6zIBU5A1GMyBS2RNZuEtnpvnsTwmv8kuSxgBMb6BBPY2W0bqx q3PaUyekpq6u9Ev2UAv5L+WOY+7wzmsgpsxxMMMALXvFAyVCBsYTYod97EYd7Waz4hi8 VJ8KCUO8bnzVoqi0vrGjdDfxSNBWSulZ4NfkTLV1Zf+cEMnfPnLvl1yBH/i6wq2gurAG wTWA== X-Gm-Message-State: AFeK/H26Pa5M3N6wEB8ZpFN8qvtKE3hpxs8Gg/JqkLysOq1bColDmJ9+n0BU7vBFWOj7A8ShendBbd8mbEZBGQly X-Received: by 10.223.165.6 with SMTP id i6mr10346447wrb.18.1489691540984; Thu, 16 Mar 2017 12:12:20 -0700 (PDT) MIME-Version: 1.0 Received: by 10.28.55.141 with HTTP; Thu, 16 Mar 2017 12:12:20 -0700 (PDT) From: Nitin Shrivastav Date: Thu, 16 Mar 2017 15:12:20 -0400 Message-ID: To: tls@ietf.org Content-Type: multipart/alternative; boundary=f403045f1640203801054addd7e5 Archived-At: X-Mailman-Approved-At: Thu, 16 Mar 2017 13:36:18 -0700 Subject: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 19:13:37 -0000 --f403045f1640203801054addd7e5 Content-Type: text/plain; charset=UTF-8 Hello, This is Nitin Shrivastav, Engineering Manager at Broadcom. I have a question on RFC 6066 Maximum Fragment Length Negotiation section The question i have is whether it is possible for a server to initiate the Max fragment length negotiation. The RFC describes a scenario where a constrained client can initiate this but in our product the server is very tightly constrained on memory and we want to reduce the memory used for SSL connections by forcing the clients to use reduce fragment length. We don't have control over the clients in our scenario which are basically the browsers like Chrome, IE etc. Thanks, Nitin --f403045f1640203801054addd7e5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hello,

This is Nit= in Shrivastav, Engineering Manager at Broadcom. I have a question on RFC 60= 66=C2=A0Maximum Fragment Length Negotiation=C2=A0section=C2=A0
<= br>
The question i have is wheth= er it is possible for a server to initiate the Max fragment length negotiat= ion. The RFC describes a scenario where a constrained client can initiate t= his but in our product the server is very tightly constrained on memory and= we want to reduce the memory used for SSL connections by forcing the clien= ts to use reduce fragment length. We don't have control over the client= s in our scenario which are basically the browsers like Chrome, IE etc.

Thanks,
=
Nitin
--f403045f1640203801054addd7e5-- From nobody Thu Mar 16 13:49:06 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 918C8129A67 for ; Thu, 16 Mar 2017 13:49:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VzM0nlv-tIU6 for ; Thu, 16 Mar 2017 13:49:04 -0700 (PDT) Received: from mail-wm0-x241.google.com (mail-wm0-x241.google.com [IPv6:2a00:1450:400c:c09::241]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A0925129A6C for ; Thu, 16 Mar 2017 13:49:03 -0700 (PDT) Received: by mail-wm0-x241.google.com with SMTP id u132so308098wmg.1 for ; Thu, 16 Mar 2017 13:49:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=D/iesGjRNKcO7kaHx7eEee81c4GPlHEkZ2qHqGX2XmQ=; b=cmgH7qIktPG4lexE8xxkfswVs04gE4P6Jm84S91exm1mW4Jcyoxq1dhFqPkzu29d+V Phs5gYilgxKxXBc+p6W+Y1azTemaMZ7ocr9oCiaORLDT7J1QnWBqKx3xQChBtxrv77zF TDtuHCvqByAQq71jLvTYFBif2gagvlkf20F6AzgjgkbmHzR06GxP3GIeFGi/OvByg2tI OSK4OV414ar8VBqtQz76CwiiDePU5uRlb2GDAlCn0i2NzOK3PcIwcA+e6IbDythjGN10 KUdC53u8kJVhxA1jzrT1cuskZdEjDOg5UDZTnaJswlPLm1ExLdgv6TKzmfzx8Rr4SDpV shEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=D/iesGjRNKcO7kaHx7eEee81c4GPlHEkZ2qHqGX2XmQ=; b=myJG+3UupuFOel0kEmKk9nftYh1Gy7OKrOnpp1LBc6QRkXSMTzb9FEERB7hsk5bdjB LrOThUsbMlWeszVp3CiVgHrqvCiHt38Ie2AoycA4fFgB9lzhaDpLrgZAovQ6mZjn7Kv1 WNNmsxaqvBLAtKnqQ97rb/Fadd/BbJQ2Nkho7VIW9eMj7CjQ5LeCaiJlplgxq1HEpcHq hJsj9lIacu3pj8YjDIZ6xzKW9bwlx+ATMOVnrAIO5U3PjgywoLJ9VHmu6MQ83TKAzjBu 3tYyM1+FmL+jbPTNFjeDOBcJXCN68AA/3CkeD58aV3+gIVbUuMIpBsVd59Qpy8irYdrC 3PQA== X-Gm-Message-State: AFeK/H169LjaRjyLfKrtdzxJfJMB8nK1X8d0C8WCNNpnmwhPl6XTLbeT25K1D5PTAL0Dug== X-Received: by 10.28.147.129 with SMTP id v123mr11218329wmd.51.1489697342236; Thu, 16 Mar 2017 13:49:02 -0700 (PDT) Received: from [192.168.1.18] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id d6sm200511wmd.6.2017.03.16.13.49.01 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Mar 2017 13:49:01 -0700 (PDT) From: Yoav Nir Message-Id: <65683BD2-FED2-4953-AA48-92E262F06650@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_F7362D6C-DDD6-484B-86FB-BCE5B4926760"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Thu, 16 Mar 2017 22:48:58 +0200 In-Reply-To: Cc: tls@ietf.org To: Nitin Shrivastav References: X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 20:49:06 -0000 --Apple-Mail=_F7362D6C-DDD6-484B-86FB-BCE5B4926760 Content-Type: multipart/alternative; boundary="Apple-Mail=_CB677DDE-0E13-4464-AF2F-169E1B248216" --Apple-Mail=_CB677DDE-0E13-4464-AF2F-169E1B248216 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi, Nitin. In section 7.4.1.4 of RFC 5246 it says: An extension type MUST NOT appear in the ServerHello unless the same extension type appeared in the corresponding ClientHello. So the answer is no. Only the client may request this. Yoav > On 16 Mar 2017, at 21:12, Nitin Shrivastav = wrote: >=20 > Hello, >=20 > This is Nitin Shrivastav, Engineering Manager at Broadcom. I have a = question on RFC 6066 Maximum Fragment Length Negotiation section >=20 > The question i have is whether it is possible for a server to initiate = the Max fragment length negotiation. The RFC describes a scenario where = a constrained client can initiate this but in our product the server is = very tightly constrained on memory and we want to reduce the memory used = for SSL connections by forcing the clients to use reduce fragment = length. We don't have control over the clients in our scenario which are = basically the browsers like Chrome, IE etc. >=20 > Thanks, > Nitin > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls --Apple-Mail=_CB677DDE-0E13-4464-AF2F-169E1B248216 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Hi, Nitin.

In section 7.4.1.4 of RFC 5246 it says:

   An extension type =
MUST NOT appear in the ServerHello unless the same
   extension type appeared in the corresponding =
ClientHello.

So the answer is no. Only the client may request = this.

Yoav

On 16 Mar 2017, at 21:12, Nitin = Shrivastav <nitin.shrivastav@broadcom.com> wrote:

Hello,

This is Nitin Shrivastav, = Engineering Manager at Broadcom. I have a question on RFC = 6066 Maximum Fragment Length = Negotiation section 

The question i have is whether it is possible for a server to = initiate the Max fragment length negotiation. The RFC describes a = scenario where a constrained client can initiate this but in our product = the server is very tightly constrained on memory and we want to reduce = the memory used for SSL connections by forcing the clients to use reduce = fragment length. We don't have control over the clients in our scenario = which are basically the browsers like Chrome, IE = etc.

Thanks,
Nitin
_______________________________________________
TLS = mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

= --Apple-Mail=_CB677DDE-0E13-4464-AF2F-169E1B248216-- --Apple-Mail=_F7362D6C-DDD6-484B-86FB-BCE5B4926760 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYyvo7AAoJELhJCxUKWMyZu9cH/3O1io5myyow7eAZf4nHSL0J XtuAFH59Zl5OXlmaT80f09hgh+Xik+3kFvD1REC0ih2t4QwYLoQe6PV/zDfMr09p slMS2z+drT6adgtWEJ4ZxiljKXNODZHEQIvb8cR9CY127x9hrmnp6IuexLeNrkVs U2SXX84KvUmirgEL7EeODO/UeOTAbwJjSoELCT5w9JjwDDiJB5u7T0kjBgpMkn8P RrOvr+5lA+vPLIrEDRdV3tZaAyZOpyv+xnWxLdGfYR/pByMNzB31EHzDJT5Tf5ui DOhBSemIkZ0q+QF71vjPoR/ENk5gPR5hU1zFEI+AFZEDMuaa9ElwN5vmkpmjgZY= =fpA8 -----END PGP SIGNATURE----- --Apple-Mail=_F7362D6C-DDD6-484B-86FB-BCE5B4926760-- From nobody Thu Mar 16 14:00:03 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 85B09129A83 for ; Thu, 16 Mar 2017 14:00:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CU6zGMAlkVP0 for ; Thu, 16 Mar 2017 13:59:59 -0700 (PDT) Received: from mail-wm0-x242.google.com (mail-wm0-x242.google.com [IPv6:2a00:1450:400c:c09::242]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7837B129A89 for ; Thu, 16 Mar 2017 13:59:59 -0700 (PDT) Received: by mail-wm0-x242.google.com with SMTP id n11so353024wma.0 for ; Thu, 16 Mar 2017 13:59:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=xkXlD5GJnvv4fICzcGRfXd3azO5+KUkFzFWkAid0mTQ=; b=o+Qem3FFb0k/F2nNa9581nBhU7jXsXI53+0JnVU7hgrUG3y8K7ArerAn+EDaP11aXV JXBetvZ6VSnhCE+0Ttwv6q/p+dKKmGoE8HWNDv/fh0pNfYLl37CbpEo1U4TVb91S8EXg FnvZZ/2Uw+WnMOMGV89oZsDa/VinzPkUfLwHW8HwkfgHGrzbuM9vrHrm2ahu3uGs4oOB O3PlLVN1v4Y3aFbw+H1KFO+pBufeD3+nU5Q+d8xr/SMBy0pQpCsb+0dudDJDwHgc16L9 mpjixoD3MOyhuzTS0KmcC5E+yG9hIlbfrxSGZ3isigmJb0luiikwxV3B2x1snYom3358 HKgQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=xkXlD5GJnvv4fICzcGRfXd3azO5+KUkFzFWkAid0mTQ=; b=J1BnEiZhqiD6Hb5KWemJCxTLaOc3Tsb8Uvo6gQ46byc9MO3PlsDwFsb3dPxwX6Kpyj 2tC7zofQwL3whqC6bBx2hBX37f94JlbaHnABLHA5vKCVrJU264qxxGguSv3+26GYV0dR CjgIjNHbU6xzrqwMrDK9GrS7BaVrhASXGN/oxlIxYQekgngRobuwA84rtOey41HN9aHj BZUebohSC8cEP8UsHcXJNyPzQeKsvSgPX8JHc6O3fCtbDePODOZPIGKNbum410Yevu7u s3XWIc0IThtR/e0EjBNx2rR0KKRoWaSD3zDuB0VjNjOWJs8XF1M3aSwY9knNYhCuLF7S OHHQ== X-Gm-Message-State: AFeK/H1PErAgMHQQ8wwdpj4i6VQv5Z/cWyrdy9obPoGr6Np0pGimm7ph9udWXx8E5syllA== X-Received: by 10.28.158.148 with SMTP id h142mr6368548wme.36.1489697998011; Thu, 16 Mar 2017 13:59:58 -0700 (PDT) Received: from [192.168.1.18] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id k139sm221342wmg.11.2017.03.16.13.59.56 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Mar 2017 13:59:57 -0700 (PDT) From: Yoav Nir Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_CED555AE-A293-4364-8A6C-142D168A144C"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Thu, 16 Mar 2017 22:59:54 +0200 In-Reply-To: Cc: tls@ietf.org To: Nitin Shrivastav References: <65683BD2-FED2-4953-AA48-92E262F06650@gmail.com> X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 21:00:01 -0000 --Apple-Mail=_CED555AE-A293-4364-8A6C-142D168A144C Content-Type: multipart/alternative; boundary="Apple-Mail=_4CF19FB8-FA31-4E62-BE4F-925ED1EB8800" --Apple-Mail=_4CF19FB8-FA31-4E62-BE4F-925ED1EB8800 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 16 Mar 2017, at 22:52, Nitin Shrivastav = wrote: >=20 > Thanks Yoav. I am assuming it is true for TLS1.2 also? RFC 5246 *is* TLS 1.2. But it=E2=80=99s true for previous versions and = for 1.3 as well. >=20 > It would be nice to provide a mechanism for servers to do this as we = are trying to run a web server in a constrained IoT end-points with only = tens of KBytes of RAM and SSL/TLS based connection is important.. I don=E2=80=99t get if you mean that the constrained end-point is the = client or the server. But either way, both sides can be configured to = use small records. You only really need this extension when you both = have large amounts of data (so large records would be used without this = extension) and the server is a generic web server that responds to both = constrained and non-constrained devices. But even in that case, adding the extension to the ClientHello should = not be infeasible. Yoav > On Thu, Mar 16, 2017 at 4:48 PM, Yoav Nir > wrote: > Hi, Nitin. >=20 > In section 7.4.1.4 of RFC 5246 it says: >=20 > An extension type MUST NOT appear in the ServerHello unless the = same > extension type appeared in the corresponding ClientHello. >=20 > So the answer is no. Only the client may request this. >=20 > Yoav >=20 >> On 16 Mar 2017, at 21:12, Nitin Shrivastav = > = wrote: >>=20 >> Hello, >>=20 >> This is Nitin Shrivastav, Engineering Manager at Broadcom. I have a = question on RFC 6066 Maximum Fragment Length Negotiation section >>=20 >> The question i have is whether it is possible for a server to = initiate the Max fragment length negotiation. The RFC describes a = scenario where a constrained client can initiate this but in our product = the server is very tightly constrained on memory and we want to reduce = the memory used for SSL connections by forcing the clients to use reduce = fragment length. We don't have control over the clients in our scenario = which are basically the browsers like Chrome, IE etc. >>=20 >> Thanks, >> Nitin >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls = >=20 >=20 --Apple-Mail=_4CF19FB8-FA31-4E62-BE4F-925ED1EB8800 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On 16 Mar 2017, at 22:52, Nitin Shrivastav <nitin.shrivastav@broadcom.com> wrote:

Thanks Yoav. I am assuming it is true for TLS1.2 = also?

RFC 5246 *is* = TLS 1.2.  But it=E2=80=99s true for previous versions and for 1.3 = as well.

It would be nice to provide a mechanism = for servers to do this as we are trying to run a web server in a = constrained IoT end-points with only tens of KBytes of RAM and SSL/TLS = based connection is important..

I don=E2=80=99t get if you mean that the constrained = end-point is the client or the server. But either way, both sides can be = configured to use small records. You only really need this extension = when you both have large amounts of data (so large records would be used = without this extension) and the server is a generic web server that = responds to both constrained and non-constrained = devices. 

But even in that = case, adding the extension to the ClientHello should not be = infeasible.

Yoav

On Thu, Mar 16, 2017 at = 4:48 PM, Yoav Nir <ynir.ietf@gmail.com> wrote:
Hi, Nitin.

In section 7.4.1.4 of RFC 5246 it = says:

   An extension type MUST NOT appear in the =
ServerHello unless the same
   extension type appeared in the corresponding =
ClientHello.

So the answer is no. Only the client may request = this.

Yoav

On 16 = Mar 2017, at 21:12, Nitin Shrivastav <nitin.shrivastav@broadcom.com> = wrote:

Hello,

This is = Nitin Shrivastav, Engineering Manager at Broadcom. I have a question on = RFC 6066 Maximum Fragment Length Negotiation section 

The question i = have is whether it is possible for a server to initiate the Max fragment = length negotiation. The RFC describes a scenario where a constrained = client can initiate this but in our product the server is very tightly = constrained on memory and we want to reduce the memory used for SSL = connections by forcing the clients to use reduce fragment length. We = don't have control over the clients in our scenario which are basically = the browsers like Chrome, IE etc.

Thanks,
Nitin
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls



= --Apple-Mail=_4CF19FB8-FA31-4E62-BE4F-925ED1EB8800-- --Apple-Mail=_CED555AE-A293-4364-8A6C-142D168A144C Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJYyvzLAAoJELhJCxUKWMyZbOwIAIb/mmQ2lImPUFGlmpJK8oA/ 0nR9JRA7zstwYns+XuTmjjJD/ZKG7F0pOUNULAtLA+sVnIC+7aaqG1l1cgx+fURG 7Baxt3TCukuOctPP06ypBEPF6pMj0E5rf+hXzjcwwOsaM/mMyx2QQ27DrtQd3yzz RTbcoXh3ySGMBhEg4MMI3r7ZN6pvcC4eIH6hn5vN93QlYW8MC3HMGPmZsy7xvXP6 DBw777d+BHxDdZOyIH2WdyiWGkXl0uk/Elln/1X4A5B3eFfksx+MoNf+AJbPPgFY KFXeIC0mJLP7elw4V1LrXVgBGataCmmfgX9uQtH6kMBicQPB8WfkujMotsuSP3c= =jFc2 -----END PGP SIGNATURE----- --Apple-Mail=_CED555AE-A293-4364-8A6C-142D168A144C-- From nobody Thu Mar 16 16:18:34 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 45049129B59 for ; Thu, 16 Mar 2017 16:18:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z_e3H_kPGMa4 for ; Thu, 16 Mar 2017 16:18:31 -0700 (PDT) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB1B3129B63 for ; Thu, 16 Mar 2017 16:18:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1489706310; x=1521242310; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=HxHV9n+rit1jngkV9HrZiv2Qpov79K+TBqQ5i6pZVjg=; b=DOEdFFclpxAhPGOurdDeqhPhrRljzhKXBlcUWrMlLciKy0qKm5gixgoj QKB/WYxklM6zj+CU16JMjkDeiFKyHDtHbSh5uMacjw2ipeLqiuj+cgDuz YuwPufRklsVX9/IOgh16L8MQmDugcjj5PJk5+yKimqNqg+drX1CB53fj+ tash/5cL6S0vtpuTalkfiNcv0YQ1ACfLUX5+z7ixbT0HroDXR5zCSwWYj A/fdlOwLn1v0RkD85WQbQKaXOZ/fOZ304WwRQlY6Dfy7eZKXUMwQX+3SZ LIxulSzrwgdDAWTzh5z+Z1YldA9r9FBST/iau8a+1uWHIU1HtNp5CHdQx A==; X-IronPort-AV: E=Sophos;i="5.36,174,1486378800"; d="scan'208";a="143216095" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.2.8 - Outgoing - Outgoing Received: from exchangemx.uoa.auckland.ac.nz (HELO uxcn13-ogg-e.UoA.auckland.ac.nz) ([10.6.2.8]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 17 Mar 2017 12:18:28 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-ogg-e.UoA.auckland.ac.nz (10.6.2.8) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Fri, 17 Mar 2017 12:18:28 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1178.000; Fri, 17 Mar 2017 12:18:27 +1300 From: Peter Gutmann To: Nitin Shrivastav , "tls@ietf.org" Thread-Topic: [TLS] RFC 6066 - Max fragment length negotiation Thread-Index: AQHSnpUB8UgZsR1fnUWlpN1q8vk4DKGYGe7w Date: Thu, 16 Mar 2017 23:18:27 +0000 Message-ID: <1489706298995.98317@cs.auckland.ac.nz> References: In-Reply-To: Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 23:18:33 -0000 Nitin Shrivastav writes:=0A= =0A= >We don't have control over the clients in our scenario which are basically= =0A= >the browsers like Chrome, IE etc.=0A= =0A= I think a more important question would be "does any browser support this"?= =0A= Looking at:=0A= =0A= https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations=0A= =0A= it seems like the answer is mostly "no".=0A= =0A= Peter.=0A= =0A= From nobody Thu Mar 16 16:35:36 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65215129B63 for ; Thu, 16 Mar 2017 16:35:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=broadcom.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6tYRd_2d6If3 for ; Thu, 16 Mar 2017 16:35:33 -0700 (PDT) Received: from mail-yw0-x231.google.com (mail-yw0-x231.google.com [IPv6:2607:f8b0:4002:c05::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F079129A9B for ; Thu, 16 Mar 2017 16:35:33 -0700 (PDT) Received: by mail-yw0-x231.google.com with SMTP id p77so43421925ywg.1 for ; Thu, 16 Mar 2017 16:35:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=UgA7jJGJz8SuHDIetyv7eOttJALFbFusZVfN7uIFqzc=; b=GmU3uMXs5qrXaVdma0Yp1cQXyNT7X/Oef40Fmlu++D8zicNjil1vI3gN1R5LgpAiZ7 cWrlDdLB3L6oNWsDXLef0AWv0y57S2UW2BIWnZbvd3NzDk3SvV1m8grFUmvbCce/Lyra MHz8xrcKD1ZM/bc5MHaRLWjbRqik4J0DpvBbU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=UgA7jJGJz8SuHDIetyv7eOttJALFbFusZVfN7uIFqzc=; b=ZkSDkTA4iIub6dy9YRl6XhF0odfdBWL2UVx6SiVezm5nfQzAXZ65C7mre6l1bqx038 aDnkNmqUTUs8B+ptSKfG1NZKxK9+gPnXHRNSNEVnwC0YOh8KMn7ZRVb0wgtt/itAhatS xbVaHCYNEoTnipRteMSd1Yj8++ldXavz5Il+ZvYFrnAuKEOGWL//02F3+8Whznec9UDg 0hWW+ggsZTQ8pZWB/WcBohtVw9za7rlZkqcRzGpHtUoFzXge/uG+1wNLx6yWTVdD4TT/ 97gOVy/YEbgzss0cSYE9UC5ECrvTcxtbUYro2nTSh8OOLhEMlQK4Pt64r7HKm1mF8I8b LkuQ== X-Gm-Message-State: AFeK/H2/rTI4k+v8Is2Y5xjm2SFLv78IL+SPTZjlEm5uedZN9FMWNrf90Z46NqkE3CVeRcIK X-Received: by 10.129.82.196 with SMTP id g187mr609570ywb.89.1489707332543; Thu, 16 Mar 2017 16:35:32 -0700 (PDT) Received: from ?IPv6:2602:304:cd81:1060:5849:6f84:6e28:92fb? ([2602:304:cd81:1060:5849:6f84:6e28:92fb]) by smtp.gmail.com with ESMTPSA id z194sm414406ywg.73.2017.03.16.16.35.31 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Mar 2017 16:35:31 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Nitin Shrivastav X-Mailer: iPhone Mail (14D27) In-Reply-To: <1489706298995.98317@cs.auckland.ac.nz> Date: Thu, 16 Mar 2017 19:35:31 -0400 Cc: "tls@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> References: <1489706298995.98317@cs.auckland.ac.nz> To: Peter Gutmann Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 23:35:35 -0000 Thanks Peter, seems like this extension is not an option. I guess since our= server is serving the web pages to browsers, we should be able to predict t= he max amount of data that will be pushed when user submits the data on the w= eb page and tune the ssl buffer accordingly. > On Mar 16, 2017, at 7:18 PM, Peter Gutmann wro= te: >=20 > Nitin Shrivastav writes: >=20 >> We don't have control over the clients in our scenario which are basicall= y >> the browsers like Chrome, IE etc. >=20 > I think a more important question would be "does any browser support this"= ? > Looking at: >=20 > https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations >=20 > it seems like the answer is mostly "no". >=20 > Peter. >=20 From nobody Thu Mar 16 16:45:46 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8603B129B63 for ; Thu, 16 Mar 2017 16:45:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KI73etboZZUq for ; Thu, 16 Mar 2017 16:45:44 -0700 (PDT) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 26212129B5B for ; Thu, 16 Mar 2017 16:45:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1489707944; x=1521243944; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=h2RpoCa32q7o276G2FOxxgD3Wc+jlNEMoftbpp/oMsU=; b=TUUNWgIFmVgz1fVTdLiXTYsey3W5/YUJ/90Or8xChAjoFRFUkXMpnJwg 5roXEETvFD9vDPTKmzhXYqJn/1jpEXhDCHBOVM3k9kqr1DHQXSZXrcYGZ 8opBJpXbcB/55am5sp8RVGxIdtLYbMQK+cNLxhNhrdu+Q+scr57wzuzh0 q8rIXuTGfmlu4BThoOedoW4kU3a3/l+FUsQx5+r7NP7rI0cJdKPpqJFOC kjOdhBGBqJePSs+Z/0NEJfCkBniQqxCOZ0JK4GxX5rLwOiCvgTvr/OkY0 aXILX48Kr/YsfkM4NbfbU5m5lMjsBVqyq9bREOytgY4aL2PC21HojXPa0 Q==; X-IronPort-AV: E=Sophos;i="5.36,174,1486378800"; d="scan'208";a="143225493" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.3.3 - Outgoing - Outgoing Received: from uxcn13-tdc-b.uoa.auckland.ac.nz ([10.6.3.3]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 17 Mar 2017 12:45:42 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-tdc-b.UoA.auckland.ac.nz (10.6.3.23) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Fri, 17 Mar 2017 12:45:42 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1178.000; Fri, 17 Mar 2017 12:45:42 +1300 From: Peter Gutmann To: Nitin Shrivastav CC: "tls@ietf.org" Thread-Topic: [TLS] RFC 6066 - Max fragment length negotiation Thread-Index: AQHSnpUB8UgZsR1fnUWlpN1q8vk4DKGYGe7w//8q+oCAANxgOw== Date: Thu, 16 Mar 2017 23:45:42 +0000 Message-ID: <1489707933992.42551@cs.auckland.ac.nz> References: <1489706298995.98317@cs.auckland.ac.nz>, <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> In-Reply-To: <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 23:45:45 -0000 Nitin Shrivastav writes:=0A= =0A= >Thanks Peter, seems like this extension is not an option. =0A= =0A= In which case it might be time to update the RFC, since there's no obvious= =0A= reason why you can't send it from the server. Can any of the original auth= ors=0A= provide a reason why it shouldn't be done by the server?=0A= =0A= Peter.=0A= From nobody Thu Mar 16 16:59:00 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 46432129A9B for ; Thu, 16 Mar 2017 16:58:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_SORBS_SPAM=0.5] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xM__3-I1vdAs for ; Thu, 16 Mar 2017 16:58:56 -0700 (PDT) Received: from mx496502.smtp-engine.com (mx496502.smtp-engine.com [IPv6:2001:8d8:968:7d00::19:7e53]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C3D43129717 for ; Thu, 16 Mar 2017 16:58:56 -0700 (PDT) Received: from mail-it0-f52.google.com (mail-it0-f52.google.com [209.85.214.52]) by mx496502.smtp-engine.com (Postfix) with ESMTPSA id A6B46B31 for ; Thu, 16 Mar 2017 23:58:51 +0000 (GMT) Received: by mail-it0-f52.google.com with SMTP id w124so6796885itb.1 for ; Thu, 16 Mar 2017 16:58:51 -0700 (PDT) X-Gm-Message-State: AFeK/H3ehrGZGVrt4hgtcujHM8Zow+6SrcKURsKHtyxIle2jLv6WKQUFl5NTEHwCQX0RMCY6Sh9A8sbNvAAJ/Q== X-Received: by 10.36.59.7 with SMTP id c7mr413718ita.43.1489708730230; Thu, 16 Mar 2017 16:58:50 -0700 (PDT) MIME-Version: 1.0 Received: by 10.79.147.155 with HTTP; Thu, 16 Mar 2017 16:58:49 -0700 (PDT) In-Reply-To: References: From: Matt Caswell Date: Thu, 16 Mar 2017 23:58:49 +0000 X-Gmail-Original-Message-ID: Message-ID: To: Eric Rescorla Cc: "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] Updated DTLS draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 23:58:58 -0000 On 13 March 2017 at 23:41, Eric Rescorla wrote: > I have just posted a new version of the DTLS 1.3 draft, updated for > draft-19. > It's still very rough with a lot of open issues (some of which are even > noted > in the draft), and no doubt contains egregious errors. > > https://tools.ietf.org/html/draft-rescorla-tls-dtls13-01 > > As usual, comments welcome. Section 5.1 The cookie mechanism is meant to be entirely stateless on the server side. However as it is currently specified it is not (and in fact DTLS1.2 suffers from the same issue). The problem is that the ClientHello may be fragmented. In order to reassemble it the server must allocate state. In OpenSSL 1.1.0 for DTLS1.2 we require that the cookie is entirely held within the first fragment of the ClientHello. This way the cookie can be validated without needing to fully reassemble the message (assuming the cookie validation function does not need any information contained within a later fragment). Only once the cookie is validated do we then attempt to reassemble the rest of the ClientHello. If the cookie is not held within the first fragment then we drop the packet. OpenSSL prior to 1.1.0 can't handle a fragmented DTLS ClientHello at all (when running in stateless mode - we have the option of running stateful which does work). We kind of get away with this for DTLS1.2. The cookie is relatively early in the CH message (i.e. prior to ciphersuites etc). So a CH would have to be fairly significantly fragmented for it to be a problem. In DTLS1.3 the cookie is now (potentially) much larger and appears much later in the ClientHello, making it much more likely that it will not fall fully within the first fragment. This could mean a fully stateless solution is impossible. Matt From nobody Thu Mar 16 17:00:09 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 27B1D129B6F for ; Thu, 16 Mar 2017 17:00:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=broadcom.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2w_4fSY1QKfF for ; Thu, 16 Mar 2017 17:00:05 -0700 (PDT) Received: from mail-it0-x233.google.com (mail-it0-x233.google.com [IPv6:2607:f8b0:4001:c0b::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 38B18129717 for ; Thu, 16 Mar 2017 17:00:05 -0700 (PDT) Received: by mail-it0-x233.google.com with SMTP id g138so7790664itb.0 for ; Thu, 16 Mar 2017 17:00:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=Fwt6qUKHBJ/4/z9m9uC0Fnf0ogeT5DjeMoa2KGpsmhc=; b=B9xtF0Yg0ZYvkC7mQuhEA0g9t06kU0+4GQbdBOm4jmVimA6qUHipoPlLgauA6bCK3J BvaIoaGbw/ZfGgITctiFQwUHcN2HqwOZuu6FzUkxgYOoFYXiQH9n8x2r7q/yuQwgyYm1 OqrGpJnKVo6xKNni111QCItec31GrhGkjleTU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=Fwt6qUKHBJ/4/z9m9uC0Fnf0ogeT5DjeMoa2KGpsmhc=; b=Z3wIHvEkH+BrWHWw1wcWaS7fLihpATbvh+hcgA1unYTZ/kMFibuFuPUZ5MV9nSeiqF pDSyqu/JZhIwvTmzPfZy+fAVKoe8iUzf5F/xqO8G9EvfZKCcbd4iokPxMmnWTKW5XNII Z2xJGLVttHpuy/J3oYMbzMxsvTIQ3APNIWPikSNKywSFQ2/26PXM17xzwYcF9ivzY1bf Feb5STyFjDIlQQIFjaYIcL78Pk8N9eh0RhGQyCG6k4mU5bs5FXD5i6rqLeD25ktyBA/r xU9w13CeNAjO8AOrOCXA/xne03GoS5QLBiHboeEz/Fe8u79FSmEsCN4JeZo7iBK3qe3V 34lw== X-Gm-Message-State: AFeK/H1s+rN5pcOXHBAQQ1ZxCEofNzbLaonKnITJQVp4uWnvbwTTXi0GqkigAl7yHWfVoocJ X-Received: by 10.36.238.202 with SMTP id b193mr387000iti.39.1489708804528; Thu, 16 Mar 2017 17:00:04 -0700 (PDT) Received: from ?IPv6:2602:304:cd81:1060:5849:6f84:6e28:92fb? ([2602:304:cd81:1060:5849:6f84:6e28:92fb]) by smtp.gmail.com with ESMTPSA id 78sm318383ity.7.2017.03.16.17.00.03 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Mar 2017 17:00:03 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-7563F123-1667-4D2E-8F4E-0178293CE5BF Mime-Version: 1.0 (1.0) From: Nitin Shrivastav X-Mailer: iPhone Mail (14D27) In-Reply-To: Date: Thu, 16 Mar 2017 20:00:01 -0400 Cc: tls@ietf.org Content-Transfer-Encoding: 7bit Message-Id: References: <65683BD2-FED2-4953-AA48-92E262F06650@gmail.com> To: Yoav Nir Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 00:00:07 -0000 --Apple-Mail-7563F123-1667-4D2E-8F4E-0178293CE5BF Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Yoav The constrained end point is server serving web pages to browsers.=20 Nitin > On Mar 16, 2017, at 4:59 PM, Yoav Nir wrote: >=20 >=20 >> On 16 Mar 2017, at 22:52, Nitin Shrivastav wrote: >>=20 >> Thanks Yoav. I am assuming it is true for TLS1.2 also? >=20 > RFC 5246 *is* TLS 1.2. But it=E2=80=99s true for previous versions and fo= r 1.3 as well. >>=20 >> It would be nice to provide a mechanism for servers to do this as we are t= rying to run a web server in a constrained IoT end-points with only tens of K= Bytes of RAM and SSL/TLS based connection is important.. >=20 > I don=E2=80=99t get if you mean that the constrained end-point is the clie= nt or the server. But either way, both sides can be configured to use small r= ecords. You only really need this extension when you both have large amounts= of data (so large records would be used without this extension) and the ser= ver is a generic web server that responds to both constrained and non-constr= ained devices.=20 >=20 > But even in that case, adding the extension to the ClientHello should not b= e infeasible. >=20 > Yoav >=20 >>> On Thu, Mar 16, 2017 at 4:48 PM, Yoav Nir wrote: >>> Hi, Nitin. >>>=20 >>> In section 7.4.1.4 of RFC 5246 it says: >>>=20 >>> An extension type MUST NOT appear in the ServerHello unless the same >>> extension type appeared in the corresponding ClientHello. >>>=20 >>> So the answer is no. Only the client may request this. >>>=20 >>> Yoav >>>=20 >>>> On 16 Mar 2017, at 21:12, Nitin Shrivastav wrote: >>>>=20 >>>> Hello, >>>>=20 >>>> This is Nitin Shrivastav, Engineering Manager at Broadcom. I have a que= stion on RFC 6066 Maximum Fragment Length Negotiation section=20 >>>>=20 >>>> The question i have is whether it is possible for a server to initiate t= he Max fragment length negotiation. The RFC describes a scenario where a con= strained client can initiate this but in our product the server is very tigh= tly constrained on memory and we want to reduce the memory used for SSL conn= ections by forcing the clients to use reduce fragment length. We don't have c= ontrol over the clients in our scenario which are basically the browsers lik= e Chrome, IE etc. >>>>=20 >>>> Thanks, >>>> Nitin >>>> _______________________________________________ >>>> TLS mailing list >>>> TLS@ietf.org >>>> https://www.ietf.org/mailman/listinfo/tls >>>=20 >>=20 >=20 --Apple-Mail-7563F123-1667-4D2E-8F4E-0178293CE5BF Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Yoav

The constrained end point is server serving web pages to browsers. <= /div>

Nitin

On Mar 16, 2017, at 4:59 PM, Yo= av Nir <ynir.ietf@gmail.com>= ; wrote:


On 16 Mar 2017, at 22:52, Niti= n Shrivastav <nitin.shrivastav@broadcom.com> wrote:

Thanks Yoav. I am= assuming it is true for TLS1.2 also?

RFC 5246 *is* TLS 1.2.  But it=E2=80=99s true for previous v= ersions and for 1.3 as well.

It would be nice to provide a mechanism for servers t= o do this as we are trying to run a web server in a constrained IoT end-poin= ts with only tens of KBytes of RAM and SSL/TLS based connection is important= ..

I don=E2=80=99t g= et if you mean that the constrained end-point is the client or the server. B= ut either way, both sides can be configured to use small records. You only r= eally need this extension when you both have large amounts of data (so large= records would be used without this extension) and the server is a generic w= eb server that responds to both constrained and non-constrained devices.&nbs= p;

But even in that case, adding the ext= ension to the ClientHello should not be infeasible.

Yoav

On T= hu, Mar 16, 2017 at 4:48 PM, Yoav Nir <ynir.ietf@gma= il.com> wrote:
Hi, Nitin.

In section 7.4.1.4 of RFC 5246 it says:
= 

   An extension type MUST NOT a=
ppear in the ServerHello unless the same
   extension type appeared in the corresponding ClientHello.

So the answer is no. Only t= he client may request this.

Yoav

On 16 Mar 2017, at 21:12, Nitin S= hrivastav <nitin.shrivastav@broadcom.com> wrote:=

Hello,

This is Nitin Shrivastav, Eng= ineering Manager at Broadcom. I have a question on RFC 6066 Maximum Fragment Length Negotiation section 
=

The question i have is whether it is p= ossible for a server to initiate the Max fragment length negotiation. The RFC= describes a scenario where a constrained client can initiate this but in ou= r product the server is very tightly constrained on memory and we want to re= duce the memory used for SSL connections by forcing the clients to use reduc= e fragment length. We don't have control over the clients in our scenario wh= ich are basically the browsers like Chrome, IE etc.

Thanks,
Nitin
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org= /mailman/listinfo/tls
<= /div>


= --Apple-Mail-7563F123-1667-4D2E-8F4E-0178293CE5BF-- From nobody Thu Mar 16 17:04:09 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1474129B7E for ; Thu, 16 Mar 2017 17:04:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DFfqencGlMDe for ; Thu, 16 Mar 2017 17:04:05 -0700 (PDT) Received: from mail-qk0-x235.google.com (mail-qk0-x235.google.com [IPv6:2607:f8b0:400d:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 07004129B69 for ; Thu, 16 Mar 2017 17:03:56 -0700 (PDT) Received: by mail-qk0-x235.google.com with SMTP id 1so53150438qkl.3 for ; Thu, 16 Mar 2017 17:03:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=MkMbhqO903xiTVyE6AVcixjLqpOH+KojuqHzT/FDJWc=; b=ksjIqR+SfQ34VzlPYmSiwOGmGir1zr/46o7pS1ckNmL2WxqiWkbx0g9YeHTfWEc5Eo RhmN6DF1WBE0swJLbILKHFkAPOb2/Vb5nHi5IVAA6McCSkVMqvYtVIP2endP8UYi67o6 8Oadn2oQ1j28BNOtB1Vp0pZXiYzkgNybfL9HedwzD7gDpy84fHNcY2lfFsa/l6e1xigN LGPzCwnUXrH2j0PPDm7tsNANNFnsfkC7wL4nC62LhFtloVHSmAJw7bnUDPvru+/uULwo e2p7xVAbY2NjKBTutTQtyL2BOFfE9aPob0YZyNRgimUqNuUsLtg6k03gNXkN4AmU/Ptw ZeFQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=MkMbhqO903xiTVyE6AVcixjLqpOH+KojuqHzT/FDJWc=; b=RDaO6UFKFa3/jTK9Mtm5QDUyID9+mqdr5WG1OePMLGB3DzQ1Gnvq8AgmfDku9cvIb0 DjbDihZ2RXQm4tSadSsEoqkLC+Kd+c3bu/PwcAx9o90AFUy4mT0SBfU4o7bYM6MJYgf7 Fxfw8H/+xRPO1z9se5EB8xjse3z01XClucL6tvnJ/BgUQ5iMQyEjQEiIozLXdPTSWdzg pYT2l0/0dqQJzv2+KYg05Ax3k6TorMvyuUtdE3E4e1hZAIe5mLuGzN4lDpbDF7fGNw0G 7QVtfJH/d/rtuMneutV9cq9djdjFpC9P3fvFm45OEqBpjh6kne9mUxbMo67TqUbOxIaK SYrQ== X-Gm-Message-State: AFeK/H0drrtOVBDgqgYO5zgX8QfstEEWzPH37eGauhMgVElJca167N80iNf9Fv4hMcYkSu8rubUs1FGrJf7I1g== X-Received: by 10.55.122.134 with SMTP id v128mr9099843qkc.115.1489709035232; Thu, 16 Mar 2017 17:03:55 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Thu, 16 Mar 2017 17:03:54 -0700 (PDT) In-Reply-To: References: From: Martin Thomson Date: Fri, 17 Mar 2017 11:03:54 +1100 Message-ID: To: Matt Caswell Cc: Eric Rescorla , "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] Updated DTLS draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 00:04:08 -0000 On 17 March 2017 at 10:58, Matt Caswell wrote: > In DTLS1.3 the cookie is now (potentially) much larger and appears much later in > the ClientHello, making it much more likely that it will not fall > fully within the > first fragment. This could mean a fully stateless solution is impossible. I think that it is feasible to simply require that ClientHello be contained in a single datagram. QUIC does this and when we did the sums it wasn't completely unreasonable, even assuming several key shares and a big-ish cookie. And then we made it possible to make the cookie even smaller in -19. That assumes that you are willing to assume a 1k MTU, which I know IPv4 doesn't guarantee. I'd be OK with adding a caveat on that point in the form of "Consequently, DTLS might not work with a small MTU". From nobody Thu Mar 16 17:05:46 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A49A129B74 for ; Thu, 16 Mar 2017 17:05:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XACP4ZydXX3A for ; Thu, 16 Mar 2017 17:05:44 -0700 (PDT) Received: from mail-qt0-x22a.google.com (mail-qt0-x22a.google.com [IPv6:2607:f8b0:400d:c0d::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 06BB8129A54 for ; Thu, 16 Mar 2017 17:05:44 -0700 (PDT) Received: by mail-qt0-x22a.google.com with SMTP id i34so51607656qtc.0 for ; Thu, 16 Mar 2017 17:05:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=3MaEsjT0dX4XwhmT33jUHBUidDyyPibXkI12P6uDFEE=; b=HDYD5Y7bL+ldfdaNudA1SDN1EUGAijOK45MUjQ0YMGbDrP7/NpO/t2dOczcQ+4Ljjx W/R1xhGRBK5KcxLgz37g+olbAeyTsako/dPGYIl6oG4iVHLRHvcufo0pGr3SL75HNqOf mBOvd7n34/N6e9q6Kis5oQei+7AnVgYTyrT+CfRlKNpFN2SvnEG8YRq1b94Cz4qsPFiA DlzNMhcVhKKAcWP4tb+kaywRwMKP6HLNtsOu5WrclidVFUWSluZIHd00UFyEnOtF+pTx ryVnGaWArgM061CnGri1iMhPjRr1xEYpoicj5TV0TvIkE/XPuUcFmmmucJ3yfK210/Xm Y0VQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=3MaEsjT0dX4XwhmT33jUHBUidDyyPibXkI12P6uDFEE=; b=bCLLqvbxZTYUfOAUXKoHafhpC0oO2EAEJudpXS0NmJkIjyWGf/caDAD+cy58WZCf0F LKRfPquFwFYC6//7lArHQc4e/wNlzjXGScpCwhs864eWmKsdof6Q2H4zHMCQROkP4faH n7tiSoclFfI3AxKwMNiOa7iYk2FXtgbC90ZOd8v+JKpqJ5jhmrGd7cgwJRZRLRPvrV0w puq1LLC6qiAX+xS+jnKF/Xv4SEc1m/7soZri+6Cy+OguyCyWbadJ2IvGS5IgbLDAZUeA HTwY/pjw0FrptFA6lWHdXaisVyhOlyer0XR0kfJkkBj+67K1enJq8X/2ooi/CxDLMNOn SF4g== X-Gm-Message-State: AFeK/H3H2SJwx5DlEqtOADy6XKD8dPNVy12s89l0z0NzY20kdV92s2gIiQ1RVIFvNNWmFr5l7ozrSeKnEcVE3g== X-Received: by 10.237.51.5 with SMTP id u5mr12316368qtd.247.1489709143117; Thu, 16 Mar 2017 17:05:43 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Thu, 16 Mar 2017 17:05:42 -0700 (PDT) In-Reply-To: <1489707933992.42551@cs.auckland.ac.nz> References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> From: Martin Thomson Date: Fri, 17 Mar 2017 11:05:42 +1100 Message-ID: To: Peter Gutmann Cc: Nitin Shrivastav , "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 00:05:45 -0000 On 17 March 2017 at 10:45, Peter Gutmann wrote: > > In which case it might be time to update the RFC, since there's no obvious > reason why you can't send it from the server. Can any of the original authors > provide a reason why it shouldn't be done by the server? Most clients will explode if the server sends an extension that the client didn't offer. You would have more luck getting clients to implement the extension. I looked at this, and it's not impossible. The spec contains some frightening things in it though. From nobody Thu Mar 16 17:22:36 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53385129A54 for ; Thu, 16 Mar 2017 17:22:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cv8J1V5r89IJ for ; Thu, 16 Mar 2017 17:22:33 -0700 (PDT) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F0741296ED for ; Thu, 16 Mar 2017 17:22:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1489710153; x=1521246153; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=dsP3/zh/sPAdK2jmpQZEWqCVlJfCpDmkcS3w/bRlSJQ=; b=GrAHSoCz+BzxoHuFHLiMYliO3R99WRu4YzzhMJr7y8U40u9NKOT2Ces0 cTiqAhHt5KWkk/orVPD7VoCansMirTtSvrKN4ITUSwUXiNI/dtJ9LMoc8 q7UdBiqYL7c8ywgbRtT6Z2BtLDf4iWDSjhXIr4Q33ohG0IrNSuw4sjW4h hC/8ZN9BKxXiBOFs8Op8qoqMw8Ke5pzjadwT2xDC7F7zgTyrPwJZS9lDI 9P52ztTseImX0OCuUqiiMAOF7IZgSSe4e3ZhL0+EuXd+hocl+ImasUK/c jTZoBENjHhEwexpZ4EDj5QD2jSrKZjQ6qEr4TRKS9KTqAX7meCsxjOw2z g==; X-IronPort-AV: E=Sophos;i="5.36,174,1486378800"; d="scan'208";a="143239322" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.3.9 - Outgoing - Outgoing Received: from uxcn13-tdc-e.uoa.auckland.ac.nz ([10.6.3.9]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 17 Mar 2017 13:22:31 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-tdc-e.UoA.auckland.ac.nz (10.6.3.9) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Fri, 17 Mar 2017 13:22:30 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1178.000; Fri, 17 Mar 2017 13:22:30 +1300 From: Peter Gutmann To: Martin Thomson CC: Nitin Shrivastav , "tls@ietf.org" Thread-Topic: [TLS] RFC 6066 - Max fragment length negotiation Thread-Index: AQHSnpUB8UgZsR1fnUWlpN1q8vk4DKGYGe7w//8q+oCAANxgO///LA8AgADcRWw= Date: Fri, 17 Mar 2017 00:22:30 +0000 Message-ID: <1489710142144.88978@cs.auckland.ac.nz> References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz>, In-Reply-To: Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 00:22:35 -0000 Martin Thomson writes:=0A= >On 17 March 2017 at 10:45, Peter Gutmann wrote= :=0A= >> In which case it might be time to update the RFC, since there's no obvio= us=0A= >> reason why you can't send it from the server. Can any of the original a= uthors=0A= >> provide a reason why it shouldn't be done by the server?=0A= >=0A= >Most clients will explode if the server sends an extension that the client= =0A= >didn't offer.=0A= =0A= Is that from actually trying it with clients, or just assuming that=0A= implementations will do what the spec says? It's another one of those bits= of=0A= TLS 1.2 that make no sense, so I've ignored the requirement in my code, you= =0A= have to add a whole pile of code to perform the check (more attack surface)= =0A= and the best possible outcome is that it has no effect, while the worst is= =0A= that it breaks things if a buggy server drops in an extension the client=0A= wasn't expecting. In other words implementing it has negative utility.=0A= =0A= There's also the escape hatch of "server-oriented extensions", all you'd ne= ed=0A= to do is define one that tells the server that the client will accept any= =0A= extensions the server cares to send, thus negating the "no server extension= s"=0A= requirement.=0A= =0A= Given that this looks like an embedded-only sort of thing, I could even add= it=0A= to -LTS, since a primary target of that is embdded/SCADA/etc.=0A= =0A= Peter.= From nobody Thu Mar 16 18:47:34 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 49927129BA0 for ; Thu, 16 Mar 2017 18:47:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q5wWRooGd3u7 for ; Thu, 16 Mar 2017 18:47:31 -0700 (PDT) Received: from mail-qk0-x229.google.com (mail-qk0-x229.google.com [IPv6:2607:f8b0:400d:c09::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 92722129B9B for ; Thu, 16 Mar 2017 18:47:31 -0700 (PDT) Received: by mail-qk0-x229.google.com with SMTP id y76so54465046qkb.0 for ; Thu, 16 Mar 2017 18:47:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=0zoxvcID8xo+j0DaUQs4wbIO2NDC2kvK1Oq+jyWtx/A=; b=C3g/YVmu7eja1ujKyZIRjWdRPTID2WA5pnzfBUfndX+2pkfnaIMFtr/EDAopyYW2A4 /kwCof+EQBxxNXV8hEwRxe9MGwDtQVxUY1n1usBZlRSM1o9z7JU3gRFA3LI1FP4ibkkD s0VrC1M0B9oeUu/Ley2Q8sECXjr1mPt/HEfLXxmDRRhwzdI+mvj9R5bDODUtp+ApRLox VDaq93VszRwog79EEH+E2rGLVj+mJ075k1f9RwCV3VCQnqOa9ZEWu9k/wC/ed6x9pCji cjOSK9INssh05ts84dAnhE8lCcp5W3hEJOSESyV/02Cp5dFG3ufxpXzGKUeehj/NRDdn cRzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=0zoxvcID8xo+j0DaUQs4wbIO2NDC2kvK1Oq+jyWtx/A=; b=B3Y7UT9wyWy2McJK7nMQGl8YmkEnsglyh418j4fwBbvU5/QoG1KBa/70kLMgQ6Shr8 FBbcN9m9UV9+KVSYsw8wxdD9T3beISFA/X6O/uDDIDpgfiQaMoVgt+NokBdz1e2Cjik9 9sshvSGXYxHco/T58icR7eLhVJBxl6wl/KIKesL4vvqJIMwf0bp642AKTdWIU5KtQnaD 819PQAASqDZaQ1L5VnQMRQ5bDmpTS5wQ+2ESFCVgca6marY79twkeJc3lviztLtMo1UV BTJXx5cfxGneNGnzpKrYLgA0nUzecHfffDtPhVVcfzHh89z9AnQ/HyFVcnG7CnsaZMaC UO5Q== X-Gm-Message-State: AFeK/H1bm9QEnacbGS+OWd/TI66MpVEsNw5X822FlN0xQsk/HxK2muQJwjUXETnyT90aaXWU9iMVOHo0K6DTfA== X-Received: by 10.55.136.2 with SMTP id k2mr7700255qkd.316.1489715250689; Thu, 16 Mar 2017 18:47:30 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Thu, 16 Mar 2017 18:47:30 -0700 (PDT) In-Reply-To: <1489710142144.88978@cs.auckland.ac.nz> References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> From: Martin Thomson Date: Fri, 17 Mar 2017 12:47:30 +1100 Message-ID: To: Peter Gutmann Cc: Nitin Shrivastav , "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 01:47:33 -0000 On 17 March 2017 at 11:22, Peter Gutmann wrote: > Is that from actually trying it with clients, or just assuming that > implementations will do what the spec says? I know for certain that NSS explodes. Not from trying, but from knowing that part of the code very well. I'm fairly certain that boringSSL does too, knowing David. You say negative utility, but I've found that if you can get away with stricter policing of these things, it helps prevent servers from starting to do the wrong thing. The odds that someone tests a new server implementation against major browsers is fairly good. In any case, what would you expect a client to do if they don't advertise the extension? In this case, max_fragment_length is so badly designed that you can actually argue that it has utility, but I don't consider that as a good argument for the general case. From nobody Thu Mar 16 19:02:20 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 372A7129BB7 for ; Thu, 16 Mar 2017 19:02:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ovZwLt-qd_Ox for ; Thu, 16 Mar 2017 19:02:17 -0700 (PDT) Received: from mail-yw0-x22c.google.com (mail-yw0-x22c.google.com [IPv6:2607:f8b0:4002:c05::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DA61A12002E for ; Thu, 16 Mar 2017 19:02:16 -0700 (PDT) Received: by mail-yw0-x22c.google.com with SMTP id v76so45009277ywg.0 for ; Thu, 16 Mar 2017 19:02:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=Z3kjSysbEW0D3KlpCobq6yCTWgTZTh6A3uyLANyAGo4=; b=eTDIGL2olu0NJjfmkygb98VOTvOKllxmcDAFUbYswYthMtXLoHNVkSJgi8r5QpRaZQ DsN5sDBK78El33UUz3lVuvflpJAeNos0N7dnoGNzAUVtKccBHIjqFW6aTPOUp3MNmghR hX1P6sYnJ/qKL8ozcF5lOOSYXNWHg9TnyLXZFBwC1M5iBJ5ytHyq5bBp2rgFF5qA8H4q i+8wgtuvhjlOMNQ/g3iqyps9Otxj6pmqWiuGMp7+GyvXmQ+FEFZJ1IysI0VLLdunw4mK h4wlEk4wT16BC+U7v4FH52r7nLOJajtror0nQy/dj3/5gdt3L4F8wXR7BSPBXmFJg8R8 XtMg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=Z3kjSysbEW0D3KlpCobq6yCTWgTZTh6A3uyLANyAGo4=; b=gbroZi3neVC/DuWs8VD8+Z5orRxU8qmkcOmK9OVrIpf7twdltLTUv4nujWLz8ZM4I0 BbAPNMsPzUb6hk8XVCGjSEsWnHMrSlhpJe1QgbvvrvTJlawNZ7xjzlQfuEotpUONRYOE nASvlOgfKTmLYpAsuy98GKb8sRoBW7loq9DEBeZkUacPOsVkefYeZI5hkwwQDlWTc3sE S+8ZYSqHGd99X73Hf8Nj6gf0TkwtgSFPiFfe4L0EY4Imc6D9rE/rUOThFV1bFra4NQyU DdnksXWt+UhgKBYMC+tar+yHhHiQOEIy6OLJ6mycyp1IFUoIgTNYqXVxizYk+H5jYDly Q/Ug== X-Gm-Message-State: AFeK/H2KyjxnD4NLiEVDXBPYib4m9B6kfQotKyWiJLnBPrLLEfmUwu/5aRofPFN1veYev+6C+43BXb7u0vpRvQ== X-Received: by 10.129.108.214 with SMTP id h205mr963993ywc.71.1489716136164; Thu, 16 Mar 2017 19:02:16 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Thu, 16 Mar 2017 19:01:35 -0700 (PDT) In-Reply-To: References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> From: Eric Rescorla Date: Thu, 16 Mar 2017 19:01:35 -0700 Message-ID: To: Martin Thomson Cc: Peter Gutmann , "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a114e81dc1cfa18054ae3912e Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 02:02:19 -0000 --001a114e81dc1cfa18054ae3912e Content-Type: text/plain; charset=UTF-8 FWIW, this requirement is actually very old, dating back to RFC 3546. It's not unique to TLS 1.2. Note that for all extension types (including those defined in future), the extension type MUST NOT appear in the extended server hello unless the same extension type appeared in the corresponding client hello. Thus clients MUST abort the handshake if they receive an extension type in the extended server hello that they did not request in the associated (extended) client hello. https://tools.ietf.org/html/rfc3546#section-2.3 -Ekr On Thu, Mar 16, 2017 at 6:47 PM, Martin Thomson wrote: > On 17 March 2017 at 11:22, Peter Gutmann > wrote: > > Is that from actually trying it with clients, or just assuming that > > implementations will do what the spec says? > > I know for certain that NSS explodes. Not from trying, but from > knowing that part of the code very well. I'm fairly certain that > boringSSL does too, knowing David. > > You say negative utility, but I've found that if you can get away with > stricter policing of these things, it helps prevent servers from > starting to do the wrong thing. The odds that someone tests a new > server implementation against major browsers is fairly good. > > In any case, what would you expect a client to do if they don't > advertise the extension? In this case, max_fragment_length is so > badly designed that you can actually argue that it has utility, but I > don't consider that as a good argument for the general case. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --001a114e81dc1cfa18054ae3912e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
FWIW, this requirement is actually very old, dating back t= o RFC 3546. It's not unique to TLS 1.2.

   Note that for all extension types (including those defined in
   future), the extension type MUST NOT appear in the extended server
   hello unless the same extension type appeared in the corresponding
   client hello.  Thus clients MUST abort the handshake if they receive
   an extension type in the extended server hello that they did not
   request in the associated (extended) client hello.

On Thu, Mar 16, 2017 at 6:47 PM, Martin Thomson <= martin.thomso= n@gmail.com> wrote:
O= n 17 March 2017 at 11:22, Peter Gutmann <pgut001@cs.auckland.ac.nz> wrote: > Is that from actually trying it with clients, or just assuming that > implementations will do what the spec says?

I know for certain that NSS explodes.=C2=A0 Not from trying, but fro= m
knowing that part of the code very well.=C2=A0 I'm fairly certain that<= br> boringSSL does too, knowing David.

You say negative utility, but I've found that if you can get away with<= br> stricter policing of these things, it helps prevent servers from
starting to do the wrong thing.=C2=A0 The odds that someone tests a new
server implementation against major browsers is fairly good.

In any case, what would you expect a client to do if they don't
advertise the extension?=C2=A0 In this case, max_fragment_length is so
badly designed that you can actually argue that it has utility, but I
don't consider that as a good argument for the general case.

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--001a114e81dc1cfa18054ae3912e-- From nobody Thu Mar 16 20:35:43 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 28C1C129BCA for ; Thu, 16 Mar 2017 20:35:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, LOTS_OF_MONEY=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tmPHeqC5adLU for ; Thu, 16 Mar 2017 20:35:40 -0700 (PDT) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BAE77129BCE for ; Thu, 16 Mar 2017 20:35:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1489721739; x=1521257739; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=1mKmzSdzrDRASB5Fuuzs41M960lJup/puoj3xYrD2uE=; b=ikrAlIQHi4InEQ7Rg8atnjrUX6066LFMN+YOylsTYicn02m+BDuxH/Hg GQAaVmbrN+OC9XH8OguVZ7TZIcw7WeY/o6DtFDyfEEMDllS1hgoapSrAp yhN4v9SKKuxk1l7/m2IZkqWQECzvg9yPhytMpzhNr14Ha5pewxLYwc6fV eF4L1HM3m/j0cvxtkIZXYKw1Rx0AU7Kf5Dbku/qGML8enrRQldkItQEyE CwowBfVkPYblFK+nSExa+A1BTdynqFj+toxKPo/fZ0/DEZ5Q4uiSqIpmA ldUvRqGUIJvprqJWikX9cfCtvH2BPNvmVtVhZ/6DI2Wsfm+PjedUfjFsH Q==; X-IronPort-AV: E=Sophos;i="5.36,175,1486378800"; d="scan'208";a="143559372" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.3.5 - Outgoing - Outgoing Received: from uxcn13-tdc-d.uoa.auckland.ac.nz ([10.6.3.5]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 17 Mar 2017 16:35:20 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-tdc-d.UoA.auckland.ac.nz (10.6.3.25) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Fri, 17 Mar 2017 16:35:20 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1178.000; Fri, 17 Mar 2017 16:35:20 +1300 From: Peter Gutmann To: Martin Thomson CC: Nitin Shrivastav , "tls@ietf.org" Thread-Topic: [TLS] RFC 6066 - Max fragment length negotiation Thread-Index: AQHSnpUB8UgZsR1fnUWlpN1q8vk4DKGYGe7w//8q+oCAANxgO///LA8AgADcRWz//0AsAAAe+X57 Date: Fri, 17 Mar 2017 03:35:19 +0000 Message-ID: <1489721710740.52293@cs.auckland.ac.nz> References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz>, In-Reply-To: Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 03:35:42 -0000 Martin Thomson writes:=0A= =0A= >In this case, max_fragment_length is so badly designed that you can actual= ly=0A= >argue that it has utility, but I don't consider that as a good argument fo= r=0A= >the general case.=0A= =0A= Why is it badly designed? I can guess that some people would prefer to hav= e a=0A= mechanism for client and server to debate endlessly what the most cromulent= =0A= fragment size is, but that's about the only thing I can see.=0A= =0A= As a slight aside, the client-only nature of the extension seems to be anot= her=0A= example of the all-the-world's-the-web view of TLS, that servers have infin= ite=0A= resources and it's clients who may be constrained. In the embedded world i= t's=0A= far more likely to be the exact opposite, the server (e.g. a PLC) is very= =0A= resource-constrained and the client connecting to it (e.g. a PC controller)= =0A= has all the resources it needs.=0A= =0A= Incidentally, here's a picture of a $25 million web server:=0A= =0A= http://www.abb-conversations.com/wp-content/uploads/2013/09/ABB_Phaseshifte= r_transformer.jpg=0A= =0A= It's resource-constrained.=0A= =0A= (Actually that one doesn't do SSL as far as I know, and the server runs NT = 4).=0A= =0A= Peter.= From nobody Thu Mar 16 20:49:44 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3883A129BD7 for ; Thu, 16 Mar 2017 20:49:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SMFa25K3d1A0 for ; Thu, 16 Mar 2017 20:49:40 -0700 (PDT) Received: from mail-qt0-x22f.google.com (mail-qt0-x22f.google.com [IPv6:2607:f8b0:400d:c0d::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AEA50129BCA for ; Thu, 16 Mar 2017 20:49:40 -0700 (PDT) Received: by mail-qt0-x22f.google.com with SMTP id r45so53940607qte.3 for ; Thu, 16 Mar 2017 20:49:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=TgiuJZ1xGiIBPaEIjdo+lQmzvG66Rx/YSgK5okUgdwE=; b=CIzUAhx1J8KogZgR5/fBLdj/FLMBTlcYhpC85n3wKdzJvgidfhfriapGHvMn5mKbG9 ptJwWMSHrdYkQnFWCFX23MTBu6PAojCM546QCL6KmqFoUaEBW94yMwmw4+gEPlfBF72n zZddC5GFgAzWDJc1Z1hC0BeM01FMtx7EbyVoH1XXqPZfbOFAmqquh+AMOC9tjZ2ipafH 9nlnpEGKB5adM3zwNV4mz8ncRU11F65mieXAjoSqACV/YYFBVI3yn/lysYczQZ/DfRtY 3QrG50p+v33a+PHvprtwXpEsxF0jcQ5mNvpT2Lu4sb7m0sdygPpU3mP6LvgXmAD0kMDr ukSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=TgiuJZ1xGiIBPaEIjdo+lQmzvG66Rx/YSgK5okUgdwE=; b=l08n3l23gUTVw+kp4ubHStoR/j4t0KB3lmMW4xVp+z18ZO8XHvNi+lT7HhQ6q6E6O7 AtW9Fajo9b9H4dJtSdXo+QpuP2z56MZ0seIHbMoxKa0vhdomNPEMtsGjGk6ofBPfLA6s oK6EAGtWJ25voJO5aZhq8iR7HDykiZFZSn5tJ6aenhsR4Zmp5/Gz/TfnwH374/iN7JfO H2WoOS8bYaOZtv7C40uYWSlqSCFx6AWjYzhjVhC22jDgVfbJWj8ELeRFkLxRw0m+uy/y yjUviCi2QeN1Nf2qgWN305cRsPY6KD4DMwWpHBisfEXvOvjm9d8BKb11J+S1PBjgHpol oOSA== X-Gm-Message-State: AFeK/H23P6icf1yFORmg5bsyhVEkPLy/6F1Vxf+Kyf3CaY7uRVFLb6AVEkbde1oovqKpwva2diwv3Wx88i5Z/g== X-Received: by 10.237.41.100 with SMTP id s91mr12641668qtd.143.1489722579930; Thu, 16 Mar 2017 20:49:39 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Thu, 16 Mar 2017 20:49:39 -0700 (PDT) In-Reply-To: <1489721710740.52293@cs.auckland.ac.nz> References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> From: Martin Thomson Date: Fri, 17 Mar 2017 14:49:39 +1100 Message-ID: To: Peter Gutmann Cc: Nitin Shrivastav , "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 03:49:42 -0000 On 17 March 2017 at 14:35, Peter Gutmann wrote: > Why is it badly designed? I can guess that some people would prefer to have a > mechanism for client and server to debate endlessly what the most cromulent > fragment size is, but that's about the only thing I can see. I looked at implementing this for NSS with the idea that I would try to be nice to embedded servers (because web servers are constrained devices too). I can't send a max_fragment_length extension that says I support records of 2^14 octets in length. Because I don't care and full-sized fragments are valuable to me in some cases, but if a server is constrained, it would be no trouble to send it smaller records. And I can't fix that. If I send a max_fragment_length extension with a value other than the four values defined in RFC 6066, all I get for my troubles is an "illegal_parameter" alert from any server that implements the RFC correctly. The design I would use is much simpler. The extension would carry a two octet value that is the maximum size of the plaintext that the endpoint is willing to receive. A client could say 2^14 and that would allow the server to send that much if it were able. The same server could say 5 and the client would be forced to fragment like crazy (ok, that last might be too far, we'd probably want to set a lower bound on the value). I'd happily implement and advertise that extension. From nobody Thu Mar 16 23:24:15 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 621DE1201FA for ; Thu, 16 Mar 2017 23:24:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BUcSE1HJsWwE for ; Thu, 16 Mar 2017 23:24:11 -0700 (PDT) Received: from mail-ot0-x22e.google.com (mail-ot0-x22e.google.com [IPv6:2607:f8b0:4003:c0f::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A9F012426E for ; Thu, 16 Mar 2017 23:24:10 -0700 (PDT) Received: by mail-ot0-x22e.google.com with SMTP id x37so81032794ota.2 for ; Thu, 16 Mar 2017 23:24:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=wLiJRV4NCU99xHwN4oTJk/zhUs0WJoc3rWvs8q1Flls=; b=apGZK0Bx4Ub+iBxY0fdj2NkaAIR7kX53heBQEZ1YGEHcJb2WPLp1aOlWVf8aO2A6pA KUYvoaXKU9VgGBJWKZHpZY7aorhvwUyROVIsvnF1zY0VFyMwt/PiGspJHA3mVtXmpEDy 7YZExKnjUnO6AP3y4RJP1QhlrtP5OAcGYPzaoHrcvpt31xYmWMTfjPSG0i63roYgK7UX NPTAKA4y6s8aOAE+RkgcnVFmexTZp1uvkGVSir0lREGdjSlwMI28cjsu+OM2x+/K4z7e ML1l/c7+HWP08tiCwYRIyG8SyvRwUXTeTMl7W/qdOIsfPiukIYYSCh05BlUTLM7fFFpY BUQw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=wLiJRV4NCU99xHwN4oTJk/zhUs0WJoc3rWvs8q1Flls=; b=RtAXyiSFNBAttrQBKCVUj12A2D/C76A+ATQVOwU2g4h9lKX2jwB3sxLcaQz17tI5P5 qqg/LohCJ9dc9ZxZyExaYIAfsH0Ko6IaTnQLlBAWRJFW//NXLrmHyGCneRfiwolFD2sO CMmcNuQ1JfHfL616d/YuhurwBId61qq3XjEMfhfDGAlekKJfPpkicyHfVYP5eHeUB7vP Zp3HGAzpowgucPAxJ2xg3c8q96zHQEy+4YWCJrPBmd9IsdpFrD7PgaRAfw4iMpeDBDN2 TN3j+DZI6U9GjDLflT4MACiUi2SbH1sZhF/V2fikdYV2txs3gMMY25BmqW1Dz+ZFnQbj Pviw== X-Gm-Message-State: AFeK/H2odGB/ql07cXHZWDuMZRFsYPFHKQNaaLQmLDSeAPE2vG3yeAev+yOjTCm65nshi6ekwBwatdtikExu7A== X-Received: by 10.202.168.11 with SMTP id r11mr7030258oie.48.1489731849643; Thu, 16 Mar 2017 23:24:09 -0700 (PDT) MIME-Version: 1.0 Received: by 10.157.16.13 with HTTP; Thu, 16 Mar 2017 23:24:09 -0700 (PDT) In-Reply-To: References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> From: Martin Thomson Date: Fri, 17 Mar 2017 17:24:09 +1100 Message-ID: To: Peter Gutmann Cc: Nitin Shrivastav , "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 06:24:13 -0000 On 17 March 2017 at 14:49, Martin Thomson wrote: > The design I would use is much simpler. The extension would carry a > two octet value that is the maximum size of the plaintext that the > endpoint is willing to receive. A client could say 2^14 and that > would allow the server to send that much if it were able. The same > server could say 5 and the client would be forced to fragment like > crazy (ok, that last might be too far, we'd probably want to set a > lower bound on the value). > > I'd happily implement and advertise that extension. I'd even go so far as to specify it: https://martinthomson.github.io/tls-record-limit/ I'll submit an I-D once the blackout ends if people are interested in this. From nobody Fri Mar 17 03:38:42 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CED7B129C03 for ; Fri, 17 Mar 2017 03:38:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8kaIb44pnkp3 for ; Fri, 17 Mar 2017 03:38:39 -0700 (PDT) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4990F126DED for ; Fri, 17 Mar 2017 03:38:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1489747119; x=1521283119; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=C8KQFxd2aPMW+Py8a6vcl33z28MbTADQwnnnM+tlBnY=; b=wNxR2fpoUG3nugqMNHpUvAjNGUV9HF7GEplhq+fhdllTmBeZ+cQ94Dcj zfaDhcVy02nS4uXNsklcWzoBYqpjmlixJ0JseY0CGgciYo2GyU7P3GCv5 Vu4LNJVPUO57R7SOFzokVpr/Tu/KITBpoDXLTpi0MdHpZS9KW6S2/AurX EfFrR+u8yjC8XoNuM+vK24ZqdKA/a/McWIBGeN0GWLOlkagmtGxGg2Mjp qRRXDVSEckvusEwVg0FHp8ackxxyBL/H/G98X6XaMlzSWQApEJ0AHjA9X eeqYQinL4KtNkjGVcXTV3bINvz8N22WH411d7ICgiE/0tx+gnS2dE3Cxe A==; X-IronPort-AV: E=Sophos;i="5.36,176,1486378800"; d="scan'208";a="143650058" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.3.9 - Outgoing - Outgoing Received: from uxcn13-tdc-e.uoa.auckland.ac.nz ([10.6.3.9]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 17 Mar 2017 23:38:37 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-tdc-e.UoA.auckland.ac.nz (10.6.3.9) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Fri, 17 Mar 2017 23:38:37 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1178.000; Fri, 17 Mar 2017 23:38:37 +1300 From: Peter Gutmann To: Martin Thomson CC: Nitin Shrivastav , "tls@ietf.org" Thread-Topic: [TLS] RFC 6066 - Max fragment length negotiation Thread-Index: AQHSnpUB8UgZsR1fnUWlpN1q8vk4DKGYGe7w//8q+oCAANxgO///LA8AgADcRWz//0AsAAAe+X57//8qVYCAACsrgIABIKju Date: Fri, 17 Mar 2017 10:38:37 +0000 Message-ID: <1489747107536.25854@cs.auckland.ac.nz> References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> , In-Reply-To: Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 10:38:41 -0000 Martin Thomson writes:=0A= =0A= >I'd even go so far as to specify it:=0A= >=0A= >https://martinthomson.github.io/tls-record-limit/=0A= =0A= Some comments...=0A= =0A= Firstly, do we have much real-world experience in using this extension? Fr= om=0A= the TLS-support matrix, it looks like very few implementations support this= ,=0A= does this mean few people care about it or just that it's defined in a such= a=0A= manner that it's not practical to support it? For anyone who does use it, = how=0A= do you use it, and what would you like to see changed? If no fixed version= of=0A= max_fragment_length is defined, would anyone care?=0A= =0A= (I've had support for max_fragment_length in my code since the extension wa= s=0A= defined but it's always been commented out, no-one has ever asked for it to= be=0A= supported).=0A= =0A= If the draft is published, I'd like to have a boolean don't-fragment flag o= r=0A= something similar available alongside RecordSizeLimit for implementations t= hat=0A= don't implement fragmentation (the implementation matrix doesn't record whi= ch=0A= implementations support this, but I'd be pretty surprised if many embedded= =0A= stacks did, given the complexity and extra memory use that this adds). =0A= =0A= In other words a way to say "set RecordSizeLimit to 2048 bytes but don't=0A= fragment messages", meaning the client or server holds back from sending 8,= 000=0A= cipher suites and 500 extensions in the hello to keep each record below 204= 8=0A= bytes. Otherwise asking for a RecordSizeLimit of 2048 might produce=0A= fragmentation, which leads to another fragment_length-induced handshake=0A= failure if your guess at what to send is wrong.=0A= =0A= Peter.=0A= From nobody Fri Mar 17 03:57:13 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB0F0129C12 for ; Fri, 17 Mar 2017 03:57:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2NNHEacJuZRp for ; Fri, 17 Mar 2017 03:57:10 -0700 (PDT) Received: from mail-qt0-x236.google.com (mail-qt0-x236.google.com [IPv6:2607:f8b0:400d:c0d::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 06E35129C07 for ; Fri, 17 Mar 2017 03:57:10 -0700 (PDT) Received: by mail-qt0-x236.google.com with SMTP id r45so59191589qte.3 for ; Fri, 17 Mar 2017 03:57:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=WKsWqSbOiEbR4ohuuuG3ZcNcmQHyq4oD3E7Z1KL2H/k=; b=A/FNDQL36OVyUn7Xq5G682Gg/7hK+UiAodtX2hsNeAMUBzsJARVqZfo24Q1EAfYnN0 QOIR9k/ldOPkCSMMdexA1w35xvfJxeJpIoxQCQnxR5jumuKCnp9RNQTVqyCSUydHMCOM vIhsuc9KRZvPbo/LGI1OwBuDtzwSPdY7KqPIuOFmzxopcXzAE3Km31ZjeyJb7QD0W+tr 0cb83rOkFyaMt5WjHnCBI8iTtoHwDH4ngGnPf9Rj1LWhTZAB2fE2tWNDHVldPzOoQexc qq5sC8K76n2ZxL+k547ySUB2j1CfXdWd573YtMrAEVdXxelP+7PdEzxL7Tz8V6fc47pZ yP9w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=WKsWqSbOiEbR4ohuuuG3ZcNcmQHyq4oD3E7Z1KL2H/k=; b=P2a6k/agbbHIq7H3krpe8h6jBlogTXrL1ztt52PlSkbk2Iw8YeusD2f3gX4X9EnBhJ UGgxvPgTWllAmBzPwqp6R6ffal2HI3ZMTFPzS4K3i8V9LoSQPSsF7PC/6OfkXtjYd00f MBeI3DZqoGhstA9ehk0sH43UXjofvNicePB2dc2W0lLXZdrm3eIo6v+9XTt/Fww2ffZt TGMe76p7mW1taYVSGBjJ7C57oZcu32DP/WRZDoYVZvemt5qGEsPnoWy8GzCZDJ4RNe5b gjF9XSC/yLkY1ADBnQ8ivRnBusfTA3rhQNGSdMOCzGaEoSTTV0snZHrHmXTg6B+AXmLK wDdQ== X-Gm-Message-State: AFeK/H035oIIUyV2TDLqj/Qpb8//J4ZSvfQxL8M7G8E6+xSfE8VjoeeUXWYa8nrTVgzisWseMvApLbGArFq1ng== X-Received: by 10.237.34.250 with SMTP id q55mr13138757qtc.144.1489748229195; Fri, 17 Mar 2017 03:57:09 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Fri, 17 Mar 2017 03:57:08 -0700 (PDT) In-Reply-To: <1489747107536.25854@cs.auckland.ac.nz> References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <1489747107536.25854@cs.auckland.ac.nz> From: Martin Thomson Date: Fri, 17 Mar 2017 21:57:08 +1100 Message-ID: To: Peter Gutmann Cc: "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 10:57:12 -0000 On 17 March 2017 at 21:38, Peter Gutmann wrote: > Firstly, do we have much real-world experience in using this extension? From > the TLS-support matrix, it looks like very few implementations support this, > does this mean few people care about it or just that it's defined in a such a > manner that it's not practical to support it? For anyone who does use it, how > do you use it, and what would you like to see changed? If no fixed version of > max_fragment_length is defined, would anyone care? This is apparently a big deal for people building little things with TLS in them. Hannes knows better than I do. On the web, this extension basically doesn't exist (for the aforementioned reasons, in part, also because browsers historically didn't much for servers and their resource constraints). > If the draft is published, I'd like to have a boolean don't-fragment flag or > something similar available alongside RecordSizeLimit for implementations that > don't implement fragmentation (the implementation matrix doesn't record which > implementations support this, but I'd be pretty surprised if many embedded > stacks did, given the complexity and extra memory use that this adds). TLS 1.3 has an issue here in that it encrypts handshake messages, and that includes the worst offender (Certificate). You might not care about 1.3, but I think that handshake fragmentation is just something implementations will need to deal with there. Plaintext records don't have any such limits. I explicitly excluded them. That means that TLS 1.2 implementations shouldn't be affected. Well, unless they wanted to send massive messages after the handshake completes. Renegotiation would do that, of course, so don't do that. From nobody Fri Mar 17 04:21:18 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38C58127333 for ; Fri, 17 Mar 2017 04:21:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kqKVE3uSnw1U for ; Fri, 17 Mar 2017 04:21:14 -0700 (PDT) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 65042126B6E for ; Fri, 17 Mar 2017 04:21:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1489749674; x=1521285674; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=swZaXG/Y9boBtW//slCVmgWQ+mBPmYVqVlSmsZhQNjc=; b=iheVPJxD/q/OHfFiSWsMpvallqP3qJpSYkpuckMbTKghyYfzbNJ76eDt qad2zRw0fTtD6LRQy8y5TEt7rUQDyzMjDdIOftirOjiCV2nkAhz692mVk XkGtjdYX+8UjsIOEdCLSSmmTgeqjgXMJvbfSy/BO9PLuo6zgUwN/4kSvw hQSBpjIhIffqK4F+PFTpb0hOzl4qLpMPkYf1VwuK9YQKbRtTvbwh/Y8S5 5KXC7xKtgq0VYK1AhBftwSLnZQgjGV1hBccUn0MOe2cC7OGxOtKNEo6xW WPH0zH/jqCWWNsuFn+D7jfY7Ih33STXImX3PNMsySjkknhT5BdMZf4b0s w==; X-IronPort-AV: E=Sophos;i="5.36,176,1486378800"; d="scan'208";a="143655661" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.3.3 - Outgoing - Outgoing Received: from exchangemx.uoa.auckland.ac.nz (HELO uxcn13-tdc-b.UoA.auckland.ac.nz) ([10.6.3.3]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 18 Mar 2017 00:21:12 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-tdc-b.UoA.auckland.ac.nz (10.6.3.3) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Sat, 18 Mar 2017 00:21:12 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1178.000; Sat, 18 Mar 2017 00:21:12 +1300 From: Peter Gutmann To: Martin Thomson CC: "tls@ietf.org" Thread-Topic: [TLS] RFC 6066 - Max fragment length negotiation Thread-Index: AQHSnpUB8UgZsR1fnUWlpN1q8vk4DKGYGe7w//8q+oCAANxgO///LA8AgADcRWz//0AsAAAe+X57//8qVYCAACsrgIABIKju//8rnQCAAOBv1w== Date: Fri, 17 Mar 2017 11:21:12 +0000 Message-ID: <1489749662616.94542@cs.auckland.ac.nz> References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <1489747107536.25854@cs.auckland.ac.nz>, In-Reply-To: Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 11:21:16 -0000 Martin Thomson writes:=0A= =0A= >Plaintext records don't have any such limits. I explicitly excluded them.= =0A= =0A= Hmm, it's somewhat disguised in the text, technically all records are=0A= "protected records" (if you use EMS, everything is at least integrity-=0A= protected). So if you mean "this only applies to application_data" then yo= u=0A= should probably say so (alerts and CCS are too short for it to matter, and = I'm=0A= assuming no rehandshake, so only application_data will be affected by the= =0A= length constraints).=0A= =0A= However, this then leads to a problem where it doesn't actually solve the= =0A= constrained-client/server issue, if a client asks for 2K max record size an= d=0A= the server responds with a 4K hello then it's going to break the client eve= n=0A= if later application_data records are only 2K. So it would need to apply t= o=0A= every record type, not just application_data.=0A= =0A= Peter.=0A= From nobody Fri Mar 17 04:32:22 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D4A01274D0 for ; Fri, 17 Mar 2017 04:32:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.419 X-Spam-Level: X-Spam-Status: No, score=-1.419 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_SPAM=0.5, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aWHg7eQGF0Ne for ; Fri, 17 Mar 2017 04:32:19 -0700 (PDT) Received: from mx496502.smtp-engine.com (mx496502.smtp-engine.com [217.160.92.157]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A838126B6E for ; Fri, 17 Mar 2017 04:32:19 -0700 (PDT) Received: from mail-it0-f44.google.com (mail-it0-f44.google.com [209.85.214.44]) by mx496502.smtp-engine.com (Postfix) with ESMTPSA id E603EF7B for ; Fri, 17 Mar 2017 11:32:17 +0000 (GMT) Received: by mail-it0-f44.google.com with SMTP id m27so21702335iti.1 for ; Fri, 17 Mar 2017 04:32:17 -0700 (PDT) X-Gm-Message-State: AFeK/H1EdH0nvhG5G3E0WNNxU2HrurXAgXWc/wFUC9Sjzs7x0+TPeozDtD+UdfM1yFL14CRZ30pqt/J7BLdwCQ== X-Received: by 10.107.142.136 with SMTP id q130mr14333558iod.31.1489750336362; Fri, 17 Mar 2017 04:32:16 -0700 (PDT) MIME-Version: 1.0 Received: by 10.79.147.155 with HTTP; Fri, 17 Mar 2017 04:32:16 -0700 (PDT) In-Reply-To: References: From: Matt Caswell Date: Fri, 17 Mar 2017 11:32:16 +0000 X-Gmail-Original-Message-ID: Message-ID: To: Martin Thomson Cc: Eric Rescorla , "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] Updated DTLS draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 11:32:21 -0000 On 17 March 2017 at 00:03, Martin Thomson wrote: > On 17 March 2017 at 10:58, Matt Caswell wrote: >> In DTLS1.3 the cookie is now (potentially) much larger and appears much later in >> the ClientHello, making it much more likely that it will not fall >> fully within the >> first fragment. This could mean a fully stateless solution is impossible. > > > I think that it is feasible to simply require that ClientHello be > contained in a single datagram. Yes, this is one of several solutions - although it is possibly a retrograde step. With the assumptions that I currently have for DTLSv1.2, even with max size cookie and session id the full cookie will always be contained within the first 346 bytes of the record (if I did my sums right) - which doesn't seem unreasonable. So as long as the first fragment isn't smaller than that then, with our current implementation, we are good. By stating that the *whole* ClientHello must be within the first fragment we are placing some significant restrictions on the extensibility of the protocol and how much we can stuff into it. Fragmenting the initial ClientHello does happen even in DTLS1.2 (before we've added extra ciphersuites and extensions for DTLSv1.3) - we had a recent report of someone having problems when receiving fragmented ClientHellos: https://mta.openssl.org/pipermail/openssl-users/2017-February/005332.html Another option is to say that the cookie extension must be fully contained within the first fragment - which avoids the above extensibility concerns. This option is much better but is still retrograde from DTLS1.2 because the extensions block appears later in the ClientHello (most importantly after ciphersuites, which could be quite long). A third option is to retain use of the cookie field in DTLSv1.3 and require that the first fragment contains it, i.e. the server sends the cookie in the HRR and the client reflects it back in the cookie field. This would solve all of the above problems but introduces a new one - the TLSv1.3 max cookie length is bigger than the length of the cookie field. There are a couple of ways around that that I can think of - the simplest being that DTLS1.3 could restrict the max cookie length - but that in itself could cause some problems due to the fact that more data needs to be stored in the cookie for DTLS1.3 (i.e. the transcript hash). > QUIC does this and when we did the > sums it wasn't completely unreasonable, even assuming several key > shares and a big-ish cookie. And then we made it possible to make the > cookie even smaller in -19. Did we? How did we do that? Matt From nobody Fri Mar 17 04:46:15 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 28C9F128616 for ; Fri, 17 Mar 2017 04:46:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aHie79AIEYCa for ; Fri, 17 Mar 2017 04:46:11 -0700 (PDT) Received: from mail-yw0-x22f.google.com (mail-yw0-x22f.google.com [IPv6:2607:f8b0:4002:c05::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D19F8127A91 for ; Fri, 17 Mar 2017 04:46:10 -0700 (PDT) Received: by mail-yw0-x22f.google.com with SMTP id v198so51126170ywc.2 for ; Fri, 17 Mar 2017 04:46:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=r80s3NPQ3akBE1T04HivuM812yj6baYVBTaoZKznR8Q=; b=0p8SrhVB3JzRgD4JI7Nve86uMQgDF1zggikzLNiWb0+U1oc85ZRGcEhg7qP8GQAXki HCxEvay2XDX60q/PIaIlpWxhfKbH9K6kKMY0lByNaGLMLkut8PimZ3slfZqPhRyKrGRc ybg3d2GsGcc/JL5uRw/xtKNupcuqcSblChtAnTeXjgIZZCzLobAEP6h/sTFur81hq38B uqH+puPnXMn0EObWMWMVaUaOeibgm7P4tO9TTMWejiZMQrBJ3WXJCBhLI/hWpUG0Ldw8 KT8LGPHNv+OUYBS5Ta/777Mm/iF8mnk55gIkqykyV1tPbHqzgJEZ8qe1tegr9WTgtsnN IXEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=r80s3NPQ3akBE1T04HivuM812yj6baYVBTaoZKznR8Q=; b=sq9cLE4he10moTTR2aptEkC4ARLbObZPiuxU0ZDfsZaMSYERGxzuNy/7/CtRcmon+g PZZ0e2OiZW3TFXhiBq1THzfsE5bK9X55ibOn3fHlqSZ4ZQMdguEmfe2AcRllMiud/lGT 6Er0eIdLbWBMeLc4BBIeZz8dtINY5fx/sOU3gfC1C1K8ym0IIM0tP9EYc/Bs+0QedT5V TUBxAjhl1JN9zTlN0MTZmyMfSsGYUl5S1UoE/IKhKVYXL/+6s67ipwVjnfOUG3fiQqAY WAEMul23zeig+JW8wLV748N0Rh7Oxv06F+DBALYpqNpWi3mbEcM25kBHACEtaMF4X6Ps edyQ== X-Gm-Message-State: AFeK/H0q2OZyIA8TydulXn0784SVpIx7w6m482yGGXcTVq4dtoLBX7Lxw/kiwW5wv/7amyYU35mKiqwwkYmEcw== X-Received: by 10.13.250.67 with SMTP id k64mr2450556ywf.125.1489751170072; Fri, 17 Mar 2017 04:46:10 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Fri, 17 Mar 2017 04:45:29 -0700 (PDT) In-Reply-To: References: From: Eric Rescorla Date: Fri, 17 Mar 2017 04:45:29 -0700 Message-ID: To: Matt Caswell Cc: Martin Thomson , "tls@ietf.org" Content-Type: multipart/alternative; boundary=94eb2c07f34a4bda58054aebb929 Archived-At: Subject: Re: [TLS] Updated DTLS draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 11:46:13 -0000 --94eb2c07f34a4bda58054aebb929 Content-Type: text/plain; charset=UTF-8 On Fri, Mar 17, 2017 at 4:32 AM, Matt Caswell wrote: > On 17 March 2017 at 00:03, Martin Thomson > wrote: > > On 17 March 2017 at 10:58, Matt Caswell wrote: > >> In DTLS1.3 the cookie is now (potentially) much larger and appears much > later in > >> the ClientHello, making it much more likely that it will not fall > >> fully within the > >> first fragment. This could mean a fully stateless solution is > impossible. > > > > > > I think that it is feasible to simply require that ClientHello be > > contained in a single datagram. > > Yes, this is one of several solutions - although it is possibly a > retrograde step. With the assumptions that I currently have for > DTLSv1.2, even with max size cookie and session id the full cookie > will always be contained within the first 346 bytes of the record (if > I did my sums right) - which doesn't seem unreasonable. So as long as > the first fragment isn't smaller than that then, with our current > implementation, we are good. > > By stating that the *whole* ClientHello must be within the first > fragment we are placing some significant restrictions on the > extensibility of the protocol and how much we can stuff into it. > Fragmenting the initial ClientHello does happen even in DTLS1.2 > (before we've added extra ciphersuites and extensions for DTLSv1.3) - > we had a recent report of someone having problems when receiving > fragmented ClientHellos: > > https://mta.openssl.org/pipermail/openssl-users/2017-February/005332.html > > Another option is to say that the cookie extension must be fully > contained within the first fragment - which avoids the above > extensibility concerns. This option is much better but is still > retrograde from DTLS1.2 because the extensions block appears later in > the ClientHello (most importantly after ciphersuites, which could be > quite long). > > A third option is to retain use of the cookie field in DTLSv1.3 and > require that the first fragment contains it, i.e. the server sends the > cookie in the HRR and the client reflects it back in the cookie field. > This would solve all of the above problems but introduces a new one - > the TLSv1.3 max cookie length is bigger than the length of the cookie > field. There are a couple of ways around that that I can think of - > the simplest being that DTLS1.3 could restrict the max cookie length - > but that in itself could cause some problems due to the fact that more > data needs to be stored in the cookie for DTLS1.3 (i.e. the transcript > hash). > > > QUIC does this and when we did the > > sums it wasn't completely unreasonable, even assuming several key > > shares and a big-ish cookie. And then we made it possible to make the > > cookie even smaller in -19. > > Did we? How did we do that? > By making the hash state you needed to store a hash value rather than a hash checkpoint. -Ekr > > Matt > --94eb2c07f34a4bda58054aebb929 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Fri, Mar 17, 2017 at 4:32 AM, Matt Caswell <frodo@baggins.org&g= t; wrote:
On 17 M= arch 2017 at 00:03, Martin Thomson <martin.thomson@gmail.com> wrote:
> On 17 March 2017 at 10:58, Matt Caswell <frodo@baggins.org> wrote:
>> In DTLS1.3 the cookie is now (potentially) much larger and appears= much later in
>> the ClientHello, making it much more likely that it will not fall<= br> >> fully within the
>> first fragment. This could mean a fully stateless solution is impo= ssible.
>
>
> I think that it is feasible to simply require that ClientHello be
> contained in a single datagram.

Yes, this is one of several solutions - although it is possibly a retrograde step. With the assumptions that I currently have for
DTLSv1.2, even with max size cookie and session id the full cookie
will always be contained within the first 346 bytes of the record (if
I did my sums right) - which doesn't seem unreasonable. So as long as the first fragment isn't smaller than that then, with our current
implementation, we are good.

By stating that the *whole* ClientHello must be within the first
fragment we are placing some significant restrictions on the
extensibility of the protocol and how much we can stuff into it.
Fragmenting the initial ClientHello does happen even in DTLS1.2
(before we've added extra ciphersuites and extensions for DTLSv1.3) - we had a recent report of someone having problems when receiving
fragmented ClientHellos:

https://mta.openssl.org/pipermail/openssl-users/2017-February/005332.html

Another option is to say that the cookie extension must be fully
contained within the first fragment - which avoids the above
extensibility concerns. This option is much better but is still
retrograde from DTLS1.2 because the extensions block appears later in
the ClientHello (most importantly after ciphersuites, which could be
quite long).

A third option is to retain use of the cookie field in DTLSv1.3 and
require that the first fragment contains it, i.e. the server sends the
cookie in the HRR and the client reflects it back in the cookie field.
This would solve all of the above problems but introduces a new one -
the TLSv1.3 max cookie length is bigger than the length of the cookie
field. There are a couple of ways around that that I can think of -
the simplest being that DTLS1.3 could restrict the max cookie length -
but that in itself could cause some problems due to the fact that more
data needs to be stored in the cookie for DTLS1.3 (i.e. the transcript
hash).

>=C2=A0 QUIC does this and when we did the
> sums it wasn't completely unreasonable, even assuming several key<= br> > shares and a big-ish cookie.=C2=A0 And then we made it possible to mak= e the
> cookie even smaller in -19.

Did we? How did we do that?

By m= aking the hash state you needed to store a hash value rather than a hash ch= eckpoint.

-Ekr
=C2=A0

Matt

--94eb2c07f34a4bda58054aebb929-- From nobody Fri Mar 17 06:18:20 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 87F61129434 for ; Fri, 17 Mar 2017 06:18:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id whSnFG9P6Xn4 for ; Fri, 17 Mar 2017 06:18:11 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D6F03129422 for ; Fri, 17 Mar 2017 06:18:10 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id EEAAABEB3; Fri, 17 Mar 2017 13:18:07 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R97Y3gIrD-K7; Fri, 17 Mar 2017 13:18:05 +0000 (GMT) Received: from [10.244.2.100] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 04517BEAF; Fri, 17 Mar 2017 13:18:04 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1489756685; bh=SLyWvBIKaxwkQQx9hcryOw0+fYbh0w3+DviB/9csplI=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=Wpt5ZkwNYXRBB+NXEn22QT7brIP3Mp9+I8qR2HFzqVnTh4XU3CHpMKP0saMZJOvhq ydfGKdGXEPxTDEU4pFeBL7nHEP/sIFBFOTZAqFPr5nMHAlIt8vo1huReQ5c6VsdnRv tAj9H83v50iLEVgml9ArkPWfNVulpCzshN8pv9zo= To: Yoav Nir , Eric Rescorla References: <9D719372-7B07-406B-8C8B-2AC762BDB5F2@gmail.com> <9AF98D89-9183-49F6-A30A-8A2E3301F81E@gmail.com> <5EF7EC11-B453-4FBE-82CB-B3BFB6D9C546@gmail.com> Cc: "tls@ietf.org" From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: Date: Fri, 17 Mar 2017 13:18:04 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="ruJ2mvWKUAkqU8JSiqL1Uu8D9TE2En62N" Archived-At: Subject: Re: [TLS] Uplifting 5289 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 13:18:14 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --ruJ2mvWKUAkqU8JSiqL1Uu8D9TE2En62N Content-Type: multipart/mixed; boundary="S47ssrKBluBWfuSUB4UM6Ao3ERRdwpni3"; protected-headers="v1" From: Stephen Farrell To: Yoav Nir , Eric Rescorla Cc: "tls@ietf.org" Message-ID: Subject: Re: [TLS] Uplifting 5289 References: <9D719372-7B07-406B-8C8B-2AC762BDB5F2@gmail.com> <9AF98D89-9183-49F6-A30A-8A2E3301F81E@gmail.com> <5EF7EC11-B453-4FBE-82CB-B3BFB6D9C546@gmail.com> In-Reply-To: --S47ssrKBluBWfuSUB4UM6Ao3ERRdwpni3 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable FWIW, the IETF LC for this has ended now and I plan to send the approval message for the uplift to the secretariat later today. Thanks, S. On 16/03/17 20:33, Yoav Nir wrote: > Oh, sorry. I missed that it was Informational. >=20 > In that case there=E2=80=99s just the issue that it has ECDH ciphersuit= es at a time where 4492bis is deprecating all the other ones. But some o= f the ciphersuites in there are in wide enough use that it shouldn=E2=80=99= t remain Informational. >=20 > Yes, it should be uplifted then. >=20 > Yoav >=20 >> On 16 Mar 2017, at 21:23, Eric Rescorla wrote: >> >> This is actually uplift to PS. >> >> On Thu, Mar 16, 2017 at 12:16 PM, Yoav Nir > wrote: >> >>> On 16 Mar 2017, at 21:01, Kathleen.Moriarty.ietf@gmail.com wrote: >>> >>> >>> >>> Please excuse typos, sent from handheld device >>> >>>> On Mar 16, 2017, at 11:37 AM, Yoav Nir > wrote: >>>> >>>> >>>>> On 16 Mar 2017, at 17:17, Eric Rescorla > wrote: >>>>> >>>>> Hi folks >>>>> >>>>> I note that we are proposing to uplift RFC 5289 to PS, despite the = fact that it >>>>> standardizes some CBC cipher suites, which the WG is looking to mov= e away >>>>> from. I recognize that these are the only cipher suites you can use= in TLS 1.0 >>>>> and 1.1, but we also want people to move away from them. >>>>> >>>>> This problem is probably solvable by marking the registry as Not Re= commended, but I wondered if anyone had other thoughts on this topic? >>>>> >>>> >>>> 5289 applies to TLS 1.0, 1.1, and 1.2. It seems strange to uplift a= bunch of ciphersuites for 1.2 just as we=E2=80=99re publishing TLS 1.3 w= hich obsoletes 5246. >>> >>> TLS 1.2 will be in use for a while unless major problems are found, s= o it's worthwhile IMO. >> >> I understand that. I=E2=80=99m wondering what message we are trying to= convey by publishing or uplifting a full standard for a now-obsolete pro= tocol. >> >> The Internet works just fine on proposed standards (or even Internet D= rafts) >> >> Yoav >> >> >=20 >=20 >=20 >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls >=20 --S47ssrKBluBWfuSUB4UM6Ao3ERRdwpni3-- --ruJ2mvWKUAkqU8JSiqL1Uu8D9TE2En62N Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCAAGBQJYy+IMAAoJEC88hzaAX42iSj8IAIEotmxNShi8GIlC0JhTjQTD 5MtiK6hlYUJFjIoyF5Y1RIc+UfUXswKwJleOOMRuz7RpwVkwYlApOnL4GLYP/UJ5 4UYgsoGwKfWxj0KqQEMJkQzY8FAuotdC2702i2Ky1Y5lRD7hcEjZ6s+nDf6fRJLB bnZJUgkfB4cddRad3i6YeAetWzIoCTpPNyxICdgBvTCI9ffFQxIjmI/Xev6OscCy J/ZiZUSPbBw7Kzhb0vWHYltnW0mttBvoDCoc6G9cwToqQLs/Zyla4fuWWa03EEzr deYD0UaPY14z4fp7kJ3/yAwaU9s65tLsyNsRdiojsPPo3tgTQVv1K9AMm7aJHcs= =shc3 -----END PGP SIGNATURE----- --ruJ2mvWKUAkqU8JSiqL1Uu8D9TE2En62N-- From nobody Fri Mar 17 06:26:36 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D485C12932A for ; Fri, 17 Mar 2017 06:26:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tST36HL83gWV for ; Fri, 17 Mar 2017 06:26:32 -0700 (PDT) Received: from welho-filter3.welho.com (welho-filter3.welho.com [83.102.41.25]) by ietfa.amsl.com (Postfix) with ESMTP id 718E01277BB for ; Fri, 17 Mar 2017 06:26:32 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter3.welho.com (Postfix) with ESMTP id D93311F03A; Fri, 17 Mar 2017 15:26:30 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp3.welho.com ([IPv6:::ffff:83.102.41.86]) by localhost (welho-filter3.welho.com [::ffff:83.102.41.25]) (amavisd-new, port 10024) with ESMTP id cf1hCj-jphXG; Fri, 17 Mar 2017 15:26:30 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp3.welho.com (Postfix) with ESMTPSA id 510502313; Fri, 17 Mar 2017 15:26:30 +0200 (EET) Date: Fri, 17 Mar 2017 15:26:22 +0200 From: Ilari Liusvaara To: Matt Caswell Cc: Martin Thomson , "tls@ietf.org" Message-ID: <20170317132622.GA26160@LK-Perkele-V2.elisa-laajakaista.fi> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Subject: Re: [TLS] Updated DTLS draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 13:26:35 -0000 On Fri, Mar 17, 2017 at 11:32:16AM +0000, Matt Caswell wrote: > On 17 March 2017 at 00:03, Martin Thomson wrote: > > On 17 March 2017 at 10:58, Matt Caswell wrote: > >> In DTLS1.3 the cookie is now (potentially) much larger and appears much later in > >> the ClientHello, making it much more likely that it will not fall > >> fully within the > >> first fragment. This could mean a fully stateless solution is impossible. > > > > > > I think that it is feasible to simply require that ClientHello be > > contained in a single datagram. > > By stating that the *whole* ClientHello must be within the first > fragment we are placing some significant restrictions on the > extensibility of the protocol and how much we can stuff into it. > Fragmenting the initial ClientHello does happen even in DTLS1.2 > (before we've added extra ciphersuites and extensions for DTLSv1.3) - > we had a recent report of someone having problems when receiving > fragmented ClientHellos: AFAIK, that mostly becomes problem only with group 260 (fortunately, I don't think anyone is crazy enough to use that!) with its 1024-byte public key, or various PQ exchanges (and there even relatively compact ones can easily be even larger). But of course, PQ might become rather important in future. Also, 1200 bytes of packet payload should be feasible. That's well within IPv6 minMTU, and also within reach of virtually all IPv4 links. > Another option is to say that the cookie extension must be fully > contained within the first fragment - which avoids the above > extensibility concerns. This option is much better but is still > retrograde from DTLS1.2 because the extensions block appears later in > the ClientHello (most importantly after ciphersuites, which could be > quite long). There's also the supported versions extension which is important. As for long ciphersuite lists, deimplementing some garbage would fix that. > A third option is to retain use of the cookie field in DTLSv1.3 and > require that the first fragment contains it, i.e. the server sends the > cookie in the HRR and the client reflects it back in the cookie field. > This would solve all of the above problems but introduces a new one - > the TLSv1.3 max cookie length is bigger than the length of the cookie > field. There are a couple of ways around that that I can think of - > the simplest being that DTLS1.3 could restrict the max cookie length - > but that in itself could cause some problems due to the fact that more > data needs to be stored in the cookie for DTLS1.3 (i.e. the transcript > hash). Well, here's one cookie design: - Key tag: 4 bytes - Encryption prelude: 32 bytes - Timestamp: 8 bytes - Peer address: 16 bytes - Cipher: 2 bytes - Group: 2 bytes - Client Hello hash: 48 bytes - Authentication tag: 16 bytes Total: 128 bytes (could be shrunk to 112 by using prelude as tag, at cost of more complex code). -Ilari. From nobody Fri Mar 17 06:33:18 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8878612943A for ; Fri, 17 Mar 2017 06:33:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qER705OY5xvr for ; Fri, 17 Mar 2017 06:33:14 -0700 (PDT) Received: from brontes.bolet.org (www.bolet.org [62.210.214.227]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F1C03129421 for ; Fri, 17 Mar 2017 06:33:11 -0700 (PDT) Received: by brontes.bolet.org (Postfix, from userid 1000) id 1324E20825; Fri, 17 Mar 2017 14:33:44 +0100 (CET) Date: Fri, 17 Mar 2017 14:33:44 +0100 From: Thomas Pornin To: Peter Gutmann Cc: Martin Thomson , "tls@ietf.org" Message-ID: <20170317133344.GA20310@bolet.org> References: <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <1489747107536.25854@cs.auckland.ac.nz> <1489749662616.94542@cs.auckland.ac.nz> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1489749662616.94542@cs.auckland.ac.nz> User-Agent: Mutt/1.5.24 (2015-08-30) Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 13:33:16 -0000 On Fri, Mar 17, 2017 at 11:21:12AM +0000, Peter Gutmann wrote: > However, this then leads to a problem where it doesn't actually solve > the constrained-client/server issue, if a client asks for 2K max > record size and the server responds with a 4K hello then it's going to > break the client even if later application_data records are only 2K. > So it would need to apply to every record type, not just > application_data. Hello, I had tried to raise the same issues here, a few months ago. The max_frag_length extension, as currently defined in RFC 6066, has the following issues: - It is client-driven: ** The server cannot send the extension unless the client has sent it first. ** Even if the client sent the extension, the only option for the server is to respond with an extension advertising the very same length. The server has no option to negotiate a smaller maximum fragment length. - "Big" clients (Web browsers) don't support it and have no incentive to do so, since they, as client, can totally use huge records, which are negligible with regards to the dozens of megabytes they eat up just for starting up. - The extension mandates the same size constraint on both directions. A constrained implementation may have two separate buffers for sending and receiving, and these buffers need not have the same size. In fact, in dedicated specific situations, records larger than the output buffer may be sent (the sender must know in advance how many bytes it will send, but it can encrypt and MAC "on the fly"). Fragmentation of messages is another issue, which is correlated but still distinct. Note for instance that it is customary, in the case of TLS 1.0 with a CBC-based cipher suite, to fragment _all_ records (application data records, at least) as part of a protection against BEAST-like attacks. Also, having very small buffers does not necessarily prevent processing larger handshake messages, or even larger unencrypted records. Here I may point at my own SSL implementation (www.bearssl.org) that can do both: it supports unencrypted records that are larger than its input buffer, and it supports huge handshake messages. It can actually perform rudimentary X.509 path validation even with multi-megabyte certificates, while keeping to a few kilobytes of RAM and no dynamic allocation. Now that does not mean that a "don't fragment" flag has no value. Indeed, streamed processing of messages is not easy to implement (I know, since I did it), and having some guarantees on non-fragmentations may help some implementations that are very constrained in ROM size and must stick to the simplest possible code. But it still is a distinct thing. Moreover, maximum handshake message length needs not be the same as the maximum record length. For instance, OpenSSL tends to enforce a maximum 64 kB size on handshake messages. Maybe we need a "maximum handshake message length" extension. In order to "fix" RFC 6066, the following would be needed, in my opinion: - Allow the server to send the extension even if the client did not send it. - Allow the server to mandate fragment lengths smaller than the value sent by the client (a client not sending the extension would be assumed to have implicitly sent an extension with a 16384-byte max fragment length). - Preferably, change the encoding to allow for _two_ lengths, for both directions, negociated separately. - Preferably, write down in TLS 1.3 that supporting the extension is mandatory. Otherwise, chances are that Web browsers won't implement it anyway. I can prototype things in BearSSL (both client and server). --Thomas Pornin From nobody Fri Mar 17 06:40:27 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7D2BA129412 for ; Fri, 17 Mar 2017 06:40:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l5S9u2opTGAm for ; Fri, 17 Mar 2017 06:40:23 -0700 (PDT) Received: from welho-filter2.welho.com (welho-filter2.welho.com [83.102.41.24]) by ietfa.amsl.com (Postfix) with ESMTP id 5FB9112932A for ; Fri, 17 Mar 2017 06:40:23 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter2.welho.com (Postfix) with ESMTP id 560611F6BA; Fri, 17 Mar 2017 15:40:22 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp3.welho.com ([IPv6:::ffff:83.102.41.86]) by localhost (welho-filter2.welho.com [::ffff:83.102.41.24]) (amavisd-new, port 10024) with ESMTP id WyJjGdOgSoOE; Fri, 17 Mar 2017 15:40:22 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp3.welho.com (Postfix) with ESMTPSA id 224852310; Fri, 17 Mar 2017 15:40:22 +0200 (EET) Date: Fri, 17 Mar 2017 15:40:15 +0200 From: Ilari Liusvaara To: Peter Gutmann Cc: Martin Thomson , "tls@ietf.org" Message-ID: <20170317134014.GA26550@LK-Perkele-V2.elisa-laajakaista.fi> References: <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <1489747107536.25854@cs.auckland.ac.nz> <1489749662616.94542@cs.auckland.ac.nz> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <1489749662616.94542@cs.auckland.ac.nz> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 13:40:25 -0000 On Fri, Mar 17, 2017 at 11:21:12AM +0000, Peter Gutmann wrote: > Martin Thomson writes: > > >Plaintext records don't have any such limits. I explicitly excluded them. > > Hmm, it's somewhat disguised in the text, technically all records are > "protected records" (if you use EMS, everything is at least integrity- > protected). So if you mean "this only applies to application_data" then you > should probably say so (alerts and CCS are too short for it to matter, and I'm > assuming no rehandshake, so only application_data will be affected by the > length constraints). I think Martin said the only case where this special case comes into play is renegotiation? > However, this then leads to a problem where it doesn't actually solve the > constrained-client/server issue, if a client asks for 2K max record size and > the server responds with a 4K hello then it's going to break the client even > if later application_data records are only 2K. So it would need to apply to > every record type, not just application_data. I don't think responding with 2k ServerHello is even possible in TLS 1.3 as defined. Even group 260 would push the size slightly above 1k And I don't think 1k is even reachable without that group. In fact, in TLS 1.3, all messages except Certificate ones are likely to be under 2k (or 1k). Of course, multiple can be combined into a record. TLS 1.2 ServerHellos can be larger, but this is mostly connected with certain extensions, like signed_certificate_timestamp. There are also some messages that can be bit bigger, like certificate_status or server_key_exchange. -Ilari From nobody Fri Mar 17 07:38:08 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A01512944D for ; Fri, 17 Mar 2017 07:38:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lekensteyn.nl Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yEBSlunqGUxo for ; Fri, 17 Mar 2017 07:38:05 -0700 (PDT) Received: from mail.lekensteyn.nl (mail.lekensteyn.nl [IPv6:2a02:2308::360:1:25]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8C6B129452 for ; Fri, 17 Mar 2017 07:38:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lekensteyn.nl; s=s2048-2015-q1; h=Content-Type:MIME-Version:Message-ID:Subject:To:From:Date; bh=lDYGJBCYuz3lcHm5cNoOAvg2AlLu/h430MIZSnMzKss=; b=wIia2ATG9DQBdTvVT5xpbtgtuZCTdd8zxFg17LW2TPJlteeGT7wqKaAkU+JTBfO4nuzwwSwgGYGFmU3lmq0gl/HOBmVxoBftLIu8xjCk1XCY0+GidlazlE+eM4VQb7RlbMnxhZFiEeafqjRh9IDY3RIFVWGUKdKHwUoP0YY99IuWp5BmZ9sJKNWsdF9NyN+zvWq+LjBlPVabAGF3EV409vwpw5g4P1FaX9awk2VEy8zPOb7p13UaRJBTe2Wkz2TvQ1IoqET+Oe4acR54ZM791tWWy6JF4wbnIduGX636C7qtEzecr/FihqSItaiJ6dCSBfOG8hjYr/pZyxrl0JQVUA==; Received: by lekensteyn.nl with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1cot0z-0007m1-L8 for tls@ietf.org; Fri, 17 Mar 2017 15:38:02 +0100 Date: Fri, 17 Mar 2017 15:38:00 +0100 From: Peter Wu To: tls@ietf.org Message-ID: <20170317143800.GA2198@al> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.8.0 (2017-02-23) Archived-At: Subject: [TLS] max_early_data_size in draft -19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 14:38:07 -0000 Hi, In the current draft, the Early Data Indication extension (https://tools.ietf.org/html/draft-ietf-tls-tls13-19#section-4.2.7) refers to Appendix B.3.4 for the use of the max_early_data_size. I cannot see how that appendix makes it easier to understand how the field is supposed to be used. Shouldn't the New Session Ticket Message section be referenced instead? -- Kind regards, Peter Wu https://lekensteyn.nl From nobody Fri Mar 17 07:45:01 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF828128796 for ; Fri, 17 Mar 2017 07:44:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id COn8ts0M3psQ for ; Fri, 17 Mar 2017 07:44:57 -0700 (PDT) Received: from welho-filter4.welho.com (welho-filter4.welho.com [83.102.41.26]) by ietfa.amsl.com (Postfix) with ESMTP id 923E3126C23 for ; Fri, 17 Mar 2017 07:44:57 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter4.welho.com (Postfix) with ESMTP id 5B3CD2783F; Fri, 17 Mar 2017 16:44:56 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp2.welho.com ([IPv6:::ffff:83.102.41.85]) by localhost (welho-filter4.welho.com [::ffff:83.102.41.26]) (amavisd-new, port 10024) with ESMTP id rerGNYyjkRzM; Fri, 17 Mar 2017 16:44:55 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp2.welho.com (Postfix) with ESMTPSA id 9C95721C; Fri, 17 Mar 2017 16:44:55 +0200 (EET) Date: Fri, 17 Mar 2017 16:44:48 +0200 From: Ilari Liusvaara To: Thomas Pornin Cc: Peter Gutmann , "tls@ietf.org" Message-ID: <20170317144448.GB26550@LK-Perkele-V2.elisa-laajakaista.fi> References: <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <1489747107536.25854@cs.auckland.ac.nz> <1489749662616.94542@cs.auckland.ac.nz> <20170317133344.GA20310@bolet.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20170317133344.GA20310@bolet.org> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 14:45:00 -0000 On Fri, Mar 17, 2017 at 02:33:44PM +0100, Thomas Pornin wrote: > On Fri, Mar 17, 2017 at 11:21:12AM +0000, Peter Gutmann wrote: > > However, this then leads to a problem where it doesn't actually solve > > the constrained-client/server issue, if a client asks for 2K max > > record size and the server responds with a 4K hello then it's going to > > break the client even if later application_data records are only 2K. > > So it would need to apply to every record type, not just > > application_data. > Fragmentation of messages is another issue, which is correlated but > still distinct. Note for instance that it is customary, in the case of > TLS 1.0 with a CBC-based cipher suite, to fragment _all_ records > (application data records, at least) as part of a protection against > BEAST-like attacks. Also, having very small buffers does not necessarily > prevent processing larger handshake messages, or even larger unencrypted > records. Here I may point at my own SSL implementation (www.bearssl.org) > that can do both: it supports unencrypted records that are larger than > its input buffer, and it supports huge handshake messages. It can > actually perform rudimentary X.509 path validation even with > multi-megabyte certificates, while keeping to a few kilobytes of RAM and > no dynamic allocation. > > Now that does not mean that a "don't fragment" flag has no value. > Indeed, streamed processing of messages is not easy to implement (I > know, since I did it), and having some guarantees on non-fragmentations > may help some implementations that are very constrained in ROM size and > must stick to the simplest possible code. But it still is a distinct > thing. Moreover, maximum handshake message length needs not be the same > as the maximum record length. For instance, OpenSSL tends to enforce a > maximum 64 kB size on handshake messages. Maybe we need a "maximum > handshake message length" extension. The TLS implementation I did has 128kB limit. Also, unfragmented handshake messages are subject to zerocopy processing. No streaming processing. The mere thought of someone implementing streaming processing in C scares me. I think BearSSL autogenerates that code. Also, in TLS 1.3, certificate messages are considerably more complicated. I don't think streaming processing of recommended-to- support stuff is even possible. My own implementation won't implement all of that, but the parts it implements (still took a few security issues because of the complexity beyond what TLS 1.2 REQUIRED) still require considerable back and forth. Most of the memory is borrowed from the message, but still not streamable. > In order to "fix" RFC 6066, the following would be needed, in my opinion: > > - Allow the server to send the extension even if the client did not > send it. TLS architecture does not allow this. Sending any extension in server hello that wasn't in client hello causes loads of implementations to just blow up (my implementation is certainly one of those). In fact, clients are REQUIRED to. > - Allow the server to mandate fragment lengths smaller than the > value sent by the client (a client not sending the extension would > be assumed to have implicitly sent an extension with a 16384-byte > max fragment length). I think allowing server to give lower limit for client records was one of the key improvments over max_record_length. I also think with the proposed extension, client could send 4096 and server could send 16384. Meaning server->client only supports records up to 4096, but client->server supports records of any size. > - Preferably, change the encoding to allow for _two_ lengths, for > both directions, negociated separately. You mean maximum handshake message size and maximum record size? -Ilari From nobody Fri Mar 17 08:02:07 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B585E128B4E for ; Fri, 17 Mar 2017 08:02:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.896 X-Spam-Level: X-Spam-Status: No, score=-4.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-2.796, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CsjXzyVbLtf4 for ; Fri, 17 Mar 2017 08:02:02 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.15.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 70A87129450 for ; Fri, 17 Mar 2017 08:02:02 -0700 (PDT) Received: from [192.168.91.179] ([80.92.121.218]) by mail.gmx.com (mrgmx003 [212.227.17.190]) with ESMTPSA (Nemesis) id 0MJBRC-1cm8EH1qoc-002o9b; Fri, 17 Mar 2017 16:01:51 +0100 To: Martin Thomson , Peter Gutmann References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> Cc: "tls@ietf.org" From: Hannes Tschofenig Openpgp: id=071A97A9ECBADCA8E31E678554D9CEEF4D776BC9 Message-ID: Date: Fri, 17 Mar 2017 16:01:47 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="2SF424mBQnOQ67g34CWvFPSADoQxlkXNu" X-Provags-ID: V03:K0:FB7oc507j1RsmA6mjJQgw3245l5R3dy16iQBFG4C3652wuUmbWZ eWhab20UxHOYWYS9pMBrsTIpqgI6j6UE3j2p09Ik28ivzVkTNQHEkW80ixFvT1m001l6bnK AwQ2ow/lTXoYz5/XkrH35Tn3mNs2JLnesLgxRLFbI1Hpi8D3/2kCiKS2+kMbxQjCY9QLSDV ih3vrCWRajq9agAniqc3A== X-UI-Out-Filterresults: notjunk:1;V01:K0:oBqfa9kFmZk=:P8UyoG9Ch7J9xebjy65ROz mASwtF6EqBMz+5rBblMXSwjTvXuHnN23iZXBlq/xenrpZ0GY5sgS4SSwWA7gez8hCr1DPkp1o livD3COh5nE5Tvn5XJczOP0QVn0Accy45tJ8tP7sMysOwcG6IWSJwERN0+rWlImfGThCIzHSi kwLpxW9uZ2oCPelMGucob1nZ7Hgvd35Z4+hEM30PCRQamPka4UEjf1V+rR8fi+mmWUObIPd0H AMZB+HO5L/C8IAvDpTpz0PE+hXWHQk0aVaxDCb1GlQOAWc0ejqaYdY5S11FSy17SzHKfWsnWz DyagmmKJsSac8aKpyb0Nt12Wk+B4/i5UITgPecuOsEjkXcyhwRKnsK+O/lEgLJDiS8+ZjBrqh 99NW4o7v9iWJWc1kjDb37iimwgj1/F6vlnDK2SB5jybiHId/LBCVAfb9dvJwyNNrVDkVx+gQ4 13KKxDGwEdRIopqC9PV2u/UmgHwytJA+VbMsJBDQTJDoZOwNskUDmPDItUdeHaPHlCcpiRYwk 8pJAqoRjhpD2duSQN2Sd07rzKFZHuSWtTGK8mQSN9Fe02NBTIAkWTt8l+HUsdAZlTm0CMnGec FwfcC5A1u7olrdigRan74pYQy+NXY3z6+fWKUvmvMePToeKWDa0jKgE9S27QdprPJdnlqte+6 1n9uvC4w3YyOIOI9sG8H3eCMya2SOsRrDFDdnQis2yjBh8AiBve2A1GLcFeFBOyGqtL0fyGve qp4ErmHt5xnH593a1/x8S4b16WxX4MqjqUPRIAipRF5axkabyiT5m2hk5S8= Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 15:02:06 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --2SF424mBQnOQ67g34CWvFPSADoQxlkXNu Content-Type: multipart/mixed; boundary="Q0jH0k55CfV7cXq2JHFperKPg7vV0Dmob"; protected-headers="v1" From: Hannes Tschofenig To: Martin Thomson , Peter Gutmann Cc: "tls@ietf.org" Message-ID: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> In-Reply-To: --Q0jH0k55CfV7cXq2JHFperKPg7vV0Dmob Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Here are my 5 cents: we implement this extension in our mbed TLS stack and we consider it quite important for IoT devices that have limited amount of RAM. The DTLS/TLS profiles for IoT RFC also recommends the use of this extension and we discussed this in the DICE WG and there was no objection against the recommendation. We had also suggested to extend this functionality to make it symmetric (i.e., both the client and the server can indicate that they are facing memory restrictions). Currently, only the TLS client can indicate his restrictions with the max fragment length extension. We do, however, understand that this is not an extension that is very useful for generic Internet devices since they are typically not suffering from the same constraints. Ciao Hannes On 03/17/2017 04:49 AM, Martin Thomson wrote: > On 17 March 2017 at 14:35, Peter Gutmann wr= ote: >> Why is it badly designed? I can guess that some people would prefer t= o have a >> mechanism for client and server to debate endlessly what the most crom= ulent >> fragment size is, but that's about the only thing I can see. >=20 > I looked at implementing this for NSS with the idea that I would try > to be nice to embedded servers (because web servers are constrained > devices too). >=20 > I can't send a max_fragment_length extension that says I support > records of 2^14 octets in length. Because I don't care and full-sized > fragments are valuable to me in some cases, but if a server is > constrained, it would be no trouble to send it smaller records. >=20 > And I can't fix that. If I send a max_fragment_length extension with > a value other than the four values defined in RFC 6066, all I get for > my troubles is an "illegal_parameter" alert from any server that > implements the RFC correctly. >=20 > The design I would use is much simpler. The extension would carry a > two octet value that is the maximum size of the plaintext that the > endpoint is willing to receive. A client could say 2^14 and that > would allow the server to send that much if it were able. The same > server could say 5 and the client would be forced to fragment like > crazy (ok, that last might be too far, we'd probably want to set a > lower bound on the value). >=20 > I'd happily implement and advertise that extension. >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls >=20 --Q0jH0k55CfV7cXq2JHFperKPg7vV0Dmob-- --2SF424mBQnOQ67g34CWvFPSADoQxlkXNu Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: GPGTools - http://gpgtools.org iQEcBAEBCgAGBQJYy/pcAAoJEGhJURNOOiAtTk8H/0BCW6Vr9j928kvzyDPVUSFJ yRxR+dA2IdVpyjXomam1d2Ld73ZQWmQ5MBV2sz/GdsY9kI1gU3QFUdyWHl+Vl8FK C4bo0htLi2EPYqjv5yHSXj0v/5Cdg+CKg3VcR9UTFEQtnUaZ213L+rzLXEgRKbD+ zDpVEyCGEzZFJl4ECSE6EREHcrokbjSPUkJr5uW9+miySDjAuDGGtVHEW4IpYFJX tO8SyP28iAbPJeU/5njknTeob/bay6vii5Q63tMpG1DOUuO5OvDVAIlujwvUFosv EkN34I4nclL6t1sn83xrH2kacKW/h59mEqLH5wayVAv9iHdESwT6PmVDlIqcr0g= =ftnj -----END PGP SIGNATURE----- --2SF424mBQnOQ67g34CWvFPSADoQxlkXNu-- From nobody Fri Mar 17 08:04:25 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A8E3129463 for ; Fri, 17 Mar 2017 08:04:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2dmWXPcT4n5L for ; Fri, 17 Mar 2017 08:04:23 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.15.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 89E17128B4E for ; Fri, 17 Mar 2017 08:04:22 -0700 (PDT) Received: from [192.168.91.179] ([80.92.121.218]) by mail.gmx.com (mrgmx003 [212.227.17.190]) with ESMTPSA (Nemesis) id 0MSMP5-1ccxIi3fr9-00TVid; Fri, 17 Mar 2017 16:04:16 +0100 To: Martin Thomson , Peter Gutmann References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> Cc: "tls@ietf.org" From: Hannes Tschofenig Openpgp: id=071A97A9ECBADCA8E31E678554D9CEEF4D776BC9 Message-ID: <867f7094-896d-9022-7213-73fd11e3a6b9@gmx.net> Date: Fri, 17 Mar 2017 16:04:14 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="cKJqmvLbS9Rom34061b4lp44FEo4qkvc4" X-Provags-ID: V03:K0:qshysHqrnWxeh8d+nEmManrtj5qaLIlo9MIDcV4wcV7nJo+ubDA sUDH2rJP848esdwpZltoO0MF8Qr0hM4QozXVE95mPpiqqDuZOK/XY0bqu3g5HO7qOiDHZ7g Puy9wLFLBFhxZ58ceyyca/IsvKPbLCxEBhoBI6DuBGTKtRyEXPrHETSgHMoIV+RbdBdV6Pw YX7duDgQ9A1c40FOaIhQw== X-UI-Out-Filterresults: notjunk:1;V01:K0:8RTtTb1j5nE=:sFywqYbJqBFThrzQhjmLo9 pg2ysGZS2f9xkdR/M+9gYhn3ElIaJ5aV9EOOIG3XlG36ucvsvIREV3rfIvR9PcYD5gR1Q5PT3 /k5aP4AXPSDkrfQ4Zf8ccEeMFB1ScFjgH9IyKuw+MDFwIKKq57wy57cXJxTjeErKG3Q46yPeh xbwCzstAL28RD7u4yBpCdvv5+7HYqb4eeHVJJyMlJg99d/Q++H0KQGn0J/DGexsuJ4h4djqFb iu2X/Jv+VMHm/LXhQq/4g6zwkKFGENlZwW0lpohbA/LzJlLLBP5sEON4P3cddu6SkmUsIw46p yY3hAzQNIthz9S/2vq3pLWzdCXzXjpS/+WiTlERETHWZo0gopspjSFa3N7jaYzMjokZNWB3jo YEbBpNwbSSYZBkuyvb8kQ0b5NRxmKGRGjXPPRPTZVGf4O1MpBVanEdUzYnXBlQkCxLr2LUXI/ QDJm/Cu0ZXQQIHRDPA2zL3D8NLI/6JK1BqraO5QkEKq/1LjsihIzYJ//8HWaXqsTOWgfELu13 z1nBXTcTYJwQ8W8SZuos9j9ZRryXeqDzdcs2MO/3RnAjx7eEl+kfkOlBDB8nizQTVazfDymZg bHQctqn14o3eDrVzLtxnECH+jRd26JUxhHVvMmzwDl/KX0pv9gRKbWCixegBbfz4Y/bM6qnnm SgGPkvLytpYUvqdhBjks9KLy8L6e4XWoAitIYWEXUISECmxyiNeGl+yGA1NTrAvw4mgnENEfa ypXyD6XIgcVNrzRu0amHo3Vqsiewvs5s6FZgjZ3ZcmSoxZc6g6iSGlyegpM= Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 15:04:25 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --cKJqmvLbS9Rom34061b4lp44FEo4qkvc4 Content-Type: multipart/mixed; boundary="mdXCLLM19fujPwAXMxgMjDWwOdAqIVxar"; protected-headers="v1" From: Hannes Tschofenig To: Martin Thomson , Peter Gutmann Cc: "tls@ietf.org" Message-ID: <867f7094-896d-9022-7213-73fd11e3a6b9@gmx.net> Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> In-Reply-To: --mdXCLLM19fujPwAXMxgMjDWwOdAqIVxar Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Hi Martin, we suggested it in Section 6 of https://tools.ietf.org/html/draft-fossati-tls-iot-optimizations-00 and Thomas also made a proposal in the same direction not too long ago as well, see https://www.ietf.org/mail-archive/web/tls/current/msg22058.html= Ciao Hannes On 03/17/2017 07:24 AM, Martin Thomson wrote: > On 17 March 2017 at 14:49, Martin Thomson wr= ote: >> The design I would use is much simpler. The extension would carry a >> two octet value that is the maximum size of the plaintext that the >> endpoint is willing to receive. A client could say 2^14 and that >> would allow the server to send that much if it were able. The same >> server could say 5 and the client would be forced to fragment like >> crazy (ok, that last might be too far, we'd probably want to set a >> lower bound on the value). >> >> I'd happily implement and advertise that extension. >=20 > I'd even go so far as to specify it: >=20 > https://martinthomson.github.io/tls-record-limit/ >=20 > I'll submit an I-D once the blackout ends if people are interested in t= his. >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls >=20 --mdXCLLM19fujPwAXMxgMjDWwOdAqIVxar-- --cKJqmvLbS9Rom34061b4lp44FEo4qkvc4 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: GPGTools - http://gpgtools.org iQEcBAEBCgAGBQJYy/ruAAoJEGhJURNOOiAt8mMH/i5Whsy86EB6T/lcpKRUipD7 SiQasjht55yWhR7Na8q1cWa4lPjPumqTL2jNNg0p/136POFg33W25LYmCS/QXNhv 60k+y2cE/5JgEV5mYrABekirDFrfzZ/Qc2DdlmkX5AAH8iP4ngfkAGtKGRgbhGpi yj5OZTzqGb0YFLtQBy3QtqtSbMqmeeYKg5sQqfjT/ZMSUTX5fwy+svLQ8nhoqQSS k5vIl52bDOwkQrjGpQtNWcfgWb5FSg70s+vF78ctmaj0YFolI++81O393C+VOfyZ I6JpYyKa9fQ5Zd72mDRtaY5JLnPFtIQbrxwswX0J1IkwNSelo8RQb5g9qRpMVsE= =/weW -----END PGP SIGNATURE----- --cKJqmvLbS9Rom34061b4lp44FEo4qkvc4-- From nobody Fri Mar 17 08:10:29 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84176129464 for ; Fri, 17 Mar 2017 08:10:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MFuPiihpLmJo for ; Fri, 17 Mar 2017 08:10:25 -0700 (PDT) Received: from mail-yw0-x22b.google.com (mail-yw0-x22b.google.com [IPv6:2607:f8b0:4002:c05::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B763012945A for ; Fri, 17 Mar 2017 08:10:25 -0700 (PDT) Received: by mail-yw0-x22b.google.com with SMTP id v76so55144356ywg.0 for ; Fri, 17 Mar 2017 08:10:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=R+/HpNgkI5+n5bzW4eYHo+C1sr4Fn6wNZJm7kD7MpXk=; b=XSTNeukpuKOngabnrjRwK2emL9n9YTskxEzyQPw1Ux4ppkHFl456m0rKVvl3yVqw9s xfKH08HGpmf1jh5Ol5fKvkOHlR1fsSL6iudfcwGKe/kEj7oeUFsx7hzuxkhN04Tb83Bb H6EY+rqfcWVlFtwALVgJ8/HTx6HcruZicp6wzwCG5oicPmJhvyPSURMMcEurv/ezOVrg 0rhMq2TFUrrma/0613nT1V63fH7ZtRXch5AITbsGX6OcrenBJW+Rdvq8ZmnZ+O5VGdU3 NWPuvqyUA76eizHmOON8vAJxZ8LvILzfc4ODC+8A9WIP31ZUaTQR/nEqjwsIEOQmqhyJ bChw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=R+/HpNgkI5+n5bzW4eYHo+C1sr4Fn6wNZJm7kD7MpXk=; b=t9INHG1N547IAzboDgx4m5N3e2NXTyLMJjTMoNAC2dtfxqckzRKIYKnvhzSk+yVNzC 401FOWRcYJYpLzIACtHCKGhsfgHT+CziJSAzVnG95/T2Je5P9bg7eZ4nDJlir3Y76Ykq J0adE0H6QvxP9McIYsMwmgVEJdkjhajW2wgRfBs/msEIpQxt1N3LPTqeYD6GYjNb3fyK k16GZHAwluCGOJKIelv88hTBn+bdEhv5d6e65zhdbfxzj3jJiGwRzHWq+RaI13aiVBRe 2D2VrUyKmegAPpKDKEBd5kQAHudh8xzfQArVKupwH9VFJL1exdennplr4LJ8cl5PMxFd SsVg== X-Gm-Message-State: AFeK/H1QfEB78WvBrP+xvddU6KAnbSzsk5oWIPfIMS4u2Mt1Cm1+R9DU7WGJw0AkCxeXCVhk5SEEflbojx+UVw== X-Received: by 10.129.92.84 with SMTP id q81mr3512482ywb.87.1489763424986; Fri, 17 Mar 2017 08:10:24 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Fri, 17 Mar 2017 08:09:44 -0700 (PDT) In-Reply-To: <20170317143800.GA2198@al> References: <20170317143800.GA2198@al> From: Eric Rescorla Date: Fri, 17 Mar 2017 08:09:44 -0700 Message-ID: To: Peter Wu Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a114d8570bf10ec054aee936f Archived-At: Subject: Re: [TLS] max_early_data_size in draft -19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 15:10:27 -0000 --001a114d8570bf10ec054aee936f Content-Type: text/plain; charset=UTF-8 Fixed in: https://github.com/tlswg/tls13-spec/commit/40e6e0cdfedf602db0e31ff62b8d4af6d47fc631 -Ekr On Fri, Mar 17, 2017 at 7:38 AM, Peter Wu wrote: > Hi, > > In the current draft, the Early Data Indication extension > (https://tools.ietf.org/html/draft-ietf-tls-tls13-19#section-4.2.7) > refers to Appendix B.3.4 for the use of the max_early_data_size. > > I cannot see how that appendix makes it easier to understand how the > field is supposed to be used. Shouldn't the New Session Ticket Message > section be referenced instead? > -- > Kind regards, > Peter Wu > https://lekensteyn.nl > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --001a114d8570bf10ec054aee936f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

On Fri, Mar 17, 2017 at 7:38 AM, Peter Wu = <peter@lekensteyn.nl> wrote:
Hi,

In the current draft, the Early Data Indication extension
(https://tools.ietf.org/html/d= raft-ietf-tls-tls13-19#section-4.2.7)
refers to Appendix B.3.4 for the use of the max_early_data_size.

I cannot see how that appendix makes it easier to understand how the
field is supposed to be used. Shouldn't the New Session Ticket Message<= br> section be referenced instead?
--
Kind regards,
Peter Wu
http= s://lekensteyn.nl

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--001a114d8570bf10ec054aee936f-- From nobody Fri Mar 17 08:14:18 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FF2F129488 for ; Fri, 17 Mar 2017 08:14:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.101 X-Spam-Level: X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l3Ar8g0PhUjK for ; Fri, 17 Mar 2017 08:14:15 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.15.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3041A124C27 for ; Fri, 17 Mar 2017 08:14:11 -0700 (PDT) Received: from [192.168.91.179] ([80.92.121.218]) by mail.gmx.com (mrgmx003 [212.227.17.190]) with ESMTPSA (Nemesis) id 0Lugbo-1c6esM3moS-00zpZF; Fri, 17 Mar 2017 16:14:03 +0100 To: Martin Thomson , Peter Gutmann References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <1489747107536.25854@cs.auckland.ac.nz> Cc: "tls@ietf.org" From: Hannes Tschofenig Openpgp: id=071A97A9ECBADCA8E31E678554D9CEEF4D776BC9 Message-ID: Date: Fri, 17 Mar 2017 16:14:01 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="upAE3xbHEVbxpkmHo3SsRVuSCk178rQ7N" X-Provags-ID: V03:K0:GSC71cIK1gHgVQBFQG20STQrQAz0T9QnoIuarP3Ch2wQ08prI+r ftdmFWS8mn/EqNGWwfqvQyCZtxcDMk9SNuLykyKv8BeJcXRqw6xxrOqhpQE1njISgKgwdoN 2JgYydPFxKbemSAUB8d3Az2qVgTF44mpd8QnMGaIq9r1tg8t2zvIPLgh9ssQWzX6LvNJlo1 idAp7PeuSU+CCmoZaNtvQ== X-UI-Out-Filterresults: notjunk:1;V01:K0:y1pbYx+MBHM=:gJ9m44sb914gZJLBDeZ2rG uTLKx2d0PGYGiFAVLcTWRlnFigyeCOmETVIVunNq6VmPVgi474KSuyTCNl7fdgbcqnzWVdPp4 JenzQtHuwVub5v3u54kGc5eeQrmlAila7hfSBAWmkJZ55JCmMjL934752ATa8/AxlkfKMoYJA QgcMB8WgG615dLGvtTxUYqCPjrPBSoQkFdl3o0jHCjG8Zpl0kdxTjl3LzLRbXsNtV2eAWRU58 UB7tuB3KaaAK81q7fcEeMDIVAKRJpAzzr5MPDiG7eCLg+fWfg5txtavUrHZND82gadyI+eSFg 0AG6daipMBhoMhlmFz1RbRSA+Gq7P+Y2hwtBTGwsB+xDywClWmfpvfW63tFHFaLpvxlzjHUXG zWuh8qvFarars5xntrw5ajTiSE28qW1hYXYOC03jCEPrR/oAK2x/RwS/1AjCiy24fUm7wzMi+ kwSpAR3I+xxul0h8+HvospoGj70rbtKflm1yRWFTEczyut+7F/jCkNrap643DSdCJzmTArl/y fofwO9lIRoNJ31+caUdfCOkfDi9E3150lflop/JruvDDWJbkcPRnmDsPzZL02yCzbPFy2dnMz xrGQt9ON0iqck5bvbuk59m3fZ2zNoZs08p4uQPZryj721Nc0tAYb6FPFU7srLbr4n4+vBvw4g akaPIEaxX/AVrtAWzMj6uXvB09A1ymkSEEak2D1OoT0IKOFR4Kljjqb3kFUqVvm7RlbOW7btL /A9hH/TASdfN7DM1jJHQJzsL9dq4ajfFeZWAVaJO1yEh6CY6FOeZbJUyZEo= Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 15:14:17 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --upAE3xbHEVbxpkmHo3SsRVuSCk178rQ7N Content-Type: multipart/mixed; boundary="8Kibh6mDx8uTcK4hqngqBwCN0wJpHI4UO"; protected-headers="v1" From: Hannes Tschofenig To: Martin Thomson , Peter Gutmann Cc: "tls@ietf.org" Message-ID: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <1489747107536.25854@cs.auckland.ac.nz> In-Reply-To: --8Kibh6mDx8uTcK4hqngqBwCN0wJpHI4UO Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 03/17/2017 11:57 AM, Martin Thomson wrote: > This is apparently a big deal for people building little things with > TLS in them. Hannes knows better than I do. On the web, this > extension basically doesn't exist (for the aforementioned reasons, in > part, also because browsers historically didn't much for servers and > their resource constraints). In addition to us (mbedTLS) also WolfSSL implements the maximum fragment length extension. According to their website their embedded TLS stack is used in more than 2 billion devices. MatrixSSL also supports this extension. There may be other embedded TLS stacks supporting it but the complete list of features is not always accessible on the websites of the vendors.= Ciao Hannes --8Kibh6mDx8uTcK4hqngqBwCN0wJpHI4UO-- --upAE3xbHEVbxpkmHo3SsRVuSCk178rQ7N Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: GPGTools - http://gpgtools.org iQEcBAEBCgAGBQJYy/05AAoJEGhJURNOOiAt1T0H+wRX7kS7KDIoJ0zUe2knHKdb r2NBaQ/f39wLCI4BTOw3+aInV/Jy6KU4Ki/u5Y9hF2glGER1Br9uhIQ1u13DAX2i S4HBciqI6RPFLyEZpMea50YxRR1nYBlSck2FIY35n70VERPf17gzGkynKoYR9WVU lvY0GKcNEI/VxfzFQ+mwsK4qCUYQhLxsQT71MyoQxvoyWPRVpuKYt8Vs0oevf4Pu lkrI+vXq28NlKvEgnngJnAKAgsJG9mY/B/8gGnZa7ARdzjVSssdv8IcbGgPxDaLm Yzttl3VRukXyfA5g0IWY5LSuiSkyrz0/3DIW98yRBqp22EeriRRYtQuddb6tHtQ= =Jx/r -----END PGP SIGNATURE----- --upAE3xbHEVbxpkmHo3SsRVuSCk178rQ7N-- From nobody Fri Mar 17 08:38:05 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 314C6129479 for ; Fri, 17 Mar 2017 08:38:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.903 X-Spam-Level: X-Spam-Status: No, score=-1.903 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id obOIV6tocW2B for ; Fri, 17 Mar 2017 08:38:01 -0700 (PDT) Received: from brontes.bolet.org (www.bolet.org [62.210.214.227]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 095BA1294A6 for ; Fri, 17 Mar 2017 08:38:00 -0700 (PDT) Received: by brontes.bolet.org (Postfix, from userid 1000) id 58E7620821; Fri, 17 Mar 2017 16:37:59 +0100 (CET) Date: Fri, 17 Mar 2017 16:37:59 +0100 From: Thomas Pornin To: Ilari Liusvaara Cc: Peter Gutmann , "tls@ietf.org" Message-ID: <20170317153759.GA22929@bolet.org> References: <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <1489747107536.25854@cs.auckland.ac.nz> <1489749662616.94542@cs.auckland.ac.nz> <20170317133344.GA20310@bolet.org> <20170317144448.GB26550@LK-Perkele-V2.elisa-laajakaista.fi> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170317144448.GB26550@LK-Perkele-V2.elisa-laajakaista.fi> User-Agent: Mutt/1.5.24 (2015-08-30) Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 15:38:03 -0000 On Fri, Mar 17, 2017 at 04:44:48PM +0200, Ilari Liusvaara wrote: > The mere thought of someone implementing streaming processing in > C scares me. I think BearSSL autogenerates that code. Yes, actual code is in a custom Forth dialect, which is compiled to token-threaded code executed by a C interpreter. That's because if you want to implement streamed processing sanely in an imperative language (like C), then you basically need coroutines, i.e. the ability to interrupt the processing, and later on jump back to the processing. You cannot do that in plain C if you have function calls and thus a "call stack" to save and recover (and if you do not, then the code becomes insanely unreadable). You _could_ make a custom stack, but this is expensive (since the C compiler tends to create local variables at will, a custom stack would need at least 1 or 2 kB of extra RAM) and it is awfully non-portable. > Also, in TLS 1.3, certificate messages are considerably more > complicated. I don't think streaming processing of recommended-to- > support stuff is even possible. Streaming processing is ill-supported and on the decline. E.g. even with TLS 1.2, EdDSA-signed certificates cannot be processed with streaming, because the hash function computation over the to-be-signed must begin with hashing the 'R' element (which is part of the signature, and occurs _after_ the TBS) and the 'A' value (the signer's public key, which is found in the signer's certificate, that comes _after_ the current certificate in TLS 1.2 Certificate message). Since TLS 1.3 also mandates some options that may require considerable buffering (e.g. the cookies and the session tickets, both ranging up to 64 kB), one might say that, as an evolving standard, TLS 1.3 is moving away from the IoT/embedded world, and more toward a Web world. This is not necessarily _bad_, but it is likely to leave some people unsatisfied (and, in practice, people clinging to TLS 1.2). > TLS architecture does not allow this. Sending any extension in server > hello that wasn't in client hello causes loads of implementations to > just blow up (my implementation is certainly one of those). In fact, > clients are REQUIRED to. I know. BearSSL also rejects server extension that do not match client extensions. It also rejects attempts by the server at trying to negotiate a different maximum fragment length. It does so because the RFC says so (even though I agree with Peter that the standard behaviour is of questionable usefulness). > You mean maximum handshake message size and maximum record size? I mean a maximum record size for records sent by the client to the server, _and_ a maximum record size for records sent by the server to the client. Since any implementation may use distinct buffers for sending and for receiving(*), the two sizes need not match. (*) In particular, if you want to support HTTPS, where pipelining requests is allowed, an HTTPS-aware server more or less needs to have two distinct buffers for input and output. --Thomas From nobody Fri Mar 17 10:02:41 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E0DF1294A5 for ; Fri, 17 Mar 2017 10:02:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gzUFwJt2xyFV for ; Fri, 17 Mar 2017 10:02:37 -0700 (PDT) Received: from welho-filter3.welho.com (welho-filter3.welho.com [83.102.41.25]) by ietfa.amsl.com (Postfix) with ESMTP id B6AFF1201F2 for ; Fri, 17 Mar 2017 10:02:37 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter3.welho.com (Postfix) with ESMTP id 0DF3A1D648; Fri, 17 Mar 2017 19:02:36 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp3.welho.com ([IPv6:::ffff:83.102.41.86]) by localhost (welho-filter3.welho.com [::ffff:83.102.41.25]) (amavisd-new, port 10024) with ESMTP id W-ajNOHxx5va; Fri, 17 Mar 2017 19:02:35 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp3.welho.com (Postfix) with ESMTPSA id CDB632310; Fri, 17 Mar 2017 19:02:35 +0200 (EET) Date: Fri, 17 Mar 2017 19:02:28 +0200 From: Ilari Liusvaara To: Thomas Pornin Cc: Peter Gutmann , "tls@ietf.org" Message-ID: <20170317170228.GA27219@LK-Perkele-V2.elisa-laajakaista.fi> References: <1489721710740.52293@cs.auckland.ac.nz> <1489747107536.25854@cs.auckland.ac.nz> <1489749662616.94542@cs.auckland.ac.nz> <20170317133344.GA20310@bolet.org> <20170317144448.GB26550@LK-Perkele-V2.elisa-laajakaista.fi> <20170317153759.GA22929@bolet.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20170317153759.GA22929@bolet.org> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 17:02:40 -0000 On Fri, Mar 17, 2017 at 04:37:59PM +0100, Thomas Pornin wrote: > > > Also, in TLS 1.3, certificate messages are considerably more > > complicated. I don't think streaming processing of recommended-to- > > support stuff is even possible. > > Streaming processing is ill-supported and on the decline. E.g. even with > TLS 1.2, EdDSA-signed certificates cannot be processed with streaming, > because the hash function computation over the to-be-signed must begin > with hashing the 'R' element (which is part of the signature, and occurs > _after_ the TBS) and the 'A' value (the signer's public key, which is > found in the signer's certificate, that comes _after_ the current > certificate in TLS 1.2 Certificate message). > > Since TLS 1.3 also mandates some options that may require considerable > buffering (e.g. the cookies and the session tickets, both ranging up to > 64 kB), one might say that, as an evolving standard, TLS 1.3 is moving > away from the IoT/embedded world, and more toward a Web world. This is > not necessarily _bad_, but it is likely to leave some people unsatisfied > (and, in practice, people clinging to TLS 1.2). Cookies can indeed be quite large and are required. I don't think session tickets are required (the implementation I did just throws those to trash). > > You mean maximum handshake message size and maximum record size? > > I mean a maximum record size for records sent by the client to the > server, _and_ a maximum record size for records sent by the server to > the client. Since any implementation may use distinct buffers for > sending and for receiving(*), the two sizes need not match. Ah, I implemented version of record_size_limit extension (grabbing codepoint 0x1053). The value sent is always 16384, but the value received can be different. -Ilari From nobody Fri Mar 17 15:49:13 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B849D129551 for ; Fri, 17 Mar 2017 15:49:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LXXGR8Sp_GIL for ; Fri, 17 Mar 2017 15:49:10 -0700 (PDT) Received: from mail-qk0-x234.google.com (mail-qk0-x234.google.com [IPv6:2607:f8b0:400d:c09::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B7DA124B0A for ; Fri, 17 Mar 2017 15:49:10 -0700 (PDT) Received: by mail-qk0-x234.google.com with SMTP id v127so76066497qkb.2 for ; Fri, 17 Mar 2017 15:49:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=x5W3Lqx1k7/Hc8KlY+3O0dU3mljrjj+f5GAl0/uPudA=; b=Rha4r/Kgxx3ZWxyRm24N1Bv1a1NEAjisC0QL06c9Cv41gk4mMFV8azf9CbfSh35UEg ou3i3nWibgDzrHw9xkOGCdNC8APv0Ulk8g+fiz4tDRUDIjH94N4Lvw958xd95Gd9BAQz iDuca8CWeMDyH530BaktPNVL7yyOumWgrGiZi9lxShaKDUTjBJfakJC25DwEFSDZl0Vp t6gSDY5OpgP28nuLmv1+kRlQo6u+eJMW+1gsLRaLRdsprPfiLA7jrC6u6Egnh3X/GwKC TQbnRrtsZyYtYJtNjrNRV7iqzJi/5nuhabuOPw4RdFBT6sSMNEkYmk+Nq6zmoo294dQl d3hw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=x5W3Lqx1k7/Hc8KlY+3O0dU3mljrjj+f5GAl0/uPudA=; b=Vur4U1G/bWpJYz4QlO+lVl0U85EtmsQ5CBq5p0c281S5SlgGPw1+lbYBw9A1Zth57Q uSLNpovbnfEuq9sI9OPRyTXyjYPvPCqk6vW7j9182/dnNchym7BPoKNYUhvm2bVTVY2F MpdlTU5lvQ56V5RtT3mMuC2nCWxuciWzgiNhBxxHn/xRd4SC2vQczEYBlm90y2A2l/qz JACKUXGB3GBhGknVhXjC/JjfVKnNlZ5cCBB6YtNtRg9+9FhgOcU4/6NgmaTwmrJbXyc5 GX+pw322rlWQD7xurRlA5Ngi4uh+cVBIXz+NRqX5H9YmGKMngFpJcNSzVuiu5CgKllGp aSDQ== X-Gm-Message-State: AFeK/H06BThFTL0JozJmXrY6XhERncMKWWPXJBhBx4paDTogP3d3nGAR2T0mlAjT7pQc/HzMkTVA6k0y/M9ZEA== X-Received: by 10.55.5.146 with SMTP id 140mr16842088qkf.202.1489790949693; Fri, 17 Mar 2017 15:49:09 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Fri, 17 Mar 2017 15:49:09 -0700 (PDT) In-Reply-To: <20170317132622.GA26160@LK-Perkele-V2.elisa-laajakaista.fi> References: <20170317132622.GA26160@LK-Perkele-V2.elisa-laajakaista.fi> From: Martin Thomson Date: Sat, 18 Mar 2017 09:49:09 +1100 Message-ID: To: Ilari Liusvaara Cc: Matt Caswell , "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] Updated DTLS draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Mar 2017 22:49:11 -0000 On 18 March 2017 at 00:26, Ilari Liusvaara wrote: > Also, 1200 bytes of packet payload should be feasible. That's > well within IPv6 minMTU, and also within reach of virtually all > IPv4 links. This was the rationale in QUIC. Most links support an MTU of that size, if only because they have to if they hope to ever support IPv6. From nobody Sat Mar 18 00:35:50 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 22B7A12426E for ; Sat, 18 Mar 2017 00:35:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OTtiVTqBL5IJ for ; Sat, 18 Mar 2017 00:35:47 -0700 (PDT) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8119912422F for ; Sat, 18 Mar 2017 00:35:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1489822546; x=1521358546; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=PxQCYpHwS1ACQmCVSQOUnW8cr03u56uVoVrCoQ+e6ag=; b=BTUv+H82xgZhBdgkN3MXMR2xxhOyBWHewjrPu+1FmqwEV7KKfufenIXG 0tuuWa3e8qtAYsO5QmL9NFsLaXMZLKytu59VYrNgUcXxtnL/QDZPgXxm1 KpK7pdIVIju0x1YYxVqZfv5+Qisj6tCki0c2YFnn/fVXYm32Xa9BjPGVt HUnhP78LswXDMZYg0nF4U5GZ50sB/fdXM9OzUWCAYceJ12N59av6KC0L8 cDxrIZoIAn0XvHdg3ABCbfKuuyjFP/HklyKRKZL0R4fy75ijYiCfaOIqd mblksVsHbNU6GA7R/O3kS9GbCvoJ7q+NpVGYEWEDUkijg+wYjpYaBZX+x Q==; X-IronPort-AV: E=Sophos;i="5.36,181,1486378800"; d="scan'208";a="143780903" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.2.5 - Outgoing - Outgoing Received: from uxcn13-ogg-d.uoa.auckland.ac.nz ([10.6.2.5]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 18 Mar 2017 20:35:42 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Sat, 18 Mar 2017 20:35:42 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1178.000; Sat, 18 Mar 2017 20:35:42 +1300 From: Peter Gutmann To: Thomas Pornin CC: Martin Thomson , "tls@ietf.org" Thread-Topic: [TLS] RFC 6066 - Max fragment length negotiation Thread-Index: AQHSnpUB8UgZsR1fnUWlpN1q8vk4DKGYGe7w//8q+oCAANxgO///LA8AgADcRWz//0AsAAAe+X57//8qVYCAACsrgIABIKju//8rnQCAAOBv1///S1IAgAIH4ew= Date: Sat, 18 Mar 2017 07:35:42 +0000 Message-ID: <1489822531565.68351@cs.auckland.ac.nz> References: <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <1489747107536.25854@cs.auckland.ac.nz> <1489749662616.94542@cs.auckland.ac.nz>,<20170317133344.GA20310@bolet.org> In-Reply-To: <20170317133344.GA20310@bolet.org> Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Mar 2017 07:35:49 -0000 Thomas Pornin writes:=0A= =0A= >having some guarantees on non-fragmentations may help some implementations= =0A= >that are very constrained in ROM size and must stick to the simplest possi= ble=0A= >code.=0A= =0A= It's not the code size, it's attack surface. There have been endless attac= ks=0A= on IP fragmentation and fragment reassembly, not to mention equally numerou= s=0A= firewall/IDS bypasses by creative fragmentation. So in my case not doing= =0A= fragmentation is a security thing, not a code-size thing (as was not doing= =0A= rehandshake, compression, and a pile of other things that have caused probl= ems=0A= in SSL/TLS in the past).=0A= =0A= The fact that I've never encountered any embedded/SCADA device that handles= or=0A= requires fragmentation makes it ever easier.=0A= =0A= Peter.=0A= From nobody Sat Mar 18 00:38:24 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DDAFD126C89 for ; Sat, 18 Mar 2017 00:38:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uy4ylcGvwnXK for ; Sat, 18 Mar 2017 00:38:22 -0700 (PDT) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 185A012426E for ; Sat, 18 Mar 2017 00:38:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1489822702; x=1521358702; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=dZ/Ec1JRjHcfKZcLKPWZ5wrcPuTjuk6BPGpWi6dgqmE=; b=zyOuUIPPpesxIOjrETawVJfbD2jZweUnhaDKrePDrDYonCU8WRCKXDW5 IcpsAcqF5pY5jY5NoXTuIgYq/+92eXp8EjsBnzq1xe8SIJs/rduc8Eepj TGdRgmVcCfYlqkMmC8QlYREj/gWaPgubz5ICjFkXzGn4jDUCWvW41wDWa 3Inyeg04hYX4120eYzgDEx9cw5ZDr4JmphnGPr1dMtse7Hxc1fbdsn92u fIir/0t14twr+ZchK5DrEDAjGfvwh6ZWAvNX+POlV92UrUwuOpmvrCRX0 kfi64bF/L2za2/PFIMQGZb0hW+fuNDICUuknNRyzfPWaHGhG1/xALm65s A==; X-IronPort-AV: E=Sophos;i="5.36,181,1486378800"; d="scan'208";a="143781086" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.3.9 - Outgoing - Outgoing Received: from uxcn13-tdc-e.uoa.auckland.ac.nz ([10.6.3.9]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 18 Mar 2017 20:38:20 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-tdc-e.UoA.auckland.ac.nz (10.6.3.9) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Sat, 18 Mar 2017 20:38:20 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1178.000; Sat, 18 Mar 2017 20:38:20 +1300 From: Peter Gutmann To: Ilari Liusvaara CC: Martin Thomson , "tls@ietf.org" Thread-Topic: [TLS] RFC 6066 - Max fragment length negotiation Thread-Index: AQHSnpUB8UgZsR1fnUWlpN1q8vk4DKGYGe7w//8q+oCAANxgO///LA8AgADcRWz//0AsAAAe+X57//8qVYCAACsrgIABIKju//8rnQCAAOBv1///TSSAgAIHDu8= Date: Sat, 18 Mar 2017 07:38:19 +0000 Message-ID: <1489822688947.65295@cs.auckland.ac.nz> References: <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <1489747107536.25854@cs.auckland.ac.nz> <1489749662616.94542@cs.auckland.ac.nz>, <20170317134014.GA26550@LK-Perkele-V2.elisa-laajakaista.fi> In-Reply-To: <20170317134014.GA26550@LK-Perkele-V2.elisa-laajakaista.fi> Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Mar 2017 07:38:24 -0000 Ilari Liusvaara writes:=0A= =0A= >In fact, in TLS 1.3, all messages except Certificate ones are likely to be= =0A= >under 2k (or 1k).=0A= =0A= OK, in that case make the max message size 1K, or 512 bytes, or whatver you= =0A= need.=0A= =0A= Also, TLS 1.3 as it currently stands, in a pre-standard draft, may have=0A= messages under 2K or whatever, but so did SSL in its day. Give it time and= =0A= it'll be bloated up with 200 extensions and 500 cipher suites just like TLS= =0A= is.=0A= =0A= Peter.= From nobody Sat Mar 18 00:40:24 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5529A12422F for ; Sat, 18 Mar 2017 00:40:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CzkOkgBN1DKl for ; Sat, 18 Mar 2017 00:40:22 -0700 (PDT) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ACAA7120726 for ; Sat, 18 Mar 2017 00:40:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1489822821; x=1521358821; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=pJQI3W+EJk8TaL9pqhwUBuu7nwMhpHVaP6/H9qXVL9I=; b=WmXgF02DcVctoF1trgD5MWOGTlDvdMZykvhB2SMwq1AFbyKsz+F5bVBk eN2DyrYmNgKqWVDIJhkUenQ4p9xY9Jb8ehFPtu8zUYorsmIxFct2ovPZP wdW1T5mbrZwzwIzn1kbQgcbWa13Ua5xxsFxjAosvZAYOJ0Y9WntZt8j5j 5VFSJL7/4cUVI4uqA+NPv5Y712Wq5fLPbPPp07Jgc9gV/V/oYjk8kp8qb yH4IS8kyiCZ3UjKKsk6S6B4cCc7cPvBofsKk5q696S7Wfe41A7WhI6yIK H5JqCJOSpXWoqIjAHvLer9iP9ahK8N+DVyVS2LTGghE1jxJI6H028Ogrj A==; X-IronPort-AV: E=Sophos;i="5.36,181,1486378800"; d="scan'208";a="143781297" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.2.2 - Outgoing - Outgoing Received: from smtp.uoa.auckland.ac.nz (HELO uxcn13-ogg-a.UoA.auckland.ac.nz) ([10.6.2.2]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 18 Mar 2017 20:40:20 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-ogg-a.UoA.auckland.ac.nz (10.6.2.2) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Sat, 18 Mar 2017 20:40:20 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1178.000; Sat, 18 Mar 2017 20:40:20 +1300 From: Peter Gutmann To: Hannes Tschofenig , Martin Thomson CC: "tls@ietf.org" Thread-Topic: [TLS] RFC 6066 - Max fragment length negotiation Thread-Index: AQHSnpUB8UgZsR1fnUWlpN1q8vk4DKGYGe7w//8q+oCAANxgO///LA8AgADcRWz//0AsAAAe+X57//8qVYCAALvLgIAB8Nax Date: Sat, 18 Mar 2017 07:40:19 +0000 Message-ID: <1489822809025.36418@cs.auckland.ac.nz> References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> , In-Reply-To: Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Mar 2017 07:40:23 -0000 Hannes Tschofenig writes:=0A= =0A= >Here are my 5 cents: we implement this extension in our mbed TLS stack and= we=0A= >consider it quite important for IoT devices that have limited amount of RA= M.=0A= >The DTLS/TLS profiles for IoT RFC also recommends the use of this extensio= n=0A= >and we discussed this in the DICE WG and there was no objection against th= e=0A= >recommendation.=0A= =0A= Do you have a server that implements this online anywhere for interop=0A= purposes? I've had it implemented but commented out pretty much forever, i= t'd=0A= be useful to have something to test against.=0A= =0A= Peter.=0A= From nobody Sat Mar 18 02:18:15 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB23D120724 for ; Sat, 18 Mar 2017 02:18:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V9slp4vj53yv for ; Sat, 18 Mar 2017 02:18:12 -0700 (PDT) Received: from mail-ot0-x22b.google.com (mail-ot0-x22b.google.com [IPv6:2607:f8b0:4003:c0f::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CDC73120726 for ; Sat, 18 Mar 2017 02:18:12 -0700 (PDT) Received: by mail-ot0-x22b.google.com with SMTP id i1so109202706ota.3 for ; Sat, 18 Mar 2017 02:18:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=cWj5gDC//gLq3XsbmcJ1sPWGQIAHManFJi8x4vNbssI=; b=VnIEBn7MBt04iYR4jc4ZExjqT3IZLoAyFA5Gt9GK7eeP6j1N/00lCHHxO3Bf5cZO5j zo2D9X0RED8kLDCDSybrtVzTTm3CQCanNCVB2IGpqA655Mtfs2TTilAxK3snON0Vv3wd g0Vb70ilLRHoy1LrDz2Chrqo6XSrFJPpPOTMpcBChbgCIInIWW460VI4OXFgnn1Frc4d 7oXV2yNNMsPjFiXTCybjxeMSNsajYyp1OzkizvdWjr3PN1nk56aJ58VZwuFWeufXGET/ bci9sdnrLgnsvvwDZR6lg2y29AS9rsyHq6Lm9KzKVIqSD4slAbwVaW+KOfuhfbg+7u02 hEeg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=cWj5gDC//gLq3XsbmcJ1sPWGQIAHManFJi8x4vNbssI=; b=oQGV+Fvx5GnqMWutT1CFb3xFNfEuNii4xWw5kXmKVfhGnad3FK158FyDlmWVPE1jFm GNywsv1bGdlkcIez9NcbR6EC8R73VJliMsCeKhFV/ZAwINT+aYFG8seVeU3aUYkOfnQW +cysiZ5h2l/Fnvtr7m0fOVkgVXlXmFxiMhx1VLBKCPXf6IQBgIeX/Zaw4haQexMIBZ9l l1JjxGANj2dtlEALIiyYLT0I/6bXJjqmBkQbzJm/ojhs+/L4J+l4jfxL6LNGX6U+oIio GG0b1Mbh2yUTWJ7pzWoNJJ/UheTvALVmeD0I1jNlWMeHG1xp/C+ROtZQ+xr2mtZY/Tnk UleA== X-Gm-Message-State: AFeK/H1cru9KJ47oPvcVRyL287LIEFHoCln7wo3JMa9AsJLAhVlEyjSb58T6S6exRTZt7LHIcmNUhkw8JThXjQ== X-Received: by 10.157.38.182 with SMTP id l51mr4586843otb.19.1489828692092; Sat, 18 Mar 2017 02:18:12 -0700 (PDT) MIME-Version: 1.0 Received: by 10.182.103.15 with HTTP; Sat, 18 Mar 2017 02:17:31 -0700 (PDT) From: Joseph Birr-Pixton Date: Sat, 18 Mar 2017 09:17:31 +0000 Message-ID: To: tls@ietf.org Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Mar 2017 09:18:15 -0000 On 17 March 2017 at 16:01, Hannes Tschofenig wrote: > Here are my 5 cents: we implement this extension in our mbed TLS stack With the greatest of respect, mbedtls *doesn't* implement max_fragment_length[1], because it doesn't fragment handshake messages as required by the spec. Attempts to use it with a conforming peer will fail to handshake. When I came across this a year or so ago, I concluded that nobody could have actually deployed max_fragment_length using mbedtls. Cheers, Joe [1] https://github.com/ARMmbed/mbedtls/issues/387 From nobody Sat Mar 18 02:39:02 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4474D124BFA for ; Sat, 18 Mar 2017 02:39:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pAFERkR2hmM6 for ; Sat, 18 Mar 2017 02:38:59 -0700 (PDT) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C12F612995B for ; Sat, 18 Mar 2017 02:36:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1489829771; x=1521365771; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=cFMloSb8NMpjD8BQhNRQ7rM0KhDAaFUG0I/tkj3wlQM=; b=z80B8kbLL+wixThH4ETVwI38HpiM7ULpd3BwpowBAyV7cj48GNdPY0jj +dgV5gnW25Tn7TFajwnZHUZ4CMwlPK+XcjoDf+8jKzcv+LKn7bLiLR1z3 t+4GjzB7YnFe+zRoVPLUzYFoHMHdpfzA3dIF+C3sOKc4p+fxwX4GccwA9 DYMLIRx6JBySR/bbKgu06+WV+VzWSgQY/dpI5C730CVHTayMg/KeD8FWF qxOBHbxnYdi0ffTjUG0Mja2yBV2qjprOKiNFHYJmYi6V4yrgDdh/6UyLU /Q5Ckwb/S2iOpXE+I5AZ4TyPjIzUn6jO3uwPAjAbmZYExg9dpfQ2/+47U A==; X-IronPort-AV: E=Sophos;i="5.36,181,1486378800"; d="scan'208";a="143791600" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.3.4 - Outgoing - Outgoing Received: from exchangemx.uoa.auckland.ac.nz (HELO uxcn13-tdc-c.UoA.auckland.ac.nz) ([10.6.3.4]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 18 Mar 2017 22:36:05 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-tdc-c.UoA.auckland.ac.nz (10.6.3.24) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Sat, 18 Mar 2017 22:36:05 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1178.000; Sat, 18 Mar 2017 22:36:05 +1300 From: Peter Gutmann To: Joseph Birr-Pixton , "tls@ietf.org" Thread-Topic: [TLS] RFC 6066 - Max fragment length negotiation Thread-Index: AQHSn8h48UgZsR1fnUWlpN1q8vk4DKGaVmu9 Date: Sat, 18 Mar 2017 09:36:05 +0000 Message-ID: <1489829754868.16595@cs.auckland.ac.nz> References: In-Reply-To: Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Mar 2017 09:39:01 -0000 Joseph Birr-Pixton writes:=0A= =0A= >With the greatest of respect, mbedtls *doesn't* implement=0A= >max_fragment_length[1], because it doesn't fragment handshake messages as= =0A= >required by the spec. Attempts to use it with a conforming peer will fail = to=0A= >handshake.=0A= =0A= What's the largest handshake message it sends? I would assume that for at= =0A= least the larger fragment sizes it'd be OK, because no handshake message wo= uld=0A= get large enough to require fragmentation.=0A= =0A= Incidentally, has anyone else who's implemented this dealt in the weird=0A= omission of 8K by using the logical value 5 that follows 1, 2, 3, 4 for 512= ,=0A= 1K, 2K, and 4K? In many cases 8K is just what you need, it halves memory= =0A= consumption while being large enough to not have to worry about fragmenting= =0A= handshake messages.=0A= =0A= Peter.= From nobody Sat Mar 18 03:18:50 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 973CE126B6D for ; Sat, 18 Mar 2017 03:18:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ftQzf-VHhngt for ; Sat, 18 Mar 2017 03:18:44 -0700 (PDT) Received: from mail-oi0-x22c.google.com (mail-oi0-x22c.google.com [IPv6:2607:f8b0:4003:c06::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 29385126BF6 for ; Sat, 18 Mar 2017 03:18:44 -0700 (PDT) Received: by mail-oi0-x22c.google.com with SMTP id w81so5421595oig.1 for ; Sat, 18 Mar 2017 03:18:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=4QJ9hb1dMnLkuXPTFQId0g1X/tev/YPiSkUQ3DpFX1Y=; b=huddLhc2PzmgZXXuSGl+nkbdrzq0xNBjPZdMfd/pHdz8hMQd0I4beYaxRz0/PK9QcD ianRcPX3XMx0VkDyRarsbUQHkqUJHSDemMj+ESl2h9mEP9wZHca1RyGsyQFktkwdjdIJ RH7XmEcfYQa2cJsLxSppMEKWlHZ6Dj+rdpffa6DSz1p7iWY5iAbwVnahIsmpCD5aY+Wl Q6obvAgeGJlezNPl3yX6u1LIuAkDoZ1dHy8ZvPbeAzaDGJEPSPJ4V2H3u2OLzHEO1gwE PlBA2HujUhIRActAgaqHthqQbJPRzMhVlOqMbIXm/QX/YR0X0igA2owcG9EnznqZwqTh GORA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=4QJ9hb1dMnLkuXPTFQId0g1X/tev/YPiSkUQ3DpFX1Y=; b=I+rM/QjMUeDCTQwJ/9JuCv3F2THyy1EccolHeJloR3aQ0h3KvPf/jtN2lBbTGcvSFl f8VmEuaMGmiWbZpudbZqTTiXcgoR8aFlGZraCtnxmmvXrXZrRpfU0eaxPn1v4YX4xBny XPyiEY6Nfp+7oTu0G9G9b7BijrTQC9C6nb1nJnzRKntJGbLKsW8LPBQPvv0jemTFBats Eh0IqmvDJrukEdxM3AUcZ/aqrcpCIVChP6sbmGN2f07H9wDEIsIXpemtu89OvBHuos+e zxIH0ezeWb8isnRJ2XGyOH0Q832en75faqEkmxUu6e6ZRqvQRdRjjnhPW9+E/gmXmP2v tIcg== X-Gm-Message-State: AFeK/H0y3BMfFoACmwzBt+cnBK0jAA7NUQDjDIw/ZkleRBlVn5v9PSYw/DKOevaLRBJsy1O24LXxQE/y3JBoUg== X-Received: by 10.202.195.148 with SMTP id t142mr6355233oif.54.1489832323494; Sat, 18 Mar 2017 03:18:43 -0700 (PDT) MIME-Version: 1.0 Received: by 10.182.103.15 with HTTP; Sat, 18 Mar 2017 03:18:03 -0700 (PDT) In-Reply-To: <1489829754868.16595@cs.auckland.ac.nz> References: <1489829754868.16595@cs.auckland.ac.nz> From: Joseph Birr-Pixton Date: Sat, 18 Mar 2017 10:18:03 +0000 Message-ID: To: Peter Gutmann Cc: "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Mar 2017 10:18:48 -0000 On 18 March 2017 at 09:36, Peter Gutmann wrote: > Joseph Birr-Pixton writes: > >>With the greatest of respect, mbedtls *doesn't* implement >>max_fragment_length[1], because it doesn't fragment handshake messages as >>required by the spec. Attempts to use it with a conforming peer will fail to >>handshake. > > What's the largest handshake message it sends? In my case, a KB or so of client certificate. > I would assume that for at > least the larger fragment sizes it'd be OK, because no handshake message would > get large enough to require fragmentation. True. Personally I was interested in the 512 byte max_fragment_length, because this is the best match for devices with the minimum IP MTU of 576 bytes. As a server, that breaks sending really any kind of certificate chain. As a client, it breaks client auth for similar reasons. > Incidentally, has anyone else who's implemented this dealt in the weird > omission of 8K by using the logical value 5 that follows 1, 2, 3, 4 for 512, > 1K, 2K, and 4K? In many cases 8K is just what you need, it halves memory > consumption while being large enough to not have to worry about fragmenting > handshake messages. Mmm, that is a strange omission. Personally I think this extension's encoding of the available lengths is too much policy and not enough mechanism. For want of an extra byte! Cheers, Joe From nobody Sun Mar 19 02:30:05 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5B34312947F for ; Sun, 19 Mar 2017 02:30:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FuloD9w9mlDE for ; Sun, 19 Mar 2017 02:30:01 -0700 (PDT) Received: from mail-qt0-x230.google.com (mail-qt0-x230.google.com [IPv6:2607:f8b0:400d:c0d::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D890012441E for ; Sun, 19 Mar 2017 02:30:00 -0700 (PDT) Received: by mail-qt0-x230.google.com with SMTP id x35so89021491qtc.2 for ; Sun, 19 Mar 2017 02:30:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=alggsat5saDCVHbG6spQ5Dxp3mJMuLPIV3qYCDkkudg=; b=MPFrBsRDRNOCZFuhqvy8vIRtKPGmOWENKjdh4Jn/qLGNkcsVtiIC3pLn1RvxiTOUu7 uAwDELMXdggtXOahEVipiCDdCkwsYvc/3jJe8rC9u3w1xvyHHnSPJzpPMqON2b11IcZA /4ZzeOUhKZbXpEhlfCGH5qiYdJ/btGzkxUMXPO/Ju6Mo45JStbQQ4itLkzKyo2z9lR/t EzX8xKmuk99Sw+BUqaV0f9W29JsVEhaOk+GApoznJ23GvsPOv8rkb3vfO+Bp8HYRkkR8 BZwKla917mPYfPsX6l+5a5ts6nOEeVJpdRzeC/ESGZ9j2EfmD1Kz7b6/dxon4aAk2NfS h7EA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=alggsat5saDCVHbG6spQ5Dxp3mJMuLPIV3qYCDkkudg=; b=HjteIAaiLO4lmkQ8qpgNrO6pAjy7WTaEiO/9FfiT0kMQLYmEjNGXesabUBCvLag5OB 7BuaLEP8rmERjBzPw7iJrdLzt4IuWZzcBEjgqv7NP0s4iN0TM2qeHtzu3b4ely5oWqta q4B0c7e0FDl7msWoeQ+LO+JMb6HoiYYyJiZf31hSi6SFVgxkgxE3AJK8BCE4LDTyqYSm PV9nb/l1OTBYaitfpNqGvVmhjZ0VPe9J63MwLoGQuCEOmyDY1AuJ2T43YJLJ9Pt8BL0t 2H2R9Cu+yoK3GUjzRNFKMKkpzKCr5KEb5V2W5Lv0dzhJLKNh0RB2P5c+ng6Wo3ayBLEd LdDQ== X-Gm-Message-State: AFeK/H2BE4seJEop8C1oCEn00jw/eMvv5rnyHlfqkVUl9351sX7nmWu68GMqD5GhXs2cdO+U+uvC9QLZW3QjqA== X-Received: by 10.200.3.214 with SMTP id z22mr23140020qtg.3.1489915800127; Sun, 19 Mar 2017 02:30:00 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Sun, 19 Mar 2017 02:29:59 -0700 (PDT) In-Reply-To: <1489829754868.16595@cs.auckland.ac.nz> References: <1489829754868.16595@cs.auckland.ac.nz> From: Martin Thomson Date: Sun, 19 Mar 2017 20:29:59 +1100 Message-ID: To: Peter Gutmann Cc: Joseph Birr-Pixton , "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Mar 2017 09:30:02 -0000 On 18 March 2017 at 20:36, Peter Gutmann wrote: > Incidentally, has anyone else who's implemented this dealt in the weird > omission of 8K by using the logical value 5 that follows 1, 2, 3, 4 for 512, > 1K, 2K, and 4K? In many cases 8K is just what you need, it halves memory > consumption while being large enough to not have to worry about fragmenting > handshake messages. No matter how much of a good idea that is, you would risk handshake failure by doing so. Compliant server implementations are required to send an "illegal_parameter" alert if you send that. From nobody Sun Mar 19 02:58:50 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9CE6C1201FA for ; Sun, 19 Mar 2017 02:58:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.396 X-Spam-Level: X-Spam-Status: No, score=-5.396 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-2.796, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uLIwqR4vRdT3 for ; Sun, 19 Mar 2017 02:58:39 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.17.22]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50F21120046 for ; Sun, 19 Mar 2017 02:58:38 -0700 (PDT) Received: from [192.168.91.180] ([80.92.121.218]) by mail.gmx.com (mrgmx101 [212.227.17.168]) with ESMTPSA (Nemesis) id 0MIzGn-1cncrV0gI5-002Tpz; Sun, 19 Mar 2017 10:58:36 +0100 To: Joseph Birr-Pixton , tls@ietf.org References: From: Hannes Tschofenig Openpgp: id=071A97A9ECBADCA8E31E678554D9CEEF4D776BC9 Message-ID: <4ce566ef-f81b-0392-0461-2823105e9016@gmx.net> Date: Sun, 19 Mar 2017 10:58:34 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="09E4qxuv1VnuHxkbvCAkxkKxHERq9cARW" X-Provags-ID: V03:K0:kK7WrTlW1tW7t0kWZrNFkek752yJjcnQdNWPu4TzVRrfuBZnX08 H2mpMbBHOR7UTajRmB5ugbzyopqjVgmvl/0c/tYcOn05j2zc2TLIqB/ezEvnZXu6KilJE7/ 1zvF0mIQcOO4GZkKkr9O5IyhlCoB23brO3EyrcbWdairyo1XmGtC/l2Ll7wdmlY94IuEBeK DeQb1lCM214kEXXIzIrmg== X-UI-Out-Filterresults: notjunk:1;V01:K0:lXqb0TfZWhk=:H71VBGrwp71rqlQ2SpVtjz 1OCsP+aEmkXNB75r3Q1QoLlqN0TpWFGvjLlSO6n7wf3lfV3cRZFcgc6/EpYrh0gHERhVgQtTn 9WIEHHaU5y3SmJ/7Pw1xyfykdK3UtNkGnDtUvn6HqCVcDPRQP2HcSniSNxvqe91v4B2dShqLM WfLLgMUxco5yVeQw8kaBIuJYvrIoIMNuiVcRypAtXrBB0sbnoL9X5kk1ZdlxvYj16cA9DQuIf hU2IexEZpFvNGx9RcygErvDK2eMaoh2jyZUWGzKMAAeYzi2GScsLBW3FWeYkePofpYUdWJm+c BYa8LiOqJBdT7wMFrKzWJPNbwP0T6AhmFI9X3liZvnHEjwETPeqa/soZDaK954hQ7mvHJ3Zgn 4/SpDMHt45/zYU7ukdKdY6SX6eSal29pQTOqYktpCke6zvbg5AGAjuvp8LKOnb3oq5WFh3X66 81iLqm+W+wt3YSmcNS4NVUZcQomj36ERIAFFD/kIeyX0eHPlPBnglg7PPotbMAzqW0HeIxhy+ C+kwWY3fl2q5zcKR12NXIvwEjHWSi3BE6WrvgB8X0NdPKyb9amT+n/iXxchG0fcx677Crbse2 SGgAQAvVZtw4Tffn559WrsRXoPd5bcaE8zkXi29FWwhqluMjh+qRUxgKysX9uZ43FQ0MviN7G GGmLytmhEYdxcw2w61qNzM7VIv36OtxsKh7wf10V6LSgJoOEufEDvFs+JJEaHCjcDO2/2QA4f r8skQWVy/i+hKnANFA1VTSP0/fRtB7PocUWRda4DnprXS9IBBloxO5B3Kdc= Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 19 Mar 2017 09:58:44 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --09E4qxuv1VnuHxkbvCAkxkKxHERq9cARW Content-Type: multipart/mixed; boundary="3rpD9w7oRniVHH9uPMI6o8CPOEnjCJgdh"; protected-headers="v1" From: Hannes Tschofenig To: Joseph Birr-Pixton , tls@ietf.org Message-ID: <4ce566ef-f81b-0392-0461-2823105e9016@gmx.net> Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation References: In-Reply-To: --3rpD9w7oRniVHH9uPMI6o8CPOEnjCJgdh Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Hi Joe, thanks for pointing this out. I will talk to our mbed TLS team to find out what the status of this issue is. Ciao Hannes On 03/18/2017 10:17 AM, Joseph Birr-Pixton wrote: > On 17 March 2017 at 16:01, Hannes Tschofenig wrote: >> Here are my 5 cents: we implement this extension in our mbed TLS stack= >=20 > With the greatest of respect, mbedtls *doesn't* implement > max_fragment_length[1], because it doesn't fragment handshake messages > as required by the spec. Attempts to use it with a conforming peer > will fail to handshake. >=20 > When I came across this a year or so ago, I concluded that nobody > could have actually deployed max_fragment_length using mbedtls. >=20 > Cheers, > Joe >=20 > [1] https://github.com/ARMmbed/mbedtls/issues/387 >=20 > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls >=20 --3rpD9w7oRniVHH9uPMI6o8CPOEnjCJgdh-- --09E4qxuv1VnuHxkbvCAkxkKxHERq9cARW Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: GPGTools - http://gpgtools.org iQEcBAEBCgAGBQJYzlZKAAoJEGhJURNOOiAtYdUIAJFxqwAWJsMPhFdUTn2Acxuz ojx/KO6Qp1kgPqTxNtYtZT4RIppGGudIjMX/+y6FMpZj3jmHCQfhO5guW4PtQHfw rm3MPtUg94A3LVrD1vHfFAzukxi18WaZXvfqUGCRG8d2HK2ccV2aDmykqvyzWpH9 iknUIg1lldlqU67GIPEUy2GskhV9bBahW6ewGzjoh/eEH3gQ6sQcr6ZyYYgmi78+ u2UsEI/oyaFrNiNnpYWQUjV6otDX/9WZl6vwlLEiJJLHQuHR2P1hb2NU0Fugp5lC Ltufu95ZFKSIQ/gPlHiEVp8YY0E+e3HkaX7tnqpwy+HTox0jAZmziBvePJ0Lpq8= =kvtt -----END PGP SIGNATURE----- --09E4qxuv1VnuHxkbvCAkxkKxHERq9cARW-- From nobody Sun Mar 19 19:54:34 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C2563126B7F for ; Sun, 19 Mar 2017 19:54:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FxhVNYgyGp5W for ; Sun, 19 Mar 2017 19:54:31 -0700 (PDT) Received: from mail-qk0-x231.google.com (mail-qk0-x231.google.com [IPv6:2607:f8b0:400d:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CF300129455 for ; Sun, 19 Mar 2017 19:54:30 -0700 (PDT) Received: by mail-qk0-x231.google.com with SMTP id 1so100522333qkl.3 for ; Sun, 19 Mar 2017 19:54:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:user-agent:cc:references:in-reply-to :mime-version:content-transfer-encoding:message-id; bh=xvdZqnC4dr9+1KdDSimLXtYzKbaokaAQKILgrovenkA=; b=Wj9Ro37A21PBZdO1ycxBwB6a1ZvicEgi65Us0Ac9JyNCmyM7RsX5Un70XNJnCpSZi8 4kR4uwIzsZWywRBtGAuecC43YburPYX17kZh6b4iNgLrlZFuE7T4fFWmEbvL9WhlCh65 EhApfNhDFSxnV+S5ZhtNFKazUt60AaAFiHmYpobhF89jvHd1rE1rj3RVCaxkKHX8Brz5 NFI2G/OkM0FEkACGlO+iZK91keIVWuCB+ecr6USXFbUWoo0iHZWBcL6MKfVRsyQH1hC9 D21Ab/1TU7BM1smvjbhgt5Sir3mGFDrYyDkuMio6S31zU0NVXjCXIptV4ikUO9//P/BE LuoA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:user-agent:cc:references :in-reply-to:mime-version:content-transfer-encoding:message-id; bh=xvdZqnC4dr9+1KdDSimLXtYzKbaokaAQKILgrovenkA=; b=cOaQiQ16rtAPwdNR8EXolmgB/G8RL9VoaSgvhFgJUQOjyw/zlN/wZYGECEvPlo93tT 5IKhGFWWnfzYhIWo1Fame5Sc6gRzrFMcPGXbknz05P3Sd925/RphQCUmYLrDiTD2V2lQ BdwjRJ8AnLf8B/ewnMVz5b9loSNJ7apTSeJkKvhqsdN6TP2vWAeT+s4P+XKCKM//pTkP T7MDHGIpIUWsr5lfn2K956tcuHtpYeqSnJezieFyEreR+W+7grdIpoZ7ts3DdJpzBhd6 rD9HgzI17zzeUfi/8o7r9iIzQD5MxDysVDtx9G/eULv6E34SV9fGlyyyuM7/tCmNSe2l HDcg== X-Gm-Message-State: AFeK/H27GCJdebJzkAfuesyxvcG+3sDecDYh6qggaa2s1vShtM8Ro3wlnJBDJ5k7FC4C2A== X-Received: by 10.55.101.7 with SMTP id z7mr23428199qkb.117.1489978470020; Sun, 19 Mar 2017 19:54:30 -0700 (PDT) Received: from dave-laptop.localnet (pool-71-175-27-43.phlapa.fios.verizon.net. [71.175.27.43]) by smtp.gmail.com with ESMTPSA id 18sm8386481qtz.41.2017.03.19.19.54.28 (version=TLS1 cipher=AES128-SHA bits=128/128); Sun, 19 Mar 2017 19:54:29 -0700 (PDT) From: Dave Garrett To: tls@ietf.org Date: Sun, 19 Mar 2017 22:54:27 -0400 User-Agent: KMail/1.13.5 (Linux/2.6.32-74-generic-pae; KDE/4.4.5; i686; ; ) References: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> <18C5AB7E-5AE6-4FB9-ADEC-7D45D2717F44@gmail.com> In-Reply-To: <18C5AB7E-5AE6-4FB9-ADEC-7D45D2717F44@gmail.com> MIME-Version: 1.0 Content-Type: Text/Plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <201703192254.27781.davemgarrett@gmail.com> Archived-At: Subject: Re: [TLS] WGLC: draft-ietf-tls-tls13-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Mar 2017 02:54:33 -0000 Yes, a proper "differences from TLS 1.2" section needs to be written to rep= lace the draft changelog. Dave On Tuesday, March 14, 2017 05:31:18 am Yoav Nir wrote: > Hi. >=20 > I will give the entire document a more thorough read, but I wanted to com= ment on section 1.2 earlier. Its title is =E2=80=9CMajor differences from T= LS 1.2=E2=80=9D, but the content is a change-log. The kind of change-log th= at usually gets deleted by the RFC editor. >=20 > I hope we don=E2=80=99t plan to publish with sentences like =E2=80=9CAllo= w cookies to be longer=E2=80=9D. OTOH I think it will be useful to have an= actual =E2=80=9Cmajor differences from TLS 1.2=E2=80=9D section, but AFAIC= T it=E2=80=99s not yet written. >=20 > Yoav >=20 > > On 13 Mar 2017, at 19:30, Sean Turner wrote: > >=20 > > This is a working group last call announcement for draft-ietf-tls-tls13= =2D19, to run through March 27. Please send your reviews to the list as so= on as possible so we can prepare for any discussion of open issues at IETF = 98 in Chicago. > >=20 > > Thanks, > > J&S > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls From nobody Mon Mar 20 04:41:12 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 553D0129A81 for ; Thu, 16 Mar 2017 13:52:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=broadcom.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6hxtL1CQrKeC for ; Thu, 16 Mar 2017 13:52:50 -0700 (PDT) Received: from mail-wr0-x235.google.com (mail-wr0-x235.google.com [IPv6:2a00:1450:400c:c0c::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD139129A6F for ; Thu, 16 Mar 2017 13:52:49 -0700 (PDT) Received: by mail-wr0-x235.google.com with SMTP id g10so40149982wrg.2 for ; Thu, 16 Mar 2017 13:52:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=k08kXcG5RP2B5RZ/zf2m7bhFtrTyx1gC8BAaIAs6UHs=; b=hPorCySBkW/05Kx9+XZxzx/mzdMJ/pl76i6todhTDKGHqaXfNTzD8Idi6zpclsBPmq Q/WhLHjbItg0zKnvxpHLLp2xL084NkaoXkbAJuYC/eczOIfrwH/b6yuE7TViKJJ/nqZL 2pNEBivhFN3nuRenGEDR+Jg+yS/PWVbDIWFNY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=k08kXcG5RP2B5RZ/zf2m7bhFtrTyx1gC8BAaIAs6UHs=; b=hZdBh+/T8BiixxOcQPcbttTSEo8BT5+jJwMH5voua08H7GowHDrk/+rqBBUlwJ3YnT BkOU6IhAiC9+X/IlTeTwLqL4T2IdI3Yb4AjZ66oqhU6+eK/iVCUFRJEYkTe0Ll16FEJj tRD2GuqDPR4Tivfdqr1AmAbL4lWbnwsMC89D+X52szEiQ9TQS6FZ8RQjV9NOdTq0vj0t P5jtv2if6HCcjc3GdOOaWbZMG7uVlulbeMo9PU5sFhXPCqvo+R47F7a95QKJkkJ+oe++ 7xOqtsOxWeEgfbOjXR6w+CLWmF81DIMwsJJwhu9A9Ev4VO32860U2Islm3vITbLyHmGe 81xw== X-Gm-Message-State: AFeK/H0bXV/RmnyrFEb6AhySTuy4xO37fQW/KSPpxemFvw7ZikRueLzYO+595zvowY1yZnprmMI9Vsqhua4nWK/2 X-Received: by 10.223.154.50 with SMTP id z47mr9670567wrb.76.1489697568270; Thu, 16 Mar 2017 13:52:48 -0700 (PDT) MIME-Version: 1.0 Received: by 10.28.55.141 with HTTP; Thu, 16 Mar 2017 13:52:47 -0700 (PDT) In-Reply-To: <65683BD2-FED2-4953-AA48-92E262F06650@gmail.com> References: <65683BD2-FED2-4953-AA48-92E262F06650@gmail.com> From: Nitin Shrivastav Date: Thu, 16 Mar 2017 16:52:47 -0400 Message-ID: To: Yoav Nir Cc: tls@ietf.org Content-Type: multipart/alternative; boundary=f403045f5090615432054adf3e86 Archived-At: X-Mailman-Approved-At: Mon, 20 Mar 2017 04:41:11 -0700 Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 20:52:54 -0000 --f403045f5090615432054adf3e86 Content-Type: text/plain; charset=UTF-8 Thanks Yoav. I am assuming it is true for TLS1.2 also? It would be nice to provide a mechanism for servers to do this as we are trying to run a web server in a constrained IoT end-points with only tens of KBytes of RAM and SSL/TLS based connection is important.. On Thu, Mar 16, 2017 at 4:48 PM, Yoav Nir wrote: > Hi, Nitin. > > In section 7.4.1.4 of RFC 5246 it says: > > An extension type MUST NOT appear in the ServerHello unless the same > extension type appeared in the corresponding ClientHello. > > > So the answer is no. Only the client may request this. > > Yoav > > On 16 Mar 2017, at 21:12, Nitin Shrivastav > wrote: > > Hello, > > This is Nitin Shrivastav, Engineering Manager at Broadcom. I have a > question on RFC 6066 Maximum Fragment Length Negotiation section > > The question i have is whether it is possible for a server to initiate the > Max fragment length negotiation. The RFC describes a scenario where a > constrained client can initiate this but in our product the server is very > tightly constrained on memory and we want to reduce the memory used for SSL > connections by forcing the clients to use reduce fragment length. We don't > have control over the clients in our scenario which are basically the > browsers like Chrome, IE etc. > > Thanks, > Nitin > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > > --f403045f5090615432054adf3e86 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Thanks Yoav. I am assuming it is true for TLS1.2 also?
It would be nice to provide a mechanism for servers to do t= his as we are trying to run a web server in a constrained IoT end-points wi= th only tens of KBytes of RAM and SSL/TLS based connection is important..

On Thu,= Mar 16, 2017 at 4:48 PM, Yoav Nir <ynir.ietf@gmail.com> w= rote:
Hi, Nitin.

In section 7.4.1.4 of RFC 5246 it says:

   An extension type MUST NOT appear in the ServerHello unle=
ss the same
   extension type appeared in the corresponding ClientHello.

So the answer is no. Only the client may request this.

Yoav

On 16 Mar 2017, at 21:12, Nitin Shrivastav <nitin.shrivastav@broadcom.com<= wbr>> wrote:

Hello,

= This is Nitin Shrivastav, Engineering Manager at Broadcom. I have a questio= n on RFC 6066=C2=A0Maximum Fragment Length Negotiation=C2=A0section=C2=A0=

The questio= n i have is whether it is possible for a server to initiate the Max fragmen= t length negotiation. The RFC describes a scenario where a constrained clie= nt can initiate this but in our product the server is very tightly constrai= ned on memory and we want to reduce the memory used for SSL connections by = forcing the clients to use reduce fragment length. We don't have contro= l over the clients in our scenario which are basically the browsers like Ch= rome, IE etc.

Thanks,
Nitin
_______________________________________________
TLS mailing listTLS@ietf.org
https:/= /www.ietf.org/mailman/listinfo/tls

--f403045f5090615432054adf3e86-- From nobody Mon Mar 20 05:01:03 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F059012F28B for ; Mon, 20 Mar 2017 05:01:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.302 X-Spam-Level: X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nasa.gov Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HvFINkpF2BO9 for ; Mon, 20 Mar 2017 05:00:58 -0700 (PDT) Received: from ndjsvnpf101.ndc.nasa.gov (NDJSVNPF101.ndc.nasa.gov [198.117.1.151]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB58412F280 for ; Mon, 20 Mar 2017 05:00:58 -0700 (PDT) X-Comment: SPF check N/A for local connections - client-ip=198.117.1.197; helo=ndjsppt103.ndc.nasa.gov; envelope-from=charles.j.sheehe@nasa.gov; receiver=tls@ietf.org DKIM-Filter: OpenDKIM Filter v2.11.0 ndjsvnpf101.ndc.nasa.gov B66474006E6D DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nasa.gov; s=letsgomars; t=1490011257; bh=ZnBHjymRPHbuDcGQXXxGVqj+l/34JOdM+sl4BmiSd6A=; h=From:To:CC:Subject:Date:References:In-Reply-To:From; b=ZKDkK7k/82+arp7PxTJDmV/bewfGHA3EWRwql+2pvgeGA+ZwrfrZcJtGPu7vG1Z5p YDtpgefv3e+3d+A2bgjgdasb7JtnWhD/f1IjppOnzorlkX34bWpup+8neWhED7/cRQ 5MeU800GjFW1iv4lNY/RXD218NJ03eSvoRRMae5jhyCNfTZTad3KfEZZ6VrIVWPiCO jmCwzJ3RMJvkmPE3gVZBAA6rIU6io/I1I3xyU14cVwrHz0Jnn5EX0MYMbeEp/ILu3J JZws4shnsFgT7g/TIy97ICwGzxzSWsgDBnJJqAT+awOnmhC3BWTHoYL+Q6bOnsG6j3 Mvp5MYzQLt+Kw== Received: from ndjsppt103.ndc.nasa.gov (ndjsppt103.ndc.nasa.gov [198.117.1.197]) by ndjsvnpf101.ndc.nasa.gov (Postfix) with ESMTP id B66474006E6D; Mon, 20 Mar 2017 07:00:57 -0500 (CDT) Received: from pps.filterd (ndjsppt103.ndc.nasa.gov [127.0.0.1]) by ndjsppt103.ndc.nasa.gov (8.16.0.20/8.16.0.20) with SMTP id v2KBqBDT004606; Mon, 20 Mar 2017 07:00:57 -0500 Received: from ndjscht114.ndc.nasa.gov (ndjscht114-pub.ndc.nasa.gov [198.117.1.214]) by ndjsppt103.ndc.nasa.gov with ESMTP id 29ad2ngcbt-1; Mon, 20 Mar 2017 07:00:57 -0500 Received: from NDJSMBX202.ndc.nasa.gov ([169.254.3.32]) by NDJSCHT114.ndc.nasa.gov ([198.117.1.184]) with mapi id 14.03.0319.002; Mon, 20 Mar 2017 07:00:56 -0500 From: "Sheehe, Charles J. (GRC-LCA0)" To: Nitin Shrivastav , Yoav Nir CC: "tls@ietf.org" Thread-Topic: [TLS] RFC 6066 - Max fragment length negotiation Thread-Index: AQHSnpUQvyj8RgnlZ0qnQayWaIb/O6GYRB8AgAABEYCABWAb4A== Date: Mon, 20 Mar 2017 12:00:56 +0000 Message-ID: <2D5292B061A3D547B3D87C3841793B300BE94389@NDJSMBX202.ndc.nasa.gov> References: <65683BD2-FED2-4953-AA48-92E262F06650@gmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [139.88.44.182] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-20_09:, , signatures=0 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Mar 2017 12:01:01 -0000 SGkNCg0KSSBhZ3JlZSB0aGF0IHRoaXMgd291bGQgYmUgYSBiZW5lZml0IHRvIGJhbmR3aWR0aCBy ZXN0cmljdGVkIGNoYW5uZWxzIGFzIHdlbGwuDQoNClRoYW5rcw0KQ2h1Y2sgIA0KDQpDaGFybGVz IEouIFNoZWVoZSBJSUkNCkVsZWN0cm9uaWNzIEVuZ2luZWVyDQpHbGVubiBSZXNlYXJjaCBDZW50 ZXINCjIxMDAwIEJyb29rcGFyayBSZA0KQ2xldmVsYW5kLCBPSCA0NDEzNQ0KQ2hhcmxlcy5KLlNo ZWVoZUBOQVNBLkdPVg0KT2ZmaWNlOiAyMTYtNDMzLTUxNzkNCg0KIlNjaWVuY2UgaXMgdGhlIGJl bGllZiBpbiB0aGUgaWdub3JhbmNlIG9mIHRoZSBleHBlcnRzIiDigJMgUmljaGFyZCBGZXlubWFu DQpXaGF0IHlvdSBkbyBtYWtlcyBhIGRpZmZlcmVuY2UgYW5kIHlvdSBoYXZlIHRvIGRlY2lkZSB3 aGF0IGtpbmQgb2YgZGlmZmVyZW5jZSB5b3Ugd2FudCB0byBtYWtlLg0KDQoNCg0KLS0tLS1Pcmln aW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IFRMUyBbbWFpbHRvOnRscy1ib3VuY2VzQGlldGYub3Jn XSBPbiBCZWhhbGYgT2YgTml0aW4gU2hyaXZhc3Rhdg0KU2VudDogVGh1cnNkYXksIE1hcmNoIDE2 LCAyMDE3IDQ6NTMgUE0NClRvOiBZb2F2IE5pciA8eW5pci5pZXRmQGdtYWlsLmNvbT4NCkNjOiB0 bHNAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbVExTXSBSRkMgNjA2NiAtIE1heCBmcmFnbWVudCBs ZW5ndGggbmVnb3RpYXRpb24NCg0KVGhhbmtzIFlvYXYuIEkgYW0gYXNzdW1pbmcgaXQgaXMgdHJ1 ZSBmb3IgVExTMS4yIGFsc28/DQoNCkl0IHdvdWxkIGJlIG5pY2UgdG8gcHJvdmlkZSBhIG1lY2hh bmlzbSBmb3Igc2VydmVycyB0byBkbyB0aGlzIGFzIHdlIGFyZSB0cnlpbmcgdG8gcnVuIGEgd2Vi IHNlcnZlciBpbiBhIGNvbnN0cmFpbmVkIElvVCBlbmQtcG9pbnRzIHdpdGggb25seSB0ZW5zIG9m IEtCeXRlcyBvZiBSQU0gYW5kIFNTTC9UTFMgYmFzZWQgY29ubmVjdGlvbiBpcyBpbXBvcnRhbnQu Lg0KDQpPbiBUaHUsIE1hciAxNiwgMjAxNyBhdCA0OjQ4IFBNLCBZb2F2IE5pciA8eW5pci5pZXRm QGdtYWlsLmNvbSA8bWFpbHRvOnluaXIuaWV0ZkBnbWFpbC5jb20+ID4gd3JvdGU6DQoNCg0KCUhp LCBOaXRpbi4NCg0KCUluIHNlY3Rpb24gNy40LjEuNCBvZiBSRkMgNTI0NiBpdCBzYXlzOg0KDQoJ ICAgQW4gZXh0ZW5zaW9uIHR5cGUgTVVTVCBOT1QgYXBwZWFyIGluIHRoZSBTZXJ2ZXJIZWxsbyB1 bmxlc3MgdGhlIHNhbWUNCgkgICBleHRlbnNpb24gdHlwZSBhcHBlYXJlZCBpbiB0aGUgY29ycmVz cG9uZGluZyBDbGllbnRIZWxsby4NCg0KCVNvIHRoZSBhbnN3ZXIgaXMgbm8uIE9ubHkgdGhlIGNs aWVudCBtYXkgcmVxdWVzdCB0aGlzLg0KDQoJWW9hdg0KDQoNCgkJT24gMTYgTWFyIDIwMTcsIGF0 IDIxOjEyLCBOaXRpbiBTaHJpdmFzdGF2IDxuaXRpbi5zaHJpdmFzdGF2QGJyb2FkY29tLmNvbSA8 bWFpbHRvOm5pdGluLnNocml2YXN0YXZAYnJvYWRjb20uY29tPiA+IHdyb3RlOg0KDQoJCUhlbGxv LA0KDQoJCVRoaXMgaXMgTml0aW4gU2hyaXZhc3RhdiwgRW5naW5lZXJpbmcgTWFuYWdlciBhdCBC cm9hZGNvbS4gSSBoYXZlIGEgcXVlc3Rpb24gb24gUkZDIDYwNjYgTWF4aW11bSBGcmFnbWVudCBM ZW5ndGggTmVnb3RpYXRpb24gc2VjdGlvbiANCgkJDQoJCQ0KCQlUaGUgcXVlc3Rpb24gaSBoYXZl IGlzIHdoZXRoZXIgaXQgaXMgcG9zc2libGUgZm9yIGEgc2VydmVyIHRvIGluaXRpYXRlIHRoZSBN YXggZnJhZ21lbnQgbGVuZ3RoIG5lZ290aWF0aW9uLiBUaGUgUkZDIGRlc2NyaWJlcyBhIHNjZW5h cmlvIHdoZXJlIGEgY29uc3RyYWluZWQgY2xpZW50IGNhbiBpbml0aWF0ZSB0aGlzIGJ1dCBpbiBv dXIgcHJvZHVjdCB0aGUgc2VydmVyIGlzIHZlcnkgdGlnaHRseSBjb25zdHJhaW5lZCBvbiBtZW1v cnkgYW5kIHdlIHdhbnQgdG8gcmVkdWNlIHRoZSBtZW1vcnkgdXNlZCBmb3IgU1NMIGNvbm5lY3Rp b25zIGJ5IGZvcmNpbmcgdGhlIGNsaWVudHMgdG8gdXNlIHJlZHVjZSBmcmFnbWVudCBsZW5ndGgu IFdlIGRvbid0IGhhdmUgY29udHJvbCBvdmVyIHRoZSBjbGllbnRzIGluIG91ciBzY2VuYXJpbyB3 aGljaCBhcmUgYmFzaWNhbGx5IHRoZSBicm93c2VycyBsaWtlIENocm9tZSwgSUUgZXRjLg0KCQkN CgkJDQoJCVRoYW5rcywNCgkJTml0aW4NCgkJX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18NCgkJVExTIG1haWxpbmcgbGlzdA0KCQlUTFNAaWV0Zi5vcmcgPG1h aWx0bzpUTFNAaWV0Zi5vcmc+IA0KCQlodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL3RscyA8aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHM+IA0KCQkN Cg0KDQoNCg== From nobody Tue Mar 21 00:44:38 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0BE5B129629; Tue, 21 Mar 2017 00:44:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kWj1c1R2VEuL; Tue, 21 Mar 2017 00:44:34 -0700 (PDT) Received: from mail-wr0-x22c.google.com (mail-wr0-x22c.google.com [IPv6:2a00:1450:400c:c0c::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 841EA129631; Tue, 21 Mar 2017 00:44:33 -0700 (PDT) Received: by mail-wr0-x22c.google.com with SMTP id l37so106559756wrc.1; Tue, 21 Mar 2017 00:44:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=pi0x4bFCfwMteYrrTH5ipdQ/lv6u4KVSYbmSXBqQuJc=; b=VvsLzlzRyg2r6Bc93z7zS4f+tTPiia+zAg5gPhgxAyQcm6/upPJfjTwYj9Mxgs45ed YsAyztf34QuoEshh1cowJTnpAYWVumBUHrLgwrVIuijIYc366qKpZadPlr6z5NQtQmqP NfOgkY3ClK+8doZ6CIAYxt6Y1NhG0aJA2JCKjMsNMzfw0AlAI1Id+BifGS4iIPs4K68i Ve3JD4HacvqjO63v1eehjKj8YvkVGeKlSn1UnfsO77WsalgTqvBI2JAUjQrFE2t25jmT DPkxRnYu4qUcgtwQftqZVCT+kamo/8UbE/QFNccPS2n1zakdX/NraWrcqRq7RREXQ7Vg 7yXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=pi0x4bFCfwMteYrrTH5ipdQ/lv6u4KVSYbmSXBqQuJc=; b=GqJ1OQFGVDV21u/6lAn5oXlQJFMGkCJi97I5vKz7NLEdGDcQ198XFPoJCXqKGS0R9z 7DX4UXmIaj6Iko53+ZP4/d/pkLCWoeETTrn46XMzMXgOIJRHoENsufrqHC62neyJXJeE YkIK5r0u55oBQu24qIogtcPwAcXlrDtdRo3/JSb6B83E8RRBcQerO0R2Fw8u+gSf2AcU /BLRF4PfIIWHKI4KWtOndrIJUYbaiL1bNSZG7bB8SIQ7HV+erRJVPm/XxNe4vXmeI9Cg zIGH7ku2VNscHxcJEZYvlFUaUNfrmmMaZF6hNwe2tfTLBDRKkpKIhZUekXg3Xb91diYa qd6w== X-Gm-Message-State: AFeK/H1tW8ecYsGUQt+0hVxNtB3/c1CEYOxknSz1FOFBHlDBOyJKREqqn+0jnUw8C1ojXw== X-Received: by 10.223.150.205 with SMTP id u71mr29066020wrb.195.1490082272043; Tue, 21 Mar 2017 00:44:32 -0700 (PDT) Received: from [192.168.1.18] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id q1sm13830810wra.65.2017.03.21.00.44.30 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 21 Mar 2017 00:44:31 -0700 (PDT) From: Yoav Nir Message-Id: <014753DA-5D5A-47ED-88D3-2291DC3DE78A@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_733773FE-1AEC-4ED5-8618-45AFFD1DACC2"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Tue, 21 Mar 2017 09:44:28 +0200 In-Reply-To: Cc: "tls@ietf.org" , IESG To: Eric Rescorla References: X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Review of draft-ietf-tls-rfc4492bis-15 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 07:44:37 -0000 --Apple-Mail=_733773FE-1AEC-4ED5-8618-45AFFD1DACC2 Content-Type: multipart/alternative; boundary="Apple-Mail=_DC4DF226-1BA3-427A-8E33-ECF6CF1DAC4F" --Apple-Mail=_DC4DF226-1BA3-427A-8E33-ECF6CF1DAC4F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi This pull request addresses most of these comments. = https://github.com/tlswg/rfc4492bis/pull/39 = There is some discussion = on that PR Some that are not addressed, I=E2=80=99ve answered below. Let me know = if you want me to merge and submit. Yoav On 15 Mar 2017, at 16:44, Eric Rescorla wrote > Sorry for the late review of this document. I just got to it this > week. I'm sending this as comments rather than issues/PR due to > how late it is in the proces. >=20 > I have two high-level comments: >=20 > - This document seems to still have a bunch of material about > static DH (especially static DH authentication). I thought we > had agreed to remove that. >=20 > - You are inconsistent about using capital 2119 language > and I expect you want to be consistent. >=20 >=20 > DETAILED > S 2. > All of these key exchange algorithms provide forward secrecy. >=20 > This is actually only true if each side generates fresh ephemerals > which does not seem to be required by the spec. >=20 > Do we really want to promote ECDH_anon to standards track? It=E2=80=99s the EC version of DH_anon, which is on the standards-track. = I don=E2=80=99t expect to convert the web to use DH_anon, but its = security is very much like what you get with a self-issued certificate, = with many less bytes on the wire. Anyway, I don=E2=80=99t think this = effort is the place to deprecate what is a pretty good mechanism for = opportunistic security if nothing else. >=20 > Nit: you want a line break between the last line of Figure 1 > and the legend explaining the message types. >=20 >=20 > S 2.3. > This specification does not impose restrictions on signature = schemes > used anywhere in the certificate chain. The previous version of = this > document required the signatures to match, but this restriction, > originating in previous TLS versions is lifted here as it had been = in > RFC 5246. >=20 > This section is about ECDH_anon, so maybe this text belongs in S 2.1 = or 2.2.? >=20 >=20 > S 3. > You have a bunch of lower case 2119 key words here. >=20 > If these conditions are not met, the client should send a client > Certificate message containing no certificates. In this case, the > ClientKeyExchange should be sent as described in Section 2, and the > CertificateVerify should not be sent. If the server requires = client > authentication, it may respond with a fatal handshake failure = alert. >=20 > Actually, this "should not be sent" is a MUST NOT, because if you send > an empty certificate, you're forbidden to send CertificateVerify. >=20 >=20 > S 4. > choice of curves and compression techniques specified by the = client. >=20 > s/compression techniques/point formats/? Since we=E2=80=99re deprecating all point formats other than = uncompressed, I just removed the =E2=80=9Cand=E2=80=9D and left it as = choice of curves. > S 5.1.1. > Do you want to rename elliptic_curve_list to named_curve_list? Yes > S 5.1.2. >=20 > Three point formats were included in the definition of = ECPointFormat > above. This specification deprecates all but the uncompressed = point > format. Implementations of this document MUST support the > uncompressed format for all of their supported curves, and MUST NOT > support other formats for curves defined in this specification. = For > backwards compatibility purposes, the point format list extension > MUST still be included, and contain exactly one value: the > uncompressed point format (0). >=20 > This implies that you have to send supported point formats, but in > S 5.1, this is a SHOULD. I believe what you may be trying to say > here is that if you send the extension, it must be non-empty. >=20 > Also, maybe I'm missing it, but where do you say that the default > is to assume that the other side supports uncompressed if it doesn't > do so. This is a backwards compat issue. >=20 >=20 > S 5.3. > You don't define what "authorized for signatures" is, but I suspect > you're talking about KeyUsage, etc.? If so, don't you need to say > this about ECDHE_ECDSA as well. >=20 > S 5.4. > The value named_curve indicates that a named curve is used. This > option SHOULD be used when applicable. >=20 > When would you not? >=20 > S 5.5. > This defines: > rsa_fixed_ecdh(65), > ecdsa_fixed_ecdh(66), >=20 > But the specification doesn't actually support this. Note that > the fixed_DH authentication mechanism are specified as having > the client's cert be on the same curve as the long-term > ECDH key, but you've deprecated those KE mechanisms, so as far > as I can tell, static DH auth is impossible >=20 > Also: > 1. Why isn't the ECDSA cert required to be signing capable. > 2. You probably should standardize on ECDSA_sign or ecdsa_sign. >=20 > S 5.7. > More text about static DH auth. Also "implicit" can probably go away. >=20 > The client selects an ephemeral ECDH public key corresponding to = the > parameters it received from the server according to the ECKAS-DH1 > scheme from IEEE 1363. It conveys this information to the client = in > the ClientKeyExchange message using the format defined above. >=20 > I don't understand what this means. Yeah, neither do I. I reworded it. > S 5.8. > This message is sent when the client sends a client certificate > containing a public key usable for digital signatures, e.g., when = the > client is authenticated using the ECDSA_sign mechanism. >=20 > This is the only way that things can work now. >=20 >=20 > S 5.1.1. > Failing to > do so allows attackers to gain information about the private key, = to > the point that they may recover the entire private key in a few > requests, if that key is not really ephemeral. >=20 > To the best of my knowledge, this only applies to DH, not signature > verification. >=20 > S 6. > Do we really want to promote NULL and 3DES to ST? The place to remove 3DES is TLS 1.3. The alternative is to either = deprecate it for TLS 1.2 or to not obsolete 4492. NULL is a little more nuanced, but I think the same argument applies. Yoav --Apple-Mail=_DC4DF226-1BA3-427A-8E33-ECF6CF1DAC4F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi

This = pull request addresses most of these comments.   https://github.com/tlswg/rfc4492bis/pull/39  There = is some discussion on that PR

Some that are not addressed, I=E2=80=99ve= answered below.  Let me know if you want me to merge and = submit.

Yoav

On 15 Mar 2017, at 16:44, Eric Rescorla <ekr@rtfm.com> = wrote


Sorry for the late review of this document. I just got to it = this
week. I'm sending this as comments rather than = issues/PR due to
how late it is in the = proces.

I have = two high-level comments:

- This document seems to still have a bunch of material = about
  static DH (especially static DH = authentication). I thought we
  had agreed to = remove that.

- = You are inconsistent about using capital 2119 language
  and I expect you want to be consistent.


DETAILED
S 2.
  =  All of these key exchange algorithms provide forward = secrecy.

This = is actually only true if each side generates fresh ephemerals
which does not seem to be required by the spec.

Do we really want to = promote ECDH_anon to standards = track?

It=E2=80= =99s the EC version of DH_anon, which is on the standards-track. I = don=E2=80=99t expect to convert the web to use DH_anon, but its security = is very much like what you get with a self-issued certificate, with many = less bytes on the wire. Anyway, I don=E2=80=99t think this effort is the = place to deprecate what is a pretty good mechanism for opportunistic = security if nothing else.

Nit: you want a line break between the = last line of Figure 1
and the legend explaining the = message types.


S 2.3.
   This specification does not impose restrictions = on signature schemes
   used anywhere in = the certificate chain.  The previous version of this
   document required the signatures to match, but = this restriction,
   originating in = previous TLS versions is lifted here as it had been in
   RFC 5246.

This section is about ECDH_anon, so = maybe this text belongs in S 2.1 or 2.2.?


S = 3.
You have a bunch of lower case 2119 key words = here.

  =  If these conditions are not met, the client should send a = client
   Certificate message containing = no certificates.  In this case, the
  =  ClientKeyExchange should be sent as described in Section 2, and = the
   CertificateVerify should not be = sent.  If the server requires client
  =  authentication, it may respond with a fatal handshake failure = alert.

Actually,= this "should not be sent" is a MUST NOT, because if you send
an empty certificate, you're forbidden to send = CertificateVerify.


S 4.
   choice of curves and compression techniques = specified by the client.

s/compression techniques/point = formats/?

Since = we=E2=80=99re deprecating all point formats other than uncompressed, I = just removed the =E2=80=9Cand=E2=80=9D and left it as choice of = curves.

S = 5.1.1.
Do you want to rename elliptic_curve_list to = named_curve_list?

Yes

S = 5.1.2.

  =  Three point formats were included in the definition of = ECPointFormat
   above.  This = specification deprecates all but the uncompressed point
   format.  Implementations of this document = MUST support the
   uncompressed format = for all of their supported curves, and MUST NOT
   support other formats for curves defined in this = specification.  For
   backwards = compatibility purposes, the point format list extension
   MUST still be included, and contain exactly one = value: the
   uncompressed point format = (0).

This = implies that you have to send supported point formats, but in
S 5.1, this is a SHOULD. I believe what you may be trying to = say
here is that if you send the extension, it must = be non-empty.

Also, maybe I'm missing it, but where do you say that the = default
is to assume that the other side supports = uncompressed if it doesn't
do so. This is a = backwards compat issue.


S 5.3.
You don't define what "authorized for signatures" is, but I = suspect
you're talking about KeyUsage, etc.? If so, = don't you need to say
this about ECDHE_ECDSA as = well.

S = 5.4.
   The value named_curve indicates = that a named curve is used.  This
  =  option SHOULD be used when applicable.

When would you not?

S 5.5.
This defines:
      =        rsa_fixed_ecdh(65),
 =           =  ecdsa_fixed_ecdh(66),

But the specification doesn't actually support this. Note = that
the fixed_DH authentication mechanism are = specified as having
the client's cert be on the = same curve as the long-term
ECDH key, but you've = deprecated those KE mechanisms, so as far
as I can = tell, static DH auth is impossible

Also:
1. Why isn't = the ECDSA cert required to be signing capable.
2. = You probably should standardize on ECDSA_sign or ecdsa_sign.

S 5.7.
More text about static DH auth. Also "implicit" can probably = go away.

  =  The client selects an ephemeral ECDH public key corresponding to = the
   parameters it received from the = server according to the ECKAS-DH1
  =  scheme from IEEE 1363.  It conveys this information to the = client in
   the ClientKeyExchange = message using the format defined above.

I don't understand what this = means.

Yeah, = neither do I.  I reworded it.

S 5.8.
   This message is sent = when the client sends a client certificate
  =  containing a public key usable for digital signatures, e.g., when = the
   client is authenticated using the = ECDSA_sign mechanism.

This is the only way that things can work now.


S 5.1.1.
   Failing = to
   do so allows attackers to gain = information about the private key, to
  =  the point that they may recover the entire private key in a = few
   requests, if that key is not = really ephemeral.

To the best of my knowledge, this only applies to DH, not = signature
verification.

S 6.
Do we really = want to promote NULL and 3DES to = ST?

The place to = remove 3DES is TLS 1.3. The alternative is to either deprecate it for = TLS 1.2 or to not obsolete 4492.

NULL = is a little more nuanced, but I think the same argument = applies.

Yoav


= --Apple-Mail=_DC4DF226-1BA3-427A-8E33-ECF6CF1DAC4F-- --Apple-Mail=_733773FE-1AEC-4ED5-8618-45AFFD1DACC2 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJY0NndAAoJELhJCxUKWMyZKccH/AtvinMtGyIhp7DeCx3z8IFV xlCQbqtcsyZ42OJ3mwSgwU5t8bEdg04iRJEgCzRlUvTehYBawnJgsOvFZV5XvZXF gQjNjk6KKs7B9WQWSbpxA1w4fXv+pffN8JK8qHsJ+ubDWlTDmGBFMjhDXuanzG7h 3Ss83w6hyQtrgJhjjB+XDW/I/Gxz9z0pkl7coMDZInp7LGvIZYuA0C5x8GX94wIS rDSNCzYkMJnr+iWLdEpjLPEFt6BF7q8M6ZNfTGLTHLuZsgIvwnr0zA1qt1NP8SvT E1MK4qHtJ2IMpS2p4mxCHkfIvDOmi4gRFmrLZmn9+gU+fFFbkNiCjKr4k88Oo2M= =6BjW -----END PGP SIGNATURE----- --Apple-Mail=_733773FE-1AEC-4ED5-8618-45AFFD1DACC2-- From nobody Tue Mar 21 02:05:00 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C15791293EB; Tue, 21 Mar 2017 02:04:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.302 X-Spam-Level: X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2lf0X99Ac6qp; Tue, 21 Mar 2017 02:04:56 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 91543129536; Tue, 21 Mar 2017 02:04:55 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id EC876BE74; Tue, 21 Mar 2017 09:04:53 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0B345zqXw6sA; Tue, 21 Mar 2017 09:04:53 +0000 (GMT) Received: from [10.244.2.100] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 07D2DBEB5; Tue, 21 Mar 2017 09:04:33 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1490087073; bh=VQGFenFBML8zjSh5yAhGOqIfdVzRG1kX6HC3Rw7I6Go=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=VXZQGFLcDo/Ocs7Wb/kqisTHohEXmKHYSmPxJE5+HQEseUi7f5us6okh68tcOicsI ayVOyTpITmGeZRzuSEFv89eFG4FyeK5Yr5ID+oWyQxS1zOIonQ7iBkZmFwR3BApwcA MGNBnqDzcOVTDagBhgf4CvLs4OTKThK5OQtwKFKY= To: Yoav Nir , Eric Rescorla References: <014753DA-5D5A-47ED-88D3-2291DC3DE78A@gmail.com> Cc: "tls@ietf.org" , IESG From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: <9467ab9e-1b4f-d108-c144-3f21792b4b50@cs.tcd.ie> Date: Tue, 21 Mar 2017 09:04:32 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: <014753DA-5D5A-47ED-88D3-2291DC3DE78A@gmail.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="lUv6WrHwfA2SH5eANC8D0dk5G4DBQPIIr" Archived-At: Subject: Re: [TLS] Review of draft-ietf-tls-rfc4492bis-15 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 09:04:59 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --lUv6WrHwfA2SH5eANC8D0dk5G4DBQPIIr Content-Type: multipart/mixed; boundary="N1TtC0XFDREpPlvmSuuxLmT6iOcB7CUgp"; protected-headers="v1" From: Stephen Farrell To: Yoav Nir , Eric Rescorla Cc: "tls@ietf.org" , IESG Message-ID: <9467ab9e-1b4f-d108-c144-3f21792b4b50@cs.tcd.ie> Subject: Re: [TLS] Review of draft-ietf-tls-rfc4492bis-15 References: <014753DA-5D5A-47ED-88D3-2291DC3DE78A@gmail.com> In-Reply-To: <014753DA-5D5A-47ED-88D3-2291DC3DE78A@gmail.com> --N1TtC0XFDREpPlvmSuuxLmT6iOcB7CUgp Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Thanks Yoav, On 21/03/17 07:44, Yoav Nir wrote: > Some that are not addressed, I=E2=80=99ve answered below. Let me know = if you > want me to merge and submit. I'd say give it a chance for one round of comments from Eric and/or others, and then submit. Or, submit before you head for an airport on your way to Chicago if that happens first. If we're left with an RFC editor note being needed, that's ok so long as it's simple enough. Cheers, S. --N1TtC0XFDREpPlvmSuuxLmT6iOcB7CUgp-- --lUv6WrHwfA2SH5eANC8D0dk5G4DBQPIIr Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCAAGBQJY0OygAAoJEC88hzaAX42iB9AIAIPhZU9a2hixlGyu9VQTQo2V rX2dBtwbWNfuZBcaN37JwKJ/6KW7usi6HIpzsXn47BexHIztkmxWt0UVO+Z4p5d/ cq2aD8arrVQe8/gUXVHEVkgCSvWTMxauyEtzzbzi3KZOn+sRXWjQwzWp1Csf9GLr sfSlIDzVdgIpsJ9PCqJNlKOak2gi5z7w9bH8Xl9aVVFctZWcm8wOxr6SBlXiOweZ pyWf02PR6d75o8qz9jyAdgzI0/Iy4BPemb/5FCWpR8P9/N0uVbwFuYF/XmNSPB0E XLTOclxWYsDGpKezre0WRSWk3o5swlW6VvzGwIjaKc/l7T9KNZogGIgsLiYsKqY= =3SVN -----END PGP SIGNATURE----- --lUv6WrHwfA2SH5eANC8D0dk5G4DBQPIIr-- From nobody Tue Mar 21 02:24:35 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 474171293FF for ; Tue, 21 Mar 2017 02:24:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dreMs_8cIlnc for ; Tue, 21 Mar 2017 02:24:32 -0700 (PDT) Received: from mail-qt0-x236.google.com (mail-qt0-x236.google.com [IPv6:2607:f8b0:400d:c0d::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D91AF129536 for ; Tue, 21 Mar 2017 02:24:31 -0700 (PDT) Received: by mail-qt0-x236.google.com with SMTP id x35so126210652qtc.2 for ; Tue, 21 Mar 2017 02:24:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=TakYXR1q3mqQ2qpZxL8/u+IIHlvL4/DdCGwlxQ7R4Jo=; b=mS2X4zWP7pZ30MM6OyCnHRK+RhzFmLGH7edmzUbHv13apcCiiRDFklcg1Lu0+BSQTj KK2/O3BMBrUuHz32T7scWy6Zq/8aFZ7W3Y4/kGxLnuIUaPUTUZzv2KOQHY23PxWw/QdX BU8+KdTFZu3IerXebwPLdgWAvwFy91hSLLsBuwq/8lCTRG9dEVFfoFJg7uUyMc223A7O xMTv3SsOJsIB4CBjWAQXP+fpQK9P7BX965aRBCAQb/19fcwrUjGNXAjV5AdSyG0lhtgX 7xT0ztpc8Ml1dKYWYedeN8EuIu86yi/slimUvFfopmQJCiG224JQZckhS5ZR/vesgSKy /TZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=TakYXR1q3mqQ2qpZxL8/u+IIHlvL4/DdCGwlxQ7R4Jo=; b=Vei2Mv7m7XLlwVpfbGcu90weuY+g0DWaPj/+WvcgANT50IrOEt4gupy/sNfRBK99+v 2u8WqZ9Zy6MuM57VQ2L6TIcvWNOr4/01CwBGyl51P8lqSA7t8Vv83kkanRI3yrkfR7sg zCo+Phgh7D976HqT0OY+uBLzQp84aynpC+fvtVNUTHp8PCIIiLKnNln2z/ZtxB/YafFs 9LgvO7UTU9zGiRynFg1cOeJukbQhtzadbC1YGKHkcFqlZ12zFgbJXUv4qE7aqJUhyepk AYkGPTRjwQ6A+0o5naIY6XcyLL7lRA7Jy09AXDE9F1WHXyOTu1S65I/2v93kFnnOsBKT JWMQ== X-Gm-Message-State: AFeK/H3LZnP2jWBiDAB3roHbuQV06ZW41rG+i0phPv8owfXzyLvzyNTt6fKzM6MIlJlkYFH49nSyylMUgGJW/Q== X-Received: by 10.200.46.91 with SMTP id s27mr33588059qta.278.1490088270911; Tue, 21 Mar 2017 02:24:30 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Tue, 21 Mar 2017 02:24:30 -0700 (PDT) From: Martin Thomson Date: Tue, 21 Mar 2017 20:24:30 +1100 Message-ID: To: "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: [TLS] DTLS 1.3 comments X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 09:24:34 -0000 The doc says that it is maintained at https://github.com/tlswg/dtls13-spec This is untrue (currently). I found it at https://github.com/hannestschofenig/tschofenig-ids Speaking of which, it would be really nice if there were an issue tracker that we could use for this. I hope that the working group adopts this an moves it to this location so that I don't have to dump issues in an email. Issues in email get lost. I realize that we're going to look carefully at the packet format and probably streamline the record structure a little. ekr has my analysis on this, which I'm happy to share. The diagrams in Section 5.5 talk about discrete flights, which makes sense when talking about the handshake, but once it starts, application data can be continuously exchanged. That's a detail that might be lost. Retransmissions of handshake messages use new record sequence numbers (though the handshake sequence number stays the same). This really isn't dealt with prominently enough to my mind. It's important that repacketization doesn't produce a two-time pad. The effect of processing packets independently isn't given proper treatment in security considerations. In TLS, when a packet doesn't decrypt, the connection dies, so an attacker has to start over if they want to probe the decryption oracle. In DTLS, packets that don't decrypt just get dropped, which gives an attacker a huge advantage. I believe that the rekeying design needs a little better description. This is what I've implemented and what I think the intent is: * if you want to update, just send with the next epoch * if you see the other side update, and you haven't already, update yourself * don't update until you see that the other side has used the current epoch That's also what QUIC currently uses. With this design, you can reduce the epoch bits to 2 during the handshake and 1 afterwards, if you care about saving bits. The draft is says this, which I can't really parse: Upon receiving a payload with such a new epoch value, the receiver MUST update their receiving keys and if they have not already updated their sending state up to or past the then current receiving generation MUST send messages with the new epoch value prior to sending any other messages. I really don't understand the "prior to sending any other messages" part. Is this right? Implementations that receive a payload with an epoch value for which no corresponding cipher state can be determined MUST generate a "unexpected_message" alert. For example, client incorrectly uses epoch value 5 when sending early application data in a 0-RTT exchange. A server will not be able to compute the appropriate keys and will therefore have to respond with an alert. It seems like that is in violation of the "drop if you can't decrypt it" rule. I wonder how many implementations do this: However, a DTLS implementation which would ordinarily issue an alert SHOULD generate a new alert message if the offending record is received again NSS certainly doesn't. Section 5.5.2 mentions re-handshake. That's not possible any more. Probably best to use NewSessionTicket or post-handshake client authentication as the example here. From nobody Tue Mar 21 02:45:36 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5D6C12947D for ; Tue, 21 Mar 2017 02:45:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g5DIgJSsmUC7 for ; Tue, 21 Mar 2017 02:45:33 -0700 (PDT) Received: from welho-filter1.welho.com (welho-filter1.welho.com [83.102.41.23]) by ietfa.amsl.com (Postfix) with ESMTP id 9A6671294CE for ; Tue, 21 Mar 2017 02:45:33 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter1.welho.com (Postfix) with ESMTP id 32B921F63C for ; Tue, 21 Mar 2017 11:45:31 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp2.welho.com ([IPv6:::ffff:83.102.41.85]) by localhost (welho-filter1.welho.com [::ffff:83.102.41.23]) (amavisd-new, port 10024) with ESMTP id 9zFd47GS-twA for ; Tue, 21 Mar 2017 11:45:31 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp2.welho.com (Postfix) with ESMTPSA id 082A421C for ; Tue, 21 Mar 2017 11:45:31 +0200 (EET) Date: Tue, 21 Mar 2017 11:45:30 +0200 From: Ilari Liusvaara To: tls@ietf.org Message-ID: <20170321094530.GA493@LK-Perkele-V2.elisa-laajakaista.fi> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Subject: [TLS] Derive-Secret(foo, "bar", "") X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 09:45:36 -0000 What is the correct HkdfLabel for Derive-Secret(foo, "bar", "") in TLS 1.3 draft-19? I ask, because I ran into interop problems because of this, between my implementation and OpenSSL, and I traced it to this. Let's assume PRF-hash is SHA256 (32 bytes output) I interpret the spec so that the HkdfLabel is: 00 20 0C "TLS 1.3, bar" 00 That is, 32 bytes output, 12 byte raw label "TLS 1.3, bar" and 0 byte context. OpenSSL seems to interpret it as: 00 20 0C "TLS 1.3, bar" 20 e3 b0 c4 42 98 fc 1c 14 9a fb f4 c8 99 6f b9 24 27 ae 41 e4 64 9b 93 4c a4 95 99 1b 78 52 b8 55 Where the e3b0c442... bit is the SHA-256 hash of empty string. That is, 32 bytes output, 12 byte raw label "TLS 1.3, bar" and 32 byte context, holding SHA-256 of empty input. Which is correct? Or neither? -Ilari From nobody Tue Mar 21 05:03:11 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64C2E1297B8 for ; Tue, 21 Mar 2017 05:03:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9bwcxHM4Xw2J for ; Tue, 21 Mar 2017 05:03:07 -0700 (PDT) Received: from mail-yw0-x229.google.com (mail-yw0-x229.google.com [IPv6:2607:f8b0:4002:c05::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 198DD1296DB for ; Tue, 21 Mar 2017 05:03:07 -0700 (PDT) Received: by mail-yw0-x229.google.com with SMTP id v76so108408688ywg.0 for ; Tue, 21 Mar 2017 05:03:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=aczJIB9MEooJE6YwHeMjtLSu1NwDqB/I8KaczdXNqr4=; b=VrV1iq6CLFll5xbTt3zxgRx/5vNePyLSLKF1fCuIqmCPv4mu+f1kVF5epUwMMqhxNi WgJub0LFCAxwfMCLiLdOYRNwHZrZ50YYdnNTGD0AsaV+OkCTFonMnyUamk5PTc3ivYHK 6bfwZgQeKrdQcB97K16DhKaQlOF3HGXfLXmtrO1sZPVTjaHrU2TyJcj/NHeG1qVMr8rU qvjfjSBqgS+Ihk3G+gRheoLtbU8YMQA8COLIqVdj7Xq7Ao7gMzYtbUFt2/htChqS86mB JbfFCfR1kdIYfBtc1i+W7a7FfEvi9JogiWx39p+DQ8IrQu1ygfS1raCpidXres2jVohW QsjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=aczJIB9MEooJE6YwHeMjtLSu1NwDqB/I8KaczdXNqr4=; b=GB+jqcguSxf027Hb4t3up7tylY4zr4WimcDcrnFdqv59tKjw/AlL40p1KvG4BakG8C xybYS8pJl7hqv8EmTuEUBsEHOBY7rfs6YTHn+WGuKWzSGgp7mOVh7+58KGD24lgddPvR EfyJt8ZCvlcT86Bf6LZjE7b4c8dzS17asJMFhZaqUDjuqnvesdHOAqH1Av45ndhlGTxy XlwAv6Cl7/I4CJi1aLruPbtmEu481BrMyLwdNzP8+PSTNrJ85n5aKR0sDAv0I5HPsVvU UEIsa1RW4Knj+VFS63R9kOoAZywUfwgAVpCbuX/xftp+1A8bu0/u2VoZOAFaVcXOv7Mp lo5w== X-Gm-Message-State: AFeK/H0FJDlnYFxWNrV0KbvBS0DMCJnX8/bLtKaUWp0Vr9z3voe3XYO7xMm2Bg2bOmUL1J+09GSlJGQlm/Zu6A== X-Received: by 10.129.92.84 with SMTP id q81mr19268608ywb.87.1490097786320; Tue, 21 Mar 2017 05:03:06 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Tue, 21 Mar 2017 05:02:25 -0700 (PDT) In-Reply-To: <014753DA-5D5A-47ED-88D3-2291DC3DE78A@gmail.com> References: <014753DA-5D5A-47ED-88D3-2291DC3DE78A@gmail.com> From: Eric Rescorla Date: Tue, 21 Mar 2017 05:02:25 -0700 Message-ID: To: Yoav Nir Cc: "tls@ietf.org" , IESG Content-Type: multipart/alternative; boundary=001a114d85703c291a054b3c6d2f Archived-At: Subject: Re: [TLS] Review of draft-ietf-tls-rfc4492bis-15 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 12:03:09 -0000 --001a114d85703c291a054b3c6d2f Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Mar 21, 2017 at 12:44 AM, Yoav Nir wrote: > Hi > > This pull request addresses most of these comments. > https://github.com/tlswg/rfc4492bis/pull/39 There is some discussion on > that PR > > Some that are not addressed, I=E2=80=99ve answered below. Let me know if= you want > me to merge and submit. > > Yoav > > On 15 Mar 2017, at 16:44, Eric Rescorla wrote > > > Sorry for the late review of this document. I just got to it this > week. I'm sending this as comments rather than issues/PR due to > how late it is in the proces. > > I have two high-level comments: > > - This document seems to still have a bunch of material about > static DH (especially static DH authentication). I thought we > had agreed to remove that. > > - You are inconsistent about using capital 2119 language > and I expect you want to be consistent. > > > DETAILED > S 2. > All of these key exchange algorithms provide forward secrecy. > > This is actually only true if each side generates fresh ephemerals > which does not seem to be required by the spec. > > Do we really want to promote ECDH_anon to standards track? > > > It=E2=80=99s the EC version of DH_anon, which is on the standards-track. = I don=E2=80=99t > expect to convert the web to use DH_anon, but its security is very much > like what you get with a self-issued certificate, with many less bytes on > the wire. > Well, assuming you don't do TOFU. , neither do I. I reworded it. > > > S 5.8. > This message is sent when the client sends a client certificate > containing a public key usable for digital signatures, e.g., when the > client is authenticated using the ECDSA_sign mechanism. > > This is the only way that things can work now. > > > S 5.1.1. > Failing to > do so allows attackers to gain information about the private key, to > the point that they may recover the entire private key in a few > requests, if that key is not really ephemeral. > > To the best of my knowledge, this only applies to DH, not signature > verification. > > S 6. > Do we really want to promote NULL and 3DES to ST? > > > The place to remove 3DES is TLS 1.3. > Well, we certainly did that, but why? > The alternative is to either deprecate it for TLS 1.2 > This seems like it might be reasonable at this point. > or to not obsolete 4492. NULL is a little more nuanced, but I think the > same argument applies. > What we probably should actually do is make this depend on the IANA draft and then mark these Not Recommended. -Ekr > > Yoav > > > --001a114d85703c291a054b3c6d2f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Tue, Mar 21, 2017 at 12:44 AM, Yoav Nir <ynir.ietf@gmail.com&= gt; wrote:
Hi

This pull request addresses most of thes= e comments. =C2=A0=C2=A0https://github.com/tlswg/rfc4492bis/pull/39= =C2=A0 There is some discussion on that PR

Some th= at are not addressed, I=E2=80=99ve answered below.=C2=A0 Let me know if you= want me to merge and submit.

Yoav

<= div>
On 15 Mar 2017, at 16:44, Eric Rescorla <ekr@rtfm.com> wrote


S= orry for the late review of this document. I just got to it this
= week. I'm sending this as comments rather than issues/PR due to
how late it is in the proces.

I have two high-l= evel comments:

- This document seems to still have= a bunch of material about
=C2=A0 static DH (especially static DH= authentication). I thought we
=C2=A0 had agreed to remove that.<= /div>

- You are inconsistent about using capital 2119 la= nguage
=C2=A0 and I expect you want to be consistent.
<= br>

DETAILED
S 2.
=C2=A0 =C2= =A0All of these key exchange algorithms provide forward secrecy.
=
This is actually only true if each side generates fresh ephe= merals
which does not seem to be required by the spec.
=
Do we really want to promote ECDH_anon to standards track?

It=E2=80=99s the EC= version of DH_anon, which is on the standards-track. I don=E2=80=99t expec= t to convert the web to use DH_anon, but its security is very much like wha= t you get with a self-issued certificate, with many less bytes on the wire.=

Well, assuming you= don't do TOFU.

, neither do I.=C2=A0 I reworded it.

S 5.8.
=C2=A0 = =C2=A0This message is sent when the client sends a client certificate
=
=C2=A0 =C2=A0containing a public key usable for digital signatures, e.= g., when the
=C2=A0 =C2=A0client is authenticated using the ECDSA= _sign mechanism.

This is the only way that things = can work now.


S 5.1.1.
= =C2=A0 =C2=A0Failing to
=C2=A0 =C2=A0do so allows attackers to ga= in information about the private key, to
=C2=A0 =C2=A0the point t= hat they may recover the entire private key in a few
=C2=A0 =C2= =A0requests, if that key is not really ephemeral.

= To the best of my knowledge, this only applies to DH, not signature
verification.

S 6.
Do we really want = to promote NULL and 3DES to ST?

The place to remove 3DES is TLS 1.3.

Well, we certainly did that, but why?

=C2=A0
The alternative is to either deprecate it for TLS 1= .2

This seems like it mi= ght be reasonable at this point.

=C2=A0
or = to not obsolete 4492. NULL is a little more nuanced, but I think the same a= rgument applies.

What we = probably should actually do is make this depend on the IANA draft and then = mark
these Not Recommended.

-Ekr
=C2=A0

<= div>Yoav



--001a114d85703c291a054b3c6d2f-- From nobody Tue Mar 21 05:09:22 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2BEC11297CE for ; Tue, 21 Mar 2017 05:09:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EkJXuvgWkk1m for ; Tue, 21 Mar 2017 05:09:19 -0700 (PDT) Received: from mail-yw0-x233.google.com (mail-yw0-x233.google.com [IPv6:2607:f8b0:4002:c05::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DD54A1297C4 for ; Tue, 21 Mar 2017 05:09:18 -0700 (PDT) Received: by mail-yw0-x233.google.com with SMTP id p77so108258592ywg.1 for ; Tue, 21 Mar 2017 05:09:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=akeOvtQ2qXvwLfPMbkHB9RUVOy51Ez0yYN9yd5p4+QU=; b=m1VrDlyEvqvQ1iUDi3V7r8krva6tR+Okl6Za7lq315Mqm13Iv3S7uqHTP7SYeqDfzb YxEM9nyxuvcJHNhP9ouTCiNLVhvC4u63rn+2PKMIv7noQKiI+MUa6+0WNGF+0BAczmfp 91p7fVxHgCSSJjhNrjxTAvgiM/aVYQPQ6RXtHZq5tfmybLlG0N8Cat6hVzv7883klb7G I6eHPaBb99xRIvr0g7j/djT2GBDMK05ip/0PDVgtnetop2Z1qLH81j6xXHjUw2vAcXUh ap9WUzsUCnePObZyq+RMAxci3e2O4Kvq795R7dx7IyHEFNxtwMkUMl3En2hP7pgII2Xd TQAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=akeOvtQ2qXvwLfPMbkHB9RUVOy51Ez0yYN9yd5p4+QU=; b=EgO2gkB+87swiwVOgwcJ9jb19CGZz+0LpnvQs1STxKq+RutZwjy5ymgjdQuaCCKo+o Sl3RZgGk4wcsz0p3JTuTHK8ytEGH93jTQ1K1n+MYk0+aj3sbJCJ+ENPdSvxwmNBIpR7Q uvVxAcnLaTHeGzEGdijHKUDpcvhZu4pjOPyKj+IMn0BroTkLXr5NgZeWGiV+qURe3zcA VaCwBtXYiVpKwfHI3XoOhqZUp/dq3cvPsY6iwPw3fGreCklhr9i8etSvD7DgKpvvVKeM 1NY5SO37XUhc++A7RLLr2vGlqNexXnzg2HX8Lo0ea4iKh/fgvBaFALoxh9ixOhQLTJ8v Tb/A== X-Gm-Message-State: AFeK/H0Uc5k6+Vug6wYXaqYNw20CacLB1MdQfpa4LbLTYHBUfjo8/sTLIfY4ZWatzJmu5Fghwor9r7Fia4DABw== X-Received: by 10.37.113.135 with SMTP id m129mr22199697ybc.65.1490098158108; Tue, 21 Mar 2017 05:09:18 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Tue, 21 Mar 2017 05:08:37 -0700 (PDT) In-Reply-To: References: From: Eric Rescorla Date: Tue, 21 Mar 2017 05:08:37 -0700 Message-ID: To: Martin Thomson Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a1148a848651ae0054b3c83c9 Archived-At: Subject: Re: [TLS] DTLS 1.3 comments X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 12:09:21 -0000 --001a1148a848651ae0054b3c83c9 Content-Type: text/plain; charset=UTF-8 On Tue, Mar 21, 2017 at 2:24 AM, Martin Thomson wrote: > The doc says that it is maintained at https://github.com/tlswg/dtls13-spec > This is untrue (currently). > I found it at https://github.com/hannestschofenig/tschofenig-ids Actually it lives at: https://github.com/ekr/dtls13-spec And I have issues filed on this already, so we can rplicate. > Speaking of which, it would be really nice if there were an issue > tracker that we could use for this. I hope that the working group > adopts this an moves it to this location so that I don't have to dump > issues in an email. Issues in email get lost. > > I realize that we're going to look carefully at the packet format and > probably streamline the record structure a little. ekr has my > analysis on this, which I'm happy to share. > https://github.com/ekr/dtls13-spec/issues/5: > The diagrams in Section 5.5 talk about discrete flights, which makes > sense when talking about the handshake, but once it starts, > application data can be continuously exchanged. That's a detail that > might be lost. > > Retransmissions of handshake messages use new record sequence numbers > (though the handshake sequence number stays the same). This really > isn't dealt with prominently enough to my mind. It's important that > repacketization doesn't produce a two-time pad. > OK. PR wanted. I believe that the rekeying design needs a little better description. > This is what I've implemented and what I think the intent is: > * if you want to update, just send with the next epoch > * if you see the other side update, and you haven't already, update > yourself > * don't update until you see that the other side has used the current epoch > > That's also what QUIC currently uses. With this design, you can > reduce the epoch bits to 2 during the handshake and 1 afterwards, if > you care about saving bits. > Yeah, I haven't thought through this piece of the design space yet. The draft is says this, which I can't really parse: > > Upon receiving > a payload with such a new epoch value, the receiver MUST update their > receiving keys and if they have not already updated their sending > state up to or past the then current receiving generation MUST send > messages with the new epoch value prior to sending any other > messages. > > I really don't understand the "prior to sending any other messages" part. > > Is this right? > > Implementations that receive a payload with an epoch value for which > no corresponding cipher state can be determined MUST generate a > "unexpected_message" alert. For example, client incorrectly uses > epoch value 5 when sending early application data in a 0-RTT > exchange. A server will not be able to compute the appropriate keys > and will therefore have to respond with an alert. > > It seems like that is in violation of the "drop if you can't decrypt it" > rule. > Probably. Maybe OK during the handshake, though, as it's basically a state error. I wonder how many implementations do this: > > However, a DTLS implementation > which would ordinarily issue an alert SHOULD generate a new alert > message if the offending record is received again > > NSS certainly doesn't. > Yeah, I'm not sure. I wouldn't object to removing this. > Section 5.5.2 mentions re-handshake. That's not possible any more. > Probably best to use NewSessionTicket or post-handshake client > authentication as the example here. > Thanks. -Ekr > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --001a1148a848651ae0054b3c83c9 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Tue, Mar 21, 2017 at 2:24 AM, Martin Thomson <<= a href=3D"mailto:martin.thomson@gmail.com" target=3D"_blank">martin.thomson= @gmail.com> wrote:
The doc says that it is maintained at https://github.= com/tlswg/dtls13-spec
This is untrue (currently).
I found it at https://github.com/hannestschof= enig/tschofenig-ids

Actually it lives a= t:
https://github.com/ekr/dtls13-spec

And I have issues filed on this already, so we can rp= licate.


Speaking of which, it would be really nice if there were an issue
tracker that we could use for this.=C2=A0 I hope that the working group
adopts this an moves it to this location so that I don't have to dump issues in an email.=C2=A0 Issues in email get lost.

I realize that we're going to look carefully at the packet format and probably streamline the record structure a little.=C2=A0 ekr has my
analysis on this, which I'm happy to share.

=C2=A0
The diagrams in Section 5.5 talk about discrete flights, which makes
sense when talking about the handshake, but once it starts,
application data can be continuously exchanged.=C2=A0 That's a detail t= hat
might be lost.

Retransmissions of handshake messages use new record sequence numbers
(though the handshake sequence number stays the same).=C2=A0 This really isn't dealt with prominently enough to my mind.=C2=A0 It's importan= t that
repacketization doesn't produce a two-time pad.
OK. PR wanted.



I believe that the rekeying design needs a little better description.
This is what I've implemented and what I think the intent is:
* if you want to update, just send with the next epoch
* if you see the other side update, and you haven't already, update you= rself
* don't update until you see that the other side has used the current e= poch

That's also what QUIC currently uses.=C2=A0 With this design, you can reduce the epoch bits to 2 during the handshake and 1 afterwards, if
you care about saving bits.

Yeah, I hav= en't thought through this piece of the design space yet.

=

The draft is says this, which I can't really parse:

=C2=A0 =C2=A0Upon receiving
=C2=A0 =C2=A0a payload with such a new epoch value, the receiver MUST updat= e their
=C2=A0 =C2=A0receiving keys and if they have not already updated their send= ing
=C2=A0 =C2=A0state up to or past the then current receiving generation MUST= send
=C2=A0 =C2=A0messages with the new epoch value prior to sending any other =C2=A0 =C2=A0messages.

I really don't understand the "prior to sending any other messages= " part.

Is this right?

=C2=A0 =C2=A0Implementations that receive a payload with an epoch value for= which
=C2=A0 =C2=A0no corresponding cipher state can be determined MUST generate = a
=C2=A0 =C2=A0"unexpected_message" alert.=C2=A0 For example, clien= t incorrectly uses
=C2=A0 =C2=A0epoch value 5 when sending early application data in a 0-RTT =C2=A0 =C2=A0exchange.=C2=A0 A server will not be able to compute the appro= priate keys
=C2=A0 =C2=A0and will therefore have to respond with an alert.

It seems like that is in violation of the "drop if you can't decry= pt it" rule.

Probably. Maybe OK du= ring the handshake, though, as it's basically a state
error.<= /div>

I wonder how many implementations do this:

=C2=A0 =C2=A0However, a DTLS implementation
=C2=A0 =C2=A0which would ordinarily issue an alert SHOULD generate a new al= ert
=C2=A0 =C2=A0message if the offending record is received again

NSS certainly doesn't.

Yeah, I'= m not sure. I wouldn't object to removing this.

=C2=A0
Section 5.5.2 mentions re-handshake.=C2=A0 That's not possible any more= .
Probably best to use NewSessionTicket or post-handshake client
authentication as the example here.

Tha= nks.

-Ekr
=C2=A0

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--001a1148a848651ae0054b3c83c9-- From nobody Tue Mar 21 05:14:12 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1D61E1296DB for ; Tue, 21 Mar 2017 05:14:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4QoVrJZCoMns for ; Tue, 21 Mar 2017 05:14:08 -0700 (PDT) Received: from mail-yw0-x233.google.com (mail-yw0-x233.google.com [IPv6:2607:f8b0:4002:c05::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E47661297E9 for ; Tue, 21 Mar 2017 05:14:04 -0700 (PDT) Received: by mail-yw0-x233.google.com with SMTP id v76so108576333ywg.0 for ; Tue, 21 Mar 2017 05:14:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=kIjluI/2LND+cViGfaAjXxCA1Nu13T0IajQvnIlkVdo=; b=TAK7BMAw8W8YgizcLu7/+7Tv0oAtubXa7jmJgmhdOLzUcddp0uoBkX9VOwsMHILpUJ eBqCrYxVolXU+xbVBb7H2MYv50AdOXOassPziefSdBu1R9oiHxhV1koKn+nf3QuiJADf ITdUa8L9tLfFCL1YrzpGo+M95IWSH+a/acul7P62sVD0UlRwvbQRyYBfAsWrF5Iw5ZB7 GgKdqnkl2tFRQpdBaI9iF32vagZkpL5d79NN30WQI5jciW8XjMcdha7kT5je1fNE875T BqVXa23IumJbCIZ0bdeU3DSls8+rYSp58aCMc8FCMVjyPW9cmJ94UtFVUjOSMv6LTy6t 39hA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=kIjluI/2LND+cViGfaAjXxCA1Nu13T0IajQvnIlkVdo=; b=lSb3mbx6l4jHtUW2yim5koOGemCeQJhfVgaK6cR9S1P+2WL+4NG7uQzFI4U8RGiD2B Lb8HhyBmjh/rRn0kCLX6nVWo579wcpvcUvGwz2YM1y7NYQyI/qAgJ8DNxh9IPfLsLX/n ShyUMz62QKrD1EhRz59ztDZEgW5TgBd0AxjkusKiYSl0zRefStyysfGQnJs4Kce5nPAW hC6VdCMeiD0qQFo5urL7Yw0cSoDuEZNrd5kFJvN6hatc+xSfG2mcpRbO7zAqKryu2Uic yyS2qmbnyclODG62/5IVuJGuaRPGwkSCrS/yDHLiUmuOqz4t9ia1dyyq42Ak74KqiVt8 TQvA== X-Gm-Message-State: AFeK/H3M4sUcjCW8uXVW4/1msau/qEVZ+IJl/YQ0tNc1Uu7G5KCpjs7UpGLgtD2CABTjY2GAEwgq66V9Kp8luw== X-Received: by 10.37.53.138 with SMTP id c132mr22135780yba.105.1490098444158; Tue, 21 Mar 2017 05:14:04 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Tue, 21 Mar 2017 05:13:23 -0700 (PDT) In-Reply-To: <20170321094530.GA493@LK-Perkele-V2.elisa-laajakaista.fi> References: <20170321094530.GA493@LK-Perkele-V2.elisa-laajakaista.fi> From: Eric Rescorla Date: Tue, 21 Mar 2017 05:13:23 -0700 Message-ID: To: Ilari Liusvaara Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a114bbb32720416054b3c942a Archived-At: Subject: Re: [TLS] Derive-Secret(foo, "bar", "") X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 12:14:11 -0000 --001a114bbb32720416054b3c942a Content-Type: text/plain; charset=UTF-8 On Tue, Mar 21, 2017 at 2:45 AM, Ilari Liusvaara wrote: > What is the correct HkdfLabel for Derive-Secret(foo, "bar", "") in > TLS 1.3 draft-19? > > I ask, because I ran into interop problems because of this, between my > implementation and OpenSSL, and I traced it to this. > > Let's assume PRF-hash is SHA256 (32 bytes output) > > I interpret the spec so that the HkdfLabel is: > > 00 20 0C "TLS 1.3, bar" 00 > > That is, 32 bytes output, 12 byte raw label "TLS 1.3, bar" and > 0 byte context. > > OpenSSL seems to interpret it as: > > 00 20 0C "TLS 1.3, bar" 20 e3 b0 c4 42 98 fc 1c 14 9a fb f4 c8 99 6f > b9 24 27 ae 41 e4 64 9b 93 4c a4 95 99 1b 78 52 b8 55 > > Where the e3b0c442... bit is the SHA-256 hash of empty string. > > That is, 32 bytes output, 12 byte raw label "TLS 1.3, bar" and > 32 byte context, holding SHA-256 of empty input. > > > Which is correct? Or neither? > I believe that OpenSSL is correct. Note that this construction already appeared in the computation for the binder keys in -18 and I believe that everyone interpreted it as the hash of the empty string. I think that's more natural given the notation, because Derive-Secret explicitly hashes the input, whereas HKDF-Expand-Label is defined as using "" = means a 0-length hash. If people think we should adopt your interpretation, I think we would need to special-case the notation, which of course isn't the worst thing in the world. Maybe we should update the draft, though. -Ekr > > > -Ilari > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --001a114bbb32720416054b3c942a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Tue, Mar 21, 2017 at 2:45 AM, Ilari Liusvaara <= ilariliusvaar= a@welho.com> wrote:
What is= the correct HkdfLabel for Derive-Secret(foo, "bar", ""= ) in
TLS 1.3 draft-19?

I ask, because I ran into interop problems because of this, between my
implementation and OpenSSL, and I traced it to this.

Let's assume PRF-hash is SHA256 (32 bytes output)

I interpret the spec so that the HkdfLabel is:

00 20 0C "TLS 1.3, bar" 00

That is, 32 bytes output, 12 byte raw label "TLS 1.3, bar" and 0 byte context.

OpenSSL seems to interpret it as:

00 20 0C "TLS 1.3, bar" 20 e3 b0 c4 42 98 fc 1c 14 9a fb f4 c8 99= 6f
b9 24 27 ae 41 e4 64 9b 93 4c a4 95 99 1b 78 52 b8 55

Where the e3b0c442... bit is the SHA-256 hash of empty string.

That is, 32 bytes output, 12 byte raw label "TLS 1.3, bar" and 32 byte context, holding SHA-256 of empty input.


Which is correct? Or neither?

I believe= that OpenSSL is correct. Note that this construction already
app= eared in the computation for the binder keys in -18 and I believe that
everyone interpreted it as the hash of the empty string.
I think that's more natural given the notation, because De= rive-Secret
explicitly hashes the input, whereas HKDF-Expand-Labe= l is defined
as using "" =3D means a 0-length hash. If = people think we should adopt
your interpretation, I think we woul= d need to special-case the notation,
which of course isn't th= e worst thing in the world.

Maybe we should update= the draft, though.

-Ekr
=C2=A0


-Ilari

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--001a114bbb32720416054b3c942a-- From nobody Tue Mar 21 05:28:36 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75582129851 for ; Tue, 21 Mar 2017 05:28:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rZipz9hvstxV for ; Tue, 21 Mar 2017 05:28:33 -0700 (PDT) Received: from mail-qk0-x22b.google.com (mail-qk0-x22b.google.com [IPv6:2607:f8b0:400d:c09::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB02C12984A for ; Tue, 21 Mar 2017 05:28:32 -0700 (PDT) Received: by mail-qk0-x22b.google.com with SMTP id y76so133220304qkb.0 for ; Tue, 21 Mar 2017 05:28:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=/ewhZtjP136P8pAv77D/U4q70yx2CPAURPzBPcNCRGI=; b=KEYkgwVuJl7No+vD42is+ESG3cIX/u9rF11vChtTU2FHRZm5cf32+a3vQhRzQj/rNL 58rink4lo6pJUCuK7GBWvdzE9jHtPbfq27vAwQSOwcIY73VS6DnLc18FRsf/7BzUIKtI ixvODy6jES/n1KaGrFzl/YZEttlp+155mrwpI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=/ewhZtjP136P8pAv77D/U4q70yx2CPAURPzBPcNCRGI=; b=aBaHwRtlnINfmvCEfhj8mUqRXdpCZyCbOStuwfnW5XBnygciNPXFBR0VKGwmHtr7BO gxxyHI9PDtuflEGtQ6XpoP0ELxDUEJN/Kw94CViOE2WFJP7/H2MOR40ZcmpPtWbP+Sy3 C5SFCvCY9kKP/2WQXHe5yVNg2h1YnfCj2LNJEaoqJpo8TFE0CqoynUH4I7xl6+L6+c0D /nUYNscE0toSR/GsssgMXcUH9nMM40gF0Zo+xKLdy2sKyTzFxiOe/6CcG92j096ahTQS AzwUDOqPi3s92wa3sCtG1DGCPAbgvcGgZ8UH7WBGLBBn1iUKV9wNJ4/Q32mNhKWdIODr IPEw== X-Gm-Message-State: AFeK/H1DpqrT9siyuWKwMRZVAxBdLEx4D8u9u/s0Tq3nMjTQC6LhJBncSDBbRHwHRlSBvg== X-Received: by 10.55.22.131 with SMTP id 3mr162235qkw.33.1490099311965; Tue, 21 Mar 2017 05:28:31 -0700 (PDT) Received: from [172.16.0.18] ([96.231.230.131]) by smtp.gmail.com with ESMTPSA id r55sm8772307qtr.16.2017.03.21.05.28.30 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 21 Mar 2017 05:28:31 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Sean Turner In-Reply-To: Date: Tue, 21 Mar 2017 08:28:30 -0400 Cc: Yoav Nir , "tls@ietf.org" , IESG Content-Transfer-Encoding: quoted-printable Message-Id: <42C2F79C-2795-4A15-9B68-AFAB3A8EB01A@sn3rd.com> References: <014753DA-5D5A-47ED-88D3-2291DC3DE78A@gmail.com> To: Eric Rescorla X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Review of draft-ietf-tls-rfc4492bis-15 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 12:28:34 -0000 > On Mar 21, 2017, at 08:02, Eric Rescorla wrote: >=20 > What we probably should actually do is make this depend on the IANA = draft and then mark > these Not Recommended. That is an option as none of the 3DES suites are marked as Recommended = in the IANA draft. spt= From nobody Tue Mar 21 05:29:30 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 780C2126C26 for ; Tue, 21 Mar 2017 05:29:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7cw0fOCaj_lG for ; Tue, 21 Mar 2017 05:29:26 -0700 (PDT) Received: from mail-qk0-x231.google.com (mail-qk0-x231.google.com [IPv6:2607:f8b0:400d:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 702D9126557 for ; Tue, 21 Mar 2017 05:29:26 -0700 (PDT) Received: by mail-qk0-x231.google.com with SMTP id p64so133282350qke.1 for ; Tue, 21 Mar 2017 05:29:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=jX4yQrJMB0X2QQUXFTbc/mRPbmSz9tt7XrSivdTNLvU=; b=nYxR1MpzlGskFNVxqnc3onS/haNTi05C0T8SaKGsA6JdEKDLwU7KRJx0Z4ORGq5dRL URXtp005akxo3FAtPlZGjiHD28+DfuahUuxqNhMMCol/w4CFcjX2KxuULUxuPF2SsZH8 GXO6Kbhe6BU62SXK4diUe08GX2g1F4f5HHf14= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=jX4yQrJMB0X2QQUXFTbc/mRPbmSz9tt7XrSivdTNLvU=; b=TcujZE96nkRCFeSg7jC5NGFRjQfavMXhRPsOadSmYDC5HUqIpLpw69E5Hb5zFaCWSb MaDf0gtLCmwx0DtiXnznped0qX3NgLid1SNSMpLNDedpdEOPOobzv2JkYK6kdTNbPnvl NhMC6C3M2ewTquGktLlNB58Ab5H89bv/A6QdT2q/jEFdtwmyPD9Y4MygCY9NPw6gS8gu 5yKA5fjvnECgBRvWLWdgq4tI1WzE/3gmpB4aQb0xpHuqrrj3DGEM7U7a9ZF5cOu1GJJz H6sKZQNs2uXRwmf5RCLhlDxY2i2cbqKVyxsJIePnkQ7gGHCM9vp/oc/QkjAFg56NlMk4 aw7A== X-Gm-Message-State: AFeK/H3SlI7hsR+lQ32SqKycEkS/HdD9sA64+VnQs3VjlgVGS1HBvRALKDX8iuf0H5kWeg== X-Received: by 10.55.9.149 with SMTP id 143mr482078qkj.148.1490099365641; Tue, 21 Mar 2017 05:29:25 -0700 (PDT) Received: from [172.16.0.18] ([96.231.230.131]) by smtp.gmail.com with ESMTPSA id r55sm8772307qtr.16.2017.03.21.05.29.24 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 21 Mar 2017 05:29:24 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Sean Turner In-Reply-To: Date: Tue, 21 Mar 2017 08:29:23 -0400 Cc: Martin Thomson , "tls@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: To: Eric Rescorla X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] DTLS 1.3 comments X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 12:29:28 -0000 > On Mar 21, 2017, at 08:08, Eric Rescorla wrote: >=20 > Actually it lives at: > https://github.com/ekr/dtls13-spec Assuming it gets adopted I=E2=80=99ll set up a WG repo for it. spt= From nobody Tue Mar 21 06:15:21 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 496A8129873 for ; Tue, 21 Mar 2017 06:15:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iot76Bm193tJ for ; Tue, 21 Mar 2017 06:15:16 -0700 (PDT) Received: from brontes.bolet.org (www.bolet.org [62.210.214.227]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A489129875 for ; Tue, 21 Mar 2017 06:15:16 -0700 (PDT) Received: by brontes.bolet.org (Postfix, from userid 1000) id C2C252071E; Tue, 21 Mar 2017 14:15:14 +0100 (CET) Date: Tue, 21 Mar 2017 14:15:14 +0100 From: Thomas Pornin To: Martin Thomson Cc: "tls@ietf.org" Message-ID: <20170321131514.GA9342@bolet.org> References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 13:15:19 -0000 On Fri, Mar 17, 2017 at 05:24:09PM +1100, Martin Thomson wrote: > I'd even go so far as to specify it: > > https://martinthomson.github.io/tls-record-limit/ > > I'll submit an I-D once the blackout ends if people are interested in this. I like this proposal. One comment, though: I think the wording in section 4 should mandate that the value sent MUST NOT exceed the maximum record size -- i.e. if an implementation supports records up to 16384 bytes, then it should put 16384 here, not a bigger value suc as 65535. Rationale: last time this was discussed on this list, some people expressed the wish to ultimately support records with more than 16384 bytes of plaintext. If such an extension ever comes to fruition (it is certainly easy enough to do with CBC and GCM cipher suites), then sending a record_size_limit with a limit of, say, 60000 bytes, would serve as indication that the implementation indeed supports such larger records. This holds only as long as no implementation sends a value larger than 16384 if it does not really accept records of more than 16384 bytes. Therefore, I propose to replace this paragraph: An endpoint that has no limit on the size of data they receive can set this value to any value equal to or greater than the maximum possible record size, such as 65535. A larger value does not allow the endpoint to send larger records than the protocol permits. An endpoint that receives a value larger than the maximum defined in the protocol MUST NOT exceed protocol-defined limits. For TLS 1.3 and earlier, this limit is 2^14 octets. with the following: An endpoint that supports all sizes that comply with the protocol-defined limits MUST send exactly that limit as value for maximum record size (or a lower value). For TLS 1.3 and earlier, that limit is 2^14 octets. Higher values are currently reserved for future versions of the protocol that may allow larger records; an endpoint MUST NOT send a value higher than 2^14 unless explicitly allowed by such a future version and supported by the endpoint. When an endpoint receives a maximum record size limit larger than the protocol-defined limit, that end point MUST NOT send records larger than the protocol-defined limit, unless explicitly allowed by a future TLS version. Of course, larger-than-16384 records are not meant for constrained systems, but for big systems. Overhead for 16384-byte records with ChaCha20+Poly1305 is 21 bytes (for AES/GCM in TLS 1.2, this is 29 bytes), i.e. less than 0.2%, which seems small enough to me; but there still is some demand for larger records, so it makes sense not to prevent them from ever happening with tighter wording. --------------- Another point which was made is that CBC cipher suites have a variable-length padding, up to 256 bytes (length byte + padding), which is not fully negligible: an endpoint with a 500-byte buffer would have to send a "maximum record size" of 223 bytes only, in order to fully support AES/CBC+HMAC/SHA-256 in all cases, while in practice most if not all endpoints will stick to minimal-sized paddings. Maybe there should be some extra wording saying that when a "maximum record size" was received, with a value less than the protocol-defined limit, then an endpoint SHOULD strive to use minimal-sized padding in cipher suites that have a variable-sized padding. Or maybe something more convoluted that says: An endpoint MUST NOT generate a protected record with plaintext larger than the RecordSizeLimit value received from its peer. An endpoint MUST NOT either generate a protected record such that the encrypted record length (TLSCipherText.length) exceeds the length of the smallest possible encrypted record that would contain exactly as many plaintext bytes as the received RecordSizeLimit value, in the currently active cipher suite. This would be only for the benefit of CBC cipher suites with TLS 1.2 and earlier, not for TLS 1.3, because recent AEAD cipher suites have predictable (and small) overhead. Arguably, pre-TLS-1.3 versions also have problem with compression, which should be in all generality avoided, just like CBC cipher suites should also be avoided. Maybe this is not a problem after all, and constrained systems that are recent enough to implement this new extension will also "naturally" avoid CBC cipher suites anyway. (In any case, if an endpoint requires small records, then it cannot really talk with peers that don't support the proposed maximum_record_size extension, so it needs recent implementations that _should_ already implement at least TLS 1.2 and some AEAD cipher suites.) --Thomas Pornin From nobody Tue Mar 21 06:32:13 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FDDC120727 for ; Tue, 21 Mar 2017 06:32:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qAz25NfSAISm for ; Tue, 21 Mar 2017 06:32:10 -0700 (PDT) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1C26C1298A6 for ; Tue, 21 Mar 2017 06:32:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1490103130; x=1521639130; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=nctVDfxu7OiNEuNifAh4SWzTmUyJFKsf1cOQvKWWnoM=; b=SYrqibCGezRsJ/OM7qPpX7thLLFB/70MfnKHseWh4m1fR65fo70g63U8 E4Sf0TYe3H8gvn2SDlW0mHQXzNwU49qxxNfrwWjexaRR2vDfxBDiW+1yD 85t+ZVLJLhgfZ3DKL6cErL8aLA9D4H8LCP9wBvdJtkpS6J6oxBexa85Jp wzfvlsM92olMLeMVNPblOZ07JowdMfEziStKQs79LzDVZBNX7u7KZ86S+ OzWa+OuawnNkGYIT+0VZjf3E68tEJyXRAAyCZ+1zLeeFlloYI/WQm7Lq+ cukmyGbanwmk5QM2KqZoUR4GDAvrD37nCgQ7xU9yErlN46mGVHlxSuLIx Q==; X-IronPort-AV: E=Sophos;i="5.36,198,1486378800"; d="scan'208";a="144490102" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.3.4 - Outgoing - Outgoing Received: from uxcn13-tdc-c.uoa.auckland.ac.nz ([10.6.3.4]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 22 Mar 2017 02:32:07 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-tdc-c.UoA.auckland.ac.nz (10.6.3.4) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Wed, 22 Mar 2017 02:32:07 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1178.000; Wed, 22 Mar 2017 02:32:07 +1300 From: Peter Gutmann To: Thomas Pornin , Martin Thomson CC: "tls@ietf.org" Thread-Topic: [TLS] RFC 6066 - Max fragment length negotiation Thread-Index: AQHSnpUB8UgZsR1fnUWlpN1q8vk4DKGYGe7w//8q+oCAANxgO///LA8AgADcRWz//0AsAAAe+X57//8qVYCAACsrgIAGvC4AgADelwI= Date: Tue, 21 Mar 2017 13:32:06 +0000 Message-ID: <1490103123694.3164@cs.auckland.ac.nz> References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> , <20170321131514.GA9342@bolet.org> In-Reply-To: <20170321131514.GA9342@bolet.org> Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 13:32:13 -0000 Thomas Pornin writes:=0A= =0A= >Maybe there should be some extra wording saying that when a "maximum recor= d=0A= >size" was received, with a value less than the protocol-defined limit, the= n=0A= >an endpoint SHOULD strive to use minimal-sized padding in cipher suites th= at=0A= >have a variable-sized padding.=0A= =0A= I'd earlier thought of suggesting that the record length be the ciphertext= =0A= length, not the plaintext length, but wasn't sure if there'd be much suppor= t=0A= for it. It would however certainly make the required calculations easier,= =0A= since you no longer have to figure out what the potential size could be onc= e=0A= you've added the MAC size, padding, and anything else that needs to go in,= =0A= particularly since some of those factors are variable-length, leading to=0A= guesswork as to what you need to specify since some of the parameters won't= be=0A= fixed at the time you ask for record size X.=0A= =0A= Peter.= From nobody Tue Mar 21 06:50:38 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82F04126DED for ; Tue, 21 Mar 2017 06:50:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.922 X-Spam-Level: X-Spam-Status: No, score=-6.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aHWRrbXcYICK for ; Tue, 21 Mar 2017 06:50:35 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C15E12948A for ; Tue, 21 Mar 2017 06:50:35 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id F3A32C0528DE for ; Tue, 21 Mar 2017 13:50:35 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com F3A32C0528DE Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=nmav@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com F3A32C0528DE Received: from dhcp-10-40-1-102.brq.redhat.com (unknown [10.40.3.105]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 6FD647E605 for ; Tue, 21 Mar 2017 13:50:35 +0000 (UTC) Message-ID: <1490104233.2781.12.camel@redhat.com> From: Nikos Mavrogiannopoulos To: "tls@ietf.org" Date: Tue, 21 Mar 2017 14:50:33 +0100 In-Reply-To: <20170321131514.GA9342@bolet.org> References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <20170321131514.GA9342@bolet.org> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Tue, 21 Mar 2017 13:50:36 +0000 (UTC) Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 13:50:37 -0000 On Tue, 2017-03-21 at 14:15 +0100, Thomas Pornin wrote: > On Fri, Mar 17, 2017 at 05:24:09PM +1100, Martin Thomson wrote: > > I'd even go so far as to specify it: > > > > https://martinthomson.github.io/tls-record-limit/ > > > > I'll submit an I-D once the blackout ends if people are interested > > in this. > > I like this proposal. One comment, though: I think the wording in > section 4 should mandate that the value sent MUST NOT exceed the > maximum > record size -- i.e. if an implementation supports records up to 16384 > bytes, then it should put 16384 here, not a bigger value suc as > 65535. > > Rationale: last time this was discussed on this list, some people > expressed the wish to ultimately support records with more than 16384 > bytes of plaintext. If such an extension ever comes to fruition (it > is > certainly easy enough to do with CBC and GCM cipher suites), then > sending a record_size_limit with a limit of, say, 60000 bytes, would > serve as indication that the implementation indeed supports such > larger > records. This holds only as long as no implementation sends a value > larger than 16384 if it does not really accept records of more than > 16384 bytes. > > Therefore, I propose to replace this paragraph: > >     An endpoint that has no limit on the size of data they receive > can >     set this value to any value equal to or greater than the maximum >     possible record size, such as 65535. A larger value does not > allow >     the endpoint to send larger records than the protocol permits. An >     endpoint that receives a value larger than the maximum defined in >     the protocol MUST NOT exceed protocol-defined limits. For TLS 1.3 >     and earlier, this limit is 2^14 octets. > > with the following: > >     An endpoint that supports all sizes that comply with the >     protocol-defined limits MUST send exactly that limit as value for >     maximum record size (or a lower value). For TLS 1.3 and earlier, >     that limit is 2^14 octets. Higher values are currently reserved > for >     future versions of the protocol that may allow larger records; an >     endpoint MUST NOT send a value higher than 2^14 unless explicitly >     allowed by such a future version and supported by the endpoint. > >     When an endpoint receives a maximum record size limit larger than >     the protocol-defined limit, that end point MUST NOT send records >     larger than the protocol-defined limit, unless explicitly allowed > by >     a future TLS version. I support this proposal. It actually prevents re-introducing a limitation which can hamper a future modification of the scope of this extension. regards, Nikos From nobody Tue Mar 21 07:55:10 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B3FD1299C2 for ; Tue, 21 Mar 2017 07:55:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.397 X-Spam-Level: X-Spam-Status: No, score=-5.397 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-2.796, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1Erv7IcDyUJt for ; Tue, 21 Mar 2017 07:55:03 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.17.21]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 23294127011 for ; Tue, 21 Mar 2017 07:55:02 -0700 (PDT) Received: from [192.168.91.181] ([45.59.213.66]) by mail.gmx.com (mrgmx103 [212.227.17.168]) with ESMTPSA (Nemesis) id 0M85r3-1bv3ht03Rx-00vhIy; Tue, 21 Mar 2017 15:55:00 +0100 From: Hannes Tschofenig To: Joseph Birr-Pixton , tls@ietf.org References: Openpgp: id=071A97A9ECBADCA8E31E678554D9CEEF4D776BC9 Message-ID: <45202253-54c1-1f71-3ec6-bba708e9bdd2@gmx.net> Date: Tue, 21 Mar 2017 15:54:57 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="HWRElXPdsQagIkaQiTk4Jti2HU0fiNlfc" X-Provags-ID: V03:K0:56/6O6RfcPtpUDA4PF2FlmCT+XZqUuNnRo1cvGgweboeEwBRlkH 4luxDuXS7ywKkqAo3xGGEaYWmc6Y4XWyhJYmLx9OYMVyOo4yBotQsViADAHtngmCywFGG9G UzzDf8UP0O8+GLH/r6bgS6UiPWugDrNh4f+4CBgMGV3rrdhtRByQI2QQJni+/pLa4kp7rgz pE0SJZnuZ60TxlHj90kHg== X-UI-Out-Filterresults: notjunk:1;V01:K0:oJOyptHeR6Y=:cySo7FfsytqiOICCxRGLzO YyAXoGck49qsOUSaITl8FQGI0rt8xgAQMYQcT57g5NggJgYYI5dZcr1BBNAWU2TP+KXRRFs2z HfKh8aJ2Wa6nS2u2jALprcF2ZNsHDqkI9GVrJYU7n7OTNd32BHw9eppoOAgohKtFCeYm73li/ N7ou3duEr0B6/qvRatSSqeLlFdVABzbOPe9ECGrjNbfpWfzIFIGOaI00wl4fo+AeLwR7Q2BeH faEtSv//uUOoFaOfai3DYzxuoigv0/4ohk/TrLXMrropgoRVS2qHU3w/jVXLJ61p4yHwKb3xM 3J5MvF3j2on9iVhMKNShGp5kASQeJFQZ2gmYpYHeovVb2ODzAiKbKnNjUJRw4fzhb988V9hi6 B55hl0eyq89tU2R//8L5SBLEE/dcQgg6M14ixqGZ2/H62Hqnk2QL/ifJ0r1y28sIFCr+jvtzi O/sdfVQ8/JZnA9TgtzA450RJm0NoKYED4k21xkNriAwBK52taTsbus1KzagwythdoZik7sCJY fqsk8z6L6nMblZ8ljQtG82qA/nz0yHBvSrhsIrmjWqfCR/bEkx9HZEOs/0QgVESGVAd1c1+oe sK/cZKIUxqG1Ejf95BkzeMbpvxG9h+d5mk3A2S+8PJTENI3A1Qx7leW8+eRQHtB2m4jJbRLw8 /PKCT/V++tm5q5kp10olggViF+wDJv0yP3JUjHo4L5M5GRMBiObDwLV+gG9AVB8LYeydyXvmc DRMwZwwagOAePfDsE2x7AZvauOPO0+AIrtnYi0+7fRblXTjVySkfNgwbHYM= Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 14:55:06 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --HWRElXPdsQagIkaQiTk4Jti2HU0fiNlfc Content-Type: multipart/mixed; boundary="rPdHlBLJerDtVoEbok1jbDsNfeWs7Wod3"; protected-headers="v1" From: Hannes Tschofenig To: Joseph Birr-Pixton , tls@ietf.org Message-ID: <45202253-54c1-1f71-3ec6-bba708e9bdd2@gmx.net> Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation References: In-Reply-To: --rPdHlBLJerDtVoEbok1jbDsNfeWs7Wod3 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Hi Joe, On 03/18/2017 10:17 AM, Joseph Birr-Pixton wrote: > With the greatest of respect, mbedtls *doesn't* implement > max_fragment_length[1], because it doesn't fragment handshake messages > as required by the spec. Attempts to use it with a conforming peer > will fail to handshake. while I am waiting for my mbed TLS coworkers to respond I have been asking myself what the MFL extension of handshake message can really provide. For example, the certificate message is typically one of the largest messages in the TLS handshake. If it is too large to fit in a buffer of the client then what should be done? As a client I cannot verify just half of a certificate. Of course, if it possible to avoid sending a long certificate chain but this is subject to deployment choice= s. While I can see some use of the MFL extension in the handshake protocol, for example, in the selection of the ciphersuite or in deciding whether multiple messages should be concatenated into a single datagram I fear there is typically much less room for maneuver compared to the application layer protocol. Ciao Hannes --rPdHlBLJerDtVoEbok1jbDsNfeWs7Wod3-- --HWRElXPdsQagIkaQiTk4Jti2HU0fiNlfc Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: GPGTools - http://gpgtools.org iQEcBAEBCgAGBQJY0T7BAAoJEGhJURNOOiAtNU4H/RP+Xa1ZIFVQHRhTPWPg3s/A 7+Rqrzi2+dvuFK/2QF5ryhmqv8CecvIck5alZhZsp6CigsIhJOFf0ul+TuCcWmA7 v8ESu77/ThBJUqNnlDmEJW1xBi+KCJ+3rK34MCkzvSfrQ5FWm/0NxHjhtSav1KA6 MwkcdStZKt/wCnhDuMEs4WsxByLgC4N0OGMEhvcRkDNzxsW085Hn34f/qNLVEdv0 g2qo5Fh9WbHuO+AvxQoaz1E5CDlCwGYEHzXvJA4sefJamXzeCERciYlyAc8Ut9RU Iy/CPkqI4ldeEgepDrrqL6chFdANIKyeDzQHoqBICadogxGVuyHZp4oM1l4NDSQ= =N+62 -----END PGP SIGNATURE----- --HWRElXPdsQagIkaQiTk4Jti2HU0fiNlfc-- From nobody Tue Mar 21 08:11:38 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D7CC129A15 for ; Tue, 21 Mar 2017 08:11:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oaGccKUK4aJN for ; Tue, 21 Mar 2017 08:11:31 -0700 (PDT) Received: from welho-filter4.welho.com (welho-filter4.welho.com [83.102.41.26]) by ietfa.amsl.com (Postfix) with ESMTP id 747351299ED for ; Tue, 21 Mar 2017 08:11:30 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter4.welho.com (Postfix) with ESMTP id 88D1624196; Tue, 21 Mar 2017 17:11:29 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp1.welho.com ([IPv6:::ffff:83.102.41.84]) by localhost (welho-filter4.welho.com [::ffff:83.102.41.26]) (amavisd-new, port 10024) with ESMTP id 2mZqiII41V9O; Tue, 21 Mar 2017 17:11:29 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp1.welho.com (Postfix) with ESMTPSA id 598E2C4; Tue, 21 Mar 2017 17:11:29 +0200 (EET) Date: Tue, 21 Mar 2017 17:11:28 +0200 From: Ilari Liusvaara To: Eric Rescorla Cc: "tls@ietf.org" Message-ID: <20170321151128.GA802@LK-Perkele-V2.elisa-laajakaista.fi> References: <20170321094530.GA493@LK-Perkele-V2.elisa-laajakaista.fi> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Subject: Re: [TLS] Derive-Secret(foo, "bar", "") X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 15:11:37 -0000 On Tue, Mar 21, 2017 at 05:13:23AM -0700, Eric Rescorla wrote: > On Tue, Mar 21, 2017 at 2:45 AM, Ilari Liusvaara > wrote: > > > > I believe that OpenSSL is correct. Note that this construction already > appeared in the computation for the binder keys in -18 and I believe that > everyone interpreted it as the hash of the empty string. > > I think that's more natural given the notation, because Derive-Secret > explicitly hashes the input, whereas HKDF-Expand-Label is defined > as using "" = means a 0-length hash. If people think we should adopt > your interpretation, I think we would need to special-case the notation, > which of course isn't the worst thing in the world. > > Maybe we should update the draft, though. Ah, I was confused by the note about zero-length HashValue. It applies to just HKDF-Expand-Label, but I read it to also apply to Derive-Secret (and given how code is structured, it didn't create obvious edge case in code). -Ilari From nobody Tue Mar 21 11:08:26 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 68767129C71 for ; Tue, 21 Mar 2017 11:08:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.4 X-Spam-Level: X-Spam-Status: No, score=-2.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.197, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E-U67I5DeV9v for ; Tue, 21 Mar 2017 11:08:22 -0700 (PDT) Received: from mail-it0-x231.google.com (mail-it0-x231.google.com [IPv6:2607:f8b0:4001:c0b::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 60CDE129C58 for ; Tue, 21 Mar 2017 11:08:22 -0700 (PDT) Received: by mail-it0-x231.google.com with SMTP id y18so13116607itc.0 for ; Tue, 21 Mar 2017 11:08:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=Nc4Bg5qMUSy9kB6CphGIFhJySIFq1SxKclhO60/Jq+Q=; b=ENwxrTmstzREDemVvEbEaA0bzr6M8oyqiBxZeHTOp6o/8j6bVpn7nGISC1OwBo6nzY QV2bQFsWipyemJyYQzJTW6ytI5LbtKMx1yU+33PYHHY3YEzGm+4tWPJYyMAEcG18bUsy fcmT0FizsidxDxoDrJTrZ0qXHbxi6VLdrr3iZr8c9sEEBcxnsLBSrCMgABY1HSOVWS92 FiXyKBGq/yM6qKXN5Gz7G7IJ4MTRQ7vWSs4DDClVaHidezYyw4ASL3WWrAGtuzJOAZUg L+jjlywsUM99CF7S/lBDp2Gc5MKhXU6sDW5RPF4C0s2wHEFUQyqEkdhjs6qsS2yK4c7R B4XQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=Nc4Bg5qMUSy9kB6CphGIFhJySIFq1SxKclhO60/Jq+Q=; b=mf8XqbgSXqjEDOx9+M1ZhzUMVOrF0QjygHNMfeE2oGyP7IcL8WluNbIoqfPhgTSe2K H3RC9Paf2V057PfdJX5UY1hZne3sFDFVoctKnbhBN6ymg5o7O4dk4yvjsbgAbdrbjbEs xQZLZiONAIn+0CFdgWBDune+DIY3CESyU36MVRxrsBxVwPTkNik117v9mPGyWgyKyRUd uSVjt0f+CLEwSew7U/9AJPtbjQ/d3ZcHcNl//8PmnyQbtpX53804zgnwxq/BgEhGqnlz 4W9RkQTUWHSllZ6ZDeITVokwb9IGuacDrk4CYm8XMz+p/1d0sTBLa6aW7f/gnGCNy/pc ysfA== X-Gm-Message-State: AFeK/H1m702e2/xrcL6D5AeGIdWE49XgGIyyLVsvDyNowfOJSou3vE8LpzYIZcMyYrCJlgdgRZnGLfSSsyFaVw== X-Received: by 10.36.215.194 with SMTP id y185mr4080407itg.101.1490119701683; Tue, 21 Mar 2017 11:08:21 -0700 (PDT) MIME-Version: 1.0 Sender: mglt.ietf@gmail.com Received: by 10.107.35.213 with HTTP; Tue, 21 Mar 2017 11:08:20 -0700 (PDT) In-Reply-To: References: From: Daniel Migault Date: Tue, 21 Mar 2017 14:08:20 -0400 X-Google-Sender-Auth: G69CWd6dJIulTg6TwwNJfVxeKbE Message-ID: To: Joseph Salowey Cc: "tls@ietf.org" , draft-ietf-tls-ecdhe-psk-aead@tools.ietf.org Content-Type: multipart/alternative; boundary=94eb2c0afc5c7de536054b418767 Archived-At: Subject: Re: [TLS] Last call comments and WG Chair review of draft-ietf-tls-ecdhe-psk-aead X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 18:08:25 -0000 --94eb2c0afc5c7de536054b418767 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi, Thank you for the review and comments received. Given the discussion our understanding was that the consensus was to remove CCM-256 so that suites defined by the document apply both for TLS1.2 as well as for TLS1.3. The draft available on github [1 ] has been updated as follows: 1. Why does TLS_ECDHE_PSK_WITH_AES_256_CCM_8_SHA256 use SHA256 instead of SHA384 like the other 256 bit cipher suites? (From Russ Housley) MGLT: This was a mistake in the IANA section. The cypher suite was correct in the remaining text. However, the current version does not consider anymore CCM-256* which also solves this issue. 2. Since the security considerations mention passwords (human chosen secrets) it should mention dictionary attacks. (From Russ Housley) MGLT: The issue of human chosen passwords and dictionary attacks has been mentioned in the security consideration with the following text: """ Use of Pre-Shared Keys of limited entropy may allow an active attacker attempts to connect to the server and tries different keys. For example, limited entropy may be provided by using short PSK in which case an attacker may perform a brute-force attack. Other example includes the use of a PSK chosen by a human and thus may be exposed to dictionary attacks. """ 3. Section 2 and 3 of the document contains more detail about TLS 1.3 than necessary. Section 2: This document only defines cipher suites for TLS 1.2, not TLS 1.2 or later. A subset of equivalent cipher suites is defined in the TLS 1.3 specification. MGLT: CCM-256 has been removed from the specification so that suites can be defined for TLS 1.2 as well as TLS1.3. The following text is considered. """ This document defines new cipher suites that provide Pre-Shared Key (PSK) authentication, Perfect Forward Secrecy (PFS), and Authenticated Encryption with Associated Data (AEAD). The cipher suites are defined for version 1.2 of the Transport Layer Security (TLS) [RFC5246] protocol, version 1.2 of the Datagram Transport Layer Security (DTLS) protocol [RFC6347], as well as version 1.3 of TLS [I-D.ietf-tls-tls13]. """ Section 3 and 4: Maybe replace the last 2 paragraphs with an addition to section 4 that states: "TLS 1.3 and above name, negotiate and support a subset of these cipher suites in a different way." (TLS 1.3 does not support TLS_ECDHE_PSK_WITH_AES_256_CCM_SHA384 and TLS_ECDHE_PSK_WITH_AES_256_CCM_8_SHA256) MGLT: As CCM-256 has been removed, we do not have to deal with the situation where TLS1.3 only considers a subset of the suites defined for TLS1.2. The following sentence in section 3 clarifies that codes points are only defined for TLS1.2: =E2=80=9C=E2=80=9D=E2=80=9DThe assigned code points can= only be used for TLS 1.2.=E2=80=9D=E2=80=9D=E2=80=9D. The description of the TLS1.3 negotiation = has been limited in section 4 to the following sentence: =E2=80=9C=E2=80=9D=E2=80=9DTLS 1.3 and= above version, negotiate and support these cipher suites in a different way.=E2=80=9D=E2= =80=9D=E2=80=9D 4. Section 3 should contain a bit more detail about relationship to 4492 bis and RFC 4279: Something like the following may be enough. "This messages and pre-master secret construction in this document are based on [RFC4279]. The elliptic curve parameters used in in the Diffie-Hellman parameters are negotiated using extensions defined in [4492-bis]." MGLT: The sentence mentioned above has been added with [4492-bis] mentioned as normative. =E2=80=9C=E2=80=9D=E2=80=9D Messages and pre-master secret construction in this document are based on [RFC4279]. The elliptic curve parameters used in in the Diffie-Hellman parameters are negotiated using extensions defined in [I-D.ietf-tls-rfc4492bis]. =E2=80=9C=E2=80=9D=E2=80=9D [1] https://github.com/mglt/draft-ietf-tls-ecdhe-psk-aead/blob/master/draft-iet= f-tls-ecdhe-psk-aead Yours, Daniel and John On Tue, Feb 21, 2017 at 1:22 PM, Joseph Salowey wrote: > Here are the open issues for draft-ietf-tls-ecdhe-psk-aead > > 1. Why does TLS_ECDHE_PSK_WITH_AES_256_CCM_8_SHA256 use SHA256 instead > of SHA384 like the other 256 bit cipher suites? (From Russ Housley) > > 2. Since the security considerations mention passwords (human chosen > secrets) it should mention dictionary attacks. (From Russ Housley) > > 3. Section 2 and 3 of the document contains more detail about TLS 1.3 > than necessary. > > Section 2: This document only defines cipher suites for TLS 1.2, not TLS > 1.2 or later. A subset of equivalent cipher suites is defined in the TLS > 1.3 specification. > > Section 3 and 4: Maybe replace the last 2 paragraphs with an addition to > section 4 that states: > > "TLS 1.3 and above name, negotiate and support a subset of these cipher > suites in a different way." (TLS 1.3 does not support TLS_ECDHE_PSK_WITH= _AES_256_CCM_SHA384 > and TLS_ECDHE_PSK_WITH_AES_256_CCM_8_SHA256) > > 4. Section 3 should contain a bit more detail about relationship to 4492 > bis and RFC 4279: > > Something like the following may be enough. > > "This messages and pre-master secret construction in this document are > based on [RFC4279]. The elliptic curve parameters used in in the > Diffie-Hellman parameters are negotiated using extensions defined in > [4492-bis]." > > Thanks, > > Joe > > > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > --94eb2c0afc5c7de536054b418767 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi,

Thank you for the review and comments= received. Given the discussion our understanding was that the consensus wa= s to remove CCM-256 so that suites defined by the document apply both for T= LS1.2 as well as for TLS1.3. The draft available on github [1]=C2=A0 has been updated as follows:=C2=A0

<= br>1.=C2=A0 Why does TLS_ECDHE_PSK_WITH_AES_256_CCM_8_SHA256 use SHA256 ins= tead of SHA384 like the other 256 bit cipher suites? (From Russ Housley)
MGLT: This was a mistake in the IANA section. The cypher suite was cor= rect in the remaining text. However, the current version does not=C2=A0 con= sider anymore CCM-256* which also solves this issue.
=C2=A0
2.=C2=A0 = Since the security considerations mention passwords (human chosen secrets) = it should mention dictionary attacks. (From Russ Housley)
=C2=A0
MGLT= : The issue of human chosen passwords and dictionary attacks has been menti= oned in the security consideration with the following text:

"&q= uot;"
=C2=A0=C2=A0 Use of Pre-Shared Keys of limited entropy may a= llow an active
=C2=A0=C2=A0 attacker attempts to connect to the server a= nd tries different keys.
=C2=A0=C2=A0 For example, limited entropy may b= e provided by using short PSK in
=C2=A0=C2=A0 which case an attacker may= perform a brute-force attack.=C2=A0 Other
=C2=A0=C2=A0 example includes= the use of a PSK chosen by a human and thus may be
=C2=A0=C2=A0 exposed= to dictionary attacks.
"""

=C2=A0
3.=C2=A0 Se= ction 2 and 3 of the document contains more detail about TLS 1.3 than neces= sary.=C2=A0
=C2=A0
Section 2: This document only defines cipher suit= es for TLS 1.2, not TLS 1.2 or later.=C2=A0 A subset of equivalent cipher s= uites is defined in the TLS 1.3 specification.=C2=A0
=C2=A0
MGLT: CC= M-256 has been removed from the specification so that suites can be defined= for TLS 1.2 as well as TLS1.3. The following text is considered.

&= quot;""
=C2=A0=C2=A0 This document defines new cipher suites = that provide Pre-Shared Key
=C2=A0=C2=A0 (PSK) authentication, Perfect F= orward Secrecy (PFS), and
=C2=A0=C2=A0 Authenticated Encryption with Ass= ociated Data (AEAD).=C2=A0 The cipher
=C2=A0=C2=A0 suites are defined fo= r version 1.2 of the Transport Layer Security
=C2=A0=C2=A0 (TLS) [RFC524= 6] protocol, version 1.2 of the Datagram Transport Layer
=C2=A0=C2=A0 Se= curity (DTLS) protocol [RFC6347], as well as version 1.3 of TLS
=C2=A0= =C2=A0 [I-D.ietf-tls-tls13].
"""
=C2=A0
Section 3 a= nd 4: Maybe replace the last 2 paragraphs with an addition to section 4 tha= t states:
=C2=A0
"TLS 1.3 and above name, negotiate and support = a subset of these cipher suites in a different way."=C2=A0 (TLS 1.3 do= es not support TLS_ECDHE_PSK_WITH_AES_256_CCM_SHA384 and TLS_ECDHE_PSK_WITH= _AES_256_CCM_8_SHA256)
=C2=A0
MGLT: As CCM-256 has been removed, we d= o not have to deal with the situation where TLS1.3 only considers a subset = of the suites defined for TLS1.2.

The following sentence in section= 3 clarifies that codes points are only defined for TLS1.2: =E2=80=9C=E2=80= =9D=E2=80=9DThe assigned code points can only be used for TLS 1.2.=E2=80=9D= =E2=80=9D=E2=80=9D. The description of the TLS1.3 negotiation has been limi= ted in section 4 to the following sentence: =E2=80=9C=E2=80=9D=E2=80=9DTLS = 1.3 and above version, negotiate and support these cipher suites in a diffe= rent way.=E2=80=9D=E2=80=9D=E2=80=9D
=C2=A0
4. Section 3 should conta= in a bit more detail about relationship to 4492 bis and RFC 4279:
=C2=A0=
Something like the following may be enough.=C2=A0

"This me= ssages and pre-master secret construction in this document are based on [RF= C4279].=C2=A0 The elliptic curve parameters used in in the Diffie-Hellman p= arameters are negotiated using extensions defined in [4492-bis]."
= =C2=A0
MGLT: The sentence mentioned above has been added with [4492-bis]= mentioned as normative.
=E2=80=9C=E2=80=9D=E2=80=9D
=C2=A0=C2=A0=C2= =A0 Messages and pre-master secret construction in this document are
=C2= =A0=C2=A0 based on [RFC4279].=C2=A0 The elliptic curve parameters used in i= n the
=C2=A0=C2=A0 Diffie-Hellman parameters are negotiated using extens= ions defined in
=C2=A0=C2=A0 [I-D.ietf-tls-rfc4492bis].
=E2=80=9C=E2= =80=9D=E2=80=9D

[1] https://github= .com/mglt/draft-ietf-tls-ecdhe-psk-aead/blob/master/draft-ietf-tls-ecdhe-ps= k-aead

Yours,
Daniel and John

<= div class=3D"gmail_extra">
On Tue, Feb 21, 20= 17 at 1:22 PM, Joseph Salowey <joe@salowey.net> wrote:
Here are the= open issues for=C2=A0draft-ietf-tls-ecdhe-psk-aead

1.=C2=A0 Why does=C2=A0TLS_ECDHE_PSK_WITH= _AES_256_CCM_8_SHA256 use SHA2= 56 instead of SHA384 like the other 256 bit cipher suites? (From Russ Housl= ey)

2.=C2=A0 Since the security considerations mention passwords (human chosen= secrets) it should mention dictionary attacks. (From Russ Housley)

3.=C2=A0 Section 2 and 3 of the document contains more de= tail about TLS 1.3 than necessary. =C2=A0

Section = 2: This document only defines cipher suites for TLS 1.2, not TLS 1.2 or lat= er.=C2=A0 A subset of equivalent cipher suites is defined in the TLS 1.3 sp= ecification. =C2=A0

Section 3 and 4: Maybe replace= the last 2 paragraphs with an addition to section 4 that states:

"TLS 1.3 and above name, negotiate and support a subse= t of these cipher suites in a different way." =C2=A0(TLS 1.3 does not = support=C2=A0TLS_ECDHE= _PSK_WITH_AES_256_CCM_SHA384 and=C2=A0TLS_ECDHE_PSK_WITH_AES_256_CCM_8_SHA256)

4. Section 3 should contain a bit more d= etail about relationship to 4492 bis and RFC 4279:

Something like the following may be enough. =C2=A0

"This messages and pre-master secret construction i= n this document are based on [RFC4279].=C2=A0 The elliptic curve parameters= used in in the Diffie-Hellman parameters are negotiated using extensions d= efined in [4492-bis]."

Thanks,

Joe


<= br>

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--94eb2c0afc5c7de536054b418767-- From nobody Tue Mar 21 11:54:29 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 654DB12778D; Tue, 21 Mar 2017 11:54:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QK2tfPI2DdWm; Tue, 21 Mar 2017 11:54:26 -0700 (PDT) Received: from mail-wm0-x231.google.com (mail-wm0-x231.google.com [IPv6:2a00:1450:400c:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72F521270A0; Tue, 21 Mar 2017 11:54:26 -0700 (PDT) Received: by mail-wm0-x231.google.com with SMTP id u132so18994095wmg.0; Tue, 21 Mar 2017 11:54:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=C4LgTtN2ymk07RbSun7dj1aZ0ZedFaN19Ngqf5bZqPQ=; b=Jlmqo2TmaxIvWPoCYWxu9Y4wMojBF9PqxdSaSukrfJrEpbXFomfWCeTt7tG6VbnPrk 7+XYxen2Q8tR3drIu6RJ+gUGSt47iVVdtnKrfjWJBdGkPCOOg7wMhFVXt+Yckr2zyRNP gvffac8M3e7NWbJbLE5oM4qR8FKf86JmjDVrPBNqn1jzi46qKs5O4gNJXtkGD10AknvH aEyNkMrmz/C2yoR3rz5MyCmqD+InO0Lm42ci2i4Rl5WhoMW1rLKmiMhfaraESO0XK3Wh y5vkADZ4Ho9SexxJGQwMPk7TT4N9qKYbFNVrjQ7jCQ8V+V2lzhyBvU9MQyDxdE2ChOty CTdw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=C4LgTtN2ymk07RbSun7dj1aZ0ZedFaN19Ngqf5bZqPQ=; b=hnHsvTuKCYey0n0tTCX3ILdsCTk8CV7/2lfNSYv/MIWuvsoLKpoeyUXvjhvDC8FFPX jU8qwYVHLCS5nMmMMKPuszvMCVCb/apDEUs0ocraub+2SIAMSPdKfO/AEI8SSIJ/FR1B sSAKyi04GaX9XTd5Kcq58XRJJByOlPTi23C1xxKK45tetsb+xHDmoqzoN9dsiEdln/tV OCtksN/XVhphW7izrl95Iwi39opCkfGaYLr0LdTs7is6PqvHCJC0NMPqjQpoilkDJBIW By0t8BacoSFdCZpxa0O0lQ/VF8FfIDM/XLBzXUz3rGNg1zNO+gT0+kGPkqaL3TqriRMx dD1A== X-Gm-Message-State: AFeK/H2JiuR0glUYNTYtyu+L6lbdKAMa/EMsHzyiOzukdaLwIHJ2sLwxY4Vxn/wX5PHj6A== X-Received: by 10.28.224.69 with SMTP id x66mr4201427wmg.21.1490122464965; Tue, 21 Mar 2017 11:54:24 -0700 (PDT) Received: from [192.168.1.18] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id v186sm18569186wmv.2.2017.03.21.11.54.23 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 21 Mar 2017 11:54:24 -0700 (PDT) From: Yoav Nir Message-Id: <796E5814-B3E1-4E3A-8272-1617121A7E80@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_F64952CA-4514-4C6E-A071-9D64E07A71F7"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Tue, 21 Mar 2017 20:54:22 +0200 In-Reply-To: <42C2F79C-2795-4A15-9B68-AFAB3A8EB01A@sn3rd.com> Cc: Eric Rescorla , "tls@ietf.org" , IESG To: Sean Turner References: <014753DA-5D5A-47ED-88D3-2291DC3DE78A@gmail.com> <42C2F79C-2795-4A15-9B68-AFAB3A8EB01A@sn3rd.com> X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Review of draft-ietf-tls-rfc4492bis-15 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 18:54:28 -0000 --Apple-Mail=_F64952CA-4514-4C6E-A071-9D64E07A71F7 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On 21 Mar 2017, at 14:28, Sean Turner wrote: >=20 >=20 >> On Mar 21, 2017, at 08:02, Eric Rescorla wrote: >>=20 >> What we probably should actually do is make this depend on the IANA = draft and then mark >> these Not Recommended. >=20 > That is an option as none of the 3DES suites are marked as Recommended = in the IANA draft. >=20 Which to me sounds like an argument for leaving the text as is. Yoav --Apple-Mail=_F64952CA-4514-4C6E-A071-9D64E07A71F7 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJY0XbeAAoJELhJCxUKWMyZ7ooIAJvWb6eVSLxR7FVRGsbjymk1 wleNUzw8C7Xth5NamxbH5TgiFeZ7xWrrzaF/nNUKqZx1EmWLg6veXHsppbfhawPX BhXSQhHt+DX9kUftp6zjQDF7yd5tuxiU7RDLJi/vVWvB160lSTIBRdweECg5Q5mC rf/6RUM2NLOkrvXk8zXiMBnLiFQ/GAwhmSXWS+ZqYXbO01jYWDww1QaAg6pGNcp+ 0+gCNVWJZGx83RfcFBpvg/OB1/kWOaCufojEMSUPmmyxDhwfmHRd0UzbXVM8cjkD TNV0zvk0T3nxbO48qNw7XfyGKUL+dqW3MK7nro/KxRwz9w4TnHTn4nz1RTG6ztU= =OMh7 -----END PGP SIGNATURE----- --Apple-Mail=_F64952CA-4514-4C6E-A071-9D64E07A71F7-- From nobody Tue Mar 21 16:31:35 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66A38129410 for ; Tue, 21 Mar 2017 16:31:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y4leTDhrNXiM for ; Tue, 21 Mar 2017 16:31:32 -0700 (PDT) Received: from mail-yw0-x232.google.com (mail-yw0-x232.google.com [IPv6:2607:f8b0:4002:c05::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4CEA5129409 for ; Tue, 21 Mar 2017 16:31:32 -0700 (PDT) Received: by mail-yw0-x232.google.com with SMTP id v76so119792555ywg.0 for ; Tue, 21 Mar 2017 16:31:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=koHanlToUUIPHRT0yxWbkVNMy9GBLs6rDFWDARN7N8o=; b=sOJkgHAR83xF7wah+Ej1pKHAmCHp9g+QXj3dbtAumQE8u7j/EcsC0LpovwJCtLVXhA GpgrC1QRmuiCkdEbuWCXjQte4+iBovesiMoOu4Ol70HpHnMxbJiP0Zr06EC1R9KoQAMl E3LQKMKWldgJrX2ttsvCWparP/eVePe92JKaMK319YAuUa0VTqjaLOW4nwiqCYSUkv27 yt1+lAXEruKcPOeBpL8s/jjUTnNESnvCylpU4OCJbxgCek9clkYeVoEq6uFLdMkrpyoo 3N59mcbEY1VTrfA9iLp5eK1P78w3p/aQeaof4a8D1h0m2Ii/iPOeX2+IdSaMQQ19dXCE ovLA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=koHanlToUUIPHRT0yxWbkVNMy9GBLs6rDFWDARN7N8o=; b=DLCZq62ZJ9fysQFPniT4nxig+S6pCF+xaQGBhJGFoUIlj0DrcrygpkV8L9sHF4lKBC AVYrV5Zvl+F4qrKPgd6V6sSpnHtIWRf8buuFtJ9b1aLlw9SLgSto8GRm8fxZiC22HKRJ 2p9+zKProVtkjHCBcpA+KExGopbZqQlxGvoZVW6EjPXCoBP4Frjl+QoJyCzsNI/SkqKc OCobq9oQoHWqlVtJgK9vQOwFX3WBjkjfUHsb/ynBZAKPYMUecKemNGvq6FZXyOGRP43q 4RaRR8P0NmeTO+lfqXIe6oI6hx6/g8GDheih1Qc7DW4nh8MIzo0kQW9zQ1BxVe3zkedJ bPpQ== X-Gm-Message-State: AFeK/H3r5gdeI1h5w7r/f/ZLx4PNRuLC5CD05sWzwP/+mqx0GYqxE0pnYGzknsgXfHdobk/oMmF/DDoffgIoJA== X-Received: by 10.129.125.5 with SMTP id y5mr20687657ywc.120.1490139091519; Tue, 21 Mar 2017 16:31:31 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Tue, 21 Mar 2017 16:30:50 -0700 (PDT) In-Reply-To: References: From: Eric Rescorla Date: Tue, 21 Mar 2017 16:30:50 -0700 Message-ID: To: Victor Vasiliev Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a11493644375fec054b460bdb Archived-At: Subject: Re: [TLS] Certificate compression draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 23:31:34 -0000 --001a11493644375fec054b460bdb Content-Type: text/plain; charset=UTF-8 This proposal seems like a reasonable idea. One question I had is what the point of the "uncompressed length" field is: struct { uint24 uncompressed_length; opaque compressed_certificate_message<1..2^24-1>; } Certificate; I initially thought maybe it was a sanity check, but if so it's not a very good one. I see that in S 5 you encourage receivers to limit the compressed length, but having it expressed like this doesn't seem like that useful a security measure because the attacker gets to choose both the compressed data and the length. Is the idea just to let the receiver pre-allocate a buffer for decompression? The text says: compressed_certificate_message The compressed body of the Certificate message, in the same format as the server would normally express it. The compression algorithm defines how the bytes in the compressed_certificate_message are converted into the Certificate message. I assume in this case "body" means "not including the header bytes"? I guess it's redundant, but it might be worthwhile being very precise Also: The implementations MUST limit the size of the resulting decompressed chain to the specified uncompressed length, and they MUST abort the connection if the size exceeds that limit. Implementations MAY impose a lower limit on the chain size in addition to the 16777216 byte limit imposed by TLS framing, in which case they MUST apply the same limit to the uncompressed chain before starting to decompress it. Do you mean "upper" rather than "lower" for limit? -Ekr On Mon, Mar 6, 2017 at 2:58 PM, Victor Vasiliev wrote: > Certificate compression has been discussed on this list briefly before, and > there was some interest in at least considering a draft for it. The draft > now > exists (co-authored by Alessandro and myself), and it can be found at: > > https://datatracker.ietf.org/doc/draft-ghedini-tls- > certificate-compression/ > [ GitHub repo: https://github.com/ghedo/tls-certificate-compression ] > > The proposed scheme allows a client and a server to negotiate a compression > algorithm for the server certificate message. The scheme is purely opt-in > on > both sides. The current version of the draft defines zlib and Brotli > compression, both of which are well-specified formats with an existing > deployment experience. > > There are multiple motivations to compress certificates. The first one is > that > the smaller they are, the faster they arrive (both due to the transfer > time and > a decreased chance of packet loss). > > The second, and more interesting one, is that having small certificates is > important for QUIC in order to achieve 1-RTT handshakes while limiting the > opportunities for amplification attacks. Currently, TLS 1.3 over TCP > without > client auth looks like this: > > Round trip 1: client sends SYN, server sends SYN ACK > Here, the server provides its own random value which client will > have to echo in the future. > Round trip 2: client sends ACK, ClientHello, server sends > ServerHello...Finished > Here, ACK confirms to server that the client can receive packets and > is not > just spoofing its source address. Server can send the entire > ServerHello to > Finished flight. > > In QUIC, we are trying to merge those two rounds into one. The problem, > however, is that the ClientHello is one packet, and ServerHello...Finished > can > span multiple packets, meaning that this could be used as an amplification > attack vector since the client's address is not yet authenticated at this > point. > In order to address this, the server has to limit the number of packets it > sends > during the first flight (i.e. ServerHello...Finished flight). Since > certificates make up the majority of data in that flight, making them > smaller > can push them under the limit and save a round-trip. > > Cheers, > Victor. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > --001a11493644375fec054b460bdb Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
This proposal seems like a reasonable idea. One question I= had is what the
point of the "uncompressed length" field is:=

=C2=A0 =C2=A0 =C2=A0 =C2=A0struct {
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 uint24 uncompressed_length;
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 opaque compressed_certific= ate_message<1..2^24-1>;
=C2=A0 =C2=A0 =C2=A0 =C2=A0} Certif= icate;

I initially thought maybe it was a sanity c= heck, but if so it's not a very good
one. I see that in S 5 y= ou encourage receivers to limit the compressed
length, but having= it expressed like this doesn't seem like that useful a
secur= ity measure because the attacker gets to choose both the compressed
data and the length. Is the idea just to let the receiver pre-allocate a= buffer
for decompression?


The text says:

=C2=A0 =C2=A0compressed_cert= ificate_message =C2=A0The compressed body of the
=C2=A0 =C2=A0 = =C2=A0 Certificate message, in the same format as the server would
=C2=A0 =C2=A0 =C2=A0 normally express it.=C2=A0 The compression algorithm= defines how the
=C2=A0 =C2=A0 =C2=A0 bytes in the compressed_cer= tificate_message are converted into the
=C2=A0 =C2=A0 =C2=A0 Cert= ificate message.

I assume in this case "= ;body" means "not including the header bytes"? I guess it= 9;s
redundant, but it might be worthwhile being very precise


Also:

=C2= =A0 =C2=A0The implementations MUST limit the size of the resulting decompre= ssed
=C2=A0 =C2=A0chain to the specified uncompressed length, and= they MUST abort the
=C2=A0 =C2=A0connection if the size exceeds = that limit.=C2=A0 Implementations MAY
=C2=A0 =C2=A0impose a lower= limit on the chain size in addition to the 16777216
=C2=A0 =C2= =A0byte limit imposed by TLS framing, in which case they MUST apply the
=C2=A0 =C2=A0same limit to the uncompressed chain before starting to= decompress
=C2=A0 =C2=A0it.

Do yo= u mean "upper" rather than "lower" for limit?

-Ekr



=


On Mon, Mar 6, 2017 at 2:58 PM, Victor Vasiliev <vas= ilvv@google.com> wrote:
Certificate compression has been discussed on this list = briefly before, and
there was some interest in at least consideri= ng a draft for it.=C2=A0 The draft now
exists (co-authored by Ale= ssandro and myself), and it can be found at:

=C2=A0 [ GitHub repo: https://github.com/ghedo/tls-certificate-compression ]
=

The proposed scheme allows a client and a server to neg= otiate a compression
algorithm for the server certificate message= .=C2=A0 The scheme is purely opt-in on
both sides.=C2=A0 The curr= ent version of the draft defines zlib and Brotli
compression, bot= h of which are well-specified formats with an existing
deployment= experience.

There are multiple motivations to com= press certificates.=C2=A0 The first one is that
the smaller they = are, the faster they arrive (both due to the transfer time and
a = decreased chance of packet loss).

The second, and = more interesting one, is that having small certificates is
import= ant for QUIC in order to achieve 1-RTT handshakes while limiting the
<= div>opportunities for amplification attacks.=C2=A0 Currently, TLS 1.3 over = TCP without
client auth looks like this:

=C2=A0 Round trip 1: client sends SYN, server sends SYN ACK
=C2= =A0 =C2=A0 Here, the server provides its own random value which client will=
=C2=A0 =C2=A0 have to echo in the future.
=C2=A0 Round= trip 2: client sends ACK, ClientHello, server sends ServerHello...Finished=
=C2=A0 =C2=A0 Here, ACK confirms to server that the client can r= eceive packets and is not
=C2=A0 =C2=A0 just spoofing its source = address.=C2=A0 Server can send the entire ServerHello to
=C2=A0 = =C2=A0 Finished flight.

In QUIC, we are trying to = merge those two rounds into one.=C2=A0 The problem,
however, is t= hat the ClientHello is one packet, and ServerHello...Finished can
span multiple packets, meaning that this could be used as an amplification=
attack vector since the client's address is not yet authenti= cated at this point.
In order to address this, the server has to = limit the number of packets it sends
during the first flight (i.e= . ServerHello...Finished flight).=C2=A0 Since
certificates make u= p the majority of data in that flight, making them smaller
can pu= sh them under the limit and save a round-trip.

Che= ers,
=C2=A0 Victor.

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--001a11493644375fec054b460bdb-- From nobody Tue Mar 21 16:51:25 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9565A129409 for ; Tue, 21 Mar 2017 16:51:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mUBWHZ3JKP6z for ; Tue, 21 Mar 2017 16:51:22 -0700 (PDT) Received: from mail-qk0-x233.google.com (mail-qk0-x233.google.com [IPv6:2607:f8b0:400d:c09::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D04C127977 for ; Tue, 21 Mar 2017 16:51:22 -0700 (PDT) Received: by mail-qk0-x233.google.com with SMTP id p64so147393168qke.1 for ; Tue, 21 Mar 2017 16:51:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=SZ8VcIhZrp15XLjj8VOp2KgytH2jYQcuMQ9ttJiuNHI=; b=iHZ6cbT9RsygEMZ86BAf/KV/WZzskC7OmfKxqYzDgGqVRn0iy2XJVFqmoSdZe4+W7n f2r72Uox82n5w4ZSylGKiM0lpdt8ZEq43Kdpv9o7NL3MuoBg20kqPRUo9egsyXuym2Op 6BwrqgIDpSAE/lC8aSZtaeP0EwPQNT8YAXASr9nHKihKEjeaWMNhziH3flfAeRJRK2e8 fvHnCA0/XGhQGFKur0g8NyKJivEcqnp0i84uimoow/Oo34j++Id2g4LQoUfVgXjl7uFk K9g9dReMIa/F9SzDnfIIKk87rzTOG/7hrqUrXnsHYHvOj3CZ2Qn3ZjcgWKQ71MAYQco0 mX6w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=SZ8VcIhZrp15XLjj8VOp2KgytH2jYQcuMQ9ttJiuNHI=; b=shj1y1T4P12jo36dzXAqzyLJUaE6cK30WBCNtGd22g4Zs0zrzW+FZkSeK51oI7Kvcd YWtJJ4zJuygnLpot91wV6ykKYUtiaj/ww90brqDPIT35H2SbhHhdk9JA368vdOJAnVlk GuRu9WUIXe/kJLeG20aHDkQ5qZyvwLXJPA5UC064amSQFNAPFHPPxu/KF3EnRLAucjqb 3RqPFTkYMJnRIEf6Hi94rgyyycGFdzlHcUHnKz+eJorrUja7Q82ZKaKneuVKhrZfq6Zf BmuIZsJ2DIa35y5USs3inE+6t0OnpJJBzIkVe7KkmEmTBImoagm61UY4IykkjLKi0WT9 abBw== X-Gm-Message-State: AFeK/H2zXx0xoCJNzCiYAPKXSBN47uhMKY54owyUGnqjphRUQRVpDarFl3wVCW3lgAmvj4J37e0UFYMROZLCWw== X-Received: by 10.233.237.20 with SMTP id c20mr34886533qkg.144.1490140281623; Tue, 21 Mar 2017 16:51:21 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Tue, 21 Mar 2017 16:51:20 -0700 (PDT) In-Reply-To: <20170321131514.GA9342@bolet.org> References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <20170321131514.GA9342@bolet.org> From: Martin Thomson Date: Wed, 22 Mar 2017 10:51:20 +1100 Message-ID: To: Thomas Pornin Cc: "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 23:51:24 -0000 Thanks Thomas, inline responses. On 22 March 2017 at 00:15, Thomas Pornin wrote: > Therefore, I propose to replace this paragraph: > > An endpoint that has no limit on the size of data they receive can > set this value to any value equal to or greater than the maximum > possible record size, such as 65535. A larger value does not allow > the endpoint to send larger records than the protocol permits. An > endpoint that receives a value larger than the maximum defined in > the protocol MUST NOT exceed protocol-defined limits. For TLS 1.3 > and earlier, this limit is 2^14 octets. > > with the following: > > An endpoint that supports all sizes that comply with the > protocol-defined limits MUST send exactly that limit as value for > maximum record size (or a lower value). For TLS 1.3 and earlier, > that limit is 2^14 octets. Higher values are currently reserved for > future versions of the protocol that may allow larger records; an > endpoint MUST NOT send a value higher than 2^14 unless explicitly > allowed by such a future version and supported by the endpoint. > > When an endpoint receives a maximum record size limit larger than > the protocol-defined limit, that end point MUST NOT send records > larger than the protocol-defined limit, unless explicitly allowed by > a future TLS version. Added, tweaked a little: https://github.com/martinthomson/tls-record-limit/commit/62a5ef2306c123394b4045913b81aee9f529dd90 (My original thought was that perhaps we could keep this orthogonal to any potential extension that tweaked the maximum size, but this has the same effect with less ugliness.) > Of course, larger-than-16384 records are not meant for constrained > systems, but for big systems. Overhead for 16384-byte records with > ChaCha20+Poly1305 is 21 bytes (for AES/GCM in TLS 1.2, this is 29 > bytes), i.e. less than 0.2%, which seems small enough to me; but there > still is some demand for larger records, so it makes sense not to > prevent them from ever happening with tighter wording. Note that the main reason cited for having larger records is not the size overhead (as you say, that's negligible), but the processing overheads associated with processing each record. Willy Tarreau gave a great presentation at a workshop a while ago showing how moving between different layers of his stack had a material effect on performance. Larger records means doing any per-record processing less often. > Another point which was made is that CBC cipher suites have a > variable-length padding, up to 256 bytes (length byte + padding), which > is not fully negligible: an endpoint with a 500-byte buffer would have > to send a "maximum record size" of 223 bytes only, in order to fully > support AES/CBC+HMAC/SHA-256 in all cases, while in practice most if not > all endpoints will stick to minimal-sized paddings. Maybe there should > be some extra wording saying that when a "maximum record size" was > received, with a value less than the protocol-defined limit, then an > endpoint SHOULD strive to use minimal-sized padding in cipher suites > that have a variable-sized padding. Yeah, the hazard there is that they don't minimally pad and then you have no real recourse if you haven't reserved space for the extra padding. If you are going to do that, you need to make it a MUST I think. I didn't want to do this, because it's basically a prohibition on any sort of padding-for-traffic-analysis-resistance (lame though it might be). So we have a trade-off. I think that your suggestion is probably OK, though that means making the limitation obvious. > This would be only for the benefit of CBC cipher suites with TLS 1.2 and > earlier, not for TLS 1.3, because recent AEAD cipher suites have > predictable (and small) overhead. Well, in TLS 1.3 any padding is counted, so requiring minimal padding at the cipher level would be possible even if the cipher required some padding. > Arguably, pre-TLS-1.3 versions also have problem with compression, which > should be in all generality avoided, just like CBC cipher suites should > also be avoided. Maybe this is not a problem after all, and constrained > systems that are recent enough to implement this new extension will also > "naturally" avoid CBC cipher suites anyway. (In any case, if an endpoint > requires small records, then it cannot really talk with peers that don't > support the proposed maximum_record_size extension, so it needs recent > implementations that _should_ already implement at least TLS 1.2 and > some AEAD cipher suites.) Yes, I think that I ultimately decided that I didn't care enough to solve this problem for block ciphers and I would let someone who cared about them propose the solution that best suits them. From nobody Tue Mar 21 16:59:02 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A3DE1293E9 for ; Tue, 21 Mar 2017 16:59:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NRqSChQ9F8B5 for ; Tue, 21 Mar 2017 16:58:58 -0700 (PDT) Received: from mail-qt0-x234.google.com (mail-qt0-x234.google.com [IPv6:2607:f8b0:400d:c0d::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 681C8128708 for ; Tue, 21 Mar 2017 16:58:58 -0700 (PDT) Received: by mail-qt0-x234.google.com with SMTP id n21so143389438qta.1 for ; Tue, 21 Mar 2017 16:58:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=WkEoaJMOH5BDGFdlZtMoG+kUqEsGsQwc2T4BFr/4hec=; b=eHy9jj0qRcgx9mhvtrNf+Zihrn/SD6Y5x7d3K4mIj/2UZAvuIObd97ozjcWhl3Eg5W mH2nnGAnGqCAbNa57z69uspVeLEOE5Gwkp1FrJcw4fVigCx5IcHaMA/SiVW776SGs0i/ O7QV7lfWRL6nN/3DqDx8TJy8hR1OjMkFT06xnW23HG+bNnSVaV95nVMkIdfFdCOSwOTV HYg+Eryio6aOF8j9TwbW1D4rGB8FZPz4uUtc/DfAt2cr6x5H/b10Wl5L6jh+egsJTx50 fHxF6lnE94TrJ5bOREUWeP0R5jfQ87XzAdvHjRhKXq78uXnIy+rFPxNXi6yYuly0M/QX Djzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=WkEoaJMOH5BDGFdlZtMoG+kUqEsGsQwc2T4BFr/4hec=; b=Z/47e8MZ+s96YF97FjPgLZDwp8DWOMcMXUjAeajMW17riHJjSvEwSXrEURmqhOKT3N MIbDyYMl0B5hzPIgJ19/Hof7bZHKznHs+NTWdwdaEhik4meiMHyYq56FZMZ80cwD2jsy zgQqgU2afHSpbAenjTVZL8Mb/T5K4FJuMf80trPrWr43ywOlnOTonY7bw2x39bdchp80 dQR0Dz3D6cS/UDx2DY/J1Uzfl5Ve4WZvXuSTy/EjUrfRa3N9pCvTcjtqf1eqEsibepOF 9Xmgeq/acemWjGCC0S5yI4w0u3KgFPXaVFLgAnvPpzBUWP+twRZCpV5jEnCnBY5T3xLr DuTg== X-Gm-Message-State: AFeK/H3zwF8bGCXxo/h5mgHowcF/QygOS67mJWXBixJ3GHstA1hdEotbCi2HN6IFmzhGlFt3bMqq+jKwK/wnuw== X-Received: by 10.237.51.5 with SMTP id u5mr38416990qtd.247.1490140737640; Tue, 21 Mar 2017 16:58:57 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Tue, 21 Mar 2017 16:58:56 -0700 (PDT) In-Reply-To: <1490103123694.3164@cs.auckland.ac.nz> References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <20170321131514.GA9342@bolet.org> <1490103123694.3164@cs.auckland.ac.nz> From: Martin Thomson Date: Wed, 22 Mar 2017 10:58:56 +1100 Message-ID: To: Peter Gutmann Cc: Thomas Pornin , "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Mar 2017 23:59:00 -0000 On 22 March 2017 at 00:32, Peter Gutmann wrote: > I'd earlier thought of suggesting that the record length be the ciphertext > length, not the plaintext length, but wasn't sure if there'd be much support > for it. Yep, you thought right. I considered the same thing, investigated what it would take to implement and found that it would be awful. The code that deals with record splitting doesn't know anything about the specific cipher suite right now. It would have to be taught about the expansion, because without that information it would potentially send a packet for encryption and then discover that it got too big in the process and start over. When compression is enabled, I can't imagine what it would do. Implementing a limit on pre-encryption data turns out to be pretty trivial, because you change a constant (2^14) into a variable (record_size_limit). You are right that choosing the encrypted size makes setting the value easier, but that moves the effort to the wrong place. The constrained device is the one that cares about this, so it can be the one to spend the effort choosing the right value. Move the effort somewhere else and you will find that fewer non-constrained devices will bother implementing the extension. From nobody Tue Mar 21 17:10:15 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3FB49129409 for ; Tue, 21 Mar 2017 17:10:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uukNTyfRM1uf for ; Tue, 21 Mar 2017 17:10:11 -0700 (PDT) Received: from mail-yw0-x232.google.com (mail-yw0-x232.google.com [IPv6:2607:f8b0:4002:c05::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1D9641241FC for ; Tue, 21 Mar 2017 17:10:11 -0700 (PDT) Received: by mail-yw0-x232.google.com with SMTP id p77so119874729ywg.1 for ; Tue, 21 Mar 2017 17:10:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=CVVLwZjKJL68rAnexQ/8/OvZ1QlxN7XTsSI+InxaUow=; b=l6x6TwSqAesCqWEl0X2G9Ex9QmQDYtsVjzPK6czD6o4dkRmANX00Lx71Xv9aYzMKtv ATU8j6F86yfdObLizwoQ4WInfIDWvy3aVdLNaXTRv7L1vhL2iuH/l4KALba+5mpCz+eu 6HAlh0VF6goPRcYrLGROOQl6Fh3XXpZsllqnkQBfQ/frfL5/3jnQKBdarHoRmrBBDsBr 2CgWans8kXYgpb7On5igp98oNLp8D80QxlM79OgxJpRE80Y5rfj2zHtbdJUcgZUVUgXC yu0jOyybRBQOgV6wcuxhXnIfTx8d35y5KncNAJrz0LvksnrZDyWZ77AJlW3hnACoYjqO PlrA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=CVVLwZjKJL68rAnexQ/8/OvZ1QlxN7XTsSI+InxaUow=; b=Puk9RFULHB20mTAH/W1NktaAkTmDglLCr3OEh1bzp5HFu5HB/AW8UNBT8JP8iN2FCD g42hYkPRwkJbbDSWALsvezEG6h/MLstAqSX1uEqZzJRZ9jy+J193wSKejVMZSKblwMtw 7vpJE2eNMFDQu+eEga+4ymMyZum+wR88mzRCjPN86+hi2RWBtabEktkfGvThbcUIMXTs o0afZ+wsyoPszFRogzBG58+Gt7xBeQXvoetcMtBjjU9L2lOJagQU1W/aEPXpe3xZ9mT2 9OZDUIo/zTGa9rynKCoJXxx4bpmO81TydhMfq8pkmNUciNP3tRbCg/+AxkW8KBBw4Uts 4AvQ== X-Gm-Message-State: AFeK/H2H8kbOGKh8IyIxf9QnrmBeqsTNPWg+5aOesWrWiYF5eAw0E9o1yAorX/o2MwylVZC0/iOxMM4OT+EBtQ== X-Received: by 10.13.250.67 with SMTP id k64mr21616617ywf.125.1490141410377; Tue, 21 Mar 2017 17:10:10 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Tue, 21 Mar 2017 17:09:29 -0700 (PDT) In-Reply-To: References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <20170321131514.GA9342@bolet.org> <1490103123694.3164@cs.auckland.ac.nz> From: Eric Rescorla Date: Tue, 21 Mar 2017 17:09:29 -0700 Message-ID: To: Martin Thomson Cc: Peter Gutmann , "tls@ietf.org" Content-Type: multipart/alternative; boundary=94eb2c07f34a6e4b49054b4695a1 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 00:10:13 -0000 --94eb2c07f34a6e4b49054b4695a1 Content-Type: text/plain; charset=UTF-8 On Tue, Mar 21, 2017 at 4:58 PM, Martin Thomson wrote: > On 22 March 2017 at 00:32, Peter Gutmann > wrote: > > I'd earlier thought of suggesting that the record length be the > ciphertext > > length, not the plaintext length, but wasn't sure if there'd be much > support > > for it. > > Yep, you thought right. I considered the same thing, investigated > what it would take to implement and found that it would be awful. I don't feel strongly about this, but... > The > code that deals with record splitting doesn't know anything about the > specific cipher suite right now. It would have to be taught about the > expansion, because without that information it would potentially send > a packet for encryption and then discover that it got too big in the > process and start over. Couldn't you just use the maximum expansion you support (which ought to be 16 for TLS 1.3). > When compression is enabled, I can't imagine > what it would do. > I feel like we could ignore this, and just say "don't do compression" -Ekr Implementing a limit on pre-encryption data turns out to be pretty > trivial, because you change a constant (2^14) into a variable > (record_size_limit). > > You are right that choosing the encrypted size makes setting the value > easier, but that moves the effort to the wrong place. The constrained > device is the one that cares about this, so it can be the one to spend > the effort choosing the right value. Move the effort somewhere else > and you will find that fewer non-constrained devices will bother > implementing the extension. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --94eb2c07f34a6e4b49054b4695a1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Tue, Mar 21, 2017 at 4:58 PM, Martin Thomson <<= a href=3D"mailto:martin.thomson@gmail.com" target=3D"_blank">martin.thomson= @gmail.com> wrote:
On 22 March 2017 at 00:32, Peter Gutmann <pgut001@cs.auckland.ac.nz> wrote:
> I'd earlier thought of suggesting that the record length be the ci= phertext
> length, not the plaintext length, but wasn't sure if there'd b= e much support
> for it.

Yep, you thought right.=C2=A0 I considered the same thing, investiga= ted
what it would take to implement and found that it would be awful.=C2=A0

I don't feel strongly about this, but...<= /div>

=C2=A0
The
code that deals with record splitting doesn't know anything about the specific cipher suite right now.=C2=A0 It would have to be taught about the=
expansion, because without that information it would potentially send
a packet for encryption and then discover that it got too big in the
process and start over.=C2=A0

Couldn't = you just use the maximum expansion you support (which
ought to be= 16 for TLS 1.3).

=C2=A0
When compression is enabled, I can't imagine
what it would do.
=C2= =A0
I feel like we could ignore this, and just say "don'= t do compression"

=C2=A0-Ekr

Implementing a limit on pre-encryption data turns out to be pretty
trivial, because you change a constant (2^14) into a variable
(record_size_limit).

You are right that choosing the encrypted size makes setting the value
easier, but that moves the effort to the wrong place.=C2=A0 The constrained=
device is the one that cares about this, so it can be the one to spend
the effort choosing the right value.=C2=A0 Move the effort somewhere else and you will find that fewer non-constrained devices will bother
implementing the extension.

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--94eb2c07f34a6e4b49054b4695a1-- From nobody Tue Mar 21 17:21:24 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7B91130134 for ; Tue, 21 Mar 2017 17:21:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0OICw8BGksfd for ; Tue, 21 Mar 2017 17:21:21 -0700 (PDT) Received: from mail-yw0-x235.google.com (mail-yw0-x235.google.com [IPv6:2607:f8b0:4002:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 514BD13012A for ; Tue, 21 Mar 2017 17:21:21 -0700 (PDT) Received: by mail-yw0-x235.google.com with SMTP id v198so119965612ywc.2 for ; Tue, 21 Mar 2017 17:21:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=Z7YDXJbVfVr5c8Mtu5DRRO7zu5k9T3aCGL1hzseR6eI=; b=NwHfgsyGXdNNYCSDcVtOKTnLABWB07yJ4bUc91uw+O7+kVxVjdlMMRYKC1nZwByvjf 5ERBD5fGYrqXEfoKJeNiaJ5gyWeL47eOYitqTCJiIaklJvoahVW1kE7VxU4gaUWY1vKy nJn7Ur2k66mHUMu2YPJWbJu5G0roMHqm9wTRyy+0rurgS/6U851E6U7dK9OPIi1KKjbU O9mRW8mLc4qFKzVMfkwWb0tug67oRZpiKtA8OCY8JfqwrJolhPp7x0bkCEoX0FbIG7Gs lwixDppxXc1LLoy3CjW/dlp+u+XjPBDNxrfj3F1U56B2I7fdypHOUBoXvWt84gLa/lmF Rgbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=Z7YDXJbVfVr5c8Mtu5DRRO7zu5k9T3aCGL1hzseR6eI=; b=EpFBsvsPvKnHDrI4QwWTgV4UYmHeBkWjBV++cY1yI8klgi3L4S6GVdYzpKcCy72Y6t 4/doR6nLocFZVi6DnoQS0ySEQQ4dT0m0MySCBrBahi0SkVMxOFXKVDKLYtC//p206tun nocxDvvr6gNKz8WOsac1HnV+dSF9hGwCL83uIY1DrC2z00RcF2w8az2VhTkKUNiRlvDB C+CJrAgG9MwHBp1hsFC8/ISYYTI0ch8GWDpdUgjXXUyNozBRjgyLWI9N61W8NnVNu+up Z/vbmJPTXDCQGmtY72yJxqtjNTHRY7HcC0iSwSi6tA2RvmtOL52rXiNx9bTrQdIIiX0j qiJQ== X-Gm-Message-State: AFeK/H3HA0Dn89GcJ+c3GU01Tah2vFzmUi/G+isNmV2qzb7alUocCEAntc8d5xi3TywiBJSIsP+4m9u2RDM+qw== X-Received: by 10.37.78.195 with SMTP id c186mr24978855ybb.180.1490142080359; Tue, 21 Mar 2017 17:21:20 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Tue, 21 Mar 2017 17:20:39 -0700 (PDT) From: Eric Rescorla Date: Tue, 21 Mar 2017 17:20:39 -0700 Message-ID: To: "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a113e88fa5d7e5d054b46bd71 Archived-At: Subject: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 00:21:23 -0000 --001a113e88fa5d7e5d054b46bd71 Content-Type: text/plain; charset=UTF-8 SUBSTANTIVE Servers receiving a "dnssec_chain" extension in the client hello, and which are capable of being authenticated via DANE, SHOULD return a serialized authentication chain in the Certificate message, using the format described below. The authentication chain will be an extension to the certificate_list to which the certificate being authenticated belongs. In TLS 1.3, the extensions are attached to the certificates, so you need to say which one. I assume end entity. You could also shove this in EncryptedExtensions, one supposes. EDITORIAL You should replace "client hello" with ClientHello throughout. -Ekr --001a113e88fa5d7e5d054b46bd71 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
SUBSTANTIVE

=C2=A0 =C2= =A0Servers receiving a "dnssec_chain" extension in the client hel= lo, and
=C2=A0 =C2=A0which are capable of being authenticated via= DANE, SHOULD return a
=C2=A0 =C2=A0serialized authentication cha= in in the Certificate message, using the
=C2=A0 =C2=A0format desc= ribed below.=C2=A0 The authentication chain will be an
=C2=A0 =C2= =A0extension to the certificate_list to which the certificate being
=C2=A0 =C2=A0authenticated belongs.

In TLS 1.3,= the extensions are attached to the certificates, so you
need to = say which one. I assume end entity. You could also shove
this in = EncryptedExtensions, one supposes.


= EDITORIAL
You should replace "client hello" with Client= Hello throughout.

-Ekr

--001a113e88fa5d7e5d054b46bd71-- From nobody Tue Mar 21 17:44:08 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2E7C12940A for ; Tue, 21 Mar 2017 17:44:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S1c3nJE7qfik for ; Tue, 21 Mar 2017 17:44:05 -0700 (PDT) Received: from mail-qk0-x229.google.com (mail-qk0-x229.google.com [IPv6:2607:f8b0:400d:c09::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D987C1292F4 for ; Tue, 21 Mar 2017 17:44:04 -0700 (PDT) Received: by mail-qk0-x229.google.com with SMTP id v127so148152842qkb.2 for ; Tue, 21 Mar 2017 17:44:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=3eE3xv2y2xCjX7VUOkW/HkOtcam9jKEFYKPcOZ406dA=; b=bhCik9gbeRjGQlsWvHkiYlUczIaN4Hs7sg0Sw7f/twq/QCqweCLXPTY2VbnrgG+UwF A6ZRi9NjVd8p0UZetvhVz9s+HR9AzfmQD+AsLQYFsYpHsnecyfrqa4aqZuRsoQxtNLI4 5EoOndylibIRaGS8w87SN5jeTgIRuFl9qCWtSKr+Lhgabq0sxv1P/Ou/Ppkq0EPw8/xF +5keBYnHCQeAzx3B29DNteuSMqGfZ10KwsqWsFdkk/rGD67BFF8HrV8CtWabVa6+eiWx cK97R3u3Ty0geKn0X0jF/tLkwBD3YAlT7p7pBRu3U5ikPHuW3v3aY5Lm6/PfDUevS+76 eGcA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=3eE3xv2y2xCjX7VUOkW/HkOtcam9jKEFYKPcOZ406dA=; b=AOH9YMLigb/Hg/lwvthe3/zM8VJSF/U/VJB6fTLvLrlNdCELTeGGbheXmbFW/4Scj+ gtUX1eBDGuaEtAG2+2y/XV3bjVK0c3sQ4RNe+qeyFGLv1U+HwhZxW/auIzD9G/1lgQC2 cFUcS4PtDnGmmMX4kVBgqrMASDrT91O5y3xynPtLwstL7gyPilBmDJwRoyDcs5dUtZcY u/klUXDdVpy3w3uTMR4DtJ8fjXfN1uOY63eLDHInEIdbpdo6NK3tsuA7REV/1hvPY8x6 xhfeOox9fWajtQvFN5Tx4Q37zVi3bRKxFg5N9tTS1HRCNpocRLaJwNjEGLe+2NioitLo kcVQ== X-Gm-Message-State: AFeK/H0LeoNLzifm/qIWcx8hntWFRyyQsRsSVUNBn+FKLoSqZLdOg/SlWQpKWkW6aajOokLjIQLl/ZBrumyTIQ== X-Received: by 10.55.5.146 with SMTP id 140mr36352784qkf.202.1490143444107; Tue, 21 Mar 2017 17:44:04 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Tue, 21 Mar 2017 17:44:03 -0700 (PDT) In-Reply-To: References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <20170321131514.GA9342@bolet.org> <1490103123694.3164@cs.auckland.ac.nz> From: Martin Thomson Date: Wed, 22 Mar 2017 11:44:03 +1100 Message-ID: To: Eric Rescorla Cc: Peter Gutmann , "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 00:44:06 -0000 On 22 March 2017 at 11:09, Eric Rescorla wrote: > Couldn't you just use the maximum expansion you support (which > ought to be 16 for TLS 1.3). That leads to the same problem that we're trying to avoid, namely that your usable space goes through the floor. >> When compression is enabled, I can't imagine >> what it would do. > > I feel like we could ignore this, and just say "don't do compression" Already done, in the spec. But not the code :( From nobody Tue Mar 21 18:02:34 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6639E1292F4 for ; Tue, 21 Mar 2017 18:02:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lpwaPFBLniKe for ; Tue, 21 Mar 2017 18:02:31 -0700 (PDT) Received: from mail-ot0-x22c.google.com (mail-ot0-x22c.google.com [IPv6:2607:f8b0:4003:c0f::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1FD391287A3 for ; Tue, 21 Mar 2017 18:02:31 -0700 (PDT) Received: by mail-ot0-x22c.google.com with SMTP id i1so162139015ota.3 for ; Tue, 21 Mar 2017 18:02:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=pWAfZRVEOUTgOCdNIw8htyzp1LEaRCU0ca9G5brh5gg=; b=HPiwXzxkbuqRK6TvluB+SQ5Lo/dKKQxVDzq/S9E6h0dqx9RbNWCXiVHIA9+z+vAq39 vB6uUWkOGiUwfyxhMTXFfa7+Ce7A8UytqoS3Opo25cP1N2f7bu3OmVRw38PffhFW4ROr 6UbXEsaudRgWYLl8KGceB+fgfg6mLI4eVeQvLyh9pcJNnnHBBVfiXCfXFF0vtprgI9Wg C6kiKx8UGXu+0KyqC8tLmOOt4UAOTHiWw8FjKlpDkrYHzjODZaZTk1TTFNJvtZ4hseWO xtAg+p0+FNPZwre7bQ3t2U7vBSf2+tfFh0vnYZ1a7QTjIxgAAOi4uTGuMO9rPJ1IEmrt Ae9Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=pWAfZRVEOUTgOCdNIw8htyzp1LEaRCU0ca9G5brh5gg=; b=Kek6Ybyf41rj184IrqkRwPsDOPlws1sz5iFmzdEJA1jBpcDuCy7649EwHpnHXwG1Bg hyhTic/dlW1KAxHlW41CQNAa97JQ2NdLZ3X+rIPsk8fT38pbwLERJm16FdNBcAXbJ5gP jpLOskB8pCb9m02Yqma4qRj6eF0315SJo9DtdHTxhKeKtAUNFDdeGXHU6I1sRqKIC0Hm DVgilXJwn/E0ndVwbBHbZqc8Z5IKhJYkSIT0wksFPNKbQ6z/SIWVF2cgLTjwgDo/LH76 xIzHPZaHMpspR+wAVXeSbe9lygUvtKVmh92DNEVWMuBQjpJ/i/8lgNgBw3+X2qt58ejr MiyQ== X-Gm-Message-State: AFeK/H339K3x3MsfKNTMA1aFZOAiKCgvxNGbcvKJWBesKVxWw5ImuHAS27stwLChpmO9ivvp4XGJ76kT6GdwdA== X-Received: by 10.157.46.133 with SMTP id w5mr18569395ota.78.1490144550516; Tue, 21 Mar 2017 18:02:30 -0700 (PDT) MIME-Version: 1.0 Received: by 10.157.13.167 with HTTP; Tue, 21 Mar 2017 18:01:49 -0700 (PDT) In-Reply-To: References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <20170321131514.GA9342@bolet.org> <1490103123694.3164@cs.auckland.ac.nz> From: Eric Rescorla Date: Tue, 21 Mar 2017 18:01:49 -0700 Message-ID: To: Martin Thomson Cc: Peter Gutmann , "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a1135bf5298ff55054b475077 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 01:02:32 -0000 --001a1135bf5298ff55054b475077 Content-Type: text/plain; charset=UTF-8 On Tue, Mar 21, 2017 at 5:44 PM, Martin Thomson wrote: > On 22 March 2017 at 11:09, Eric Rescorla wrote: > > Couldn't you just use the maximum expansion you support (which > > ought to be 16 for TLS 1.3). > > That leads to the same problem that we're trying to avoid, namely that > your usable space goes through the floor. > I'm not quite sure I'm following. In the extension we say "You can send up to X bytes" and X can either be expressed in plaintext or ciphertext bytes. If we express it in ciphertext, then senders can totally safely marshall up to X - E_max bytes of plaintext where E_max is the maximum expansion of any cipher suite they support. The maximum amount of wastage in this case is E_max - E_min where E_min is the minimum amount of expansion of any cipher suite they support. If E_min == E_max, then this is fine (because you can just advertise X + E_max to hit a target of X). What am I missing? -Ekr > > >> When compression is enabled, I can't imagine > >> what it would do. > > > > I feel like we could ignore this, and just say "don't do compression" > > > Already done, in the spec. But not the code :( > --001a1135bf5298ff55054b475077 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Tue, Mar 21, 2017 at 5:44 PM, Martin Thomson <<= a href=3D"mailto:martin.thomson@gmail.com" target=3D"_blank">martin.thomson= @gmail.com> wrote:
On 22 March 2017 at 11:09, Eric Rescorla <ekr@rtfm.com> wrote:
> Couldn't you just use the maximum expansion you support (which
> ought to be 16 for TLS 1.3).

That leads to the same problem that we're trying to avoid, namel= y that
your usable space goes through the floor.

I'm not quite sure I'm following. In the extension we say "= You can send up to X bytes"
and X can either be expressed in= plaintext or ciphertext bytes. If we express it
in ciphertext, t= hen senders can totally safely marshall up to X - E_max bytes of plaintext<= /div>
where E_max is the maximum expansion of any cipher suite they sup= port.

The maximum amount of wastage in this case i= s E_max - E_min where E_min is
the minimum amount of expansion of= any cipher suite they support. If E_min =3D=3D E_max,
then this = is fine (because you can just advertise X + E_max to hit a target of X).

What am I missing?

-Ekr
=C2=A0

>> When compression is enabled, I can't imagine
>> what it would do.
>
> I feel like we could ignore this, and just say "don't do comp= ression"


Already done, in the spec.=C2=A0 But not the code :(

--001a1135bf5298ff55054b475077-- From nobody Tue Mar 21 18:22:15 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A573D129420 for ; Tue, 21 Mar 2017 18:22:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nomountain-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 39cFBd0e9pEX for ; Tue, 21 Mar 2017 18:22:13 -0700 (PDT) Received: from mail-pg0-x234.google.com (mail-pg0-x234.google.com [IPv6:2607:f8b0:400e:c05::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 595291292F4 for ; Tue, 21 Mar 2017 18:22:13 -0700 (PDT) Received: by mail-pg0-x234.google.com with SMTP id g2so100940375pge.3 for ; Tue, 21 Mar 2017 18:22:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nomountain-net.20150623.gappssmtp.com; s=20150623; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to; bh=3/bGai6jRj72KHMvmwiV5VkHTH2YbVqBp4wa9G18sTY=; b=0scNRS7duXCYHZFQ5lS7bPmW6P2aAhM6fCWmUXS+4SPXfYwvASEklKFxqK/2mU9OEP +s3zi+PKzJiDjUAZgE25Ku4Azk9NAPt8juXj1pFwh+p4AA1/kW/2jBxtqPiZw6qjqqe1 i2SCVMXpA1KC0GSHZTslJXRurdPdL7F/8NJ+t6Hb3N0moXe/QN79Y+g78oFz2QmSQQYe 9bW1W2W+H6AwqEo87DVlg+5vzq4QP5jvz1kkWbiPPSyzE2Gfnxg8/bj0hjFmxQyx6p9O rgUPEbiGUfugdtV5Zgxn5BTmtcUGmj/Rjk3kqhpnSHfx4JVQDyw5OUqjVfBZTn7S9ZAJ AjEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to; bh=3/bGai6jRj72KHMvmwiV5VkHTH2YbVqBp4wa9G18sTY=; b=QKW21roXz0JlltHLetZ4F/pgx1argCArYlASDqaEargeP8mS75bJUY/+7yTccc+8Dw a9+758bBk8Yf1d2RRD7kbx0j5KxvGUJqti7CQ4fg+i93Wdki7yrAGfBj75YB6bdDi5Wb sFPClmUilyNtkjAZSzNmd/RCrclJ8bNrPMF4j9qdLApTFky6dJPc/kcaSGqN8XSaDyNl DWMOfg0J0P2FBnaC4+mu411XyQowjuAVl0Wd7z7eBd0j6YFTAa8gNHBB9QVq2tCMB6Dk oYCAnvw+08KBL5SpfuFUIUwGLxVHdQGCirD9/LI/ntbWMRiimW/I0+CcYmE+L/xdLX8E 5lBQ== X-Gm-Message-State: AFeK/H3jcLW42HZ46KK0BaqxaNMVLsqNW+MyjQVcbI/3XX+JwlbTtWiBVfwDG1rYKl4b1w== X-Received: by 10.98.70.28 with SMTP id t28mr43177140pfa.176.1490145732737; Tue, 21 Mar 2017 18:22:12 -0700 (PDT) Received: from Melindas-MacBook-Pro.local (216-67-23-199-radius.dynamic.acsalaska.net. [216.67.23.199]) by smtp.gmail.com with ESMTPSA id q4sm23700064pgc.63.2017.03.21.18.22.11 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 21 Mar 2017 18:22:12 -0700 (PDT) To: tls@ietf.org References: From: Melinda Shore Message-ID: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> Date: Tue, 21 Mar 2017 17:22:08 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="xWwX2GPUL5LQkgwXT7jXhD4Wc4MbFeHhQ" Archived-At: Subject: Re: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 01:22:15 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --xWwX2GPUL5LQkgwXT7jXhD4Wc4MbFeHhQ Content-Type: multipart/mixed; boundary="0HClPSWqlmmCFrLV0nrIGIxLOkWjBNb9H"; protected-headers="v1" From: Melinda Shore To: tls@ietf.org Message-ID: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> Subject: Re: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt References: In-Reply-To: --0HClPSWqlmmCFrLV0nrIGIxLOkWjBNb9H Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 3/21/17 4:20 PM, Eric Rescorla wrote: > SUBSTANTIVE >=20 > Servers receiving a "dnssec_chain" extension in the client hello, an= d > which are capable of being authenticated via DANE, SHOULD return a > serialized authentication chain in the Certificate message, using th= e > format described below. The authentication chain will be an > extension to the certificate_list to which the certificate being > authenticated belongs. >=20 > In TLS 1.3, the extensions are attached to the certificates, so you > need to say which one. I assume end entity. You could also shove > this in EncryptedExtensions, one supposes. >=20 >=20 > EDITORIAL > You should replace "client hello" with ClientHello throughout. Thanks, EKR. I've updated the draft based on these comments and will submit it once submissions reopen. Melinda --0HClPSWqlmmCFrLV0nrIGIxLOkWjBNb9H-- --xWwX2GPUL5LQkgwXT7jXhD4Wc4MbFeHhQ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJY0dHBAAoJELiGRpM6HoEuiNoQAK2vuARH0dMMZJ5e0bfAuUnN l+e+gFIXOjBIj000FqVg90b8jBvxJC75ZGXrWjAWRnm/VH6TZ454QSHOEn7aQebH tg8DtlMNUk365KSw+CNNgqhYJNXIn6Egbdmr7JUN4zZ6IFtHklbeQcDFVBJMe2bG 0o8ZFdcuWhbcHWKQr8GWMmhjYj13ZXcBp5MFNa8hantvdkUmcXYF4eQvDBGtU4g/ NApECZKDiwBAK5FtQT6iLmIliURzuQa/cdYfD53hW52JpOIAO5J+3oKKqVmCxUyH BQjH45JKu28+FyvQhriFy+lTCLFebUrgVDKjxw0tyEi26Vz3ho0qd6ezRboRDc4p SXpKnWXYFMKrWernoZecr6kwmJUuNzXPhWUy/N5IQBKmIoEvrHATcfoLS/KaSzDZ LbwsI97ee5S2dllUnsti9/Zmgtvo9CAgC9mec7My7hlDJUHnQ5eZyylsxVDx9EIa Wyq24WhXYUlAxsjwXP3HK5BmS8FRdl3SNaEqwUDcHE/3r7oHXFpDx5IrJuSoHKJr zqehSKeympRHYZEhXUJYhsRn53wYFcuiqx6KgyFBA4dzVss5tMcCQbF11a7DiFb3 lh+kDED0wB9Gt9ALVpe+d+Io6AK4yQqmGz4FrRoGqXj6oNRrsfiz7yVKmrNe0rt6 +LTogzLYI2f353s56+Tv =FCli -----END PGP SIGNATURE----- --xWwX2GPUL5LQkgwXT7jXhD4Wc4MbFeHhQ-- From nobody Tue Mar 21 19:04:02 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4874712941A for ; Tue, 21 Mar 2017 19:04:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bSaOB0pL_IUc for ; Tue, 21 Mar 2017 19:03:59 -0700 (PDT) Received: from mail-qt0-x232.google.com (mail-qt0-x232.google.com [IPv6:2607:f8b0:400d:c0d::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BFECD126BF7 for ; Tue, 21 Mar 2017 19:03:59 -0700 (PDT) Received: by mail-qt0-x232.google.com with SMTP id x35so144450511qtc.2 for ; Tue, 21 Mar 2017 19:03:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=41xUb27TN/ZsXxaNp4HiE3F8EYbw5ls+tPfZMNWA5O4=; b=saB3K0gvBCeSg4PpM3MiG6zCAnz3LUZMLgUmz7g/2QpGf14qj19wU81G7du1D9IRIl w4RnWgzpAfLGPqjpz/ZTlrnaSM3/Fsh8pXGc0ofAaOfEwne7Yvt88nW2Ph90Ei8zn3je Q+58EUsn1VyIjTJ9ZMOb3l7qQCXmx7OTrcIitCsTDuT1EjNTaVWtDq1ZicuLwIidpvb5 mkk1hz2qRIqtzDiHORIA1y3xCB8/gnQhZirRdXLdhpeH0U5Y2gGBHnU8uD4QDlIRyPHZ f8jEWCXnbglnbZc1peoqO4yV28OatsVmo6yexlWF+vKZX168BUjEBDrHWb/HyOF1w7pd 3d3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=41xUb27TN/ZsXxaNp4HiE3F8EYbw5ls+tPfZMNWA5O4=; b=JwpykPwSPZewzw3fdBCDx/4e5EBKRzGI6OtcQzhI+U9tffhE5Rj8t4OFWCGIZKyy7r vk4lxuBqQxkUYFehaHkIqBQ53vPWF5BFx/B4PXg9vjGq7QL3XpAWswCm3TsqHf8A+3l2 ABMrwSa+Lx+OfiXB3C+Sxeh+t6/gh8CkVsZ7O4Z1o2P0Z4p/90aPNkn6w4xDxEkkemZE NFsgLT8LOP+aAAa+R48St5mzw5H3aFaHpsB9v3+Iiu1TjzbSg9qkTE6PkqfV6asuxHfD z2nGn/0zoNGn3cId9F0/GQxlupIz82DBQsmq9DSWRTsPGBbsr7bRfTed5r/19AK33fMn T8dA== X-Gm-Message-State: AFeK/H1XyBbmQexnb8/5Pul6SMIJD4SviMN4icGuknvyL+6UDVx3S2bLbtWfrqEOQBf6nHYhCjdd1m2Q+0wDEg== X-Received: by 10.200.46.208 with SMTP id i16mr35276048qta.13.1490148238921; Tue, 21 Mar 2017 19:03:58 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Tue, 21 Mar 2017 19:03:58 -0700 (PDT) In-Reply-To: References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <20170321131514.GA9342@bolet.org> <1490103123694.3164@cs.auckland.ac.nz> From: Martin Thomson Date: Wed, 22 Mar 2017 13:03:58 +1100 Message-ID: To: Eric Rescorla Cc: Peter Gutmann , "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 02:04:01 -0000 On 22 March 2017 at 12:01, Eric Rescorla wrote: > The maximum amount of wastage in this case is E_max - E_min where E_min is > the minimum amount of expansion of any cipher suite they support. Right, I was concerned about the case where this difference is (potentially) large. That's all. The main problem I see with a design that shifts complexity to the sender is the economic one. I want to provide as much incentive to implement the sender side of this as possible, which means keeping it simple. If the cost of that is a little more complexity on receivers, but only when using block ciphers, I think that I can live with that. Given that the complexity is likely more in logic than it is code, then I'm even more happy with what I've proposed. From nobody Tue Mar 21 19:54:02 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66796130889 for ; Tue, 21 Mar 2017 19:54:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t7uSQ6fG3H4x for ; Tue, 21 Mar 2017 19:54:00 -0700 (PDT) Received: from mail-yw0-x22d.google.com (mail-yw0-x22d.google.com [IPv6:2607:f8b0:4002:c05::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CC42412702E for ; Tue, 21 Mar 2017 19:53:59 -0700 (PDT) Received: by mail-yw0-x22d.google.com with SMTP id v198so121356710ywc.2 for ; Tue, 21 Mar 2017 19:53:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=RFaHgqYfPBxo46bi2E7Qe6PcfrDSHp6s+J4E9T5WBC0=; b=tSNblklwolEIqQ268aVgG6kKl2Inb9Snu+gJg6+KCSGFsvfZJQDiCiOv52XlY75bGS uqgz/Tu0CHZ3TLhlMXQhZFAKw2vWKGvPVR/X1kyJVd8EpPRwky1CE1jqrQ3el0uwDwkr O1n2l/ezAMzMFN8MJSWrbrhCD4g1msQzw/Ra+XO8huP9YIEQkrdrw+q4yAZMMWBk0JN2 qH2sniVn3PYIEEOlmrp9qns0+h3UUFSQ5mdhRy4kS5OtEZ5Ccq3Vsf2ErFU4y6MfjAQT /ZunbrnYQPc/HSQsKRo46AGb3KeGt62f57UfhtAmDT526RGm/coqjfEOOwKm0yBk8tNC onqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=RFaHgqYfPBxo46bi2E7Qe6PcfrDSHp6s+J4E9T5WBC0=; b=VuXOOAuIHH6lxBzB9Fjc6IAx5YBSZd0UMqwi6b1IulAVayWnuEY1+W+a/5lr55fG1L oH0cHq77vRU0ETsXwe2wLr4q8ECwlaUPZl5TekBHAFZ2lOgzovV8EbXJbtD9rizWXTYq Ltk93IDQY3LBE7SXpUUa4oelYm/PhXoUAnFElOGJLPhbHJwMjeCXj7E5aI3J6Hfq1LgS 7heVIBouajyN+7Ys0AHl+OzYZ1Fj2VexbGmDFlE2uEmmYKfW53ErP6HS+yjccT8spzds /BJcpvlNei9938F+1UZbObPaloh4SYuzhdDI5OWrg8fg9+RBHRlRZLdU1g5QcZi35bQi vR9A== X-Gm-Message-State: AFeK/H3+ZM/5Mjmv0d4Ny49bLetk21m0mjsrgPL019zxnxzgfohjbQ384n2EvmCUBOnd9hnej499sHToY92rAA== X-Received: by 10.37.201.196 with SMTP id z187mr26362829ybf.161.1490151239099; Tue, 21 Mar 2017 19:53:59 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Tue, 21 Mar 2017 19:53:18 -0700 (PDT) In-Reply-To: References: <1489706298995.98317@cs.auckland.ac.nz> <855C5079-FDA7-4E68-AE29-1E9605B495D7@broadcom.com> <1489707933992.42551@cs.auckland.ac.nz> <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <20170321131514.GA9342@bolet.org> <1490103123694.3164@cs.auckland.ac.nz> From: Eric Rescorla Date: Tue, 21 Mar 2017 19:53:18 -0700 Message-ID: To: Martin Thomson Cc: Peter Gutmann , "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a114d88ea44f52b054b48dfb3 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 02:54:01 -0000 --001a114d88ea44f52b054b48dfb3 Content-Type: text/plain; charset=UTF-8 On Tue, Mar 21, 2017 at 7:03 PM, Martin Thomson wrote: > On 22 March 2017 at 12:01, Eric Rescorla wrote: > > The maximum amount of wastage in this case is E_max - E_min where E_min > is > > the minimum amount of expansion of any cipher suite they support. > > Right, I was concerned about the case where this difference is > (potentially) large. That's all. > > The main problem I see with a design that shifts complexity to the > sender is the economic one. I want to provide as much incentive to > implement the sender side of this as possible, which means keeping it > simple. If the cost of that is a little more complexity on receivers, > but only when using block ciphers, I think that I can live with that. > Given that the complexity is likely more in logic than it is code, > then I'm even more happy with what I've proposed. > Sure, I don't think I really care, I just wanted to understand your reasoning. -Ekr --001a114d88ea44f52b054b48dfb3 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Tue, Mar 21, 2017 at 7:03 PM, Martin Thomson <<= a href=3D"mailto:martin.thomson@gmail.com" target=3D"_blank">martin.thomson= @gmail.com> wrote:
On 22 March 2017 at 12:01, Eric Rescorla <ekr@rtfm.com> wrote:
> The maximum amount of wastage in this case is E_max - E_min where E_mi= n is
> the minimum amount of expansion of any cipher suite they support.

Right, I was concerned about the case where this difference is
(potentially) large.=C2=A0 That's all.

The main problem I see with a design that shifts complexity to the
sender is the economic one.=C2=A0 I want to provide as much incentive to implement the sender side of this as possible, which means keeping it
simple.=C2=A0 If the cost of that is a little more complexity on receivers,=
but only when using block ciphers, I think that I can live with that.
Given that the complexity is likely more in logic than it is code,
then I'm even more happy with what I've proposed.

Sure, I don't t= hink I really care, I just wanted to understand your reasoning.

-Ekr

--001a114d88ea44f52b054b48dfb3-- From nobody Tue Mar 21 19:55:36 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0BD9212702E for ; Tue, 21 Mar 2017 19:55:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nYCmmZSX6yEd for ; Tue, 21 Mar 2017 19:55:33 -0700 (PDT) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9DC4E129435 for ; Tue, 21 Mar 2017 19:55:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1490151332; x=1521687332; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=rbYuADkBr6uFhYbvoetyvZkzPw3nbIxwS3IY3H/n+Mk=; b=j/DyLD97ic+VRbOYA1diMwG84Scu0UyTruwMJEIpfT0F0EiGBahYd8Jw 76yzli0YNaZ7APxDy5WyIRMRtwcEPcx2rNnsd6RzxhD53oM90JKiCnovR r8LpXF1zj+LvkeFc0PPNXp5qyK6U+fFo0CF9nuaZeLH2R/TvjEmTK9kmD bI7QRpNGKMpttAXoXv44va9S8HTiLhiiJXoY1s11VBc8VMxRGevNzc6/r 4G8UTn1DP/iBpTA0R82HnBhxF+Tx6RA+JXxAj/WW9SfLjRPv2l4+YG6bl EIBe30PcOIBshtZDPDT8dTxyZe7IVshDMLNhlMpcOFMWPMwI5bMNYZnhf A==; X-IronPort-AV: E=Sophos;i="5.36,202,1486378800"; d="scan'208";a="144659088" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.3.9 - Outgoing - Outgoing Received: from uxcn13-tdc-e.uoa.auckland.ac.nz ([10.6.3.9]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 22 Mar 2017 15:55:30 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-tdc-e.UoA.auckland.ac.nz (10.6.3.9) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Wed, 22 Mar 2017 15:55:30 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1178.000; Wed, 22 Mar 2017 15:55:30 +1300 From: Peter Gutmann To: Thomas Pornin , Ilari Liusvaara CC: "tls@ietf.org" Thread-Topic: [TLS] RFC 6066 - Max fragment length negotiation Thread-Index: AQHSnpUB8UgZsR1fnUWlpN1q8vk4DKGYGe7w//8q+oCAANxgO///LA8AgADcRWz//0AsAAAe+X57//8qVYCAACsrgIABIKju//8rnQCAAOBv1///S1IAgAAT2wCAAA7cgIAH4B0L Date: Wed, 22 Mar 2017 02:55:29 +0000 Message-ID: <1490151325506.25280@cs.auckland.ac.nz> References: <1489710142144.88978@cs.auckland.ac.nz> <1489721710740.52293@cs.auckland.ac.nz> <1489747107536.25854@cs.auckland.ac.nz> <1489749662616.94542@cs.auckland.ac.nz> <20170317133344.GA20310@bolet.org> <20170317144448.GB26550@LK-Perkele-V2.elisa-laajakaista.fi>, <20170317153759.GA22929@bolet.org> In-Reply-To: <20170317153759.GA22929@bolet.org> Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 02:55:35 -0000 Thomas Pornin writes:=0A= =0A= >TLS 1.3 is moving away from the IoT/embedded world, and more toward a Web= =0A= >world. This is not necessarily _bad_, but it is likely to leave some peopl= e=0A= >unsatisfied (and, in practice, people clinging to TLS 1.2).=0A= =0A= I would go slightly further and say that TLS 1.3 could end up forking TLS i= n=0A= the same way that HTTP/2 has forked HTTP. There's HTTP/2 for web content= =0A= providers and HTTP 1.1 for the rest of us/them (depending on your point of= =0A= view). Similarly, there are sizeable groups of users who will take a decad= e=0A= or more to get to TLS 1.3 (they're still years away from 1.2 at the moment)= ,=0A= or who may never move to TLS 1.3 because too much of their existing=0A= infrastructure is dependent on how TLS 1.x, x =3D 0...2, works. So as with= =0A= HTTP/2 we may end up with TLS 1.3 for web content providers and TLS 1.0/1.2= =0A= for everything else.=0A= =0A= Peter.=0A= From nobody Wed Mar 22 08:07:54 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A140D130133 for ; Wed, 22 Mar 2017 07:38:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vBM7zNIga8Kk for ; Wed, 22 Mar 2017 07:38:02 -0700 (PDT) Received: from mail-qt0-x22d.google.com (mail-qt0-x22d.google.com [IPv6:2607:f8b0:400d:c0d::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E43D131752 for ; Wed, 22 Mar 2017 07:37:43 -0700 (PDT) Received: by mail-qt0-x22d.google.com with SMTP id n21so154440596qta.1 for ; Wed, 22 Mar 2017 07:37:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=gNgDVr4O1AlXhhG2n3UWaLDq/lxYmxB9NIJAEfY1n7U=; b=k3tJ+hQXW8pl3g1cjC4FFJcoafesImR9+ANShs4AbWVBfGbVQ9AdTViw9Y+dLSv0lX 47Y1jiZb/GpzMcAF1Ag79a0XN5yn6zry7G0zlxOmPVyxGU07hzrbn6zbzLPqTlTSpTn4 wVRle8qK58bYZl1tDZEooatdouJiyCJvcieQU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=gNgDVr4O1AlXhhG2n3UWaLDq/lxYmxB9NIJAEfY1n7U=; b=jl3xxbzL0Muy/ba/4zd4ekp0sQF+lEg70c2kp88bxxzaK99+aNS2WtLnQXWb5BdK3n INqiUSEu75Ow8MtPPuY4lSa28qy3ciYY5twjKkDRzM494fAlqaCd0Sq3TvhhWZuMtIUo y3wUu8eB1Lr0RGahPkPT9EXhWBfGzN5s+Y9db2JBqY3saXeChKBrCLuRCrcggt058Mze MugM1M7XXhyj3DLHwTdQG1t3wGznF0EFllc6QTlu70liVjHgAZ5rB2UsuFq8Z3tE/S8w GkNTUb9OzuztrLpJoi5SsyXPYhaUpY/qCp1RqiP26w3/UE49V2336cy11YsP9ZazzhZj XPsw== X-Gm-Message-State: AFeK/H3+eU8uwtDtUhJJYJ+cYSltpF4VI1c5RXET4pf+VoR9o70Aa2DVnIkG4RkJAWZauw== X-Received: by 10.237.60.3 with SMTP id t3mr42341648qte.86.1490193462092; Wed, 22 Mar 2017 07:37:42 -0700 (PDT) Received: from [172.16.0.18] ([96.231.230.131]) by smtp.gmail.com with ESMTPSA id t12sm1100882qke.9.2017.03.22.07.37.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 22 Mar 2017 07:37:41 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Sean Turner In-Reply-To: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> Date: Wed, 22 Mar 2017 10:37:40 -0400 Cc: tls@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <54343047-7620-4A96-BD39-6E60AE7EA5A2@sn3rd.com> References: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> To: Melinda Shore X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 14:38:08 -0000 > On Mar 21, 2017, at 21:22, Melinda Shore = wrote: >=20 > On 3/21/17 4:20 PM, Eric Rescorla wrote: >>=20 >> EDITORIAL >> You should replace "client hello" with ClientHello throughout. >=20 > Thanks, EKR. I've updated the draft based on these comments and > will submit it once submissions reopen. Minor nits from me too: 0) s1 (just once): r/server hello/ServerHello 1) s3.3: Is the or X.509 containers in the following supposed to be like = otherwise known as X.509; it=E2=80=99s just that =E2=80=9CPKIX=E2=80=9D = kind of jumped out at me: is not limited to public keys encapsulated in PKIX or X.509 containers 2) s3.4: Should we refer to SNI Extensions as =E2=80=9Cserver_name=E2=80=9D= extension to match the registered value? You refer to this extensions = as dnssec_chain in previous sections (just trying to be all = matchy-matchy). spt From nobody Wed Mar 22 08:08:35 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F2C912949F for ; Wed, 22 Mar 2017 07:56:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nomountain-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZEfzBYqoL2bv for ; Wed, 22 Mar 2017 07:56:46 -0700 (PDT) Received: from mail-pf0-x22b.google.com (mail-pf0-x22b.google.com [IPv6:2607:f8b0:400e:c00::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB312126C25 for ; Wed, 22 Mar 2017 07:56:39 -0700 (PDT) Received: by mail-pf0-x22b.google.com with SMTP id o190so11928483pfo.0 for ; Wed, 22 Mar 2017 07:56:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nomountain-net.20150623.gappssmtp.com; s=20150623; h=subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to; bh=MvcEZekcqu4/Mcu6BANNET0FR4lGEHm7tSR/TgIAB0I=; b=wxiuJSmYVMjw2WaZ44vKE8vF3QgBvEUlrZwT+8Qn4WqRj9F2WkEDEfx7NPNAQBWDxW 2XGx2CgYTPeB++fkrl1Gt8+60NuHMlbl8aQq23rbfXnpUvKI79EpM7n83Djpq7R+ZIIz ytCaNIi3CfnkcnkzTkJZ9OMaZaFsD2JvvagFQYTB1A+Mp/HunCnbw9HQsWFxXwakeE8m nMSNULIzLG7Gasy3PJ4qq8NFj4LbUhuqesN7V9lS8i5b+3lMocw06Y9dzMwvAcp8Z91U /wMtyG5dJuk/8OJ2L3ErZ2Of6SQCo6UCmi3DqkjKx5EbVX4rNVka1zLGK7Ls+6VriF2W NGsQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to; bh=MvcEZekcqu4/Mcu6BANNET0FR4lGEHm7tSR/TgIAB0I=; b=NElacRMCMVkMs105JE8pSz0++OChn5JV/qaRUyJ0OcHn72vkz7f6+s87DJrKNNwACL i0AVLW4CZIFSAIkCM2za8Ompdem13zIr9HNHSNc8jB/KVHb9hzS/SE7RMFdyYmbeZT75 EhX3ytr8pu4k0SWwRqDlSNPIqn0amo5qKg5kE8ZWFUH6NWWTtMPpoIp1jZM1kZ2R3Jrl L9XdYoUKUA8Y7jHMOhjUbe7WMY9FdF3RK7fhUp797f20NBNZ+mMDks1grvMH7aTjikjy ANVRqxBbQVmj4s6jB2RuTczg+tBA3cGjwF5FbIQj2YJ82UHdIeFkh8rH11Wqtr+MtaLX RxtQ== X-Gm-Message-State: AFeK/H3LU2slBkF74j2gSdXhgG0zsVHGG9c6eN0bxWvyVpiNVXbaXKAnOexLkOVkZjeQ/A== X-Received: by 10.84.238.207 with SMTP id l15mr29971323pln.90.1490194599284; Wed, 22 Mar 2017 07:56:39 -0700 (PDT) Received: from Melindas-MacBook-Pro.local (66-230-100-107-radius.dynamic.acsalaska.net. [66.230.100.107]) by smtp.gmail.com with ESMTPSA id u75sm4634107pgc.31.2017.03.22.07.56.37 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 22 Mar 2017 07:56:38 -0700 (PDT) To: Sean Turner References: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> <54343047-7620-4A96-BD39-6E60AE7EA5A2@sn3rd.com> Cc: tls@ietf.org From: Melinda Shore Message-ID: <5f39565c-5417-b94f-f1e6-32261c473455@nomountain.net> Date: Wed, 22 Mar 2017 06:56:35 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: <54343047-7620-4A96-BD39-6E60AE7EA5A2@sn3rd.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="SnpF69J7AOcNuaGTGfpjrraubi7AaBfBG" Archived-At: Subject: Re: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 14:56:48 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --SnpF69J7AOcNuaGTGfpjrraubi7AaBfBG Content-Type: multipart/mixed; boundary="BCM4xPiEJibTllslHRmVgHGPhBktmfKBx"; protected-headers="v1" From: Melinda Shore To: Sean Turner Cc: tls@ietf.org Message-ID: <5f39565c-5417-b94f-f1e6-32261c473455@nomountain.net> Subject: Re: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt References: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> <54343047-7620-4A96-BD39-6E60AE7EA5A2@sn3rd.com> In-Reply-To: <54343047-7620-4A96-BD39-6E60AE7EA5A2@sn3rd.com> --BCM4xPiEJibTllslHRmVgHGPhBktmfKBx Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Thanks - I've updated those, as well. Our sense right now is that the pieces that need completion prior to going to working group last call are to add some pseudocode to clarify construction of the chain, and test vectors. The draft could definitely benefit from additional review. Thanks, Melinda --BCM4xPiEJibTllslHRmVgHGPhBktmfKBx-- --SnpF69J7AOcNuaGTGfpjrraubi7AaBfBG Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJY0pCkAAoJELiGRpM6HoEu5VYP/j5L9DbxRc0zj7uaJKFkOCXv p08COzk5E2axnknyUiVwEN9M4BrOn3ngQRbeEsIQzR3jDRgW9E6ROykUaUFOr02C ZAnODYdTx9+F/8BuHq+VrZWHzqi7CZcr0kdOsitWg9hkAUNbLshMDMiOeYbh2gD0 dwY++gz3inV1QPk2rgiwvCexSOAal1pfZPXZyJRRkHoW4kdjUvpPOB1zFFnc0woo 7KafHRPMRRJOFhyIiT1kVf+Zt4Daa5ruOFdtMOE4BstNge/U8rfOibcnme7E2ToH /74YvBhCO7XqZ42HK6BrptwcnTwMH1HmcQnbpMMVoW7gPS3QZ+SFwuHTMgYEz/jx Wxg3zDsM/nAd/JAle/yW00hPA12WtrWTjRWt7x7v18J/YoGS+B3uqiXex2/GbRfU 0jTA5UkUQfE+1lbYqOnypbw1S69jDUoz5jLzHhpu6ZGtpP6ssgwhM8AXJuLx/cv1 Gr8QphNSSXZTibg2e0+xhl2ppZK/7zXIxH1FJKON5J4pxN52dBGIza49suCUDr+A bUjnQBdKw8Dks6SYWxwDQwa59BO+z5Tte3vJb/OD86as94Z0Mtul6h8f70cMn9nM aw3S12X3tBIx1aiFY2r2UxN3K7gTPkt1Y2PhpLxivW+ZvrnoMky2x4oj5anoMT+l dfjPHvV7Gq9efDCCxqW+ =ioDO -----END PGP SIGNATURE----- --SnpF69J7AOcNuaGTGfpjrraubi7AaBfBG-- From nobody Wed Mar 22 08:15:18 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B9F4127369 for ; Wed, 22 Mar 2017 08:15:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B7uaeE1LgwdC for ; Wed, 22 Mar 2017 08:15:15 -0700 (PDT) Received: from mournblade.imrryr.org (mournblade.imrryr.org [108.5.242.66]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AB5491298C8 for ; Wed, 22 Mar 2017 08:15:09 -0700 (PDT) Received: from vpro.lan (cpe-74-71-8-253.nyc.res.rr.com [74.71.8.253]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mournblade.imrryr.org (Postfix) with ESMTPSA id F2A657A32F1 for ; Wed, 22 Mar 2017 15:15:08 +0000 (UTC) (envelope-from ietf-dane@dukhovni.org) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Viktor Dukhovni In-Reply-To: <5f39565c-5417-b94f-f1e6-32261c473455@nomountain.net> Date: Wed, 22 Mar 2017 11:15:07 -0400 Content-Transfer-Encoding: quoted-printable Reply-To: tls@ietf.org Message-Id: <3C90FC2F-D41D-412F-BAE3-136F466ABA2C@dukhovni.org> References: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> <54343047-7620-4A96-BD39-6E60AE7EA5A2@sn3rd.com> <5f39565c-5417-b94f-f1e6-32261c473455@nomountain.net> To: tls@ietf.org X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 15:15:17 -0000 > On Mar 22, 2017, at 10:56 AM, Melinda Shore = wrote: >=20 > The draft could definitely benefit from > additional review. Quick comment: 3.3. Raw Public Keys [RFC7250] specifies the use of raw public keys for both server and client authentication in TLS 1.2. It points out that in cases where raw public keys are being used, code for certificate path validation is not required. However, DANE provides a mechanism for securely binding a raw public key to a named entity in the DNS, and when using DANE for authentication a raw key may be validated using a path chaining back to a DNSSEC trust root. This has the added benefit of mitigating an unknown key share attack, as described in [I-D.barnes-dane-uks]. Binding raw public keys to a node in the DNS tree does not by itself mitigate (or militate against) UKS attacks. Indeed with just a raw public key there are no names to check in any server certificate, so when the application (web browsing) is vulnerable to UKS, raw public create an exposure to such attacks. However, the use of the "DNSSEC Authentication Chain Extension" means that the server in fact cryptographically commits (because the TLS handshake finished message commits both sides to the same session transcript) to the DNS location (owner name) of its TLSA records. So it is not DANE (RFC6698, RFC7671) that protects RPK against UKS, but rather this draft! What "DNSSEC Authentication Chain Extension" does is effectively augment RPK with the server's name that would otherwise be found in the certificate, a reverse SNI if you like (but actually stronger than names in certificates, because it also binds the protocol and port). --=20 Viktor. From nobody Wed Mar 22 12:31:05 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65B14126BF6 for ; Wed, 22 Mar 2017 12:31:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h4vsdECG7RS2 for ; Wed, 22 Mar 2017 12:31:02 -0700 (PDT) Received: from mail-qk0-x22f.google.com (mail-qk0-x22f.google.com [IPv6:2607:f8b0:400d:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4AFE3129502 for ; Wed, 22 Mar 2017 12:31:02 -0700 (PDT) Received: by mail-qk0-x22f.google.com with SMTP id y76so164227043qkb.0 for ; Wed, 22 Mar 2017 12:31:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:date:references :to:in-reply-to:message-id; bh=U3Foii9etqiRT7e4J8IC8AwaZiWRo8rxddYbvekLjsU=; b=kqe5bi0s8W0h8eyuArgGegr8H9gtEocPK6WEoK+MGAAHIJk85hDZ0CDdAwqUUccY70 9S2IXmmpFw+cR1sD1KKoHwJVLwrCc5YwoJe4Xj321UIFup6Ro2JlhT4/FkDRerMHd2Xe bLbo82Z/MXhcQUAa3URQCZXDBG/KXaUt0h19g= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:date:references:to:in-reply-to:message-id; bh=U3Foii9etqiRT7e4J8IC8AwaZiWRo8rxddYbvekLjsU=; b=Y8ANuqtK5cpnlp7CqdmKDWg0RftE3t4p33acCxu6j8ZTLFZQ0cCrSgsCI4xa7WEOyI Hv1LED+C+WNq72xny8W8FpqUwGOpXbvVEAanApj7NzXeoigfebzyySy3WabJU9ZT50zh LJ7jp2V/7Np4d53xP2dq5kYeHaasWUplmo4E+K8kUv6Zg4sR7fVycTWEktWucpAbLVBM 4sx4xBr/IjA+UMYMeVYRTu27NBxl0QKb9k4+tVc8H6vCs9ShAmxDkFh8VoWIMiQ7fn3a QsixZNS4/i9hbcoAXBsTa6l0WZux+rub3bR7UJLPzscJtUW07MnR++1JrhEwzwYMXaGy l4VQ== X-Gm-Message-State: AFeK/H3jAadsmTyPLzg70stpmKGlPQujFYkOYq8dhPH8dy1i6uYBGkBeEr/3YT9cDbRz9w== X-Received: by 10.55.156.210 with SMTP id f201mr2625099qke.8.1490211061003; Wed, 22 Mar 2017 12:31:01 -0700 (PDT) Received: from [172.16.0.18] ([96.231.230.131]) by smtp.gmail.com with ESMTPSA id x19sm1623343qtc.23.2017.03.22.12.30.59 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 22 Mar 2017 12:30:59 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Wed, 22 Mar 2017 15:30:58 -0400 References: To: "" In-Reply-To: Message-Id: X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] IETF 98 Agenda Uploaded X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 19:31:04 -0000 > On Mar 15, 2017, at 19:22, Sean Turner wrote: >=20 > Please note that I=E2=80=99ve uploaded the TLS session=E2=80=99s = agenda: >=20 > https://www.ietf.org/proceedings/98/agenda/agenda-98-tls-01 >=20 > spt You should note that the last item on the agenda is "Disposition of = additional drafts discussed on list=E2=80=9D. The chairs are going to = try to get a sense whether people have been reading/following a couple = of drafts [0] that have been discussed on the list: - Exported Authenticators in TLS draft-sullivan-tls-exported-authenticator - Delegated Credentials draft-rescorla-tls-subcerts - TLS 1.2 Update for Long-term Support draft-rescorla-tls-subcerts - TLS Server Identity Pinning with Tickets draft-sheffer-tls-pinning-ticket We=E2=80=99ll obviously take the discussion to the list after Chicago = [1], but I wanted to make sure nobody is caught off guard during the = session. spt [0] The list of drafts is actually longer but we thought we=E2=80=99d = deal with these first because they=E2=80=99ve been around for a bit. [1] We=E2=80=99re going to do it after Chicago, because we don=E2=80=99t = want to divert attention from the 2nd WGLC on TLS1.3.= From nobody Wed Mar 22 12:32:52 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E4FE129BF7 for ; Wed, 22 Mar 2017 12:32:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M3384qoXqb-S for ; Wed, 22 Mar 2017 12:32:49 -0700 (PDT) Received: from prod-mail-xrelay08.akamai.com (prod-mail-xrelay08.akamai.com [96.6.114.112]) by ietfa.amsl.com (Postfix) with ESMTP id 0A5271294FB for ; Wed, 22 Mar 2017 12:32:49 -0700 (PDT) Received: from prod-mail-xrelay08.akamai.com (localhost.localdomain [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id A46A2200014; Wed, 22 Mar 2017 19:32:48 +0000 (GMT) Received: from prod-mail-relay09.akamai.com (prod-mail-relay09.akamai.com [172.27.22.68]) by prod-mail-xrelay08.akamai.com (Postfix) with ESMTP id 8E9B7200001; Wed, 22 Mar 2017 19:32:48 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; s=a1; t=1490211168; bh=MsNvkjr6/KBohiBRjfg6R4EsKo05YeGAZlkYVMZUi7A=; l=989; h=To:References:From:Date:In-Reply-To:From; b=EjMkU3OBH44Uo2/HfRdmOPaWSUWMtDRbwxy4gIGLwO85zecfeW7xj1/SxqpFPvsof 0qE1hXIDIEnhcp0rH2DDonami8iKDfFPe4/o76tksv93Q0yI43qVZKnaHi5YbXADdK +MR3+gcS0+zHhBRMstvM9Q48cteDIlPSgT2IhYV4= Received: from [172.19.17.86] (bos-lpczi.kendall.corp.akamai.com [172.19.17.86]) by prod-mail-relay09.akamai.com (Postfix) with ESMTP id 3D19D1E090; Wed, 22 Mar 2017 19:32:48 +0000 (GMT) To: Sean Turner , "" References: From: Benjamin Kaduk Message-ID: Date: Wed, 22 Mar 2017 14:32:47 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------8EA3BAA82F405A9CE2E2F2C6" Archived-At: Subject: Re: [TLS] IETF 98 Agenda Uploaded X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 19:32:50 -0000 This is a multi-part message in MIME format. --------------8EA3BAA82F405A9CE2E2F2C6 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit On 03/22/2017 02:30 PM, Sean Turner wrote: > - TLS 1.2 Update for Long-term Support > draft-rescorla-tls-subcerts Presumably that is actually draft-gutmann-tls-lts? -Ben --------------8EA3BAA82F405A9CE2E2F2C6 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit On 03/22/2017 02:30 PM, Sean Turner wrote:
 - TLS 1.2 Update for Long-term Support
    draft-rescorla-tls-subcerts

Presumably that is actually draft-gutmann-tls-lts?

-Ben
--------------8EA3BAA82F405A9CE2E2F2C6-- From nobody Wed Mar 22 12:49:39 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82A3F129C07 for ; Wed, 22 Mar 2017 12:49:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UgDnZbRK1L5d for ; Wed, 22 Mar 2017 12:49:37 -0700 (PDT) Received: from mail-qt0-x22d.google.com (mail-qt0-x22d.google.com [IPv6:2607:f8b0:400d:c0d::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1BA45128BA2 for ; Wed, 22 Mar 2017 12:49:37 -0700 (PDT) Received: by mail-qt0-x22d.google.com with SMTP id n21so160373177qta.1 for ; Wed, 22 Mar 2017 12:49:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=wwHxhpIJwiJLYNQl7yFtyAn7nPm4y9tUfNlwcVTWYCM=; b=gA4XFob2wl5xBoGaKunTluPZCrrWcD9jbkGX2I2MFl/pmpI7BbUQ5zCzzrp1sYQaow Zo4vaVmPWa+B1he2PVfWfNaHunYNEudc7lT9g9Z8z1qPe4WLsSoBSkzP/b4iSPNzJcyI abdF4c+IsMbhmd1dALdDvEDpNqVwO4TlV4Xis= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=wwHxhpIJwiJLYNQl7yFtyAn7nPm4y9tUfNlwcVTWYCM=; b=WUFQbpBJI/WaS7Hq+GbjhfcfiRPa/UfoRsz5yrR8vxpz1Ovc3HSzPNfkDcZEC20eoY RrUxrxaptskOCN2jEbwEcvjqepZuZd5tpZ8fvbJgxFtxeEyHCrev+gIBXtfp/VvJ64g1 6CmPcfGdSZgaOTqTwnygNBdCPU42D5hm08XavIw8uzu4fCq4wprffeVYiyEM5jzaj+6s UTlEVRKFpnhy9W6uLyKg+6zTnV7yS74cd3eQLkWqBtz7tzEABI2iXpvklmOw/PlWJuCc HEOxzG/JFLRzsJx/76YiaDeaFhYrD1/GDzipn26HaIDxb1D22R5aEqFnfI3BQMREA+J2 lGqw== X-Gm-Message-State: AFeK/H0C7LnzxPyyaD9jkxf8zZGkDi+etwwuoRATQo5hLXNf51dcmSwDbAF/gzrdSPGVbQ== X-Received: by 10.200.49.232 with SMTP id i37mr37504529qte.241.1490212176160; Wed, 22 Mar 2017 12:49:36 -0700 (PDT) Received: from [172.16.0.18] ([96.231.230.131]) by smtp.gmail.com with ESMTPSA id s5sm1654628qkd.33.2017.03.22.12.49.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 22 Mar 2017 12:49:35 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Sean Turner In-Reply-To: Date: Wed, 22 Mar 2017 15:49:33 -0400 Cc: "" Content-Transfer-Encoding: 7bit Message-Id: <245A136F-B323-4246-87CA-1ED41BF4B6C1@sn3rd.com> References: To: Benjamin Kaduk X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] IETF 98 Agenda Uploaded X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 19:49:38 -0000 > On Mar 22, 2017, at 15:32, Benjamin Kaduk wrote: > > On 03/22/2017 02:30 PM, Sean Turner wrote: >> - TLS 1.2 Update for Long-term Support >> draft-rescorla-tls-subcerts >> > > Presumably that is actually draft-gutmann-tls-lts? yes spt From nobody Wed Mar 22 14:06:34 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 20994128D3E for ; Wed, 22 Mar 2017 14:06:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.921 X-Spam-Level: X-Spam-Status: No, score=-6.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id el6YK8EMfasV for ; Wed, 22 Mar 2017 14:06:30 -0700 (PDT) Received: from smtpde01.smtp.sap-ag.de (smtpde01.smtp.sap-ag.de [155.56.68.170]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C4B61128E19 for ; Wed, 22 Mar 2017 14:06:09 -0700 (PDT) Received: from mail07.wdf.sap.corp (mail04.sap.corp [194.39.131.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtpde01.smtp.sap-ag.de (Postfix) with ESMTPS id 3vpMfl5MYMz1Hmm; Wed, 22 Mar 2017 22:06:07 +0100 (CET) X-purgate-ID: 152705::1490216767-00002B31-2F7F17CD/0/0 X-purgate-size: 1401 X-purgate: clean X-purgate: This mail is considered clean (visit http://www.eleven.de for further information) X-purgate-Ad: Categorized by eleven eXpurgate (R) http://www.eleven.de X-purgate-type: clean X-SAP-SPAM-Status: clean Received: from ld9781.wdf.sap.corp (ld9781.wdf.sap.corp [10.21.82.193]) by mail07.wdf.sap.corp (Postfix) with ESMTP id 3vpMfk5qfszGqNW; Wed, 22 Mar 2017 22:06:06 +0100 (CET) Received: by ld9781.wdf.sap.corp (Postfix, from userid 10159) id BC8EA1A655; Wed, 22 Mar 2017 22:06:06 +0100 (CET) In-Reply-To: <1490151325506.25280@cs.auckland.ac.nz> To: Peter Gutmann Date: Wed, 22 Mar 2017 22:06:06 +0100 (CET) CC: Thomas Pornin , Ilari Liusvaara , "tls@ietf.org" Reply-To: mrex@sap.com X-Mailer: ELM [version 2.4ME+ PL125 (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="US-ASCII" Message-Id: <20170322210606.BC8EA1A655@ld9781.wdf.sap.corp> From: mrex@sap.com (Martin Rex) Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 21:06:33 -0000 Peter Gutmann wrote: > Thomas Pornin writes: >> >>TLS 1.3 is moving away from the IoT/embedded world, and more toward a Web >>world. This is not necessarily _bad_, but it is likely to leave some people >>unsatisfied (and, in practice, people clinging to TLS 1.2). > > I would go slightly further and say that TLS 1.3 could end up forking TLS in > the same way that HTTP/2 has forked HTTP. There's HTTP/2 for web content > providers and HTTP 1.1 for the rest of us/them (depending on your point of > view). Similarly, there are sizeable groups of users who will take a decade > or more to get to TLS 1.3 (they're still years away from 1.2 at the moment), > or who may never move to TLS 1.3 because too much of their existing > infrastructure is dependent on how TLS 1.x, x = 0...2, works. So as with > HTTP/2 we may end up with TLS 1.3 for web content providers and TLS 1.0/1.2 > for everything else. I expect TLSv1.3 is going to be in a decade where IPv6 is today. Not supporting IPv4 is a non-starter, because you can not reach 95% of the internet, and not even get internet connectivity in a lot of places. Not supporting IPv6 is paradise: less code, less headaches, less interop problems, less security issues, and you will _not_ miss anything at all, because everything that is at least remotely interesing, is accessible via IPv4. -Martin From nobody Wed Mar 22 14:35:01 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD1CA1274D2 for ; Wed, 22 Mar 2017 14:34:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0DdbVZe68mYY for ; Wed, 22 Mar 2017 14:34:57 -0700 (PDT) Received: from mail-qk0-x234.google.com (mail-qk0-x234.google.com [IPv6:2607:f8b0:400d:c09::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 74B021292D3 for ; Wed, 22 Mar 2017 14:34:56 -0700 (PDT) Received: by mail-qk0-x234.google.com with SMTP id p22so26519206qka.3 for ; Wed, 22 Mar 2017 14:34:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=W4pKvtP/hT6O3x4SHuwjF1n9sQ5OATl/np+80NzjOy8=; b=VnnZr00AscShyOToc7FQh8saV6jQmkdm/QRDmZQ2JYlyTlBkGkKsfw0U7ssIiMpFDK O6HO/RP2hxDkedSXLudpN2o3CFWKmPPj3SfgeifbrsEmMQwaF26hgrlelQo7miHNBBzP GMTfZzQ+0HHzXVMkWcyXWFi0OjAOa4x5qSYyQX8LNBy9CmBb01Z2rJjIMLbyqj/Pevsh F6jreOHUIY0Vb1GcPF9QpeTsaZ+6nQBJf50re0t1WJ8y858hz1MV5xsd7laiScYeUeEP rxwL1p6Q+XZ+NcC1GGKW26OeTikTzY0PxMmfryJxnht6LNmT0kykJBrnZ/gyNJwe+N2W NegA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=W4pKvtP/hT6O3x4SHuwjF1n9sQ5OATl/np+80NzjOy8=; b=GVu9OnMtZArt7UoL2MWMXvt407gin/uG7rn0ZR+x+ZCTul5F7hWDWUkjDCvoaxFb1R r5Zdp6OJXCVBcWTWzkW7q09syBZ8eKZ15AZxovv/UbU8uMHfZJMDmEoY+a6wHHlN52FZ 7hfMpgAlO7Eqtpypp0ptKJpztqrC/stgkiwzwqdoFdlvRafIVJZMF0VEMwa6PegnbXDJ k0QzULy3E92eorY5lBdMT6JxHjYAHFtw0CJEcQHsgvU663ViqhAol1rrWSmFV2HcbwNY F/VA3eZDn10KMd4X5WrkOkkBpkqJPox2ajEvK42g/GZtgXM+qofqQIB3etUOdxBmaKxk q0Jw== X-Gm-Message-State: AFeK/H1JVszp3zPQh49VbmXMZ3juGiQcElVVzg6gVJU+5UsNdTENj5BSf/RG362lexzZgugRAXsHXQsiIuvtAAVE X-Received: by 10.55.95.71 with SMTP id t68mr40738016qkb.81.1490218495259; Wed, 22 Mar 2017 14:34:55 -0700 (PDT) MIME-Version: 1.0 Received: by 10.55.47.4 with HTTP; Wed, 22 Mar 2017 14:34:54 -0700 (PDT) In-Reply-To: References: From: Victor Vasiliev Date: Wed, 22 Mar 2017 17:34:54 -0400 Message-ID: To: Eric Rescorla Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary=94eb2c0554e80c85af054b58880d Archived-At: Subject: Re: [TLS] Certificate compression draft X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 21:35:00 -0000 --94eb2c0554e80c85af054b58880d Content-Type: text/plain; charset=UTF-8 On Tue, Mar 21, 2017 at 7:30 PM, Eric Rescorla wrote: > This proposal seems like a reasonable idea. One question I had is what the > point of the "uncompressed length" field is: > > struct { > uint24 uncompressed_length; > opaque compressed_certificate_message<1..2^24-1>; > } Certificate; > > I initially thought maybe it was a sanity check, but if so it's not a very > good > one. I see that in S 5 you encourage receivers to limit the compressed > length, but having it expressed like this doesn't seem like that useful a > security measure because the attacker gets to choose both the compressed > data and the length. Is the idea just to let the receiver pre-allocate a > buffer > for decompression? > It's to some extent for all of the purposes you've mentioned, but in general knowing the size of decompression target makes writing code easier (since you only need to call inflate() once). > The text says: > > compressed_certificate_message The compressed body of the > Certificate message, in the same format as the server would > normally express it. The compression algorithm defines how the > bytes in the compressed_certificate_message are converted into the > Certificate message. > > I assume in this case "body" means "not including the header bytes"? I > guess it's > redundant, but it might be worthwhile being very precise > Indeed. I'll see if I can make this more clear. > Also: > > The implementations MUST limit the size of the resulting decompressed > chain to the specified uncompressed length, and they MUST abort the > connection if the size exceeds that limit. Implementations MAY > impose a lower limit on the chain size in addition to the 16777216 > byte limit imposed by TLS framing, in which case they MUST apply the > same limit to the uncompressed chain before starting to decompress > it. > > Do you mean "upper" rather than "lower" for limit? > I meant "lower than 16M". I've edited the editor's copy to make this paragraph clearer. -- Victor. --94eb2c0554e80c85af054b58880d Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On T= ue, Mar 21, 2017 at 7:30 PM, Eric Rescorla <ekr@rtfm.com> wrote:<= br>
This proposal seems like= a reasonable idea. One question I had is what the
point of the "u= ncompressed length" field is:

=C2=A0 =C2= =A0 =C2=A0 =C2=A0struct {
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 uint24 uncompressed_length;
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 opaque compressed_certificate_message<1..2^24-1>;
=C2=A0 =C2=A0 =C2=A0 =C2=A0} Certificate;

I= initially thought maybe it was a sanity check, but if so it's not a ve= ry good
one. I see that in S 5 you encourage receivers to limit t= he compressed
length, but having it expressed like this doesn'= ;t seem like that useful a
security measure because the attacker = gets to choose both the compressed
data and the length. Is the id= ea just to let the receiver pre-allocate a buffer
for decompressi= on?

It's to some exte= nt for all of the purposes you've mentioned, but in general knowing
the size of decompression target makes writing code easier (since yo= u only need
to call inflate() once).
=C2=A0
The text says:

=C2=A0 =C2=A0compressed_certificate_message =C2= =A0The compressed body of the
=C2=A0 =C2=A0 =C2=A0 Certificate me= ssage, in the same format as the server would
=C2=A0 =C2=A0 =C2= =A0 normally express it.=C2=A0 The compression algorithm defines how the
=C2=A0 =C2=A0 =C2=A0 bytes in the compressed_certificate_message ar= e converted into the
=C2=A0 =C2=A0 =C2=A0 Certificate message.

I assume in this case "body" means &= quot;not including the header bytes"? I guess it's
redun= dant, but it might be worthwhile being very precise

Indeed.=C2=A0 I'll see if I can make this mo= re clear.
=C2=A0
Also:

=C2=A0 =C2=A0= The implementations MUST limit the size of the resulting decompressed
=
=C2=A0 =C2=A0chain to the specified uncompressed length, and they MUST= abort the
=C2=A0 =C2=A0connection if the size exceeds that limit= .=C2=A0 Implementations MAY
=C2=A0 =C2=A0impose a lower limit on = the chain size in addition to the 16777216
=C2=A0 =C2=A0byte limi= t imposed by TLS framing, in which case they MUST apply the
=C2= =A0 =C2=A0same limit to the uncompressed chain before starting to decompres= s
=C2=A0 =C2=A0it.

Do you mean &qu= ot;upper" rather than "lower" for limit?

I meant "lower than 16M".=C2=A0 I&= #39;ve edited the editor's copy to make this paragraph clearer.

=C2=A0 -- Victor.
--94eb2c0554e80c85af054b58880d-- From nobody Wed Mar 22 14:50:42 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 564B51294B5 for ; Wed, 22 Mar 2017 14:50:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oWWtx1unKewd for ; Wed, 22 Mar 2017 14:50:39 -0700 (PDT) Received: from mournblade.imrryr.org (mournblade.imrryr.org [108.5.242.66]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0BCBB129353 for ; Wed, 22 Mar 2017 14:50:35 -0700 (PDT) Received: from [172.31.30.83] (gzac12-mdf2-1.aoa.twosigma.com [208.77.215.155]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mournblade.imrryr.org (Postfix) with ESMTPSA id E13927A32F1 for ; Wed, 22 Mar 2017 21:50:34 +0000 (UTC) (envelope-from ietf-dane@dukhovni.org) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Viktor Dukhovni In-Reply-To: <5f39565c-5417-b94f-f1e6-32261c473455@nomountain.net> Date: Wed, 22 Mar 2017 17:50:33 -0400 Content-Transfer-Encoding: quoted-printable Reply-To: "" Message-Id: <06E7213B-5842-4465-936D-CF153C76B6DA@dukhovni.org> References: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> <54343047-7620-4A96-BD39-6E60AE7EA5A2@sn3rd.com> <5f39565c-5417-b94f-f1e6-32261c473455@nomountain.net> To: "" X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 21:50:41 -0000 > On Mar 22, 2017, at 10:56 AM, Melinda Shore = wrote: >=20 > The draft could definitely benefit from > additional review. I find it ironic that section 4 includes: The components of the authentication chain are built by starting at the target record set and its corresponding RRSIG. Then traversing the DNS tree upwards towards the trust anchor zone (normally the DNS root), for each zone cut, the DNSKEY and DS RRsets and their signatures are added. If DNS responses messages contain any domain names utilizing name compression [RFC1035], then they must be uncompressed. while at the same time there is ongoing discussion of *adding* = compression of the server certificate chain (as a TLS 1.3 extension). Would the compression of server certificates also cover compression of the DNSSEC chain extension? If so, perhaps this would be a belated moral victory for DJB[1]. :-) --=20 --=20 Viktor. [1] https://cr.yp.to/djbdns/notes.html Compression Compression DNS packets use an ad-hoc compression method in which portions of domain names can sometimes be replaced with two-byte pointers to previous domain names. The precise rule is that a name can be compressed if it is a response owner name, the name in NS data, the name in CNAME data, the name in PTR data, the name in MX data, or one of the names in SOA data. One problem with DNS compression is the amount of code required to parse it. Reliably locating all these names takes quite a bit of work that would otherwise have been unnecessary for a DNS cache. LZ77 compression would have been much easier to implement. Another problem with DNS compression is the amount of code required to correctly generate it. (RFC 1035 allowed servers to not bother compressing their responses; however, caches have to implement compression, so that address lists from some well-known sites don't burst the seams of a DNS UDP packet.) Not only does the compressor need to figure out which names can be compressed, but it also needs to keep track of compression targets earlier in the packet. RFC 1035 doesn't make clear exactly what targets are allowed. (Most versions of BIND do not use pointers except to compressible names; suffixes of the query name are excluded. dnscache uses pointers to suffixes of the query name.) Another problem with DNS compression is that it's not particularly effective. LZ77 would have done a noticeably better job on current data, and a much better job on new record types that might become popular in the future. (BIND versions 4.9.* through 8.1.2 compress names in new record types, such as RP and SRV, in blatant violation of RFC 1035. The names are not decompressed by caches that do not know about the new types. This is an interoperability disaster.)= From nobody Wed Mar 22 14:58:59 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6738D129514 for ; Wed, 22 Mar 2017 14:58:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YfUkSmigJb0n for ; Wed, 22 Mar 2017 14:58:55 -0700 (PDT) Received: from mail-qt0-x235.google.com (mail-qt0-x235.google.com [IPv6:2607:f8b0:400d:c0d::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 405C81293DA for ; Wed, 22 Mar 2017 14:58:55 -0700 (PDT) Received: by mail-qt0-x235.google.com with SMTP id x35so161975025qtc.2 for ; Wed, 22 Mar 2017 14:58:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=U8B0s4aEnObtLc90/fnUe+kQMs5m9d7mi3xlHtA38Dg=; b=oX1bcINRTgJPwzg4DAhZ/ul09hKSyTj6Gr5KnE32G6qJFQZHvbS0tWKtMU7BvsWfq7 URFs/UHQV/xSQGQ2UUgSTgIZJqKBPU8Fwcu2T1kP/jIhmI6ByofXJOs9x7Q9pnyJQj3e XKeT27gTA4CT/9JuQEEDHgMr5/glYaiFmKCDZhYSa7fpcZ5AVJsok0aexgKh+dW8GTYJ OFrshruJNUwvXCpQD8HerAo4ZzmlgmCoeMTMMLgTm5C/zC1luWDDxYEYZEbgXkSXqThX d2OP8vRwJAPmwrYBxk9U41rM32jYNzxIsFvD8eF8fL+XqJ9m1yyP2iKmb3w0BGzDR3eP nSqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=U8B0s4aEnObtLc90/fnUe+kQMs5m9d7mi3xlHtA38Dg=; b=hYRn06xMcDPewHN8aYfb0t3D8r2AgFIm+8oflp1/OaDaoUsdsZZ90Ra5ZfyDEvlFeF y5W5iwcL7VOyeWUGMdXuTdQ7OeLECilLtT9vajw02vtOxj5sPBMuVzn+wUiOOM10FFU1 oNPecB1v2bPsJag9SAEyAGy7aKlc7tyE85JJ8241MPQP75O8aKTk40zlvUS5paSW1R6u QmIIqjfyS/iee4oj4eJUubTC0x6X4Okj8XxxyTxkDXoOldpK1T9uwa7l5Q4xm2tlriQY XNRcY7qbT/YJGK/5zynnm5C7y3eTkkasx0lUlMNUwzXoa91w4oAIjwaH6h/EJj7+wQ0L 8GOg== X-Gm-Message-State: AFeK/H144iEmPTpMuSSSkfp1gzhHSe6U37ZknYPR2jovB45RMseAG2EaY7ny8I8Gv2PbJZG9LsDK40Pcn8Wavg== X-Received: by 10.200.46.91 with SMTP id s27mr43544431qta.278.1490219934187; Wed, 22 Mar 2017 14:58:54 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Wed, 22 Mar 2017 14:58:53 -0700 (PDT) In-Reply-To: <3C90FC2F-D41D-412F-BAE3-136F466ABA2C@dukhovni.org> References: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> <54343047-7620-4A96-BD39-6E60AE7EA5A2@sn3rd.com> <5f39565c-5417-b94f-f1e6-32261c473455@nomountain.net> <3C90FC2F-D41D-412F-BAE3-136F466ABA2C@dukhovni.org> From: Martin Thomson Date: Thu, 23 Mar 2017 08:58:53 +1100 Message-ID: To: "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 21:58:57 -0000 The way that the UKS attack is mitigated here is counter-intuitive. It is via inclusion of the *name* in the handshake transcript and validation of that name that we get the protection we need. Victor is right to question this. This isn't a very obvious result and needs more text than a single simple sentence. On 23 March 2017 at 02:15, Viktor Dukhovni wrote: > >> On Mar 22, 2017, at 10:56 AM, Melinda Shore wrote: >> >> The draft could definitely benefit from >> additional review. > > Quick comment: > > 3.3. Raw Public Keys > > [RFC7250] specifies the use of raw public keys for both server and > client authentication in TLS 1.2. It points out that in cases where > raw public keys are being used, code for certificate path validation > is not required. However, DANE provides a mechanism for securely > binding a raw public key to a named entity in the DNS, and when using > DANE for authentication a raw key may be validated using a path > chaining back to a DNSSEC trust root. This has the added benefit of > mitigating an unknown key share attack, as described in > [I-D.barnes-dane-uks]. > > Binding raw public keys to a node in the DNS tree does not by itself > mitigate (or militate against) UKS attacks. Indeed with just a raw > public key there are no names to check in any server certificate, > so when the application (web browsing) is vulnerable to UKS, raw > public create an exposure to such attacks. > > However, the use of the "DNSSEC Authentication Chain Extension" > means that the server in fact cryptographically commits (because > the TLS handshake finished message commits both sides to the same > session transcript) to the DNS location (owner name) of its TLSA > records. So it is not DANE (RFC6698, RFC7671) that protects RPK > against UKS, but rather this draft! > > What "DNSSEC Authentication Chain Extension" does is effectively > augment RPK with the server's name that would otherwise be found > in the certificate, a reverse SNI if you like (but actually > stronger than names in certificates, because it also binds the > protocol and port). > > -- > Viktor. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls From nobody Wed Mar 22 15:51:01 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1326B1293EE for ; Wed, 22 Mar 2017 15:51:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PeUi2XJzhFfv for ; Wed, 22 Mar 2017 15:50:58 -0700 (PDT) Received: from mail-qk0-x22d.google.com (mail-qk0-x22d.google.com [IPv6:2607:f8b0:400d:c09::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 71EBD12896F for ; Wed, 22 Mar 2017 15:50:58 -0700 (PDT) Received: by mail-qk0-x22d.google.com with SMTP id y76so167176170qkb.0 for ; Wed, 22 Mar 2017 15:50:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=zwCRIpLdNEHjoMIGxmNbwUzYJ2MEZHjurTX4Pk4Gco0=; b=YfMV8oWFDDcMql2gD41Y4g63zLuhDg/49sN8aEWBojm2ouU75k3kcVg82k5gXW1ZHQ 3aIVcyevTqlx3xNzWovjCpx5IEPnq3np9axrHMJhYt1164C8njaN44beoCbe0mrO60/j S5sxtTlOeIgMSTO0Io3NcOVNsxj0BgnyAapXs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=zwCRIpLdNEHjoMIGxmNbwUzYJ2MEZHjurTX4Pk4Gco0=; b=Nh3hTOP/TFfk7vGa11BW7IX4R7GsA3yPArZskudxZARwKlaJY0iR0fTaB8yDgMV5IU TEN//bUgwj/ItUd67Dn6BtPCK8p8dMRGMmEouwKY1iHK5fIFCQjZHdMq0V4PagijDLMh p5CsfMLYiOLeTjlvC6z7yvUOwVAAndPrfV8GHZIX+5P56MhDlZsVc5N0UyH1C8+s9jnE 09Mb0BDR7aU8xTwLW8TBc+Y2aqvCImMLYnGCrVGmXvOncz5Fz7/UbjTY5WM3l/0jD2HF 9qZFR1TGYYj1g5lfr4jSuSSx+luwD9EJ0hmhxNr828QEvqB9BlFz0x2ADqnaNrWO3L2R ceVA== X-Gm-Message-State: AFeK/H0yQSZ2kmtlD4qJ96S3aQ9ZDl2Zoru5r2YjqEx82JcfJ8PrNJ4a6xyNydlNkIX+5Q== X-Received: by 10.55.8.5 with SMTP id 5mr24122580qki.70.1490223057351; Wed, 22 Mar 2017 15:50:57 -0700 (PDT) Received: from [172.16.0.18] ([96.231.230.131]) by smtp.gmail.com with ESMTPSA id w123sm1973166qka.24.2017.03.22.15.50.55 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 22 Mar 2017 15:50:56 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Message-Id: <4CBA4B06-411F-4B87-B664-D451260F8C25@sn3rd.com> Date: Wed, 22 Mar 2017 18:50:52 -0400 To: "" X-Mailer: Apple Mail (2.3259) Archived-At: Subject: [TLS] WG Call for adoption of draft-rescorla-tls-dtls13 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Mar 2017 22:51:00 -0000 All, -00 of draft-rescorla-tls-dtls13 [0][1] was discussed at IETF 97 [2]. = It=E2=80=99s now at version -01 and GH issues are slowly rolling in. = It=E2=80=99s also on our agenda again at IETF 98, and DTLS a chartered = work item, so it seems like it=E2=80=99s time to get the WG adoption = process started for this individual draft. Please let the list know = whether you support adoption of the draft and are willing to = review/comment on the draft before 20170406. If you object to its = adoption, please let us know why. Cheers, J&S [0] https://github.com/ekr/dtls13-spec=20 [1] https://datatracker.ietf.org/doc/html/draft-rescorla-tls-dtls13 [2] = https://www.ietf.org/proceedings/97/slides/slides-97-tls-dtls-13-01.pdf= From nobody Wed Mar 22 17:11:41 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 59929128D19 for ; Wed, 22 Mar 2017 17:11:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ajzoe2XXJTXR for ; Wed, 22 Mar 2017 17:11:38 -0700 (PDT) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4DB571276AF for ; Wed, 22 Mar 2017 17:11:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1490227898; x=1521763898; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=qrDfVl49PTb225DsEgo3c63TpYqSiAet93WtKQwF5+o=; b=noIGFkgVP9/VxEWodG/QLklJ4/zPWvByCKnccAg0pwH1jCiuebaJ9M69 7JZ6dUCbJKxU2TwDdx+44M/PPk4glwFTfP5SnMtXZNd+cLVP8Tt5MGO+W 6u1Rjl0Wa7sbWQvtWzihgZHx388tnBFjqgTjwxTtZGnU9hNGFeK2xciqg PfNdUi8N77as5uXoYWdmUtNwvrNUZLZLRqLk7NwyeboW49ZFT7hEEaBSU Kjdaq7dXTAz/lwE9hDc2DlTocFoima01b7QGUyE33CrxluI7xI5Siwr2T YcrbkWlcsnKjTQKVpnnMQ54jw4p1icXgRxj7stUyS1r+PqwUBCFjtEs1Y A==; X-IronPort-AV: E=Sophos;i="5.36,207,1486378800"; d="scan'208";a="144861856" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.2.4 - Outgoing - Outgoing Received: from uxcn13-ogg-c.uoa.auckland.ac.nz ([10.6.2.4]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 23 Mar 2017 13:11:36 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-ogg-c.UoA.auckland.ac.nz (10.6.2.4) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Thu, 23 Mar 2017 13:11:36 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1178.000; Thu, 23 Mar 2017 13:11:36 +1300 From: Peter Gutmann To: "mrex@sap.com" CC: Thomas Pornin , Ilari Liusvaara , "tls@ietf.org" Thread-Topic: [TLS] RFC 6066 - Max fragment length negotiation Thread-Index: AQHSnpUB8UgZsR1fnUWlpN1q8vk4DKGYGe7w//8q+oCAANxgO///LA8AgADcRWz//0AsAAAe+X57//8qVYCAACsrgIABIKju//8rnQCAAOBv1///S1IAgAAT2wCAAA7cgIAH4B0LgABXOACAAQ1YMQ== Date: Thu, 23 Mar 2017 00:11:35 +0000 Message-ID: <1490227889332.58996@cs.auckland.ac.nz> References: <1490151325506.25280@cs.auckland.ac.nz>, <20170322210606.BC8EA1A655@ld9781.wdf.sap.corp> In-Reply-To: <20170322210606.BC8EA1A655@ld9781.wdf.sap.corp> Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] RFC 6066 - Max fragment length negotiation X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 00:11:40 -0000 Martin Rex writes:=0A= =0A= >I expect TLSv1.3 is going to be in a decade where IPv6 is today.=0A= =0A= It'll be interesting to see. This certainly seems to be true for HTTP/2=0A= a.k.a. HTTP4Google, I was expecting usage to be mostly Google-only but from= =0A= the little data I could find it appears to be even worse than that:=0A= =0A= https://trends.builtwith.com/docinfo/HTTP2=0A= =0A= 0.1% uptake is effectively zero adoption after two years, so this does seem= to=0A= parallel IPv6.=0A= =0A= >Not supporting IPv4 is a non-starter, because you can not reach 95% of the= =0A= >internet, and not even get internet connectivity in a lot of places.=0A= =0A= Yeah, good point (as an analogy for TLS). It'll be interesting to see wher= e=0A= things are in a year or two. Certainly 1.2 will be around forever, and by= =0A= that I don't mean "a while, until 1.3 gets deployed", but forever. TLS 1.0= is=0A= already proving scarily long-lived.=0A= =0A= The one good thing about (almost) everyone fixating on TLS 1.3 is that it's= =0A= been possible to develop and in some cases already deploy LTS in peace, so= =0A= it's ended up doing what the target audience requires without lots of=0A= unnecessary bells and whistles added.=0A= =0A= Peter.=0A= From nobody Wed Mar 22 22:28:22 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 94E48129451 for ; Wed, 22 Mar 2017 22:28:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TUSLbsk5tifa for ; Wed, 22 Mar 2017 22:28:18 -0700 (PDT) Received: from mournblade.imrryr.org (mournblade.imrryr.org [108.5.242.66]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0AD0F129453 for ; Wed, 22 Mar 2017 22:28:17 -0700 (PDT) Received: from vpro.lan (cpe-74-71-8-253.nyc.res.rr.com [74.71.8.253]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mournblade.imrryr.org (Postfix) with ESMTPSA id 232197A32F1 for ; Thu, 23 Mar 2017 05:28:17 +0000 (UTC) (envelope-from ietf-dane@dukhovni.org) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Viktor Dukhovni In-Reply-To: <5f39565c-5417-b94f-f1e6-32261c473455@nomountain.net> Date: Thu, 23 Mar 2017 01:28:16 -0400 Content-Transfer-Encoding: quoted-printable Reply-To: TLS WG Message-Id: References: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> <54343047-7620-4A96-BD39-6E60AE7EA5A2@sn3rd.com> <5f39565c-5417-b94f-f1e6-32261c473455@nomountain.net> To: TLS WG X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 05:28:20 -0000 > On Mar 22, 2017, at 10:56 AM, Melinda Shore = wrote: >=20 > The draft could definitely benefit from additional review. A more complete walk through: > 2. Introduction >=20 > This draft describes a new TLS [RFC5246] extension for transport of = a > DNS record set serialized with the DNSSEC signatures [RFC4034] = needed > to authenticate that record set. The intent of this proposal is to > allow TLS clients to perform DANE authentication [RFC6698] of a TLS Should RFC6698 here be replaced or augmented with RFC7671? In RFC7671, the processing of DANE-EE(3) are DANE-TA(2) is modified from what one might naively do with just RFC6698. One of these changes of course introduces the UKS problem referenced in this draft, but since this draft militates against UKS attacks, that's not a problem. > server certificate without performing additional DNS record lookups > and incurring the associated latency penalty. It also provides the > ability to avoid potential problems with TLS clients being unable = to > look up DANE records because of an interfering or broken middlebox = on > the path between the client and a DNS server. FWIW, sometimes is the very DNS server the client learns via DHCP that does not support DNSSEC, so no "middle-box" may be required to block DNSSEC access. > And lastly, it allows > a TLS client to validate DANE records itself without necessarily > needing access to a validating DNS resolver to which it has a = secure > connection. [ It might be interesting at some point to implement a service in a local validating resolver to which the obtained DNS RRs can be forwarded for validation. This way, all the application is doing is proxying DNS lookup via the TLS server to data that the local resolver may be prevented from obtaining directly, or would take too long to obtain. This of course is not for the draft. ] > Furthermore, > SMTP MTAs usually employ Opportunistic Security [RFC7435], in which > the presence of the DNS TLSA records is used to determine whether = to > enforce an authenticated TLS connection. Hence DANE authentication > of SMTP MTAs [RFC7672] will typically not use this mechanism. Note that RFC7672 describes opportunistic DANE TLS for SMTP, so RFC7435 should probably be replaced by RFC7672 here. > The client then authenticates the chain using a pre-configured = trust > anchor. Speaking of trust-anchors, the client will ultimately need to have some mechanism to deal with root KSK rollover. If the client has no local resolver that is, at least intermittently, able to refresh the root KSK, then the client may well also need to use this specification to update the root KSK list from the DNSKEY RRsets returned by servers, and to persist these for future use. That's probably worth a mention... > As described in the DANE specification [RFC6698], this procuedure > applies to the DANE authentication of X.509 certificates. Or raw public keys as described in 7671, and indeed mentioned below in the draft. > 3.1. Protocol, TLS 1.2 >=20 > A client MAY include an extension of type "dnssec_chain" in the > (extended) ClientHello. The "extension_data" field of this = extension > MUST be empty. One might ask the client to include the port number here, the server may not know which port the client used if some load-balancer redirected the layer-4 server address. > 3.4. DNSSEC Authentication Chain Data > Each RRset in the chain is composed of a sequence of wire format = DNS > resource records. The format of the resource record is described = in > RFC 1035 [RFC1035], Section 3.2.1. The resource records SHOULD be > presented in the canonical form and ordering as described in RFC = 4034 > [RFC4034]. >=20 > RR(i) =3D owner | type | class | TTL | RDATA length | = RDATA Note that the TTL in the canonical form is the one in the RRSIG, rather that a typically smaller value in response from the resolver. Whose responsibility is it to ensure that the records fed into the signature verification algorithm have the correct (maximal) TTL? > The first RRset in the chain MUST contain the DANE records being > presented. The subsequent RRsets MUST be a sequence of DNSKEY and = DS > RRsets, starting with a DNSKEY RRset. Each RRset MUST authenticate > the preceding RRset: Except that of course, as explained below, they don't have to be a sequence of "DNSKEY" and "DS" RRsets, because wildcards also necessitate NSEC, NSEC3 or possibly (some decade this century unless scalable QCs arrive first) NSEC5 records. > o A DNSKEY RRset must include the DNSKEY RR containing the public > key used to verify the previous RRset. I assume that the DNSKEY RRset must be presented in full, because otherwise how is its signature to be validated? This even applies to the root RRset in support of KSK rollover. While it is possible to limit the transmitted RRSIG records to just those supported by the client, I don't see any opportunity to transmit partial RRsets of any other type. > o For a DS RRset, the set of key hashes MUST overlap with the > preceding set of DNSKEY records. Again, except for the root (whose DS RRs need not be transmitted at all), all the DS RRsets would surely need to be sent in full, else their signature cannot be validated... > In addition, a DNSKEY RRset followed by a DS RRset MUST be self- > signed, in the sense that its RRSIG MUST verify under one of the = keys > in the DNSKEY RRSET. Are these instructions to the server (what to send) or to the verifier? More specifically, the DNSKEY RRset must be accompanied by a signature made by one of the KSKs whose hash appears in the DS RRset. If there are multiple algorithms in the DS RRset (say RSA and ECDSA) then if at all possible an RRSIG by a KSK for each such algorithm MUST be included unless the server knows which DNSSEC algorithms are supported by the client and can safely omit RRSIGs for some of the algorithms. > The final DNSKEY RRset in the authentication chain, containing the > trust anchor may be omitted. As mentioned below, that would make RFC5011 KSK rollover rather difficult, and presumably we don't want clients to eventually cease to be able to verify chains for lack of fresh trust anchors. Indeed it is not just the root zone KSKs (trust anchors) that change from time to time. Rather, on a more frequent basis the root zone ZSKs will roll over, and these are probably not part of any stable set of trust-anchors maintained by the client. For example, unbound's root key file on my machine contains only the KSK: $ cat /usr/local/etc/unbound/root.key=20 ... . 172800 IN DNSKEY 257 3 8 ... So a fresh root zone DNSKEY RRset is going to be needed with some frequency. Right now the root zone has a single KSK and two ZSKs and is signed by the KSK: . DNSKEY 257 3 8 ( ... ) ; KSK; alg =3D RSASHA256 = ; key id =3D 19036 . DNSKEY 256 3 8 ( ... ) ; ZSK; alg =3D RSASHA256 = ; key id =3D 14796 . DNSKEY 256 3 8 ( ... ) ; ZSK; alg =3D RSASHA256 = ; key id =3D 61045 . RRSIG DNSKEY 8 0 172800 ( 20170411000000 = 20170321000000 19036 . ... ) While the SOA record and the rest of the root zone appears to be signed = by just the 61045 ZSK: . SOA a.root-servers.net. = nstld.verisign-grs.com. ( 2017032201 ; serial 1800 ; refresh (30 minutes) 900 ; retry (15 minutes) 604800 ; expire (1 week) 86400 ; minimum (1 day) ) . RRSIG SOA 8 0 86400 ( 20170404170000 = 20170322160000 61045 . ... ) One of the two ZSKs is presumably on its way out... So it seems to me that the client extension needs to signal whether the client is in need of a fresh root DNSKEY RRset. Clients can omit sending such a signal with most TLS connections and only ask = periodically, say once a day or so, perhaps from a few different servers just in = case). > If omitted, the client MUST verify that > the key tag and owner name in the final RRSIG record correspond to = a > trust anchor. There may however be reason to include the trust > anchor RRset and signature if clients are expected to use RFC5011 > compliant key rollover functions inband via the chain data. But how is the server to know unless the client asks? So I think that perhaps the client extension needs to ask (RFC5011-enable flag and port so far). > ... Wildcard DANE records will need to include the wildcard > name, and negative proof (i.e. NSEC or NSEC3 records) that no = closer > name exists MUST be included. And so the earlier text that says DS/DNSKEY only needs to be less restrictive. > Note as well that if a user has a specific TLSA record for port = 443, > and a different wildcard covering other ports, attackers MUST NOT = be > able to substitute the wildcard TLSA RRset for the more specific = one > for port 443. DNSSEC wildcards must not be confused with the X.509 > wildcards. I don't understand this paragraph. DNSSEC closest encloser proofs are needed to show that the wildcard record is applicable. The client knows that the server is returning a wildcard response, which must prove that the actual port sought has no explicit TLSA RR. What am I missing? Is this just asking the client to do DNSSEC wildcard answer processing correctly? > 4. Construction of Serialized Authentication Chains >=20 > This section describes a possible procedure for the server to use = to > build the serialized DNSSEC chain. >=20 > When the goal is to perform DANE authentication [RFC6698] of the > server's X.509 certificate, the DNS record set to be serialized is = a > TLSA record set corresponding to the server's domain name. Well, actually domain name *and* protocol *and* port. > The domain name of the server MUST be that included in the TLS = Server > Name Indication extension [RFC6066] when present. If the Server = Name > Indication extension is not present, or if the server does not > recognize the provided name and wishes to proceed with the = handshake > rather than to abort the connection, the server uses the domain = name > associated with the server IP address to which the connection has > been established. Or some suitable default name selected by the server. I don't think it is necessary to prescribe a selection mechanism. The server may be behind a load-balancer, and the name may be statically configured, = rather than obtained from the local address of the accepted socket. > The TLSA record to be queried is constructed by prepending the = _port > and _transport labels to the domain name as described in [RFC6698], That covers the label order, is it necessary to repeat it? > where "port" is the port number associated with the TLS server. = The > transport is "tcp" for TLS servers, and "udp" for DTLS servers. = The > port number label is the left-most label, followed by the = transport, > followed by the base domain name. >=20 > The components of the authentication chain are built by starting at > the target record set and its corresponding RRSIG. Then traversing > the DNS tree upwards towards the trust anchor zone (normally the = DNS > root), for each zone cut, the DNSKEY and DS RRsets and their > signatures are added. If DNS responses messages contain any domain > names utilizing name compression [RFC1035], then they must be > uncompressed. Of course there are additional complications when the original name requires CNAME or DNAME processing to reach the ultimate target domain where the TLSA records are stored. Perhaps that's worth describing in more detail, as that's the non-obvious part of the algorithm. > 5. Caching and Regeneration of the Authentication Chain >=20 > DNS records have Time To Live (TTL) parameters, and DNSSEC = signatures > have validity periods (specifically signature expiration times). > After the TLS server constructs the serialized authentication = chain, > it SHOULD cache and reuse it in multiple TLS connection handshakes. > However, it MUST refresh and rebuild the chain as TTLs and = signature > validity periods dictate. A server implementation could carefully > track these parameters and requery component records in the chain > correspondingly. Alternatively, it could be configured to rebuild > the entire chain at some predefined periodic interval that does not > exceed the DNS TTLs or signature validity periods of the component > records in the chain. Perhaps the job of transmitting "canonical" TTLs should also be up to the server, in which case this section should explain that the server must replace the TTLs of each record with the corresponding RRSIG max TTL field. > 6. Verification >=20 > A TLS client making use of this specification, and which receives a > DNSSEC authentication chain extension from a server, SHOULD use = this > information to perform DANE authentication of the server = certificate. > In order to do this, it uses the mechanism specified by the DNSSEC > protocol [RFC4035]. This mechanism is sometimes implemented in a > DNSSEC validation engine or library. >=20 > If the authentication chain is correctly verified, the client then > performs DANE authentication of the server according to the DANE = TLS > protocol [RFC6698], and the additional protocol requirements = outlined > in [RFC7671]. Some discussion of UKS may be appropriate here, since there'll probably be some day soon an update to RFC7671 that says that name checks are not generally optional for DANE-EE(3), but as this protocol militates = against UKS attacks, the original policy of RFC7671 should stand despite any = such (near future) amendation. > 7. Trust Anchor Maintenance >=20 > The trust anchor may change periodically, e.g. when the operator of > the trust anchor zone performs a DNSSEC key rollover. Managed key > rollovers typically use a process that can be tracked by verifiers > allowing them to automatically update their trust anchors, as > described in [RFC5011]. TLS clients using this specification are > also expected to use such a mechanism to keep their trust anchors > updated. Some operating systems may have a system-wide service to > maintain and keep the root trust anchor up to date. In such cases, > the TLS client application could simply reference that as its trust > anchor, periodically checking whether it has changed. Hence clients should signal servers whether they want the root DNSKEY RRset, or already have a sufficiently fresh local copy. --=20 Viktor. From nobody Thu Mar 23 07:32:01 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ACDC71243FE for ; Thu, 23 Mar 2017 07:32:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.919 X-Spam-Level: X-Spam-Status: No, score=-6.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4q8_WpjSsHnf for ; Thu, 23 Mar 2017 07:31:59 -0700 (PDT) Received: from lizzard.sbs.de (lizzard.sbs.de [194.138.37.39]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB4D61296E5 for ; Thu, 23 Mar 2017 07:31:58 -0700 (PDT) Received: from mail1.sbs.de (mail1.sbs.de [192.129.41.35]) by lizzard.sbs.de (8.15.2/8.15.2) with ESMTPS id v2NEVufC020650 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 23 Mar 2017 15:31:56 +0100 Received: from DEFTHW99ERJMSX.ww902.siemens.net (defthw99erjmsx.ww902.siemens.net [139.22.70.135]) by mail1.sbs.de (8.15.2/8.15.2) with ESMTPS id v2NEVt9I006683 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Thu, 23 Mar 2017 15:31:56 +0100 Received: from DEFTHW99ERCMSX.ww902.siemens.net (139.22.70.70) by DEFTHW99ERJMSX.ww902.siemens.net (139.22.70.135) with Microsoft SMTP Server (TLS) id 14.3.339.0; Thu, 23 Mar 2017 15:31:54 +0100 Received: from DENBGAT9EH2MSX.ww902.siemens.net ([169.254.6.129]) by DEFTHW99ERCMSX.ww902.siemens.net ([139.22.70.70]) with mapi id 14.03.0339.000; Thu, 23 Mar 2017 15:31:54 +0100 From: "Fries, Steffen" To: "tls@ietf.org" Thread-Topic: Enforcing stronger server side signature/hash combinations in TLS 1.2 Thread-Index: AdKj4jdTMGBzllsXQzCZ8vwWateOaA== Date: Thu, 23 Mar 2017 14:31:53 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [139.22.70.49] Content-Type: multipart/alternative; boundary="_000_E6C9F0E527F94F4692731382340B337846DD1BDENBGAT9EH2MSXww9_" MIME-Version: 1.0 Archived-At: Subject: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 14:32:00 -0000 --_000_E6C9F0E527F94F4692731382340B337846DD1BDENBGAT9EH2MSXww9_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi all, according to TLS 1.2 section 7.4.1.4.1. a client may use the signature_alg= orithm extension to signal any combinations the client supports, listed in = the order of preferences. If the client does not use this extension, the se= rver must use the signature algorithm in combination with SHA1. This may le= ad to an error on the client side when validating the certificate. Unfortun= ately the server is not allowed to use this extension, otherwise he could t= ell the client his preferences according to his security policy. Is there a= standard compliant way to utilize SHA256 based certificates on the server = side even when a client does not signal additional signature algorithms? I looked through the mailing list but did not find an immediate answer to m= y question, but I guess, it must have been discussed already. Thank you in = advance for any hint. Best regards Steffen -- Steffen Fries Siemens AG Corporate Technology CT RDA ITS --_000_E6C9F0E527F94F4692731382340B337846DD1BDENBGAT9EH2MSXww9_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi all,

 

according to  TLS 1.2 section 7.4.1.4.1. a clie= nt may use the signature_algorithm extension to signal any combinations the= client supports, listed in the order of preferences. If the client does no= t use this extension, the server must use the signature algorithm in combination with SHA1. This may lead to an erro= r on the client side when validating the certificate. Unfortunately the ser= ver is not allowed to use this extension, otherwise he could tell the clien= t his preferences according to his security policy. Is there a standard compliant way to utilize SHA256 based= certificates on the server side even when a client does not signal additio= nal signature algorithms?

 

I looked through the mailing list but did not find a= n immediate answer to my question, but I guess, it must have been discussed= already. Thank you in advance for any hint.

 

Best regards

Steffen

 

--
Steffen Fries
Siemens AG
Corporate Technology
CT RDA ITS

 

--_000_E6C9F0E527F94F4692731382340B337846DD1BDENBGAT9EH2MSXww9_-- From nobody Thu Mar 23 07:39:12 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF3D21296D2 for ; Thu, 23 Mar 2017 07:39:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fdjzdbgifhnt for ; Thu, 23 Mar 2017 07:39:07 -0700 (PDT) Received: from mournblade.imrryr.org (mournblade.imrryr.org [108.5.242.66]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B90712967F for ; Thu, 23 Mar 2017 07:39:07 -0700 (PDT) Received: from vpro.lan (cpe-74-71-8-253.nyc.res.rr.com [74.71.8.253]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mournblade.imrryr.org (Postfix) with ESMTPSA id 152E87A32F1 for ; Thu, 23 Mar 2017 14:39:06 +0000 (UTC) (envelope-from ietf-dane@dukhovni.org) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Viktor Dukhovni In-Reply-To: Date: Thu, 23 Mar 2017 10:39:05 -0400 Content-Transfer-Encoding: quoted-printable Reply-To: TLS WG Message-Id: <4DD1F233-D659-4F79-9ADA-BC31A49DA653@dukhovni.org> References: To: TLS WG X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 14:39:10 -0000 > On Mar 23, 2017, at 10:31 AM, Fries, Steffen = wrote: > =20 > According to TLS 1.2 section 7.4.1.4.1. a client may use the > signature_algorithm extension to signal any combinations the > client supports, listed in the order of preferences. The signature algorithm is primarily about signatures made as part of the TLS handshake, and not so much signatures in certificates. > If the client does not use this extension, the server must use the > signature algorithm in combination with SHA1. For signing the TLS key exchange, however, it should still present whatever certificate chain it has, even if that chain employs SHA256. It is exceedingly unlikely these days that a client will not support SHA256 signatures in the certificate chain. > This may lead to an error on the client side when validating the > certificate. You really should not even deploy SHA1 certificates these days, though some sites are still using their legacy SHA1 certificates that have not yet expired. > Unfortunately the server is not allowed to use this extension, = otherwise > he could tell the client his preferences according to his security = policy. The protocol (as it should) lacks the additional round-trips necessary = for the server to initiate signature algorithm negotiation. > Is there a standard compliant way to utilize SHA256 based certificates = on > the server side even when a client does not signal additional = signature > algorithms? Yes, just use them regardless of the client's signature algorithm extension. See the TLS 1.3 draft for improved language about the interaction of signature algorithms and certificates. --=20 Viktor. From nobody Thu Mar 23 08:24:00 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13B17129781 for ; Thu, 23 Mar 2017 08:23:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IUL8GJaRIJfk for ; Thu, 23 Mar 2017 08:23:55 -0700 (PDT) Received: from mail-yw0-x22d.google.com (mail-yw0-x22d.google.com [IPv6:2607:f8b0:4002:c05::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C4E4012426E for ; Thu, 23 Mar 2017 08:23:55 -0700 (PDT) Received: by mail-yw0-x22d.google.com with SMTP id v76so149197921ywg.0 for ; Thu, 23 Mar 2017 08:23:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=z+UBiA8KMTWrnrDXxdoQQU5+p3fPhlS3Gg12EzzEUCA=; b=q0J8DvD9cUwJUJF/oAju43bx1SnL7xDdaT19KR7aYOh0jUEbgibuS86bAAG8yXIC+9 tliYN4Ish2IXBMhxkSKU89yzLdncE0tqrbmagiVLi9kUHUG3DkFDNm5sMII64K+5qFRE UXo+YBNFBswdjId6QtD9ro1Ynmn1V3a3ibRQCaFU+LXXvswG0JlAzwmOm4ucWnF9SnE7 2x0AWoUydnXdie373tHA/8Vu0lxtAF/Ih+w2zB/sQN0wTZrgXNBH6cwsoL/EqS0jaqER R8XNKuOQWjNAdcM0YEL5h5K8NQ9M8M/ehGdsbxLhfVBbikqFxfFR1icOsap/Cu5w30M1 IhRA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=z+UBiA8KMTWrnrDXxdoQQU5+p3fPhlS3Gg12EzzEUCA=; b=c1xuEZFr+XqJI5ue3St1Uckhas3hvJsqvYmsoHH5iiw+f/TgeZtvDFpuf/DN4Dl1BF 8ffSEy0APrqXwmX0f6iZf12BB6PCot7s+8cGQld9pHoun/IWAPFLUZesszyslE17yADn fAKZ1dQlE5BtiTb36lQFVH9kjrV21eeJIrlziWMbKUzI2vmnXAF3Muzexo3XhFPJ0MTI DtQKAhrAG/cHtuPpzWhGBhwpH+Jm6dLNEJ1YfDdjM4j04VY6USsZ5X578Q+HFnSSpGxT xj7XTJZdIJ5gK/7bxCa3snhZQu0SnfGLacRW6O04hPb9brg98II+VE185x34F+XPsW4j 3wRA== X-Gm-Message-State: AFeK/H0WR4akl+p/3O1d9wWlh8VCkw06s2hRgeB0lISyPUrOLxo/koNmBitEMsEGAg1TLGftjYnfOaEW9TO8uA== X-Received: by 10.37.53.138 with SMTP id c132mr2100572yba.105.1490282634751; Thu, 23 Mar 2017 08:23:54 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Thu, 23 Mar 2017 08:23:14 -0700 (PDT) In-Reply-To: <4DD1F233-D659-4F79-9ADA-BC31A49DA653@dukhovni.org> References: <4DD1F233-D659-4F79-9ADA-BC31A49DA653@dukhovni.org> From: Eric Rescorla Date: Thu, 23 Mar 2017 08:23:14 -0700 Message-ID: To: TLS WG Content-Type: multipart/alternative; boundary=001a114bbb320f478f054b6777d3 Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 15:23:58 -0000 --001a114bbb320f478f054b6777d3 Content-Type: text/plain; charset=UTF-8 On Thu, Mar 23, 2017 at 7:39 AM, Viktor Dukhovni wrote: > > > On Mar 23, 2017, at 10:31 AM, Fries, Steffen > wrote: > > > > According to TLS 1.2 section 7.4.1.4.1. a client may use the > > signature_algorithm extension to signal any combinations the > > client supports, listed in the order of preferences. > > The signature algorithm is primarily about signatures made as part > of the TLS handshake, and not so much signatures in certificates. > This does not seem consistent with https://tools.ietf.org/rfcmarkup?doc=5246#section-7.4.2 "If the client provided a "signature_algorithms" extension, then all certificates provided by the server MUST be signed by a hash/signature algorithm pair that appears in that extension." I appreciate that there are people who feel that this rule is bad, and to some extent it has been relaxed in 1.3, but I think the text is pretty clear here. > If the client does not use this extension, the server must use the > > signature algorithm in combination with SHA1. > > For signing the TLS key exchange, however, it should still present > whatever certificate chain it has, even if that chain employs SHA256. > It is exceedingly unlikely these days that a client will not support > SHA256 signatures in the certificate chain. > Yes, that's generally true. Though a TLS 1.2 client which does not offer SHA-256 in its ClientHello but accepts SHA-256 is broken. So, this should generally only happen with TLS 1.1 and below. > Unfortunately the server is not allowed to use this extension, otherwise > > he could tell the client his preferences according to his security > policy. > > The protocol (as it should) lacks the additional round-trips necessary for > the server to initiate signature algorithm negotiation. > I'm not sure quite what the OP Is trying to achieve here. For certificates offered by the server, the client just tells you what algorithms it will accept for no negotiation is needed. For certificates offered by the client, the server tells the client what algorithms it will accept in the CertificateRequest. https://tools.ietf.org/rfcmarkup?doc=5246#section-7.4.4 -Ekr --001a114bbb320f478f054b6777d3 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Thu, Mar 23, 2017 at 7:39 AM, Viktor Dukhovni <= ietf-dane@dukho= vni.org> wrote:

> On Mar 23, 2017, at 10:31 AM, Fries, Steffen <steffen.fries@siemens.com> wrote:
>
> According to=C2=A0 TLS 1.2 section 7.4.1.4.1. a client may use the
> signature_algorithm extension to signal any com= binations the
> client supports, listed in the order of preferences.

The signature algorithm is primarily about signatures made as part of the TLS handshake, and not so much signatures in certificates.

=C2=A0
&quo= t;If the client provided a "signature_algorithms" extension, then= all certificates provided by
the server MUST be signed by a hash= /signature algorithm pair that appears in that extension."
<= br>
I appreciate that there are people who feel that this rule is= bad, and
to some extent it has been relaxed in 1.3, but I think = the text is
pretty clear here.


> If the client does not use this extension, the server must use the
> signature algorithm in combination with SHA1.

For signing the TLS key exchange, however, it should still present whatever certificate chain it has, even if that chain employs SHA256.
It is exceedingly unlikely these days that a client will not support
SHA256 signatures in the certificate chain.

=
Yes, that's generally true. Though a TLS 1.2 client which does not= offer SHA-256
in its ClientHello but accepts SHA-256 is broken. = So, this should generally
only happen with TLS 1.1 and below.



> Unfortunately the server is not allowed to use this extension, otherwi= se
> he could tell the client his preferences according to his security pol= icy.

The protocol (as it should) lacks the additional round-trips necessa= ry for
the server to initiate signature algorithm negotiation.

I'm not sure quite what the OP Is trying to achieve he= re. For certificates offered
by the server, the client just tells= you what algorithms it will accept for no negotiation
is needed.= For certificates offered by the client, the server tells the client
<= div>what algorithms it will accept in the CertificateRequest.

-Ekr
--001a114bbb320f478f054b6777d3-- From nobody Thu Mar 23 08:28:25 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5CE6E12948A for ; Thu, 23 Mar 2017 08:28:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.919 X-Spam-Level: X-Spam-Status: No, score=-6.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xp2E-4v3WJt6 for ; Thu, 23 Mar 2017 08:28:21 -0700 (PDT) Received: from gecko.sbs.de (gecko.sbs.de [194.138.37.40]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2EF96120727 for ; Thu, 23 Mar 2017 08:28:21 -0700 (PDT) Received: from mail1.sbs.de (mail1.sbs.de [192.129.41.35]) by gecko.sbs.de (8.15.2/8.15.2) with ESMTPS id v2NFSJ6W001603 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 23 Mar 2017 16:28:19 +0100 Received: from DEFTHW99ERKMSX.ww902.siemens.net (defthw99erkmsx.ww902.siemens.net [139.22.70.147]) by mail1.sbs.de (8.15.2/8.15.2) with ESMTPS id v2NFSJKO010174 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Thu, 23 Mar 2017 16:28:19 +0100 Received: from DEFTHW99ERFMSX.ww902.siemens.net (139.22.70.67) by DEFTHW99ERKMSX.ww902.siemens.net (139.22.70.147) with Microsoft SMTP Server (TLS) id 14.3.339.0; Thu, 23 Mar 2017 16:28:18 +0100 Received: from DENBGAT9EH2MSX.ww902.siemens.net ([169.254.6.129]) by DEFTHW99ERFMSX.ww902.siemens.net ([139.22.70.67]) with mapi id 14.03.0339.000; Thu, 23 Mar 2017 16:28:18 +0100 From: "Fries, Steffen" To: TLS WG Thread-Topic: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 Thread-Index: AQHSo+oY1JOkT6DAvEmwIlzllF5qgA== Date: Thu, 23 Mar 2017 15:28:17 +0000 Message-ID: References: <4DD1F233-D659-4F79-9ADA-BC31A49DA653@dukhovni.org> In-Reply-To: <4DD1F233-D659-4F79-9ADA-BC31A49DA653@dukhovni.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [139.22.70.49] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 15:28:23 -0000 Hi Viktor, thanks for the response, I replied inline. > According to TLS 1.2 section 7.4.1.4.1. a client may use the=20 > signature_algorithm extension to signal any combinations the client=20 > supports, listed in the order of preferences. The signature algorithm is primarily about signatures made as part of the T= LS handshake, and not so much signatures in certificates. [[stf]] In general I agree, but section 7.4.2 directly relates to certifica= tes used by the server: If the client provided a "signature_algorithms" extension, then all c= ertificates provided by the server MUST be signed by a=20 hash/signature algorithm pair that appears in that extension. Based on that I concluded the same restriction (fallback to SHA1) regarding= the absence of the signature_algorithm extension applies for the certifica= tes. =20 > If the client does not use this extension, the server must use the=20 > signature algorithm in combination with SHA1. For signing the TLS key exchange, however, it should still present whatever= certificate chain it has, even if that chain employs SHA256. It is exceedingly unlikely these days that a client will not support SHA256 signatures in the certificate chain. [[stf]] This is true, specifically, if the client offered SHA256 cipher sui= tes > This may lead to an error on the client side when validating the=20 > certificate. You really should not even deploy SHA1 certificates these days, though some= sites are still using their legacy SHA1 certificates that have not yet exp= ired. [[stf]] Completely agree. I was curious if there is an option to signal to = the client that the server is not willing to support outdated algorithms ex= plicitly, rather than using a SHA256 based cert, which may lead to an error= in a legacy client, it it does not support SHA256. > Unfortunately the server is not allowed to use this extension,=20 > otherwise he could tell the client his preferences according to his secur= ity policy. The protocol (as it should) lacks the additional round-trips necessary for = the server to initiate signature algorithm negotiation. [[stf]] Yes, realized that. It gets better in TLS1.3 > Is there a standard compliant way to utilize SHA256 based certificates=20 > on the server side even when a client does not signal additional=20 > signature algorithms? Yes, just use them regardless of the client's signature algorithm extension= . See the TLS 1.3 draft for improved language about the interaction of sig= nature algorithms and certificates. [[stf]] That is the point I stumbled about. The text in 7.4.2 describes wha= t a server must do, when a client uses the signature algorithm extension, b= ut does not describe the supported behavior if the client does not use this= extension. It somehow implies that the server shall behave like described = for the cipher suite case (section 7.4.1.4.1). From a security perspective = I completely agree, one should not use outdated crypto.=20 Best regards Steffen --=20 Viktor. _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls From nobody Thu Mar 23 08:37:11 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A06521296ED for ; Thu, 23 Mar 2017 08:37:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.918 X-Spam-Level: X-Spam-Status: No, score=-6.918 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gWy-ADhrA0Zd for ; Thu, 23 Mar 2017 08:37:07 -0700 (PDT) Received: from lizzard.sbs.de (lizzard.sbs.de [194.138.37.39]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 05285129781 for ; Thu, 23 Mar 2017 08:37:05 -0700 (PDT) Received: from mail1.sbs.de (mail1.sbs.de [192.129.41.35]) by lizzard.sbs.de (8.15.2/8.15.2) with ESMTPS id v2NFb3SM006632 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 23 Mar 2017 16:37:03 +0100 Received: from DEFTHW99ERLMSX.ww902.siemens.net (defthw99erlmsx.ww902.siemens.net [139.22.70.136]) by mail1.sbs.de (8.15.2/8.15.2) with ESMTPS id v2NFb3bm000827 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Thu, 23 Mar 2017 16:37:03 +0100 Received: from DENBGAT9ER1MSX.ww902.siemens.net (139.22.70.87) by DEFTHW99ERLMSX.ww902.siemens.net (139.22.70.136) with Microsoft SMTP Server (TLS) id 14.3.339.0; Thu, 23 Mar 2017 16:37:03 +0100 Received: from DENBGAT9EH2MSX.ww902.siemens.net ([169.254.6.129]) by DENBGAT9ER1MSX.ww902.siemens.net ([139.22.70.87]) with mapi id 14.03.0339.000; Thu, 23 Mar 2017 16:37:02 +0100 From: "Fries, Steffen" To: TLS WG Thread-Topic: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 Thread-Index: AQHSo+tRbCE70GuRKkiIdy7OdMXyAg== Date: Thu, 23 Mar 2017 15:37:02 +0000 Message-ID: References: <4DD1F233-D659-4F79-9ADA-BC31A49DA653@dukhovni.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [139.22.70.49] Content-Type: multipart/alternative; boundary="_000_E6C9F0E527F94F4692731382340B337846DE14DENBGAT9EH2MSXww9_" MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 15:37:10 -0000 --_000_E6C9F0E527F94F4692731382340B337846DE14DENBGAT9EH2MSXww9_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgRXJpaywNCg0KYmFzZWQgb24geW91ciByZXBseSBteSBjb25jbHVzaW9uIGlzIHRoYXQNCg0K LSAgICAgICAgICB0aGVyZSBpcyBubyAoc3RhbmRhcmQgY29tcGxpYW50KSB3YXkgZm9yIGEgc2Vy dmVyIHRvIHVzZSBhIFNIQTI1NiBiYXNlZCBjZXJ0aWZpY2F0ZSBmb3Igc2VydmVyIHNpZGUgYXV0 aGVudGljYXRpb24gaW4gY2FzZXMgd2hlcmUgdGhlIGNsaWVudCBkb2VzIG5vdCBwcm92aWRlIHRo ZSBzaWduYXR1cmVfYWxnb3JpdGhtIGV4dGVuc2lvbg0KDQotICAgICAgICAgIGNsaWVudHMgc2hv dWxkIGFsd2F5cyB1c2UgdGhlIHNpZ25hdHVyZSBhbGdvcml0aG0gZXh0ZW5zaW9uIHRvIGVuc3Vy ZSB0aGUgc2VydmVyIGNhbiBhcHBseSBhIGNlcnRpZmljYXRlIHdpdGggdGhlIGFwcHJvcHJpYXRl IGNyeXB0IGFsZ29yaXRobXMNCg0KQmVzdCByZWdhcmRzDQpTdGVmZmVuDQoNCk9uIFRodSwgTWFy IDIzLCAyMDE3IGF0IDc6MzkgQU0sIFZpa3RvciBEdWtob3ZuaSA8aWV0Zi1kYW5lQGR1a2hvdm5p Lm9yZzxtYWlsdG86aWV0Zi1kYW5lQGR1a2hvdm5pLm9yZz4+IHdyb3RlOg0KDQo+IE9uIE1hciAy MywgMjAxNywgYXQgMTA6MzEgQU0sIEZyaWVzLCBTdGVmZmVuIDxzdGVmZmVuLmZyaWVzQHNpZW1l bnMuY29tPG1haWx0bzpzdGVmZmVuLmZyaWVzQHNpZW1lbnMuY29tPj4gd3JvdGU6DQo+DQo+IEFj Y29yZGluZyB0byAgVExTIDEuMiBzZWN0aW9uIDcuNC4xLjQuMS4gYSBjbGllbnQgbWF5IHVzZSB0 aGUNCj4gc2lnbmF0dXJlX2FsZ29yaXRobSBleHRlbnNpb24gdG8gc2lnbmFsIGFueSBjb21iaW5h dGlvbnMgdGhlDQo+IGNsaWVudCBzdXBwb3J0cywgbGlzdGVkIGluIHRoZSBvcmRlciBvZiBwcmVm ZXJlbmNlcy4NCg0KVGhlIHNpZ25hdHVyZSBhbGdvcml0aG0gaXMgcHJpbWFyaWx5IGFib3V0IHNp Z25hdHVyZXMgbWFkZSBhcyBwYXJ0DQpvZiB0aGUgVExTIGhhbmRzaGFrZSwgYW5kIG5vdCBzbyBt dWNoIHNpZ25hdHVyZXMgaW4gY2VydGlmaWNhdGVzLg0KDQpUaGlzIGRvZXMgbm90IHNlZW0gY29u c2lzdGVudCB3aXRoIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvcmZjbWFya3VwP2RvYz01MjQ2I3Nl Y3Rpb24tNy40LjINCg0KIklmIHRoZSBjbGllbnQgcHJvdmlkZWQgYSAic2lnbmF0dXJlX2FsZ29y aXRobXMiIGV4dGVuc2lvbiwgdGhlbiBhbGwgY2VydGlmaWNhdGVzIHByb3ZpZGVkIGJ5DQp0aGUg c2VydmVyIE1VU1QgYmUgc2lnbmVkIGJ5IGEgaGFzaC9zaWduYXR1cmUgYWxnb3JpdGhtIHBhaXIg dGhhdCBhcHBlYXJzIGluIHRoYXQgZXh0ZW5zaW9uLiINCg0KSSBhcHByZWNpYXRlIHRoYXQgdGhl cmUgYXJlIHBlb3BsZSB3aG8gZmVlbCB0aGF0IHRoaXMgcnVsZSBpcyBiYWQsIGFuZA0KdG8gc29t ZSBleHRlbnQgaXQgaGFzIGJlZW4gcmVsYXhlZCBpbiAxLjMsIGJ1dCBJIHRoaW5rIHRoZSB0ZXh0 IGlzDQpwcmV0dHkgY2xlYXIgaGVyZS4NCg0KDQo+IElmIHRoZSBjbGllbnQgZG9lcyBub3QgdXNl IHRoaXMgZXh0ZW5zaW9uLCB0aGUgc2VydmVyIG11c3QgdXNlIHRoZQ0KPiBzaWduYXR1cmUgYWxn b3JpdGhtIGluIGNvbWJpbmF0aW9uIHdpdGggU0hBMS4NCg0KRm9yIHNpZ25pbmcgdGhlIFRMUyBr ZXkgZXhjaGFuZ2UsIGhvd2V2ZXIsIGl0IHNob3VsZCBzdGlsbCBwcmVzZW50DQp3aGF0ZXZlciBj ZXJ0aWZpY2F0ZSBjaGFpbiBpdCBoYXMsIGV2ZW4gaWYgdGhhdCBjaGFpbiBlbXBsb3lzIFNIQTI1 Ni4NCkl0IGlzIGV4Y2VlZGluZ2x5IHVubGlrZWx5IHRoZXNlIGRheXMgdGhhdCBhIGNsaWVudCB3 aWxsIG5vdCBzdXBwb3J0DQpTSEEyNTYgc2lnbmF0dXJlcyBpbiB0aGUgY2VydGlmaWNhdGUgY2hh aW4uDQoNClllcywgdGhhdCdzIGdlbmVyYWxseSB0cnVlLiBUaG91Z2ggYSBUTFMgMS4yIGNsaWVu dCB3aGljaCBkb2VzIG5vdCBvZmZlciBTSEEtMjU2DQppbiBpdHMgQ2xpZW50SGVsbG8gYnV0IGFj Y2VwdHMgU0hBLTI1NiBpcyBicm9rZW4uIFNvLCB0aGlzIHNob3VsZCBnZW5lcmFsbHkNCm9ubHkg aGFwcGVuIHdpdGggVExTIDEuMSBhbmQgYmVsb3cuDQoNCg0KDQo+IFVuZm9ydHVuYXRlbHkgdGhl IHNlcnZlciBpcyBub3QgYWxsb3dlZCB0byB1c2UgdGhpcyBleHRlbnNpb24sIG90aGVyd2lzZQ0K PiBoZSBjb3VsZCB0ZWxsIHRoZSBjbGllbnQgaGlzIHByZWZlcmVuY2VzIGFjY29yZGluZyB0byBo aXMgc2VjdXJpdHkgcG9saWN5Lg0KDQpUaGUgcHJvdG9jb2wgKGFzIGl0IHNob3VsZCkgbGFja3Mg dGhlIGFkZGl0aW9uYWwgcm91bmQtdHJpcHMgbmVjZXNzYXJ5IGZvcg0KdGhlIHNlcnZlciB0byBp bml0aWF0ZSBzaWduYXR1cmUgYWxnb3JpdGhtIG5lZ290aWF0aW9uLg0KDQpJJ20gbm90IHN1cmUg cXVpdGUgd2hhdCB0aGUgT1AgSXMgdHJ5aW5nIHRvIGFjaGlldmUgaGVyZS4gRm9yIGNlcnRpZmlj YXRlcyBvZmZlcmVkDQpieSB0aGUgc2VydmVyLCB0aGUgY2xpZW50IGp1c3QgdGVsbHMgeW91IHdo YXQgYWxnb3JpdGhtcyBpdCB3aWxsIGFjY2VwdCBmb3Igbm8gbmVnb3RpYXRpb24NCmlzIG5lZWRl ZC4gRm9yIGNlcnRpZmljYXRlcyBvZmZlcmVkIGJ5IHRoZSBjbGllbnQsIHRoZSBzZXJ2ZXIgdGVs bHMgdGhlIGNsaWVudA0Kd2hhdCBhbGdvcml0aG1zIGl0IHdpbGwgYWNjZXB0IGluIHRoZSBDZXJ0 aWZpY2F0ZVJlcXVlc3QuDQpodHRwczovL3Rvb2xzLmlldGYub3JnL3JmY21hcmt1cD9kb2M9NTI0 NiNzZWN0aW9uLTcuNC40DQoNCi1Fa3INCg== --_000_E6C9F0E527F94F4692731382340B337846DE14DENBGAT9EH2MSXww9_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTIgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLCJzZXJpZiI7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUt cHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30N CmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3Jp dHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5N c29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdyYXBoLCBkaXYuTXNvTGlzdFBhcmFncmFw aA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFyZ2luLXRvcDowY207DQoJbWFyZ2luLXJp Z2h0OjBjbTsNCgltYXJnaW4tYm90dG9tOjBjbTsNCgltYXJnaW4tbGVmdDozNi4wcHQ7DQoJbWFy Z2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRp bWVzIE5ldyBSb21hbiIsInNlcmlmIjt9DQpzcGFuLmdtYWlsLQ0KCXttc28tc3R5bGUtbmFtZTpn bWFpbC07fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVw bHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLCJzYW5zLXNlcmlmIjsNCgljb2xvcjojMUY0OTdE O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5O30NCkBwYWdl IFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzkyLjBwdDsNCgltYXJnaW46NzIuMHB0IDcy LjBwdCA3Mi4wcHQgNzIuMHB0O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlv bjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6MTIw ODAzMTQ2MTsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6 MTAwMzc4MjI2MCAtMTkxMjA1MjkzMiA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5 MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5Mzt9DQpAbGlzdCBsMDpsZXZlbDEN Cgl7bXNvLWxldmVsLXN0YXJ0LWF0OjI7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Oi07DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLCJzYW5zLXNlcmlmIjsNCgltc28tZmFyZWFzdC1mb250LWZhbWlseTpD YWxpYnJpOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCm9sDQoJ e21hcmdpbi1ib3R0b206MGNtO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGNtO30NCi0tPjwvc3R5 bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0 IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDld Pjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRp dCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVh ZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYg Y2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj5IaSBFcmlrLDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90 O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+YmFzZWQgb24geW91ciByZXBseSBteSBj b25jbHVzaW9uIGlzIHRoYXQNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29M aXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRlbnQ6LTE4LjBwdDttc28tbGlzdDpsMCBsZXZl bDEgbGZvMSI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7 O2NvbG9yOiMxRjQ5N0QiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPi08c3BhbiBzdHls ZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48 L3NwYW4+PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdE Ij50aGVyZSBpcyBubyAoc3RhbmRhcmQgY29tcGxpYW50KSB3YXkgZm9yIGEgc2VydmVyIHRvIHVz ZSBhIFNIQTI1NiBiYXNlZCBjZXJ0aWZpY2F0ZSBmb3Igc2VydmVyIHNpZGUgYXV0aGVudGljYXRp b24gaW4gY2FzZXMgd2hlcmUgdGhlIGNsaWVudCBkb2VzDQogbm90IHByb3ZpZGUgdGhlIHNpZ25h dHVyZV9hbGdvcml0aG0gZXh0ZW5zaW9uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0LWluZGVudDotMTguMHB0O21zby1saXN0Omww IGxldmVsMSBsZm8xIj48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYm cXVvdDs7Y29sb3I6IzFGNDk3RCI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+LTxzcGFu IHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9z cGFuPjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMx RjQ5N0QiPmNsaWVudHMgc2hvdWxkIGFsd2F5cyB1c2UgdGhlIHNpZ25hdHVyZSBhbGdvcml0aG0g ZXh0ZW5zaW9uIHRvIGVuc3VyZSB0aGUgc2VydmVyIGNhbiBhcHBseSBhIGNlcnRpZmljYXRlIHdp dGggdGhlIGFwcHJvcHJpYXRlIGNyeXB0IGFsZ29yaXRobXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6 IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPkJlc3QgcmVnYXJk czxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7 c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5TdGVmZmVuDQo8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7 Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPk9uIFRodSwgTWFyIDIz LCAyMDE3IGF0IDc6MzkgQU0sIFZpa3RvciBEdWtob3ZuaSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmll dGYtZGFuZUBkdWtob3ZuaS5vcmciIHRhcmdldD0iX2JsYW5rIj5pZXRmLWRhbmVAZHVraG92bmku b3JnPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48YnI+DQomZ3Q7IE9uIE1hciAyMywgMjAxNywgYXQg MTA6MzEgQU0sIEZyaWVzLCBTdGVmZmVuICZsdDs8YSBocmVmPSJtYWlsdG86c3RlZmZlbi5mcmll c0BzaWVtZW5zLmNvbSI+c3RlZmZlbi5mcmllc0BzaWVtZW5zLmNvbTwvYT4mZ3Q7IHdyb3RlOjxi cj4NCiZndDs8YnI+DQomZ3Q7IEFjY29yZGluZyB0byZuYnNwOyBUTFMgMS4yIHNlY3Rpb24gNy40 LjEuNC4xLiBhIGNsaWVudCBtYXkgdXNlIHRoZTxicj4NCjxzcGFuIGNsYXNzPSJnbWFpbC0iPiZn dDsgc2lnbmF0dXJlX2FsZ29yaXRobSBleHRlbnNpb24gdG8gc2lnbmFsIGFueSBjb21iaW5hdGlv bnMgdGhlPC9zcGFuPjxicj4NCjxzcGFuIGNsYXNzPSJnbWFpbC0iPiZndDsgY2xpZW50IHN1cHBv cnRzLCBsaXN0ZWQgaW4gdGhlIG9yZGVyIG9mIHByZWZlcmVuY2VzLjwvc3Bhbj48YnI+DQo8YnI+ DQpUaGUgc2lnbmF0dXJlIGFsZ29yaXRobSBpcyBwcmltYXJpbHkgYWJvdXQgc2lnbmF0dXJlcyBt YWRlIGFzIHBhcnQ8YnI+DQpvZiB0aGUgVExTIGhhbmRzaGFrZSwgYW5kIG5vdCBzbyBtdWNoIHNp Z25hdHVyZXMgaW4gY2VydGlmaWNhdGVzLjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjM2LjBwdCI+VGhpcyBkb2VzIG5vdCBzZWVtIGNvbnNpc3RlbnQgd2l0aA0KPGEgaHJlZj0i aHR0cHM6Ly90b29scy5pZXRmLm9yZy9yZmNtYXJrdXA/ZG9jPTUyNDYjc2VjdGlvbi03LjQuMiI+ aHR0cHM6Ly90b29scy5pZXRmLm9yZy9yZmNtYXJrdXA/ZG9jPTUyNDYjc2VjdGlvbi03LjQuMjwv YT48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+JnF1 b3Q7SWYgdGhlIGNsaWVudCBwcm92aWRlZCBhICZxdW90O3NpZ25hdHVyZV9hbGdvcml0aG1zJnF1 b3Q7IGV4dGVuc2lvbiwgdGhlbiBhbGwgY2VydGlmaWNhdGVzIHByb3ZpZGVkIGJ5PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij50aGUgc2VydmVyIE1VU1QgYmUgc2lnbmVkIGJ5IGEgaGFzaC9zaWduYXR1 cmUgYWxnb3JpdGhtIHBhaXIgdGhhdCBhcHBlYXJzIGluIHRoYXQgZXh0ZW5zaW9uLiZxdW90Ozxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5JIGFwcHJl Y2lhdGUgdGhhdCB0aGVyZSBhcmUgcGVvcGxlIHdobyBmZWVsIHRoYXQgdGhpcyBydWxlIGlzIGJh ZCwgYW5kPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij50byBzb21lIGV4dGVudCBpdCBoYXMgYmVlbiBy ZWxheGVkIGluIDEuMywgYnV0IEkgdGhpbmsgdGhlIHRleHQgaXM8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4w cHQiPnByZXR0eSBjbGVhciBoZXJlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MzYuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVv dGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFk ZGluZzowY20gMGNtIDBjbSA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGNt Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFu IGNsYXNzPSJnbWFpbC0iPiZndDsgSWYgdGhlIGNsaWVudCBkb2VzIG5vdCB1c2UgdGhpcyBleHRl bnNpb24sIHRoZSBzZXJ2ZXIgbXVzdCB1c2UgdGhlPC9zcGFuPjxicj4NCjxzcGFuIGNsYXNzPSJn bWFpbC0iPiZndDsgc2lnbmF0dXJlIGFsZ29yaXRobSBpbiBjb21iaW5hdGlvbiB3aXRoIFNIQTEu PC9zcGFuPjxicj4NCjxicj4NCkZvciBzaWduaW5nIHRoZSBUTFMga2V5IGV4Y2hhbmdlLCBob3dl dmVyLCBpdCBzaG91bGQgc3RpbGwgcHJlc2VudDxicj4NCndoYXRldmVyIGNlcnRpZmljYXRlIGNo YWluIGl0IGhhcywgZXZlbiBpZiB0aGF0IGNoYWluIGVtcGxveXMgU0hBMjU2Ljxicj4NCkl0IGlz IGV4Y2VlZGluZ2x5IHVubGlrZWx5IHRoZXNlIGRheXMgdGhhdCBhIGNsaWVudCB3aWxsIG5vdCBz dXBwb3J0PGJyPg0KU0hBMjU2IHNpZ25hdHVyZXMgaW4gdGhlIGNlcnRpZmljYXRlIGNoYWluLjxv OnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+ WWVzLCB0aGF0J3MgZ2VuZXJhbGx5IHRydWUuIFRob3VnaCBhIFRMUyAxLjIgY2xpZW50IHdoaWNo IGRvZXMgbm90IG9mZmVyIFNIQS0yNTY8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPmluIGl0cyBDbGll bnRIZWxsbyBidXQgYWNjZXB0cyBTSEEtMjU2IGlzIGJyb2tlbi4gU28sIHRoaXMgc2hvdWxkIGdl bmVyYWxseTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+b25seSBoYXBwZW4gd2l0aCBUTFMgMS4xIGFu ZCBiZWxvdy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBw dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICND Q0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDtt YXJnaW4tcmlnaHQ6MGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDozNi4wcHQiPjxzcGFuIGNsYXNzPSJnbWFpbC0iPiZndDsgVW5mb3J0dW5hdGVseSB0aGUgc2Vy dmVyIGlzIG5vdCBhbGxvd2VkIHRvIHVzZSB0aGlzIGV4dGVuc2lvbiwgb3RoZXJ3aXNlPC9zcGFu Pjxicj4NCjxzcGFuIGNsYXNzPSJnbWFpbC0iPiZndDsgaGUgY291bGQgdGVsbCB0aGUgY2xpZW50 IGhpcyBwcmVmZXJlbmNlcyBhY2NvcmRpbmcgdG8gaGlzIHNlY3VyaXR5IHBvbGljeS48L3NwYW4+ PGJyPg0KPGJyPg0KVGhlIHByb3RvY29sIChhcyBpdCBzaG91bGQpIGxhY2tzIHRoZSBhZGRpdGlv bmFsIHJvdW5kLXRyaXBzIG5lY2Vzc2FyeSBmb3I8YnI+DQp0aGUgc2VydmVyIHRvIGluaXRpYXRl IHNpZ25hdHVyZSBhbGdvcml0aG0gbmVnb3RpYXRpb24uPG86cD48L286cD48L3A+DQo8L2Jsb2Nr cXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2 LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5JJ20gbm90IHN1cmUgcXVpdGUgd2hh dCB0aGUgT1AgSXMgdHJ5aW5nIHRvIGFjaGlldmUgaGVyZS4gRm9yIGNlcnRpZmljYXRlcyBvZmZl cmVkPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij5ieSB0aGUgc2VydmVyLCB0aGUgY2xpZW50IGp1c3Qg dGVsbHMgeW91IHdoYXQgYWxnb3JpdGhtcyBpdCB3aWxsIGFjY2VwdCBmb3Igbm8gbmVnb3RpYXRp b248bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPmlzIG5lZWRlZC4gRm9yIGNlcnRpZmljYXRlcyBvZmZl cmVkIGJ5IHRoZSBjbGllbnQsIHRoZSBzZXJ2ZXIgdGVsbHMgdGhlIGNsaWVudDxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjM2LjBwdCI+d2hhdCBhbGdvcml0aG1zIGl0IHdpbGwgYWNjZXB0IGluIHRoZSBDZXJ0aWZp Y2F0ZVJlcXVlc3QuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48YSBocmVmPSJodHRwczovL3Rvb2xz LmlldGYub3JnL3JmY21hcmt1cD9kb2M9NTI0NiNzZWN0aW9uLTcuNC40Ij5odHRwczovL3Rvb2xz LmlldGYub3JnL3JmY21hcmt1cD9kb2M9NTI0NiNzZWN0aW9uLTcuNC40PC9hPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjM2LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij4tRWtyPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9o dG1sPg0K --_000_E6C9F0E527F94F4692731382340B337846DE14DENBGAT9EH2MSXww9_-- From nobody Thu Mar 23 08:53:41 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D215F127078 for ; Thu, 23 Mar 2017 08:53:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nomountain-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KZX8MnuGuTUF for ; Thu, 23 Mar 2017 08:53:38 -0700 (PDT) Received: from mail-pf0-x232.google.com (mail-pf0-x232.google.com [IPv6:2607:f8b0:400e:c00::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8028C126B6E for ; Thu, 23 Mar 2017 08:53:38 -0700 (PDT) Received: by mail-pf0-x232.google.com with SMTP id p189so84393813pfp.1 for ; Thu, 23 Mar 2017 08:53:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nomountain-net.20150623.gappssmtp.com; s=20150623; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to; bh=C/mpMgVvSgpGKJl1+QvxvF9S6hTR08AQkpYUoURMolI=; b=uh+hmfSNC/X8KLCtRZpM+Wmj6icVJJvwRj1tz+1f/9brngQGbUI8fSufivPxi0CPJB V+fHPm2PJaExRZ5eLnow0cUFfxAyF2b0uvrJWk+XtvV71H1xtw2VJn+15hVJBX5qyA26 HIpQSkjicwUMlMCrnIwojvN2ueK0RjDvY19z1tsMDWcXnPlSc1HRLGS9ygBEBdhvFvJ/ bzXT1YgNCZMAz9xhg8rsebsmWDNQ5LS53qo6LD7L3eBn8FuBmtLi/gwJc7quHG5l6KPp 6s5iIrYt7ZCrWT4vl0nlVmMqXzwcI+zqJGLWrw1oJLRpX3i9SoZ9ETrdkzf1yNS9ICgt pIJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to; bh=C/mpMgVvSgpGKJl1+QvxvF9S6hTR08AQkpYUoURMolI=; b=lj+DGA68DYLlveX5a9+tiRMV6wGFuxnVLsLCLgiJoaAdZhMj/R2sfyblrba/VYyFv4 SrIDOKII7vvZWTi59tP9MM+jeH9ISenq5vpSdU7xlhiIW50G3GzvW4wmILtKVoLFSOKg dN4kuNWwpGf1SKmdOZPzUSY8gFHchwdo2YfkUIyCJj/H2+c1HBDXV+xZ0N6jxZ2Ynx1J /VRDgXYLdptHW8SP7FQRolx2rPjaXZ4OfuyYi6AHa5yOqK78O1f2ypihphkH8I+UCVko 5TCcQAqRRWuj43cvLxvMwml+MCTgE2R6RCph6geOzOdwtW3ApIS1FnTmWsIGMmXz5sl7 lU+A== X-Gm-Message-State: AFeK/H3BSrM3NTe/Y/3FCLr+31XffdDSLAYXItN6wLRFQmPUmBGIQcvPf21mH/lCBWPmbA== X-Received: by 10.98.202.80 with SMTP id n77mr3669421pfg.167.1490284417917; Thu, 23 Mar 2017 08:53:37 -0700 (PDT) Received: from Melindas-MacBook-Pro.local (74-124-98-225-radius.dynamic.acsalaska.net. [74.124.98.225]) by smtp.gmail.com with ESMTPSA id d1sm11155870pfk.20.2017.03.23.08.53.36 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 23 Mar 2017 08:53:37 -0700 (PDT) To: tls@ietf.org References: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> <54343047-7620-4A96-BD39-6E60AE7EA5A2@sn3rd.com> <5f39565c-5417-b94f-f1e6-32261c473455@nomountain.net> From: Melinda Shore Message-ID: <27455360-f4ee-4918-ee08-5ccf99a94ec9@nomountain.net> Date: Thu, 23 Mar 2017 07:53:34 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="GUR0PHNGXW1LF7nCQv5QciIW4UDRh62cm" Archived-At: Subject: Re: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 15:53:40 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --GUR0PHNGXW1LF7nCQv5QciIW4UDRh62cm Content-Type: multipart/mixed; boundary="nrEKAClOBRSKpVTpKBQsBen8tldo98Xx7"; protected-headers="v1" From: Melinda Shore To: tls@ietf.org Message-ID: <27455360-f4ee-4918-ee08-5ccf99a94ec9@nomountain.net> Subject: Re: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt References: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> <54343047-7620-4A96-BD39-6E60AE7EA5A2@sn3rd.com> <5f39565c-5417-b94f-f1e6-32261c473455@nomountain.net> In-Reply-To: --nrEKAClOBRSKpVTpKBQsBen8tldo98Xx7 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Thanks for the thorough review, Viktor. I'll get the straightforward bits into the draft over the weekend and plan on discussing the ones proposing changes to the extension or to chain construction and processing in the working group session. Melinda --nrEKAClOBRSKpVTpKBQsBen8tldo98Xx7-- --GUR0PHNGXW1LF7nCQv5QciIW4UDRh62cm Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJY0+9/AAoJELiGRpM6HoEuln4QAKKHGLFotwGy3/qdjjEhuziy Y70TZ4LDxvLOmvGWo5aWkKOANTJEsmqhNh15PXJ9gAVEEDDjt/z3s2PyF0RMnu0v 5tUeIT8iCFiGqnbhzsh3uW4zjtgG7BsES5XhzXyJX2RFvcOdQc9fbPl0vR+up30x yYYQmdx5io3K+oVd/WmvcrlGcozxCaNjQCtFb0WZoaZrDK/ntd7AR77hd4ftBYCn dIx3pEiWm1GZgKJ4zuQ2Bpw4YyyrybS7MAwxW4/fmzdHR/n0g+zSUi+7OKdgLtjK xStFESHmagtQ97RkPb4stKrv6gi399Riza4Uq9h0b0LttiTmDeVdQaYQsbJUOjgt ghaDE5khgaThpcZLG/9Z2G33EVwGO3dGm2ELqfd08HPPtDfwgh0AfGyaRuZs0lPx hXizHpbyudXRxtsTff3BLx2DCoN45JC7eBOmnl/4szpMY2ua4Wp10bt71mpukMyw 3cRu6d9EJ9h8KorK/or3Wbks7aTRceXmYF2zKxZxcTMcF2ruzFRSQ4I+ZyI9E1A7 Cb79AUqO7POHLFqQBjipfGvFu04xYMGKc8CHNSUuH57XSyfhk8R5Fzca+xAg3fTY x6JhuhYddjbaW/c62dZgvIBoZHgFjGu4TVy153VowrF3FVZZLur3XCUWeViBy2An tWE9HzCBh88Wk42UOKGE =Zl2l -----END PGP SIGNATURE----- --GUR0PHNGXW1LF7nCQv5QciIW4UDRh62cm-- From nobody Thu Mar 23 09:14:23 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7226E1294A0 for ; Thu, 23 Mar 2017 09:14:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7Ul3TaTe0AI5 for ; Thu, 23 Mar 2017 09:14:18 -0700 (PDT) Received: from mournblade.imrryr.org (mournblade.imrryr.org [108.5.242.66]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B890B1297BF for ; Thu, 23 Mar 2017 09:14:16 -0700 (PDT) Received: from [10.67.220.17] (unknown [38.86.167.110]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mournblade.imrryr.org (Postfix) with ESMTPSA id 9B1B67A32F1 for ; Thu, 23 Mar 2017 16:14:15 +0000 (UTC) (envelope-from ietf-dane@dukhovni.org) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Viktor Dukhovni In-Reply-To: <27455360-f4ee-4918-ee08-5ccf99a94ec9@nomountain.net> Date: Thu, 23 Mar 2017 12:14:15 -0400 Content-Transfer-Encoding: quoted-printable Reply-To: TLS WG Message-Id: References: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> <54343047-7620-4A96-BD39-6E60AE7EA5A2@sn3rd.com> <5f39565c-5417-b94f-f1e6-32261c473455@nomountain.net> <27455360-f4ee-4918-ee08-5ccf99a94ec9@nomountain.net> To: TLS WG X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 16:14:23 -0000 > On Mar 23, 2017, at 11:53 AM, Melinda Shore = wrote: >=20 > Thanks for the thorough review, Viktor. I'll get the straightforward > bits into the draft over the weekend and plan on discussing the ones > proposing changes to the extension or to chain construction and > processing in the working group session. It seems to me that the TLS bits of the draft are close to done and relatively simple to finish. Perhaps at this point the reviews the draft needs are more likely to be found in the DNSOP than the TLSWG. Is there precedent for doing two working group last calls, one in the TLS WG to confirm that the TLS bits are done, and then another in DNSOP to go over the details of the DNS bits, and only then proceed to IETF LC? I don't know how many other folks on the TLS WG list are prepared to do a thorough review the DNSSEC aspects of this draft... Perhaps the TLS and DNS communities overlap sufficiently that my concern is not warranted? --=20 Viktor. From nobody Thu Mar 23 09:31:36 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 85A2F1299AF for ; Thu, 23 Mar 2017 09:31:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nomountain-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U5MdoVBNnRP7 for ; Thu, 23 Mar 2017 09:31:32 -0700 (PDT) Received: from mail-pg0-x22e.google.com (mail-pg0-x22e.google.com [IPv6:2607:f8b0:400e:c05::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 47B7E1299B2 for ; Thu, 23 Mar 2017 09:31:28 -0700 (PDT) Received: by mail-pg0-x22e.google.com with SMTP id t143so60479255pgb.2 for ; Thu, 23 Mar 2017 09:31:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nomountain-net.20150623.gappssmtp.com; s=20150623; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to; bh=ynUuBIgW/vX2wmhY2uX7b1sR+xpHOSmjaBC3qr1ww50=; b=eNKd+fGI5OgXvIUedQuacooP61W524wPuCDrSC+oq0FkioPgj0ZfkSlmiiGmfAO5P6 ynIyuqBp7P4+82qmzDn78ScNWjnsz0NQVmeIw8DR3Fok/l1OBCCgd6efDCucGgihMhKE ONqdewMxDa++d/1Tb05KEKLBq1/FuHRXUJS1EwbOW7+lQySi9XHpJnXnybhCprZydvm6 d31togk99BaOSLpHLNp0q1nDZ64/GHb8TNuK+kBrLVzQcnNDJb3qXYZjs+AjMd3Bn1hx LuQ+mOHNEcBHeN3mgnNWY3r9FSJ3r0aH7syHDT6ZpvhWtC/X/9uLD+Jfy+/vUzwyq9cq iaBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to; bh=ynUuBIgW/vX2wmhY2uX7b1sR+xpHOSmjaBC3qr1ww50=; b=G7ysb1q5rUBWSk3wY3leLCD6kds3+8gR9FpoL2tqbgcyQpl22T6DUrcRchJK+FP2p6 c4+9PmTuXoOfCBTwfxTRKsn9r4JGxslJnI3lI3rfNRcGg4n6jNc+HHKD3gLPAkjEBYmH FzVAckSoj6B8uJlGwqpzWo4m8AXFJm1RjZ0kNN62T4WGIU0F96eReYCDbg5IKb6n5A++ /qBxRIRFowCSq3MpHAJ2GDC+czR1HFIif6fQzQtxosZXZ6mFzTZ4nviSvEW8FJTtO7va 1BdOTymZvFyT6BjgRnI2AAweqsxwZNvjZ+Z2qWDuldfwMB+JNQ2cw5JyfSq4ds28chcy X0Lg== X-Gm-Message-State: AFeK/H0H2bcSCPxuF2/nYx2fNijQWE+5Wqm0MaFY1QH+bnYcXSV65X+jzDftbKPqi3bpyw== X-Received: by 10.99.127.76 with SMTP id p12mr3959915pgn.42.1490286687622; Thu, 23 Mar 2017 09:31:27 -0700 (PDT) Received: from Melindas-MacBook-Pro.local (74-124-98-225-radius.dynamic.acsalaska.net. [74.124.98.225]) by smtp.gmail.com with ESMTPSA id 189sm7735192pgd.30.2017.03.23.09.31.26 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 23 Mar 2017 09:31:26 -0700 (PDT) To: tls@ietf.org References: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> <54343047-7620-4A96-BD39-6E60AE7EA5A2@sn3rd.com> <5f39565c-5417-b94f-f1e6-32261c473455@nomountain.net> <27455360-f4ee-4918-ee08-5ccf99a94ec9@nomountain.net> From: Melinda Shore Message-ID: <896987d1-4bb4-3f04-a34e-c09b245d038b@nomountain.net> Date: Thu, 23 Mar 2017 08:31:24 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:45.0) Gecko/20100101 Thunderbird/45.7.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="ox3xteVJ1L6hmxHf6qF5qKtIOrfxxdAhq" Archived-At: Subject: Re: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 16:31:34 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --ox3xteVJ1L6hmxHf6qF5qKtIOrfxxdAhq Content-Type: multipart/mixed; boundary="4flTWCO8pC7cF0gLhX7oX0WOdRjlu1fl6"; protected-headers="v1" From: Melinda Shore To: tls@ietf.org Message-ID: <896987d1-4bb4-3f04-a34e-c09b245d038b@nomountain.net> Subject: Re: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt References: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> <54343047-7620-4A96-BD39-6E60AE7EA5A2@sn3rd.com> <5f39565c-5417-b94f-f1e6-32261c473455@nomountain.net> <27455360-f4ee-4918-ee08-5ccf99a94ec9@nomountain.net> In-Reply-To: --4flTWCO8pC7cF0gLhX7oX0WOdRjlu1fl6 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable On 3/23/17 8:14 AM, Viktor Dukhovni wrote: > I don't know how many other folks on the TLS WG list are prepared > to do a thorough review the DNSSEC aspects of this draft... > Perhaps the TLS and DNS communities overlap sufficiently that my > concern is not warranted? I think it's quite warranted, and we're sending requests for review to both the dane mailing list (still open even though the wg shut down) and to dnsop. The DNS parts are more complicated than the actual extension mechanism and need expert review. We'll be requesting review once the new version is posted. Melinda --4flTWCO8pC7cF0gLhX7oX0WOdRjlu1fl6-- --ox3xteVJ1L6hmxHf6qF5qKtIOrfxxdAhq Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJY0/hdAAoJELiGRpM6HoEuMEsQAMSWcDH67xyBJGt/oot5s4ka MCmfxVNOBIWAYqxzDn94Z79zsRHQ8JDHiJaKW+RnQo+N9YRCpCHGpZ7kRw/lBscs qD5cNTeyC2ebbERc6kziAlGnGS5v783v32Q7PUCqbMmUsMGZHXZHWY9MbALtRIcV +PVvtCFOAy6Yp/eTwyTjBSvPItH4et/C4lgmvqNf3wSZS+XDjP740ROmlRbSJryZ uRYuNDS5el9f1nEvqpuuPYJ2GL12BYSitdqfFyRGgWNuEZUVTEwsM0f4X0oCtDbG +gcdD+38JqyfTG1r0hYXYX6e9VmtFCa6e82nsO2F0agxFL0tqbi0If9tVce4YbCD 4ZkCbYKg0d7ixm3rk6iGpOctnScPiGtc/tawk+yjbS5PfP9Az8AmqvwmRseabqjM UrQFiUS8DbkLvstIamSwp6ekVF3k/BPJ7KlBFRJS9Ybsz+uzg1X65SUccGkH8ZQU ztEYEV/3zggdcS9yYHBf6WSDiwGMqY9OsjT662P92KGne8IOBfmSXQ9rLpSkjkmc mSbmOoXB8K4DGxFrBS/l9Kwz8NxiCpsjDKRNXHy+3FuwTJgbH8Cb4qGu/0AeWjK8 WzMIdQ/G3ZqHU5TIXviGyx06ASLltBKQO751uM9+eCi4wKYI1kHpgK1aeaRybIM9 CwGKLh4uxeJe+4ryBvWM =k+PF -----END PGP SIGNATURE----- --ox3xteVJ1L6hmxHf6qF5qKtIOrfxxdAhq-- From nobody Thu Mar 23 09:38:55 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF212129A07; Thu, 23 Mar 2017 09:38:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G9IQeeN7NACK; Thu, 23 Mar 2017 09:38:46 -0700 (PDT) Received: from mail-wm0-x22d.google.com (mail-wm0-x22d.google.com [IPv6:2a00:1450:400c:c09::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 688FB129C20; Thu, 23 Mar 2017 09:38:18 -0700 (PDT) Received: by mail-wm0-x22d.google.com with SMTP id n11so66030551wma.1; Thu, 23 Mar 2017 09:38:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=gYufdNUjO6MbRN45+2+5yzoO6bt2cNJo1lLDl/ZuYE4=; b=J1JVqwrj/5sKy+mgWI4bFy1emdYk3dy8MIBNyfpcqPaMVq0x/TlKrgxZng892CHoNh AKGfA8FCumVSv6OZlWUbVrOx2Iw7U9bqNgyDMBatTupH3zty/mWU9uv16HHLmV/hGKnK 4AdtTxF/GaDyL0VQiWi/X7I1lvM20wLsGoOot/T7xWOR8kj8RWxCzuhlL3z3GZOfl2LC kyBYaJ4lEq9DXG/dq9OXIrdd3oMNdj1NhVmo8Jeej/EvmjhBpaKvWFlMq6FkFbE5p9nc mYpBsHi0uEoDLCXyVSDGCqu9YYPHBt9CNJGvh3vlpJr1D0WB39288i3NI9c/phv+oH+8 D58A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=gYufdNUjO6MbRN45+2+5yzoO6bt2cNJo1lLDl/ZuYE4=; b=d1nVXTBHE98IlObY4HsvCHImyZtaZkVC0ax2yI41jUz/yZvLP7brQg6t/8fgmZDp9P uEsr6MPwHixGat9gvV9SiDnXOxGSa20AA5cCCEAbBuuABmcDACqSGSTg8XW2amm4LSwM oZUC4ZVTdjXyeRfi627js55i4MqwORGGfXNbhyAQQ52ua7PNNvrEiRZZQuutI8eoPkjj t91/xjGJqCcF/SVOqKN7DAXVTkHSxq2ZD2wb6aJ+uXpYCcRSJKBl8WPIY/ikbUFd7oVz 1YxXy7i4z48yRRn/MD3+8GAAwx1qcoANQ8y4e1T/2aJApTUHeLT+BOcUT08lPJnd8suC DUVQ== X-Gm-Message-State: AFeK/H1t9/OYGHl0hjDbNXSvmHJwMR0IcFEpC6IE50vQLXKnppoKE4INw2q7Rj1DyXBggg== X-Received: by 10.28.128.147 with SMTP id b141mr13624563wmd.45.1490287096957; Thu, 23 Mar 2017 09:38:16 -0700 (PDT) Received: from [192.168.137.29] ([109.253.211.150]) by smtp.gmail.com with ESMTPSA id e16sm6496542wra.62.2017.03.23.09.38.15 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 23 Mar 2017 09:38:16 -0700 (PDT) From: Yoav Nir Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_70A1F909-5E7C-4371-91DB-6B67FEE38413"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Thu, 23 Mar 2017 18:38:12 +0200 In-Reply-To: <9467ab9e-1b4f-d108-c144-3f21792b4b50@cs.tcd.ie> Cc: Eric Rescorla , "tls@ietf.org" , IESG To: Stephen Farrell References: <014753DA-5D5A-47ED-88D3-2291DC3DE78A@gmail.com> <9467ab9e-1b4f-d108-c144-3f21792b4b50@cs.tcd.ie> X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Review of draft-ietf-tls-rfc4492bis-15 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 16:38:48 -0000 --Apple-Mail=_70A1F909-5E7C-4371-91DB-6B67FEE38413 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 21 Mar 2017, at 11:04, Stephen Farrell = wrote: >=20 >=20 > Thanks Yoav, >=20 > On 21/03/17 07:44, Yoav Nir wrote: >> Some that are not addressed, I=E2=80=99ve answered below. Let me = know if you >> want me to merge and submit. >=20 > I'd say give it a chance for one round of comments from Eric > and/or others, and then submit. Or, submit before you head > for an airport on your way to Chicago if that happens first. > If we're left with an RFC editor note being needed, that's > ok so long as it's simple enough. OK, so how is that technically done? The Upload page is defunct until = Monday. Yoav --Apple-Mail=_70A1F909-5E7C-4371-91DB-6B67FEE38413 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJY0/n1AAoJELhJCxUKWMyZeDYH/2UJt5+e9j7Fk3UTtzj608si 1K0wAeHie03K2WwAM3LlEhm6ar0jN2nYJD4f7309lTtyhZwQT0oIgQXMbZywFxb3 hKnUsf1TpoDNm8tInzIYBl4rMQiWB/uW6XVtfwokiwYakjO56DYNCGeldXYB0izj B9A8omodQY0k4RIjKIceWu/iFx4xXcj/Iz2Aw8lB6w27AgiaJGyyCYV5pf/3DZQJ Xf0LjyhQGxOEwrkhoO4BD6LsaIHhMgOhvIxlnz6JkXHcYe9q5zXOXwbfce96/RxP ei+oHaCmNj6iRazu9X3tuawnnub2F3G5DWSd8nFVxkuoZ4Mygdoo1jMbXmmf1uI= =XE7C -----END PGP SIGNATURE----- --Apple-Mail=_70A1F909-5E7C-4371-91DB-6B67FEE38413-- From nobody Thu Mar 23 09:45:26 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 732F91315DF for ; Thu, 23 Mar 2017 09:45:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.921 X-Spam-Level: X-Spam-Status: No, score=-6.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rRArvQCK51vD for ; Thu, 23 Mar 2017 09:45:22 -0700 (PDT) Received: from smtpde02.smtp.sap-ag.de (smtpde02.smtp.sap-ag.de [155.56.68.140]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AD15F1315EB for ; Thu, 23 Mar 2017 09:44:40 -0700 (PDT) Received: from mail07.wdf.sap.corp (mail04.sap.corp [194.39.131.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtpde02.smtp.sap-ag.de (Postfix) with ESMTPS id 3vpspZ6lFkz26J2; Thu, 23 Mar 2017 17:44:38 +0100 (CET) X-purgate-ID: 152705::1490287478-00003836-25909ACF/0/0 X-purgate-size: 2356 X-purgate: clean X-purgate: This mail is considered clean (visit http://www.eleven.de for further information) X-purgate-Ad: Categorized by eleven eXpurgate (R) http://www.eleven.de X-purgate-type: clean X-SAP-SPAM-Status: clean Received: from ld9781.wdf.sap.corp (ld9781.wdf.sap.corp [10.21.82.193]) by mail07.wdf.sap.corp (Postfix) with ESMTP id 3vpspZ50t9zGq6K; Thu, 23 Mar 2017 17:44:38 +0100 (CET) Received: by ld9781.wdf.sap.corp (Postfix, from userid 10159) id A00031A65A; Thu, 23 Mar 2017 17:44:38 +0100 (CET) In-Reply-To: To: "Fries, Steffen" Date: Thu, 23 Mar 2017 17:44:38 +0100 (CET) CC: TLS WG Reply-To: mrex@sap.com X-Mailer: ELM [version 2.4ME+ PL125 (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="US-ASCII" Message-Id: <20170323164438.A00031A65A@ld9781.wdf.sap.corp> From: mrex@sap.com (Martin Rex) Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 16:45:24 -0000 Fries, Steffen wrote: > > based on your reply my conclusion is that > > - there is no (standard compliant) way for a server to use a SHA256 > based certificate for server side authentication in cases where the > client does not provide the signature_algorithm extension The statement quoted by Eric is an obvious and silly defect in the spec, which the entire installed base of TLSv1.0 and TLSv1.1 completely ignored --even Microsoft's implementation of TLSv1.0 and TLSv1.1 properly ignores it. The only defective TLS implementation, that I am aware of, which put this silly and obviously backwards-incompatible and defective requirement from rfc5246 into code, seems to be Microsofts TLSv1.2 implementation in Windows 7 through Windows 8.1. One can interop with Windows 7 through Windows 8.1 just fine without signature_algorithms when offering at most TLSv1.1, or offering TLSv1.2 in a SSL version 2 CLIENT-HELLO (in which case Microsoft SChannel will negotiate TLSv1.1). > > - clients should always use the signature algorithm extension to ensure > the server can apply a certificate with the appropriate crypt algorithms Unless the server is creating his own certificate on the fly, the signature algorithm on the server certificate is something which the server has no control over, and which is therefore quite obviously not up for negotiation in the TLS protocol handshake. signature_algorithms can only be normative for signatures created as part of the TLS handshake. For signature algorithms on certificates, it is a simple selection hint (similar to TLS extension server_name_indication only being a selection hint). That is a thoroughly intuitive requirement for backwards compatibility. Btw. there are a number of defects in the TLS spec (and the TLSv1.2 spec rfc5246 in particular), one is introducing (rsa,md5) as a permissible signature algorithm into TLSv1.2 handshakes. While obvious to anyone with a clue, it took a few implementors several years to understand that blindly following wording of a "proposed standard" specification is a terribly bad idea and a poor excuse for lack of common sense and lack of interop testing. For those who missed the defect on reading, a simple interop test will make this specification defect stand out like a sore thumb. -Martin From nobody Thu Mar 23 09:51:52 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A224C129A38 for ; Thu, 23 Mar 2017 09:51:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FbPdZll7FY3c for ; Thu, 23 Mar 2017 09:51:47 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0122.outbound.protection.outlook.com [104.47.40.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8FF2112999F for ; Thu, 23 Mar 2017 09:51:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=+D6iRsaEXOKw+Eir8KCsqPy9tIgOYS0Neu8a0yDNaa8=; b=g+aNukCp8o4DeEYu7TpPr3tf4ZPx6EYQahLaEsY3vf8XNwBcWRbXjtdTgyaidecv6PqJB6TTxW807rVOEo1ktpSitYc9O1517FfkGslOqvPCZOtDkB46vgmX2XyThguarZr19YiQKlAdPJ+u+C5RowVWpN7uA/VbgBvbso6UptE= Received: from DM2PR21MB0091.namprd21.prod.outlook.com (10.161.141.14) by DM2PR21MB0091.namprd21.prod.outlook.com (10.161.141.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1005.2; Thu, 23 Mar 2017 16:51:46 +0000 Received: from DM2PR21MB0091.namprd21.prod.outlook.com ([10.161.141.14]) by DM2PR21MB0091.namprd21.prod.outlook.com ([10.161.141.14]) with mapi id 15.01.1005.002; Thu, 23 Mar 2017 16:51:46 +0000 From: Andrei Popov To: "Fries, Steffen" , TLS WG Thread-Topic: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 Thread-Index: AdKj4jdTMGBzllsXQzCZ8vwWateOaAAAQFKAAAGKvAAAAHthAAACB/PQ Date: Thu, 23 Mar 2017 16:51:46 +0000 Message-ID: References: <4DD1F233-D659-4F79-9ADA-BC31A49DA653@dukhovni.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: siemens.com; dkim=none (message not signed) header.d=none;siemens.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:a::1d2] x-microsoft-exchange-diagnostics: 1; DM2PR21MB0091; 7:fZHmojvc/ZvssBl84GwNZOMFNfBKF6jLfeTvvi+puMwxTnGxQCkz7rKW+8l1fCf8G3MyVhp6pMc0/sBigaE0MqxRYGF7pxBTVRv0AEzAAp6ODormnVPh47BYnHl5vWEeZuN4nbartOV+FiQGk7ocjb+FpHJy8satOcif3fRw8rRTavVUwGhehWvGFRTvheHJm3aj1HoroO9yyIu/LOQO7o/Tyh1GJ2avTOBx+nnM1+ElLV/l1DaZT9LP/om3NQ+6NUviIG6fujdq2KC1lZIrblot4slfZdu77xoPIqN5mR3nZvO1O2rcyZhWVym8/dtePEXHcttGc2h7AZl5+0YOETqAFMf0dV8hBCkuET24pDI= x-ms-office365-filtering-correlation-id: 0cae8883-697f-432a-6696-08d4720ce452 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081); SRVR:DM2PR21MB0091; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(192374486261705)(126837547833334)(155532106045638)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040386)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(93006021)(93001021)(6055026)(61426038)(61427038)(6041248)(20161123555025)(20161123558025)(20161123564025)(20161123562025)(201703131423011)(201702281528011)(201703061421011)(201703061406011)(20161123560025)(6072148); SRVR:DM2PR21MB0091; BCL:0; PCL:0; RULEID:; SRVR:DM2PR21MB0091; x-forefront-prvs: 0255DF69B9 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(39840400002)(39450400003)(39410400002)(39400400002)(39850400002)(24454002)(52314003)(377454003)(15404003)(7906003)(7736002)(33656002)(236005)(9686003)(606005)(790700001)(229853002)(102836003)(81166006)(189998001)(54356999)(2900100001)(10290500002)(19609705001)(6116002)(76176999)(25786009)(6306002)(99286003)(8936002)(53936002)(55016002)(54896002)(5005710100001)(50986999)(10090500001)(3660700001)(7696004)(9326002)(2906002)(38730400002)(5660300001)(86612001)(86362001)(2950100002)(6246003)(93886004)(77096006)(8676002)(3280700002)(6436002)(6506006)(53546009)(122556002)(74316002)(34023003); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR21MB0091; H:DM2PR21MB0091.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM2PR21MB009159D219B9691EF67FD5568C3F0DM2PR21MB0091namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Mar 2017 16:51:46.1080 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR21MB0091 Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 16:51:51 -0000 --_000_DM2PR21MB009159D219B9691EF67FD5568C3F0DM2PR21MB0091namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgU3RlZmZlbiwNCg0KWW914oCZcmUgc3RlcHBpbmcgb24gYSBzb3JlIHBvaW50IGZvciB0aGlz IFdH4pi6LiBCYXNlZCBvbiB0aGUgc3RyaWN0IGludGVycHJldGF0aW9uIG9mIHRoZSBUTFMgMS4y IFJGQywgeW91ciBjb25jbHVzaW9ucyBhcmUgY29ycmVjdC4NCklmIGEgVExTMS4yIGNsaWVudCBk b2VzIG5vdCBzZW5kIHRoZSBzaWduYXR1cmUgYWxnb3JpdGhtcyBleHRlbnNpb24gKG9yIHRoZSBl eHRlbnNpb24gZG9lcyBub3QgaW5jbHVkZSBTSEEyNTYpLCBhIGNvbXBsaWFudCBUTFMgMS4yIHNl cnZlciB3aXRoIGEgU0hBMjU2IGNlcnRpZmljYXRlIGhhcyBubyBjaG9pY2UgYnV0IHRlcm1pbmF0 ZSB0aGUgaGFuZHNoYWtlLg0KDQpVbmZvcnR1bmF0ZWx5LCBpbiBwcmFjdGljZSB0aGVyZSBhcmUg VExTIDEuMiBjbGllbnRzIHRoYXQgc3VwcG9ydCBTSEEyNTYsIGJ1dCBkb27igJl0IGFkdmVydGlz ZSBpdCB2aWEgdGhlIHNpZ25hdHVyZSBhbGdvcml0aG1zIGV4dGVuc2lvbi4gU29tZSBvZiB0aGVp ciBpbXBsZW1lbnRlcnMgd2lsbCBhcmd1ZSB0aGF0IGV4dGVuc2lvbnMgYXJlLCBieSBkZWZpbml0 aW9uLCBvcHRpb25hbCBmdW5jdGlvbmFsaXR5LiBPciB0aGF0IGEgVExTIGNsaWVudCBtYXkgbm90 IGhhdmUgaW5zaWdodCBpbnRvIGl0cyBQS0kgbGlicmFyeeKAmXMgY2FwYWJpbGl0aWVzLiBPciB0 aGF0IGEgVExTIHNlcnZlciBpcyBoYXMgbm8gc2F5IGluIHdoYXQgY2VydGlmaWNhdGUgdG8gdXNl Lg0KDQpCZSB0aGF0IGFzIGl0IG1heSwgZnJvbSB0aGUgc2VydmVy4oCZcyBwZXJzcGVjdGl2ZSwg dGhpcyBzdHJpY3QgY29tcGxpYW5jZSB3aXRoIHRoZSBSRkMgcmVkdWNlcyBpbnRlcm9wZXJhYmls aXR5IHdpdGhvdXQgYSBjbGVhciBzZWN1cml0eSBnYWluLiBBIHNlcnZlciB0aGF0IGZhdm9ycyBp bnRlcm9wZXJhYmlsaXR5IG92ZXIgUkZDIGNvbXBsaWFuY2Ugd291bGQgc2VuZCBpdHMgU0hBMjU2 IGNlcnQgYW55d2F5LCBhbmQgbGV0IHRoZSBjbGllbnQgdGVybWluYXRlIHRoZSBoYW5kc2hha2Uu IFRoaXMgaXMgYSBjaGFuZ2UgSSBtYWRlIChyYXRoZXIgcmVsdWN0YW50bHkpIGluIHRoZSBsYXRl c3QgdmVyc2lvbnMgb2YgV2luZG93cy4NCg0KQ2hlZXJzLA0KDQpBbmRyZWkNCg0KRnJvbTogVExT IFttYWlsdG86dGxzLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBGcmllcywgU3RlZmZl bg0KU2VudDogVGh1cnNkYXksIE1hcmNoIDIzLCAyMDE3IDg6MzcgQU0NClRvOiBUTFMgV0cgPHRs c0BpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbVExTXSBFbmZvcmNpbmcgc3Ryb25nZXIgc2VydmVy IHNpZGUgc2lnbmF0dXJlL2hhc2ggY29tYmluYXRpb25zIGluIFRMUyAxLjINCg0KSGkgRXJpaywN Cg0KYmFzZWQgb24geW91ciByZXBseSBteSBjb25jbHVzaW9uIGlzIHRoYXQNCg0KLSAgICAgICAg ICB0aGVyZSBpcyBubyAoc3RhbmRhcmQgY29tcGxpYW50KSB3YXkgZm9yIGEgc2VydmVyIHRvIHVz ZSBhIFNIQTI1NiBiYXNlZCBjZXJ0aWZpY2F0ZSBmb3Igc2VydmVyIHNpZGUgYXV0aGVudGljYXRp b24gaW4gY2FzZXMgd2hlcmUgdGhlIGNsaWVudCBkb2VzIG5vdCBwcm92aWRlIHRoZSBzaWduYXR1 cmVfYWxnb3JpdGhtIGV4dGVuc2lvbg0KDQotICAgICAgICAgIGNsaWVudHMgc2hvdWxkIGFsd2F5 cyB1c2UgdGhlIHNpZ25hdHVyZSBhbGdvcml0aG0gZXh0ZW5zaW9uIHRvIGVuc3VyZSB0aGUgc2Vy dmVyIGNhbiBhcHBseSBhIGNlcnRpZmljYXRlIHdpdGggdGhlIGFwcHJvcHJpYXRlIGNyeXB0IGFs Z29yaXRobXMNCg0KQmVzdCByZWdhcmRzDQpTdGVmZmVuDQoNCk9uIFRodSwgTWFyIDIzLCAyMDE3 IGF0IDc6MzkgQU0sIFZpa3RvciBEdWtob3ZuaSA8aWV0Zi1kYW5lQGR1a2hvdm5pLm9yZzxtYWls dG86aWV0Zi1kYW5lQGR1a2hvdm5pLm9yZz4+IHdyb3RlOg0KDQo+IE9uIE1hciAyMywgMjAxNywg YXQgMTA6MzEgQU0sIEZyaWVzLCBTdGVmZmVuIDxzdGVmZmVuLmZyaWVzQHNpZW1lbnMuY29tPG1h aWx0bzpzdGVmZmVuLmZyaWVzQHNpZW1lbnMuY29tPj4gd3JvdGU6DQo+DQo+IEFjY29yZGluZyB0 byAgVExTIDEuMiBzZWN0aW9uIDcuNC4xLjQuMS4gYSBjbGllbnQgbWF5IHVzZSB0aGUNCj4gc2ln bmF0dXJlX2FsZ29yaXRobSBleHRlbnNpb24gdG8gc2lnbmFsIGFueSBjb21iaW5hdGlvbnMgdGhl DQo+IGNsaWVudCBzdXBwb3J0cywgbGlzdGVkIGluIHRoZSBvcmRlciBvZiBwcmVmZXJlbmNlcy4N Cg0KVGhlIHNpZ25hdHVyZSBhbGdvcml0aG0gaXMgcHJpbWFyaWx5IGFib3V0IHNpZ25hdHVyZXMg bWFkZSBhcyBwYXJ0DQpvZiB0aGUgVExTIGhhbmRzaGFrZSwgYW5kIG5vdCBzbyBtdWNoIHNpZ25h dHVyZXMgaW4gY2VydGlmaWNhdGVzLg0KDQpUaGlzIGRvZXMgbm90IHNlZW0gY29uc2lzdGVudCB3 aXRoIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvcmZjbWFya3VwP2RvYz01MjQ2I3NlY3Rpb24tNy40 LjINCg0KIklmIHRoZSBjbGllbnQgcHJvdmlkZWQgYSAic2lnbmF0dXJlX2FsZ29yaXRobXMiIGV4 dGVuc2lvbiwgdGhlbiBhbGwgY2VydGlmaWNhdGVzIHByb3ZpZGVkIGJ5DQp0aGUgc2VydmVyIE1V U1QgYmUgc2lnbmVkIGJ5IGEgaGFzaC9zaWduYXR1cmUgYWxnb3JpdGhtIHBhaXIgdGhhdCBhcHBl YXJzIGluIHRoYXQgZXh0ZW5zaW9uLiINCg0KSSBhcHByZWNpYXRlIHRoYXQgdGhlcmUgYXJlIHBl b3BsZSB3aG8gZmVlbCB0aGF0IHRoaXMgcnVsZSBpcyBiYWQsIGFuZA0KdG8gc29tZSBleHRlbnQg aXQgaGFzIGJlZW4gcmVsYXhlZCBpbiAxLjMsIGJ1dCBJIHRoaW5rIHRoZSB0ZXh0IGlzDQpwcmV0 dHkgY2xlYXIgaGVyZS4NCg0KDQo+IElmIHRoZSBjbGllbnQgZG9lcyBub3QgdXNlIHRoaXMgZXh0 ZW5zaW9uLCB0aGUgc2VydmVyIG11c3QgdXNlIHRoZQ0KPiBzaWduYXR1cmUgYWxnb3JpdGhtIGlu IGNvbWJpbmF0aW9uIHdpdGggU0hBMS4NCg0KRm9yIHNpZ25pbmcgdGhlIFRMUyBrZXkgZXhjaGFu Z2UsIGhvd2V2ZXIsIGl0IHNob3VsZCBzdGlsbCBwcmVzZW50DQp3aGF0ZXZlciBjZXJ0aWZpY2F0 ZSBjaGFpbiBpdCBoYXMsIGV2ZW4gaWYgdGhhdCBjaGFpbiBlbXBsb3lzIFNIQTI1Ni4NCkl0IGlz IGV4Y2VlZGluZ2x5IHVubGlrZWx5IHRoZXNlIGRheXMgdGhhdCBhIGNsaWVudCB3aWxsIG5vdCBz dXBwb3J0DQpTSEEyNTYgc2lnbmF0dXJlcyBpbiB0aGUgY2VydGlmaWNhdGUgY2hhaW4uDQoNClll cywgdGhhdCdzIGdlbmVyYWxseSB0cnVlLiBUaG91Z2ggYSBUTFMgMS4yIGNsaWVudCB3aGljaCBk b2VzIG5vdCBvZmZlciBTSEEtMjU2DQppbiBpdHMgQ2xpZW50SGVsbG8gYnV0IGFjY2VwdHMgU0hB LTI1NiBpcyBicm9rZW4uIFNvLCB0aGlzIHNob3VsZCBnZW5lcmFsbHkNCm9ubHkgaGFwcGVuIHdp dGggVExTIDEuMSBhbmQgYmVsb3cuDQoNCg0KDQo+IFVuZm9ydHVuYXRlbHkgdGhlIHNlcnZlciBp cyBub3QgYWxsb3dlZCB0byB1c2UgdGhpcyBleHRlbnNpb24sIG90aGVyd2lzZQ0KPiBoZSBjb3Vs ZCB0ZWxsIHRoZSBjbGllbnQgaGlzIHByZWZlcmVuY2VzIGFjY29yZGluZyB0byBoaXMgc2VjdXJp dHkgcG9saWN5Lg0KDQpUaGUgcHJvdG9jb2wgKGFzIGl0IHNob3VsZCkgbGFja3MgdGhlIGFkZGl0 aW9uYWwgcm91bmQtdHJpcHMgbmVjZXNzYXJ5IGZvcg0KdGhlIHNlcnZlciB0byBpbml0aWF0ZSBz aWduYXR1cmUgYWxnb3JpdGhtIG5lZ290aWF0aW9uLg0KDQpJJ20gbm90IHN1cmUgcXVpdGUgd2hh dCB0aGUgT1AgSXMgdHJ5aW5nIHRvIGFjaGlldmUgaGVyZS4gRm9yIGNlcnRpZmljYXRlcyBvZmZl cmVkDQpieSB0aGUgc2VydmVyLCB0aGUgY2xpZW50IGp1c3QgdGVsbHMgeW91IHdoYXQgYWxnb3Jp dGhtcyBpdCB3aWxsIGFjY2VwdCBmb3Igbm8gbmVnb3RpYXRpb24NCmlzIG5lZWRlZC4gRm9yIGNl cnRpZmljYXRlcyBvZmZlcmVkIGJ5IHRoZSBjbGllbnQsIHRoZSBzZXJ2ZXIgdGVsbHMgdGhlIGNs aWVudA0Kd2hhdCBhbGdvcml0aG1zIGl0IHdpbGwgYWNjZXB0IGluIHRoZSBDZXJ0aWZpY2F0ZVJl cXVlc3QuDQpodHRwczovL3Rvb2xzLmlldGYub3JnL3JmY21hcmt1cD9kb2M9NTI0NiNzZWN0aW9u LTcuNC40DQoNCi1Fa3INCg== --_000_DM2PR21MB009159D219B9691EF67FD5568C3F0DM2PR21MB0091namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNv TGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgN Cgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIixzZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29u b3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0K CW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1l cyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uZ21haWwtDQoJe21zby1zdHlsZS1uYW1lOmdtYWls LTt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250 LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMUY0OTdEO30NCnNwYW4uRW1h aWxTdHlsZTIxDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5 OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1 bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpA cGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEu MGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7 fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6MTIwODAz MTQ2MTsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6MTAw Mzc4MjI2MCAtMTkxMjA1MjkzMiA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2 NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5Mzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7 bXNvLWxldmVsLXN0YXJ0LWF0OjI7DQoJbXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Oi07DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWls eToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgltc28tZmFyZWFzdC1mb250LWZhbWlseTpDYWxpYnJp Ow0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGwwOmxl dmVsMg0KCXttc28tbGV2ZWwtdGFiLXN0b3A6MS4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNv LWxldmVsLXRhYi1zdG9wOjEuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC10YWIt c3RvcDoyLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtdGFiLXN0b3A6Mi41aW47 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9 DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLXRhYi1zdG9wOjMuMGluOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6 bGV2ZWw3DQoJe21zby1sZXZlbC10YWItc3RvcDozLjVpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsOA0KCXtt c28tbGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLXRh Yi1zdG9wOjQuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJv dHRvbTowaW47fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBl ZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0t LT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4N CjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1s PjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZs aW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+SGkgU3RlZmZlbiw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+WW914oCZ cmUgc3RlcHBpbmcgb24gYSBzb3JlIHBvaW50IGZvciB0aGlzIFdHPC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OldpbmdkaW5ncyI+Sjwvc3Bhbj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPi4NCiBCYXNlZCBvbiB0aGUgc3RyaWN0IGludGVycHJldGF0aW9uIG9mIHRoZSBU TFMgMS4yIFJGQywgeW91ciBjb25jbHVzaW9ucyBhcmUgY29ycmVjdC48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPklmIGEgVExTMS4y IGNsaWVudCBkb2VzIG5vdCBzZW5kIHRoZSBzaWduYXR1cmUgYWxnb3JpdGhtcyBleHRlbnNpb24g KG9yIHRoZSBleHRlbnNpb24gZG9lcyBub3QgaW5jbHVkZSBTSEEyNTYpLCBhIGNvbXBsaWFudCBU TFMgMS4yIHNlcnZlciB3aXRoIGEgU0hBMjU2IGNlcnRpZmljYXRlIGhhcyBubw0KIGNob2ljZSBi dXQgdGVybWluYXRlIHRoZSBoYW5kc2hha2UuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlVuZm9ydHVuYXRlbHks IGluIHByYWN0aWNlIHRoZXJlIGFyZSBUTFMgMS4yIGNsaWVudHMgdGhhdCBzdXBwb3J0IFNIQTI1 NiwgYnV0IGRvbuKAmXQgYWR2ZXJ0aXNlIGl0IHZpYSB0aGUgc2lnbmF0dXJlIGFsZ29yaXRobXMg ZXh0ZW5zaW9uLiBTb21lIG9mIHRoZWlyIGltcGxlbWVudGVycyB3aWxsIGFyZ3VlDQogdGhhdCBl eHRlbnNpb25zIGFyZSwgYnkgZGVmaW5pdGlvbiwgb3B0aW9uYWwgZnVuY3Rpb25hbGl0eS4gT3Ig dGhhdCBhIFRMUyBjbGllbnQgbWF5IG5vdCBoYXZlIGluc2lnaHQgaW50byBpdHMgUEtJIGxpYnJh cnnigJlzIGNhcGFiaWxpdGllcy4gT3IgdGhhdCBhIFRMUyBzZXJ2ZXIgaXMgaGFzIG5vIHNheSBp biB3aGF0IGNlcnRpZmljYXRlIHRvIHVzZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+QmUgdGhhdCBhcyBpdCBt YXksIGZyb20gdGhlIHNlcnZlcuKAmXMgcGVyc3BlY3RpdmUsIHRoaXMgc3RyaWN0IGNvbXBsaWFu Y2Ugd2l0aCB0aGUgUkZDIHJlZHVjZXMgaW50ZXJvcGVyYWJpbGl0eSB3aXRob3V0IGEgY2xlYXIg c2VjdXJpdHkgZ2Fpbi4gQSBzZXJ2ZXIgdGhhdCBmYXZvcnMgaW50ZXJvcGVyYWJpbGl0eQ0KIG92 ZXIgUkZDIGNvbXBsaWFuY2Ugd291bGQgc2VuZCBpdHMgU0hBMjU2IGNlcnQgYW55d2F5LCBhbmQg bGV0IHRoZSBjbGllbnQgdGVybWluYXRlIHRoZSBoYW5kc2hha2UuIFRoaXMgaXMgYSBjaGFuZ2Ug SSBtYWRlIChyYXRoZXIgcmVsdWN0YW50bHkpIGluIHRoZSBsYXRlc3QgdmVyc2lvbnMgb2YgV2lu ZG93cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZiI+Q2hlZXJzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5BbmRyZWk8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBp biI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFu PjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWYiPiBUTFMgW21haWx0bzp0bHMtYm91bmNlc0BpZXRmLm9yZ10N CjxiPk9uIEJlaGFsZiBPZiA8L2I+RnJpZXMsIFN0ZWZmZW48YnI+DQo8Yj5TZW50OjwvYj4gVGh1 cnNkYXksIE1hcmNoIDIzLCAyMDE3IDg6MzcgQU08YnI+DQo8Yj5Ubzo8L2I+IFRMUyBXRyAmbHQ7 dGxzQGlldGYub3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW1RMU10gRW5mb3JjaW5n IHN0cm9uZ2VyIHNlcnZlciBzaWRlIHNpZ25hdHVyZS9oYXNoIGNvbWJpbmF0aW9ucyBpbiBUTFMg MS4yPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+SGkgRXJpayw8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3 RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPmJhc2VkIG9uIHlvdXIgcmVwbHkgbXkgY29uY2x1 c2lvbiBpcyB0aGF0DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBh cmFncmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZv MiI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxz cGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPi08c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVv dDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj50aGVyZSBpcyBubyAoc3RhbmRhcmQgY29tcGxp YW50KSB3YXkgZm9yIGEgc2VydmVyIHRvIHVzZSBhIFNIQTI1NiBiYXNlZCBjZXJ0aWZpY2F0ZSBm b3Igc2VydmVyIHNpZGUgYXV0aGVudGljYXRpb24gaW4gY2FzZXMgd2hlcmUgdGhlIGNsaWVudCBk b2VzIG5vdA0KIHByb3ZpZGUgdGhlIHNpZ25hdHVyZV9hbGdvcml0aG0gZXh0ZW5zaW9uPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0 LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzIiPjwhW2lmICFzdXBwb3J0TGlz dHNdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6 SWdub3JlIj4tPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1 b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+Y2xpZW50cyBzaG91bGQgYWx3YXlzIHVzZSB0aGUgc2lnbmF0dXJlIGFsZ29yaXRo bSBleHRlbnNpb24gdG8gZW5zdXJlIHRoZSBzZXJ2ZXIgY2FuIGFwcGx5IGEgY2VydGlmaWNhdGUg d2l0aCB0aGUgYXBwcm9wcmlhdGUgY3J5cHQgYWxnb3JpdGhtczxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+QmVzdCByZWdhcmRzPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlN0 ZWZmZW4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPk9uIFRo dSwgTWFyIDIzLCAyMDE3IGF0IDc6MzkgQU0sIFZpa3RvciBEdWtob3ZuaSAmbHQ7PGEgaHJlZj0i bWFpbHRvOmlldGYtZGFuZUBkdWtob3ZuaS5vcmciIHRhcmdldD0iX2JsYW5rIj5pZXRmLWRhbmVA ZHVraG92bmkub3JnPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PGJyPg0KJmd0OyBPbiBNYXIgMjMsIDIw MTcsIGF0IDEwOjMxIEFNLCBGcmllcywgU3RlZmZlbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOnN0ZWZm ZW4uZnJpZXNAc2llbWVucy5jb20iPnN0ZWZmZW4uZnJpZXNAc2llbWVucy5jb208L2E+Jmd0OyB3 cm90ZTo8YnI+DQomZ3Q7PGJyPg0KJmd0OyBBY2NvcmRpbmcgdG8mbmJzcDsgVExTIDEuMiBzZWN0 aW9uIDcuNC4xLjQuMS4gYSBjbGllbnQgbWF5IHVzZSB0aGU8YnI+DQo8c3BhbiBjbGFzcz0iZ21h aWwtIj4mZ3Q7IHNpZ25hdHVyZV9hbGdvcml0aG0gZXh0ZW5zaW9uIHRvIHNpZ25hbCBhbnkgY29t YmluYXRpb25zIHRoZTwvc3Bhbj48YnI+DQo8c3BhbiBjbGFzcz0iZ21haWwtIj4mZ3Q7IGNsaWVu dCBzdXBwb3J0cywgbGlzdGVkIGluIHRoZSBvcmRlciBvZiBwcmVmZXJlbmNlcy48L3NwYW4+PGJy Pg0KPGJyPg0KVGhlIHNpZ25hdHVyZSBhbGdvcml0aG0gaXMgcHJpbWFyaWx5IGFib3V0IHNpZ25h dHVyZXMgbWFkZSBhcyBwYXJ0PGJyPg0Kb2YgdGhlIFRMUyBoYW5kc2hha2UsIGFuZCBub3Qgc28g bXVjaCBzaWduYXR1cmVzIGluIGNlcnRpZmljYXRlcy48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+VGhpcyBkb2VzIG5vdCBzZWVtIGNvbnNpc3RlbnQgd2l0aCA8YSBocmVm PSJodHRwczovL3Rvb2xzLmlldGYub3JnL3JmY21hcmt1cD9kb2M9NTI0NiNzZWN0aW9uLTcuNC4y Ij4NCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvcmZjbWFya3VwP2RvYz01MjQ2I3NlY3Rpb24tNy40 LjI8L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+JnF1 b3Q7SWYgdGhlIGNsaWVudCBwcm92aWRlZCBhICZxdW90O3NpZ25hdHVyZV9hbGdvcml0aG1zJnF1 b3Q7IGV4dGVuc2lvbiwgdGhlbiBhbGwgY2VydGlmaWNhdGVzIHByb3ZpZGVkIGJ5PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+dGhlIHNlcnZlciBNVVNUIGJlIHNpZ25lZCBieSBhIGhhc2gvc2lnbmF0dXJl IGFsZ29yaXRobSBwYWlyIHRoYXQgYXBwZWFycyBpbiB0aGF0IGV4dGVuc2lvbi4mcXVvdDs8bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5JIGFwcHJlY2lhdGUg dGhhdCB0aGVyZSBhcmUgcGVvcGxlIHdobyBmZWVsIHRoYXQgdGhpcyBydWxlIGlzIGJhZCwgYW5k PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWxlZnQ6LjVpbiI+dG8gc29tZSBleHRlbnQgaXQgaGFzIGJlZW4gcmVsYXhlZCBp biAxLjMsIGJ1dCBJIHRoaW5rIHRoZSB0ZXh0IGlzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+cHJldHR5 IGNsZWFyIGhlcmUuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAw aW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6 MGluO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPjxzcGFuIGNsYXNzPSJnbWFpbC0iPiZndDsgSWYgdGhlIGNsaWVudCBk b2VzIG5vdCB1c2UgdGhpcyBleHRlbnNpb24sIHRoZSBzZXJ2ZXIgbXVzdCB1c2UgdGhlPC9zcGFu Pjxicj4NCjxzcGFuIGNsYXNzPSJnbWFpbC0iPiZndDsgc2lnbmF0dXJlIGFsZ29yaXRobSBpbiBj b21iaW5hdGlvbiB3aXRoIFNIQTEuPC9zcGFuPjxicj4NCjxicj4NCkZvciBzaWduaW5nIHRoZSBU TFMga2V5IGV4Y2hhbmdlLCBob3dldmVyLCBpdCBzaG91bGQgc3RpbGwgcHJlc2VudDxicj4NCndo YXRldmVyIGNlcnRpZmljYXRlIGNoYWluIGl0IGhhcywgZXZlbiBpZiB0aGF0IGNoYWluIGVtcGxv eXMgU0hBMjU2Ljxicj4NCkl0IGlzIGV4Y2VlZGluZ2x5IHVubGlrZWx5IHRoZXNlIGRheXMgdGhh dCBhIGNsaWVudCB3aWxsIG5vdCBzdXBwb3J0PGJyPg0KU0hBMjU2IHNpZ25hdHVyZXMgaW4gdGhl IGNlcnRpZmljYXRlIGNoYWluLjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj5ZZXMsIHRoYXQncyBnZW5lcmFsbHkgdHJ1ZS4gVGhvdWdoIGEgVExT IDEuMiBjbGllbnQgd2hpY2ggZG9lcyBub3Qgb2ZmZXIgU0hBLTI1NjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPmluIGl0cyBDbGllbnRIZWxsbyBidXQgYWNjZXB0cyBTSEEtMjU2IGlzIGJyb2tlbi4gU28s IHRoaXMgc2hvdWxkIGdlbmVyYWxseTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPm9ubHkgaGFwcGVuIHdp dGggVExTIDEuMSBhbmQgYmVsb3cuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpz b2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6 NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGluO21hcmdpbi1ib3R0b206NS4w cHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFu IGNsYXNzPSJnbWFpbC0iPiZndDsgVW5mb3J0dW5hdGVseSB0aGUgc2VydmVyIGlzIG5vdCBhbGxv d2VkIHRvIHVzZSB0aGlzIGV4dGVuc2lvbiwgb3RoZXJ3aXNlPC9zcGFuPjxicj4NCjxzcGFuIGNs YXNzPSJnbWFpbC0iPiZndDsgaGUgY291bGQgdGVsbCB0aGUgY2xpZW50IGhpcyBwcmVmZXJlbmNl cyBhY2NvcmRpbmcgdG8gaGlzIHNlY3VyaXR5IHBvbGljeS48L3NwYW4+PGJyPg0KPGJyPg0KVGhl IHByb3RvY29sIChhcyBpdCBzaG91bGQpIGxhY2tzIHRoZSBhZGRpdGlvbmFsIHJvdW5kLXRyaXBz IG5lY2Vzc2FyeSBmb3I8YnI+DQp0aGUgc2VydmVyIHRvIGluaXRpYXRlIHNpZ25hdHVyZSBhbGdv cml0aG0gbmVnb3RpYXRpb24uPG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPkknbSBub3Qgc3VyZSBxdWl0ZSB3aGF0IHRoZSBPUCBJcyB0cnlpbmcg dG8gYWNoaWV2ZSBoZXJlLiBGb3IgY2VydGlmaWNhdGVzIG9mZmVyZWQ8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj5ieSB0aGUgc2VydmVyLCB0aGUgY2xpZW50IGp1c3QgdGVsbHMgeW91IHdoYXQgYWxnb3Jp dGhtcyBpdCB3aWxsIGFjY2VwdCBmb3Igbm8gbmVnb3RpYXRpb248bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij5pcyBuZWVkZWQuIEZvciBjZXJ0aWZpY2F0ZXMgb2ZmZXJlZCBieSB0aGUgY2xpZW50LCB0aGUg c2VydmVyIHRlbGxzIHRoZSBjbGllbnQ8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj53aGF0IGFsZ29yaXRo bXMgaXQgd2lsbCBhY2NlcHQgaW4gdGhlIENlcnRpZmljYXRlUmVxdWVzdC48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj48YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL3JmY21hcmt1cD9kb2M9NTI0 NiNzZWN0aW9uLTcuNC40Ij5odHRwczovL3Rvb2xzLmlldGYub3JnL3JmY21hcmt1cD9kb2M9NTI0 NiNzZWN0aW9uLTcuNC40PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPi1Fa3I8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_DM2PR21MB009159D219B9691EF67FD5568C3F0DM2PR21MB0091namp_-- From nobody Thu Mar 23 09:58:31 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3813129A57 for ; Thu, 23 Mar 2017 09:58:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gv-SRC7D3zDa for ; Thu, 23 Mar 2017 09:58:28 -0700 (PDT) Received: from mail-yw0-x234.google.com (mail-yw0-x234.google.com [IPv6:2607:f8b0:4002:c05::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7980B129A72 for ; Thu, 23 Mar 2017 09:58:28 -0700 (PDT) Received: by mail-yw0-x234.google.com with SMTP id v76so151269185ywg.0 for ; Thu, 23 Mar 2017 09:58:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=lpDZ1ZKyhLVnqBMKqiVXWmeaIoaxu4sXl6NvAGzpNDs=; b=VP3YGJMeILHQMikmJdgfa28ZdYe1f3LjYS35uGFFSiPxzhIZF0c6hgYYBtO3wY0w7R 2dwa1Vfr/3pU8hBjT55V8kONL73sD4CznEHqzETR/xcTsF9qncTUavTLZTi3FUEoAEv3 GfApaE367SWC9k3bFhLM+VcLeWAX9qKL3/USFsS6dzZjYpljVG+CX76/SCkIj1u3yEiJ /bgbfl7hWXQxQfkzeSRTcria073aUPECV64R3qaSI0H/CjJy6Te9dI/A/fe+BY9+nrD5 2Js/ZDFRQWG0u4AhmL0g2qSox46aRvz53bQlNADSsxYLsZQ59LJIiUyxMyBtPICY5+ov bKTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=lpDZ1ZKyhLVnqBMKqiVXWmeaIoaxu4sXl6NvAGzpNDs=; b=qY+QxqoHCo8mTiYaa9GGnVStgg6f+FqmQ8SJF0vcqIfzkiN84jidrqq+FP0tRT4fnJ DwRrzq6ccPH0JDbfA6jqeYG6Qr+mBzspblhrPbkt8zFruHdPCIgSx3kN2rU+5UW0kvBS OZq33R9AaId4OH/qpnFt/cZGCZrKOy6m7mSaU0O6cfrEI0JENFJ9JQkGIZzmvHvp/gq3 iMkZIvjHgNZu7gLlOMLFh1h9jmfKBeu6zQyE/kYG3raq/DZU1FoEp5T26JpMp40D272w w4hHjuQXemEWKa3l3watwX1vMIwuvW3erYxcZF1ilLtB741eV17AO2MXmazKaQm8meFp CIJw== X-Gm-Message-State: AFeK/H3kmDiT5g2g9LlStCbbLPoA65EPCP6Fgm/gVJAMoHvndkYUt9nPM9rInr2MQjb1lR/1BZhr9mz71bx3pg== X-Received: by 10.13.204.206 with SMTP id o197mr2644651ywd.87.1490288307638; Thu, 23 Mar 2017 09:58:27 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Thu, 23 Mar 2017 09:57:47 -0700 (PDT) In-Reply-To: References: <4DD1F233-D659-4F79-9ADA-BC31A49DA653@dukhovni.org> From: Eric Rescorla Date: Thu, 23 Mar 2017 09:57:47 -0700 Message-ID: To: "Fries, Steffen" Cc: TLS WG Content-Type: multipart/alternative; boundary=001a114e6b3c30aad7054b68c9ea Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 16:58:31 -0000 --001a114e6b3c30aad7054b68c9ea Content-Type: text/plain; charset=UTF-8 On Thu, Mar 23, 2017 at 8:37 AM, Fries, Steffen wrote: > Hi Erik, > > > > based on your reply my conclusion is that > > - there is no (standard compliant) way for a server to use a > SHA256 based certificate for server side authentication in cases where the > client does not provide the signature_algorithm extension > Not quite. If the client offers TLS 1.1 or below, then you simply don't know if it will accept SHA-256 and you should send whatever you have. If the client offers TLS 1.2 and no signature_algorithm extension, then you technically are forbidden from sending it a SHA-256 certificate. Note that any client which in fact supports SHA-256 with TLS 1.2 but doesn't send signature_algorithms containing it, is noncomformant. It's not clear to me how many such clients in fact exist. - clients should always use the signature algorithm extension to > ensure the server can apply a certificate with the appropriate crypt > algorithms > Yes. -Ekr > > > Best regards > > Steffen > > > > On Thu, Mar 23, 2017 at 7:39 AM, Viktor Dukhovni > wrote: > > > > On Mar 23, 2017, at 10:31 AM, Fries, Steffen > wrote: > > > > According to TLS 1.2 section 7.4.1.4.1. a client may use the > > signature_algorithm extension to signal any combinations the > > client supports, listed in the order of preferences. > > The signature algorithm is primarily about signatures made as part > of the TLS handshake, and not so much signatures in certificates. > > > > This does not seem consistent with https://tools.ietf.org/ > rfcmarkup?doc=5246#section-7.4.2 > > > > "If the client provided a "signature_algorithms" extension, then all > certificates provided by > > the server MUST be signed by a hash/signature algorithm pair that appears > in that extension." > > > > I appreciate that there are people who feel that this rule is bad, and > > to some extent it has been relaxed in 1.3, but I think the text is > > pretty clear here. > > > > > > > If the client does not use this extension, the server must use the > > signature algorithm in combination with SHA1. > > For signing the TLS key exchange, however, it should still present > whatever certificate chain it has, even if that chain employs SHA256. > It is exceedingly unlikely these days that a client will not support > SHA256 signatures in the certificate chain. > > > > Yes, that's generally true. Though a TLS 1.2 client which does not offer > SHA-256 > > in its ClientHello but accepts SHA-256 is broken. So, this should generally > > only happen with TLS 1.1 and below. > > > > > > > > > Unfortunately the server is not allowed to use this extension, otherwise > > he could tell the client his preferences according to his security > policy. > > The protocol (as it should) lacks the additional round-trips necessary for > the server to initiate signature algorithm negotiation. > > > > I'm not sure quite what the OP Is trying to achieve here. For certificates > offered > > by the server, the client just tells you what algorithms it will accept > for no negotiation > > is needed. For certificates offered by the client, the server tells the > client > > what algorithms it will accept in the CertificateRequest. > > https://tools.ietf.org/rfcmarkup?doc=5246#section-7.4.4 > > > > -Ekr > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > --001a114e6b3c30aad7054b68c9ea Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Thu, Mar 23, 2017 at 8:37 AM, Fries, Steffen <<= a href=3D"mailto:steffen.fries@siemens.com" target=3D"_blank">steffen.fries= @siemens.com> wrote:

Hi Erik,=

=C2=A0

based on your reply my co= nclusion is that

-= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 there is no (standar= d compliant) way for a server to use a SHA256 based certificate for server = side authentication in cases where the client does not provide the signature_algorithm extension

=
Not quite. If the client offers TLS 1.1 or below, t= hen you simply don't know if it
will accept SHA-256 and you s= hould send whatever you have. If the client offers
TLS 1.2 and no= signature_algorithm extension, then you technically are forbidden
from sending it a SHA-256 certificate. Note that any client which in fact= supports
SHA-256 with TLS 1.2 but doesn't send signature_alg= orithms containing it,
is noncomformant. It's not clear to me= how many such clients in fact exist.

=

-= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 clients should alway= s use the signature algorithm extension to ensure the server can apply a ce= rtificate with the appropriate crypt algorithms

Yes.

-Ekr
=C2= =A0
=

=C2=A0

Best regards

=

Steffen

=C2=A0

On Thu, Mar 23, 2017 at= 7:39 AM, Viktor Dukhovni <ietf-dane@dukhovni.org> wrote:


> On Mar 23, 2017, at 10:31 AM, Fries, Steffen <steffen.fries@siemens.com>= wrote:
>
> According to=C2=A0 TLS 1.2 section 7.4.1.4.1. a client may use the
> signature_algorithm exten= sion to signal any combinations the
> client supports, listed i= n the order of preferences.

The signature algorithm is primarily about signatures made as part
of the TLS handshake, and not so much signatures in certificates.=

=C2=A0

This does not seem cons= istent with https://tools.ietf.org/rfcmarkup?doc=3D5246#section-7.4.2

=C2=A0

"If the client pro= vided a "signature_algorithms" extension, then all certificates p= rovided by

the server MUST be sign= ed by a hash/signature algorithm pair that appears in that extension."=

=C2=A0

I appreciate that there= are people who feel that this rule is bad, and

to some extent it has b= een relaxed in 1.3, but I think the text is

pretty clear here.

=C2=A0

=C2=A0

> If the client does not use this extension, the s= erver must use the
> signature algorithm in co= mbination with SHA1.

For signing the TLS key exchange, however, it should still present
whatever certificate chain it has, even if that chain employs SHA256.
It is exceedingly unlikely these days that a client will not support
SHA256 signatures in the certificate chain.

=C2=A0

Yes, that's general= ly true. Though a TLS 1.2 client which does not offer SHA-256=

in its ClientHello but = accepts SHA-256 is broken. So, this should generally

only happen with TLS 1.= 1 and below.

=C2=A0

=C2=A0

=C2=A0

> Unfortunately the server is not allowed to use t= his extension, otherwise
> he could tell the client = his preferences according to his security policy.

The protocol (as it should) lacks the additional round-trips necessary for<= br> the server to initiate signature algorithm negotiation.

=C2=A0

I'm not sure quite = what the OP Is trying to achieve here. For certificates offered

by the server, the clie= nt just tells you what algorithms it will accept for no negotiation<= u>

is needed. For certific= ates offered by the client, the server tells the client

what algorithms it will= accept in the CertificateRequest.

=C2=A0

-Ekr


_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--001a114e6b3c30aad7054b68c9ea-- From nobody Thu Mar 23 10:03:49 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54735129A68; Thu, 23 Mar 2017 10:03:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 89tGSgANAWfe; Thu, 23 Mar 2017 10:03:39 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 281D6129A97; Thu, 23 Mar 2017 10:03:39 -0700 (PDT) Received: from mb.local (c-73-202-177-209.hsd1.ca.comcast.net [73.202.177.209]) (authenticated bits=0) by nagasaki.bogus.com (8.15.2/8.15.2) with ESMTPSA id v2NH3Scm089073 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Thu, 23 Mar 2017 17:03:29 GMT (envelope-from joelja@bogus.com) X-Authentication-Warning: nagasaki.bogus.com: Host c-73-202-177-209.hsd1.ca.comcast.net [73.202.177.209] claimed to be mb.local To: Yoav Nir , Stephen Farrell References: <014753DA-5D5A-47ED-88D3-2291DC3DE78A@gmail.com> <9467ab9e-1b4f-d108-c144-3f21792b4b50@cs.tcd.ie> Cc: Eric Rescorla , "tls@ietf.org" , IESG From: joel jaeggli Message-ID: <512716bf-f87a-f8c6-2c47-64293a2ca30f@bogus.com> Date: Thu, 23 Mar 2017 10:03:22 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="4njKm3MEUAL1RUnDenp6wppFnumJC95GC" Archived-At: Subject: Re: [TLS] Review of draft-ietf-tls-rfc4492bis-15 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 17:03:41 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --4njKm3MEUAL1RUnDenp6wppFnumJC95GC Content-Type: multipart/mixed; boundary="ldcdiChAUcL1NQJwAELeKE7oh1BleWutv"; protected-headers="v1" From: joel jaeggli To: Yoav Nir , Stephen Farrell Cc: Eric Rescorla , "tls@ietf.org" , IESG Message-ID: <512716bf-f87a-f8c6-2c47-64293a2ca30f@bogus.com> Subject: Re: [TLS] Review of draft-ietf-tls-rfc4492bis-15 References: <014753DA-5D5A-47ED-88D3-2291DC3DE78A@gmail.com> <9467ab9e-1b4f-d108-c144-3f21792b4b50@cs.tcd.ie> In-Reply-To: --ldcdiChAUcL1NQJwAELeKE7oh1BleWutv Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 3/23/17 9:38 AM, Yoav Nir wrote: >=20 >> On 21 Mar 2017, at 11:04, Stephen Farrell = wrote: >> >> >> Thanks Yoav, >> >> On 21/03/17 07:44, Yoav Nir wrote: >>> Some that are not addressed, I=E2=80=99ve answered below. Let me kno= w if you >>> want me to merge and submit. >> >> I'd say give it a chance for one round of comments from Eric >> and/or others, and then submit. Or, submit before you head >> for an airport on your way to Chicago if that happens first. >> If we're left with an RFC editor note being needed, that's >> ok so long as it's simple enough. >=20 > OK, so how is that technically done? The Upload page is defunct until = Monday. send to ietf-action@ietf.org with the request for posting, cc the responsible ad and they will approve. > Yoav >=20 --ldcdiChAUcL1NQJwAELeKE7oh1BleWutv-- --4njKm3MEUAL1RUnDenp6wppFnumJC95GC Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iEYEARECAAYFAljT/9sACgkQ8AA1q7Z/VrIAjQCfYJLiTOZoQMECF1TtMylEVcD1 WysAn0tDlELUVB9jglKxnbVPKlBs6gLA =759e -----END PGP SIGNATURE----- --4njKm3MEUAL1RUnDenp6wppFnumJC95GC-- From nobody Thu Mar 23 10:05:33 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65540129A6C for ; Thu, 23 Mar 2017 10:05:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BQbxbGjffhuN for ; Thu, 23 Mar 2017 10:05:29 -0700 (PDT) Received: from mail-yw0-x22d.google.com (mail-yw0-x22d.google.com [IPv6:2607:f8b0:4002:c05::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BFD0F129A64 for ; Thu, 23 Mar 2017 10:05:20 -0700 (PDT) Received: by mail-yw0-x22d.google.com with SMTP id p77so151058334ywg.1 for ; Thu, 23 Mar 2017 10:05:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=w1jFZmlRDDCzv2fpPAG5cYpd3MtAqDPfIrfxTZ5bGEw=; b=vvzcz/VegYekv5MdgnE89PNoWcQ/seipl3afV2Wl9gAnSMo3Zy7zIW6ef/gPq83W2R zs1wP5IuQn/a7jDp1+SlPvkKQD/yAtHybMXlyqCghxQJx/lnWz7b+5VtKPNoDuGfpxIR VDMWRrswhaLxvHtbvnQJefailnu4zzrzfDc8ekwBGI6xqkIqXnh4d7QU4Eh15GxQ5Cpm aCZvMAp0xy4HjXfFGavOom/g9YW7LiyDDahZ8pjy0xpUIireckQREGI0fjkcuAO6+O+o iwnBGIUf6If8C39S37e/gfIQwp50hvG8N5gIHGtlt2o8IfNOoIVh5Q+BGTPAjF3xmXp9 qPaA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=w1jFZmlRDDCzv2fpPAG5cYpd3MtAqDPfIrfxTZ5bGEw=; b=Y2q1DY812vpubaC+stWUx5DhjH2zxiNetBF1SDeGvKfKmnEQRZM1B+lNuKxyHQqwW1 u84dpuxj9Ty5y6C/Fs8eDs1Fg7r5yfaWHrCf5SEHhXLRawn20c3fKHokoDUevpA2lD97 594xDI6VuThAHNb/p/Md5M3PqoJ4zl9+3WPdcHMIw59XMP6TxqHpQZNlVxH9zy0BBm9o TwxOOgfVz16j3BmLZY/2C+9hCpKqVW3EByD3fQXoB4cpn24mmS6MHFC8BZuYKcSoUSLE +SiO/pK44jFKtcjkHfVcpCPP8DtcZQHf49bGeg+mUs1ki9XptPlPlKrp4ZsIWjwM87V2 iubg== X-Gm-Message-State: AFeK/H2eeUYwD7Wq2MLq7xE56N9crplZg71a/43nfYaCINWbr2/uFBTgEtUI64dq4qm9CNsrN42T3V0Tb2SWjg== X-Received: by 10.37.171.66 with SMTP id u60mr2591795ybi.64.1490288719968; Thu, 23 Mar 2017 10:05:19 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Thu, 23 Mar 2017 10:04:39 -0700 (PDT) In-Reply-To: <20170323164438.A00031A65A@ld9781.wdf.sap.corp> References: <20170323164438.A00031A65A@ld9781.wdf.sap.corp> From: Eric Rescorla Date: Thu, 23 Mar 2017 10:04:39 -0700 Message-ID: To: "mrex@sap.com" Cc: "Fries, Steffen" , TLS WG Content-Type: multipart/alternative; boundary=94eb2c0c30f0c4a36e054b68e1a6 Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 17:05:31 -0000 --94eb2c0c30f0c4a36e054b68e1a6 Content-Type: text/plain; charset=UTF-8 On Thu, Mar 23, 2017 at 9:44 AM, Martin Rex wrote: > Fries, Steffen wrote: > > > > based on your reply my conclusion is that > > > > - there is no (standard compliant) way for a server to use a SHA256 > > based certificate for server side authentication in cases where the > > client does not provide the signature_algorithm extension > > The statement quoted by Eric is an obvious and silly defect in the spec, > which the entire installed base of TLSv1.0 and TLSv1.1 completely ignored > --even Microsoft's implementation of TLSv1.0 and TLSv1.1 properly ignores > it. > I don't think this statement is entirely accurate about what the requirements are. - TLS 1.0 and 1.1 did not offer any way for the client to tell the server what algorithms it supported. For this reason, if you receive a TLS 1.0 or 1.1 ClientHello, all you can do is send whatever certificate you have. So, TLS 1.0 and 1.1 implementations are not ignoring any requirement by doing so, rather they are following the specification. - TLS 1.2 implementations which receive TLS 1.2 ClientHellos which either do not have signature_algorithms or which have signature_algorithms without SHA-256 are not supposed to send SHA-256 certificates (per the text I quoted above). Again, I realize opinions differ on the wisdom of this text. The extent to which it is an interop problem depends on how many clients would support SHA-256 but for some reason offer 1.2 w/o the required extension. I would be grateful for any data on the frequency of such clients. - As has been noted elsewhere, TLS 1.3 relaxes the requirement to not send certificates which do not match signature_algorithms. -Ekr --94eb2c0c30f0c4a36e054b68e1a6 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Thu, Mar 23, 2017 at 9:44 AM, Martin Rex <mrex@sap.com> wr= ote:
Fries, Steffen wrot= e:
>
> based on your reply my conclusion is that
>
> -=C2=A0 there is no (standard compliant) way for a server to use a SHA= 256
> based certificate for server side authentication in cases where the > client does not provide the signature_algorithm extension

The statement quoted by Eric is an obvious and silly defect in the s= pec,
which the entire installed base of TLSv1.0 and TLSv1.1 completely ignored --even Microsoft's implementation of TLSv1.0 and TLSv1.1 properly ignor= es it.

I don't think this statement= is entirely accurate about what the requirements are.

=
- TLS 1.0 and 1.1 did not offer any way for the client to tell the ser= ver what algorithms
=C2=A0 it supported. For this reason, if you = receive a TLS 1.0 or 1.1 ClientHello, all you
=C2=A0 can do is se= nd whatever certificate you have. So, TLS 1.0 and 1.1 implementations
=
=C2=A0 are not ignoring any requirement by doing so, rather they are f= ollowing the
=C2=A0 specification.

- TLS= 1.2 implementations which receive TLS 1.2 ClientHellos which either
<= div>=C2=A0 do not have signature_algorithms or which have signature_algorit= hms without
=C2=A0 SHA-256 are not supposed to send SHA-256 certi= ficates (per the text I quoted
=C2=A0 above). Again, I realize op= inions differ on the wisdom of this text. The extent to
=C2=A0 wh= ich it is an interop problem depends on how many clients would support
=C2=A0 SHA-256 but for some reason offer 1.2 w/o the required extensi= on. I would be
=C2=A0 grateful for any data on the frequency of s= uch clients.

- As has been noted elsewhere, TLS 1.= 3 relaxes the requirement to not send
=C2=A0 certificates which d= o not match signature_algorithms.

-Ekr
<= br>




<= br>
--94eb2c0c30f0c4a36e054b68e1a6-- From nobody Thu Mar 23 10:11:15 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DFF7D129AF9 for ; Thu, 23 Mar 2017 10:11:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.02 X-Spam-Level: X-Spam-Status: No, score=-2.02 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xDIGjb2HaNUf for ; Thu, 23 Mar 2017 10:11:11 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0130.outbound.protection.outlook.com [104.47.40.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 60C8712987B for ; Thu, 23 Mar 2017 10:11:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=J+vDu5T7thc+p8o/iFKo7izkXFIx4rL8M4oEUd0yQ94=; b=NJ4nxEz7RnZjLIjd3ZeSohmeJLPTzf6y61a8+p1UuIrgRQ4lofJEWH3cdoF9sLUsRDbUDSvgS0FD/kp4BWnhVp1wBfAHMFYTC1mdGjHlTBwOxAnSlcjqWQhWeGSk5mFDNXaZQELFoDbsIZw+hoM26M1z/b6XW8FoGYgtlJvbS9A= Received: from DM2PR21MB0091.namprd21.prod.outlook.com (10.161.141.14) by DM2PR21MB0089.namprd21.prod.outlook.com (10.161.141.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1005.2; Thu, 23 Mar 2017 17:11:04 +0000 Received: from DM2PR21MB0091.namprd21.prod.outlook.com ([10.161.141.14]) by DM2PR21MB0091.namprd21.prod.outlook.com ([10.161.141.14]) with mapi id 15.01.1005.002; Thu, 23 Mar 2017 17:11:04 +0000 From: Andrei Popov To: Eric Rescorla , "Fries, Steffen" CC: TLS WG Thread-Topic: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 Thread-Index: AdKj4jdTMGBzllsXQzCZ8vwWateOaAAAQFKAAAGKvAAAAHthAAAC0feAAAAReFA= Date: Thu, 23 Mar 2017 17:11:04 +0000 Message-ID: References: <4DD1F233-D659-4F79-9ADA-BC31A49DA653@dukhovni.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: rtfm.com; dkim=none (message not signed) header.d=none;rtfm.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [2001:4898:80e8:a::1d2] x-microsoft-exchange-diagnostics: 1; DM2PR21MB0089; 7:HJEOBaoeai9BLoB9nB00Sync8SMZ0TBgfrg7kD05OcXg2yOBHVRWn29A5SiiOB7nbRy+I1nSJgWtz+G5+QgMWUs5fGXruJNCPLYwk1sOzslw+d3psKTVn9YfAO4IH9+pWvVtr1Wxd1wh+YFYlBXTcOgJKi5Rb7xUtHKp/UP2t2AwB7NoabJs/VlRNtEKzez4EJEKjYA9w6VIU58eHGNEk/XxtFkUUme1GFEiKaxx08UpT5up4c3oCfs5lLNmmMU60aCBcPfbshGzd9nFwN3ZPnyQgRju8sWau3Ph3kRWpLiaE3kvxZkHsUZwxXldq5JkArEg1Q0ij7wr/j3hO7pK37xSWh8YIpW7HF6x64Sl0+Y= x-ms-office365-filtering-correlation-id: 107ad1a6-4740-4777-30ea-08d4720f96de x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(48565401081); SRVR:DM2PR21MB0089; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(192374486261705)(126837547833334)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(61425038)(6040386)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(93006021)(93001021)(6055026)(61426038)(61427038)(6041248)(20161123562025)(201703131423011)(201702281528011)(201703061421011)(201703061406011)(20161123560025)(20161123558025)(20161123555025)(20161123564025)(6072148); SRVR:DM2PR21MB0089; BCL:0; PCL:0; RULEID:; SRVR:DM2PR21MB0089; x-forefront-prvs: 0255DF69B9 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39410400002)(39840400002)(39860400002)(39850400002)(39400400002)(39450400003)(377454003)(15404003)(24454002)(38730400002)(55016002)(7736002)(2950100002)(6246003)(102836003)(99286003)(54896002)(6306002)(33656002)(6116002)(790700001)(5005710100001)(25786009)(10290500002)(3280700002)(3660700001)(4326008)(2906002)(2900100001)(10090500001)(53546009)(93886004)(8936002)(8676002)(189998001)(81166006)(86612001)(74316002)(229853002)(122556002)(76176999)(7696004)(77096006)(6436002)(54356999)(606005)(9686003)(50986999)(53936002)(236005)(5660300001)(7906003)(6506006)(86362001)(34023003); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR21MB0089; H:DM2PR21MB0091.namprd21.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_DM2PR21MB009190C73B515AFF6F1BF52C8C3F0DM2PR21MB0091namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Mar 2017 17:11:04.6364 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR21MB0089 Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 17:11:14 -0000 --_000_DM2PR21MB009190C73B515AFF6F1BF52C8C3F0DM2PR21MB0091namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 w5ggIE5vdGUgdGhhdCBhbnkgY2xpZW50IHdoaWNoIGluIGZhY3Qgc3VwcG9ydHMNCg0Kw5ggIFNI QS0yNTYgd2l0aCBUTFMgMS4yIGJ1dCBkb2Vzbid0IHNlbmQgc2lnbmF0dXJlX2FsZ29yaXRobXMg Y29udGFpbmluZyBpdCwNCg0Kw5ggIGlzIG5vbmNvbWZvcm1hbnQuIEl0J3Mgbm90IGNsZWFyIHRv IG1lIGhvdyBtYW55IHN1Y2ggY2xpZW50cyBpbiBmYWN0IGV4aXN0Lg0KDQpXZSBzYXcgZW5vdWdo IFRMUyAxLjIgY2xpZW50cyB0aGF0IGFyZSBub24tY29tcGxpYW50IGluIHRoaXMgd2F5IHRoYXQg SSBtYWRlIHRoZSBzZXJ2ZXItc2lkZSBjaGFuZ2UgdG8gYWNjb21tb2RhdGUgdGhlbS4NCk9idmlv dXNseSwgTWFydGluIFJleOKAmXMgY29kZSBpcyBvbmUgZXhhbXBsZS4NCknigJl2ZSBhbHNvIHNl ZW4gYSBudW1iZXIgb2YgZW1iZWRkZWQvSW9ULW9yaWVudGVkIFRMUyBzdGFja3MgdGhhdCBoYWQg dGhpcyBkZWZlY3QgaW5pdGlhbGx5LCB3aGVuIHRoZXkgZmlyc3QgaW1wbGVtZW50ZWQgVExTIDEu MiwgYWx0aG91Z2ggdGhleSB3ZXJlIHF1aWNrIHRvIGZpeC4NClNvbWUgb2Ygb3VyIGN1c3RvbWVy cyBpbiBFYXN0IEFzaWEgcmVwb3J0ZWQgdGhhdCB0aGUgVExTIHN0YWNrcyB0aGV5IHVzZWQgaGFk IHRoaXMgZGVmZWN0OyB3aGVuIHBvaW50ZWQgYXQgdGhlIFJGQywgdGhleSB0b29rIHRoZSBpc3N1 ZSB0byB0aGUgY29ycmVzcG9uZGluZyBTVyB2ZW5kb3IocykuDQpPdmVyYWxsLCBhIHNtYWxsIHBl cmNlbnRhZ2UsIGJ1dCBpdCBnZW5lcmF0ZWQgZW5vdWdoIHN1cHBvcnQgY2FsbHMgdGhhdCB0aGUg c2VydmVyIGNoYW5nZSB3YXMgd29ydGh3aGlsZS4NCg0KQ2hlZXJzLA0KDQpBbmRyZWkNCg0KRnJv bTogVExTIFttYWlsdG86dGxzLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBFcmljIFJl c2NvcmxhDQpTZW50OiBUaHVyc2RheSwgTWFyY2ggMjMsIDIwMTcgOTo1OCBBTQ0KVG86IEZyaWVz LCBTdGVmZmVuIDxzdGVmZmVuLmZyaWVzQHNpZW1lbnMuY29tPg0KQ2M6IFRMUyBXRyA8dGxzQGll dGYub3JnPg0KU3ViamVjdDogUmU6IFtUTFNdIEVuZm9yY2luZyBzdHJvbmdlciBzZXJ2ZXIgc2lk ZSBzaWduYXR1cmUvaGFzaCBjb21iaW5hdGlvbnMgaW4gVExTIDEuMg0KDQoNCg0KT24gVGh1LCBN YXIgMjMsIDIwMTcgYXQgODozNyBBTSwgRnJpZXMsIFN0ZWZmZW4gPHN0ZWZmZW4uZnJpZXNAc2ll bWVucy5jb208bWFpbHRvOnN0ZWZmZW4uZnJpZXNAc2llbWVucy5jb20+PiB3cm90ZToNCkhpIEVy aWssDQoNCmJhc2VkIG9uIHlvdXIgcmVwbHkgbXkgY29uY2x1c2lvbiBpcyB0aGF0DQoNCi0gICAg ICAgICAgdGhlcmUgaXMgbm8gKHN0YW5kYXJkIGNvbXBsaWFudCkgd2F5IGZvciBhIHNlcnZlciB0 byB1c2UgYSBTSEEyNTYgYmFzZWQgY2VydGlmaWNhdGUgZm9yIHNlcnZlciBzaWRlIGF1dGhlbnRp Y2F0aW9uIGluIGNhc2VzIHdoZXJlIHRoZSBjbGllbnQgZG9lcyBub3QgcHJvdmlkZSB0aGUgc2ln bmF0dXJlX2FsZ29yaXRobSBleHRlbnNpb24NCk5vdCBxdWl0ZS4gSWYgdGhlIGNsaWVudCBvZmZl cnMgVExTIDEuMSBvciBiZWxvdywgdGhlbiB5b3Ugc2ltcGx5IGRvbid0IGtub3cgaWYgaXQNCndp bGwgYWNjZXB0IFNIQS0yNTYgYW5kIHlvdSBzaG91bGQgc2VuZCB3aGF0ZXZlciB5b3UgaGF2ZS4g SWYgdGhlIGNsaWVudCBvZmZlcnMNClRMUyAxLjIgYW5kIG5vIHNpZ25hdHVyZV9hbGdvcml0aG0g ZXh0ZW5zaW9uLCB0aGVuIHlvdSB0ZWNobmljYWxseSBhcmUgZm9yYmlkZGVuDQpmcm9tIHNlbmRp bmcgaXQgYSBTSEEtMjU2IGNlcnRpZmljYXRlLiBOb3RlIHRoYXQgYW55IGNsaWVudCB3aGljaCBp biBmYWN0IHN1cHBvcnRzDQpTSEEtMjU2IHdpdGggVExTIDEuMiBidXQgZG9lc24ndCBzZW5kIHNp Z25hdHVyZV9hbGdvcml0aG1zIGNvbnRhaW5pbmcgaXQsDQppcyBub25jb21mb3JtYW50LiBJdCdz IG5vdCBjbGVhciB0byBtZSBob3cgbWFueSBzdWNoIGNsaWVudHMgaW4gZmFjdCBleGlzdC4NCg0K DQotICAgICAgICAgIGNsaWVudHMgc2hvdWxkIGFsd2F5cyB1c2UgdGhlIHNpZ25hdHVyZSBhbGdv cml0aG0gZXh0ZW5zaW9uIHRvIGVuc3VyZSB0aGUgc2VydmVyIGNhbiBhcHBseSBhIGNlcnRpZmlj YXRlIHdpdGggdGhlIGFwcHJvcHJpYXRlIGNyeXB0IGFsZ29yaXRobXMNClllcy4NCg0KLUVrcg0K DQoNCg0KQmVzdCByZWdhcmRzDQpTdGVmZmVuDQoNCk9uIFRodSwgTWFyIDIzLCAyMDE3IGF0IDc6 MzkgQU0sIFZpa3RvciBEdWtob3ZuaSA8aWV0Zi1kYW5lQGR1a2hvdm5pLm9yZzxtYWlsdG86aWV0 Zi1kYW5lQGR1a2hvdm5pLm9yZz4+IHdyb3RlOg0KDQo+IE9uIE1hciAyMywgMjAxNywgYXQgMTA6 MzEgQU0sIEZyaWVzLCBTdGVmZmVuIDxzdGVmZmVuLmZyaWVzQHNpZW1lbnMuY29tPG1haWx0bzpz dGVmZmVuLmZyaWVzQHNpZW1lbnMuY29tPj4gd3JvdGU6DQo+DQo+IEFjY29yZGluZyB0byAgVExT IDEuMiBzZWN0aW9uIDcuNC4xLjQuMS4gYSBjbGllbnQgbWF5IHVzZSB0aGUNCj4gc2lnbmF0dXJl X2FsZ29yaXRobSBleHRlbnNpb24gdG8gc2lnbmFsIGFueSBjb21iaW5hdGlvbnMgdGhlDQo+IGNs aWVudCBzdXBwb3J0cywgbGlzdGVkIGluIHRoZSBvcmRlciBvZiBwcmVmZXJlbmNlcy4NCg0KVGhl IHNpZ25hdHVyZSBhbGdvcml0aG0gaXMgcHJpbWFyaWx5IGFib3V0IHNpZ25hdHVyZXMgbWFkZSBh cyBwYXJ0DQpvZiB0aGUgVExTIGhhbmRzaGFrZSwgYW5kIG5vdCBzbyBtdWNoIHNpZ25hdHVyZXMg aW4gY2VydGlmaWNhdGVzLg0KDQpUaGlzIGRvZXMgbm90IHNlZW0gY29uc2lzdGVudCB3aXRoIGh0 dHBzOi8vdG9vbHMuaWV0Zi5vcmcvcmZjbWFya3VwP2RvYz01MjQ2I3NlY3Rpb24tNy40LjINCg0K IklmIHRoZSBjbGllbnQgcHJvdmlkZWQgYSAic2lnbmF0dXJlX2FsZ29yaXRobXMiIGV4dGVuc2lv biwgdGhlbiBhbGwgY2VydGlmaWNhdGVzIHByb3ZpZGVkIGJ5DQp0aGUgc2VydmVyIE1VU1QgYmUg c2lnbmVkIGJ5IGEgaGFzaC9zaWduYXR1cmUgYWxnb3JpdGhtIHBhaXIgdGhhdCBhcHBlYXJzIGlu IHRoYXQgZXh0ZW5zaW9uLiINCg0KSSBhcHByZWNpYXRlIHRoYXQgdGhlcmUgYXJlIHBlb3BsZSB3 aG8gZmVlbCB0aGF0IHRoaXMgcnVsZSBpcyBiYWQsIGFuZA0KdG8gc29tZSBleHRlbnQgaXQgaGFz IGJlZW4gcmVsYXhlZCBpbiAxLjMsIGJ1dCBJIHRoaW5rIHRoZSB0ZXh0IGlzDQpwcmV0dHkgY2xl YXIgaGVyZS4NCg0KDQo+IElmIHRoZSBjbGllbnQgZG9lcyBub3QgdXNlIHRoaXMgZXh0ZW5zaW9u LCB0aGUgc2VydmVyIG11c3QgdXNlIHRoZQ0KPiBzaWduYXR1cmUgYWxnb3JpdGhtIGluIGNvbWJp bmF0aW9uIHdpdGggU0hBMS4NCg0KRm9yIHNpZ25pbmcgdGhlIFRMUyBrZXkgZXhjaGFuZ2UsIGhv d2V2ZXIsIGl0IHNob3VsZCBzdGlsbCBwcmVzZW50DQp3aGF0ZXZlciBjZXJ0aWZpY2F0ZSBjaGFp biBpdCBoYXMsIGV2ZW4gaWYgdGhhdCBjaGFpbiBlbXBsb3lzIFNIQTI1Ni4NCkl0IGlzIGV4Y2Vl ZGluZ2x5IHVubGlrZWx5IHRoZXNlIGRheXMgdGhhdCBhIGNsaWVudCB3aWxsIG5vdCBzdXBwb3J0 DQpTSEEyNTYgc2lnbmF0dXJlcyBpbiB0aGUgY2VydGlmaWNhdGUgY2hhaW4uDQoNClllcywgdGhh dCdzIGdlbmVyYWxseSB0cnVlLiBUaG91Z2ggYSBUTFMgMS4yIGNsaWVudCB3aGljaCBkb2VzIG5v dCBvZmZlciBTSEEtMjU2DQppbiBpdHMgQ2xpZW50SGVsbG8gYnV0IGFjY2VwdHMgU0hBLTI1NiBp cyBicm9rZW4uIFNvLCB0aGlzIHNob3VsZCBnZW5lcmFsbHkNCm9ubHkgaGFwcGVuIHdpdGggVExT IDEuMSBhbmQgYmVsb3cuDQoNCg0KDQo+IFVuZm9ydHVuYXRlbHkgdGhlIHNlcnZlciBpcyBub3Qg YWxsb3dlZCB0byB1c2UgdGhpcyBleHRlbnNpb24sIG90aGVyd2lzZQ0KPiBoZSBjb3VsZCB0ZWxs IHRoZSBjbGllbnQgaGlzIHByZWZlcmVuY2VzIGFjY29yZGluZyB0byBoaXMgc2VjdXJpdHkgcG9s aWN5Lg0KDQpUaGUgcHJvdG9jb2wgKGFzIGl0IHNob3VsZCkgbGFja3MgdGhlIGFkZGl0aW9uYWwg cm91bmQtdHJpcHMgbmVjZXNzYXJ5IGZvcg0KdGhlIHNlcnZlciB0byBpbml0aWF0ZSBzaWduYXR1 cmUgYWxnb3JpdGhtIG5lZ290aWF0aW9uLg0KDQpJJ20gbm90IHN1cmUgcXVpdGUgd2hhdCB0aGUg T1AgSXMgdHJ5aW5nIHRvIGFjaGlldmUgaGVyZS4gRm9yIGNlcnRpZmljYXRlcyBvZmZlcmVkDQpi eSB0aGUgc2VydmVyLCB0aGUgY2xpZW50IGp1c3QgdGVsbHMgeW91IHdoYXQgYWxnb3JpdGhtcyBp dCB3aWxsIGFjY2VwdCBmb3Igbm8gbmVnb3RpYXRpb24NCmlzIG5lZWRlZC4gRm9yIGNlcnRpZmlj YXRlcyBvZmZlcmVkIGJ5IHRoZSBjbGllbnQsIHRoZSBzZXJ2ZXIgdGVsbHMgdGhlIGNsaWVudA0K d2hhdCBhbGdvcml0aG1zIGl0IHdpbGwgYWNjZXB0IGluIHRoZSBDZXJ0aWZpY2F0ZVJlcXVlc3Qu DQpodHRwczovL3Rvb2xzLmlldGYub3JnL3JmY21hcmt1cD9kb2M9NTI0NiNzZWN0aW9uLTcuNC40 DQoNCi1Fa3INCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18NClRMUyBtYWlsaW5nIGxpc3QNClRMU0BpZXRmLm9yZzxtYWlsdG86VExTQGlldGYub3JnPg0K aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHMNCg0K --_000_DM2PR21MB009190C73B515AFF6F1BF52C8C3F0DM2PR21MB0091namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcg Um9tYW4iLHNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNv TGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgN Cgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIixzZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29u b3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0K CW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1l cyBOZXcgUm9tYW4iLHNlcmlmO30NCnAubS02NzMzNzY3MTc4OTgwMzc2MDA5bXNvbGlzdHBhcmFn cmFwaCwgbGkubS02NzMzNzY3MTc4OTgwMzc2MDA5bXNvbGlzdHBhcmFncmFwaCwgZGl2Lm0tNjcz Mzc2NzE3ODk4MDM3NjAwOW1zb2xpc3RwYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLW5hbWU6bV8tNjcz Mzc2NzE3ODk4MDM3NjAwOW1zb2xpc3RwYXJhZ3JhcGg7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCglt YXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIixzZXJpZjt9DQpzcGFuLmhvZW56Yg0KCXttc28tc3R5bGUtbmFtZTpob2VuemI7 fQ0Kc3Bhbi5tLTY3MzM3NjcxNzg5ODAzNzYwMDlnbWFpbC0NCgl7bXNvLXN0eWxlLW5hbWU6bV8t NjczMzc2NzE3ODk4MDM3NjAwOWdtYWlsLTt9DQpzcGFuLkVtYWlsU3R5bGUyMg0KCXttc28tc3R5 bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCglj b2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTIzDQoJe21zby1zdHlsZS10eXBlOnBl cnNvbmFsLWNvbXBvc2U7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29s b3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQt b25seTsNCglmb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46 MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRT ZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1p ZDoxODA5NzM5OTM7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUt aWRzOjEzOTc0OTkzMzQgLTE1OTgwMDYzMzYgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2 OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTM7fQ0KQGxpc3QgbDA6bGV2 ZWwxDQoJe21zby1sZXZlbC1zdGFydC1hdDo1Ow0KCW1zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvg5g7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglm b250LWZhbWlseTpXaW5nZGluZ3M7DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6Q2FsaWJyaTsN Cgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMDpsZXZl bDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30N CkBsaXN0IGwwOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6 V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ Zm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6 bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0K QGxpc3QgbDA6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28t bGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNv dXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0K CWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0K CXttYXJnaW4tYm90dG9tOjBpbjt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1s Pg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1s PjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpl eHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVs YXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGlu az0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAg Y2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0LWluZGVudDotLjI1aW47bXNvLWxp c3Q6bDAgbGV2ZWwxIGxmbzIiPjwhW2lmICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTpXaW5nZGluZ3MiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPsOYPHNwYW4g c3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsNCjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5Ob3RlIHRoYXQgYW55IGNsaWVudCB3aGljaCBp biBmYWN0IHN1cHBvcnRzPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFw aCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvMiI+PCFb aWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OldpbmdkaW5ncyI+PHNw YW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+w5g8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVv dDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFb ZW5kaWZdPlNIQS0yNTYgd2l0aCBUTFMgMS4yIGJ1dCBkb2Vzbid0IHNlbmQgc2lnbmF0dXJlX2Fs Z29yaXRobXMgY29udGFpbmluZyBpdCw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0 UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBs Zm8yIj48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6V2luZ2Rp bmdzIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj7DmDxzcGFuIHN0eWxlPSJmb250Ojcu MHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwv c3Bhbj48IVtlbmRpZl0+aXMgbm9uY29tZm9ybWFudC4gSXQncyBub3QgY2xlYXIgdG8gbWUgaG93 IG1hbnkgc3VjaCBjbGllbnRzIGluIGZhY3QgZXhpc3QuPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+V2Ugc2F3IGVub3VnaCBU TFMgMS4yIGNsaWVudHMgdGhhdCBhcmUgbm9uLWNvbXBsaWFudCBpbiB0aGlzIHdheSB0aGF0IEkg bWFkZSB0aGUgc2VydmVyLXNpZGUgY2hhbmdlIHRvIGFjY29tbW9kYXRlIHRoZW0uPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5PYnZp b3VzbHksIE1hcnRpbiBSZXjigJlzIGNvZGUgaXMgb25lIGV4YW1wbGUuDQo8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPknigJl2ZSBh bHNvIHNlZW4gYSBudW1iZXIgb2YgZW1iZWRkZWQvSW9ULW9yaWVudGVkIFRMUyBzdGFja3MgdGhh dCBoYWQgdGhpcyBkZWZlY3QgaW5pdGlhbGx5LCB3aGVuIHRoZXkgZmlyc3QgaW1wbGVtZW50ZWQg VExTIDEuMiwgYWx0aG91Z2ggdGhleSB3ZXJlIHF1aWNrIHRvIGZpeC48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPlNvbWUgb2Ygb3Vy IGN1c3RvbWVycyBpbiBFYXN0IEFzaWEgcmVwb3J0ZWQgdGhhdCB0aGUgVExTIHN0YWNrcyB0aGV5 IHVzZWQgaGFkIHRoaXMgZGVmZWN0OyB3aGVuIHBvaW50ZWQgYXQgdGhlIFJGQywgdGhleSB0b29r IHRoZSBpc3N1ZSB0byB0aGUgY29ycmVzcG9uZGluZyBTVyB2ZW5kb3IocykuPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5PdmVyYWxs LCBhIHNtYWxsIHBlcmNlbnRhZ2UsIGJ1dCBpdCBnZW5lcmF0ZWQgZW5vdWdoIHN1cHBvcnQgY2Fs bHMgdGhhdCB0aGUgc2VydmVyIGNoYW5nZSB3YXMgd29ydGh3aGlsZS48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ Q2hlZXJzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj5BbmRyZWk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3Nw YW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+IFRMUyBbbWFpbHRvOnRscy1ib3VuY2VzQGlldGYub3Jn XQ0KPGI+T24gQmVoYWxmIE9mIDwvYj5FcmljIFJlc2NvcmxhPGJyPg0KPGI+U2VudDo8L2I+IFRo dXJzZGF5LCBNYXJjaCAyMywgMjAxNyA5OjU4IEFNPGJyPg0KPGI+VG86PC9iPiBGcmllcywgU3Rl ZmZlbiAmbHQ7c3RlZmZlbi5mcmllc0BzaWVtZW5zLmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+IFRM UyBXRyAmbHQ7dGxzQGlldGYub3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW1RMU10g RW5mb3JjaW5nIHN0cm9uZ2VyIHNlcnZlciBzaWRlIHNpZ25hdHVyZS9oYXNoIGNvbWJpbmF0aW9u cyBpbiBUTFMgMS4yPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gVGh1LCBNYXIgMjMsIDIw MTcgYXQgODozNyBBTSwgRnJpZXMsIFN0ZWZmZW4gJmx0OzxhIGhyZWY9Im1haWx0bzpzdGVmZmVu LmZyaWVzQHNpZW1lbnMuY29tIiB0YXJnZXQ9Il9ibGFuayI+c3RlZmZlbi5mcmllc0BzaWVtZW5z LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJv cmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGlu IDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdo dDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+SGkgRXJp ayw8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0 eWxlPSJjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5iYXNlZCBvbiB5 b3VyIHJlcGx5IG15IGNvbmNsdXNpb24gaXMgdGhhdA0KPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Im0tNjczMzc2NzE3ODk4MDM3NjAwOW1zb2xpc3RwYXJhZ3JhcGgiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUY0OTdEIj4tPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny4w cHQ7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPnRo ZXJlIGlzIG5vIChzdGFuZGFyZCBjb21wbGlhbnQpIHdheSBmb3IgYSBzZXJ2ZXIgdG8gdXNlIGEg U0hBMjU2IGJhc2VkIGNlcnRpZmljYXRlIGZvciBzZXJ2ZXIgc2lkZSBhdXRoZW50aWNhdGlvbiBp biBjYXNlcyB3aGVyZSB0aGUgY2xpZW50IGRvZXMgbm90IHByb3ZpZGUgdGhlIHNpZ25hdHVyZV9h bGdvcml0aG0NCiBleHRlbnNpb248L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5Ob3QgcXVpdGUuIElmIHRoZSBjbGllbnQgb2ZmZXJzIFRMUyAxLjEgb3IgYmVsb3csIHRo ZW4geW91IHNpbXBseSBkb24ndCBrbm93IGlmIGl0PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj53aWxsIGFjY2VwdCBTSEEtMjU2IGFuZCB5b3Ugc2hv dWxkIHNlbmQgd2hhdGV2ZXIgeW91IGhhdmUuIElmIHRoZSBjbGllbnQgb2ZmZXJzPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UTFMgMS4yIGFuZCBu byBzaWduYXR1cmVfYWxnb3JpdGhtIGV4dGVuc2lvbiwgdGhlbiB5b3UgdGVjaG5pY2FsbHkgYXJl IGZvcmJpZGRlbjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+ZnJvbSBzZW5kaW5nIGl0IGEgU0hBLTI1NiBjZXJ0aWZpY2F0ZS4gTm90ZSB0aGF0IGFu eSBjbGllbnQgd2hpY2ggaW4gZmFjdCBzdXBwb3J0czxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U0hBLTI1NiB3aXRoIFRMUyAxLjIgYnV0IGRvZXNu J3Qgc2VuZCBzaWduYXR1cmVfYWxnb3JpdGhtcyBjb250YWluaW5nIGl0LDxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+aXMgbm9uY29tZm9ybWFudC4g SXQncyBub3QgY2xlYXIgdG8gbWUgaG93IG1hbnkgc3VjaCBjbGllbnRzIGluIGZhY3QgZXhpc3Qu PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBw dDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Im0tNjczMzc2NzE3ODk4MDM3NjAwOW1zb2xpc3RwYXJhZ3JhcGgiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj4tPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny4wcHQ7Y29sb3I6 IzFGNDk3RCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPmNsaWVudHMgc2hv dWxkIGFsd2F5cyB1c2UgdGhlIHNpZ25hdHVyZSBhbGdvcml0aG0gZXh0ZW5zaW9uIHRvIGVuc3Vy ZSB0aGUgc2VydmVyIGNhbiBhcHBseSBhIGNlcnRpZmljYXRlIHdpdGggdGhlIGFwcHJvcHJpYXRl IGNyeXB0IGFsZ29yaXRobXM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5ZZXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPi1Fa3I8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4g MGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0 OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0ibS02NzMzNzY3MTc4OTgwMzc2MDA5bXNvbGlzdHBhcmFncmFwaCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkJlc3QgcmVn YXJkczwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlN0ZWZmZW4NCjwvc3Bhbj48c3BhbiBzdHlsZT0iY29s b3I6Izg4ODg4OCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3Nw YW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0Oi41aW4iPg0KT24gVGh1LCBNYXIgMjMsIDIwMTcgYXQgNzozOSBBTSwgVmlrdG9yIER1a2hv dm5pICZsdDs8YSBocmVmPSJtYWlsdG86aWV0Zi1kYW5lQGR1a2hvdm5pLm9yZyIgdGFyZ2V0PSJf YmxhbmsiPmlldGYtZGFuZUBkdWtob3ZuaS5vcmc8L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxicj4NCiZndDsg T24gTWFyIDIzLCAyMDE3LCBhdCAxMDozMSBBTSwgRnJpZXMsIFN0ZWZmZW4gJmx0OzxhIGhyZWY9 Im1haWx0bzpzdGVmZmVuLmZyaWVzQHNpZW1lbnMuY29tIiB0YXJnZXQ9Il9ibGFuayI+c3RlZmZl bi5mcmllc0BzaWVtZW5zLmNvbTwvYT4mZ3Q7IHdyb3RlOjxicj4NCiZndDs8YnI+DQomZ3Q7IEFj Y29yZGluZyB0byZuYnNwOyBUTFMgMS4yIHNlY3Rpb24gNy40LjEuNC4xLiBhIGNsaWVudCBtYXkg dXNlIHRoZTxicj4NCjxzcGFuIGNsYXNzPSJtLTY3MzM3NjcxNzg5ODAzNzYwMDlnbWFpbC0iPiZn dDsgc2lnbmF0dXJlX2FsZ29yaXRobSBleHRlbnNpb24gdG8gc2lnbmFsIGFueSBjb21iaW5hdGlv bnMgdGhlPC9zcGFuPjxicj4NCjxzcGFuIGNsYXNzPSJtLTY3MzM3NjcxNzg5ODAzNzYwMDlnbWFp bC0iPiZndDsgY2xpZW50IHN1cHBvcnRzLCBsaXN0ZWQgaW4gdGhlIG9yZGVyIG9mIHByZWZlcmVu Y2VzLjwvc3Bhbj48YnI+DQo8YnI+DQpUaGUgc2lnbmF0dXJlIGFsZ29yaXRobSBpcyBwcmltYXJp bHkgYWJvdXQgc2lnbmF0dXJlcyBtYWRlIGFzIHBhcnQ8YnI+DQpvZiB0aGUgVExTIGhhbmRzaGFr ZSwgYW5kIG5vdCBzbyBtdWNoIHNpZ25hdHVyZXMgaW4gY2VydGlmaWNhdGVzLjxvOnA+PC9vOnA+ PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv O21hcmdpbi1sZWZ0Oi41aW4iPg0KVGhpcyBkb2VzIG5vdCBzZWVtIGNvbnNpc3RlbnQgd2l0aCA8 YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL3JmY21hcmt1cD9kb2M9NTI0NiNzZWN0aW9u LTcuNC4yIiB0YXJnZXQ9Il9ibGFuayI+DQpodHRwczovL3Rvb2xzLmlldGYub3JnL3JmY21hcmt1 cD9kb2M9NTI0NiNzZWN0aW9uLTcuNC4yPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxl ZnQ6LjVpbiI+DQomcXVvdDtJZiB0aGUgY2xpZW50IHByb3ZpZGVkIGEgJnF1b3Q7c2lnbmF0dXJl X2FsZ29yaXRobXMmcXVvdDsgZXh0ZW5zaW9uLCB0aGVuIGFsbCBjZXJ0aWZpY2F0ZXMgcHJvdmlk ZWQgYnk8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzttYXJnaW4tbGVmdDouNWluIj4NCnRoZSBzZXJ2ZXIgTVVTVCBiZSBzaWduZWQgYnkgYSBoYXNo L3NpZ25hdHVyZSBhbGdvcml0aG0gcGFpciB0aGF0IGFwcGVhcnMgaW4gdGhhdCBleHRlbnNpb24u JnF1b3Q7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCkkgYXBwcmVjaWF0 ZSB0aGF0IHRoZXJlIGFyZSBwZW9wbGUgd2hvIGZlZWwgdGhhdCB0aGlzIHJ1bGUgaXMgYmFkLCBh bmQ8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDouNWluIj4NCnRvIHNvbWUgZXh0ZW50IGl0IGhhcyBiZWVuIHJlbGF4ZWQgaW4g MS4zLCBidXQgSSB0aGluayB0aGUgdGV4dCBpczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KcHJldHR5IGNsZWFy IGhlcmUuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdp bi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90 dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCjxz cGFuIGNsYXNzPSJtLTY3MzM3NjcxNzg5ODAzNzYwMDlnbWFpbC0iPiZndDsgSWYgdGhlIGNsaWVu dCBkb2VzIG5vdCB1c2UgdGhpcyBleHRlbnNpb24sIHRoZSBzZXJ2ZXIgbXVzdCB1c2UgdGhlPC9z cGFuPjxicj4NCjxzcGFuIGNsYXNzPSJtLTY3MzM3NjcxNzg5ODAzNzYwMDlnbWFpbC0iPiZndDsg c2lnbmF0dXJlIGFsZ29yaXRobSBpbiBjb21iaW5hdGlvbiB3aXRoIFNIQTEuPC9zcGFuPjxicj4N Cjxicj4NCkZvciBzaWduaW5nIHRoZSBUTFMga2V5IGV4Y2hhbmdlLCBob3dldmVyLCBpdCBzaG91 bGQgc3RpbGwgcHJlc2VudDxicj4NCndoYXRldmVyIGNlcnRpZmljYXRlIGNoYWluIGl0IGhhcywg ZXZlbiBpZiB0aGF0IGNoYWluIGVtcGxveXMgU0hBMjU2Ljxicj4NCkl0IGlzIGV4Y2VlZGluZ2x5 IHVubGlrZWx5IHRoZXNlIGRheXMgdGhhdCBhIGNsaWVudCB3aWxsIG5vdCBzdXBwb3J0PGJyPg0K U0hBMjU2IHNpZ25hdHVyZXMgaW4gdGhlIGNlcnRpZmljYXRlIGNoYWluLjxvOnA+PC9vOnA+PC9w Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVm dDouNWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KWWVzLCB0aGF0J3MgZ2VuZXJhbGx5IHRy dWUuIFRob3VnaCBhIFRMUyAxLjIgY2xpZW50IHdoaWNoIGRvZXMgbm90IG9mZmVyIFNIQS0yNTY8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJn aW4tbGVmdDouNWluIj4NCmluIGl0cyBDbGllbnRIZWxsbyBidXQgYWNjZXB0cyBTSEEtMjU2IGlz IGJyb2tlbi4gU28sIHRoaXMgc2hvdWxkIGdlbmVyYWxseTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0Kb25seSBo YXBwZW4gd2l0aCBUTFMgMS4xIGFuZCBiZWxvdy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1s ZWZ0Oi41aW4iPg0KJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlk ICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0Ljhw dDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVpbiI+DQo8c3BhbiBjbGFzcz0i bS02NzMzNzY3MTc4OTgwMzc2MDA5Z21haWwtIj4mZ3Q7IFVuZm9ydHVuYXRlbHkgdGhlIHNlcnZl ciBpcyBub3QgYWxsb3dlZCB0byB1c2UgdGhpcyBleHRlbnNpb24sIG90aGVyd2lzZTwvc3Bhbj48 YnI+DQo8c3BhbiBjbGFzcz0ibS02NzMzNzY3MTc4OTgwMzc2MDA5Z21haWwtIj4mZ3Q7IGhlIGNv dWxkIHRlbGwgdGhlIGNsaWVudCBoaXMgcHJlZmVyZW5jZXMgYWNjb3JkaW5nIHRvIGhpcyBzZWN1 cml0eSBwb2xpY3kuPC9zcGFuPjxicj4NCjxicj4NClRoZSBwcm90b2NvbCAoYXMgaXQgc2hvdWxk KSBsYWNrcyB0aGUgYWRkaXRpb25hbCByb3VuZC10cmlwcyBuZWNlc3NhcnkgZm9yPGJyPg0KdGhl IHNlcnZlciB0byBpbml0aWF0ZSBzaWduYXR1cmUgYWxnb3JpdGhtIG5lZ290aWF0aW9uLjxvOnA+ PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bztt YXJnaW4tbGVmdDouNWluIj4NCiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KSSdtIG5vdCBzdXJlIHF1 aXRlIHdoYXQgdGhlIE9QIElzIHRyeWluZyB0byBhY2hpZXZlIGhlcmUuIEZvciBjZXJ0aWZpY2F0 ZXMgb2ZmZXJlZDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0Oi41aW4iPg0KYnkgdGhlIHNlcnZlciwgdGhlIGNsaWVudCBqdXN0 IHRlbGxzIHlvdSB3aGF0IGFsZ29yaXRobXMgaXQgd2lsbCBhY2NlcHQgZm9yIG5vIG5lZ290aWF0 aW9uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 bWFyZ2luLWxlZnQ6LjVpbiI+DQppcyBuZWVkZWQuIEZvciBjZXJ0aWZpY2F0ZXMgb2ZmZXJlZCBi eSB0aGUgY2xpZW50LCB0aGUgc2VydmVyIHRlbGxzIHRoZSBjbGllbnQ8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4N CndoYXQgYWxnb3JpdGhtcyBpdCB3aWxsIGFjY2VwdCBpbiB0aGUgQ2VydGlmaWNhdGVSZXF1ZXN0 LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21h cmdpbi1sZWZ0Oi41aW4iPg0KPGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9yZmNtYXJr dXA/ZG9jPTUyNDYjc2VjdGlvbi03LjQuNCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vdG9vbHMu aWV0Zi5vcmcvcmZjbWFya3VwP2RvYz01MjQ2I3NlY3Rpb24tNy40LjQ8L2E+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bWFyZ2luLWxlZnQ6LjVp biI+DQombmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzttYXJnaW4tbGVmdDouNWluIj4NCi1Fa3I8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxicj4NCl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KVExTIG1h aWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpUTFNAaWV0Zi5vcmciPlRMU0BpZXRmLm9y ZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L3RscyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vdGxzPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_DM2PR21MB009190C73B515AFF6F1BF52C8C3F0DM2PR21MB0091namp_-- From nobody Thu Mar 23 10:24:43 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0D1FD1294B7 for ; Thu, 23 Mar 2017 10:24:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.92 X-Spam-Level: X-Spam-Status: No, score=-6.92 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gKrVLfPlDrlH for ; Thu, 23 Mar 2017 10:24:40 -0700 (PDT) Received: from smtpde02.smtp.sap-ag.de (smtpde02.smtp.sap-ag.de [155.56.68.140]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D97E11293F5 for ; Thu, 23 Mar 2017 10:24:39 -0700 (PDT) Received: from mail07.wdf.sap.corp (mail04.sap.corp [194.39.131.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtpde02.smtp.sap-ag.de (Postfix) with ESMTPS id 3vpthk1YVWz25yS; Thu, 23 Mar 2017 18:24:38 +0100 (CET) X-purgate-ID: 152705::1490289878-0000521C-7591481D/0/0 X-purgate-size: 1622 X-purgate: clean X-purgate: This mail is considered clean (visit http://www.eleven.de for further information) X-purgate-Ad: Categorized by eleven eXpurgate (R) http://www.eleven.de X-purgate-type: clean X-SAP-SPAM-Status: clean Received: from ld9781.wdf.sap.corp (ld9781.wdf.sap.corp [10.21.82.193]) by mail07.wdf.sap.corp (Postfix) with ESMTP id 3vpthj5W4lzGq7J; Thu, 23 Mar 2017 18:24:37 +0100 (CET) Received: by ld9781.wdf.sap.corp (Postfix, from userid 10159) id B250C1A65A; Thu, 23 Mar 2017 18:24:37 +0100 (CET) In-Reply-To: To: Eric Rescorla Date: Thu, 23 Mar 2017 18:24:37 +0100 (CET) CC: "Fries, Steffen" , TLS WG Reply-To: mrex@sap.com X-Mailer: ELM [version 2.4ME+ PL125 (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="US-ASCII" Message-Id: <20170323172437.B250C1A65A@ld9781.wdf.sap.corp> From: mrex@sap.com (Martin Rex) Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 17:24:42 -0000 Eric Rescorla wrote: >> >> based on your reply my conclusion is that >> >> - there is no (standard compliant) way for a server to use a >> SHA256 based certificate for server side authentication in cases where the >> client does not provide the signature_algorithm extension > > Not quite. If the client offers TLS 1.1 or below, then you simply don't > know if it > will accept SHA-256 and you should send whatever you have. If the client > offers > TLS 1.2 and no signature_algorithm extension, then you technically are > forbidden > from sending it a SHA-256 certificate. Note that any client which in fact > supports > SHA-256 with TLS 1.2 but doesn't send signature_algorithms containing it, > is noncomformant. It's not clear to me how many such clients in fact exist. rfc5246 makes it perfectly compliant for a TLSv1.2 client to support sha256-based signature algorithms and be willing to use them, and *NOT* send the TLS signature_algorithm extension. https://tools.ietf.org/html/rfc5246#appendix-E.2 > > - clients should always use the signature algorithm extension to >> ensure the server can apply a certificate with the appropriate crypt >> algorithms Except that the vast majority of servers only has a single certificate, and will have to do "the right thing" in most situations anyway. The definition of the "signature_algorithms" extensions is sufficiently dense to say that you MUST not send it, except when ClientHello.client_version=(3,3), and it is not possible to send it when using a backwards-compatible SSL version 2 CLIENT-HELLO. -Martin From nobody Thu Mar 23 11:25:32 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA10D129B5D for ; Thu, 23 Mar 2017 11:25:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bvOwMjj2A4Ma for ; Thu, 23 Mar 2017 11:25:28 -0700 (PDT) Received: from mail-yw0-x229.google.com (mail-yw0-x229.google.com [IPv6:2607:f8b0:4002:c05::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B6A8F1294C4 for ; Thu, 23 Mar 2017 11:25:20 -0700 (PDT) Received: by mail-yw0-x229.google.com with SMTP id d191so26072217ywe.2 for ; Thu, 23 Mar 2017 11:25:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=MG6R5qHWle93oINHxrKgJylurn5s30R+f9bCv4PX8Ek=; b=LSxe3l0iMO0xXk3NTeZ0nzi42q0XCBZISRUUduTXWdxbqTEZwFszmbrn37vy414TDX WZlB6n3bqutv6ycbQJlUr8xcBBBp/ScKXr3dmJy7vvkB9T+YYmjVR89+Fh8nqhjTyUZ6 /ODdXtgH1av4y8H1SR6zLqST3doKKnUYUk+9JrtfZNnKs1/hAu8mhZ8mOI8fCxR4E5xe 52/foISxBQPdgF6Ep3I9+XNk9vEh1GcrVXz9f/zydwNEJqKVpNkNqSXUeSvVXbZ35egm LA6evtF4IXAP8wdITirWIZ7X3+myoDMYMCOssXM+IRCdEthin/GOjo7hhmsKKYEbFp/f hWWA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=MG6R5qHWle93oINHxrKgJylurn5s30R+f9bCv4PX8Ek=; b=pXSNbpWQz1OShSHyD3QtR9cA8WC7emdWi4wHCaneW6tSPEyK1DPFCiPY2KydWttanq 0grUo4nD1mKRJFd+ICmwm7gpHtdcCHdpktLTxDLuChnZP5fXnmulRwgjREfJtbl8PTH+ G7KtliqM7i/icb4JwLqYX1uH+j98CyEcAt9ogqDdpRD+3a0eWEvmyAM/YoSSedjrcIIo ph5zsxSs0NuVkVh3OB3p+vz4OT53WhNNznWCDLBI/TYmAyDYeJfh2fHlUXV9EqaNKRza blw0k092e638IMCaIvPiCGOZea4FZVnbuDstaHLZTxdGVO+Njc7ecwTeokvkxxpbIUPX DJRQ== X-Gm-Message-State: AFeK/H17LPdQlUrHMk+y7oLUC/1rO1OhnxsXlOZr56V3WsGH1r7tSIZi6kO0FJ7/UOU24nYDzrRQPaW+paUIIQ== X-Received: by 10.13.204.206 with SMTP id o197mr2982711ywd.87.1490293519959; Thu, 23 Mar 2017 11:25:19 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Thu, 23 Mar 2017 11:24:39 -0700 (PDT) In-Reply-To: References: <4DD1F233-D659-4F79-9ADA-BC31A49DA653@dukhovni.org> From: Eric Rescorla Date: Thu, 23 Mar 2017 11:24:39 -0700 Message-ID: To: Andrei Popov Cc: "Fries, Steffen" , TLS WG Content-Type: multipart/alternative; boundary=001a114e6b3cde5bd5054b69ff76 Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 18:25:31 -0000 --001a114e6b3cde5bd5054b69ff76 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Thu, Mar 23, 2017 at 10:11 AM, Andrei Popov wrote: > =C3=98 Note that any client which in fact supports > > =C3=98 SHA-256 with TLS 1.2 but doesn't send signature_algorithms contai= ning > it, > > =C3=98 is noncomformant. It's not clear to me how many such clients in f= act > exist. > > > > We saw enough TLS 1.2 clients that are non-compliant in this way that I > made the server-side change to accommodate them. > > Obviously, Martin Rex=E2=80=99s code is one example. > Thanks. That's interesting to know. -Ekr > I=E2=80=99ve also seen a number of embedded/IoT-oriented TLS stacks that = had this > defect initially, when they first implemented TLS 1.2, although they were > quick to fix. > > Some of our customers in East Asia reported that the TLS stacks they used > had this defect; when pointed at the RFC, they took the issue to the > corresponding SW vendor(s). > > Overall, a small percentage, but it generated enough support calls that > the server change was worthwhile. > > > > Cheers, > > > > Andrei > > > > *From:* TLS [mailto:tls-bounces@ietf.org] *On Behalf Of *Eric Rescorla > *Sent:* Thursday, March 23, 2017 9:58 AM > *To:* Fries, Steffen > *Cc:* TLS WG > *Subject:* Re: [TLS] Enforcing stronger server side signature/hash > combinations in TLS 1.2 > > > > > > > > On Thu, Mar 23, 2017 at 8:37 AM, Fries, Steffen > wrote: > > Hi Erik, > > > > based on your reply my conclusion is that > > - there is no (standard compliant) way for a server to use a > SHA256 based certificate for server side authentication in cases where th= e > client does not provide the signature_algorithm extension > > Not quite. If the client offers TLS 1.1 or below, then you simply don't > know if it > > will accept SHA-256 and you should send whatever you have. If the client > offers > > TLS 1.2 and no signature_algorithm extension, then you technically are > forbidden > > from sending it a SHA-256 certificate. Note that any client which in fact > supports > > SHA-256 with TLS 1.2 but doesn't send signature_algorithms containing it, > > is noncomformant. It's not clear to me how many such clients in fact exis= t. > > > > - clients should always use the signature algorithm extension to > ensure the server can apply a certificate with the appropriate crypt > algorithms > > Yes. > > > > -Ekr > > > > > > Best regards > > Steffen > > > > On Thu, Mar 23, 2017 at 7:39 AM, Viktor Dukhovni > wrote: > > > > On Mar 23, 2017, at 10:31 AM, Fries, Steffen > wrote: > > > > According to TLS 1.2 section 7.4.1.4.1. a client may use the > > signature_algorithm extension to signal any combinations the > > client supports, listed in the order of preferences. > > The signature algorithm is primarily about signatures made as part > of the TLS handshake, and not so much signatures in certificates. > > > > This does not seem consistent with https://tools.ietf.org/ > rfcmarkup?doc=3D5246#section-7.4.2 > > > > "If the client provided a "signature_algorithms" extension, then all > certificates provided by > > the server MUST be signed by a hash/signature algorithm pair that appears > in that extension." > > > > I appreciate that there are people who feel that this rule is bad, and > > to some extent it has been relaxed in 1.3, but I think the text is > > pretty clear here. > > > > > > > If the client does not use this extension, the server must use the > > signature algorithm in combination with SHA1. > > For signing the TLS key exchange, however, it should still present > whatever certificate chain it has, even if that chain employs SHA256. > It is exceedingly unlikely these days that a client will not support > SHA256 signatures in the certificate chain. > > > > Yes, that's generally true. Though a TLS 1.2 client which does not offer > SHA-256 > > in its ClientHello but accepts SHA-256 is broken. So, this should general= ly > > only happen with TLS 1.1 and below. > > > > > > > > > Unfortunately the server is not allowed to use this extension, otherwis= e > > he could tell the client his preferences according to his security > policy. > > The protocol (as it should) lacks the additional round-trips necessary fo= r > the server to initiate signature algorithm negotiation. > > > > I'm not sure quite what the OP Is trying to achieve here. For certificate= s > offered > > by the server, the client just tells you what algorithms it will accept > for no negotiation > > is needed. For certificates offered by the client, the server tells the > client > > what algorithms it will accept in the CertificateRequest. > > https://tools.ietf.org/rfcmarkup?doc=3D5246#section-7.4.4 > > > > -Ekr > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > > --001a114e6b3cde5bd5054b69ff76 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Thu, Mar 23, 2017 at 10:11 AM, Andrei Popov <Andrei.Popov@= microsoft.com> wrote:

=C3=98=C2=A0 Note that any client which in fact supports<= /u>

=C3=98=C2=A0 SHA-256 with TLS 1.2 but doesn't send signa= ture_algorithms containing it,

=C3=98=C2=A0 is noncomformant. It's not clear to me how = many such clients in fact exist.

=C2=A0

We saw enough TLS 1.2 clients that are non-complian= t in this way that I made the server-side change to accommodate them.

Obviously, Martin Rex=E2=80=99s code is one example= .


Thanks. That's= interesting to know.

-Ekr
=C2=A0
<= blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px= #ccc solid;padding-left:1ex">

I=E2=80=99ve also seen a number of embedded/IoT-ori= ented TLS stacks that had this defect initially, when they first implemente= d TLS 1.2, although they were quick to fix.

Some of our customers in East Asia reported that th= e TLS stacks they used had this defect; when pointed at the RFC, they took = the issue to the corresponding SW vendor(s).

Overall, a small percentage, but it generated enoug= h support calls that the server change was worthwhile.=

=C2=A0

Cheers,

=C2=A0

Andrei

=C2=A0

From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Eric Rescorla
Sent: Thursday, March 23, 2017 9:58 AM
To: Fries, Steffen <steffen.fries@siemens.com>
Cc: TLS WG <tls= @ietf.org>
Subject: Re: [TLS] Enforcing stronger server side signature/hash com= binations in TLS 1.2

=C2=A0

=C2=A0

=C2=A0

On Thu, Mar 23, 2017 at 8:37 AM, Fries, Steffen <= steffen.frie= s@siemens.com> wrote:

Hi Erik,=

=C2=A0

based on your reply my conclusion is = that

-=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 there is no (standard compliant) way for a server to = use a SHA256 based certificate for server side authentication in cases wher= e the client does not provide the signature_algorithm extension

Not quite. If the client offers TLS 1.1 or below, th= en you simply don't know if it

will accept SHA-256 and you should send whatever you= have. If the client offers

TLS 1.2 and no signature_algorithm extension, then y= ou technically are forbidden

from sending it a SHA-256 certificate. Note that any= client which in fact supports

SHA-256 with TLS 1.2 but doesn't send signature_= algorithms containing it,

is noncomformant. It's not clear to me how many = such clients in fact exist.

=C2=A0

-=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 clients should always use the signature algorithm ext= ension to ensure the server can apply a certificate with the appropriate cr= ypt algorithms

Yes.

=C2=A0

-Ekr

=C2=A0

=C2=A0

Best regards

Steffen

=C2=A0

On Thu, Mar 23, 2017 at 7:39 AM, Viktor Dukhovni <ietf-dane@dukhovni.org> wrote:=


> On Mar 23, 2017, at 10:31 AM, Fries, Steffen <steffen.fries@siemens.com>= wrote:
>
> According to=C2=A0 TLS 1.2 section 7.4.1.4.1. a client may use the
> sign= ature_algorithm extension to signal any combinations the
> clie= nt supports, listed in the order of preferences.

The signature algorithm is primarily about signatures made as part
of the TLS handshake, and not so much signatures in certificates.=

=C2=A0

This does not seem consistent with https://tools.ietf.org/rfcmarkup?doc=3D5246#section-7.4.2<= /u>

=C2=A0

"If the client provided a "signature_algorithms" extension, = then all certificates provided by

the server MUST be signed by a hash/signature algorithm pair that appears i= n that extension."

=C2=A0

I appreciate that there are people who feel that this rule is bad, and

to some extent it has been relaxed in 1.3, but I think the text is

pretty clear here.

=C2=A0

=C2=A0

> If t= he client does not use this extension, the server must use the
> sign= ature algorithm in combination with SHA1.

For signing the TLS key exchange, however, it should still present
whatever certificate chain it has, even if that chain employs SHA256.
It is exceedingly unlikely these days that a client will not support
SHA256 signatures in the certificate chain.

=C2=A0

Yes, that's generally true. Though a TLS 1.2 client which does not offe= r SHA-256

in its ClientHello but accepts SHA-256 is broken. So, this should generally=

only happen with TLS 1.1 and below.

=C2=A0

=C2=A0

=C2=A0

> Unfo= rtunately the server is not allowed to use this extension, otherwise=
> he c= ould tell the client his preferences according to his security policy.

The protocol (as it should) lacks the additional round-trips necessary for<= br> the server to initiate signature algorithm negotiation.

=C2=A0

I'm not sure quite what the OP Is trying to achieve here. For certifica= tes offered

by the server, the client just tells you what algorithms it will accept for= no negotiation

is needed. For certificates offered by the client, the server tells the cli= ent

what algorithms it will accept in the CertificateRequest.

=C2=A0

-Ekr


_______________________________________________
TLS mailing list
TLS@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/tls

=C2=A0


--001a114e6b3cde5bd5054b69ff76-- From nobody Thu Mar 23 11:26:27 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 97345129B5D for ; Thu, 23 Mar 2017 11:26:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kQ4PBzpIpJOb for ; Thu, 23 Mar 2017 11:26:23 -0700 (PDT) Received: from mail-yw0-x22d.google.com (mail-yw0-x22d.google.com [IPv6:2607:f8b0:4002:c05::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 81D471294C4 for ; Thu, 23 Mar 2017 11:26:23 -0700 (PDT) Received: by mail-yw0-x22d.google.com with SMTP id p77so152679379ywg.1 for ; Thu, 23 Mar 2017 11:26:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=f8Dg7/24quBKJeZPHSTUqGbA2+RJJRnRXADHKb24wSU=; b=NT8HYN3iHhyiPmen1E1/3agnpBR5105IljU3h143fntjpYNyKPzvzLq8ZdCW2CExzO hR4Wz1viVcS56TPshUi0rZ29WPt9xSLFEbeecGSaa75U8XJtuXFxPNaUyw7Bw1ouDX+d 8uK5HUBBzIlF7hm7a8qfRlIiDjbC5Gj2L+w3cKfEVMJjovYhMA3gDhlKa1HTcjvhTjLl nYm/tG5JFWYsLX1KjoDbzmQ3ZlkGhScek817XKZQMHqqj8VFuRpA9Oo0cp0b6KJB0lLn yVplacbCqESa1a8Xe1CuzLvl/21NudDM11i94F6Yp+uToEVbRIKPo8hzzgR2nAgsoxk+ 9RBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=f8Dg7/24quBKJeZPHSTUqGbA2+RJJRnRXADHKb24wSU=; b=P1552VJbth+zEcjai90yu/HtEWdAwztxYCVMMfXEGGFsKr6GX5Flg1hBvu/VEVb4So xjS+hiyUEedxBYPX2EJunFAmGij0EygJIfBTiOvXqtqr2HWATMnGnd+t1kYtl22fupff RttP51VHtl3QpUYZmZyH6OxPSSg4PMmVpphS124K9oYotYYKAIEG8+JJmekfOovY+m8K A6lj7g/sx7ScvU+RTnqI1m2LymX0HJBvuJglfKFZTS+abcGWlthgQlanU43hUeLkZQOY j2rkUOgVvZE3TmmFNs8s5K5cfq+dG3ArkLmLIUGNFT4Ce4qIVIrmmp0L5sZlBd7CwFTR 9h3w== X-Gm-Message-State: AFeK/H2ddQ8joRqkFE5upU5JzDNcxOQnkfKpEd1KnLWEDognVlgu5p7vGpPL3+RaBNzrONQZCM1tGyLAp5Q+rQ== X-Received: by 10.37.201.196 with SMTP id z187mr2849970ybf.161.1490293582729; Thu, 23 Mar 2017 11:26:22 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Thu, 23 Mar 2017 11:25:42 -0700 (PDT) In-Reply-To: <20170323172437.B250C1A65A@ld9781.wdf.sap.corp> References: <20170323172437.B250C1A65A@ld9781.wdf.sap.corp> From: Eric Rescorla Date: Thu, 23 Mar 2017 11:25:42 -0700 Message-ID: To: "mrex@sap.com" Cc: "Fries, Steffen" , TLS WG Content-Type: multipart/alternative; boundary=001a114d88ea9c2bc3054b6a0308 Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 18:26:26 -0000 --001a114d88ea9c2bc3054b6a0308 Content-Type: text/plain; charset=UTF-8 On Thu, Mar 23, 2017 at 10:24 AM, Martin Rex wrote: > Eric Rescorla wrote: > >> > >> based on your reply my conclusion is that > >> > >> - there is no (standard compliant) way for a server to use a > >> SHA256 based certificate for server side authentication in cases where > the > >> client does not provide the signature_algorithm extension > > > > Not quite. If the client offers TLS 1.1 or below, then you simply don't > > know if it > > will accept SHA-256 and you should send whatever you have. If the client > > offers > > TLS 1.2 and no signature_algorithm extension, then you technically are > > forbidden > > from sending it a SHA-256 certificate. Note that any client which in fact > > supports > > SHA-256 with TLS 1.2 but doesn't send signature_algorithms containing it, > > is noncomformant. It's not clear to me how many such clients in fact > exist. > > rfc5246 makes it perfectly compliant for a TLSv1.2 client to support > sha256-based signature algorithms and be willing to use them, > and *NOT* send the TLS signature_algorithm extension. > > https://tools.ietf.org/html/rfc5246#appendix-E.2 Yes, I agree with this, if you use the v2 ClIENT-HELLO. -Ekr > - clients should always use the signature algorithm extension to > >> ensure the server can apply a certificate with the appropriate crypt > >> algorithms > > Except that the vast majority of servers only has a single certificate, > and will have to do "the right thing" in most situations anyway. > The definition of the "signature_algorithms" extensions is > sufficiently dense to say that you MUST not send it, except when > ClientHello.client_version=(3,3), and it is not possible to send it > when using a backwards-compatible SSL version 2 CLIENT-HELLO. > > > -Martin > --001a114d88ea9c2bc3054b6a0308 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Thu, Mar 23, 2017 at 10:24 AM, Martin Rex <mrex@sap.com> w= rote:
Eric Rescorla wrot= e:
>>
>> based on your reply my conclusion is that
>>
>> -=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 there is no (standard complian= t) way for a server to use a
>> SHA256 based certificate for server side authentication in cases w= here the
>> client does not provide the signature_algorithm extension
>
> Not quite. If the client offers TLS 1.1 or below, then you simply don&= #39;t
> know if it
> will accept SHA-256 and you should send whatever you have. If the clie= nt
> offers
> TLS 1.2 and no signature_algorithm extension, then you technically are=
> forbidden
> from sending it a SHA-256 certificate. Note that any client which in f= act
> supports
> SHA-256 with TLS 1.2 but doesn't send signature_algorithms contain= ing it,
> is noncomformant. It's not clear to me how many such clients in fa= ct exist.

rfc5246 makes it perfectly compliant for a TLSv1.2 client to support=
sha256-based signature algorithms and be willing to use them,
and *NOT* send the TLS signature_algorithm extension.

https://tools.ietf.org/html/rfc5246#appendix-E.= 2

Yes, I agree with this, if you use th= e v2 ClIENT-HELLO.

-Ekr

> -=C2=A0 =C2=A0 clients should always use the signature algorithm exten= sion to
>> ensure the server can apply a certificate with the appropriate cry= pt
>> algorithms

Except that the vast majority of servers only has a single certifica= te,
and will have to do "the right thing" in most situations anyway.<= br> The definition of the "signature_algorithms" extensions is
sufficiently dense to say that you MUST not send it, except when
ClientHello.client_version=3D(3,3), and it is not possible to send it<= br> when using a backwards-compatible SSL version 2 CLIENT-HELLO.


-Martin

--001a114d88ea9c2bc3054b6a0308-- From nobody Thu Mar 23 12:13:44 2017 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3CC6C13163A; Thu, 23 Mar 2017 12:13:36 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.48.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <149029641619.22463.13421375632901507295@ietfa.amsl.com> Date: Thu, 23 Mar 2017 12:13:36 -0700 Archived-At: Subject: [TLS] I-D Action: draft-ietf-tls-rfc4492bis-16.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2017 19:13:36 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Transport Layer Security of the IETF. Title : Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier Authors : Yoav Nir Simon Josefsson Manuel Pegourie-Gonnard Filename : draft-ietf-tls-rfc4492bis-16.txt Pages : 32 Date : 2017-03-23 Abstract: This document describes key exchange algorithms based on Elliptic Curve Cryptography (ECC) for the Transport Layer Security (TLS) protocol. In particular, it specifies the use of Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) key agreement in a TLS handshake and the use of Elliptic Curve Digital Signature Algorithm (ECDSA) and Edwards Digital Signature Algorithm (EdDSA) as authentication mechanisms. This document obsoletes and replaces RFC 4492. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tls-rfc4492bis/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-16 https://datatracker.ietf.org/doc/html/draft-ietf-tls-rfc4492bis-16 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tls-rfc4492bis-16 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Mar 23 18:00:38 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3967F129A8C for ; Thu, 23 Mar 2017 18:00:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7TfxqHawtCw2 for ; Thu, 23 Mar 2017 18:00:35 -0700 (PDT) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D3193124B0A for ; Thu, 23 Mar 2017 18:00:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1490317235; x=1521853235; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=noQtfqbDOvKPgLR6w0NvCwYU9Si5EdgjL0xAHr0pkJg=; b=U6/qkvXX1gKIpsInqr5/DwupHwuhmvql2yKkcusJxOYwN/BuWBbqSsLy St46SMcciY/p5LZfpHRbfOv50nOTbF+QJhelQL/noX8flL4Wrypt4TQIW KvBeRv24hWhPYXUBDvtCOXorAlNzj1HJYVy1jjEGld2lFopOgC7DAOHsk 3sLoQo/C728t3GhXw6wnQ/Hr/w8SDs4WvEy+q1YFN7ghcGqE+3Jg5dCn2 IgCgkPQHTxNQLVnH228zqUjxqawBfJlj9bo3ayOfDWdCDJhi0ejcv7SjU cL1o88fhE38Rbe8xor3StcqmDZoc62oW5q/OpDVVaxFa4ndNH2MtLI4kN A==; X-IronPort-AV: E=Sophos;i="5.36,212,1486378800"; d="scan'208";a="145115810" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.3.4 - Outgoing - Outgoing Received: from exchangemx.uoa.auckland.ac.nz (HELO uxcn13-tdc-c.UoA.auckland.ac.nz) ([10.6.3.4]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 24 Mar 2017 14:00:08 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-tdc-c.UoA.auckland.ac.nz (10.6.3.24) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Fri, 24 Mar 2017 14:00:08 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1178.000; Fri, 24 Mar 2017 14:00:08 +1300 From: Peter Gutmann To: "Fries, Steffen" , "tls@ietf.org" Thread-Topic: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 Thread-Index: AdKj4jdTMGBzllsXQzCZ8vwWateOaAAV7P7y Date: Fri, 24 Mar 2017 01:00:07 +0000 Message-ID: <1490317199552.71745@cs.auckland.ac.nz> References: In-Reply-To: Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 01:00:37 -0000 Fries, Steffen writes:=0A= =0A= >I looked through the mailing list but did not find an immediate answer to = my=0A= >question, but I guess, it must have been discussed already. =0A= =0A= It's been discussed several times, but I'm not sure which search terms you'= d=0A= have to apply to find the threads... the general consensus was that even=0A= though the text says it applies to certificates as well, you ignore this=0A= because it serves no obvious purpose but breaks functionality and=0A= interoperability.=A0 See several previous discussions on the rationale behi= nd=0A= this (hmm, if you can find them :-).=0A= =0A= Peter.=0A= =A0=0A= = From nobody Thu Mar 23 18:11:58 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 879DE1276AF for ; Thu, 23 Mar 2017 18:11:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SD90BtOBKZgB for ; Thu, 23 Mar 2017 18:11:55 -0700 (PDT) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4D044129B10 for ; Thu, 23 Mar 2017 18:11:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1490317914; x=1521853914; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=qDm+mVII48frxED6G3fPZe4hHzToBYD0c0Vn5tpaCjU=; b=HnqcCwlvclL7FMFfIAM0kag+h/Z4ts6uKN+yx0ywkYnV57Uq/Cu5JGhu sXweMOfQ+9hMu0KGggdNM4p8f+WMRoSH2KDoT3HYxXQsEQFPJ/F/601Nz TVO1Cg8bvirD8wWhlR5YMBUFEoFec/zqCeugK2uVuEvI3mxYL7QBvwP4+ Fya2g5H2fQ9vIKCPAwxc9qj2cIj4+QExgxXq7WQVmjs0UjksePLKvzYGY 6DH2NN0+onzKr7r1wmTrd2XXS50E617ClUrto57Pq07+n4Xa2N5Y42tc0 Lm+hdnEnaC0GhPxszXI2u1dgKXB63tHJssb//TzmfG7YeuhYEtYfSSXVO Q==; X-IronPort-AV: E=Sophos;i="5.36,212,1486378800"; d="scan'208";a="145118653" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 10.6.2.8 - Outgoing - Outgoing Received: from exchangemx.uoa.auckland.ac.nz (HELO uxcn13-ogg-e.UoA.auckland.ac.nz) ([10.6.2.8]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 24 Mar 2017 14:11:52 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz (10.6.2.5) by uxcn13-ogg-e.UoA.auckland.ac.nz (10.6.2.8) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Fri, 24 Mar 2017 14:11:52 +1300 Received: from uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) by uxcn13-ogg-d.UoA.auckland.ac.nz ([10.6.2.25]) with mapi id 15.00.1178.000; Fri, 24 Mar 2017 14:11:52 +1300 From: Peter Gutmann To: Andrei Popov , "Fries, Steffen" , TLS WG Thread-Topic: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 Thread-Index: AdKj4jdTMGBzllsXQzCZ8vwWateOaP//KBSAgAAMVgCAAAPbAIAAFOEAgAFlb68= Date: Fri, 24 Mar 2017 01:11:52 +0000 Message-ID: <1490317904391.60980@cs.auckland.ac.nz> References: <4DD1F233-D659-4F79-9ADA-BC31A49DA653@dukhovni.org> , In-Reply-To: Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 01:11:57 -0000 Andrei Popov writes:=0A= =0A= >Unfortunately, in practice there are TLS 1.2 clients that support SHA256, = but=0A= >don=92t advertise it via the signature algorithms extension.=0A= =0A= It's actually pretty safe to just automatically assume SHA256 (for TLS 1.2)= ,=0A= regardless of what the other side advertises.=A0 There was a survey paper= =0A= published a while back, I can't remember exactly which one, one of the many= =0A= TLS-in-the-wild ones, which showed that of the servers that supported ECC,= =0A= close to 100% did P256 + SHA256, some low single-digit figure were P521+512= ,=0A= and 384 was lost in the margin of error, some fraction of a percent.=A0 Of = the=0A= anecdotal evidence from SCADA etc which isn't publicly visible, it's about = the=0A= same, you can pretty much assume P256 + SHA256 by default.=0A= =0A= Which is precisely why LTS specifies P256 + SHA256 as its MTI if you're doi= ng=0A= ECC.=A0 To paraphrase Calvin's quote about success, "the secret to success = is=0A= changing your expectations so that they're already met".=A0 Assume P256+SHA= 256=0A= (when ECC is indicated), or just SHA256 in general for 1.2, and you won't b= e=0A= disappointed.=0A= =0A= Peter.=0A= = From nobody Thu Mar 23 18:25:45 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA169129A7F for ; Thu, 23 Mar 2017 18:25:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YdSHBn7lx_jh for ; Thu, 23 Mar 2017 18:25:42 -0700 (PDT) Received: from mail-qk0-x22b.google.com (mail-qk0-x22b.google.com [IPv6:2607:f8b0:400d:c09::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3AB8A129A51 for ; Thu, 23 Mar 2017 18:25:42 -0700 (PDT) Received: by mail-qk0-x22b.google.com with SMTP id p22so549589qka.3 for ; Thu, 23 Mar 2017 18:25:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:date:references :to:in-reply-to:message-id; bh=IdEh6J5nqKrqlyNO0kvnduEKUyywyWX874m32wISH6M=; b=GRDwbZzoTs3EqeWGGo08uPNMcT8FTHVloy4xvITpFvMy+pRiez6YhUFg/e0TSUE0Bu N66nKyGfWLOawFsRRvQGm+Km87FEWPFfny9dXSlOkZMTbxO48UEfh8ZfundLNkMUrTHy hcfENCN4wMzkAPjKv84yWRDSotJ1o1rPlIJiQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:date:references:to:in-reply-to:message-id; bh=IdEh6J5nqKrqlyNO0kvnduEKUyywyWX874m32wISH6M=; b=gMjo/sVUYXLQk5Z4m9SqAomITLB4JLurBUsm1ZTroS7CLiUklzO3xaD9JwBRX1+x/X Y9jxiIZiW340VWLx6gOfQbZt2ZqbviKtgnWOCz1SIJONGOE4b6bOn6k6qayI5kTjjXYg 9/Gu8GdO+++Z8ChqEFebjd6n3AQAPkRWKnD+jAL9DTPsgcMp0LdMimnkiyMRI8SehO4n KKu620Cr3iz1YDyVTRBhTeAp73KIXpnza7UocfCE5cCKZNr/Atj8NovGf1IowgPi4C3a VESsGZsKkNPN+JQllwyzrMCC4plAdd8RJ5ToxWBolcZa+q8D7hQ2O6jhMhZ0xnd8mPjC hvYA== X-Gm-Message-State: AFeK/H0ZZQapmWaJuMXaKahMBGfrvmRTsTvW5AN0/5Pz3TFrz9WtP60nTmNUOR/nIAzgqw== X-Received: by 10.55.121.134 with SMTP id u128mr5542308qkc.12.1490318741136; Thu, 23 Mar 2017 18:25:41 -0700 (PDT) Received: from [172.16.0.18] ([96.231.230.131]) by smtp.gmail.com with ESMTPSA id o16sm518939qkl.67.2017.03.23.18.25.39 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 23 Mar 2017 18:25:39 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) Date: Thu, 23 Mar 2017 21:25:38 -0400 References: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> <54343047-7620-4A96-BD39-6E60AE7EA5A2@sn3rd.com> <5f39565c-5417-b94f-f1e6-32261c473455@nomountain.net> <27455360-f4ee-4918-ee08-5ccf99a94ec9@nomountain.net> <896987d1-4bb4-3f04-a34e-c09b245d038b@nomountain.net> To: "" In-Reply-To: <896987d1-4bb4-3f04-a34e-c09b245d038b@nomountain.net> Message-Id: X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 01:25:44 -0000 > On Mar 23, 2017, at 12:31, Melinda Shore = wrote: >=20 > On 3/23/17 8:14 AM, Viktor Dukhovni wrote: >> I don't know how many other folks on the TLS WG list are prepared >> to do a thorough review the DNSSEC aspects of this draft... >> Perhaps the TLS and DNS communities overlap sufficiently that my >> concern is not warranted? >=20 > I think it's quite warranted, and we're sending requests > for review to both the dane mailing list (still open even > though the wg shut down) and to dnsop. The DNS parts are > more complicated than the actual extension mechanism and > need expert review. We'll be requesting review once the > new version is posted. We=E2=80=99re planning to cc: the DANE, DNSOPS, and DPRIVE WG during = WGLC. This obviously assumes we are there sometime shortly after = Chicago. spt= From nobody Thu Mar 23 18:30:01 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D6CC129BDB for ; Thu, 23 Mar 2017 18:29:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xzRTDDJ0juIF for ; Thu, 23 Mar 2017 18:29:57 -0700 (PDT) Received: from mournblade.imrryr.org (mournblade.imrryr.org [108.5.242.66]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8BE71129B10 for ; Thu, 23 Mar 2017 18:29:57 -0700 (PDT) Received: from vpro.lan (cpe-74-71-8-253.nyc.res.rr.com [74.71.8.253]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mournblade.imrryr.org (Postfix) with ESMTPSA id B93247A32F1 for ; Fri, 24 Mar 2017 01:29:56 +0000 (UTC) (envelope-from ietf-dane@dukhovni.org) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Viktor Dukhovni In-Reply-To: <1490317199552.71745@cs.auckland.ac.nz> Date: Thu, 23 Mar 2017 21:29:55 -0400 Content-Transfer-Encoding: quoted-printable Reply-To: TLS WG Message-Id: <52C6D0EF-D6AC-484A-9096-BDAE5C870F82@dukhovni.org> References: <1490317199552.71745@cs.auckland.ac.nz> To: TLS WG X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 01:30:00 -0000 > On Mar 23, 2017, at 9:00 PM, Peter Gutmann = wrote: >=20 > See several previous discussions on the rationale behind > this (hmm, if you can find them :-). See, for example, the thread that contains: https://www.ietf.org/mail-archive/web/tls/current/msg17977.html I chose that message because it was easy to find. This particular topic has been a bit of a focus of mine on this list, so searching for my posts with a few of the related keywords pretty quickly messages on this topic. Given that TLS is opportunistic in SMTP, I strive to find ways to achieve as much as security as one can get and not end up with less by dogmatically insisting on more than is possible. Hence RFC7435, and more recently the dose of pragmatism that made it possible to convince the group to avoid repeating the error in the TLS 1.3 spec. The net effect is that in practice you simply ignore the signature algorithms when it comes to the certificate chain. I've never seen a TLS server that has multiple chains to choose from for the same server identity. This applies also to TLS 1.2, despite RFC 5246. --=20 Viktor. From nobody Thu Mar 23 22:08:50 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C17E3129407 for ; Thu, 23 Mar 2017 22:08:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PlITmnAz_un1 for ; Thu, 23 Mar 2017 22:08:47 -0700 (PDT) Received: from mail-qk0-x230.google.com (mail-qk0-x230.google.com [IPv6:2607:f8b0:400d:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 01BE91243F6 for ; Thu, 23 Mar 2017 22:08:46 -0700 (PDT) Received: by mail-qk0-x230.google.com with SMTP id p64so3074267qke.1 for ; Thu, 23 Mar 2017 22:08:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=hUNwfm5BanClv73gLBi0clUgGJ0SGrXzoU4aKz9sWQM=; b=giwOd7T/C0652BqJslBKF7GSbmG59U5+reuUfApPwQlSTcPZP+t3wgkQhbGTSdJGRp KJgbyOBAwbVU2wMNlTWd98XcpPYQnzch8r96P4fNoqemQogF6iE0fursALynwT8QBr0F kvY8WtZdXKdFk3K3XrJMio/exx/AzoHAvfYSsrTd9KMBCzogdq7Teyspoom2SDxtb6qf U31Psln85+Me7+N8utVXoC7HR8Ea7GTn9q45v41Ru0w0FNIdyjpBVLA0UoHvwhVoljYB aOKgZRh8pKABoLp4J3Cmc1QKJJb8EJi53/8ZFV6kUrR4g1/LJec2lC9Gfy/STCjLvM28 VBYw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=hUNwfm5BanClv73gLBi0clUgGJ0SGrXzoU4aKz9sWQM=; b=U/zlW5hq/eOozV+oxIkVOg6OxwCbKF6gyCiaM5aoJhFCvpUUAEDIjh6tY3hhKZkLgE OOkGhVobVhpmU/BuZIRcShk6RNCRWMqSnJjl04skUnZ7Y3rufCKWlfaQ33jkanNQreUj f/8pCfifw2mhi7rh4kX+zpnAvbpIKYfS1nccG3t57E3TFnDVyNsCvL6HcUltkr2HpDcf 7G2mXwu9nTE/eEsC4cACJzo0/hGLpcd6Pmf54c+6pvh2w+3RRJNQhQbveCBIIdjcOvik ZM33eEAxe/0R86EFQG5WNawInjx318gTSB7gqAkoWtldl8j0dSOl07756oebObKF5pIu 1Q9w== X-Gm-Message-State: AFeK/H2nPYoWpRmPIuQFwDfSynR+WM0hbdHszIYPsbn9V9L9oIV+sz9pvx6fxaUrK5z/HdmAPqiTri+6LD0elA== X-Received: by 10.55.122.134 with SMTP id v128mr5525007qkc.115.1490332126008; Thu, 23 Mar 2017 22:08:46 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Thu, 23 Mar 2017 22:08:45 -0700 (PDT) In-Reply-To: <52C6D0EF-D6AC-484A-9096-BDAE5C870F82@dukhovni.org> References: <1490317199552.71745@cs.auckland.ac.nz> <52C6D0EF-D6AC-484A-9096-BDAE5C870F82@dukhovni.org> From: Martin Thomson Date: Fri, 24 Mar 2017 16:08:45 +1100 Message-ID: To: TLS WG Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 05:08:49 -0000 On 24 March 2017 at 12:29, Viktor Dukhovni wrote: > I've never seen > a TLS server that has multiple chains to choose from for the same > server identity. I didn't have to look far. www.cloudflare.com will switch hit and pick RSA or ECDSA on demand: $ ./tstclnt -h www.cloudflare.com -p 443 -D -b -C ==== certificate(s) sent by server: ==== Certificate: Data: Serial Number:03:61:3e:ff:c0:fb:82:d6:a4:d8:45:8e:8f:18:04:3a Signature Algorithm: X9.62 ECDSA signature with SHA256 Issuer: "CN=DigiCert ECC Extended Validation Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US" Validity: Not Before: Fri Oct 28 00:00:00 2016 Not After : Fri Nov 02 12:00:00 2018 Subject: "CN=cloudflare.com,O="Cloudflare, Inc.",L=San Francisco,ST=CA,C=US,postalCode=94107,STREET=101 Townsend,serialNumber=4710875,incorporationState=Delaware,incorporationCountry=US,businessCategory=Private Organization" Fingerprint (SHA-256): 12:C4:A5:74:7E:D5:6E:37:2C:87:89:02:25:E4:CD:51:89:6D:8E:AD:7D:55:CF:76:BF:D1:9B:6B:74:6C:70:D0 $ ./tstclnt -h www.cloudflare.com -p 443 -D -b -C -c :009c ==== certificate(s) sent by server: ==== Certificate: Data: Serial Number:01:bf:d1:dc:15:00:6e:0a:bb:a7:c6:70:ff:5e:11:01 Signature Algorithm: PKCS #1 SHA-256 With RSA Encryption Issuer: "CN=DigiCert SHA2 Extended Validation Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US" Validity: Not Before: Fri Oct 28 00:00:00 2016 Not After : Fri Nov 02 12:00:00 2018 Subject: "CN=cloudflare.com,O="Cloudflare, Inc.",L=San Francisco,ST=CA,C=US,postalCode=94107,STREET=101 Townsend,serialNumber=4710875,incorporationState=Delaware,incorporationCountry=US,businessCategory=Private Organization" Fingerprint (SHA-256): 30:BA:61:01:2F:FE:7C:EA:AF:9A:14:8A:0C:B0:C5:C8:52:A9:C0:4F:4B:1C:27:DB:6E:FA:99:19:C7:F4:9C:CF I just had to ask nicely. I'm pretty sure that there are more out there on the web; I'm sure that mail is a whole different proposition. From nobody Thu Mar 23 22:23:48 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4E1991243F6 for ; Thu, 23 Mar 2017 22:23:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WnI614ueLs21 for ; Thu, 23 Mar 2017 22:23:45 -0700 (PDT) Received: from mournblade.imrryr.org (mournblade.imrryr.org [108.5.242.66]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 18D7C120726 for ; Thu, 23 Mar 2017 22:23:43 -0700 (PDT) Received: from vpro.lan (cpe-74-71-8-253.nyc.res.rr.com [74.71.8.253]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mournblade.imrryr.org (Postfix) with ESMTPSA id E47467A32F1 for ; Fri, 24 Mar 2017 05:23:42 +0000 (UTC) (envelope-from ietf-dane@dukhovni.org) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Viktor Dukhovni In-Reply-To: Date: Fri, 24 Mar 2017 01:23:41 -0400 Content-Transfer-Encoding: quoted-printable Reply-To: TLS WG Message-Id: <7970606B-0096-475D-8842-2A14E5168413@dukhovni.org> References: <1490317199552.71745@cs.auckland.ac.nz> <52C6D0EF-D6AC-484A-9096-BDAE5C870F82@dukhovni.org> To: TLS WG X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 05:23:47 -0000 > On Mar 24, 2017, at 1:08 AM, Martin Thomson = wrote: >=20 >> I've never seen >> a TLS server that has multiple chains to choose from for the same >> server identity. Both chains of course use SHA256. Sorry I meant to say multiple digest algorithms for otherwise identical chains (same public key algorithm and server name). Even in the SMTP space some servers have both RSA and ECDSA certs. When that's the case, cipher negotiation ensures that the selected EE certificate's public key algorithm is mutually supported. There's still little need to pay attention to the client's signature algorithms in choosing the EE-certificate and associated chain. --=20 --=20 Viktor. From nobody Fri Mar 24 03:00:42 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA692129636 for ; Fri, 24 Mar 2017 03:00:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.92 X-Spam-Level: X-Spam-Status: No, score=-6.92 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vlD3RNMj2Vq5 for ; Fri, 24 Mar 2017 03:00:38 -0700 (PDT) Received: from gecko.sbs.de (gecko.sbs.de [194.138.37.40]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E2D8B129624 for ; Fri, 24 Mar 2017 03:00:37 -0700 (PDT) Received: from mail2.sbs.de (mail2.sbs.de [192.129.41.66]) by gecko.sbs.de (8.15.2/8.15.2) with ESMTPS id v2OA0SWe001963 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 24 Mar 2017 11:00:28 +0100 Received: from DEFTHW99ERKMSX.ww902.siemens.net (defthw99erkmsx.ww902.siemens.net [139.22.70.147]) by mail2.sbs.de (8.15.2/8.15.2) with ESMTPS id v2OA0R0O027781 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Fri, 24 Mar 2017 11:00:27 +0100 Received: from DEFTHW99ER4MSX.ww902.siemens.net (139.22.70.78) by DEFTHW99ERKMSX.ww902.siemens.net (139.22.70.147) with Microsoft SMTP Server (TLS) id 14.3.339.0; Fri, 24 Mar 2017 11:00:27 +0100 Received: from DENBGAT9EH2MSX.ww902.siemens.net ([169.254.6.129]) by DEFTHW99ER4MSX.ww902.siemens.net ([139.22.70.78]) with mapi id 14.03.0339.000; Fri, 24 Mar 2017 11:00:27 +0100 From: "Fries, Steffen" To: Peter Gutmann , Andrei Popov , TLS WG Thread-Topic: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 Thread-Index: AQHSo+tRbCE70GuRKkiIdy7OdMXyAv//KBSAgAAMVgCAAAPbAIAAFOEAgAFlb6+how/RcA== Date: Fri, 24 Mar 2017 10:00:26 +0000 Message-ID: References: <4DD1F233-D659-4F79-9ADA-BC31A49DA653@dukhovni.org> , <1490317904391.60980@cs.auckland.ac.nz> In-Reply-To: <1490317904391.60980@cs.auckland.ac.nz> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [139.22.70.49] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 10:00:41 -0000 Peter Gutmann [pgut001@cs.auckland.ac.nz] writes=20 Andrei Popov writes: >Unfortunately, in practice there are TLS 1.2 clients that support=20 >SHA256, but don't advertise it via the signature algorithms extension. It's actually pretty safe to just automatically assume SHA256 (for TLS 1.2)= , regardless of what the other side advertises.=A0 There was a survey paper= published a while back, I can't remember exactly which one, one of the man= y TLS-in-the-wild ones, which showed that of the servers that supported ECC= , close to 100% did P256 + SHA256, some low single-digit figure were P521+5= 12, and 384 was lost in the margin of error, some fraction of a percent.=A0= Of the anecdotal evidence from SCADA etc which isn't publicly visible, it'= s about the same, you can pretty much assume P256 + SHA256 by default. [[stf]] well, assumed the other side sends any cipher suite containing SHA= -256, the server can assume that technically the client is able to utilize = it in signature operations. Which is precisely why LTS specifies P256 + SHA256 as its MTI if you're doi= ng ECC.=A0 To paraphrase Calvin's quote about success, "the secret to succe= ss is changing your expectations so that they're already met".=A0 Assume P2= 56+SHA256 (when ECC is indicated), or just SHA256 in general for 1.2, and y= ou won't be disappointed. Peter. =20 From nobody Fri Mar 24 05:37:35 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B5231297E6 for ; Fri, 24 Mar 2017 05:37:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JEaqaDkNY0SJ for ; Fri, 24 Mar 2017 05:37:33 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5DC351296CF for ; Fri, 24 Mar 2017 05:37:33 -0700 (PDT) Received: from pps.filterd (m0050095.ppops.net [127.0.0.1]) by m0050095.ppops.net-00190b01. (8.16.0.20/8.16.0.20) with SMTP id v2OCbVUH030801 for ; Fri, 24 Mar 2017 12:37:31 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-transfer-encoding : mime-version; s=jan2016.eng; bh=no2JlMv9XWUnV6R4YZrrK5aoWkHRIQ8QUwexW14ILug=; b=IrXndzOcpvY/Cb0DJmbMdAEzvmLJxdAffo8b1YPNPFFoSD0ShcT1qyTNPGRkD7iP/8nm 8iPj1PgfiIUmqbAe2nydIfH4ZZsu8W3QFub55nuRdAw+Tm+46aTu2enAZJj/7dCyJ0H3 GSODbJNgPrX+1ItazdSxta0H62uypfQ2mfeEQfIL5g8z/j9OWu/1rZSzyaJZfrRyXRdl Si/fzw205gFLbjQUGMEZenwWD8leBOukXUA6785PTqmh3g/McMs1ZWa4NaEqdR634Nz3 UWjmDGRIZ3FgGH5088BlM8Iur4QJRt2F2zHGhs6m0CB2wa2odOjrQ1ab6ZFhUxcnXyzT xQ== Received: from prod-mail-ppoint2 (a184-51-33-19.deploy.static.akamaitechnologies.com [184.51.33.19] (may be forged)) by m0050095.ppops.net-00190b01. with ESMTP id 29c9wsg8dn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Fri, 24 Mar 2017 12:37:30 +0000 Received: from pps.filterd (prod-mail-ppoint2.akamai.com [127.0.0.1]) by prod-mail-ppoint2.akamai.com (8.16.0.17/8.16.0.17) with SMTP id v2OCbGs1019250 for ; Fri, 24 Mar 2017 08:37:28 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.31]) by prod-mail-ppoint2.akamai.com with ESMTP id 29b9ww8xdq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Fri, 24 Mar 2017 08:37:28 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb1.msg.corp.akamai.com (172.27.123.101) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Fri, 24 Mar 2017 08:37:27 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1178.000; Fri, 24 Mar 2017 08:37:27 -0400 From: "Salz, Rich" To: TLS WG Thread-Topic: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 Thread-Index: AdKj4jdTMGBzllsXQzCZ8vwWateOaAAV7P7yAAlwAIAAB6SGgAAAhYSAAAbAPnA= Date: Fri, 24 Mar 2017 12:37:26 +0000 Message-ID: <5fb32f1f5a054f739c3454642d4ee70e@usma1ex-dag1mb1.msg.corp.akamai.com> References: <1490317199552.71745@cs.auckland.ac.nz> <52C6D0EF-D6AC-484A-9096-BDAE5C870F82@dukhovni.org> <7970606B-0096-475D-8842-2A14E5168413@dukhovni.org> In-Reply-To: <7970606B-0096-475D-8842-2A14E5168413@dukhovni.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.32.234] Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-24_11:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703240110 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-24_11:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703240110 Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 12:37:35 -0000 > Sorry I meant to say multiple digest algorithms for otherwise identical c= hains > (same public key algorithm and server name). We used to have to do this, during the MD5-deprecation days. From nobody Fri Mar 24 06:01:19 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BB05129683 for ; Fri, 24 Mar 2017 06:01:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z7MGlCfoYB-4 for ; Fri, 24 Mar 2017 06:01:11 -0700 (PDT) Received: from mail-yw0-x229.google.com (mail-yw0-x229.google.com [IPv6:2607:f8b0:4002:c05::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 663AE12441E for ; Fri, 24 Mar 2017 06:01:11 -0700 (PDT) Received: by mail-yw0-x229.google.com with SMTP id p77so1263409ywg.1 for ; Fri, 24 Mar 2017 06:01:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=zLkXQuw7YUw830KvZ6oxQ0/LeHrw3AB8oRtSzmPEwsw=; b=iA3eM3iwwHnpOS/EMuUxvR7m0TASFlg2QDBNCZlknK3mbqb8nit9cfe/nj0L7B5PAc Uslely+oCuZHhdWKmA2Os7RCeKNaWRwVZCfJf5jcWeEPqkPqY7ZUJyC2UTT1s+KzYPVB VbDLib8R1sdXoQpgLM8RIJ4LxIn48CZUDM71vr73T/SfQcTtOB/PruacClPjhNm7z8aD F+hjUFKeGBkQpZy2J5UV6TMrN0cCB4GnqL3Slx3IUu4+t3cWhMcbbLgJV3gpJ6fF4lk/ Gn0EgoM5UprvQeLgH9t4rs7MHvvd9RU69zUv4se7UCnRl69TyQtWs8YTp4qpqg65NjhY YyZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=zLkXQuw7YUw830KvZ6oxQ0/LeHrw3AB8oRtSzmPEwsw=; b=jvqP1nOpHS2HZO/N27WpXb9r/2Ga1j/rL0GDrUhqvsi2TUhyGBcWzO+/4ieMl9dFR5 ErvymRKDysiwJ1t2LAV7xhRJblqpTu8w0lv7GtVzJwlPfq2NY91iqhYDG/Lt3gjr2S6C p/OxhijTeDc1sTzF72ejH1Bjp7f5sxCxyPwfJgqVVZiELKboVp+YmE30qliS+/YuRRB3 1HGu0RbrnPTC53xD6NVNWJYBGd9fbS67PSWDtTkpGt6sBDDG+68JbWG5DC0reGxGRwY3 Niq3Rb3jxbXzsTPL3XgDVZgQXGNG6ouwhTDVRAiklKcwgQMdX3ez+z4KDuQi5LhiJXNH iJvg== X-Gm-Message-State: AFeK/H17Hhs0Q4Sm33wIVY95f1Cdjx3bChvs14XGPCec6HstlK6gbJgjQSUpJQ1KDQtPpPRyN2tKNgGoVc0mqA== X-Received: by 10.37.53.138 with SMTP id c132mr5597606yba.105.1490360470404; Fri, 24 Mar 2017 06:01:10 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Fri, 24 Mar 2017 06:00:29 -0700 (PDT) In-Reply-To: <7970606B-0096-475D-8842-2A14E5168413@dukhovni.org> References: <1490317199552.71745@cs.auckland.ac.nz> <52C6D0EF-D6AC-484A-9096-BDAE5C870F82@dukhovni.org> <7970606B-0096-475D-8842-2A14E5168413@dukhovni.org> From: Eric Rescorla Date: Fri, 24 Mar 2017 06:00:29 -0700 Message-ID: To: TLS WG Content-Type: multipart/alternative; boundary=001a114bbb326d1896054b799622 Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 13:01:17 -0000 --001a114bbb326d1896054b799622 Content-Type: text/plain; charset=UTF-8 On Thu, Mar 23, 2017 at 10:23 PM, Viktor Dukhovni wrote: > > > On Mar 24, 2017, at 1:08 AM, Martin Thomson > wrote: > > > >> I've never seen > >> a TLS server that has multiple chains to choose from for the same > >> server identity. > > Both chains of course use SHA256. > I am too lazy to check if it's still true but at least for a while https://www.mozilla.org/ had both a SHA-1 and a SHA-256 certificate so that we could serve Firefox to people on very downrev browsers (e.g., XP). -Ekr > Sorry I meant to say multiple digest algorithms for otherwise > identical chains (same public key algorithm and server name). > > Even in the SMTP space some servers have both RSA and ECDSA certs. > When that's the case, cipher negotiation ensures that the selected > EE certificate's public key algorithm is mutually supported. > > There's still little need to pay attention to the client's signature > algorithms in choosing the EE-certificate and associated chain. > > -- > -- > Viktor. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --001a114bbb326d1896054b799622 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Thu, Mar 23, 2017 at 10:23 PM, Viktor Dukhovni <= ;ietf-dane@dukh= ovni.org> wrote:

> On Mar 24, 2017, at 1:08 AM, Martin Thomson <martin.thomson@gmail.com> wrote:
>
>> I've never seen
>> a TLS server that has multiple chains to choose from for the same<= br> >> server identity.

Both chains of course use SHA256.

I am too lazy to check if it's still true but at least for a while https://www.mozilla.org/
h= ad both a SHA-1 and a SHA-256 certificate so that we could serve Firefox to=
people on very downrev browsers (e.g., XP).

=
-Ekr


Sorry I meant to say multiple digest algorithms for otherwise
identical chains (same public key algorithm and server name).

Even in the SMTP space some servers have both RSA and ECDSA certs.
When that's the case, cipher negotiation ensures that the selected
EE certificate's public key algorithm is mutually supported.

There's still little need to pay attention to the client's signatur= e
algorithms in choosing the EE-certificate and associated chain.

--
--
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Viktor.

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--001a114bbb326d1896054b799622-- From nobody Fri Mar 24 06:27:10 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FE4612988C for ; Fri, 24 Mar 2017 06:27:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.42 X-Spam-Level: X-Spam-Status: No, score=-1.42 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_SPAM=0.5] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mGvGCfJt_miD for ; Fri, 24 Mar 2017 06:27:07 -0700 (PDT) Received: from mx496502.smtp-engine.com (mx496502.smtp-engine.com [217.160.92.157]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 160E212951A for ; Fri, 24 Mar 2017 06:27:07 -0700 (PDT) Received: from mail-io0-f174.google.com (mail-io0-f174.google.com [209.85.223.174]) by mx496502.smtp-engine.com (Postfix) with ESMTPSA id 1EBEF64F for ; Fri, 24 Mar 2017 13:27:03 +0000 (GMT) Received: by mail-io0-f174.google.com with SMTP id l7so1582397ioe.3 for ; Fri, 24 Mar 2017 06:27:03 -0700 (PDT) X-Gm-Message-State: AFeK/H3VptZqJYQACUlIPVycVRc5tkNaJ0vCMksOc1exo2Lqxpe/K95tascbmegG9zaGuus7B+s4Os7OV8Swcg== X-Received: by 10.107.31.11 with SMTP id f11mr9381148iof.183.1490362022391; Fri, 24 Mar 2017 06:27:02 -0700 (PDT) MIME-Version: 1.0 Received: by 10.79.29.66 with HTTP; Fri, 24 Mar 2017 06:27:02 -0700 (PDT) From: Matt Caswell Date: Fri, 24 Mar 2017 13:27:02 +0000 X-Gmail-Original-Message-ID: Message-ID: To: "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: [TLS] ClientFinished calculation following EndOfEarlyData in draft-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 13:27:08 -0000 In draft-19 EndOfEarlyData was changed from an alert to a handshake message. Therefore I would have expected to see it included in the calculation of the ClientFinished (where early data is accepted). However section 4.4.4 defines the verify_data as follows: verify_data = HMAC(finished_key, Transcript-Hash(Handshake Context, Certificate*, CertificateVerify*)) The Handshake Context is given as ClientHello...ServerFinished. Was the EndOfEarlyData deliberately omitted from the ClientFinished calculcation? Or is this just a typo in section 4.4.4, i.e. should it say: verify_data = HMAC(finished_key, Transcript-Hash(Handshake Context, EndOfEarlyData*, Certificate*, CertificateVerify*)) I am currently looking into an interop failure between the OpenSSL and Haskell draft-19 implementations due to this. Thanks Matt From nobody Fri Mar 24 06:32:15 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 56857129AFE for ; Fri, 24 Mar 2017 06:32:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ws3iy-ZQbxAH for ; Fri, 24 Mar 2017 06:32:12 -0700 (PDT) Received: from mail-pf0-x236.google.com (mail-pf0-x236.google.com [IPv6:2607:f8b0:400e:c00::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E16C1296E0 for ; Fri, 24 Mar 2017 06:32:06 -0700 (PDT) Received: by mail-pf0-x236.google.com with SMTP id o190so1122126pfo.0 for ; Fri, 24 Mar 2017 06:32:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=p0o+S+J2qv/g5rCMFTheDaTtCPxEvm+d9Tm9NqZ6Sm4=; b=nMPQuCm4ipP/SV2MX61k8PH8rHAAdz5WWohrpjA92Zlo6748Z6DlV/lZ5P4Ra1h1i5 +DYwYeq2wGyBz6VS9QtzFu8IYlOH03C1HQVpwncbX2Vd1Jku/xFy0i6OaHFsHAJosepq tyw5Rfjf6FS8x9R/WsoCZIa5+9uj5pPl4Qb9s= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=p0o+S+J2qv/g5rCMFTheDaTtCPxEvm+d9Tm9NqZ6Sm4=; b=rvycF340M2B6cUEQ1oWRFpjnlqY4ZJ/wV79W9ujIsDKI8Tbl3O/2OEBjnHY69pL4qv 6dG2deQn3F9Ay9Nn7vrfK183mU2DdP88XGPUL4/7BRPgJqrwHAIMy0d/tOLs0Dq8XVac BFCylvRffo5PaMWnSK3tB9JkEGbbcpnr2kSGNSzi+wFhEQNY9/2TKRl3eaKDra67W2YF GSQI0IOGP37p5+1vxNUJ7FXo8tul+tHI/lzFG0ua8Jfwf64N5eIwKSvI0j4CWk+B1ViT CjxyDgasyawftqzsURPjvS7IHrKLZY+2kyjMx9+rVm3tv45+QiY2Cy3cSRmGa6YyXFHY av2w== X-Gm-Message-State: AFeK/H26cmCsjyhbby1sDxoYYea9Xp6d9zcvkgZC+U/t6yBgY+eu6sliuXy9Z0KI0gVLwh7L43Gkgyo5W6XN98qV X-Received: by 10.84.254.8 with SMTP id b8mr11121339plm.76.1490362325540; Fri, 24 Mar 2017 06:32:05 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: David Benjamin Date: Fri, 24 Mar 2017 13:31:53 +0000 Message-ID: To: Matt Caswell , "tls@ietf.org" Content-Type: multipart/alternative; boundary=089e08e4c4210066ae054b7a05fd Archived-At: Subject: Re: [TLS] ClientFinished calculation following EndOfEarlyData in draft-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 13:32:14 -0000 --089e08e4c4210066ae054b7a05fd Content-Type: text/plain; charset=UTF-8 I think it's a typo. My understanding is EndOfEarlyData was meant to be in the transcript. David On Fri, Mar 24, 2017 at 9:27 AM Matt Caswell wrote: > In draft-19 EndOfEarlyData was changed from an alert to a handshake > message. Therefore I would have expected to see it included in the > calculation of the ClientFinished (where early data is accepted). > However section 4.4.4 defines the verify_data as follows: > > verify_data = > HMAC(finished_key, > Transcript-Hash(Handshake Context, > Certificate*, CertificateVerify*)) > > The Handshake Context is given as ClientHello...ServerFinished. > > Was the EndOfEarlyData deliberately omitted from the ClientFinished > calculcation? Or is this just a typo in section 4.4.4, i.e. should it > say: > > verify_data = > HMAC(finished_key, > Transcript-Hash(Handshake Context, > EndOfEarlyData*, Certificate*, > CertificateVerify*)) > > I am currently looking into an interop failure between the OpenSSL and > Haskell draft-19 implementations due to this. > > Thanks > > Matt > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --089e08e4c4210066ae054b7a05fd Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I think it's a typo. My understanding is EndOfEarlyDat= a was meant to be in the transcript.

David

On Fri, Mar 24, 2017 at 9:27 AM Matt = Caswell <frodo@baggins.org> = wrote:
In draft-19 EndOfEarlyData w= as changed from an alert to a handshake
message. Therefore I would have expected to see it included in the
calculation of the ClientFinished (where early data is accepted).
However section 4.4.4 defines the verify_data as follows:

=C2=A0 =C2=A0 =C2=A0 verify_data =3D
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 HMAC(finished_key,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Transcript-Hash(Hand= shake Context,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Certificate*, CertificateVerify*))
The Handshake Context is given as ClientHello...ServerFinished.

Was the EndOfEarlyData deliberately omitted from the ClientFinished
calculcation? Or is this just a typo in section 4.4.4, i.e. should it
say:

=C2=A0 =C2=A0 =C2=A0 verify_data =3D
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 HMAC(finished_key,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Transcript-Hash(Hand= shake Context,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0EndOfEarlyData*, Certificate*,
CertificateVerify*))

I am currently looking into an interop failure between the OpenSSL and
Haskell draft-19 implementations due to this.

Thanks

Matt

_______________________________________________
TLS mailing list
TLS@i= etf.org
https://www.ietf.org/mailman/listinfo/t= ls
--089e08e4c4210066ae054b7a05fd-- From nobody Fri Mar 24 06:33:25 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF784129A16 for ; Fri, 24 Mar 2017 06:33:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ANqHokbleX_a for ; Fri, 24 Mar 2017 06:33:22 -0700 (PDT) Received: from mail-yw0-x22b.google.com (mail-yw0-x22b.google.com [IPv6:2607:f8b0:4002:c05::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B3334129AFE for ; Fri, 24 Mar 2017 06:33:21 -0700 (PDT) Received: by mail-yw0-x22b.google.com with SMTP id v76so1921250ywg.0 for ; Fri, 24 Mar 2017 06:33:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=oMG8iFodKu9bYda+f/YLeWiPJgeEVqdy+5sOqbuqXVc=; b=PxK4Jd5GHGz0nEOirCSd/zXZA8MNh9GfEvywR5emeLxPe3QpIU10QWHtgO08Qy8XQy ngsgRnW0dY4FOQqFVtBPz10RNH3wsRbgBf5isY4/7SnGgRdNqokJ+XGhPCq9U3zPXbD/ 2RBxBvj+kMpjtmSMnqtYPB54u+2VlVLuqfu9WhM4Lx0R7SPGwI4nzhkRZQE6a3IHsVA0 aEF4OtxjnHwngA7My4HGrcS9A4smawDO2RUGYqUPaDbElb3MSRbwlTybwurj91vGnGeI rL9YBaL1IEBTb218OVjEX1g4yT4EJQaYsD7sl2IuAL7AuLKPF0GylmDdIcy7cDZonu11 RvWw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=oMG8iFodKu9bYda+f/YLeWiPJgeEVqdy+5sOqbuqXVc=; b=OncCl5xvk2KdDNPF8L1sFhYXROdcdYbRq0q7uayiH6W2V4mxbaf2UI3JPY/hmsP0TN 9/U4UZTV3guWLi0+6RZ1KTnlYels3hPuS9sXJA3WMWJ8RKbD4c1/o4vjRtJkDvxWbo/0 y6TFIwLso71XAkwy2JYmQZnbkUT7FjBAflW0cnYGfdVxz6fhmnD4C2cWIkSYPNl/ezBI T8R++IRoVVamQBgFYXaXTtWuDsYxY46c8VvfZMoUz+3bpDxincZ/NJuWic5ehy+aqq4l yqAHnMi9dAkjPPvLSWzN/6KjugV3BqP4cqruaRM9m8sRE2oZaLT1CwKmCZgNPY0w4mqu XOjw== X-Gm-Message-State: AFeK/H2VKkdC7Vnjmsce1MC8lIXX1iX904/EHRusVplH+nBJ2ZiqmPAbAKxjHHgt34igl+6CgUhulOl58XRmuQ== X-Received: by 10.37.201.196 with SMTP id z187mr6006748ybf.161.1490362400966; Fri, 24 Mar 2017 06:33:20 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Fri, 24 Mar 2017 06:32:40 -0700 (PDT) In-Reply-To: References: From: Eric Rescorla Date: Fri, 24 Mar 2017 06:32:40 -0700 Message-ID: To: Matt Caswell Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a114d88ea7f375b054b7a0904 Archived-At: Subject: Re: [TLS] ClientFinished calculation following EndOfEarlyData in draft-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 13:33:24 -0000 --001a114d88ea7f375b054b7a0904 Content-Type: text/plain; charset=UTF-8 On Fri, Mar 24, 2017 at 6:27 AM, Matt Caswell wrote: > In draft-19 EndOfEarlyData was changed from an alert to a handshake > message. Therefore I would have expected to see it included in the > calculation of the ClientFinished (where early data is accepted). > However section 4.4.4 defines the verify_data as follows: > > verify_data = > HMAC(finished_key, > Transcript-Hash(Handshake Context, > Certificate*, CertificateVerify*)) > > The Handshake Context is given as ClientHello...ServerFinished. > > Was the EndOfEarlyData deliberately omitted from the ClientFinished > calculcation? Or is this just a typo in section 4.4.4, i.e. should it > say: > > verify_data = > HMAC(finished_key, > Transcript-Hash(Handshake Context, > EndOfEarlyData*, Certificate*, > CertificateVerify*)) > > I am currently looking into an interop failure between the OpenSSL and > Haskell draft-19 implementations due to this. > Thanks for catching this. It's a failure to update the draft completely when we made it a handshake message. Note that this contradicts S 7.1. which lists it as the input to Derive-Secret. I think I'll just move that graf to the Transcript-Hash section. https://tlswg.github.io/tls13-spec/#rfc.section.7.1 -Ekr > > Thanks > > Matt > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --001a114d88ea7f375b054b7a0904 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Fri, Mar 24, 2017 at 6:27 AM, Matt Caswell <frodo@baggins.org&g= t; wrote:
In dr= aft-19 EndOfEarlyData was changed from an alert to a handshake
message. Therefore I would have expected to see it included in the
calculation of the ClientFinished (where early data is accepted).
However section 4.4.4 defines the verify_data as follows:

=C2=A0 =C2=A0 =C2=A0 verify_data =3D
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 HMAC(finished_key,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Transcript-Hash(Hand= shake Context,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Certificate*, CertificateVerify*))
The Handshake Context is given as ClientHello...ServerFinished.

Was the EndOfEarlyData deliberately omitted from the ClientFinished
calculcation? Or is this just a typo in section 4.4.4, i.e. should it
say:

=C2=A0 =C2=A0 =C2=A0 verify_data =3D
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 HMAC(finished_key,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Transcript-Hash(Hand= shake Context,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0EndOfEarlyData*, Certificate*,
CertificateVerify*))

I am currently looking into an interop failure between the OpenSSL and
Haskell draft-19 implementations due to this.

Thanks for catching this. It's a failure to update the draft com= pletely when
we made it a handshake message. Note that this contr= adicts S 7.1.
which lists it as the input to Derive-Secret. I thi= nk I'll just move that
graf to the Transcript-Hash section.

https://tlswg.github.io/tls13-spec/#rfc.section.7.1

-Ekr
=C2=A0

Thanks

Matt

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--001a114d88ea7f375b054b7a0904-- From nobody Fri Mar 24 06:38:39 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6F9D1204DA for ; Fri, 24 Mar 2017 06:38:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AoJtdzOwTTDM for ; Fri, 24 Mar 2017 06:38:36 -0700 (PDT) Received: from mail-yw0-x236.google.com (mail-yw0-x236.google.com [IPv6:2607:f8b0:4002:c05::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D585E1296CF for ; Fri, 24 Mar 2017 06:38:35 -0700 (PDT) Received: by mail-yw0-x236.google.com with SMTP id i203so1937898ywc.3 for ; Fri, 24 Mar 2017 06:38:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=pjkKYFvwczJ5uRJu1Wm3c5RbQ12SzcdLCO3N0p8pyEQ=; b=W1VZu2wHbk7CVZoIYQkhungS0GoiScgfCkJ+UrujEc+C2k26FgLoznfNLO/+u/7IHQ St1vqs4ttVAqfBBtDNbJuPQrSjygb2a2dxIDbFH8vabhcaXqWBiVMX4DejtxEeB8uxhu FQxBZayX8IdM1ZWfZwQRiWGQ9ziT4tQH0bTzoc6AO2EhHrd57iHSHxQJ634wmdRSpKDv RTzmL+lFws+RDN+bglMTGaFVC2clNn+iDK7GOVz4WWYdYfBDFuPBeOHCaFpqla/mjQm+ 3nu/APcXB75XsQj/Q5evf0ZUY3dGM7mA9xB9FqGgqM1XudkMrYuXbbwe5MMLUa+JbgdD IXEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=pjkKYFvwczJ5uRJu1Wm3c5RbQ12SzcdLCO3N0p8pyEQ=; b=HdFzqtdmnI77XWxSpXOYJevy8170/PVWudSbwIHNIb3EmySYgOdpHP9e3v/SJsimft kmwV2pTDcAJUfQ5kpmd8ZpHIJ8rokK04MHJ8DVKlQeOVihZ2DLkQrfvlQnGmji9YUe6Z 6/truv06FaREQDRk8g1LNk0mmBmUtCk0QEbRIfhhKsb3iA76lR3xp2DsvDmFZV/s+WYI h0YXvxG7VttvsWSA46yUZ5sahBHBTz3bU3AhQVVLwBK7PyLH4WubqgVRCsDYansEdFak rDdq7nBKUuNMOA0Vg7Nz8pPljPs9AP0ApSiCFv3fqoEbZ+zyDPJX0KkSoax+rBlsdVmU 47PQ== X-Gm-Message-State: AFeK/H1p+mxtcIVDEC0CMNG2ryd9SeEAFofVS9F5PsJ30TjyT+vDeXNQONVa0V7MUSIkkszTZxrK9EKyh33PXQ== X-Received: by 10.129.108.214 with SMTP id h205mr5914868ywc.71.1490362715167; Fri, 24 Mar 2017 06:38:35 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Fri, 24 Mar 2017 06:37:54 -0700 (PDT) In-Reply-To: References: From: Eric Rescorla Date: Fri, 24 Mar 2017 06:37:54 -0700 Message-ID: To: Matt Caswell Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a114e81dc39bb2d054b7a1cdf Archived-At: Subject: Re: [TLS] ClientFinished calculation following EndOfEarlyData in draft-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 13:38:38 -0000 --001a114e81dc39bb2d054b7a1cdf Content-Type: text/plain; charset=UTF-8 https://github.com/tlswg/tls13-spec/pull/912 On Fri, Mar 24, 2017 at 6:32 AM, Eric Rescorla wrote: > > > On Fri, Mar 24, 2017 at 6:27 AM, Matt Caswell wrote: > >> In draft-19 EndOfEarlyData was changed from an alert to a handshake >> message. Therefore I would have expected to see it included in the >> calculation of the ClientFinished (where early data is accepted). >> However section 4.4.4 defines the verify_data as follows: >> >> verify_data = >> HMAC(finished_key, >> Transcript-Hash(Handshake Context, >> Certificate*, CertificateVerify*)) >> >> The Handshake Context is given as ClientHello...ServerFinished. >> >> Was the EndOfEarlyData deliberately omitted from the ClientFinished >> calculcation? Or is this just a typo in section 4.4.4, i.e. should it >> say: >> >> verify_data = >> HMAC(finished_key, >> Transcript-Hash(Handshake Context, >> EndOfEarlyData*, Certificate*, >> CertificateVerify*)) >> >> I am currently looking into an interop failure between the OpenSSL and >> Haskell draft-19 implementations due to this. >> > > Thanks for catching this. It's a failure to update the draft completely > when > we made it a handshake message. Note that this contradicts S 7.1. > which lists it as the input to Derive-Secret. I think I'll just move that > graf to the Transcript-Hash section. > > https://tlswg.github.io/tls13-spec/#rfc.section.7.1 > > -Ekr > > >> >> Thanks >> >> Matt >> >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls >> > > --001a114e81dc39bb2d054b7a1cdf Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

On Fri, Mar 24, 2017 at 6:32 AM, Er= ic Rescorla <ekr@rtfm.com> wrote:


On Fri, Mar 24, 2017 at 6:27 AM, Matt Caswell <fro= do@baggins.org> wrote:
In draft-19 EndOfEarlyData was changed from an alert to a ha= ndshake
message. Therefore I would have expected to see it included in the
calculation of the ClientFinished (where early data is accepted).
However section 4.4.4 defines the verify_data as follows:

=C2=A0 =C2=A0 =C2=A0 verify_data =3D
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 HMAC(finished_key,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Transcript-Hash(Hand= shake Context,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Certificate*, CertificateVerify*))
The Handshake Context is given as ClientHello...ServerFinished.

Was the EndOfEarlyData deliberately omitted from the ClientFinished
calculcation? Or is this just a typo in section 4.4.4, i.e. should it
say:

=C2=A0 =C2=A0 =C2=A0 verify_data =3D
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 HMAC(finished_key,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Transcript-Hash(Hand= shake Context,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0EndOfEarlyData*, Certificate*,
CertificateVerify*))

I am currently looking into an interop failure between the OpenSSL and
Haskell draft-19 implementations due to this.

Thanks for catching this. It's a failure to update the dr= aft completely when
we made it a handshake message. Note that thi= s contradicts S 7.1.
which lists it as the input to Derive-Secret= . I think I'll just move that
graf to the Transcript-Hash sec= tion.


-Ekr
=C2=A0

Thanks

Matt

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--001a114e81dc39bb2d054b7a1cdf-- From nobody Fri Mar 24 08:18:30 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5D89129BAB for ; Fri, 24 Mar 2017 08:18:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.921 X-Spam-Level: X-Spam-Status: No, score=-6.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id voL9I9ULILHq for ; Fri, 24 Mar 2017 08:18:26 -0700 (PDT) Received: from smtpde02.smtp.sap-ag.de (smtpde02.smtp.sap-ag.de [155.56.68.140]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 553A0131539 for ; Fri, 24 Mar 2017 08:18:21 -0700 (PDT) Received: from mail07.wdf.sap.corp (mail04.sap.corp [194.39.131.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtpde02.smtp.sap-ag.de (Postfix) with ESMTPS id 3vqRrX2kW9z26Vl for ; Fri, 24 Mar 2017 16:18:20 +0100 (CET) X-purgate-ID: 152705::1490368700-00003836-2824FF36/0/0 X-purgate-size: 2735 X-purgate: clean X-purgate: This mail is considered clean (visit http://www.eleven.de for further information) X-purgate-Ad: Categorized by eleven eXpurgate (R) http://www.eleven.de X-purgate-type: clean X-SAP-SPAM-Status: clean Received: from ld9781.wdf.sap.corp (ld9781.wdf.sap.corp [10.21.82.193]) by mail07.wdf.sap.corp (Postfix) with ESMTP id 3vqRrX0twhzGpB0 for ; Fri, 24 Mar 2017 16:18:20 +0100 (CET) Received: by ld9781.wdf.sap.corp (Postfix, from userid 10159) id 135531A65C; Fri, 24 Mar 2017 16:18:20 +0100 (CET) In-Reply-To: <52C6D0EF-D6AC-484A-9096-BDAE5C870F82@dukhovni.org> To: TLS WG Date: Fri, 24 Mar 2017 16:18:20 +0100 (CET) Reply-To: mrex@sap.com X-Mailer: ELM [version 2.4ME+ PL125 (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="US-ASCII" Message-Id: <20170324151820.135531A65C@ld9781.wdf.sap.corp> From: mrex@sap.com (Martin Rex) Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 15:18:29 -0000 Viktor Dukhovni wrote: > > The net effect is that in practice you simply ignore the signature > algorithms when it comes to the certificate chain. Essentially correct. This is the only reasonable, highly backwards compatible and perfectly secure choice. > > I've never seen a TLS server that has multiple chains to choose from > for the same server identity. This applies also to TLS 1.2, despite > RFC 5246. Servers with multiple chains for the same server identity have been around for a while, and their number might be higher than you expect. More often they choose cert by offered cipher suites (RSA vs. ECDSA), rather than by signature_algorithms. I have recently encountered three public CAs that issue such dual-certs, two of them either thought about potential consequences (or got it right by chance): VeriSign and DigiCert. * The RSA and ECDSA dual server certs from VeriSign were issued under the same (RSA) RootCA cert "VeriSign PCA3 - G5", * The RSA and ECDSA dual server certs from DigiCert were issued under the same (RSA) RootCA cert "DigiCert High Assurance EV Root CA" However, the RSA and ECDSA dual server certs from Comodo were issued under _distinct_ RootCAs. I don't know whether Comodo or the purchaser of the dual server certs goofed this, but unless you negligently dump an overbroad "blindly trust everyone" into your client-software in a web-browser fashion (which gives _everyone_ the creeps, see Certificate Transparency and HPKP bandaids), those Comodo-issued RSA+ECDSA dual server certs from distinct PKIs are a severe interop nightmare. If you want to roll out support for ECDSA cipher suites into an installed base of TLS that is currently limited to RSA, dual certs from distinct PKIs may result in servers unexpectedly picking and responding with an untrusted server cert in existing usage scenarios, after a software update of the TLS client (which adds support for ECDSA cipher suites). Two Cloudflare (CDN) examples for dual cert servers: Comodo: https://regmedia.co.uk/ DigiCert: https://www.cloudflare.com/ Actually, the latter seems to be a triple-cert server (try -sigalgs RSA+SHA1) Things could be so much easier if folks would spend a little more time thinking about backwards compatibility, i.e. what is necessary so that a new feature can be rolled out into an installed base of TLS client and servers, without causing interop failures for existing usage scenarios. TLSv1.3 has a few problems. Including the pointless hiding of ContentInfo in the outer TLS record, which is non-interoperable with some of the installed base and precludes efficient end-of-communication discovery. -Martin From nobody Fri Mar 24 08:40:38 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F111126CC7 for ; Fri, 24 Mar 2017 08:40:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.921 X-Spam-Level: X-Spam-Status: No, score=-6.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vVltbzP6slGM for ; Fri, 24 Mar 2017 08:40:36 -0700 (PDT) Received: from smtpde02.smtp.sap-ag.de (smtpde02.smtp.sap-ag.de [155.56.68.140]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E28A129BE9 for ; Fri, 24 Mar 2017 08:40:36 -0700 (PDT) Received: from mail07.wdf.sap.corp (mail04.sap.corp [194.39.131.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtpde02.smtp.sap-ag.de (Postfix) with ESMTPS id 3vqSLB4l1kz26Yp for ; Fri, 24 Mar 2017 16:40:34 +0100 (CET) X-purgate-ID: 152705::1490370034-00002B31-84774984/0/0 X-purgate-size: 1414 X-purgate: clean X-purgate: This mail is considered clean (visit http://www.eleven.de for further information) X-purgate-Ad: Categorized by eleven eXpurgate (R) http://www.eleven.de X-purgate-type: clean X-SAP-SPAM-Status: clean Received: from ld9781.wdf.sap.corp (ld9781.wdf.sap.corp [10.21.82.193]) by mail07.wdf.sap.corp (Postfix) with ESMTP id 3vqSLB48h3zGqBD for ; Fri, 24 Mar 2017 16:40:34 +0100 (CET) Received: by ld9781.wdf.sap.corp (Postfix, from userid 10159) id 834EF1A65C; Fri, 24 Mar 2017 16:40:34 +0100 (CET) In-Reply-To: <7970606B-0096-475D-8842-2A14E5168413@dukhovni.org> To: TLS WG Date: Fri, 24 Mar 2017 16:40:34 +0100 (CET) Reply-To: mrex@sap.com X-Mailer: ELM [version 2.4ME+ PL125 (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="US-ASCII" Message-Id: <20170324154034.834EF1A65C@ld9781.wdf.sap.corp> From: mrex@sap.com (Martin Rex) Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 15:40:38 -0000 Viktor Dukhovni wrote: > > > On Mar 24, 2017, at 1:08 AM, Martin Thomson wrote: > > > >> I've never seen > >> a TLS server that has multiple chains to choose from for the same > >> server identity. > [ https://www.cloudflare.com/ ] > > Both chains of course use SHA256. Actually, looking at the DigiCert issued ECC cert for www.cloudflare.com I'm a little confused. This is the cert chain (as visualized by Microsoft CryptoAPI): server-cert: CN=cloudflare.com, ... contains ECDSA P-256 public key is allegedly signed with sha256ECDSA intermediate CA: CN=DigiCert ECC Extended Validation Server CA contains ECDSA P-384 public key is allegedly signed with sha384RSA root CA: CN=DigiCert High Assurance EV Root CA contains RSA 2048-bit public key is self-signed with sha1WithRsaEncryption For those who insist on reading rfc5246 verbatim, this chain requires ECDSA+SHA384:RSA+SHA384:RSA+SHA1 The digital signature on the server certificate looks bogus to me, that should be a sha384ECDSA signature according to NIST, because it uses a P-384 signing key. The signature on the intermediate CA is imbalanced, and should be sha256RSA rather than sha384RSA. (that is only an interop issue, not a security issue). -Martin From nobody Fri Mar 24 08:44:45 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F392C1296C9 for ; Fri, 24 Mar 2017 08:44:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.911 X-Spam-Level: X-Spam-Status: No, score=-6.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, T_PDS_TO_EQ_FROM_NAME=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y2nOcs1doo9K for ; Fri, 24 Mar 2017 08:44:42 -0700 (PDT) Received: from smtpde02.smtp.sap-ag.de (smtpde02.smtp.sap-ag.de [155.56.68.140]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 505CE126CC7 for ; Fri, 24 Mar 2017 08:44:42 -0700 (PDT) Received: from mail07.wdf.sap.corp (mail04.sap.corp [194.39.131.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtpde02.smtp.sap-ag.de (Postfix) with ESMTPS id 3vqSQw6Bd3z260F for ; Fri, 24 Mar 2017 16:44:40 +0100 (CET) X-purgate-ID: 152705::1490370280-0000521C-21D99167/0/0 X-purgate-size: 1220 X-purgate: clean X-purgate: This mail is considered clean (visit http://www.eleven.de for further information) X-purgate-Ad: Categorized by eleven eXpurgate (R) http://www.eleven.de X-purgate-type: clean X-SAP-SPAM-Status: clean Received: from ld9781.wdf.sap.corp (ld9781.wdf.sap.corp [10.21.82.193]) by mail07.wdf.sap.corp (Postfix) with ESMTP id 3vqSQw5fkjzGpB0; Fri, 24 Mar 2017 16:44:40 +0100 (CET) Received: by ld9781.wdf.sap.corp (Postfix, from userid 10159) id B68281A65C; Fri, 24 Mar 2017 16:44:40 +0100 (CET) In-Reply-To: <20170324154034.834EF1A65C@ld9781.wdf.sap.corp> To: mrex@sap.com Date: Fri, 24 Mar 2017 16:44:40 +0100 (CET) CC: TLS WG Reply-To: mrex@sap.com X-Mailer: ELM [version 2.4ME+ PL125 (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="US-ASCII" Message-Id: <20170324154440.B68281A65C@ld9781.wdf.sap.corp> From: mrex@sap.com (Martin Rex) Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 15:44:44 -0000 oops, typo: Martin Rex wrote: > > Actually, looking at the DigiCert issued ECC cert for www.cloudflare.com > I'm a little confused. > > This is the cert chain (as visualized by Microsoft CryptoAPI): > > server-cert: CN=cloudflare.com, ... > contains ECDSA P-256 public key > is allegedly signed with sha256ECDSA > > intermediate CA: CN=DigiCert ECC Extended Validation Server CA > contains ECDSA P-384 public key > is allegedly signed with sha384RSA > > root CA: CN=DigiCert High Assurance EV Root CA > contains RSA 2048-bit public key > is self-signed with sha1WithRsaEncryption > > For those who insist on reading rfc5246 verbatim, this chain requires > > ECDSA+SHA384:RSA+SHA384:RSA+SHA1 ECDSA+SHA256:RSA+SHA384:RSA+SHA1 > > The digital signature on the server certificate looks bogus to me, > that should be a sha384ECDSA signature according to NIST, because > it uses a P-384 signing key. > > The signature on the intermediate CA is imbalanced, and > should be sha256RSA rather than sha384RSA. (that is only an interop issue, > not a security issue). From nobody Fri Mar 24 09:16:57 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 93FD71270FC for ; Fri, 24 Mar 2017 09:16:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pVlMKexhWO1k for ; Fri, 24 Mar 2017 09:16:53 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 932531297AB for ; Fri, 24 Mar 2017 09:16:53 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 6BA523004CC for ; Fri, 24 Mar 2017 12:16:50 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id Nl0vP0wVfX0R for ; Fri, 24 Mar 2017 12:16:49 -0400 (EDT) Received: from [172.26.11.44] (unknown [104.129.194.81]) by mail.smeinc.net (Postfix) with ESMTPSA id E961D300261; Fri, 24 Mar 2017 12:16:48 -0400 (EDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\)) From: Russ Housley In-Reply-To: Date: Fri, 24 Mar 2017 12:16:48 -0400 Cc: IETF TLS Content-Transfer-Encoding: quoted-printable Message-Id: <141723AB-B4E4-4233-8C35-C720E4A7FE0C@vigilsec.com> References: <0DA64421-5975-4B7E-BC08-7428AFA9D1A1@vigilsec.com> <9D8BEE12-49F9-4DE3-81C7-909CB114805F@vigilsec.com> <1b678d65-b146-b25f-c1ad-6dfc044f7ce0@akamai.com> <733EE968-69EF-43A5-A39B-F016993A3CCD@vigilsec.com> <949EBD4E-613B-4B36-BD93-FDE3E4D4926F@vigilsec.com> To: Eric Rescorla X-Mailer: Apple Mail (2.3259) Archived-At: Subject: Re: [TLS] Using both External PSK and (EC)DH in TLS 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 16:16:56 -0000 > I agree with David here. Specifically, I think. >=20 > - The base specification should continue to forbid certificates in = combination with PSK > - We should at some point contemplate an extension that allows the use = of certificates in combination with PSK > - The base spec should be factored in such a way as to make that = extension easy. While I agree that we do not want to delay the TLS 1.3 specification to = sort this out; however, I do not think we have provided the hook to make = this future extension easy. Looking at the key schedule in -19, I = think we can provide the hook without being disruptive. My goal is to = minimize the pain to implementing the extension in the future by putting = a straightforward hook in today: 0 | v PSK -> HKDF-Extract =3D Early Secret | +-----> Derive-Secret(., | "external psk binder key" | | "resumption psk binder key", | "") | =3D binder_key | +-----> Derive-Secret(., "client early traffic secret", | ClientHello) | =3D client_early_traffic_secret | +-----> Derive-Secret(., "early exporter master = secret", | ClientHello) | =3D early_exporter_secret v Derive-Secret(., "derived secret", "") | v (EC)DHE -> HKDF-Extract =3D Handshake Secret | +-----> Derive-Secret(., "client handshake traffic = secret", | ClientHello...ServerHello) | =3D = client_handshake_traffic_secret | +-----> Derive-Secret(., "server handshake traffic = secret", | ClientHello...ServerHello) | =3D = server_handshake_traffic_secret v Derive-Secret(., "derived secret", "") | v ExtPSK OR 0 -> HKDF-Extract =3D Master Secret | +-----> Derive-Secret(., "client application traffic = secret", | ClientHello...Server Finished) | =3D client_traffic_secret_0 | +-----> Derive-Secret(., "server application traffic = secret", | ClientHello...Server Finished) | =3D server_traffic_secret_0 | +-----> Derive-Secret(., "exporter master secret", | ClientHello...Server Finished) | =3D exporter_secret | +-----> Derive-Secret(., "resumption master secret", ClientHello...Client Finished) =3D resumption_master_secret The only change is "ExtPSK OR 0=E2=80=9D in the HKDF-Extract for the = Master Secret computation. The Section 4.1.1 can call out this place for the future specification: OLD: - When authenticating via a certificate, the server will send the Certificate (Section 4.4.2) and CertificateVerify (Section 4.4.3) messages. In TLS 1.3 as defined by this document, either a PSK or a certificate is always used, but not both. Future documents may define how to use them together. NEW: - When authenticating via a certificate, the server will send the Certificate (Section 4.4.2) and CertificateVerify (Section 4.4.3) messages. In TLS 1.3 as defined by this document, either a PSK or a certificate is always used, but not both. So, the ExtPSK is not used in the key schedule (Section 7.1). Future documents may define how to use them together and tell how the ExtPSK is handled in the key schedule. Russ From nobody Fri Mar 24 09:31:28 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 03A2F1297E9 for ; Fri, 24 Mar 2017 09:31:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.695 X-Spam-Level: X-Spam-Status: No, score=-4.695 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-2.796] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WlO2qTqy7-3N for ; Fri, 24 Mar 2017 09:31:25 -0700 (PDT) Received: from homiemail-a89.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BDBB61294CF for ; Fri, 24 Mar 2017 09:31:25 -0700 (PDT) Received: from homiemail-a89.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a89.g.dreamhost.com (Postfix) with ESMTP id 43732C00271F for ; Fri, 24 Mar 2017 09:31:25 -0700 (PDT) Received: from mail-lf0-f46.google.com (mail-lf0-f46.google.com [209.85.215.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: ryan@sleevi.com) by homiemail-a89.g.dreamhost.com (Postfix) with ESMTPSA id 0A7FAC00271C for ; Fri, 24 Mar 2017 09:31:25 -0700 (PDT) Received: by mail-lf0-f46.google.com with SMTP id j90so3240930lfk.2 for ; Fri, 24 Mar 2017 09:31:24 -0700 (PDT) X-Gm-Message-State: AFeK/H3vKmmquarQMPol3KOltZgZlWjBHR0hYr+dtX2VOBDT5GqgJygfGw59yC9DpZm9pHSKtlMtu0Kk8u1jOA== X-Received: by 10.25.157.65 with SMTP id g62mr5079441lfe.29.1490373083114; Fri, 24 Mar 2017 09:31:23 -0700 (PDT) MIME-Version: 1.0 Received: by 10.25.193.197 with HTTP; Fri, 24 Mar 2017 09:31:22 -0700 (PDT) In-Reply-To: <7970606B-0096-475D-8842-2A14E5168413@dukhovni.org> References: <1490317199552.71745@cs.auckland.ac.nz> <52C6D0EF-D6AC-484A-9096-BDAE5C870F82@dukhovni.org> <7970606B-0096-475D-8842-2A14E5168413@dukhovni.org> From: Ryan Sleevi Date: Fri, 24 Mar 2017 12:31:22 -0400 X-Gmail-Original-Message-ID: Message-ID: To: TLS WG Content-Type: multipart/alternative; boundary=001a11411ca233d001054b7c8650 Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 16:31:28 -0000 --001a11411ca233d001054b7c8650 Content-Type: text/plain; charset=UTF-8 On Fri, Mar 24, 2017 at 1:23 AM, Viktor Dukhovni wrote: > > > On Mar 24, 2017, at 1:08 AM, Martin Thomson > wrote: > > > >> I've never seen > >> a TLS server that has multiple chains to choose from for the same > >> server identity. > > Both chains of course use SHA256. > > Sorry I meant to say multiple digest algorithms for otherwise > identical chains (same public key algorithm and server name). > > Even in the SMTP space some servers have both RSA and ECDSA certs. > When that's the case, cipher negotiation ensures that the selected > EE certificate's public key algorithm is mutually supported. > > There's still little need to pay attention to the client's signature > algorithms in choosing the EE-certificate and associated chain. > Cloudflare does with the SHA-1 and SHA-256 support ( https://blog.cloudflare.com/sha-1-deprecation-no-browser-left-behind/ ) Google has a certificate chain that supports only SHA-256 (if you trust GeoTrust) or which supports SHA-256 and SHA-1 (if you only trust Equifax, and require the cross-sign). For example, OpenSSL without the ALT_CHAINS fix of 1.0.2 would prefer the Equifax path over the GeoTrust path. There are plenty of large CAs with complex cross-signs that introduce additional digest algorithms at the intermediate level, and the server can influence that path validation by using the signature algorithms (although few do). I would say that the vast majority of servers deployed on the Internet using commonly publicly trusted CAs have more than one chain to choose from - often dependent on the installed trust anchors - but the servers may simply not be aware of it, and relying on clients to do the needful (for example, with AIA fetching). The delta of sites that don't work in Firefox (when SHA-1 is disabled) compared to Chrome (when SHA-1 is disabled) illustrate this - as Chrome performs the AIA fetching to find the alternative SHA-256 paths, while Firefox does not, and requires the server supply them. Similarly, a given server may have paths where the leaf uses SHA-256, but intermediates use either SHA-256 or SHA-384 dependent upon the trust anchor it is rooted in. --001a11411ca233d001054b7c8650 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Fri, Mar 24, 2017 at 1:23 AM, Viktor Dukhovni <= ietf-dane@dukho= vni.org> wrote:

> On Mar 24, 2017, at 1:08 AM, Martin Thomson <martin.thomson@gmail.com> wrote:
>
>> I've never seen
>> a TLS server that has multiple chains to choose from for the same<= br> >> server identity.

Both chains of course use SHA256.

Sorry I meant to say multiple digest algorithms for otherwise
identical chains (same public key algorithm and server name).

Even in the SMTP space some servers have both RSA and ECDSA certs.
When that's the case, cipher negotiation ensures that the selected
EE certificate's public key algorithm is mutually supported.

There's still little need to pay attention to the client's signatur= e
algorithms in choosing the EE-certificate and associated chain.

Cloudflare does with the SHA-1 and SHA-256 support= (=C2=A0https://blog.cloudflare.com/sha-1-deprecation-no-browser-lef= t-behind/ )

Google has a certificate chain tha= t supports only SHA-256 (if you trust GeoTrust) or which supports SHA-256 a= nd SHA-1 (if you only trust Equifax, and require the cross-sign). For examp= le, OpenSSL without the ALT_CHAINS fix of 1.0.2 would prefer the Equifax pa= th over the GeoTrust path.

There are plenty of lar= ge CAs with complex cross-signs that introduce additional digest algorithms= at the intermediate level, and the server can influence that path validati= on by using the signature algorithms (although few do).

I would say that the vast majority of servers deployed on the Interne= t using commonly publicly trusted CAs have more than one chain to choose fr= om - often dependent on the installed trust anchors - but the servers may s= imply not be aware of it, and relying on clients to do the needful (for exa= mple, with AIA fetching). The delta of sites that don't work in Firefox= (when SHA-1 is disabled) compared to Chrome (when SHA-1 is disabled) illus= trate this - as Chrome performs the AIA fetching to find the alternative SH= A-256 paths, while Firefox does not, and requires the server supply them.

Similarly, a given server may have paths where the = leaf uses SHA-256, but intermediates use either SHA-256 or SHA-384 dependen= t upon the trust anchor it is rooted in.
--001a11411ca233d001054b7c8650-- From nobody Fri Mar 24 10:10:51 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C333D127337 for ; Fri, 24 Mar 2017 10:10:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.921 X-Spam-Level: X-Spam-Status: No, score=-6.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0x2I7bTlGrNh for ; Fri, 24 Mar 2017 10:10:48 -0700 (PDT) Received: from smtpde02.smtp.sap-ag.de (smtpde02.smtp.sap-ag.de [155.56.68.140]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3ECC212948E for ; Fri, 24 Mar 2017 10:10:48 -0700 (PDT) Received: from mail07.wdf.sap.corp (mail04.sap.corp [194.39.131.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtpde02.smtp.sap-ag.de (Postfix) with ESMTPS id 3vqVLG2sWxz26QL; Fri, 24 Mar 2017 18:10:46 +0100 (CET) X-purgate-ID: 152705::1490375446-0000521C-E36329D6/0/0 X-purgate-size: 1814 X-purgate: clean X-purgate: This mail is considered clean (visit http://www.eleven.de for further information) X-purgate-Ad: Categorized by eleven eXpurgate (R) http://www.eleven.de X-purgate-type: clean X-SAP-SPAM-Status: clean Received: from ld9781.wdf.sap.corp (ld9781.wdf.sap.corp [10.21.82.193]) by mail07.wdf.sap.corp (Postfix) with ESMTP id 3vqVLF6mG1zGpGq; Fri, 24 Mar 2017 18:10:45 +0100 (CET) Received: by ld9781.wdf.sap.corp (Postfix, from userid 10159) id DD8051A65C; Fri, 24 Mar 2017 18:10:45 +0100 (CET) In-Reply-To: To: Ryan Sleevi Date: Fri, 24 Mar 2017 18:10:45 +0100 (CET) CC: TLS WG Reply-To: mrex@sap.com X-Mailer: ELM [version 2.4ME+ PL125 (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="US-ASCII" Message-Id: <20170324171045.DD8051A65C@ld9781.wdf.sap.corp> From: mrex@sap.com (Martin Rex) Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 17:10:50 -0000 Ryan Sleevi wrote: > > I would say that the vast majority of servers deployed on the Internet > using commonly publicly trusted CAs have more than one chain to choose from > - often dependent on the installed trust anchors - but the servers may > simply not be aware of it, and relying on clients to do the needful (for > example, with AIA fetching). The delta of sites that don't work in Firefox > (when SHA-1 is disabled) compared to Chrome (when SHA-1 is disabled) > illustrate this - as Chrome performs the AIA fetching to find the > alternative SHA-256 paths, while Firefox does not, and requires the server > supply them. AIA-fetching is a security disaster waiting to happen, it's insecure and irresponsible. While it may be a browser's every day business to aggressively follow each and every URL received over insecure communication channels (plaintext HTTP), download the stuff and try hard to execute it without the slightest amount of risk management (i.e. perform dangerous stuff millions of time to make demonstrations of SWEET32 and attacks on RC4-bias possible), such behaviour is not what the typical programmatic client or server will do (let alone should do). Some users might have a hope that clicking a bookmarked https-URL from a freshly launched web browser would save them from their browser performing arbitrary requests for attackers. Well, if a browser performs AIA-fetching / AIA-chasing, then it is betraying its user, because the AIA-URL received in the ServerCertificate TLS handshake message is not authenticated until _after_ successful verification of the digital signature of that server certificate (at which point AIA-fetching has become unnecessary). If Chrome really does AIA-fetching (*shudder*), how can it be disabled? -Martin From nobody Fri Mar 24 10:19:54 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E5AA12978B for ; Fri, 24 Mar 2017 10:19:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dafZU9nJ2zgy for ; Fri, 24 Mar 2017 10:19:51 -0700 (PDT) Received: from mail-yw0-x236.google.com (mail-yw0-x236.google.com [IPv6:2607:f8b0:4002:c05::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D15E312948E for ; Fri, 24 Mar 2017 10:19:50 -0700 (PDT) Received: by mail-yw0-x236.google.com with SMTP id p77so6414059ywg.1 for ; Fri, 24 Mar 2017 10:19:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=miKdI+8PLQq1z7kiSZiutf8v5GoYA0vw7iNKv7Z4Cco=; b=n9T+kIItB6sj0eSTLFHGbTtG5/tUCZYWapv7qXEwTOSdElELY9T/L71wqK45fr5Ttc j9pZtZSt/izvEEcnSiV7M5KKK0LN6OD1FDjnbEV2VBRRh7OkeQ7Aq1JFrGupHrenxwAy /ddrKHXAws4ccjiODD58HJpn9pRLT7HuNHzj719v9AsosdgkwA2+rTyH+hmvc8reyJ7z fksPiJ/8YQtjPhv/ZEWhJD7kpzkHxgPGVMC/CjAbgJBEefrVycaDZOYE+c6nB9TveQem uucBYhwghwQtXXGkblkhMkJ+YXYuZg5iqNdksck2fuLIT1y+iAdJ7qzufsiDAq9kMnag +61g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=miKdI+8PLQq1z7kiSZiutf8v5GoYA0vw7iNKv7Z4Cco=; b=AIalzWqOuUobEPbzB8M33qACqlNYPRo+Z/tS5zy4PJUJocSDC9uUmoFNumWFPvI4Cc AiIsFl7YRU5HBEQlxjEXvJ4mf6LVv6VXlhconGpEIaqxY9j4om+Ur8+Bn7Z9iZ67eo+H r5H3vmT8c96KEtbBXccWnM5vNRO3KgdV1niIGcxDIFF7GRj9KHPU7MrLdI8LAlvcBfMd UDJUnFlHMDgru8X5777w1hwt7N98lNVBDcNREmVM0o6de6g6f5F2iZKR1DzSWBKUhqGQ XLk7p0kuAWW8fbXaoGVb3Ztwib2nucxoWS+3rg4Dt+3zvotb5LGM+LNL1sxd+ziRF2gN FqXA== X-Gm-Message-State: AFeK/H05geH2bi/omKBZPXjmxJpsx6F6vSpfPSTtD7YbGRKMh1rdSGpKY3WrmC3m41j35ciMKcKCFQN+M7gkcQ== X-Received: by 10.37.53.138 with SMTP id c132mr6555781yba.105.1490375990006; Fri, 24 Mar 2017 10:19:50 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Fri, 24 Mar 2017 10:19:09 -0700 (PDT) In-Reply-To: <141723AB-B4E4-4233-8C35-C720E4A7FE0C@vigilsec.com> References: <0DA64421-5975-4B7E-BC08-7428AFA9D1A1@vigilsec.com> <9D8BEE12-49F9-4DE3-81C7-909CB114805F@vigilsec.com> <1b678d65-b146-b25f-c1ad-6dfc044f7ce0@akamai.com> <733EE968-69EF-43A5-A39B-F016993A3CCD@vigilsec.com> <949EBD4E-613B-4B36-BD93-FDE3E4D4926F@vigilsec.com> <141723AB-B4E4-4233-8C35-C720E4A7FE0C@vigilsec.com> From: Eric Rescorla Date: Fri, 24 Mar 2017 10:19:09 -0700 Message-ID: To: Russ Housley Cc: IETF TLS Content-Type: multipart/alternative; boundary=001a114bbb32776fa1054b7d33bb Archived-At: Subject: Re: [TLS] Using both External PSK and (EC)DH in TLS 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 17:19:53 -0000 --001a114bbb32776fa1054b7d33bb Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Why would the external PSK not just go into he PSK slot. -Ekr On Fri, Mar 24, 2017 at 9:16 AM, Russ Housley wrote: > > > I agree with David here. Specifically, I think. > > > > - The base specification should continue to forbid certificates in > combination with PSK > > - We should at some point contemplate an extension that allows the use > of certificates in combination with PSK > > - The base spec should be factored in such a way as to make that > extension easy. > > > While I agree that we do not want to delay the TLS 1.3 specification to > sort this out; however, I do not think we have provided the hook to make > this future extension easy. Looking at the key schedule in -19, I think > we can provide the hook without being disruptive. My goal is to minimize > the pain to implementing the extension in the future by putting a > straightforward hook in today: > > 0 > | > v > PSK -> HKDF-Extract =3D Early Secret > | > +-----> Derive-Secret(., > | "external psk binder key" | > | "resumption psk binder key", > | "") > | =3D binder_key > | > +-----> Derive-Secret(., "client early traffic secret", > | ClientHello) > | =3D client_early_traffic_secret > | > +-----> Derive-Secret(., "early exporter master secret", > | ClientHello) > | =3D early_exporter_secret > v > Derive-Secret(., "derived secret", "") > | > v > (EC)DHE -> HKDF-Extract =3D Handshake Secret > | > +-----> Derive-Secret(., "client handshake traffic > secret", > | ClientHello...ServerHello) > | =3D client_handshake_traffic_secre= t > | > +-----> Derive-Secret(., "server handshake traffic > secret", > | ClientHello...ServerHello) > | =3D server_handshake_traffic_secre= t > v > Derive-Secret(., "derived secret", "") > | > v > ExtPSK OR 0 -> HKDF-Extract =3D Master Secret > | > +-----> Derive-Secret(., "client application traffic > secret", > | ClientHello...Server Finished) > | =3D client_traffic_secret_0 > | > +-----> Derive-Secret(., "server application traffic > secret", > | ClientHello...Server Finished) > | =3D server_traffic_secret_0 > | > +-----> Derive-Secret(., "exporter master secret", > | ClientHello...Server Finished) > | =3D exporter_secret > | > +-----> Derive-Secret(., "resumption master secret", > ClientHello...Client Finished) > =3D resumption_master_secret > > > The only change is "ExtPSK OR 0=E2=80=9D in the HKDF-Extract for the Mast= er Secret > computation. > > The Section 4.1.1 can call out this place for the future specification: > > OLD: > > - When authenticating via a certificate, the server will send the > Certificate (Section 4.4.2) and CertificateVerify (Section 4.4.3) > messages. In TLS 1.3 as defined by this document, either a PSK or > a certificate is always used, but not both. Future documents may > define how to use them together. > > NEW: > > - When authenticating via a certificate, the server will send the > Certificate (Section 4.4.2) and CertificateVerify (Section 4.4.3) > messages. In TLS 1.3 as defined by this document, either a PSK or > a certificate is always used, but not both. So, the ExtPSK is not > used in the key schedule (Section 7.1). Future documents may > define how to use them together and tell how the ExtPSK is > handled in the key schedule. > > Russ > > > --001a114bbb32776fa1054b7d33bb Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: base64 PGRpdiBkaXI9Imx0ciI+V2h5IHdvdWxkIHRoZSBleHRlcm5hbCBQU0sgbm90IGp1c3QgZ28gaW50 byBoZSBQU0sgc2xvdC48ZGl2Pjxicj48L2Rpdj48ZGl2PjxkaXY+LUVrcjxicj48L2Rpdj48ZGl2 Pjxicj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9leHRyYSI+PGJyPjxkaXYgY2xhc3M9ImdtYWls X3F1b3RlIj5PbiBGcmksIE1hciAyNCwgMjAxNyBhdCA5OjE2IEFNLCBSdXNzIEhvdXNsZXkgPHNw YW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86aG91c2xleUB2aWdpbHNlYy5jb20iIHRh cmdldD0iX2JsYW5rIj5ob3VzbGV5QHZpZ2lsc2VjLmNvbTwvYT4mZ3Q7PC9zcGFuPiB3cm90ZTo8 YnI+PGJsb2NrcXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44 ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mgc29saWQ7cGFkZGluZy1sZWZ0OjFleCI+PHNwYW4+PGJy Pg0KJmd0OyBJIGFncmVlIHdpdGggRGF2aWQgaGVyZS4gU3BlY2lmaWNhbGx5LCBJIHRoaW5rLjxi cj4NCiZndDs8YnI+DQomZ3Q7IC0gVGhlIGJhc2Ugc3BlY2lmaWNhdGlvbiBzaG91bGQgY29udGlu dWUgdG8gZm9yYmlkIGNlcnRpZmljYXRlcyBpbiBjb21iaW5hdGlvbiB3aXRoIFBTSzxicj4NCiZn dDsgLSBXZSBzaG91bGQgYXQgc29tZSBwb2ludCBjb250ZW1wbGF0ZSBhbiBleHRlbnNpb24gdGhh dCBhbGxvd3MgdGhlIHVzZSBvZiBjZXJ0aWZpY2F0ZXMgaW4gY29tYmluYXRpb24gd2l0aCBQU0s8 YnI+DQomZ3Q7IC0gVGhlIGJhc2Ugc3BlYyBzaG91bGQgYmUgZmFjdG9yZWQgaW4gc3VjaCBhIHdh eSBhcyB0byBtYWtlIHRoYXQgZXh0ZW5zaW9uIGVhc3kuPGJyPg0KPGJyPg0KPGJyPg0KPC9zcGFu PldoaWxlIEkgYWdyZWUgdGhhdCB3ZSBkbyBub3Qgd2FudCB0byBkZWxheSB0aGUgVExTIDEuMyBz cGVjaWZpY2F0aW9uIHRvIHNvcnQgdGhpcyBvdXQ7IGhvd2V2ZXIsIEkgZG8gbm90IHRoaW5rIHdl IGhhdmUgcHJvdmlkZWQgdGhlIGhvb2sgdG8gbWFrZSB0aGlzIGZ1dHVyZSBleHRlbnNpb24gZWFz eS7CoCDCoExvb2tpbmcgYXQgdGhlIGtleSBzY2hlZHVsZSBpbiAtMTksIEkgdGhpbmsgd2UgY2Fu IHByb3ZpZGUgdGhlIGhvb2sgd2l0aG91dCBiZWluZyBkaXNydXB0aXZlLsKgIE15IGdvYWwgaXMg dG8gbWluaW1pemUgdGhlIHBhaW4gdG8gaW1wbGVtZW50aW5nIHRoZSBleHRlbnNpb24gaW4gdGhl IGZ1dHVyZSBieSBwdXR0aW5nIGEgc3RyYWlnaHRmb3J3YXJkIGhvb2sgaW4gdG9kYXk6PGJyPg0K PGJyPg0KwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAwPGJyPg0KwqAgwqAgwqAgwqAgwqAgwqAg wqAgwqAgwqB8PGJyPg0KwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqB2PGJyPg0KwqAgwqBQU0sg LSZndDvCoCBIS0RGLUV4dHJhY3QgPSBFYXJseSBTZWNyZXQ8YnI+DQrCoCDCoCDCoCDCoCDCoCDC oCDCoCDCoCDCoHw8YnI+DQrCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCstLS0tLSZndDsgRGVy aXZlLVNlY3JldCguLDxicj4NCsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgfMKgIMKgIMKgIMKg IMKgIMKgIMKgIMKgIMKgIMKgIMKgJnF1b3Q7ZXh0ZXJuYWwgcHNrIGJpbmRlciBrZXkmcXVvdDsg fDxicj4NCsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgfMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKg IMKgIMKgIMKgJnF1b3Q7cmVzdW1wdGlvbiBwc2sgYmluZGVyIGtleSZxdW90Oyw8YnI+DQrCoCDC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoHzCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCZx dW90OyZxdW90Oyk8YnI+DQrCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHzCoCDCoCDCoCDCoCDC oCDCoCDCoCDCoCDCoCDCoCDCoD0gYmluZGVyX2tleTxicj4NCsKgIMKgIMKgIMKgIMKgIMKgIMKg IMKgIMKgfDxicj4NCsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgKy0tLS0tJmd0OyBEZXJpdmUt U2VjcmV0KC4sICZxdW90O2NsaWVudCBlYXJseSB0cmFmZmljIHNlY3JldCZxdW90Oyw8YnI+DQrC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHzCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDC oENsaWVudEhlbGxvKTxicj4NCsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgfMKgIMKgIMKgIMKg IMKgIMKgIMKgIMKgIMKgIMKgIMKgPSBjbGllbnRfZWFybHlfdHJhZmZpY19zZWNyZXQ8YnI+DQrC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHw8YnI+DQrCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDC oCstLS0tLSZndDsgRGVyaXZlLVNlY3JldCguLCAmcXVvdDtlYXJseSBleHBvcnRlciBtYXN0ZXIg c2VjcmV0JnF1b3Q7LDxicj4NCsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgfMKgIMKgIMKgIMKg IMKgIMKgIMKgIMKgIMKgIMKgIMKgQ2xpZW50SGVsbG8pPGJyPg0KwqAgwqAgwqAgwqAgwqAgwqAg wqAgwqAgwqB8wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqA9IGVhcmx5X2V4cG9ydGVy X3NlY3JldDxicj4NCsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgdjxicj4NCsKgIMKgIMKgIMKg IMKgIMKgRGVyaXZlLVNlY3JldCguLCAmcXVvdDtkZXJpdmVkIHNlY3JldCZxdW90OywgJnF1b3Q7 JnF1b3Q7KTxicj4NCsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgfDxicj4NCsKgIMKgIMKgIMKg IMKgIMKgIMKgIMKgIMKgdjxicj4NCihFQylESEUgLSZndDsgSEtERi1FeHRyYWN0ID0gSGFuZHNo YWtlIFNlY3JldDxicj4NCsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgfDxicj4NCsKgIMKgIMKg IMKgIMKgIMKgIMKgIMKgIMKgKy0tLS0tJmd0OyBEZXJpdmUtU2VjcmV0KC4sICZxdW90O2NsaWVu dCBoYW5kc2hha2UgdHJhZmZpYyBzZWNyZXQmcXVvdDssPGJyPg0KwqAgwqAgwqAgwqAgwqAgwqAg wqAgwqAgwqB8wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBDbGllbnRIZWxsby4uLlNl cnZlckhlbGxvKTxicj4NCsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgfMKgIMKgIMKgIMKgIMKg IMKgIMKgIMKgIMKgIMKgIMKgPSBjbGllbnRfaGFuZHNoYWtlX3RyYWZmaWNfc2VjcmU8d2JyPnQ8 YnI+DQrCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHw8YnI+DQrCoCDCoCDCoCDCoCDCoCDCoCDC oCDCoCDCoCstLS0tLSZndDsgRGVyaXZlLVNlY3JldCguLCAmcXVvdDtzZXJ2ZXIgaGFuZHNoYWtl IHRyYWZmaWMgc2VjcmV0JnF1b3Q7LDxicj4NCsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgfMKg IMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgQ2xpZW50SGVsbG8uLi5TZXJ2ZXJIZWxsbyk8 YnI+DQrCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHzCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDC oCDCoCDCoD0gc2VydmVyX2hhbmRzaGFrZV90cmFmZmljX3NlY3JlPHdicj50PGJyPg0KwqAgwqAg wqAgwqAgwqAgwqAgwqAgwqAgwqB2PGJyPg0KwqAgwqAgwqAgwqAgwqAgwqBEZXJpdmUtU2VjcmV0 KC4sICZxdW90O2Rlcml2ZWQgc2VjcmV0JnF1b3Q7LCAmcXVvdDsmcXVvdDspPGJyPg0KwqAgwqAg wqAgwqAgwqAgwqAgwqAgwqAgwqB8PGJyPg0KwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqB2PGJy Pg0KRXh0UFNLIE9SIDAgLSZndDsgSEtERi1FeHRyYWN0ID0gTWFzdGVyIFNlY3JldDxicj4NCsKg IMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgfDxicj4NCsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKg Ky0tLS0tJmd0OyBEZXJpdmUtU2VjcmV0KC4sICZxdW90O2NsaWVudCBhcHBsaWNhdGlvbiB0cmFm ZmljIHNlY3JldCZxdW90Oyw8YnI+DQrCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHzCoCDCoCDC oCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoENsaWVudEhlbGxvLi4uU2VydmVyIEZpbmlzaGVkKTxi cj4NCsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgfMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKg IMKgIMKgPSBjbGllbnRfdHJhZmZpY19zZWNyZXRfMDxicj4NCsKgIMKgIMKgIMKgIMKgIMKgIMKg IMKgIMKgfDxicj4NCsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgKy0tLS0tJmd0OyBEZXJpdmUt U2VjcmV0KC4sICZxdW90O3NlcnZlciBhcHBsaWNhdGlvbiB0cmFmZmljIHNlY3JldCZxdW90Oyw8 YnI+DQrCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHzCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDC oCDCoCDCoENsaWVudEhlbGxvLi4uU2VydmVyIEZpbmlzaGVkKTxicj4NCsKgIMKgIMKgIMKgIMKg IMKgIMKgIMKgIMKgfMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgPSBzZXJ2ZXJfdHJh ZmZpY19zZWNyZXRfMDxicj4NCsKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgfDxicj4NCsKgIMKg IMKgIMKgIMKgIMKgIMKgIMKgIMKgKy0tLS0tJmd0OyBEZXJpdmUtU2VjcmV0KC4sICZxdW90O2V4 cG9ydGVyIG1hc3RlciBzZWNyZXQmcXVvdDssPGJyPg0KwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAg wqB8wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBDbGllbnRIZWxsby4uLlNlcnZlciBG aW5pc2hlZCk8YnI+DQrCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoHzCoCDCoCDCoCDCoCDCoCDC oCDCoCDCoCDCoCDCoCDCoD0gZXhwb3J0ZXJfc2VjcmV0PGJyPg0KwqAgwqAgwqAgwqAgwqAgwqAg wqAgwqAgwqB8PGJyPg0KwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqArLS0tLS0mZ3Q7IERlcml2 ZS1TZWNyZXQoLiwgJnF1b3Q7cmVzdW1wdGlvbiBtYXN0ZXIgc2VjcmV0JnF1b3Q7LDxicj4NCsKg IMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKg Q2xpZW50SGVsbG8uLi5DbGllbnQgRmluaXNoZWQpPGJyPg0KwqAgwqAgwqAgwqAgwqAgwqAgwqAg wqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqA9IHJlc3VtcHRpb25fbWFzdGVy X3NlY3JldDxicj4NCjxicj4NCjxicj4NClRoZSBvbmx5IGNoYW5nZSBpcyAmcXVvdDtFeHRQU0sg T1IgMOKAnSBpbiB0aGUgSEtERi1FeHRyYWN0IGZvciB0aGUgTWFzdGVyIFNlY3JldCBjb21wdXRh dGlvbi48YnI+DQo8YnI+DQpUaGUgU2VjdGlvbiA0LjEuMSBjYW4gY2FsbCBvdXQgdGhpcyBwbGFj ZSBmb3IgdGhlIGZ1dHVyZSBzcGVjaWZpY2F0aW9uOjxicj4NCjxicj4NCk9MRDo8YnI+DQo8YnI+ DQrCoCDCoC3CoCBXaGVuIGF1dGhlbnRpY2F0aW5nIHZpYSBhIGNlcnRpZmljYXRlLCB0aGUgc2Vy dmVyIHdpbGwgc2VuZCB0aGU8YnI+DQrCoCDCoCDCoCBDZXJ0aWZpY2F0ZSAoU2VjdGlvbiA0LjQu MikgYW5kIENlcnRpZmljYXRlVmVyaWZ5IChTZWN0aW9uIDQuNC4zKTxicj4NCsKgIMKgIMKgIG1l c3NhZ2VzLsKgIEluIFRMUyAxLjMgYXMgZGVmaW5lZCBieSB0aGlzIGRvY3VtZW50LCBlaXRoZXIg YSBQU0sgb3I8YnI+DQrCoCDCoCDCoCBhIGNlcnRpZmljYXRlIGlzIGFsd2F5cyB1c2VkLCBidXQg bm90IGJvdGguwqAgRnV0dXJlIGRvY3VtZW50cyBtYXk8YnI+DQrCoCDCoCDCoCBkZWZpbmUgaG93 IHRvIHVzZSB0aGVtIHRvZ2V0aGVyLjxicj4NCjxicj4NCk5FVzo8YnI+DQo8YnI+DQrCoCDCoC3C oCBXaGVuIGF1dGhlbnRpY2F0aW5nIHZpYSBhIGNlcnRpZmljYXRlLCB0aGUgc2VydmVyIHdpbGwg c2VuZCB0aGU8YnI+DQrCoCDCoCDCoCBDZXJ0aWZpY2F0ZSAoU2VjdGlvbiA0LjQuMikgYW5kIENl cnRpZmljYXRlVmVyaWZ5IChTZWN0aW9uIDQuNC4zKTxicj4NCsKgIMKgIMKgIG1lc3NhZ2VzLsKg IEluIFRMUyAxLjMgYXMgZGVmaW5lZCBieSB0aGlzIGRvY3VtZW50LCBlaXRoZXIgYSBQU0sgb3I8 YnI+DQrCoCDCoCDCoCBhIGNlcnRpZmljYXRlIGlzIGFsd2F5cyB1c2VkLCBidXQgbm90IGJvdGgu wqAgU28sIHRoZSBFeHRQU0sgaXMgbm90PGJyPg0KwqAgwqAgwqAgdXNlZCBpbiB0aGUga2V5IHNj aGVkdWxlIChTZWN0aW9uIDcuMSkuwqAgRnV0dXJlIGRvY3VtZW50cyBtYXk8YnI+DQrCoCDCoCDC oCBkZWZpbmUgaG93IHRvIHVzZSB0aGVtIHRvZ2V0aGVyIGFuZCB0ZWxsIGhvdyB0aGUgRXh0UFNL IGlzPGJyPg0KwqAgwqAgwqAgaGFuZGxlZCBpbiB0aGUga2V5IHNjaGVkdWxlLjxicj4NCjxzcGFu IGNsYXNzPSJtXy02MTM3MjQ2NTE3MzQzMDY1NjNIT0VuWmIiPjxmb250IGNvbG9yPSIjODg4ODg4 Ij48YnI+DQpSdXNzPGJyPg0KPGJyPg0KPGJyPg0KPC9mb250Pjwvc3Bhbj48L2Jsb2NrcXVvdGU+ PC9kaXY+PGJyPjwvZGl2PjwvZGl2PjwvZGl2Pg0K --001a114bbb32776fa1054b7d33bb-- From nobody Fri Mar 24 11:17:38 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 46C5812985A for ; Fri, 24 Mar 2017 11:17:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.695 X-Spam-Level: X-Spam-Status: No, score=-4.695 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-2.796] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wou_FTRooIxw for ; Fri, 24 Mar 2017 11:17:35 -0700 (PDT) Received: from homiemail-a74.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F4591294AF for ; Fri, 24 Mar 2017 11:17:35 -0700 (PDT) Received: from homiemail-a74.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a74.g.dreamhost.com (Postfix) with ESMTP id C33CAA00491D for ; Fri, 24 Mar 2017 11:17:34 -0700 (PDT) Received: from mail-lf0-f48.google.com (mail-lf0-f48.google.com [209.85.215.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: ryan@sleevi.com) by homiemail-a74.g.dreamhost.com (Postfix) with ESMTPSA id 8DC6CA00491B for ; Fri, 24 Mar 2017 11:17:34 -0700 (PDT) Received: by mail-lf0-f48.google.com with SMTP id h125so4305479lfe.0 for ; Fri, 24 Mar 2017 11:17:34 -0700 (PDT) X-Gm-Message-State: AFeK/H22qOQeiZO/LclINrK0z0O9BliSqp4eR0Hqy4XMUiQ6RfXToJyUnacBi+F6X2UVj1VrqYItz2RRn4LkHg== X-Received: by 10.25.157.65 with SMTP id g62mr5284662lfe.29.1490379452868; Fri, 24 Mar 2017 11:17:32 -0700 (PDT) MIME-Version: 1.0 Received: by 10.25.193.197 with HTTP; Fri, 24 Mar 2017 11:17:32 -0700 (PDT) In-Reply-To: <20170324171045.DD8051A65C@ld9781.wdf.sap.corp> References: <20170324171045.DD8051A65C@ld9781.wdf.sap.corp> From: Ryan Sleevi Date: Fri, 24 Mar 2017 14:17:32 -0400 X-Gmail-Original-Message-ID: Message-ID: To: mrex@sap.com Cc: Ryan Sleevi , TLS WG Content-Type: multipart/alternative; boundary=001a11411ca2de7429054b7e019a Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 18:17:37 -0000 --001a11411ca2de7429054b7e019a Content-Type: text/plain; charset=UTF-8 On Fri, Mar 24, 2017 at 1:10 PM, Martin Rex wrote: > If Chrome really does AIA-fetching (*shudder*), how can it be disabled? > I can understand and appreciate your viewpoint, although we disagree. I'll save the rest of the list from rehashing that discussion, since the topic at hand was the question of whether there can be multiple valid paths with different hash algorithms. I attempted to demonstrate the various ways this practically happens and how it can be measured. Given that this is an intentional design decision and a disagreement on core security principles, it may be appropriate for you to consider a browser that aligns with your security perspectives, given that despite the explanations and shared perspectives, I have been unable to convince you in the past as to our disagreement. But I do hope we can agree on the topic at hand - that servers routinely have multiple certificate chains that combine a variety of digest algorithms, both with a single leaf certificate (CA variations) or multiple leaf certificates (e.g. Cloudflare, Facebook) --001a11411ca2de7429054b7e019a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On F= ri, Mar 24, 2017 at 1:10 PM, Martin Rex <mrex@sap.com> wrote:
=
If Chrome really does AIA-fetching (*shudder= *), how can it be disabled?

I can under= stand and appreciate your viewpoint, although we disagree. I'll save th= e rest of the list from rehashing that discussion, since the topic at hand = was the question of whether there can be multiple valid paths with differen= t hash algorithms. I attempted to demonstrate the various ways this practic= ally happens and how it can be measured.

Given tha= t this is an intentional design decision and a disagreement on core securit= y principles, it may be appropriate for you to consider a browser that alig= ns with your security perspectives, given that despite the explanations and= shared perspectives, I have been unable to convince you in the past as to = our disagreement.

But I do hope we can agree on th= e topic at hand - that servers routinely have multiple certificate chains t= hat combine a variety of digest algorithms, both with a single leaf certifi= cate (CA variations) or multiple leaf certificates (e.g. Cloudflare, Facebo= ok)
--001a11411ca2de7429054b7e019a-- From nobody Fri Mar 24 12:30:09 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4ACB81294BE for ; Fri, 24 Mar 2017 12:30:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nthpermutation-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ENTSlqiPjuDU for ; Fri, 24 Mar 2017 12:30:02 -0700 (PDT) Received: from mail-it0-x231.google.com (mail-it0-x231.google.com [IPv6:2607:f8b0:4001:c0b::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1603F1296DE for ; Fri, 24 Mar 2017 12:30:01 -0700 (PDT) Received: by mail-it0-x231.google.com with SMTP id y18so11660357itc.1 for ; Fri, 24 Mar 2017 12:30:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nthpermutation-com.20150623.gappssmtp.com; s=20150623; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding; bh=ZPxcM+JkrsNFV/EeA4STUOlPUMtmkNHoMu5KrFMbMuo=; b=CIgBnakDkLA9DHq/ijiGfXXLRArb3d3I2cRGFahdQ86TMSQqEr9kawWx1Xnxo72Ix7 Vx9fx3Ega2FjLgHZZD2m7/KDyPRK996IBVAcY+6M9pymM6LQJwe8aXAoQ1WHY2tZyMAQ ln1xGnbl8rOuPrUuz4dLGnieWd7WLbleaarHEeA5lz3/TivBTuL/eZALy8akKD07vnsr I+I3mpC05JuluEB98QNwHyoFbAj2at0qotp3GeG/b/v+utHOxvVtk31S3L+9hXjxNEV1 lcy/Zz3N5oXM8FWoQ3CBvGej/4DmqV1tiLxHg3o8BGRmOFO5sZO9Q+p0AE43vWr4VIX0 fs7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=ZPxcM+JkrsNFV/EeA4STUOlPUMtmkNHoMu5KrFMbMuo=; b=eaj16y1fzfvrV/pdP2Z9jzuKY+6M0zZvPrVlkEJcq3iZYzf4Daf5n3zMq3bnOGyTuq 6QQfaAK7mAOgNsS6uhHqQCJgUhBPjeSMoOnHEDCLkm29lWlr6p/BNV9WrAkSDq/4WJ/D 5vuX0+Qesw8oAQ+3zEI+Lf7Xil01FE14t37pe2aoQEms+eaoYiMjOr3SsRCfWUan1kXU cUxCrWvr0sputCAWqCgJ/QSDVMtHeKZaHim3Gkof/HWIzvxWGhrLBT0Ss4BQrHCdwwGp 2mDHkIebhvPKyaB5AeBiLCS9KZ42EtkRVFqp6/D0SEdvKld9BApF+EjY+3rSGdtupqPp U5Gw== X-Gm-Message-State: AFeK/H070r+SDdk0pyoBXEvKtb4CM0mC9y5JWB/biUeo6IzF+Vxjgn4Me5Coe8hcZwrmpw== X-Received: by 10.107.199.129 with SMTP id x123mr9834019iof.216.1490383799799; Fri, 24 Mar 2017 12:29:59 -0700 (PDT) Received: from ?IPv6:2601:152:4400:513c:7598:48a0:ae76:31c9? ([2601:152:4400:513c:7598:48a0:ae76:31c9]) by smtp.gmail.com with ESMTPSA id d196sm1643805ioe.3.2017.03.24.12.29.57 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 24 Mar 2017 12:29:57 -0700 (PDT) To: tls@ietf.org References: <20170324154440.B68281A65C@ld9781.wdf.sap.corp> From: Michael StJohns Message-ID: Date: Fri, 24 Mar 2017 15:30:01 -0400 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: <20170324154440.B68281A65C@ld9781.wdf.sap.corp> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 19:30:08 -0000 On 3/24/2017 11:44 AM, Martin Rex wrote: > oops, typo: > > Martin Rex wrote: >> Actually, looking at the DigiCert issued ECC cert for www.cloudflare.com >> I'm a little confused. >> >> This is the cert chain (as visualized by Microsoft CryptoAPI): >> >> server-cert: CN=cloudflare.com, ... >> contains ECDSA P-256 public key >> is allegedly signed with sha256ECDSA >> >> intermediate CA: CN=DigiCert ECC Extended Validation Server CA >> contains ECDSA P-384 public key >> is allegedly signed with sha384RSA >> >> root CA: CN=DigiCert High Assurance EV Root CA >> contains RSA 2048-bit public key >> is self-signed with sha1WithRsaEncryption >> >> For those who insist on reading rfc5246 verbatim, this chain requires >> >> ECDSA+SHA384:RSA+SHA384:RSA+SHA1 > ECDSA+SHA256:RSA+SHA384:RSA+SHA1 I don't think RSA + SHA 1 is actually required. The Signature over the trust anchor (root CA) is basically a no-op - assuming the certificate is in the browser(client) trust store. The trust is traced to the public key regardless of the form in which it's provided. We use self-signed certs a lot to carry the public keys and names (and sometimes constraints), but that's not required by PKIX. Mike > >> The digital signature on the server certificate looks bogus to me, >> that should be a sha384ECDSA signature according to NIST, because >> it uses a P-384 signing key. >> >> The signature on the intermediate CA is imbalanced, and >> should be sha256RSA rather than sha384RSA. (that is only an interop issue, >> not a security issue). > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > From nobody Fri Mar 24 13:47:24 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2F5AB1289B5 for ; Fri, 24 Mar 2017 13:47:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.221 X-Spam-Level: X-Spam-Status: No, score=-4.221 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=symc.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nmRUZm9GSflx for ; Fri, 24 Mar 2017 13:47:21 -0700 (PDT) Received: from asbsmtoutape01.symantec.com (asbsmtoutape01.symantec.com [155.64.138.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AA5B12871F for ; Fri, 24 Mar 2017 13:47:20 -0700 (PDT) Received: from asbsmtmtaapi01.symc.symantec.com (asb1-f5-symc-ext-prd-snat7.net.symantec.com [10.90.75.7]) by asbsmtoutape01.symantec.com (Symantec Messaging Gateway) with SMTP id C4.48.36325.7D585D85; Fri, 24 Mar 2017 20:47:19 +0000 (GMT) X-AuditID: 0a5af819-428639a000008de5-c8-58d585d7a94a Received: from TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (asb1-f5-symc-ext-prd-snat7.net.symantec.com [10.90.75.7]) by asbsmtmtaapi01.symc.symantec.com (Symantec Messaging Gateway) with SMTP id FB.5C.04315.7D585D85; Fri, 24 Mar 2017 20:47:19 +0000 (GMT) Received: from tus3xchcaspin01.SYMC.SYMANTEC.COM (10.44.91.13) by TUSXCHMBXWPI02.SYMC.SYMANTEC.COM (10.44.91.34) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Fri, 24 Mar 2017 13:47:18 -0700 Received: from NAM01-SN1-obe.outbound.protection.outlook.com (10.44.128.10) by tus3xchcaspin01.SYMC.SYMANTEC.COM (10.44.91.13) with Microsoft SMTP Server (TLS) id 15.0.1236.3 via Frontend Transport; Fri, 24 Mar 2017 13:47:17 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=symc.onmicrosoft.com; s=selector1-symantec-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=s7XbpAztEHx3q//4LKa385YAeJu49TPuww8TcVDnPWc=; b=fpIJn42CIMAzEcQf1WLBdBt7Im5wmrFDE2aPmO+XmJtVD70bezUXBkIi33ZYlfPtGvSGprZEt8DLwIKPyzVCKoG8XSPnlfu8LhJ6bb6zeH44nuiI2H/3AP7wwZ+6dTPi2wEUYZNCTfoS2ILvb/UCze3fZ4jrzwe5gxNMDuV9gaQ= Received: from DM5PR16MB1834.namprd16.prod.outlook.com (10.172.45.9) by DM5PR16MB1835.namprd16.prod.outlook.com (10.172.45.10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.977.11; Fri, 24 Mar 2017 20:47:17 +0000 Received: from DM5PR16MB1834.namprd16.prod.outlook.com ([10.172.45.9]) by DM5PR16MB1834.namprd16.prod.outlook.com ([10.172.45.9]) with mapi id 15.01.0977.021; Fri, 24 Mar 2017 20:47:16 +0000 From: Roelof Du Toit To: "tls@ietf.org" Thread-Topic: Application Data before Client Finished message Thread-Index: AQHSpN/SEhprFr7qJk6yEGHBVM43PA== Date: Fri, 24 Mar 2017 20:47:16 +0000 Message-ID: <0AD86891-21E6-40C1-B257-347CE73AEE02@symantec.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=symantec.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [72.23.5.194] x-microsoft-exchange-diagnostics: 1; DM5PR16MB1835; 7:iMxQ4HSRFHt+fUIOV70kea2FRlHUZ4HGiT+31QuPnrJJLWMJ6QjMSsl0fpkeJBhqAweB6kREZ2v6rPU/vcYinZctYCw3Z6HiWvaHxOYoUYdhSC+wsxn8QlzsyZ/1eZU0FYyDWvtQakgh32OkB921S3nY8+cehCGRGHap/YXWriaU/H/mACdamzHmWJ+ohjccNCyVC56VV3AnbA+udx8Y9j4ig1PSpLx6lsgjj5XRxfIaexy+xYLWwAX31louBLaPrl8u5YrGAutdz5DVa1XmLS2PTmZvvO4+OuHTA/ORkrdP+2xrvBU3znjB1crhCk4xbQUg6wbkrJRuGZPgn3YATA== x-forefront-antispam-report: SFV:SKI; SCL:-1SFV:NSPM; SFS:(10009020)(6009001)(39450400003)(39830400002)(39410400002)(1730700003)(3660700001)(8676002)(10710500007)(122556002)(2501003)(3280700002)(2351001)(81166006)(10290500002)(6506006)(6486002)(80792005)(77096006)(2906002)(6436002)(36756003)(82746002)(6512007)(6916009)(54896002)(189998001)(38730400002)(110136004)(6306002)(53936002)(5640700003)(83716003)(66066001)(99286003)(50986999)(25786009)(2900100001)(7736002)(5660300001)(8936002)(7110500001)(2420400007)(54356999)(6116002)(86362001)(15650500001)(3846002)(33656002)(102836003); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR16MB1835; H:DM5PR16MB1834.namprd16.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; x-ms-office365-filtering-correlation-id: cfc47a17-b348-4167-1d99-08d472f6f52e x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075); SRVR:DM5PR16MB1835; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(158342451672863)(21748063052155); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6041248)(20161123555025)(20161123564025)(20161123562025)(20161123558025)(20161123560025)(6072148); SRVR:DM5PR16MB1835; BCL:0; PCL:0; RULEID:; SRVR:DM5PR16MB1835; x-forefront-prvs: 0256C18696 spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_0AD8689121E640C1B257347CE73AEE02symanteccom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Mar 2017 20:47:16.6053 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3b217a9b-6c58-428b-b022-5ad741ce2016 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR16MB1835 X-OriginatorOrg: symantec.com X-Brightmail-Tracker: H4sIAAAAAAAAA02SfUgTcRzG/e3u9DYanGvltxmYoyLzXYoMzUyIBCtCkNQCu+aR4nzhNlfW P0K+5JaZFomSr0moCKEQ6hK1leZLuRa5NSNtbVoJJgnZhpFtuxP65/h8v8/z3P0e7kdikkFC RuYWqBm2gFbKfUW4KDPFL9xSPpse1bmxP3bNqEWJKLmjwyU4hzJF8dmMMlfDsJEJl0Q545P1 qGgp8dqIVU+Uoo0ELRKSQB2C0k4bpkUiUkL9RGBfXsG2hPrPrQQnrCNw9nTxrjEEw9WL/LCM YOiO1c8TwakqDHRLGZxwTwAD7SacGwwIpocfCzwuXyoaXKN1hIelVDAMzOq86e1ULGg3OY+U Ogbm5jbEcQT0PCsjuC/sg/YGo5fF1HEwdztwDyNqJ/ye6vFmMSoA5hwtAq4EBR1DRr7QDvhu /+sthCgdgqdDI4gTwuCNxcFzECwsTiOPCajbGHR1OgTcMEiAfvUj/9ozYFpt4xMXQd+8xu/z 4MfcLYLjFOifsuBcuFEAdX8q+HPshumJdwTXWQaf3lehuyi08b+jc6yAsS/jeKO3qj9MNjjc TLr3IfBEH8lZguG+zubH8QEof9jEczKYmtax/z2tiOxGe2jVZVW+urBYTRcxUdERqpJ8hedB u6+TIkJRmN+HvBfKuWsAvZw4bUAUieTbxAFXZ9MlBK1xO93/kcTkUrEtzr0SZ9Ml1xm2MIst VjIqAwokcXmAuFb5Nl1CXaHVTB7DFDHslioghbJSJK2s7c0Q3rigmDnv1FS8xr7NW+dnHgX2 WVLZCVl4kr/BvJR2uCU+bHTvZvWKMdWHOWXwETnbTTHisq9HHEk+R+MqC2pOPLjZnCJsWV2o iTUsfhjpsln7s36tu3pLzGr7i6mgV465hYQ0V1/Ic0OyiS23nzXFnNSE1rGisf4SOa7KoaMP YqyK/geKK03wTAMAAA== X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprLKsWRmVeSWpSXmKPExsXCFeXNrnu99WqEQe8VWYtP57sYHRg9liz5 yRTAGMVlk5Kak1mWWqRvl8CVcezkdMaCZw4V+2/uYm1g/G3XxcjJISFgIjH9wQLWLkYuDiGB b4wSP9asZIZwjjJK7Ot9CuW8YpTY03eTHaSFRaCTWaL7WSREYjKTxI5FF1kgnEOMEqf3LWMC qWITMJT4eWASK4gtIqAoseNqN1i3sICFRNd/iBoRAVuJa/MWMkLYehJrdrewQmxQlVg08zyY zStgL3Ft1RMWEJtRQEzi+6k1YL3MAuISt57MZ4J4QkBiyZ7zzBC2qMTLx//AHmIU6GaU2Lpn PyNEQkfi7PUnULa8xP2npxlBiiQEepglVq54wgTh7GSV2PX+NtRYX4mL7xdCdcRI7Jr3CSqe LfHuVgcrhO0tsf3UdRaI5llMEpP+tEHdISNx+sQlVoifpSTuXulkhLBlJF7c2csK8UOyxNFH x1gmMKrPQvLSLCSpWeAgEJQ4OfMJkM0BFNeUWL9LH6JEUWJK90N2CFtDonXOXCjbQ+Li3G/M yGoWMHKsYlRILE4qzi3JLUlMLMg0MNQrrsxNBhGJwNSUrJecn7uJEZyefovtYDzwx+cQowAH oxIPb4fn1Qgh1sQyoMpDjNIcLErivDcMN0UICaQnlqRmp6YWpBbFF5XmpBYfYmTi4JRqYJQI vXm5ldn8yn1dxxMuwVfuzTGY7lmdL3lc7vnm17ZHFSov3d9305Txhm9PxY8gxx3r+M0WlLvY 6ns03bxzt6VY79FlkwN7NxocauY9f4v31WrnXZ4LJT4eXaUssuv2inrj7pcvU3d8enfzhzbj 7djtMpV+apKlt27//xX+/Hqz+tydM1p41QKVWIozEg21mIuKEwH4z96sMAMAAA== X-CFilter-Loop: ASB02 Archived-At: Subject: [TLS] Application Data before Client Finished message X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 20:47:23 -0000 --_000_0AD8689121E640C1B257347CE73AEE02symanteccom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSB3YXMgd29uZGVyaW5nIGlmIFNlY3Rpb24gNC40LjQgcmVxdWlyZXMgYW4gYWRkaXRpb25hbCBl eGNlcHRpb24gdG8gYWxsb3cgc2VuZGluZyBBcHBsaWNhdGlvbiBEYXRhIGZyb20gdGhlIHNlcnZl ciBwcmlvciB0byByZWNlaXZpbmcgdGhlIGNsaWVudCdzIEZpbmlzaGVkIG1lc3NhZ2U/DQoNClRo ZSBjdXJyZW50IGRyYWZ0IGhhcyB0aGUgZm9sbG93aW5nIGluIFNlY3Rpb24gNC40LjQ6DQpPbmNl IGEgc2lkZSBoYXMgc2VudCBpdHMgRmluaXNoZWQgbWVzc2FnZSBhbmQgcmVjZWl2ZWQgYW5kIHZh bGlkYXRlZCB0aGUgRmluaXNoZWQgbWVzc2FnZSBmcm9tIGl0cyBwZWVyLCBpdCBtYXkgYmVnaW4g dG8gc2VuZCBhbmQgcmVjZWl2ZSBhcHBsaWNhdGlvbiBkYXRhIG92ZXIgdGhlIGNvbm5lY3Rpb24u IEVhcmx5IGRhdGEgbWF5IGJlIHNlbnQgcHJpb3IgdG8gdGhlIHJlY2VpcHQgb2YgdGhlIHBlZXLi gJlzIEZpbmlzaGVkIG1lc3NhZ2UsIHBlciBTZWN0aW9uIDQuMi43Lg0KDQouLiB3aGlsZSBTZWN0 aW9uIDIgaGFzIHRoZSBmb2xsb3dpbmc6DQpBdCB0aGlzIHBvaW50LCB0aGUgaGFuZHNoYWtlIGlz IGNvbXBsZXRlLCBhbmQgdGhlIGNsaWVudCBhbmQgc2VydmVyIG1heSBleGNoYW5nZSBhcHBsaWNh dGlvbi1sYXllciBkYXRhLiBBcHBsaWNhdGlvbiBkYXRhIE1VU1QgTk9UIGJlIHNlbnQgcHJpb3Ig dG8gc2VuZGluZyB0aGUgRmluaXNoZWQgbWVzc2FnZS4gTm90ZSB0aGF0IHdoaWxlIHRoZSBzZXJ2 ZXIgbWF5IHNlbmQgYXBwbGljYXRpb24gZGF0YSBwcmlvciB0byByZWNlaXZpbmcgdGhlIGNsaWVu dOKAmXMgQXV0aGVudGljYXRpb24gbWVzc2FnZXMsIGFueSBkYXRhIHNlbnQgYXQgdGhhdCBwb2lu dCBpcywgb2YgY291cnNlLCBiZWluZyBzZW50IHRvIGFuIHVuYXV0aGVudGljYXRlZCBwZWVyLg0K DQoNClVucmVsYXRlZCwgSSB3YXMgY3VyaW91cyB3aHkgdGhlICdjbGllbnRfdHJhZmZpY19zZWNy ZXRfMCcgY2FsY3VsYXRpb24gZG9lcyBub3QgaW5jbHVkZSB0aGUgJ0NsaWVudCBGaW5pc2hlZCcg bWVzc2FnZSB3aGlsZSB0aGUgJ3NlcnZlcl90cmFmZmljX3NlY3JldF8wJyBjYWxjdWxhdGlvbiBp bmNsdWRlcyB0aGUgJ1NlcnZlciBGaW5pc2hlZCcgbWVzc2FnZT8gIEFmdGVyIHNvbWUgZGlnZ2lu ZyBJIG5vdGljZWQgdGhhdCB0aGUgc3BsaXQgd2FzIGFkZGVkIGluIERyYWZ0IDE2LCB3aGlsZSBE cmFmdHMgMTMgdGhyb3VnaCAxNSBoYWQgaXQgYXMganVzdCAndHJhZmZpY19zZWNyZXRfMCcgKGNh bGN1bGF0ZWQgd2l0aG91dCAnQ2xpZW50IEZpbmlzaGVkJykuICAgSSdtIGd1ZXNzaW5nIGl0IGRv ZXMgbm90IHJlYWxseSBhZmZlY3QgdGhlIHN0cmVuZ3RoIG9mIHRoZSBzZWNyZXQsIGJ1dCBJIHdh cyB3b25kZXJpbmcgYWJvdXQgdGhlIGFzeW1tZXRyeS4NCg0KLS1Sb2Vsb2YNCg0K --_000_0AD8689121E640C1B257347CE73AEE02symanteccom_ Content-Type: text/html; charset="utf-8" Content-ID: <02052A52B98D234D943E816814A24F74@namprd16.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eTpDYWxpYnJpO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwcmUN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZvcm1h dHRlZCBDaGFyIjsNCgltYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250 LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OkNvdXJpZXI7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTcN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtY29tcG9zZTsNCglmb250LWZhbWlseTpDYWxpYnJp Ow0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5IVE1MUHJlZm9ybWF0dGVkQ2hhcg0KCXttc28t c3R5bGUtbmFtZToiSFRNTCBQcmVmb3JtYXR0ZWQgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZvcm1hdHRlZCI7DQoJZm9udC1mYW1pbHk6 Q291cmllcjt9DQpzcGFuLm1zb0lucw0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglt c28tc3R5bGUtbmFtZToiIjsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lOw0KCWNvbG9yOnRl YWw7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9u dC1mYW1pbHk6Q2FsaWJyaTt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4w aW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjEN Cgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5IGJnY29s b3I9IndoaXRlIiBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0K PGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij5JIHdhcyB3b25kZXJpbmcgaWYgU2VjdGlvbiA0LjQuNCBy ZXF1aXJlcyBhbiBhZGRpdGlvbmFsIGV4Y2VwdGlvbiB0byBhbGxvdyBzZW5kaW5nIEFwcGxpY2F0 aW9uIERhdGEgZnJvbSB0aGUgc2VydmVyIHByaW9yIHRvIHJlY2VpdmluZyB0aGUgY2xpZW50J3Mg RmluaXNoZWQgbWVzc2FnZT88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQiPlRoZSBjdXJyZW50IGRyYWZ0IGhhcyB0aGUgZm9sbG93aW5nIGluIFNlY3Rpb24gNC40LjQ6 PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGk+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQiPk9uY2UgYSBzaWRlIGhhcyBzZW50IGl0cyBGaW5pc2hlZCBt ZXNzYWdlIGFuZCByZWNlaXZlZCBhbmQgdmFsaWRhdGVkIHRoZSBGaW5pc2hlZCBtZXNzYWdlIGZy b20gaXRzIHBlZXIsIGl0IG1heSBiZWdpbiB0byBzZW5kIGFuZCByZWNlaXZlIGFwcGxpY2F0aW9u IGRhdGEgb3ZlciB0aGUgY29ubmVjdGlvbi4gRWFybHkgZGF0YSBtYXkgYmUgc2VudCBwcmlvcg0K IHRvIHRoZSByZWNlaXB0IG9mIHRoZSBwZWVy4oCZcyBGaW5pc2hlZCBtZXNzYWdlLCBwZXImbmJz cDtTZWN0aW9uIDQuMi43LjxvOnA+PC9vOnA+PC9zcGFuPjwvaT48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQiPi4uIHdoaWxlIFNlY3Rpb24gMiBoYXMgdGhlIGZvbGxvd2luZzo8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48aT48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdCI+QXQgdGhpcyBwb2ludCwgdGhlIGhhbmRzaGFrZSBpcyBjb21wbGV0ZSwgYW5kIHRo ZSBjbGllbnQgYW5kIHNlcnZlciBtYXkgZXhjaGFuZ2UgYXBwbGljYXRpb24tbGF5ZXIgZGF0YS4g QXBwbGljYXRpb24gZGF0YSBNVVNUIE5PVCBiZSBzZW50IHByaW9yIHRvIHNlbmRpbmcgdGhlIEZp bmlzaGVkIG1lc3NhZ2UuIE5vdGUgdGhhdCB3aGlsZSB0aGUgc2VydmVyDQogbWF5IHNlbmQgYXBw bGljYXRpb24gZGF0YSBwcmlvciB0byByZWNlaXZpbmcgdGhlIGNsaWVudOKAmXMgQXV0aGVudGlj YXRpb24gbWVzc2FnZXMsIGFueSBkYXRhIHNlbnQgYXQgdGhhdCBwb2ludCBpcywgb2YgY291cnNl LCBiZWluZyBzZW50IHRvIGFuIHVuYXV0aGVudGljYXRlZCBwZWVyLjxvOnA+PC9vOnA+PC9zcGFu PjwvaT48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5V bnJlbGF0ZWQsIEkgd2FzIGN1cmlvdXMgd2h5IHRoZSAnY2xpZW50X3RyYWZmaWNfc2VjcmV0XzAn IGNhbGN1bGF0aW9uIGRvZXMgbm90IGluY2x1ZGUgdGhlICdDbGllbnQgRmluaXNoZWQnIG1lc3Nh Z2Ugd2hpbGUgdGhlICdzZXJ2ZXJfdHJhZmZpY19zZWNyZXRfMCcgY2FsY3VsYXRpb24gaW5jbHVk ZXMgdGhlICdTZXJ2ZXIgRmluaXNoZWQnIG1lc3NhZ2U/Jm5ic3A7DQogQWZ0ZXIgc29tZSBkaWdn aW5nIEkgbm90aWNlZCB0aGF0IHRoZSBzcGxpdCB3YXMgYWRkZWQgaW4gRHJhZnQgMTYsIHdoaWxl IERyYWZ0cyAxMyB0aHJvdWdoIDE1IGhhZCBpdCBhcyBqdXN0ICd0cmFmZmljX3NlY3JldF8wJyAo Y2FsY3VsYXRlZCB3aXRob3V0ICdDbGllbnQgRmluaXNoZWQnKS4mbmJzcDsmbmJzcDsgSSdtIGd1 ZXNzaW5nIGl0IGRvZXMgbm90IHJlYWxseSBhZmZlY3QgdGhlIHN0cmVuZ3RoIG9mIHRoZSBzZWNy ZXQsIGJ1dCBJIHdhcyB3b25kZXJpbmcNCiBhYm91dCB0aGUgYXN5bW1ldHJ5LjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+LS1Sb2Vsb2Y8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_0AD8689121E640C1B257347CE73AEE02symanteccom_-- From nobody Fri Mar 24 13:50:27 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DE3E1294D2 for ; Fri, 24 Mar 2017 13:50:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 48x9NOYOF0Vf for ; Fri, 24 Mar 2017 13:50:23 -0700 (PDT) Received: from mail-yw0-x22d.google.com (mail-yw0-x22d.google.com [IPv6:2607:f8b0:4002:c05::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 290691286B2 for ; Fri, 24 Mar 2017 13:50:23 -0700 (PDT) Received: by mail-yw0-x22d.google.com with SMTP id v76so1113615ywg.0 for ; Fri, 24 Mar 2017 13:50:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=44dbjq983oDPUnn9MwZOh3/4AhU2V4vSFLRMehwssqQ=; b=eRj8CUw4hm7+hwhncSlvXQO+40Vz/sADsqfKtEkuvyTQfiP7mTgGxVjE+y1VG156Nj 13jFaFtM44AeEN4HukB9ShZwjSpMxB9Nccm4ayAgOeYBuW6HobwIZHOne/7FrbQjGY+m 7NCjpUvAKtgdWB3WpQMLCM6xihoTp1D9BQphwy9uTEiioD0/atVt6PR2Y21lifAGjGjg rK0NUGrRLKCpcrxuORo6bV6RgnfPupnnbYX37I7a1xGlS1ZPO+5JZiPShf9y5vScOH44 wv/9zhAM61IQ0Ew2NizI8Q88rwsYrepEQj+ZfAw5F5hKTho0zIDKrP67i0QS4FFeWefJ v8Og== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=44dbjq983oDPUnn9MwZOh3/4AhU2V4vSFLRMehwssqQ=; b=d2aBbPcGftS0qHDADoKnQ24h4HdAvJWc0gYV92caXfST/QfcxuvVHm7fUkNIV8LMV1 3hbvjGGHJLTpIs/6Jvnb5N6uyjVOd7dlcT0sabAdvVo+I6nO8p9qUJlLtUZBGIvZDhGt Sc/om3Y8gjDM0JYIVhv2Oq1CtUXn/Yj6J8Qqb3YN0nSYCsaWoXouonOg4kdYvj5Yy3Qo 3EaqS1+JkLyx3kX/pVJ1zDDjBwbFlQd+Wpkfcy+lxKZ9biP6ay0kvb+w4foP9b9h2ZFs /SPj8REAg4GClb/H3mf9m9hP/SwlzIZYsDIM590m/DtMIlw8NtfzNxqCq08hMGpxZ+KQ cHcQ== X-Gm-Message-State: AFeK/H2LITbUi4TlOagOaoQJNvSShYOD7F9/JUt29r/Nuh/K/nmQ8ZeFy1TBXjbBuy5S8L7TN1tgJa3iEC7GUQ== X-Received: by 10.37.78.195 with SMTP id c186mr7322185ybb.180.1490388622277; Fri, 24 Mar 2017 13:50:22 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Fri, 24 Mar 2017 13:49:41 -0700 (PDT) In-Reply-To: <0AD86891-21E6-40C1-B257-347CE73AEE02@symantec.com> References: <0AD86891-21E6-40C1-B257-347CE73AEE02@symantec.com> From: Eric Rescorla Date: Fri, 24 Mar 2017 13:49:41 -0700 Message-ID: To: Roelof Du Toit Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a113e88fa6947c7054b8024d2 Archived-At: Subject: Re: [TLS] Application Data before Client Finished message X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 20:50:25 -0000 --001a113e88fa6947c7054b8024d2 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Fri, Mar 24, 2017 at 1:47 PM, Roelof Du Toit wrote: > I was wondering if Section 4.4.4 requires an additional exception to allo= w > sending Application Data from the server prior to receiving the client's > Finished message? > > > > The current draft has the following in Section 4.4.4: > > *Once a side has sent its Finished message and received and validated the > Finished message from its peer, it may begin to send and receive > application data over the connection. Early data may be sent prior to the > receipt of the peer=E2=80=99s Finished message, per Section 4.2.7.* > Thanks, yeah, this text is old. Will see about fixing. > .. while Section 2 has the following: > > *At this point, the handshake is complete, and the client and server may > exchange application-layer data. Application data MUST NOT be sent prior = to > sending the Finished message. Note that while the server may send > application data prior to receiving the client=E2=80=99s Authentication m= essages, > any data sent at that point is, of course, being sent to an unauthenticat= ed > peer.* > > > > > > Unrelated, I was curious why the 'client_traffic_secret_0' calculation > does not include the 'Client Finished' message while the > 'server_traffic_secret_0' calculation includes the 'Server Finished' > message? After some digging I noticed that the split was added in Draft > 16, while Drafts 13 through 15 had it as just 'traffic_secret_0' > (calculated without 'Client Finished'). I'm guessing it does not really > affect the strength of the secret, but I was wondering about the asymmetr= y. > The principle is that all the traffic keys are computed at the same time. -Ekr > > > --Roelof > > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > > --001a113e88fa6947c7054b8024d2 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Fri, Mar 24, 2017 at 1:47 PM, Roelof Du Toit <<= a href=3D"mailto:Roelof_Dutoit@symantec.com" target=3D"_blank">Roelof_Dutoi= t@symantec.com> wrote:

I was wondering if = Section 4.4.4 requires an additional exception to allow sending Application= Data from the server prior to receiving the client's Finished message?=

=C2=A0

The current draft h= as the following in Section 4.4.4:

Once a side has = sent its Finished message and received and validated the Finished message f= rom its peer, it may begin to send and receive application data over the co= nnection. Early data may be sent prior to the receipt of the peer=E2=80=99s Finished message, per=C2=A0Section 4.= 2.7.


Thanks, yea= h, this text is old. Will see about fixing.

=C2=A0

.. while Section 2 = has the following:

At this point, t= he handshake is complete, and the client and server may exchange applicatio= n-layer data. Application data MUST NOT be sent prior to sending the Finish= ed message. Note that while the server may send application data prior to receiving the client=E2=80=99s Authenti= cation messages, any data sent at that point is, of course, being sent to a= n unauthenticated peer.

=C2=A0

=C2=A0

Unrelated, I was cu= rious why the 'client_traffic_secret_0' calculation does not includ= e the 'Client Finished' message while the 'server_traffic_secre= t_0' calculation includes the 'Server Finished' message?=C2=A0 After some digging I noticed that the split was added in Draft 16, while D= rafts 13 through 15 had it as just 'traffic_secret_0' (calculated w= ithout 'Client Finished').=C2=A0=C2=A0 I'm guessing it does not= really affect the strength of the secret, but I was wondering about the asymmetry.


The principle is that all the traffic keys are computed at the same time.=

-Ekr
=C2=A0

=C2=A0

--Roelof<= /u>

=C2=A0


_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


--001a113e88fa6947c7054b8024d2-- From nobody Fri Mar 24 13:53:31 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C28BA129968 for ; Fri, 24 Mar 2017 13:53:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.421 X-Spam-Level: X-Spam-Status: No, score=-6.421 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_SPAM=0.5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xxor-5vxCeBg for ; Fri, 24 Mar 2017 13:53:26 -0700 (PDT) Received: from smtpde01.smtp.sap-ag.de (smtpde01.smtp.sap-ag.de [155.56.68.170]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72CEB129882 for ; Fri, 24 Mar 2017 13:53:26 -0700 (PDT) Received: from mail07.wdf.sap.corp (mail04.sap.corp [194.39.131.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtpde01.smtp.sap-ag.de (Postfix) with ESMTPS id 3vqbH84Rj0z1Jm9; Fri, 24 Mar 2017 21:53:24 +0100 (CET) X-purgate-ID: 152705::1490388804-0000521C-85BD9E09/0/0 X-purgate-size: 2181 X-purgate: clean X-purgate: This mail is considered clean (visit http://www.eleven.de for further information) X-purgate-Ad: Categorized by eleven eXpurgate (R) http://www.eleven.de X-purgate-type: clean X-SAP-SPAM-Status: clean Received: from ld9781.wdf.sap.corp (ld9781.wdf.sap.corp [10.21.82.193]) by mail07.wdf.sap.corp (Postfix) with ESMTP id 3vqbH82jJHzGnxb; Fri, 24 Mar 2017 21:53:24 +0100 (CET) Received: by ld9781.wdf.sap.corp (Postfix, from userid 10159) id 519011A65C; Fri, 24 Mar 2017 21:53:24 +0100 (CET) In-Reply-To: To: Michael StJohns Date: Fri, 24 Mar 2017 21:53:24 +0100 (CET) CC: tls@ietf.org Reply-To: mrex@sap.com X-Mailer: ELM [version 2.4ME+ PL125 (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="US-ASCII" Message-Id: <20170324205324.519011A65C@ld9781.wdf.sap.corp> From: mrex@sap.com (Martin Rex) Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 20:53:29 -0000 Michael StJohns wrote: > Martin Rex wrote: >> oops, typo: >> >> Martin Rex wrote: >>> Actually, looking at the DigiCert issued ECC cert for www.cloudflare.com >>> I'm a little confused. >>> >>> This is the cert chain (as visualized by Microsoft CryptoAPI): >>> >>> server-cert: CN=cloudflare.com, ... >>> contains ECDSA P-256 public key >>> is allegedly signed with sha256ECDSA >>> >>> intermediate CA: CN=DigiCert ECC Extended Validation Server CA >>> contains ECDSA P-384 public key >>> is allegedly signed with sha384RSA >>> >>> root CA: CN=DigiCert High Assurance EV Root CA >>> contains RSA 2048-bit public key >>> is self-signed with sha1WithRsaEncryption >>> >>> For those who insist on reading rfc5246 verbatim, this chain requires >>> >>> ECDSA+SHA384:RSA+SHA384:RSA+SHA1 >> ECDSA+SHA256:RSA+SHA384:RSA+SHA1 > > I don't think RSA + SHA 1 is actually required. The Signature over the > trust anchor (root CA) is basically a no-op - assuming the certificate > is in the browser(client) trust store. The trust is traced to the > public key regardless of the form in which it's provided. We use > self-signed certs a lot to carry the public keys and names (and > sometimes constraints), but that's not required by PKIX. A server TLS implementation is *ALLOWED* to unconditionally include the RootCA cert, and in that case a client not sending RSA+SHA1 clearly indicates DO NOT SEND ME THAT PATH if the bogus words in rfc5246 about signature_algorithms is taken literally. Remember that were talking about *SERVERS* preempting the clients decision (like Microsoft SChannel implemented it), not clients ignoring certs sent by the server for policy reasons. A server implementation refusing to send such a cert chain to a client that doesn't include RSA+SHA1 (and blaming DigiCert for it) is equally justified than Microsoft SChannel choking on absent signature_algorithm extensions. The only reasonable interpretation of that part of rfc5246, is to completely ignore it. -Martin From nobody Fri Mar 24 13:55:47 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9337A128B44 for ; Fri, 24 Mar 2017 13:55:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mDor3EQXmRn5 for ; Fri, 24 Mar 2017 13:55:44 -0700 (PDT) Received: from mail-yw0-x22b.google.com (mail-yw0-x22b.google.com [IPv6:2607:f8b0:4002:c05::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 27F501286CA for ; Fri, 24 Mar 2017 13:55:44 -0700 (PDT) Received: by mail-yw0-x22b.google.com with SMTP id v76so1188174ywg.0 for ; Fri, 24 Mar 2017 13:55:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=B+RzYJlr5Nz5mhNeR7Yv9Tuhl7b3N5vU8R54L5gCp0k=; b=dgRvtcRFZ0RDnUy3zWfqOjGDlJK5W5EhatAGEBeaEZKIqIjglfnZEKhy/ajRD8oqTo YGYjDoxpnUwaoTzJgggR5K7SFm0AqcOFJBdQaBjWSQXkDqZbq6NJ6AOJnp6tCl/YGJLo mze55AKYm8jFFmsJ4eDOef/QjKN2YylQyqJc4P4Jioh62BWUnE8rjZJCBMqIoOG2JFy6 yOiQtEXQ7Yj5lI4qXAIoV5xd/41XLInUCsjXIIW5PwHy4hlK8w97yYwKfoGzbhp0uFaT 3p6iNYhrVdTKkHoAlJ0wXbwot3o5zwbkbHo7oaYkgIONfWzSJeKUcEVuwVw64M33KTcl 584g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=B+RzYJlr5Nz5mhNeR7Yv9Tuhl7b3N5vU8R54L5gCp0k=; b=pK2LJsq8pdRL9HDoCEA4o5OEvj9BtaN3OT3Xs5R1SzCET24GCEgo8A7hc2V/jRwLLV RnYvxvcvfUDiJdRr+XKYBNrLa5nr/7PHD0wkrYF/oe3QoiF/MhnjxWxJoAJaMTaJn7m7 tWpcDy6gMvT+/sG+R1/GJd6PCZ5WVW6LQfx6Ej5F9XoX+681PBRNWd0vx8qSH/Su0HbO rbAWbxGdpJZiRGFmrGufEotL64PcBjGYaccHghgSdHsTxuZozcfx8fh80/MTWeK0weBo wXRtFmdbGZPtfbWjvbRYiLfitj9ascZ96JYfVA16at9MeIIOqlul6V/i42pyu4/YgwZp jSgA== X-Gm-Message-State: AFeK/H0RLSuLVZtPog/gfTE6/tnoR881VizXX23rkioemRtD7/9n6VjM1HvRHFHJC65T7pOvtosIloBuQXdUKA== X-Received: by 10.129.125.5 with SMTP id y5mr7370370ywc.120.1490388943376; Fri, 24 Mar 2017 13:55:43 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Fri, 24 Mar 2017 13:55:02 -0700 (PDT) In-Reply-To: References: <20170324154440.B68281A65C@ld9781.wdf.sap.corp> From: Eric Rescorla Date: Fri, 24 Mar 2017 13:55:02 -0700 Message-ID: To: Michael StJohns Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a114936448cc759054b8037dc Archived-At: Subject: Re: [TLS] Enforcing stronger server side signature/hash combinations in TLS 1.2 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2017 20:55:46 -0000 --001a114936448cc759054b8037dc Content-Type: text/plain; charset=UTF-8 On Fri, Mar 24, 2017 at 12:30 PM, Michael StJohns wrote: > On 3/24/2017 11:44 AM, Martin Rex wrote: > >> oops, typo: >> >> Martin Rex wrote: >> >>> Actually, looking at the DigiCert issued ECC cert for www.cloudflare.com >>> I'm a little confused. >>> >>> This is the cert chain (as visualized by Microsoft CryptoAPI): >>> >>> server-cert: CN=cloudflare.com, ... >>> contains ECDSA P-256 public key >>> is allegedly signed with sha256ECDSA >>> >>> intermediate CA: CN=DigiCert ECC Extended Validation Server CA >>> contains ECDSA P-384 public key >>> is allegedly signed with sha384RSA >>> >>> root CA: CN=DigiCert High Assurance EV Root CA >>> contains RSA 2048-bit public key >>> is self-signed with sha1WithRsaEncryption >>> >>> For those who insist on reading rfc5246 verbatim, this chain requires >>> >>> ECDSA+SHA384:RSA+SHA384:RSA+SHA1 >>> >> ECDSA+SHA256:RSA+SHA384:RSA+SHA1 >> > > I don't think RSA + SHA 1 is actually required. The Signature over the > trust anchor (root CA) is basically a no-op - assuming the certificate is > in the browser(client) trust store. The trust is traced to the public key > regardless of the form in which it's provided. We use self-signed certs a > lot to carry the public keys and names (and sometimes constraints), but > that's not required by PKIX. > I agree that the text is a bit ambiguous on this point, but I tend to agree that this is the best reading. -Ekr > Mike > > > >> The digital signature on the server certificate looks bogus to me, >>> that should be a sha384ECDSA signature according to NIST, because >>> it uses a P-384 signing key. >>> >>> The signature on the intermediate CA is imbalanced, and >>> should be sha256RSA rather than sha384RSA. (that is only an interop >>> issue, >>> not a security issue). >>> >> _______________________________________________ >> TLS mailing list >> TLS@ietf.org >> https://www.ietf.org/mailman/listinfo/tls >> >> > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --001a114936448cc759054b8037dc Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Fri, Mar 24, 2017 at 12:30 PM, Michael StJohns <= ;msj@nthpermuta= tion.com> wrote:
On 3/24/2017 11:44 AM, Martin Rex wrote:
oops, typo:

Martin Rex wrote:
Actually, looking at the DigiCert issued ECC cert for www.cloudflare.com
I'm a little confused.

This is the cert chain (as visualized by Microsoft CryptoAPI):

=C2=A0 =C2=A0server-cert:=C2=A0 CN=3Dcloudflare.com, ...
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0contains ECDS= A P-256 public key
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0is allegedly = signed with sha256ECDSA

=C2=A0 =C2=A0intermediate CA:=C2=A0 CN=3DDigiCert ECC Extended Validation S= erver CA
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0contains ECDS= A P-384 public key
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0is allegedly = signed with sha384RSA

=C2=A0 =C2=A0root CA:=C2=A0 =C2=A0 =C2=A0 CN=3DDigiCert High Assurance EV R= oot CA
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0contains RSA = 2048-bit public key
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0is self-signe= d with sha1WithRsaEncryption

For those who insist on reading rfc5246 verbatim, this chain requires

=C2=A0 =C2=A0 ECDSA+SHA384:RSA+SHA384:RSA+SHA1
=C2=A0 =C2=A0 =C2=A0 ECDSA+SHA256:RSA+SHA384:RSA+SHA1

 I don't think RSA + SHA 1 is actually required.=C2=A0 =C2=A0The Signatu= re over the trust anchor (root CA) is basically a no-op - assuming the cert= ificate is in the browser(client) trust store.=C2=A0 The trust is traced to= the public key regardless of the form in which it's provided.=C2=A0 We= use self-signed certs a lot to carry the public keys and names (and someti= mes constraints), but that's not required by PKIX.

I agree that the text is a bit ambiguous on this point, but= I tend to agree that this is the best
reading.

-Ekr


Mike



The digital signature on the server certificate looks bogus to me,
that should be a sha384ECDSA signature according to NIST, because
it uses a P-384 signing key.

The signature on the intermediate CA is imbalanced, and
should be sha256RSA rather than sha384RSA. (that is only an interop issue,<= br> not a security issue).
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls


_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--001a114936448cc759054b8037dc-- From nobody Fri Mar 24 20:15:08 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5BCE1293F2 for ; Fri, 24 Mar 2017 20:15:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=augustcellars.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cRRodZeUnAag for ; Fri, 24 Mar 2017 20:15:01 -0700 (PDT) Received: from mail4.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0DA44126C7B for ; Fri, 24 Mar 2017 20:15:00 -0700 (PDT) Content-Type: multipart/alternative; boundary="----=_NextPart_000_02C8_01D2A4EC.11243B70" Content-Language: en-us DKIM-Signature: v=1; a=rsa-sha256; d=augustcellars.com; s=winery; c=simple/simple; t=1490411698; h=from:subject:to:date:message-id; bh=eIz+NcSGDaFJOFOVU4z6mnUmn1bSGHNcvCu5iRuTr3E=; b=U6INFjfMjl1wqTNGn0hwAfb9Heuz6Y5zaTQtbxEN+dElh/8s7eRq4q4F5piVS0VsxxPMLQYNfrx InH1VR1Rt01XIFvDDv1TGJGzP7KP9UqD5S/RNEz842OAkcKlC/On69n26f1VaKFWMB7HpbkvMqTuu X3avQGnb6IZumqtXB2nW22IYSSnfyPzP4L5zB1F9helZoARc/mn+l8xxgndW9lqdpMJlp1UEVGID6 A4TC4Yrw6dS5KE7cGU8NR/M6/8t5JqDekwg2tJnGLb6LULaSvPK1wTRFBEDB5Y+8U5sXVQ2mKJysY pf0idfXD49T7JPXZhnxb8w/YW4svhqF5VvRg== Received: from mail2.augustcellars.com (192.168.1.201) by mail4.augustcellars.com (192.168.1.153) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Fri, 24 Mar 2017 20:14:57 -0700 Received: from hebrews (64.134.170.36) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Fri, 24 Mar 2017 20:14:51 -0700 From: Jim Schaad To: 'Eric Rescorla' , 'Russ Housley' CC: 'IETF TLS' References: <0DA64421-5975-4B7E-BC08-7428AFA9D1A1@vigilsec.com> <9D8BEE12-49F9-4DE3-81C7-909CB114805F@vigilsec.com> <1b678d65-b146-b25f-c1ad-6dfc044f7ce0@akamai.com> <733EE968-69EF-43A5-A39B-F016993A3CCD@vigilsec.com> <949EBD4E-613B-4B36-BD93-FDE3E4D4926F@vigilsec.com> <141723AB-B4E4-4233-8C35-C720E4A7FE0C@vigilsec.com> In-Reply-To: Date: Fri, 24 Mar 2017 22:14:51 -0500 Message-ID: <02c701d2a515$f9f8bcd0$edea3670$@augustcellars.com> MIME-Version: 1.0 X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQIMlBberIjSb54gXmQ46wMOF7ui8wHJiQ+GAeMnNZECTTT6AAPLO09VAhSep+gBtUNlHQH4+aZ0AnEfSc0BdR+rkQJIfwiNoINNhkA= X-Originating-IP: [64.134.170.36] Archived-At: Subject: Re: [TLS] Using both External PSK and (EC)DH in TLS 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Mar 2017 03:15:04 -0000 ------=_NextPart_000_02C8_01D2A4EC.11243B70 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable EKR =E2=80=93 I think that is the wrong answer because of the resume = case. =20 However, I would expect that the external PSK would be appended or = otherwise munge into the computed secret (assuming DH) and would be = consumed as part of that processing. No additional slot needed. =20 jim =20 From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Eric Rescorla Sent: Friday, March 24, 2017 12:19 PM To: Russ Housley Cc: IETF TLS Subject: Re: [TLS] Using both External PSK and (EC)DH in TLS 1.3 =20 Why would the external PSK not just go into he PSK slot. =20 -Ekr =20 =20 On Fri, Mar 24, 2017 at 9:16 AM, Russ Housley > wrote: > I agree with David here. Specifically, I think. > > - The base specification should continue to forbid certificates in = combination with PSK > - We should at some point contemplate an extension that allows the use = of certificates in combination with PSK > - The base spec should be factored in such a way as to make that = extension easy. While I agree that we do not want to delay the TLS 1.3 specification to = sort this out; however, I do not think we have provided the hook to make = this future extension easy. Looking at the key schedule in -19, I = think we can provide the hook without being disruptive. My goal is to = minimize the pain to implementing the extension in the future by putting = a straightforward hook in today: 0 | v PSK -> HKDF-Extract =3D Early Secret | +-----> Derive-Secret(., | "external psk binder key" | | "resumption psk binder key", | "") | =3D binder_key | +-----> Derive-Secret(., "client early traffic secret", | ClientHello) | =3D client_early_traffic_secret | +-----> Derive-Secret(., "early exporter master = secret", | ClientHello) | =3D early_exporter_secret v Derive-Secret(., "derived secret", "") | v (EC)DHE -> HKDF-Extract =3D Handshake Secret | +-----> Derive-Secret(., "client handshake traffic = secret", | ClientHello...ServerHello) | =3D = client_handshake_traffic_secret | +-----> Derive-Secret(., "server handshake traffic = secret", | ClientHello...ServerHello) | =3D = server_handshake_traffic_secret v Derive-Secret(., "derived secret", "") | v ExtPSK OR 0 -> HKDF-Extract =3D Master Secret | +-----> Derive-Secret(., "client application traffic = secret", | ClientHello...Server Finished) | =3D client_traffic_secret_0 | +-----> Derive-Secret(., "server application traffic = secret", | ClientHello...Server Finished) | =3D server_traffic_secret_0 | +-----> Derive-Secret(., "exporter master secret", | ClientHello...Server Finished) | =3D exporter_secret | +-----> Derive-Secret(., "resumption master secret", ClientHello...Client Finished) =3D resumption_master_secret The only change is "ExtPSK OR 0=E2=80=9D in the HKDF-Extract for the = Master Secret computation. The Section 4.1.1 can call out this place for the future specification: OLD: - When authenticating via a certificate, the server will send the Certificate (Section 4.4.2) and CertificateVerify (Section 4.4.3) messages. In TLS 1.3 as defined by this document, either a PSK or a certificate is always used, but not both. Future documents may define how to use them together. NEW: - When authenticating via a certificate, the server will send the Certificate (Section 4.4.2) and CertificateVerify (Section 4.4.3) messages. In TLS 1.3 as defined by this document, either a PSK or a certificate is always used, but not both. So, the ExtPSK is not used in the key schedule (Section 7.1). Future documents may define how to use them together and tell how the ExtPSK is handled in the key schedule. Russ =20 ------=_NextPart_000_02C8_01D2A4EC.11243B70 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

EKR = =E2=80=93 I think that is the wrong answer because of the resume = case.

 

However, I = would expect that the external PSK would be appended or otherwise munge = into the computed secret (assuming DH) and would be consumed as part of = that processing.=C2=A0 No additional slot = needed.

 

jim

 

From:<= /b> = TLS [mailto:tls-bounces@ietf.org] On Behalf Of Eric = Rescorla
Sent: Friday, March 24, 2017 12:19 PM
To: = Russ Housley <housley@vigilsec.com>
Cc: IETF TLS = <tls@ietf.org>
Subject: Re: [TLS] Using both External = PSK and (EC)DH in TLS 1.3

 

Why = would the external PSK not just go into he PSK = slot.

 

-Ekr

 

 

On Fri, = Mar 24, 2017 at 9:16 AM, Russ Housley <housley@vigilsec.com> = wrote:


> I agree with David here. = Specifically, I think.
>
> - The base specification should = continue to forbid certificates in combination with PSK
> - We = should at some point contemplate an extension that allows the use of = certificates in combination with PSK
> - The base spec should be = factored in such a way as to make that extension easy.


While = I agree that we do not want to delay the TLS 1.3 specification to sort = this out; however, I do not think we have provided the hook to make this = future extension easy.   Looking at the key schedule in -19, I = think we can provide the hook without being disruptive.  My goal is = to minimize the pain to implementing the extension in the future by = putting a straightforward hook in today:

      =            0
      =            |
      =            v
   PSK = ->  HKDF-Extract =3D Early Secret
        =          |
        =          +-----> Derive-Secret(.,
  =                |    =                 =  "external psk binder key" |
      =            |        =              "resumption psk = binder key",
              =    |                =      "")
          =        |            =          =3D binder_key
      =            |
      =            +-----> Derive-Secret(., = "client early traffic secret",
        =          |          =            ClientHello)
    =              |      =                =3D = client_early_traffic_secret
            =      |
            =      +-----> Derive-Secret(., "early exporter = master secret",
              =    |                =      ClientHello)
          =        |            =          =3D early_exporter_secret
  =                v
  =          Derive-Secret(., "derived = secret", "")
            =      |
            =      v
(EC)DHE -> HKDF-Extract =3D Handshake = Secret
                =  |
                =  +-----> Derive-Secret(., "client handshake traffic = secret",
                =  |                  =    ClientHello...ServerHello)
        =          |          =            =3D = client_handshake_traffic_secret
          =        |
          =        +-----> Derive-Secret(., "server = handshake traffic secret",
          =        |            =          ClientHello...ServerHello)
  =                |    =                  =3D = server_handshake_traffic_secret
          =        v
          =  Derive-Secret(., "derived secret", = "")
                =  |
                =  v
ExtPSK OR 0 -> HKDF-Extract =3D Master Secret
  =                |
  =                +-----> = Derive-Secret(., "client application traffic = secret",
                =  |                  =    ClientHello...Server Finished)
      =            |        =              =3D = client_traffic_secret_0
            =      |
            =      +-----> Derive-Secret(., "server application = traffic secret",
            =      |              =        ClientHello...Server Finished)
  =                |    =                  =3D = server_traffic_secret_0
            =      |
            =      +-----> Derive-Secret(., "exporter master = secret",
                =  |                  =    ClientHello...Server Finished)
      =            |        =              =3D = exporter_secret
              =    |
              =    +-----> Derive-Secret(., "resumption master = secret",
                =                     =    ClientHello...Client Finished)
      =                     =              =3D = resumption_master_secret


The only change is "ExtPSK OR = 0=E2=80=9D in the HKDF-Extract for the Master Secret = computation.

The Section 4.1.1 can call out this place for the = future specification:

OLD:

   -  When = authenticating via a certificate, the server will send the
  =     Certificate (Section 4.4.2) and CertificateVerify (Section = 4.4.3)
      messages.  In TLS 1.3 as defined by = this document, either a PSK or
      a certificate is = always used, but not both.  Future documents may
    =   define how to use them together.

NEW:

  =  -  When authenticating via a certificate, the server will = send the
      Certificate (Section 4.4.2) and = CertificateVerify (Section 4.4.3)
      = messages.  In TLS 1.3 as defined by this document, either a PSK = or
      a certificate is always used, but not = both.  So, the ExtPSK is not
      used in the = key schedule (Section 7.1).  Future documents may
    =   define how to use them together and tell how the ExtPSK = is
      handled in the key schedule.

Russ

<= /p>

 

------=_NextPart_000_02C8_01D2A4EC.11243B70-- From nobody Sat Mar 25 04:41:03 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E84C5128656 for ; Sat, 25 Mar 2017 04:41:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QhNzG2P88zsp for ; Sat, 25 Mar 2017 04:41:00 -0700 (PDT) Received: from mail-yw0-x22b.google.com (mail-yw0-x22b.google.com [IPv6:2607:f8b0:4002:c05::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 26EDE12741D for ; Sat, 25 Mar 2017 04:41:00 -0700 (PDT) Received: by mail-yw0-x22b.google.com with SMTP id d191so7517084ywe.2 for ; Sat, 25 Mar 2017 04:41:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=zV3j7x1CRXtuE+li0/gjqGFhiqg8UQ1n7COXKMJA25g=; b=zvkICbeWB8jIZ3YEJkqO+8V4FPKxs6iuVZCaDynHJyZiN5RzesKJeZ1UvUvZnHNTPG I+G608n+LJq5JsedlcuvrDcT33peOMgQSmMgdKNVZGmV0Lk3YS09i3T3Mxw2mx9Y8qVE R6eCa6rAK+9Ch4Uj7VWp8T1bll4xQWeYCjaa0PRCMI3H+cfESstucNuFX4ijnmQX03+B WADTctLLNJmIvROT0sUQmXmsz7nCbZoYLTUcwQ71mgSCax9qvMQiPhHXvJEFCvniRdUE qbnM0zBx5C35E22hEmvA61Nv/uc6IG0+eWZEXqEiXno7T9tsL5R8WWrvx62rUG6mZW0Z RfGQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=zV3j7x1CRXtuE+li0/gjqGFhiqg8UQ1n7COXKMJA25g=; b=DWqOBC7oEIXYECN26nho5uU+YUAGllmI5a9S1iLitgLerPV118A6A+GQyTNpwzIYTr flfczFa93Mr7NDOF7kaw8KLeIs4zQ2LO033nLpz5B3JsuP5dTzLi8dy0MDIDayCLaO81 MZs/OV2u7E7d7pMno/+g1aoPt5nrk/2RINxXZgtlkAvtw+I8ahcOFTemO6f0sL31JVjP 3oq+lyrn6RMzhkpUgz5heExiJeHrR75CSL/1wPJRGv6k9fS+1tCr/Ckl0r3ciWHhUjmD HsjtL9lbKx3JaZWD69byoj/9dz+IVM5EY9wjG3qeaRH6MIv38YSkwxnccRRroiQHjhm/ cRZw== X-Gm-Message-State: AFeK/H0DkmFoKQrGs0c2SlB2mstridermNTpHKaUzt0GCqdo2/cWcTKY2MCiiynQCwjQ8iYA7IF3iH76aNyzQA== X-Received: by 10.129.108.214 with SMTP id h205mr9587853ywc.71.1490442059338; Sat, 25 Mar 2017 04:40:59 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Sat, 25 Mar 2017 04:40:18 -0700 (PDT) In-Reply-To: <02c701d2a515$f9f8bcd0$edea3670$@augustcellars.com> References: <0DA64421-5975-4B7E-BC08-7428AFA9D1A1@vigilsec.com> <9D8BEE12-49F9-4DE3-81C7-909CB114805F@vigilsec.com> <1b678d65-b146-b25f-c1ad-6dfc044f7ce0@akamai.com> <733EE968-69EF-43A5-A39B-F016993A3CCD@vigilsec.com> <949EBD4E-613B-4B36-BD93-FDE3E4D4926F@vigilsec.com> <141723AB-B4E4-4233-8C35-C720E4A7FE0C@vigilsec.com> <02c701d2a515$f9f8bcd0$edea3670$@augustcellars.com> From: Eric Rescorla Date: Sat, 25 Mar 2017 04:40:18 -0700 Message-ID: To: Jim Schaad Cc: Russ Housley , IETF TLS Content-Type: multipart/alternative; boundary=001a114e81dc816d01054b8c95af Archived-At: Subject: Re: [TLS] Using both External PSK and (EC)DH in TLS 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Mar 2017 11:41:02 -0000 --001a114e81dc816d01054b8c95af Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Fri, Mar 24, 2017 at 8:14 PM, Jim Schaad wrote: > EKR =E2=80=93 I think that is the wrong answer because of the resume case= . > Why? It seems like for Russ'a application, you would inject the static PSK initially and then it would be implicitly part of any resumption so no need to reinject it to obtain PQ safety. -Ekr However, I would expect that the external PSK would be appended or > otherwise munge into the computed secret (assuming DH) and would be > consumed as part of that processing. No additional slot needed. > > > > jim > > > > *From:* TLS [mailto:tls-bounces@ietf.org] *On Behalf Of *Eric Rescorla > *Sent:* Friday, March 24, 2017 12:19 PM > *To:* Russ Housley > *Cc:* IETF TLS > *Subject:* Re: [TLS] Using both External PSK and (EC)DH in TLS 1.3 > > > > Why would the external PSK not just go into he PSK slot. > > > > -Ekr > > > > > > On Fri, Mar 24, 2017 at 9:16 AM, Russ Housley > wrote: > > > > I agree with David here. Specifically, I think. > > > > - The base specification should continue to forbid certificates in > combination with PSK > > - We should at some point contemplate an extension that allows the use > of certificates in combination with PSK > > - The base spec should be factored in such a way as to make that > extension easy. > > > While I agree that we do not want to delay the TLS 1.3 specification to > sort this out; however, I do not think we have provided the hook to make > this future extension easy. Looking at the key schedule in -19, I think > we can provide the hook without being disruptive. My goal is to minimize > the pain to implementing the extension in the future by putting a > straightforward hook in today: > > 0 > | > v > PSK -> HKDF-Extract =3D Early Secret > | > +-----> Derive-Secret(., > | "external psk binder key" | > | "resumption psk binder key", > | "") > | =3D binder_key > | > +-----> Derive-Secret(., "client early traffic secret", > | ClientHello) > | =3D client_early_traffic_secret > | > +-----> Derive-Secret(., "early exporter master secret", > | ClientHello) > | =3D early_exporter_secret > v > Derive-Secret(., "derived secret", "") > | > v > (EC)DHE -> HKDF-Extract =3D Handshake Secret > | > +-----> Derive-Secret(., "client handshake traffic > secret", > | ClientHello...ServerHello) > | =3D client_handshake_traffic_secre= t > | > +-----> Derive-Secret(., "server handshake traffic > secret", > | ClientHello...ServerHello) > | =3D server_handshake_traffic_secre= t > v > Derive-Secret(., "derived secret", "") > | > v > ExtPSK OR 0 -> HKDF-Extract =3D Master Secret > | > +-----> Derive-Secret(., "client application traffic > secret", > | ClientHello...Server Finished) > | =3D client_traffic_secret_0 > | > +-----> Derive-Secret(., "server application traffic > secret", > | ClientHello...Server Finished) > | =3D server_traffic_secret_0 > | > +-----> Derive-Secret(., "exporter master secret", > | ClientHello...Server Finished) > | =3D exporter_secret > | > +-----> Derive-Secret(., "resumption master secret", > ClientHello...Client Finished) > =3D resumption_master_secret > > > The only change is "ExtPSK OR 0=E2=80=9D in the HKDF-Extract for the Mast= er Secret > computation. > > The Section 4.1.1 can call out this place for the future specification: > > OLD: > > - When authenticating via a certificate, the server will send the > Certificate (Section 4.4.2) and CertificateVerify (Section 4.4.3) > messages. In TLS 1.3 as defined by this document, either a PSK or > a certificate is always used, but not both. Future documents may > define how to use them together. > > NEW: > > - When authenticating via a certificate, the server will send the > Certificate (Section 4.4.2) and CertificateVerify (Section 4.4.3) > messages. In TLS 1.3 as defined by this document, either a PSK or > a certificate is always used, but not both. So, the ExtPSK is not > used in the key schedule (Section 7.1). Future documents may > define how to use them together and tell how the ExtPSK is > handled in the key schedule. > > Russ > > > --001a114e81dc816d01054b8c95af Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Fri, Mar 24, 2017 at 8:14 PM, Jim Schaad <ietf@augustcellars.c= om> wrote:

EKR =E2=80=93 I think that is the wrong an= swer because of the resume case.

Why? It seems like for Russ'a application, you would injec= t the static PSK initially
and then it would be implicitly part o= f any resumption so no need to reinject it
to obtain PQ safety.

-Ekr

However, I would expe= ct that the external PSK would be appended or otherwise munge into the comp= uted secret (assuming DH) and would be consumed as part of that processing.= =C2=A0 No additional slot needed.

=C2=A0

jim=

=C2=A0

From: TLS [mailto:tls-bounces@ietf.or= g] On Behalf Of Eric Rescorla
Sent: Friday, March 24, = 2017 12:19 PM
To: Russ Housley <housley@vigilsec.com>
Cc: IETF= TLS <tls@ietf.org= >
Subject: Re: [TLS] Using both External PSK and (EC)DH in TLS= 1.3

=C2=A0

Why would t= he external PSK not just go into he PSK slot.

=C2=A0

-Ekr

=C2=A0

=C2=A0

On Fri, Mar 24, 2017 at 9:16 AM, Russ Housley <housley@vigilsec.com> wrote:


> I ag= ree with David here. Specifically, I think.
>
> - The base spec= ification should continue to forbid certificates in combination with PSK> - We should at some point contemplate an extension that allows the us= e of certificates in combination with PSK
> - The base spec should be= factored in such a way as to make that extension easy.


While I = agree that we do not want to delay the TLS 1.3 specification to sort this o= ut; however, I do not think we have provided the hook to make this future e= xtension easy.=C2=A0 =C2=A0Looking at the key schedule in -19, I think we c= an provide the hook without being disruptive.=C2=A0 My goal is to minimize = the pain to implementing the extension in the future by putting a straightf= orward hook in today:

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A00
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0|
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0v
=C2=A0 =C2=A0PSK ->=C2=A0 HKDF-Extract =3D Early Secret
=C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|
=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0+-----> Derive-Secre= t(.,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0&q= uot;external psk binder key" |
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"resumption psk binder key",
= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"&qu= ot;)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =3D binder_key
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0|
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0+-= ----> Derive-Secret(., "client early traffic secret",
=C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ClientHello)<= br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=3D cl= ient_early_traffic_secret
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0|
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0+-----> Derive-Secret(., "early exporter master secret&qu= ot;,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Cl= ientHello)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0|=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0=3D early_exporter_secret
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0v
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Deriv= e-Secret(., "derived secret", "")
=C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|
=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0v
(EC)DHE -> HKDF-Extract =3D H= andshake Secret
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0|
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0+-= ----> Derive-Secret(., "client handshake traffic secret",
= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ClientHel= lo...ServerHello)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0=3D client_handshake_traffic_secret
=C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|
=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0+-----> Derive-Secret(., "ser= ver handshake traffic secret",
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ClientHello...ServerHello)
=C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=3D server_handshake_tr= affic_secret
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0v
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Derive-Secret(., &q= uot;derived secret", "")
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0v
ExtPSK OR 0 -> HKDF-Extract =3D Master Secr= et
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|
= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0+-----> De= rive-Secret(., "client application traffic secret",
=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ClientHello...Server= Finished)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0|=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0=3D client_traffic_secret_0
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0|
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0+-----> Derive-Secret(., "server application traff= ic secret",
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0|=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0ClientHello...Server Finished)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=3D server_traffic_secret_0
=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|
=C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0+-----> Derive-Secret(., &q= uot;exporter master secret",
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0ClientHello...Server Finished)
=C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=3D exporter_secret
= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|
=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0+-----> Derive-Se= cret(., "resumption master secret",
=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ClientHello...Client Finished)
= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=3D resum= ption_master_secret


The only change is "ExtPSK OR 0=E2=80= =9D in the HKDF-Extract for the Master Secret computation.

The Secti= on 4.1.1 can call out this place for the future specification:

OLD:<= br>
=C2=A0 =C2=A0-=C2=A0 When authenticating via a certificate, the serv= er will send the
=C2=A0 =C2=A0 =C2=A0 Certificate (Section 4.4.2) and Ce= rtificateVerify (Section 4.4.3)
=C2=A0 =C2=A0 =C2=A0 messages.=C2=A0 In = TLS 1.3 as defined by this document, either a PSK or
=C2=A0 =C2=A0 =C2= =A0 a certificate is always used, but not both.=C2=A0 Future documents may<= br>=C2=A0 =C2=A0 =C2=A0 define how to use them together.

NEW:
=C2=A0 =C2=A0-=C2=A0 When authenticating via a certificate, the server wil= l send the
=C2=A0 =C2=A0 =C2=A0 Certificate (Section 4.4.2) and Certific= ateVerify (Section 4.4.3)
=C2=A0 =C2=A0 =C2=A0 messages.=C2=A0 In TLS 1.= 3 as defined by this document, either a PSK or
=C2=A0 =C2=A0 =C2=A0 a ce= rtificate is always used, but not both.=C2=A0 So, the ExtPSK is not
=C2= =A0 =C2=A0 =C2=A0 used in the key schedule (Section 7.1).=C2=A0 Future docu= ments may
=C2=A0 =C2=A0 =C2=A0 define how to use them together and tell = how the ExtPSK is
=C2=A0 =C2=A0 =C2=A0 handled in the key schedule.
<= span style=3D"color:#888888">
Russ

=C2=A0

=

--001a114e81dc816d01054b8c95af-- From nobody Sat Mar 25 05:49:28 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C32BA126FB3 for ; Sat, 25 Mar 2017 05:49:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=augustcellars.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Du8xHKw9-3Pn for ; Sat, 25 Mar 2017 05:49:24 -0700 (PDT) Received: from mail4.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A1D33126D74 for ; Sat, 25 Mar 2017 05:49:24 -0700 (PDT) Content-Type: multipart/alternative; boundary="----=_NextPart_000_02D6_01D2A53C.4D95F620" Content-Language: en-us DKIM-Signature: v=1; a=rsa-sha256; d=augustcellars.com; s=winery; c=simple/simple; t=1490446161; h=from:subject:to:date:message-id; bh=onjVFTK73HnUpLoNyAat5NRjW6fiyoyp8Z7ha6MBJQ0=; b=fTuvohrgGk6UDanGCl3tCIdI9Yr+XEvKPmSmNz1j20qipZOte9mRB0XQFdGVRF2LZKrAqOGaAJE 39NZoq91/6D4i2KrwUJ20YgBF5vYjaZE1qttn4HQKnm7sLWllSoRevrRmBY9ySQKfCHLhepPkQPyB 2OmCI1Jt22bAtiZFgznpQO5RYY7vSBLlAxEY3guXALDl6euQhiOedUiIdYBMghbbOxDMK5ZdttjJt GdS77QC4bw83bsn6tDW/2UBFEZX1aR/1OeAIDeHV7NWo9Gw412jPQOXOTk+43nCAmtV63kdAeFlNJ J0gpole6QZl5UQAeUcB46OS5L4n0JmVR3oBA== Received: from mail2.augustcellars.com (192.168.1.201) by mail4.augustcellars.com (192.168.1.153) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Sat, 25 Mar 2017 05:49:20 -0700 Received: from hebrews (31.133.135.244) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Sat, 25 Mar 2017 05:49:15 -0700 From: Jim Schaad To: 'Eric Rescorla' CC: 'Russ Housley' , 'IETF TLS' References: <0DA64421-5975-4B7E-BC08-7428AFA9D1A1@vigilsec.com> <9D8BEE12-49F9-4DE3-81C7-909CB114805F@vigilsec.com> <1b678d65-b146-b25f-c1ad-6dfc044f7ce0@akamai.com> <733EE968-69EF-43A5-A39B-F016993A3CCD@vigilsec.com> <949EBD4E-613B-4B36-BD93-FDE3E4D4926F@vigilsec.com> <141723AB-B4E4-4233-8C35-C720E4A7FE0C@vigilsec.com> <02c701d2a515$f9f8bcd0$edea3670$@augustcellars.com> In-Reply-To: Date: Sat, 25 Mar 2017 07:49:12 -0500 Message-ID: <02d501d2a566$36652050$a32f60f0$@augustcellars.com> MIME-Version: 1.0 X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQIMlBberIjSb54gXmQ46wMOF7ui8wHJiQ+GAeMnNZECTTT6AAPLO09VAhSep+gBtUNlHQH4+aZ0AnEfSc0BdR+rkQJIfwiNAdSPeVcCRi9TyaBjGBbg X-Originating-IP: [31.133.135.244] Archived-At: Subject: Re: [TLS] Using both External PSK and (EC)DH in TLS 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Mar 2017 12:49:27 -0000 ------=_NextPart_000_02D6_01D2A53C.4D95F620 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable =20 =20 From: Eric Rescorla [mailto:ekr@rtfm.com]=20 Sent: Saturday, March 25, 2017 6:40 AM To: Jim Schaad Cc: Russ Housley ; IETF TLS Subject: Re: [TLS] Using both External PSK and (EC)DH in TLS 1.3 =20 =20 =20 On Fri, Mar 24, 2017 at 8:14 PM, Jim Schaad > wrote: EKR =E2=80=93 I think that is the wrong answer because of the resume = case. =20 Why? It seems like for Russ'a application, you would inject the static = PSK initially and then it would be implicitly part of any resumption so no need to = reinject it to obtain PQ safety. =20 It seems odd to me that you would want to use a different key agree = algorithm when you are doing the initial negotiation as opposed to the = resumption. Depending on how the static PSK is specified, it might = need to be restated for the resumption as well. =20 Jim =20 =20 -Ekr =20 However, I would expect that the external PSK would be appended or = otherwise munge into the computed secret (assuming DH) and would be = consumed as part of that processing. No additional slot needed. =20 jim =20 From: TLS [mailto:tls-bounces@ietf.org ] = On Behalf Of Eric Rescorla Sent: Friday, March 24, 2017 12:19 PM To: Russ Housley > Cc: IETF TLS > Subject: Re: [TLS] Using both External PSK and (EC)DH in TLS 1.3 =20 Why would the external PSK not just go into he PSK slot. =20 -Ekr =20 =20 On Fri, Mar 24, 2017 at 9:16 AM, Russ Housley > wrote: > I agree with David here. Specifically, I think. > > - The base specification should continue to forbid certificates in = combination with PSK > - We should at some point contemplate an extension that allows the use = of certificates in combination with PSK > - The base spec should be factored in such a way as to make that = extension easy. While I agree that we do not want to delay the TLS 1.3 specification to = sort this out; however, I do not think we have provided the hook to make = this future extension easy. Looking at the key schedule in -19, I = think we can provide the hook without being disruptive. My goal is to = minimize the pain to implementing the extension in the future by putting = a straightforward hook in today: 0 | v PSK -> HKDF-Extract =3D Early Secret | +-----> Derive-Secret(., | "external psk binder key" | | "resumption psk binder key", | "") | =3D binder_key | +-----> Derive-Secret(., "client early traffic secret", | ClientHello) | =3D client_early_traffic_secret | +-----> Derive-Secret(., "early exporter master = secret", | ClientHello) | =3D early_exporter_secret v Derive-Secret(., "derived secret", "") | v (EC)DHE -> HKDF-Extract =3D Handshake Secret | +-----> Derive-Secret(., "client handshake traffic = secret", | ClientHello...ServerHello) | =3D = client_handshake_traffic_secret | +-----> Derive-Secret(., "server handshake traffic = secret", | ClientHello...ServerHello) | =3D = server_handshake_traffic_secret v Derive-Secret(., "derived secret", "") | v ExtPSK OR 0 -> HKDF-Extract =3D Master Secret | +-----> Derive-Secret(., "client application traffic = secret", | ClientHello...Server Finished) | =3D client_traffic_secret_0 | +-----> Derive-Secret(., "server application traffic = secret", | ClientHello...Server Finished) | =3D server_traffic_secret_0 | +-----> Derive-Secret(., "exporter master secret", | ClientHello...Server Finished) | =3D exporter_secret | +-----> Derive-Secret(., "resumption master secret", ClientHello...Client Finished) =3D resumption_master_secret The only change is "ExtPSK OR 0=E2=80=9D in the HKDF-Extract for the = Master Secret computation. The Section 4.1.1 can call out this place for the future specification: OLD: - When authenticating via a certificate, the server will send the Certificate (Section 4.4.2) and CertificateVerify (Section 4.4.3) messages. In TLS 1.3 as defined by this document, either a PSK or a certificate is always used, but not both. Future documents may define how to use them together. NEW: - When authenticating via a certificate, the server will send the Certificate (Section 4.4.2) and CertificateVerify (Section 4.4.3) messages. In TLS 1.3 as defined by this document, either a PSK or a certificate is always used, but not both. So, the ExtPSK is not used in the key schedule (Section 7.1). Future documents may define how to use them together and tell how the ExtPSK is handled in the key schedule. Russ =20 =20 ------=_NextPart_000_02D6_01D2A53C.4D95F620 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

 

 

From:<= /b> = Eric Rescorla [mailto:ekr@rtfm.com]
Sent: Saturday, March 25, = 2017 6:40 AM
To: Jim Schaad = <ietf@augustcellars.com>
Cc: Russ Housley = <housley@vigilsec.com>; IETF TLS = <tls@ietf.org>
Subject: Re: [TLS] Using both External = PSK and (EC)DH in TLS 1.3

 

 

 

On Fri, = Mar 24, 2017 at 8:14 PM, Jim Schaad <ietf@augustcellars.com> = wrote:

EKR = =E2=80=93 I think that is the wrong answer because of the resume = case.

 

Why? It seems like for Russ'a application, you would = inject the static PSK initially

and then it would be implicitly part of any resumption = so no need to reinject it

to obtain PQ safety.

 

It seems odd = to me that you would want to use a different key agree algorithm when = you are doing the initial negotiation as opposed to the = resumption.=C2=A0 =C2=A0Depending on how the static PSK is specified, it = might need to be restated for the resumption as = well.

 

Jim

 

 

-Ekr

 

However, I = would expect that the external PSK would be appended or otherwise munge = into the computed secret (assuming DH) and would be consumed as part of = that processing.  No additional slot = needed.

 =

jim

 =

From:<= /b> = TLS [mailto:tls-bounces@ietf.org] On Behalf Of Eric = Rescorla
Sent: Friday, March 24, 2017 12:19 PM
To: = Russ Housley <housley@vigilsec.com>
Cc: IETF TLS = <tls@ietf.org>
Subject: Re: [TLS] = Using both External PSK and (EC)DH in TLS = 1.3

 <= /o:p>

Why would = the external PSK not just go into he PSK slot.

 <= /o:p>

-Ekr

 <= /o:p>

 <= /o:p>

On Fri, Mar = 24, 2017 at 9:16 AM, Russ Housley <housley@vigilsec.com> = wrote:


> I agree = with David here. Specifically, I think.
>
> - The base = specification should continue to forbid certificates in combination with = PSK
> - We should at some point contemplate an extension that = allows the use of certificates in combination with PSK
> - The = base spec should be factored in such a way as to make that extension = easy.


While I agree that we do not want to delay the TLS 1.3 = specification to sort this out; however, I do not think we have provided = the hook to make this future extension easy.   Looking at the = key schedule in -19, I think we can provide the hook without being = disruptive.  My goal is to minimize the pain to implementing the = extension in the future by putting a straightforward hook in = today:

                =  0
                =  |
                =  v
   PSK ->  HKDF-Extract =3D Early = Secret
                =  |
                =  +-----> Derive-Secret(.,
          =        |            =          "external psk binder key" = |
                =  |                  =    "resumption psk binder key",
    =              |      =               =  "")
              =    |                =      =3D binder_key
          =        |
          =        +-----> Derive-Secret(., "client = early traffic secret",
            =      |              =        ClientHello)
        =          |          =            =3D = client_early_traffic_secret
            =      |
            =      +-----> Derive-Secret(., "early exporter = master secret",
              =    |                =      ClientHello)
          =        |            =          =3D early_exporter_secret
  =                v
  =          Derive-Secret(., "derived = secret", "")
            =      |
            =      v
(EC)DHE -> HKDF-Extract =3D Handshake = Secret
                =  |
                =  +-----> Derive-Secret(., "client handshake traffic = secret",
                =  |                  =    ClientHello...ServerHello)
        =          |          =            =3D = client_handshake_traffic_secret
          =        |
          =        +-----> Derive-Secret(., "server = handshake traffic secret",
          =        |            =          ClientHello...ServerHello)
  =                |    =                  =3D = server_handshake_traffic_secret
          =        v
          =  Derive-Secret(., "derived secret", = "")
                =  |
                =  v
ExtPSK OR 0 -> HKDF-Extract =3D Master Secret
  =                |
  =                +-----> = Derive-Secret(., "client application traffic = secret",
                =  |                  =    ClientHello...Server Finished)
      =            |        =              =3D = client_traffic_secret_0
            =      |
            =      +-----> Derive-Secret(., "server application = traffic secret",
            =      |              =        ClientHello...Server Finished)
  =                |    =                  =3D = server_traffic_secret_0
            =      |
            =      +-----> Derive-Secret(., "exporter master = secret",
                =  |                  =    ClientHello...Server Finished)
      =            |        =              =3D = exporter_secret
              =    |
              =    +-----> Derive-Secret(., "resumption master = secret",
                =                     =    ClientHello...Client Finished)
      =                     =              =3D = resumption_master_secret


The only change is "ExtPSK OR = 0=E2=80=9D in the HKDF-Extract for the Master Secret = computation.

The Section 4.1.1 can call out this place for the = future specification:

OLD:

   -  When = authenticating via a certificate, the server will send the
  =     Certificate (Section 4.4.2) and CertificateVerify (Section = 4.4.3)
      messages.  In TLS 1.3 as defined by = this document, either a PSK or
      a certificate is = always used, but not both.  Future documents may
    =   define how to use them together.

NEW:

  =  -  When authenticating via a certificate, the server will = send the
      Certificate (Section 4.4.2) and = CertificateVerify (Section 4.4.3)
      = messages.  In TLS 1.3 as defined by this document, either a PSK = or
      a certificate is always used, but not = both.  So, the ExtPSK is not
      used in the = key schedule (Section 7.1).  Future documents may
    =   define how to use them together and tell how the ExtPSK = is
      handled in the key schedule.

Russ=

 <= /o:p>

 

------=_NextPart_000_02D6_01D2A53C.4D95F620-- From nobody Sat Mar 25 06:52:25 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C3D712441E for ; Sat, 25 Mar 2017 06:52:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cSuEGYYBXV_s for ; Sat, 25 Mar 2017 06:52:21 -0700 (PDT) Received: from welho-filter1.welho.com (welho-filter1.welho.com [83.102.41.23]) by ietfa.amsl.com (Postfix) with ESMTP id B2063126DFB for ; Sat, 25 Mar 2017 06:52:21 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter1.welho.com (Postfix) with ESMTP id 02D431EEE4; Sat, 25 Mar 2017 15:52:19 +0200 (EET) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp1.welho.com ([IPv6:::ffff:83.102.41.84]) by localhost (welho-filter1.welho.com [::ffff:83.102.41.23]) (amavisd-new, port 10024) with ESMTP id 2yG0aigCubxy; Sat, 25 Mar 2017 15:52:18 +0200 (EET) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp1.welho.com (Postfix) with ESMTPSA id B1500C4; Sat, 25 Mar 2017 15:52:18 +0200 (EET) Date: Sat, 25 Mar 2017 15:52:17 +0200 From: Ilari Liusvaara To: Russ Housley Cc: Eric Rescorla , IETF TLS Message-ID: <20170325135217.GA19918@LK-Perkele-V2.elisa-laajakaista.fi> References: <0DA64421-5975-4B7E-BC08-7428AFA9D1A1@vigilsec.com> <9D8BEE12-49F9-4DE3-81C7-909CB114805F@vigilsec.com> <1b678d65-b146-b25f-c1ad-6dfc044f7ce0@akamai.com> <733EE968-69EF-43A5-A39B-F016993A3CCD@vigilsec.com> <949EBD4E-613B-4B36-BD93-FDE3E4D4926F@vigilsec.com> <141723AB-B4E4-4233-8C35-C720E4A7FE0C@vigilsec.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <141723AB-B4E4-4233-8C35-C720E4A7FE0C@vigilsec.com> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Subject: Re: [TLS] Using both External PSK and (EC)DH in TLS 1.3 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Mar 2017 13:52:24 -0000 On Fri, Mar 24, 2017 at 12:16:48PM -0400, Russ Housley wrote: > > > I agree with David here. Specifically, I think. > > > > - The base specification should continue to forbid certificates in combination with PSK > > - We should at some point contemplate an extension that allows the use of certificates in combination with PSK > > - The base spec should be factored in such a way as to make that extension easy. > > While I agree that we do not want to delay the TLS 1.3 specification > to sort this out; however, I do not think we have provided the hook > to make this future extension easy. Looking at the key schedule in > -19, I think we can provide the hook without being disruptive. My > goal is to minimize the pain to implementing the extension in the > future by putting a straightforward hook in today: Unless you have fairly good idea about how such extension would look (especially security properties!), I think it is premature to specify where the key will go (if it doesn't go there, you got problems). At least from what I know about my implementation, adding new keys to be injected in present spots is easy (after one has computed the value, it is one method call to inject it). Actually changing what keys are derived from each stage or creating new stages is of course expensive. Currently, there are three stages in key schedule. - 0-RTT (Binders, 0-RTT keys and 0-RTT exporters). - Handshake (handshake keys, finished) - Application (application keys, exporters and dynamic PSKs). In comparision, new handshake message would be far more expensive code-wise, even if I could piggyback main handshake states like with CertificateRequest. And something that actually changes the main state machine would be far more expensive still. And extension specs are only really bound by TLS offer-answer rules. The rest is matter of how difficult the extensions are actually to implement, and how much security problems they have... -Ilari From nobody Sun Mar 26 11:15:55 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B916612704A for ; Sun, 26 Mar 2017 11:15:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id znZ7tToQQwlM for ; Sun, 26 Mar 2017 11:15:52 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4E41D126C25 for ; Sun, 26 Mar 2017 11:15:52 -0700 (PDT) Received: from pps.filterd (m0050093.ppops.net [127.0.0.1]) by m0050093.ppops.net-00190b01. (8.16.0.20/8.16.0.20) with SMTP id v2QI7DaA003448 for ; Sun, 26 Mar 2017 19:15:50 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : reply-to : content-type : mime-version; s=jan2016.eng; bh=yJb3bfTmMh9n0LWQ7Zy1fbXp/RCOpr7eGjxz+5pfccg=; b=gUt7VoBdOxc41fYJXZU3cGJ/EpsWq9g/vGOMMfWUFzXflnDHzMCB7C00gawuyIbOFdST ee4M5v3nraB64pPWI37/5ysI9akhnY8vNSQsZT7M0jIsbjNzGi0laNczikqN52dfXyEz Eeq1GlASAs4SKIPGmsvrP20S1YGgTMVI0QJqIpoGRdHdvPo93ak3p8BdEOovOjx3MfFB zqxqxgjdcJffdEAaNtgTqngARqWHOVgyrcZtuxU7tz0Cs4NRfTp9hSnpJfsCQ/h4RQdW vDQJV5D/ywa66PFUdBT/Ycu5Cj7gmt/ORrMEhd0nHjDmqxhT9OHsUEhiWKhsFdc7lNob Ug== Received: from prod-mail-ppoint1 (a184-51-33-18.deploy.static.akamaitechnologies.com [184.51.33.18] (may be forged)) by m0050093.ppops.net-00190b01. with ESMTP id 29dgpqntsf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Sun, 26 Mar 2017 19:15:49 +0100 Received: from pps.filterd (prod-mail-ppoint1.akamai.com [127.0.0.1]) by prod-mail-ppoint1.akamai.com (8.16.0.17/8.16.0.17) with SMTP id v2QIB6Nv017542 for ; Sun, 26 Mar 2017 14:15:48 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.32]) by prod-mail-ppoint1.akamai.com with ESMTP id 29dkvugft5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Sun, 26 Mar 2017 14:15:48 -0400 Received: from USMA1EX-EXJRNL1.msg.corp.akamai.com (172.27.123.99) by usma1ex-dag1mb2.msg.corp.akamai.com (172.27.123.102) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Sun, 26 Mar 2017 14:15:47 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by USMA1EX-EXJRNL1.msg.corp.akamai.com (172.27.123.99) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Sun, 26 Mar 2017 14:15:47 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1178.000; Sun, 26 Mar 2017 14:15:47 -0400 From: "Salz, Rich" To: TLS WG Thread-Topic: OpenSSL licensing change Thread-Index: AdKmXLkmx4KSGA6kR3e8Oo107H7Klw== Date: Sun, 26 Mar 2017 18:15:46 +0000 Message-ID: <7912673eed38476ba1aa6139b136945b@usma1ex-dag1mb1.msg.corp.akamai.com> Reply-To: "license@openssl.org" Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.43.69] Content-Type: multipart/alternative; boundary="_000_7912673eed38476ba1aa6139b136945busma1exdag1mb1msgcorpak_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-26_15:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703260168 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-26_15:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703260168 Archived-At: Subject: [TLS] OpenSSL licensing change X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Mar 2017 18:15:54 -0000 --_000_7912673eed38476ba1aa6139b136945busma1exdag1mb1msgcorpak_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable As part of our effort to reach everyone who might have contributed code to = OpenSSL, I am posting this brief note here, with the permission of the chai= rs. Please forward as appropriate. If you have questions, issues, or disc= ussions about the licensing effort, please see the links in the blog post, = and don't post them here. We are working to change OpenSSL to the Apache v2 license. For details see= here: https://license.openssl.org https://www.openssl.org/blog/blog/2017/03/22/license/ Thanks. -- Senior Architect, Akamai Technologies Member, OpenSSL Dev Team IM: richsalz@jabber.at Twitter: RichSalz --_000_7912673eed38476ba1aa6139b136945busma1exdag1mb1msgcorpak_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

As part of our effort to reach everyone who might= have contributed code to OpenSSL, I am posting this brief note here, with = the permission of the chairs.  Please forward as appropriate.  If= you have questions, issues, or discussions about the licensing effort, please see the links in the blog post, and don= ’t post them here.

 

We are working to change OpenSSL to the Apache v2= license.  For details see here:

https://l= icense.openssl.org

https://www.openssl.org/blog/blog/2017/03/22/license/<= o:p>

 

Thanks.

 

-- 

Senior Architect, Akamai Technologies

Member, OpenSSL Dev Team

IM: richsalz@jabber.at Twitter: RichSalz<= /p>

 

--_000_7912673eed38476ba1aa6139b136945busma1exdag1mb1msgcorpak_-- From nobody Mon Mar 27 00:47:40 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60B8912949B for ; Mon, 27 Mar 2017 00:47:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tOLPQYu0ombL for ; Mon, 27 Mar 2017 00:47:34 -0700 (PDT) Received: from smtp.ssi.gouv.fr (smtp.ssi.gouv.fr [86.65.182.16]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C5D351293DA for ; Mon, 27 Mar 2017 00:47:34 -0700 (PDT) Received: from smtp-switch.internet.local (smtp-switch [192.168.3.9]) by smtp.ssi.gouv.fr (Postfix) with ESMTP id D074590B8E2 for ; Mon, 27 Mar 2017 09:46:32 +0200 (CEST) To: tls@ietf.org References: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> From: Olivier Levillain X-Enigmail-Draft-Status: N1110 Message-ID: <58D8C395.8090707@ssi.gouv.fr> Date: Mon, 27 Mar 2017 09:47:33 +0200 User-Agent: MIME-Version: 1.0 In-Reply-To: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [TLS] WGLC: draft-ietf-tls-tls13-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 07:47:38 -0000 Hi list, I think there is at least another issue that still needs to be discussed: how to properly handle post-handshake handshake messages. The subject has also been raised several times on GitHub (https://github.com/tlswg/tls13-spec/pull/680, https://github.com/tlswg/tls13-spec/pull/676, https://github.com/tlswg/tls13-spec/issues/572) and on the mailing list (https://www.ietf.org/mail-archive/web/tls/current/msg22038.html). Bottom line is: - handling client late authentication requires a lot of state in the client stack - currently, handling client late authentication is mandatory For a longer version, post-handshake records of type Handshake can be of three kinds: - NewSessionTicket (sent by the server, and that can safely be ignored entirely by clients) - KeyUpdate (sent by either party, requiring only a bit of state) - CertificateRequest (sent by the server, an arbirary number of times, and requring the client to keep some state *for each request*) Of course, this last item makes the post-handshake client state machine explode, whereas the first two items can ben implemented in a trivial way. The client can not indeed ignore all this state to answer, since it is supposed to answer at least with a Finished message, which will cover the CertificateRequest message. Moreover, since each of these Finished messages must cover the initial handshake and the current CertificateRequest message, it requires a forkable hash implementation, which requires more memory. A client _could_ ignore CertificateRequest and never answer them, but this would not really be conformant, and it would be problematic as soon as the parties need to send Handshake messages. Thus, I believe the current text is inadequate. Different solutions are possible : - remove client late authentication entirely (this would have my preference, since it introduces other issues*) - make client late authentication optional (compatible clients would signal it as an extension) - rethink the client late authentication, as was done with KeyUpdate, to limit the state required on the client side. Best regards, Olivier Levillain * One of these issues is that requiring Client Authentication upon an applicative request may lead a client to have to write records on a SSL_read call : 1) client and server complete the handshake 2) client sends a request (SSL_write) 3) server reads the request, decides an authentication is required, and sends a CR 4) client reads the response (SSL_read), but has first to comply with the CR (that is write packets) to get the response This violation of the network layers can be dealt with (and has been, since Apache allows eactly this kind of flow) but it introduces complexity in the code, which I belive we should remove altogether : an application request should not trigger an SSL authentication request. What was done with KeyUpdate sanitized a similar situation. From nobody Mon Mar 27 10:28:16 2017 Return-Path: X-Original-To: tls@ietf.org Delivered-To: tls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8EED312943B; Mon, 27 Mar 2017 10:28:08 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.48.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <149063568856.30490.16941844136725579077@ietfa.amsl.com> Date: Mon, 27 Mar 2017 10:28:08 -0700 Archived-At: Subject: [TLS] I-D Action: draft-ietf-tls-dnssec-chain-extension-03.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Mar 2017 17:28:09 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Transport Layer Security of the IETF. Title : A DANE Record and DNSSEC Authentication Chain Extension for TLS Authors : Melinda Shore Richard Barnes Shumon Huque Willem Toorop Filename : draft-ietf-tls-dnssec-chain-extension-03.txt Pages : 15 Date : 2017-03-27 Abstract: This draft describes a new TLS extension for transport of a DNS record set serialized with the DNSSEC signatures needed to authenticate that record set. The intent of this proposal is to allow TLS clients to perform DANE authentication of a TLS server certificate without needing to perform additional DNS record lookups. It will typically not be used for general DNSSEC validation of TLS endpoint names. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-tls-dnssec-chain-extension/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-tls-dnssec-chain-extension-03 https://datatracker.ietf.org/doc/html/draft-ietf-tls-dnssec-chain-extension-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-tls-dnssec-chain-extension-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Mar 27 23:25:43 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C0BE1296CD for ; Mon, 27 Mar 2017 23:25:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4YCl2n6ImHGQ for ; Mon, 27 Mar 2017 23:25:33 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [IPv6:2620:100:9005:57f::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6CC4E1296A0 for ; Mon, 27 Mar 2017 23:25:33 -0700 (PDT) Received: from pps.filterd (m0050096.ppops.net [127.0.0.1]) by m0050096.ppops.net-00190b01. (8.16.0.20/8.16.0.20) with SMTP id v2S6PDsp018723; Tue, 28 Mar 2017 07:25:32 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=1ow9E+5r1CefCtTOLkK3sR+q7BfqoYJ3pck8p940iPM=; b=GH3gCGmDTnEQA0KI/VvZE31YCT7aJeusdNqku+srGRyjVGUmrFqKBjSVXBJMfGOYMJI2 MwMqOEqnOUoAXs+t0rWVKt1SeXAGSnxmZpH9rETG4WMkdtr7mj9f4GJUyCp3qpIGgTzd o3cA1wcoBIwZxoAQ9QXTPjBUxWTJtjC/KkmKrN12fn2GkatMGOREmtXc3liGY2hos64j XJdtPr8x1inQ1iKpxQCsRWD29Gfvz8oLvw8/z4CIYC82kjzj2IbnHHJ0qR5xCgx+wlsR NNG1VOnmlVRsLtSC4u6qO7SWGCLNFdWlurC7mTkKEWCJRaPPuVjYUBClwaYLDakYWomN Uw== Received: from prod-mail-ppoint4 ([96.6.114.87]) by m0050096.ppops.net-00190b01. with ESMTP id 29fjhq002j-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 28 Mar 2017 07:25:31 +0100 Received: from pps.filterd (prod-mail-ppoint4.akamai.com [127.0.0.1]) by prod-mail-ppoint4.akamai.com (8.16.0.17/8.16.0.17) with SMTP id v2S6O3K5005183; Tue, 28 Mar 2017 02:25:31 -0400 Received: from email.msg.corp.akamai.com ([172.27.25.34]) by prod-mail-ppoint4.akamai.com with ESMTP id 29fjex003a-11 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Tue, 28 Mar 2017 02:25:31 -0400 Received: from USTX2EX-DAG1LAG.msg.corp.akamai.com (172.27.27.106) by ustx2ex-dag1mb1.msg.corp.akamai.com (172.27.27.101) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Tue, 28 Mar 2017 01:23:33 -0500 Received: from ustx2ex-dag1mb6.msg.corp.akamai.com (172.27.27.107) by ustx2ex-dag1lag.msg.corp.akamai.com (172.27.27.106) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Tue, 28 Mar 2017 01:23:33 -0500 Received: from ustx2ex-dag1mb6.msg.corp.akamai.com ([172.27.27.107]) by ustx2ex-dag1mb6.msg.corp.akamai.com ([172.27.27.107]) with mapi id 15.00.1178.000; Mon, 27 Mar 2017 23:23:33 -0700 From: "Kaduk, Ben" To: Sean Turner , "" Thread-Topic: [TLS] WGLC: draft-ietf-tls-tls13-19 Thread-Index: AQHSnB+ik/D18tmssUmt9kJ4fbJaiKGqAOwA Date: Tue, 28 Mar 2017 06:23:33 +0000 Message-ID: <228B1CCF-088B-4F4C-B2FD-A20036B9224A@akamai.com> References: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> In-Reply-To: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.33.24] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-28_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703280061 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-28_05:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703280061 Archived-At: Subject: Re: [TLS] WGLC: draft-ietf-tls-tls13-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 06:25:35 -0000 T24gMy8xMy8xNywgMTI6MzAsICJTZWFuIFR1cm5lciIgPHNlYW5Ac24zcmQuY29tPiB3cm90ZToN Cg0KICAgIFRoaXMgaXMgYSB3b3JraW5nIGdyb3VwIGxhc3QgY2FsbCBhbm5vdW5jZW1lbnQgZm9y IGRyYWZ0LWlldGYtdGxzLXRsczEzLTE5LCB0byBydW4gdGhyb3VnaCBNYXJjaCAyNy4gIFBsZWFz ZSBzZW5kIHlvdXIgcmV2aWV3cyB0byB0aGUgbGlzdCBhcyBzb29uIGFzIHBvc3NpYmxlIHNvIHdl IGNhbiBwcmVwYXJlIGZvciBhbnkgZGlzY3Vzc2lvbiBvZiBvcGVuIGlzc3VlcyBhdCBJRVRGIDk4 IGluIENoaWNhZ28uICANCg0KQXMgdGhlIHByaWNlIG9mIHJ1bm5pbmcgdGhlIFdHTEMgcmlnaHQg ZHVyaW5nIHRoZSBtZWV0aW5nIGxlYWQtdXAsIG15IHJldmlldyBjb21lcyBpbiBhdCB0aGUgbGFz dCBtaW51dGUuDQoNCkdlbmVyYWxseSwgaXQgaXMgaW4gZ29vZCBzaGFwZS4gIEkgdGhpbmsgSSBz dGlsbCBvd2Ugc29tZSB0ZXh0IGFib3V0IHdoYXQgd2UgYWltIGZvciBhbmQgZXhwZWN0IHRvIGFj aGlldmUgd2l0aCByZXNwZWN0IHRvIHNpZGUgY2hhbm5lbCByZXNpc3RhbmNlLCB0aG91Z2ggYXQg dGhpcyBwb2ludCBpdCBtYXkgYmUgdG9vIGxhdGUgdG8gZ2V0IHRoYXQgdGV4dCBpbiA6KA0KDQpU aGUgZm9sbG93aW5nIGlzIGJhc2ljYWxseSBhIGxhdW5kcnkgbGlzdCBvZiB0aGUgbWlub3IgaXNz dWVzOyBJIHdpbGwgc2VuZCBlZGl0b3JpYWwgbm90ZXMgdW5kZXIgc2VwYXJhdGUgY292ZXIsIHBy b2JhYmx5IGFzIGEgcHVsbCByZXF1ZXN0Lg0KDQpJdCB3YXMgYWxyZWFkeSBtZW50aW9uZWQgdGhh dCB0aGUg4oCcbWFqb3IgZGlmZmVyZW5jZXMgZnJvbSBUTFMgMS4y4oCdIHNlY3Rpb24gc2hvdWxk IG5vdCBiZSBhIGNoYW5nZWxvZywgYnV0IEkgYWdyZWUgd2l0aCB0aGF0Lg0KDQpTaG91bGQgRmln dXJlIDQgKOKAnG1lc3NhZ2UgZmxvdyBmb3IgYSB6ZXJvIHJvdW5kIHRyaXAgaGFuZHNoYWtl4oCd KSBpbmNsdWRlIGEg4oCcKyBlYXJseV9kYXRh4oCdIGZvciB0aGUgc2VydmVy4oCZcyBmbGlnaHQ/ ICAoVGhlIGxlZ2VuZCBmb3IgRmlndXJlIDQgYWxzbyBsYWNrcyB0aGUgZXhwbGFuYXRpb24gZm9y IHRoZSDigJgr4oCZIHN5bWJvbC4pDQoNClRoZSBsYW5ndWFnZSBvbiBwYWdlIDMwIGlzIHBlcmhh cHMgdW5jbGVhcjoNCg0KICAgQmVjYXVzZSBUTFMgMS4zIGZvcmJpZHMgcmVuZWdvdGlhdGlvbiwg aWYgYSBzZXJ2ZXIgcmVjZWl2ZXMgYQ0KICAgQ2xpZW50SGVsbG8gYXQgYW55IG90aGVyIHRpbWUs IGl0IE1VU1QgdGVybWluYXRlIHRoZSBjb25uZWN0aW9uLg0KDQpJcyB0aGF0IGFueSBUTFMgc2Vy dmVyLCBvciBqdXN0IG9uZSB0aGF0IGhhcyBuZWdvdGlhdGVkIGFuZCBpcyB1c2luZyBUTFMgMS4z Pw0KDQpJbiB0aGUgZGVzY3JpcHRpb24gb2YgbGVnYWN5X2NvbXByZXNzaW9uX21ldGhvZHMgb24g cGFnZSAzMSwgd2UgbWFrZSByZXN0cmljdGlvbnMgb24g4oCcZXZlcnkgVExTIDEuMyBDbGllbnRI ZWxsb+KAnSwgYnV0IGRvIG5vdCBzYXkgaG93IHN1Y2ggdGhpbmdzIGFyZSBpZGVudGlmaWVkLiAg KEhtbSwgbWF5YmUgd2UgYWxzbyBkbyBzbyBlbHNld2hlcmUgaW4gdGhlIGRvY3VtZW50LCB0b28s IG5vdyB0aGF0IEkgc2VhcmNoIGZvciB3aGVyZSkgIHdlIGV4cGxpY2l0bHkgZGVmaW5lIHdoYXQg YSBjbGllbnQg4oCcY29uc2lkZXJlZCB0byBiZSBhdHRlbXB0aW5nIHRvIG5lZ290aWF0ZSB1c2lu ZyB0aGlzIHNwZWNpZmljYXRpb24gKGkuZS4sIGEgVExTIDEuMyBDbGllbnRIRWVsbG8pIG9uIHBh Z2UgODcsIGFzIHN1cHBvcnRlZF92ZXJzaW9ucyBpbmNsdWRpbmcgMS4zLiAgV2hpY2gsIGlzIG1h eWJlIG5vdCB0aGUgbW9zdCBmdXR1cmUtcHJvb2YgdGhpbmcuDQoNClRoZSBkZXNjcmlwdGlvbiBv ZiB2ZXJzaW9uIG5lZ290aWF0aW9uICh0byBwb3B1bGF0ZSBTZXJ2ZXJIZWxsby52ZXJzaW9uKSBv biBwYWdlIDMyIHNlZW1zIHRvIGxlYXZlIHVuZGVmaW5lZCB3aGF0IHRoZSBzZXJ2ZXIgc2hvdWxk IGRvIHdoZW4gcmVjZWl2aW5nIGEgQ2xpZW50SGVsbG8gdGhhdCBkb2VzIG5vdCBjb250YWluIGEg c3VwcG9ydGVkX3ZlcnNpb25zIGV4dGVuc2lvbi4gIChBbHNvLCBJIGRvbuKAmXQgdGhpbmsg4oCc Q2xpZW50SGVsbG8uc3VwcG9ydGVkX3ZlcnNpb25zIGV4dGVuc2lvbuKAnSBpcyBhIHdlbGwtZGVm aW5lZCBzeW50YXguKQ0KDQpXaGVuIGNvdmVyaW5nIHRoZSBzZXJ2ZXJfcmFuZG9tIHZlcnNpb24g ZG93bmdyYWRlIHNlbnRpbmVscywgd2UgZG8gbm90IG1lbnRpb24gd2hhdCBpcyB0byBiZSBkb25l IHdoZW4gZG93bmdyYWRpbmcgdG8gVExTIDEuMCwgd2hpY2ggSSB0aG91Z2h0IHdhcyBzdGlsbCBh IHBlcm1pdHRlZCB2ZXJzaW9uIGJ5IHRoaXMgc3BlYy4NCg0KSXTigJlzIGEgbGl0dGxlIG9kZCB0 aGF0IHdlIGxpc3QgaW4gZW51bSBFeHRlbnNpb25UeXBlIG9uIHBhZ2UgMzUgYSBzdHJpY3Qgc3Vi c2V0IG9mIHRoZSBleHRlbnNpb25zIGVudW1lcmF0ZWQgaW4gdGhlIHRhYmxlIG9uIHRoZSBmb2xs b3dpbmcgcGFnZXMuDQoNCkRvIHdlIHdhbnQgdG8gYWRkIHNvbWUgY29tbWVudGFyeSBhYm91dCB0 aGUgZXh0YW50IFNIQTEgY29sbGlzaW9ucyB3aGVuIHdlIHNheSB0aGF0IHtyc2FfcGtjczEsZHNh LGVjZHNhfV9zaGExIGFyZSBvbmx5IFNIT1VMRCBOT1Q/DQoNCknigJlsbCBub3RlIHRoYXQgd2Ug ZGVmaW5lIDI1NiBwcml2YXRlIHVzZSBFQ0RIRSBncm91cCBjb2RlIHBvaW50cyBidXQgb25seSBm b3VyIHN1Y2ggRkZESEUgZ3JvdXAgY29kZSBwb2ludHMuICBQcm9iYWJseSBmaW5lLCBidXQgYSBi aXQgc3VycHJpc2luZy4NCg0KU2hvdWxkIHdlIGZvcmJpZCBkdXBsaWNhdGUgZW50cmllcyBpbiBQ cmVTaGFyZWRLZXlFeHRlbnNpb24uaWRlbnRpdGllcz8NCg0KQ29udmVyc2VseSwgd2UgbWlnaHQg d2FudCB0byBleHBsaWNpdGx5IHNheSB0aGF0IGR1cGxpY2F0ZSBPSURGaWx0ZXIuY2VydGlmaWNh dGVfZXh0ZW5zaW9uX29pZCBmaWVsZHMgc2hvdWxkIGJlIGV4cGVjdGVkIGluIE9JREZpbHRlckV4 dGVuc2lvbnMsIHRvIGVuYWJsZSB0aGUgY2FzZSB3aGVyZSBtdWx0aXBsZSB2YWx1ZXMgbXVzdCBi ZSBwcmVzZW50LiAgT3IgaXMgdGhhdCBzdXBwb3NlZCB0byB3b3JrIGJ5IGNvbmNhdGVuYXRpbmco PykgdGhlIG11bHRpcGxlIHZhbHVlc+KAmSBERVIgZW5jb2RpbmdzIGluIHRoZSBjZXJ0aWZpY2F0 ZV9leHRlbnNpb25fdmFsdWVzIGZpZWxkPw0KDQpJ4oCZbGwgY2FsbCBvdXQgZm9yIFJ1c3PigJlz IGF0dGVudGlvbiBhdCB0aGUgZW5kIG9mIFNlY3Rpb24gNC40LjMgd2hlcmUgd2Ugc2F5IHRoYXQg 4oCcaW1wbGVtZW50YXRpb25zIE1VU1QgTk9UIGNvbWJpbmUgZXh0ZXJuYWwgUFNLcyB3aXRoIGNl cnRpZmljYXRlLWJhc2VkIGF1dGhlbnRpY2F0aW9uLuKAnSAgSXMgdGhlcmUgYW55IHJlYXNvbiBu b3QgdG8gcXVhbGlmeSB0aGF0IGFzIHNvbWUgc29ydCBvZiDigJxkb27igJl04oCZIGRvIGl0IHVu dGlsIGl04oCZcyBkZWZpbmVk4oCdPw0KDQpTaG91bGQgQWxlcnQubGV2ZWwgYmUgQWxlcnQubGVn YWN5X2xldmVsPw0KDQpUaGUgZWRpdG9ycyBjb3B5IGhhcyBhbHJlYWR5IHJlbW92ZWQgdGhlIHJl ZmVyZW5jZSB0byBSRkMgNDUwNywgd2hpY2ggaXMgb2Jzb2xldGVkIGJ5IFJGQyA1MDc3IChhbmQg d2FzIG5vdCBjaXRlZCBhbnl3aGVyZSwgYW55d2F5KS4NCg0KQXBwZW5kaXggQiBoYXMgYSBjbGFp bSB0aGF0IOKAnHZhbHVlcyBsaXN0ZWQgYXMgX1JFU0VSVkVEIHdlcmUgdXNlZCBpbiBwcmV2aW91 cyB2ZXJzaW9ucyBvZiBUTFMgYW5kIGFyZSBsaXN0ZWQgaGVyZSBmb3IgY29tcGxldGVuZXNz4oCd LCB0aG91Z2ggdGhhdCBpcyBub3QgZXhhY3RseSB0cnVlLCBlLmcuLCBmb3IgQ29udGVudFR5cGUu aW52YWxpZF9SRVNFUlZFRCgwKQ0KDQpTZWN0aW9uIEMuMyBub3RlcyB0aGF0IOKAnENlcnRpZmlj YXRlcyBzaG91bGQgYWx3YXlzIGJlIHZlcmlmaWVkIHRvIGVuc3VyZSBwcm9wZXIgc2lnbmluZyBi eSBhIHRydXN0ZWQgQ2VydGlmaWNhdGUgQXV0aG9yaXR54oCdLCB3aGljaCBkb2VzIG5vdCB1c2Ug UkZDIDIxMTkgbGFuZ3VhZ2UsIGJ1dCBtaWdodCBiZSBzZWVuIGFzIGluIGNvbmZsaWN0IHdpdGgg b3Bwb3J0dW5pc3RpYyBlbmNyeXB0aW9uIGluIHNvbWUgY2lyY3Vtc3RhbmNlcy4gIEkgZG9u4oCZ dCBvYmplY3QgdG8gdGhpcyB0ZXh0LCBidXQgaXQgc2VlbXMgd29ydGggbWVudGlvbmluZy4NCg0K UGFnZSAxMTMgc3RpbGwgaGFzIHRoZSDigJxbW05PVEU6IFRMUyAxLjMgbmVlZHMgYSBuZXcgY2hh bm5lbCBiaW5kaW5nIGRlZmluaXRpb24gdGhhdCBoYXMgbm90IHlldCBiZWVuIGRlZmluZWQuXV3i gJ0sIHdoaWNoIHNob3VsZCBub3QgbWFrZSBpdCBpbnRvIHRoZSBmaW5hbCBzcGVjIQ0KDQotQmVu DQoNCg== From nobody Tue Mar 28 04:35:30 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 52B3F12998C for ; Tue, 28 Mar 2017 04:35:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wA-J8YRgIeFI for ; Tue, 28 Mar 2017 04:35:26 -0700 (PDT) Received: from mail-qk0-x22d.google.com (mail-qk0-x22d.google.com [IPv6:2607:f8b0:400d:c09::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 648F01294E5 for ; Tue, 28 Mar 2017 04:35:26 -0700 (PDT) Received: by mail-qk0-x22d.google.com with SMTP id f11so62313592qkb.0 for ; Tue, 28 Mar 2017 04:35:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=ZRFoSbn4rYABTUXtTF+MqPuGzPE3X0UPDuu1/ubYz1w=; b=Or5kNPhRq/7aqzmYjo8ZZ1nHmC9BZ1or1N7d1bQRROS8ICYzWmDGMD2s2ekoARNmvY tUczNcbTCm9YBsE9w+7r7bo+U5YwUf6vTsduutO12lZ7kRbQi60PzXoITla1nUY5Qoox XjpC0Zi9zrA4/TAT85+tm12ePzs2/6YaOVa4vzCdD/MsZX2G/WFq6sKjLJWnIeRo4qYO wMgnaM2AtBdq9xDcSInzkADYLQ5eiTWByrUpXCXc9jEKZpsm8r5aMYp3fX3E94LcYBZd 8OFOdrRKjwzBlJeRkNauWrtZcEQH9hZbOPXbms0/5oFbxiC37YyH3PAd0arYn/5YcOQO oeAg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=ZRFoSbn4rYABTUXtTF+MqPuGzPE3X0UPDuu1/ubYz1w=; b=qADC2lq8fMJI2WQ3ewteeYHmH04kDJdmVJC56/5jLkGoPD1mA34LQFUdS8ROmwPeqV DL00l55rUGS0qkjHsg+RSEYx2cNac7voVKehfHQchMphbmhipI9XAN3c2L66aMqZeC2k sMy2cv3AKbv+HeJjCGDvpxhv730sjSTshMxvTTPOwyE2VK8Mk9Ew/h7YtDkcmHFBvHrS +X51mhjLdUgK7ptif83pjZNDJ3XEVGWLDnsjcW4cqjl5aYf9Tj8qeITeBsXhYzhBGMEa INJtv5gpIgBqSZWp5e923IhZA6GixXaciR6hbp5aDxu21ES81AjGaoUO1BvbPIfWGE6r UzqQ== X-Gm-Message-State: AFeK/H377TxnG9x1SEb9Ov/2gxD5mNpA9jDTruZITCJZA+qjjVo3Fbf0WvPOCOQGeyy/fNaTWtkYjmg/OqtCxA== X-Received: by 10.55.164.151 with SMTP id n145mr14765256qke.202.1490700925300; Tue, 28 Mar 2017 04:35:25 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Tue, 28 Mar 2017 04:35:24 -0700 (PDT) From: Martin Thomson Date: Tue, 28 Mar 2017 06:35:24 -0500 Message-ID: To: "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: [TLS] draft-thomson-tls-record-limit-00 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 11:35:28 -0000 I just submitted a version of the draft we've discussed a little on the list. I don't think we concluded the discussion about what to do about block cipher padding. ... A new version of I-D, draft-thomson-tls-record-limit-00.txt has been successfully submitted by Martin Thomson and posted to the IETF repository. Name: draft-thomson-tls-record-limit Revision: 00 Title: Record Size Limit Extension for Transport Layer Security (TLS) Document date: 2017-03-27 Group: Individual Submission Pages: 6 URL: https://www.ietf.org/internet-drafts/draft-thomson-tls-record-limit-00.txt Status: https://datatracker.ietf.org/doc/draft-thomson-tls-record-limit/ Htmlized: https://tools.ietf.org/html/draft-thomson-tls-record-limit-00 Htmlized: https://datatracker.ietf.org/doc/html/draft-thomson-tls-record-limit-00 Abstract: An extension to Transport Layer Security (TLS) is defined that allows endpoints to negotiate the maximum size of protected records that each will send the other. Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat From nobody Tue Mar 28 04:55:14 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B749F129431 for ; Tue, 28 Mar 2017 04:55:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h1y00UA_6VHx for ; Tue, 28 Mar 2017 04:55:07 -0700 (PDT) Received: from mail-vk0-x229.google.com (mail-vk0-x229.google.com [IPv6:2607:f8b0:400c:c05::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B2F05129417 for ; Tue, 28 Mar 2017 04:55:06 -0700 (PDT) Received: by mail-vk0-x229.google.com with SMTP id z204so84933980vkd.1 for ; Tue, 28 Mar 2017 04:55:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=3Q/TYkvP7rgkhPF050WAq9Zuhj09TKSJxnm6lYSOfG8=; b=AW91TcWwBQBNwq0LFaDgDEbUJEJuncLXvyb1TYmHQTvO1taKfmDEmz0GmMq64iULEG n8ue4BPqq+Q77GS+Enx59rgY9jJqRPWxo+FBn0tW8gFsIyZCBeQkburMlwjnCUSO09uv kfSvEERKMR+sdc7t71zC9fS1q4SY7Wp+sIn7fJ2zzkki29yWIVGu0tKsmIIbMs43L5TZ YOsIJENLufidPAJjAvynV5ACI2gG3MAcJMoMYGJUUnK/OZyby934/gLI/8f990mZL70K acM+rWTjM+5KhcqzfbN+t5coRHEO5op9KWKPeNXcjnQrrbERnZqX9+601YXm8I+AynH6 Uosw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=3Q/TYkvP7rgkhPF050WAq9Zuhj09TKSJxnm6lYSOfG8=; b=TfBU+8pOREm8oaWtlrmlYnCDAeK/f3Si7gIvo5zzMb2OgfkwimsVlzELNOoQKC//JC SeY9yaP69r1p/dIxXJIbxo87MGucTx15Nmf2CU4AorFWEzetjBk3XAFH3yvYsUxT9mSd lTYmowuKeGhLeIOMctWLTIW7VNIR9lYGGLng8uUbWEQTrWDZ3RB3OXk8d+6w3e1sKVZp OHq9P+q+viXddbsvealLcU1o91r6z9Ht30EtJG3dCmkuyx07rPLq2oVJHmGcXR2lttyY pA7PWywhsDeGldpIsnPhEmVvsozKJEi7vJ/cN8mlmsTn9zNs9iChtvwgLqACFNTa3MNM ZFaw== X-Gm-Message-State: AFeK/H1KnNZ91oEqCb2F9BO+uN6wfu6mKz2GoVeXZlH3IWinAYwdPC82Lzd2UJekxFOOX3QyeGd2RUHyzB1PCA== X-Received: by 10.31.63.2 with SMTP id m2mr10804851vka.6.1490702105608; Tue, 28 Mar 2017 04:55:05 -0700 (PDT) MIME-Version: 1.0 Received: by 10.159.48.138 with HTTP; Tue, 28 Mar 2017 04:55:04 -0700 (PDT) In-Reply-To: References: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> <54343047-7620-4A96-BD39-6E60AE7EA5A2@sn3rd.com> <5f39565c-5417-b94f-f1e6-32261c473455@nomountain.net> From: Shumon Huque Date: Tue, 28 Mar 2017 06:55:04 -0500 Message-ID: To: TLS WG Content-Type: multipart/alternative; boundary=001a114dafea788d40054bc9217c Archived-At: Subject: Re: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 11:55:12 -0000 --001a114dafea788d40054bc9217c Content-Type: text/plain; charset=UTF-8 On Thu, Mar 23, 2017 at 12:28 AM, Viktor Dukhovni wrote: > > > On Mar 22, 2017, at 10:56 AM, Melinda Shore < > melinda.shore@nomountain.net> wrote: > > > > The draft could definitely benefit from additional review. > > A more complete walk through: > > > 2. Introduction > > > > This draft describes a new TLS [RFC5246] extension for transport of a > > DNS record set serialized with the DNSSEC signatures [RFC4034] needed > > to authenticate that record set. The intent of this proposal is to > > allow TLS clients to perform DANE authentication [RFC6698] of a TLS > > Should RFC6698 here be replaced or augmented with RFC7671? In RFC7671, > the processing of DANE-EE(3) are DANE-TA(2) is modified from what one > might naively do with just RFC6698. One of these changes of course > introduces the UKS problem referenced in this draft, but since this > draft militates against UKS attacks, that's not a problem. > Yes, I agree. We should add a reference to 7671. > > > Furthermore, > > SMTP MTAs usually employ Opportunistic Security [RFC7435], in which > > the presence of the DNS TLSA records is used to determine whether to > > enforce an authenticated TLS connection. Hence DANE authentication > > of SMTP MTAs [RFC7672] will typically not use this mechanism. > > Note that RFC7672 describes opportunistic DANE TLS for SMTP, so RFC7435 > should probably be replaced by RFC7672 here. > Yes. > > The client then authenticates the chain using a pre-configured trust > > anchor. > > Speaking of trust-anchors, the client will ultimately need to have some > mechanism to deal with root KSK rollover. If the client has no local > resolver that is, at least intermittently, able to refresh the root KSK, > then the client may well also need to use this specification to update > the root KSK list from the DNSKEY RRsets returned by servers, and to > persist these for future use. That's probably worth a mention... > Yes, and it kind of is mentioned later in the document where there is a discussion of whether or not to include the trust anchor DNSKEY RRset in the chain or not. We need to sort out the requirement there. > As described in the DANE specification [RFC6698], this procuedure > > applies to the DANE authentication of X.509 certificates. > > Or raw public keys as described in 7671, and indeed mentioned below > in the draft. > > > 3.1. Protocol, TLS 1.2 > > > > A client MAY include an extension of type "dnssec_chain" in the > > (extended) ClientHello. The "extension_data" field of this extension > > MUST be empty. > > One might ask the client to include the port number here, the server > may not know which port the client used if some load-balancer redirected > the layer-4 server address. > Hmm, I remember you brought up this point a while back, but I can't remember the subsequent discussion and what we decided to do about this. I suppose it may be possible to preconfigure the servers on the other side of the load balancer to know the original port to avoid this problem. > > 3.4. DNSSEC Authentication Chain Data > > > Each RRset in the chain is composed of a sequence of wire format DNS > > resource records. The format of the resource record is described in > > RFC 1035 [RFC1035], Section 3.2.1. The resource records SHOULD be > > presented in the canonical form and ordering as described in RFC 4034 > > [RFC4034]. > > > > RR(i) = owner | type | class | TTL | RDATA length | RDATA > > Note that the TTL in the canonical form is the one in the RRSIG, rather > that a typically smaller value in response from the resolver. Whose > responsibility is it to ensure that the records fed into the signature > verification algorithm have the correct (maximal) TTL? > I would assume the validator on the TLS client side. > > > The first RRset in the chain MUST contain the DANE records being > > presented. The subsequent RRsets MUST be a sequence of DNSKEY and DS > > RRsets, starting with a DNSKEY RRset. Each RRset MUST authenticate > > the preceding RRset: > > Except that of course, as explained below, they don't have to be a > sequence of "DNSKEY" and "DS" RRsets, because wildcards also necessitate > NSEC, NSEC3 or possibly (some decade this century unless scalable QCs > arrive first) NSEC5 records. > Yes. The need to include NSEC/3 records for the wildcard DNS record case is mentioned later in the draft, so this text needs to be reconciled with it. Also, on the issue of ordered vs unordered sequence of RRsets, the draft at the moment appears to have contradictory text on this issues. Earlier in section 3.4 it says: "The record sets and signatures are presented in the order returned by the DNS server queried by the TLS server, although they MAY be returned in validation order, starting at the target DANE record, followed by the DNSKEY and DS record sets for each intervening DNS zone up to a trust anchor chosen by the server, typically the DNS root. " I know there are proponents of each. We need to decide which it is. > > o A DNSKEY RRset must include the DNSKEY RR containing the public > > key used to verify the previous RRset. > > I assume that the DNSKEY RRset must be presented in full, because > otherwise how is its signature to be validated? This even applies > to the root RRset in support of KSK rollover. While it is possible > to limit the transmitted RRSIG records to just those supported by > the client, I don't see any opportunity to transmit partial RRsets > of any other type. > Yes. > > > o For a DS RRset, the set of key hashes MUST overlap with the > > preceding set of DNSKEY records. > > Again, except for the root (whose DS RRs need not be transmitted > at all), all the DS RRsets would surely need to be sent in full, > else their signature cannot be validated... > Yes, again. > > > In addition, a DNSKEY RRset followed by a DS RRset MUST be self- > > signed, in the sense that its RRSIG MUST verify under one of the keys > > in the DNSKEY RRSET. > > Are these instructions to the server (what to send) or to the verifier? > More specifically, the DNSKEY RRset must be accompanied by a signature > made by one of the KSKs whose hash appears in the DS RRset. If there > are multiple algorithms in the DS RRset (say RSA and ECDSA) then if > at all possible an RRSIG by a KSK for each such algorithm MUST be > included unless the server knows which DNSSEC algorithms are supported > by the client and can safely omit RRSIGs for some of the algorithms. > We seem to be quoting generic DNSSEC protocol requirements here. I'd be in favor of striking this sentence. > The final DNSKEY RRset in the authentication chain, containing the > > trust anchor may be omitted. > > As mentioned below, that would make RFC5011 KSK rollover rather > difficult, and presumably we don't want clients to eventually cease to > be able to verify chains for lack of fresh trust anchors. > Right, we need to decide whether this protocol extension will support in-band RFC 5011 key rollover capability or not. If so, the chain will have to include the trust anchor DNSKEY RRset (or I suppose its inclusion could be negotiated by client signaling). One could make the case, that key rollover is best handled by a system wide service that the TLS client uses (mentioned in the draft). However, there may again be potential middlebox interference problem here that could prevent such a service from working reliably (e.g. if the middlebox prevents the delivery of DNSKEY queries and signed responses). Another way this problem could be addressed is by regular client software updates - browsers I believe are comfortable with this mode. The DNS root key rollover happens (or is at least planned to happen) on a time scale that is much larger than typical client software updates. The protocol described here is general purpose though. It could be used with a custom trust anchor for a different point in the DNS tree where key rollover schedules are more unpredictable. > > > If omitted, the client MUST verify that > > the key tag and owner name in the final RRSIG record correspond to a > > trust anchor. There may however be reason to include the trust > > anchor RRset and signature if clients are expected to use RFC5011 > > compliant key rollover functions inband via the chain data. > > But how is the server to know unless the client asks? So I think > that perhaps the client extension needs to ask (RFC5011-enable flag > and port so far). > The client asks for it, or the server sends it unilaterally, or we decide that client TA rollover is handled outside the protocol. > ... Wildcard DANE records will need to include the wildcard > > name, and negative proof (i.e. NSEC or NSEC3 records) that no closer > > name exists MUST be included. > > And so the earlier text that says DS/DNSKEY only needs to be less > restrictive. > Yes (discussed previously). > > > Note as well that if a user has a specific TLSA record for port 443, > > and a different wildcard covering other ports, attackers MUST NOT be > > able to substitute the wildcard TLSA RRset for the more specific one > > for port 443. DNSSEC wildcards must not be confused with the X.509 > > wildcards. > > I don't understand this paragraph. DNSSEC closest encloser proofs are > needed to show that the wildcard record is applicable. The client knows > that the server is returning a wildcard response, which must prove that > the actual port sought has no explicit TLSA RR. What am I missing? > Is this just asking the client to do DNSSEC wildcard answer processing > correctly? > It sounds like it. I would strike this paragraph. > 4. Construction of Serialized Authentication Chains > > > > This section describes a possible procedure for the server to use to > > build the serialized DNSSEC chain. > > > > When the goal is to perform DANE authentication [RFC6698] of the > > server's X.509 certificate, the DNS record set to be serialized is a > > TLSA record set corresponding to the server's domain name. > > Well, actually domain name *and* protocol *and* port. > Yes. > > > The domain name of the server MUST be that included in the TLS Server > > Name Indication extension [RFC6066] when present. If the Server Name > > Indication extension is not present, or if the server does not > > recognize the provided name and wishes to proceed with the handshake > > rather than to abort the connection, the server uses the domain name > > associated with the server IP address to which the connection has > > been established. > > Or some suitable default name selected by the server. I don't think it > is necessary to prescribe a selection mechanism. The server may be > behind a load-balancer, and the name may be statically configured, rather > than obtained from the local address of the accepted socket. > Personally, I'm in favor of mandating TLS SNI usage with this extension. But I lost that argument with other folks, so I defer to consensus. > > > > The components of the authentication chain are built by starting at > > the target record set and its corresponding RRSIG. Then traversing > > the DNS tree upwards towards the trust anchor zone (normally the DNS > > root), for each zone cut, the DNSKEY and DS RRsets and their > > signatures are added. If DNS responses messages contain any domain > > names utilizing name compression [RFC1035], then they must be > > uncompressed. > > Of course there are additional complications when the original name > requires CNAME or DNAME processing to reach the ultimate target domain > where the TLSA records are stored. Perhaps that's worth describing > in more detail, as that's the non-obvious part of the algorithm. > We need to sort out the ordered vs unordered issue first. We can then elaborate on CNAME/DNAME processing. > > > 5. Caching and Regeneration of the Authentication Chain > > > > DNS records have Time To Live (TTL) parameters, and DNSSEC signatures > > have validity periods (specifically signature expiration times). > > After the TLS server constructs the serialized authentication chain, > > it SHOULD cache and reuse it in multiple TLS connection handshakes. > > However, it MUST refresh and rebuild the chain as TTLs and signature > > validity periods dictate. A server implementation could carefully > > track these parameters and requery component records in the chain > > correspondingly. Alternatively, it could be configured to rebuild > > the entire chain at some predefined periodic interval that does not > > exceed the DNS TTLs or signature validity periods of the component > > records in the chain. > > Perhaps the job of transmitting "canonical" TTLs should also be up to > the server, in which case this section should explain that the server > must replace the TTLs of each record with the corresponding RRSIG max > TTL field. > I would be okay with that, but it doesn't have to be that way. Validating resolver logic placed in the client can just as easily figure out the canonical TTL before signature verification. > > > 6. Verification > > > > A TLS client making use of this specification, and which receives a > > DNSSEC authentication chain extension from a server, SHOULD use this > > information to perform DANE authentication of the server certificate. > > In order to do this, it uses the mechanism specified by the DNSSEC > > protocol [RFC4035]. This mechanism is sometimes implemented in a > > DNSSEC validation engine or library. > > > > If the authentication chain is correctly verified, the client then > > performs DANE authentication of the server according to the DANE TLS > > protocol [RFC6698], and the additional protocol requirements outlined > > in [RFC7671]. > > Some discussion of UKS may be appropriate here, since there'll probably > be some day soon an update to RFC7671 that says that name checks are not > generally optional for DANE-EE(3), but as this protocol militates against > UKS attacks, the original policy of RFC7671 should stand despite any such > (near future) amendation. > Yes, I agree. > > > 7. Trust Anchor Maintenance > > > > The trust anchor may change periodically, e.g. when the operator of > > the trust anchor zone performs a DNSSEC key rollover. Managed key > > rollovers typically use a process that can be tracked by verifiers > > allowing them to automatically update their trust anchors, as > > described in [RFC5011]. TLS clients using this specification are > > also expected to use such a mechanism to keep their trust anchors > > updated. Some operating systems may have a system-wide service to > > maintain and keep the root trust anchor up to date. In such cases, > > the TLS client application could simply reference that as its trust > > anchor, periodically checking whether it has changed. > > Hence clients should signal servers whether they want the root DNSKEY > RRset, or already have a sufficiently fresh local copy. > [See previous discussion] -- Shumon Huque --001a114dafea788d40054bc9217c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On T= hu, Mar 23, 2017 at 12:28 AM, Viktor Dukhovni <ietf-dane@dukhovni.org= > wrote:

> On Mar 22, 2017, at 10:56 AM, Melinda Shore <melinda.shore@nomountain.net> wrote:
>
> The draft could definitely benefit from = additional review.

A more complete walk through:

> 2.=C2=A0 Introduction
>
>=C2=A0 =C2=A0 This draft describes a new TLS [RFC5246] extension for tr= ansport of a
>=C2=A0 =C2=A0 DNS record set serialized with the DNSSEC signatures [RFC= 4034] needed
>=C2=A0 =C2=A0 to authenticate that record set.=C2=A0 The intent of this= proposal is to
>=C2=A0 =C2=A0 allow TLS clients to perform DANE authentication [RFC6698= ] of a TLS

Should RFC6698 here be replaced or augmented with RFC7671?=C2=A0 In RFC7671= ,
the processing of DANE-EE(3) are DANE-TA(2) is modified from what one
might naively do with just RFC6698.=C2=A0 One of these changes of course introduces the UKS problem referenced in this draft, but since this
draft militates against UKS attacks, that's not a problem.

Yes, I agree. We should add a reference to 7671.
=C2=A0

>=C2=A0 =C2=A0 Furthermore,
>=C2=A0 =C2=A0 SMTP MTAs usually employ Opportunistic Security [RFC7435]= , in which
>=C2=A0 =C2=A0 the presence of the DNS TLSA records is used to determine= whether to
>=C2=A0 =C2=A0 enforce an authenticated TLS connection.=C2=A0 Hence DANE= authentication
>=C2=A0 =C2=A0 of SMTP MTAs [RFC7672] will typically not use this mechan= ism.

Note that RFC7672 describes opportunistic DANE TLS for SMTP, so RFC7435
should probably be replaced by RFC7672 here.

Yes.
=C2=A0
>=C2=A0 =C2=A0 The client then authenticates the chain using a pre-confi= gured trust
>=C2=A0 =C2=A0 anchor.

Speaking of trust-anchors, the client will ultimately need to have some
mechanism to deal with root KSK rollover.=C2=A0 If the client has no local<= br> resolver that is, at least intermittently, able to refresh the root KSK, then the client may well also need to use this specification to update
the root KSK list from the DNSKEY RRsets returned by servers, and to
persist these for future use.=C2=A0 That's probably worth a mention...<= br>

Yes, and it kind of is mentioned later = in the document where there is a
discussion of whether or not to = include the trust anchor DNSKEY RRset
in the chain or not. We nee= d to sort out the requirement there.

>=C2=A0 =C2=A0 As described in the DANE specification [RFC6698], this pr= ocuedure
>=C2=A0 =C2=A0 applies to the DANE authentication of X.509 certificates.=

Or raw public keys as described in 7671, and indeed mentioned below
in the draft.

> 3.1.=C2=A0 Protocol, TLS 1.2
>
>=C2=A0 =C2=A0 A client MAY include an extension of type "dnssec_ch= ain" in the
>=C2=A0 =C2=A0 (extended) ClientHello.=C2=A0 The "extension_data&qu= ot; field of this extension
>=C2=A0 =C2=A0 MUST be empty.

One might ask the client to include the port number here, the server
may not know which port the client used if some load-balancer redirected the layer-4 server address.

Hmm, I reme= mber you brought up this point a while back, but I can't remember=C2=A0=
the subsequent discussion and what we decided to do about this. = I suppose
it may be possible to preconfigure the servers on the o= ther side of the load=C2=A0
balancer to know the original port to= avoid this problem.
=C2=A0
> 3.4.=C2=A0 DNSSEC Authentication Chain Data

>=C2=A0 =C2=A0 Each RRset in the chain is composed of a sequence of wire= format DNS
>=C2=A0 =C2=A0 resource records.=C2=A0 The format of the resource record= is described in
>=C2=A0 =C2=A0 RFC 1035 [RFC1035], Section 3.2.1.=C2=A0 The resource rec= ords SHOULD be
>=C2=A0 =C2=A0 presented in the canonical form and ordering as described= in RFC 4034
>=C2=A0 =C2=A0 [RFC4034].
>
>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 RR(i) =3D owner | type= | class | TTL | RDATA length | RDATA

Note that the TTL in the canonical form is the one in the RRSIG, rather
that a typically smaller value in response from the resolver.=C2=A0 Whose responsibility is it to ensure that the records fed into the signature
verification algorithm have the correct (maximal) TTL?

I would assume the validator on the TLS client side.
<= div>=C2=A0

>=C2=A0 =C2=A0 The first RRset in the chain MUST contain the DANE record= s being
>=C2=A0 =C2=A0 presented.=C2=A0 The subsequent RRsets MUST be a sequence= of DNSKEY and DS
>=C2=A0 =C2=A0 RRsets, starting with a DNSKEY RRset.=C2=A0 Each RRset MU= ST authenticate
>=C2=A0 =C2=A0 the preceding RRset:

Except that of course, as explained below, they don't have to be a
sequence of "DNSKEY" and "DS" RRsets, because wildcards= also necessitate
NSEC, NSEC3 or possibly (some decade this century unless scalable QCs
arrive first) NSEC5 records.

Yes. The n= eed to include NSEC/3 records for the wildcard DNS record case
is= mentioned later in the draft, so this text needs to be reconciled with it.=

Also, on the issue of ordered vs unordered sequen= ce of RRsets, the draft at=C2=A0
the moment appears to have contr= adictory text on this issues. Earlier in=C2=A0
section 3.4 it say= s:

=C2=A0 "The record sets and
=C2= =A0 =C2=A0signatures are presented in the order returned by the DNS server<= /div>
=C2=A0 =C2=A0queried by the TLS server, although they MAY be retu= rned in
=C2=A0 =C2=A0validation order, starting at the target DAN= E record, followed by the
=C2=A0 =C2=A0DNSKEY and DS record sets = for each intervening DNS zone up to a trust
=C2=A0 =C2=A0anchor c= hosen by the server, typically the DNS root. "

I know there are proponents of each. We need to decide which it is.
=


>=C2=A0 =C2=A0 o=C2=A0 A DNSKEY RRset must include the DNSKEY RR contain= ing the public
>=C2=A0 =C2=A0 =C2=A0 =C2=A0key used to verify the previous RRset.

I assume that the DNSKEY RRset must be presented in full, because
otherwise how is its signature to be validated?=C2=A0 This even applies
to the root RRset in support of KSK rollover.=C2=A0 While it is possible to limit the transmitted RRSIG records to just those supported by
the client, I don't see any opportunity to transmit partial RRsets
of any other type.

Yes.
=C2= =A0

>=C2=A0 =C2=A0 o=C2=A0 For a DS RRset, the set of key hashes MUST overla= p with the
>=C2=A0 =C2=A0 =C2=A0 =C2=A0preceding set of DNSKEY records.

Again, except for the root (whose DS RRs need not be transmitted
at all), all the DS RRsets would surely need to be sent in full,
else their signature cannot be validated...

=
Yes, again.
=C2=A0

>=C2=A0 =C2=A0 In addition, a DNSKEY RRset followed by a DS RRset MUST b= e self-
>=C2=A0 =C2=A0 signed, in the sense that its RRSIG MUST verify under one= of the keys
>=C2=A0 =C2=A0 in the DNSKEY RRSET.

Are these instructions to the server (what to send) or to the verifier?
More specifically, the DNSKEY RRset must be accompanied by a signature
made by one of the KSKs whose hash appears in the DS RRset.=C2=A0 If there<= br> are multiple algorithms in the DS RRset (say RSA and ECDSA) then if
at all possible an RRSIG by a KSK for each such algorithm MUST be
included unless the server knows which DNSSEC algorithms are supported
by the client and can safely omit RRSIGs for some of the algorithms.

We seem to be quoting generic DNSSEC protocol= requirements here. I'd
be in favor of striking this sentence= .=C2=A0

>=C2=A0 =C2=A0 The final DNSKEY RRset in the authentication chain, conta= ining the
>=C2=A0 =C2=A0 trust anchor may be omitted.

As mentioned below, that would make RFC5011 KSK rollover rather
difficult, and presumably we don't want clients to eventually cease to<= br> be able to verify chains for lack of fresh trust anchors.
<= div>
Right, we need to decide whether this protocol extension= will support
in-band RFC 5011 key rollover capability or not. If= so, the chain will
have to include the trust anchor DNSKEY RRset= (or I suppose its
inclusion could be negotiated by client signal= ing).

One could make the case, that key rollover i= s best handled by a system
wide service that the TLS client uses = (mentioned in the draft). However,
there may again be potential m= iddlebox interference problem here that
could prevent such a serv= ice from working reliably (e.g. if the middlebox
prevents the del= ivery of DNSKEY queries and signed responses).

Ano= ther way this problem could be addressed is by regular client software
updates - browsers I believe are comfortable with this mode. The DNS = root=C2=A0
key rollover happens (or is at least planned to happen= ) on a time scale that
is much larger than typical client softwar= e updates.

The protocol described here is general = purpose though. It could be used
with a custom trust anchor for a= different point in the DNS tree where
key rollover schedules are= more unpredictable.
=C2=A0

>=C2=A0 =C2=A0 If omitted, the client MUST verify that
>=C2=A0 =C2=A0 the key tag and owner name in the final RRSIG record corr= espond to a
>=C2=A0 =C2=A0 trust anchor.=C2=A0 There may however be reason to includ= e the trust
>=C2=A0 =C2=A0 anchor RRset and signature if clients are expected to use= RFC5011
>=C2=A0 =C2=A0 compliant key rollover functions inband via the chain dat= a.

But how is the server to know unless the client asks?=C2=A0 So I think
that perhaps the client extension needs to ask (RFC5011-enable flag
and port so far).

The client asks for i= t, or the server sends it unilaterally, or we decide that
client = TA rollover is handled outside the protocol.

>=C2=A0 =C2=A0 ...=C2=A0 Wildcard DANE records will need to include the = wildcard
>=C2=A0 =C2=A0 name, and negative proof (i.e.=C2=A0 NSEC or NSEC3 record= s) that no closer
>=C2=A0 =C2=A0 name exists MUST be included.

And so the earlier text that says DS/DNSKEY only needs to be less
restrictive.

Yes (discussed previously)= .
=C2=A0

>=C2=A0 =C2=A0 Note as well that if a user has a specific TLSA record fo= r port 443,
>=C2=A0 =C2=A0 and a different wildcard covering other ports, attackers = MUST NOT be
>=C2=A0 =C2=A0 able to substitute the wildcard TLSA RRset for the more s= pecific one
>=C2=A0 =C2=A0 for port 443.=C2=A0 DNSSEC wildcards must not be confused= with the X.509
>=C2=A0 =C2=A0 wildcards.

I don't understand this paragraph.=C2=A0 DNSSEC closest encloser proofs= are
needed to show that the wildcard record is applicable.=C2=A0 The client kno= ws
that the server is returning a wildcard response, which must prove that
the actual port sought has no explicit TLSA RR.=C2=A0 What am I missing? Is this just asking the client to do DNSSEC wildcard answer processing
correctly?

It sounds like it. I would s= trike this paragraph.

> 4.=C2=A0 Construction of Serialized Authentication Chains
>
>=C2=A0 =C2=A0 This section describes a possible procedure for the serve= r to use to
>=C2=A0 =C2=A0 build the serialized DNSSEC chain.
>
>=C2=A0 =C2=A0 When the goal is to perform DANE authentication [RFC6698]= of the
>=C2=A0 =C2=A0 server's X.509 certificate, the DNS record set to be = serialized is a
>=C2=A0 =C2=A0 TLSA record set corresponding to the server's domain = name.

Well, actually domain name *and* protocol *and* port.
=
Yes.
=C2=A0

>=C2=A0 =C2=A0 The domain name of the server MUST be that included in th= e TLS Server
>=C2=A0 =C2=A0 Name Indication extension [RFC6066] when present.=C2=A0 I= f the Server Name
>=C2=A0 =C2=A0 Indication extension is not present, or if the server doe= s not
>=C2=A0 =C2=A0 recognize the provided name and wishes to proceed with th= e handshake
>=C2=A0 =C2=A0 rather than to abort the connection, the server uses the = domain name
>=C2=A0 =C2=A0 associated with the server IP address to which the connec= tion has
>=C2=A0 =C2=A0 been established.

Or some suitable default name selected by the server.=C2=A0 I don't thi= nk it
is necessary to prescribe a selection mechanism.=C2=A0 The server may be behind a load-balancer, and the name may be statically configured, rather than obtained from the local address of the accepted socket.

Personally, I'm in favor of mandating TLS SNI usa= ge with this extension.
But I lost that argument with other folks= , so I defer to consensus.
=C2=A0
>
>=C2=A0 =C2=A0 The components of the authentication chain are built by s= tarting at
>=C2=A0 =C2=A0 the target record set and its corresponding RRSIG.=C2=A0 = Then traversing
>=C2=A0 =C2=A0 the DNS tree upwards towards the trust anchor zone (norma= lly the DNS
>=C2=A0 =C2=A0 root), for each zone cut, the DNSKEY and DS RRsets and th= eir
>=C2=A0 =C2=A0 signatures are added.=C2=A0 If DNS responses messages con= tain any domain
>=C2=A0 =C2=A0 names utilizing name compression [RFC1035], then they mus= t be
>=C2=A0 =C2=A0 uncompressed.

Of course there are additional complications when the original name<= br> requires CNAME or DNAME processing to reach the ultimate target domain
where the TLSA records are stored.=C2=A0 Perhaps that's worth describin= g
in more detail, as that's the non-obvious part of the algorithm.

We need to sort out the ordered vs unordered = issue first. We can then=C2=A0
elaborate on CNAME/DNAME processin= g.
=C2=A0

> 5.=C2=A0 Caching and Regeneration of the Authentication Chain
>
>=C2=A0 =C2=A0 DNS records have Time To Live (TTL) parameters, and DNSSE= C signatures
>=C2=A0 =C2=A0 have validity periods (specifically signature expiration = times).
>=C2=A0 =C2=A0 After the TLS server constructs the serialized authentica= tion chain,
>=C2=A0 =C2=A0 it SHOULD cache and reuse it in multiple TLS connection h= andshakes.
>=C2=A0 =C2=A0 However, it MUST refresh and rebuild the chain as TTLs an= d signature
>=C2=A0 =C2=A0 validity periods dictate.=C2=A0 A server implementation c= ould carefully
>=C2=A0 =C2=A0 track these parameters and requery component records in t= he chain
>=C2=A0 =C2=A0 correspondingly.=C2=A0 Alternatively, it could be configu= red to rebuild
>=C2=A0 =C2=A0 the entire chain at some predefined periodic interval tha= t does not
>=C2=A0 =C2=A0 exceed the DNS TTLs or signature validity periods of the = component
>=C2=A0 =C2=A0 records in the chain.

Perhaps the job of transmitting "canonical" TTLs should also be u= p to
the server, in which case this section should explain that the server
must replace the TTLs of each record with the corresponding RRSIG max
TTL field.

I would be okay with that, b= ut it doesn't have to be that way. Validating
resolver logic = placed in the client can just as easily figure out the canonical
= TTL before signature verification.
=C2=A0

> 6.=C2=A0 Verification
>
>=C2=A0 =C2=A0 A TLS client making use of this specification, and which = receives a
>=C2=A0 =C2=A0 DNSSEC authentication chain extension from a server, SHOU= LD use this
>=C2=A0 =C2=A0 information to perform DANE authentication of the server = certificate.
>=C2=A0 =C2=A0 In order to do this, it uses the mechanism specified by t= he DNSSEC
>=C2=A0 =C2=A0 protocol [RFC4035].=C2=A0 This mechanism is sometimes imp= lemented in a
>=C2=A0 =C2=A0 DNSSEC validation engine or library.
>
>=C2=A0 =C2=A0 If the authentication chain is correctly verified, the cl= ient then
>=C2=A0 =C2=A0 performs DANE authentication of the server according to t= he DANE TLS
>=C2=A0 =C2=A0 protocol [RFC6698], and the additional protocol requireme= nts outlined
>=C2=A0 =C2=A0 in [RFC7671].

Some discussion of UKS may be appropriate here, since there'll probably=
be some day soon an update to RFC7671 that says that name checks are not generally optional for DANE-EE(3), but as this protocol militates against UKS attacks, the original policy of RFC7671 should stand despite any such (near future) amendation.

Yes, I agree.=
=C2=A0

> 7.=C2=A0 Trust Anchor Maintenance
>
>=C2=A0 =C2=A0 The trust anchor may change periodically, e.g. when the o= perator of
>=C2=A0 =C2=A0 the trust anchor zone performs a DNSSEC key rollover.=C2= =A0 Managed key
>=C2=A0 =C2=A0 rollovers typically use a process that can be tracked by = verifiers
>=C2=A0 =C2=A0 allowing them to automatically update their trust anchors= , as
>=C2=A0 =C2=A0 described in [RFC5011].=C2=A0 TLS clients using this spec= ification are
>=C2=A0 =C2=A0 also expected to use such a mechanism to keep their trust= anchors
>=C2=A0 =C2=A0 updated.=C2=A0 Some operating systems may have a system-w= ide service to
>=C2=A0 =C2=A0 maintain and keep the root trust anchor up to date.=C2=A0= In such cases,
>=C2=A0 =C2=A0 the TLS client application could simply reference that as= its trust
>=C2=A0 =C2=A0 anchor, periodically checking whether it has changed.

Hence clients should signal servers whether they want the root DNSKEY
RRset, or already have a sufficiently fresh local copy.

[See previous discussion]

--=C2= =A0
Shumon Huque

--001a114dafea788d40054bc9217c-- From nobody Tue Mar 28 05:00:27 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5EE2212996E for ; Tue, 28 Mar 2017 05:00:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T3gjfp23-SkN for ; Tue, 28 Mar 2017 05:00:20 -0700 (PDT) Received: from mail-vk0-x233.google.com (mail-vk0-x233.google.com [IPv6:2607:f8b0:400c:c05::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 06F0C129417 for ; Tue, 28 Mar 2017 05:00:20 -0700 (PDT) Received: by mail-vk0-x233.google.com with SMTP id r69so84846090vke.2 for ; Tue, 28 Mar 2017 05:00:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=yhzhLKWGS5Sek27H33d9AuPGpF9cTY8IBNpqKwkhx3E=; b=SNG65JMdTYErM4LSUXgVcrwPMYaFJDLlCbmsAtn/eXUJ7rXOG1K6JyJdN6zI2kPpg6 mIQeqiHRmmd4BGRIHHbdpjildYJ8lsuw0nqHcZw2jcqE3UpHnWLt4f996xQKFVYKnMf7 tx+MXkn6YBToYvsOBv0xMByyzyqlC/F/mJqrwaDCMGpDSyXd2uX8b6cz5niVgffxt2CJ /mucsaBKR4VScgLGJ0RCX5o5O0XuUW7DNhisLbd3PGKdg/nRvnb2ABnmCBjfsOgx5ja1 Qe+5AYvcER6Wnf0OLoQKqMucK3Afw2rA3C+1sujmORhwcUHQusmr2ulTy7Ywmcog06qy AVDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=yhzhLKWGS5Sek27H33d9AuPGpF9cTY8IBNpqKwkhx3E=; b=BIlC0UkYr10/IoYh5u+ScqtiKZ8BcRQRESxYWQk2tsi8jxSg5Hq5Go29VEZIIZ0CpA nV86oGS0fHnTApaQnHkL02q+qubLw7lgxE/hE5UG+wpmmrVFwDpfEf4jZGKem/tg0IwG /XbZoVRz1N6YEsuujp+UmY7TLYS56sWKsn3pu/l+ZkBS9ujr2WobB+XVpVk2H6ek9W5D +1booV1Tv5sg43ljoDUbxtNp3MAjJBTNEKnWb07Z5Xoytc38sFETquKDs2WFmmfC7qwC ZCvx9+dfsye4NmA6osfcuj1NPpYZf8Y0g/zD3oibLSryfKjtNoV8BT5qMdgGeV8B/SK6 QaYQ== X-Gm-Message-State: AFeK/H34PbHsrcwe0COVBoaJHpouAaBzOn1edegr1cAfPMQuQsKSXIx1c9l/ZH/SLakizbzNZncRUuGTMuwH+A== X-Received: by 10.31.107.93 with SMTP id g90mr12343170vkc.155.1490702419038; Tue, 28 Mar 2017 05:00:19 -0700 (PDT) MIME-Version: 1.0 Received: by 10.159.48.138 with HTTP; Tue, 28 Mar 2017 05:00:17 -0700 (PDT) In-Reply-To: <06E7213B-5842-4465-936D-CF153C76B6DA@dukhovni.org> References: <1362c5bd-99c6-c806-ce2a-b51f86a31f38@nomountain.net> <54343047-7620-4A96-BD39-6E60AE7EA5A2@sn3rd.com> <5f39565c-5417-b94f-f1e6-32261c473455@nomountain.net> <06E7213B-5842-4465-936D-CF153C76B6DA@dukhovni.org> From: Shumon Huque Date: Tue, 28 Mar 2017 07:00:17 -0500 Message-ID: To: "" Content-Type: multipart/alternative; boundary=001a11478dd02717ec054bc93416 Archived-At: Subject: Re: [TLS] A few comments on draft-ietf-tls-dnssec-chain-extension-02.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 12:00:27 -0000 --001a11478dd02717ec054bc93416 Content-Type: text/plain; charset=UTF-8 On Wed, Mar 22, 2017 at 4:50 PM, Viktor Dukhovni wrote: > > > On Mar 22, 2017, at 10:56 AM, Melinda Shore < > melinda.shore@nomountain.net> wrote: > > > > The draft could definitely benefit from > > additional review. > > I find it ironic that section 4 includes: > > The components of the authentication chain are built by starting at > the target record set and its corresponding RRSIG. Then traversing > the DNS tree upwards towards the trust anchor zone (normally the DNS > root), for each zone cut, the DNSKEY and DS RRsets and their > signatures are added. If DNS responses messages contain any domain > names utilizing name compression [RFC1035], then they must be > uncompressed. > > while at the same time there is ongoing discussion of *adding* compression > of the server certificate chain (as a TLS 1.3 extension). Would the > compression of server certificates also cover compression of the DNSSEC > chain extension? If so, perhaps this would be a belated moral victory > for DJB[1]. :-) > I think the reason for the last sentence quoted above is that DNS name compression is defined in terms of an offset from the beginning of the DNS message, and the draft as currently written uses a sequence of RRsets rather than a complete DNS message. I sympathesize with djb's critique. If DNS wasn't designed in the early 80's then perhaps we would have had something different. I supposed we could redefine name compression for this draft to use an offset from the beginning of the chain data. Does the proposed compression of certificate chains include extensions in the Certificate message also? If so, the DNSSEC chain extension would automatically be covered. Generally speaking, I would not be opposed to compressing the DNSSEC chain extension with a normal compression algorithm. Perhaps some empirical measurements might be useful to determine whether it yields significant enough savings. Large parts of the dnssec chain (signatures and keys) probably aren't terribly compressible, although I guess the same issue exists for certificate chains, and if it's worth it for the latter .. -- Shumon Huque --001a11478dd02717ec054bc93416 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On W= ed, Mar 22, 2017 at 4:50 PM, Viktor Dukhovni <ietf-dane@dukhovni.org= > wrote:

> On Mar 22, 2017, at 10:56 AM, Melinda Shore <melinda.shore@nomountain.net> wrote:
>
> The draft could definitely benefit from<= br> > additional review.

I find it ironic that section 4 includes:

=C2=A0 =C2=A0The components of the authentication chain are built by starti= ng at
=C2=A0 =C2=A0the target record set and its corresponding RRSIG.=C2=A0 Then = traversing
=C2=A0 =C2=A0the DNS tree upwards towards the trust anchor zone (normally t= he DNS
=C2=A0 =C2=A0root), for each zone cut, the DNSKEY and DS RRsets and their =C2=A0 =C2=A0signatures are added.=C2=A0 If DNS responses messages contain = any domain
=C2=A0 =C2=A0names utilizing name compression [RFC1035], then they must be<= br> =C2=A0 =C2=A0uncompressed.

while at the same time there is ongoing discussion of *adding* compression<= br> of the server certificate chain (as a TLS 1.3 extension).=C2=A0 Would the compression of server certificates also cover compression of the DNSSEC
chain extension?=C2=A0 If so, perhaps this would be a belated moral victory=
for DJB[1]. :-)

I think the reason for = the last sentence quoted above is that DNS name
compression is de= fined in terms of an offset from the beginning of the
DNS message= , and the draft as currently written uses a sequence of RRsets
ra= ther than a complete DNS message. I sympathesize with djb's critique.
If DNS wasn't designed in the early 80's then perhaps we w= ould have had
something different.

I sup= posed we could redefine name compression for this draft to use an
offset from the beginning of the chain data.

Does= the proposed compression of certificate chains include extensions
in the Certificate message also? If so, the DNSSEC chain extension would<= /div>
automatically be covered. Generally speaking, I would not be oppo= sed to
compressing the DNSSEC chain extension with a normal compr= ession algorithm.
Perhaps some empirical measurements might be us= eful to determine
whether it yields significant enough savings. L= arge parts of the dnssec
chain (signatures and keys) probably are= n't terribly compressible, although=C2=A0
I guess the same is= sue exists for certificate chains, and if it's worth it for
t= he latter ..

--=C2=A0
Shumon Huque
=

--001a11478dd02717ec054bc93416-- From nobody Tue Mar 28 06:59:33 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 811941293FB for ; Tue, 28 Mar 2017 06:59:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, TVD_PH_BODY_ACCOUNTS_PRE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mwpvFDIWI5jF for ; Tue, 28 Mar 2017 06:59:29 -0700 (PDT) Received: from brontes.bolet.org (www.bolet.org [62.210.214.227]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A668129993 for ; Tue, 28 Mar 2017 06:59:25 -0700 (PDT) Received: by brontes.bolet.org (Postfix, from userid 1000) id B74D62032B; Tue, 28 Mar 2017 16:00:56 +0200 (CEST) Date: Tue, 28 Mar 2017 16:00:56 +0200 From: Thomas Pornin To: Martin Thomson Cc: "tls@ietf.org" Message-ID: <20170328140056.GA1861@bolet.org> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) Archived-At: Subject: Re: [TLS] draft-thomson-tls-record-limit-00 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 13:59:32 -0000 On Tue, Mar 28, 2017 at 06:35:24AM -0500, Martin Thomson wrote: > I just submitted a version of the draft we've discussed a little on > the list. > > I don't think we concluded the discussion about what to do about block > cipher padding. I don't have strong preferences on this, but I would incline toward using the plaintext length in the extension. In any case, adding a longer-than-necessary padding in order to defeat traffic analysis does not make sense if it expands the size beyond the minimal record size for a full record (i.e. if an endpoint wants to add extra padding bytes to a record with 16384 bytes of padding, it is only _revealing_ extra information, not hiding it). I suggest altering this paragraph: The size limit expressed in the "record_size_limit" extension doesn't account for expansion due to compression or record protection. It is expected that a constrained device will disable compression and know - and account for - the maximum expansion possible due to record protection based on the cipher suites it offers or selects. Note that up to 256 octets of padding and padding length can be added to block ciphers. into this: The size limit expressed in the "record_size_limit" extension doesn't account for expansion due to compression or record protection. If and endpoint advertises a size limit which is lower than the protocol-defined limit, then the peer SHALL NOT send a record whose final, protected size exceeds that of the minimal protected size of a record that contains exactly "record_size_limit" plaintext bytes and uses no compression. For instance, if using TLS 1.2 and a cipher suite that mandates AES/CBC encryption and HMAC/SHA-256 for protection, and an endpoint advertises a "record_size_limit" of 700 bytes, then the minimal protected record size for 700 bytes of plaintext contents is 757 bytes: - 700 bytes of plaintext - 32 bytes for the HMAC/SHA-256 - 4 bytes of padding to reach the next multiple of the AES block size (which is 16 bytes) - 16 bytes for the explicit IV - 5 bytes for the record header The padding may have length 1 to 256 bytes as per protocol rules; but in the presence of a "record_size_limit" of 700 bytes expressed by the peer, an endpoint SHALL refrain from sending records whose total protected size exceeds 757 bytes. It is expected that a constrained device will disable compression; moreover, the practice of adding a longer-than-minimal padding is done in order to defeat traffic analysis, and sending records longer than the minimal size for full records is counterproductive (such a record would reveal extra information to onlookers, and thus should be avoided). ------------------ Another unrelated comment: in section 3, there is the following: The "max_fragment_length" extension is also ill-suited to cases where the capabilities of client and server are asymmetric. The server is required to select a fragment length that is as small or smaller than the client offers and both endpoints need to comply with this smaller limit. Actually, it is worse than that: per the wording of RFC 6066, if a client advertises a length of L bytes, the server must respond with _exactly_ the same length L; the server is not allowed to select a smaller length. The relevant RFC text is: The "extension_data" field of this extension SHALL contain a "MaxFragmentLength" whose value is the same as the requested maximum fragment length. and it is reinforced some lines later: Similarly, if a client receives a maximum fragment length negotiation response that differs from the length it requested, it MUST also abort the handshake with an "illegal_parameter" alert. The "max_fragment_length" extension is completely client-driven: it is used only on the client's initiative, and uses the client's length. The server's only choice is to accept the will of the client, or reject the connection. Thus, it handles only the case of constrained clients talking to big servers, not the other way round. --Thomas Pornin From nobody Tue Mar 28 07:50:18 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 89910129687 for ; Tue, 28 Mar 2017 07:50:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ieGc_iPLvxrq for ; Tue, 28 Mar 2017 07:50:15 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B6048126FDC for ; Tue, 28 Mar 2017 07:50:15 -0700 (PDT) Received: from pps.filterd (m0050093.ppops.net [127.0.0.1]) by m0050093.ppops.net-00190b01. (8.16.0.20/8.16.0.20) with SMTP id v2SEc2dA007354 for ; Tue, 28 Mar 2017 15:50:13 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=Yphkn17tVj0d1cN4KTACAu6ZyZ2ITbo17LZne7DbevA=; b=Mo7ngwniepq4pd0rZlwQjvBgFnG6yFfodh8O3XntdwSOXTeZ9lLUaJEqE4Vn2pfiJrHK aue+twvMk0Vg77qTtsRTt1Tkn8875J2lM/g48ypKb/3U4/Xo+/NxIivO6wLGXMVyiiUh jXa2BE/mdoO+cIpLi2V4yfmtOQbeS3j4dcRbH99DA+s7wX91H4UQboGSYER5QKGiPaST ThiG4IVWwyZETNf12nBqUtKEEnI9WMuJMxnyFreELOQXPkcjNM77GdYaIm1b3sU0+LWE sJ4kB6dS7QsRg7sxNdQYOVrMqv4h9Mq0gNmk4zOYsOS75BO1sYXeHh8tm0HjTmoWpkO3 2g== Received: from prod-mail-ppoint3 ([96.6.114.86]) by m0050093.ppops.net-00190b01. with ESMTP id 29fsqnr49k-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 28 Mar 2017 15:50:13 +0100 Received: from pps.filterd (prod-mail-ppoint3.akamai.com [127.0.0.1]) by prod-mail-ppoint3.akamai.com (8.16.0.17/8.16.0.17) with SMTP id v2SEhE1v027659 for ; Tue, 28 Mar 2017 10:50:11 -0400 Received: from email.msg.corp.akamai.com ([172.27.25.34]) by prod-mail-ppoint3.akamai.com with ESMTP id 29fss4r0bc-6 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Tue, 28 Mar 2017 10:50:04 -0400 Received: from ustx2ex-dag1mb6.msg.corp.akamai.com (172.27.27.107) by ustx2ex-dag1mb4.msg.corp.akamai.com (172.27.27.104) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Tue, 28 Mar 2017 09:48:02 -0500 Received: from ustx2ex-dag1mb6.msg.corp.akamai.com ([172.27.27.107]) by ustx2ex-dag1mb6.msg.corp.akamai.com ([172.27.27.107]) with mapi id 15.00.1178.000; Tue, 28 Mar 2017 07:48:02 -0700 From: "Kaduk, Ben" To: "" Thread-Topic: [TLS] WG Call for adoption of draft-rescorla-tls-dtls13 Thread-Index: AQHSo17NgTCAw3v6UUivQqUC8JB2KaGqf2IA Date: Tue, 28 Mar 2017 14:48:02 +0000 Message-ID: <0A77D715-2DE4-41CC-AEC4-285BD8C2ED1E@akamai.com> References: <4CBA4B06-411F-4B87-B664-D451260F8C25@sn3rd.com> In-Reply-To: <4CBA4B06-411F-4B87-B664-D451260F8C25@sn3rd.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.36.169] Content-Type: text/plain; charset="utf-8" Content-ID: <07FE35EB5314B54E82A45583DDC56B4A@akamai.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-28_12:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703280127 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-28_12:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703280127 Archived-At: Subject: Re: [TLS] WG Call for adoption of draft-rescorla-tls-dtls13 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 14:50:18 -0000 SSBzdXBwb3J0IGFkb3B0aW5nIHRoaXMgZG9jdW1lbnQgYW5kIGFtIHdpbGxpbmcgdG8gcmV2aWV3 IGl0Lg0KDQotQmVuDQoNCk9uIDMvMjIvMTcsIDE3OjUwLCAiU2VhbiBUdXJuZXIiIDxzZWFuQHNu M3JkLmNvbT4gd3JvdGU6DQoNCiAgICBBbGwsDQogICAgDQogICAgLTAwIG9mIGRyYWZ0LXJlc2Nv cmxhLXRscy1kdGxzMTMgWzBdWzFdIHdhcyBkaXNjdXNzZWQgYXQgSUVURiA5NyBbMl0uICBJdOKA mXMgbm93IGF0IHZlcnNpb24gLTAxIGFuZCBHSCBpc3N1ZXMgYXJlIHNsb3dseSByb2xsaW5nIGlu LiAgSXTigJlzIGFsc28gb24gb3VyIGFnZW5kYSBhZ2FpbiBhdCBJRVRGIDk4LCBhbmQgRFRMUyBh IGNoYXJ0ZXJlZCB3b3JrIGl0ZW0sIHNvIGl0IHNlZW1zIGxpa2UgaXTigJlzIHRpbWUgdG8gZ2V0 IHRoZSBXRyBhZG9wdGlvbiBwcm9jZXNzIHN0YXJ0ZWQgZm9yIHRoaXMgaW5kaXZpZHVhbCBkcmFm dC4gIFBsZWFzZSBsZXQgdGhlIGxpc3Qga25vdyB3aGV0aGVyIHlvdSBzdXBwb3J0IGFkb3B0aW9u IG9mIHRoZSBkcmFmdCBhbmQgYXJlIHdpbGxpbmcgdG8gcmV2aWV3L2NvbW1lbnQgb24gdGhlIGRy YWZ0IGJlZm9yZSAyMDE3MDQwNi4gIElmIHlvdSBvYmplY3QgdG8gaXRzIGFkb3B0aW9uLCBwbGVh c2UgbGV0IHVzIGtub3cgd2h5Lg0KICAgIA0KICAgIENoZWVycywNCiAgICANCiAgICBKJlMNCiAg ICANCiAgICBbMF0gaHR0cHM6Ly9naXRodWIuY29tL2Vrci9kdGxzMTMtc3BlYyANCiAgICBbMV0g aHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFmdC1yZXNjb3JsYS10bHMt ZHRsczEzDQogICAgWzJdIGh0dHBzOi8vd3d3LmlldGYub3JnL3Byb2NlZWRpbmdzLzk3L3NsaWRl cy9zbGlkZXMtOTctdGxzLWR0bHMtMTMtMDEucGRmDQogICAgX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX18NCiAgICBUTFMgbWFpbGluZyBsaXN0DQogICAgVExT QGlldGYub3JnDQogICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90bHMN CiAgICANCg0K From nobody Tue Mar 28 08:21:58 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B77C129555 for ; Tue, 28 Mar 2017 08:21:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.522 X-Spam-Level: X-Spam-Status: No, score=-14.522 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wMFS94rSID0w for ; Tue, 28 Mar 2017 08:21:55 -0700 (PDT) Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 62D05129450 for ; Tue, 28 Mar 2017 08:21:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=7530; q=dns/txt; s=iport; t=1490714515; x=1491924115; h=from:to:subject:date:message-id:mime-version; bh=Z6RCc/xJSVbG0N9CYnpQ+ijkKo86ZnXizPedLsiVVBA=; b=UYhS2XTt7PZ7CyNomPiM0WK2OA2BM6UfUGqiZpsixVqb1ABJKhBH2AT2 COVyZysJZp960pU0Bhor03qHI/MNqfDyJ16P5+CYwbNUIX0V9NXZmmLcn z2nlnRkVs2jVB0UxDGFAy0fGr03dw+CU+HTRVjJxbqTGNsDz1AllM1jT1 8=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AuAQD4ftpY/5tdJa1dGgEBAQECAQEBA?= =?us-ascii?q?QgBAQEBgm5mYYESjWqUbox+hTGCDolFPxgBAgEBAQEBAQFrKIVJXgGBACYBBBu?= =?us-ascii?q?Jf50CkiyKTgEBAQEGAQEBAQEBIoZOhwSCKYV7BZxgAYFTkHKRPJNpAR84gQRZF?= =?us-ascii?q?YUYHoFjiCUHgSmBDQEBAQ?= X-IronPort-AV: E=Sophos;i="5.36,236,1486425600"; d="scan'208,217";a="403507136" Received: from rcdn-core-4.cisco.com ([173.37.93.155]) by alln-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 28 Mar 2017 15:21:54 +0000 Received: from XCH-RTP-009.cisco.com (xch-rtp-009.cisco.com [64.101.220.149]) by rcdn-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id v2SFLsQj009861 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL) for ; Tue, 28 Mar 2017 15:21:54 GMT Received: from xch-rtp-006.cisco.com (64.101.220.146) by XCH-RTP-009.cisco.com (64.101.220.149) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 28 Mar 2017 11:21:53 -0400 Received: from xch-rtp-006.cisco.com ([64.101.220.146]) by XCH-RTP-006.cisco.com ([64.101.220.146]) with mapi id 15.00.1210.000; Tue, 28 Mar 2017 11:21:53 -0400 From: "Scott Fluhrer (sfluhrer)" To: "" Thread-Topic: The alternative idea I had for token buckets. Thread-Index: AdKn1wUM1ikoRY2eRq24o925ujkrJQ== Date: Tue, 28 Mar 2017 15:21:53 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.98.2.53] Content-Type: multipart/alternative; boundary="_000_b829a7fab57b4edd9bc4a1488f40e5cbXCHRTP006ciscocom_" MIME-Version: 1.0 Archived-At: Subject: [TLS] The alternative idea I had for token buckets. X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 15:21:57 -0000 --_000_b829a7fab57b4edd9bc4a1488f40e5cbXCHRTP006ciscocom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Here's how it would work: - The server has a long term secret key K, which it never gives ou= t - When the server wants to give a token to a client, it picks a ra= ndom value R, and securely gives the client the values R and E_K(R) - When the client wants to use the token, it picks a value i, and = computes the key Hash( R || i). It uses that key to protect the message, a= nd also sends the server the values E(R) and i - The server decrypts the value E(R) to recover R, it computes Has= h( R || i) to recover the message key, and then decrypts the message That way, the server doesn't have to send the client N different tokens... --_000_b829a7fab57b4edd9bc4a1488f40e5cbXCHRTP006ciscocom_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Here’s how it would work:

 

-     &= nbsp;    The server has a long term secret key K, which it n= ever gives out

-     &= nbsp;    When the server wants to give a token to a client, = it picks a random value R, and securely gives the client the values R and E= _K(R)

-     &= nbsp;    When the client wants to use the token, it picks a = value i, and computes the key Hash( R || i).  It uses that key to prot= ect the message, and also sends the server the values E(R) and i=

-     &= nbsp;    The server decrypts the value E(R) to recover R, it= computes Hash( R || i) to recover the message key, and then decrypts the m= essage

 

That way, the server doesn’t have to send the = client N different tokens…

--_000_b829a7fab57b4edd9bc4a1488f40e5cbXCHRTP006ciscocom_-- From nobody Tue Mar 28 08:32:15 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72B22126FB3 for ; Tue, 28 Mar 2017 08:32:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KuBaCKez_uwl for ; Tue, 28 Mar 2017 08:32:07 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B11DE128C83 for ; Tue, 28 Mar 2017 08:32:01 -0700 (PDT) Received: from pps.filterd (m0050095.ppops.net [127.0.0.1]) by m0050095.ppops.net-00190b01. (8.16.0.20/8.16.0.20) with SMTP id v2SFLrbF008909 for ; Tue, 28 Mar 2017 16:31:59 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : content-type : mime-version; s=jan2016.eng; bh=B+YXqH3GHngceoeVyZXOuI8++N9kqg6YLocIHoM19Xs=; b=NOr2gW08RCbFDDJZ19/TC5wZgzDzUxW8d6PYV2zjCfN/7n7zwrmO9YroCiB8nDkIZjZy OmLb7tekulzmXuqXBiI5062PmrD8fW95l1xRZPYr1AO6SW+DiKgTPbD51HpHxApkrTl1 b/2Jm0lKdAdkxUjtKK/hRg3c7MHiZcA6gqCgfo0jxAOWNSeCw6ts3KNB1atruLwsjhLC ujviCA5KGjtLHxOFl4QhpOSSNmNhVQ4Pok7v4ZZAaf0YspN/5o1LHmKxUPqcrIBv7UEd DpWpZ0+UitS2KMQWztIWPcjnStp74iCRzZVeGb2dKc/XcD0IOJ9GetMqovAB5kEtt1im vg== Received: from prod-mail-ppoint1 (a184-51-33-18.deploy.static.akamaitechnologies.com [184.51.33.18] (may be forged)) by m0050095.ppops.net-00190b01. with ESMTP id 29ft5mg4k1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Tue, 28 Mar 2017 16:31:59 +0100 Received: from pps.filterd (prod-mail-ppoint1.akamai.com [127.0.0.1]) by prod-mail-ppoint1.akamai.com (8.16.0.17/8.16.0.17) with SMTP id v2SFQg7X029665 for ; Tue, 28 Mar 2017 11:31:58 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.33]) by prod-mail-ppoint1.akamai.com with ESMTP id 29fsutr0j3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Tue, 28 Mar 2017 11:31:57 -0400 Received: from USMA1EX-DAG1MB5.msg.corp.akamai.com (172.27.123.105) by usma1ex-dag1mb4.msg.corp.akamai.com (172.27.123.104) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Tue, 28 Mar 2017 11:31:57 -0400 Received: from USMA1EX-DAG1MB5.msg.corp.akamai.com (172.27.123.105) by usma1ex-dag1mb5.msg.corp.akamai.com (172.27.123.105) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Tue, 28 Mar 2017 11:31:57 -0400 Received: from USMA1EX-DAG1MB5.msg.corp.akamai.com ([172.27.123.105]) by usma1ex-dag1mb5.msg.corp.akamai.com ([172.27.123.105]) with mapi id 15.00.1178.000; Tue, 28 Mar 2017 11:31:57 -0400 From: "Short, Todd" To: "tls@ietf.org" Thread-Topic: draft-ietf-tls-tls13-19 section 1.2 cleanup Thread-Index: AQHSp9huw7Wcgg8hMU2q9bM77DXKug== Date: Tue, 28 Mar 2017 15:31:56 +0000 Message-ID: <8B1F82C3-0289-4C55-A75C-1FA1C2F3F1CD@akamai.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.20.0.170309 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.36.176] Content-Type: multipart/alternative; boundary="_000_8B1F82C302894C55A75C1FA1C2F3F1CDakamaicom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-28_13:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703280131 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-28_13:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703280131 Archived-At: Subject: [TLS] draft-ietf-tls-tls13-19 section 1.2 cleanup X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 15:32:13 -0000 --_000_8B1F82C302894C55A75C1FA1C2F3F1CDakamaicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgTGlzdDoNCg0KSSBkaWRu4oCZdCBicmluZyB0aGlzIHVwIGluIHRoZSBtZWV0aW5nIHRoaXMg bW9ybmluZywgYnV0IEnigJlkIGxpa2UgdG8gc2VlIHNlY3Rpb24gMS4yIOKAnE1ham9yIERpZmZl cmVuY2VzIGZyb20gVExTIDEuMuKAnSBjbGVhbmVkIHVwLiBXZSBkb27igJl0IG5lZWQgdG8gbGlz dCB0aGUgY2hhbmdlcyBhdCBlYWNoIGRyYWZ0LiBJbnN0ZWFkLCBvbmx5IHRoZSBtYWpvciBkaWZm ZXJlbmNlIGZyb20gUkZDIDUyNDYsIGV0IGFsLiwgc2hvdWxkIGJlIGluY2x1ZGVkLiBJdOKAmXMg ZGlmZmljdWx0IHRvIHdhZGUgdGhyb3VnaCB0aGlzIHNlY3Rpb24gYXMgd3JpdHRlbi4NCg0KSSBy ZWZlciB0byBSRkM1MjQ2LCBzZWN0aW9uIDEuMiBhcyBhbiBhcHByb3ByaWF0ZSAoYW5kIHVzZWZ1 bCkgZXhhbXBsZS4NCg0KLS0NCi1Ub2RkIFNob3J0DQovLyB0c2hvcnRAYWthbWFpLmNvbQ0KLy8g Ik9uZSBpZiBieSBsYW5kLCB0d28gaWYgYnkgc2VhLCB0aHJlZSBpZiBieSB0aGUgSW50ZXJuZXQu Ig0KDQoNCg== --_000_8B1F82C302894C55A75C1FA1C2F3F1CDakamaicom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0 IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eTpDYWxpYnJpO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFu LkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZvbnQt ZmFtaWx5OkNhbGlicmk7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLm1zb0lucw0KCXttc28t c3R5bGUtdHlwZTpleHBvcnQtb25seTsNCgltc28tc3R5bGUtbmFtZToiIjsNCgl0ZXh0LWRlY29y YXRpb246dW5kZXJsaW5lOw0KCWNvbG9yOnRlYWw7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0 eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6Q2FsaWJyaTt9DQpAcGFnZSBXb3Jk U2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGlu IDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9z dHlsZT4NCjwvaGVhZD4NCjxib2R5IGJnY29sb3I9IndoaXRlIiBsYW5nPSJFTi1VUyIgbGluaz0i IzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5IaSBMaXN0 OjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+SSBkaWRu4oCZdCBi cmluZyB0aGlzIHVwIGluIHRoZSBtZWV0aW5nIHRoaXMgbW9ybmluZywgYnV0IEnigJlkIGxpa2Ug dG8gc2VlIHNlY3Rpb24gMS4yIOKAnE1ham9yIERpZmZlcmVuY2VzIGZyb20gVExTIDEuMuKAnSBj bGVhbmVkIHVwLiBXZSBkb27igJl0IG5lZWQgdG8gbGlzdCB0aGUgY2hhbmdlcyBhdCBlYWNoIGRy YWZ0LiBJbnN0ZWFkLCBvbmx5IHRoZSBtYWpvciBkaWZmZXJlbmNlDQogZnJvbSBSRkMgNTI0Niwg ZXQgYWwuLCBzaG91bGQgYmUgaW5jbHVkZWQuIEl04oCZcyBkaWZmaWN1bHQgdG8gd2FkZSB0aHJv dWdoIHRoaXMgc2VjdGlvbiBhcyB3cml0dGVuLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdCI+SSByZWZlciB0byBSRkM1MjQ2LCBzZWN0aW9uIDEuMiBhcyBhbiBhcHBy b3ByaWF0ZSAoYW5kIHVzZWZ1bCkgZXhhbXBsZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQiPi0tPGJyPg0KLVRvZGQgU2hvcnQ8YnI+DQovLyB0c2hvcnRAYWthbWFp LmNvbTxicj4NCi8vICZxdW90O09uZSBpZiBieSBsYW5kLCB0d28gaWYgYnkgc2VhLCB0aHJlZSBp ZiZuYnNwO2J5IHRoZSBJbnRlcm5ldC4mcXVvdDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9i b2R5Pg0KPC9odG1sPg0K --_000_8B1F82C302894C55A75C1FA1C2F3F1CDakamaicom_-- From nobody Tue Mar 28 08:36:38 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81056127010 for ; Tue, 28 Mar 2017 08:36:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JZXvdUXXkFmh for ; Tue, 28 Mar 2017 08:36:33 -0700 (PDT) Received: from mail-qt0-x230.google.com (mail-qt0-x230.google.com [IPv6:2607:f8b0:400d:c0d::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3FC9F126FB3 for ; Tue, 28 Mar 2017 08:36:33 -0700 (PDT) Received: by mail-qt0-x230.google.com with SMTP id x35so67234058qtc.2 for ; Tue, 28 Mar 2017 08:36:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=4e71ZGsKCgvUXx/zKCuKvqGTP4+CqxSXLZtJUFI5/JQ=; b=jpsv0U0eB3k+Oe+Y+CWUutu6T09iCRruh3d0dyCiRVaRHZIcvSfqqSts+vP1Yac7yp 2UDgNpt5BpaRWrq4lkAyFPgSeenb1dmYXK/StNsZsG3PHsi+qDoJu5EnM251uL0+R1VC dTtXLid+BzutJaWtw3Xnv899+4fIMu/UGOovcn1bkFDulG6Q3bmQ429rjyEmEvHrXNS5 GQsXpYA6uBy8lxFlzRZiEsjYyRBc1POt0pJg7C4bCKLRVXEV54bjHRXngphXnrSp3Uk8 pV53mgklWRzJExZtCiZ/WMJf+jvu3PSU97mxrc5z0LLSrq8pQXSGgAcyhuED4bKoTlTV ra5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=4e71ZGsKCgvUXx/zKCuKvqGTP4+CqxSXLZtJUFI5/JQ=; b=JBuFSCt3eeihWbOTfJjRUjJm6c2mnlLUkKAYDqTFQYNDwjFy3jfHzeq1gyHmV2Iajy SVTxgz2Kl6OkoMKqfdSew2FUKHJ71Uphg/MklSA53VovxUaAH2Pz8oKjWq10/QPLiFOP AK8JLindRsSlp/xVVlsivnBUN+H0VjxdH/Tp2MjLvNOFqJ421BngevexlWD1CYeZ7Lv+ oxf1isPy7qPFscwyYTjz9THurPjVtZ4fJry7EKLHkL7HAImVN1ezf7meNxAhg1AN3twx Bkz5mbFWY80gh36r35YrX/cH22i6v1fpgl0B0O9K87GyReNMS+azP/MaNsu+QTtA4lS9 vMeA== X-Gm-Message-State: AFeK/H3HP5gFjMP8xC/gVHLTMXgQEWpU2r9vncwXqOVWHawHNjwelWkwbsOXfrV7zhNaG1GhhHQDNtsTc+qKEA== X-Received: by 10.200.46.208 with SMTP id i16mr26910877qta.13.1490715392310; Tue, 28 Mar 2017 08:36:32 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Tue, 28 Mar 2017 08:36:31 -0700 (PDT) In-Reply-To: References: From: Martin Thomson Date: Tue, 28 Mar 2017 10:36:31 -0500 Message-ID: To: "Scott Fluhrer (sfluhrer)" Cc: "" Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [TLS] The alternative idea I had for token buckets. X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 15:36:36 -0000 I'm sorry, but I don't understand this proposal. I'm losing you when you say E(R) without specifying the key that you are using. On 28 March 2017 at 10:21, Scott Fluhrer (sfluhrer) wr= ote: > Here=E2=80=99s how it would work: > > > > - The server has a long term secret key K, which it never gives = out > > - When the server wants to give a token to a client, it picks a > random value R, and securely gives the client the values R and E_K(R) > > - When the client wants to use the token, it picks a value i, an= d > computes the key Hash( R || i). It uses that key to protect the message, > and also sends the server the values E(R) and i > > - The server decrypts the value E(R) to recover R, it computes > Hash( R || i) to recover the message key, and then decrypts the message > > > > That way, the server doesn=E2=80=99t have to send the client N different = tokens=E2=80=A6 > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > From nobody Tue Mar 28 08:41:40 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 15D7F129568 for ; Tue, 28 Mar 2017 08:41:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.523 X-Spam-Level: X-Spam-Status: No, score=-14.523 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3OuV7swbFGGP for ; Tue, 28 Mar 2017 08:41:36 -0700 (PDT) Received: from alln-iport-8.cisco.com (alln-iport-8.cisco.com [173.37.142.95]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1C2D612940A for ; Tue, 28 Mar 2017 08:41:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2066; q=dns/txt; s=iport; t=1490715690; x=1491925290; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=ThdisAnpIC9aaUQsYbYvXchZIg3j6RkBCJ55yjAJLmI=; b=BGQ5JXhycZKv9MpSSjqWFmL3Dt53WeMijLIKTnV/tizDgfU1O9HCLQB9 WHSfGAevohxo756yXbIdZmwQf6qtmUB52taioygEqhTKTA94CvuSeFZ1C LAsLl0fRECx6Bj0TEaXx2u0RvEVk+5T4I1bVT+qQL1J2Jzi8IQd6CHXHK c=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0C2AQADg9pY/5RdJa1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBg1RhgQsHg1uKD5FRiBeNNYIOHwuFeAIagwc/GAECAQEBAQEBAWs?= =?us-ascii?q?ohRUBAQEBAwEBIRE6CwwEAgEIEQQBAQECAiMDAgICHwYLFAEICAEBBA4FCIlnA?= =?us-ascii?q?xUOrG+CJocxDYMRAQEBAQEBAQEBAQEBAQEBAQEBAQEBGAWBC4VDhG+CUYFtLYJ?= =?us-ascii?q?vgl8FnCY6AY4WhC+RPIpviHoBHziBBFkVQYRXHoFjdYhggQ0BAQE?= X-IronPort-AV: E=Sophos;i="5.36,237,1486425600"; d="scan'208";a="404048548" Received: from rcdn-core-12.cisco.com ([173.37.93.148]) by alln-iport-8.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 28 Mar 2017 15:41:29 +0000 Received: from XCH-RTP-007.cisco.com (xch-rtp-007.cisco.com [64.101.220.147]) by rcdn-core-12.cisco.com (8.14.5/8.14.5) with ESMTP id v2SFfTxq031698 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 28 Mar 2017 15:41:29 GMT Received: from xch-rtp-006.cisco.com (64.101.220.146) by XCH-RTP-007.cisco.com (64.101.220.147) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 28 Mar 2017 11:41:28 -0400 Received: from xch-rtp-006.cisco.com ([64.101.220.146]) by XCH-RTP-006.cisco.com ([64.101.220.146]) with mapi id 15.00.1210.000; Tue, 28 Mar 2017 11:41:28 -0400 From: "Scott Fluhrer (sfluhrer)" To: Martin Thomson CC: "" Thread-Topic: [TLS] The alternative idea I had for token buckets. Thread-Index: AdKn1wUM1ikoRY2eRq24o925ujkrJQAI5SuAAAg79lA= Date: Tue, 28 Mar 2017 15:41:28 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.98.2.53] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] The alternative idea I had for token buckets. X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 15:41:38 -0000 RV9LKFIpOyB0aGF0IGlzLCBSIGlzIGVuY3J5cHRlZCB3aXRoIHRoZSBzZXJ2ZXIncyBsb25nIHRl cm0ga2V5Lg0KDQooSSBtZWFudCB0byBzcGVjaWZ5IHRoYXQuLi4pDQoNCj4gLS0tLS1PcmlnaW5h bCBNZXNzYWdlLS0tLS0NCj4gRnJvbTogTWFydGluIFRob21zb24gW21haWx0bzptYXJ0aW4udGhv bXNvbkBnbWFpbC5jb21dDQo+IFNlbnQ6IFR1ZXNkYXksIE1hcmNoIDI4LCAyMDE3IDExOjM3IEFN DQo+IFRvOiBTY290dCBGbHVocmVyIChzZmx1aHJlcikNCj4gQ2M6IDx0bHNAaWV0Zi5vcmc+DQo+ IFN1YmplY3Q6IFJlOiBbVExTXSBUaGUgYWx0ZXJuYXRpdmUgaWRlYSBJIGhhZCBmb3IgdG9rZW4g YnVja2V0cy4NCj4gDQo+IEknbSBzb3JyeSwgYnV0IEkgZG9uJ3QgdW5kZXJzdGFuZCB0aGlzIHBy b3Bvc2FsLiAgSSdtIGxvc2luZyB5b3Ugd2hlbiB5b3Ugc2F5DQo+IEUoUikgd2l0aG91dCBzcGVj aWZ5aW5nIHRoZSBrZXkgdGhhdCB5b3UgYXJlIHVzaW5nLg0KPiANCj4gT24gMjggTWFyY2ggMjAx NyBhdCAxMDoyMSwgU2NvdHQgRmx1aHJlciAoc2ZsdWhyZXIpIDxzZmx1aHJlckBjaXNjby5jb20+ DQo+IHdyb3RlOg0KPiA+IEhlcmXigJlzIGhvdyBpdCB3b3VsZCB3b3JrOg0KPiA+DQo+ID4NCj4g Pg0KPiA+IC0gICAgICAgICAgVGhlIHNlcnZlciBoYXMgYSBsb25nIHRlcm0gc2VjcmV0IGtleSBL LCB3aGljaCBpdCBuZXZlciBnaXZlcyBvdXQNCj4gPg0KPiA+IC0gICAgICAgICAgV2hlbiB0aGUg c2VydmVyIHdhbnRzIHRvIGdpdmUgYSB0b2tlbiB0byBhIGNsaWVudCwgaXQgcGlja3MgYQ0KPiA+ IHJhbmRvbSB2YWx1ZSBSLCBhbmQgc2VjdXJlbHkgZ2l2ZXMgdGhlIGNsaWVudCB0aGUgdmFsdWVz IFIgYW5kIEVfSyhSKQ0KPiA+DQo+ID4gLSAgICAgICAgICBXaGVuIHRoZSBjbGllbnQgd2FudHMg dG8gdXNlIHRoZSB0b2tlbiwgaXQgcGlja3MgYSB2YWx1ZSBpLCBhbmQNCj4gPiBjb21wdXRlcyB0 aGUga2V5IEhhc2goIFIgfHwgaSkuICBJdCB1c2VzIHRoYXQga2V5IHRvIHByb3RlY3QgdGhlDQo+ ID4gbWVzc2FnZSwgYW5kIGFsc28gc2VuZHMgdGhlIHNlcnZlciB0aGUgdmFsdWVzIEUoUikgYW5k IGkNCj4gPg0KPiA+IC0gICAgICAgICAgVGhlIHNlcnZlciBkZWNyeXB0cyB0aGUgdmFsdWUgRShS KSB0byByZWNvdmVyIFIsIGl0IGNvbXB1dGVzDQo+ID4gSGFzaCggUiB8fCBpKSB0byByZWNvdmVy IHRoZSBtZXNzYWdlIGtleSwgYW5kIHRoZW4gZGVjcnlwdHMgdGhlDQo+ID4gbWVzc2FnZQ0KPiA+ DQo+ID4NCj4gPg0KPiA+IFRoYXQgd2F5LCB0aGUgc2VydmVyIGRvZXNu4oCZdCBoYXZlIHRvIHNl bmQgdGhlIGNsaWVudCBOIGRpZmZlcmVudA0KPiA+IHRva2Vuc+KApg0KPiA+DQo+ID4NCj4gPiBf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KPiA+IFRMUyBt YWlsaW5nIGxpc3QNCj4gPiBUTFNAaWV0Zi5vcmcNCj4gPiBodHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL3Rscw0KPiA+DQo= From nobody Tue Mar 28 08:46:19 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8502C12940E for ; Tue, 28 Mar 2017 08:46:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FxzuId884U7R for ; Tue, 28 Mar 2017 08:46:16 -0700 (PDT) Received: from mail-qk0-x235.google.com (mail-qk0-x235.google.com [IPv6:2607:f8b0:400d:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C932312945C for ; Tue, 28 Mar 2017 08:46:15 -0700 (PDT) Received: by mail-qk0-x235.google.com with SMTP id r142so40244892qke.2 for ; Tue, 28 Mar 2017 08:46:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=gfis0hdMS5PUT6dvj93029PMZ08nNjLGk+OBShpsCwg=; b=fuVC7H0LNgsMXYC5sGfI4V96zNm9tpqMewInZGESU5y6/yt+8EicMogrJeUxY1N10q KB5vQo7I0O9jkivMV0gV0gYlYUGCXmuDGUddCm0ANmuZcRxvSFDStfdHSOkUaRPLFFzc LcYzwNjHA0Sk/F0087N4txSDxYSMdn81mMrhKACVYkGC0OwxKB1gIIoHbuotrBkIBqu1 gEw/+fKexb1fN0i2qd1eSIG3w1xrvAaQeEkjeOFdbrKz1qrxhv+9ixFSrEd2QVhIaHEv 4TGwPt1M7w8JgjU51Qqh4nCGWbKBJhUeWHO/OCcl/FGsn/Bosj2BaMEWmzLpLzIwECvU HjOw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=gfis0hdMS5PUT6dvj93029PMZ08nNjLGk+OBShpsCwg=; b=SATrLP5GY9EqlXEMdYU2CRXHY+vrfmIWFSIy9zOIr+dWOFCt7xmPq/5Exu9lUkBFCv zeRRdaV2nzjK1Lx2/h8Sr/3C1mwAQqZYL4zeFC5MsgJLvgaQSk/O1EJJn3lvjuZTaGLQ +e1CwWfeqZDXNPBslNjfhVdAdIGtra6XZu3wEnVgqCkuUuRmtUSjEwznmV5TW+KSTZBs IuEahoPVo5HxB9Pm6GH9ozNLbjms3JFA9TvcDHOErGez5Q5TEe+Ngzg6aIEbfKrYxbdD sYpzwBaDwjDay7EDO7lAMdgds3UQ/ZUDGHdD60sYOhq9nbSdMVmcVyqsuvKrG4wGfpaR XQYQ== X-Gm-Message-State: AFeK/H00TRqXQsUiBeEJJPDKUxkgyEwGks8uSOXQs09E0hPcsrYjRbtsgSsM5E0neZpQUl3QLl3sd6+A/eZMdg== X-Received: by 10.55.122.134 with SMTP id v128mr25026038qkc.115.1490715975041; Tue, 28 Mar 2017 08:46:15 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Tue, 28 Mar 2017 08:46:14 -0700 (PDT) In-Reply-To: References: From: Martin Thomson Date: Tue, 28 Mar 2017 10:46:14 -0500 Message-ID: To: "Scott Fluhrer (sfluhrer)" Cc: "" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] The alternative idea I had for token buckets. X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 15:46:17 -0000 On 28 March 2017 at 10:41, Scott Fluhrer (sfluhrer) wrote: > E_K(R); that is, R is encrypted with the server's long term key. > > (I meant to specify that...) OK, so how does the server recover E_K(R)? The point here is that it doesn't know R. From nobody Tue Mar 28 08:49:07 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 737B4128CDC for ; Tue, 28 Mar 2017 08:49:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.523 X-Spam-Level: X-Spam-Status: No, score=-14.523 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZwiUULjJ9RYV for ; Tue, 28 Mar 2017 08:49:04 -0700 (PDT) Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0CF1F120725 for ; Tue, 28 Mar 2017 08:49:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=950; q=dns/txt; s=iport; t=1490716143; x=1491925743; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=rZqy0J23tnrMa26UTqeWFSoqvxt+gVmco4WOK+v0h0E=; b=jdVdI5W/NJkDzPnVq+RFIVD33wPO6tN7yA06iEnEHkVcDFnev4h07hJP 81Zc0IJaRpBFv95ipsPD420g5+nPFiQlk2Xa9qT563k5MpdoWD9n6jcOd lRCxuzY0GVjuTdzP4pdd9n9JZe6w14GrERCcuqWFkEW1trwmrAQa9aFL1 0=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0C1AQCMhdpY/5FdJa1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBg1SBbAeDW4oPkVGIF401gg6GIgIagwc/GAECAQEBAQEBAWsohRU?= =?us-ascii?q?BAQEBAyMRRQwEAgEIEQQBAQECAiMDAgICHxEUAQgIAQEEDgUIiWcDFa0AgiaHM?= =?us-ascii?q?A2DEQEBAQEBAQEBAQEBAQEBAQEBAQEBAR2BC4VDhG+CUYFtLYJvgl8BBJwmOgG?= =?us-ascii?q?OFoQvkTyKb4h6AR84gQRZFYcZdYhggQ0BAQE?= X-IronPort-AV: E=Sophos;i="5.36,237,1486425600"; d="scan'208";a="404213041" Received: from rcdn-core-9.cisco.com ([173.37.93.145]) by alln-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 28 Mar 2017 15:48:56 +0000 Received: from XCH-RTP-006.cisco.com (xch-rtp-006.cisco.com [64.101.220.146]) by rcdn-core-9.cisco.com (8.14.5/8.14.5) with ESMTP id v2SFmt2O006084 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 28 Mar 2017 15:48:56 GMT Received: from xch-rtp-006.cisco.com (64.101.220.146) by XCH-RTP-006.cisco.com (64.101.220.146) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 28 Mar 2017 11:48:55 -0400 Received: from xch-rtp-006.cisco.com ([64.101.220.146]) by XCH-RTP-006.cisco.com ([64.101.220.146]) with mapi id 15.00.1210.000; Tue, 28 Mar 2017 11:48:55 -0400 From: "Scott Fluhrer (sfluhrer)" To: Martin Thomson CC: "" Thread-Topic: [TLS] The alternative idea I had for token buckets. Thread-Index: AdKn1wUM1ikoRY2eRq24o925ujkrJQAI5SuAAAg79lD//8DXAIAAQrPw Date: Tue, 28 Mar 2017 15:48:55 +0000 Message-ID: <4de0dc85d3844a90ad0b01a0953f3bc7@XCH-RTP-006.cisco.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.98.2.53] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] The alternative idea I had for token buckets. X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 15:49:05 -0000 DQo+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+IEZyb206IE1hcnRpbiBUaG9tc29uIFtt YWlsdG86bWFydGluLnRob21zb25AZ21haWwuY29tXQ0KPiBTZW50OiBUdWVzZGF5LCBNYXJjaCAy OCwgMjAxNyAxMTo0NiBBTQ0KPiBUbzogU2NvdHQgRmx1aHJlciAoc2ZsdWhyZXIpDQo+IENjOiA8 dGxzQGlldGYub3JnPg0KPiBTdWJqZWN0OiBSZTogW1RMU10gVGhlIGFsdGVybmF0aXZlIGlkZWEg SSBoYWQgZm9yIHRva2VuIGJ1Y2tldHMuDQo+IA0KPiBPbiAyOCBNYXJjaCAyMDE3IGF0IDEwOjQx LCBTY290dCBGbHVocmVyIChzZmx1aHJlcikgPHNmbHVocmVyQGNpc2NvLmNvbT4NCj4gd3JvdGU6 DQo+ID4gRV9LKFIpOyB0aGF0IGlzLCBSIGlzIGVuY3J5cHRlZCB3aXRoIHRoZSBzZXJ2ZXIncyBs b25nIHRlcm0ga2V5Lg0KPiA+DQo+ID4gKEkgbWVhbnQgdG8gc3BlY2lmeSB0aGF0Li4uKQ0KPiAN Cj4gDQo+IE9LLCBzbyBob3cgZG9lcyB0aGUgc2VydmVyIHJlY292ZXIgRV9LKFIpPyAgVGhlIHBv aW50IGhlcmUgaXMgdGhhdCBpdCBkb2Vzbid0DQo+IGtub3cgUi4NCg0KVGhlIHNlcnZlciByZWNv dmVycyBFX0soUikgYmVjYXVzZSB0aGUgY2xpZW50IHNlbnQgaXQgKGFsb25nIHdpdGggaSBhbmQg dGhlIHByb3RlY3RlZCBtZXNzYWdlKS4gIEl0IHJlY292ZXJzIFIgYmVjYXVzZSBpdCBhbHNvIGtu b3dzIEsuDQo= From nobody Tue Mar 28 08:51:05 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A160F12965B for ; Tue, 28 Mar 2017 08:51:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4ZWJdM2n6EyM for ; Tue, 28 Mar 2017 08:51:03 -0700 (PDT) Received: from mail-qt0-x235.google.com (mail-qt0-x235.google.com [IPv6:2607:f8b0:400d:c0d::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3722512940E for ; Tue, 28 Mar 2017 08:51:03 -0700 (PDT) Received: by mail-qt0-x235.google.com with SMTP id x35so67628813qtc.2 for ; Tue, 28 Mar 2017 08:51:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=WhcmNbWtiPJK9UeOFrKzveuBXBcFsoD6Qxh51S/yQpY=; b=Ry8kpU8H01dukeSrxy5vxRdSIa313aboqG1jVwAtNgR1fadzqSMrFNJ+VzjSbOjgpP VCWcX9CVVu6DnSNmThuH/5RS3BlHMzDfRKF5Z1lkIfws2leCBx1zkqsLPgogM+Hsj/he U5YQvfv4kpKjs4ivBAAmIxVh2OO6F7GWGCC8NTGdudqOSgFhSEz9X6YPjqEXp3zCER4+ BTxC2QCuJn5u9h+vvN+nZaSXRuj2eUU3vr6UNIw6Qo+yA9sQTmpCQclcwfdfXzyj51wU vItpkIfwLAFSrlpOSccyz8COcsTWkCBY7JyjOX3WsLSHeHRW/sB+V8BrzYwJHf3UxqW9 QPxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=WhcmNbWtiPJK9UeOFrKzveuBXBcFsoD6Qxh51S/yQpY=; b=SuUE9KRxInftVTMYv5DwFfCewyNM7hMyOWfV/Zczyd41TOpePyDtlMMKVyi4rIPobJ 8IgpTcd1D7UMd3eVHQ8Q0vU0P+gOf5Xq5hQHD10FztCcG8ddn9QbQkq8cUe/8rorcjMJ ljDP0058LoGRoN3N+evFlLUYfd16VfSWw29H6lBqKid1cOxvVW+gPBZPJLaXNDybyfNk lorSPT2z7E9/b2c3q6zn5x9bC/Kb3bzDnV0GoH7MaD3lXZsA/L6RrHqYQuesFy7bIIPw i/kpWUCflqPMeZ/83ifBHMvjC7ofxZPT4bYOF4jhD9Bz2UEWPgA5c3RVxEchZm5wVR0J uPGA== X-Gm-Message-State: AFeK/H25BeQHlgzJVOJxEA4lDcZ3q+pf6iYcrCcatARE+g+0EyXCFGcq9Y0Lz0+fowISIqnGwdVZQb6drW7okA== X-Received: by 10.237.41.100 with SMTP id s91mr29590842qtd.143.1490716262298; Tue, 28 Mar 2017 08:51:02 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Tue, 28 Mar 2017 08:51:01 -0700 (PDT) In-Reply-To: <4de0dc85d3844a90ad0b01a0953f3bc7@XCH-RTP-006.cisco.com> References: <4de0dc85d3844a90ad0b01a0953f3bc7@XCH-RTP-006.cisco.com> From: Martin Thomson Date: Tue, 28 Mar 2017 10:51:01 -0500 Message-ID: To: "Scott Fluhrer (sfluhrer)" Cc: "" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] The alternative idea I had for token buckets. X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 15:51:05 -0000 On 28 March 2017 at 10:48, Scott Fluhrer (sfluhrer) wrote: > The server recovers E_K(R) because the client sent it (along with i and the protected message). It recovers R because it also knows K. So E_K(R) is sent directly? That would link packets. From nobody Tue Mar 28 08:57:06 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E43AD126FB3 for ; Tue, 28 Mar 2017 08:57:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.523 X-Spam-Level: X-Spam-Status: No, score=-14.523 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 54rH4YIn2dgj for ; Tue, 28 Mar 2017 08:57:03 -0700 (PDT) Received: from alln-iport-1.cisco.com (alln-iport-1.cisco.com [173.37.142.88]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8250A120725 for ; Tue, 28 Mar 2017 08:57:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=838; q=dns/txt; s=iport; t=1490716623; x=1491926223; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=bb98V7YCIAnAhFdHnunpNkNNZFCDcwBH5Wt32QDYjxk=; b=DDeE1TZzpaXmK6f0m/mlf0ahQEvg/buZufpNr1nwWW8avlMSnflO3RE1 6Nc38KSGQpXX3THlwycWOTWrKpb5JJm+d5nYBNlXja+2TmMNkXit/bSt+ D+ML1qCrIh8RVPXIm0Ly8SWQ6wxqLEQclhBq+fJ45k3zj99mejsw2Fq2B Y=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0C1AQAih9pY/51dJa1dGQEBAQEBAQEBA?= =?us-ascii?q?QEBBwEBAQEBg1SBbAeDW4oPkVGIF401gg6GIgIagwc/GAECAQEBAQEBAWsohRU?= =?us-ascii?q?BAQEBAyMRRQwEAgEIEQQBAQECAiMDAgICHxEUAQgIAgQOBQiJZwMVrQeCJocvD?= =?us-ascii?q?YMRAQEBAQEBAQEBAQEBAQEBAQEBAQEBHYELhUOEb4JRgW0tgm+CXwEEnCY6AY4?= =?us-ascii?q?WhC+BbY9Pim+IegEfOIEEWRWHGXWIYIENAQEB?= X-IronPort-AV: E=Sophos;i="5.36,237,1486425600"; d="scan'208";a="401264613" Received: from rcdn-core-6.cisco.com ([173.37.93.157]) by alln-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 28 Mar 2017 15:57:02 +0000 Received: from XCH-RTP-008.cisco.com (xch-rtp-008.cisco.com [64.101.220.148]) by rcdn-core-6.cisco.com (8.14.5/8.14.5) with ESMTP id v2SFv2Na008480 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 28 Mar 2017 15:57:02 GMT Received: from xch-rtp-006.cisco.com (64.101.220.146) by XCH-RTP-008.cisco.com (64.101.220.148) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 28 Mar 2017 11:57:01 -0400 Received: from xch-rtp-006.cisco.com ([64.101.220.146]) by XCH-RTP-006.cisco.com ([64.101.220.146]) with mapi id 15.00.1210.000; Tue, 28 Mar 2017 11:57:01 -0400 From: "Scott Fluhrer (sfluhrer)" To: Martin Thomson CC: "" Thread-Topic: [TLS] The alternative idea I had for token buckets. Thread-Index: AdKn1wUM1ikoRY2eRq24o925ujkrJQAI5SuAAAg79lD//8DXAIAAQrPw//++o4CAAEGE0A== Date: Tue, 28 Mar 2017 15:57:01 +0000 Message-ID: <2a3cf37ab75e4a3d879d3ba8cc76e796@XCH-RTP-006.cisco.com> References: <4de0dc85d3844a90ad0b01a0953f3bc7@XCH-RTP-006.cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.98.2.53] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [TLS] The alternative idea I had for token buckets. X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 15:57:05 -0000 U29ycnksIEkgd2Fzbid0IGF3YXJlIHRoYXQgdW5saW5rYWJpbGl0eSB3YXMgYSByZXF1aXJlbWVu dC4uLg0KDQo+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+IEZyb206IE1hcnRpbiBUaG9t c29uIFttYWlsdG86bWFydGluLnRob21zb25AZ21haWwuY29tXQ0KPiBTZW50OiBUdWVzZGF5LCBN YXJjaCAyOCwgMjAxNyAxMTo1MSBBTQ0KPiBUbzogU2NvdHQgRmx1aHJlciAoc2ZsdWhyZXIpDQo+ IENjOiA8dGxzQGlldGYub3JnPg0KPiBTdWJqZWN0OiBSZTogW1RMU10gVGhlIGFsdGVybmF0aXZl IGlkZWEgSSBoYWQgZm9yIHRva2VuIGJ1Y2tldHMuDQo+IA0KPiBPbiAyOCBNYXJjaCAyMDE3IGF0 IDEwOjQ4LCBTY290dCBGbHVocmVyIChzZmx1aHJlcikgPHNmbHVocmVyQGNpc2NvLmNvbT4NCj4g d3JvdGU6DQo+ID4gVGhlIHNlcnZlciByZWNvdmVycyBFX0soUikgYmVjYXVzZSB0aGUgY2xpZW50 IHNlbnQgaXQgKGFsb25nIHdpdGggaSBhbmQgdGhlDQo+IHByb3RlY3RlZCBtZXNzYWdlKS4gIEl0 IHJlY292ZXJzIFIgYmVjYXVzZSBpdCBhbHNvIGtub3dzIEsuDQo+IA0KPiBTbyBFX0soUikgaXMg c2VudCBkaXJlY3RseT8gIFRoYXQgd291bGQgbGluayBwYWNrZXRzLg0K From nobody Tue Mar 28 09:18:09 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53BE8129654 for ; Tue, 28 Mar 2017 09:18:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vJ7JUr-T-mGT for ; Tue, 28 Mar 2017 09:18:03 -0700 (PDT) Received: from mail-qk0-x22f.google.com (mail-qk0-x22f.google.com [IPv6:2607:f8b0:400d:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B66031294A8 for ; Tue, 28 Mar 2017 09:18:03 -0700 (PDT) Received: by mail-qk0-x22f.google.com with SMTP id p22so69981002qka.3 for ; Tue, 28 Mar 2017 09:18:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=pCtRuJatGMVkTCf2t31kSRRaBvvPMD9Lkk88pVQ46as=; b=FvPNb2faKD5Zly6HYiF3cpX9fOZJWgJh3IWLGW1ogTFP2t+smaXoMpVf+3xI9AFZhz hUmSF643ruSE7nGct1qNq+WMLWnUP+3riVOr00bhFGFdw3Gbak/UFvN9/sj31KVS6Idg bXaauu6Q6KE4eE53St3nQwyitVbyoFKgZue49vs8hqNT1bJCnYd8c4BIBLp7lrU1mp5V DREnrTAiaBS5IPUSP/PWQkTy/Q5F+cKjssp62KDw0l5jyGzCpbDuFuwaOa2pX2mukIsM J6xl5dP0MCDFcwunizKNihO9ZHMTJRySr7Zxkp2YGtTDsDQyo5qCubWmF5IG0v1jFM/t voSg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=pCtRuJatGMVkTCf2t31kSRRaBvvPMD9Lkk88pVQ46as=; b=SlOtVohpKlwT1MwownpEGJYC2vI9ZegNYqrU5aIA19MFvxaS0gy4jfum8+3SdH95qK 2KTOny/DEADtOSme4C1Gu1vSO8qSpR/nEs5zPf07pAJVxmfrA2zy1NFN7FnbOY57i9Hv 5Zj7UwLgjadeuUhyIxSJ6woYm3i7Iq/coB9pb8oN5SMpSHYyz15g+zvXJuymB+TDYs4p QgzDc1pt8RS021kn7ZVXEODHEVFxy0UdjJ7ajiwfoV9MbFzDa6plBoZNszdMPQrlKiTo SRtQYGCBn8FenLbWOC/5QlwcHq5+K4UEvv+PH0J3Ke/yiXyjaG4Ki7wq4ofPXsOxC7JX y4Mw== X-Gm-Message-State: AFeK/H3OeXC82wNQLyvpaJgFLORwaRs1UHunOqwH+3d6sJ8fE9hKJlKhVLu8LvKjt8fEonoZGKB5Y5NET1DyjQ== X-Received: by 10.55.126.195 with SMTP id z186mr3077167qkc.144.1490717882849; Tue, 28 Mar 2017 09:18:02 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Tue, 28 Mar 2017 09:18:02 -0700 (PDT) In-Reply-To: <2a3cf37ab75e4a3d879d3ba8cc76e796@XCH-RTP-006.cisco.com> References: <4de0dc85d3844a90ad0b01a0953f3bc7@XCH-RTP-006.cisco.com> <2a3cf37ab75e4a3d879d3ba8cc76e796@XCH-RTP-006.cisco.com> From: Martin Thomson Date: Tue, 28 Mar 2017 11:18:02 -0500 Message-ID: To: "Scott Fluhrer (sfluhrer)" Cc: "" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] The alternative idea I had for token buckets. X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 16:18:08 -0000 On 28 March 2017 at 10:57, Scott Fluhrer (sfluhrer) wrote: > Sorry, I wasn't aware that unlinkability was a requirement... Yeah, it's the only hard requirement. :) From nobody Tue Mar 28 10:38:03 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7AC5212973E for ; Tue, 28 Mar 2017 10:38:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.001 X-Spam-Level: X-Spam-Status: No, score=-0.001 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ziA1F0il6L1G for ; Tue, 28 Mar 2017 10:37:59 -0700 (PDT) Received: from mail.objectiveintegration.uk (objectiveintegration.uk [134.213.135.47]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2B40E129771 for ; Tue, 28 Mar 2017 10:37:55 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.objectiveintegration.uk (Postfix) with ESMTP id DC74D1A02E4A for ; Tue, 28 Mar 2017 17:37:53 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at objectiveintegration.uk Received: from mail.objectiveintegration.uk ([127.0.0.1]) by localhost (mail.objectiveintegration.uk [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fQHz6d7BZ5TQ for ; Tue, 28 Mar 2017 17:37:30 +0000 (UTC) Received: from [192.168.110.205] (host81-129-252-225.range81-129.btcentralplus.com [81.129.252.225]) (Authenticated sender: mark.dunn@objectiveintegration.uk) by mail.objectiveintegration.uk (Postfix) with ESMTPSA id 3EF7F1A01A96 for ; Tue, 28 Mar 2017 17:37:30 +0000 (UTC) To: tls@ietf.org From: Mark Dunn Message-ID: <7017641b-dc2d-ad47-57dd-46f75d14157a@objectiveintegration.uk> Date: Tue, 28 Mar 2017 18:37:29 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="------------4C645683C65AA04C6DD9ADF0" Archived-At: Subject: [TLS] 4.1.2 Client Hello ammendment X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 17:38:01 -0000 This is a multi-part message in MIME format. --------------4C645683C65AA04C6DD9ADF0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit should the text that reads ClientHellos will contain at least two extensions, “supported_versions†and either “key_share†or “pre_shared_keyâ€. be changed to ClientHellos will always contain extensions. Both "key_share" and "pre_shared_key" require other extensions, so "at least two extensions" is incorrect. --------------4C645683C65AA04C6DD9ADF0 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit should the text that reads
    ClientHellos will contain at least two extensions, “supported_versions†and either “key_share†or “pre_shared_keyâ€.
be changed to
    ClientHellos will always contain extensions.

Both "key_share" and "pre_shared_key" require other extensions, so "at least two extensions" is incorrect.

--------------4C645683C65AA04C6DD9ADF0-- From nobody Tue Mar 28 13:09:26 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 163A612944C for ; Tue, 28 Mar 2017 13:09:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YR-GkqrdB2ar for ; Tue, 28 Mar 2017 13:09:23 -0700 (PDT) Received: from mail-qk0-x229.google.com (mail-qk0-x229.google.com [IPv6:2607:f8b0:400d:c09::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EEB9512948A for ; Tue, 28 Mar 2017 13:09:22 -0700 (PDT) Received: by mail-qk0-x229.google.com with SMTP id d10so69970554qke.1 for ; Tue, 28 Mar 2017 13:09:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:user-agent:cc:references:in-reply-to :mime-version:content-transfer-encoding:message-id; bh=dmth2fxICE0GRQgDe9HPG7Cceqme1m7RGjElDSRkSLA=; b=o8XVqmNv5a31Z86K5XR2b48ajmYN6ymyLtbnOA9umWS5B3xxm+y5cHZV2ommBNtPKa W2MGhBUKBuiamGK91HkxeF2f5up5k+CCKZlnvknfLcY2gQeNl6LWkIL4ya+O8DKDQIV2 8UTVShXyqlG3KLiziecE4gB9d9FH4Wh7z6NRAr29nqHH2PHbyN8czQ45H/l0E0TU65eo jMvjglyQTGiQnrclcJ30steVYj2eZugIl8MywKMQrXL6j33X7X2gBq7jptwFAIbyDLCr /P+y3qkXi2Aw/Nh3T9LzR5mdE1zz8StYTWUjbRYmziGhVExhnqOufehiReNCcTJii3xL 7WFQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:user-agent:cc:references :in-reply-to:mime-version:content-transfer-encoding:message-id; bh=dmth2fxICE0GRQgDe9HPG7Cceqme1m7RGjElDSRkSLA=; b=iV8j2GE/ou9JpG7/x97EMbFmC6fOni+EU9fJLrF4kWBLt0VIY+8TijMYI/iqxEuFYP CddfijgpXu2e0ibdN8Okl4S4LpXjB6APpGNlOgLGAOYYMgSE4MDIuBisdm6EdSwgGbkp IiyQg2NxKic4oEpDKAbNLS5vp2rtldRZ9NLhc/cGYKWdiQD60J8xpqwOWKUGJI/ZUype /HUcM3YA78OaS6/+XURSNJY/G/fnEn+Lq0uAuvJO180CyMWB5+qiJpD89O1QmIDrjEdZ SkBdDnylQzVzoDA5o+uEdFBER2dNh//PqtLNylTywRgGAYQ6aojKXFvuUgueQm73lPkO a12Q== X-Gm-Message-State: AFeK/H0W1nkUS/1RiP2jdvlSlFy2aFOXWYhnrGjGgN6EW8Wwoy6at9T3fIjM+8wg2BeOxA== X-Received: by 10.55.23.146 with SMTP id 18mr20468299qkx.157.1490731762047; Tue, 28 Mar 2017 13:09:22 -0700 (PDT) Received: from dave-laptop.localnet (pool-71-175-27-43.phlapa.fios.verizon.net. [71.175.27.43]) by smtp.gmail.com with ESMTPSA id c10sm3354186qka.1.2017.03.28.13.09.21 (version=TLS1 cipher=AES128-SHA bits=128/128); Tue, 28 Mar 2017 13:09:21 -0700 (PDT) From: Dave Garrett To: tls@ietf.org Date: Tue, 28 Mar 2017 16:09:19 -0400 User-Agent: KMail/1.13.5 (Linux/2.6.32-74-generic-pae; KDE/4.4.5; i686; ; ) Cc: Mark Dunn References: <7017641b-dc2d-ad47-57dd-46f75d14157a@objectiveintegration.uk> In-Reply-To: <7017641b-dc2d-ad47-57dd-46f75d14157a@objectiveintegration.uk> MIME-Version: 1.0 Content-Type: Text/Plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <201703281609.20291.davemgarrett@gmail.com> Archived-At: Subject: Re: [TLS] 4.1.2 Client Hello ammendment X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 20:09:25 -0000 On Tuesday, March 28, 2017 01:37:29 pm Mark Dunn wrote: > should the text that reads > ClientHellos will contain at least two extensions,=20 > =E2=80=9Csupported_versions=E2=80=9D and either =E2=80=9Ckey_share=E2=80= =9D or =E2=80=9Cpre_shared_key=E2=80=9D. > be changed to > ClientHellos will always contain extensions. >=20 > Both "key_share" and "pre_shared_key" require other extensions, so "at=20 > least two extensions" is incorrect. Um, that's still "at least two". ;) Taking a look at that section, there's a better line stating this just belo= w in another paragraph on the same topic. I've posted a quick PR to rewrite= this slightly to clean this up a bit. https://github.com/tlswg/tls13-spec/pull/922 Dave From nobody Tue Mar 28 13:31:27 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54143129590 for ; Tue, 28 Mar 2017 13:31:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U3UDuyRn2t_S for ; Tue, 28 Mar 2017 13:31:23 -0700 (PDT) Received: from mail-qt0-x22d.google.com (mail-qt0-x22d.google.com [IPv6:2607:f8b0:400d:c0d::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7AE581275AB for ; Tue, 28 Mar 2017 13:31:23 -0700 (PDT) Received: by mail-qt0-x22d.google.com with SMTP id n21so74742857qta.1 for ; Tue, 28 Mar 2017 13:31:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:user-agent:cc:references:in-reply-to :mime-version:content-transfer-encoding:message-id; bh=YHwlaEPyKk9iPTQXd5EG+qxqgLagUqar4atJE77u4ok=; b=vFCFcC20791a7KjI1PZrWNl98ciVV3yuT+hApZste0UCSqk/xp/Nm/UB6YbKaJsWTI XJy1CGPHrgECmGfgihKNOAk4k3jGuvKStlFXogzt3MPRFbAUmQYx4MJR2V8y+0F2QFuT 2+Ukc1rXSkFuRQ/XE3JI1s4vPjbeFIC/Q7JAp3XQW72OXhIZnuzscfWrcr9i+GL2yEUL LEH5pIccl7bfLkVw/3zjQy649lxuQVVegJDqC7XHY5vgdN+Ag6yK3d0rAbfxH6yqtb1a iRJo1di9f2PttL3sYws5ME7lMLkFtw301OUV0qCWpP7UJMl/28E8EenM3hqe1XXENO6q OS9w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:user-agent:cc:references :in-reply-to:mime-version:content-transfer-encoding:message-id; bh=YHwlaEPyKk9iPTQXd5EG+qxqgLagUqar4atJE77u4ok=; b=GZeDwZ5C5eCsFzrZ+PiKXfU6O8w0ESx2um2n6G74Lvbv9aRb/WKrak62JUSz5ApJvu OdTuDaxJGwlEWBUt9w7sxD7yn0gS46SmnKH6EFTJOAi+NM8U9igm8QXV16zLg3e+r+HP 3ZcqKZ8OOr7C5FAsazIZqLqmg/2I3HkOi448jAyQeDMhzWNX+RSBCAnud3JK5/sNusKG jDcW/DU1INNkalWeVKPvLTi+hL4U3NAqVpfke/1i/XvVAV3XPG9GLuOFSFTa0GU9S5BJ 5816RgpgcbraCJ55FMX6btMF2ml7GxhxYJ1NCByKwOoMJeWlsgw52Nli6UTzkhgu0U7O JfvA== X-Gm-Message-State: AFeK/H3Vvcp1Yc3q9zaupa52QnYMW7aLVD/1jrZxMWVDJgHJsqXriG+wZwQUCR2jFQYw2g== X-Received: by 10.237.53.231 with SMTP id d36mr27341832qte.240.1490733082531; Tue, 28 Mar 2017 13:31:22 -0700 (PDT) Received: from dave-laptop.localnet (pool-71-175-27-43.phlapa.fios.verizon.net. [71.175.27.43]) by smtp.gmail.com with ESMTPSA id t47sm3398408qte.45.2017.03.28.13.31.21 (version=TLS1 cipher=AES128-SHA bits=128/128); Tue, 28 Mar 2017 13:31:21 -0700 (PDT) From: Dave Garrett To: tls@ietf.org Date: Tue, 28 Mar 2017 16:31:20 -0400 User-Agent: KMail/1.13.5 (Linux/2.6.32-74-generic-pae; KDE/4.4.5; i686; ; ) References: <8B1F82C3-0289-4C55-A75C-1FA1C2F3F1CD@akamai.com> In-Reply-To: <8B1F82C3-0289-4C55-A75C-1FA1C2F3F1CD@akamai.com> MIME-Version: 1.0 Content-Type: Text/Plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <201703281631.20531.davemgarrett@gmail.com> Archived-At: Subject: Re: [TLS] draft-ietf-tls-tls13-19 section 1.2 cleanup X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 20:31:25 -0000 On Tuesday, March 28, 2017 11:31:56 am Short, Todd wrote: > I didn=E2=80=99t bring this up in the meeting this morning, but I=E2=80= =99d like to see section 1.2 =E2=80=9CMajor Differences from TLS 1.2=E2=80= =9D cleaned up. We don=E2=80=99t need to list the changes at each draft. In= stead, only the major difference from RFC 5246, et al., should be included.= It=E2=80=99s difficult to wade through this section as written. >=20 > I refer to RFC5246, section 1.2 as an appropriate (and useful) example. Yeah, this has come up a few times, also in another post here very recently= =2E It's always been on a vague todo list to fixup. I've filed an issue jus= t for this so we have it actually tracked. https://github.com/tlswg/tls13-spec/issues/923 Dave From nobody Tue Mar 28 13:42:56 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8EC5B1297ED for ; Tue, 28 Mar 2017 13:42:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ADrf2OV-PtOP for ; Tue, 28 Mar 2017 13:42:53 -0700 (PDT) Received: from mail-qt0-x229.google.com (mail-qt0-x229.google.com [IPv6:2607:f8b0:400d:c0d::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E50B5129A17 for ; Tue, 28 Mar 2017 13:42:51 -0700 (PDT) Received: by mail-qt0-x229.google.com with SMTP id x35so74907266qtc.2 for ; Tue, 28 Mar 2017 13:42:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:user-agent:cc:references:in-reply-to :mime-version:content-transfer-encoding:message-id; bh=xTrHR6tuv8OriQ4xXCe9pTK6PyO2MJnbhEpoHIDG04Y=; b=roBeF5pBJsZ/6mfSdr+p86qyCy/jNRPZw6z3OT+QqcJ3rKVdXf+LSaZ4IQ3G89zhMw s/PVglomih2iasqwdD5V8Zkd6WIc9q3LeSanaD4ble8uj4bvI0hKBb5J+lc5vG71iFs5 QmosO2lpS4+7Vcw88rW+bFNuip/ZvZ/zVe6Mxa1HUQyEoR9GrDQcyvgK2rs8SMnuWHdF LvWkbuYOuVpjoD65yhHgG9UtdAk9pTrgiOxKccdOIag/cxdCxdqcx9wW0JhEUdycbjpt vyXIiSAdEra5FLnQUfXMyISpmrpVy486fnE0JDT7NYcZdp0gUCi0YxNybJe95+MW7Yn6 hQnA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:user-agent:cc:references :in-reply-to:mime-version:content-transfer-encoding:message-id; bh=xTrHR6tuv8OriQ4xXCe9pTK6PyO2MJnbhEpoHIDG04Y=; b=p1z8qtK984jzj9twj3cWX5DVu1dtq37y5HKiBkoQB8+6SjD39nkRV0ufK0v2bV0JoN MZNUgakHBh15/VN1l00wgGv8Uuu7dYF2MFaM48u0P2zQqggyrQtIL50Sy4pbNupUNU7O YRIjBozsF9VTLJefgOwQVKpf0ursSFqvxh7uRM+gZWO4OZ7Z7yhDovImxo2aicgLthrh jlHWS5JrqnKpdmlPT08PlcBSyXOfmIdEKLVC7bQwlt/KZHuLcPxQup656FXlkot3efRh Uslpz3BrLu/HYzWzGQny0T7nD0e8uJHmur3t0WobjBtj10pXJ2+WZpJp5JGEYcOItn0o lE4g== X-Gm-Message-State: AFeK/H1oPVssGAvfhofyuhaVsMxfsrNCBpTbOhrZ+COPmS01xXvqmF6JSlWCa37wa1skKA== X-Received: by 10.200.55.181 with SMTP id d50mr31446468qtc.140.1490733771110; Tue, 28 Mar 2017 13:42:51 -0700 (PDT) Received: from dave-laptop.localnet (pool-71-175-27-43.phlapa.fios.verizon.net. [71.175.27.43]) by smtp.gmail.com with ESMTPSA id f128sm3419515qkd.62.2017.03.28.13.42.50 (version=TLS1 cipher=AES128-SHA bits=128/128); Tue, 28 Mar 2017 13:42:50 -0700 (PDT) From: Dave Garrett To: tls@ietf.org Date: Tue, 28 Mar 2017 16:42:48 -0400 User-Agent: KMail/1.13.5 (Linux/2.6.32-74-generic-pae; KDE/4.4.5; i686; ; ) References: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> <228B1CCF-088B-4F4C-B2FD-A20036B9224A@akamai.com> In-Reply-To: <228B1CCF-088B-4F4C-B2FD-A20036B9224A@akamai.com> MIME-Version: 1.0 Content-Type: Text/Plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <201703281642.49321.davemgarrett@gmail.com> Archived-At: Subject: Re: [TLS] WGLC: draft-ietf-tls-tls13-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 20:42:55 -0000 On Tuesday, March 28, 2017 02:23:33 am Kaduk, Ben wrote: > Should Alert.level be Alert.legacy_level? Yep. Trivial to fix, so quick PR filed for it. Dave From nobody Tue Mar 28 15:44:07 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5350D127B57; Tue, 28 Mar 2017 15:43:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ey7jtiiybL2t; Tue, 28 Mar 2017 15:43:49 -0700 (PDT) Received: from usplmg21.ericsson.net (usplmg21.ericsson.net [198.24.6.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D145124234; Tue, 28 Mar 2017 15:43:49 -0700 (PDT) X-AuditID: c6180641-c3fff70000000a06-42-58daa0c92dec Received: from EUSAAHC008.ericsson.se (Unknown_Domain [147.117.188.96]) by (Symantec Mail Security) with SMTP id 50.A7.02566.9C0AAD85; Tue, 28 Mar 2017 19:43:40 +0200 (CEST) Received: from EUSAAMB107.ericsson.se ([147.117.188.124]) by EUSAAHC008.ericsson.se ([147.117.188.96]) with mapi id 14.03.0339.000; Tue, 28 Mar 2017 18:43:44 -0400 From: Daniel Migault To: Jim Schaad , "curdle@ietf.org" CC: "saag@ietf.org" , "spasm@ietf.org" , "tls@ietf.org" , IPsecME WG Thread-Topic: [Curdle] FW: New Version Notification for draft-ietf-curdle-pkix-04.txt Thread-Index: AQEf37CDGDDCSU9BXbxVbCIypDLQd6MQV6aggAAQoyA= Date: Tue, 28 Mar 2017 22:43:44 +0000 Message-ID: <2DD56D786E600F45AC6BDE7DA4E8A8C118BB7D3A@eusaamb107.ericsson.se> References: <149073663013.1172.4888065212435317707.idtracker@ietfa.amsl.com> <051401d2a80b$e9bdea90$bd39bfb0$@augustcellars.com> In-Reply-To: <051401d2a80b$e9bdea90$bd39bfb0$@augustcellars.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.11] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpmkeLIzCtJLcpLzFFi42KZXLonQffMglsRBlf/qlhsXTiL2WL19O9s Fvu3vGCzmNLfyWQx71qyxafzXYwObB4b50xn81iy5CdTAFMUl01Kak5mWWqRvl0CV8bMva+Z CmaJV7z5MI2xgfG1UBcjB4eEgIlEU6dJFyMXh5DABkaJ3YfPsEE4yxklju+/wNTFyMnBJmAk 0Xaonx3EFhHwkbjy4AwrSBGzQAujxIorPxlBEsICYRKzZ79ngygKlzjd+ZkFwraSmLd/CyuI zSKgKnHh2XdGkM28Ar4SU954QSxrYpS4crgZbA6ngIPErca5YIsZBcQkvp9aA2YzC4hL3Hoy H8yWEBCQWLLnPDOELSrx8vE/VghbSeLj7/nsEPU6Egt2f2KDsLUlli18DVbPKyAocXLmE5YJ jKKzkIydhaRlFpKWWUhaFjCyrGLkKC0uyMlNNzLcxAiMmmMSbI47GPf2eh5iFOBgVOLhVTC5 FSHEmlhWXJl7iFGCg1lJhHf+MqAQb0piZVVqUX58UWlOavEhRmkOFiVx3nflFyKEBNITS1Kz U1MLUotgskwcnFINjOsanG9H7tCr+HAwitn45eSlPqKHWv7UhyuH2VjdcGmW6cxYespAukhA xKd0ztH7NgIdAeoLOLdfzTl4bnpTcm4jx/vHuueYL89ZMXtK9butNncZzPfo/H9RsmfHnw13 jD/lbOg4NHfRFfufv24uyFCb2m7X3fF9rk3Ywy9eb/4nm4tfr+UzmqbEUpyRaKjFXFScCAAN fttwlgIAAA== Archived-At: Subject: Re: [TLS] [Curdle] FW: New Version Notification for draft-ietf-curdle-pkix-04.txt X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 22:43:51 -0000 Hi,=20 Thank you Jim for the update. Here is the version resulting from the discus= sion we had during the WG meeting yesterday. Please review the document an= d provide your feed backs by April 4 so we can move the draft to the IESG.= =20 Yours,=20 Daniel -----Original Message----- From: Curdle [mailto:curdle-bounces@ietf.org] On Behalf Of Jim Schaad Sent: Tuesday, March 28, 2017 4:40 PM To: curdle@ietf.org Subject: [Curdle] FW: New Version Notification for draft-ietf-curdle-pkix-0= 4.txt Here is the promised updated draft. Changes: 1. Fixed an example that David Benjamin found was wrong. (Incorrect sign = bit in public key.) 2. Remove all of the pre-hash text except to note that= it does exist. 3. No changes to the OID arc being used despite the agreement during the m= eeting. After the meeting, Russ, the chairs and I had a short talk and dec= ided that this did not need to occur. The problem was only with getting ne= w values assigned not with the current values which were already assigned. That should be the final issues in the draft Jim > -----Original Message----- > From: internet-drafts@ietf.org [mailto:internet-drafts@ietf.org] > Sent: Tuesday, March 28, 2017 4:31 PM > To: Jim Schaad ; Simon Josefsson=20 > > Subject: New Version Notification for draft-ietf-curdle-pkix-04.txt >=20 >=20 > A new version of I-D, draft-ietf-curdle-pkix-04.txt has been=20 > successfully submitted by Jim Schaad and posted to the IETF repository. >=20 > Name: draft-ietf-curdle-pkix > Revision: 04 > Title: Algorithm Identifiers for Ed25519, Ed448, X25519 and X448 for > use in the Internet X.509 Public Key Infrastructure > Document date: 2017-03-28 > Group: curdle > Pages: 15 > URL: https://www.ietf.org/internet-drafts/draft-ietf-curdle-pk= ix-04.txt > Status: https://datatracker.ietf.org/doc/draft-ietf-curdle-pkix/ > Htmlized: https://tools.ietf.org/html/draft-ietf-curdle-pkix-04 > Htmlized: https://datatracker.ietf.org/doc/html/draft-ietf-curdle-p= kix-04 > Diff: https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-curdle-pki= x-04 >=20 > Abstract: > This document specifies algorithm identifiers and ASN.1 encoding > formats for Elliptic Curve constructs using the Curve25519 and > Curve448 curves. The signature algorithms covered are Ed25519 and > Ed448. The key agreement algorithm covered are X25519 and X448. The > encoding for Public Key, Private Key and EdDSA digital signature > structures is provided. >=20 >=20 >=20 >=20 > Please note that it may take a couple of minutes from the time of=20 > submission until the htmlized version and diff are available at tools.iet= f.org. >=20 > The IETF Secretariat _______________________________________________ Curdle mailing list Curdle@ietf.org https://www.ietf.org/mailman/listinfo/curdle From nobody Tue Mar 28 19:13:06 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6384C127275 for ; Tue, 28 Mar 2017 19:13:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ozHXMqlTP4v1 for ; Tue, 28 Mar 2017 19:13:04 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C576E12956B for ; Tue, 28 Mar 2017 19:13:02 -0700 (PDT) Received: from pps.filterd (m0050095.ppops.net [127.0.0.1]) by m0050095.ppops.net-00190b01. (8.16.0.20/8.16.0.20) with SMTP id v2T27RXV014122 for ; Wed, 29 Mar 2017 03:13:00 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=vzt8Dn6bSjVlXEK0B9WyjkFcf6KsgZRqRfFjfoh9D/o=; b=Yz+7agkMXAyQrUM2hicn5XebyXLPmtDY6swASNpom9mcu6xOPV+E7FCzSwURNe2jzLdV V1ob+79oAfE7LHj1TJL5HGff3WseB9uJAOJqmTn2rqfyvS9B84QRFZzU7kk0bgcOMYIf MtgJtwYD3QO2rmc1kKaALxq6Ns2d2awRBjqxvyf0qpjqNqrd1cRPogpk1wBTgP8YLxZO SXeEQjpPICN5XpTfXKka8a83E3PYgJymcPn8WQqj596zPJ9fskrf5Z6n23jp94hjgHTh w08EkoKzPxjUHQ03V7V9JNbcuI1QSvjy/z06R99z/4w6Ht5xEpJW0UDTg2MCd4qgNU7S Cg== Received: from prod-mail-ppoint3 ([96.6.114.86]) by m0050095.ppops.net-00190b01. with ESMTP id 29ft5mk3uw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 29 Mar 2017 03:13:00 +0100 Received: from pps.filterd (prod-mail-ppoint3.akamai.com [127.0.0.1]) by prod-mail-ppoint3.akamai.com (8.16.0.17/8.16.0.17) with SMTP id v2T2BEtw006209 for ; Tue, 28 Mar 2017 22:12:59 -0400 Received: from email.msg.corp.akamai.com ([172.27.25.32]) by prod-mail-ppoint3.akamai.com with ESMTP id 29ft4vgs18-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Tue, 28 Mar 2017 22:12:59 -0400 Received: from USTX2EX-DAG1LAG.msg.corp.akamai.com (172.27.27.106) by ustx2ex-dag1mb2.msg.corp.akamai.com (172.27.27.102) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Tue, 28 Mar 2017 21:12:58 -0500 Received: from ustx2ex-dag1mb6.msg.corp.akamai.com (172.27.27.107) by ustx2ex-dag1lag.msg.corp.akamai.com (172.27.27.106) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Tue, 28 Mar 2017 21:12:58 -0500 Received: from ustx2ex-dag1mb6.msg.corp.akamai.com ([172.27.27.107]) by ustx2ex-dag1mb6.msg.corp.akamai.com ([172.27.27.107]) with mapi id 15.00.1178.000; Tue, 28 Mar 2017 19:12:58 -0700 From: "Kaduk, Ben" To: "tls@ietf.org" Thread-Topic: review comments on draft-rescorla-tls-subcerts-01 Thread-Index: AQHSqDH7PyVKA0g+FE+PQRPt34CgAQ== Date: Wed, 29 Mar 2017 02:12:58 +0000 Message-ID: <11F20304-A244-4362-9042-E6CC3EDD304A@akamai.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.43.146] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-28_21:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703290017 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-28_21:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703290017 Archived-At: Subject: [TLS] review comments on draft-rescorla-tls-subcerts-01 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 02:13:05 -0000 R2V0dGluZyB0aGVzZSBpbiBlbWFpbCBiZWZvcmUgbXkgcHJpbnRvdXQgd2l0aCByZWQgbWFya2lu Z3MgZ2V0cyBidXJpZWQgaW4gYSBwaWxlLg0KDQpXZSBtZW50aW9uZWQgYWRkaW5nIGEgTlVMIGJ5 dGUgc2VwYXJhdG9yIGluIHRoZSBzaWduYXR1cmUgb24gdGhlIERlbGVnYXRlZENyZWRlbnRpYWwg KGFzIHdlbGwgYXMgc29tZSBvdGhlciBwb3RlbnRpYWwgdHdlYWtzIHRvIG5vcm1hbGl6ZSB0aGUg Y29udGV4dCBzdHJpbmdzIGVsc2V3aGVyZSBhbmQgaGVyZSkuDQoNCkRvIHdlIHdhbnQgdG8gbGVh dmUgdGhlIHZhbGlkIFNpZ25hdHVyZVNjaGVtZXMgYXMgYWxsIHRoYXQgYXJlIGRlZmluZWQsIG9y IG1lbnRpb24gdGhlIFJlY29tbWVuZGVkIGNvbHVtbiBpbiB0aGUgcmVnaXN0cnksIG9yIG5hcnJv dyB0aGluZ3MgZXZlbiBmdXJ0aGVyPyAgSW4gb3RoZXIgd29yZHMsIHNob3VsZCB3ZSBnaXZlIHNv bWUgZ3VpZGFuY2UgZm9yIGhvdyB0byBzZWxlY3QgYSBzY2hlbWUgdG8gdXNlPw0KDQotQmVuDQoN Cg== From nobody Tue Mar 28 19:25:18 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B95C612762F for ; Tue, 28 Mar 2017 19:25:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LnihNbB9FoeM for ; Tue, 28 Mar 2017 19:25:14 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 488DC1273E2 for ; Tue, 28 Mar 2017 19:25:14 -0700 (PDT) Received: from pps.filterd (m0050093.ppops.net [127.0.0.1]) by m0050093.ppops.net-00190b01. (8.16.0.20/8.16.0.20) with SMTP id v2T2HPUo012045 for ; Wed, 29 Mar 2017 03:25:12 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=S3ONGuA8DfIsOoFuC32+5PXO35CIOq6SHo0LZKo5/TI=; b=QDkHLlMMjvdrwj/Bkx656G0wUpGmDXY5TNsQNKTpUVdNngszizZPXHLsrFB3q0bQFYoP Kfg0xew1UytLPv2XcOBTFzYkDN3tNk9/nDKhwdB0M2/pOIAswF5j8Y5WXmJKMykujJ/Z fQfOL+WNMRhk/uA8LnTTKWpm4IOh+yJ9wCuaPk1nZaJDhwdsAybRzSXxuF5hg1f0cvkX 4ytNzpP/AY7UzfiKIC7nrg84C0dZanaNeeOXCqUE9b/UzdUfAezgD66f4WESaFApPt1Z tVwxI3azkMgDwRMJhh8yopzF8MSFC8hErOKY2PnMYTSM+/t1L/V0tGNCQfCoG853yA9S Yw== Received: from prod-mail-ppoint2 (a184-51-33-19.deploy.static.akamaitechnologies.com [184.51.33.19] (may be forged)) by m0050093.ppops.net-00190b01. with ESMTP id 29fsyu38ux-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 29 Mar 2017 03:25:11 +0100 Received: from pps.filterd (prod-mail-ppoint2.akamai.com [127.0.0.1]) by prod-mail-ppoint2.akamai.com (8.16.0.17/8.16.0.17) with SMTP id v2T2Mpp2022476 for ; Tue, 28 Mar 2017 22:25:10 -0400 Received: from email.msg.corp.akamai.com ([172.27.25.30]) by prod-mail-ppoint2.akamai.com with ESMTP id 29fsx689cs-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Tue, 28 Mar 2017 22:25:10 -0400 Received: from ustx2ex-dag1mb6.msg.corp.akamai.com (172.27.27.107) by ustx2ex-dag1mb6.msg.corp.akamai.com (172.27.27.107) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Tue, 28 Mar 2017 19:25:08 -0700 Received: from ustx2ex-dag1mb6.msg.corp.akamai.com ([172.27.27.107]) by ustx2ex-dag1mb6.msg.corp.akamai.com ([172.27.27.107]) with mapi id 15.00.1178.000; Tue, 28 Mar 2017 19:25:08 -0700 From: "Kaduk, Ben" To: "tls@ietf.org" Thread-Topic: review comments on draft-rescorla-tls-dtls13-01 Thread-Index: AQHSqDOvx+onzIw55EeoPXm5ZpiTwA== Date: Wed, 29 Mar 2017 02:25:08 +0000 Message-ID: <886102B6-C2CE-4257-BEB9-11F72000DE50@akamai.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.43.146] Content-Type: text/plain; charset="utf-8" Content-ID: <61578964F93ABE4B9FD1F0D4DDB96C07@akamai.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-28_21:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703290018 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-28_21:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1703290018 Archived-At: Subject: [TLS] review comments on draft-rescorla-tls-dtls13-01 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 02:25:16 -0000 QSBmZXcgdGhpbmdzIEkgbm90aWNlZCB3aGlsZSByZWFkaW5nIHRoZSBkcmFmdCB0byBwcmVwYXJl IGZvciB0b2RheeKAmXMgc2Vzc2lvbjoNCg0KV2UgdGFsayBpbiBhIGNvdXBsZSBwbGFjZXMgYWJv dXQgZGF0YWdyYW0gcHJvdG9jb2xzIGJlaW5nIOKAnHZ1bG5lcmFibGXigJ0gb3Ig4oCcc3VzY2Vw dGlibGXigJ0gdG8gRG9TIGF0dGFja3MsIHdoaWNoIGxlYWRzIG1lIHRvIGF0IGxlYXN0IHBhcnRp YWxseSByZWFkIHRoYXQgYXMgbWVhbmluZyB0aGF0IHRoZSBwcm90b2NvbOKAmXMgb3duIHNlcnZp Y2Ugd2lsbCBiZSBkaXNydXB0ZWQ7IGFzIHdlIGtub3csIHRoaXMgaXMgbm90IHRoZSB3aG9sZSBz dG9yeSwgYXMgdGhlIHJlZmxlY3Rpb24vYW1wbGlmaWNhdGlvbiBwYXJ0IGNhbiBmYWNpbGl0YXRl IERvUyBhdHRhY2tzIHRhcmdldGVkIGF0IG90aGVyIHNlcnZpY2VzL25ldHdvcmtzLiAgU28gcGVy aGFwcyBzb21lIHJld29yZGluZyBpcyBpbiBvcmRlci4NCg0KV2Ugc2hvdWxkIGNhdGNoIHVwIHRv IHRoZSBDbGllbnRIZWxsbzEgYmVpbmcgaW5jbHVkZWQgaW4gdGhlIHRyYW5zY3JpcHQgaGFzaCBh cyB0aGUgc3ludGhldGljIG1lc3NhZ2VfaGFzaCBtZXNzYWdlLCBzbyB0aGUgZnVsbCB0cmFuc2Ny aXB0IG9mIGl0IG5lZWQgbm90IGJlIHN0b3JlZCBpbiB0aGUgSGVsbG9SZXRyeVJlcXVlc3QuDQoN Ck9uIHBhZ2UgMjAsIHNlY29uZCBwYXJhZ3JhcGgsIHBsZWFzZSBiZSBjbGVhciB0aGF0IGl0IGlz IHRoZSBtZXNzYWdlX3NlcSB2cy4gdGhlIHJlY29yZCBzZXF1ZW5jZV9udW1iZXIgdGhhdCBtdXN0 IG1hdGNoIG5leHRfcmVjZWl2ZV9zZXEuDQoNCkkgYWxzbyBtYWRlIGEgbm90ZSBvZiB0aGUgZGlm ZmVyZW50IGtleSB1cGRhdGUgYmVoYXZpb3Igb2YgdGhpcyBkcmFmdCB2cy4gZHJhZnQtaWV0Zi10 bHMtdGxzMTMtMTksIHdpdGggdGhlIGVwb2NoIGNoYW5nZSBhbmQgbG9ja3N0ZXAgcmVrZXlpbmcg YmV0d2VlbiBwZWVycy4gIFRoYXQgd2FzIGluIHRoZSBwcmVzZW50YXRpb24gYXMgd2VsbCwgYnV0 IEkgaGF2ZW7igJl0IGhhZCBteSB0aG91Z2h0cyBzZXR0bGUgaW50byB3aGljaCBmbGF2b3IgSSBw cmVmZXIsIHlldCwgdGhvdWdoIHRoZSBleHBsaWNpdCBLZXlVcGRhdGUgZG9lcyBoYXZlIHNvbWUg YWR2YW50YWdlcy4NCg0KLUJlbg0KDQo= From nobody Tue Mar 28 20:33:23 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D23E3127F0E for ; Tue, 28 Mar 2017 20:33:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.72 X-Spam-Level: X-Spam-Status: No, score=-2.72 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fb.com header.b=GxTj1tf+; dkim=pass (1024-bit key) header.d=fb.onmicrosoft.com header.b=klK46QpK Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SIRhT-rqj0kZ for ; Tue, 28 Mar 2017 20:33:19 -0700 (PDT) Received: from mx0a-00082601.pphosted.com (mx0a-00082601.pphosted.com [67.231.145.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E553C127BA3 for ; Tue, 28 Mar 2017 20:33:19 -0700 (PDT) Received: from pps.filterd (m0044012.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v2T3UC5g020057; Tue, 28 Mar 2017 20:33:14 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-transfer-encoding : mime-version; s=facebook; bh=+9Kwafj6ezv6/r2BBIjjHFXLY0zlQRw3+5TtEctKXuY=; b=GxTj1tf+yquJltrqJPIGcm7ohanPH6+b+b0+CM2lYNT9CwxDp045ssMivDE7ZXwcKPb7 bz/gZN85R6DE4tQfPn6Gc/UVzh2S09mGQJKZHMqteJ5BBJ3zdDg/NTl7RyZtsXVHhoi8 Cp8B52WSogBNpZhAbeFYmJ0SR0wsM1bt6OA= Received: from mail.thefacebook.com ([199.201.64.23]) by mx0a-00082601.pphosted.com with ESMTP id 29fyf4s3nd-1 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 28 Mar 2017 20:33:14 -0700 Received: from NAM02-CY1-obe.outbound.protection.outlook.com (192.168.54.28) by o365-in.thefacebook.com (192.168.16.22) with Microsoft SMTP Server (TLS) id 14.3.319.2; Tue, 28 Mar 2017 20:33:13 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.onmicrosoft.com; s=selector1-fb-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=+9Kwafj6ezv6/r2BBIjjHFXLY0zlQRw3+5TtEctKXuY=; b=klK46QpK+FqYyxnoHYb6WXcumPmLT5kpUdjof3Uhkl+Rwmei7UNTaDCzouRiAviAcPjFJ4nmrIa0lKsBRMp2nLgmxXiRb1SDQ5hoGCvvnf9TcqnO1cjkYOC10dQcAovHBC7nTBN4dJt1gba8j8FnoKiia9VVKu4nBdkCjxgbEgY= Received: from MWHPR15MB1182.namprd15.prod.outlook.com (10.175.2.136) by MWHPR15MB1184.namprd15.prod.outlook.com (10.175.2.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.991.14; Wed, 29 Mar 2017 03:33:11 +0000 Received: from MWHPR15MB1182.namprd15.prod.outlook.com ([10.175.2.136]) by MWHPR15MB1182.namprd15.prod.outlook.com ([10.175.2.136]) with mapi id 15.01.0991.021; Wed, 29 Mar 2017 03:33:11 +0000 From: Kyle Nekritz To: Dave Garrett , "tls@ietf.org" Thread-Topic: [TLS] WGLC: draft-ietf-tls-tls13-19 Thread-Index: AQHSnB+1EIcQN0h+c0CXAm3DuJGZoaGp32aAgADwEwCAAHDrHg== Date: Wed, 29 Mar 2017 03:33:11 +0000 Message-ID: References: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> <228B1CCF-088B-4F4C-B2FD-A20036B9224A@akamai.com>, <201703281642.49321.davemgarrett@gmail.com> In-Reply-To: <201703281642.49321.davemgarrett@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=fb.com; x-originating-ip: [25.172.93.132] x-microsoft-exchange-diagnostics: 1; MWHPR15MB1184; 7:LpmhyA7RjV/ucCL2PeZYT8L+fkjLLqUk8nM8+h6fksz7j8DMm/u4Rl3YBBMMnQ1sglFGzAJrCzpnIFskQkmlNEVbmp5nyYiJhRGbTaXL7Y6Kgbvh4eX08DqGepsjj7PMQ8pfnYF3UNSkr4iHPTtlFR/o8CjuE0tpfPGBMfdi4mzf8dRthQEvlS8+ITn46F9BJQETyS+N7Sv0vVysdSiQcQ+d62li2q0RsJVEXZZ2QnCccafCwDHcfBfDHuNTiLXvqAgm+BDc/+7pVI1FwSIsiiLhr0QJ0MoECIT/N2k9NogszUu3aaQZCU+5HhDrb9BgCJzygNiWCw94mXdgUfXJTw==; 20:NVPNKg7fzVgP445pEYRIRtulnFx5QTAjUhgm3+xsB6ImverPnP6IYNh5J5mZOHcv+39W5W53LgwTRNkcXtp7hSLGUan6Qs1UCze7S5MqCta7pW68rSF3hnDuFSw7j6PdaJbPYYRRti06WvYWiTLCplzncaVxeyv71q+Rvk/T2DA= x-ms-office365-filtering-correlation-id: 19add976-d1ae-48e0-6a21-08d47654534b x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(201703131423070)(201703031133076)(201702281549070); SRVR:MWHPR15MB1184; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(10436049006162); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040445)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6041248)(20161123560025)(201703131423070)(201702281528070)(201703061421070)(201703061406070)(20161123564025)(20161123555025)(20161123562025)(20161123558025)(6072148); SRVR:MWHPR15MB1184; BCL:0; PCL:0; RULEID:; SRVR:MWHPR15MB1184; x-forefront-prvs: 0261CCEEDF x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(39400400002)(39410400002)(39850400002)(39450400003)(39840400002)(377454003)(24454002)(50986999)(2906002)(122556002)(76176999)(229853002)(2501003)(54356999)(7696004)(86362001)(3660700001)(3280700002)(2900100001)(230783001)(66066001)(189998001)(33656002)(6436002)(575784001)(2950100002)(7736002)(8936002)(77096006)(99286003)(55016002)(6506006)(305945005)(6306002)(81166006)(53936002)(6246003)(6116002)(25786009)(53546009)(9686003)(8676002)(5660300001)(74316002)(38730400002)(39060400002)(102836003)(3846002); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR15MB1184; H:MWHPR15MB1182.namprd15.prod.outlook.com; FPR:; SPF:None; MLV:ovrnspm; PTR:InfoNoRecords; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Mar 2017 03:33:11.0502 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR15MB1184 X-OriginatorOrg: fb.com X-Proofpoint-Spam-Reason: safe X-FB-Internal: Safe X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-28_21:, , signatures=0 Archived-At: Subject: Re: [TLS] WGLC: draft-ietf-tls-tls13-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 03:33:22 -0000 I raised this before in PR #693 (https://www.ietf.org/mail-archive/web/tls/= current/msg21600.html). I'm not sure it makes sense to rename this to legacy while other parts of t= he document still refer to it. But I'm definitely in favor of deprecating i= t. From: TLS on behalf of Dave Garrett Sent: Tuesday, March 28, 2017 4:42 PM To: tls@ietf.org Subject: Re: [TLS] WGLC: draft-ietf-tls-tls13-19 =A0 =20 On Tuesday, March 28, 2017 02:23:33 am Kaduk, Ben wrote: > Should Alert.level be Alert.legacy_level? Yep. Trivial to fix, so quick PR filed for it. Dave _______________________________________________ TLS mailing list TLS@ietf.org https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman= _listinfo_tls&d=3DDwICAg&c=3D5VD0RTtNlTh3ycd41b3MUw&r=3Dl2j4BjkO0Lc3u4CH2z7= jPw&m=3Dix39YzN5D9ZIP69oc6EpeIHky4mBDPr78L-0dRI3acY&s=3DwDljuAs_X9UuW_4VC-T= wYR9TkDPrKiVZz7oRdOmL3aA&e=3D = From msahli@enst.fr Wed Mar 29 05:41:37 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA42C129516 for ; Wed, 29 Mar 2017 05:41:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.5 X-Spam-Level: X-Spam-Status: No, score=-1.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_SORBS_SPAM=0.5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=telecom-paristech.fr Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gHC3jj4huQU6 for ; Wed, 29 Mar 2017 05:41:35 -0700 (PDT) Received: from zproxy110.enst.fr (zproxy110.enst.fr [137.194.2.192]) by ietfa.amsl.com (Postfix) with ESMTP id 8C9C31294FE for ; Wed, 29 Mar 2017 05:41:35 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by zproxy110.enst.fr (Postfix) with ESMTP id 85BC1103148; Wed, 29 Mar 2017 14:41:34 +0200 (CEST) Authentication-Results: zproxy110.enst.fr (amavisd-new); dkim=pass (1024-bit key) header.d=telecom-paristech.fr Received: from zproxy110.enst.fr ([127.0.0.1]) by localhost (zproxy110.enst.fr [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id tRg4aSddhPGf; Wed, 29 Mar 2017 14:41:34 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by zproxy110.enst.fr (Postfix) with ESMTP id 02BF310314D; Wed, 29 Mar 2017 14:41:34 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.9.2 zproxy110.enst.fr 02BF310314D DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telecom-paristech.fr; s=A6AEC2EE-1106-11E5-B10E-D103FDDA8F2E; t=1490791294; bh=NARYu7dgpAOjdVuPS9g7UmJsYQ8eaLwNr55sQ+a8l90=; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type: Content-Transfer-Encoding; b=MwslMUS0wb2wI9+rgmW1IBtKApoRYSFnkC5CId5felu+0yXObS9uEPy8h1TNjdp4a dDmeBkc4loOyv1hygNgdiNIpEe53r5utxPyrL63I3LVXQKw9wLnUylTHELr1OBTv/S mRd5zvHiscbBCE5dDlhVpNrOACv+xTEeAvMNoHMc= X-Virus-Scanned: amavisd-new at zproxy110.enst.fr Received: from zproxy110.enst.fr ([127.0.0.1]) by localhost (zproxy110.enst.fr [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 2d99u2Zsrla4; Wed, 29 Mar 2017 14:41:33 +0200 (CEST) Received: from zmail111.enst.fr (zmail111.enst.fr [137.194.2.201]) by zproxy110.enst.fr (Postfix) with ESMTP id C5BBB103148; Wed, 29 Mar 2017 14:41:33 +0200 (CEST) Date: Wed, 29 Mar 2017 14:41:33 +0200 (CEST) From: Mounira Msahli To: tls@ietf.org Cc: Houda Labiod , ahmed serhrouchni Message-ID: <50700431.53802914.1490791293494.JavaMail.zimbra@enst.fr> In-Reply-To: <851B7D2D-C8E0-4D9F-9259-877D0666956E@sn3rd.com> References: <1575133442.47281418.1481107447078.JavaMail.zimbra@enst.fr> <1260834683.47309360.1481109342289.JavaMail.zimbra@enst.fr> <1BD268B1-1501-4A89-A243-3222B82D294E@sn3rd.com> <225960635.46624063.1490006387696.JavaMail.zimbra@enst.fr> <851B7D2D-C8E0-4D9F-9259-877D0666956E@sn3rd.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Originating-IP: [137.194.2.193] X-Mailer: Zimbra 8.0.9_GA_6191 (ZimbraWebClient - FF44 (Win)/8.0.9_GA_6191) Thread-Topic: ITS ETSI/IEEE-TLS extension Thread-Index: grEIeWv1dMfHVq17pt/I1Lf+MgE8qA== Archived-At: Subject: [TLS] ITS ETSI/IEEE-TLS extension X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 12:43:29 -0000 Dear TLS list members, I have updated the draft: Transport Layer Security (TLS) Authentication using ITS ETSI and IEEE certificates, https://www.ietf.org/id/draft-serhrouchni-tls-certieee1609-01.txt My team and I currently working on three major secure vehicular communications projects in Europe: Intercor, SCOOP@F and C-Road. The purpose of this projects is the setting of public key infrastructure for vehicular network. we use the ETSI and IEEE-1609 certificates to make secure link inter-vehicles and between vehicle and its network infrastructure. In this context we propose the draft: "Transport Layer Security (TLS) Authentication using ITS ETSI and IEEE certificates". We extend TLS to support ETSI and IEEE-1609 certificates. This extension is very usefull and has become a pressing need. We already validated our proposal with two implementations over OPENSSL and GNUTLS librairies. Now we want to submit our work on your IETF working group for review. Your working group would be most appropriate for the proposed draft. Could you please send me your comments. Best regards Mounira MSAHLI From nobody Wed Mar 29 06:10:59 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD7E8126C26 for ; Wed, 29 Mar 2017 06:10:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lz9vF5Z2Mt95 for ; Wed, 29 Mar 2017 06:10:55 -0700 (PDT) Received: from mail.objectiveintegration.uk (objectiveintegration.uk [134.213.135.47]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 97C10126DD9 for ; Wed, 29 Mar 2017 06:10:54 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.objectiveintegration.uk (Postfix) with ESMTP id 302691A02E40 for ; Wed, 29 Mar 2017 13:10:53 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at objectiveintegration.uk Received: from mail.objectiveintegration.uk ([127.0.0.1]) by localhost (mail.objectiveintegration.uk [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qQtrgPTs-foQ for ; Wed, 29 Mar 2017 13:10:29 +0000 (UTC) Received: from [192.168.110.205] (host86-136-78-129.range86-136.btcentralplus.com [86.136.78.129]) (Authenticated sender: mark.dunn@objectiveintegration.uk) by mail.objectiveintegration.uk (Postfix) with ESMTPSA id 13C341A01A96 for ; Wed, 29 Mar 2017 13:10:29 +0000 (UTC) To: tls@ietf.org From: Mark Dunn Message-ID: <16998c3d-4de6-7c88-d8a3-6d6193326500@objectiveintegration.uk> Date: Wed, 29 Mar 2017 14:10:28 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [TLS] xLS 1.3: cookie X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 13:10:58 -0000 I am trying to implement cookie and finding it a little underspecified. I am using the TLS 1.3 specified in github and draft-rescorla-tls-dtls13-01 1a) Should a client expect to respond to a cookie during session resumption? It seems unlikelyas it would kill 0-RTT, and I am not sure whetherit would reduce the workload of the server. ClientHello +pre_shared_key +early_data +... -----> HelloRetryRequest <----- +cookie ClientHello +cookie +pre_shared_key +... -----> ServerHello +pre_shared_key <----- +... ClientResponse finished application Data -----> 1b) If (1a) is false then do you agree that the "cookie" extension MUST be accompanied by the "key_share" extension? Otherwisewe might be faced with ClientHello +key_share +... -----> HelloRetryRequest <-----+cookie ClientHello +cookie +key_share +... -----> HelloRetryRequest <----- +key_share ClientHello +key_share +... -----> ServerHello +key_share +... 2) I understand this is too late for TLS(only DTLS SHOULD use cookies) but is there a better solution than a cookie? While the use of the "cookie extension" helps mitigate DOS and DOS amplification(ref draft-rescorla-tls-dtls13-01 section 5.1), it penalises the legitimate client which requires an extra round trip.Alsocookie does not help with a botnet attack where the bots may send legitimate unauthenticated requests. For authenticatedclients a botnet DOS attack could be mitigated by authenticating the clientfirst. In the worst case where the client provided an unacceptable key_share the Server would have to provide ClientHello // flight 1 +key_share +signature_algorithms +supported_groups +... -----> HelloRetryRequest // flight 2 +cookie // from DTLS 1.2: HMAC(secret, Client-IP, Client-Parameters) +key_share(server_share) +signature_algorithms // not required as supplied by client +supported_groups // not required as supplied by client <----- {CertificateRequest} // implied when key_share(server_share) is used ClientHello // flight 3 +key_share +cookie // this may provide state information to the server +... {Cetrificate} {CertificateVerify} {finished} // provides reachability for the client first and is protected by server_handshake_traffic_secret [application data] -----> // protected using keys derived from traffic_secret_N ServerHello // flight 4 {EncryptedExtensions} {Certificate} {CertificateVerify} {Finished} // provides reachability for the server <----- [application data] For authenticating clients, this would provide better defense against DOS, DOS amplification and require fewer round trips. From nobody Wed Mar 29 07:19:08 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0BFB5129513 for ; Wed, 29 Mar 2017 07:19:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TSAEnzVHVg3m for ; Wed, 29 Mar 2017 07:19:04 -0700 (PDT) Received: from welho-filter2.welho.com (welho-filter2.welho.com [83.102.41.24]) by ietfa.amsl.com (Postfix) with ESMTP id 00E7F129507 for ; Wed, 29 Mar 2017 07:19:04 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter2.welho.com (Postfix) with ESMTP id ED594209D7; Wed, 29 Mar 2017 17:19:02 +0300 (EEST) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp2.welho.com ([IPv6:::ffff:83.102.41.85]) by localhost (welho-filter2.welho.com [::ffff:83.102.41.24]) (amavisd-new, port 10024) with ESMTP id YNM521a41svo; Wed, 29 Mar 2017 17:19:02 +0300 (EEST) Received: from LK-Perkele-V2 (87-92-51-204.bb.dnainternet.fi [87.92.51.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp2.welho.com (Postfix) with ESMTPSA id BB21621C; Wed, 29 Mar 2017 17:19:02 +0300 (EEST) Date: Wed, 29 Mar 2017 17:19:01 +0300 From: Ilari Liusvaara To: Mounira Msahli Cc: tls@ietf.org, Houda Labiod , ahmed serhrouchni Message-ID: <20170329141901.GB23157@LK-Perkele-V2.elisa-laajakaista.fi> References: <1575133442.47281418.1481107447078.JavaMail.zimbra@enst.fr> <1260834683.47309360.1481109342289.JavaMail.zimbra@enst.fr> <1BD268B1-1501-4A89-A243-3222B82D294E@sn3rd.com> <225960635.46624063.1490006387696.JavaMail.zimbra@enst.fr> <851B7D2D-C8E0-4D9F-9259-877D0666956E@sn3rd.com> <50700431.53802914.1490791293494.JavaMail.zimbra@enst.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <50700431.53802914.1490791293494.JavaMail.zimbra@enst.fr> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: ilariliusvaara@welho.com Archived-At: Subject: Re: [TLS] ITS ETSI/IEEE-TLS extension X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 14:19:06 -0000 On Wed, Mar 29, 2017 at 02:41:33PM +0200, Mounira Msahli wrote: > Dear TLS list members, > > I have updated the draft: Transport Layer Security (TLS) > Authentication using ITS ETSI and IEEE certificates, > https://www.ietf.org/id/draft-serhrouchni-tls-certieee1609-01.txt This uses *certificate_type extension, which is well-known to be extremely poor match for TLS 1.3. And for application like this, one wants something that is usable with TLS 1.3. Furthermore, it doesn't specify how the certificate message is interpretted. Also, as of currently, the highest ECC performance in TLS is X25519 for key exchange and Ed25519 for authentication. -Ilari From nobody Wed Mar 29 07:28:52 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6115D129527 for ; Wed, 29 Mar 2017 07:28:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.922 X-Spam-Level: X-Spam-Status: No, score=-6.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CFyhuEMEZuyg for ; Wed, 29 Mar 2017 07:28:49 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 304D4124D37 for ; Wed, 29 Mar 2017 07:28:49 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id C046381253 for ; Wed, 29 Mar 2017 14:28:48 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com C046381253 Authentication-Results: ext-mx01.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx01.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=nmav@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com C046381253 Received: from dhcp-10-40-1-102.brq.redhat.com (unknown [10.40.3.166]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 407577D9ED for ; Wed, 29 Mar 2017 14:28:48 +0000 (UTC) Message-ID: <1490797726.28079.18.camel@redhat.com> From: Nikos Mavrogiannopoulos To: "tls@ietf.org" Date: Wed, 29 Mar 2017 16:28:46 +0200 Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Wed, 29 Mar 2017 14:28:48 +0000 (UTC) Archived-At: Subject: [TLS] comments on draft-ietf-tls-tls13-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 14:28:51 -0000 Hi, In this mail I summarize my comments for draft-ietf-tls-tls13-19 (which I have read but not implemented). They include both editorial comments and content comments. Overall this is a very good document, congratulations to everyone involved. On the following text, I use the format Section: Comment. 1.2. Major Differences from TLS 1.2  It is very hard to make use of this section as is. It is organized on per-draft, while it would be expected to have the changes of the document since TLS 1.2. It contains phrases like "Remove spurious requirement to implement "pre_shared_key"." At its current state it is not useful to someone familiar with TLS 1.2. 2. Figure 1 ascii art is a bit awkward (IMHO). "Key Exch" looks like bad shortening. Symbols '^' and 'v' were confusing on the first read. A suggestion could be to avoid ^v, and define shortened terminology upfront and use it on the figures. One the content, Figure 1 contents are too many to swallow at an overview. A suggestion would be to split into two diagrams (preshared keys and not). A more general note on the section/document, is that although the PKIX identity (certificate) is protected from passive adversaries, the PSK identity is not. This is a discrepancy in terms of protecting the user's identity between PSK and certificate authentication (that should warrant . 4.1.1. HelloRetryRequest how many times can it be re-sent by the server? I assume only a single one, but it maybe good to make it explicit. 4.1.2. It is not defined what a server should do if encountered with a ProtocolVersion of TLS 1.3. 4.2. rfc6961 is standard's track but TLS 1.3 only uses the RFC6066 status request. Why not require RFC6961? 4.2. the exception for including cookie in HelloRetryRequest seems like something that could cause issues in future revisions. Any future revision of the protocol would not be able to add such exceptions (since they will be rejected by existing clients), and the fact that the cookie is there, it indicates that such an exception may be useful. A suggestion to address that would be to allow the HelloRetryRequest contain any extension or grant an exception to a specific extension number range. 4.2.5.2. The parameters are informally defined. I'd suggest to follow rfc4492bis and use its text as in: https://tools.ietf.org/html/draft-ietf-tls-rfc4492bis-16#section-5.4.1 4.2.7. There is no guidance on the use of max_early_data_size.  I'd find it natural to have a recommended minimum value for application protocols layered on TLS to take into account. E.g., text like servers supporting early_data SHOULD allow at least 1024 bytes of data (arbitrary number). Is the 32-bit upper limit intentional? 4.2.8. This section changes the semantics for pre-shared keys as used in any other protocol (including TLS 1.2). With the new text it implies, pre-shared keys must be combined with a hash algorithm. Thus existing PSK deployments which share keys and would like to upgrade to TLS 1.3 cannot do transparently. They would have to fix to a specific hash algorithm for their existing PSKs, and make sure they provide that information to all the underlying software (which may be different on the server and client side). I could find no implementation guideline on what to do in the case of pre-existing PSKs in that text. My recommendation would be to switch the sentence "For externally established PSKs, the Hash algorithm MUST be set when the PSK is established" to "For externally established PSKs, the Hash algorithm MUST be set when the PSK is established, or default to SHA-256". That way implementations can cope transparently with an upgrade to TLS 1.3 for already present PSK keys without requiring an additional RFC describing that. 4.2.8. The overlap of the namespace for usernames to be used in PSK authentication, and the namespace for "resumption" does not give a good feeling. 4.2.8. Related to the above, it is unclear what obfuscated_ticket_age should contain when using PSK authentication (but not resumption). 4.2.8.1. It is not defined what the binder should contain when using PSK authentication (but not resumption). 4.2.8.1. If a single binder corresponds to a single identity, the parsing and mapping of binders in the PreSharedKeyExtension seems unnecessarily complicated. A suggestion is to move the binder inside each identity structure: struct {           opaque identity<1..2^16-1>;           uint32 obfuscated_ticket_age; opaque PskBinderEntry<32..255>; } PskIdentity; 4.2.8.3. I believe that section can benefit from some improvements. >From a first read it is not clear what this section wants to protect from. It provides some checks, but it is unclear to me what these protect from. Some more concrete comments on the same section: It mentions "see if the value used by the client matches its expectations". A question that arises, is what is the recommended expectation for a server? Given the text in 4.2.8 that should be a week, but the text in 4.2.8 seems to imply that the restriction is defined somewhere else, and I would have expected it to be here. The text recommends: "a server SHOULD measure the round trip time prior to sending the NewSessionTicket message". I see two issues here. (1) it doesn't mention how to do this measurement --my guess is that this can be done in the context of TLS--, and (2) it assumes that round-trips are fixed over time. About (1), I ask because the obvious measurement time between [server Application Data*] and client [Certificate*] would include the processing of the application data by the client. On (2), this check will not work as is for mobile clients which will have variable round-trips. The check 'ticket age must be shorter than elapsed time by a round- trip', is unclear to me what it intends to protect from. A clarification: "the actual time elapsed on the server", elapsed since when? (I guess since the first message was received). 4.3.2.1. The OID Filters extension on a first look seems quite independent and unrelated to everything else in this document (seemed quite a distraction that could have been in an appendix as well). 4.4.2.1.  OCSP Status and SCT Extensions This is a very nice addition to TLS 1.3. Something that I miss as an implementer is guidelines on how to determine the (time) validity of an OCSP stapled response. Here my point is that OCSP responses have several fields optional (e.g., nextUpdate), which make a validation to be hand-wavy. It would be nice to have a profile of OCSP responses that would be recommended for use in TLS, as well or a recommendation of what constitutes a "fresh" response for use in TLS. 4.4.2.2., 4.4.2.3. I think the reference to RFC5081 should be replaced with RFC5270 which obsoletes the former even though not explicitly. 4.4.3. "RSA signatures MUST use an RSASSA-PSS algorithm". What should a client or server do when encounters an non RSA-PSS signature in TLS 1.3? 4.4.4. "Where HMAC [RFC2104] uses the Hash algorithm for the handshake.  As noted above, the HMAC input can generally be implemented by a running hash, i.e., just the handshake hash at this point." If that's now possible, it is a great addition for TLS 1.3. As this is not possible in TLS 1.2, I envy the TLS 1.3-only implementations. 4.6.3. My comment on this section, is that leaving up to the implementer to decide the re-key, would most probably result in the implementer delegating that decision to the application. In my experience that would mean no re-key in practice for the majority of applications. I'd have preferred a one-size fits all approach, where re-key is done on decided points. 5.1. I miss a maximum number of alerts received per session, or some other alert limiting mechanism (having CVE-2016-8610 in mind). 7.5. There is no definition of early_exporter_secret, and it is unclear why it is even mentioned. In short how is this supposed to be used, and why should implementations consider adding an interface to it? A. Is the described state machine intended to be normative or informative? I.e., which takes precedence, this description or the text above? (would be nice to clarify) B.4. I believe it was discussed before, but I miss the AES-256-CCM ciphersuites. If only one must be defined, it may be better to only have the 256-bit variants (at least for the non-mac-truncated version). E. I'd find it natural for this to be the security considerations rather than an appendix. G. Quite a long list. Would be nice to have the contributors to TLS 1.3 separately. Bibliography: There are references to PKCS6 and PKCS7 that are never used throughout the text (I guess there are more). regards, Nikos From nobody Wed Mar 29 07:30:45 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D537129533 for ; Wed, 29 Mar 2017 07:30:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MTi0Z-xuipzJ for ; Wed, 29 Mar 2017 07:30:41 -0700 (PDT) Received: from mail-yw0-x22f.google.com (mail-yw0-x22f.google.com [IPv6:2607:f8b0:4002:c05::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 178CD129474 for ; Wed, 29 Mar 2017 07:30:40 -0700 (PDT) Received: by mail-yw0-x22f.google.com with SMTP id d191so11799143ywe.2 for ; Wed, 29 Mar 2017 07:30:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=O/pGkOnFN3qYbL9AQZRQj2NQ/Alncqq2X6cOQ5ef+fE=; b=1VNtmTIHTZLPS+B9BaRAX/iGPmaVGiVaDuG3RbVeVjTA1kb71M44NSwKz8Z5S3P31T eh7tt8ak5QiXGfB8zyHwpfb9KMk0sY8lIXoGheWHrO1pNKamfRv7DffblcsJY3eeBS9X aadtuceOFEYqguGFh1kY+6TCuQzCQVriUyJV4MIBCOlQWjU/h4cdqdWd1cuJ2h/iCRZ9 bpHTxCKH9GDdVek5fHXtELwUvuf87UqS27MkK6XVFQZ4jQn9QfaFwZHfCpmkk3tLGX7Q Lm0HzU+2tncxu5q9ZOhlOLRC5HHHoszg5kBIJ+1s8sSiz3uLyIBK3jsQA7MXr9JWwbvz FmXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=O/pGkOnFN3qYbL9AQZRQj2NQ/Alncqq2X6cOQ5ef+fE=; b=gUqAjGcpOA9CAQQrMT4tHcsBWxGoYWKAK4PNJQ1jD4JNOJhh+UIHS7QxDjS8FWqzMV ntjA/sIb4r6GhrZ201ovx43hlQeOPj3RDm6bOkNnRD0pCxtMiBrEYX1EsdKzGuiL6Aup ZZ/vmceGNCyjSn2Lnw0DGgxCEGeSWCQ/7Tr/kFETkfOvBVo2rEB1MY6MZaWDqdKbrUy1 c0w4V51NRkWFzRnH0Jk+w1mNEEhBG1G3+6Wgwz8SEhOXA1Jt1FmMO6trj1yWlspD4GSM J7Z/efc3bWrp7B94spzR74RlucLQwY7U17tYyhD7rydbawxBuq72Geiq4L/qr0NYrZQm mvCQ== X-Gm-Message-State: AFeK/H2MU745bU1VqCI2WLnYmrQo2EYRqcreeAea1EmTnLLZploI6vfpzXO7gXA8SgYenXXRxsomCxA3UJuiVQ== X-Received: by 10.129.108.214 with SMTP id h205mr670762ywc.71.1490797839141; Wed, 29 Mar 2017 07:30:39 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Wed, 29 Mar 2017 07:29:58 -0700 (PDT) In-Reply-To: <16998c3d-4de6-7c88-d8a3-6d6193326500@objectiveintegration.uk> References: <16998c3d-4de6-7c88-d8a3-6d6193326500@objectiveintegration.uk> From: Eric Rescorla Date: Wed, 29 Mar 2017 09:29:58 -0500 Message-ID: To: Mark Dunn Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a114e81dca279d6054bdf6bc8 Archived-At: Subject: Re: [TLS] xLS 1.3: cookie X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 14:30:43 -0000 --001a114e81dca279d6054bdf6bc8 Content-Type: text/plain; charset=UTF-8 Hi Mark, Thanks for your note. Some comments below... On Wed, Mar 29, 2017 at 8:10 AM, Mark Dunn < mark.dunn@objectiveintegration.uk> wrote: > I am trying to implement cookie and finding it a little underspecified. > > I am using the TLS 1.3 specified in github and > draft-rescorla-tls-dtls13-01 > > > 1a) Should a client expect to respond to a cookie during session > resumption? > Yes, it has to be ready to. As you say, it kills 0-RTT, but that's how HRR always behaves. > > 1b) If (1a) is false then do you agree that the "cookie" extension MUST > be accompanied by the "key_share" extension? Otherwisewe might be faced with > > ClientHello > > +key_share > > +... -----> > > HelloRetryRequest > > <-----+cookie > > ClientHello > > +cookie > > +key_share > > +... -----> > > HelloRetryRequest > > <----- +key_share > > ClientHello > > +key_share > > +... -----> > > ServerHello > > +key_share > > +... > If I understand you correctly, then I think this is wrong. You only send key_share to correct the client's key_share, so if the client sent a key_share but you send cookie to force a round-trip, then you don't send key_share, just cookie. > 2) I understand this is too late for TLS(only DTLS SHOULD use cookies) > but is there a better solution than a cookie? > This seems like it would be a big restructure of the handshake, and given the relatively modest use of client auth in many contexts, I don't think it would probably be worth it. Best, -Ekr > For authenticatedclients a botnet DOS attack could be mitigated by > authenticating the clientfirst. > > In the worst case where the client provided an unacceptable key_share the > Server would have to provide > > ClientHello // flight 1 > > +key_share > > +signature_algorithms > > +supported_groups > > +... -----> > > HelloRetryRequest // flight 2 > > +cookie // from DTLS 1.2: HMAC(secret, > Client-IP, Client-Parameters) > > +key_share(server_share) > > +signature_algorithms // not required as > supplied by client > > +supported_groups // not required as > supplied by client > > <----- {CertificateRequest} // implied when > key_share(server_share) is used > > ClientHello // flight 3 > > +key_share > > +cookie // this may provide state information to the server > > +... > > {Cetrificate} > > {CertificateVerify} > > {finished} // provides reachability for the client first and is > protected by server_handshake_traffic_secret > > [application data] -----> // protected using keys derived from > traffic_secret_N > > ServerHello // flight 4 > > {EncryptedExtensions} > > {Certificate} > > {CertificateVerify} > > {Finished} // provides reachability for > the server > > <----- [application data] > > > > For authenticating clients, this would provide better defense against DOS, > DOS amplification and require fewer round trips. > > > > > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --001a114e81dca279d6054bdf6bc8 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi Mark,

Thanks for your note. Some com= ments below...


On Wed, Mar 29, 2017 at 8:10 AM, Mark Dunn &l= t;ma= rk.dunn@objectiveintegration.uk> wrote:
I am trying to implement cookie and finding it a little under= specified.

=C2=A0 =C2=A0 I am using the TLS 1.3 specified in github and draft-rescorla= -tls-dtls13-01


1a)=C2=A0 =C2=A0 Should a client expect to respond to a cookie during sessi= on resumption?

Yes, it has to be ready = to. As you say, it kills 0-RTT, but that's how HRR always behaves.


=C2=A0

1b)=C2=A0 =C2=A0 If (1a) is false then do you agree that the "cookie&q= uot; extension MUST be accompanied by the "key_share" extension? = Otherwisewe might be faced with

=C2=A0 =C2=A0 ClientHello

=C2=A0 =C2=A0 +key_share

=C2=A0 =C2=A0 +... ----->

HelloRetryRequest

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 <-----+cookie

=C2=A0 =C2=A0 ClientHello

=C2=A0 =C2=A0 +cookie

=C2=A0 =C2=A0 +key_share

=C2=A0 =C2=A0 +...=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0--= --->

HelloRetryRequest

<-----=C2=A0 =C2=A0+key_share

=C2=A0 =C2=A0 ClientHello

=C2=A0 =C2=A0 +key_share

=C2=A0 =C2=A0 +...=C2=A0 =C2=A0 =C2=A0 =C2=A0 ----->

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ServerHello

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 +key_share

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 +...

=
If I understand you correctly, then I think this is wrong. You only se= nd key_share to correct
the client's key_share, so if the cli= ent sent a key_share but you send cookie to force
a round-trip, t= hen you don't send key_share, just cookie.




2)=C2=A0 =C2=A0 I understand this is too late for TLS(only DTLS SHOULD use = cookies) but is there a better solution than a cookie?

This seems like it would be a big restructure of the handsh= ake, and given the
relatively modest use of client auth in many c= ontexts, I don't think it would probably
be worth it.

Best,
-Ekr


<= div>

For authenticatedclients a botnet DOS attack could be mitigated by authenti= cating the clientfirst.

In the worst case where the client provided an unacceptable key_share the S= erver would have to provide

=C2=A0 =C2=A0 ClientHello // flight 1

=C2=A0 =C2=A0 +key_share

=C2=A0 =C2=A0 +signature_algorithms

=C2=A0 =C2=A0 +supported_groups

=C2=A0 =C2=A0 +...=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 -= ---->

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 HelloRetryRequest // flight 2

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 +cookie // from DTLS 1.2: HMAC(secre= t, Client-IP, Client-Parameters)

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 +key_share(server_share)

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 +signature_algorithms // not require= d as supplied by client

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 +supported_groups // not required as= supplied by client

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 <-----=C2=A0 {CertificateRequest}=C2=A0 =C2=A0 =C2=A0 // impl= ied when key_share(server_share) is used

=C2=A0 =C2=A0 ClientHello=C2=A0 =C2=A0// flight 3

=C2=A0 =C2=A0 +key_share

=C2=A0 =C2=A0 +cookie // this may provide state information to the server
=C2=A0 =C2=A0 +...

=C2=A0 =C2=A0 {Cetrificate}

=C2=A0 =C2=A0 {CertificateVerify}

=C2=A0 =C2=A0 {finished} // provides reachability for the client first and = is protected by server_handshake_traffic_secret

=C2=A0 =C2=A0 [application data]=C2=A0 ----->=C2=A0 =C2=A0 =C2=A0// prot= ected using keys derived from traffic_secret_N

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ServerHello // flight 4

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 {EncryptedExtensions}

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 {Certificate}

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 {CertificateVerify}

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 {Finished} // provides reachability = for the server

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 <-----=C2=A0 [application data]



For authenticating clients, this would provide better defense against DOS, = DOS amplification and require fewer round trips.





_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--001a114e81dca279d6054bdf6bc8-- From nobody Wed Mar 29 07:32:47 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2603C129531 for ; Wed, 29 Mar 2017 07:32:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.923 X-Spam-Level: X-Spam-Status: No, score=-6.923 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GsPK6o6aSY6c for ; Wed, 29 Mar 2017 07:32:43 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1BC8F129526 for ; Wed, 29 Mar 2017 07:32:43 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 0CA2EC06C9E8 for ; Wed, 29 Mar 2017 14:32:41 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 0CA2EC06C9E8 Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=nmav@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 0CA2EC06C9E8 Received: from dhcp-10-40-1-102.brq.redhat.com (unknown [10.40.3.166]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 4B6EA8764B for ; Wed, 29 Mar 2017 14:32:39 +0000 (UTC) Message-ID: <1490797957.28079.20.camel@redhat.com> From: Nikos Mavrogiannopoulos To: "tls@ietf.org" Date: Wed, 29 Mar 2017 16:32:37 +0200 In-Reply-To: <1490797726.28079.18.camel@redhat.com> References: <1490797726.28079.18.camel@redhat.com> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Wed, 29 Mar 2017 14:32:41 +0000 (UTC) Archived-At: Subject: Re: [TLS] comments on draft-ietf-tls-tls13-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 14:32:45 -0000 On Wed, 2017-03-29 at 16:28 +0200, Nikos Mavrogiannopoulos wrote: > A more general note on the section/document, is that although the > PKIX > identity (certificate) is protected from passive adversaries, the PSK > identity is not. This is a discrepancy in terms of protecting the > user's identity between PSK and certificate authentication (that > should > warrant . ... an entry in the security considerations. > 4.2. rfc6961 is standard's track but TLS 1.3 only uses the RFC6066 > status request. Why not require RFC6961? Please ignore that. I forgot to delete in my draft. regards, Nikos From nobody Wed Mar 29 08:30:00 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F4811296D3 for ; Wed, 29 Mar 2017 08:29:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.719 X-Spam-Level: X-Spam-Status: No, score=-2.719 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=fb.com header.b=ArPMF6vF; dkim=pass (1024-bit key) header.d=fb.onmicrosoft.com header.b=iJpIwfPO Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nwWcfRIPh1nW for ; Wed, 29 Mar 2017 08:29:47 -0700 (PDT) Received: from mx0a-00082601.pphosted.com (mx0b-00082601.pphosted.com [67.231.153.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 78C9812969C for ; Wed, 29 Mar 2017 08:29:47 -0700 (PDT) Received: from pps.filterd (m0001255.ppops.net [127.0.0.1]) by mx0b-00082601.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v2TFLqSq017421; Wed, 29 Mar 2017 08:29:44 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=facebook; bh=rBZHBLXM5ixVeJ3Fj/kRr/DxTzqqRexcZf8jPHXv5sw=; b=ArPMF6vFLDVDESx/BHCYZ6gfr50qBruSK+LIC3B4B2B1POxdcUE2MYjxZFK1UMpWE8C3 rA52V65gxAkocAv7aOcULVsEG8UGmAQnd7Or2AWfloqmBpwy7JLfetU77qytsg7Fxc2x M6/RJbtdp8gVogkLNnuihFO4P2YoiXNwBZ0= Received: from maileast.thefacebook.com ([199.201.65.23]) by mx0b-00082601.pphosted.com with ESMTP id 29gd4u8esk-1 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 29 Mar 2017 08:29:43 -0700 Received: from NAM03-DM3-obe.outbound.protection.outlook.com (192.168.183.28) by o365-in.thefacebook.com (192.168.177.23) with Microsoft SMTP Server (TLS) id 14.3.319.2; Wed, 29 Mar 2017 11:29:42 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.onmicrosoft.com; s=selector1-fb-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=rBZHBLXM5ixVeJ3Fj/kRr/DxTzqqRexcZf8jPHXv5sw=; b=iJpIwfPOYn9VA9AyZnRz+vn8fUAO6+va02M5Ki/N/jQv+dUXB+je4JkkA+fU/lgAXwm3bYDABgx8ZAMVhoNHZNo86ahPpxzewiPJseUPNNr7uIu3ueFWFLzrVpxJ76q6Z90OoxZJtdk3pLxFolqT0N5+JmMqb/yWu1kjNmgN1mc= Received: from MWHPR15MB1455.namprd15.prod.outlook.com (10.173.234.145) by MWHPR15MB1453.namprd15.prod.outlook.com (10.173.234.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.991.14; Wed, 29 Mar 2017 15:29:41 +0000 Received: from MWHPR15MB1455.namprd15.prod.outlook.com ([10.173.234.145]) by MWHPR15MB1455.namprd15.prod.outlook.com ([10.173.234.145]) with mapi id 15.01.0991.021; Wed, 29 Mar 2017 15:29:41 +0000 From: Subodh Iyengar To: "Kaduk, Ben" , "tls@ietf.org" Thread-Topic: review comments on draft-rescorla-tls-subcerts-01 Thread-Index: AQHSqDH7PyVKA0g+FE+PQRPt34CgAaGrLbaF Date: Wed, 29 Mar 2017 15:29:40 +0000 Message-ID: References: <11F20304-A244-4362-9042-E6CC3EDD304A@akamai.com> In-Reply-To: <11F20304-A244-4362-9042-E6CC3EDD304A@akamai.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: akamai.com; dkim=none (message not signed) header.d=none;akamai.com; dmarc=none action=none header.from=fb.com; x-originating-ip: [25.173.47.4] x-microsoft-exchange-diagnostics: 1; MWHPR15MB1453; 7:maqKroW5/SAT6ztCMLMFN4W8VcQdv7IblqyZEgeFnHAvEpWcUtAbW8yfOdlSmzL/8IAiimOzDhyvrJUqy/NK4EUK7ieq/UgS0La9OPb3QgFQ9oTdUL+UIR2cBX5Eom9Z5bSUiZmEzWo3DrusUZ/d7CSevMlc8ir5sF9ZXev98ad7wHylx01h0zZdfGjQhQo3i1Va3A4aiN4IT8ONpTX/LIL9F6OssBf/0EMxQxywsJHISfD4JIoEQUcDsdTrX9XZuhlg2hOdqe0UlOydV6EHV7tQrTTzs+o+Ml+R5fDGAfmZ+WCb00geAl7XLJY6g5BGDTV6seMZjrCnTKQ7738cqg==; 20:punjyxvi4FV8/XMfdrR6UycE56XHdNSQpZIif2Z7+hzAd0Tt8aZqPt0yBpJDYwUaGmipQGahAgWpf05dWLbiqZZ4mmyeel6duzzQZ70g8V73m+9n/qv3oW2DBrKDX87ISues8+RyCKkpwUk+907sb2fjX7Z0hzcK7UM92qkmSzE= x-ms-office365-filtering-correlation-id: 89fa1782-1503-4bff-e32b-08d476b86b35 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(22001)(2017030254075)(201703131423075)(201703031133081); SRVR:MWHPR15MB1453; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(10436049006162)(166708455590820); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(6040450)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(93006041)(93001041)(6041248)(20161123555025)(20161123562025)(20161123564025)(201703131423075)(201702281528075)(201703061421075)(201703061406075)(20161123558025)(20161123560025)(6072148); SRVR:MWHPR15MB1453; BCL:0; PCL:0; RULEID:; SRVR:MWHPR15MB1453; x-forefront-prvs: 0261CCEEDF x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39450400003)(39840400002)(39400400002)(39850400002)(39410400002)(51914003)(377454003)(66066001)(122556002)(2906002)(7736002)(230783001)(3280700002)(3660700001)(25786009)(6246003)(229853002)(575784001)(86362001)(38730400002)(2501003)(53546009)(99286003)(6606003)(77096006)(19627405001)(2900100001)(53936002)(5660300001)(74316002)(54896002)(55016002)(6306002)(6436002)(6506006)(606005)(236005)(7696004)(189998001)(3846002)(6116002)(9686003)(2950100002)(7906003)(8676002)(76176999)(102836003)(54356999)(33656002)(50986999)(8936002)(81166006); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR15MB1453; H:MWHPR15MB1455.namprd15.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_MWHPR15MB1455C0846672F4D26073EFA7B6350MWHPR15MB1455namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Mar 2017 15:29:40.7633 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2 X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR15MB1453 X-OriginatorOrg: fb.com X-Proofpoint-Spam-Reason: safe X-FB-Internal: Safe X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-03-29_11:, , signatures=0 Archived-At: Subject: Re: [TLS] review comments on draft-rescorla-tls-subcerts-01 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 15:29:59 -0000 --_000_MWHPR15MB1455C0846672F4D26073EFA7B6350MWHPR15MB1455namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Thanks for the comments Ben. > We mentioned adding a NUL byte separator in the signature on the Delegate= dCredential Yup this is something we noticed during the hackathon interop that would de= finitely be helpful in an implementation and we should change it to have th= at. What we realized when we implemented it was that we ended up representi= ng a delegated credential in code as a type of cert with a similar interfac= e for verification and it would be useful to reuse the same verification co= de for TLS 1.3. > Do we want to leave the valid SignatureSchemes as all that are defined, o= r mention the Recommended column in the registry, or narrow things even fur= ther? In other words, should we give some guidance for how to select a sch= eme to use? It's restricted to the ones that are supported by the client in TLS 1.3. I = don't see TLS recommending signature algorithms to use beyond section 4.2.3= that "rsa_pkcs1_sha1, dsa_sha1, and ecdsa_sha1 SHOULD NOT be offered.". Wh= at kind of a recommendation would you like to see. Would love a pull reques= t at https://github.com/ekr/tls-subcerts/pulls to get a general idea of wha= t you would like to see. Subodh ________________________________ From: TLS on behalf of Kaduk, Ben Sent: Tuesday, March 28, 2017 7:12:58 PM To: tls@ietf.org Subject: [TLS] review comments on draft-rescorla-tls-subcerts-01 Getting these in email before my printout with red markings gets buried in = a pile. We mentioned adding a NUL byte separator in the signature on the DelegatedC= redential (as well as some other potential tweaks to normalize the context = strings elsewhere and here). Do we want to leave the valid SignatureSchemes as all that are defined, or = mention the Recommended column in the registry, or narrow things even furth= er? In other words, should we give some guidance for how to select a schem= e to use? -Ben _______________________________________________ TLS mailing list TLS@ietf.org https://urldefense.proofpoint.com/v2/url?u=3Dhttps-3A__www.ietf.org_mailman= _listinfo_tls&d=3DDwICAg&c=3D5VD0RTtNlTh3ycd41b3MUw&r=3Dh3Ju9EBS7mHtwg-wAyN= 7fQ&m=3Dc2n5STs7L3HaVUDLCexXj_71qQVn5w-ZUJ76hgi1PWs&s=3Do7UX4TmoWt7yZ-eFOM2= nOkq8UJETS_S_szs-YPNjUmo&e=3D --_000_MWHPR15MB1455C0846672F4D26073EFA7B6350MWHPR15MB1455namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable


Thanks for the comments Ben.


> We me= ntioned adding a NUL byte separator in the signature on the DelegatedCreden= tial


Yup this is something we noticed during the hackathon interop t= hat would definitely be helpful in an implementation and we should change i= t to have that. What we realized when we implemented it was that we ended u= p representing a delegated credential in code as a type of cert with a similar interface for verification and it= would be useful to reuse the same verification code for TLS 1.3.


> Do we= want to leave the valid SignatureSchemes as all that are defined, or menti= on the Recommended column in the registry, or narrow things even further?&n= bsp; In other words, should we give some guidance for how to select a scheme to use?

It's restricted to the ones that are supported by the client in TLS 1.3. I = don't see TLS recommending signature algorithms to use beyond section 4.2.3= that "rsa_pkcs1_sha1, dsa_sha1, and ecdsa_sha1 SHOULD NOT be offered.". What kind of a reco= mmendation would you like to see. Would love a pull request at https://github.com/ekr/tls-subcerts/pu= lls to get a general idea of what you would like to see.


Subodh

From: TLS <tls-bounces= @ietf.org> on behalf of Kaduk, Ben <bkaduk@akamai.com>
Sent: Tuesday, March 28, 2017 7:12:58 PM
To: tls@ietf.org
Subject: [TLS] review comments on draft-rescorla-tls-subcerts-01
 
Getting these in email before my printout with red= markings gets buried in a pile.

We mentioned adding a NUL byte separator in the signature on the DelegatedC= redential (as well as some other potential tweaks to normalize the context = strings elsewhere and here).

Do we want to leave the valid SignatureSchemes as all that are defined, or = mention the Recommended column in the registry, or narrow things even furth= er?  In other words, should we give some guidance for how to select a = scheme to use?

-Ben

_______________________________________________
TLS mailing list
TLS@ietf.org
https://urldefense.proofpoint.com/v2/url?= u=3Dhttps-3A__www.ietf.org_mailman_listinfo_tls&d=3DDwICAg&c=3D5VD0= RTtNlTh3ycd41b3MUw&r=3Dh3Ju9EBS7mHtwg-wAyN7fQ&m=3Dc2n5STs7L3HaVUDLC= exXj_71qQVn5w-ZUJ76hgi1PWs&s=3Do7UX4TmoWt7yZ-eFOM2nOkq8UJETS_S_szs-YPNj= Umo&e=3D
--_000_MWHPR15MB1455C0846672F4D26073EFA7B6350MWHPR15MB1455namp_-- From nobody Wed Mar 29 11:04:57 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 551441289B0 for ; Wed, 29 Mar 2017 11:04:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=salowey-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hs2I13NMQnQ9 for ; Wed, 29 Mar 2017 11:04:54 -0700 (PDT) Received: from mail-pg0-x235.google.com (mail-pg0-x235.google.com [IPv6:2607:f8b0:400e:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 768C81292F4 for ; Wed, 29 Mar 2017 11:04:54 -0700 (PDT) Received: by mail-pg0-x235.google.com with SMTP id 81so14445828pgh.2 for ; Wed, 29 Mar 2017 11:04:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=salowey-net.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to:cc; bh=l/jtAntXx19wISAayqseToo22q/MWX30347X7ugmAaU=; b=G4Qg1/rqNzhiXreE63kIyiP5jvA1amu6RFtawUVPht/cuUJIgjDvhJlKGJ3p7KXr5+ zMs6Mh4sshCuEn9VNShycywclaW2ugAR8xYRsou7aIMwDrIQd2to4dlLAY8MUyZJY7JM KM5g9O0E+sRRuFRAUYUa7m84huP3/0kMx6XqTjrZLq0WWVXwnguR0UDZhkbyLhm8P2Gl s9P98hTqFf83Vp0RJig3ksSlxKCS5FHSpzOib2dv7PoP2BeG3gjHWzhvs/wd7cDOoYut TLLilDq3c7dkWTHm6QFB9uHv2sKWeBsnAYdR6i3iYWzVb3Lc73Pkp6/E6Tw6LuT1ozDZ b64Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=l/jtAntXx19wISAayqseToo22q/MWX30347X7ugmAaU=; b=Ak5N/ISXhtKdlbBgV70Hbb8s5DEJuCOvQF4ZT4chyk5WBafi3eSBS1I1VovbKy4Pdv 4ZvynBnI+l4mbNGSYCFu61UjR8i8p2+9TXC9cDRGIqVXH6vhuwZ2y4ucU+dHIf579OKC jgVqgXWTM6i6raiXeJpBJYy1AP6IShMROEiYMnXOyU6RKnhBAaHOImJhMtG9CNsqrIPH ZNbnEp1BOe9oLmVLLZDpwexqFMzCapY7mABZekeq+fMcDgp/pwBXGYZnid+1qatgqs43 4Y1NXygBpO4Fhj0+BzGpSwq3g7aaME+RJxKqf6jk3MQjiPTmq7O0ynmsIWGW3Q3gew+C 3odA== X-Gm-Message-State: AFeK/H3wZteilHrpPUC6ihoAO0axBA3m6S2sifCj+0hdXlpOdMCMmgTnYqDK7EKzJso46TfYq+RKQFSO/hBPGw== X-Received: by 10.84.215.23 with SMTP id k23mr2057718pli.58.1490810694044; Wed, 29 Mar 2017 11:04:54 -0700 (PDT) MIME-Version: 1.0 Received: by 10.100.165.141 with HTTP; Wed, 29 Mar 2017 11:04:33 -0700 (PDT) From: Joseph Salowey Date: Wed, 29 Mar 2017 13:04:33 -0500 Message-ID: To: "saag@ietf.org" Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary=94eb2c1a1402d8a587054be26992 Archived-At: Subject: [TLS] TLS SAAG report for IETF98 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Mar 2017 18:04:56 -0000 --94eb2c1a1402d8a587054be26992 Content-Type: text/plain; charset=UTF-8 The TLS working group met on Tuesday morning. The main topic was discussion of WGLC issues of TLS 1.3. We continue to work on issues and plan on having a draft -20 that will go to the IESG. We had updates on DTLS, DNSSEC chain extension, certificate compression and delegated credentials. There was support in the room for adopting the following drafts (pending confirmation on the list): draft-rescorla-tls-dtls13, draft-ghedini-tls-certificate-compression, draft-rescorla-tls-subcerts and draft-sullivan-tls-exported-authenticator. There was not clear support to adopt the following drafts: draft-gutmann-tls-ltss and draft-sheffer-tls-pinning-ticket. --94eb2c1a1402d8a587054be26992 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
The TLS working group met= on Tuesday morning.=C2=A0 The main topic was discussion of WGLC issues of = TLS 1.3.=C2=A0 We continue to work on issues and plan on having a draft -20= that will go to the IESG. =C2=A0 We had updates on DTLS, =C2=A0DNSSEC chai= n extension, certificate compression and delegated credentials.=C2=A0

= There was support in the room for adopting the following drafts (pending co= nfirmation on the list): =C2=A0draft-rescorla-tls-dtls13,=C2=A0draft-g= hedini-tls-certificate-compression, =C2=A0draft-rescorla-tls-subcerts= =C2=A0and=C2=A0draft-sullivan-tls-exported-authenticator. =C2=A0 = There was not clear support to adopt the following drafts:=C2=A0draft-gutma= nn-tls-ltss and=C2=A0draft-sheffer-tls-pinning-ticket. =C2=A0
--94eb2c1a1402d8a587054be26992-- From nobody Wed Mar 29 14:32:05 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF97312963F for ; Tue, 28 Mar 2017 09:17:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.4 X-Spam-Level: X-Spam-Status: No, score=-0.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_LOW=-0.7, THIS_AD=2.198] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=mnt-se.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KlsDgj85Rs8Y for ; Tue, 28 Mar 2017 09:17:38 -0700 (PDT) Received: from mail-it0-x236.google.com (mail-it0-x236.google.com [IPv6:2607:f8b0:4001:c0b::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 62EC9129686 for ; Tue, 28 Mar 2017 09:17:35 -0700 (PDT) Received: by mail-it0-x236.google.com with SMTP id y18so119244944itc.0 for ; Tue, 28 Mar 2017 09:17:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnt-se.20150623.gappssmtp.com; s=20150623; h=from:content-transfer-encoding:mime-version:date:subject:message-id :references:to; bh=fqsQDqOdZw0+uAZlftpsbKq2DUA8XsflQIcnTU3DRyQ=; b=Gsnb+IbrOZ29nSHH815rVXnTEcL2E9tWXuuBO516eAcS9XZvRTr0lLgewpFw9YuVLt fJKdElQ4JNtntRGChhzO+bWPzVbKbg5W8sTH0M+1GFkGbUrkkvfP6mAEBqqeX/GGkI8E lyb4PJJE/WdOIUEMnr7lpmZoZZakmwH8fJccCTFOdBj/EP0vfec8lrhXsSjcPxCxPn1A YHJ3viiDDN+gTQ52rQqRxTDqZlDrkUtDOgsFZNM26bqLYisB/u1M32V4W7jHSXeyRyA7 07J1q8cU75F6MLQZ92rI1bUV2bJE2LgVPEuKdJdIseFxrO1+KafQC1lGrrd/VaxcH7TT Ng/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version:date :subject:message-id:references:to; bh=fqsQDqOdZw0+uAZlftpsbKq2DUA8XsflQIcnTU3DRyQ=; b=AniFYrrBBXTuHar1yCXp6SJWTmHe6slxFypFKn+4rqF1E1vqyVArqSm0VnT46KqLpv 6X3XMevoEnKs+cfZ1Tc3J/jMG6ZOCrnM3OPsp41lUWG/2ZosOU9zC9Wky1NY1jyqBJTt MROte0m21/sgE/Zw9OsrTH2EfCFeci/vPM949wQ3iKyCUdt0p8Fcqhp0/Lqpyebk5Ofq EVT2MqgC1E+XkrUmObAPxvY28DUNhGE1TD889KBW8kH0C0mM9UsP17caZ4x1fsZ/pxfa XosxNDMfHBUdq9aZ40OqdVYR31U+H+KEN85D/o79DGm9vkejiG/W3e/uIpTvT3FFmOSC P5Jg== X-Gm-Message-State: AFeK/H2IDtn9MwGHcIfjirOq334JKqZBpQyOcMb7cZFH19oNUt5g1+b7UOB2DWSv5EK35g== X-Received: by 10.107.129.66 with SMTP id c63mr27715043iod.92.1490717822032; Tue, 28 Mar 2017 09:17:02 -0700 (PDT) Received: from ?IPv6:2001:67c:370:128:d0fd:d68b:f525:789a? (t2001067c03700128d0fdd68bf525789a.v6.meeting.ietf.org. [2001:67c:370:128:d0fd:d68b:f525:789a]) by smtp.gmail.com with ESMTPSA id e20sm2341228itc.3.2017.03.28.09.17.00 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 28 Mar 2017 09:17:00 -0700 (PDT) From: Leif Johansson Content-Type: multipart/alternative; boundary=Apple-Mail-BD49AEE5-480E-44F4-92C5-3558EAB8E3EA Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (1.0) Date: Tue, 28 Mar 2017 11:17:00 -0500 Message-Id: References: To: unbearable@ietf.org, tls@ietf.org X-Mailer: iPhone Mail (14D27) Archived-At: X-Mailman-Approved-At: Wed, 29 Mar 2017 14:32:04 -0700 Subject: [TLS] Fwd: Thurs 9am-10am in Lugano: additional TB TTRP meeting X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Mar 2017 16:17:42 -0000 --Apple-Mail-BD49AEE5-480E-44F4-92C5-3558EAB8E3EA Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable This may be of interest - sorry for the crossposting. Skickat fr=C3=A5n min iPhone Vidarebefordrat brev: > Fr=C3=A5n: Brian Campbell > Datum: 28 mars 2017 10:01:55 GMT=E2=88=925 > Till: Leif Johansson , Leif Johansson , John= Bradley > =C3=84mne: Fwd: Thurs 9am-10am in Lugano: additional TB TTRP meeting >=20 > Would one of you gentlemen mind forwarding or replying or something to dra= w attention to this on the unbearable list so that it's more likely to be se= en by the many people that have my messages caught in spam filters? Thanks.=20= >=20 > ---------- Forwarded message ---------- > From: Brian Campbell > Date: Tue, Mar 28, 2017 at 9:57 AM > Subject: Thurs 9am-10am in Lugano: additional TB TTRP meeting > To: IETF Tokbind WG >=20 >=20 > Unfortunately, the presentation and discussion on Token Binding and TLS Te= rminating Reverse Proxies was cut short by the end of Monday's meeting. I w= ould like to invite (or maybe beg) anyone who's interested in, or has input i= nto, the topic to meet again this week to discuss it more. Ideally I'd like t= o have some sense of consensus on a preferred approach so I can proceed with= document work.=20 >=20 > I've reserved Lugano, the attendee sign-up room, for an hour starting at 9= am on Thursday (trying to find a good time was hard, sorry, I hope this work= s okay for folks) for this ad hoc meeting.=20 >=20 > Lugano is on the 2nd floor. See https://datatracker.ietf.org/meeting/98/fl= oor-plan?room=3Dlugano#chicago-swissotel-floor-2 >=20 > The slides that were partially presented at yesterday's meeting are attach= ed for background and context.=20 >=20 > Hope to see many of you there! >=20 --Apple-Mail-BD49AEE5-480E-44F4-92C5-3558EAB8E3EA Content-Type: multipart/mixed; boundary=Apple-Mail-093ACE67-BA70-41B3-810A-FF4FBF374113 Content-Transfer-Encoding: 7bit --Apple-Mail-093ACE67-BA70-41B3-810A-FF4FBF374113 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

This may be of interest - sorry for the crossposting.

Skickat fr=C3= =A5n min iPhone

Vidarebefordrat brev:

Fr=C3=A5n: Brian Campbell <bcampbell@pingidentity.com>
Datum: 28 mars 2017 10:01:55 GMT=E2=88=925
Till: Leif Johansson <leifj@sunet.se>, Leif Johansson <<= a href=3D"mailto:leifj@mnt.se">leifj@mnt.se>, John Bradley <ve7jtb@ve7jtb.com>
=C3=84mne: Fwd: Thurs 9am-10am in Lugano: additional TB TTRP meeting

Would one of you gentlemen mind forwarding or replying or somet= hing to draw attention to this on the unbearable list so that it's more like= ly to be seen by the many people that have my messages caught in spam filter= s? Thanks.

---------- Forwarded mess= age ----------
From: Brian Campbell <bcampbell@p= ingidentity.com>
Date: Tue, Mar 28, 2017 at 9:57 AM
Subj= ect: Thurs 9am-10am in Lugano: additional TB TTRP meeting
To: IETF Tokbin= d WG <unbearable@ietf.org><= br>

Unfortunately, the presentation and di= scussion on Token Binding and TLS Terminating Reverse Proxies was cut short b= y the end of Monday's meeting.  I would like to invite (or maybe beg) a= nyone who's interested in, or has input into, the topic to meet again this w= eek to discuss it more. Ideally I'd like to have some sense of consensus on a= preferred approach so I can proceed with document work.

I've reserved Lugano, the attendee sign-up room, for an hour starting at 9a= m on Thursday (trying to find a good time was hard, sorry, I hope this works= okay for folks) for this ad hoc meeting.

Lugano is on the 2nd floor= . See https://datatracker.ietf.= org/meeting/98/floor-plan?room=3Dlugano#chicago-swissotel-flo= or-2

The slides that were partially presente= d at yesterday's meeting are attached for background and context.

Hope to see many of you there!

= = --Apple-Mail-093ACE67-BA70-41B3-810A-FF4FBF374113 Content-Type: application/pdf; name=tokbind-tls-term-ietf98.pptx.pdf; x-apple-part-url=12A42438-1650-4020-84A3-1B0CF88DE40B Content-Disposition: attachment; filename=tokbind-tls-term-ietf98.pptx.pdf Content-Transfer-Encoding: base64 JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAGtWEtvGzcQvvNXzFEqIJrDN3u0m6IJWiCJF8ihyMFV5MaJ FCeSm/bn9yN3SUm7kmEElg5LzZLz+ObBGX2jN/SNjJMxqcRkvGSFFQVOMuFDzirarugdfaGLqx3T ckdcvrvl+Bibg2OmPy9w9vYnSk47+hfnPvVcrq5Jle/1FcQrqfAJMVjFtpAXxyTPnBWMZJPOCorl hvIWy8mzYTBgHbSOjjZYB2M4OkPWJheVojVdw0pvnIIKT5DmUkED5tlDYcYkTgH6QdvE0VsbIC5q nTyEsGRgpvwgLaPqOfSMdDDSRkusFfkovXYZlgLp69V2ufr68M/NmrZ3OJO35G+/TZkpE5h+8XLD 9Ms9jIIY8WTn6ew8JXUWIC3BgZBXpDE5J4vfjYnS9QBfdjQog4czQXIylhb40UGFrsth0N3SjObU faIXXYmkCT+2mR9njx0xtMpLpdlNGf5Js8vt3Tw7WNPspi6+1AXNRXlzVQlty+ZrJf1VF6u6WB8s dAgyFMXfi+7VOdV1Ull16jXP2oRI3fI8KOIQlEdR0d4XVAbee5htYImw0RkVcQQzUHk5L96bveiG xa/DE7IKIqnaGOd0YCN1r8QZ92irzyjikzSBeeIeAUUa8h+rwOauZXPG3/Xd/ZzeQ4WzMA8qTCLk R0NOcwnhEyGXY9jYOLGJYNMfTfHtsplVgdVz0UejqkZxXYQx1Ofs5HQmE37UTg4lPp8NN7Z9UD4f Q90H17MxTMWxyj8bw1Bc0sodx74aRgqAIkRGHoI2zsMWHg9D3tXnUH7EbPfz8OZi/3wsB6oeQz3Y 68FGSa8sqiTHST2oYpFgfXS2RSt2Ozko0BJ0KIhiVk/fDjvqzsZkiwx+itKDN/ZK4yKW3uECPgVe RWQC4mZdk6xu+VDt2rbcrMpW5Rf7ejMp/mJ2svj3UC0qh2bu53ZnNKzalfOhqtaO7RFupCZtu1m0 OoHFcSVGeRC5ORhflM7kQoz+ob9u9mjm8hBsmoKJi1c8dvEWfvX6GvoqPBxu+IiYAkO7D20xusnR Udmk0F6VZsHkFdqvo5YBTU1pGZwN0rR7Eu1i/uLhFARFH2hh612mpy1DvrhO9COVuU24hxpzU9RB l0qofT46h8QwfkiMgTlq+W81cLohtuvz9XWt6KAg6SzN4P9yd37uzxwEDbxf3tQjl5Ur4qO8qBsQ p+X3MV3MkD9HDFoUjw9CwqlEaxg4nzEY8myPQUQ5RI+LIgVaX6T2GFSTfx+UGFt+YOi2Grapi2NL Dpqwh/Gb3kaRm8Bi69vKomXD9wmlydtNXiGkH0WCzcloMBHThmYkySESOaYRDa+bvOrr/6rcak1T tml05BIlckgfBb/DkIDojxTLJdzytswtOreJ3CcCHmyjtAbDyYJrItTemSGn5nAZGeogFi2mjID4 NiFi5RNpl0cfNMzT0UFs8+jQdmbBbbefcOwHCN0GiPEYN5r+zo4qEXWpQJDl5XEPI1gga7REB6ZJ a8wbZVYxvSiNUVKJYQh8u1rfPNx9X13dr++3d5vVw/ZumSegMmPm6VBGA4+6gJUP0RoUK6YyLaKA j8fFY4rjYnOECrEOcAhOnSyGxTI3KqcjSlqZ35KySCRPGOOiTlj042Iddk8oIjjHgrWmn0l7qBNm QQsXGR/AC9U8RmPA6xwNsQOMsC8lb4XFAiHSUzyKHs7hQnDQN+/ByGsIIie0zN9I79EhZDWcj7Hw wgBcCMpEDM14EwImV+0YXgKmWfuAO9pnGix0JhVVMcQixEijE0zaRJHZj2jDPhsw/eZ9qPJZWYb6 YKItoA+BCwUIF4JjDLxZe5aHpCcQThxaw77SEwErCGMbIN4i+oIGVpkSI6IQFI9/FArFK1SFJX3M f0S8+R+w3HI4CmVuZHN0cmVhbQplbmRvYmoKNSAwIG9iagoxNDEzCmVuZG9iagoyIDAgb2JqCjw8 IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyA2IDAgUiAvQ29udGVudHMgNCAw IFIgL01lZGlhQm94IFswIDAgNzkyIDYxMl0KPj4KZW5kb2JqCjYgMCBvYmoKPDwgL1Byb2NTZXQg WyAvUERGIC9UZXh0IC9JbWFnZUIgL0ltYWdlQyAvSW1hZ2VJIF0gL0NvbG9yU3BhY2UgPDwgL0Nz MiAxMCAwIFIKL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvVFQxIDExIDAgUiAvVFQyIDEyIDAgUiA+ PiAvWE9iamVjdCA8PCAvSW0xIDggMCBSIC9JbTMKMTUgMCBSIC9JbTIgMTMgMCBSID4+ID4+CmVu ZG9iago4IDAgb2JqCjw8IC9MZW5ndGggOSAwIFIgL1R5cGUgL1hPYmplY3QgL1N1YnR5cGUgL0lt YWdlIC9XaWR0aCAyODAgL0hlaWdodCAxNjAgL0ludGVycG9sYXRlCnRydWUgL0NvbG9yU3BhY2Ug MTAgMCBSIC9JbnRlbnQgL1BlcmNlcHR1YWwgL1NNYXNrIDE3IDAgUiAvQml0c1BlckNvbXBvbmVu dAo4IC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ae1cvZYbuc7c19nQoVOHDh06dTjh hE4dOnS46YYbbu4n8CPcV7m3Zuqbch2AZFNS/0kf+szpBUEQBRSLao1G3p8/6yoGioFioBgoBoqB YqAYKAaKgWKgGCgGioFioBgoBoqBYqAYKAaKgWKgGCgGioFioBgoBoqBYqAYKAaKgWKgGCgGioFi oBgoBoqBYqAYKAaKgWKgGCgGioFioBgoBoqBYuAwBv7666/DsH/+PBD9QOgDCS/oLRiAlnhtkXwx 5xv4AQf5QOhFWirgvhiglv7+++9DjtKB6AdC35dCqtpFBoKWeJp+/fq1uHCVgAPRD4RehbpKch4G qKWmonYo8kD0A6F3ILYg9mQAWuLTR+/ogrFpMQeiHwi9KaWVfH8G/AWZdjhEdG5U2IHoB0JvRGal PYoBPzjjRxJmVy/yQPQDoVensRIeywC01Hz0NJ0U3ooFH4h+IPSKBFaqMzDQPCzZSY/fVyk+AzW1 7bi0b0c/EPr24ivDqRjgw0V3l6vrmQESnqZu7EW4nl8oMnzW7VvQD4S+pexae0IGXJOLolWADCyH fXVfB6IfCH01XbXwnAy4ltzWMaGhIWJky+DCKxp0RLeVmYaGK6I7nNvC2g76CqJqyZkZcFm6HbRE mXmA2663i5r1JG7vgO5wbu8AfRFFFXx+BqAfv7KEgodDv2O5YmRPNu7QWjswHFegMrRwBv1A6Jny KuaOGKCWXJySok8FJ6eaAZI0jEUePIMvVP6mU7MwQoAPHf2PP/7wIezdoIGV0UMxNbxrBsY6lFxd nFoipzw5Hp4BP76Q2ZRTRi+mGcACfIrokPF///PBxZwjtUrGKtAoIKMPOKmpu2NAgpFBdWX9uIcx WhKM5rDJTIgUtGP1YrKfnuDnkDLGOdJRyhBhYQ5Qeb1I+X0tGs/oTTbKeacMSBg0KAO/ux4kksUA z+Z2YIlTunvagIWY4AlDD2BCBWDoMtZRUoCMsFD+YIRhgOasYnrogYoa3jsDed9dGNJDNsaqa8b/ 888/TpeAFDzOqXiG+VAZaPgwHyIdpZzBFxIle3p+RXrAAN2pKPsBGPB9lxgWjcUApGUM78/Pzz9+ /Pj333/9n/4ROkRqODAm0Xsybh4lFrOYeT5gEf0BxHN4C9y1Q8pwaKga2pY2BtL1KWbQqoHByI8f Pz49PX379g2PJHi865B2kEpTk+hjGeejpPwDYxIaYZPoTsV2NurZLvmBmbkdvO9cBkEpFT4aoG08 KdwPe6AlTi0GKOH79+9xjr58+YJzpMzomujKo6kZQ6t6RlPGPecMomJ6iAqA0QPi4fU7IrcWgArb Gmjn/OhLrXFTdivAoVkDH0Y4RxR5Duh5ev4gs3fv3n348OHz5894X8cluqNrogNaqzAre2CM0Xsy xqrB1CrQY4ge+nYCIFG6bwe0c2bfLHUHY4cyHFoSlfP79+9fv36Vf9FYDEBmPIlwiD59+oSHkYC4 kHe+zcMpdmhFDowBek+ryjYIUMzAGEBjapCcC3sBWwgAXagRle2/n24BukNO9UIj3DctIEAHeqFk XDhKeGr0IrXkZW9er3Ekn0ThEIWFHBIaRwnDcU7GhyS+pKdSj8HyXtgg8yL0IO0k+roCIKigUZ7s dYF2zuYb4U25vVFJghaTMjiF4etJejlKk3pWhqYxeYi4NkA7Ic3kHqD6YfROh5JcFKxVwQhDFbMK +loCYKd+D2WvBbRzHt9BdaQt8NnVC/PkwWYlquciPTdTwYlsfoiUPGDJzyUZmv4eivuZqidjRiqb cGEMlniYY4VsSjtI5cs9bW/J7QLIiI6r2duBds6gymngzr569xXLc2iHUw0hIOu5uQW+PATkQxQC tFZ+ejK0IrPhazHb06QWerxsGIsLlUGGL4cT12ISLUGw7AH6LQJ4reg3iiPmqVuAdl7rjZBDMcm+ wp2zqxTp0I7iBbjNmKxnxchgpIYywgcLAlWAjDwFj0MrMhuOjtlFGWcs5cTUzHKPxxINt0O/TgBe m9ss2MvW7HVAO69CtbrURfB4jx5zY6lCgdGDyH56ZvTspRKi9yRSpIxmSRlaYdlQqvlToCUylHaQ RDEyfPlgocJohCGyKWEvyaUCYE7dm4gCZRhjLgXaOd5LDU2FoUeqU8RcXbAnFJYyu8FIj6eto8S/ +yiJDF8Cpx8in6KNuxZmQzE0BM1PPJprGdlTYG+JoHNAL5WWyCA0hr0lObmW0MgBvVTzAnAIlSpD iPLI4NQ80M6RqpwN+pAtqBEZHqNVV5Sd8zQhvAwFuDPrmVV5DD1+iJRKZcjTMzwh7Qwd1mLY055w WVsYZiwFDBIyla8dBKtUX+W251lEnxGAkshQDQFLAW7AxjUDtHNMrwv5WbkPZdPw+0XFN/MEuBAT Zn0Y9JwXwuO/E+UAzwY7B8jjs7ADdJjtyVjZaPSGyMYrBEymnQwLyTV8A49s9NKOBaC0MnL+0CyG CqbB+xho51l1EYpvVu4xIcCnJlsQtFLBQ1uebChGhmLgGegZYc0nkZbTCEOhuNG0HdqT9PTmMUjI a+DUlEf2kiOG8b0AZZOhJW7I9jA5e8l7AsBCv5jT75j1oduaYgZO9YC286Pl3hWq9YI5xcrdnz0e CXuxEWYIq5Q2YClMRgjQEAGuZyWE359E7qftmZVtbORZQevXNHDu3/P0r20HXC9Ads9w/wBiMLU1 ehaAI6p+d8IOfs66nwG89/QMf0ZfyzMAVZ1epJwyfJY2pjTrxqt79A7Wg3NaJfcpLdFs00No1zMb xxfn8nfnGKyETTihZCPEN6F7h0igOS3zKCAbOQA9NoGaTkd0W0BNp8+GgB66SxdLfJVspQ0Gh3Iq /iXL64WpgaQdel17ALrnFJp6Y+Llv04U/fLIGIf5Ki7hnUdJWwwD353DF7k9myBkeLZmpDsZ7Eua 0C5mlOEZHFf2opEDkFOdOlywd0YH3FEXZLbRF1wHHQW2Nx2iDAlJesiePIWYEMYYRcpQGLC8FwwR o7Ce0fO/4v8++AzzuwcEaJbhvavIkGGMrlVuyG6CioFj0VXGigY66l3gJPxb5rWeSj1E+FdsbSYV ELX1k0YzDE5e0h6Gspt99aB9YciphANDyxlzKXQPUWllDGoYQGNTBo3vgD6jiiti0FTv4j9PW+vs eJ4eIvxXtHDjEoBKGzMGRRJUpKEyKGzQVBNaqWQo56SBMF5N6ADKSFX7tvT3i0CYuqiqXMCx6DdK ZbAcffUu/G8B8MYejyQ/AqvYPUT4B6VuNwVc6EcKyYbPZqXRE/RG52JHhM75cw0zHuVBcBMaTnxU iMsjWSrvoQuBKt7D3KlIN/78808vAzY+7fcMCm46fbZpD5wAwuXo2+kHmQHUu/i/BcC/u1z9t6Qe 4m7+TCmgfStdIU17sIPKg5wZKHsQpmw0wtALGEx5WBMaTpwgfFTIO+vUqsnMil80IOOXE/v+PYvB XR5hKYk82VAMDNkhLAwJ9Pqx6EjhKGmHCx8o4a3dzucoEEV+brxr+0gs/s8hYG9GzypGhvYLHjnd kN2D6Pm1EIbbjih7bIwhQAIYyB8YOqjbwpp3YomUDCwMURLu4h9OzwY7DAUqIwS8rvj9FsJnAe09 4nEAJaNfXMB1aCZf5Y4Ge9dR54gUrXX3DQWTaAoXDHTdPErC1Q72DOdf+0jnIDkCxrO9AnIZjAz+ meRgAOrC+3ZczSRNJ4ECXBhyoZQMIHqUkFsAdFxwNnMq2A2PFKgyKJLQQEF+/AEaDwJ8ZRcXbDQL J3ef8SveQXvvAuhGzyP8koVfu/j/NEDLeIngKxXuYibzdoWH7yu4d6ARZOISq2i8eZS0TdlQeWEL FAn/YtpBjPIroQxNychTi9Bcgjt5IBXKkw1hwfBLkXAGG5xjH6lkTvkd8doInmItz0ZIzgJymPL7 IYJ08ds9pnjBht54rNC7QyNAQFfbgMZFvZEBPRMBB+gtPmfghxUoHn0Bha8SfKEA/6RLrXHIBi+y 0Zc2FIJBL8zJVBjC2ROeozehM+Fc0kuYk/QiJ6ERpkgm7yUUtAyuBQO8sAVKJYPBWuJDORXMhPA7 53RqSkOEcTuo6hAwBhK0hyEDhoLGGUFmOIN0McQvKVyIxlGDl3SLzRNEsfFFG2LGpWcikq/yAV1O gs8u0BfyoyN0zQut8bVCdCHgOjuzCg69DAyRHLg9+WEWl9AHhsLGqRQmYxyfEbXQDdi4xqkQELJx yC9auKgU9pr15SaPDDnloSHOoZ8cIw8MXADlM0J6VjYG8E5nmMpDQfMQIcD3WrY+MdPue6rrbB4i f8+DjnBR0mgTjUDqglYxaxnMzFcJvlCwEUDjNNG+7q63Fs5qaIRD9LjWURooOXcBXDoHqxTjhttK O0jCGKzyhRzy3jtKzYUDpzjHIVIYjd59DB2ShPo9px8iiAdTixL13fdUl9reNc4OTw2S4IKkcUHe KCZob7G86wKAwovLgQ7SIG/f7nnbWUUSdDSuCgG3HCXu76SS2QUQ3Ris9TAC0eP2YHkA8myc4r2n Z0dRqqZTnPNJ5DEE9bunGkCHJFoVDCnZXzPHO+6zyLaW0lAwpMvkb4r+5Vg726gBiGqQvE3er2OV WD1BEtq3VR46ewt9iWxfK+dMBi70O5ZfvVDQMHC5nlVhNhAZCsDQD1GeDUuUU/4mtGZhuK3lNAR9 3SGisJFKzxFhMf/gHpSGhchG6e58Xhbh0AVfK9jOC6Fv+9i0b2GVWPOyVCVXLNFa9QVjJg+7Vu8z SwShtfTIL0N6bn7soJqVhx5x7m/nGKPMea1PYbYH7Qu1RIagcYgm3871JIecuymtV8Om/vkGnVVw goWXFkasi8Q5H4zkWV1BJ4vZmIT3xWDCCUIFBL8CYEjPeKvPMK1yaDnFeXg7pwAZQpGHhoYB2mcV 44agb3kSuUKQfPIorQ7tZWxnq0HtRd7i8JDFkuvqIdaMRBHZC8NUqDAMGdAM6+VkBty5qhcWcoah lssvj4ygZ/lh+IUM4pyHyHMi0odu+5T8NDJ0QOQQwRspGZl5lLxItxGgrtc6v9cJ9bpVbBB3NUWb w3VZJVZPqEDk1QvwwhjpZb+t/i0zxWOKdi/zYoBSyfACtNydiqTBu+u5GQCnOPdD5EkE18ygWRkM y9A5p6C3UDLg+GYmFMbhptDXHY1LV7FBtKOLDHtrN75JVknE6ukZs72pUBuGLDL45ewZg/yDKaKE nGHYK0kVMkB6Dr8rcVac59+JmEegYSh/NhTp0AojLu6Cvv13Im13MACqp5Kq2gc6VLLRkA06t9s9 ZInVE23z20TaaydfTi9bzoGxIjTryVgqiYaGjJeew+9K4rz5O5GShJzBPygGU4LWnxFZkqC3eBK5 aFGtnko7Q3sZ29lskLuAb+Xpj8jsel1cYjX1HM4RYlgSOc+acX+e7XlWgWZyQXidbivA46VnHCX6 X74t/fEjv/Hikd6gp3U7QPiUL2eYQzMSuJtudxAPyuBTCcbO0KGSjYboC+/f8EqFFyW8JMJY6+1c LphkjvU8c4iQx6XiEspTHnkjtJILMXs05YZs1zMJxx0XAhQT7EkIhdHQUGkz9NbbHQSAknZTWoDe Z4gGQTJeLtAmDP0ReQt0YAGop+fFQyR5yJBOBoaCYawLLVCHgFN+N2hTz7iDbVCBK8fAwyunhT87 sycs56oAvcN2BwmhTtSAlveHDpVsNNS38vj9pY1QmBZkgsms53CIghKyVOjp+V1vbiN+O+jFmkMl Hu/tqKlmfNOpJZ7HI91GDK8dtjtoaU+lBeh9hv6VvK0RsYnhKEHbcGKvtd1h6FOK6Tm11iPlnP+/ HGiJDE/oNgMUJiPHoHG8JiOAGsYdMc1rkATxmp038HsZoPVtT+zyIV+82VNpWyv58PzYfR0lHCJ8 doTPYF0eblMqWTA5xj1uay1QgIWLTyVC06OY5sJQQzMGTve7zeX4SAG/gVLM3AIq2ZP37JztIk+G PlwDVcAqDEAwPErYYnx29PLR1ev/Z8Dl0bNdbB5Df9MDJ/9cAhTA4cIhoqG7L3RbaeWUJxhhqHgY +IdpEjMeQ/4swDNCC30JbF6alQG/7EVjAL3KVlaSYxmAAPArJ95v8GMrfIKEKyjHBeO2xBPi5Q8G HjqQEw4RxAw4PBdwEZc2hw7htrK5cwytJTCATmj+/SjT3kylDA46dmpWxiJ0LqY8d8cAXoohEpwm XHg84YKepQEZTSFxVjEycrD/4R5KBhbeXOULfuo8Z4AnO4WYDcZzidDRGiCan4jCiSmHYAZmzvkn PTPQd6eZKjgzwLc3eJ+Di29vIG+K2SU0kI3rLdhcJS3h6YNzihgpmbi4szD4MYuYDAd/09nzMxj3 gA5PJoEeTPEoIWczLXPOT81D90oq/90xoI9xoGoIhoJ/FdT/3aSiLCRNZaOpJf/dxImiX+g5mzyq QZ6m4eg4I4hxuGwjYP4UNxFJFqYuhc7FlOeuGXAxUypZMJJxNjz4Ci05ek4uj1DkyYaj83TM7Asy 336UroOeKa9i7o6BnqKk4WxAzLwwdaOWiK5swQhDVQI/bX6sgU8C+WYSznn+Ba20Fxm3QM8XWZF3 xMBFipKGserGQ0SKiN7TMP1hlsPb0ZFHvysFCB5hNRsMh555J3lHYqhSb2EAKuLvSk05ZSc8K2pp jJ4lDc9a6IL2kyJ7sfH5d5K37E6tvSMGpKggnubQZbyKlsbooYZ131MJOh8feWSs3vgdKaRKnWQg Kwr6kYRo476ujFWb0MOpIa6cWyiZ0IIIiPJv1LgYKONhGMiKkoqgLtgu49V/NSB6kDFx6dxOyYJm v37Pja/yCH4YzVQjTQaColzVfog20hLRKWM/QbC3O0Tkodl4PkSrv3o0d6GcD8BAUBRVvbWMxduB 6E3oHV491HsZD8aAFMXnEb99et1faq5g5kB0QcNA7zs3fgVXteTkDFBRuOPL27z4FVB4dqi8ib7R m8nQDqD5d6W3vl/+QVO9nQss1XCeASoK32iFkPgV7n0OESs8EP1A6Pndqcg7YoBfz+a7O32Fe7f6 D0Q/EHo3egtoNwZ6X9vep4AD0Q+E3ofbQikGioFioBgoBoqBYqAYKAaKgWKgGCgGioFioBgoBoqB YqAYKAaKgWKgGCgGioFioBgoBoqBYqAYKAaKgWKgGCgGioFioBgoBh6Ygffvn8Y/Hz48ffjwfFoG xsVfNHuqHi+qfD4Yu3mqNlHMfPE58lWcTx8/PvPnwNZQ27t3X8Y/iDmwwjH0TP3j7jh7th7X6iv0 fs5zFIq8boijNJbKprMz+3U2jTkhM/XP7MvZelyrr9D7Cd9arNXpsS8RM12cTWN1jsLpmB8eKzbf ONkzCpxp8FiVznRxbIUivGnM1H/+XcitrdVX6P2Bn0fHqnRmv46tMGvMPTP1By01h2frca2+QrP1 PHLxrGjP7NfZNObtz9QftNQcnq3HtfoKzdY5cvGsaM/s19k05u3P1B+01Byerce1+grNnq1NbOVa nR7b2kwXx1bopybbM/UHLTWHZ+txrb5Cs2drs85RlvQhnhm9IWbm55D6e6AzfYUzMjNE2h7iUf7J Tk++gzNdnJB8bfq9169GgjGQzeR56WUIQIcPZ3YQLSPs8FIHBcx0ceYWJutH2OBnwM/Zpmb6Pb/q nNXH6GimC8R446eyZ+ofv4CfubtM9WS/d9TUfEeIHPxkrvb0zHSBmD1Lughrpv46RxdRunPw7Tt4 hufvTBd1jnaW1gBuZr/OoKtBC2FqsqOTvxjOdPHY5+iEf5oMSvPhzH7VOXLG9rFn9uXRz9GR37e/ dJdn9qvO0aWs3h4/sy+PfY6O/Xcrl+7gzH7VObqU1dvjZ/alztHtPK+VYWa/6hytxfZ8npl9qXM0 z+fWkTP7Vedo613I+Wf25d7PEeoPP/hs4fXnGf8ep97XZVXs6ZlRIF8ZuInYOBhvO/jb2LPmjDXT BWLywpN47r3+S2mEfiCqxZ8zb1loeWYHz/+EnenizJty7/UHUS0O8fRcPETnV523ObOD5+9oposH OEdoYfHHN/e09qdPX+scnXB3/j+co0cS3ufPdY5OeIym/jXivT+PHukcPT19f6R2cCRmXsnR8plF ONnFmVuY3IVF7Z25R3/9fX6uc+R8nMWe0eGZNTZT/+IhOv/LneRS50hUnMqY0WGdo/Ns2eQ5wsfj 56l5XMmMAs//QjfTRZ2jsRL2nH1+/jHzeK1ztOemAOvez9Hk3yUXtXcvwps8R3f0JY0ZBd7F8wiN LP7sfLrn4SCY8IO/sMCjOwz9uD/YGM6DHhiJ93WvPz/e7jK+46M8/Hz58g0/nz9/O7DIi6AXtaeA i9JWcDFQDBQDxUAxUAwUA8VAMVAMFAPFQDFQDBQDxUAxUAwUA8VAMVAMFAPFQDFQDBQDxUAxUAwU A8VAMVAMFAPFQDFQDBQDxUAxUAwUA8VAMVAMFAPFQDFQDBQDKzLwP1uXh6MKZW5kc3RyZWFtCmVu ZG9iago5IDAgb2JqCjYzMzYKZW5kb2JqCjE1IDAgb2JqCjw8IC9MZW5ndGggMTYgMCBSIC9UeXBl IC9YT2JqZWN0IC9TdWJ0eXBlIC9JbWFnZSAvV2lkdGggMjY4IC9IZWlnaHQgMTIyIC9JbnRlcnBv bGF0ZQp0cnVlIC9Db2xvclNwYWNlIDcgMCBSIC9TTWFzayAxOSAwIFIgL0JpdHNQZXJDb21wb25l bnQgOCAvRmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeAHt0DEBAAAAwqD1T20Gf4hAYcCA AQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMG DBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgw YMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCA AQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMG DBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgw YMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCA AQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMG DBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAgW9gfzcAAQplbmRzdHJlYW0KZW5kb2JqCjE2IDAgb2Jq CjQ1MQplbmRvYmoKMTMgMCBvYmoKPDwgL0xlbmd0aCAxNCAwIFIgL1R5cGUgL1hPYmplY3QgL1N1 YnR5cGUgL0ltYWdlIC9XaWR0aCAxMTkyIC9IZWlnaHQgNzk1IC9JbnRlcnBvbGF0ZQp0cnVlIC9D b2xvclNwYWNlIDcgMCBSIC9JbnRlbnQgL1BlcmNlcHR1YWwgL0JpdHNQZXJDb21wb25lbnQgOCAv RmlsdGVyIC9EQ1REZWNvZGUKPj4Kc3RyZWFtCv/Y/+AAEEpGSUYAAQEAANwA3AAA/+EAdEV4aWYA AE1NACoAAAAIAAQBGgAFAAAAAQAAAD4BGwAFAAAAAQAAAEYBKAADAAAAAQACAACHaQAEAAAAAQAA AE4AAAAAAAAA3AAAAAEAAADcAAAAAQACoAIABAAAAAEAAASooAMABAAAAAEAAAMbAAAAAP/tADhQ aG90b3Nob3AgMy4wADhCSU0EBAAAAAAAADhCSU0EJQAAAAAAENQdjNmPALIE6YAJmOz4Qn7/4gfo SUNDX1BST0ZJTEUAAQEAAAfYYXBwbAIgAABtbnRyUkdCIFhZWiAH2QACABkACwAaAAthY3NwQVBQ TAAAAABhcHBsAAAAAAAAAAAAAAAAAAAAAAAA9tYAAQAAAADTLWFwcGwAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAtkZXNjAAABCAAAAG9kc2NtAAABeAAABZxj cHJ0AAAHFAAAADh3dHB0AAAHTAAAABRyWFlaAAAHYAAAABRnWFlaAAAHdAAAABRiWFlaAAAHiAAA ABRyVFJDAAAHnAAAAA5jaGFkAAAHrAAAACxiVFJDAAAHnAAAAA5nVFJDAAAHnAAAAA5kZXNjAAAA AAAAABRHZW5lcmljIFJHQiBQcm9maWxlAAAAAAAAAAAAAAAUR2VuZXJpYyBSR0IgUHJvZmlsZQAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAbWx1YwAAAAAA AAAfAAAADHNrU0sAAAAoAAABhGRhREsAAAAuAAABrGNhRVMAAAAkAAAB2nZpVk4AAAAkAAAB/nB0 QlIAAAAmAAACInVrVUEAAAAqAAACSGZyRlUAAAAoAAACcmh1SFUAAAAoAAACmnpoVFcAAAAWAAAC wm5iTk8AAAAmAAAC2GNzQ1oAAAAiAAAC/mhlSUwAAAAeAAADIGl0SVQAAAAoAAADPnJvUk8AAAAk AAADZmRlREUAAAAsAAADimtvS1IAAAAWAAADtnN2U0UAAAAmAAAC2HpoQ04AAAAWAAADzGphSlAA AAAaAAAD4mVsR1IAAAAiAAAD/HB0UE8AAAAmAAAEHm5sTkwAAAAoAAAERGVzRVMAAAAmAAAEHnRo VEgAAAAkAAAEbHRyVFIAAAAiAAAEkGZpRkkAAAAoAAAEsmhySFIAAAAoAAAE2nBsUEwAAAAsAAAF AnJ1UlUAAAAiAAAFLmFyRUcAAAAmAAAFUGVuVVMAAAAmAAAFdgBWAWEAZQBvAGIAZQBjAG4A/QAg AFIARwBCACAAcAByAG8AZgBpAGwARwBlAG4AZQByAGUAbAAgAFIARwBCAC0AYgBlAHMAawByAGkA dgBlAGwAcwBlAFAAZQByAGYAaQBsACAAUgBHAEIAIABnAGUAbgDoAHIAaQBjAEMepQB1ACAAaADs AG4AaAAgAFIARwBCACAAQwBoAHUAbgBnAFAAZQByAGYAaQBsACAAUgBHAEIAIABHAGUAbgDpAHIA aQBjAG8EFwQwBDMEMAQ7BEwEPQQ4BDkAIAQ/BEAEPgREBDAEOQQ7ACAAUgBHAEIAUAByAG8AZgBp AGwAIABnAOkAbgDpAHIAaQBxAHUAZQAgAFIAVgBCAMEAbAB0AGEAbADhAG4AbwBzACAAUgBHAEIA IABwAHIAbwBmAGkAbJAadSgAIABSAEcAQgAggnJfaWPPj/AARwBlAG4AZQByAGkAcwBrACAAUgBH AEIALQBwAHIAbwBmAGkAbABPAGIAZQBjAG4A/QAgAFIARwBCACAAcAByAG8AZgBpAGwF5AXoBdUF 5AXZBdwAIABSAEcAQgAgBdsF3AXcBdkAUAByAG8AZgBpAGwAbwAgAFIARwBCACAAZwBlAG4AZQBy AGkAYwBvAFAAcgBvAGYAaQBsACAAUgBHAEIAIABnAGUAbgBlAHIAaQBjAEEAbABsAGcAZQBtAGUA aQBuAGUAcwAgAFIARwBCAC0AUAByAG8AZgBpAGzHfLwYACAAUgBHAEIAINUEuFzTDMd8Zm6QGgAg AFIARwBCACBjz4/wZYdO9k4AgiwAIABSAEcAQgAgMNcw7TDVMKEwpDDrA5MDtQO9A7kDugPMACAD wAPBA78DxgOvA7sAIABSAEcAQgBQAGUAcgBmAGkAbAAgAFIARwBCACAAZwBlAG4A6QByAGkAYwBv AEEAbABnAGUAbQBlAGUAbgAgAFIARwBCAC0AcAByAG8AZgBpAGUAbA5CDhsOIw5EDh8OJQ5MACAA UgBHAEIAIA4XDjEOSA4nDkQOGwBHAGUAbgBlAGwAIABSAEcAQgAgAFAAcgBvAGYAaQBsAGkAWQBs AGUAaQBuAGUAbgAgAFIARwBCAC0AcAByAG8AZgBpAGkAbABpAEcAZQBuAGUAcgBpAQ0AawBpACAA UgBHAEIAIABwAHIAbwBmAGkAbABVAG4AaQB3AGUAcgBzAGEAbABuAHkAIABwAHIAbwBmAGkAbAAg AFIARwBCBB4EMQRJBDgEOQAgBD8EQAQ+BEQEOAQ7BEwAIABSAEcAQgZFBkQGQQAgBioGOQYxBkoG QQAgAFIARwBCACAGJwZEBjkGJwZFAEcAZQBuAGUAcgBpAGMAIABSAEcAQgAgAFAAcgBvAGYAaQBs AGV0ZXh0AAAAAENvcHlyaWdodCAyMDA3IEFwcGxlIEluYy4sIGFsbCByaWdodHMgcmVzZXJ2ZWQu AFhZWiAAAAAAAADzUgABAAAAARbPWFlaIAAAAAAAAHRNAAA97gAAA9BYWVogAAAAAAAAWnUAAKxz AAAXNFhZWiAAAAAAAAAoGgAAFZ8AALg2Y3VydgAAAAAAAAABAc0AAHNmMzIAAAAAAAEMQgAABd7/ //MmAAAHkgAA/ZH///ui///9owAAA9wAAMBs/8AAEQgDGwSoAwEiAAIRAQMRAf/EAB8AAAEFAQEB AQEBAAAAAAAAAAABAgMEBQYHCAkKC//EALUQAAIBAwMCBAMFBQQEAAABfQECAwAEEQUSITFBBhNR YQcicRQygZGhCCNCscEVUtHwJDNicoIJChYXGBkaJSYnKCkqNDU2Nzg5OkNERUZHSElKU1RVVldY WVpjZGVmZ2hpanN0dXZ3eHl6g4SFhoeIiYqSk5SVlpeYmZqio6Slpqeoqaqys7S1tre4ubrCw8TF xsfIycrS09TV1tfY2drh4uPk5ebn6Onq8fLz9PX29/j5+v/EAB8BAAMBAQEBAQEBAQEAAAAAAAAB AgMEBQYHCAkKC//EALURAAIBAgQEAwQHBQQEAAECdwABAgMRBAUhMQYSQVEHYXETIjKBCBRCkaGx wQkjM1LwFWJy0QoWJDThJfEXGBkaJicoKSo1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpz dHV2d3h5eoKDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW 19jZ2uLj5OXm5+jp6vLz9PX29/j5+v/bAEMAAQEBAQEBAgEBAgICAgICAwICAgIDBAMDAwMDBAUE BAQEBAQFBQUFBQUFBQYGBgYGBgcHBwcHCAgICAgICAgICP/bAEMBAQEBAgICAwICAwgFBQUICAgI CAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICP/dAAQAS//aAAwD AQACEQMRAD8A/p0+zMOMf1pjwDGcZBOCK6J7fHynPrUPldiPoa/sWOK0tc/jBUl/Kc28GPujiomt iBnr9e4rpGgHPHFQPAB9OK2jjGQ6a6HOi0z+VRNbdQQMdPfmt9rY8jPbNQvARwcev/1q3jjH3HGj fY51rTHGP8ahMGeO/wCtdM1sSQMe4qBoe361usd2F7K2hzckB+7jgdff07VD9nYIY16Ec10jwYJP OPSq0lseOg6Cto4u+4Oj1OZNoD93P1xULWrYxz7V07QEcY75FQtbBh8gHT8q3WJIdFNbnLvbMv8A iKgMWByOeldM8AJJ7gHgdzVd7dTlT9ea3jiBSpHNmEdhn61XeAcnH4Htmuka2U9hioXtRg7etbxx LQnRscw8YHaoGhOCTx3rfa2fOACRSC0/rzXRHF2I9lfoc49vxtx1/GqrW3O4Y9+K6ZrXJ2/iahNq SSevHetYYvuX7Docq1mDwffpiqptOcHvxx2/xrqmt8du+f8AGoDBu4FdH1tdRLC2OVMHAPTiopIN wzj2z9a6h7ZT0HQ1WNsBnjOTVKvqDoW0scu9vgZxVRrfc/f8RxXVy2vOB19eaqtbno3pzj19K1jW Vr3JVBnL/ZSBk88fX61A1uM5XI5rqHtmPbHt/hVRrcnOeOe1aRr9blKNtGjmnhA+vXNVTbk9q6Z7 Papzzn09qgNsMYGcfSn7bfU09jc5h7dsglfrj+dVWtjgjHvmunktyD06fjVd7cemPrVrEOwvqvvH Mvbt3GQKqNbkZAXtya6hoOwqpLAzr8ueuOK0WLLdFvc5V7YDJGc54+lQSW42A9P8/jXTy2wHIHtx xyapm1Oe/wCVdEcVsSqDWiObaA5HfnpUDx+n4gV0cluVBGOneovsuCVb8Tj+laPF2V0OMH8NjmTE Bnp0qs8AYnHeumaAY+nSqstuwYFcDtmrWKT2NVQtsYEluCcYI57VSa3OASBk9q6U2+Dluf8AP61E 9vjnPb9aSxNkaxpXdjl2tuSMVWNrntyP8/5/pXTtB/fGM9/eqskPzfLTeMGqOtmcy0G0Yxx/Oo2g JAHp1ropIBk7uvvVfyOOnrz0q1iUzSFG3U5qS3JJdR74/wAiqcsDYyB0HIrqREH6g9x/9eoXt2H3 T+FN4ldTVUHbQ5Foc9BmomgyQFHtXUva4GCPQjjp/k1Wa3GQV4we9X9ZXYIYZpnPvCSCBjpzVGSD jHUYFdHJAf4R7g+tVzbcDd9Rms5VkbuLkzmWgGMYzzx9BVdrXIJ69eldO9ocZA/Cq4tsDcfXp/nF E8RaxcKTvqcw9seVIzzUD25xyOPb/wCtXSvasTyPT61A9vz6ZB7Vm8TtqdKpabHNCHH19P8APtVW S3OS3PqRnjH6V0htjnJHpwKhmi3DB/Os6ldX0KVK/Q5poN3BP6Zqq9sxAB9fyro2thuJ68dB/Ooz bZO73xWf1iyOmlSfY5lrUgfN37+3/wCrNVmt8I2/knr6108lu39M9qrNbdxjPcim8Rdbm6os5R7f ad3Xjj3oaE4GAe2c10Mls2KiFtkkJ37/AMx/k1jLEruVCk07HOGA9h7/AJ1A1sen1GDXRPbZbnjp j/8AVUBg2A54P881H1m+x1woI5loCvXoemarGFXyMYP9a6R7fK7QO+emc1WFttXOMn09qwlibLY0 VB3MHyRtwR19qqSwOGz+Gf8ACuie3IOeDk547UwxH+Id+T1rNV7O5tCjc5U2p/i7cVHJa8ZwOSM1 00lsG56HPXpVKSAbeOgOckVM67drluhbQ51rZvxP6VXktiBwO3SujeDnd71A9uF5H5g4681hOqaQ T2OXeDJyKrPCRXQvb7BuJ6HnHv09KpzQEZP5EU/aXNHTSMJ4ew9elVjCCM85zW+8Wfu9feqjR4Pr 2NRKpZl8qOeeDHHbFV3twef5VvPBluMH/wCvVZ4l6YxnrWc5RRauYbxDr+dUfsroCOox25ronhXo v61BJbkZz3xWftkti4ps5o2pKkAe+DVY22QQMnkkV0Tw44x17mq0kfO7gYHA9f8AP1qp1r7m0Yrc 5yW1Y4xxxk/Wqn2Ykd/YmuhaLaQQO/f/ABqGWP8AiH15rF1uxry9jnHtVz/hUTpjJA5reliDLj8F AqlJbsvTr9OlR7W71KSujGeHnAAx1qo0Kk8cYrYkgx8p+v0qOSEfwjj6cVSqDhSMN4txyMH61A8a kYHp27VstBncAO/+eaqGIFgRnnp9Kj2gexMQwqCcdPeojESef5c1tvCe2fb8KrNAxGTkZp+1TNvZ O9jFlhzxjiqbR84wTmt1oCDnGcVWlhEe04ye5z0qfaaj9k7amHJAO/IA6VG0JwFwQOnHatuRDuOA MZzj6VA6cYA5zyB/+uonUsawglcxPs3zeozz6/SmeSgbceeePY1rNG2Mr9OlQshJ6HjnPFYe1uaq kkrowZrbkuvJ7f54qu1v3Gfoff3rceEcbTn1z3qIwgj179KXtmN0E2c+IASX9enrUU0HcHJ6Ct77 NuyR68f/AF85qHyARxkCqlWe5SoK1jEMR8vLfhjrVYxFgAenOSe1dE1vv+8CMnb8vXFQNbqB8gz6 fSpVXSxq6DXU59ov7vfpn3pDb9W6Dj866Fbb5dzdMduag8lWGOcGj2jZbhbcwUgG7DD6VBLafMD6 5rojBweByeO386Y8B/hGAAOf/rH/ABpe01E4LlOc+zZyW446fSmSW5X73U966Bbfs3TqD+HFNa1y cnn0xVe1JcLq5zZg/hbrz09fao2tdvQZrpGtQG3dR2JHT8Kh8ne2G/H396aqIIroc2bfL4A46nI9 acLb068dq6YWx25JHBxjHpUb2wAwR+NS6qehpCjbqcsYGUjk8jAHvR9k9RzjPFdH9lUN07fhj8qU 2qhD1JHTnnml7WwQp9zlzbnnI6Y+lM+zYUsq9+PrXSyWuVwfyP8AhTBbYBJ4I9T2o9pctUzmjAoG VAqNbZTlT07CumaD5SCFOBj6+/WoXtsDIAznPStOfuQ6fY5toNzFMZ9yai+ytjI6+1dT9lThiMZO M+hpBbKoIOOBgjrzT9p2H7J2uzkmtmBO0E5wDn6UxLTjcRxnJ4/wrrDbkjYM9M4HrUBtEGSeCD9f 0/8A101NEey6nNNahc8HbSi2PKkcjGO/6da6N7Red3UgL14/z+dNMAAXjPqR+nNU5LdGkIXZgLbq shkYHkZODjmoDEfMZgdw4Gc9Cenauia3OPlJz/tVDJaH5mcY/Q1PMglFrY58wNktzz1yeSPf1pkV spk3YOCTkdOK6KSBXfA7oAcY/lnr61A1u6qC34Dq3WplsCMOaMIQuN3bGSM+vSqwtXd854OOh9M1 0T26ggEjO4jOOmcUw27Jkr1CkAHqec57USSTLjeWpzTQD7pJIP8AD2OPpUMsB2jgYHGfXIzmume1 VjtYdG46E+3NVXj3HnBLdOKjmsyeRnOtEpy64ByCdpxxjGaZLaDA3AEhcDGcn6+9bn2chsOuQMfL 0Ax/9aiWNVT6A59/oeTScug0rppnPixDkN7AHGOw6DjvVCW32yAY47A5OD7iur8lU+c546nJ/wAB VZrc5wwwCMsv86UamupXIrHPMgl++AFAGO5x7cmofs0gUq69DgEjv6V0H2ZvMOOABg8fp3/OgQq7 KOc9Cc+v4USmugcrumc09qAAR9cnqAaha2AYFsdCPfrz271vyW4YMVA47Z6H2pPsx3HP1B69uh+o /nUKfccINs5r7NuGBwSeoHPX+dV5IH2blyQAAfrXSNbKnC859R2FQeXuB+6F64PY9vrVOYmzEEAZ NzAZA545J9e/58VXaFz8vc/TA/AVuxRHJUL2x9cVVliHPlYBHQdsVDqanTolYw2i3ZB4wMVF9kX+ 9/49/wDWrbeFVPzEEA8nB/lTMWvp/wCO1PKYyjrqf//Q/qseAk5bB7H1qEW7bsHn2rfa06j0PSo2 typwRX9QrF9j+SHQbexgNak/dHPvUT2+Bz16n/OK3nt1PX1xg0xoT25+tbLFmbo23OeaDB5Hbjmo /IUdB71vNb4GBjn9KjeEdPl59a1jiyVRWxz7QfLxjpmojbg8nHT0/lW+YOPlxg/pUBgBwSK6I4oX 1XyOdaIYAxjJ/CoGhAOcdf8ACulNvlcds1W+y8YP5VtHEol0GrHPNDk4GB+FV5YVAyvT8/pXQSWw AyoPHpVV7QgfKf8AP1rohifMHR8jCFurn5QPXkdvzqOS0IB4Bx3reW2Yk5HT+dIYGz1zW0cW11JW H8jlzbDp14yahMGB8oxiunaBu4FVmtw/b/D8a3ji+41Q7nNmFTy3PqR2qFrYZ+U+/Tv9K6I28YyN pqu1uM9PfPato4zUFh2c7Jbk5P8A+uoGtWIxjvj610htR255zULWwxW6xonQ6nLyWp9cnpx0qubf ttwPp+FdM1sD/X/Jqo0BAOB9a3hi0w+r+Zzr2uFLYx3xVVrb5sfnXUPb8cj3x7VWe2MlaRxmu5f1 fY5owY4qsbcnJJ/EV1D2uRnGcZOPrVYWwx/Mf41qsXoL6szmTbKvQf8A66qyWuT6eldO1tj6Z6iq zW3pWscU+41QZyrWuTjHIBP+NQNbdhn3rqXt/X+VV2swQT1ya2ji2CoprVHLG2z047dKrNaNkD+d dS1mxznv2qFrQsMHqar669jRUbvQ5WS0OMtiqr2rL97mute3YZA/wqm1mPvEfj9KaxjG8MjlngOe R3yT1qqbYH+hrqntsn5qrm1Gf8fetFjBqicu1mh/pkVSks2U5UZB6454rrTaDYdx6dunP61Ue3Ge Pzqo4xplyw2hyr2Y/rioJLQj/Oa6g2/PPfj061BLa4HQ/Wqli9RRo6HLSWQKA98dKrNZ7Tz2711L 2/Xrz6c1Xa2br19c1SxZfsUzkmtiCUI47/5/wqp9kBbIABrrmtuh6n09Kr/ZhuA6c1oscVHDHLSW pbLAfjVZ7MnjHHSuse1BAUHI61WltDkFOfpVLFrobrCLc5KS0+XBz1qu9oQPlB98V1xsn6t1B6f5 FV2tcnB61Txatqyo4R3OUNuzKR7d6qvbYHP5V1ktoQMD6CsO4nW205tSmjYoGxtUgEndtH6ms6uZ QgnKcrJJv7tzppYKpUkoxjfp82YxtO4/OoJLf16fT0rsJrIKxwM4OKz3sgGw/FUsZcX1Zo5Q2/Yd qjezBA3fmP8ACukayPBAz+tVmtSOmTz2qnivM0hQktWcu9sQeOxx3qA22egrqmtD1GePzqo9rnGK UsV5nRTodzmGt8NwCPTNU5bfqMda657QBePTrjmqMlptOevNTHFeZo8P0RzDWwIyfTPHpVZ7b5t3 +cV1JtgTuAH41E9qpHPXrUPFJdTaGHsrHJm1PBIqs9kw5wPSuoe2wMjp+dV5LYOp4rP60aewTOYN o2MHOaiMWOPfHFdI1nuGeg71C9ooJz+g96HiFqaRpWOZeIsRge1QvBxz+Oa6T7KFJwOxGfSsq9hZ I8LkjvgVH1i+hooHPzKnb1pptlYbgQferH2YYyep70JC4kAX8fesJ4m+lzZQ0MtrcnjkDPXj+VVp Lc5OAe/bmumlgyRxwCCDVd4tzZI6Hj2o+sdQ5bHLtBnjBxnrVd4MjpXRywKcHHv9aqtbsQcHbgjj FRPEaXNYwuc2bcljj/8AXVT7Oe+a6SS228Dn6Cq8kHJ/H3qXiEy40Uznmh3DJx61Re3x0HTiuleF SCfTrVaWEgHjOah4lrRGns+5zclspB4wOlUpIGU7uvPIFdQYMLnAI6iqr268jjPc96h4ruV7C2zO WMW/jr3/AAqu9qSMkYwec+prphb/ADHAHB4qs1uNpGP/ANdTOvrdGvKkcw8Py4PT+lVWix2HvXTS 22EwByOme9UjbADgVl7VdS1TRgvB0yB9az5Ier474wea6Z4CeDjjJNU2gGMAHPUY9aFWK5HsznZL fPBqvJbqV+nb61vyQcccZ61WeAj5R1x+AqXW1HGDOda2CnPp2NVzbjJI7D9K6EwA/Q/5NVWhXHIx SeI1OhRRz8tsGFU/shBwcdhg/wCRXTSQeg+gHSqUkKnAwfz9OlDxFipRVzn3gHzJjHHrVWS3UjkY OORXSTW5HPPpxxn/APVUBtdjeueT7UvbdTWyOYeIrgEY+v8AjURi5JAzyBXRS2655464B/Sqv2UB fn5z0I9u1L29wcb7HPNDwCffpzVeSBQNx4+XPQ10LWpP3exIzUBtztxgdMHmp9qUouxz8luuMt17 H0NVWhwxVhntxxXRSw5HQH19f5VA1rv5xznil7ZlpW0sc2tuMZI6/jVcwf3eg4wK6V7UqowCM89f 61AbURf6sZ4wQOvJzUqb6D1RgPB8uRye9QG3LE8Dtg4rpPsZk+bByq54/wAKYbMscAc9u/P0pc7N 4xbV0cu1sV4XnHf/ADiohaZ6ZFdN9kypUHjI5J4yab9j8uQnGR69qbqNid+iOb+yySHjHGOO/NQG 15O4cfTrXUrbKXC49evrUT2LiT5Bx159/rU87LknZcpzwgATaPX7vQ81VNplsE/l35rrhYkfK/PO Oe1RNZbXBHpk9cnPahVNy3Tk7HNm0EiEEc4xj0qJrJQPlOBz/wDqrqfsoK5zjP1pi2m45YflQ6hp yaHIG12nG0fjT0swRk/Q5rqvsmG2j1qEwHBA9eOKftCVCzOVewJJHQ479OKatoAe35da6o2fy56i q72427cY55z2NCqB7JLU542oI+Xv7Uw2gK7eBkZx9K6I2wAwOe/H+NEcAUbOCP6UnUY4ay1OXe0y wyMH26GmG3IGzrnjJrpJbbDYAP8AWofsqspJxgdKftNinHW6ObFof4hz1pGtCXJVeOnTrXR/Zxgk egH1qE2+Rgk/l6UnUYuTuYElpkNtH4fzqF4ORtxnP5iulW2JwSBjOeppktupOTx2HFCramvstLnM rFyC+cn8enSmyWikkgc988mt4WpXH9PQ0htQEz36j8a09ohRhdamEtuR8y45wo/xqF7Rs5XnkYI5 z6iugWDaoYg/iKriFTx7Z/GhVdRSp3VjnzbkZJx9M9yeaVoPlyePT866KS0QKXAOeM4qoyZ+6Aff HXFCrXeg/ZW0MTy4w+CMHH5VFJblhgDHJ5+mK2XgwMHgHkZ5H+TVZkd9pxxkjae2Kp1RW0ZmC2Cs JCPb5R39ajNspYBANwHy46cVplRny255qQRgKJQuDkg/yqZVWrFRhfRGC1p5Q8w45ck8f4VHNABz GOT6c9K3Z1Y/JgEc8+tVxCCVJ5449B+FS63UqNPVpGG9sSxJxz275qpJGUOUHB+UKeAf8PSuguAT kHGSOnvVRbdW+ZuxB6dRVe10bZM6XvaGK8DsjR87i3Rfp0qubYmIHbtxn29f84roTErERvjg/gPq ahkYBDuUElTz3475pusCpJbmBIjMwY+mMjgE4z71XEJ3bpOQM7u9bLwkE7R0GOetQGLo+ORxz0xQ 6iM3HqZ3lYQue4AY+n51WaNlfAIwORgc56/jWyyKYz8uCeMdiag2FWx0B+WojPQtq1jHeBWYMx5B x0OOBTfs4ZsDqeW461qtEAM+nQA1AVG3y33BsEjb9c/lxU+0LgZDwiP5m5z+XPqP8TVU24EY83k9 cg8H61qyRggS5zuwpz+H+FIy4jLZ574HXnr+FNz0IaTZkvD5ZMY+hxnjH0qgYCUzt5BJDDpgdRW3 LCcHqSeuKrtAwI+UkA46dSalPsDRiyxoYc9DyeOo/wAaoeWn99/++RW5JCzcDn5SCTVX7G3+Qf8A CqVUi8uiP//R/rhaJ+QT+FQSQFhj34romgwfmz+Pf61A1uOoPQf59K/d4Y1n8yPDLoc/9nxgY69z UMltx0A6nqePaugNtxk8cce/6VE1uwOG9K3hj9SHQ6HOi3wM5GMfjxUfk4GQM9ePpXQtCP4R371G 8GRtIxkVv9eTI+qPoc95IA2471X+zk9T7V0JtuoI7Y4qNrUL8uM+461pHHaB7F7WOfNuSTj8/r6V C9sR/PmugNswHTp/jURhwcEVv9dE8M2c8YG5BFQNang4/wA/lXSvBzgj2xiomgz1+o4rSOO00Yvq upzRh/CoWtya6M23bHHXjiq5t3JyRxW8cb5j+rXuc81sMd6rvanbwevXNdG9sR05/wA+lQ/Zz6du lbRxzF9Vv0Oce3CjPPPXj0qs1qD97OccV00tsT61A1uD82O3pW8McV9V7nLG2LcAYyegpj25U9O/ Suja3IXn+Xaq7QMeT39a2WOD6p2OYa2wNp4H3en6VE9oCMHP4df5V0rQNjP4GomtTzx9K6Fj13F9 U12OWexGPlzntULWkm0Een5V07WxJ3dKia1cDgVrHH+YnhNNjkZLd045/GomiYZyMetdYbXHysOu eaqvbAjaByeg4reGP6AsG3ucv9nBzxULW/8As10ptgB0xx1681Xkt2HY/wA63WPKWE0OZe1yeRjj 8KrvaHnH5k10zQHvn+tVzaDvzzzmqjjmEsI+hy7WxHA/Sqr2oIwR+HpXVtbndjA46GovsnHqfStV jwhhG3scs1sMYUdOKqNbHntxXVy23O49MnpVU278cE96Fji5YWxyxtDg7gT36VUe0Kk4B+v0rrTb EZOKgeA7ckcdapZgNYS6OSa2HTse3Sqj22TnA59utdc1uB8wHOetVHtG5KjFaLHlfVjlWs/m+Xj/ AAqtLand81dW1sw68e9QtanPf8KHmBp9Udjk/sanOeT71XMOOcDI6cCuraDA4x069qqyWx+8cdec 01j7vUawrSOTe2AOcdefaoGs+Dn65rqXtSccfX86gNsdpOOPXpVvHm8cKcs1n3xg/wCeKrSWh5OD XWG3YjP5D1qNrclSaI5gaLC6HJfZHBy2cdTUUtmoU/LyOc11BhyvI7fn9TSG055yP/r0pZh3NYYZ bJHGNaHdjnaTxXnGtxznwRdzruLLMSDHxkJcDB5z6dK9umh+z7GGBumROTgHewH5+1ebPZQN4dvN GViFivbiF2k6FfnlAz+Ax7ivmOJc2l7KUIbunU+/3bfmfoHA/DbxNWm7f8vqK+9z/O35G1NZASOU JIycAVnz2TH5j26V2Eam6lnDgDy7l4hgdcAHP60yWzK/Kec/pX1UMxvqj4ieCavdHFm2I4x0z29a qPa/L2GTyPWuzksiVx3xWe9o5GWGPb3NbfXUw+rvY4+W03HKjjpxVWa0ZcZHWuxezTOOvbmqz2qj 7p+uan67Z7miwl1Y44wfNhhz/KqzwMTnkHpzXYSWYyNuPf8AziqhstxOQPatFjVuU8M1uzjzCw+6 Oc9v1qJ7QkBuOe2K617PAyKrPZbhuU9OmPTFJ4wqNC2iOOktGzyM1Xaz2j5vwFdY9pgYkzyegqpJ AS2CPbn0pfWuw/YdWcs9qef6VA8DA4H/ANaula26segP/wCv/Oag+zdWAOO2RUvElKkjmGgG3aw4 78VWntFkQAjoMAjsK6iSE9h0/lVMweg7+nSp9uzZUkcPJpjAZj/WkXT2jOT37Y//AF110kOeR9fp UJgHQjGevvQ8QugnSRyTwN068Z9qrvCwyMV1T2vtVWW3BGCOemfSlLElRpnLyRcle/8AjVN4eOBj njiupa0IzwDn2NVJrbKnjjPFRLEIv2TOWkgwTn8arSwNjj6/5FdJJbMc1WaDPAFJV0zSNJ9jlTCS cmmNbZ5PUn6V0b2+eo6cHNV3gwT3PQH2qqmIVrpm6p9TmmgO7aw6flVRrYdO3euoe34wenY/5FZz 2vfr2IrBYgdOOlmc9JAvGM5x3qq0HOO9dB9n6krg8ZPTAqrJBxnHtQsR5mvstDAe2CoRnn3qp5Pz c4J6Guia3Gcke/P+NUWgbnAwc9KiVffUfs+xhPBgHjqP5dKpNFsBKjnoT/ga6OSBgMdcfWq7wlV6 f59aXt9DRQv0OZMZK9AMnHT1qm8WOCDjHNdO0ChSAOck81TktyWBI4BrNVtTN07dDm3gzkn0/Oq7 W4757En/AOvXSSwFlzz6CoHhG0EL0/Co+sM6FT2OaeAhcnnvVRoPl247dq6Z7Uqc+9N+zhhjGAP8 /wA6p1tNS3Svoc19m7/lVH7M4UZGCeldcLcZxjpUMltmQAdO1THEdDb2asci9mWGD07EVE1qSGCj tjFdibPcm1snPp9aYbLblvY1TxDsN4fqjixaNIdo/Oqj2ZAAYA9+eldr9jOB78Y//VURtM9ev9Kf tWmTGPQ4oWOXDbT6ninLaOpY4wCcg12v9n4x8vrUSWKE5xz39azliDop02tDiGsgzkbTxxwM/wA6 q/2aznaw7cnrwO2K7p7IBty9+voDTXsMDCDBJAHQ9euaqOJew/Zp3ucU2nbFHYgghvX1/nTBaKgb cc9h2NdqbLcm04znP/6qqLpxEflHkE8kjOPbHFCxK6l8tjhTp5ZAAABuPsaBpxOcdjnjPHH/ANau 6SxjIClQTnOSSc9zjPSoZrFAfkGASC2T16/561X1roKFJbnFixwvzHgYYYGTx+tJ9lZfY+/ANdfL YE+h/utyOnr7UySxdkGAMhTkUvadzaMepyH2UgkkYOe/rmo3tN772HHYgda6r7FlsfNj25NAsSwx ggdMfz5odZFKN+pyQtAo6ck9qYtkAM8cnj0FdhLYBQdo5GT7D2/Oqq2R3MoHA55pe1TTaZfs9jmX hA+UZPsev5VXa1GwKvXPNdIbRt+0DHvTvsRXgqRznn+nWo9rYfLzaHM/Z/l4Haq5tN3LDA4JNdYb bHJH4iqv2YqxCjnp6dPrQq9mx+zWzOVe0UEkDjFRNbZO1s4HcetdS9sWbB6Y6d6iezUnI9af1m3U FQu9DlXt9xGck+tRC2IBUfQ9q6Y2235D1qEwYOT7Af8A16pYjSw3hznvs5VSG/8ArVUa3IbAGW6D j/GumWLLHGeemKgaHc3Gc/rx7VMcRZtidBMwZImUbiO2Pxqk8DE7hnI6HFdPJbAnaOfTNV3twB9T 6fpVQrqw3h272MJoCVBIJ+oqDyecqDgfz61t+WcdjxnviovJYpvOOnHXt9aHUY1BWSZivASOBjsD nk+lQCEjlxxnmt5oiF6L3/8A1VX8ht3A98Zz+dNVtLCdF3uYsyZGFHf9P1qM2xzuQd+v8j9a1miI bBBHp/8AWppgAIU5HzfUfjTVV2Eqd3qZTwcBPfGehNVXgDEe3Y8/hitpomPyt8o6jP8ASq4iHB7Z 4/DvSVTc1cLPQwzb5JG3Pp9fzp2xgm3qe49K2yg55/OqTxKhDL3br7Ue26EciiZM0eRv6nuex7VW VCW2nGcf1rbaMupPp0A/p71WeHPznjAG7ufen7boVKk01JGJNEcFCMgdwf8AOKaYQMtnPAHPHTjo a1fJUkkfQ+3t2qJ4sqdvoOv6mmqvQPY2bkYn2dvMIB+hwc/nVeSLBz0/z/n/AArXkyxycgdMdqY+ Np3j0+lVz9SY002ZPkAHJXgjk9iKrGEcs2OeB/T8q2XRQmMEnHSqgiL5547Y/P8Az/Wp9rct01sZ TR4yuOvUdev/ANeo3i2qVwM4+76/jWk8REm4nLEYwfSiWMovHJHPJ5GaTq9CI0+5l+Rk5z/Fk46f gKofZnLfKcDnIP51teWAvGSdu45FVyikZ4Ix3NJVOgTorQyPKct0yM9D+VRsg3YTk/w1rMmMhed3 J7CqbRHJJHHUD6Vbq3epPstdDHbI6Zzk9PT0zSG33ZDtyQM9s8GtOaNoz5n8WcgjFI0ZOSMZ6D17 nFU6mmgQpNN3MJ7cBy2Dx0298Cmf8Bb8z/jWm0QJ+QkHt169qb5N5/eP+fwqJVEilTvqj//S/sVM DdcZ9OfyqBoC+Rjn9a6drMj29BUf2LHUntX6IsxPwp4BbWOZaEDqOnaomgQ4yfrmume1z0A9getV /snzYOP8/hW8cxJ/s7sc61oMU1rQABRmuh+ykDjn+lQG0IOeRxkZreOZd2RPBeRzjWxx2NMa2OMn 8u1dGbQ4GfTnNQ/ZCAQf/r1sszRP1BnNtb+vP0qMWwGeOa6BrPK5HpnFNezbPGOtbRzFbFf2eznX tE3Z6+xqq1s2cAYrpWtsDOKga2bp+Faxx4vqEr6o5s2vODgd6hMCryK6U2vbAPsarNaAAjbmt4Zg tkRLA9Wc68BxgjrVdoSOCM85/wA4rpjZgc1B9lzn2HH+ea2jmCE8FtZHOSW53ZUVXkg25IH410j2 rYwOT/KomtCACR/UitY5h5lPBNKxy7wMDsIHHAqsbcBskdc8V1ZtsjdVZ7fODjkVrHMbieD02OXN v6D3OajkgDY2jqMV0bWnr7nHSoHs/Q810LMPMFhbPY517cA88enuPWq32fGcZ/Cune03NheT2zUX 2NiMj9a1jjl3E8G72RzTW/GBkgjIPsKqyWoxlfxJrpzZsflx0qP7ES2Bx9auOP1LWEd9Dk2t2I5G cd6rtbEjLD04rr5bRlwMZBPHcVXNlvOTzjrmt1mS3uV9UOOa1/hA/KmSWmByO3611rWPrnPaoJLM 8kZ9fWtlmSaWo1hGci9srHKj+f8A9eoTbHbkAk117WSkADJ9f84qBrX5uh4NWsyXcqOCfY482xfI xyOtQNa+uPeuuey547/hx9artZHOBzVLM+zL+pdzkmtUIzjj9KptarzwMEjHNdi1k+MsOM44qA2B HoBnuKtZku5X1BrU417Ft2P6VBJZbRjnB745FdjJYkZJ/SoWsyCeMf560f2m9NSllvU457RWUqRm q0lnkHIINdkbNckgAHr0zUT6ec/OO2KFmeujNHgW9jiTZgZxk8emKglsDuIUZrtDYheAOn41GLAl uemO9H9pO+444BWszh2sm6EcgjPHeo2sSOMc5rt2sOeMD2ANVmsMnOB60v7U8zeOXrojh5LHcc45 7+9MNmQAAPpXdNpx5CjjrVY6aSAGHU9f6VX9pvuP+z2tjijpwUgY5oazO3ABJzjmu1/s4lccHGM8 VEdPPSl/aGu5r9Rsea6pYWu60kvmWO3iv4Jp5GICiON9zEn0wOa+f/gx+0J+zj43utSttD8RaJJI s95dC3luYwzrDcLAXVWbJHUZAr81f+CzP7SXx/8AhBqHh/4UfCW+Fhp3iTQL241eSKKMykrMIdol kBKqyEghRz61/Kt4s0fxLomi2txJLbxhJfLjFqx85QQSdzqOn418XmfiFTwWOhBU+fkevTppZ6/P Q/oHwszCOX4WNSpRv+9hUurKX7vnXLezsm5X+Xmf6KKaY9uz71I8yTzlb+8JAMMPY0yTTt7bn9Ot fzq/8EFPjT8ZviX418aeB/iH4o1vXNJ0fw7YPpVhqt291HaHz2j/AHPmFmUbAFC5wB0Ff0qPYjOO 3Svrcoz+OKoRr048qd9D8VzzLJ0cRKFTV7nEvp5K7uM5rNlswAeM13psAM7R3qlJZkHDZ56n/wDV Xq/XzyZYfscN9jGNxA6cY71QlsVIC4Ofb1ruprPavAyvWqsloQefp9KpY+2w3Q0scI+nKw2jqBzn pVOW0AxgcgY/+vXfvZbvl7+v9KzZbFi3zjIHf8atY8bw9jhnsm6Dk5wQagaybJJBx6+1dwbAgYVe D0P0qu1kSpHA9u9Wsf5krDnBNaq+Sox061DLZb2JXA9PpXbvp4foO2OP1qo9kFG7ufatVjewew0O HeyYKc44P6VUe0/X/PpXbmxwD0xnj/PNVH05uwPuB71SxvmJUTh5LQEcjvzUElqCny/hnrXYy2DN gAewqpLY4Py5z+VS8W31L5FvY4prM4z/AJFVntNucj349K7OSy447HoartaNnb0z3qnin3D2CRxj 25GQR71UltQDyK7OSzAOGHOSeneqE1lnBIqfrXW5tGnocg1vuOeDVOe3BGXHGf1rsHsht5B+v1rP lsdwyMgDBz61KxWu4+RHIyQDtxVaS2G35RkA5yK6x7LK5K8fTOc1WktNgKBR9AKHii+S2pyLwEjY c4+lVZIecY/OutNnhd2MgD0qm1kCflxjqcU1iblqknozk5IiWwvbrVV7cnjtXXPZgfKnGeCaqSWb jGPz46Z+lQ8V2K9ijkHhKk4Ht+dVJbYuu5un5da6yW1K4zwP88VTa3z83GO1JYm+qKjRZyb27sTj gjtVR7R1OW/Mf5Fdc1rkZbtwTVJ7VmyRwP1z7Gplii5UdrHKvajtx6mqstuccY9OldRJavu9ASaq myDYz1xnNNYnzNUk0co9uAcjPpUMtmWzjAJHHFdU9kW6dOuKg+yKQe/J61MsSVGinoco9pltmDgY pslmPvYwTwT6V1DWZD5A6449aR7RgoIHU8Y6VH1h3RrGilc5NrNAefbOf61Etgq84weTzxXWGz45 7Hk44pWsyx4BBJyOBR7fo2Co31OUWxQHcwqJ7P8AhYDqevpXWrYKxKnPTB/CmSWbEBQPbFL2+trl OlocvJYg42gDjI4pq6eCNoHJHPfP511i2ZydwH+fwqWOyDfKe44pSxNtLnRGicE+mEdBwD0A6CkG m5HzdePpXcPZrkHufw/CoVstuOxxxjjNU8XfqSsPqcZJZLjnAPf0qutoIl+71PUHpXdHTScyHA78 dOlQmz9R9eOOKFiVsaunqcT/AGduZuO4PPGah/s+Uycd/mOfy61262gycgYAHynpzTfsqhznkY/i 7Y9Kf1kr2SZxL2cqIWXGAAM/of8A9VVzp5RTx2yP+BV3E1ijKF28/wC1nGP8ahNiyDJ5yBgkelTL EKwexs77nCNp7bsjjAGAOPbuKhezYtgryV6KMHiu1ezKfIo4HC56ioPshTCY6g9D2PWrlX6jdBWO K+ycFec8n/8AV/8AqpHtsqDt57nv+Vde1opbaME5JI4Ax+VVvsOSp4GeRnt6ZrJ4juw9m+xyq2kg OMdySfrUJsyCTgDnIPpXV/Y1IZl9fpmoJbYdOcY5BPbIqlWLp0NDmZLXcuDjOASfT/GqzWe1Q3tj nvn/AOvXTi3VwV54OPeq0lvhiijPGfel7fW1y/Zvqc41koOQTn3pj2g28jPPeuie2wh68djUK25Y ZH1zSeIVrlciOZlsRGzIy4OOc56f/XFV/ske7cwJ4yc+9dQbQH72PXHY1Te32OAevsP/ANVUq/dk zp21Oe+yLyzcAnp+PWq0lsCAF78YI7107W21efvHg4x9KgNk5+VOhHcdBUPEK+5r7J9Dl3sSylQD 2HNVTZuVwBkjPT/9Vdf/AGexIB47gd/pXH+KfFPh/wAGaidJ1+dYLvy1kFsQWfbIAyZxnGVIIzzg 1y4nOaNFXq1FH1dj06GWVKvwQbtvZXLt74e1PSVh/tKB4TcwLdQbgPnhfO1xz0ODjOKwntCGO4f4 8j2rJtPiZ4J1HWf397LGbplMk0tvKyQiKIKq7Y1ZuVQAYBJJ7V3M0JeIXfluuJxbSI23dHKUD+Ww zkOEOSvUV87lvHWBqzVCriYe0fRS7uysnvfTbr6o+lzLgbGRpSxeGwtT2K+043tZJu7Ssu6bS09G cwbdsfNkY6cev1qCSF93IHXrXTyW4VdqjGGyR/n2rMaDKg+mMH19q+wp4i9z4yVKzsjDa2wMH168 VVNsAucHAx2/ziuleHAL+vTH+RVCRD0PTqMVSxLtuKWHsjFMO0lW59setQGPHy4+vFaxiLtvX196 jePJG0dGAJqniSVG5kSQYO89ehqAxAjA9ev8622g3r2B6cf41Sa32DJOMeo4/Wj6zoVKnbYyHiO7 Hp3I5prwjg4z6HHNarxblyDk9+abJDtX8PqKPrOwKg9zCkjAbbjjjoKZJb8fNjjqfStF4yzke3bp SNb5UkZ45XNDxHmRGle6MQR7VJT15J5/SqciYOGxk9d3pXQG3Ab5sepHYYqrLEFJJHYkc1rHFK5o 6Ttcx3QFsAEdfyqtKgKkdh/npWs6L5e719KrSRZH45yT6YojiVe5LpsyHth1H6+tVvJYPg4Hpkc1 rsM5brz0+tVypXIbBIwMHPWn9a0ZmqN3Yy3j2jA3A4A6d/x6VG8ShCxBOeTitJ7cnBHqOAccGmeX IG3nB7ZNS691ubOkzKkTyzjGcnP/ANeoCACpJzhvz961jCpX5gOOn/6qqtCTndx2xQq+u5LotFGW M78H35ql5RUnB5I7dOOO3+NacgUDMmCBnp6VVY7eEwM8cfrWsazsZygjPli7tx64Paqrqyt0I55J 6VryDzOo5PHP6VVZVBO0H6dRzTjXbJcNbozJYlOE6fT2qIIUPJPtitNgo6dVHX+VU0VnbHOe+O1N Vt2DetjPVGBbIGcdfak2n/Z/z+FXZUJG1+QD1zj/AAqv5a+/+fxrOWIuxqJ//9P+1J7Tn5eDjnNR /ZmznPb6V0BizwQPxqPyTkY/X2ruhj+h+ff2d0sYBt2xyefam+ScHOPTNdAIgMkgDHSovKByAOnP Sq+vjWW66o542/tx/Ko2tRtxjJHauiMOe3vStbZ5A461qswZX9l32OWNpnPaoWtGz0/IV1QgI46D 1AqBrbPP+TWqzJrqQ8rdjlTaN0/HmontnGQfzrqmtwenXqaYbPjpk9v84rRZiZ/2W29EckYD2Bqu 1sewFdg1kD0Hf/PSo2seg9Rz3raOaMHlb7HHta7gBj6kVXktGBJxnmuybTzklu/IqI2BPrjjFarN NSf7MaWqOP8AshB6Z4/CoDbjdgDjFdo1gVODk9+Kb/Zvy574xnHFaLNhrK30RxH2TPQY57UxrMrn 27H3rs2008jjj2/pTW00NnIIz14zWv8AaiF/Zjb2OFNoxOPft2prWTE7dvqOvWu4OmgDBGD7VWbT TngH/P41rHNV3B5a0cM1kCxxuz34pjaa+3Cj8MccV2509sZX8qU6WxGCR9M81t/a3mTHLn2PPRYZ zke3HHNR/YNzf/X7V3kmm7H56+pHaj+zWb5QDwOMdP8AOK3Wb21uR/Zz2Z569ic/LgD0/wAOtR/Y T6e1eiDSAAdy8jjHrTP7Iy28A9ue9Us68zb+zHvY82+xHOMHnp9KjezcfKB9MV6I+lgfMQfQnFQv pa/eA9jkYArdZwtDP+zNdjzdrF9vQ8nNJ9hZeo+o716P/ZmWJUZ4zkdzUEujuh3EYHqM96r+2E+p qssluedtYZ+6O+earNpzhuOM9PavRjpcjHCrjjn2/lUMmmsDtC89O9Ws2W1yllZ502mvnnnuMVXe xIPA/H/A16O2nPnAU+hwOKil0iUEgDpj360f2vY1WU+R5u9iG/Kq5sDkjBx6+lejjSWOfkI9x6/W oW0ph2PPPTNDzfWxays86bTQF5xgVXfTih6Y5GOOK9EOmu2R39MVXfTJASCO2T2FXHN+hcsvstjz ySxG3OBmq8tiSMnnHH1r0X+zZCQu0Y7iqx0wE8rj0471os2Q3gH2PPPsXy4UAZHIpn9nnG3bxn+f 9a78afjgDnHemPp/y52gelX/AGoi1gPwPPGsCueO/SoWsj0wfWvQJNL/ALi9eoPTFQtYFRux/wDW FV/aaauX9S0PPm0/uRyTTJtNwPlA9vrXetYBhgjkUz7CeMjjJxWizRX3D6l0scCumH+DH/AqGsFb pgV3TWOD8w4P1qNrEFdh5zwAR61Ucy7sn6rbZH85v/BX74CeN/i98SvDX/CA6fqeq31h4UuZEsdO sWuwyG9AkeSQELEEXkbgdx4FfjB8Xv2DPjJ4a0fw6vxH8T+E/Ceo6tPvstK8Qa7aWNybQRIVkIL7 U8wlsByoG2v3v/4KxfHXxF+z58XPCeueFNN0u41Cbwtd+RfagJZWtSl0PmjhWRYmJ9XR8Y4r+dL4 5/HDxpouoeEviD8S9O0vxd5Fw15HpPiHZc2ksb4kAkiidZEUtjgspwTjFfy9xziM+q57iY4aUI0f s3V5yfJsldJJPXXV3eyP3/g+GUQyug6ql7T7VvhS53q7at27fmftv/wSO/Zd8Sfs/wD7Q/jzUbuP fo/iDwrp95ot2+rabq80qC5cSGSbTJHi5IJBIUkY471+/wBNZKCcDAIGP8a/ne/4Ie3C+J/2iviR 46i8P6H4ah8ReCtG1q20zw61w1kqTXc6HYLp5HjYNGQy7tvHy8Gv6WJbDLE446V+4+F2OrxyPDLF T5p2d3trfbeW2ztJ3ab8j8u8RKFJ5rWdCNo6W+7fZb77Hnj2S5weO9Z1xp5Ldcfj/wDWr0Q6aGy2 D6DFUpNOIyR+tfoX1+z0Z8O8LdannE1gp+8O2fTmqL6eCc4GAPzr0abTyDwPrVF9OUAqo4PT+tbR zG3Uf1I8/ey9BzmqkliTwRnIxnpXetp2AevB/Oqklkeigj8P61f15dGL6q0cFLYBCAw/LvVaWxQr jAGM9v8A639a757FlI3DpVU2bN16eh9auOOuKOFv0PO5LAgbhwB+dVpLR8HjHGea9Cew3IflBxxz 1qnJZdiCOgz3rdZgCwujPPpLKQElOR3qnPasv3hxXftZryg9TVR9OyPm6/4fWrWPXUzeFfY8/ezY r8vp1NV5bMqOR+Fd5Lp7E44HOBiqc2nr3BJyetKWPXcpYQ8/fT13FVHAzVFrFVydvt9fzrvZNPx8 y+tVm08EfvBzjitHj9Nw+qXexwDWZLZ646mqU1q3UZH+Fd7Jp4ViPwI/zmqkmnk8e+ORT+vLuNUJ XtY4CW2XtxzVOSzLD5ASM446V30tg3RsHA6f/WqjLYkY/nTeLRbwr10ODktgF5B9qpGCMgtjjJPz DNd3Np5fI6nPSs9tPYk/L35prGK24/Y7aHEta5PA+tUHtgMgAn6V3p09wSUAz0/+tVN7R8E4+n/6 6r66tkzX2GljhHt2+7sznnNUXs3AAPOf6fhXoMtiMB8exrNayPOQfl5JPeoeLGqGljh/sZfgde1U 2sfmxtIruDZ85A5qrJY9WGfcdKhYy2zKjQ6nDS2Tg/LyB34qq1m23JAxXbSWRyQB39/8KibTz6Z/ Hg5oeMXc09kcHLbBSDjt6c1W+wkZ3Y5BruzZOQAR2qo1kA+QMkHNQ8d0RXsNbtHCf2a4UHuMVC9l sJHqc8V3rWbKgYjr1yPX+tVjZcdBz3NNY8t0LbHEGz+XfycHpUqWY2nPJ9K6/wCwoG4Gee9P/s7a wZQevFEsau4o0HuccdPBxk9uhFSi0OD37j/P511D2eH2qD6ZpfsLDA24Hr/n+VTLErTU1VOxyKac MbR1xn/Gq8mnFsbR+PUHHSu2a0EfqR2P/wBaovsoYHAAOTzSjjeoexTOS+w7VGRwOw4JxTDZk8YP U4zzXWGyJXge/wCtMNqAQpxg9SP0qpYpXLcbaWONFhtOCPU8mmGxI6Y9R612bWnAOAD2zVc2YIz3 H40LFJ9SlQtojlGsXIKrgjOfSqgsdnP1zn+ddk1r8vH+f51ELPDYx34zT+teZp7BnGtZlFzjjHWo ntWI38+nP9a6+W1G/wCUHHfPamPaqvzdz0JpPGd2HsL3T6HIC2HQ59j7VHJb4yvUeprq2tgoYnPo KqvbAHp3/P8AHt+dL62mUqVlZnMfZSRvAHHPHeqrW+87SBnn1/8A1V1UluSMIB054/rVI279scdP 8+1WsSn1KcNdjmvsmwZYeuMVSkt3PYcHGc+1dgbYtweuDgY6nH61W+y9tv49eaz+tI0+quyOPFmC xfgZ6+2Tx6VG1lEBz+P59K6qS2DOccL17YxWp4l8Mt4e1STSrqWKZ41V2aDJUM6htuWAOVzg8dfz qnjenf8Arc6aWAqOlKql7qaT9Xe332Z5vJZ5P7sDjBPAqlJbbV5xk9Qf8fwrr5LfjgAnOKrNbZXk c+v9aFi11MlT6HImBQNv8xx6U1rcBRjgZ/z/AJ/SukazUjC9M/8A6zUX2cFdgAP41LxiRsqCepzL QYbavUjnIqq1rnLDnnr7V0htFU85yeijqKjeBj05/T+tR9cCOHT3RzLWwUjGOelDWqqwD9CT0/8A rCtZoCO2RjkqfXpUTQlyCM5B6Gm8Tpubwo6Nn3T+z/4C+AXjHQG1P4i6fLus7kWqWlnqIsnmLRx5 keRkkkc7znapVVGcCt678NfsHaBrUWsT6B4chuYr2ZJU1e9kv2uG3bR5wZ1+6BwcDnFfjN8dfFcv h/xcIv7Z0jRkh0WS+ifU7GW8kuZgECwW4SOUI7cZZ9q+pr5i8NfHmSyu7jUdU1jUbFrnUEupBpFp FuicI/mTxEyRKGVztWIrsw5ORsAP+VXHfDecZjmeOlLG1ZQVSfLFzqWV5NWW6tbte22l9f8ASXhb OOHMJg8NVq4dxqShBS5OWC+Ba2Vt99V6O6P6P7r9pD9kjwHeQa94cXwjZXWlwmOObTtKjmAywVWk BRwzEdCTknnNflP+xF4r/ZK8beLPH/h39pg6PK3ibxJc3WgS6mfIcE3UzM1tJlTE3I6EEcD2r5gX 4x/s3614Eg8G+JT4ybWNTcQax4r1W+SS2s4zH5Z8nToIWaSOB33qPNDuox8p5H5ofFR7W0hgsrOQ z2/9o33k3Bj2u8azHY4BJK7hyVzxnBNZ8F+HTdOvhZTnSnJxtK2vu3aae716Ozt94cUeImDowhVw tDmgk+ZOXvO7tZtJ2Vm+klq13R/TN+0D8Cfhf8GTpCfC7VNR1LT9VtpbnGpXgvhDsfCrDLjcUKkc MWII618yywIFG/pydvavjr9gnVL/AFP4caxFe3U1zHBqiJbrKzN5amLlVDZwD6CvteaJSMe+R7Zr /Rrwtw+KwmRYXD4zEOtOKd5u937zte7b0Vlv0P4F4+xeFxWbYivgqHsoN6RVtNFfZJau70SOcktQ VyOevbPX8az5IOjDHXr/AIV1L24Tpgew56d6y5YlY9+mRjrn8OK/Qliru58a6T3OcZAX/A4xjio3 UAbjg5PWtyS1VCWjH4f5zVR4M/vOfQjtz/Wuj65HoTGg0royCgb64zz71XljAHzdT1HWtowYXdjo f0FV9jMecfL0xz+tT9b6lSo6GUqKq/Njv+dV3Gc46dK1Ghweg4/DI/z3pGtst83ryOlV9a1uy1F2 MLyud2OPSmlQTn/P5VpPBtb5Mj0qBrfHXJGfccfrV/WkYqly30MwpljjPAz+NUJEJOScn/P+NbMk bKCF+vPcVXMI2ncODnI/nThi7BOm7GE0Z2gLnIH51XlTaM4ByfTp7VrvHsJI6dAO/wBfwqs6MQfz /GtvrdyfZPlehlleitwOh7YqrJGoU55OeP61rSK2MYGO+f8AH61VePexB7inHEpk+zMtgWJ/lUEg JxtHbNacke488YBPH+NRGFfvYycH5fr6VbxKtc15NLGWVYHa3H6/4VBIcDA74+orTeDnceu7OKrP G4BcDp6kY4pKumZ8uljI25bB6npxwPwqCSIZ5/I/5/pWl5Py5xwehHtUDRDGWGCCOvfvxW31hGLo 31M8JnB5zgnI7VWKYOCO3Udfx5NajDPJz/s/n71A8Sq/J4xnJp/WLDlSSszO8nqOcDHFQlQF2ZyB /P8ACtB0C8bSOOg6/wCfWqzqDwME9Rz/AIVbr36hKikZpUl9+Prz1Pb/ADzT8v8A3D+f/wBapGVj kgE9gP8APWodkn9w/lSdS/UxVj//1P7fxEOaa0a9ce9aIjxxgY/p+VDRZO3Ax1BAr5KOa9ziWCZm GPHB9KRoAByD61pNAwOCB600xN93HPf61os28yvqbMw2wOMA0CA84zWksJb7o+v+FDW5zjH5VrHN rA8G+hlmJe+frmm+QoGMfStYQ5xx/kUvkHb05q1m/cTwfmYn2cE7j9cUhtw3UdCB/nFba256Y47k UogbHH/6q0Wboawb6mE1rgcAiozagjJ/Wuk+zNnnn1HvTRbDH45INaRzRF/U7nOC1Hvke/rQbTnr 0GTn0rphbDjIz9QMCkNqo6dT60/7VRLwT2OZNoST9eeMUwWGTg5x0GK6kWg25Ix6ilFmOwrRZnHq y/qnc5b7AMgc+5NIbJwcKMc56V1gs+owMH/P+eKX7N2x75z1rVZin1H9U8jk/sAb5qjOnZ4GP8K7 H7KvZfb1oW0JGRxkjjPpVrMV3H9Uv0OQ/syMptYfjTf7KiXOQfQ4967H7KOVbvz78U77Gg6Dn1zV rMOqYfU1vY4g6TvkywyO2aG0lAMADjmu2Nmg4A71GbNj1FaLMF3D6iuxxY0zJyw4A4qI6YhzjAHX jtXcGy+XnGcjr0pgsmXsB7f5zT/tJfzFfUdNjgm0hN2GHTvQdKHQKMEcfWu6Noe/P4//AFqabQjP y9evTmms0XcX1BdUcR/ZShCQPbI7VWbS0PJGPeu7az7dAO3SoXtABjaMetNZl5mn1PyOJbSkHOOn cDFRLpgHVQeenbB7125s1AJwKhezXB2jnpVLM/Mf1PyOMfTRgggDjnjt2qn/AGUqkgKD2ruDaY4O age1A455qlmXmV9VvocKdKVDu2nBJqvNpC9gcg8/Su5e1IyAfbnrVZrPAOM//q/CtVmPW5P1S26O HGkR5LjIJ689u9VpNIUggjGewru2sw2WI6jtVZrMjI69qpZi+4lhvI4ZtHhByBnp7cgVWfSI8EYP 976V3ZtWzjGBULWbdQOlWswa6ieHXY4KTSA4BUdBzUI0dSvQkdBjtXeNbNtAxzTBbY+Uge5rT+0Z dxPDLscG2hxMSWHB6HFU5NERhggntxx1r1SDTWn4A96jm0SQHdtz9BWSzpJ8rkNYO6ukeTHRAG6Z 5ycd6in0Vc8Agn/61erNpLwrll7c5HFZU1qvTrz3relm7lsyJYO2jR5p/Y+AAeSc4xioV0gtKqMp 2s6gsOoGa9ANhnr6VNb2WbiNRz+9XPT1Fd8cxfVmcsIrbH8Kn7cf7TH7Snxt+Plx4h+IvgKLV/Cn hfVrzwsmmeGLOd7i90+K7kZWecCdkdvL3MVC8AjGM1+J3xH12Lx7cxW6xXlvLHcuzaWbV4JHDE7H iUKSEWPapDEsWyRx0/Xf9vP4l/HTwjqV1NoN5NZQR+N70aHtWApiO7mVuJCy4UueHAGSSO5rwbwp +1F438H+Abvwh8XvD9zr19q+ooltcmaK1/s/T2iZQLeO3L26FpVkIAZDhSCApBr+ec64hzKjiJ4y lSjUcnayqWdk7XtKPLot7NPS2tkftWTZPgKlCOHqVJU1FXu4XWqvbR31fk97nhH7Dn7bXx+/YG8X +JvF3wQ8OWGrwaxbxadq0Wu2V1cRxLaOZAPMgaMxSKSd248DqBX9q/8AwTk/bs8I/wDBQD4OzeNN H0270zXNA+xaf4rtJIwlouo3ULSH7E3mSO8H7tsF8MOMg9a/js8Pftf/ABW8EeCNT074f6zfWFxr 0F/Fa6NDo2mvbyW16ZlnzeWs0d0siQ5w0qsxI7qBn+g//g2uHh7VPgb8Sbrw7bT2pTXtEiv1mcOj 3KWc4aSPuFfG4q3RicYGAP0ngrivMKtadLE0lGC2tJy6Xd04xtrouXmTd9dD43ivhzCQpqtRqNy6 3VuyVtZdHfWz6n9ActjGoxjGD2qjNYDHIPODnFepy6Ujc7R6is6fS1dSOmcY9gK/T1my7nwLwVzy 2TTwVwo5qjJpqBcN6+leoS6ZwcDHGDxWe+mHOSMVpDNNdyPqOt2eZjTFRirZ+tU20zbyc89cYr0x 9IQjp7j0qg+mMWwRgfzrojmvmZSwNkebS6dt+bnP+RVZ9OUN39q9Hm0lj247f/Xqo2mMUIQFj7it o5p5mf1J32PNH01wdoGOetU5NOKt8wxXo7abIx2lfY1Tn010YD73HTAroWbtaXD6lpsecyWY6YPb nH5VRl06QnO3JPtXpD2DY6bcZ6//AKqrnTnIz+VL+1WgWE7nmk2mqD8wx69O1VJNNIXoevavRbrT wDyCfcVQ/s5ScBen51ssyb3ZLwnQ86l0/bkbSTu/wqk2m5O8Dr0wMYr0mXTfL+YDvz0qk1gG5A7d qtZnroxfVeh5w+m7hhVPXFU20snPHHQetelnT2HbpVeSwz1XnHpTWaMccIeYTaaE9eBiqR07cMAf U16dNpgK5cEVSk0lsgj8+OlV/aeg/qnQ8xfSsg/KQcZrPk00g7iOpzz7V6dNpxDjeMnGMVRl01/v be3f1+tJZld6gsGeYvprEFGB5bP0qu2mgNsxx049eteiyabIQc5xnJyKryaSEXcelXPMioYRnm8u lgDc3PpVWbSUPbHX1r0ebTdnPPtWabJs4Ue/51CzK+paw1tLHnJ0tVbL8Dk88/jVSXS8Hkfn3r0i XTpAMbcDnms6TTGJIIHT8QKSzMf1bpY84n092OAOCetV307K7SOlejtpZ5z3Azx3rPfTju4GcD6c +lWsyKWEtqefNp+0AYOe4P51XbTjgsuMgmvQH04YLOBx1z2qu2m7cDGe56fzqlmC2H9W8jgzp7bc MP071XFhtkP+0cflXoDaaejDB7ewqvJpThvlHGfqeKP7RjfUp4Z3Rw7aac9Mc8fSomtCQCoz3Irv DpZHRenPFN/ssrJ90Zx0/wABR/acbDWFZwxseSGHfP5VG9gGO8jGOa7eTTBt5A9R0pkdgV6DPv3w P8/55qvr8bXB4Z7HFtYE4YqTxz9PSmT2BC4IwT6etdr9kIycZ9aga15zgc+tZ/2hqafVTh2sFICk jI/n3pgsfm+UDcOhA7Cuvay9B7dKgeybdk4Hcf8A1zT/ALRQo4bocm9rjkdO2ec1BJYiRgw4xwB0 rrWtMZDfdP4k1Ua0CLnoe1L+0exssKzlGsUUYx26DNVTZlWPp+v9K60wuVyFHJ4Jqm1s+4Bf85/G hY9rcv2BzM1mWGB1JwAaqSW+Fyv/AOuuse0B4OP8ag+zlhj+dUsw0uW8Prsci1tgY5J9arSW2eG6 f0rqHtWVthBweM44qB7SMnLc+hqnj13H9SbWhzjWoIzIP/1/rUH2RUJPJz2610jQYbacnj8qrvbA Db2PT2rL6/2ZqsIc2YVRhtHT1qBkZiWxjHGf5VvNasefcg4qGWB1yp/H61axyvYSp2OZltwyt1GR g547f4V6L8aLMxfEzVUTyyokT/VZ2j92uAM81wGsavoWh2/2/wAQ3tpYwFgnnXkyQpk9BucqMnsK y9N+JXhz4l3Umr6NqenX08uJpo7K5jnZQDtywViwBxjJFevTxP8Asc5f3o/ipHrUOX6lVjfVzhp8 p/5leW3IxxVKSLnHIzzXUyQMzHsO/wBaz5bbLH16/UV5315dzypYfyOde3OMEnPr/Sq32cKd3U9M V0TWhzkHGOCKrNbHA6VP19dGVDCs594VDY69AQKjeAfQflzW89qWbA6/zqS+0a9sti3Q2+ZEkye6 OMg8fjWM8wimo31ZosJJtu2iONeBScfkRUf2QiPeBzkZH863vs7n7wz8vWojH8hUDnHYCtPrvYcK DWsj5q/aE/Y5+NHx18RWHiD4aW1hf2lvEmn3c8t/b2sdtNMsbxrIZ3QnIBztBAIwTyK3NK/4Ia/t hX2jXWp3UnhyCaBC62aXktxJK7p56xr5UJXcYxu+90qj8Yvjd8dPh5rV74S+FPi/VPDlpeafDfXV jprSo9/cQvGI1UxAurqCWzkAjIyelcZ4D8Sft6/HXxcLfwj4g8d69rTzGRLdpbieaSYx8uEuG2fu 0UqWboOO+K/zszzMM0hi8QljIRjzysuXXWTtdu66raPlq1c/t1UKNWFGVPD2XJC+re0I3e6873fp bY9An/4JAaxN4EuPEUPjjS7zWbOxOq3/AIftbOSJ4LUYaVnmu5LdSIwMZA5Jr8ZfjPY+GbzSY9P0 awe1uItYvWiMtwZMQB9nlYxgtuBYvn2xxX7Fab+zD+2D438BeIfiPr174l0vRNP1wL4l1S6uhbQW t4zgCSS1hbz5WywZfLjOADjnivxe+MGn3cMFvGxJeO8vt7DIJxMRk555616fh5WxtSvH69ivaNO6 aVlb3k7WST1TXXbocnEdelRwWIp4elGz0d0nJaqyu7taO+lr3V72R9u/sBWj2vw313cpDf2wnfqB Fz/+uvulo9y7QGz1zXxl+wBFNcfDPWWuWLn+2VAJzniEetfb08BQ4UYzwM/pX9z8LYv/AGCiutv1 Z/H2a0f9pq22uYDcvtbJOf51VnXBG7NbJjKHLDnOQewqhNDnI54+6a+iWM6NnnPDaGQcHIXPQ/hV Zl9s854rTZSp3juOn4ZrPkVQuFyecgHFaLFg6FloUmUkkjkdeOuR7VAU3N0A74z0q+6A9F6DHtmo VjJIHAOO3Oa0WL0I+qX0KJi3EY7jAqExMG3HkE8AelankgMBjP8AFz0x3o8sAHjtketL641oCo6W Ziyw7z8vf04/z+VMaNjgHJ5+U+tapjw57eg9artFlwSO/X0rRYy5LpGRLGCnIwR0Haqn2Ugttz0+ Yn19q25VIAPOMHNQ3VtDB5ckc0UpkTLJFndEckbH4GG78Zp/XLaX3LpYF+9Lsc48YbO3n1wPeqU0 fODz+vFbsihSQcjPY/561RkiVm3Dkk8+lbRxXQxnDdMx5lBXvzjOPbpUCwghmP1z/n2rUKBsqv14 7Y/z6VDPEypkZ4H+R6VTxXQn2SbMOReSGbB/WoypH3gemavvG2TuBOSQTmoTGdpOOnQ+tbuu7CVG 72Ml8sNpz159qgmRgdr4yR1+taRQHBfpk8ZqKWMZyMgdvYCnHEEKhdXZkyRny+fb7vP86YwXGG/z 6mtBhuPrxyOuDVZ0JyvTGcetbRxF9yfYmay7W+XJ7jPtUEgGMkd8k+1XWSRDkDPYVA6llGRye3bi qVbuzFUrOzKW7J7en1qtJx0C4HZauFDsIX2yR6Ypnlrn6n0/z+FEcRZlOlfczZ0+cA8ZODTPsy/3 j+n+NWp13PyO+Kj8of3R/n8K6Y4lWM3TSbP/1f7oxF/F37UeWT1474rVEQJyo5pxiHRh1r8OWOl3 PpPqke5jmHedvUU9YOcYGcHFayxADIGKUQgAj+larGsn6tDuY/2Y54HIqQWuR6dsfWtfywemaBGe me9aLGS7h9Xh3McWxbnHsPT8qcLXAxj8a2fLwPrS+WBW8ca0Q6MDIFoOBjp6dKkEIJyRjHStUKAK QJ8uKtY2W9w9lEzFtsHKg/j/APXpVt1wGx2/nWmVGf6UmytI43uJUY9SgLcHhsfXFH2fIz+HSr5X BoCg8/nWjxpXsI7lEwewP1FN8ojovXrWgSO3+NNOAPWqWOQfVolIwkj0pBC3SrvFBp/2hEpUIlIx sRyvHWjySOq+3FWyQOtMLDNXHMF3BYdFYQjIyDmmfZ+fqatlvT9aaTkU3mPmXHDormEgdM96jaEr 2B54PerZ5OajfoeKbzPzLWGSKhjXGTxTDHirTHBK4x/OoWBBxSeY9LmscNErGM4pmzrWlb7RJtfB VwUJ+tU2OCQevTmqeY3W4LDRvYptEccnj3H/ANeo/KyCBgev+TVwgE5qMhWPIyQe/eksxt1NY4Vd CiYsnAI+tRPGB0xVwpgnFMIz/Din/afmUsCUTHx9KhMQ6kfQ1oNHgZA7d6jK9TWizS63EsAuiM4w r0wBUDwAdM/n1rVKZOOKiaPjitVmr/mJeB8jKaAg9KqyW+STx6Eitoxj1ppTsP5da3jmzXUzeB8j Aa3BwSPQH/GmGFc4HIraMRB7fTFQmM9SB+VaLNm9WyJYBGI1sCcDP4U9LQFsgdcdOK09oyNoqQD6 fj14pzzeaWjD6iuxoaRo8lxMqIvvgDtXpsfhKw8v5/vEenevl34oeNvGnhaw021+HzQrq17qluiL cFVRrRG3XQy/G7y/ujqTwOa988GePpte+H2neJrxU+136MkUKcB5QXAHsDsJr4bBcc5bVzXFZZi1 Jzo0/aNpe6l7vu6Pmc3zK0ba3010OvGZFiqeEp4unZRlLl8766+mj17plLxN4bS2A8rlduckfpXl tzp+xizj6Vxuj/Hn4gL51r8UNOsrKxl1O3srHUoH8wzm7B8qNUUcMrAB84xnvXpk+SxVxz069KXA niJg83pTxOXOSgna01aSuk7PWS2as03dHRmvDlfCtQxVm31Tun8zkWtQG2gY5ogtlF3GRwPMXr9a 3JE3HaV5z7U2GACePPTeuT171+lwzpnh1Mv7H8F37Zvwj8cavfXeq6Z4d1V5I/iLeTWVzdxreQTI 88sipDaSbI5yXUt5T4SQcMwFfjf4++HuueEfG+p+I9Y0TV4tHvv30E9zo/8AZVr50hOVjtUaWKNE k3Kqo+MDjHSv2t/bK8BGDx/PrfjCbSrJ7zxyZtEXWLiGbT5ZFnm2NOGYp9nMgUOG3DkqeRivjzxh 8L/2hD4j1Sxvte0bwx4H8ZKjWpm8V6NqltN8ot3e3uPMiL2iOjDZGq7F+TduBJ/A6nFcsPinz16f LJS3bV/eu1F3k5SWrtFW0adrq37pgOHIVMMmqU7q1rWf2dHJWiknotXfVWbPmefRrmw+BA8Qf8Iz Dqtzeu1lp8s2kW0YtxZeZcXjLJATNL5cDIxkcqVBI6Lz/UT/AMG3GqaBr3wI+I8+haZpOmeVr+iQ XS6St0sc0ws5yXlW6kkxJnhvLKxnqBX4F+BPhX40+Hfwo1bx/wCB/FXhlnvI5fDNwbvWtP022tzb vJJJOIriQvqcgjkaSJIQHX5SPMDbK/o//wCDfPwVf+EPhH8SbbVH0w3Nxr+jzTxaUjrEjfZJ1Dsz jDtcAfaNyEoBJtGMbR9jwJxFRqYytGM0/elZptdNU4dLaJPq7v7Sv4fGmSVIYGLV9FG6aWmulpbu /borK+jt+9klsCM9Kz2hw2GGPpXUyQ7h+FUWiHQ/mRX7Gs0jvc/HfqT7HNy2+evr1rPe2yPlGOtd NLD3Hb2qt5BFbQzGL6hLBu5zRgkI4B4PSqMlsvpXWPbkH5awNfu10zTJb9uRHjlevJrZZlFdTP6m 2Zj2yE/dwM81WezQcgHHXHrXTBFkAYYxjJz1rlPC95Jq2iLeSgEtJIuVOQQrmtP7TWiuEcE2myvL ZLjp074x/KqD2mQAPp+OK69omPGKqPboBnaDnrVxzC27JeEZx8ll/FgD8KqtZptxjOB+FdfLBkZO Mj8OlU5LcAYx9PxroWYESwvU42Wwj6gc+naqEmnbm3L3HORXava7WqtJbIWyRj2HSrWYva5m8I7b HFNYggkj8v6VUbS0AJwOuRmu3e2jP3v/AKwqnJaKDhfz9av+0PMX1buji20sFcEc+3rUH9mAgBhj txXeJabm29/SsnXLvQvDdq1/4gvrOwt1+9NezJBGuAScs7ADAHrQ81SV5OxawnY4yTTNpxjggnOK z5dO+XIrxbV/25f2KNG1OXR9Z+K3gG2mgkeOVJtXtyFaPGQSpYfl9K3/AAp+1F+zH8QmiXwN8QvB eqPNkRRWer2jyOR6J5gbj6VMM8puXLGV2jWplc4QVScWk76+lr/mvvO/bSguTgnt71Sl03qGHOMd P/113sMdrdwrdWckc0bjKyQkMrD1DDg1Xe2ydoP0JrRZk+plHCp7Hnsmlsyk4/HHes2TTGB4DfTp Xo72nYdh2rMuLQdVx7k/5FWs06FfVkefyaY5XJB9vWqDacc/KvWu9khXf5YI3dcD271Ue3zzjJ+v aoWZt7lrCI89fTn6KD9O+KonTmOVx0579K9CksieQMZ75qk9mwbFUsz6XD6mefS6Yy5OM8Zqi1jv y23Pp6V6BJbYOGHbpiqTWyYIUHH+fzrT+0tLEvC9zgn08schTjpUH9myNnaCa782y7jlaqG1AORj HX1zVwzRj+pK5wbWMi9AcdDnpioGszv+T6iu8ezBPt6VEbInpt9vWtVmF9yvqRw4sjwMcgc8dayt avNL8PafNrGuXMNnaQLvmubl1jiRemWZsADJxXoxtSDjj/H9K+Xv2zbHzf2bPE0SoGYwW4VevPnx /wCFL+0dUrlRwd9LHoWgeKfB/ivQV8ReH9Usb2xYzqlzbyiRGa3GZFUrkkrXgX7QX7Tfgf8AZ7Gl nxBY6lqB1bcYlsY1TYFlWIk+cUzktkAZ49K+U/2Z/wBsjwT8FfhRYfDPXbRpLi1l1Oe5jit4pZCL s/uyCzjIycHjivlz/goR+0NY/H/RY9b8MW97af2HY3Bt2mRI2DyzrIrKEJHGB1Pavho5/nUsfUjO ko0Yuett0k+V3v3se9DKsG6Uffbm7afdc/eN7E5MeO+P85qrJaIIyqrx0Bx2r5Y/4J+/ELx38WP2 WtD8b/EjULjU9XuLq9invboKJXSKTam7bwcDv3r7Je3VeO2BX2lLNVOKmnueT9RcW0+mhxsloFXH J/Gq7WuFztPPJzXWvCp6cY71QeHPOav+079RvCJbI5l4fmO0dR0x61VeFSMFeO9dJJArHk5x3Aqi 8SgZJ+uenH5U1mGujK+qXOca3UHaR+GT3qB4EOTjvwM8fTpXSPAh5Az71VeAEZPy981o8y0H9TOe a3UgkL04HeqTwF+gxjn610LQguSx9cfy71ReIHgHn+eKlZiaexXUwPL59cduuM1Xmt9wPAPH6+1b 0kKsDtz17e9VWjOeMVf9o3e4QwiehiNCQowM9sYqk8JHAGCfzxXQPGGOc1TkjByAD+VH1/l3KlhN DGaMsSo68fX9K4X4gP4ytPDl3f8AgxNPe5tLS4vJjqLMI1ihQElQuNzE4wM4r03ylxjOM9P51heI 1gj8Na6Zt23/AIR3UMhTyfkQVz43G/upcsrem5rhsPyzi+VP12+Z/MR+0T+1L8WvjPYzeA/HU9i2 mQXwnjjtbZIX3x5C5cHOBnvXvn/BLKaysPjPrujsGD3fhnzIMZI/dTxs+ewwDx61826enj74da1f fHTwdpKzaTaarPop1PVbGDUNPW7uYiRC0dwrxmTYdy/KSowQQcV9F/8ABMySW7/aVvrqRQHbwveO +AFGWmgzgDAA9BjivCyrOKlWs0p80Y2V+a75tbxcbaWVnvd32XX3czyylRpWjG0pN6ctla6s0763 d+iStuz94ZLcE4fPI6en8qzpoD93kHI7V00keMnr7VnzRjO49fQ19YsefPzwnY56SAZHof1qv5KD KgdeM5qXUlkXUdPSPgGaQMPUeS5/nV6SHLCNASD19iPeksxTbiug5YJpJ9y/4P8ACupeLvElj4b0 eJprq+vI7WGJASS0jADj0HU+lfV37W3gn4c6LoPhDxN8OdVj1WwfTY/DtzeQwNDE17ZKWBG45PnK WZTjBC8E15vYQyfDr9nPxJ8StKkmsvF+twXXhvwZJMmwW3mxFLi+XO1vulkR1zg88Vxmiax4Y1H4 cn4HfEvWr60tm0G0066vJJjtsbu2RF068t0dE8nyHRCW3nehYHg4P8yce+MdbCZvha+Hpc9ClOUJ PW72U3G2lo3SW92n5M/UeHeCPbYKtGpU5ZtJ2++19L6+VutzxaVVAIA5J6981RMS7iSvbHHHT0ri vhz4k8Tao2s+DvHltHa+I/CmrzeH9cjjO5JJoFVkuI+n7ueJ1kX2bivQHXbhiOlf0ngs4pV6MK9K V4ySafdPVH5rPByhNwqKzi7P5Hz9r/xp1z4R/FubVvDfgnwr4pvYbCK6/tDxJDcT/wBmJCy7pI0i njQg87tyueOK9R+NX/BRr4k618M/D+oy6/4a8LXuqahqFzj4faBBaX9pHYPLbh5Lnz1mHnNtKowX KOWOduD+cn7cupNqnxPtGu9rGLSvs6mNAvyoVAyBgZ9z1r448tVuJFjXtITn0AXviv4szDhWnisV UxE58t5ybS1uk5KzburXd9EtrdT+vpZhClCnSprnSjFJvp7sdUunbd9z9CL79pLWbf4TaTpfgHx5 rum6lZ3moXeraXcStBHPdaq6yN9m8qSYy7DH8zyiMrldoHNfn58ZPBfiPSNKi1jWo42SLVb2yuGF xG7tcs3msPlYscg5LDIzxnPFQSxl3l54EkhyD2yOKpfEO1I0iwIBwJbsdO3mmvZyDKIYLEQ9jLST bd0r63drq3d733OTH43DVMFiPrFJuVlytSst92nF36bNfjc+5/2D4pH+G+sSBcB9XUqDgDiEZI9B nt1r7bkjG/cce4Hr/n/Jr4w/YOiaH4baurLjOsZye48pelfa8y/NwMn+f0r+suG8Xy4GlFdv1P5W zKgvrNWS7szpNJv7nT59SSM/Z7d445puNqNJkIufU4OPXmuUuruy8rz0mjKBiC6kEZHUHHtXqXw6 8F63r3xb8B+KbrSr2fwxZ62+raldzQ+XaS2tn88pQ3BSOfbsYbV3dx3r9FfD/wC0Z8cPib4Vm1v4 GeA/h1oWp6msunTafZQWH2S30MDyo7o7ZHePUWIkwjxriPb1GK8jE+JOWUoTf16k3FyTXtI3i17O ya5r3k3UW28Ldz7fL/D6dahCpOM4Np7rd67abWt8+uqt+Od3r2lwNf8AmyZOlp5upKqMWtk3BMyA AlfmIHPc1Uh1Rb/W7HQLCC6kvNUsf7TsIREyGa08tpfNUsANpRGIOR0r6z+KvwF8RvqfxH8WLZW6 j4kar/wj/hyw3XZvLCe2uIJpGmVLVopDgeWyLLkMea9d0/8AY8+LHhXUvC/xx8WeHdO0zSfC3g6P wbeW15LFK17/AKHNbTXqxvNBI0qpMZFgC7jsC5yc173/ABFPhKlJSq5heKkr8qbvH2k07Wi96ag1 /eb30S9Sj4a4VT5akpb+Sv71u3a7Py+Xx5p1xpen6xawXT22p6i+m2km1ATMmzO5S24L+8XnHNaG vfE/wL4N8cXPwl8VmbTtd0+9vLe7vruaAaYy2p2bI3BD+YzA7c8NwB1r9mfCX/BP34GReB/Cfw0/ t/XtSn8O3k3jJL7TNKgAubi5eMraSzJJcqGUQgiP3YFs4FfPnxc/4Jxfs+fH/wAa6r8SPipY/FHw rc6vpM/iT+0LmyMunvfXNygaJo7OxlmiUZO0cgfLlsnFfnGe/SC4dlhoLBVp8/uNu2n8L31rZWdR 3S3Wivo7+tR8PMNShaFPnlLlWrltf3re67PRWdnpc/NHUPi78L9L+bUtd0uEA7DunTgn1xmu/sL+ x1WzS/0yaOeCZN0UsLB42B/iVgTkV/PV4i0BX8U6lost3FDHFdzRRT3bOMiNyq/KFLEsAMccnvX7 cfBjTtU+H/wp0Pwlr9pcfb7KyjhuIYFEiB+uFkU7GGCOQce9fa5Zx7RqT5MTOMLq6u7du713/Luf llfg/GWcqVGU4p2bSbs9bbbXs7X3s+zPaFhHAYcjP/1s1CYPNXdggnjNYl/r90l6bHSNMvNQGARN G0USMSMkASN5nBODleo4yKp2fjq0DxWOt2kdjO11GsjNqEUnlw/x/uVQM8mfujcBXTiPEjKaUbvE p+ju/u3NsH4f5pVq+y+rta2vLRX/AMT0+d7edjsdXkS6uWmt4IbZCcLDBu8tcAZxuZm5PJzmuYtp ra6acQjBhmaGQ4xlxjJ96474XeK/FHxv02+1vwJfeBbSO11N7Q2evanew3qwqTm6mjt7OVIkLEKA ZMknjpWz4X8VW3iubUpo7DTtPa1vntJ49LvXvreSaH5ZJkkkSNwJCNwUqNucVhk3iHluKxkctw1X nqRXvLX3bLrezd/K/n0KzDhXEww1XH4hKMXLT+9du7jyrlstOq3VluX5Iv3m0jJOQSeOPpWfLENx xgZPat+cdcjoOv8A+us+SBS+eSMZYV+iwxZ8TUwquYrQEEsuc8ZAxyKgkUkbenJxmtaVWxuJ4PA7 VSkQn51I4/rWixae7HLDLXQyJEc5GffiqRXA9cDkY/zitVhg7TzjrVORE285zk5x/kVvHFmUaSXQ yyrnGOx65qGRMEoTkAEdfzrSlIT5jkdsdeDVGRV/hzz82ew79/WrWIu9DKVCztcpbBuOBj1GeRj8 6qtlmIHHc1fdEckcc+nTHqTxVPaY1zkj/ZI/ya0hiuplNdiqUU5JBOfU9M1VZmwccDpz1JqzIdx2 dOe/6CqrMpBHA5zjHT3rSnXMWuxXTBXnqOSR0Hb86rSFg21S2MZ7Zq7I6OeAfXB71WLKCG9+ucDm tFiNbkKL3Ksibsq7c+vY59qr/Zl/vf5/Opps53Dp6elVvM/3v8/hWsal1uTOlqf/1v7yVjwOM89K d5bYzU5HHWkKn2r+fY1KZ7zqN9SEoe1J5eBU42nuOlHyDvVLEQQOT7kGzsKUp7fjUo9+navF/wBo T49fDj9mT4Pa78cvixdtZ6D4fszd3sqLvkclgkcUaj70kjlUQd2IqZ42nFXbHCMpNJbs9iwP8aCA T7etfkR4G/4Lnf8ABOTx3p9reQ+Lr+xmuLQXk1nfaVdiW1TGX87y0dQEPyswJXPevnf43/8ABxl+ wz8Mb1bHwLbeKPGQW7it5rzSbLyrUBn2sVedkZsLkghcHpkVgs5pX5Y3b7WZ7kOGMxb/AN3l62dv v2P3+xikJx1r8bf2bP8Agur+wR+0h42i+HNtrl54U1drF72RvGEKaXYr5YyyC7lk8ncTwo3ZbHFf YN1/wUZ/YNsvFF54LvvjB8PbfUtPlSC6guNatY1V5FDqqyM4R+CM7WOOhwa3+vq9rP8Ar1OGtlta lK1SDXy87fmfaNJkV594N+K/wv8AiN5v/CvPE3h/XvI2+d/Yuo2175e8ZXd5Ej4yOmetd6d4GSDj txip/tKPQ53TtuPJ44xzSdelReYeOaDKwHGKPr6KVMew4/nTSCOTVdnkbvj2pvzd2NCzGxoqZY3C mluP0zUGWHRqZu478elL+0F0KUCc8dSaacVWLnGQTTTLgE56DJJPFN4/uaKDLG8ZPoMknsMVh2Pi rwvqkzW2l6nptzIjFHjtrqGVlYcEEK5IPsRX8lX/AAcH/wDBRbR9c8Nw/sjfAbxv/Z9zBeyXPjQ2 yNFDerbx+ZFax36SAMqNgvGgIdioZgV2n+Hl/EHiyK/lv7HWJY5Hcyl0mmicknPJH+Ne9k+E+t03 UVTl7aP7+h1zyzEJRko6P7/zP9nkrMD9xvpg9/wqFwy8OCOvUevNf45ej/tF/tIeGcpoPj7xRZh0 8txZ69eQgrgjbhZRkYJGPc19H/CL/gpT/wAFDPg++n2vgH4reObax025glt9PfWprmyHlMCqNBM7 oY+MFMYI4r0J8O1UrqrH8SKeEquXK4M/1nzIoOFGajaY9QMe+a+Rv2Lv2ovB37V3wB0D4l6Br3hv WtWOlWK+K08L3YvLOx1eW3SW4t9wAKkM2djDK5welfWJbeME/l7V8XPMLNpm9XDSpzcJdP6/4buO LszZ/X6UtxKryF1/i5P1PWq7sqk5PPpUJkznFQ8z6IqFFXuTFyelMZwvWqxPPJP4d6Zuz1JIx+NT /anmbqCLBbcMA4z3pm5uDkZ/pVcnA4/rzUe5h0GKqOZX6mkaRacs2Pb0phbbyD2qsSc7ugpNx9Kr +0vMtUmTk917Uwtx9ahZgD6U1SWYIoJJ6Ac1SzHzLVPuTEqfb6Uw4qlqV5baTB9q1RhbxGRIhJN8 q75GCIuT3ZiAB3NSl2A5DDkj5gRyOtVHM2NUkyRgpGT29fWoWRWPY0rbwnmAHb/e7U0yDpnHNP8A tSQ1QTAoqjj1+pNQlCDk9c5OelLvGcZFN81eoIFNZrpuafVkfmT/AMFK/hP8QPijoPgweBb2305L O/1O3vby7ultYI5NRt47e03szKOZeNx4XrkV+Pur/sx/HTTNH1zwz4J+I+k69dQy20HhvULPxbbW sNvPy00CxGfbk4kywbgRsa/Vb/gqtE934J8LeW0afv8AVt7zOiIE+zx7s+YrKTjoMZr+Gv4p+IfC mqaLPe/DTxBqtjcfa3XUtLuZ2is7WZZWjE8b+e52OGf7yqFBwvDYH5ln/DdTNcw0q8qTj9hSXRq7 3Wq7tNXXU/VOE81hhMC0qSk0pbtp79FdLbt3vuj98f8AgnF4D/ab+NnxZ0LxDFr3iu+0fwr49/4n 9n/aBuNJ22KpI7FBKdzMwIDBSjLyG45/r5nG6RnHqTX+dp/wTA+J+uan+2d8KrPSrzV7a4/4Syy0 6Z21F7mJ9PjKbrbyvLUqjMztnftAbGO5/wBEyR9rtyPvHj8a+yyPA1csqVqc2rSaaSSVla3Tc+f4 rxNLFxw8qa0SavrdvS+/+S+ZUKAc8V8S/tm/t9/s+/sF6HoviL48S6uF124mh0q30a0F1LLJbKHk By6KmAepNfbjtk8V+RX/AAVItnmvfAtzBc21nLbSX86XEtlFf3CBTFzbrKjlGzj5lGe3TNevmHEv 1WhOvbm5el2vyUn9yZ85lvD6xeIhh+bl5uqs+l+rS+9o/kK/aY/bJbxn40k+JHwW0bxOIYfEg1Qt NZ+ZG1nudnj2KHUblY55AGCeuTX55t8f/iQusR3lq7xotrdWWlw3ej2v+j293O000cBeJuWZjl1G /kjIHFf0m+KviBaeFfBWlXWsanqF9pUV7d20t7aQR299KJ7W4EkavLEcSfOREUjypAwM4NeTfEn4 iTXfwR0f4ZfDXxDretJfeKkvNDs/iTazarqcMVonnLDbSxC1Vo5ZAxZXUknd8+cY/I5eJmHo140p 5Ypc2nM5Sasua937J2srvW2jav3/AGal4d4qrScqOMaS1slG/wBlbKfV2S6X18j+f3xHJ4u8XtY3 XxbtfGiR2/mQR3X9mu1vDaKpaFYEKxKW3lg+T93kEnNf0Lf8EXf+Cr/7Jv7Knw08QfC39oi98S6f q+o6vYJZakY7jVku7e2jkhhaRWfNp5aPHEsMYZNqggjpXntl4k/bT+IPhPTtR8EfEkWOv2l3f6dZ 22jA6fZTWdmszs91YwB1e7XMhMrZchljIOMnzfxTd/FXxJ4HX4n3z6P491WwtotD8Q3HirT7P7ZY 3lwIvLntUlsUdkjRZNoY/NuVtxZcj6fLfFim6kKUqVNNS5Uo1JLlcm0r3pJWk9Fd2btZXR5eZ+GF X2c+apNJrmu4RbklZ/z3ulq7JtXfQ/u6tpoL60hv7Y7op4knjPQlJFDKfbg1FJGM85B9DUXhlCvh XTF6Aaba8f8AbJa1ZFXuDx15r9bWceZ+LSy5IxZIs8evYVUeHJxz/UVrurZ3Z4ORVd0B/Hr61vDN 9bmby/TRGNJAF4Bz/P8ArXxz+2L+058Jf2bfAcdx8S724tptVdY9PtraFpZZhG48xhjChU75I9s1 9teWCwXBwTjJr+Tf9q34geKP2mviFq3w78e51ePwpqep/wBio91BCTZpduhTMSBy64HDsWKjjGDX g8TcbRwNDne706fPdo9zh3hGWPr+zTslq/8AgaPqfrV4c/4K6fsIatb3sHiLxjH4ZubGwhvUtvEk Rtnu45kcr9mEZlEhBj2sDjBI9a1/+Cdv7dvwT/bW8J69a/Cj+0IL3wtfKmpWWpRBJDFes7QTxlSV KMVZTzkMOmMV/Ln8c/h/4P0LTXis/BegeLCdOm0myupd6Nva2aWKcXJuIl2wYd1AOSRzuGRXI/sy eMfjL+zudM1X4LxJoNl471vRn8SXnhDWZ3ii0eGWFHtru1ullfG5pCJ0mGHkYAlVUDHI/EahiYU5 TVnJ2TvFK78nK6228rK70PRzTw4r0JTVN81tdnovVLXfy87I/vLaE8lunT9KqSw8YwPftXTXMKJO +wHaHOAPQHis94QMg9TzzX3Czjrc+LjlnSxzrQgZznPbrVZo+MLxXQyQkZ24qq8ef/1GtY5xdbkT yzyOdliJPH/6qqPDkHP5f4V0TRLjgYz/AJ9aqlEdwqcn+6OfYd/Wto5zbqQ8sMBrcZ9B7/5NQPCo O0dPpWqJ7OV/JjmjZ8A7AwZvm6fKMnmnPETlcZI7HrVxzi27Mo5andH4kf8ABaP/AIW/d/Df4ceG PgtZ+J9S1LVPGF1Bc6Z4Uubi2ubuCO1VtkhtyCUByeeB1r0n4g/te/sqW/7B2r/B68+D9y3iKz8O x+GNeh12a1iuLXV5bdE3yXczm7dzIwYlBnB5wK8K/wCC8Nz4n0/4U/DSLwZJdLqNz4vvLa0SzZkl kklt4lSNdpBO4kDHfNfzaar+07+0hpXiOy0+/wBZu9NvfDt5Nb27WdnbW11b3T4jn3yQxK8koxt+ dmIxgEV8HxFi82qYlvAVKai1qpX5rdbb6Pa6Save8rWf6Zw5k+CnhKbxEZ80XdOO2/Xbbezvfy3P lL44/BTXPCXxJm+HEw8NWd9CJbt/sWrw3NiiiFZvKF4D5bSAMF2A535XrXia/BX4pTeLLLwZpGmP qGr6jpw1mys9KmhvJZLT7O12zgwO4UxwIzyISHQKdwBFfoR4PPwksv2sI5Pj34e8UeMdGuLfVJb6 wv8AQrq71aS6uLdXF1NYQXcEwMcjeZv8/wC7hyDnFfZGj+Gf2Ev2TNL8Uat4f8VXM2ueI7e3tNM0 6702S2mh0+SZY7yyBni1W2DE4lMpdJQFKK3zEH5fN/ErEYD2eFjh51asqcXG1OTjKTdn717xUfik pJabO97fe4PhehipSqSnyQUrS11UfS1m+l7/ACsfkX4b/aZ/ba/ZvgtfB3h7xl488JwrbQ39ppLX dxDF9lvEE8M0dvLlfLmRhIjKuGByM5r7f/Z6/wCCzn7efhLx3osHjPxYfFOkfbk+26drFrb77mID mP7THGsibuPmGcdcV9V/8FBPi9+y1pbXfg+++H+j6x43lsNMutIvY9Kt2gXSLGb9zDI1j/ZtxAJb aPa5a3YiNsDacFfkO08O/sg3fxp+HI+GfiPW7jSdS8S6Za+Ivh7q2j32ltbRS/NPcQ3Mj3OYy58t ApZ9oBBNdXDfi3VxmBp4utgalNyUmmk5RfLFO943sne0XKydmrnDmfhvgoYiVGVWMtlsk7t2trb5 2u/Jn9bHg3/gqn+wgfhdpuv/ABIn8Tx+J57SD+2NA0m3jeOyvZ1yYUuJGAkVc8PtGRycdK/ED40/ 8FL/ANrHxj44vz8FPEA0PR5dXu00eObRorqaHTrdiyi6J3LJIyDBdQoHH1r9Ddd/Zi+CF7qPiPxB 4QPi/QhZ61ALfRvDug2NxBalVgSFYtQumSWQjAdwyqOSQCTk+W6J8B/hP408K67aeIJtX8O63peg 3s0niTU5YITeaiblVi84BcGCRGAlBaMNjHQc/BL6Q14357x0elrq60b91O2uq110tuevh/BfBU5y lOMm1p7y036Wdr26/j1PxXuP+CgX7Yr+Jf8AhJvDfjXXotQZruOaJCk8crwHaD9nKFOg+6q1/YP8 B9c1zxl8EfCHizxLL9o1HVPDOm39/OVCeZPcW0ckj7VwBuZicDGK/lf/AGRvD2leG9E8Sa8bPT9V fTfiLoqwTyxw3C7Zp7rcio6SFlccMACMgBgcCv6tP2f7Zh8B/BjshQN4W0wqMYGPs0Z46DjNfs3C vFzrYvEYeO1NLVve+u3TQ/NeNeFqVDD0K0IpOTa0S6Lutzt5IWU8/UDHP1qlJCd3Oeorp5ITjnnj /OaoSQnvX30M200Z+drLzm5YCcgcnkZPaqbWw6EfTPaukeHHQ9evFVJImAwfwz2rSOavozOWXnOv bkrz+nbFQtbZzgDPTjtXQNCXILfgar3sdvYM0OozQWzqAWW4lSNgD04cjOcjj8q3jm6VouVmzSll c53cY3/q/wCV/uOdNvxgDHpmo3t/4z+ddHHAt1hrfEo7eX8/48ZzVd7faec/nWs8e4yaejM44G6u tjnmty3p+VfN/wC1dpF/qXwH1zTtMQvPOLaONAQMs06AAZI6/WvqlrY5PTr9a+ff2iLvwefAz+FP F82qw22pSR+a+i2n2y7WGJw0jxoSiErj+NwPrWUs3cYuUdWvK/4dTWll6coqWx/NR4u8B+KvBfxy ubHxXZTWNyvhpQY5lAJAvCGCkFlbBGCATjvUHxM+H/jiT4eahcWmmaiBPpbajC6wEGW0jOXlj3YD oFR+RkfKetezfET4iwfE34waX4i0fxHB4i0LTfB0NtoN0kKpcJaf2lI0cNyACvngJllJYDpkiof2 rfH3w/8AE/gbW9es4fEjP9hEY+3T2kRQbhnattCiABmyFAAxxXFQ4hx9TB01KmrzjLmaTsuiVpcr V99dtVrue08mwccVNxqO0JRsna7vq3dXWnp/kfqJ/wAE1pLa7/ZE0C4tHeWF73UPJllRY2ZBOQpZ VyAcdcd/WvuWSDceePpXw7/wTBZLj9izwtcKdwe41AhgMceeQfp0r70mjOOOPSujDY9U6cIp7JI8 nEYRyqTk+rZz0sRAygz7dO3eqEqc8/410DKTy3r096zZFOT29K6Y5i3uyVg1a6RhvGTljweuD0/K qrQqAe307VsyJz0PtVKRNrZHXrVLHruCwnkZDRBeV5GefXtzVOSPb09Mk1sScMTgZ7f/AF6z5Itx 9O2O2KpZj5lxwWhkyIM8gc5+hqm6qOmAeR6mteRMrtyOKotGqnofTPHWqWY6bj+pW3Ml4yq8evzY 5quyOeo59D3rTlUZwcc9R7VVlCgAE+3FNZhpuH1HyMt0IG7p0P8A9aotvXA5x+VW3Dj7w/H1qs2R 8oFbrHX3Y/qhTaPK/NyM5wOtc14qjVvCWvK3y/8AFO3+Tnj7qdc11r5QYHXrisPxE8UXhLxDJMpb b4cv+PwT2NcOYZlajK39am1HBfvYLzR/Nl8YfgV8S7rxl4p1zwb4Vvn0Hw+8a6xPoFpeyafaMtok rPN9qBlRmXMj78AZJHyYr6N/4J+eAvEvhL9oaa68W2tzayX3ghbuxS4jeItbTvCyNiQK21lwUKgq R0NfFHinxZ410jx9c+MtDm1fQoxflozbtIoDxxhScvtDsR1B7HHSv0S/Y41uw1r9qN59N1zVdej/ AOFcwBbnW7iG6uYMSQ7rdXgd1WOM5CoSGUYBAr5PJ8VjqNTDUasoyi1uk76JXTd2r3631WnS7+yz 3B4WrDE14RcWpaJtWs27NKydrafjfofrcyYHJHpn1qpKoCkr+WOtaLDI7DPIPrVCQHHy8HPX1r9D WPdrHwiwz6HI6w+zVtLQDl7ibPtiCSti1udDs7yG58S3Udjp8csZvLuVlRIotw3MSxUdOmSMnHPN c5r1sj+I9EnJYOlxcqMHAO+2kzkDr0FeTftPuyfAzX8MQTBCNwzx+/j9ASfyrzMRjpeyr8srPXX/ ALdR6lPB81SgpLTT/wBKZ3viz4yfFb9pP9rYpLpksXhrTtJGn+E9Js7tLsS2kcirvZ7UyIs0wGSn LJnbzivnTTNS8B/Bj7f/AMLnez3pfvfQXwjuWkgiZRMtpIvlojx7Tl2Ks244+Za439irV/GHhe98 U+INOe98RaNoWgtJcxJDJaNaLM4k/cNPGpeSQIzIFKBiMbsnnyHxT44+N3jj4Ca74M8E6fqGpeFN RnfXLC7vbc213iBTMSYopyhCENkvvOB24A/k3NKVSVKjg3KMacWot35HbunK9pJauL1lq02j9wyj CUnUrzjBybSaWrtZbe7vfv8AfbUtfsh/Fjxb41/aB+I974wtms08WalJ4lsI3jMC71YqUhRgpMfk Mm3AxtQ9Oa/SJhnCttBz0x1r8Uf+CfHiJp/jGvhbV9Lnt75LO8v7eaRyyRwSRAMBvj35ZhwxlIIb aF4Jr9twyqd7ANxwHGf0r+pOGsbOGEjRnGyhaKta1kla2rPwzMcLGVeU4yvzavyb36HwX8cP2a/i 38dfiHcXnw7sILu2sLeGC+uLq8tbKKF7mRUiDNcSx5y3UjOB1xXgHi39jn4y+D7iC3vYNGupry8n s0h0nVLbUZUaLKs8qWrStHGNhO9sDHPSv0s0n4deLvEXxJ1LxdoPw8vfHUNrYTW08e1TZ25ljYKS ryxZkycjIOAMgZrU+E/wc/aUt/DWrXPhvwXpVta6gGZbeHW7DT9TtjbSYPn5WWdRsDxjhG2ngkHB /jXiPxExWExuJhCdNRhJ/E4reTvd899N9Yq+x/YGA4bw1ahTlOVm4x7/AMqstra/M/LvVf2PvjBp dhNdX9mq3MOlX2v3NmxZCml23lk3gd1VHjdWDJsYkjtyK+eviJosiaLayfKRHNcE568yHgV/SWng j9t/WLDXbfwN4c8H6XY6i1hZFpNWt55LRY4niSJXhhi3M+SzblBBAznrX4B/Emw1KGzNmyI7JfXk Urfew6TMDj2JHWvS4B44xWYVX9YcPdaa5JqW6d72Wltlq7nj8UZJQoYeccO29LPT0a+//gn0d+xH Zxx/DvVQWCE6v0wSf9UtfYcsNopGWdhkcKuOvuT7V8t/sl28kPgO/MsSwltR5C8Bv3a8jJr6nAVp BuIAzzg5P4V/YvD2PbwVKSfQ/lnMsNy4iordWev/ALEvwE+GHjnVNP1bxroC69Jc6hqU32e9uJ7m NY4Fk2slvA+6L5lHBUZP1r9MdKtbT4feFfE3hrwFDoekNF4ktbe7s0g1BbW3juSkSI6SugMpV88s cZ+lcF+zh+z7+wh4g8G6VDd/EXXtV1hNOnvdT8N2viZ7eDT5n+eWNLa1hLLklhsySeetfXel/s8/ sH6LJZ3kGnWF0GlIsbq91C7uhJchlcgs9xEGlGVPzfMBjtxX8L57kmMxletWdeTTlJpa2S6rd/Cp x5ktm1pqj+hqWb0qduXDSskk2o6Nrd9N7X81qfNfhrVdKXx03w80/UPDkGpXyWN3p881lpSRWMTN Mt27yzAlpWI3ckPjGc4Brc079ozWk8e6B8LNI0/RrmW+WeO3Tw7qX2+bzt6wo8iWAREiZP3jk/Mp +Ug17nf/AAc+CfgzW9O8TaJ4P8GR2R1kt4o1nxFa3IktopmZT5Usl1KjSg/Lh8DB561k+HdX8J/C X4iaudZvfhLplhDbvc6Hp3g7TIobw25xIs9xdzW8qNEY9zbFALMMjsKwwvhZmWIw8YfVZzl7sVok 73cOrST54Na9Y2v3dbPIupKUV8Wuqt5dL/itL36nHa98f/H9j400bwxpyLcRy6tNBr0a22o3Elvb x+bIhQz/AC5bAPG7g9MdPin9or9qPUrXwdB4cFk8Opat4Eubmz06LTE1CSSSLUIUhVjb28oQyKju RLjaBg54z+tmv/tX/BDwbptjrl9rPh6O1vbeKVLmO+tYHAmZVUtCi27pnfnkAgZJwM1+Kf7Yf/BW OL9mj4g6R8Jv2YodGkivNKvLvUbnT9QluYBLNcn94s1vczsWZmZ8MyYJ+73q8u4JxdP2M6lFzi+X ZWfvQ9ot5Wd42b2t8Ld7IqnmTVOVWNLkas0+ZNbtdFdO+i09bdf4zL3x/rukeJdV0/y7QNPeNA7z 2yyOm2bPyB87HBH31wwHHQ196eKpvElxaeJINA1LXrmZhbDyJZpCkTLdbXFuqN8sewAeuM54r4ov fEPiLxvrni65i0KHVpZLr7dqGrSwSTzaaouxunSVSoi8xmEbGTcp3Yxuwa+7/jrp3w31HRZNJ8EL 4mbxDJHENZa9NqljkOCRaLDmYrnvL29zx/TuYez+sYeHs+Vt67NfZd5dl0PzbBVan1fFT57pJ2vd P7astHds90/Yd+JHx7+CHxFuNe8G6Bq/iAX+mxw3kMVm2oOiW7+d5qI2csuMHkDBOTxXyzd6h4m1 j43QeKYRY2Vxfas09yIriDzR585aQFcuxLqSD+leeeGPhz8TtO3PoWvNpI8qaEv/AGzHZ7lCqZEA 81CQwfGOjYYdjSfCP4eeIh8TdPi0zyZZlu0mb/SYOY4m3Sn5nP8ACM8HJ7DNZrh/B0cTjMxhVg5y ik7X2V/iu7beXTU5MPxFja8MLl/sZqKlfW27tt7qffr10PGG+KH7VfwSGp+K/hr4p8X+HNGg1JYo X0HUza26XVyd7CSBXy5dVznYRkAk1+gn7DXiXWfGPw61fxLrt9e393ea7PNcXmoP5txK7KpZpDxl ic1+fHxj+CX7Svwz8Nf8LznurK18P6rObK2lttWsZbrG44D2aStcIpOQHZBnHWvof9iz9o0293pv w78SW8lzqHiW/uZ0voViihiaFCqqUUKDuCHJXnJ561+mcKVMNUrRxmH9lJ3cXKG91HWMrJ6p3b13 6HwGeTqUv3FX2kVZO0tt7cy1WmtttNde36oPG7YGRzVKYqq89xxWjKwbBbp/ntWZMm3OQRgdM4r9 TWL7ngzo21M+VlDBsknHHXPPWqDkjHOee/t3q/Mv8PsT0+lUJgBx1Pr9TWqrLuZyplRwB7kHnNVH LZ3qO3Pt2qYEsfn54OPp2qItkY55GSfUiur6wZ+z62Kc2Bl+mAM1nunyE4IyP8/5xVuXJ4GfUfrV borEA5+9x3461tHFaWM50l1KhypKkdOc+9VZGIOD9OlXWAJIyfx5/wA/nVKSPcpGeh64rpWLSOed Gy0KRIJ5GOAPw/KoGUEdOvarJA4zk8dun5VAybQQD0P15ro+spsxWHKkhHmAjn15qtL5hIK+uT6j mrErHA9Qcc96rPu5V8DPIz68/wCNaKvpoc3sm1YhIYg/qff0qPDen/jv/wBap2OMkkZA3VD9pf3/ AO+j/hSVZdS1h13P/9f+8gzHtj2pPNbPbGOmRWV55+n60puMc5Ga/jZ58u59V7I1TK3X5fxNJ5rk /wANZXnscD6jtQZiBgn8qj+3UHsjU8w842+9fzuf8HJXxp8YfD79i7Svht4dS1ax8d+If7K1hpYj JMsFkgvYxAwOEJkjUEkHjgYzmv6EvPGMg/yr+Zz/AIOZZN/7Pnw5Uk8+Lrz/ANIWrNZ0p1aUL7yX +Z9LwfgVVzKhCXf8k2fxp+DPih8RvhB4jt77wEJ7OfWtAuvDmoXsJXd9gvwUuLd1YMNjjBzgc9Dk VMmm2V/ps9rfveqVQtGLJwnzDH3yQTjHTA61514phni8Y+GIollxIIw5SXIK7jjcvXA9e9fY3we0 aG58cx2txE0kZRyFZflJ2g/j/Q17ud42GFp/W4xtJpttaN8rdtddtbep/XHDGSSxdWeFe11HXziv JdT5M1WLwRdaJp/hiOG9trpL64kbWImZ7qYOqlYZzIPK2RYJTCBsk5YjFcTb6D4bv/Igstd1FfOW WaMXdnC+EibD5PGOfWv1Fsvgtpcflagni/Sb9be6l1KSweCVJbtbjYp06PcMebZk7nOdrDJUmvn+ 28N6lZvYR3ckN4D4f1i5uHjtvlluI2cwEZXgqOAvGaxwHiBGSkqU5ad293zP7UPJeWtu9ljfCOFG V6lKOr6esVvGp5v89rX+ZNBPibwzdb/CHjW4sJ9q3HmWsTwMUB+Rt0Mq5wRwea+z/CH7eX/BQ/4X aNaWfhP45a9a2MaFLaCTULvyhluAELuFBLdO5rxi4swnhm+1K605GmtvAVpq6PJY7T9qluGRshQM nb1Tt1xV288IaVqC63YR2WniSw1Hw/Cnnx7F2Xao8w+YgM3J29welepW4mc5fvdUnZ3jB9Yr+Vfz I+cq+HeElFJUk7q+8+ik9fefSLP6R/2B/wDg4c8U+EbG2+Hf7cUdnrNhZ6f9ktPF3h9pLjWLq/Ri x+2xXEiRuGQ4Bj2spAyGycf0Z/sdf8FAP2fv25rLWL74Ez6pPHoTQpfnUbX7NhpwSmw7mDfdOfSv 8322+GenG8tjLplmwfxjfWrSQuV8u3jQGN+G5lycN39RX0Z8AP27P2m/+CengrSrj9nbVbPQR4xu vI1q1ks4dRhd7V8RlPPVymFc/dPOea8icvbVYxws3zSdlHRL7Tfdr4X5HzfEPhfh1h69b2fJNK6a k7X5oLVcvVS6fof6ZgkzzSNIOp4rz74e63f674C0LW9Uk8y6vNGsru5cALummgR3bAwBlmPAxiuu MgrxP9YE1ufgOKy6dGrOjPeLafydi+ZBimNJj6+lZ5mUenrUTXDZ3dM/jU/2+t7mccMy35uRnP4V 8W/8FDPix4o+C37H3jP4ieD7k2t/Z2CxR3CgsyLcSLFIVwkhDbWOCEYg84r7BNxkZHXPUd6/PL/g qZF/aH7DnjaxKNKJILRfLQnc3+kIcDEkR/J1PvVSz1Ssm92vzPayTAqeLowkrpyX5n+bX+0z498H 3nijxB4Y1jRL6e8W4tX8O3d1e3KjSYm2yXSG2m2tN9oJJzIFKk5GeK+RprmyK+V5aYGSTtdf5Ma/ Qb9oXUvhvceCvFvhzU9MRddXxXZ3+la99njkf7OttHFLZC5SeQbGLNIVAfDRryu4ivhvVdH8NWnh ix1Ow1GWfVLgyte6c1vsjtQrbYyJi58zePmPyjb05r9w4bzGEqNuSSd7attP3U7rfljb0XNe+r1/ Rs9yZ06icJxkuVS0Sja7d4+bT9XbyVlx91LYHa7KgLHGFeQED3+Q81r2Gky30iW2nJl5GAj8ueME nn++o5rmrmZ1kR24PA6r6e5Fd74O+IHinwBdWWr6EmnyPY3y6jbpfWEF4pmVSmHWZWWSMgnMbZUn BxkZr6vGe0VNuik5dE27eXRny2DhQdZLEtqOl+VJvz3sf0C/8EJ/2svjz+x1+0ToXgrxBZa3J8L/ AIg+I18KaoJcLpVtr1yYY47sTIrI08QKK6AglZATjiv9DIyY9Rjj61/lN/se+P7fxl+0X4dfx/c6 otzf+O9F1XR9L0t4bTRxqU2pW/2h57V/3MMZhBCmNRhgob5Bx/qf2VzmxhIP/LJMDIPG0dxx+XBr 8U4zxcqOJj7SNpNa22vptrr2vpsd/EeUUFh6GJw8rqTktd7Rta+is7O9tdGtTojKPxphlHXIH1rI +1Ef/Xpn2kZxnmvjP7ZR8msKarP6k/WmGTjrWX5+ecmmmZQOprP+2OzNfYdDTMnYGmCUHnPFYt1q drYwm5vJY4UX70krhFGPUsQK8S+IP7UX7OnwpsY9S+JXj3whokNxva3fUNVtY/NCHDeWvmFn2k87 QcVpDNnJ2RrHDNvRH0MZie4/OgSSNwBzX5r+Mf8AgrP/AME+/B1pBeJ8R9J11rkP5cPhSObWZRs6 iQWqMIic8eYVJ7Dg1+Hn/BVj/gqr8PfHPw28P6h+xH8RPHWl+JJdVS51WGwtryyRLAQuNrrMhjWQ ShflUknPpXdh8TUqVI01F3fe+h7GC4cxNZJqm0ns7O33n9dDPIRj/wCtX5xf8FavGvi74f8A/BO3 4o+LfAuo3Ok6na6JAsF/ZSNHPGs15BFII5FIKMyOy7hyM8V/HN8BP+CtX/BQxvjl4f8AB03xguot Nur1I7u/8fRJ/YUUe0nF48UK3AQn5SyEHJBzX0Z/wUA/4LA/tK/EH9nXVP2avGc3wa8R2XjHTbb7 RrfgK81G4ubNYLyOQRusxCiRmh+bcv3GyOSK+jo5TiVXpQundp/K/obVeH6lH3pWkk7Nf8PufiBY ftq/tW6boUfh3SviT43ttPtL2K+s7CLWbvyYLhCHSRFMmAyuNwPrzX6FfDr9pP8A4LL6QYdf8EeO PiZdtrHgx/iEjNqT3yy+HrNpI5L/AGTbwscZRg3APseK/F208FeNfEGty6Zbx21jJLKzNb3TMnlB W2lduCw25xzzX35p/wAN/wBsXwv4NtPHWm+I510rTLM+A/tkeoXccItNTBddMXg+XA4kYlFGwljn mvreK8VSwypctanFye0+umiWq1v63/E9/g7Io4yNZ1MHKaj1ilp3vdPy+R9c/s6/8FJP+CkGifth +CPEPjjx74nvrvxLeaZaJpviaU3GmXematJHEsi2ZxEA6HMciqGU8gg1/oeylEmdOm1iv5Gv8oi+ Hxm/Zt+P/hWf4wx3U2oeFLzSL+G2gl86a3srWRLiCKLcMD5BmMcjBFf6HHwN/wCCqHwi/aA8B23x G8PeBPi7YW1/MIrSK78MSyrcTSFjHHb3EUhimZ1UkbTjg+hr5LibFQo0MPinUg4TXxRaUX1Vm32O DNMqftpYXD4WUJQck4uPvL4bKSS78x+nBZe1MkkHpXxtq/7eP7NXhfRbvxL451PXPDum2FwbXUL/ AF7w5rFpbWsqY3JLM1oY0ZcjILV+KvxS/wCDkb4N6PrmraL8L9K0jUYrK6lt7C+vLm6dL5Ecqsqr HFEUVgNw3HocV4GXYqpi03houaXVapfceVUymvSly1oOLevve7917H1L/wAFPf2wPAPhXV/+FV65 4Y1HVbjR/tEMl3Hcw28e+/szKpjysjD5YyGLJx1AI6/yc6N8DdK1X9nv4qazFZfbNS0bR9K8W6fq VnOvkjTdSvlidZYDGJJNrMNk28IcZC88e8ftsftReP8A9tWw1H48W9r4aS7nlhsrHRrSOaaSQNGU a6itpBI8gjj3HzDnYwyBxmvkX4R+Pv2qv2aPhH4h8IS6bp3/AAifxe0fT9E1XVJrFr6e00tZxdJd wKVj2qMBiS2wjAyCQa9rBYBxUqixKpzc4Xi3q3B8zS16rR23u9G1Y+0wODhSjGCpOacXd2dlzJK9 /W9tldLVJs+nP2GvFmnXX7Q/g748Wul3en+FPh3JY614rvIwrw2tvpawC8uY0j/0iT5AGZNrZ/hz mv7hvg/+3N+yr+0F4mh8I/B7xjp2tapcxG4jsII50mCiL7QwYSRqFZYvmZTyARmv4wP2ZNW8Q/sS /CfxtrXxH8K6H4zj+JvgC98K6d/wjWv2FxNpq6hFC0N1NaW1zM5eVHjLxrGHUqQSTnHsH/BBDXvH ukft32Hw88R6fe6XZHw7rOrJaXls8BeX7IsazfvUDktGQMg7SMcd6pVYVo16mGqxcIOys3ey+K99 2n6bmeeZclClKsnzcrbas1e11tolpbvoz+4gyAdq/G7/AIKw3XhqC8+H914qw9okupeZC8k0KuCq ctJbkSAA+nX8K/X3ze/T3r8Zf+Cten32t3nw90/Tbdrh5J7+LCJvdN3lgFeQFJ6Zbj1r5vEZlGcJ xlOyaet7W+f6nhZLRl9bp8sbu/6M/my/by+MehePfgt4J8P6BFewx6dr0X2rTbZpZIZ1IcRgxhXm Z9nyZDNlScjPNflb8NfiNovgDxJp9zqPiXX4ZLO/uJhLpCXMF3ZQyREKkSXUTIGEvO5cnaSMjqP2 P8YfsseJ/iNpPh/QruO7tpJNRC2skV7ZLIv2eKR/nCMXU57n6DnFfmz8c/2QviCvxYu9KtZY9EkO pTafYHWL5Em1fy3KmWyjnMSyJGxEbbW684r1eHMwyKGGeXOulD32/eT3bvfRt7vb53SPq82y3NFU +uRpPmvFbNbJea19beWpf8PftM3eu3dno3jbxt4/sfD63F5PrzPdpcXd60sjOstojWjCBn2xmRJC ynn5hmvWtR8d/CT4jwaTc6L4vu5b8NbW00eoXg0ibVHtZjHHHJHaIIDF5IDRyyIZiwCFcMWHiOof s+ftQaJ8NV8HeC/Aq3kNpqLnVPEdrPZanI88eVdMiRvLiUdcjnGScYrwrw78NfHXhTxRHe+Jo7O1 ubSWK/dBGNwkUB0XK4UBgRkgkV7WByHJ8TV9rga8FKLdlCUHfXVtRV1fTd9FtZHnVc4zalGMMXTn Z6NzUvwbdnb0773d/wDUl8Nsg8N6cf8AqH2wJ/7ZLWkSo4AFfAf7A37ffwS/bj+FMWs/Dm4Nlr2j W0Nr4k8KXzj7fp8yKE34GPNt5CP3cyDafusFbivdvil+0n8P/hLrlt4d8Sw6vPdXSq8cemWZuQob puIYYzXnYjGVaVV0qkbSW6PnowpyjzrY98kHA/WoGXn2r86/jj/wUV0D4P8Aw5k+Imm/D34heIYl mFutvZaZNFh2GVM0hjdYkbs2DnsK+NLf/gvZ8FdM1GbQviH8NPiT4f1KGFGfTri1je4aUv5csaxy eS37vBJJAztIwCK6sFXrV0/Ye9bezV18r3CpGlH4otX8mfutMmYmA4+U8/ga/l0174YeGtc+I19q HiDSLuSK5FxaLJDNEktxeS3U7JtwrGNm2EI20YUHcckNX9G3w4+Mvgf4tfDHTvir4UuHTR9VtDc2 0t+ot3A5BV1YkKVIIPJ6V+LPifVvCum+Ipr7x8r6hpMhNv5Wl3i+e63NxL8uSryb8ZbKjKp8qsAa /FfFvPasYYenB2bbT1d1ttZp/wBaH6h4c5fDmr1LXVl89z85f2gP2g/hj+zx4Y82/wBATWrSDWUi W2ubRFlxGkggjlfz0LgqQsrMNwO4YbAz8EeF/wBqz4aeO9d8Paje6JZ6esFuuj2V3oj2ul6tp+qS yrcNHHFHDIzaaQ/2VWZgZPmZtrEqf0c/aL+C3wB+Lhsr208Q2NtpNhr1lezaNPIvz2VpCZZBczSg kK/lFXA+ZUbIBOa/Pn4v6Hpvwcs/DnhjwJH4BXw/4+1HTtStofC+vwa3dWbw39tKfthePzbUSLEi LDuU7sjJHB28P6eV4iFKEKFSVeTTlJycVHdPe2tru0U01o3tf6jPKeYpzre0iqcL2Ss76afjZeV7 7an97oj2Kqt2RR7ZAFQSDPUen68V/Of/AMFgf+CxP7Q37BH7Qen/AAS+D/hzwxf2934XtNdl1LWo riadZriSWMoEjkRNoEYIyM9a/nQ+Of8AwVo/4KVftgXsGnW+s6pp6afb3N3/AGd4Bs5rH/R0XzJZ J/swMjpEq7i7nCDJJAr+kcBluIrU415SjGD1u30P53rzipOnCDlL03P9FKUorCNyqn0JGfasvU5z ZafcX0mMQwSSkdPuKT/Tmv8ALG8RfGr9q68tv+Ep1fxR452oSEvpNTvkAKYJAfzB0yMjtX3Z+zx/ wV2/4Kd6Jq3hL4OW/wAQdWuNCu7210GCHVdNtL2SS1MixSRi4mgaaRlVsFi7MMjJzXtS4arcqlCv F23/AK1PLnmDhdTpNaf10P6ZfH/7eXx+8SXp07QDZaHCxwJtPhaSXYpJB8yZnG7kHIUYAPoa8FT4 w/tR/E29ttNh8U6vMbq4jREln+zwL5oLElgY0AC92bG4HmqumeGP7QGpTXOoR4W1e7gimZ8zAEhl g2ow3hX3clRgHnscHw1pcd1FumkEbG2UoNgKyxsec5YBNqkjoen41rPMcPCEowjZrS9m9XttZ/j8 z87X1uU41Jy5lva6s7b6O68tj8YP+Co/gz9oT4WeL/BHxZbVNTsrXxPpF1HY31jqo3SXFrcN5gKQ zM8ZRZF++BySOxr+w/8A4JbfGTT/AI8/sGfDrxlaX11f3dnoUWhazc3gk85tT039xchmk5k+Yffy Q3UGv5d/+CtHg7QvGWj+HvGGmWGpnX2u7i3sNI0a0N3aSRvl7lpJBI0iuh2sgVGBy+SAoB/e/wD4 IDW81t/wTV8NRXCOjf8ACQ69lJFKEA3jY4Nc+Oz51cqp1KllOMrPpve3V30tr1P0LIclfPzJPllG 9/nZ9Evl0PI/+C/ln9q+CvgCCO3knkPiLUzD5UhQxOtpEfMJAJIUDOOPrX4Ia/8AGX4M+FfhhafD PRtNs/F914beG+0nVdRi1OKC6vLp/Mu5Rbm5i8oxAIg3IwlOT8uAT/SN/wAFp9O+Emo/DPwLF8ZL 0WWnf2xqaW0ghuJmW4mt4YxKq2zKSYAfN2udr7dvevwH+IvhjwX8LbFPEfw88C6HrWj65bzaPoNy 8s1zqDajYsJZrj7HBfzyRo8Lrl2ypK4UcMa/Lc3zujWq0qFSFRtO6s+WLatf3m1e0b3S6OV7u1v3 HhvLZ0cL7SLir6bXa1fT12v5dDxv9m/4ieP/AItftNafrWrXulP4oj0TX54vEOt3Bhe9mliTB1C9 a4idhHFmOIhwVAVcHmv0zuV/Zy8EXWtweOfFOmaNqUDHwtYW0FvdaraSpr8kt7AA9tqN+rPeBRJM whaOCY7CwPB/M79lvUNLb9sbTbzw4v2OKLwhqW57aYwok8GmReYzvEvAaZTuGOWIBOTmv0N8S/sr a7+0h4U/4S34uaV4A0TxT9l0m+0DWbLWZJL61tJJzPKbi21DU4QkrMPKeIxuBuyACBn8m8R6+GpZ xTjXrPD0nTh8PLzLmlLS0rpxSvdKLaTdv5X9nkNCq8FKy5pKT32dkuvS/wCJ53438J/Da0+IHxP8 V/EjVPBNxF4EFqYtF1G0FtqFzBJYR2ghV7nTIfMVzG0UMe+LfNkqxzvPH+JPBGg+MP2j/hr+0fou mWcX9ifEyDwlqGiagkViht7FIJ41VBqV3NJHH5wWIxQqGVs5JGK9X/bh/wCCfP7VPhi7s/iT8LNY 0j4rX8181vNpfh/w3Eji2kUzxPMYyYbhbfIiXJLhhu6kmvmv4k+B/wBpj4W/Gf4YH9pg6Evh6++I ttqLWOlJqMXlagbWGOUyQXkcRUvEkal0ZuRwcCpy7Dqn7NU8whKp7OcXFSTaUaaUoqCUXq05XaWr S1tr2YiSqNwlSlZuLTatvLR3b6Oy+T2uf0qSfHnwJ4n8Q3fwQ0+3uLEf29Ddy3el6Xf3B+15j2W7 z3cCoiq42l5PlGARxivh/wCJ3g7w/wDGW78QWmrtrC6noNrd3EVr9ljW11CCKaImFru2uVe5kLeY irsGBjDLwR9KeI/GviPV/Fr+HtC1yDRZX8RWdzql1rX2mIWyx2sTwRyXsTyedvVSFBRQXA4rz278 ZfDzxTqC+G18daDFrOvPrOk+IbWyt1giuIbcxOAbm4SJYPMVWZ5cgDHy85r+dMozGOHlGvhoyVkn zJOTSte+kUknFf8AB6n6Msknb2dZpXfXZ9NXr9/olufjh+yto+peDPBPizQfEtjdQ3i/EfQZzZyQ ux2b7qZAyDAJZGVlBYZB4qb9hn9rPxL+yj8S9c/tjxPc6z4YlvpBrWiajBqU4is1CyQS2TxxXEME 8azE7WkjjdV2MQcV6V+zTpdv4HHijwFrLW0DS+O9OuYY1vLa+DrG1wweKeNmjdF35JG4JkK2DXxF 8GvgR+0V45/aHs/hF4buL3RrLxP4nNyz212vlyWG9WV7j7K0k3kmGP5lcbVGMgEiv6/yHiWhSxeY YnEYtUaaUJSk7JOKjeT2k2kruyv5M/KMw4ahiaeGweIpOUU5bauOlk3tbVK7fTZH9o3gHxv4O+Kn gzT/AIhfD3UbbVdF1a1S80+/tW3RSxOMgg9QR0KnkHg10E9vk4Prxx3qXQvD+n+GLO5S00Pwr4T0 17hTZaR4Yj+y2C/u1V5BG0cSiSVwS2Byea84v/jL4DtvE994TWS/lvNNkSO7FraS3CKZEDqcwh2I 2nrtwK/RMl8RskzigsfkWOWIw8r8s1dJ2dndSSaaaaaa3XY/Es14Yng5ezqeWunzs02nrdXv0O0l i3Z8sfTH/wBevww/ay/a/wD2o/h98U/E/hPwFqlvHYaVNK1rDb6dHLKsCjcoaRo8kgYBbLdeK/XG 4/aN+BFtqEOlah4o0uxuriRIYbfUzLYySSSnaiqtykeWZjgAck1+Gf7TnxX8R/Cz9ob4kah4OliN xrFtfaHNE24YEmw9dgGQy8HfXs4rNsQqTnhoKU1qk3ZPVX1s+nkcuW5VhqlTlrytHq0rtfL/AIJ8 9eJ/2v8A9sPVvA9z4sPi/W8R6b9vlFmfKih+UZDGKXgKWA5UEHrg8V+LFt+0B8Q7Lx3J4q8dX2se IrmC/TU4je6jcxPHeQyieOcspbdhwCVcFT0Ir9S9O0P4v/EX4e3XgXwedX1GafS3jfSbGRpVdioe X91HIdyq2WJ2kDGfevyZuNF13whrq6r4o0m6awkuTHJBfWkqx3cIbbL5buArsmDsOSA2O1fS5Lmd WE5VG0pRfuuLad001Z6NNeXkc+IwEIQi6cXZ73Ss9NdNrep/QP8ADn/gud4p1T4J3/iPxZZeCrbx lpF9ZQ2sF1ZiO51aOaQ+dND9jtrdIhCmPMJlB7gHNc1rP/Bw/wCJ5fFpd/hZ4dTSlDBodL1W7WRm LcMkswlXAHGNnPXrX4R+E/jj48+D1nqWgeArqyisdWjmWW3udPs77y0uV2Ou65hkKSBABujIwfun vXn8SXfhG/1DwtrlvpcpuoDbS3LFLv7Oz4YSW8sLMocdiCRzjFfRYvPMxxlSo8wq+0SbdNNrmSdu ZaQi7J6pOU7NtKysjwst4YyrAYSOGy2gqKbbmoxsud7PSTV2kloo7bbn9WPwO/4LmfCH4w+O9F+H V34D8T6bqGt6lb6VayW1zbX0Cy3MgjDNnyX2LnLEKSADjNfpT+0Rr97oOseGNKhXdBq19eWF8AMs YUtJZf3Z6K25ByRjFfxZfsM6Be3X7THgfW4oZXtdP8W6Wby6SJnhg82fEfmyD5U37TtLEZIOOlf2 WftGano+teNvB9jpt3ZTy2mrX5uED+YIi2nTuvmCPJAYcgHg18/mOPjRnZO2jfU3/sxyp6K5/Od4 H+Hll8Pp7DRLDXND8QKfCNjcm88P3D3Nsnn3NxJ5JlaOPMkedkgA4YEZ4r0b446J8M4f2X9Y1N7r VT4qhkZbiwMa/ZBa74TbvymcsxZWy/pgc8/irr3xm+K3w48Xal4a8NeJLS5t7R5tMiutHT/RJbeO Z2XyDLEj7NzMVLIG57VjaN8Rtd8UzSC+1XxFea1qNzJFfxS3Bls57JI0ZFMZy5dXQk/whQuADmvo J4Wc6FP22Ilbdyild6OyadrRfXW6/AzwdahHETXs0uiW6XTR99rfPyP7QP8AgmnBfx/sdeGv7WgS 2uWudReaCNFjSMtcsdqovCgdgOBX3NKn9M18Hf8ABLhJ1/Yg8HfagBITfl8DGc3T198zKByO3avk XmHK+W+3Y9N5c5vmtuY8kZIJTH04rOdePm+orXfbyATz/nNZjt827keo6VtHMn3I/s27vYzJFwdv 8qoSqS27361qSevbpVZ1GDkcDp/9etVma6sbytmVKoJLE9Bn/wCvUEdnPM2ERjztBAOMnsfr9ar6 9qi6Fol5rcyl1s7aW6dF4LCJSxUducV+VniH9r74ifFH4v2K/CuTWbbw54ItI/EfiGx05WaK9E4U +ZcjAeKO3OEMmdpJrxs84tWDoynGN2k2lrrbpe1k22kr7n0vDXB8cdXjGrPkjdJvTS/ldO3e17aa an636r4N8Q6WEbULOeLzEEimSNhlT0PT2rlb+yuLOTyrqNo24bbIMHB5BwfWu38P/wDBwB8D9b8K /wBq+KvAk1zDHcmHUFivbRpIzNuZCkE2ZHjwDuKrgHGTk1zGs/F/Rfjwy/Fzw3BLbadr8a6lYW8+ N8VvMMxoQOBtXAwOAOlfL8I+IONx9dUa9DlSjeTs1aWnu6rz6N7PpZvuzjgurhKDq4ih7O/w/vIT 5u793VfNLtucnKu4cjHYH0zVF0wMgA9+elachyMenFU2TzBtQcelfpqzG258c8vtuUGDDnB96quA 45DZ9PakvNS0m1vl0qe7tUu3OI7V5kEzHGcCMsGPHoOlJIyg7xyCOCDWqzDsZvAJ7PYgcgj+tc74 slMPgnxLOvVfDV/6eie1b8jqRgc49D+tYniPT59S8F+JoLcAt/wjV8eSAOidSSB+tcOa5io4eUm7 JW/NG2Ey5OrFWvqfznaXa/A0+HZfFXxg1nXrnU7+41K3t9JttMivoLcBMR3Ak+3wusm4DhogB1+c DFe9fsA6HYWX7Ter3mgyWVxYf8IkUW40yOdLVZGe2Yxn7QquJBglgeM5KkjFfDfjHw03w4+Jt94d 8a2EVxNaTEXFqLsFPnjWRSJLdyCdrDo5HODyMV9q/BPxX4N8H/tK2Gi/spfbLfSNZ0rTNMvP+E6u gLRNRvXiE8oaFgkYX7qM/IXOeDiuPCYr6tWjUp1J1I1VdO0XTSurJW1Taa5b35t7nt5hhHVhOlOn GLg9Vqp3V7t306Nva1j9uZEUcdcnnPaqLMQSH7Hlh1Fd18XPgnfr43vvBfhj42/BjwTNpOr/AGDU bTxDqkV/eNbvHG4mjVQillLN+72g9ATxmvNvin4U+E3wv+C9z4s8Z/H7wDqviLQ2m1GwtfD9pfCT XJIN7Q2piBESefkI21cKAGBySa+ybxMYxlOnZvo5QTX3yt9zZ8PRr4apK1KfN6KT/KOnzOR8RLcj xLoJAAQXN15hJwRm1kAxXnf7Q2qadovwh1fVNWtfttvEkBktN0aeZmeMKC0ySxgBsZ3IRj8x8RfA T9rLWfil8a9RGsacugeENKhkvYSftMtrZyNGys0t7dF3AlZjtDvtBwqgdK9r/aP/AGi/gQvwd1t2 1XR/EP2QWs9xoFpqIhuLqJLmItGpQ+au4fxICQK+a/tBYihXTi7yXw3XNrFaaPR/P5n1LwTw9ei5 6KPXppJ66rVfI9M/YX8eeHPEPgrxKf7L0K032Ti6abVmlluN0cqiPyoHRVQgqgCqoGCV5NfC3iTx J8QPA2gah4LXUbPT4WF2sukI+o+XYwvG8k0DseR5qMxX75JPzMq1237G2v6Lpn7NXj/4u+GdPsZJ EdbfT9FuZbmRjAkbGRd4ZQciT5TuBDgZyua+bPG3gDwh4vtbrxf4jtrzw9oM0YfSIJM+a+oSWxms 7ZhslY+dwSc7eeHAwa/B8ZleGp4icKl4xTurpS95W+FOTd/ea09E7aH6jlGNrVKTnT1bdrq6082o rt1fyKX7AGoaXc/HvydOtoI4/seprbywXe9/LjAIEkL7pdvzfIxfbkcZNft4z4yTxX4dfsHD+zv2 jY9IggSKAaFeOhaEKxIVQzJMfnZS2c54zwOBX7bGXPyH8/Wv6Iyupy0tNnru32/rsfjWIo3qS8j7 P/Zp+L3hXwF8L/FdjqN2NIu5NbtZH1RhMf8ARyAHCLAGLGMZZ+Pu9M9K0PDHx0+AbJquteDbM3Bj uJYtX8Q37QLPdzyE+W4WW3WVYWJU5OdvBYgg4/KjX/CfjXWvF1zr2n+F73xDpVkFvZZLbbGIJLM+ e4LuVUh1ADrkkrnaAeaqfDjQfFmp6w2m6ZaaRp415n0bUbUkW8k1neTC5/eXMjrGrZCwqCdw4YKQ Ca/zx414Tw+JxmOlOsrube60V22mlK9/Npa20aP7YyajRhh6UkneSjffokvLSy0TbV77M++/Gvxh +AFz4Y1PS/iAL6yuNVQTPZDUYx9qtLc7LyRJIryAtKzSL9nUf6yPLocA1+D3j3RdGn08Tym4RzeX TW3lPhQhlY4cEHPGPf3r7B1CDx54B8eatey6StzaaZceRY216U12K3FphIrQ3W6RYgcEBR1CnC4X j5k8fRGTTYpWUMGuLlumAMyEnA9K+68OMphl7aoyupcrundbPpqk7NJ2etj5rjOp7WnJy89H5W6v ddUe0fsz2xs/Bl7E8pm/4mJ+fnH3BxzzX0MSCwY4yD1r4++EfxD0TwV4al0y+Eslxc3u6KGIAcbA Mknp0PY11Op/tHaDpGqQadqen3g86TaJIXR9oH8RDFCfouTX9g8PcV4KnhqWGqVkp21X3/I/mPM+ HcU6tTEQpNxvv/Wp9K/Ar9nbxV4R8TN8atd8Z3/hCPVVvWsrjwxJY3upCJgNuYmuFePzAxByAyYG eox9Gav+zb4W1TUbPT9M+Ifje40eC1GpT/a9b8qWG8kYo04itbKZYg21AQx3LjqeK/PL4M/tQeDv hVe38V54aXV1nl1JvPhlSGR/tqqI9+8SDEZXI+QHnrkV0mqftp6HdWWNM8EwQXr20kFxcSXkjxyy GUujiNYBgKnylckE81+C4/8A1llXqRw9aShd25eWKs30XNfZK762Wh+o0q2CjDlqa+Tu/wCr7H6d +H/hd8APFfgA+FPiNrXijXrvT5VK6kviHVDBOXi81gFaxSNyGJ+aRgQuBnvXD+Dfgt+ylejUtDk8 FDUrkwXC2Mms607skiOqbgP7RhAGCNofAH8O7Jr438Ff8FNPjN4X8P2/gzw7pHhi1VZJbi9mnVbe O6j8tVEb7liVMKnGwgsx7mvD7v8Abt+LLNPcaZDpFtdTTPNHfQy3BliVpVm2IGuwgAdRg7c+ua81 8OcQ1JycsRNetTS9227J63bvd6/Mv+0cvi1amvuf9L0Tt520P0y8A/B34EXw8QeDtK+HXha9uTJG 1tqOpwu32Ys5AjWUz3KbcjGcOSM54rC+Nv7Lnwp+GHwzuPir8UPhvpf9n29lZaXqH/CKQLb6vY8x N50dxNYrFEs5x5js7HJIU84r82tE/bz/AGhdH1S81TR76wEl9891H9mEyOVyQxVpJDlSSQSeMk1h +I/+ClP7U9xrVr8KbG90n+w7vTft17Z3Wj2t0Z7tZVQy7p4CcYxhSCBjg0nwRn8qyl7ZOCs2vaTT 031s7a+TMpZ7gowUXHd2+FPyR+M9l471nwFrfie3+H00ttYeJ5Z9JvYpJY5XOnrdrIIblNpGS6oy theVytftR+1r8Mf2gL74AeHtd1Lwz4d0jwrIsUGja5ptjb215eyFss19cBQ8jbcn53/4D3r8TtAm n17VfFn9oa3Z6RFGq3Mtk8Z/4mUsN0qxQxRxr98FtxY7QACSe1fud+21+1JonxS/Z60X9n7w5YT2 Nr4VhsftV5qksSRSXmSkxQorOUcjK55HT0r9U4pdWnmWXPDUE3z+/K2ytCz1td9Fa/y2PkMhqQeD x8a1V8vK+VXtr791peybs3e2l99D4K8J/C/4DW8ccHxI8Q+I5r4oouP+Edk0hbXk5YxyXcyycLgD dGPmzzjrV0zwN4D1r406ZZ/BRNSksYZoJmg1K7j1K/cwuXlkP2KFY1TaN2CMLzlsDNek/CBP2WtP 8Fabo2r6lZ2PiKZmbV9UuLSbWLSCIudqQWohiG/bg7mlKj8a7Pwx+zZ/wrfxfD430b4leB9YaG/t 7f8Asrw5qsjaldQ3DtuKJCgXylUfvQzgAcYOa1xPEXs54iNetUUrNQU4yUJdLrlXLbtd3Sd9LnLk +RwnHDOlTptXTlyuPPHybdpN97Jo/JP9pT9nH4z/AA0gs/iv438I+JtG8MeI2f8AsPW9QtZobG/a JsSNBK67WwfT8Kt/s03klj8TfAMckkUQi1Z3RXj/AHjm4kMRG/GeAc4Jx6V1Xxa/aL1HxB4a1T4M eJ9Il8RJHqS3ejXmqa1qki6XGgYyw21obgWoEjEOxMZYFRgjkVx/wn0W5aDwj4+sbW8uH0rxD51w IWVkFpFKHIXeQTJnIGWxjHTrX7Jk2Y4r6vTjjqfK4ysmrWa5XZ/FJrqnez7Kx+U5ngaE8TWjg5OV 4u61vfm22XS21z+gBnyPlJwOB6/yqi+TzkH68/qK8bs/2gvh3c2zXV9cPZMH2+VchN5HGG+R2GOc da6bwp8TPBPja7ubDwvfJdy2qh50QEbVYkKckYIOOxr7ijmdOSspIxVB7zVjrpC6v8/f19+1UZQS 5Uj0xirkjb+Dg+vI/OqUrkH5e5x6V1LEhPDJlRiQRyOKpPkdBxk4z6+9STTW8UgWRlHQKCQOtQyM +CCeRxgCtli0znlRTuQN8yllPUcD3/Dp1qnKQAe3bqRn61Osh2kDBOMDPFVWcsTz/hmuyli76Mj6 vpZEPAJC8joSO35/rUDSFMB+nJOOOnbpW/ouiXOu3senWYVTI4QyuThAzYyQK+XvjX8ZNd+E8RuI 9Kt7y1Fytob1pm2iRo/NP7teQAvcnkn2riq8R4SFb6vOaUux1RyLEui66pvlXU92kwRmMEfTnntV f5hlvlBJHHTr7+1fEUP7ZMV9LHFZ6DLc7Yw8xgky52jLMqAMQoA7k+5r6n8F+MNM8e+G7XxboolF vdKSizDDgq21gQCe4OOea9HC5pSraRlr26nk18LKm02tHs+n3nUyFicHGCc5z+VRSrn5cjnkj0/O pmPm5zg596qS8HH869CNbbU5nR0uQtHg5DcED/8AVRsb0/Wnuw/i69RjtUe8ejfnVqv3CVJdj//Q /ud+0gDPPH+fWmm59KyPMkAxtb9TWZqetWOjWUmp6xPDaW0I3y3F1IIokHqztgAfUiv8r/8AW6O7 kfpkMHzOyR1YuPXNH2kAZOa8o8J/FX4dePJ5rTwJ4g0bWpbdA88elXkN00ak4BcRs2ATwM967n7Q DxnPbrV/62La5rVy2dN8s4NPs1Y3BdDPH86/mi/4OW7kSfAr4axkgf8AFW3rd88WR6D8a/o/+0t1 H5Gv5ov+Dk+6H/CmPhspOc+JdQb3/wCPQdPSvY4c4idfM8LS5t5foz6vgTBL+1KLf97/ANJZ/Mjq HgL4cXfwL0Tx/qWjSP4gj1pLO01uPVreJVgMbv5B00r50nI3eaG2r0xkiu5+A+nNfeObeRQWKQzF MngfKBkAck+tfHfjGV4/EXhYedMqtZhkhMeUZju5V+cE/wAQ9AK+6v2XLQ3PjSJnQIywXBYgnnKr jHofWv0DilVMPltapOblzc7W+ibemrenpZeR/eHA0aWMzejQp0VHl9mna3vNRWrst356nar+zPD4 UexvPEM2r6TrEGsXerWelTxyZkF4hE11l+DDgLy2VGRjGK+ftF+HOs21zpx0mSW6sY/C+tRLdw6j E6AyPJiMAkb2ftKT+7OQeBX6a6pqN1a+IIrXxDrOoHUbjTZ9LsYr+MrLPA6o0loS0gIt+NwIDA4H yivB/CXwk+ENr8P3u9ZbQNL8TWGg6haaf4YQylJtMuTMbqVbhZVSOJH2iTcufnJVhjFfmWS8a4h0 pzxU3Ju2yutVU2vyuyb3u7Nu76H6Xnvh/QVaEcNSUUt9WtealZaRktV6aJdFdfN158JdXsPhBHqF nqlxNeXng6G2m0m2mWXULMQTny187d5TSyD5vMUkEcZBrl7jwh46aTXkl/tpC2seH2jcRLIreWib hBtY4izxcE8g5Ir7jvPgD8A7v9myLXNDljv/ABnqPh620jVPCOm3EnlRaRBKslpJBefaNrB3L4OQ 3y/eIOK8nh8GjQb/AMSSadoV4JZ/EGgQTNb6qhMqLEqGQqzHylhHDx8GTqAete9heLot1kp8z5uq gvtUv7+3Trtr1t8tPgmU405KDjHla0dTpGqtnTXrdWTvpfTm8Y0H4SfEXVHjurO/jf7B4h1TWpo7 qPyTLB5PzQR7wMqnWPadzngA18+/EOPTdK+H3gFfE/2mSZ7y+W3k8n7M4uFkjKPJEwG1Bn5gBnoR X6ieFviH4t8GeHNT8EP4Hd/+Eq167sLrUr+OKW7062tdsqXdqyqqxrc42A7S+P4s81+fXx4h8NWH h74Y23jufVNDsby71GO5utQtRqN9akmMo0kStHk79oLKdyqSQGI2n6LgzP6+IzGlCslbmduXlbdo Vb/Dd73066d0eDx7wzhcPluInQUk0opuXNZ/vKNn72i0aXyfmf6UHwwuQnw08Ognp4f07r/17R10 t/4i0bSVWXVby1tVeTyka5mSIO/90FyATx0Ffy1ftm/8F9Nc/ZfubT9n34F/D2TXPEumaFpsV1rG qXUcmnQvJaQSRmKG0dmnG1iGVpIsHHXkV/Oz+2j/AMFJv2gf2pbDwzav4i8fJ/ZcLahr9nrlxbLp /wDbKs+LjT4LOGLyo1jcoRIXb3xWfDHBuaZi6UnalCeqk2npa6dk7q/S9j+H854WnDE4qrW6TeiV 2029vsu2j32Z/pjx30cqCaFkdG5R0IZWB6EEcEe4prXg3Y/Dj3r/ADqPg1/wcT/8FDvg/wCB9J+H Gla5oWp2Wh2xs7V9Y06C4mli/h86XAZyn8BznHBzX39pf/BU/wD4LCftN/su+JPiVoFt4VtvDPh6 yivPEGt2tpbW+oSW7ufLkgVXDFmcbCI1DDg8da+hznw5xeCpqVXFRTeivZJu17J8zdvPlvbWxxZL wjWx9ZwwvvRT1sp8yTaSuuXlu20kufWTUU7tX/tVN0vOM1+cn/BV27I/YS8csv8Az72g+7v63MY6 eXLn/vhvpX50f8EnP+Cx/wATP26vipqvwe+Lvhjw/wCG30fw4dXj1SxvZV+0yRSxQmPybgfLu37u JGxjv1ryv/gsv/wUji8I+Az8B9IsNOm0PxMbuG814zySXdlJpF8sLhbWB4zIHlVgD5q/LhunB+Go 4DMYZrTyyrT/AHl07XTVvi3TfROy3e1rnq5Nw5WoYmliJK8YuMm/Lma2dn0fbRXP5qvjvefEvUvg z4x8GX02uSfD7RPEkGqRXUkZk06XxBLFFCIre4a1jeOZoXLyRsYw6Rk4LAZ/KARSNLlduc/xdM+/ HSvsbxt8ZfGfjHwfqnwk8PXk9t4d1PxDDrq6FaI8MNxcrEsSySJ5kilowp2bixXLYYZxXhJ8G3dl byNf2ZEgZf3jZHy9xjODn/8AVX9M8KSeDpVYV7JyldJb2tFXd+r679kfacWY2GYvD+xikqcbXUVG 71dm47+Ter3Z5bPb3Uj7ljiZhwQFwuPUYU81reGo7xdVg8iwg1NmfyEsLoMY5Gk+QDCspBBPBzwc duK+kPBXibwZ8NNJ1/TfEXhKw8RXPiLQ0tNGu3ubmKTQrsyhmuI1RkWSbYpQo+UCvnrivTvgl8Z/ F37K3iXwj40+H3inwtczRXJ1mawlgivGsZpbd4ZobuO7tyAxjYxkBmTcQQcgMPUzLiGsqVSNChzS s+W7aUtG2rxTcdrar0bPFy7h3DqtCdfEcqVnLROzvpu9U920pWW8WUv2SNZ0D4a/H3wzp/j7QDb6 haeO9Ef+2v7Qe3XSTa6hE9wromY3+RSu7eNv3snFf6hXhbxr4X8VeH7LX/DOp6fqlleoFtL3T7qO 5hmYD5hHJGzK5BBzgk5BzX+cb42/4KdeKvGf7NHiz4HrY6MqeLfEt5rd+76DpcdxDFc3aXSC3vUA uFfKlWCoFVcBSQTj82NF+OOvaOsUOkaz4it47ct5MUM+FhJJzsAZQM57Yr4PNODMwze1esvYzW6u 6i1Semui8tNb3V9XPE9TAQp0sNTr80YuTi+VJtOy10V3p1vpbW2i/wBcGSeSMgyKygnuP8ahN4Rz njrX+Z3+yx/wVF/bI/Z31S7svgr4q1a5m10wWkkOtWaaxGro/wAhiiuZGRHOdpIUnB/L7p+NP/Ba T/gpTp/i4fCbXPFc+ga/ozyadq0WjaJZwNc3gdmRtrW7yRhVKqYw3zbSeM8fC4zw7zKjX9iqsXo3 1Tst21Z6XdtzwqGTe1g6tOV43Svt7zvZLV9NT+9k3jHnP4Un2yv4ev2bv+CxH7b3hn4mRS/tEeKv FHiXw3p8Uw17R9C0ixTVbZzGREZd9m5iCyFS3mYG3Izmv6Yv2AP20NM/bN+HGqeN9At9ZFnpN/Fp M95rX2RZJL9IUa5jjjtlj/dKxyjMoJUgHkGvj87y/GYCn7arJSjpqr2123SO+pwtVhTnUbXu7q+u 6X5tHwv/AMHGN/JD+yH4Vmglkjf/AIT23j2ozBWRrK5zuUHDYxxu6V/Fv4et9TjuZm0vLI0H9oXQ jG8Rxk7ctlfkGSAcZGSOa/sf/wCDi+/vo/2QvCf9nOyOfH0IyoJwv2C7z93J/T9K/ifmutXtraFf NlxJoIcyOsi8eccbfMfGBjaDH8v+znJr9P8ADqq8RlnNfeTPVyz9zTpys9L/AJs+iPhY9lca1DFo twQkL2z3pgeRFMuGLBwQMnjBxlfSsKG01NJJ5tPldme43YaVkBGTwOnHPavHLHQpdD1+G1tby6ZL rT7O+k+0GNSXniZ2CiGSQFARhSxD/wB5VPFdH4D1rWodXgsvArNaXF3o8+l6nJqbxXMUrXDMJHgD xHyQYygU8urAsHGQB9LUwFpzrQnzJpb6Lq9ev3I++weOk6VOhUhytOS03vpsv+D39D0yKbxQklxm SYrldmJgQuCc5yeOMVnfEvTbg+C7u8nuhmYRpLZhAkkBDphi467+eAfrS/Dn4Y/F7xJ4jsLHRtka ajBLDZ3uryra2DuBhk+0XJWESL1wW3DrXq/jCFdF+Eng6X40aMknhhdU8TWVzqOhXFvaajqlzbPi NZbwtcF47efZ5e+BFKZVGbduHm1cZTpYulGjKMpXV1G3Ns2tH1bhZarXqknf0J4avUwdeVa8U00n K9u3Ttza76dO3xh4O0TUdZ12RP7QdGWKW7la7u/LLiMbnAdmyznsOrHpX6I/CTwvJ4s0vUo5btbX +y/C82tRCS5MImltymYx5kyb2ZWbCJlyQMA81+SOpX1paazdW+jxK7Q3jGG4W486Py16YwqhsnBD YHTpzX0roXj7xNHpsLyX9rG6oVCSwNnCqpXlUI5ycc8YOeMV9Lxfk1fFU4ck+Xtpt9z6/Kx8f4fZ 3Rwjqr2d2vuf32NP4q2vjjxX8QI9QsPtl44t7aGIGOa7csQdqhm3MSScBc+w6V9w/CH4j/tQ6bo2 i/C/XvE3ieLTTJb3mlaITMkVncSSGKCSGNlJDcsU8sc5IHJNfm7q/jT4ratq19e6HLNPb2aLLdLa ztDCUiWR1fyyyk7VRmHGc/XFbHg34p+NtF8Qm8u0jMlwi3cKicyRwpJ8yJHgnYFzwvVa8fPeGqmL wEMLKNOXItE0m07ab7Pz3sdeS5rh6ecTxM4ztOW+tt3967fM/XH9qfx9+0R4M8AyeCdb8Ya9rMPi jwrBrstnfSypbFrosixyx3KosjoUP7xcqSBgnBr8J9B8Eaje3rWl/ceR5ZMThWyQynBAxmvqD4g/ GbxJ4s8M3Ol6lEJJGtFsobh5GkaKINwiAgkDrgDA5NfMeja7/wAIlqkX254tRW4szIsNuzIYZZVI jDkgHfGxDFOhxgnmu7w8yOrleCq0acYxk3f3YpXdvLRaaK5xeJOJwmOxtCpKPupW6pLXtu/lc+59 O8G6pHo1jq8OvSj7LpdvZRWF1E1zEkdvGAj+TKzryJCOAFJz8oxWjFoPjzw74NsfDem+K9SsI7S4 +0wyrNdwJPbSooED7GG+IFM4B2j61mWPjdha22h3ml3n9pGU6fPpYicTp5MaSZJBx8wJ+UfMMEkY xX1HbfEm2+Onhbwj8P8AxcusWl5pt5ceF9P1PWZ1t9HsNNixMltuSJnWSOV3Z2ZmOGUYGK+IzHN8 bS5Z1feim3tF2VnZpW16/mj9XwnC2U1Uo0qSUnFdZK97XvrZO9tNGvkfF/iFNR8IeHbmXxBd2Wq3 VuI7S11G6lunvbVh5TxIpd/LdUSHy40KlURmHXbj6S/YJ/b4079if9qmD446np9/4z0+w0S80OGB bkWskqXcar5i+ZuC7CPunqO9eUeLJvC3iMaRZ+bZ3Yuy2rSWySGYx/ZXlhWK4XH7t3Me7ZnJjYN3 rj9I8D+F7D4n2dwLd1sfP+1SQRDzXUFg7IiMFVgASFD+wPbP6NkONwksvqfXoNyalpZLysu2z2Px XjrIKyzONDLuVU/dW7631feyfV3/AE/qX8I/8HOnwCvfFMOn+Pvh34o0bSZThr+zuYL6eIY+80GY wwzno/TBryP9sf8A4LC/sUftT+JPBWi+AG1yc29xc2tyNZtPsEUEl5sWF3cSSDaGHzcYx+dfg9on 7LWk62s2pPDbvbzgS6fCBcGZIllYOsixOCrOBtC5bceEwa+ivEf7NHw58U+BPD/guLTxaXmmJJZp dWURiNzc3RDJ++KkypnO5j904GRX5hnmbcOU6qp01USd07P4dHr3eum61/H7bhXwW4gnTWLcYRcV eKfN713bzSvG8k9brofpvo1x4u1vw5ostmfDrXF1ELezWy8vzbNIkK7/ACEUb2lGTn5iFyeOtfM3 wovNL0n44fEtbBLTxGPtbxx2E9k1wNOnLYa6tgXEuxUMm4KXJKrgbua1Pg94LtPht4VuvDF3ewx6 r4al1Eab/bcq4mgtYpPLVZUKvvUAqwwOB1r9m/2R/wDgl54S+KHw50v4z+EfHHhC6vNet4p9VXTP tMX2aSUeY0IfznYtEWKkYGSOtfltelOrSxOHy6n7bmSskoxbXNzJ2b1SS+y+7f2j66tg8PgpRqZz W+rKm2pSfPJXs1b3U7N7pyVnprsfCvgAfsy+Jvg/ptho/wARp9C1q10rUX8Q6fpmkia01OFI2jY3 FvO8LxoFIaTzhvl3EYNfiJ418M6JBr9xpuk2xS2inRGuY/3YQMeAqruVVYYAGfUV/Uv+0f8A8Er9 Y/Zj+H/ib4seDNT0+8k1RI45ytwyFmQkoHEoBkUkA4D8Yr+frxZ4K+IPjDXNbf4j6pYWOq61qMc9 5e6zOLWJDasWZ5iqMUUhlZcDDds16fAWIqZZjcXSxMZ0pe63GdlP3vev7qXMlzNJ3asrKy0PLzzD 4XGYSnicBiFiKbckpK/Kmkly2lZxe19L69d3yf8AwSQ8VXvw0/4KGeC9akbU7Cwutb/4Ry/u7cSG Cb+0Ekjit52X5CJHAba3UKWA+XI/s/8AjLJqb+Obazgmukt5YYfNhiKBGKs2d+5g23CjJHSv41/h 78K/it+y547+Fv7Qfii/t5vCGv8Ai6w1yOHSro3AkfS5I3Mstr8vzpDcMEZh/EwBxnP9h3xW1Dw+ /j1NS1e+Wyhmso1t52jaVgJUkyGTBGCpAPBOSMdK+i8SuI1OnHFYWfMmmk1d6xdmtr3T7bH55lvD 7hVVOrC1r309Lbb7nxT+17rkGlWOj63r+l+H9f03w1ph8QaxbX2pvZ6vBbT7oUMcMsq20u9zsUSr zgKnz4NflV4x+I3xm+EvxA8M6h4A8O+LbL+177VvEulatf2OmeKbqXTRFLJGLe8adnzErOrKJ+EB k5fNfud8Uf2a/gb+0Houj2/xO8V6H4f0/wANyRoJtVvlgn1AtAdi3Fq6BljVn3ws8mdwBC15xoP7 C/wj13SofBfhP4ueGxaaRDFa6VJp+oRiazs4GcJtuUDmIyiR1mdSjSo2x8ivxHA8U/V3B4yh7Tnv Fp2as0+W652k7vmtKKuny3urv2atDCJOHtvZuOu0u/dR2t2d11S6b37Lfxg8afFL4E+J7f4h6Rda Hd+HNRmsLe1vrmG4mkt2sobxJpHhYxr5izZEYLbRhcmvg34i2fgXVfDs0ttc30Nv9lgu7mSza306 UE7xgAuAx3NkjliOfav1k8Bfs1aT+zv+z5q3w08Ja14S1SCz0e6eCW0vIFuZlMLASXBxGJZNoAEh +Y7QDkiv5ofiS3jy91W+0y3u49UisNCt9Sv1s5GmS2RZXiG7A5PQHaDgdcYOO+cP7RxKVOXsoQaS T8rLu/K3vaXtdnrZFjKMadWVJqo3bVd7X7L8u58sftx/CvTpvAVj4tudH8SwWl/fwQWXiO8mVrEy ldrLHHsy+EVslW+975r8tfFvwj8R+EbC9iZ7oXpf7XpshSWEyW1uweO7jJH+rmUbkYdB+FfeP7Qe teJvid4NFtq0sENvo93cX9hBOkphiWfrCsjSIEQBdyE7mLAjJzzc06+0/W/hzZavqLy6xMfDtn4e m+1RsstjbQphpYjEuwxiHKR7yzlj8yFa/prgzM8VluBowqT57Sd1q+vu6u/TfVLsj4XPcFTxleql GzaWu3k/6szwP4c/tU/tEePfC0fhf46eIfEXi7TJZEun0zXZfOmnhh/1LtczFZmRAW8smRlGeBjN fRV348/Z60oTp4J8H6ppU1zpLWfmf8JHHBIkUk376N2s4GedJY1Mbo5X5SDkiuD8SXPgf4SeN4rD 41+GtbvQPDP2PRrbS9ajtJBFKz+VJcyi3nDKqkKIlVBtGDXyFD4mvrWR7awWxhMy7HdoIWYgkH7z rkfXNepVyfD5lWniKNJ04v3rxlywm5bu0JatWV3KOu12rnPhcXWwNGGGqSU5LTVJuNtknJXSfZOx 69+0rqXwH8SeEY7nw74UPhO0iVvOTRbm51C5kaRhtEpvpAgVACBsUMTnNea/sr/DLwLF8XvB3iP+ 3bxha+IIJreyubcRxtKkykQmcMypKy/NtGckY461y/i/4pfEPSNAm1HSdZmtZkZJN1qRGUeKUOrN s4OGbIyDWn8LfE3jiPxInivxDbaL48hl1y2u21D7RcmewmedGn1GIW7QgnJWJ3mV1BIG3JzX1WGw 2KwuB9lCq1G/WfM35XmvP+e7Wx8/mLpYjEuUqavb+WyVv8D/APbbdz+nhzbwFhc4Y3ALwqgAVNow 4AxwNmRj1PFGlXqWt8+nxIA8iASzhmDSICWO4DA2gcH3xVnUNGVJpvsu8gNIQOoJ+beDz7nHrXPD SbqO7tku5CZD8u9WKt5bAuwY855z+GK+Op53CcXc+DqcPyT5b9D8+f2+/wBp74p/B7xz4duvBcqL bzeGtThvrx47m6khjkYwCBj5u1FlzsJK8MOCO/7c/wDBAj43az8Y/wBii7XxKs/2/R/Ft/ayzyhB HJHOqTRCIIBwittYsMkgnmv52P8AgpR8VtS+Hvj2HwTNA8tv4h8LWgvnhcRHZDeSyFF+XIywQtg8 kc5rtv8AglX/AMFXLD9h7wF4g+Ft34G1TxHpWr6/Hq9jdW1+kL2S+V5UsLB42EjHYrJt2jJO4gYN d2J4cnVy+eKoYRRlJxtK6vKKv3tZ3bVr2srn6flmbxhh8Ngp4x1FFNuFn7sm/JWkrJarW7P3W/4L l3Oix+EfhSviG/udMsW8WX8d5fWUC3NxBby20Uc0kcTsquwRjhSwz6jrX4X+I/2kPBPhK98M+Fvh trfi7xDYeGLa/wD7J1LVIJLK8E2oYiFokFrf7Ut1GXUowdnchgy4FfYP/BSX/goF8Df2z/AXgjRP Dum+J9MuNJudSv8AWLXVLFk+yvcWypbrHKkqJKRKgyQ2ApyQcYr4l07RNC+K0Wp+HvhT4W8OaHou qzRbvG3iKxns49GitjGTJHem6uhAhbb5zEMQZAM8iviMRSp+zozxsZWXMn8Kirtq7drt8rdknqr6 XaP03KqFWEOSHutO+qd9Hfb1tufG2leNfiF+zd8a7fxvo7QeH9f0CwvrmfTPFK3MAvDJEm+0eGMx yM8ofciOyg4BLev682vx8/bF/aS+F6+Eviboeg+G9P1vTbPWZZr7UtYsJprPSbg3MKLb3s0kPk3B h2hlYZyrKdxAr4g+H3wduND/AGpkvPi54W1n4o+HoUvNLu9Y8PrHqFnLcX0AFvdie+t3jkRUDujM gPybgRtr9Pv2b/ENt4T1DUvgxepr8mveEri78HWOn+LFRrj+y8TX9nf3MkWqWjtF5OIY7jy1i3FY lGWBr4zxUzrCSjSxFDDxq1qcYy5+yu3pZ3SjKzfOtOZeZ73CtD2NZrEN8jbXL0bsvk7rs1t5noz/ ALS/xV+J3h+88UabDouj6N4H1G1fxeGNjqn2nTm2vclGvLYzBba3zKSgkd84ALcH8q/2h9R8AfEL xV4Z+HnwX1zxbdaZ/wALJGp6Lr/iS8nk0e4tdXtQ0MljlEMUMU0MqqvkoVGQuQDj3D9vnXf2mtE1 uPT/AA/pWhaCvjLUtT0iXVtG1KXUn1a5vIlsYtPnt5bnUEga4tkiAm3RojEqXG3NfF3xZ/aX8JTf tXeANY8feB9a8D634L1axsvE9pJqlveW0ltp8f7lUggs4I1lDs7M5EhdWCk8ZrwfDPhqcaNPHYCl FqUJyjGE4y5XGNveV26l5cyjJN8qaUo6o7OJeJ8JUxUqdSn7OPPG6adrOSvaWuqWvS/TZn6oz/sY 67rXg218V+Kdd1G61jXvENtb20yyyz2vmqERS8mw5KkEMGcfdOMjBrmG/Yn0jR4ra68TeKm0+5gm 1F4oTauXuJlYDyYAzKC7q3Hamav/AMFkv2VrfwtP5lr4mn1WbW2vo7a30izS3tIgsih4h58Ubu5Y EgoPwNWPBn7aPgH48+Bp/Ffh21mGk6JpU9940j1OXT7K5tUvb5IoprSI3W+QkhS6puK7shdozXgY HBcfqPNXw8qUG3fSO1norrRJabavtdH1tPiDg6q6kI14zn01n3T30vr1+Z4n8DtO+E/h/wCG3jLx Ulm3ia20vVGmiTUjJYyqp837TakQu4Cs4HzgkkKDxkivun/gnF+338H/AIBG6v7TwZDr/jTVYp/t niDxXqy+RZwpIxitbETf6qIRFFK5BJXjg1+XXwj8XW9j8B/iNoqXNoVvLm+u1RZQ0rLEZSjIEO3G GySQfbFfJvwlbwjrPjTSNH8SahDYWN/fRW99fm2M620bkB5njAZnVBkkLya/SsbwtLGyxkqs5Nwm nFtcy+DrB+49W3a3xJS3Sa+PyHNcHUlDDYqhGdOorSjeUb67c0XzW7q+quj+1vxF/wAFpP2e/G/g aPw1r/gyG4ae0d5RYXlqHgePK+ZGrnIKkA7WPPI5Fekf8E6tV/Zz+Lfhrxgvx58E+HF8R22uCTJs Vv0bTZ4VmtJI3UStE7xMpmRWH7zPtX8aHjPw98O9L8aXdhaXZuYre6aKO7WGJUnVWwrhSquA4AIB ORnmv0K+Gv7Yf7Rmj3EPw9/Z+0qGeTXk0PwcnizVImNno+sTzMIEkVxPDIZYAkYLgYVSyrnJPJkm KxuBrU8Xh+SrJJfxIRhFQ2aagoKVov3b3aaVr7B4lcAZNhsC8PgKLw0JT15Kk5ty3Vudtx2adtGt 9j1P/grT4k/Zu+Gv7aeg+EvgZ4durLSI7nRdV1K9tUuobG1kivSLtmjnQsNqoCxBVFA4HWuX8Y+M ruL9rTxT8RoPDvhzxL4Vtdf1F7y91QXf9nQRAExyXk1qFKCQMGiALFvava/iz8AdO8Y/GvVpPjrY +JLS88beHLGPSdZ8D6vHqFrYarJ9plnaRLaxaeSCSWMDCQgAbiT0x8l/F/4X6cbW7l0n4bnxYfE2 oXMWla7aeINSM97JblI8jTrZ4UV1GWCSRlioZiAFOPp8L4h08Vg6CUoqo9WouLilN62vKMVy2aS5 nZLZpn5bgOFVGpVjytxikk3o5cvVtJuUn1dvusekfs3/ALUviX4SfGrxDrhs9S0mC10/UdKtJfDF 1b2UaX90pS1dhqtw6/Z03/OCu7yyTw3I/I3xV+1b8YdG8Kar4X1Xx74pMOqXMV3d6NbSLqBsooXc xSIbh3jjjYyk4ifBLYYDivYNa/Zs8fanpevalF4Jl0b+wkgg1OO/N880d5dSxrBbL5kzYnlEgKq4 wUDHrivkT4V+CV1Xwhpuv+JvAOlvpZ146W3iWa61C2uLvLM07ELcrA0dogzKyooQY3HnNfXZdjsI 6bqTmpqDSaXJfmtfeU2ndJOy126XPPzTKqkJWhBpzTd9dl6LpdrXT5nDaF8YfF3wx8Sz3FtcWoug HSBfFHhLTb15BcfLJ5iTxSY+ViVIyc4xiuI+JHiy4lgh0TUNP8OCa3dpP7TsNJk0y6kMmCVkxsjY L2ATjJr9ENS/ZD+EeveFYP2grbUbfSfAcF8tjb69caldXD3t3G7RzRpafZbu4i2SrwWyGXDKCpyO U+JGiXfxL1Y/CDxl4h8ezWFnKmqWdtqc9rd2D+YpS3vojN9kkSB42IO8Iwz0549jB+IOCqVYypQ+ G6qNqzi1utE7yV/ejdct1fXQ8L/VWqo2knd2cUtb3+e3Z9baHD/8E+Ne8Oad+0X4A0/W9R0m3tJ/ F+kfa4NRuTFZPsvFcNeIF+aNQWwWDbd3GM1/UL8XvFmpX3x20v7Lp+haRYRy50/UtEtPsqXkradq EN7K0iKHdFdNq7xgDO3Oc1/Nr+zz8P8AStD+KfgT4bA2PiK2uvHmnTar4YuNOsbe9e3W4RwLXUTL Ldssu3BjQgEDHOa/pC8VeDPC+keJfDOh+A4JLl77U9VuZvL2K3mmzu0aCKNFBjVMHYr9AQOoxX5p xRxJhVxFQqb80J2fRRV3zO9rX10s01qpPU+ryjh6pVwNR81uVxVu77aei7H8Ul5b+CdN0LV28TaR d32rXwZNP1ITyW62rtMzfawpUi5VwpQIdo53bsjFdH4S8afDbwfNp+i/DO415X1HTkTxfLrFhYMF uVwzDT5V8yaOMMOGyjsODwSK1fFmsfEjx1rP/CEfFLWdYsh4ZEHhXT9LvrW5vZbXT7O4mxboIhtH 2ZmfCcAsSBjmuvsfE/wmtvAqfs/zeH7YXa+I5tW074gppE8WvXsDoIU02RJbkJFb7tzkqrlX/vV/ SeJjhK0ZQnOUtOa2ri9FbdcumjSi99dXc/J8DXxFOtemox+zfaW+u2uuqd76aH9Y3/BM/wARJrf7 KGkWNtZ6lb21hd3MNnfX0flx38MkhkWe3J5ZASUY4HzKcV5h/wAFRvjt8Xvgh4H8Jv8ABnxBF4fv 9X1e5trm6uUiaE28NuZSWaZH27SOMcnoMnFM/wCCQut63qH7Kt5pWsXV1cw6V4uv9P02Ke7a8S1t AsTrbxOwUBEZmzhFBYk7Rk1xv/BWjw5a+LvBng2wlBMiatdPbyEAxrKYgI1kU8lZHwh2jI3Z4AJH 5Ms29jVca7vZv9bfpddXsfpv9kKpG9KN7rb8/lvbstz4hvviD+2JefCvw58bvFHj7Xr3QdbvFs45 dInFmvmoVY7gkSbVcNhSeSa808VftS/tIfD74naxo3hPxf4kuNIbVZIdKuLrVLa4jiRQCY5GvIWV mXkZDDODxXqnxq8W+JbL9hP4canbWlvpNpL4i1W61jR9NuHS3uYoLWAfZP3plYNIflVstkngV+dG n6BB8Tr678Y/YpdChnllMcN/cB7fbt3wxW/7lN0jlWXkfMSBx1rwMgz7E4ujUxWLdoxlUjo+07Ru lJa6bq6a9T3KnDVFYylhsPC7kovVd43b1T08nqn6H6Mfss/thftLab8drjxX8YdWh8SeFtVWLSdQ jt54v+JcELfZ7mGGILHvJJEu0Zcc9RX9BPn+YgdDwQMD2Ir+TP4WDSvDI8Q6JqVlDeT3y2z6Y9sX SSzeF2B2gOqN5m75iynG0Yxk1+7nw2+NX7RviPwvolp4f8CrqH2u1t0tdQv9S8v7UZGMSN8yDlnB Xk9vxr263FcI1Je2lGEUtG2orZd359ls/ntnHAX1ShCpRjKTbd1v6WstF8+qPrb4jqZPAWtouc/2 TdgEHByYm6dP51/LHeWqeHPiVqMeq6ndJBLpdospsHBmmBKhoSC6rxyTuJHHev2Y/bN+Iv7anwCm 0nSviFpHg3QbDXreWC50yS5+3XU0TgBtjxMTG+1xtyBz261+K2madrF38Xr63tJbXSZzo0F3FPq7 CAKq8KyO7DazfwnkVvHNKNeksTRrxlBp6p3WjXXy8rnjYPBuMHT9m7tq3z9H/keDeE9R8UWWuQx6 f/pRw1q082ZYCJMx72BOABncGP3cA9q/rP8AgVp8ei/Brwvo9vdQXqW2h2sK3VqCIpgiY3x5AOxu oyOnav5rrz4AXfhufRLDQta0PxDc6v4Xh1Wc+HbjyTbNcOSLa7M6qJJAEJbZ6qM8Gv3t/Y++Jlh4 1+D1rosUBtpfDkUGgzq8ocu8MCPuHAwcEZHY+tdlPOaNZxnRaenppe1++4YzK60Yv2l9H172v+R9 Zu6sMD8e9fL3ji+8WfCf43P+1n8QNZ1Oy+FPwx8JJql1oNtJ5cHiPxZcTTLpWlsoHzCRwss4JwII 29eflWx/4KO6Dc/tEQ+A2s0/4RC6l/sy21URyC7+37iqOV6GKR8R7duV4bPUV92/te/Ev44aB4Q8 CeNf2cvB/gz4l/D3w9cXGkeNPDnimA3ka+L9RlMLS39qChjigt1jFvOW2AM/OSwr1lmTpXlJra9m 7J+V3sfPY7Km1ySi1qk2le3Xa6323R+PHh79uzwH+2Ro0HwT/bKvJND1jUb+/wBY8F/Gazj2aj4V 169u5Z5EnaDZLJpFx5irLGCzwZMkYPK18x/GPwp/wVY/ZD+KEPwl1TxHrt9Pc2q6loM1nf22qWOr adIT5F5YvPu82GVRuQgZwcEZ4r2C8/ay8N/CPxV8VfAnxd+A3woTxZ4u1GW4t4pNMlnsfDkD2Dqv 9kmCclAzlJF+YgMd56ba9d/4Jv6hbftweB9c/YU/agsLrUvB3h7w5qvi/wAL+Ohk6n4CmsovMlaG 4b79jM21ZLV2Cs5GzDnn6HKszqTg5KMVGyabammpdnp8ndq3bp8nm+X0qcoqM3J3a0XK1a3TXfqr aPVX1v7/AP8ABOb41/GL43fB/V9Z+N10LvVtO8QzaWr/AGdLZhHHGh2usWFJDE8gV7h+0Ra6/rce meGdG1G/0+K8ttVkvPsLYa4S3t1kSFxkZRm6jNfHH/BKGGDT/gl4mtLeUzRxeNLyGOYggukcaKrY OSNwGcdq96/a98SeNPDEfhPXfApK3kOqz75FOCsTIgIBPckjH0ry8+x0kqyha+tr6K/4219T6Xhr Bpqi538+rPyXu/2cb1pdaN7q9paa/Y2t3dat4Tks7oajp9nCnmG6uD5Xk+T5e2Q7HZgrDjrUv7NH 7PGl/FvVNW0u8k1S7mtLJLiztNFtbqaWd2JC+Z5ONkb9AWPBxx0qP4o+JviL4m+NPjnXPiX9ot/E N3oci6vFhYT5htol5VAB8y7Sf72c96+sf+Cf0+iXniAx3/ixtBvb6GKyvDPYtfKCrlEkkMsiQwhI hgSFsjgAYyR8JxpxBjsDw/UxU6/vyjBpxV1FuzaTjFtw3Sdr2tdtu5+i8H5VhcZnqo/V/dg56Sve SV0uZN/Fs2l52Pt/4Efs1/Av4UePLRvAGrae13pOq6TrEPirWJZkkinMCyXNjZArcJNMokZSJCoB wcZwR9J/Hmy1X9oqf/hCfGQvvEuk6VMNU0bWdVuEjuJdQmkRFthE04t08uFtobYCcZznNew/Bzwn ovhXxLr2k+Hrqxh0+N41stM1ScxatF5Sxbp1tVnLbbklhE+5iUdCCM5GF45e0v8A4geII20/xLH4 bsdH0/UpdAgOLK7iaZRJcXiyTTM0eGwMOCWA4wCK/iatxVi8VmLrSqzcopPmk23fTXS3d2V+X4n5 n9JYTJMHSiqdGhHRL7MUuid9E7v+raHzN4V/Zn+Fvgf4t3Hwk1Wx1G38JXmnbPE13BexpaahOP3k DhoVaN0D4HlPvdTknFflz+3n+zt8LPAVlrt1pNhPZahHqkOm21he27LcRQpHvacOURvLkRl2kABs 8E4Nf0PXy+EbO7stJ8K+DTqfhe9iubjSdJKvazMm2NVuPPe2MNr/AKQsrfvFTcu4clwzfkZ+1JqP jbx9qnjDTvidp6ab/ZcsWoeILKHSGh1KPRLXayXEc6pDE6fwbWcFvkxtByft+COKcbDMKdd1XZW5 lzO795K7Tve+3yUbnz3FeV0KuXzp+zXvRsr8tk7O9kno1rzfK17O34g6r4BtNC8L6H4l8I+ItdfT tU1afTZ9NaOS1gBhgjeSR/LlaNjvdlVSMlVDd8Cn468KaPbalpcHhyHUxJdaRFLfC92fPeB3jkMR RiDFwoQsd3XOK/ZTV/j58JbbwxoXjL4P+EtH0jw6+txXE7a9ps8ksF7pCw/6VY3UV5NLHLIigMjy BODx8xxhfCPwlon7Tvh7xb8RfFfh/RdI0fwn4bvtYsn09JUuEn81ng021FxcsTb7ned0XLbiTvGT X7lhfFLFKk8VjMPKMINq8mr3crKLSS1T0/E/FnwNQ1p4erH37PRO2y1T13+7c+Ev+Cd1leW37Q4l ufOUR6BfxqsiYUH5DgMOpwQfxr90XkUjjGSck1+Nf7FwMf7RRv2W6KXOiXrwz3aiKQriIbBGjMm0 HlWzuIPNfsA8h3ZKn64r+hKWYKrFSXU/HYYD2c5R7M88u4P2dbfxnb678WfEfinSdWtrkyWUegRw ssEVuBLHOWlP+saTCoNpBI5qh8c/iT8PdX0qey+BviH4qa9ql1NDqmo6jNd+bYCa3hAHnQQQxsJI UVSrjO0L+NbsPxu8CfCbxNdQ+JNc8b6XdyGO7ii8Lwac8Z8okpI8l7lw6HJCgAetefeGvjd8PvDW i+IrHRNR+LMLapPLJb2tjqNna29yJYwJjeeWjFmcFhhVxg81/GWY0q08yqYmdGc1GT5duVpy84J2 WjtzNPdn9ZRox9nGFOok7Rvvpou1/wCuhx+o2+gar4E1HU9L1L4iaheSQRag900N4bAThP8ASxO2 NrI8jbklLfIAQcluPM/HOnbdKgGDkTzduPvn8q+j/GPxr+EX/CBT+F/Dvhfx7YSS6eLS0mv/ABNL LZxXCx/Oz2wt1SSN2JYR5XHTpXlXjKOKLT41kWTLPORsO3B3nrwc8V7eRVqsGnOEo3k7czi7pK2n L09bHj57S5qc4t6pL9PNngvwuexh/aO+H+l6kyyQXfiKxW5s51VopYmlAPmKw2svYhuMHmuF/aJ1 nUNJ+PfxF1K3gZdFttX1C30aSCJGhWSJyTHAANvyqVO0DABFdTrXxA8BfDzxVoXiaXQdU1XxLpGt 6fq1myX8UGnNY2sjNLbzQtC8jSysFCuG2qAcqTXzj4q1DVfix8Q9Y8TXmkPY3Gt+ILnU5mtLiSb7 JazOXeNYMBZGiBJ3ApuwBgYr7bB4SUsw+t1I2pqnyu7W/PzXSvfbq13Wtz4epjFHCLDUm3PmurKW 3La17Pr0v8z7g034FeFYvAHg3xRqWs6nNeeJ7aZ59Pt9NMjWzQopQIxkJk3k8nau0DPPSul+G/wA +Gnj6IvDP4sdnlFnbNFpUAja6IVljztckEHjHzE44r9PPhL4EsfEFp8NtF13xeNOtND0CW+0zWop obSeSxXydumtCbtAokzl3V0m68gDNb9p4O8F+EvEA8JeGtfntbBdajntpLK7CixjV3RpIwss6Kdp VAzgkxqPn4Od8F4vZXSy6WGxEKk696lpRtyqPND2a2+yo1Ol2pK9+m1PIVGsm4Re10/T/M/Ki/8A gv8ABzQ01eS8bxPK2hPGuteWYIEtPMk8pFk+UMjFsL84Xnjmr1h8NPg2+tW3hybS/EQv77R11yyt 59RMbyWLQGcTBVUblZFLA7gPrjn9kvhd8LvgbrHiu/ufFUum2iTTgzyXtutyuoSQorpNLE9lP9oW UsZdzuSSQ3BxUfijS/DmheOrXxH8H7rSNQ1IXN5plv8A8SiO4jWzDEKqWn9nQKrRglS25sD7oA6e 5T8fsihiINZVUkotS1qRSaVSpU5WlGWjg4QbafwW1Lnkqi2owhdf3Xbp1fX8dbn5IW2l/D6ystI1 P4QaLe6jYeLhJpSyjWJ4S8sLp9ohlLqpZF3DJ2op7E44+fPH974Q/Z9+KJs/FPw08OarrVtavYeV qF7d3ls8TSkCeIWcyYO4AglmA71+/uhRN4X1m4uLvT38P6pFZi9tHiSOVElIZWlEFsI4whLkLGx+ XH0r5/8Aiz8PfBnxb+KOlePPjvcyeLZbPRFs7e3W1+yzw2oxMWjVNTRF+YAYMZLfpXy1bxtymrR9 j/ZsoLlheSqOU5uFJQbvHlj70lzu71bd7vV45jw7iaqioTjHVP4Ukve1srXt6an8ut0/wa0Gad7X RbXULzW0+xM1xdTg2V39pDtPCsUqDO1Su2TcuDnGcEff/wC0hN4r0zw3NY+MNNstF0CRIjbanY6R aNe3W99u95lBll3qf42HrjIr4T8V3fhfwfpeu2Xwu1VrdvEGsx2eoaRqOkslzJaW0+5DBdTRzhTJ KNzrDOnA2kFen35+0o9zL4GvtE8Q6Z4jWyS5SX7THezeVclZdqC3ikTyIxHlssu5iGI6DFfc4+qp 4vBy5W05P4r8y+HWKlZK22iknv3a+JwEWsJjVJ6qP2bcv2t3G7ae7u4tbHwb4k0/4NL4gmf4a3fi aXR8J9jGtWUMd3nYPNMnkyheXztAJwuOc17r4A8dfD2TW7fw9o/hvS7aW/1PTAt+lm5ubVoJtx8i SW6k2+ceJTtOR0xXhOn23w8ZFt7vSddKKMK01+ik5OTnbATX6FeGvBX7I/i+WwvfhGLgeMbPV7CI eHdLW5uLe6t4lL3GoRO8OUjQjMgkcHgnaK+h4pzClQoQp1oVJL+bdK1tZ2a69Xotb6XPleDsJOti 5OjOnF6aapvfSN0/w8j+dX4uyCf4gX7R4X9+wIHqCa+r/gx4AXxp8N9LtdI0ue+v3uL3ZKucNHFm RowCQvyKGcnOcVu/tB+HPhX4QY2ek+Cr7UNTvI5NYttZ1AXaLPYh2Sd2jDIhSGQFVkjCjK/Nu5NY nwnl1eL4YQzeHI72Oy8mQX8ixtMiJ9oOC7qpEYLY5yPTNfoNXPni8LSlQXLZpJy22a2Tv5Wdrv7z 57L8kp4XMascTLnum2o72umtWra91e2+uz63w14e8ExJa/2lb2M5kW4E/mIxMaFBsOePmB+7kEZ6 givp39nzwj4S1PXp9B8Bare6dqeoGK2lgt2TzGj3Mcp+65K7gcAEn8K8a+FE+o3V3ZaJ4F01NX8S 310otoBp8l5cIUI8tIPmeN/NJ+ZTEcYAzzz30vwu+J3gP4lajqvxn03W/DNzJNhptRtHso4mkQNK Qg8tyUQ7gkQzj0GK+J4nzurTqVKFPEunLlvHX3m0+kN2vNPU/UeFsjw9aFKdXD+1ipWklHRK2rc9 bPZ6qyv8j6G+OPw01v4CRR6d4j8Ta3c6jeRyOLS+v/JvLcIQAXgigV4lcEMhdQWHK5FfAfiL41Rz ePbrUvEFzfxwCBIQLS4kB3RoqcRnAOcZLcEntzX3N8QdF0W5+LMus3Os+BPEFnp/h7T38/xNfzXt lfFrcLGE8jy3eRQo3RE/uzhXLck/k18WrdZvHMVxGdJTIlkZdKXZbpz90joDjp7e9cvhxnOKxdNU sZXlUk4qTk7pXetkull/WpfiZw5hMC5VcFRjGN7JaS0Vru/Zu9v+AfpZ+zde/swy+OrL4m/Gf7b4 o0yzsGvH8NabqT2uqefJ5iWmd/yfu5VEkgBPyEZPOK9L8U/FvQPBtroEJvbTWZNUhha/k09nU6fN MxXyLlXRR5qgBmCFlAIwxOQPDP2b/B3wp1b4W3+o3GneHP7QstPEj+JotWu7S+trycArZ3FlKsqT wrHGWEkCIu51Vpc/LXI/F+6tLPxVpfhB9PsIlgubY2mqaXaXVvBqMMZINyzXIVpSzsVMhUZKYHAr 3+H+JKyx9TDQqT0k7qSjsl0tdpap9JPdq2p8zmvDNL6gsW6cLuK1i5Xvd7ra/fddNGfeLOGUD9PX v+VQSSLkK+CSD8w/lVW5ngs123TKoCj75xxj3r5R+MXxs8RaJr3/AAi3gaGGZ206TUjeQtllSAMz rlonjHK45BJBwME5r9wwmOpOcYVaigm0ru9lfq7Juy9H6H5pSwVSd1Tjc+5fCGi6p4hEsGlRrcSL PaFYjy7bp1HyqAc+/HAr89/2lvD2san8Jr2x0TT7u6nfxWIvJtYXlZnNoqgKqKTknA+te3fC39o7 SPDXwdg8U+M30q68XXUpmstFXXJrC5u7cu7xSpDBpcgjSLymVyLkM5PRRxXs/wCyl8UPF2v/AAJ8 U/FLw/4q8B+HNb0q5m1vS/C+q2V/c3zwwMsMlyL6Hy1YtJshRSpbpnABavxDjrNJ4LGYjMsNVhVj GcYpfvI3drXu4fDdaOy38nb954V4UwWJwlDB4vE8spwk3y+80nfpok9Vpe/WzWp+Hvwr8Sn4Q/Em SPxVe+INHtRYXmn+IbHSbmTS7+WJ4jHLYu5Ukb2O2RShBGRivr/wf8QtZ+GXgC00fwzaWN3ptvZ/ bIbq7uds2yZTKVMSKRkZxjPOO1Y/jL9ql/EWpRXt14C+HI1LWHY5tNDjl3zLK0ZLSXLyOXdwWOD1 PFX/ANq3U/2h/DsWkTfHDwvpvhm4v7Ge3s9ItrWy0zUFjKIPPubOFFkSNlx5LMoVhu2k847MHxbj ljqMp4dUp1VZ3qRbfLd6Rtra7u76Kx8xjuGMqWAnSpYt1oUpOSaouLXPyq0p822iaVmr3tuzY8Nf tmQePLNBaaBHZCzgMUlwkrSfa7hmLbpN5wgQYXCA5HJ5r6o+Fd9rnxcki03wXpt9rF8tnPfajHpF vJNFaQ2qB55pHIG2JAwBcjGTX4wW/jLUbqKG00UJZCGNLNigV2YSNguSAuGHrzXv3iRdO8OeANaX RdX8eWmu2l1DardBo7bSLqydgk6743815N+MADZgZY5wK+trZ/jcNKKpyd5PRSvJavrs7a9Hp6I+ Oo5ZhsY51KrvyR1cUoXstkkmr6Wu46vVu7ufpvK6KQjja3ZSdpx644NR7l/yf/r1+Pl0lzFr1x4O 0u+11fself2lc3z3cjsZFthOB6Khc4Gfzrif7Y8Uf9B7Vv8Av+/+NfX0+L42XPF3PkqnD9dyfI4t Lz/4B//R/G2//al/au8MeN38M+HviX48W1FzHBDcSancoxEm3BZTICDz0PPavoH9o/x1+2N4H+E+ hw/Hf4p+LL7QPHmjrqmn2H9rx6rBc2oZfkubZLotCysGIWUBvlHy818JeK/if4m8TeJL74sfEeAa trWp6mLyaeFY4oZZciR3ZIVCYbbt2qFAzkDtXgnj/wCM3iXxZptrpGo2Rjis2zGRJIxIxtHDMQOP QAe1fy1SyCFerQcaMI8tuZqMHrbo7X362Xoj+xaWdYXC06jrO8204r3nbXqehzePT8K/GGrQfs++ LvFtrpVwI0+3Z/su6vBG2/8AfRW8zBVDZKLuYjua/fn9jz/gv78dvgL8AdO8DeNH0bx5qVtqDWtl Fr32+PU0sgF2b7mL/R2QEnbkmQ4O7tX81vw81D4eajqE6fET+3YVby/sb6OInIcyKJPNWXkr5W7a FIO/GeK+rNb0b9j3RLTX9R8N+L/G02qWGrWi+FtO1jSIYDeWRANxLfyLKfIljbcFRQ27gnGTiOMO HctxsIYTHUJ1HGz5lC7b0WsorRO6va2ifRM9fh2rRxUE8RKm6c2rxk2uX3lqk3o7N230b8z/AFAv hl41uvHXw60LxtfRR282raRaalLBCSUja5iWQqpY5IBbHNfzxf8AByFdF/hR8NVUn5fEOpOF7HFs g5r9RP2QP2uP2fvij8GPDun+BPE1hdzaZoOnWV5b79kkUqwRrtIPBJPTaTX5Bf8ABxz4l0q3+G/w 1ivJ0QHWNUYjOf8Al3i7de9fwX4cZlVXFeFwk4OLUpaNNPSMu5y4fhWrl/EFSNSi6cU6jjdNLltK zTe6taz9GfzMa7ZvqOoeHp5rwWx/s5rgxTKwin25/doQpAkOeBkZr7Y/ZF0i5T4gmacr5Aspm2/x EfKOtfPGgeDPht418I6N4un8Sy2OpWGmyNa6UbeR47wwMqrH5gBCM28kE4Hynmvsv9kfSCvjR7vC YFnIjKB83IXqa/f+Pc5g8qxNNXvFSTvFrq9nZX9Vft5H9s+G3D8oZlhsT7rUlCaale65U9dXZ+Wn oemXnhf466b438Mx/FTWtBu7yG81ZsXVqRdNYvEDYR2zbDsMS/6wgjcPWvO7iO+03RY9V8cXXg+4 8QR+Er9bu6jUorQtcFW2l4gVtsEeZnvng9a9K8Jy+K9X8SeH31vxh4b1ZzfeIQ+bNfPuYo1xDFbt glWtQMTEH5hxXlfjq91Dw78JhPfz+ELu5TwjKZ9SXT5Etg014EXcqx/JaMxAdDgs2cA1+WZfWlKt TovlvdL3IuO86u14LTy9F0sv16rhYxoTneSSV9ZXStGlv78tdNH/AIu936tc6N4e0TTLnxz4X0vw zp4fwpptvHNYz+VbtHFLlUEshGIQW3KScZPavOL3wh4c1PWvFH9q6N4bmM/i/wAOTM0GppHNLcRx r5ct0HmULNEf9VGMGRegbNa3gzxI3j3wJNp2v6V4Y1C1uPDenxDS4y9vbXAWTB/hbZBkZjAU8jtX q8Pw9sb3UvEMlz4f8LXcb+KdFu08m7eOdmt41InuuDieAj90gADqBmuWWZTwtSr7WTUr782ukqVl fmT018u214zLKqc8PR9jTTjbS6vq41U9OSW+ndu+t/tZuj3nia9jtdJbShfxXniO7tp7htRhupbW O1YNE8bPMz4LjaYUOV6MoFfCP7c/w58SrpHgnRpNIurS783VmOnXChpo2TymYH5mHyjJzuIFfpR4 Yj8S+BbaGe00HREtT4jvbrUp7dnk+zRSuZIblWfdslmkA8zkDBOOK+ZP+Cn/AO07b/tC+FfB3iPx g9hN4gtkl0yFdJiiWzEESKJfNfbva4B2AkHs2RyK+j8N8XU/tqhLDwVuZ7a7xqK8vf0tp01VtVvL 4bxci6eUVqdWC5XHVt8rVp0mlFKmr8z7tWfR/Z/F/wAF6Bd67Y3dxLqlnZxxztEWnZZGXbz/AKtO fTGW4r1jw38DvC/iHVpbi+8WpNYNaAGNLNklSV02uzYYAorZKc8jGe4rwGDxCbG4uIxBp84Mxffd LIxBwOFC7Fxx7/WvoDwJd/EueVIdIl0u0G1c+XbRAlSN6gmTd1HTNf1LxFWxlNTnRrKnfyj+bjJ/ kfy1wRl+XYqpSjiqDqpb2ct9bbSirfM627/4J++F7jwwvjuy8ca8dLe5+xf2g+kxNCboJ5jR/LIC Ds+bkdPWpLf4PxfDvwfd2GlfEK5uIre3mmbTvsMlqLljhSrHzvL5JAy3A61614X8H/H3x3rTeGdM 8Y6dp4a6+yrb6jPaRW5njtGuvM2bSo3RqYlYD75C9TXn/wAXPAnxp8EeFm1Lx3qOm6jpN61tbzS6 YLSR3+1263YjV40DB0iYK/8Adfg818FhM/zHE1oYTF5nGbuny2jezen/AC61e60a8rH6rmHCeQYB VcRgcqlSaTXMpz/+XvS66p+dz470fVNdh1KCKK+lg86XyxMk3zbd+O2P5171d6HpninR4/C3iO2K yWF9cFtTExE1/FN5bIGBJ2iIowHc7jmvJ/Aurjw14ss9atbSC6khuSIrfUYPtELBgV/eIThsA5HT Bwe1e2JpzLciVu7AnA45Oe9foue42VOpFw93S6a3vr+S9d9tD8L4ZyqliaUlUvPXWL1Vv+H16NWW 9z9q/wDgl78eP2Vv2VdB13w18R/hXpvjV9aaG6TU7uWBpLNbdWBT/SFc4br8mDxXrf7TX/BRH/gl v8X/ABp4T8RWXwY0a80bSZrqTU7W21Gz097ydkCRIxjXbJHESzFGxliDkYr8wvgLZ6QdQ83XI5JL BFd7xYyAxhXlwpOQG2g44615l8f7X9h3Q7yTxV4O0Ca28KBILi2sbu8sbi/aOZfnbEYADE442545 5r+fJ4hYnMKmBxEJz5mmpQhT5ua7dvau1a7b0SlZxUov3dH+scR+F+Gw+Fp5rRap80ZcydScYJRU Y+7CL5Vo22+W9/eTUrM/Wzx/+1l/wSo8T/sr+IfCfhr4W2h+I2sWM6WF1NcW8y2krELCUuldX/cw hVBCZZwSc5Jr+UbxX4I1+DU3W3093MhaRLeF1uSyKeTmPeTjoePyrJ+KvxL+FcHxGvLr4R6fHDoK XIfTZruIC/WIqud+whNwbdjA6da6z9mv9ur4o/ss/FaD4n/BC8sNL1CCK6t7d9Ssoby3WG7jMcwa KVWBLr8vtnNf0TwVwfissw6nhIuXNGPuzioPS/xcu8tdXK8nbWWiP5e4l4hyuvUlh602mpy96M3N Nu23MrqGmlrRV7qLu0fR/wAKvB/wh8Q/s0eLfFfiDQbg+JfCer6ffte2dncSwLZXl3Db/ZLiVJlg jiKCbDSRghwqgktx1n7WfwT+GPwx8C+GvG/w38NePB4O1lrfUIpvGWnLplteNO0pWSzubdmHzRqY 9oJyF3j1r5Q8Qar4++KFlq/xkla1uYdQ1GXUNeTTLYotnJcz5VpliTy4IpHYiIFgD0A7V6b8af21 /ix8cfhT4X+Cnj2bRX0XwnHDZ6ZHaQNERHCjpG8wEhSSRVcjfs3e/Y7RyjHrHUsRSruUfaN1I87t BOMfdXV2km4/DZS2e511s0wFPAVsPiqa5nBezlyx97V+9p3Vrp32d7WRU+Deo/C7SPBt1c634IsN b1qLVUm0/VW8Rvp93bB1Aijjsg2J0R13F9p5OG4r7/8A2mvGupXPwrb4oeAb660i7+JU1lcfEvwl e2MjXMOqWEsr2t3aajcIvmRzHLFLMBIxgSYyM/nr4MvfgFrvhXTPD8y3mm+MVuLhF8SRXYXS0gk2 tC9zGYnlDxtuz5fbHevsLxN+0P8AtIfGBtJ+G/xM8b2Xi7Sfhxpk9xoTl5I7aa1VVM0FvObdJZJZ QBjdjJzyK8bPsDOWYLGQUlyOTam5NSjokkm5wUW0pK3JJSUdLcx6XD819RjhYVItTsk4cl00m3zW UZtpaPVxavq37p+heo6f8Of2lbzwJ4d/ZkHibxL8QtW8GJp3jG58OTT6ZPe3kNsu2K6RrVfOKbWD sZH83b1GQa/ZL/glda6b+xZ+zp4i+HvxhtNetfEF14outWisFtDKJFeKNBvlBAVtytuyOe1fCX/B OX40/D74N+LvDHj5ILi38lU1W5sZZQ729u3zMoZ0DbTkjcfev7L/AAV4z+C/xk8KWXjlYtClN/AJ jFei3knTPRX3DOcc89uR61+M5Nkcs3nXyPD42FCdN8yhX5nzwT3jOPKk4OVuVJ3VnsmfUeKWc0ss o0MTiMFKvSrRXNUptQanfm5WnGbaaindtdUrbH8p/wDwW1+Mfw6+Nn7N2meEfBy6ib/S/FSanLDq VskKfZBYzKZd7OVDB5Nu32yM1/HMmj39iLsvJaGK50jz4RBPG7iNp1UCRU3FZMgko+xsYOemf7xf +C0Pxm/Zn1T4c3Pw28N6Jp9zqul6hKl5LYLEoKLEwzmIElQc9RjvX8Rl1YeHLvUNXbSY2jUWpk2x hsKvmIMEgj5eRycjPbPT7Twvx/sY4vBRlGpGnNLngpcknpfl57S0lo3azadm00fO4rJIPB4OvGnK k5ptQm1zJNu12lZprVbPXWxyPhzwQPC/jGDSotR0rVhLa2l69xpM32iBDcweaYHcomJos7JVwdrg jJxX1j+yf8Kdf8YfG7w34M+EevPHrWuaeM6nFa38f9hXbyNkuLZZJJhEEV96qYzvAxlTXzt8I9Di HjPyAzkHZIMjafmjY+/5966SwuvFXw61GLxb4W1J9KvrKzbVob3T9QS0uIURiBskEisJc/8ALMHf jBA5r7bPasqzqYf2qu4rdK0r33X6K3Z6H1WQYaOFwdPFSpaKUtm7x+HZ3/O/3n3b49+MPxZP7Oeh fsjWeha0+o6FrOp+JbfXI3upUu7G7haCVY7J02KmFJ85RgqcHoTXyd4d+IniTXNO0P4Yal4X0zxh Z+Hf7dvLXQNRiEaSvdwSSTyyvC0ErG22GZA0pAZBgYyp+cW/az1Pw7ev4tn1nXlulhlsrOe1vZPP beMtGGDBkiO45GcHng1Hb+J9D+Mfg0poccVlODcS3Wo3rSjzm3eaFcgMu4Y2rtXkn5j3HJl/ClbD QbrUYxTd+ZJ6Sad29U7WdrRad29t1OO4ywOLk6WDruUlF2g2tY72WjV292+ljzXxMunR6xcabb6Z a2MkUsgukt4nV0lEjAoC0kmQAR0OOnUjJ9q0DwboOsaWscT3wlDMQVW3ZWgCRhOGkRvM3Mc4JGMY B5x4ZolpqXh7xLNbWc8UdxbSzWwnjXKjnaxAdAcHnGVBHtX2J4O1jx7omg3Wl+GzNJZNaSSXsa2q XMSRyJGsspLxv5fCqC4IwOMjPP1/EFWpRpwjRmvVtq/4P5f0z5XgfC08ROtOrT+SSdvua+en/A+b PF+gz+G5by6jmMlqJjatCEZZo93nQo8pEUka9GJVZCSOF5BI2rm51jXfE8Md9b3ShIFj08zvPJ5t pnELReciuUfqpI5zjArlPin4gvob650WA4+0tb3N1jfHhozKygKriMqfNJ+58pwBjnPZeDYLbUdT t7qxWUQ/2dAiiUjdujG2ThScAsCR0OOTzW9SE44aFepvZ6/Jenn8jmwU4zzOphoaJS1X397+W3U9 O8R/Bb4g+FPAkfxO8XaDrNj4cmEfk6vNaMtvI8od4dkk+yJi4jYqNw3bTt6V8ZaPb6Fq8d67HUpt SlvYv7MigjjaFomMhkDjczqw+TYq5H3s9Bn7K+JHibxZqvw0u/Bur61qZ0dI43WzmuJprZGiJEZW DeVBG4hcD5dxx1NfLHhK217wdqNvcWdvd6bfwwpfQXe6SCVlkDSW93F91l+RlKFT8w571HDles8N WnVknO+ltFZaq97+jt5aFcb4emsZhqVOL5La31d3daW+9Xt+B9oeGfFs1r8LfD3hLxVbaP8A2ZYe I76/a6sYoT4ied7eEMs7y8m14Tyw/wAu7zMc1758S/2jPHeq+EvCmja94J8OafZaNcajfaDfLpH2 N9RtruYSfvGjdEmEbfKsi8gfLuIAA+c/Dfg74ieNmsLu2S7v5dVu3SFvMDPcXexTJwWDFyCvOBu6 AnGK/RH4s+FPiS7fCv4f/Ez4taXcLpGm3NrYWUVrc3cngxPMzJZXcaw5abzcqyDftPtX5fnE8Iqi nV5ZNczaV9PivZRTfdN2fZK5+4ZXh8SqdOMVKKfKotpdvPfS1ldaPfv+Uttaixu7K/s2keWa1lmu VKbBE3mSKyoUZmYBADuIU5JGMAMfXPh/4cudd15b8xzMjvJFu2MxK7F7HDd+CeOMV4z440H+zre0 l0+/ile4LSzeXviMW13QRuWxuZlUONuRhgOoIq98Lkt7jWZ4NR+2zSPbtHZtDM6pHNuj+aQYYum3 cNoKnJBzgc/dYqUp4GdSE+/Tz9VsfnVfBRjnEKM4duvlffXc/XX4e/B3xN4q8K6vqEcFlbW/h6AQ Q+cxa4vkv2bLQQo2WaFySy5GVxXrVt4JvbSxluvs8kZvbTYIrdWR4zGuwpKXDZD5yNuDxyeK+A/h X4x+IngWx1vw74Tvr61g1ZrWLU4LdNwuFgfzIlYE5+VvmGOT3Ir3WXxZ4wvvCGi6Rb3l7aQ6TY3D Si6O1LmOSYSOlsRHu3Hj7zNznBA4r+Yc/wApxvt5JV4uLfZqytfu95L8eiVj+5OFVS+rwboPRLz+ zbsttfl5nyN+2V471yyuNM+C2oaY8Nl4eupb+HU3jlNxcSXeQ4MhOwxcfKcZJycnpWl8Bf2qviz8 Np1i0HXDaWUQEcNs8zIDuOAOD698cV+k3wc+A/gv4y/D7xN8UfEusWEN5pF5dpZ+G9YLPqOs/aUj FvFbncg3Wh3OyKBu3dOK8vh/Z00XVPBmq+LZ9HsopdMs5o7fTZQI76e/kgL25hg80tIiMjB+QAzK D1r63/XDLP7OhlWNwilyrVtp+827uzvZtp+iaZ+Q4rw4xsc9xeZ4HHOPNK3LyNacsXGN07NWkktN 01q0a/hf/grZ4l+Jeo2fwj+JNol1osk66ZM8DXDX0k24orIGnjiJMhA5CjaOTXpnxS0bxd4l+Okm s6boU/h1P7OtZI7PXb+w0wMkC+UHiuLid4eWUsCxJ55GBX48/Gjw/ofw2/aA069gtPs8Udpo+pXu n3EeAJdivcqQScEsCMZOPev1x/bg/wCCoP7Of7Xtt4a0Hwz4IvPCNjomizaXdXGlQRTXU/7oeSUV NqYEgI+bJwSepr3qXhxgqEKGNyTD8kasLtWclra70kldK3qkrNWP534k4sxcMbiMux1RSdKcldWj qn2td3122u7nkP7Qn7UFp4d8JJf/ABg0fwp4j8WWk2m2miwZvJPK0dLXOENvMsAdJkG7cQ8juzBW j24/RP4K/wDBZT4L/Ffw++qftOafBout2y2tvpemaFaX9yLiARFWleYeYiFW5KnqOinOR/KN8YfG ninVntdV1KDVbeV5UtkF+svmMkcW0bd5Y7QAuBngYA4rM0DXvGOkXEd9dQ6jbQBgxlmgkWPkjHJw MHtX3EvCDA1ssjSqTale94ya/wC3Y7pLvbXzvqfA/wCutf65yyXuxVvh6Pq/P16H6+/tj/tT+Jvj pr2p/wDCqfD9xY2es3B/ta3v7ckTw2Lg2ksfygoFUH5SScMRX566d+09+0T8Ip9T1bwtY2tomq6M +gavatpKm0uLJgwzLHsCl1ySsv3gcHPFfoLP8M/GDadputaloSrBqNrBd2dw8AjM0IiXfMgMB3hS fmIbA6lhVLSNE8O6xu0uOytL+S4lNm1hFqtrZtceYjBoknnKQws4yA0pKjOTwDXxOS8Q5bhcP9TW AhUp31TafVbtvpZLXay10P3vNfCGpiIyxlLNJQlGN9uyb0tt19bvqz83db/bB/au+JHw30f9nj7X NLY2jpBZWtopjurhJHU28MjBsukbn90O24+tM8G/ta/HL4X6dcReJtEGoQaTJceH7jULhZra5t79 lKeTNeREMWRFcCBmAIySOpr9K7zQLLxJOb3wz+zboUCWzWCadrmpavBqYtbeFgt1dag9jf8AmT4j DOvlRDBUfKw4PikP7BXxW1HQ/EOkX114fuLS78SXHiq3m8190iiOVI4ijRoAD5gbPABwMV+jx4n4 cpUZUsVhaVGDldq8NZS+J3pyeuut7P1SP5tyThXifNK6eXSqVppcuiei6L3kvX/gs+UE/bK8aa74 U1yw1XwNYapoWrWp09YybwQ2U6SC5MsU0bBvNAX7rsVVM4Ar7s+Dn7V3gn4l/D3UPD3hzwlpHhfS vs9toxluNVg+1xSLaqk84jMcT3AZizKpxwQrMSC1fHVx+wF+0HdiSbQ4kkswA8q6dfqERWXaGYDC jeOAT16c13egfstfF/wNarZaD4PfLJG0xlv4p2M6/ekX5k27wB8uDjkg1lneM4SxNFwoYmmpXurV LJPTVpzSb0WtvXfX7XKvDbjnD1n9by6q4bP909fmot212uVv2j/FetXHjHS/BupxNqlw9nbG2vbW N53nt5XYwETOu5UYMTgEr3GcV1el/ATUvC3jC68C+PvEnhfQkjiW61aNLs31zAiFGgDJDC7Ayq5M RAIfaewrnvE/7OHxy8e6uuvaloWreHWtUjjFtoUjSLcBD1cm5yHK5GVOB2Ar7V8O/s++E/hRrN9r /haLxAb7xF4at7mW2u5ZLywsr2PHl20lxMBc7gd5ky7hRtCtXhZrxhgsJhaOGwuLi5cruo8sveut b3cVZNte7JXW62f0WQ+Fed4vMb4zL6kKcpbuElZJPpZN6pLdb9T4j+LPw/8ADPw8uE0efTjrUDag LPVb7U7O9SFo5JgPPjRI43EawjzAuN/PAPQc98EfhD+znqnx607wU2tXNk114mNppepm3lW2dRIj W8ixSvFMYJMFELx7w7fMmBX2p4psPFsvhGVPFP2H7P8AaoC66U7yOsRJyT5zMOccdO9af7Ovw3+G kfxc8I+N/Hls9zrNr4gsms4bO7WB1ghnjfdEJR5RkA3FS77AfvcVGH4xqLDSUqs76q8WndvZtNWS X3JdGftOI+idmmJwzzHLsLOrCKu707JWu5K6fZX/AFR+vOt+HriJ3SGZ3Akmk8tCTIQcqRgAc88G us8Lnx74Okn0zQbKS5/tKMR3ZlsftLRpIH+ZS6MUwO4x0r7SuvG3w50XWLr4l/8ACQ6Zbawsi6b9 l8QajZtcwt5Mh+0O0cDxhYzwcZOcYzXwV43/AOCoWoWXxCfwrqviPWtSuLR2gudY0KaK6sZDbqNk iy2sJOx/4EZck5BGa/HsJn+MxVSeEp4XncUpWbWq1107NbPfTQ/Bc84Eq4SMZYlcil1kpLXR2Wln vumfkz/wVb/ZH/aJ8eeKvC3jDwN4C8X6xaQ6Td21zNpukXk8cB81JIt7RxMBvDZUHGR0r8W/CelX XhrU30PxRp11a3VjdRxXEFwkkMscjS4KSI21lYFR1GeK/rv/AGo/+CiP7UP7N/hzSPEemWXxIitP EWmT61polikNveWVxIhgujIYW8ghN2FbDdMqAK/nl0PxX4s/ap/alt/iXBrml6PruraVPq2uar4s v7RLeS4tWlD7TcoIhI8KKqKQWMnKnJGP3DhXjbNHldXD5hhFTpUYtqfNu9W00k2lbqk9ej6fIR4R w1LG0MVSxcZyqOzirtpXtd3SjfS9ubbexleFl1/V/FUXhTQUM95dSiG2trtTPH5k05jLSRFGJTB5 6YH6/VWm/CLx14Muf+FS/ErWLLRWvHvrW+tbi7ls9OBtnH2hFOXjDGSIIGAKs20VJ+1540+G3gP9 oQWmnape+IPFFvq+l6vZ/ETTZ7G7VrKSzga1j+wWcSwyXNu/Jy2HI2Ou7JrstA8Q6VN4l8PeMfi1 earfQpp97PeT6noEcCySTtMpeCJNrXg+0MpkdARGSQSoQV+d51neLqYTD4qjHlhUjzJJNycuVtcn u+lr8rf8p/RmQYTB18RXhiPecGle+iTa3V97X7r8UeUfCf8AaA+G/hP40ah8N9Q1qTwt8N7yC91W JteljuNTN3Y2bQW0C38djMQ0vnSBVWFUyVJYFQ1fV/hf9rf9j6517/havw7h8aaZrF9p9pHJf3Mm n6i6tYWcmnxWl0TFaSOh+S4fDsrTKrkbs1+QjftmfFX4eQW2gaXZeCNQsbK4mFvFrfhvTb9iBvA3 ySxmRziQn5mPOP7orrPDfx/sPi54vt/it8X9B8OrFG5tp9A8J2qeHLS8RBtBxZqVRwTuZguWC44z X0HEPhvLESeKrUWouCjeFS7lb+aDgruWl3KTSsvNn5zhM6prGqh7S6Tbs1tts7vReSv8z6v/AGgf 2hv2kP2g/Et/JJr+lxeDpLtUufDrverbajAkjFGu7dJWCu6Ha4icBRwpz8x7fVvjL4l+Ifww0v4X eKv+EcdbFUivb68tbi8e8KwiJWIuOItuMgIR6V8k+HfDeveM9bmsfBVukdjI0l39mlu1jigQuzRx mWYqG2rgAswZsHiurtPA2jzeKJX8PXMFzpXnZt7m8RIbiRAo5aLa+07sgDcfXNePiMowOHpU8PTj GHstYpRV1pa7/vO3W97abK36Zw/lNGddV1RlUdRtNuUrPq7eWq7b+Z5L4y/YmOtQ2o0zxRo00sML M8trpkwZt0rYE3kswVx0A/u4NZ+s/sm+L9sb3GseGmlxGu14LmMbUUIOGix0HPPWvtXQvAXi+61N dL8NSWokuBuKxzLArhSSpdni2kjJxls+laFxL458yWKzMRvpbCXSr+6aRJDLauAGj/eIFUhVADJh h2OTWkPEfNoyVNYuMku6gmr9/d2v/wAN2+zxXgbw5UcqssvlGT00lN/deT1sfAGs/s+a34X0u71K ebwx5MUe6eSG7eJth+Vl2x7XIOeQM59K774dfs6aTrmhxeKNLtSIxIrJNHdmOPOOCokJOCQcc9Ou K7T4m+HJtH8J3764cBMLJai5BkCYz5hViU2B8A9/Yda+rf2fPDr33wE06TTLh7edVR5mMqAMDv8A LVFLKACCxI3c8H1rrzzjrG0suWI9vrKajdXStbrZnhcMeE+VSz14GOFfKqblZ2bupNaXS0PTL3wX 4YvtE0u+tod109kq3kFxIjsk6kqxAjUjYwAK5JNe5fsWaf8ACrRvib4s/wCFq6Td6ZYTeEtVu/7Y 0ySe1uJBZ2MrSW4UOYXkkjLNG22Nw6Lh15BsP4V8PJpVjc3EjS38283cULRuYxGdoBTbkE8H7xyM 1498UPhx4l+IuiXnhA2FvHa3EcC5tWkSS4dHRhnaCS3BACjJHFfgmX58q3Nhp1nCE9HK7Vlza211 t07o/ffEHgKljMprP2TlKmm4pJX51F2bvor+eh1fwe+IXwH8dfsy+JoPgprPxfs7/QtaiuX8cf2J d3r2YkimhtrCSOLUnVYnDKFZVLgliQSBX0D8CtF+OvjX4ReHZfhdZLYazojRSf8ACUT6tYXdwsUi KpmGnTXMPlySqpXEv7wHdk5JrwH9nz9g3xT8JPib4f8AGPhXU9I0DWUto9X037VI89p++Doslz58 rReYMHCuoeNgGABxX0vp3wC/aK+FVxqerfC7xJ4esFcyahfS2t20Ul1uZ9puDa3EfnlCXKKF+XOQ OefZ4h4wyWGIq0cNjFNSd06kXvazi2oq61ur3WtuVauX8mZN4Z57yRlXpRhJpWXNF6X02nvura6/ cU9I+AHx08JJr194m+JVxo134w1C61C6iL6WHu7xQ0qOA95MFbb2UfJwF4xXwp4k+LHgX4afD7TP AfjnRovHL6dLHcXOrW96sUX9oEsLgSmyvJYR8jKpV4kEuMFRyap/E79jn9oaXxPdfFa98Za34haz mnu7a21TWLmViWQySQwq5IUHoq7gNuATX51eNvjfFrmkroTWuo26vO7XUFvcrCkgGBzjcSeP4h17 1+kcJZPhs2ftsPio117vPyL2fLJJrdWlbl0WttD5jizh7GZW+XM4exfvKCfvcyuuqulZ+W1j9KdZ /bE/ZT8KeCNAtvC/hC61S9h86a38O6a1tHDot4gZor2I3Nm8MsgLY3I2/pmvi7Uf2nPiRceK/EGt eF4/E2mWGo6Tb3Os6rfwQXc322JY4PPugW8hLXeVXcRlQVByTiu/i8N/sT6zZ22o+HtP+Kd215pQ +yA3GlQSR3qqY8sRHukjEyn5RgsmOQc48h0nwHNZw6hquv213bRWVq81h9uvYka6kVkzCoCsJGKb jsBBJ74Br6XKsmyfDRqOVGbk9H7XVu8r2SvbR+Xm7nzlbKMwlKlGlXXK9Vy37buyXT/JWOe+B8mt a3+1B4c8c+JB4Z8T6rf+I7a5toY/EUNkq3iuJBJOYH3xQqVMjgBMKDtI4r+gW++Oiax4v0bS/Ffj PwPqMpuL6TRrXwzq01/DbJNa3iyo09yiSu0kxBAORyCOvP5UfFf4CeA9LvNMvbDwxfhrzS4r2Rru PZIhSOPzpHeNAPK3yAhscKy5OTXmfiP4f+HvAHjW1XTtk2rWpW6t77RtQW9ijLhlwksYKlwAQR6Y 9RXkYvNMvzPE0MZG8XGDjFWVktv5mkltol13ufe4Pw3zHL+aE6sJXab1knqrq/u7/P8AI3/HPwN+ AGkapZan+zRrHivxdd3HhzRL+2N3M9pa6dqN15zXOXaRBL5UikJG0exmJ+bkZXxR8PfBf2n4f6bo eo6fqniqLxXaab4strNzKkmyWE+Tay+ZOsriVyZGUKQSBt29dD4f/CPxfe/B7xVeeAI5LbR7Ozgv fE63mowWf/Ev0+YtEpjnUtMBLJ9yP5/YivnzxB8b/il4J0/R/E/hDV9K1nT9DvLfULLSLeW+MOm6 gLiN0bytkMXmS+SkbctuUDuAR9Rl1XFYmXLQruai2k5S1d42Sk0mlrey0vpK7bsfkPEeRfUcVy4i mk7JvkiuXe+m3S135tWtq/6Tf2CtO8DeGfhZrug+BtUj1O3h8XahLcOLNtPliuZCrTQywuzEtFJm MSBiHVQeOg+cf+Csl54lHw/8L2/hRkjmudSurQ3DyrCIxLFgnzHZUXjOWbhRk8YzX5g/A/8Aaz+I v7NviDUtPt7vTrvWby3Or6pbyxSz6dbzaiwuZImbMbLNFu2yY3begLda+ufiX/wUM8C/Ey18C6v4 e0nR/EWu6Ulze+L7a+0i7vbfRwkIa4ubSJpoEnCEMQrO2VHNZVssx2H5qkaXtLXeuz6pt2Ssz3aW PwjpK0+XTpv2aXW58meKPCHxctvhbZaCPKXVlmguJ2t7yO/1aa5Q7bZbZYMCOI87EAYkljuYMAOR +EGjeJbTT9bs/H8C3NxZi8j+xavcLFcQSiznkExhdSwlhYFsfxPhcgmv08+Gv7b3g/8AaH8RjXod f8F2Vx4eu4EsNS0DQLiyvreyulDSzgvI6qd0ZWZCSDwFODX4r/E3406l4i+LWv6rpxFxHqWoXUk0 8gEEtxHcF0YuIcAGRHJYe5ySa+c4fqZjjPreX4nDKm42k3aSabd7LmUXay73W1ktX9FldXC06uHx 0arlq42vdNW30Xd9F5n1olx8P/EGs20fhHRzpGoRWlq93eXGqGW3lEJZZSI5lXa8smXCq5xnaoOK /dbw7pfgvxJ8GNG1jR9VFpDofgySOGGK4eV7rWLayeR0BDeWFtnw0rqysF27UJNfzmWWlXWz+z/B thNex20tvLBqbqyPPEUEhhWPe4G2RyAxPzADpnFfrnezfsraB8B9F8JfEg/FXw/qV9o8U02m2HiC 2tNLuNYltQGmuLDymeMF8I6yASAJzgkZ+X4jwdOKoclZ6N6fFKzXZtvbZdNdj9BzutiJSjGOHleb VtOVXV+a14pNdL+d9j81NV8Xar4l0Dw9p51S18Szp4klGlajr8N0morbHEZRVnkktnjmmuGcbXeS NohuKjANQaPqmm+PPG/hfV9J1jXpY/B1vc2s2kwDUptIYXEaS3ckkUzCJAoMTB26tgqDiua/aZ+I I0zwD4S+GzTG/v8AwzHNFpMOgfLpkdtdSFriSZ5nZxdySojnYqqcsSOlfJ2haZ8WdZup7vw8dZuD qLQWN1bae7SXc0aESDzlVTuj8zvkfMORX6plOWxxWE+sOooRd/i0ek7pp6WTS2trdruz89z2hPA4 x4P6vKUoWuoq6V1qmlzXd+t3tfsez6Yl5NrV1pLy23h+6vJBp2oNqlrLDGPszGVkuE8qV/tBlVd7 qNxPykDJr0HxV44+LxtNRtdJ1eG00rUtZtnvfD+k3MFmZ7zT44mgnezjxMF3bSZAgDkEZypxzXjj 4bL8O9Rg8J6m+oajORHcSa4YLmKGS5mILxxtdRocI2cvt+cjNfYfh34T+EfAsmofFfRvHfgyTxTo slnfabpVnBeXWoRTJIgZnaaAW21EDFiysmDjuCPExmfYag6Nde9fSPuN9Y2d0m4rbV7W7nvUOHK7 p1KE4cuq5le3R2vfd/Lr0SPAfEPw98EaXq3hjxP4Yv8AxZf3at/buto2iER211aL9oLQItyWngBD K5OwIvz88iv26/Zh+KkreH2+IWn6ResPE3nXGtaJfaXBc6TqtpflfMtLqaS5DTQ4GFBj+RuVIPNf n34y+CHxT+Ovjyz8T6J4gg/tHVI9X1m91S4FzaaGg02MGbybvYkf2eXeqn7qAttYAEZ9l+BMzx+E /DuiyXV02nXmnGG7uJ7aNYI7iNiJUhMUkhlhgABjcqOvAPFfn3EfFFSvg6EqGI/eU5c1tbx+PyV/ haXflPreFuGsPWxtelWp3hONmrXuvO9+/luZ37bPwB1D9nzx9pf7aHwD8IaBqHw+hhjstV8PxaLZ vqPha8u90Kfa41UJd2r7ysFw/wArNhZCJACewfT/APhTf/BPuPwx4Sga68V/FqKLxR4sTQbOC3/s jRQ4bTtLuFtmYq0rb7mYYyx8sMFr6T0zXfGGi+MtQ0qGKXU9KstOfR7u3effbzWF0oxbNFI22WAs MkLGdpJbggGvgb436votn8UPEVzq1nPYzazp62ksOmXAgsk3KgRTPKJJDGoUNuYFsgDHQjsyrxNl i4xoQw6VbkXNNPRpS0Sje6vGTvrZX6p6eDmngssBiJYlVW6KbcY6X5mur62tFrTt1Wtj/gnN4Y07 wX8Kdf0nS79NStz4ruLiO5QbT+8ijJV1wNrKcgivon4z+ENI+JWlyaFrOo63plvpqDU5ptHtBext GhDMbxPNj2xoBlDu+ZyBxXyL+yf47tNQ+BGq2nhq5tNB1s6t9iVtb1C1KzXMSxLJOjLHEvluoO0F WPqxPNe56L4Q8b6lrEOh+LPEsF8+otI11LYSOtvJb+RhbeXyim4bjn+LnGB6fW+IvFlXDYSUXW5K ujb0bstW9mtbHleD3ANPMMS/a0eenGL6ta3VvPqfmp43f4NfBf4qP4X8Z+M/Gi2iWy293Bp+l2e6 90PUR50kP2gzloZiWGSY3UcgHgV+kP7Ev7XPw4+C1tPYfB/xVea5o1uRax+Gtb0a3mvksbm5WdVa c2sBDlmlzMJZWYoqqqLzX5M/t8eGI9M+Ok9ysEMtwtnpgtgkkplSOC3KMgQgKcvg5J3AL25FfTn/ AAS10vwl4j8UajB4uvdAeKysrZ7a28RyDT1NxbA4juLuLdIIgCfKHJdgQQM1w59R+s8OU80qV5yb hFtLkWr3a5Ypp6vXmT1a2sjSnh4YXinE5T7CPsozmtpN2SdlrK3RdHbfTc/TP4o/tpfHb4rHW9Js p50ivHnsr25S3EE8mnb/AN1ayxIGCFNoAOd2eC3FJ4B/aX1PwB8KU0LwKdYGv3Ur2d+ty4NjPbyl slxG/mEo7J5fIGR8wr9jpHtfBvw8fxl4LEOu2RsI72DU/CdpbtfXFwztFellktY4PsyyARkx/OVH Tdk18g/Fz476Be/DiLwp4W8N+JbLWrLX5bOOw1SS0WJ7rUMSS2d6gRSbeVSduyRGH8Tiv56nmDqP 2c8OtHfWbd21f3nb7Sfptr1P1HKsRTrRVOhhfc5rO1klZbuLUWre6rb73S5Uj4K1X4ifHK78Ux+F br4pajfi7iig1C8srq+CW1tEoLLIk6wGXyxkBUJyV46ivkn4567480I+K7+/8W3N/IpXSln1OC9Z 9ZtIvLYW6TMkkcabkVnWSXBCLjO0Z+1tEg8QfHTxGnwqu/D/AIR8F3d3Je6rFrAsns7lpIkkmFuL i4nWNY3P7tTnAwOTjnk/hZpMnxUt/EHgjWpL5dE0p7RWs9Vvmn02xbynd7i3toxvEruu1mVHAQtk DIYfSYbNHho/WakE1GzkvdvbmWqfK7tt6JeevNZmHFuV0nh/Yr3X/wAB2elu34bHxz8I/ix8TfCX 7K/in4f6Z4h+GVp4f8XTE3ul6nfxHXrSZp45BLZ20Ye5k2gYK+XhRlsk5x4X8RZvE2mafq2reDPF N5qmmXWmJY2mogyKqxm4CmKffaxEyBW5KKE2ngk8V+l2q6sngzwzp+tfDmw+EL2FxrMsCeM1TVJr lL23G+VWkjs1ZFKbQ4V1HPQZyfPvi0P2fvC/7EMGjrfeHNV8Wa/4kluZ5LZLpbS3iLiTdgv5zALw crnp719TkvFcvrcZrBu1Wpa1k9He8pK2jjy7c13reN9X+TUsngqE/wB5eyfva9tOu3TZdFc/EPwv pnxmvNWl0f4Xa28Gs2Au5LFrKVF8m2jUy3P7xipTCZ4xk89McyWLftPeJJrC2b4m+IJ73UbmWyXT 7BL27uPtMab/ACo0iIErHgEIeCw65FfSnwC+I3hLSvFOqS+L9L8H3Fh9h1TRdPtr65ltEt9Q+zNH bX8su+FygOAY2l2OeCpNeheBPil8P/h/q1x4C1nSvDKeE7zSYdf8fat4aivNRvNWsJbqNYXjn+2E Wk6FxMBaiMpIAkodRtH73X41x2HdShSo62TSUYu9731a1d7WSWsmldJtr8ufDWDqxhVnJtttXu0k tLaJ+t29LdNLP73/AGc9G8Q6DD4Y+LE7f2lfadoFtA9vqWjR6h9snSEMzSvO+ICT99ijeWMlunP3 h8Rv2wPF/hqLSZNGt0Oqq8Z/sefSbezffMp8t4Ajead2VRdqgMGz1r0b/gnReaTrPwQbxRe25uWt LDTr+DSBF/q4b6ICQcuqzO0ahREqBmIwOuAvjH4XaTH8YofHOuNA0vk+Z4etr998jkMdoeCcFUiV sopXcA2Mciv404hz6nVzWr/aEdI8zVno7PZ2W13vq1vex/TuVUKVWPsKUE3FR1lFPeN9L3e1uln9 54t448Y/tm/HPw/Bba94YgfRreYeZ4Rura6S5vT8zLI6hN6gEHDCVcgj1xXw94isZ47CNTBuYST9 c4BDEc5445r9W4Lvx9rNw+saHotvpdzZyCya4gknfzZJ8ytEnmwOGdiNw6AKDjA4r84/EFlPFYwK MHzpZFkyO5c5r2eCM5lU56apxio2sot9b7tt30W+/TZI8rPsujRpSjF6drLR310Wmv8Amfmh8dvC Gir4wsvE91d2UTJaxiTSVllF2xictvUpC0YWQMQvz9Qc44zufCXwz4l1FdU0f7LPd2NzoN9r0dsk UcyL5dtJtmZbh403xgE+YCZFwdiseK7f4tyalL43/sS2g01kgskuYJb6Hc8MpbbvRwR90AYDEpyT tya5jwt4C/4SaGaO01G6S8hsZ7uUWsc8sEkUERkkVlhXeCzELziFQSW45r9ixeYyeD5ak7ab25rL daK353PjcqwsVV56cf0u+u769tj9iF8P+KNe8E+BrdrGxS7h8LsvkWNmY1t9PdYxFdSqLZNzM27d Iryk4OMd/YV8N6F4m8U3Gm+E7qyN7YWkMrShQkSPFmORJYpPs28vJypJ+UZ3Z5NedfD/AMXeEvFG seC/BHwg0TUvEF9o+hy2mpWlzp/lpDP5G+SQTRCSSRWZTtDjhgAOpr6ii/Z2+M/xS0K98QW3hXXL D7RFbWLaSIXjkt7iIbopjldxhMb4diQQwIwcZr4LB8J5zi6MKtDDSUXz2dl0nHmum7u3tIdlaave 56FXE4OnJutNdN7Ly7fL5aB4G+EcF/aR+I9Vh023DQTG7ih1aKWbS1gRYzJIVvkjd32kxxbRkdCQ Kj+I2seEfBXw10S+0C1ltvEUGo392upWckc6zwSSbQGnhuJ3V9pHyHGASOcCuj+GPw38a+FvGGt6 LeNrsGjxbYr1tUF0Vui0YhiBitoxvxNuK7VPy9eta/xBg/4SLxtqHw6nhuln8L6F/bkfh6zke1jl tpUHEqTfKI5H2/KSGJB3DsKw3hpxHLFKisHOadlut3OcFFNysv3lOcNdrNN63ZLGUJTUXJLrp6W1 3v8AEultnvY+fPCXinXtd0/UdZtrGSZIFt01m+08SPqMCbmFt5aYw6pwAzooByCSRmqHjP4VeM7y P+1bu11nw67QWOnxS3scsGqX1jbpuMRMNnKWbfhtqrj1Jrc8M/CP4zafpyaj4L8MNYya7LHpup22 q32nKLLYxLysAygp5Tl1XrwBknFeG/EX4l/Ej4WeIbX4W+PtKh1rQdQ0ySa11TTLqAahA9ldCBke 7h+0NHvQBuqZz3rXG+Hub4aEcVTpxUZuFvfjJtTpxqxsuZrWDTV9LaaS0Mv7SwylFymnbf72l+Kd /wBLXPwy+IHgr4j+JvhVcXviaz8Niw8BzRalp8UtzNHeXUmpTqsUTW07IkjSBzISqAlQWBIr9vfh D+zZ8Yf28PCGkfC/x34h1Ozt47CK5t9N8VwTWOj6bJDJueG1Mc0nmnYQU+VGxyeDiv54tIuvE3jN PFUXgLRru90+xa2fW4NSlmvoUuG1BYormDaY0gcBgibgxIyo+9iv2L+Mf7YnxA+BPh7VJfB8Wn3c mnC0K5juBLHukMDQsVkVdpByxA6gYOK/TOJsFmHPQw2As6im5W0ja/K7PWVuaTvdWevkfC4CWHlQ rVai5YuLXM48yfxK6Xu3stLX29dfvR/+CBUt2ZZdF8U/D9pbV/IiRpLqQNKMZdzk4wf4TnpXstv/ AME67X4YyanrPxe8f+FJNegkm1p/7Dt7OxW53QPGi5kgabc2Sm1WC9CBnmv53/DH/BQP43eJvDuq 6lqvj7xNpuo2cts1hpFhpiyR6isr/wCkAzDHktGucMVbdx3r7l1z4seBvGvhttX8G6t8Sr7VJfEe jx2UuqeTNYwWNzIRNb3r+WjCQYwmwH3xXx3FuUcSt0sPi5pLmtzJSmktNG5paS5lrFtNx2umjPhS dCVSdbC4hKyvyqnGLetr6Sltr00Tvsfib+1F8Af2z9X1HUdFs/BXitNIYW9/dPqNlaw3PlRf6MGS ZFSRYCzYEZPzFgSpPNeG3+ieIPhx4ft/COiQ+J9GsbpZIbvTNXxDPIRMSY54oiqNhlBAI9DjNeHf Ho/E9PEuoeJr2816ezF6bZ5bu6leKOXLFUUtIc/Kuegx0r6r/Zy+HOn/ABY+Hel6n8WfGq+GNJgm ZpdRuEn1DUJnW6KMkUaMWHlRv5mX2gqCFJIxX9OqrLKsup4nGVYSpxeqp05tuVtPdTm5SVuiufl+ AwtfMs3q4alFqclo5SSXKn0b5Uo79bFr4FeDdbl+KOkabq2rS+EoNRZYJtaup/7Pjt4JvvO88jIs aFQTksAccV+kWg/sO3Xx88Z+KNL/AGXfGVr8RJdLS3sboeINQTCvfRBUntLkSyQyJuBV3coVAxg9 uM8Vfsv/AAt0Sy02Hwd4r8VfEXStank2+ItOvYrE2k1nEjz2c+n6psLNBG4YP5oT5htGQa868L+F PjL8MPD/AIv07wVoelv4Sv4I7fUNf1pdKuNUgGxHxHJBcSOiAkb/ACs/LkMQTgfk+ccVyzeosbgs V7KSUYqM0oqXva3UrVFLRxUXyyuttz924d4cr5dhXQxOHU4ybd0pSlF28nFWW71srq+q04X4nfCX xH4O+Jdx8KPjNr+g+ErTS4I1u1spJrnTYbkBPMS3isopAZFD5boOvzZ6+HeB/Dfw8udL8beEtKsd e1j+3zp2l6J4hlv4dI0zTZpbzYkmqrMhjdHPCnzkSIks7EA19YeIfgl47+FfiCy+KXw18TeDvEsO lwxJNq88EL6ZAJBGsMk6XhdCsryMoSSMHKHqenxD4r0HwJfeLtVfx5rL634ma9U+GtK8Jxxf2TeS Xe/zxI0YUwlX2+XHGh3+wxX02Q5tCtRcYVudWjfkTXvKSu+SylHo25T03asnfzuIMFWoxc5YdQld pOcr3TjLRPmaa3SUYO+102j7Z+F37Gvi7wf8H9Wn8QeK/Bnhm41gzWttA2rhZtZ+wjDQzXXmGySG 3eMyIcMzsy4yCtcP8a9Ce7/4R34gp4f+Ilh4Zi0KHTdIvPGOrLrlveajbrJKywm3jjkSByxMaqMI uWbO7jb8DeGPFmn/ALP3jbXfi3eeIIW0mKTw7ofhvUbRbqxgkcxz37C8uCz2zRMqK6gCR2bg4DCv zJ8N+IJNJlk1PRbi7tdQikZ4mtCYkjiI2syFMMsnqQfu138N4XFYvFYjFTxSlKE2lyppe9FWs09b KybfNbVJ2tb5XPMXTweEw1GnQcFKN/e30bvpbq72tZ99T9H/AIRftHWtz4S8d3njLTPARm0Xw6L/ AEG511njnu76OeOMRW0b7/tcpQsfJ+QYBYnjB8x1DXviJ8YtF13402elNDo9n4ek0e61Hwnpo03Q o5vLaUQ3MRxmbLcHqSoPQg14ZoFp4v0KwP8AwkFn/Yeka3a5uH1aCKKa8ttzSiWxN3EzhRsxvhOH YbC3zV9Q+B/Aui6V4E074b6qPCmmab49sbrVtF8fa4Z/tmn6fEZreTzIbdJSke6MlxtDnBIBBFep mzp4erOpRjzOUo9eZKKS57K61XK5WTbeujei+b4Ny/2s4OrJw9yb21blbl76a2vZJX32Z4RpHwc0 rxh4X0L4jR+KNLj1bStDKr4PEF7NqlzbBrppLtfJt3gSFM4LSSp3rxrwlN4ekvPB2l6jbS3N1Ob6 301lcIFuJLtljLElVCgnnJx+FfV2v+N/CPw78O6d8KtDu/EFv401CyXTk1XR3FhpF/ormcG3uIpF iuGEzYkzI2wAfd5JHyFrXw58c+G9S8JPrulXtvDaPcNPO8bNComuXaMmZN0eHXBUhsMDkZBr6PKc ZOv7VV6nKpN8l7J2tLayi3G70vd9H0RpnODhh3CGHp804L95ZXW8N9ZK6Sbvt1PtPwKLTxD4dk07 41at4B8Gx+H4Lrw7P4gWziv9cje1WRba2tLSzuY/OR5YwPtKK4MjFmdhxXxF41tvilqOv6Z4V/ah 1rxPocNtAbrTF17T5ri5+yXIDK8STSRPskAUgliuDke/p2qfC39n7xNpGl3nif4gWXhOay8Lm6tL aLQr+6/tC93yMYFcSHa7PhTJxGeq8V86+KPHi+NdJ0Pwp8RdlidG88trUNrLdaxfLMo2LdSzzYkS HaqRKoUIhPWuXh3Awjiak6CaV9b0pRcNHZ03JNSvqpcvMldKy1vrxNmnPhqdHEP3klytVU1PVNqp ZrlSVrXtrG+t7L7F/a8+FH7NXwtsvh/rXwL0/VUs/Eng7T9Tv/7Qu3eWPVGk2yl9+5SAQflTauMc DNcB8Q/DGuXOhrJ4g+IPhy907U7loLPQ11G4up/DMQvU3tqFqkB+zLITuUReYzAE46Z4vxj8JvgV 4X8NWsngnx/da1r0y2moXFhd2McNpDazL5saLcwT3ANyw2hoWVSjEq5BU139v8e5tL8MeIfhr4i8 H+Fb7TbO4uJ7bUTp8dvqs9xeEQK89+AXmjtyd6R9A/PWtMoeIjg8PKhUniHCUrucXGTV3a3tFfS6 SatdK97XOXOfYzxdVVYQoRkoq1NqcU0rO/s7J3s5NWdm9E9yx4j+FHgXQ5NV8YWPxO8MXF7c+Fma XwjYxap/aEkkcHkrEzNarbcRj7QGaUDaQv3/AJa+PvLg/vzflX6Y+D/2PvAPin4E+OP2l7zW9fk1 vStIS00nRNM06W4tfN8iGOVr64WBo4I2jctCTKCxHSvz2/4RnXv+fS6/79H/AAroy7PKdT2sY4iU nGXK+aKjZpL3VaK5ktubW+qu7GFXh7FpRksMoqSurNyun130b7aW7H//0vwQ8LeIvjFp/hvVtJ0W 7ivNPtrJ73ULS/aFI44d6KWjSQqTIG24EeX74IzXzp46msNTgbUrtUguThjHBgKB6gds12fw28O3 /inx3aaV491N9ItJvMke9vInlQ7ARhgpBJJwOO9d9+0PZ/sxad8JdE0rwF/wkyfEGK5ul8U3F3Jb yaTLakn7MLIIPNDAcSbyeeBX8lYBUsPmMaEY3lOzbhHRJ6Xk9nquiutL9z+zswyTM8Zlf1uvK1Kn eKVSet1qlGL95aPS+je3l8I6n4huNNnSaxkGEO4MOuRyD2rE1HxtrWu6nNqusTyTXVxIZZppWLvI 7cksTySe5JrmddglicvJuC9V+lY1ojTTqHJxnt1r9woYOmoc1r+Z+Ne3rQqezu/Q+wfA37QnjPwZ fWc/gfUNT01bSeGe3jF05QTRYO4qhVW5HAI6cH3+rf2nP20vjj+2Zd6MvxKnT7N4ftWhsbaPc2JJ AizSvI3zM0hQHGcKAABjNfn74Z8M3aiO7nJWORsxgbXJA6EjPavqXwh4Mu9ZKR6WXug7hLmJFBaM f3sFgSTg/mOa/LeIsuyujiKePlSj7Sne0nur7692tN/zP2jhfG5zmFOWXOrJ05u7j6duqW10tLJX Wit1XhnxX4ttJtN8OeAfOe72sl7LIo+zIrEcDqWOO4AOe5r9SP2VtI+O+u6xeaB4KMl3q66a4gSS 0MfnS/eYRuB8z4HArwL4Q+BvB/w11Oy1O8b7fbyXH2a5Gzy5ImkA2nyiS2QenGG556V+637Of7Um i/sy+ILb4keFdL/tYWFm3l6Y8AmLSuoCMDt3xhQDu+YE+uK/lPxY44lKCw+CwqkpP4mk/tatp2vZ PSPNG+3Mr3P7i8P/AApzbBYCrmNLEOVanF8tFT5Yv3fdTlsrvd2et9j4svL/AMS/s56XYXHxj020 sdble7uY7O4t1EsKXCnccbS0Rl4LngsMA5r5A+N3x58Nav8ADFtMk0zQkvbjSFsYpIbXaiFrlXWJ FMQ/cgjcwyBkkgHv+pn7XXx01X9uTx9D8RVtfD2mW2oWMJlgu7PbPEVTZt3FNzZKnG9t2K+Fvi5+ zXHf+CZtP0ZYb+eztY5o7ayXLqy/MxPGeMZ7+lfFcK5ngYYmnVzCLVTnvp7uik+W8btR3u480rPT me7/AFqfDue1ciio04wk6K5ot875mlzJT+12TSWuw7R9R0i78CavceC18Ky6lB4f0m0Z1iItHjt9 rSLIFAYxpzgk/ezj0rZ+PXx48HfDXwhe6rpGmaPczXep2OozakkZSKW8tEADOcjdJEAojPcYrY/Y c+H/AMD/AINeMtC+IX7QFlqNn4ZTfdardS3aRxyQrkSRPCwYyhuVC5HXjHWud/4LA/Hz9lq/0+X4 Q/s4RajaeAtVWy1WzsrSOzaL7TaKQWEro1zGwZmDr5uGPXIAr18rwlLG59RwVOnKpT51eWqvprtd NR9mtOZNOS922p8fxDxbicJlc3VwzpVPYuam0vZJqTik20n7SXO3blaaV7n4i/FH9vT9oHWNC1rw B4f8R3Wl+H9cupri+sNMlmt1mEjbikuJCXQHkI5ZRk4Ar47j8eeJJNIgiN/dMVnlYSPMz7VcKGUK ScZIyfWsLxR/ZSTyJpqORkkGUYYDt6isG1sJ5kjMbrywDoOCBX+heR8P4DB0FHD0FBb7JXfd+Z/l PxfxTmeOxk6uMxLnLvd/cvL/AIHY+nPhT4luWsJbANfXt4zmYx28ZlKRAck9cCuwl+PGk6JGYo1v pJcHDbwoB7DvX3b8M/iJ+zd8EfhL/Z/guOxvNbfRsXGpTRL9qknnX98BK4ICL0C9gK/GP4ma1Fq/ iO61G1MSi4leUxwqERCxJ2rt+UD6DFfCcMY2OeY7FKrgpU6cHaLlo5d3a2i2sfU1uLMbkmCoQwmI jKVtbK9vm3q++h9AWX7WXjC1c2swR7Y3InP3TLkIUxuIzjaenTPNenSftRaNrOgyw6tYh5EVDElu oBYogTDdMAgZPqea/N6JLmS5ESMSSQvHNeseH1k05pba4BRp4dgEq7MjvgntX3OYcH5bFKUaKTXb Q8DL/GPiGDnTliXJSunzJNantlx+0FZzSRG000WbR5dnQgkOehUnpXofg/44alrUkE8V0814EaNk lzgE5CtgYB6gmvirWrT7LcMiYcZ7HNV9A1q80zUhPbM6YX5tn3uvA+vvXXiOGcHWovkh066/nqeR lfiJmGHxKdWWnWyt89ND97vAn7TPg/4J6Xban8QZDdRTsYikcTPIQi/OHCj5Q2cKT1z6Cvza/a+/ aN0T47eNjrvhvw7pnhjT4ohBZ2GlGUxmMEkPIZTkuw9AB7ZzXm1l4T8W+Po3u7+8muDBbm4kV3Z2 VI0JAYnC8AY6/SvCvEt9IXWGMbcKBk9q+B4S8PMtwuYSx0G5Vlo7NqKT/u7P1d/K12fqnip4xZxm 2V0cBUp+zw6+Ffak9L3fqtul9WzDk1sZkc8swIUkZx9CelWvDOvW+m61batPZ2morbyBza36F7eX 2kUFSR64Iri547lbnyHUgE5U9OO1bdlbSSHcZIxzhwOWH0Ge9fsUqMWmn1P5soYurGpGadnF3Xqf Q2s/GXxHb6Pq2neGI00Sx11431XS9DaW10+4ETb4Y5IQ5WRIm+ZA+7a3Ir5+vb3U0uwrEYdQwZW7 H+vrXU3N3pdtpqRuGdsEMwYblJ46e1cHezkkclyMBWIOCnYcnIrhy7Awp83s4Wv+PT8lb7jTM8dU rPmqzuz7B+BXhzxN4jnV/DemX2qrFGz3f2dSywq3HmOQvyoO7Mcepr9EfgWdN0LxAYt8c1zc6Re2 rafcK8UN3I6r/oUsqumI5AGDOHA4r8w/gb8Q/jXoaaloXwon1C3h1PTJdP1kWLOimxlwJFmdCAIz xndwTwRX0dYa54h8H3Yv9S1qMyWpRdkZ+5LjICDA5HHPTivzXjHC1qzq4eckk/hSvd/4u2u1rep+ pcDZpRw3sa0INuL969kt/sv0739O/wCr/wAP/GVlpeqac6XCQI+kMI/NkZTKBE/ygMv3c9FBIz09 K91t/wBtv4laNrGuaFZ31wYft9xawnMjeUsbgKE+TjC8DtjtX5KeBtSTX9e0mGaUyMlyGaQncFAQ 5AJOOSQB7195+FPgdpmt6PrXim5gmMserXDsswEYAO0gA/xFiG4ANfzxxHwxlXtrZlFS00ur/a8z +kOG+K8e4c+F92Kum09Nl5aeX/AO4/ac8Yaf4usLLWNOvrm6a406ylvpXiaJjdPaSGZG3MN2D/Fk ZP8ACOlfldoOnfa7vU2tNzYtxv3onDeYnAyf1X5vbGa/Tv8AZ1+FesfHz4nwfDWytba10yW7WyZG mjjk86UbA6iV8lwGOcetfaX7bn/BLvXP2Rvh5aXVx4i0C41h5U0y+0yK6T7RDasfNWUR7RiJgRtG SS2eeOeHIeOcDkkv7Is2/cXNb3Y83M4qTS5U3yu0b3dm0nZ2+kzfIf7XxNHFymozmpuMH8U1Be9K K6rz0XTTS/4efBTRXs/FcrXKlSJA2HG0geUxB+nPBrzT9p7R/Bmo6Pplz4NvNvlaUg1eK6mSYvqB ZhJ5BjUBEKhdqNll5yTmvtH4v/BP4qWXwov/AI06hqpn0mO5tPDMGtXQlXzZIYtsdjAyxsheKHBZ d4AQjk5xX44/Gu6urZv7NtriRVhyNuMB92ORg4P86/YuGIyzHH08VCrZ6aWdvh80rr3lbTzPynxM zqnl+TLKlRvdyd27Na6bN6q2t/uPn/XLgxqLZ2y6HjJyceorpvC/xL8W+FrcWGhOYI3+Z2jLA8dS SCCOMjGfwryeeS5kl2ksTnKZGTk/nXpvhLwd8UPHHiPSvg3o9lq11qd1fLbaXo0UTy3L3V8VMaQw Y3M8xK4GMtkY7V/Qc8NBwUKiTXn/AJH8j4bMK1Oo505tPy/I+kvCfjr/AISXV73Vb+5lu3855JL+ cuHuXdstI3mHcCx6lufWvoiH4o+Jm1ex8N+F5pbN7uB7XUI45QkcqBlUq53AMhIGQcgnB7V82+P/ AIK+M/gLdv4I8W2l5aazAxi1bTLqF47i0uFGJYZVYBlkjYYdf4TwQK5n4TatoE/xR0rQfiNrjaDp d5cJa6jr/wBmkvDpVpJIPMuhbR4eby0JPloQW7EGviZZfhswiquHtKK27dr9vP8AI/W8l4wxOWr2 VSTi5NczT13va++2nXzP1K+I3gj/AIS74Z6NqGta9plxHp0F3b2Wi2cJ+0WBT7bcOLmeO2Ecvmyp uQm4chSQBgYXyTWvjU1/oWlHVFma38PaTFothZvO0yw26MzssbOBsR5ZHk2DIUscVx3gTxL4S8S6 xP4U8HXeoXU8aalZwSeSIba5to45EtpkUtuEkqMWKMvyk4BNcj+1N8DPi1+znqelw/E3Sb3TIfEO krr2ix3gT9/p8rNGrtsZgGYqwAOCCORjGfjMHl1GFWOXYmr77bcYv3Xv71krX9dXre+rv9xmPFlS pUq5rhKXupJSl8WtrJtvb007WsWNS8d6J4nW40ue6WDzraVolldEXfGpkVSZPlySNuOpJ4rzrwRb HxDrdno1k0j3F4yW+ZR5mJOc7Qm47B2GMgV82aOtjq2tKvmz+UWZ5FADS4H3QoJwzHv6V191ofir wlGfFLw6pa26RNLY3CKVEhPAdH4BVTwxXODxmvtVlVPDxlRhOzktL9/11sfn2K43rYqpTr16d1Dd p9D9HfGX7c9n4U+EOlfs/RJol3pug6jc6vHdWdlGuove3CCN43vdu9ol2gqp4U5/DyDwD+1d4Z1T ULa/1WK3+3/a022t/ALmCd2bJMikYZfZjnPSvy5uze3cEmoFZGzLhpc8b25IPbnnmu++Hnh6ae/T Wr2c2qW8iTxoQXlmIIIVBjbnjqa4qvh9ltHDz5m+Z7vu/T+tD0qPjVndXFwnCSUVtG2iXrvdb+vc /Un4jaeI9GsZrRWLSyBpMKNp3buU29RjvxzS/CKwn/4SQRsf3cIaZYTvxuIQEgLnnA5+n0ryX4sf tNtrFrpHhrRtFgsxpVotnPciaSR7xy7uJHRm2xna4TbHhTjOMk1FpfxG1fTNFbVtIa2g1aZSIoHX AVcjPyuc5AXvkE+tfEU8uxn9nqlWhyud0rtPro9L2018lvY/bMbx5kk829vTrOSgleyau0tUr7u+ 3c/Tn4Q+PfC/h59e13xH4U1WT7Df2Sm+nS5sk04MSW3TIdoFynyjdzg5HevGfjN+2foWhQW/hXRo E8QWmm2Jt9Ot2upFisWm+aR0JBDgvklQFyW68V8Ap+1X481T+0vCfiGC2kbVntxPNslLp9mBClY1 fYxI4O4NgdB0rT8F/Cu1vtSN/qN/pvFuLiO2ud8SS5+6hkYYUk+uMmvl4eHWEwuInjc3v0tFSk0/ dS0101vtbd33d/vcz+kLWxWFpYTh+dn1nKKTja62bcXdavfy1Z+ivwp/4KVaZ4W+EWmeBfC/ge8n 8b2XjqLxbpHiW1uPMjtoIoBCIYrIhgJlcbkkOTj5SSOK+8vBuq/Df4v6J4Y+KfjD4O+Mr6e1v9Tk +LF/aqYJ9aF780BgQFjCU8wByqEPnPGK/MH4B6LqnhH4maZ8QfBa6PfW99cDRmgkjktoILhYd6yq 0cchaQfNtYKVyvzetfux4Z/aq8XeAxZw2OmIZ7nTb211CTU7iGDRpoYEwJYryVot0jvs+V13AFeh r8J8XuK6mW1YU+HsvjKU1duVRx780WmtHo7S723Tse1wHjcXi6VbE5piZTcXorWWqSXvRd7NPSOy faWp+Vf7Vf7CXjD4rfGyzuf2YNL1jTtB1zQoX02y8XiKwmtpLeOR5omnkZYeQpaPcVZs4xnAr4n+ Hn7PHxqma9GhLBeDTZkiuzFMimOR38tAAzAsS4IG3I79K/ob+P8A+2x4Auvgrc6h4rayu2nQabou i2t/b3kcvlFdt1IyjdGct9xyc7eOG3V8h6X/AMFHL/4IfCaw8OaJ4P8AhV4l0k6Yl5eSa/olrLqL E3WFidreVZCxdTkSANt5BxzX0HhL4t8V43LPZYrAxptPkin717f3tOZ2tHpZ3d5apfG8f8FZJ7X+ 0lNuUrSkudpq7d3t1te1tO9rM/G/9q/xJ4h07UtM8Ca9b+Xq2nmLzlg5InkTKqzjgtgjoeCK+x/h D480vxV+y1rfijx1b+G5YPBi2kWpTTRRvezCecBR/rA8zq3D7UbanJ9a/M79rj9qo/tA/HXU/iZo +gaP4W+2yrNFpfh+F7e1tp9oUmCNnkKLxwNxAqK8+N918NP2Zr/4K6Ro2iyT+Jr+11PU/EE0Xmaj CLeN0+y20hlKpFLv/ekIC2Bzxz/QGZcH4nE5ZgMNOny1eeLdntrepZ30XLe2+tj8my3xRhgM1zHG UnzwlTlDXW+loX0V9bXemzP0j/a3/wCCtHg/9orwb4L8AeG/Clj4cg8BaS2ipqfh0vbXOqfIixzT qpUHBjwQ2885zzil8E2fiDWPAF3Hft51l4l8Ow3V1davMjS6Xa3MjRGaErKVTzDuTc8bY/ugjI/n rS8ntrlZgF5OV/Drn8+a77w9rc2mme7e9uIbg25hiS3yUZSP4hngHOenNfSZr4YYeNCEMFPks09V zX281bXW/wB6et/icj8dczoVKn1iKnCV1ZXja99mvV6Pufs74e8NfCX4R6/p/jXxJqeqXV3px+y6 GTeRXcKyFSdp8tcqMPkBjzmv3O8C3mka74Kgu7K5hdpNJSZ1ieNmQSpG3zABsHnuf/rfxA3HiXxF KAPts3liYTK8rsBu27c4GRnAx+leo+Avjb8U/CD3UOjalfoL6ILcKJXBkjQYVflP3QOg6CviPEHw Sxec0ISWNtOPdaW7LXTq+t2+h+l+EX0i8Jw7i5S/s793K2kZWd++1nfRdLLuf1veHvGqaXp0mj2H iGJEmNtDrFokkISRFDyRLOFRC3KlgpAII4x317XT11PU21C4urWCKSaGWJvskUmQ8BPB++MKSck5 wMDg1/HRdfEjxZbaub5NVvI5nlWeWaOZ1PmAnk4xkjJ9+a/Xj9kr9rbxF8IfDE8/xg1K61HT5tuq PJf3VwbvzZoWWKGBWBL8AEgfux1zmvyfjLwDxuX4Z4nCV1Vk9OVRSb9N1/SP688Lvpc5bneN+qYz BvDJauo53itLJy0VtEu607I/cO48MQW+nRXmg6rpt/JMwNzbw2nlS20ccZVGmyyr+9GHXax2rwcV 5p8SbvVPAXw/vfE2pW6PF/Z63kMaqE81A0Sbl/esCMkjPt+fxF8Of+CjvgvXdce28SXFjptgLiMy S3F3KkiQiKRWBBjO/BCnjqTzzXjf7SP/AAUX8CeM/CN74I8CSX7w3VqkC3FyisnylCQoZQwBKkg5 HrjnFfB5J4W8QyzGlh6uEbScXJtaW9Ukrn7hmnjxwvhsqq4mGaQd1NR195uztaOndK7Vu+p+kP7F f7SNpoHxc8P+M/EXhDRvEehaTcyTzaJqPl/6W0kLRZfzEkU+WSGQNuAI6DNf0TeDP25/2NPiN4js vDvi/wCCXg7Rbe5cxy6vqEGn/ZbbcOrmO334I4+UZ5HFf5+ngf8Aarm8I2sWoaRNem6hOUPnSQwg rnAaNGCncAM5B9PWvMPiZ+158Y/iZDb2/ijWJTbWzym2gtcW/MjBvnEW3JGAATnAGK/fMP4f57Tx UqeDdOnSvrz04zb9OZNu/XWO5/PXF/i3wDnmX4WrmzrPFQp8inRqTppJtyu1CcIXTk/sybtaTaP7 x/iJ+1B/wTk+IvhLxD8L7H4I2FrrJs7uxtdS0BrETW1xhkjuI5QRIgUlWBK9DjHavyB8OfHr9gv9 ny38ReHvh54c+M9truoWs1rPNp2r2dvazXlurmNgPL+eOORiTjoPWv5nvhF+1r8QvhN4xPjHS7r7 Tc7JEmt7wtLHKJF2ln+YE4IB69hXnvjv4t+JPGznVru/1F7qa8mlD+aSqmU5k2/NkZ+ldFfwjzHG YpU8zrp0oxSXs17JSd7+/GHKpJWVr338j8u488ZeF1kkcNkssRzKo5uNStUqW0SvGU5Scebqo9Vr dWP6ANB/ae/4KffFvwfDpS/ETxZDp7W0lmILuSB4pbYqRHawxFG3xGLaSWAwS2M181wfAn4xaBqu jQ2EFnrOo6f4cudCubLXdKguYLOK9urmWVoImHzuvniWKcgMjk4+6K/L/wCGX7Xvxs+EVsth4G1m 4t0hn86H7THHd4m2eWWDSq23KnBA4HHcCvpOP9tL4+eFf2nbM/F2/szeWt5bx6pFptxbfZWjmRTK wuLZ/KY7GDA72CsMY4Ir28bwpneHqVlh6GH9nyyaSTUpW2TVtrO2+npv+WZNxZwXXhRlWeIhVlKK l8Lir7tPTqu1/wBPplv2P/iJqt1aXjajDod1pEEt1HdHTpoZJpwxkh+aEMcq2BuzleoFbnh3xN+1 N4nu9D0C407xHcReG9PuLPT72OC6jkRZWdrjymnYsy3Dys0wQAOdpYev6F+BP+CpP7HpsLK38T6h IqpA1pCLSwku5FljwqGd8AyKBndIV3u3zYOTXbeNP2nP2tPHXxC1WD9kPU9aOh6N4ZHiaSy8PwCC GG3mVftlzHG3RNgiLkH5SMcc1+Gy43z+vWnhs1ylUopPklUTUU72dnyrfmd9XZadT+icdwJw/RjH FZLmSqTg058tWL5rq8b25rNW6JP5n5cXfx3/AG7rDUrnSl0fw8yXES2k1pqPhnQGhijifzIW8loD 8wDNzwSDg5wK6fQfhR+0L+0V4qnuLHwNLqWp3gjlvtN8J6XbWUduF2wRyBLWGKKNZHRclFUFmwSS ST5D+0prf7Ven6s/xd/aHXxALnWYYdVhn1ZPsr30TRBLe4jwBujKBRkDBA68ivNfgH/wUP8Ai/8A s36nrFh4L1vU7Cw8RWEeka9DpcjxyT2rZLRbmJKkn5iV7gV+o5XkFWvhvrWX4agpW1dKO70uua6v Z27bfI/Hc6zPL8FXgsTWqxnK1vaNctn1so3tp/wD9MPGXwCX4XfC7w9rvjz4LePtLTSdbNt4u1rW r8wWd9kgrZQqsYNu+MkOd2Se9L4cf4KWPjVfihD8LrmTwLfy3Nho2i32syFxcQxR7s3iAOzQNIrk bMMGAz1r8nLn9unxfceOQt7danJYWmqJcmDUJP7QErqRtaaObKO2McEYr9mv2YfiHpl54Dnv/Cni /wAK2Nnq+qxTQ+D9esY9V8RW9ppqmVLuW2htJwIn3sDJHtyB864UV8Rxbw1mmBwnPXhKTn2nV2b1 Ss5NNXumr6aaaH2HAnGmV4ms6Ua8bptPTl07p797ddND6zuvB/gT4i/DK/8AFHwP8AnwrrPhOKK/ 1fUlv21IXltMrJv8mYIibHRnOc5zjHFebeB/BeheI7WKx0vw74i8T+JGSe4vdO0GaNZoxbEM900T xOnlMrquxCSpUk8ECu8+EHxaHgnwHqXxu+DHxE+GF/f3NpcWL+GteljS4eGXHmI8NxG6IQBx8u7j gDNfCfxH/ae8LfDfVn1HxL4l0vTNXZ/3h8PyStAsUmMMskHl5Rwc/dAx1Ffh2V5TjsXVnh6cJN32 9/m0Wz0U+W93va+lz+qamc4LD4fESjjIxpRs4zlN8t3e6cpOz11XLK/LpZJXfT/tN+E/hjrvwO1z xx4TtNb0+7lK28Gm39yk4iImXzGcpDGu0gfKFOQe1eq/sqaLs+B2kwkl2MEIbaWxyGxyTzxX5cfF X/goL8PotJ1DwNpvk6ipnby9RsyWgYocAgbvmViMjp1zmvXP2a/+CrXwg0zwh/wr34haZqFodPjX 7DeWEQmE4YgFHG7cjZJ+YsRjjiv0HOPDriX+wfZUsJOdqnMle8lGySsnq7P59WfCcNeMXCNDihSl mUHelyXu+W/M38W17db2e176H7Gar4f1OC3tL2WwiFrLK/2adowpn2EeYpcctt3Y+nFfTP7JXhiK 6+LrX1rPLDeWGj3uoWEkDMJEuIIQY3BjG4FTz3X1FfCfif8Aad/Z58HW0U3ivxZp1ssyB44lufMk TdhiSsbNj34rj9C/4KY/stfDHXJvF+neLvst9pSLe6TNNYS3cd3IpULEsJjIcfeLF1C4HXkV+HYT hbOsRBexwNSafaEtde/f09T9x4/4zyWGVYvCVMwpU6koSSvOK1d7XV2/V27tLofs/e/Az4p/GzxF dax4q1K9vZ49ON3D/aMUKmO38xnCBwVJwxbqNx5JFaB/ZJsI9FjWWxkWcuJmvEkuF+TG1kKLC6jB XII9cc1/OL47/wCC8vhDxNrX2698MazcySiQ3mpfaYrYSs8jy747ZAFQZcAIDgDn2r0bR/8Agtr+ yDcGe8ksPiDYRm3t47a2URziC6O3zJJZg4EkOVfCBVYggc4OcMZ4D8awpp/U6ut9Y8j7WvGN2vO7 f+f86YXxay/2cKNHiGlSULWhGHLFbKylzRUk73Xu2snezsj9i/Gfws8MeDtREPiO2vLDRFZp7rUb 1pjax27pt3SSBYZTGWI5BHXjmvxU1D4Ifs/6D470bxXrWq/BM2M0lxLJY20viS4hne3hQvbzJIw+ dQwf5WCs+QSRgHR/aE/4LN/s6a/fanN4TstZ1+x1EmI6beebYWot3jA2GKJonGG5Aj2eoYEc/npp H/BQ79nTTvhvqPhUfATwlqOuXqaiLfxLql9qstzEb2R2hfb9s2b7ZGAjJByVUtnnP7Z4N+G3E2Ew Vb61Rq03NpbqLs0021KWjT309D8x8YfEPLsTLAp4qGIlGPvcr5uV6Pe7u+jadttNz+orwJqv7C/w 30/Tda8DaV4T1+7063bVoD4Q025tnsoY1jmF2puZ4GEYO5gQd6tkY618mft7fDHSvjFZ+H/EHgCP TV8P2sd54jt5LN7kxw2N5IiCR0nmkwr3AlC7QDknPGK/FG9/4KAfD/Qf2XtPk8O+GvCOneLrfxAL SXRLe31gSHR1h3ee+oNfGNvNmLKYAm4H5w2MAeWah/wVc+LMmn6fp/hrQtC0iS0006fcSyLPqJu8 sXV2S8kkjjKk8LGqjjmvrMN4Q8RQqvFYKU4yUmrTqXi092/eb16WT1tfRHzGF4y4ahXpzxMm/dV9 LvbS2yT6dHbzP1n+NngCKz0nS21K8VobfThFLdiWWOJVkRWZWbeufu4YEYyvfivz71bxD+zl8Nr2 61bxP4oaG4sbY3Wnf2FM0sq3qMDEGPZRySUYsDjAxX5QfEH4xfGL4iXNzqHivX9VuknlZ2iluH8v L9QIwQqrxwAMD0r511e61Cf/AFzyHjaQTkjHav1bg3wTxFChGljce33UFbfXd38+iOfj76SGHrSv l+WpNJWlN3btpe0bdu5/VR+yX8b/ANmj9oCyl8PeOfEVvrWrz3kb2lt4jOZmLnYTG9ygJYgKBtOe noK+9v8Agr//AME7fg/8GP2OdM1X4J+EorPxRrPjOGwYWV9PerJbNEkiK8juU/d5ZmOAVyQTwMfw 2+EZ/Eya5Zz+HZpYJklQwSxSGNkbcNsm7+HB5zniv1Z+Pn7Z/wC3d4B1lf2dPHXxEh8Q2PhKaE2d 5pd9b6vbu5QSFvt0aD7USG2yO2ScbSflGPMzXwUxmBzali8lxd1dS5JyaS5ZJ6KMbST2t7ttd+nz MPGdZzhqFLNsO6cIc0ZypRTc1OHKl70la293za2ty9bPxp+GXiz9k6Oz1WaCPXNJvNHbTLq/06Y+ TaahcRNvhfcobA3ZViAGwQAcV5NrH9tWHwCvPij5Wq6YNUf+zbGOBYZo33FS73LSKGSB0Z1Qxgvu AB4JNfJHjf4qfFLxdHNaeJdZ1C+WeUzyQXEzOhcnIYqTgkdvTtTrr4ofFfxD4NHhXU9avJdJtYo7 ZNLaXbFsXlQEPBC4HPav13LsgzCFDD/WqsJzUlzys1zRWqVtr362SPhs04iyeticYsNQq06bp2px vF8tTq29+Syva7erV9Ebvg7x34z8HG5j8Fald2D3SrFP9lfb5sYOdrdcj2r6x8P+Lo/iF4w+36la 6VpEk0FnZyQafF9ltU8mJYTKVJbDPt3ytn5mLNxnFfAl7rkXh/V5o/DF5JdwRmPyJbq0WNmO0F9y Evt2tkD5jkc9+PXtevPil8Hr/TtS8R2zadqWo2lrr1lG8W0fZLxBPbTJtOAsiEMox0r386ymGIV4 JKUlo9m9t9Omm+x8pwrxDPC1VUldxhut0t9ter+8/oC+EGkfDvSNA02fxDp8mqNDeCNLuw1Y2au8 GwIVJt5g+QcqF2gjvXzt/Zn7R3ij9oDxR4m1HSdfv4r/AFyaa1vL57a/uZIElcIXmumDSFY9gLEA nA4HSvi34Vf8FPPjV8OIv7J1DT9J1XTZ72K+eG9hYypOkgdp4ZUdD5x+YAtuX5jlTmvsHwD/AMFZ fgna3HiLV/FXg7XZbu4vpb7S5H1YzyKshIaLYyrGpbdk44XGBnAr+W8fwRxPltTF1KOAWIVRWXv8 32la0XKNt9bdEf2nhPE/g3NvqCr4+eHdJ66cu0LN6pq1+zTemnQ1v2qNL8Q3i6T4itpXurK1D2F7 cx20VqlvfMd3kN5R+d9oznHSum/ZDj1D/hL7NNL+VpdVsRdFQTI0JMu4HH8BI/Ovgf4vft9eEviH 8Jp9B0fRr2w1NvEw1MQzTK8HkCGRAd4+YsNwyNoHvXyDon7XPxj0SaUeEtWuNIZxEWksG8p18skg K4+cZ3HODX2mU+Gmc4rI5YGrTjSkrpc1tr3v7t093t5HzvFPjbwzgeJo5lhK0q8JKMvdvva1ves1 st3fX7v6vP2r9P07wh8OYdT8W20N1YjWLdCgf5TuRwWBUknYSM4HB61+a3hTw/outeLde1OS/gtb K3W61G+ukvYxMmn2cIlm2wMV84FWVQob5zxtOK/Gn4pftYfHj4p+FLbwn4w8UazeadbS+allcXck i7gMB2LHLHJOMkkV86zeOvFyRmEahd7CMOplbaRgAgjPcAflXXwH4CY3A4F0cRjFztvZNq11bdrX TXp62Ph/FH6T2EzbMViMNg24qKXvWV2r9NdNe999j91P2kf2hfE+seK183xF4kfR7cf2PFo8Opwb 7axWFYntxLbKYCpVFDFUw4A3Anmv0e/Zt8TeIPCvgfSZ/D0bI+paBBaysIZGYrNGvIZMEuCMq3UV /ItofxE1jS0EDy+bHu3+Wx4z/Ov3D+B//BYfV7Cx8NeBPEPhbwtZ6ZotlBbC7sJbjTJf3IRTLLJG zl3O0OSEYk5IXNc/iZ4VZhTyyhhMswyrRjfm1UdLaaPd3879bj8LPGbKZZjWrZhU9jzpJJ3kr+qv pt2P6IvCvxU1ONYINQ0bRJrjTo5YfMazNhcSDblYFlijLfLg8lgcMa+bfjXp/j3XPG994v0PwtoM VxfWaXr2UUcV0NPS4iEUZilLxkP8hcYX5Sckcmvl7VP+Csv7Pt3fM/hjwz4n1uFYM3morc+UVlmX kNFKf3z7crvJz3zxXKfGX/gqf+zrrbK/gr4ealJa3AEzPO6abdwsLXysYVJ4xEsh3gK53f7JNfy5 k3h3xHSxPPTytx5lZ35fWzXOrX31Se3TR/01m/HvC0qa5catE9VzNXutrXT66pPrtY4/Uv2J9b1H w2/iTRLm8u5ks0u7+KG6sJhEsgIwscE8shwSBnYMZywFfTvwE8VeKrr4fRWlxGLWWwdtCkWWPyJ1 gsraMBfOZXNvJnGZflIxjjOD8H/sd/GvwlrviK+8O3NuranqWkPFbLqEzWQt5TOpIhkEiea0kY2s OyMzADYWH6P/AAP8PaRafDnULG6j1K4vJNSvsvDdRvAX8pRKssqhxJEw27X3jBGSWzx9Z4h4vH4a FTBZlLm5XFxdktHfbV6K2/kbeEWFy/F1IY3LoKPNFp2d9U4b323u9Pkfnz+2zoN7on7S1jrniyTU hYahY2MmnwQagsDXdtFEY7gxXTh0iPmBhvZfmIJI5r7G/wCCQsXwa1n4n+NbHwNqviLR7O90izVY 7yw03WL67uIpHPlIbhI44/NPCbRuY8E45r5p/wCCgHwGufHWu3PxK8CaXrNyvhzR7O28V3M8kQtU kuAgtFskzvlKRkGdUDEbtxwoye2/4J8/DO78EvrmseIfBL3UeoRWenW51We9tbWGcRl1uhNbureY 2/eULFApGBX0ONzDDz4Kpt1rT5IR5dEtJJ6x5tdLO907O+l0l+V5hlVWfHGKoQp+7KdSXNZN3cZb OSS30aemmm13/S14X/Zs+HPh+NbHwPcWkD6MbDV7HVdTmnbUVukuxM9u0AuXt1iKAq2FVyy9eSa8 nsNQ8NSfFybW/H3iqz1K68+4jtbDTLWaWKISnm1j8whliVGDhnyA5PzMBXzDf+BDodjpdjN4V8H2 hla4nuNe1C61j7LKFB8yJnM5kYQDBOE4Y9SOa8dl+PHw/wDhPo93o8XxH+HfhoQmGS9ewvtQW5vl YbZbdCoYlSvzOGC5b7pxxX82UcvrYxfup+0k9PdhJtXb3ac/uVvkrn6TSyyWHVWpiazaenM+VW6P X3rXte1ly3ei6fo9+0h4V+Fmu3q/Er4zav4v1m20rRYxHbQanZ/aLMqXCwO3lvmXcY3ZkGCGPocf izoesa34Q+LYn8Za6+leFdUF1evHcXUdxaXFzBAwjNzAsnLb3Ay4BOTtz0r1r4pftn/ss/CHwjL4 n8D+OfA/j66ub0GWz1uG4vrKa42kqsSSQwtH5cbZk3thm24bgrX5qaX+0D8L/Fmtah4j1N/A9xFc eQn2OJ2S6g8giVXhYSQqu9k8uTBL+WW2/Ng1+t8F8L5rLCVZ4ujJxd1rCSl0WnM9HfW+q6JJ7fm3 E+Y4OnhVhKGIUpLlas7JL3vs9NPm7q+x1fjf4x+MPFMWg+A9U8WeFW0O41MvBaOksE1sYS6LcTw2 Ua7oiEHzEvJgj8PBtb8V23ia60O3jsIp7hblzcrJDcrGxlwB8zSYJfGDgive/Hvxb0/4x22h+FP2 etG8J6XrFgZdbtb2HU7i0u9PmXaJFtTJePGyMcPslUuHLFeDgbdh8Mf2jfAfwy1Obx/ps99B52nz aVry+JLS5TSobNzGVWzjWQy+Y0gVXV4yg9RkV+qZfjKOEpRdWnGjOV0oSnGMtW1zWVr3Vna93bRN 7/kcqVdynSTcoNp83K3HZO2+mv4PU+a/hF4b8eeP/iNqPhL4Q/DrTfHN/d6rqKab4VmWdoPORBvu SRcRyAxR/Ngy7B1xmv1c+B/i/wDa98QW6fB/QfgCwsn0mTQ5NP8ADd8mkXEy6dM8s8bSSzu3lfap NrBmywCgk85/On4JeOPjF4F+JV/D8MEsrzxCdQ1S3tNL12MSxu9zC6NlFeIlzG58obvmlKjByK/W fwj8F/8Agohrmt6d8Ub6T4T+GNWt/DNpFpuoJqF1E1pE6xKYrm1g+0t5zpy6L5eHbcWbG2vkPEjH 0+eMMVGhy2Ti6lSalfukpR8veSb30kejkGElGM4qtNN3slBNXT2b/S62Wqvc/Q/9mvSrXwx8L9U8 S/G2fVrHxJY3Fu2saZbzuVF+iK3lv5UU0crCTIYqTjHPWub8dfDzTfjL8VfCHivTZLr7MXkQ208T wxXc0PmTRhZBEuUJAUptKsQepOK8z/Z68LePfE/w5u9J0y80zUryO0NrqLy3kDwySSwhXlt4518x WZiSJcg9MgEV6ZouleHfAvxMsLyK4+3PaOmj6RpqavDHFEWjLTSzNgpGSrOFkdQwJVgeBX87Zi+T HVHTnaa517q0s/XbfR9En1P2ilGKi5OXNJ20clpptZeavq9fkd/D4E8Ga7q1xBaaBqssEeswTXXm LNEjyxW8kcpTDRnKyMVVFIUqN3GAK+EvFXhuNbGJ2TGJZAPb5j9a++oPDumQ+KLnQ9J1RYoWdvtD 2d3FqE0vm/vDGB54C7MgGUHLY7bq+VfGVgq6RCp4Pmud3pkn1r0uD8TJVqkYydtLXv2ff+vK+i4s 8UJ0bqV00fmx4u8O3bfGqB9Ps7G9uFtrVootUlWO3aTzflWQu8Y2Z4b5x8p6itXRvDfivSdO1TxX oOnTXHmxXWk3ltokkyojTW5eabzRE8Zt4xkNEHywHDFfmrofjtZ+Do7+OIpf/wBtyoRIx2m1a22k RqBkHfu3Fj6Y65rfsfirZWPgq103SbO8TVEhjhMll/obbUtPsxma4icyOvYxFAjqMs3av0vMK+Jq QpypU7391p6aLrvs/keXkVOilKE5266efy0f33PpWH4TweDvGng638MXmq6Jd6zoaa441G5kia7v GA2w5tlXdDIRiNHyOTlhk19VeJPiX8QZo08J+Idb0WylsoE2paxtDJslJG6d1hYzbeuC2eOK+cLT w5cSTaHqmpxT+fNaXioWLu00OYgIifMUxjgncuD6A9a1YPhsIvE08LpJHbyCN1kABEaliwVmkcjC joWkyRycZrz8TmbqKEatdvlT8/ta/kr97K+1jk9jHntCF7/5fff/AD8z6stPi58V9QuLfTPFunWc UdjBGklxHFpY3TRsHSdXW2Y7drL+75b1PGKd401bxtb6ffeKbjWLLXYl1eUXsFvHa6fJJE22JnQr HvxkLHgLkgbhwc11vwfTwtr13c+HI4pvECWn2ozvqEcTStLcqv7+3SK62tIGOMglQOuTxVTWvh/B oNrY2GpaE0N693dWSJa24eWfypA2+ctNuPbbsCjAz9fjXnEZ1XCpTtrqtdVq09dVde8rPS+phGjT pSSpSSdr6JLda266W/4c+a7Ow+E+rRvB4v8AA1jqt5bRblutQ1O5gJDtuOI1ZADls459eld/rGo3 tzpsnwvt9av9A0/UNNi1DU7HTpje6bO2UgDGaSZYSCsaK2eRhVr1LU/h7FqMM2v3UV3PqGY1vRF5 ZjijRdu2cu+5ZMLnBOMYxXKzfCvSdR8Y3PiCa6mu9Hk0tIJdF025CzWULS+YpcnciBpFG4BiGbop PNe//b9aMb0a84pdE2+2iTdrdrpJ2XZI8l0KVSTVWCld31sfzf8AhzU/ir8LfAup+JvgXosFzpV8 0+h69qt1E8k6pPch5LhQXbyPKmUxqy/LIMEgE4r7a+O8fxg+Emq6vrXwh8mw1Sa1hubWazubXUJm 86do5pGim3iFmjbGxvuHoAea+NrDxx8Uvgv4P1nSdH1No9M8Ra4dEn0e6fzI3sriXzVeGJ0IUu2W DgAkr1Hf7F/bV+DMWveGPFml+H9YsoL25nt5pI7+6Szjh/00SHMspVQP4eW5OQBX7xQrJZlFV4wc KsrOTi586vD477cu3Zp20R85ioS+p1KdOck6SdkpWUbp/D5u3W70TPzc8R6Z+1HrV8dTvtT12OWZ dzBL+O2G846L5irn2AxX1f8ABf4V/G7UrjTvFXjvUrgahB4gsxe23iPxPYGWW1ydwi01Ssztu5Uh uOm09a+Bj8FdV8MWKxalr3g5LhwWLz6/BIpAIxjEjY/AV79+zzpMVz8U9BkuNT8IXcn/AAkFnJ9p 0/UxdXJEbY8tdzHIbqRtz6EV+ncT0ozwbWHlBKC6Q6dl72i0/LQ/OOEq1WONtVhO8n9qV/v0389D 8gf2gdZ8TfEb4k6texadp2mWEN/c/Y7DSl8q2twZCzpGryPIctyS7sc9+1faP7G/iX4veKvBXh/4 OfDbUJf3Grz6lHYS3LwwPeu+5JHK5+YbEwQMgjivm7xjDG+q6uvl3BY3t1KrKQqj942P4OQfTr71 9M/sdeH/AIb6Z4H1fU/HN5rmk79NzoV1pVut9NNqfnRsyLMpWO2Kxlm3k5A+XG4ivs+Pa9NZKouF 3G3LpzWdrXte7sn0d7dT5rgmlL+2Zz5mr817aaN+WiuxPDc/9kS3HiDQrYeb5ytPDOiXNu8+4kbo nVvM3MpYh1IJ7EV7nov7Rf7R+o+BdV8MeGtEsLHSZZ7rVNU1aw0azigupZLeOJYXj+zCGONAi/Kg UMxLMCTXJ+EvH1t8PPEEPjPwmt1ANPmEkMwligvkkKlS7y+VIpBy4CsucHjjNfTXhb49/GH4lfCv xrfeO9N8T+JfDl/bSL5lvrUVlpsIgCbhPBDZ7pSDtGVKAE5wetfkGe1qjcassHCpHmjrOaTTvayT 0k0tUnJXfS6ufvXDWHp03yrETjK0tILZdZN2laPeyv02Z8LXvgL4k+LZY7TSNN1O6t30uKab+z0d 7YFQGZsojJhe5xgGvEfi3o/wvgn0aHw1p+p6VqtvpS/2kLq8S6+06izsWlCLFEbZRHtCxHcQRktz ivvuw/aj/a/+BPh+P4b+F/FfiXw1oFjpcdibJTJHaW32gea0BkBOGbcTtzk+lcZ8M/BelftC3Hiw +JdA8R/Erx7q8VrdeHbzQ714orJ4X33v9oySJtUvboREx3AE9CcCvpsDnuKw7+s4pRVJbOEnqnon K6jG1nd+80raN7nj1MkoYiFXCwi1U1vz2aVu2iknfayf6Hzp8KLm3vfB2q+H7bVfFC3IsZtX1DTo 0efSZ2hhEcLbYw2LhFkkJllwoU7V5avQPC/jn9nTVfg7r/hK6j1bQ9T1COwmTxA+h2cluklrEwu4 Yp7YmdFnZiQmQHAVpCDkV9Pfs9fBv9qD4jWjfDfw7d3fhCznhutLtYZbdkhvLi5Vf3V3dWsZabyy irunIUEDaOTXEeGv+CfH7cHxEtvF/wAIdT/s60Hg+S48Raxpmq6zYWsLXTRKrPCTMEllaLA2ocgd cVks8wGMxVShPERjKMoySjO733XuWlqlde8ls3scMcrx2EoU3HDuS5JL3o2VrW19+8VdvX3b9uh8 DQy+KNdu9N1rSdPu73SxNbeHhceI5I5rRrjAlNsJ3K+REQc4RlKoT8wr7FT46eG/h38FtR/Zr8Se BYP+EivbfWL+w8RjUFms7CyyWMWn25icYYoyi4Wbcy9yOvyVdfCXxCfDsWi2NibnUJb9wbuWdYoY WRR+42tcCHoN/msuTnaD6fTvwR1n4o6V8LNdj1vQvDGpeH7S1m03XNV1dLR9ShLozw2sE4ZrtIPl LMbdSFGQx5xX0HFFShWpQqWjUUJq0edwd7+678zvrtFpc700R4XBFPEUq8aUJSouUNZcvMkvtKyS srLztZs9Z8K/s4fD/wCL37MP/DV/xCufF114g0KO306TUIb3S5LQQyNOqLNb3Vwt9NIR0aNSoAA9 cfnB4z8U6lqWs+ErJNX1a+sFkuYoBqc0nmPDb3DxxB4g7oNiAKq7iEAAXiu21bx1BpuseGfB81p5 8d3oZuo5I7u5iiSRDdhD5CsI5CuTgume2RzXnukaDPqmq+CNcHlLbpeXpmijli8/aLp2YxxStub5 QcHBXOAa+kyPK6mGdTEYqtzRk5OEX9iNnZL5p7fdseXnmaxxFKGGoQtJWU5LeXwXbfXfrd+Z7F+z ZperX+u6f4gTwh8P/F0P9kalbRQfEXVDYafAwMhEi4u7bdJGDujB3KW7V8lfGvxPp/iHxUuiw+Hf CXh59KmlsZV8JST3EN3IH2l2nmuboSYx8jIwUg5wc5r2/Xv2f/HvxS8Np8QvCM2lpZ2d7cafDpur app9nrNzO9yxjig0/wAxJp5CGXPkxFSxwOenHWHh268R+Pz4e+LMN1YR6LpE1smm38sGj3ivbxMy pvkhZNyyZJVl3uPlBDEV34HGYeOLq4z2sZOKd4pvmhbuubld019mNt76nFicBia+Ehl0acoqUklN 25JfOycO+8m9raI9L+N/7Nfib4L+GfC/iXUfh/4x8F2HiC1tLiC78U3lvdjUZEP7yaBYYYjFGxyQ jglR1NZnxb0/wvaeCY5tI8by6/eTRTz33hhoZki8NO2o8W6vITG7XHMreUABkE5Oa9C/aG8B/FfQ /hf4HvPF+l6FbWsji1t9U0HU7PURcuHDqtybaWV4pVjYfLMQzYJAABx82ahp2mWer+L55LoSPIwF xCbdmEUguQFUEkBicZ3D7ueelHDlerXw1CrUxF3GUvh95SV2km5ObWmt1JO6S2bi1nVClhK9bD0c PpKEfj91xdrtxS5E9dNU1a8raXX29/wv34+/B74fWvh/wN8YVn8Papp4v734cWOoXRezntLZXhe6 tmUQYVlEi7WOCQcZrxP/AIbr/aG/6GCb/vs1H4y8I+HR4eHie7trvTtXTSpYIlh0CSK2vLZ9PVlm n1R7kpK45CokAOOpPFfHmP8Abj/790sFgMFKG6qO7u3BR1bvbSKva9ubW+92z0sRmmOpcqhF0k0n ZTbv05neTabt8OiWlkj/0/5Q7/x94jvNZFyk7CbBk3rIwIO7OQc9c+9UfEGuavrcjXeoyieZ8s0s zZcZ5ODnuea87ubS9guPljdHxjaFPH4VXmg1xYvMk3AEZ5AzjpX4zSy2lFxlCysfvWMzDH1OZ1Zy lrd7/itDp9SsrW90dFZ0eQrkxhimDjqSAc15vZ6NdabqSNE8RcJvBV+hBxzkdq7rRvBnjzXtEvvE 2jQSS2WmAfbJg6L5Q+hIJHI6A1xIvL0TecXy2MbzjpmvSwUmuenCopW3XZ9n2PIzCjilKnWrRcVJ Xi7NJpaXT669V1PZfDOqLbwuLjUp0klANwq7CrY9DtyDj0r2bQfEUkqG30FWkldhIJd/zgrzk4A4 4r5esNb18YSK5ZADxgKP6V6BpWo+MLhx9n1CZM9GWUqc/QEV8vm+UqTcnJfp+CPquF8yxVKvTqQr z0ey/Je8z7JHxX8X6Ra22qXUszrbTxzBXBdFfcACCQeMnoa+h9G/bMX+xbptQW+zLbPC9xZoEgJ2 lSXIXIA7/jX5rL4Z1zxtNdaVceKdRNnDZ/a1WWMujunVShbHDDANfMNj4r17wxNKNL1CQMJcNbOS Y2GeuOlfKrwkwGZwlGbTnDXRNaPpe2/9M/V4+NvEWRVY1YYqp7OpdauMrtabKT0V9NV5H74+G/24 pLGxtoFtZboW8aLZ5t3W3WNVCqCx3bvZlwcGv1j/AOCe/wC2b8FNF8Zy/GH9o/wxZ2vh/S4Xlnv7 lmBnO0hY0ikwJM9MHI7V/Pz4B+Bh1PwvpviHXfEEEE95Yw3jWoLKw85A4AU4OMHr0Paua+O3w6+I n9kW+jeGdSa80tV86YxltoYDO3ZnJx1zjFfgOe+G/D+Z1f7Po1fZNy1k02vdd2rSXJK9rOMlKMld STTaP6L/AOIj8WVMoqvN5Tq0Jwa5IOMZNSjZe8uacUr301+R+/X/AAVZ/wCCm37Olv4w06/+Bfgz Rbrw/qGkQTaZNLbWs9tH13o1tJEyIwPYcd81/N78YP2vfEPxT0V9O1SDTEthO7wommWsLxl+qq0S KQPQCuPuvAXxFbwREvizZJYQP/o5ncoWVxnjd6ZzXzB4q8zw6zacfKciUsZEcODkjHTIyMdutftP hf4WZJl0OSjarVU5SclZJtybbUUlGG/wwSitkktD8E8RPEHMVh6NCmpUqEacYqMryntrzTes7u7u zm9S1Np3dY2AHJAUYB+tcpJqDiQSbzkc47Zz0rpp7rSJCry5ACncU6k+46Dn0rh7iSEXS+X907sO 3oTX9H4ZK1rWP5gzKN3zc6Zdk8QXjxsDIUAGDtzj+dZM+tQq5DPvwOSaz725iAMcWXIbDlR6en+N YTmSRdwU/XvXp06Ktex85iG1tLU6WLVkRzIHAOMrtB5PrWyfHF5JsW7maZUUpGJSzbd3p715/tlC 7mVsDsBzj3qqWkbIwT3wB0rV0IN3aOVVZx+GR6RY+JrQ3ImnIZB1ictg4/HNWrfxrHFema0EUJZN rg7sNg575/SvI2EhYBxg9cD1pjSy7t3IX3zVfU4SvcxeYVYJanul78UddNm2l213JFDIQXWKRl3g A4BwQTjtXJjxMBcrdM3zK4IYscjH1GOlebpOygOB9c9KX7QHAAPJHJHPf17VNPLaUL8kdzaea15u LqTbttf+tDq7jUhdZkQhMuQPmJ4p9ncSpIGaZdpGMBsH864zzNp2Jx+HPvU5kc7Xwcd8/h/KutUV bRnFLEtyuzrrq4C5kV8565bJ/wAmmPc7UDg/xDcN3GPxrmZi7XJI7cA+5qdt4Ift19ah00upUa10 0z6M+Fnj688H3s32O+v7OG7hNterY3HlCeIkEI6/ddcgEq2RkV9faRrPwR1GxS/8VT6u0xuLd4yr 2bu2ZFEpkRiCwCZ2AEDPXjp+XsUsu7cmQPUd667StL13Vlc2qMFVNwkYEKfbNfIZ5w5TxElU9pyP ut/vPpMq4hxOHXsqNOM12av+p+93h2//AGJbPVrG48K638RMRAXBimi0QoxiIbb5fn4AJHAPT3r6 9/ap/bw+Dv7Rmoxal4bv/E3hS4sNGh0a3t9G0rSLRJ0t0xFM7R3aZkY8SOMsevWv5UTeaxpN0YCX DqSMqTwRT18S6jGR5kr5JwQzH+XNfleL8EaVetCvUxkpOHw3Se/fo/uP1XL/AB/zTCUKuEpYWklP R+7Jdu0rrbpufv78EfjF8Hfghap8SNV1vxHdeIRPO0UptLeWNLokqrq4vdwfnO7HHUZr1jxv+378 L/jFp9nrnj/W9fmv0gS0lnurYSvKIhmMSFrhy4U5AJ7V/NNLr2oSL9nEj7BltueM1Ti16/SQgs7D Axk1GI8AsuxOJeNxVWUqt9JWSstfdWm2p7mU/SazbB4VYChhqSp2aatPW9rtvnv0XU/Vrxb+0boi ajqKTeI9b1DSFze2ejyiRYPtMgKAGMu0alEP3guSMV+cvjDx1qmrSmGa5nlXeTiUk7fTB+lea32t XNypyWGf8+9Zf2mUkoxJzX65kfC2HwSXLq9Frbp6I/GOJOLq2YS5qkVHVuyctbu/WT/yNiXVpkbc uRjHPfP9K9A8G/Fnx/4L8Y2fxH0DWNRtNc06eG6sdVhuJVvIZoMeVJHNncGjCjaQeABjoK8Zedg+ wK2eSBimefdyEogdsHOPQV9JPCxkrSWh8f7flldH0v43/ag+KfjvXZPE3inV7u71W4uZLy71S4ld 7ue4mbc80kjkszsTlj3PWuH0b4sa3okN3aRG2lS9MYnaeGOVyYm3rtd1LLyckKRnoc4FeNNLLJ8+ 1gR6iq4Mpb1I5xmsMNkuEpw5KdNJeSN55tXclU5233PqbRP2kPHekabHo2hzQWUUcssyyQxqsxaQ BW3S43EALwM8dsZr0r4oftp/HX43fDrw98KPiDq8Woad4amu5tLmniia8L3m0y+fdFfOlGEUIrsV QD5QMmvg0zSBCFyFHHp/OnrLMBwTuIwx9Mj2rNcOYOM/aqlHm721+81pcQYlQlRVWXK91d2Z6fH4 h1C0vdyuSw5JVhnDdefWvtOw+P37Q3xh8JWPgTxF4ll1bR/CmhSWWj6bq12ixWOnA72tbYSYAUsS 2xeSSTX5t+e6sTk+hJFaUeuailv5CyuI+m0YGAfoM08yyaFeHLZX81cvKs5VCpzSu11Sla/zs/yZ 9xt8GfHvizRJtW8PWGmwQlHkSFb+KNpo4R8/lxs/z464+uPSvrL4S/8ABPv9oKW/ubzxZ4fW2mtI HUWz31uzFhGzlgVkK5VV5B/OvyCsPFOu2snmWtxIrbDGuDkhDngen1rsofj98XrK+e9i13UUmlYO 7GVjuKnKk888jvmvjs64ZzirB0cHiYRT7xk300vz+t/wsfoOR8V8M0pe0x2ArTlpblrQir66tOg3 vayUltuz9Odc/Ym/aM0rVUuv+ET1CRVcMhgKSA9xyGINcf4x/Zx/aSuPFFrFceEtZxIGlWcWzuqj gMCUyOMivhOP9p742tMJX8S6vkP5pX7TIE3ccgBsA8elekaJ+1z+0NDdx31l4p1ZnRWjQSTMyBXw WABJxXhPhniGlac6tGTSa2mv1Z9EuLeBqt+bB4qCbTdqtJ/+4l+Z6r/won4u2HjCbTf+Ee1kT2Zh nuES1lMsavko7BFJUPtOM12vje2+Jdlcajo9lp+q2aXOPOV45I/OX74UZAzgnIrwO5/bN/aMhlub weI9TS5vQqXEkTlZJBFnaGYckDPFeFa78Y/iNr+rHVdZ1XUZ5/ly7zyb/l6c57V6lDh7MsRUjPF+ z91LbmeunRpdVpucmK4n4XpYaUMvhiFJyd+Z07ct3ZKyu3y6PZN+Wh93aJ49+NXhTw5Z+E9FsdRi tbbU/wC12P2SZ/8ASQhjUk4xjDEEd+9fRHgrxb8dPjL8RBffEqeSWGcWumS2mq2lxBY+QZFUo0cc bdFCnpngZr8xvD37S/7QPh1Zf7B8R65axtt3BZ3AO3kHHOSPWu0s/wBsn9o6NZJG8U6tK7jJLS7y WHQ5IyCOxHSvns38P8TW9pKjRoqbv7+vMuazf2Xb7+x9Vwx4k8PUJUvrGIxUoRabp8tPkfLey/iq /wA49Wfr7/wUU/Yx0f8AYx8a6Ho3wq8WaB4mstS0uLWr680QyFYJZXJS1kCqVDw7QGJYHdnKjpXw zez6v4h8P31ytvf3IuTCWW3jYyOU7Ar0x3NfLdt+2B8f4NIl0MeKdXEMsplkjaYtuY9zuyTzXQwf t4ftWWFnFp0fjHVzaQIiR2xZfJAjOVG0Lg4PrWGW8B51Qw0KdadOrOL+Jykm1e+vuP036GmfeI/D WKxM6lH21KnOKvFU4O0rWbSVSMVffRLfbvraJ8IfiV4m0jXfGPg3Q5HstA8g6tcXDIhtRdSiGLas pV5GaRgCEDFepwOaxfF3h7xhD4ci0XVrWeRpW8wXEsOWRo/l8uKToY+cnB6+lej+Gv8AgpB+0noM VzK93p9691c/bJ5b2wglYyeWsZOdox8qKK7eL/gqJ8cr+yitdc03w3fxQK4tlu9OjKxM7b2KKeBz 7frXqVsNxJCrd4SlKKelqjT27uGut+2nTTXyKS4FqUbPNcRTk1rfDwaer6KtorW0u9ep8EXfhzxB p10kGo2lzCWXcnmIyFh/s7gOK+1/2U/glY/tMfFXQPhJ4u1zTPDdnqjppx8R6nv8jTkHPnXXlIzG JO5JXA7jFcd8R/2/fjH8VvEcvibxXBolxfSxRxTzmwhZn8pw6scjhgQBkduK4zwT+1n4m8C6zPrV npGiTzXSNDNvt9qsjnlQFYYB6cduK9fMMLnWIwMr0Y06ttLTvZ+TcVt+PVHz2U0uFMNmtLnxs6uH v73NS5Xb0U5b/gXvj78ObL4YfFXV/htod7a6vZaFfT2KalZb2t7lInKCZSyg7HI3A4xz+Ncv4d8B +KfFEmmWmjYibVLxbGCRn8qFZHfywxd8AJk8tnA5zjFdZf8A7ZXia81a41W50LQpXuIFtyJrbzFj RWLBVDH5euPoAK4RP2qPEtvetdxafpMW7G1ILZY9jA9VxjB4q8Hhc4WHhSlSjzpLVyvd21drd9TX N3wt9cdaji5ezlJvlVNrlV9Em276afia3xs+D/jH9nf4t6x8HfiTDZrrOhXIstS+w3MV/AkoUN+7 ngd45AVI+ZWIr2PxJ+0tZeJfg/4T+E9r4Y0Gxl8Mm9F14ogikGq6xFdvvjiu5GYqVthlYQqjAJzn iuLj/bV0yTUH1PVvAvhq/lktIrXF2JWVfK3cr8wxu3cj2FfL+r/E9NZ1KS+fT7aFWYmOKAFUQE5w B6CunB5RisX7NZjh7Sp2afMrOVrNpJ6GWbZxl2WyqyyXMOeNVtcvJJOMb3V3Ja38te56dpnjETak xuILeYFJLaOO5XcgR1KZwf4lzlT2IBrsNQtY7DS1hnaJWZFMR8wMse7pnv8ApXgul/Emwg1mO/ut ItZkWZZjbMWEbBTnYcENtP1zXofxI+N3hHxxaWEGn+FtO0ie1Qxz3GnF0FxuJI3IzMMjOM969PE4 Ct7enGnTfK92mtO3Vfgj5zB5xSeHqSniFzLZNS1va+qj+bW3obvhvW5fMhgWMStnLQ44PB549PU1 yniOHVomk1iS0eOzkn+zpKqkoJcbwm7+9tBP0rix4/nWGNbK3jtzFHs8yMkM4J7nPWtWw+KdraIY 7uyFxMJEeJ5WJ2FTk4Ge/fNdMsvrRm6sIb9P60Mf7ZpTXJUq27fd6X/Q6fw5po1JHaVpPtJXMUbI drAAkgv6kdOPxrFuLrypDZjcjsQpX7pU56fhWj4m+OM+vLaCDTrOxmtrZoJ7i0Db7olywkmBYqGU NtAQKMAcZya84k8ZJJd+fPHlmAAxwwYd808PgsRJudWNr9L3t93R7/1Y58bmVD4KVTm87W/Ptse0 Dz9LsIriSMsUcyRTYzEw4+VlGe/evMLtvtV48mw/M5Py5C+9Zc/jy8uYvs11PcbegGc8HrXquv8A xi8BeK3sri98P2+lzWsMFtLFou6K2mW3iCGRkkZyJZCu+QhgGYkgDpWSwdejJPk5r3u107b9/I4Y 1aVWLXtVG1rJ3177Lp579Dsvh1FZJ5l54ie6it7aynnD2aRvJ520i2HlyMmUabarkZKrlgDXpfgr 4y/EnwxpX2/Rdb1S1Yq0LJaXEsKvEcho5NjDcjZIZTwe4r5v8W/FDwR4i8RyanpOky6DYuFVLGzm e48pVjVTh5TuO9lLnJwC2BwBWJafEjTdNhFvai4IZiztMRt9sD19TXm4nJJYlc1anrK3utJ23uuq v3s2j2cNxC8HJRw9dWV1zRbXNtZ2dtOquk9/Rfbev/tTfF34l/Cy2+BvifVbW8s478XNvq2sfPe2 0UcewWiXkuXS0HXygQgbnGc182JHHokNprV9PDL9oSYx2iSbpUeI7VMyYG1WzuXk5HpXmUXjDw9c J508lzE+Gz5eGD7mzg57Y7VBL4w8N3Fwm57tEVySu1MYOMY5p4DhqnhVKnhqShGTbaStdvf79PuN sy4kr4/2dTE4hTlFKKcpapJ6LXtr/SOybxJsSdbWASeaAryEHtg5z35r6q/ZT+O3x/8Agp8Rk8Yf s8X1/a+JX067tBfafIRLHa3MTJdRjPYwllI9DxzXzLb/ABN+GVtp02ipDevE372K5eICTzSMFSob G3uDya5CD4qSeH9Vt9c8KSz2stmq+QWVWO7GDuHIOc9+1Tisqq4ilOlGjq1pzbPte2pjKpDBTp1V iYy78kk2tbPv8n1Ptrwc0GofEffHceZe+ZNeXMskhTe7feQAnBI5xnqa8c+NWsyarqJui5jCIiC3 YguAAO4JB/Cvl5/Gt7c6lLrs1y6XE0u9tq8MWJLdMYwegFdEPGFlqOjeTqU0aXUNxlHlZtzIw6bc bcAgktknnFYUOE6tHEwxLleyStbbv8vloa4niqeJwf1TmS1cvi0fb579dTFupZJZRFZb2JOT6kns K6SPTNU8PeGrHxlHqFif7RvLqyWxhuN19B9mEZMlxBjMcUnmARMSdxVuBtr7F/Yn+GX7O3jX4p2w +O/ibwlDokTlriz1bVbvS/P2lSQlxDazbQc4wQM88jGav/Gr9nL4LeFfiRrUvgr4h+BbvSINZu47 GyttSuLjbZgq8BWc2oEow+wEDJKknArOvxTSjj3l8qU1ypPm5G4yvdcqfdaN3VvM7MBwdUeAWYqt TfM7KPtIqcf7zXbdd+th3wb8B/CHxxpuh3/xJ+KkPh9r+LV5NXtJNLvbufS2sYw9kGZMLONQfCL5 TExdXGMV82+K7+TVtZLFpTGnyoZjtYInAHOPwFejWfhbwjr3jS20PwzrfhfS90Eo+0X+qsLBJbYD c5neJSPMxlBt5zgdq5rxp4K0q3urm3bxH4WuprW5jt2ntL9pIpWdd5aIiP5kGcM3GDxXNgNMQ5yn J8y0i0vd1e3Kl5LVvRLzb9PNuathYQp04+67OSn8TSX80vJvRLd+hShtNP12dSJlfkKyYxxjkjGP u45Ga6+wvtFOlXHhfSbGymMx+fUZYy1yu1hgLzgDjjjPNY/w30uPxlr1l4VfXPDGkm4/0aO8v7tb S3iLHbuklK4UD7xLdq+2ov2MoPhj4UuvF1x8Vfg5rxhXzfs+k+K7f7QxYEgCF1V2weuBmuDOsxo4 eSpVpO+jikn37pW+9mvDuAxte9WjGPLZqTcoX22s5Xv6K58l+G/B8Or+JIdMt5d9wPm8tSFcY7fN wM+9enan8P720muL0wmCGJt0b3UZUPhscEDn1NeQfD7xlH8PfjBD481C60q8hguPPaBLqGXzFYMA h8xWjIyQWBH64r7b8U/FjWfHfwy03wt4an8FCNbo3Rlv/EFrHeKgwjwbZJEQIXO8ZTceobGa8XiC WY0cXQVKKdOSSbbStu3+S+9n0/DeZYeWDrqpZTi27Wu7Kyj163fpbzPNfj38RvhZ4r8L+F7bwl4V sPDtxoukQaHqVzaSyu+tXwcu+oz72ISRwQpRQFAUd6+dNY0X+zYYbu+jZEuIfPtWA3iTnGQVPTjv XSfFbwxr3iHV9l1qng22WK4VIbW01u1mEjF/L3LJGTHgHkkkLt5r6Ct/hz4o8CeA7e6vNQ8Bz2Wp m3kt0t/EWm3Nysx+Vt0YmLRMwByWAHH0rqp4mOEw9DllrJ7N+mz/AOH6nPCrjcdVrOVOyik72Xnq 1u7+ummljxXw34HuvEWjrqMMMly1wzRqka7WVgcAAdSW7AZJPavN9b+BPxDk8cWfhGS2axutTmWG KO9b7NEN3IeRpMBVA53Gvru8u/HvhuRW8Or4XksdOlFzJHF4g02QxzRqGJikM4LNn5uAeeBnFeE+ JP2kvi54Y8Tabd6pLaXt9peoz3NqLqe31CNXljIZc73GCrcDOPxFYZZjc3rVpSwig007Jy1Ts+Xb ztf8GPP8Nl1KnTjjHNWtdqOj1XNZ+l7eejR5bqt/4e8CeH38NRWtwuuxXk8V5fCdTayW21RGscYQ OJA4cs5cqylQFBBJ8G1LXdW+0EiaQM3AYMcgH0ruvFet3mu6pPrWqwQr50+ZIoZYxteXLYVVYkjG eRkDv6V5fqElvc7mtAViVgoDMCw9q/Tsry6ooqU4+899b6n5LnWac7tCVorSK208z6h+Enw58K+P vA3iTxXrHjHStH1HQILSWx0TUknNzrLTy7JI7V40aNWgX53MjKNvTmtPQL/RNSjk0uVWNypHzKvm KYwfnZceg9a+YPDepWVkHtZ4pp3yssaJMsSYBw24Hht2QOox75r1rwn4T8ba0lz440PT1Om2SiW+ l+220ZihZ9gPlGZHYB8DhT9MV4+aZVNSqSrVbK65b8qS20Xe779dEfY8O8TUacaVOjQTlZqXxO61 1t0su3qd3rFp4XstRFlpIaeSV9vzoCwB647H+lfSy/s+/D+5/Z1ufjXrXjGC31u21xdGt/Cb2k8l zNZtAzm/W6A8hURwIvLJDEnI4FdV8U/+CfH7SFh8Nk8Rad8N/FFprSTpqz6y2vaNNpY0d4d6jy45 g8c5Locl8bcjGTx8JJqXxR8K6LceC/Fenax5kN9aXDML2Fo4LSRW8yPyCzK0kpZGV942bSCDuJHz WCrrHU08Di05QlaS5ot267N23W+vkfXZjiqeCryWOwnuzjeDSkl5LVJvz6efU9D+KS/B7SvKj+Fs lxd26YxdX5/fMxUEnaOF+bsM49TXztez6oIDcNbOglY+W5TYCPUcc1HqGoa1q2sweG7PTpmvrwxW mm26TReYJ5WAHCnaxfkAEjGRzW/qGj/GHSvLtU0e/At4Yo7z7XJBMBO5ZkKYf5FKbcJknIJzzgfW ZTljw1GNOVXma6zkrvz+/wAj8uzbN3OtK0HGMv5Y6LTqnrstN/zOF+y6g52LG5fG4jBzj1xWjaWV 5FbhnhAVmKiRuBke9fTWgfA/9quLwBefEyDwDq89hHd2kba7GkTQxG5z5MZxJz5pB28dq+/fhJef H670W9+LPxt+AQ8Z+HPBXh680uaA6d/ZtnaXV24jhup5bPa8klvIdwVvlZsKflJrkx/EjpuKh7OU b2b9olZ6WSVne7aXRrexx5hllfD4OpiKFGrVrJJwpqHxK+rcm0o2Svs77H4vNNdBhCR8xGcKM81j 3YkS2kSVMFjhScqRg5OK+jviHZ/FBL0arJ8P5dFi1q/mvtLmS3kR/Jtx5c8MIL48pS2WyuQ2MHFa fxN/apuvE3iO0fxD4W8NWMumeHLPw2bew0eziJFjbmCG4kBVla4cMWnl+9I+HPzAV72HxNWdNTp0 0325l+l15Hh42pWpY6jQ3pSvzTd046ae61rf1VlrrsfJa2k8gwjYyAF7k112l+HvL02HVrm6g817 trc2Tb/PRUVWErDZs8tskLhy2QcgDBPS+D9W8W/F/wAcWPhbRdCfVby6lVItN8Paegu5Rld4higU bm2rwCCOvqa/TP4w/D7TV8NaN4dvfhJ428Np4bjuLSx1C48PyW2oalBcSyXMcurOrMss8MYZA0ag bE9Aa8zPOI5YOpSozp3crt2adl87PV/r2PveGeF45hRr14V4w5LW5rrmfla+y8+3dHwbpfxcPhhB ZWdrBc262whBlBik8xuWJMZ+cK2QpbkD0r7u8V+LPgR4o/ZTn+Jvh3x5BF440/UhYaj4O1O1aC5m 0fJS3ktXUtHIx2qZEVvlHJ9TzvhX/gmr+058ajaW/wAG/AXirXpr2eSaTTrbSLqK4trYLG8c7vKi xGOXzVC7XPqQMjPsfjj/AIIUf8FLSDqOmfBnxZHEXVXWC1ZtjOcBRHuZ8erc+5r4fHPKMbUozhiH TlCV21Z3tvGSadlLys9E0z7TA4jPsBQrUXFVIyjaz6X2lFrqv1aa3Pym0L476/oWq2+pW5lDW+8i aNikwDAg4dSDgA8AV+r37P3/AAVF17Q/AUvw8ms9PjslhFhLrusFSPO1ACNHn2nzFiTZveWOOQqq 4KnIz5De/wDBDH/gp3Zgz3Pwh8aeW121ihSwdt0w4AwOQpPRiMe9c5cf8EZf+Ck1iixS/Bbx20jl /LA0ubc5Q/Oo4wcdTXRxVk3CebU408fKDs1a8rW/FdzPgzjLjTI6kqmX86ve65ea/wCDtsvPQ8s+ I37f3xj8Z/FF/Hl8NOM0bpCtvb+aLCVIIxArGPcM70UbjgFh19K+qf2Wf+C1P7Qv7LHh7WPDfgu0 0lo9elhbUDNGHXy4AQqKrK2BzxgjFcZaf8EXf+CiGoaVHZw/Bzx3FqEgS9W4ksJhD9lYFdhj8vO8 vgg7uBwRzmtfTP8AgiX/AMFEfDms2t54w+C/jXV9ON/9lntNPhe3mmUDlVcxuYs9VYocjtXDjcFw ZUwqwtRU+WKskpJXSWiT5lvtq156E0cfxnUxrxU5zcqjvJyjzK73bi4vbfSL7rWx1E//AAV8/a/+ JXxF8/T/ABPrUc2oyfZobSz2LCvmsWCLEq528keprzvwr8F/jL+0k/irxiuu6FCPDWmz+IdTu/Ee s2unyzooaR47SOd1kuJm52pGrZPGQSAej8O/8Eev+CgVhc7tO+Evjz+1HnJsbcafMBEkLfOXJj2v wQvOOeRnOK9B0j9gr9uebw/qfg/W/gj8S7rxBcXFlcafq50+5jhtbRPME8LwCHbJ5xKlX3AptPBz x4tL/VvAO+TOjT2T5eROyfrslf8AGyZ9VhIZ1iIuGcRnN6yS1S2dk7LRvp+a1PzxuPCPijWY7nVr Cyv7yO0iMl5cQwPIsESYy8rKDsQZGS3A9arf2Hq0LGG3jcTRxiRsAhlB78cjrX9If/BNb9kX47fB b4032t/tW/B74qap4O1zR7vTdbsrKKeCPUYHxthmjRAZE81FYqzAHb0NdXrv/BMrxxrvx41XxN4O +HPjq10Rv9PhVNPuH81Q2/ycvEuASACCuB9BXh4/xrw2FxVTDOHNGMbqUWmn8OmnW7aXXR3S0v8A c5R4E4nG4Sni/aKDk0nzWildyT1bvdWTd0o2krSbul/Pp8Mf2cvid8VfAniz4m+GldLPwhaWt7qE rCXzGF1cLbxLGyg4be2csQMA4OeK40fBj4taMYrzUdP1jTlnszfWk92ktv51vnaJIi20sjE8MOD2 zX9R37Yv7JHhKb4iaKf2cfhp4/0HQtM0aO21mObT7kxPeq3mTTIohyyEsdu48AEYHFfenjb9kf8A Y18YfsneGrjWteOj+LdVjgtPENxrq3SyWtjFIUghiV4W8phgNsDL8oIOMCvhc1+kS8Py1fq/uz1s 7cySlGNktHJ683La/Km7WTa+swn0eML7Kj7etNTclH3YOWsoymnJR5uSK5eVy11a3eh/CJqf/CV6 Jdq0l3fxyK28SpNIGLeu4HOfevcPh94Q/av+IPgDxP4v8AL4y1Hw1oNrBc+LrywlupLSztw+Ld7t lYhVMhwhb+Kv6HPj/wDsB/sdWXw91vXPCPxg8N3l14fs5Z4rP7JdYvYoSEj+yyGIh2um5Vc5UIR3 Gfxu8P8AxO1T4a6Z4h+F3gDxHd2OmeJLZdP8RabbJOseoQBhJsmhKAkAqGX5QV6iv0jIfEanm1Fu hhvei1fmjdW3vdJq/wCTPheJ/CKrlNWE6uJfJO9vipyv6VFGTWu9rP77fI3gfxv+0L4eu5n+G2u+ L7afyGa5XQ728RxbxjLFxA+QiqCSTwBzX2d+yz/wUK+KHwQ+IGgXvjWW41nQ7XV4bzWLe8L3U86b /wB44aQ7z+742BgHAxkZzX6bfsQfsvaR41+H2tW3gvxfFoctx4euJrrUbOw1iK81WO4BT+wS0cXl yxSFFcyKCp37WJ6V3Pw9/wCCKyav4Ru/H/xc8U6f4MeztBeW66jY3zpIkrSFHZ1t9iFNm10kII3K ehr4niHxL4bxcsTgszw6stH7vvbPXZNW6ddrdD6HBeDmb4KhRxuFxWrs7ata2slb4tbp8t13sfmZ +0X/AMFg/j9r/wAYZPE3wCurrwZ4egml/szSLMoZXWTILzyKgLsxO5VbOzhQTtFfL0H/AAU+/bkt 2WwvPF93OF5SK/tYpGOf95MmvrT4k/sO/tKReP8AVfjRNo00E9l4itHtNU0/S3s4vOG5reW2higS ALlEPyqAG2jGWrpJf2Xf2lZrnxF8YvipbXmueLL8WYstQ8Q2WoLq1ncW1xDcR3VkGgRC2f3QGG43 AKBhq+kyjH8G4XCUo0MNSkrRWqTk3pu2rve7k3fyPi8w4Q4vxWLrOpUqqzb02st9n6WSuvM+PYf+ Chv7QmratC/xGWx1N1Co8k1r9nn8r0ym3sTtyOpr9LNA/bK0C0+HTP4Une3muPN82Q2YW++eNY2t 2lwSbdhzsB5OT1ra8Rf8E4fH/wAV/hBL+1L8aNXtJfFc3nWtzoOryXp8RX8sG0pcNC8RygRtihcI FjwPmr6v+H37W37J/wCzJ+yZY/C74p+HvCc/xFtdOlsNJs/F1rDLaNbSI+ye9t4oBOLiFJGEErsS 7N833VI+L4iznIcfOhSwOB5pKVpRgtPNpKLvFb3sl56n3+U8E59luHrYrE4q0be65tRe/VycUnrt dvsmfUWhf8FRf2UofEPhu48X6zIzaboUdtOlq3lolzLEiyMpMRCnIGQuTxyTxXH/ABM/4Kc/sj6N qV9LdeObsx3VmLpbS2e6u5JiAVEbeVGEDEdFYjjqa8m+HHhv9nnVv2U9D8ReNLv4d6tp3l3kljp9 loRk1CO6svMYS3d2mwzLcB9iqzudiKqhSMn4I+K3/BP/AF74nfBC6/a88KX3gyHQNKlh8JW+h2ES 6berdKSwee0G9nwjgNOzs7nAPIzXwXDPAuQY3FVaCjWgqKae1t76Nw6dex5HiXxviuFsDhsbmHLb ESjTh7s5XlJ8sdI3um3pLbq2lZnBeO/+C4vx/wDDvi3Vrn4A22i+H7W7ieztZ/sfnXXkuoTzTvOw S8bgQowxz1Ga+E9Z/wCCqv7fFxro164+KfjGWZXLY+3yCMFjzsQHC57lcGuy+M//AAT3+Ivwi+Eu i/F/VtU8P6jB4kNydNsdGvDd3sQtW2TfaoVQNDjIKZ++MkV8b6H8C/2gYNQ+1eFPDGu3F1JbOkaW +mSXbPFcq0R2xmKQZZSdpAyOq4IBr+puHuG+FaVNujQpbJXkld6K13JX2sfgmNzvP8xlKrD2r1af LGas09Vay26dGttHc/Rp/wDgvx/wUDs9QS+tdW0iJTYx2k8T2CyxTui7BcskpK+aR1YcE8kZr66+ EH/Bw38c9Pt4vEnxm8NeGLm0uIpNGF/oZjh1BpIkD7pbRpGOxtw+cqqZzs5BFfgD41+GH7Q2oy2m keJ/D/i2R9H0wWlpb32m3StaWULM2xVaPKxKzMee5Ncjo3wY+LWs3S2em+GfEE0z/dij065LMPYe WSa7sw8M+EcVQ5ZYalFdXFpP701+N15Bl+bcU0Kil7KrLteDs9uji7ryVvU+/viD+31rOuXovvCW iQWzLcPcmW/mkuYzKTmKRYDiNGjH3cD61ra1/wAFfP2v9V1KbWtX1DRL+7mwJZdT0q2vY3VWZlTy LhHi2pn5Bt+XAx0Fc38b7v4reLP2dfhZ8NpvANzp0nw+8Oaxp+rajFoL215ctqGrS3MUlzKsYeUx Q7I1eXJAyBxzXx1Z/AX4yeIlR9E8I+JbhJFMiGPTLqTco6sNsZyvuOK6cv4d4cnTvOjTai2veals +7b0e68raLYrMcw4kc3GKqJy1aUJL8LdNn5n1N4k/wCCjPxX+JunW2kfESz0maK0mmnhfSbC204r JOFD5W3jRSuFGARgc4xk11H7Pf7Zvwz+HvxM07xJ430rVUsLG+ivT/ZJikndosnAEm0KCcZOenT1 ryXwX/wT6/a28Uww6rp/w/8AFht35Dvpd0owD15jz+Yr9j/j5/wSj+EHjj4UeI/2pfhBNoPg7Q/B ejaTpet+Eb/UZUv21aOwthdXEa3G6TbNcNM8gYDbtAVcHhYutkE28qwsOZSjJtUteVLV3s9N7r5n 5vx1xjjuFsNHPc+lKmuaMYucJPmk78q22stW7JLd2Pgb4qftZ/sq+PPiFdXjQ/EKfw2+kkW9uq6V p91/aQiYR7xbRFBbJIRkcuyjJOTXA/DP9rPwh4K+E+meEYNV8SpqNlqtxcnT4Qg0lLeRECyRrvVz cuy/vCQFKquMkcV/2VfhD8FLjUPHcvxg0hvEtongTWh4Y+x3UsRg14RbrK5/dAGRY2BLI3ykdQcV 5Rp37JHi4fDe3+K/2PUriwku2gl8u2dY4mR8bTKeGLgZwOVPB5Iz588DkMaf1KrUnaLikpPd8rta 6tdpu+2qXlf9Ly3N87xPLmFCMJNxk3bpG6Wut+1lru31Z96fHf8Abz/Z68Ya3HdfCPwzrsWnyWll He6RqBt7ZJ7q3hEckha2GfmO7HBJySTmvkCz/aS0nT76eePTLmyM8U8Uhjk3bBIu1F2EAYX1PNfs fpXhH/gmb4e13wlcfCzwJreneL7rw5omreHrK+1RdRshr6uzX0eoxXCEtFmNTGoVQCzZyuK+gtc8 M/8ABPP4v6PefF748aW/ib4yR/2dDq3hnw1LBpdleSpNi7eeSMFbue6i5aaFY1RjgKAtfmuF4hyP LKsMup4Oq4NWUm5Svva9r2jpy88lbmsm9j9sq5Nm+LpUsXiMbTi6koq0Yr3eZJ3b0tprvqrtb6/l N8Dv2pfiV41sIfgX4bNjqWlXyLqcmh68tpFFLe2cRkE4nvGSIMqoQASCy5QA7sH660H4cfGn4Xfs zeJfjToel63o/hXxVa/ZY7a2v7c6ZfSaeSbv7ZC0ouZ4rYkzII1O1wGPyKK9u/YF8F/sw+Bf2t/F nxG+OfwD8XXXg6+t5JfBegGJrmHTpC4McbyyNEsgCqU3hj7Asaxf2u/2nbT4X6R8T/hf8O/C3irw xB4s0qGysdJmsIL2GO1kfdfWLSMgNpAxbcJ13TMVWM4HNfOZ7XjWx1Ohl1BRjUlByW8t05SaUlFr VRvfmXLJ6xtf77hjEywuX4p46UpOmnyTcfce6ShJ+9dW5lZOGyWruvx10b9pDTfBM2vW1xql9qia j4f/ALFgawaaJcmRHJOTHkZUn5lPXI5ArJ+H/wC1b8N/CPjKx1S/0fVYbVNKuLTUd9wb2S7upBIF nImIAA3INmcDbkcmsnwVY/DTw/4m1SP4geB9enjvNIWDRYri5a3ms74+W/20xpGTNFgOBHxw4Oci vbP+ChbfsQ6r4l0HXPgFo974bd/C9hBrHhuCKUpbalGCJZTNcSuZBMMOWXADcBcCv1hwwE8ZDAzw dSSqp3lG1vhS15Xb5taPbufjFTDZlTwMsxpY2mvZS+F3vq/7y5telum7Wie5pP7XPwp8XIIT/Z9h ftFpcZbVNKR7VxawyJcDZGrrlmI2HaPmO44IzXQ6v8d/2a7V4vGOgxeHU1uDTL3TrezjsLsqJolB SeYSGS2lW5PBAwCQ25FBBPP/APBKP4V6lb/tW+E7zXEvdBt9ctLyLQfEt/ov263t/tkE1quoQx3C GGUW7MWVsModPUV6J+2z/wAE8vGfwF+JF18JPhXbXvitNT1nyf7XigUxXs4kZojattDrvDZZSFGc 9gK+bzCWQUM7jlHt5Qm43XvJJpXUk9NlZaPd6K2p9Pk0+IJZI82qYeFRe87OE20k0lJWdr3klfor Np6HA6r+zH8ffEdz8Ofjppvhi+uPC2s6Vdadaa1Bb7rJrqFbqa4jyo2x+UjBmJACqQc4pnwZ/ZO+ I/xr1fw1qHhObRI7LwvDq1/rl3eavZWiRJaXTSOsJlkBklYY8pYwS56VDd/CD/go9afCyH4LfZvF Wj+CtK8RSs+npEFistR3RxyvJcQq0w2syhhu289DzV34A3/xS/Y1+P2n/FLxPY6hNNpC3RI/shZr cXAheGG9SKUrHJ5MjrKrSrtLAcHpXtYrEZjChVjRxNOUop8kYXk3H3rJ6pczUumiaWrR4X/CfGUa 9TAVeRtOTl8Ka5X0Tdrx162fQ9R8A/sneKPDkvhP9pX4p+FvHF94ZvJL9fDviXRdSgsJItYt52lh uJ7yWKYgW7lJHAAZyMKcmvmr9qz9nj4gaF8Vb6w8V+Lp/G18I31O/wBfs9PkdJJp1WUAyCSRm3Ek F2IClTx1x+w3wy/an/aH0T4feGdavfgFaePrHSrqbVYdV1XT5LWz1JL2R/tUlxa/aHhaZpZAUkWM AHI24AI8e8b/ALafiLwjP4e0mL9lzwJp+mnVk8U6FPqlnfXVxeIZAjW8sysVkikZSojbKLu+VTXx OAz7iWGZOq8PFxjzxXvUulrfFLni924qKT15ruKT+vxeE4YxOCl9WVSUJ8s27TsldpXUPdlfT3nf f3eU/Kr4c/s7ftEaP4JT4p22i6qukf8ACR21nYXrofKa+hVp5NsbE5ZYVLs+3AUcmvsf9seXwZ8R obTVfAkHhFtSu9F0+2m0zwj4Zn0l3uluAHWSZnYajckfO8sAKNnPqB+p9h8RZ9B+Gt1pvxp/ZS8M 3dpceJk8aapa6VBcQ7LB4zK1nalhvWRAzIyKwRTgY4yfzIuPHfxe8YeKk+MP7IfwDHg3WNOvr6Zb +ytr+JNOikMfkGwaecCGeNAwMi5PzNjtgwPHGKzLFPGVIxh7Juz56Sg7p8qnLnk0nZapLV7Pp31e B/7Pw6y/D4as/bR0UoTcnZ+84RUdbX+10SXm8DwT+yV+0h8ZfDniLW/APgYaxoWnWcOmf23Cshvk 1G4shHBaRxNLhzI/yHbESu3aSMV5N/w7I/bq/wCiW+Lv/BbL/hX1d8APj/8A8FGvhfrN78ZvBXws 0uS+fWJL258V3i3MsxumdhOXkF+Fd23eWzbSSABnOTX25/w98/4K/f8AQraB/wB+7r/5Orxs44k4 ppYiVPLZYbkX81VXv12n+i72R0y4cjJL2mV4htKzvTkrNbr+Hqr7XSfTW13/AP/U/kw1L9pvw211 dvoF34g0iZ5NsH2UK7tHtB3PIWXDFs5A4x9K0n/aq8OX3hKz0LW7/wAQX91aSSzS3c6R+ZcFmDRL IxmIxF0Uheh5FfoPN/wbc/8ABROG68i6j8GRlTgyjVJWA/K3z+lVr3/g3I/b1tFw8/hAsRwIrm6b P4/ZsV+cx4SyeSgrrTVaq+1t9/x8+x+1LxTzmHPy1FaV0101d9r2+5babXv+YJ/aC0T+zWvLi71h 7uWNhPGsMPku5O4ZO7DDpyy5qBvjp4A1KaK1uIdUETW+Z3WysEdZP7q4HK5zzkH2r9GdQ/4N8f25 9OQu8WhSlQdwge4bn2PlDNYum/8ABBL9tW4l2vFYxH7pyk/X/v3zXr0uFcBK7h+D/rY8GXiBmEko zmn63f6n53L8SPhhJM5ni1k5kLJ5a2yfLgDB5wDx24q/bfFz4b6dIj2ttrR2NvUPJB/Ce+K/XzwV /wAG4n7UuukP4j1/TLBWHSO0uJiM+uQor0i6/wCDa/4q2U4W68Zbht5EOmOoJ/FjTxGQ4FK02383 +hjR4yxsWnFxXyR+Rdx+2b8P4NT1C7uvBllci+hijSKbAFqyJsLxbMff6sCOtfLknibwtdqbmEne 5JHmRBiATnpnH5iv6BW/4NsviPJJ+88aMD0IOmuxP/fJr9Dv2eP+DVr4N+KtEWT4r/EfxVa3ZjDl bGytYoiemF81GOMc8k1+bcacX8O8GYL6/i+eMG4x92M5vstNdO7+9n29DHZxxA5zxFWDVNOTbSVu Zq+kFd6+Tt5I/lotv2q7kNFPqltaSyQWdvYRvaLJaN5dsgjTdscgkqACQBWbqv7Ukt8Cghkj9Nt3 cd/o/Nf04/H/AP4NdvCPg/UQnwq8fa1eWakeY9/bW8jnPQjylX8ua4z4Qf8ABr/a+L9YMfjjxvq1 nYljl4bKFGz/ALzg8f8AAa+UpeInBcsn/wBY+SfsUr39nU5l5cqV7+Vj7KUOJXUjg1i4vmXNfmjt vd3XN8rX8j+Z6L9o/VYx9nEpeFRgRzySyLx9WNcb4p+LFj4ltpI722sUZmVjLEhD5+u7n8a/pp+M v/BsJ4y8M+JZbX4feNUudLZcwz6hagyAjsfKxkH1C18l6/8A8G437SgmLWWr6XIFOPusgYDvggV+ m8G43JM1oUswy2D5ZpNPllF6900tfJn59xRj83wfNhsbXUv+3oyXy67eSPwI1LxDot5HsgiityWB LReY2R6fMxrGn1PSp5Yt7qY40I8sq20k9yc1+/Sf8G7P7VP+rjutLcAbflbn3POK7zRP+DbX9pTU gv8AaOr6XbDbgggSYP4Gv0anhYxja1kfnVbMXOUnzrX0P5wZrrQ3jKxv5bNyzoDlvqCSPypDdeHw oXcSAvPDdvxr+paw/wCDYb4vXMebzxlpsb4CgJak8f8AfVaEn/BsP8Q7eEtP42tSehEVkCPzL10Q o8yUE9jiljVzN3P5VGutFjBWORlB5IwSPx5qqx0J/mjnl6dgef1r+rS0/wCDZjxc0gSfxrtBGCRZ J/V67zTv+DYCSWPNz49lQ8fdso+n/fVdH1VqyuvvMPrkW+b9GfyGbdDkGfMm5GOh7/WopIdBdSrS zcnPC5r+wO5/4NhtMtfmm8e3TDr8tmnUemDWRL/wba+EbFt1z4y1KRep228a1rTy+UrWkvvMZY6l b3vyP5DVtdAXI86brnG3J4qMw6GOFlm/AfqK/rU1H/g3b8CwnMfjHVFGc/NBGefTPFcte/8ABvd4 Rh5g8YaixALD/R48E/nXXHJq7/4cw/tTDd9vI/lS8rQl+UTze4K8gipRHoJXmebP+6Sa/pzv/wDg gBbWoAs/E91IepVoYxgnt15qOx/4IBNcfJdeIbkdiyxrjFbf6vYi3Nb8TnnnGGUknL8D+ZInQ5Ji /nTDoeV4zjqKsJBpcykRzzOBjO1Mnn8K/qGvv+CBXw30GDzvFXjWSxUgNvupIIFx06yEV+AH7WXw t8Pfs+/HvxF8IPBepR6xYaLdR28WpwukizlokdiGjypwWI4PauTGZTUopTqLc2w2aUas3TpSu9/k eDW0On25BSWc9uY85/Piuy8Paz9jtZ7FZ5VgmGW3grggdvQmvPJby6dA0cb56Fs8flWe13qIXbtP JxXm1MHCa5ZHq0sTKlJSjodzf3elysqRG43oMF8ZBA7/AP16ypBp0uDK9wADn5Ux0rmPtt/t37Dx 7ECovtd/94L35C04YSmtDCrXu+Y7CWWxH3GnJPAxH179aqbNKQs++4LHkgp3/KuYbULpTh8j+Ijv TxqF7twqk98nNP6tHoTCql0OidNPdSVecA9go70IbEKFV5uOQfLrnft1+EzsYDHPXmrIvdRCA7Hx 0xg5q3hopXY/ap2ujSzZtcGfzZs4xjyv69aY0tmNzK8p3DaT5RBrMOoX0eWcFecZ5FRrqF7vHQ5O Rz0ojRpsUVbU1kktIY/JjlnIIPWLP51VnttPmk/evPk9SsfBIFQNqV4D9zpjBpBfXr/djzjp1FON GK1Mmk29CR7HTCv37nP/AFy6+9WRptgqb1kuSSf+eeP51Q+2aiTkE7h1GMj8asw6hesQXGQfr1rV 0VtcLpvVDhpti37wm5JJ5GzHTvV1LDTOj/aenACH+dUpb/UgxMa4HbPpSG/1Uc4HbqPzqZ0+5KUV 0L0dhpMZLqLkE84wc0sllpEmCY7nI9FPb8KqQS61cP5cMZZsZwBzxUsr63Ap82Hgkjn0pcivc0Ti ugnkaYjGOOK4Ixktgcjv15rUtryC2ULFDNgcKdgz+JzXPPf6krFjFgngHPT8KabzUQD8uPXJxUPD RluD5Hujq21ZJJRL5VxwMHK5x+tRvfwTPvlguGbqDsBx/wDXrlF1C/Y8AZ3evcfj/SrKahrCqXjj BQckjBqVhILVIFyRaaOs/tlB+7EV2PlwMKD+JqKHUTDGEihuQF/hKjP5g1zA1nUZV3quMH5SBkVF JrGrwpyFGe+Kn6lD+VD/AHfb8DovtkYmMxgnBduSyg8e2D1q4bq2kADRzEg5A2Y/rXJ/btYkKvsD Y7e/akW+1QIW8sqBznnitJYSKWyK93azOveaCVSrRz4PYLj+tRfuAhRUuMfT9Otcn/al8oHr7VX/ ALZu95OcduemaiNCG6B04J3sdckdjF8saTjB/uf/AF6lH2TGRHOeey/nXM22o6lO22JQwX7xHpUs Ws3e/wAvG0988UOnHqiY8rOkK2gGRHcc9Ttqo8ViW3mO4Lf7g7e1Vk1K6IzkHAx7/Sqk2oajCCzK dpPDY4/OoUFvY3dONi3Jp+nM/mPBdfl0/I1GdP0hny9vcGtGaLUY4Y2k4dl3dCVbPpWR9o1QybW2 KP7znA/l+lbunZXRHsollbDSUOVguxml+yaaW/1Nyce1V2n1DcFSaHPs1Kbq/hb53iI9QwrP5F+w jcleztTHhUuQpOT8vJ9OaqnT7DG1YbrPfgcfrTDq1/sLFkxnA5/PH41DJrF6OMoSehBzya2SuKpG PcvDTrRh/qbnj29KjbTrTPEFye+cDr+dU11i9YlTtyBg1Iup3+MZXPcd6lQ7DUE1a5afTrWT70Vz 6ggf0pq2Onfd8i6x64xnNV4dZuHby2kjU57mpnvNQJKxtGT6Keenap02sU6cbE32KyAIEF1hQOc9 f1qNksNvltDdnjgdf61S/tfUQpPygA9+3sTioTq+o7dybMZwCB/9eqUYvock6cb6Gh5Om7cfZ7rr 6fp1pfstqfu290QB04z/ADrPXV711ABTjk/WrI1G/AyzqCPSpbV9gjhoNEogsiuPst3wcjgfh3qR 7a1PzeRdY7rgf41X/tu4VvldcepGKsxapdzIzKY/kXLZwKXMlsbLDRta4wRWgf5oLoHGSMDt+NSl LCRTut7k9+R/9eqra9OzDa0Y9ODUy6vdFcs8Q7jHpRddUL2EdkXbOS1szvgt7hWHfaP8auHVN7Fn t7gkjnKD6cViLr0oby8x5+vFW3vNVjgjumWPy5DhGLDnFTaLesQ9kuVWexbfUYtnlG1uSCMHKDpT ftFsUyLOcY6AKoP481Rk1XUYyC3lcjPByfyzVb+2rtkOXi65yKTpwX2QVBb33NEyWZbebO4z0P3f 1FO82zU7Ta3PAIGAO/41m3ep31ruRmQleCeP8auQQ+JbiNLmGF2jkG5WIwCPUZ7VtGEeiCNCMVa+ xZW5VEXFvc/KdwGBVwawyyeY1vPlhgnYv6VhyXupW0piu3ijPoTlvyq/ps82osYEuoVZRldw4IwP esZ0I3s4lQpRaZfbWvlCLbT4HAO1eaYdWuVUeVazj5gTwuDj+VZMuoyowRbm3cl9pwCPbJ9vxqud bure5K745AOMocAn2PtT9jTW0UZ+yi9TqB4hvXYyC1lyV2kbVHH0qL+37oY/0OYbMgZRT2rDN/rU qK8RVlI69R9MjjNWdQN6thBdxOg8xcMM5JPsP1ohhqP8gvq8bXRcXUrls4s5sM2SQEz60NJJcjY9 pMAT2VQQfzrlf7TmiC/OpJ/hB+6ffFO/ti5DCFnTOeTnHX6VvGnST2FGmkb5KEndaXJwcZCr+nNW EtJZMtBZXbZ42rgdPxrJeXUkVXuZbe3XHBZsscewPNQRapJKxS3mVioyxPyA/TJqvZw7CjSs9zr/ ALb4hS2MM8GoGPGCrSfKQOmRmomh1ebltPvORjI29Pzri7nW7mPKb8MDg+n6UHVJ0iSUTozMfuAd Prz/AErNUqW/KVNczs5XO1g027nJElpdRFiBuYLx6EEHivVfG3wjfwVcJZz6rp17JLax3WNPmEyr uGdhcfLvHRh6186x6xfuWKvGNo3H5h0H1qe31VpEUPMAzcEdAPrWilTV7wv8w9lzW9479INUWM26 x3qxswbywTtJH+zuxWlFc+JLS1eytxqKwTkJLGrkI+TwGG7nmvH31W9Tcok455HTFJDf6hOhEUuS o5Hfn+dR7Ok9HEd5J7tHrc9jrMz7nt7xmBxyQcDH1qhL4avrnO6yuScbdxC549815ub3VLT55WkC txnacZ/Gpz4hu4sqsiHjqBj+dVGnTi7cpEP7zPRdP8P61p8wu7C3vY5QQVkQqjA+xDZFdZDp/wAQ 5rjz2GqO+CNzTknB46mTuDXhn9tXNyGDSAepC8EfnTItWn8neZV+9tweTx3+lXKNGS1jr/XkaQk9 +b+vvPsLwH4r/aG+HWojXPAupeI9KuYRkXNhftBIoXnG5JQcDH6V9VWf7ef/AAUUutDGnQ/Eb4iS WcxE5U69cfO3G1+Z85GOD2r8orbV55ZFtzOibv4m6Lj396nk1VomP+kxuRySB1ryq+U4Gq+apQT+ 7/I9bC5ti6KcaNeS8lJn6VT/ALXv7eMsgWT4gfEQkT/awD4guf8AX8jzf9f9/r83Wq9z+1v+3Zcz wy3Pj/x+8lvu8hm8Q3AMfmcOVIuBjd3wea/Nb/hI26K5HQZFMOuyOwSNxz2b1FS8ny/Z4dfcv8jW WeYxq/1iWv8Aef8Amfpon7XH7dUIby/H/j6MlBCzR+JbsEoh4Tm5Pyg8gdBQ37ZP7etvm/n+JfxD zE/2gyHxLc7g4H38/aM7gO/WvzTivbu5/wBXtJ6hQTx3NNg1C8lmW3tiZGIPTp+tQ8ky6Ss8OvuX +RpLP8fHVYmS/wC3n/mfqNb/ALZn/BQwTrcRfE74hAlSFc+KrgNh+Wxm4/i71ftP2w/+ChVrdNeQ /FLx/FK20SSDxbMCQOmf9K7Z4r8oZNY1S3uTbyrgg4wcZFaovdWVvLnaJG68kZrllw3ly1+qx+5f 5DpcSZjZJYqf/gT/AMz9j9I/4KOf8FMtAtV07S/jF49iRR8qjxXKcKO3Nwa6+z/4Ku/8FQYVI/4X N43LxcK0niZzgn6zc/rX4fy6tewsFMyZPQDn+VEetXe4b3RTnn0NZT4by9pL6uvuPQXEuYbrES+9 s/a2b/gpn/wUt1V5ZNY+NHjh1kH7xD4slRWBHcCfGPavBtc/a1/au8b3Mt94s8e+IdRt7pi8lpqH iKSSJnI27zFJKRux/FjNfma2t3iDd5hbB42qTVVtfu5Ccuc+pXFcsuD8slLnlhYt7X5V/kdlDjXM qCSpYqSs76Se59x3njz4yLD9mtPEtzFCriQRDXMKDnIIUPjg8/4V51fW/wAS9W11/EtxrcD6hI2+ S9l1pfPY7duTIX3EleOvTivmSLVb65OxXywGeFIGO/amT3d/GhYhjgfex/8AWr2MNl2Go/BSSe23 /APKxucYjE+9Vqt+smfoN8Pfi/8AtUfD77C/gX4g6jo/9mt/oLWPimS3EA3iTEYSUBRvUNwAC3Pa vo34kf8ABQz/AIKIfGr4dTfDP4ifGHXNY8P3CGK80vUfE7tFcKjfdlRn/eAkZ+bIPWvxttdUnYYm Z1ATpjGT+IqF9TvgWdWcqvI4x+lclXh3Azn7R0I3/wAKNqXEmLjBQVaVl/eenp2P0Tl+Mn7UMPwz k+EK/EG8HhS4nW6m8Nr4mkOnNKjB1c2ok8vcGAYHbnIB6ivRrT9tr9vuwtNN0m3+M3ipLbRpIZdL g/4S+6aO2a3wYjGplKjZj5eMCvymTVb6RPMV2Htjn8sVG2pamxBLN9QP/rVUuHsDJNTw8XrfWK3+ 7czXEWM0lCvJf9vM/XH4w/t2ftm/HHxBp/if4qfESfV77SYhDpVzd65LJNaoDk+VJu3qWb5yc5ye tfPk/jrxzf31xqWtanoF9dXjtLc3moXpubiRnJLFpJNzEknrnNfEFlNq0zERMPlH/LX5Rz6etOaT XIX3EMwzzsIYVWHyDA0rewoKPouhOJ4gxla0a9dySeicnZfof1S/8E5v+CyOq/skfCmH4Q+KfBnw w8U6HFcSXlqutXt4JoZZn3sxiZ3twdwHKxKcDknNfqBp/wDwcN/DCZ4bWH4UfBe3tVl8xo2u5eCe rhRHt3H1PNfwWW1/dTHZLOYyBn5lY/hkCpYfEFxA22bzCuedoIyPxr80zjwQ4fxdaeJnhI80ndvl i22+rum2z7zLvFLH0qcaVS0+Xa7fTRbNdD+2X9s7/gtV8Pf2h/gvqPwj+Gvgn4N6DqOprGo1qGd0 ubdoyGBgaOOMqeByW/M1+NWlft0/t8eE9a/tLRPjSLaSJ1mVU8S3jIGRfLQjv8q8KOwr8Kb7W7mW c/YRKU4++pzn3qiNT1NwXlNwgxjCISSfyNe1knhXk+ETh9WUr9XGP+SX9eRw554nZniaUKKquEI3 tGMpW1tfdu+y3Z+5vi39tj9rjxQLvU9b+Kcctxd2g0+8u4PFGrK09sH8zyHUlkKbyWAx1JxXT+Av +CoH7d3w11tPEehfF6IzKm0JcazdXKgbQv8Ay0ibBxx+ffmvwDW/1RAJVNwcgZVQemeeDjmrUuoX rIfszSscZw6OD/IV7q8PckjG31KLt5LT0fTY+ZfG2ZyjyfWp27c0mvuv/wAOfuh8Wv8AgpN+2Z8T 7q71LxT8aNSuG1CJYr2103X9Rs42RCcIQsQUgZ6CuXj/AOClf7bw8uG0+N/iuAQ2q2KgeKb85t0z iPAiGQMn3561+IT6jryqGCyjJ4Khj+lXIr+6ks5IrhbhZNwKny2JI9uK76fBuUxjb6nH7jlqcYZn JpPFSXzfltrpt+B/Rv4S/wCCz3/BQnwloo0iT4v6jqEJdMT3OuamZ0hVCnlK0ZUYOQ24qXyODjNf GnxV/aW8a/EfWG8R32rabfXlxPLcXt3d6jqN080s6eXKzmRxkuowxPJHHSvyktIr17YSRXRG7kpK rZ49eKhW/wBWt5WGHbaesauAfccUsLwblNOt7dYbXbeX5XseRnePxOZ4ZYTG1PaU735ZWaurpOz3 dm/vZ+o3gD4weAvDmlz6d4g0zSwXDul3o+o3dtcFyuArGTzEVQcHIXPavcPCP7c2naF4QuvAGq2F pqGk3ZQtDNqshljkiIKyoTAcNuGTjqeua/El/EmqzPta2nPb5wxz79Kz1l1N5C4jnHOfuMPw6UYz w/yXE3dbDN3d/jqLXo1aWnyDL8/xuHiqdGtbS2y27Pufvmf25fhLonxDsfil4P8AC9pFrthDDDbX J1m4hhTycDd9nMMiljjLHdgsSQAOK9F+I3/BS3wj8WPFX/Cf+L9DEOtCNI/N07WvssQEYwNgislK nnk5JPcmv5xlvNcDkeXcKoPXYx4/KrklzqisHt0uX4GcxnGe/GK86XhdkLnGtLCS5oqyftau3b47 W8j1aXF2YRi4qto3d6Lfvsf0a+Iv+Cpei+N/hdb/AAm8caUtzpunsZNNk/tVZJ4JCMb/ADpbJ5g3 qUdPwr5D0/8Aa0isvHVt4oe7j1Wwgm86XQ9Yv557K44xslWIQsUP8Q3fMeSa/IWS51xiGuIpwjdk iP6/59qWbU7+3BWztJCw/jeJj9Dg8VtgvDfIMPGpGngNJ3veU3vvu3Zvyt3NKnHGb80ZfWneOz00 8uh+nnxF+Mtr8UviHP8AETWrqy05pvLjt9M0VpUtIIoUCKi+dM8uMAcGTrXmet2nha6mW50fX76X cpBN/wCUj7h6bZH4HbNfn0tz4imnDGO5/wBoLEcY9uKvXDa2qDyobj1O5Dn06Cvr8tynB4anCnh8 PyxgrJJu1l0PGxmeYrEynOvV55Sbk297vd79T9if2fP2ufjH+zlq1vL4T+IGoWNrBC1sbRBHfRJD KDuSO3nYRhRncFBUZJPc16947/4KUfFy6nstO8F+Mj9i09N9tJqNhb28yTuzO7Kkck6AbjkfMfTA FfgrFceJidxiuhjn/Vtg/pWs9xrMtk8UyXW84KKIjj67scV8rmHhlw9jMW8dicrpznbVuEW3vZt2 u2ru2uzfc+4yjxj4mwGEjhMDmVSnFNW5ZyVrX0S5rJavp37s/ok+GX/BZ39qP4SPbaz4b1nws2sW sstydZubMzzzzSRCMGWNn8khANyoIwu7nHOK56x/4LF/tVNrra/ruv8AhbW0mcTT2GsaZFJbzNu3 MJIwFUo3QxsChHGK/n5s4tcncrcm7jTHDCJj+HSqskPiOJjGguXPtE2CPxFedDwf4VS5f7Hp2ve1 no9NV22W1tl2R31fG/iqpNzlmcua1m/du1ro3bVat631be7P3r+L/wDwVo/aX+MnhlPBviXWfCdr p1tLHLpdto2j2dhHZBJhMYlWCFRLGSqjbLuAA9zXyX4c/aR1Kxu5LjxrJo3iqMSQzRwapcXlv5ex 97IrWU8DBX6NzkD7u081+YrW3iaSMny7sN6CM4xULx+JzHsNvdjOOQhP9K+qpcK5XCjUoU8Goxna 9nJN2tbVNPoup8diuNMzq1IVKuKcnC9trK927K1t2+h+nHi39pPXvEuoTXkesXGnW0qokenW2ral PDFhFVyrXE8knzsC5BYgFiBgAV5HqfjPUryAxR+I7hFZsOFvZyCMdNu/FfE0Nv4hIO6G6DDorI3P 6Uvl+Js4+zXg56hD/hXXhMiy+hBQo4KKS8nfTu936ts8mvnOLqyc54jV+n5bL5H1bb3ktrF9nt/E MkcIBCxiaQKBnPC5x1pf7Rl/6GJ/+/kn+NfK/k+KFAYQ3gx/eiP8qM+Kf7l3/wB+G/wrpng8M3f6 svx/zOR4vFdKzP/V/pP8PftdfsoeP7yOy8FfEz4e6pcTzC3gt7PxBp7SySnoiRmYOzHsAOe1e+CK 3niLRGAjkkxyxsPrwfav8pT+19Qhky9ugZSDxg8juDmttPiH4qgQwLPdqDwVjuHUHPbhsGvAjwxa 3K0reX/BPZqS0erP9UUaTDefJGI3ByfkdT/I1VPg455t2559q/ywk8eeLLfIt7nUogAc+TeSpgf8 BYVZsv2gPjVpamHR/G3jSygxtS3ttcvokX1wElGPpXoQyuvHaS+5/wCZwulFvV3P9S258L3McZAi AOSMEgVwOsaC6g+fGpOM/fr/ADj/AIZ/8FM/+Cg/wV1OHVPAHxY8ausB+Wx1zUH1ezcd1kt71pUY H6A+hr6Jm/4L+/8ABVVbvz7nxN4buY1/5ZS+HbQKw99hVvyNFLDYiMveUWgrUIcq5btn90r6HAJ8 uhx7MT+Ve2+FoI7bTkW1Urt/vdvzr+G79n7/AIOP/wBqHwr4slb9p7wrovizQ3t38lfDVv8A2Tfx XHGw73kkiaPruBG7pg1+hPhn/g6V+AVkBbeI/hP40t4wNwktr+zmO70wSvHvmvzzxb4Wr5rlcqFG gqj7H3nhvm1LBYqTxE0lJW1/Vn9OvjS2SazDTLuJbOR2NQ+ArYxQyLFgAkHdnmvxQ+Gf/Bw1/wAE 4vi14Rm1Pxtruq+A76G58r+yPENhPcyyqVBEsclik8ZXJ28kHIPGOa/Tj9l/9rT9mn9pLRX1r4C+ M9B8UW4yJk0+cLdQkEf6y1lCToPdkx71+f0uFsXS4WngZ4VJ2ty62+7sfb1c6ws89hVhVTVt1a22 1z3bxxZm5KkopYDIavIrvRo2lJaMZI5Fe8eJJYJIAXDlcdgf515RPf6USTG4A6c81+keGFCvRy+j S+r8qirW1t+J8H4hOjPGTnGqncyrDRGI2pGhY8c119hpOpQEFIosf1rEttb0eBg7SAnoAPrXV2ni /R1jHmSkD09a/RcZTrv4aV/kfAUJUr2c7fM3YItc8v5EgOBgZBp7WusyJseO3wepIP8AKq8Xjvw7 GuDMeDz8p6VZHjXQ5V8xHyOisorw5Yavdv6vb5HsKdKyvVKR0rVmG9EtR9Qf8aX7L4gRcoLMHHQZ 6ewzVweL9FxlXdT35GDUTeKdOdSY2J7dKUqeIb/hL7jWEqSXxmLfaf4jmTgW4b6Ejj6GvLNf0TxK pwfshySfutx+tepXni628tjESf8Aczn0rhdT8VwSIzt52FznOD/Wvey+hUWvIvuPIxlSD0UmeK6h oPiCWRgVtsH5T1A+vevJ/EPhPV4CZHMeR3AwAc17vqXi+FWdY1Yn1I4P4e1eQeIvEl7dZEeFzkcg ZHtX1WVQxHtF7qSPmszlTSaTbZ5dceHtWuQUjuRCT/EEViPzrwjxL+yh4t8deJbjxAvxN8e6Y08I t1sdGubW2tYkAwfLiMDYY55YkmvowatPEDvcsSeM4AI9xWjp3iaaKcMoRuhbB5/nX2U6VZJ8rXyP n6FWmnaabPzJ1z/gg78Afi3eDUPiJ4u+I+qzRr5cUupaqlzsBbd8iyREckk+leB+Jf8Ag1w+A+pa g9x4c8e+KbWFm3CC5S3kZc9tyxrn8q/oT0Dxg7Y8qFQCMli/btxXp1p4qkdQ7xj23TD8utfEY+hU VRzlFH2eBxd6ajGX9fcfzBp/wau/CZgof4heIs5xxbw/4c1zuv8A/Brt4H08qmieNtUlUkBvOtYw fr8tf1eNq000eUAj4zlZAeD/ACqNNSVXWKe75z2bNeW6843fLH7j0nLmtds/lb0f/g1n8B3lsTee PdWRj/yzW2TYf0NdQf8Ag1S8BPDti8da2iY6paoMfT5a/q+0TULJ2QCdNwIPNepx6jIIAsdzG393 BOf0Br8+4g49r4SajTpRd+6/4B9nk3CtLEx9+cl6M/jTm/4NV/hLaZe58eeI93PzeTFj36qKz2/4 NhPgXajEnxB8Rg/xExQfp8tf13eKrq6bcDISD0AcjNfN3ie+aNySzAgn5QST6elfVcN59LGRTnGK b7I8PPcreFbUW2vU/mYb/g2S+AM7bJfiF4nZc5GEhwMeny1E/wDwbH/ABHL/APCwvFYUEMSEgz/6 DX9Ef9uX8z5jLkdOjcfiRVae+8QbAxebrgjHWvtI4Dmd3b7kfKSx7tsz+dg/8Gy/7PIYmTx54sk5 zjZBx/45TJ/+DbL9ne1TZF458VKFBPEdsc8d/wB2TX9Cj3etNMebnOBtHINV7ubXGGGE5OCcEf1r pjlcL3fL9xP9pVGrK5/Om/8Awbf/ALN7nMnjbxhkjqv2fBH/AH7q2n/Bud+zp5Yt18b+L9iDbwLY fmfKzX9ALS6u3y7Z+SQML2qjL/agbEiXgJ4DZOMD2FdP9lUnpZGH9o1N9T8E4v8Ag2p/ZrnbzB41 8YZPOc2//wAbzWvH/wAGzX7M+zJ8b+LBgdD5B/PEdfvRpj6xkBftXzHGGz3rsrfTtYkUSg3WFyc7 vTtya8vGYCENLr7juo46cleMT+fu1/4Nkv2art1I8c+KwpH3sQj8/kr13wp/waufsnXzJPeeOfGp HQ7PsxU/TMfFfu/o5vIcbhOefmVumPXOa+h/BNxcSMsMRkJOCMEj/EV+V8a5liMPQcqFRR+SPpMo ownNc8bn4X+GP+DT39iyEC9g8d+PVcoV+VbI/eHvCQRWzff8GmH7Fl2pYfET4kBmPOP7PAz9Ps9f 0veGrTXTCvnsxXAIO7p+YxXX3FnfmEosj8jg7hxX8Z574jZ4sQ4/2k0vK3+R+qYbJsNyJezXzP5G PEn/AAaZ/seaehNv8TvH28AlVdLE/mRFXz/4j/4Nf/2VtLZ4W+IHjC729NwtFA/75ir+wTxrpmuL byb37dQwH0r438ZaNqLM7STMSBnO4YH1r9t8NOJ8fiUniMbz+tv8j5XiDL6UXalRsfyu6x/wbf8A 7MOmbhH4u8VuBnHz24/P93XkWr/8EBP2dtHcsniXxFIFPAeWEZwe+E6V/TZ4j0HUJ2d2lOOeAx+b tXzZ4x0a7tvMZtxOc/K5PAr+lqFePJrJX9EfFww8m72P59/+HHvwfaTyNK1vVcj7qmSJRg987DXX W/8Awb4eGPEiLCmv3gRcEK91GM+4/c1+yejyMl6sUyFQZMHLqOa+1/BWmwTQxxJnfjJ2ybs8d8Gv xjj7xLr5a1GhOK/7dTP3PgLw3wuZU71qbdv7zR/M7N/wbpeDbNfL1DX9TRANyiO7jYZ/79VMv/BA r4JxbYdX8R+IUCrsYQyxbdv08uv6cfFujaha24fa23tzXhUln5ty8bvIgLY+te/4ecaVczpKVapC S8opHzfiFwbQyyry0aco+rv+Z+Flh/wb9/sszqN/ibxKOByJIsZ+gj61vW//AAb2fsoNy/iTxFgd SzxAn/yHX706PoNi+0IWc9G3dcn869P0nRtMUhJY0zjuM9PXiv1SpiaVNXUV9yPyn2U5PVn87lv/ AMG+v7J7IfJ8ReIEGeNssX9Iqpy/8G/X7JUZLzeIfEB/ukzxdD/2yr+kybRIZVLQxwYHGAuK5250 Oy5W4jiHbAXt7iuH+26d3eK+5f5HR/Zs1s/x/wCCfzf3f/BBD9kK1zJH4g18kdAZkPT6RVly/wDB ET9k62ia0Oua60TDlPtKAH1/5Z1/RHrGl6RGm2OCPaBknb7+4rxnxFHbDPlwxKucg4H+Fd+Gx1GX 2F9y/wAjCthpq6b/ADPwpH/BFj9lPCqNV8SHAIGLteAOn/LOo5f+CKX7JJkAudQ8Ssh5wbtMf+iq /aORLbdvaJQwPBABzWrYqjph41OMdVH6V6tKvh760k/kv8jm9hU5bKbPxOT/AIIn/sWNkSXviIsM ZAuF6+37qnXP/BFP9jFUES3fiMjg83CHr9I6/b6K0tYxuVF5PPyjn9KlnsIDGPNUMPReBj6V1+0w qafs19y/yMfZ1pfaPwyH/BFL9jMA7bjxAe3NwpGPwjqtL/wRZ/Y2QcN4ibt/x8D/AONV+81jo9tL H8kQx02dcH/Par/9nSIuFRBjnI9PwrklmODUnH2a/D/I9f8A1exSoe2bdvQ/n4n/AOCMv7IiE+Wd f+UdDOP6R02H/gjf+yIELMNeOOwnP/xuv3nvrV1mxGQh5y20n8q5+50+4RiyzZz3Ydce1dbxWEa/ hR+5f5HgxoYiDvzM/DqH/gjT+yDMCxTXyM4LCUjB/GOuq0v/AIIv/sdBkdD4h3eqTEY4/wCudfsa ILhWDhs9zxjP612eiQGX5pi2SM4GCK5q+OwyvanH7l/kdVDB1L35mfi8f+CK37IdwuyRPEzBh82b jk59QY6zbr/gin+xlbjaLXxESpzxcEA/+Q6/oB06zLKC75T6c1T8T6Vai0aVSxIB+83UmvIq5xRT s4L7l/kbQwDvuz+ea7/4I2/scxMRHaa8p9GuTnP/AHxWE/8AwR8/ZKD7UsNckOOds7ED6/LX7HeJ IWa7ZNxU5xw2ffrWbbaTZtAzTTyHjJUMefYV5GO4hpU435V/4D/wD2sLkvPbT8T8ef8Ah0P+yapK tp+rnB6/aGz/ACq1af8ABIT9kqRudL1gg8cXR7dulfqtqVvapOVQyfi3X2/Gup8NWFmwG8ZGfvMR np0rmqcRQ9ney+5HZTyROVrfifkbdf8ABHz9llATDo+tORxgXQz/ACrOk/4JF/spRA+dpOqRc4y9 3nj6AV+3ktnpH2fbLNt7nAbFeaa3ZWAzJCSQMncD3rmw3FCqPl5F/wCAnXLh5W7/ADPyIT/gkt+y pK6xx2N3tY9WuM/0r0DS/wDgjB+zLqkQVbDUvLBO0C6XBJ9AQK/Qa1iR5xGjkkt0JJzmvpv4eaHY 3kKi43Z7srHGfb0q854p9hS54pf+Ao+h4V4No4ur7OUfxZ+QP/Djr9mEoJpbDUUx13Xa4A9+KxL/ AP4Iq/sv2j7I7HUSMDk3C4NfvtqPg7Q5IdjyNxyfnJA/Af4Vz0/gnSlgLWxQoD909fyrwst44dR3 m1/4Cj0+KeBKOEv7OnZ/4n/wD+fLWP8AgkR+y/pIPm6dPjohe5HOfx5x7Vy11/wTJ/Z5hiCQWM7K nyoHuWAAHpz0r93fEXhfSGWQNCNy5xkIce/NeHah4TtmuTHLCNo5BOOR26dPSv0HL+I6Ml70Fp/d R+WYnJZX91v72fjTe/8ABOH9m6OQpLpEhJ4DNO5H4HNZsn/BN39mtmVrfRtx6AfaG/xFfr7qHhez MeDbxAKDgDv9cVwl34Ttmm3RxRqM/wAPt7V9Zg8ywdRK9NfcjzK+VVo/a/Fn5er/AME3f2bFBk/s bB67ROxwBwf4jTT/AME8P2bUUr/YqYHIJuDu/IHpX6ct4dtQp2BAcY3NjP61hNo0UWVYI2TzkDHN d7r4azSpx/8AAV/kciw1RPd/efnGP+Cfn7OoXyo9MhUA7tvnuBn86zZf+CfP7PKt5o0m3I6NtuHO ffGcV+m8Og6cfu28LHr1rI1bQtLcYax2c5Lb+MfSvOnjsKnb2a+5HXHATa5ub8Wfl7L+wh+zsk5Q aPbg+8kmeP8AgVV4P2EvgHI2xNGtWB6fvHJP4ZzX6K3OjaY02ViRVznaRmpLfTLDKqVQ4IGcc49s 1Usywt7KmvuRk8rqdZP72fn2P2CvgG2d2jW3GOBK4/rzUj/sF/AIISdCtcDBDb5Mj8M1+n+n+F9B liV2iVtw645/pW43hPRkj3p07oSAR26dP50nmGFe9JfcjsWU1ejPymP7BnwIx/yA7UnPUO4HI+vt Qn7CXwTRGH9hWW7HBLvnHFfqDqXhLSpEDIiq3Bznjj6d65m58MwLKGZxgDau0HP8+9EMxw8tPZr7 l/kRHKKnNdv8T82v+GF/g0WxHolgSTwuX/nmoJf2Fvg+I976HpwHXG5+R+dfpQnhm1Vt6tsOeq88 1fHhOyRRkFiMkPwP8a1lmOH/AOfa/wDAUVHKJr3k/wAT8xV/YY+Drncmh2IGOu6THHPer8f7EPwg idYl0SwyBkNub9K/RuXR7JQY3dmPYHpkVRXSkXlrc4HOS3b6ZriqZlRs37Nfcj0cPkTb73Pztn/Y o+EIUsdEtBznLM5FY7/sXfC9MZ0PTm9fvbh+lfpkdEtb6Ip5LjqAW71SbwwFOwNjgjcw71hRzik3 rFfcjsxPDatfX7z8zW/Y9+FueNEsF7ELnOenenH9jj4aBjb/ANiWG7AJ+U5Ga/SZPBdvJJmeSQnr kAf/AK61ovh7DMm6HcSTgEsFyR7ev4V3TzfDpaRX3HgVcmkt7/efl7cfse/DSCLJ0ewH+15f+c1z lz+yx8OYDtj0WzbgfMIxwfoTX6nXfwzt+ROGbtvDYx65Oa5K9+HNtBmSFiyqOQ56D2960pZtQbty r7kYTyWetk/vZ+Zlz+zX4AhXbFoFkW/vGMEVmT/s8eBLRfOk0WwUE8fKoxX6N3PgaxuCVPmEr6tg D8q5G88A2V25WUOYx0IfgfhXRLNMMvspfIKeTVZbXZ8Bf8KI8BOwC6Np5HclB+vWtC3/AGffA3lg f2PpmM5wEG45/Cvstfh3p27bCzqQejMTx9Bmuy0P4TJeyLyzD7oVOSDXJiM5wsVdpL5HVSyas3b9 T4WT9nLwVOQF0ez/ABRcccjHH51Jefs9+CLdQv8AY1gW6HaikA++K/TeD9nqIr5jiVlwCxdeAD9a huvgtFDkqpZVzwqjPPrn/wCvXlPinBt2TX3HeuHqqu7H5cP8AvAe/dLpNkcdFWNfTPQ/41Cfgb4I 2gnRbIkfeHlJz6Gv0iv/AIQoVaWcMobodig4/A1xt/8ADowj9ysjJ04ABx9M963jxHQn2MpZDVi7 y2Pg8/BbwYAypo9mvpiIdqgPwb8I8OdGthzjmFcf0r7VfwEcYDOMn7mQOnrWZL4OMDbZnm4Ocg/1 qHnVBu0WhLLai32PkGP4OeFFl3tpFn6YEI7/AIVvW3wY8GyHB0S129x5Iz+eBX1Fa+GYFlVVSdvc kHr0/wA4rutM8HTzAtHGQB6gg152Y5zShHm2PWwWVupJRtc+QI/gV4Kdf3WiWpyoJ/dDv9al/wCF CeB1ChtItgTkf6tTj8MV97ad8PL2aRGk2oPQ7iDXRf8ACvzEMtFE3qNoGfTqBX5zjuOKdKXKp3Pt sDwbKcHL2a18j80rr4JeBolIOixHGBuEKD8uK5W++E3hGJt8Wkxj/eiHP44r9K9a8LIsDRGDbgZy rHp+FeOazp1uu6LyWwvJLg8Z7DNetlHFqq6rX5nm5nwp7Je8l9x8QT/DHwwuFj0yEDHJ8pefpxU9 r8LvC7ks+mRED0jXPP4V9StbW0R3PE2OmCDXQaPYWM43CJRkDIZCfyr7iGZrkvynzEsrXMfLtn8H /B1zKPM09EPZSqkjPH93/wCtXV2nwN8DSBmayX5QSP3AIz/3zX2dovhWxlQCZFYEddpJH49q9R07 wd4bBVZIHYZ+6hbJH0xXmYnP1FdTbC5JfVJan5yn4DeDyTItkN5GQvlIAf0FRL8E/DzLuGnxKFJ4 MKnGPwr9TJ/h/wCGzHsj09znu6EEVQ/4Vt4Xfia3njwMZQyBc9ec15f+tkfM63w5bSyPywuvgvoC oQNPhxnICwqWHvwK5m++F3h63PliyQMM4/dKP021+qup+ANCtgxgt5WAy29iwB/GvItf8KaWSWa2 L8YXJ3ZOOnNephuKYyXWxxYnhuzukj857r4b6Nt3LZxAc8pEPbttrEk+HOlA73tkCEfxIAePoK+z tY8PmEkrbtGhbHUHg1ya+GbO6JaRp02sOgNfRUM6XLc8StlEWrJHydN4C0wZ8u1i/EAZ/TFZsngv T4m2JboO+AOcY7cYr69n8HafGhwsrHvuPJFc3deGYgTsi4AyGHJAr1KOcQl1OCeR9z5T/wCEXs43 2tCPTIUf1pX8MWSnCxDA+9wM5+uK+gL7RI0kAQHB5II4HvmqA0ZFf90AS3UYNevTxcJJM4auWuK5 bHhKeHbTYf3LdD6EH9KkHhvR1Qu0DdlwAuM+3FfQ9n4btrhMnGcZPUE+wrWTwtp6RElFGTwAc59+ e9bTx0DCjlM3Zs+Xx4c0xckw8ckAkChvD2mquRFj06Y57c9a+kLjwpbBAyoCAeCwHPrntVF/DEWT jZxnjBHuPatI42DSQ6mWT1PnoeHdLYCXy27cYAxSSaHp0Mn+qP3Rhhg/nxX0L/YscP8ArIVIGRjF Z02lxfMPKUbSMHHXitliYtnPLAyimkeFJo9m2f3WcdM4ximtodkoy0KkHvivcVtQRnyk2g45xyae +mWhXcIhyCThsDiuh1UtWioUHazPBf7HtFwVjC4HXHSoP7Jt+Sq9eBwK95Wwtgcx22EHYHIH14p5 i0mOMNJbHk4bBHb8OayliY32JlgeZ+Z4Q2iQY+4eR3WoX0i3HyBBjHbk5/wr3lhoLHaYMZ5x/L6V jyHSFbc0BBzjJH3aqnVTeqCWBcI6SPHBpFuy58s5znJ5601NKs2G9ULY7H0r2AjTccwHAH3sfpTV XSWOwRsBjjbgY/rWnOn0M1h9rM8eXTbQ8SIwOcgU/wDsy0/uP+lettb6Uzbo4sHgDJPJ7c0v2aD/ AJ4D/vuqbj2MPYy6M//W/kvLzn5SgwfVhTTJcJnbGOfVhWCJLhuTn1+lJ5lypzznHfPevU9n0Ol1 OqNqWa6KAeUckc4IP9e9VjNKoLGBznnoKxzNdls4bjA7ihnuSAdzevJPH8qPZMFV10NGS8k2keTK QDngD/GqDX/BzHN1HG3P9aa0t0v3Tzxk5/xqsbjUicqzA4/vDGKSiVObTvcWW9J4MUp9eD+nNUGu 4gSGim6E5waklu9VJwCfxI6VF9r1fHyEZx6rzQoqzJ5ys89qwA2yj86k03Xr7w/cG98P3moafNgq ZrOeWF8HtujIPNVJZdQckttPfIrPnn1HBXOMHtWbgnoEatj1zQP2lf2gfBl19v8AB3j/AMa6bcbd vmWmt30JI9Dtk6V9/fDT/gu//wAFHfhb4U/4RMeJNH8RhZXkj1LxXaLqOoAMABH57FCUXGQGyQSe TX5IST3nI656g+9Z0321mGFP5DBpQi46LQJNSXvan9Cfwj/4OW/2r/Cd9HB8Z/CPg7xVZNLulOnk 6PeBcchHQywk+m6L8a/fb4P/APBdD/gm549+HOj+LPiF48svCGsX1oJdS8L6jDNc3OnzE4aF5reE xvjqGXqMZxyK/wA+mSPeMTKhPoyg/wBKzJreBxjyoQR0O2iU6j0uZrDUkrqOp/qafBH9sz9iD9oq 8s9G+C/xQ8G65qF8QLPS7a+SO/lc9FS2kKSluPu7c19jv8OrwMdspC5yd8ece2a/yEvDWueNfAvi Wx8aeAtQbSdX024S707UrEmC7tp0+7JDNHhkcdmByK+wLb/gp5/wUwsL2K+g+NvxB8yHAQnXrsj5 emVZyD+I5rx8TQxjlejVsvNXO/DvDqNpwu/Wx/qXW/gySIbftEbc45QU9/B7EEmZMZ6qv+f5V/Ej /wAEyv8Ag4i+MfhX4kX+m/8ABRzxve6z4Qj8PPDpcunaNb3V8NVE0WxpZLdYpWUw+ZksTzjgmv3N s/8Ag4n/AOCYN2Y/+K01mLzMArP4fvgUz/e2ow474zXjVKWaq6i0/uPX/wCE+Kjz9fV/efsfceCP Nj2tNxn7yrk1xuq/D+zhRiJ3yOvOM/hXzP8ACP8A4KifsL/HbxHa+DvhZ8UfB+qavfYFnpX2z7Nd TO3SNIrgRsz842KC2eMV9b6tqu/JcN15/H8BWNHE5nCX7x2+4ivQwLjeKPEb/wAEW0hK+awOSS2T mvP9X8F2dqhDyM4/hFewalfFNzgyfQ9K871i73KXG/aR0HPPfNe5gczzH2iUpe6fO4nB4Xlemp5P caBpEfyup4POSf8A61aWl6RoZ+QIVUkFuc/zpb28EpynAzzkH9Kl06fYwdcegIGMfXP+NfaRxuIl CzmeFDBUebSFz1rQPD2hRsskEPJXOW6/0FeoWXhHT5FUxxR/iATXm2h6kY41xjIAB59vyr0iz1xV QDOCB6GvkcwxOLv7sz6nB0aC0aNVfCdvES4j3EcHAA4+tWbfw+iMWaFFGeMYNV/+EgsyuJJFVm+8 CT/Kr8GpMuGVkwelfOYjG4pR9497D4ag5Kx6b4V01EmUNGDg9dmPzr2KC3tUhzImOMFdoP8ASvJf CmqtLgswX2J6/rXq0eqqIiHZlA/H8q/l7xIxeIeJtbbsfruUULYWPszznxdYWboXEW0jqQM4xXzR 4nhRpGCD5s8bB2r6Y8W38Elu20Mw3c4GOv418u+J70JcFIiV78kfl0NfpnhjiZuMOa9zxuMsOlT2 3OKkMqKQ4UdMYrGv5J87lA6+gzj65p0+plGO9wo9xn+mawrjVIJRhJo8jJ+UZx/Ov6Jo1Jb2PxWr BLqPmu7zcNziI47gEkViX+qSplGO/vydv+c0kupBgRvjYjgnAxj6VzGpX0co379x/u4xjn6mvToN t2aOOemqZTu9VfzN0ygNkEqDnH55qnLqbkhkBwCBxzzWTJKk7kMNgzyXzgVNGgjXGF+gz6cV6k5w jqzmpxcup1llqMxI3EE46AHpWsmpSqQPLfg8bAe/uTXFw3D24UIMnPOSK6K11NZFG4/kD/Q15WKd m2lodtKLulc6231aSLEjZHYhsjH416v4M16VpgXeX5QMbTgY/AZrwVYhM4Zn3cjqcAfXP+FereEL e4t5AjRORnouCD+J7V+e8Y+yeGmpWv8Ace7lyl7RM/QDwJeS3NgGaVicfxHt29x+NepYk8vcCa8T +H0irZIbdmUYG7dtOfbA5/GvXBLcsp/eptA6Cv8AOnjK7xk1Gy1P2bCRbowZ5z4+ivvs5khdcD+9 718J+Prm4S4aISopY/U5/DFfcHjM6jLFJ5TKVVScPkHH6V8SePwkT5drdnyQ/OWwfxr9z8GMVySi pNM+c4ppXTPnLX7nUceWJYwB15OM/U182+NL25WCQOw4HBUdcfpXvviq8kh3iNWUgccdffr3r5i8 cXZZGMivjOAo47fjX9kQcJ0kz89o3hOx4hHrxj1gLKvmc4BwB3r9D/hBNo0umLLGcSEAur84+ma/ OS1itrrVwHAXa2TknufwNffvwvW3ttHjaEPkAAksGUHtnqa/knx4pQcFTjOSbfTb8z+vPAlyUpNw TVt3v8j3jxdNYrpLeYRkocDoQBXyHfajZjUeGHXjJ59xXufjSW5vLLPmOvykArk8Y74HSvk+6huo r0zSOrfNja3B/wA5rv8Ao+ZfGnSfNVbZ4fj9ipupBRhp3Pofw3q9qyALgn1AG79a9JtLpJCHkLn6 4/pXzh4dtLabbNM5VuwQ/wBevX2r2DTdsahI2mfBDcvjJr+qcZCEYvlkfyzS5nJXR3F3eWlrFvIL EnPXjn6VmyalAEDA9O5PWopYYmjLyBgRn5TJkfl/9esExrNlF8vIB4OTXyylBu93oe3GMtrGfr+s RlSqhiMfeTn8DxXg+v39uZDHGrA553E4zXqWvy3UJKhdvHABIBrxPWZjvPnDaScHrg17mFUVFWOG rBtnKXNwGkLRlgxPPzYx9K29LvGLiNmG7PU1xl/MY59mM4OeD29eKn0y7dXDxgZB4Dev517GHopx vFmc278jR6+ZIljBfLEY/Wq819CAArlT0AJ5JrkxrE4QACMnpgkg/wAqoi9ZpApQFt33iTx7DtXR Si7WbMrpNJHrXhnyJ2XzXx1J5z+ddjrENnFGDbBT3zkE8d+leRaEqiUNOGCk/NzkCus1AQMi+Wrs P4dpwfevgMzlJY1Pnen9dz+jeHcNCpw9Vpypq76vf8ipcXEY3O7KcZ9OfpXGXV/bbgksu3BxkH88 mr7WFtISArce+MZ+uK4a5sbOGdlK5y5+9/8Arr67B1oNtNu5+DZxgZ04JW0NW81O1VgkMiPjPfv7 Gt/QdbtWyrsVOdozzkj9P0rzLUIgVCwoflwSSAAf1/pVnSJntiSp2keqg/1NdnsIOLdzw6dVp2Po yz1iHy/vMB/Edpzis/xFrEL2nklpMY44z19vesbSrxmsluJFR+PmBJU/hWLr2vlIXR4kXI4KkN/W vHqxu2rG8ZWadzxHxNqUTzH5iWGQowwPX0zWXaX0jRBYwwJ4y3es/wARX9tNcPJGhyCRlsYyPx5r Ci1xoYhGi88dTzivnc3pPSEIn0mW1lLWUjRvL2JZCSTuBwc/rius8NamisC4Bye5wM15LdXTzyl2 x04HTP8ASt/QL3nywqg9Sx4H5muCtRvTsehTr+9ue9zajA0GGAzjBXn/ABrzLX5YFBfpnoATnP15 zRPqM6wlYZgFxkj0xXmutX9zKzYY8fxZJOPauDB4GXPeM7HpfW1y/CatnODfBcYI5zwK+r/hjKvy +XIyg88jOfevhC0nlNzv89gS2CSf8c19N/D+9kRU8udidoJyR/St+IMJJ0bc/wCB9hwFioxxCbj+ J9k6xbRTRZW7WMsvUIp/PmuEa1NqGP2vc3YgcZ+grHXVrhI99xMWAXG1lBGPriue1DXnjbcjIoYZ ICqePwFfIZHh6i91Sv8AL/gH0HiHVpyfPyW+d/1MLxPPFFI4kkDtjHynnP415XcTwSSYEpj449eP rxTPF3iRLq6fGxeeAF/rjj8a8gu9TknlIaTaAflHX27V+pYTAtRWtj8MeIV3dHdam0fl587fk846 9O//AOqvMLvVBBO0K5Yn7v8AnFWbq+jFv5ZmPTDEnJrzyXUEE5VHGMnD5wf619jk1Cy1dzzcVNXR 2slvbSoJZZGHH8Rx9K5PUJIY5WYsG9On69qgu7pzbllkfpgHcDz7VxFxf3CPtJLZJBGRya9mrCT2 kcc3FWujvdPuFnYIjBQe3v1qvrTiFAQc4z3/AC9K5TTLl7lzKQykHHXH4VJrV88UGWb8zXk4m6qK zNF3Obm1FXbYwyc44HcdhxS2lxGx3Bh+K/pXFXl48km5zjnIK5yQPxqxa6lGrBc7sHAJ7EUvZvmv ccakXoz6B0a6gEAa5x8q/LtOOO2RxWhcSq67onwpbocYJ+gFeS2Wt2sMYWVjzxtzwa15NSRlCK4j B7EMQPqK39lJK4/bRvozqmv1ibkp3G4DrWPdXcjHERAHGc/0rPMpSP5pkY+qrgVmTM0n3WGc/exn H+fSohKx0Rd7HR2M0rvtHlg55U5HeuokNxFbhfJUDHJDDJH0xXB6ZdiO4CSNwOi7Tn8+ldsL+2KA shYA9T059smuLE1pqVlsdkaad0mYUk6udjAIffB49DirdtPHuLZGTkDsKxNYvrdJGdIySfmOCB+l S6VqULR4lJK4BC57968vH1ZOF7Hv5Ko+1UbnSO7SD92V6cknt9MVgXl6tqp3Hdt/h6cCtW6v7DyP 30MpU/dxx9K4u+v7UMwiVgBxliDx9Ca5sqrOctUeznlHljdMu2msvLMpjRwSckHuPx/xr0XSblwP liywwAvX8e/8q8iUklAkp3Z+6cY+gxXpmgG2tot0gkz90Fcj+Rr2cdUjy6HwP29zrtWikubXc1se DywJC5HevLtUkmibb5AOer7yu38BXcanqMEakefcA/3Vzj+fNef6hqNy6MGjDDOQwU5/OuPLastb bBi49jhdQke43KoK46kZ/rXD37rbrsTeTzk7uDXR6jeyGUmRSMtkhc9/yrj9SmkG52icZ6Ngf5/C vWxErLQ6MFtojkJ7t/tIwWBzuLBucfSvon4cx3U6xzxT4wMBW4+nJr5medPtILqSQx7gD9a+k/hn Lb3XlxSRd+20kHHevn86q8tHU9DCwTqM+wNN1e8tbALdlJAVAyFUj0561y2sawLmJgIox8331+XJ 9MZxUlg1paIIpElUgdUbZn9SKz76KzmRmkLBDn70qfnjAr89oKCm20fRxlJpRueS6prKO7Rz+UpX IALZwM9xivLtaufPbfE6KoONwXrXpWu2mj/Md4bLYxxnGa8z1O2tVZntlOwH7hPIHr3r6HC4iNk4 3R52NjJxs3cwpVttu9nIYccf41ymoZBIRiwPAyc1t3c8ZB8krke/P5Vwd/fyiRlYMQB/CCR/+uvR wzcpHi1ZRSs0aFnH86kLuPckdR06V7p4WCyCOJlMWCMYGByMfSvnfTtQQSq8rMOcFR1BxX0R4MeO 42fMGUkFs5HbPY1w8VVWqDue/wANrmqqyPpDQbW1tkTzmSRm6HcOPY5ropYrS6j/ANIW2AB+8yhs fgDWDoKWk8flywZAAw5GRnH41d1jT45IMWqrED1Pav5Uzereu1KTTP6KwFO1Je6eV+MrewRZTZSQ OcZyo289+DXyd4kgcXZkJT5jnAbOa+kPE+lqWdLnzcHjeucD3AFfMfiTT47O8Z7aYMuc4YE9q/Vu BpJJR57nwXGN2rqNvmUbVdsoY+WcHgEg/wAxXqPhhoHdUby0BwDlen44GPbmvEkCt8tw64z06Yr0 PwwyrOqNKuzj75wB6dfWv1+V/Z7n5S5JSd0fXXhrw3BKRMsUD9hjbzn2616zpXhIOoIS3IJzsMfK ++cCvAfD63VjGtxZzqwABZBIAoOe1esaT4gnnEbrAGct/E7c/livjcb7XeMj6HB1IJ8rjZnp48O2 LRCAkHIG5VODn8a57VPD+XbYsyKi43cOCBx61ZW6aSBibcox5OPn/QmqNzq16iB0DqpwAhXH8s14 FOVSN/ePU5IWs0cXqWnXUcZhgvJ8EEMggz/Mf1rwjxlpNmkLwyyPv67WUjPvn1r27XtavwCoidF7 uZCR+Axx+NeIeMtQE0QmKkAZ64LHtnNe5gK1S6/4B5mI5LPQ+Xtcs0eQhc/ewQrenA4rLt/DV1MB nzQpGQC2cc10fiCfMom2ggfNtIB47dP8Kw4fFFwB5axuMcAZ4x79q+9o4qs4fuz4fEU4c75ug258 NNLCEUlSOVB45H0rzPX9BvbNS4kYoeRhc4/GvU7rxLdYAkULkZ65OPyri9X1dXQh2z229ABjof8A 9Vell2KxEZLm6nHiKEH7qPG7xbmEbWbLZwDjpn2qpBbSNndls9iecflWxqt0pYOcAH1P5+9UI7mF sLvyQccDIx+Fff0MQ+VWR5FajHmcTWggkiAfBU5+Tn9a11trqWLeCGBJ5zzmsaO+t2/dZ+YZ+8Dj 61tW13BFCCSHyM4C9Tj+dE6s7FUcPHmavoZU8c4YJKhU7eOcgn1qg1vcFj5ZzngYz2rZuNShYlNv PYL/APq4NV47xcYdmHB+U+p6V0wryirtCq0IN8tzNFrIrhWkIAyef85ont3kbMYLEAHgcke/WtPY s/3XB7DgVFNKLZvkI54JAPT3xXXSxcmzkq0IxTaRz81lcEbY1UkHPzDA96iS3O4KUU7eSANw61oN eTltzYILdc9PpTReNFIx2pjIyfr+dd/t5ONrHmQUbme8Dt80SEZ54/8Arc1l3EE3O1SdvBPbOfQ1 1Ud8wXYpTBGBhj2qo9zCBzjI5IBPP14rnlXknsdjoK1zmRE5Byue23A61j3MMYDGSNTg4+ZOMZ7G u2c2T4dSc8c5yPeoZhbBdpCYzjnHAqqeMs1oVPCprc4ONYShUdwOo455/wAipVitF/dllB45710L wxSyGUAMBj7p/oM0xkgBO6Pb3z1yf0rujitTzVhuWWhkC3sinysCfp6/nR9mg9B/n8a6HZHFGXCA jgbsc8/Wo/Mi/ufqP8Kn6y+gSwnK7M//1/5Pf7QsWXkQAnn/AFJzSGfTyAXaLHXmP+VcK0mV+Rzj uP8AJpC7ZwWz7f8A669xVGbOp0sd/wCfpi52mILjjK889ccVTuJdJClD5XT5So5H+NcYG7Zz3pu1 GOQeefanCs4u9iJWlpsWrlmLkx4x1yDiovmx1x7VS2g8ljnvjHWotilsB275OeazerbSByskmab7 +Cc9OcVXeMuMZP6VV+zqR88hHpUclnHjAZgPc9KSsPmfRD5LYkEFgM+tVGtZANxYHtTWsAw3RSN9 Axqp9jfcd0jEDjlqm1mS5X0sSFVIOX+Yc4xVSQRryWOfbIpz2GTkt+bdKrSaccggjn1ak4t7Bza2 GGC3PLN/9eq7Wto335OM+lB0+Tdxs6/3qY2nyJ8x2D/gRpKJSem5E1jpxPMrfl0FVX0zSDyZ+D1B XNXHswOpQj1zVaS2SMZzGfSkkK5nTaDoTjO9WyOQEx+grLk8MeHmPyrz7Zrb8iAAgmMEn1pjLbof 4Tx1DVEqceolJ73Nn4VeMb/4JfFHQPi54KEbat4b1a21nTvtKebD9otXDx70JG5cjkZGRX7pN/wc y/tv2y+TrGjeBbhjyzf2ZNGSfXKzYr8DWlgPBX9eoquRATksAO2al0k1axftm48rlofvvH/wc7/t UpcgXXhPwNNHwHi8i6jLf8CEpIzX1P8ADn/g5x+GGr2yQ/GT4b6rp9wZQjTeG75LmHZgZfy7hEbd uz8u7GO+a/ldMMB+9sPPQ4qm9jYs210i+hx/hURoRurxX9egpQTW7P8ASo+GvxZ0D41fDPQPiz4L S6i0vxJpVvrFit4mycQXKBk8xVZgrY6jJ+tdpbs4k2kAZ6jGM/iK/wA6zw5+1/8AtReA9HtfD3hD 4heMtPsbC3W1s7Ox1a5SCCFBhY44w+1VUcAAYHatu5/4KKftni1SKb4ofEAxxuJFA1O5yGHckNk/ QnFewsVRira/d/wTyqmDqObaenT+rH+kl4evFEKqm4kYBCuevfivQbO+tucOxc9cjgc1/nhfBj/g uv8AtxfBywXTpvEVp4stUUrHF4rs1upU5zn7TG0UzHt87tX6afs1/wDByt471nxPpngz4t/DvTL6 41TVbewi1Dw9dNaeUt1KsS7oLjzd23dnIcZxXkYnDwqNuE/6/I9nCzndRcD+x+KWPO5SOT1IPfrx WzZytLJ+7k74yykYrlLK/wBkStMeWGeeDg81u21/5DrIuTg8gE9PUYr4bMqs9UkfT5fCLkrnsvhK aaOQKZFPzZKhC345xXrqXkEsWFPOeyn/AArxbwvcQ3bLtUqenzfKQPxNeqQqqR8srenGf0r+ZuO5 xeIvLRn7pw3SX1dLocx4lnR4yu35V5YvnFfMXiqSETuBuySevH4CvozxM0RjLh0J6YC4P6V82eKr uUOYdqkZPJGf0r7bw7r6Raep4fGVC8WmeT6iiTFlXfkdWzXEahprT9ZZkHpG2D+QrrL6S5jYtEue uSOKwJpLg8sjfgwzn/69f0hhMXypWZ+E4nD3laxixWMVq3Ekpx03NyfXOKwdUW7wzqW2rkHB29Pe urmmdV2SJtB5AYj8elc1epCzErtXHHI3Z/pXr0MY73ZyTwytY4m8nu02ugOT8wUnp9adaXt40m6V tw6lcmr87KWyy7eCOlNhZ4VKRd+Dk9x2rtljU48ric1LCWle5qR3UoXhvxXkCp7W8dnwzyjOCW2k iqMbTdifY7uh9a1kucJtEg3NzwwP515VbE2Tuj0FRu9GdFa/bZWUWIEgIAIHBP55r2zwW0nnguk6 FcZB+YfmBkD614ZY3DNIscG3CfecgFR78ev41754MmtUKyJKgYEfONoBz2LHt+NflXG2NfsXeOh7 +VYZe0XvH194JvmaFHjmDMMBkwc4r1n7bI8GwFsnIBjjyfc5rxLwjdWbxxgIyuerRzIQcfXNetjb tHlglQCCAw4wPbjIr+GOKZR+sybj+R+x5ZB+xSucJ4onYQsYZJmfnaHUBQffmvinxzcXiTzy39qM JnhDkEHp36V9meKZI2jZA2zHKvu5b2Jx6/lXxz4/S6umZ7t5GRdzAx5JGOuSRg1+r+FuJUaiv/X3 HznEEH0PlLxXrIVX8mCYDPpkD6V8w+NNSN15gXdndyBmvePG9q0ayTWzTrGeCM8njpjpXzF4lVXZ hKZgc8HIBHscniv7FwcoKkprU/O3Fynyt7nGaDazf2urBWC7vmYjJGK+0/A2q39jCLOJZpI2UEvt IA9AeOa+MtMlS3v1eWWRMNgO0p/UHqK+vPBGoXMOFEvnJtBZmfA2n3HQiv5t8WqvtXd000j+o/CS Dpw0qNNnpeuazJdQ+Q0PlhRjc5POPY18765fwxXbSRRbuSMnPr196938Q6oGtPMinTAGNpkUn17c 1886pfLJfM8MbcnglsAk+xx+hro8HKMYyTUbeV/8zzvGKo5rWdzpdJ8QSwqrRhPcbTmvUdK8VXkk YkRSEY43bea8WtpZ0BKMUc8ANzjt0/8Ar10NleTRRiO4vkBz0G4AfrX9TTpwqQtY/lxuUZbnu1xq hmtcZY55yoODj2rlWvXD5y67eMMM/qa4uTV76GD963mp0UxscH1z71AupypCZ5BgY6k9f5V4ksBy Xsdsa99WbPiDUJnhYhz0+nFeHatMHk3NIQc9Dkn+ddTq+r3TlpIwpUfeDYzj2ya841XUY5mzvSPr nLLXdg8M4omdbmleJjahIB87zOoJx0PNZ9rqMXmhBjA6Enr/AI1Q1C6dVO9lx6FwM/h0/SsyG5ji /eiRPYAKa97CU9NTKtJ20PSI9VkUAFXTj0Bzip4b9pZDtVsjktkdPzrgob6K5zvKbR/ewOcdOgqe K5kT99bNk9MEZGPStnh1ZsnC1XKomz6A8K3UfnK0wZl7F8FR1r0O91SxS2Z7cgnsVXFeCeHNbniA JiDg/eXbxXost3aTQeZ5LqcZKgcV+PZ/hP8AbE5XP7R4BxLeSSpQtt1vf8jI1DxHEhcy4X/ayOfw 9a8uuvFGmyTs8ci8HaDyefboK6zU0tRGTBC2DnKlQMk+uTXl18hinIEDouccYxX2+TUqbV7M/mnj iFWNRwb6ly51fzvmeXCg9AOnp1NXdJvUjcGUOwJ4YZA+vSvPrie88woCduTlNgxwc9a6DTLm6fy5 dwUHoD90epr6KVNJaH5xRqas9y0vUYXiEYPTkBznjPTtTdXmleExxjO0nv1GPeuNtZIZE3Tshbqv UD8O1UtWv44k2JKMsOVVS5GBx7V41ailLRndKd0jzLxBIvnYUcBicgbh+ef6Vziajaxsz4XJB5HH 5ccVLr13c+cxXJzz93b8vuMiuKuLtuhCscduP8/jXhZhQU9Gz1sDWUdjVvprd2/dMFPXaOa3vDt3 HEAkgyW4BbrXnP2tEy3y57ew962dP1V4VB2uOeDXl16L5ORanq0aq5+ZnsjyIYD86E9hn5ufavPN YJQkh+h5IU1T/tZ5QZEjnboMnp+PfFYOq6hOeXRvmYcjpiuPDYWcXrK9zteJi02kVBH9sm8pWVRn IJyP5V9FeA7Ke2jGyZCMDIB4/Wvm+0nkFwAilueWOK9+8E6h5X7hiRuIIVlxz6/54p53UkqNkfac H0YKrzSPfbvU9Q+z+SJI5BtA2hc5H5f1rj7y4feIwBvIOQxUDn3rcWC/Ee+ORyCPm2v29hWJLbeU d9+qOvcSAMfb0r5jKKkI6I9vjSFSW55T4lgucS7okTPQqytnP4V4zfR3UTlmEgwx4z0/QYr6L1pd KuYWk8sAqvIj4714bqwtC7eUFU5xjHP41+h5fj21ytH4xisNbZnmd/rVzF+6BC887gSBj39a5a51 S5EgFvtbqCzLyPU9a7jUbZJCRI0XJwBz0/OuTuYLa3bDhXx1MY6H8TX3mX4mHKtDwq1KXNa5NGss 0BL5XgYG7sPasa9SGT5QAD7N+dPfUbaG2y0hGemQf8nmuauZ45zujcsxxl2zj8v611NybfQJcqXc 6axkjhBjZwcjhciodRumRP3aEgfLk/8A165m2nvS5VVBI/ibO3p19O9N1GS5SMhpRnuOTz+leXXp 2nqzemkonP3jb5wPm3FzlcZA/Ko4oxA2QctkHIHH51lXMxEgO7dk5PvTRqir8rByCCOKuKk2rGPM leTPUNJ+zPhfkLEkDByB79OtdOqWaEiVVPGMkGvJLbVJLPaYC+5uQDzg44xxWrBrFzKQ1xMueoGO nvXXUpykr3KhOD0sdpe3OnwSMp4yMZxiswT6YxMZkAJ5HOP1rmtQu38vhmIBxuHQ1ixajaudqsVY cdv1rH2Hu7nS6kU7I9Ns5tP37i4LDnbg/TkmuoS/050wPnPUA+n1rwmfVZX+SKZOOqvk/wAjW3Y3 4ihYBlGQSAFJ5HfOa5K+Bdua500sQlsjr9XaOQfIuD6kg8ZqnZQjhfl68HA49efpXBT6gHnYGRmB /unPT8av2+uJZlQJVxngOckf5+tcWLw0+Sy1PWyzER57s7mea7iIWFVYeobuK5+81e7jYs8YUdye RwcVE/iW3nXmQe67cfjWBe6hpzAt5zcnkBuT+ByK5MBRmpe8j18zrJwtGR0dlrmnvPi4aNhkZX5l NesaTqGlOhIbZ14blf1PNfNizW8hM0BkCj5hu5P5V0Fvq73MgjBZTwcMBHjHHTHNeti8HzxunY+M jWtKzPcL+8hmTcjlccKMY/rXIX2stGhWUyAc9+vviuf/ALTnhg2s7BT0AYEfXisC4f5/PCF8kg7m LD6kEVyYXDJXTZpWquyG6lrECnexbG7q3r7GuL1fWLadNkb4GD3/AMKt6zcW9ucNt3HA2hOPx6Yr zi/1C3eYmNW9CyoP84rvnQ5ldDo1eV6PceL2B5FCSA8jI/pzivc/h7qpt7hFlb5dwz05/HP6182K 0fniaMHO7dgjHXrXr3hqewkRRcYUnoQ4Uj8cZrxczwylBx7npYXENNOx9jSa4ixotvGo3D+NySe3 HFcXfanfiJo7lV2bjggndzXMaPqn2cKPODJtwzeeFbPsMV015eWyW++SNixGQ3mBiffHFfIQoRpa JHtKfN71zzvV5pzHiMN6g5zz+VeZ6jcavDIzkHbnnd3+uK7HWLthcEGeQKMjrgjnp1rgNWlcNuSb HO4gseRivWoR2vqefipXT1MG/vp2bEhREPVgK5G+nV5SIZMqefvfnXRTXlrI3lu8ZOMYYZrnLlIC eHQd1KjB59K9GhZS2PLlHZ3I7N7rzhICTzwCOw9a9w8La3PbLGCGU8DKHGPfmvFrcgPtjABY9GbG TXovh/z0YIGcE9VA3KPpXmZ7GM6TUj08mqShU93qfTOia5qsQWaKWRk6hRJtH1NehJ4r1Y7UuI2K qu35QGB+vNeFaEt8rjy4y6467cmuvl1G5EGyJWVgMEOoGf61/P8AnmW051X7qZ+8ZRi5RpJuTQzx XqepzoZHi+8SSOcYHfHavl7xXNDcyMH2o+e3r+Fe2a7qV2ts6oApIxhh19+tfP8ArwiZibgxcjBY gg/pX1XB9BU5JWPnuKKzmrXucGsbQ3IMUhfB4VuQPevSdEtbm8ZJAVOOcnjB968082FJAYGC/Nhe p4/HpXqfhHUpLYAq8TYbOACcfWv16tN+zuj8slTUptS0Pc/DOk6uwRnUyDIAKHOR+de2abYIE8u4 e6jz8uISAce2K8N03xNcO6iYb0Q5Ij4/H1r0HT/E8j7WSOEgMMGQsxH4g18njoVZHu4aVJWs9T0R NFv/ADVa0mvY885kzj8ST0rcltNVhtNskscpA6x5Jz69a5uz8SQsds8yOpXhMOTjv3HNZkhtrrJs 7uSHccjDMpB/M14TU5O0tPkerGpTV+XUkvHvY1Mc5IbBwWI6fQ14x4suna3YmM/LycYOfX/PNeh6 lZGxRpftazM2cKZN7D8OozXkPinUDHEUV8N02gE9ex4r0cJG8k46nBiZpRbeh8/eJ9ZZ5mSIMFJ2 lBxXNW95aOywz7zk9MHj2rX8QXY3EohORuLHOMj3rjbbU4HYtcKchuQOD7Y5r7/DQXJoj43EpNt3 Oilt8g+Xvfncqv2H61xurrKQYTlCem0k10L30O0uqnjn5jgcVwmuXst3JxsGOCEGSAK9DBRk5pnH OUUmcRqUDqWVSp6kYPPvWCt3JGNiIcg53VavpSCzFD6cDGPxrIjkIfPTByOOp+tfd4Zuy6nhYhu9 0b1tfzox8xcljkDNbSai4yHhIGOx/wAK5i3nTccc8Z56njn0q7DeyYG+FCe5I610TeuqCM7Lc33v JXUOFKZ/H9alW62RnDZB7+n6VlCRw4eSJVXuuCQaqtNGcggHvjGMVmrmqatq9S+LuIuV6kHqD19q gl1F1QuBjHQEhves9xG2JIxtY8YXOaps+4Flfkf3uoNdVKy1OOtUtdMsi8llycrjJxx/WmpdyLzJ hyemeOtU2lSBvvbc+gHA79agc7skcnrntXdzXVzhinc0ZZwQX249FBOf8moUvI8fNF8y8nJrKuHn ddkWWPfrxVMi8Mm9lJUnkbqTn2NHVsnI3BqMQzsOPUY9PeoGnindSozyD36is+MLJIIw/I/hORjF N8tQ+ePb/wCv9aaWqLm5ct3sahukRiGCjAxk+tEd0cnAjbI4zzxWcxdOU2N2+bgD3xVcTlG2rsGD kYPFEdVoZO2muxtSalLgJlRycdcfrUf225/vRVmTzRg7yoI9QD+lVPtMHoP++T/jVxTIk09bn//Q /kB34bZ16g/WnEY+bbxj0/8ArVEsuW4xz7HipJLm527fM46YyccV617XuNMbmMjJGDn8acEjIywz 0qMuOoOMc5qPeF69M8YFUmWrE6BcYCjPr7UhjRjuwpIHSoBNGE4xn15pTMoBHy/lzU2aYS1ZZKRb Q2Bn35xTTHGfvjOOxqJpo2xuOTUbTxDAwfrTabskTIkVIfukZwMHmmNGmfujnigXEPHBPPQcUzzo zhQDnnvjpTkmOC6kTwRluU5x26VA3lsSvln5SQDjtV7dATg5z259OtRzPBsyR147np7DFJXCVikb aPGWAwRkD1qA2sTjBGMelaSyW+MkHj0JqF5oFPyIce5NP1JcexnPZwnhM8fhUAsoRnIOPU//AKq2 BdRjgLg/XqPxqE3EbA568H1rMdtdGZZsY5PlKKfc4qGXSbRxuZFGBnitQ3EG3zAT3zxioftVvjBH 6HmlKOo7qxkPotpjtwMg1VGiWROFIHFb8skI+UDAxk5zVQz25IXaPbA6YotpoLS5jyaNbA4XP1GK qPpEAyuTz64rcM0IPCsPXGehqrJPASGRD+ZqS99TGbToRjaMe9RTadGU2j+lbZlgCgtG5HUHBxVR ru3OUKY59D0ocWxuSOYfRLIkjYvIz0H1p1lbpo9/b6rprGC5t5kuLeeL5XjkjYMjqRyCrAEH1roD NEnAXJPoOlVpnTvwO/r/AFoJjFpXvY+ydE/4KV/t7+HJFl0/4veOhs4VZ9TlmTHushYHn2r0ay/4 LD/8FHbC6S4i+LGuEoCAsqWrxnIx8yNEQfxHvX5wSwJP1VOnyk9RWJceF7K4j2kFfdCf8aJaq0ib 2aaZ+pkn/Baf/gpUIPs8fxd1yLPR7aO0hfB7b0hDfrxXrnwZ/wCDgf8A4KQfCTWftmsePIPGFrK6 mbTvF9pFfRlV6iORfLmiyOuyRa/Dq48IFPlinlx6Z4rMfwZcbSFm4BGN3X+deRi8mw9dNVaClfuk erhszr0WnTqtNeZ/b94M/wCDpT9m7W1tbX4lfDbxJpcsk5S7vdKv7e/iij4AkWOTynYnncgPHQFq /br4M/tC/DX9pr4U6T8cfhDO154f12KSaxmuYXtpv3bFJEeNwCCrAg8kZHBPBr/LMi8IXq4CyLnO Qcf/AF6/q2/4J9/8FqP2a/2W/wBkTwb+zl8QvDXjG51Lw9bXEF9qGmC0e1kaad5d0avNHJgBsHOK +YqcHUaDUsJTd76+90+bPqaXEs68ZRxMvTRL8kf1LanqMQf5TznPH/1s1gNeyn5z93PUcn+dfiSv /Ben9h29LTPY+OrbB4Q6bbuSPqLvAquv/Bdv9hq+1uLS7lPHNtayDL6jPpcXlxf70aXLSke6qfpX 1mEy1wST/T/M+SxGLUndfqfs7f6iGJ2lsdlzz+IrDlumZTuABIxt68eua+Tfgt+3b+yV+0RNFYfC Txnpd7f3HyRaRdsbHUGYc4FtcBHY+mzdX0NeayYiWkWQY4+XB/lXrrCySSSOGVeLehoz3aRyAMfm zwMZx+eKoTXjMxCtkBvxH5GuXu9ZNwrMvngjoHAwT9AaxUvLt8DLjgZAXjnt0rpjgJNasj63roj0 aK6ZiFQMOercf1xWhDPOjAlQTjGc5z+lcxp7yLDtmJPTkgDvXRWtym3aoVhnB6Zz+QrycWnG9tjs oK/vHXWDxOwt2dUY84JGD9Dz/KvX/CdvbJIgjbBXlthJZvcDn+leG2c1kJFeUbWHOdh49uK918GX scciPajG0Dltwfnpjp+tfkvGc5RovkufRZbGLnZn1H4JF6HDIrmMEYa4OePXkAg19C2RlEHmb1YE jCouB04yTxXzr4f1qK0VP3ivIuA2cMvPXjnkc5JFeq2fii5a03QSSbd3yeSF2j1yAOlfxfxbRr1q rko6H6xlU4U42uM8X3sUbl5FYlIy21eSSO3Q/wAq+LPHGrC8L3qpLgSMojZtx+pAA4r6g8VapLMf OdmZivDYO4cdOAK+PvGlndspulM0b7iXZF5I9icfp+dfe+G1FU5Xnp/TPLz2d03Y+cvHV1Bcbmnl w4GUXnLHvjGcV8ueJ2UOwBCjHzMy8/UAdK9y8bvcG5kCMycEZlcE8dyBn8q+cvETyRkySSqCR95i AQfpnp71/X2Wxth0r9D88c06uxy+nQR3NykCB5fnzg/MMZ69P0r6e8KaRJJaqbApHtG1o5RwQOpr 5a0+6uI3ZrGUIc5aQ4GR7Z4/CvZtK8WaxHZRxTLIwBCh4lQ9epHHWvwvxAwmMrVeWlJadz+kPDzF YalRvWjr5f5nrWsR3Wl27XCeWWXglCD+n/168mvdSnuR5l0yxAt91QvOB1ya6FriW+hJ3z7sZ2+W gOfwrgdWsp43JmcrkcqW5HrxXo+HMFCpyVZanj+JMuenz0o6HWaPHaXH7+WUn/ZdBzjtxiu9tF06 zTesKN2GDzn6HvXhmmXU9rIAN8qYwTuTn/PtXewXkKFSfMORzuYED8K/o5Qk476H84TaUtj1L7Tb LHuZdvPHoB+NZV5qFlCuZo1cE/Lzz/gK5G6v2EW+COMgeh9PrXK3Opaju3xMiE8HGGx+fFcEsLe9 mdFKuvhsa+uSQyRNMIAqdMBQf5nmvHdWksMmRhswcsNq5/LNd3eSv5IW6njJbJyCOPwFeYalPDDO 2xlk67WUE5/EV34Nct0mZV5Xkcdf6rPNL5aRylM7Ru6H+VNtAXOZI5FI+6PMC4+lR3V/PM5jeJCg J+YAg4+hpkVjaSL5zAk56ZJB/M8flXuxqpJWVjidOUmtTdQtENhYAsTkkqSPzFakMMsXzQuX6E7n UA/liuOiS3Q8IMjjORxx6kVq6ddXAuPL3QKo/hJy349q0xE5OLZ35Xh17VXPXNAuWhizLGnX7wfJ /DpXdteRfZwflBPcnt9a860J7aWPywIzg7SCen44rpbqxTyfLxjd12t2r8jzaadez7n9g8IUpxy6 62sYWseJIog0askh3EcE5rzK51e5uJjt24P97d3/ABxXYat4cgiXzbHYrHJwZMk/hivOr5Z7diZe MA8Ic/h0r7LJHS5fdZ+F8e0qvtn7SNirc3M28MsqoT12rnPr3OPyrY0lYZGWSYSMuezFQce3NeeX +qX0bGS3d1A4JcYJ9q0fDniHUJ28qMxny05V85OeuOK+qqUZez0Pxv2i59T24yoI1UsRH/0zySPr nrWTqGrxopSFXGUwHChj9c54xWMmpyhgJSqkqPlJPHr2rH1GbUmP2hEDdV3KQOPzrx6kb6M6uZmN qFxGzOzSso6tkDJH5jH4Vw8t3YxktEQSeOGGf85rV1VXkXzbgHIJAGQSCenOa4l9PVMuzjDDkLnI 9O1eJiqK1949fDNpaIvrewA7XIVicc8/y/wrbsoInZWkOVznOT39M5rhGCQoT82DyCMkjNadlcFg BIZhk/wkfoM8149ahLeLPTpVddUd/PLa2pDLI4Yj7u/OSOOlY2p3QmO0kkgcBiOp/Wq4vEjjzFIX fHG9SMH0rD1Ce8uFDSHvyRj+v9K4qNF3O/2iWxu2C3QYSTZHzZG7aR+HNezeD9UZV8q6Bw2McFs+ nQivm6wF0JdzMQOxViOPwr1nw5q80RV2ZiQcAEAgjp14rLNcM5wcdz7rhnEqEk2fTEmt29tH5UUT txksqn8fWq01z9ohZlVtuM7XwCM/XFcPDq7GMptfacYYN39AKiS/FxIVQyBs4+cDHHvwa+aweEUX oe3xNXc9TI8UXNzbiR1jiKgdGB6+wrwW+8V2hcgRvvBP3V4+le1+JLuZICRbrKSPu7zj6186ar9v a5eWFI4snLD7w+nIr7zJ6aknzo/H8x92W5mX11qN9KLiFypJO1TxWc1q8mHuflYehP8An9afJc3k KlsxYzjcSB+QFcpqd/dBgqsSc9d3Ar7rCJvSJ4059WaV6luImMfPbBYiuMnuLrzykWVUYOcjoBir VzdXKx4h6Eck8gfyrmJb/wDfeXO6bv8AZ+X1969enTlynl1pp7HQQ6g4U7mk5PXbmq+patLINke7 I4OAc8d+TWMZkVvkYDuMNg47elUbm8mkYM8mVzgYwT9etefUpXkdMamlhZ3vpHKbUVQPvdST6E9q oOLkOMk4B/h5BqrJfmKcgoSOhZiBj9af9sEjbowsYOM56isbyi9gUlJWRtL5kqHDyhh/d7fnWjaW 13bqReTTYwDuYsx/l+Fc9Z3/AJcgTeCSO2TyfoKvSXMvImlJB6YyMfp/Su5NtbmSkluaTyxyMRPc jA4EZB6j14qr5WnIdxkUnGAQKzP7RsdxQMxB4JKnORz6VJEInbcHVsZONh4GOlFW1r3NKMru9iQ3 Fskn7jlgAMlattFc3PzLtGR13Efh6GiC7ticSAcA4JHJqWa4tNudwAPIODgcCuWdS+yOulT6tme8 VxDlGIJ67twz3x0qEx3L5Plq3qQBn8TRNqCkmPejDOFJAz/KpI72V12q0bHsM8/jxXFiKkkro9jB xFlhuZ1DlHjUDqELZH5/h3rJlTym+7uGBwyAdPpV8Xt1GW2oAP8AaJAz9MVFHPPcfejQ5/hPPT0r KjUstTurxvC7Ktpf+VKBIrqM7cAY49a6yyjtryUSQMwcjjcMnFUYri6RipVAueSg/Tmte3kW3Zbh kZ8DPy4X8MiunEVdLo8GVGzL0un6gsJ2v8pG0MGCHr1xmuA1iHVItwgZuO5kyM/h/KuvvbmS9gLo GXn7uQ39a5u4s/NDxq1zuH0C4x9azws2lqc9an0R5pNfzbWhunO9uNxYg1kPAwUtEzHjgnp+hrXv rOe3ufMZZyN2Q20HH15NY0s8aKySu4GPmByBXo1pu3uhQipNNrYdp7FRiT5MnAZuen4/zr0TSrd5 CDEysTjPzKACfwNefWsiOoEMjAZwRgH+ddjpivauHt5m3Fs/dyD+XFfN42T1toelTTR7zoWj3aKP taqwIyGVxjPuMf1putX91auIVK8DbnIBGO3T+VcSniDV4owqjdgZZ1j6/rxVS4uGugbqR5Ny4JUD b/U189Totz5ps9b2ijBRiilqdxnfPsbJ4ztY4PqTn2rgLvUHk5mUkA8Hdjge5Fdvf3lx5RKxjbjk vnr+teT3j3sjNcXXlIBnaFXP9K9TDUbnm4pt7EtzeWbEhYmGOpHzVivqCmQKrhR2ABFOg1SKYGJ/ K2j7zfPx+XeqD3WnQzkRyByew4wPxrrjBwbXKcsZaXudBZz2JyZyQx5ySa9U0OaRWiktWAG3Hyyg Hp6EV4zZpFNOB5pwewXoB7132mywW7CMuT2+YZ/lXiZvBuPLc9rKqiUk2j6I0ubV4VEkc+4ED5ZN p/Krkkkgf7RLzIecgDAz+NcLo2ovDEDIHAI+VuoP4MOK6SK8glJ+eRCOgCDFfjOY0LVG2j9Yy6tz RWpT1f7dcKZ94AAKn5R+vPSvBfETTSXLR3EhGDyMDbx7CvadXub2GJjISU6HCqMj0z/WvGNadJ7h 3XjHXd647GvZ4cTUrnl5zUurHGCEGY7WXHqeM/Tmux0C3aST/R/lHQkt/hXGs0iTbwBg8gckfhnp W9pdxImfLESknrk9fxxX6fFt0z4KtJXue7aRam0VZZGlVsja0ZDj64NevaVfww24ZTukJ+ZmQJ9O AcV4T4fvLd5ALqbD5HAYnI9icj9a9w01fDs9sDNdTq4HAQgj2/hr57Gzt8R6WEp9nZG7LqMofziq semM5/n0/LFMvLuPUh5UkAHA+cNwT+HFSxaRpU/zrNK5HTDDOPTGKhu9H0W3XzZTMD2UEg/XtXjc 1NPRHqO6TaOVv3srV9uy4SQjG7HycD1zXjHiV3mnaSL5m6E5559OTzXqWqQ6cQxhy6qCR5hYfy9K 8k1yO3iImVot3GNvGD78817GCaumjxcdqtDx/VFlRzE0UgXcc7uRWbZ+RbsJDCoJ4z0OPzNdBqt9 GR5TTAtycdD1rmGhAOVdiT2B4/8ArV9VCpdangS0ZoatNA1oDJyB7DNeYapDHGxlRWXOOvXn15rs bsSkBlkdiDgKeR+WK4PWbi5mwTlivbp/SvUy7ffQ5cRJWu0cteOV+di5OeBjj05qorK5GeMjqelU LuWQS4bd1OGBPf2qBbhAf4vfqR+dfYUY6Hiurdao6BLVRgJtA9uDT5IW6t1z/CwyM/SsM3cLsMb1 JwMHP61O10ULFNrAHO3PaulKWhDcYu5rgxwHDs7FuxOePSkVkaTIHYj/ACaxWu4yCYwMn72CMipP PiRNpzjHHTIrXlNFURs7sADce3U96o3CRp8z8E87s1nOzMNwBOTjdz2/HipsTsuFK8dA3IOPxrWn Tsc0pX0KU8Il/wBWWOM9ScCgJPApkYlyRjAwcfWrZjuGcCQDnqASOfWpVR4zulPUdD/jXSp2OelS 97Uy/NkUs4VsdTzn8KrySrw6s47Fevatd2iXL8qxwDgcVmsiOodd2ScFeB/WnGepo6PSRnidQQ4Z yP4Rjn/61Mmv8HdFkY5Oe/4//Xp7xPG+SM54yDjOKoSxyYZpDkHjGeP1renJbmVSLSZorqcDqY5A u7G7PYe3FEbRvH8+GBIz/n/61c6VdHZWVue/+NTrOYTsEeTwPvVpKFtjz4VJNvm6GysBZcKWA5zz j3qP7OP77/8Aff8A9esmS8dx8ysgHBIOc5/lUHnQ/wC1+Y/xqlTZtzxP/9H+O4TvgFWp5aZuFwAO fU8//WqoPtCt8sZ98nP8qXdddSh65IzXtIlNt2LW5n4Prwf896Fbb8oxkZyc44HtVfzSGBC4+v0o MjnII69CBj9etDS6FItEgKQTySeSfT0FLu3txyenBqpu3KNvIHemF5QPl6dcjA61MtgcXe6NIsMb SufemkggjGB68Vn+cwBznOOWzSNL69M9M04iT7lzC7RuGCO9G6I4yRkZ5xVPzQTyG/Dv6U0yhgCu R7Uk9Ck7GjvUAgnnA5/UUzeGwTjOPpzWa0yufkP4cVDtZxv5P0agTNZmVcgNyBjIqHzEcjBP1NUJ AFA2nnPIySOKhkkKnPHPYEZ5pSeguU1+CPmP0x6VE0cbYG8AenQVREowNr4B7mq87RsV3ln4zgHA BovtoXHQvSQKh5bAwCc1HJAj4wUPHcVAJIMZmk9gCM8f1qG4ltSfLQsxHc8YH51VkT6kksWxhyOP Q1VERzuVwPY803ciIV6/jx/Wo3wW4x05rJLWxb2HvE2cowIPp6/lVcq5cxjOQcZ6U8SSj/VpyD/k 1ZWUOhUjB/2u1LRsaiUPLlJwrYI9agZLgH5yMe3NayiJj+8wce2KrsoWQt8v5VN9RtXVxi2ksq7x 905PaohbLgF1JHarW0phV+bHJ7ZpmRuLMueOh4HFU2iYp3sU3hs92NrDj2qN4IsZUDGcDIrSlK43 Kq9O5OeKzpFmLHaFX0+Y1BbK0lsrhmJUHHc9KgNlGBnK4+tTmF5X3SYA74NNNuwJEe7PXnnmnfoQ 31MuSJkcBdp9ADUTK+AWBA7k8AfWtf7GWPmShsEZO3g1DIk8OHRSSOV388/Ski0+5y9/fNZRefID sDbQFIJPuMVzr+LLNGxLHL046dq9Amu9QmXZJ5fPqgx/Kua1HRbPUzuuoURtuMxfKfxx1pS20Bvu ZWnfEP8Asm8TUNO+0wzxMHhnt5PKkRhyGVgcgj1BzX058Mf+Ci/7XfwdmRfh/wCNtdit0k8wWeoT /b7YkHJBiud4wc84Ir5Wk8DxMx8uWREPTcoY5/SqE3g2+jbEUisMnBI20QrVY/DKwlCMviR/YD/w Sm/4KGfHX9tPXfEfh34t2GiCDw7pNvcrqOlo0NxNcSyhAHiZim0rkkrjBAwK/YyfU4EwqMQc85IG fz+tfx4/8EnP2r/hX+xtrvi66+MJ1BI9ds7OCxl0+3NyA9u5Z9+CCvB44NftpD/wV7/Yt1G5WGXW tVhViBvuNKnCrx1JCmvewc1OnGU5K/qvyOLGyUZKNOOiXmfrhp+oxAAuBIfTcOv071vf2kWAKjaC OCwH9K/LXS/+Cnn7DN15Yl8dx2+5hy9tOm33P7vI/Gva9G/b8/Yt1RQ9n8SfDzowCjz7nyySenDq pHXnNefjsJ1Wp00Kz5bM+7tK8iS7EgcMCwX5cnGe/WvedBm063EcOJmxwSrYLDPQZB/nX57aB+19 +ynBOu/x74TH8YY6pbjI/wC+xX078PP2lP2bvGcsFt4b8aeFrm5L+VElvq1uZGkPRFG/nP0r8c43 oVukW15H0uUOO6aufc2h6zND8ljGy4IJDkFsDuD34NenWmvCQhzKI2PViuAPXOB/SvErY2r2cRWS RiMSLIQrLg99yjp71sG6tn2zMJgoGxiDlSfXHFfy3nGBjUk200z9HwtZwWjO21PVILW3kuFu+CCz KS2WHfnjpXzR4u1/R5pGaM+YSOH3sfwPPPtXb61rWn7Q6FZGVc4Q7iFHQZJwPyr528VXyTRS3D4j TIKrLyPzwD+GRX1HCOV2nzu/5fkceY4vZHhvjG+tFnfD/KSdqMo4/EcmvmLXre9ub15EcIP7zLjN e7+INSnuXIeS3jA4QQptIz6k5/nXhutMkM8kkTswUYLOwOSPTPT8K/prAV5Qo2t0PjYxUqiuctps s3m4LK7cj5QTnH+ycYr3Lwpr8K2flSrHIR0MiYII6YJ7/hXhqToWEFoVWRucMAAQOwwc12EE09lG FuI4ZGHJ2Zz7DI9K/KuMcuWIlyy79/8Ahj9z4MzD6vTukev3XiKeNygwmRzgjJGPzI/GvPNRlbe0 07RjPQ9SMev41jhrqRvPezjTGRvJB69vaqV1KrymW5VVXsgbBz+ddnB2BjRqK3z/AK1ObjPGOtC7 /X/gF37c0SYkSTJwCVY8g9xiui0ue0JEx2ggdZGbgn8qxtNlUjzCqtuPHIIFbUl7p64JjTf90jA5 4r9yoYhOPLY/BsRR97Q6n7XczQZMi7R3UjoPrWU9+sb7XCksuBtHNZ9pq0jttjtfMxgHbgAD866R 5F8kSNDgN13c7cfiawxFTk6CwsE5bnH6jb20ih8v7gHv71w2oxW0UbHzHweRwcgfWu01ySJUaSJV Y9ugOf1rx7VgbjO3YWz9wknn3ya3wHNPVsrExUXojKkeOVi/mh+gyc8frTkkkibzJCNvQA5/Cufa UpPsYspz820AD86m+0JDIqlpMtyC/p+Fe5yP1ORNm0128bj5GkHbb1Hv0ro9PuFWPdKHYEYw46H3 zjiuJ8+dTkoHBOPv9vxzV6y1S6ZwY4wqIOVcgj6ZOc1eKb5T08pinVSPVNPvvtAVY4lDDuBn6nrX WW+oXMY23TkAHhQgzXm+kak8rB1jt93Ylmzz7Ctue61BmOXt1HbBOcfka/Lsx5faNN29T+ueF3Uj go8sW/Rf8MW9av2jH2iOQg/e2jHX0wa86v8AXNSnOZCjgn5TgA47dcVr3xEYO7ezHptOR+HSvOte N6S00cERQD+M5avo8g5dEfjXiLGbk29O6KN/dxI5a5cqd3zZPH5Cum0e6sAsRic/Nxkbiv49a8xm lulcSFTnGSNpx+GD/StvSpJpQs7tJleiKpAJ9OfSvt6kE4bn4RtUuez21xplxKqrJ5jjIIIGeB25 6VQ1XSsoZZJY4hkHIY9+3HFcRbrcQ3BYMQTkjzHUj8jU2saneThYk8tAcAIDxkjr0/SvHxFJ3tc7 KM7puxTvI96mIEE4ONucn3NcdetIqLtUKQP4wef8/rUV1cXQkPm3O45O4gDAP4YrDvtQneERTTls c5YdvbivBxVGV7XPUwtRWtYSSdZMq2xuvGAMGq8Txh8eZgg427gOfauauRZ/Z/nuRySMZxnPp9fp WKYrWKUGKVdp5++D+dRTo3VrnWp2dj0qWW5Kbism4KcFXHsOv0rAuLqNsQlLkgjk7hiqsBFthWkU gDOPXPpUaXMVyzQlym3lduMen+eKxjHld+x2Uot2Rs6NcQW8+2Vp856uM/TH/wCqvX9Buo2mVHkg GQRl0wc/lXhkKTKynznVd3DKQD09a9S8P2kTMJLe8d2xnZOCePqCK83Moxmm+ax9zw9OadrHvNms jw+Ws8TZ4XZwB64BA6065RbJWaaQZ2g7sDOfqa5eyv7yGJoWK9Mg4KkZ9Mn2rKv9QukJDeZIcjkS bhj17185hcM3J2eh6+dYpKG1zE8QX8Ydka4kcsRhCcY/KvNLi6zIUlLsBkbcjv8A4V1et+VcMWuW nQtkgEZPr1zXlmqfY4X226zEg5LE8n8q+3y+Huq5+V4+7baKGpXAUsIUVAMkZIJwK8/1DUbt1EZC YzjavfPtVvUtRQ7oQGPPIZucfjXH3F+0Mn+qdskYPJx9ea+7wELHgYqb1RduJj5S+ZuUY5JAIx36 VzN7PHE5aFVfPP3cZq7eX8rxgyKwG3IHT8+vSsO5JuVCrvzjOABj2r1r+7dnnO+5ftL15xgNtIGc dRwKgkack/vJOB93JxWfaRSIT95fRe3NXrmdooCpKZJ5Pf8AyK8utKKd4rc6Iaq7KLyIHy4BPbrm oXvEXkZIB5A6/T+VVTqEgcrIVAAxgdD+lWiqzfvA0eMcADvWScb+8XdtPlNG11cBciNwMDknGM+x 71cl1h2GwFtp4y65FYj2sChSrZYjJA4FIkMgX5ZTgdh/Poa7IqHQmSlZXY6XUvn5zkdeKz31WwHz SCRcEZ2lhU8whUAqxP8AeJB/HFYNzqNvC5ykrfQcHPqf6VcIxaMZScNUdVBr+lAFsTjoTvJ5qWbV obtV8lnx6ktz+VcHBe/aJcxlx0GSB+lbbzumCzSYIP3UGOnpWVWkkdcK0pI3Ybw8eYJPf0+uTWnF NFHiQ7zk/dAyfXsa5mO6fbtMsrBjxuAGenHSrA1Ml9rOSAMZbp09RXlYiG9j2sFVa+Jm9dTxyrkQ nGfvEnn8jWRJqDQsB/qx6cgfnUf20zNlZFC9wRnn6mq909wybGwwPQdD+dYUKfKenianNF3NWLWJ 2QJIsjrnhkcjArqbfVIooxGRMC4x8xLDP4mvO7a2l8kGNst6SHpj8OatDVdRt08qZGCjo0ZJz+Yr onFPY8OrUsrtnZ31zbLn5GJx/BWUdSkt0EkC4OOsgOfoOtZkU88vzSHqPvEnP5Vi3sl2I2/fNjkg E4GO9TCN9Gck6+t0aV7q93OSHATjGR/TIrkdV1CK3P7xQ4I6gjJI471nXP2lgCs2CRgZwR+Zrm52 mZWBfIx2UHH5CumWGW6OmFeVrdWdJbavbzyCOMRp0OcAZ/L1r0DQI9Uk4tZvcoWAB9O1ePWZQOGb cMDoQPy967LSbxllWZXk+XvwM8/pXhY6ho+VnXCo95H0LpUt3bKPtAaXjDbZVx/IVPfXKlx5VsIx xlmeMn9TXmP9orPGHDuvoTgc1Io+0oyvdbSB/GdwH5V828Prds9WOIex0FzdKSQJwnOCu5G6dOBx XD67diMkg5IHYjA/D8KyLwXEEpBmRgMkGMk59evFc492Z5PmkQYPc5wR+FdtHCq/Nc5KtZtNPQW5 mmCmXywAeBkcH+lc7cW9pIu+YSFj2U4/l0q7c3wD+XJKrop5UZA+nFZd1LAY/MiBxgcA88/hXdGU lqjjupaIns0ht2Mql+DwrNvH49a7HT9UTcN0PmtkHAwD+VcZaIu0FAV5yMHrx9a7LTotzpuDAnq2 a8zMJRs+Y9rAQafunsug6liLzDBPkDKgDNdkl3JdJ5pE8eBnDICp+vpXk1rqF5p0YW3klQ4AGwH/ AANa48UX8ULfbZSqHoeQx49K/LcxwPNJyifomBx0YxSkT+Kb+/CghmII6Bf/AK5ryPUboMpaVMkj +MYP5f0rtLjUk1BvNRi4weSTXnGtoH3bXUnnqSAD+FevktDktF7nnZtXUveizIjvGkyAM49Og/Ct Gwe0nIV1lGT8pR8cn8q5GO0vCfNilwM8j/65rqLK1lYCMJnOMEgEZ75xivvIRjFaM+KkrnqPh+O8 091a283bnKmRs8Z+hr23S/E2o2yh4E3MRy3B7dOgrwXRX1aFvLl2BF6ZByR+PFelWGoanCiukTtF jlVGP1BrysfQjLSSudeEqSgrRbPZ7Txrqki7Uj2P34AP5rinT+LL+IAzlvmBAEmSo/PpXn9pfX0y CZYmTOflMrKQfrWrcTXk0XLu5/i/eIfzJ/wr56ph4qSXKetTxTfu7le+1mOWIzzy2q9yFbqfpxXj uuzQXEjsJ4VXkjPXke9dPrOnNM7PNubjJGSAfTpxXjviOWKOQqzsMHgAg9vpXu4DDxv7rPLxdR2e hz+qtbW8SgSxhiTtPU89K4y6v7nJxNlcjO0YBx9abqN5E8oMhOV6DHb2wazFu3myotwwBwByDjr3 9a+po0uVczPnalRylZIqXN06vnc7HHXJ/Ic1gXmq7DvdHOeCR9O/Nb0txFbuS8BHUg9Rj8axb1bS 6BcKBkZIPQ/lXq4SSejRyVldaM4e41GUMybZEBbuAQBVONlZiwlPXlR/Kr99FEudowowcj/69Ykj xwsWKlfQ56+/FfT0ZJ7Hl1qbjo2bsZjdQGPTHDCkkghzgOAR39a5w324fKWxjBHX+dW0vFIL7m7D kcmuuMXcx9r9l6mkLW2QF5HBIb8RmjzbfLcj1CjrWK2oID1GOmWHQevSqb6tbqxU7QegyMCuiMGT Ksmux1n2zyoh5aArjp9O9RDUbhV3Roy4446Vxx1O1dwq5wcAYJAxWrHKXUIjleSMA+38q0ULHLLE Xd0dA2ssp/ehc45ODzT01iNxw4HP3e+ayzGSNxYHHHPtWf5ZVs4yx6Y9PyqnBW2NHWlFo6c6pgHk HHcnuarSallxt3bgcn6H3/WuV89g+whiMZ3f/rqB7h3OSG75w3f1pOlG454xt2sdNLqIGCrAZBHz DBrKbVV+44zxxjp+VZstzIU2sH/PP9KoSSFzwxz7jP5VpCmjKVaT6m6bqJmJAJAOQM1TkuEY+YpP B5GTzWcvmmMq20kdnGP1FMNo3+s5wMDh8VtBq2phO7SNJXzygOMA4Jp+9/T9RVL96ANwPYHJyf0p 2W/2/wAv/r1aqaaGVRNM/9L+OkRd2bB7g8daeEJTzQcn246fjTNrb97AZBGQc4/GpA6jHyqM9Dns K9VSNba7DFh4LqcnIPT/AOvUZDj5gP8Ad55/pVnfztJGCCOtJGYw2SflxwR3x7UKTJa0uVvmyOMD qaewBPTPHPv+tTmVH53DjgH+VMBWQ/u8DnBOR+dJvQcY2dyE7A+xfmB74wB7UzYHGSD9OlWfNjBw 5A5x1HIFSKIU53IB0FU5jlDS6Kgh3LkMB2NIbaZgee+cE8/SrTJtPDKSTjC9aiM3luAxOScjHI49 6TegowTdmRi13E7uD2qNrcIdvHPcVbW5iJy3BzySMAVX8+HPyPwe3b8TimpX3CdNKxVa3UjKFj7j PemfZXI3guAtXzLGUC7gOctg859KZ9rQ5XOMAnBPAoew4tPRmdJbucHdjAzyB371CLc4Abkg85Pb 1rSF8VHK8AYByetRHUcKWVc9Tkj0pJ6bhZLWxTMSRZyDwPXimKsBb39cHmrK34Y4Kqu7pgdaY14+ c/IQD34xUx33M5JuzD7LGTnb7ZGaiNi4kPoQNvJ70xp5vM+Vk2k4pzT3a5VGjPI68HFPnRcYlpbI Y6qVA9cc0fYhMCDyR1Kkn/CqLXF0zFdygDoM9abHPPtLb4xntmkn2HKT2ZoGxAYBWYMB1z/hTvsC BsuWPuO/1qh9qnTG1wBj+HpmphczgAgjHc++OpqXYSu9TTNirDbHk/Qdab/ZygcrjHIJ61mfbbor hJH98CphdyKAWdyR1JHSloXFdi7JYKxO4A54FQHSbRmJGRxjHoagN1uyGkYkEdulP3OMsMkZ6dMf nVKyJVyJvDqyOXV+g9qiGguHyzgAZ6Zqws8inC44GeSc0jTSkcYwfSpZUY33Mq40qePmOTOc5GCD VCSymC/eYDt3zW4zXQO7KgY5zjP5mmH7S+T50I474z9az5l0BxvokYO2WP7o3nvkEVGRIQMocdGP Uj8q1GedWYCZPr1qLeQuGmVexIGaq4KD6ldQkibSjDnuOKhNgjNgBsjnp6VbaZCARMvQZwOuKeLi FD/rjgHqF/8Ar0uZdA5WzIlsCoBUNnOAKge1kQjCn1Ga05bqHBzcsADwAn/16yrm7sF+UTyt3+6B +XNT7RFKnpqBUumDnrUwsMryOcexrIOo2yk/vHI6EECj+17VR+73n6nAqromCdzQSwjWT94sbAfw txmrUSeTKJbSKOJ0bcrxuQQe2PSuQl16cqdsI3rwVLZGPY8Vj3PirV4Ymle3jjjB254Jz+fpUuXc cLH3F8If2xf2p/gf4k0jxJ4E8ba6i6JqEWoWemXV7LPp5ki42yWzvsdGUlWU8EGv2k+B/wDwcZ/t AeHryS3/AGgfCPh7xLZtCVjudBY6PdiTdkMwIngK44wIgffrX8rU3i/Wnf52VOONorMutb1W5yk0 rsM8DJAH5V8/m/DOXY1WxVFS87a/etfxO7C5jXpXcJWP73fh7/wXo/YX8dC2t/GN54l8ITTHM8er 2P2m2hc/9PFp5pK57mMcdQK+1vBP7UH7PHx4jnl+CnizRPE0lvCJrq20m6jmkjjc4DyxHDqMnGSo 54r/ADPlu51cuWbLDnk/rX9Jf/BuhZJdfFb4k31w0m1PC+nxFoly+HuyTznjp1NfD5jwHgcHCeJw 7krdL3W/3/ie5g82nXahUSP6XNfaWRJE2GNTk+YRGigevPevB/ELeGopTHIpkcHKEHIPuQBX0T4t ksDH5MRbeRj96vP/AH1jH6mvnfUtOtjM2wpwcvgEDHqCORXbls707tteh1KKdRcqucFcmJmzFHKi hgTnCgj8cGtCzuobfhmdtzDJZSB9PSsW+ea3nMls6Hn+9u4J6Ekiobe/Yt/pD7VONpJBBOfYdK+c zWlzy0Z+n5HNQivM7RtYhwWQzSISRtCjI/8ArU3+1rdn81EdeOTIuOe3HIAqnFMsoWVishX7pUcf j0qwWuRH8jMiZwQWQbj7CtchpqMk9uhGf1eZOL1Ihrc6ybo0kfBP3AADjpXWWWoSXMQLYjz1zgkn 8K5FL+SIljBnjG44BFaltPJM3mJFJx0YAgZzX6/RiuRNI/HMUpKb0O4i1VbTCyNbqMcbuv5c1HPr kRUGApJnjIBwPyArmHuL4Rt5Gw/9dNvH5iqkmsrIjRXDjOQCYsjn8PSsKlBP4gpVWytrt3ezRFg0 ZXP3QxX+leW3T30T5jBQc7XyxyK7S4mtriTacM2eC3X8zXGXzSb3Ziihfuq23NehgqVloZV3fSRj TwxNHvlcF1z94EKcj3rDl1PVGZYox5qjp8vAHscVQ1S8vY5GJI65BPC8fTv9KyrLU7p5f3K+a3cD OMCveoUE1eWp586tm43Ojmv7pdknz8ckEAgY+lbemmy1KRdzSeZncUzj+eK5qHXN3/HzDIhP8QJI 9MYxWvBqdun75HZSfZTx9MdawxXNyWie1ks4qquaN0e06Nb2rr5ciwsuCMuxGD9Aa6mHT8J5dlHA c9gx6/XNeMaNq880iuMvg4bep/TFdtHr9pbgiRZMgckIe/0xX5RmVKqqjTd/yP7A4Xr0Z4KNRRt/ XexLr1tdq2+WCCNegbcTn8BXjGttqkV2JUKbB93pt9+td7feIraVT5bncclQ2QM/r3rzXXLxZY2D TKGY9AcD+XrX0vD0pppSR+QeI9Om3JxZlXF5d3E6uJrWNcAYKEH9P8KkfVL+1dYy0LqxIDZbJPpt xmvNLqS7juWVpIgM7hjO4/iTV1Ne1G2xHb3UAyM7ZFB78jnBr790tEfzzWfvHcQ+IL2GYR3Adgvz MscZb8j/AFq5f61b3MCYjmjcnI8xQvtnp0riLbXtekUyxJCW6GY468+/5U/UdanLCK7u7U5HIiBZ j9QOnWuHEUk2gjUWqHXDaW0mxSA+RkYPOe/YVkXl/EvCNGB1CbS2PfjvWff6llWkgDuoOeMYHPfP P6VgXF5LGC5JV25xIR0P8vyryq9G562Gd9zRubq3dQqbQSfmZkOenb0FUEnsmcKNuc5yQACT16ms /wDt1fK2uEUg4UtnH0GKTdczqIEggO8ks+c8Vwy5kmjtS15jTmuir5DgY6AcKfaoUvNg3xlHJ9Tj 8uf6VBPGbaPy7nKdMbV3AD8K59rktLlH9htAFZQ1TOyk3dNHoGlOlxA0l2m/JJAQA8fTn8s16Bo5 0uIKWfGOcbcH8AQK8Ys765jAlYuGXvkqD+IrsbDxBI9vumUgZAG1t+R/P8K8zGU21ofY5XOO7PaY dXJmYwyBk6dsjPuafe3qx4ZjI57bChAz3OK8407UIg4aYSDPIG3g+nJXNbMt+joZkbaAegQnIH6V 51Okk9EdWPquUW2Ral/arh5kcDccgS4I/wDQq8j1e51CK4O4hvXaD16euK7bVyt2p86YqhHygKQT j6jiuA1WCGKNTCSR6nv2r6jLpWtc+DzGy2OOv7i4LERsoPBLEHNZhuL2UGZ9uBnHJJ/pVq6Gwl44 92T/ABHA/nXPS3EnnYfEYzgke1fY4TY+erR9/fckfXJNpSaE8cK/0qE34mcfuwQR1IPH0qC5ll8l o1O4feIJxg/Wsl7qRAUJwQODnpmu2dtbI4pNt2bOrZkZcMAvy9QKyryRQh8k7vbisZZLtyX83HoN vQVCZpFcmMlux44/DmvOqJLqdG2q2JGmhx+9fBxjG7Iyfw5puxjgKxzngL6n2/8Ar1nXUilTkOPf aKlhuNi7wDxypI6g9eAKz5FbRlwkrWZ0VjA+MTbieowcHP0NaQBQdOcHIJ6Vgw3CM+ZGIPqCc/rW rL5e0MJG5GME5H6Veqtc0hqnYzrxXGXYELnGFIz+eaxjFBONm5xuPQ5yP/r1rNhj5QPPU5FRBYYW IdVBBBznnNaRmjCVNu19SO1tFt1xahQRyd4bpUjpDH8rkktwODxn3zSpP5m7y2bIGMK2P5in/a7j IKpISTjkrWUm3qztpU7LVkZaKPBUBsDBJyP8asQ/Y5ywcxg9OWx+tPmdzFukUgZ7nqaxZYC671XA 68MefbtXnV2mtD1cMrG19kWPmJkcjGAh3A1XuUuFIbDEY5VSMfWsdJ7i1OYYyGHrk/1xUsOqSRMH nHBzwuev05rGlB33udVSV1axezIXLsHGFB+bHXn0xViO3TIZ2frxgYP86rpqEMvPl/Kx5JBz9RVx JI2wI4/vjrjr712J3Vn0PKaV/eGXEtuF8ySR2wP4lAHPtWNc6hZKm2PYxB4Gfyq3ews25PJTHUAk g5B9vWuauLK4gfdHAoGM4DZ9PWpglc5qlk9DMvbyTzuh2cYGAR19ayrnVpImVcBhjOEPp9BUt9PM W8t1XGCAOKx5ABuU7VJz/td/auqcUlqi6KfNuaMGq3E7bS2AexwCOPwrtNHvYIcGSO4kI5woVv6Z rzAWV4ZRKhUgHkAjOfXHU13OhzRsNk77T90kLXi42nFK62PTjJxerPX7TxCggDx2c7AnaS0ZyCPc Crc2r3VzEVt4PLOM5I6j0yRXJ2azwJuhu52HXaqnA+mKbf8AiG8iOIXcg8YORx64r572MW9Edzqy tdlLV4gSXaN9xBDDJAHTsK81ltZTOcIMcnc2cf8AoOa7ybUprhf3+AB83zNgn+dY76oY87CeTjgj vzXXRbjoc1SMJ6nKtH9nzGUh685U/wBSKBJCjYURo5GGGfl98dafeTXLkyFj83bPT9KyWVHc8qW7 HP8AOuqeq3OemrSR01sglxJwc94zkf49q6O0W7OFhYqMZGflBrzOJ2hnL/uzn7y7iOfbmu00i6n3 gNsQk8KTnp3zmvDx9J2ep7uBknZWPU9NguDEjGUBgc4J4+nUVfuLMs4klkUf3s8j+dc1az3xYGRo xgfdVgRk9+1TXl5ukEcvlkjqdwH8vWvgqtOTnoz7KEoxgrobdv8AZ3JjkTAJxlRzXnGr2sqs10xA xxjBPH4ZruL28sTHsVCAOxbJPbjj1rzvUpbQTs24lj91ZG4/nXq5S2pPSx52YNW0K8d3K6bR5aDk EgY6e3rW7YXbSKG3RNyB8uQ31rg50vd2+IxhCc7geB+dbtn9pMWWeFscAgcfz68V9hBx5T5261PZ tF1SVNqXMiyrtyquN2fUZr0C11qS3UNAkTIedjqefbn0rxPSvEEtlIkEiw5GWyDt7epNehaT4nvE cbQu3cCcy/y4PFeZicO9WkdNOrHudx/wlVw/+jvZIO2FGCc/XNZU+uRWn777MkMhJ+Uxnr2z0GKu y6zcahBi1htUZ+c7wTn8uK4vW5bpjtvTbSZGNiDnjr6VyUqak7SVh1qr6O/yMXXfEU10p84leM4V WAP054rzO41K28x/lZTnnjkg/U1181raFd4CRnPI3MMn8cisG5tLZhlvlxyfnzn6Yr2aTjH3UedW lKV2cbNdaeZNxlZGyTgx7iePXNY99fXqLuilLZzuIQYx2FdDe6dbTMSEmA7leQPeuQubCW2GEkyr crk9uh/GvUpVI23OFqcU2Zd7d3ckGHkII7lBn6c9q5+Z7spmSXcp7hRV+5tpUPlSscds/wD6q5m7 naBAQGODjHtXt4WCTsjzaumtv6+8S7bjJJOeu4Y/lWBOsW4gEnB6D0qW4unJz+8znHUY57VVW6tz n5Tz1Ix2+le3h7xOKrOLabGiPecGMnuecc0edFB+78pifc55+npU/wBtib94AQT+tUppIpcsAQPy xjuK9GnO5xTikStKwB/dkjjt68042yTJmXcfbI79aqKWB3rOwIPIPIx/nNRy3U/ltGG3gnIO3A6d 6216B7t3zDDbWwAAYnb0PamsgLkxkkDpjg8/nVN2nTc64PuRwPyqst5Lu4K+9dEVpuebNpNpGmRK vz7mYE+v/wBapfOY8GTGBxtqot5Acq5GfVe1RfakYEpjv17Vo6mmo2+V2TL6zSbcrJkEEge3Qdqi MxwWdsHGRkYz+lZyTsRngH/PNQzTy4OMbTz+VOS6IqDvHmZfmlCgyMV9QAepqoHUttGPm6E4NRCQ bACmR3z7fhUT3cZTBHT2/limpPYcrK7ZceZwNqMCMAE+tC39zyrFeOmRzVaK6iY7E28cncMUweU7 EErn1BwM+1CRjKTsmnoXftTS8E9OnQUb5PT9ayX+SQsDt/HIzml3yf3xRKHYXtF3P//T/jH+13h/ 1gkI796iNzcBwSrlT+gqo2q3LjHTnG1h/I81Gt5qWwsQNufpn/61elzFz6F4SXmSylhzkf4VOJLt iHUZ7Ek81nreXpGGGMdic4z9Kn+0XGzI3AemP89aGyoJ9yx/pmwHZkdBk1AXuwu0Lg9BgVD9qkUZ Uv2+Uc1Et3dH5GDYzgMDjBqUx819i2hvioDZxyenWrKR32eWxnu3asszyA7d7DkmovNmlZvncjqO f/r0766kuehtpayqSwmHTt/9el8qZiFkmBHoOuaxJEYgxhif7zA+lIsURGFdifXPr1ovco3CkoUh 5FWq8ksSDDTAHocAfyrKAtkyWUNnqTkn8KjPknMaLtP97PQUSSWzuJXuy699bDLh8nj2xTUvYsbw Tg56elZipGI8IN3c9DUxKIVCJyQc5wT/AJNTcElfVmguoDnaRtHJJqE6kv3ycgkZwKqyABirqRzg jHWpFMQJI6EZGBnI+naku5TtsPN/BJgAH6gYpXmU4EakZ7cCmqyeYFU4qGa5aGUfKTkDCsM8fzp9 dCG+jA3Eqgbdx6bh+FIbqbqImxjr0/kKb9rlLDJ2gA4OBTWu5W+/k/ypJmqVth32iYruRMY9aXzr hDuCLnpgg8Um8sgILKOAvHXPY/0qYSmRiC+cjAyfT6iknoJ26CreXeCnlp9PelaW9UFsA4Azt7H3 qu04THBOOTkjkUC43g4+UDpg/wCf5U9hqbuyT7VeFCqDb7HH/wBahrjUTlkZScYPHT8aqvOpGDIB 371MjIR/rAD7HBP9KnfYmXkKz3rkASLu4yvpSb54zh5Qc9cZ4pnnIjEscYzgcEk/gKJLlNu8AA9D n+fsKUnqOKtqDtIi7DMeSSee1RBskATnpg8kVXM0eeCvJztxk/malOxgcbc5yAKGr2YJ3HSxoBtZ mP4nAFV444WACSMx7dqsB4zlmXk8A9BSC4jw2AOO31ob8i46dRJlhQYK4wMmo38hjvAxn+EUwTJI xU5OeaY3QEYGeO+aXSwSl1BxZnk9f5VCzLGhKKecKT2zUvljHJxjtURDM21Co+tQ0kTGRmyTSSJg fL+RrPlgnYZ6qD7DmukMDEmSR06YIyKqMIl/jQkdu9PlJ5jlnV0zhRz6jkVEscwXlcZGDyM108hg Q42/eHX3qhMu9Dt7jt7U3sNMwwJM42kg5yainjjljENwpADbgT0BrQMU55jXleetRGaYnBOeeOM4 q9hzjZGRJo1s/MjHPYqB+tZMmhyl8xSRsOnORXVO7Agvk84PGakKwjDN6dPelOF9yFKyOGXS7snb hSfrX7vf8ERf2jvg5+zD4q8faj8avEVp4cj1nS9Ns9Oe5Er+c8dw7SAeUkmNowTuAFfiqUjcnaB9 cnIpNuAMBQT35P8AM1x4zAU61OVKezOilWlB88T+7DUP27/2Q/EUQbSPiP4bleQlFX7R5R3e5lVM cD2HvXGSfHT4V63NtsPGHhqct91E1a2yQe+N+TX8RcRXJ8xjwM7QAc1qxTvOpCMwyeQCR078Vw4f J4UYckdTujmU+ZSZ/a3Z+OPBN/O0EGuaI7/eIiv7Z2xj2kz9e9bS+I/Cu8SR6lpmT8q5uoiWz3xu r+I9ZbsSK0b4YDj5jR9q1WMnE8uep+dv0ryMZwpGrLmVW3y/4J9RgeOJUYqHsb/P/gH9x0WtabAy rBJE27ksjqRn6KcY96dJqpuCrws3zZPABA9fSv4fU17xPEh2314ox/z2cY/Wprbxj4viXamragqn +FZ5QPy3VpgOFY0Gpc9/l/wR5lxi665fZ29H/wAA/t0l162tY988yKoGP3mEwB2LEmm/2xBK32gz RmPHy7ZSV9unFfxMt4s8U3ERiu9Q1JgTnDXEhU+mRmuy8FfFz4o/DvU11XwNr+saZODkta3LhW9m RiUYfUV9bRnCEbWPj6uJlN3fU/tNg1QTbSJV2k4XYd2e3U5q6bm2WPLSEsB90EAfpX8uPgb/AIKe ftSeFdRgj8W3Onaxpy3MJnmmskFybfd+9AMBj+fbnBIPNfqt4Z/4KXfsqeI4gsviC40yRn27dVtJ 4Sc9yQpUDPGd34UOhGorxZrTrtO8kfonqN/5fzE7SRxgBsj9a8u1m++1OULBlzgea2M/kBXCaX8Z /BvjiyF/4M1W01aKVA0TWcySDDdDgNu/CqV3earIGym3dztYgYz9Sa9PCYJp3M6+LjJl/Uri4UKY 1tmweUMn5dDVBNQv48u8FugxkhJD09wKx3ukYeXcHHPqNo/Koje2bZMToT0OD/jmvXjSVrWPObbk 9Tq7PWGlVmmh6dskke+a1o9UtWAYQ7yeECMGI/z9K8tNyyOB5zquCGKZHX8RW8t/HAMw3M4C9nP3 vfoa4MfTkl7p9Zw/Bc65+h6TDqLBwyx3AzgD5QOnXnrV5tfllQxCWVAc4UgkfjjNed2etXT5aTEi njuOfXOammuLYtlVbPOck89z3718LiKSlPX9D+icrxDo4Vctmvn/AJnSHULtpj5tygjzwHQg/wCJ 9KwdR1iaKYvGFcjqQRgfhXKX+sQJkAKGVSSzqxx+NcBd62LpmMEoJx82BnH4HNe3l2DfMmfmXFWY xd+Y7a714PIZJYFLY2lmUHn261ybXVlPes7xM5IJZEAZcDrwcVyi3d2Rujw4zy2wjjp2rRsg8pEs u1e+4ZB9R0r62FPlR+N4hucrtaHape2UqqmnW6buN7yqV49BtJ/lWZeajdxK6MluSPu5ba1Zx/s2 RgSZEbp98hT2OB2rGubPTIULwDzG+8S0gGD7gnJrCaim0c9mtB813fPH5oWHGO0vzce2c/Wsh7m8 fPmkcjOQd35moDLbQP5ufqvv9cGs03iT5AjXaSPmYnPPTCgj3rzpnbhaqNa1MrybHZi3oW4/LtXS W03ksplPbBYcVxCXARg0e3OeVK5qOS9+bzl2r2yxLD68cV5WIjfqenTbvpqejXF2FdlO1lKnG1hj 9axVl/ekIM885dSP/r1yK6gZg0btGydQVyMmpYbmXcFtgp9ME5H51zxw7jHc7KVV31PWNPlsYbTE twBuA+6ATn0IrodPlimXDusm0AoeVb9K8WkuTBF9qnLtjOQkmMc+mBWhZ6vsjBmjmKvyN8hHv2rz amGbbd9z6vA4xK11se6peQQgtIzMeNo8wnH4HtVeXV7X7O3mKyeoD5B+vFeb6U8jSGS2WNQedrzD HP1xWtdOzYiuAiqBgkfMfw5rClhop8rOnF4hyjdDb/ULSRd+xd2CN2Rn+VcPeahbDAKTsMdPMwP0 qbUpIzIVi2FTkb5F25xXFXsmG2jyjzzgZ5/pX0ODo8tmj4fHTuySeeCdv+eYGRjeTnHaqF8rPGDG 6+gBGetUnmjY7QIw2OpHHX3zWTdaoUPlyuh2sAVxtA756V9JRu7Hg1K+jVjcVjbggqCc8kniqkk9 vgyMQB14HT+vFc7czmdN0TgAHtz+IrIluBGdpaVjwSMjjP4e1d/sulzHnSvc62fVrP7q7c8cjOSP pWZNqWSCqbsdyTXPNq0IX7kpPXBOKrNqkRGJS3sDg/nXPLD9BzqrobL3sMmVk+Q45C81WE6BvMik k6jOBnj8aoDUI3jDQnIPGQR/WoBOrcBm7kMe/fpioWHRpzux1EV2SBuJ49j+vNbMOoAIWRCpOBwT j+lcH5txtLeY2OSB15qdL9YF2ncWxxjpin7JCVXlTR2ct8Hc+ZkAHrnFVF1AEnO7A/H+ZrkX1YMu drD/AD1xVZ72aVi6scYzwRT+rGtOV3sd20yyr918Hnp/hSxyscSo7c9AQeDXHW1zPG27zHJ78j8R XRw6tbrFtkkbPbcAfzxXPVp9johPXc0ZNUCqFlAJOMNtJOR7VUl1adQF2HCsOPeqMp+1HIYgdcqA Dj/P+RWfKsEa7SS2O5JziuWVNdj2aE/M3v7RjKhp4x6jH69OtZM5huZm8v5U55K+vPr1rOku7MR9 +/cjHtWX9tjLEYfA64Jz6VnSpNO6KqVk1ZM6uB4Igf3ytgY5Urir2LR2ykmD1Pltzn6VwdvNA7dJ BzjJbPX0962zPAyjZuyBgHjnHrxWjjZnnz1erOsiLg/xHJ/i7Vmag9pKcbiW78ZOKy/teF4VevBJ Of0xQ89qo8wuIxgk45/Wp8zlmn2Mm+t7UuCM4BxwcZ/CseYWEBzGzD6jnJ9fWrl7/ZhJma4Zsn+H pXOXTo7/ALrkY4YZzitb3WrNYprU1rZ3kZZflPYFQAR2rrdPk2ysyHgHHzKDXEWvlWw3MxBzjK/T vmuvsWRowPP5GMblwefUkGvHxcrq56FJu53tldxbN88sA/4Af1war32pWk8fDx8dOoNZFtb3CDMo RlPPykc/h1okAXK+VMCehCZGPyrxoxSbaZ3Sk1Ezpp9jMFfAPXuMfSuem1S2DFGYEc5IB7D6Guhl tY1QtOCM8DIHFcVdCMttwwC5/hOeP/rV1UoxnszjmmramdJfRSybIZARnjcv/wBaq7Xkwc7pERc5 zsHWomuI0bbskTgYJAxk/Ss65lhlJAPzHnPXHFdLir7GUZ9TpbG9mgk3xr5g7rg/nxXc6RLJIFZo 4zjkK6Kf5jNeX6eTCu9ZXXk8DIHH1BrpoNQmZVKTOpHsD39q8jH0VK9j2svqcq1Z7PEN0I2JEm0c qFwPzxVqK10yVfMIt2bGMMRk1wOh6tdY2TSgjpgoTjP1zXRNdaSw/wBJ6nGCse3ivgsZhJxly3+4 +zw+KTipW+8j1c2cbFYlC8fwnI4+tcPqa29w2xRPwAQcZ5/+vXTXkVjOPNikmwTwo/z/AE/GuQ1G aysyY18zzO2WOPXkGu/AQatrqcWOnzdjBQ/ZHERLNk5PQfoateZbOdyq5IOWXbkZHOcisUebfSkI u4g5zgD8OTV23iubfDnIzz8ucdPxr6yjFaNvU+clJ3slodzpb6RdlULOD3WVWAGPzx9a7azliUF4 SWI4wNpHPpuFef6bexrOI5ioIXB+UqPXr713Fpd2dv8AK+xs9Nsg9O2RWNd9Ei4ysvQ7KCeaO24J hABJzGD1PPQ1XlnsJkIa5tg38RdGz/XFPi1q3WMQMjvuOFYBGH5jn9KsxxWcy/vbfGejhAPzx2rz lortG9zlbq+soso80RJ5yiNz+Nc1fXVvcYkiKpjjvz+dbmtWMcB2W6gDGcAZxj8utcBqU89lGzbo 3yOhQHGfqa7aUIytys5akrbmXfXsiNiN3yc5IBx+PtXM6hMCpdX+Yc5Pb86abtnmLrOiN1I24BPu M1lXWoRCQpIUfPdRx/n2r14UmmkkeXVqN6mPqN3cYzknI+8R+fFcJe3kkkvmTZY+j8Y9O1dVd30Z O0RtheMjgCuZu40uN2D856Dt7Zya+hwNo3TR5uId03fVGJdXqKoRhjjPyjrWUt7DGcqWJBGcjt7H irkkTK+yUEnuVx1qCWO2OOCpXuR6dM17dJKx48uaSbHvqcEwCkNx69jUBuoSM/MT7+meaoyhQS67 f5D/AOtULyMedoIBwNpzXZCEUrdzlnKXXcvSXioSUB+bpj+fNQpfxE9ScDH0/GqNwYyBgEHOOnpU GExuYgg4+99a6YpBKd7F+W6UKSd4yeoPH4imW95AQQTJgt6ZpsTRsCrMqj3H86hKOPljcEDPbHvj pWsOxyOMlLmRfeVd5CZ9Dnimou5dzYBz1Aqq0rqm1twPTnGCPrVdLyYY8sfKevIyR3p+Roo+9c0N 5jG1F465x2qv5vm8AheMnPXH51JHcyHqcZ4HT609AxPz4IPUjvzmqHBvYEKFcBucDOMiqLsd2CV+ 9wepqSUc5QbTnj0qhcJLGQ+R6j/Jp3s9DKu29i3LcKkZBAz/ALPXHaoYLtWbGzJz+lRRXUrAKwTp 374o+0EggquARjbWuyaZhZtpxNEqGcFlyM9Bx/KpfJg/uN+Zqkt4ifNtPAB5/wD10/8AtZP7p/Ss pO50xhFbs//U/ija7WMBpsepCYNarSWkFgt+tzB5pH/Hqd5cD67dv/j1Z0GmuGKTD8mzg/WmDTlS UuxByMYPP5V6cZpLYtxdk7kv9olz94+uSDj15zj9ae148ahict1bBHGfxqpJabV3MSR02nrioRZQ KMwZDHnHYVGj1FHqacd5IillRGB53AklfyxzTI7ueRmLDHPzA46VU8ps+UA23Gcg46/SlWH5Dt5+ hwcelNtdDSK10LxuztLKOhxyMAU5bwb/AC8d8ZxwMVnlJZowOR2GODTntZBJnnA5BPH50Ihxdrmm txCuS4Rh2A3CoJZIQRgqmcYGay3t3wHDg55IORmnpZomJJzuIbJABxSktLDcb2RfE209VwevOfpS 5IzwD069DVYwxuARu56Yz+HU010Zux44GeM/rSdhpNvUlkZVUsxK4475+lIzwtglTnr0xgCiCKTL JOCV9m6e3Q1cQ6Vko6EAHG45NOMF3JtbcpAhnyzYwcjJP6VBKY96mM8FuCflGfTPpXdNpuiR22zS p3u53A2xxW54J7bi3X6Cun0T4VfELUVkuE8L6xfR4KIYoJECt6nCNn6U3BxZfLzapHkLSszqFVcg 42rzzTNkQkJBBI6ehrvb/wAGa3o94LLxFCdIkYgGK9V0dVP8WMZwK+mPB3wK+El5oDa1N4tsNRvY osppVrbGZppMfdCvJCRj1JxW1LDylqjJtR+JnxhDbSSqdgUj1IP6VproGrkpG1uyiTHlsB97PTH1 r6s1C88MeHrKOHStHWG58zP264t4cHAPHlb2XH50vhT4Oa18W7/+0P7ZttMvQhaCOK0jiRlHLNlX VBge3PSuhYO2+o3UPnq6+HniWytS0kVuN+DhZA7jHbAHFZkHhLxDcWxuWtWEats85kO0H3IFfZut fs2fEHw9pU2tXfjKzkt4wFdktyxw3AXAz8x5wACa+a9a+Hk63ri0uNTu8uPMne1MAb3VS5J/ECon hV/Kx866I5vR/hT4116RpLCyl+XBVmjcKwzgYO3FTaz8KfG2nj/S7fDDkqoIP15Az+FezeHb3VfD Glf2dY+JvE9s54NrHbkqn0LSHH4CtnVtS8f+I7BdJuvFviiK3aXc73cUjLx0J8k5NXLBrlUrFupC /Ly79df8j5GvvDerabCZr+CWNSwCu0bKufqQP51kRW7nBXyhz0Y4NfWmu/CF5Ld9S1Dxsl8sa7tt 9a34OTjIBkUgH8a5rwt8Kfh7qt+INf8AE5sYmf8A1sdhLMSO+AG3fpXG6b7Gns2fP8GmajdSrDaB JJH4CxkEk/41pXPgXxqJvn02+zkAlIZGXPocA/zr6OuvhZ4O8Nas02j6jq10kZD2199l+xqCp4cm VSOPSvVLb4gfGe00dxb+NJHikBj22+oWiypGPvbhsDc8dDRGMdX1L+rSfxI+D73wt4i0x/8ATrO5 t2ABBnhdc+/zAVlBp0/duwz39Qa+y/GHw+8NX1o2u6r8RYL6WWMStZ3M9xcXG487ThWXj6gV51pe rfCvRLHy5dMvdRmA2vLNIscJP0UB8f8AAqyjFd7ClRSlZf5nzo5m3BY8475BwKe1nIzBXc4I5K9P wyBXtWueJ/Dt48cuk6BZ2gJyi+dIwIB/iBOSPxrktU1KXWJ9729lbHtHaRCNePxNRKa2RMaN+pwk elytgq/Xjmrf9nbVO+TrnpkCuu0y20l5US/SYJ0llVgcD1C4r1Sx8E/De9sBdW2syC6LEraPC24q PQ8qT7ZFRd6GsKPNs0fOr2MKkAPj3pgtY8Hl/qor1268K+H47jyG1Hy3wxxPGV9eM9M1y1/pstnD 8zr5TNhWBBJHsOtPldrsJ0JQdmjgvsrrwAD6Ekf5zQIC6ZZRjnBA6V11nYwXkwtUmjTOSrynagPo T2qveWEUUrR70LD+KFty/nUtoyUElscn9iZzsIxjp0x/WpktDB8yYJPVW5rW2W6sCc9Mdc/jU80U EbKisGGASy1DmkXGm7anNPBJJIZWwMjB28CmmwjGRwuRyTzXR7IVc9MHoD/WjzIFYEqByeQOv4US rDVK61OVOlB0+UYGeuOKa2hED5sEHoa6tpxIvH5dqYJS77cYx+XHep9sxqktjmItHjUgbAQOc1ON MXO3YpJzyK3CWbOAG49e1NBk2ZVAFB6/zodQiMLe6ZA0qFcOF59hzWjaw2kO/wAyBJCykDfkbTnO Rgj9ac3nBCOcd81GvGWH51k6hoqaQv2W23EKqoewXt+dOEUceWYEnPrSKecDvwDTDIR7ccEGqc7o fJZkwihKl8knmgR2qqHYe20dKi3TDhT1GSM9eacMBd/Hce9JTdtxKOtrEhGFztK7uxHH5VF8sZwe D26UkmeG4II49qrTT2dvhppolI68ii9w23L/AO742HGM9Pao2MT5+UEEdxnp65rnZfEum26/uyZC MnjjP51zt143Ug/Z41HHHOTn+VCpydypTinc9N0m7utEulvtDnuLGZDuSayleBw3qDGQc17p4a/b A+PXgO4iltfFl1dwQ/L9k1hvtsbD0PmHcOvXcDXwvd+J9QuXwHYKR90cDP8An3rHmuLmU75HJJP6 1tSqSjqptGU7NbXP2e8I/wDBUXT5JUsfiX4eckEB9Q0ab5T6nyJc/o9fpb8Ifix4E+MPgyHx14Pj uRYzyyQr9sjEMoaFtrZUMw69Dmv5K1Bz1+hr+jD9g2K7i/Zg0HbG7Bpbt8qpI5mbrivoMsxtSrJ0 5PoTRpx5r2PvmG8tnUrbRvgZycDHPbk0G4WM7ZOAeRvA6/SuMjvLmLERCrg5IY4PvmthZVK+Y3AI J/8A1Zrpx0bbH2GQza1S1Ogi1OEKF2ljuweMY4+XB/8A11LJfoqb5N6cZG45P14rmXv5UAAjDAqB sXkMPUk1lXmqXci7BGYwDjKKOuOlfMVMLNyumfpNDNkoW5Ui1q2p6WQSzsRjHyR859zzXFC/iVyY UZcn/WFR+XrQ6u0jNKjynGWKgZPp3qSW6sSoV1I9VHBGfoTXs4ZKGyPis3nKsnOT1MmSTUZFVhMo 5JO47CB7DPNSR6ssX7uRmZiQdyyHoPxqreW2nSt5bxOSeO47VmyW9tCwIhZVHH4+oz0r141Lo/PM TRcGzoZNagjiAdeTnMrv0/Cqp1DTJ2aRwZOAxCkYJx64rkpnjWYFjtPJHy56VmXOoLExMO6XjBwA MH29ay5W27HBJ6e8dZLcWDNuhifdt6dBx1x7Vl3F1BCuWUJz8u31/DNctLqcSkC4Wbnnlv04qddY EwCKuUGM4cEn8s1w16UlpY3oSNWTVJsbxjnON3JJqq16ZIthcoc5+U7cfzqBhaElwuG6kElv0rIl FizcQtkYGea5OTU7Yy3Ojt5pQCivuwc5ZgBjPXI71q2zSxsZGlRV64Bz/KuMdVxtUBVHG3GTj14q KM20j/KGTjqvTj0rmqQVtz0qE2j0NNQblHZX5G0xjH6CtVdRhAAuIBJn5iHU5/n1ry1Wtwcs0jZ7 Zx09wK6Wz+XA8vzBnOCxP+TXDOjFPc9fD1Zct7Hq1nrOmWyFQkcSqM/ICOevetiTXrJrf92u4sM7 8ZwPSvLzdW3lhNgjx3Llc/h7VUju4UJZWzjp84IxXN7CLbbOutiZWskdrdNEwMjFHJB25XoT9SK5 Ce4iAxJ5aAHoo6n0rPufEMMaMSJCcHL7hz+dcxcapaSgo5Az3LA4/LNezg6VlY+crVU2O1PVYklJ AJ/hOP5965ubWoM7kwT6lc5x61Wka0jmZpGYgnIAIP8AnNZF/NasAF3D1yv+FfR0KaSS3PBrVHqy 7NqrSExxmEZ/hGRj8BUHmpICzkc9xmsJb6xd8DJPGcHbVh7q3/5Zfd/2ue/rXbNW3Rkmpatl7z7K E4lUkjPT5qhlvLRgPJ29eeDx9TWY90pcxqwJHU54H0qGSdRtctkA8jk5/lWUoK+hDu72NWK4iJEY VDnuPf1q353lYDevG3npXMR6ijS528AdB37d6vxzJdrhs4HfOMVlJNPU1o1NGkjXj1CHGN4U5zgn FRyT5BJfPqc9qrGNAC0jLwPYYz0pqRWwIZiucfXFJprRFVGpNJoQ3sIOXZlHPRetPt722VsRsxGc ncD1/GmXjWyqSVDNjr2965wiCV+Ys56sHKitnG6K9o47HbR3lpysgcZ/iC//AF6nVRIjNE3uRnmu U8uJAjKu0A44bnirsF9GgG5uT23Zya5p0rK6NqVT3tjolupoAflc49+lMfUp0O4pvGcHb+NZxvN6 lo2jGOoJpxmEkZVpQPTY1ctWm3oezTkk7ItHUYwC6xEEdVY4qv8A2oYlJkg3Y78Hn6VCnlp8wLHB zub5sflVO4voWHls6qc/NmM//WpKC3E6vVMvf2vF/HHtz9P6Vp2+sQBCCq9MfL6+nPf8a5VGtX+4 6Nnj5cgdaDfGBscDnjkc/pV+yTOZyd73N2XVYgxaVWA6jHPP581mza2sv7owkDoMjiqj6shjIx1H O4Z//VWPdalYlB8wUsedoz/hVKnvoc9WbfUdd3pQZAJA6BRlevsarreMrZQOBwBnjFVlngkThsdS cjr9abIfMi2gqAO+R09fWlKndWLo3Okt9TQShVbc3HDL+tbK31xGRIoD98KxT8OvavOIpbiCfbGq kdM7uDXTQahchv3sY6clcfhXk4jDpSPQo1LqzZ6HZanhQ1wGU4OBu9OnatD+10lUtDK55xg5I/r+ NefjUzs8nyiwPAx15/GnMsL4MauW44AI+vGTmvJnh023LQ6aNVp23Oo1C4eTG1mJ9PTt3rl9QOoq oaSRgD6MM/iKWeRoh9xgSOp4/IVzt/eBlKlGypzgf5/SilCzSRVSyTEmzI22SYlick/pjiqs98tu cRpuAHDAbuaqSXySD5oyAByRhTz7ZqFZmRisOSDn5ep967HHTVHLGWuhs22oxmMZBznOzBHfrWvb arC5VRE6Hrljx+dczHLICjshx655H512FiYBGd8fUZbPYivHxiUU3Y9TCKTehvWF1/y2hI6YHLf0 rSmu3BDOrn12nOa56BLctgK3XAKkc4rXeIvEVtTIT027jyK+XxEIuVz36Epct0Ty6nc2gRwh68M3 U5+lc3e3hu5fMlUZbjnj6EVWv4r7BaWKRwOCm7nHTjNcdeXLs+IvtEWDjk5wR9DXVhML1RFbEO1m dMjrEvyDYTzz0x+Namn5ngBdg2OfvbR+AzXDJfyxqBPIz8cl24P4Y/Wp7TUWE+w7tvUDIPOcetex Ck7M8WpV5j1S2UsSqoxAzk5yPXrWzDp1tKoD5Vs7gGTp+NedQak5QruUAjqRjpxjOK0rW2ebDszF eMKGH5CocLLc19pdpWO6SKW3bakQIGMMr5BHXp1q+mq3UB2xh0wcdGwPpXLwIysCRJng8Mcn9f6V PeWj3CeYjze4ZtvA9T61g7X1ZrqouxdvdY1CSTywJnHTc7YHrx0ritZuLiYHzo5Ezzu5x0q3caZc xjzI3kB7bMnOPfpXM6kNYCg+fIuckh1yK7aUY33Rx1ZNx1Vzlb525KkZONwGeg/CsJ5JgDG0bj0J 9a0Lz+1M+W12g5I2rHz65rm5bW8RcfaXPOQwAGffGa9mhbe6PJqXUtERTJfSMSoODg7eRj2rJubi 5iDRlQrA7Sw6/WrIF7GrN9p3jsehB9hWLcR35fbJKDzkZwPyFepRir6s5K0nbYoSTXPmdSSMeh/z iq7TMzFcg8cD3705xKGOcc9T61jySSq3YAHbkEZNe1Sjc8ipKzuWZ5XkUNgdf89aY1zHFGFdSMen 9KotcOx25HryaUyzKvygYxnHXOexrqSexMnpzEwuFcABjjnGR+hNVjK6cEYGOSAD/Wrnnrt6rnqe 2PeqZmUnlsduBW0EYN2W5SeYjgfL0HC4J71CLxw3yc5446DFXJSARiQMGHp6VDIzrwu0g98da6FL qjlqJr3exJ/aSsNj7lB4AJyfrTpPIlAIfoO4x/KseR5mcBo1CjocUzc6HICn86rl03FTqPYvPJGC 0e7v2PFReeoAXccAjJBP61XWbeSGiXj09qHl8sY8vAPOTV3SWhnKT1bLwuJOT5rEccelSPPMwyWL KBtGenNUFaDBLKQepwP0pW2SqNp7ZwRz7U7bMuM1JbkDyOr8lgO5HSrUd1EB8xOOh9fx6VnmMtJm M8GnmVxHhsHvg1Ts7EJ8rNNpo2+aN8gdOxqPzpPV/wA6zo2Z8ghSAeMe/pU236/l/wDWqOZLQyvJ 6n//1f4twcMACT/T604RZ+d8jHPPNPEb/dXAz05qd0XGI4iWHBdT1x0yMjpXbdK5qrvQrmFSgkbJ y3HHNRrFEDwDux2FSm5cKFEYPPA96WMzPwcDnGM9PrQpXWpUYtkfkxEfKDj6H/8AVUwtoxlcr7VY aOcD96R6kc04pucZ64znrz7+lJyG3fQz4rMFmJbkdj3FTrZsz7MZ47Dnj6VbGBJy31J44oeKQr+5 lCjPTcR/Sjm8xqI1dLEjEkALjO5gcfT61OmkXUjEQwO6nhW2Hr/Wo44m3HbJvB+bG7jPrUrrc7Qm 529FDH8cCmqiGoX2Kk+k3drxdQsmem8Y/pxVldFS4tvtccsGcfMkjBAMD1NVJY22GSRXznuc1WMs aLlQOOoI55/ShVI7oTi0IYoYjsLKQf7jErmocFWHkoMfTOa1BG8+LiKNiFAVmUcA47+lJ+8xiKMg njBX+vNJy6oSV9Gdt8O/G8PgLUF12wtLe8vEbdFHfRF4kI/iGGXBHb1r3rWv2zPijrNi1nPBZ2ox tV9MD2rKP95WJP0zXymsN4oLkAEnpj/61TrZNJB5u+RsdQFIUH0ya6IYmolyxehM6EZW5kO8QeJN U8TX76hrU9xdSsfle4laVgPTLEkgVpeFPEmp+HL/AM60u7izMy7GW1RPnH91t2AQe+abpGu2ekox extLuTduzeRKQAOoBJzg/hXYL8TNALMtz4b0eINgf6HCq4GOxkDn9TWUZqM731No0ly8t7Iu3fjR 7y+Y3E6SM3zlIUXaT9AMD8K0vDHijwz/AG5G2pWK3aK370XDtsweDuCDjH6+9eZy6noV9dNcpbXN pDjhYXiJJ+pA/lWXa6/caXcPdaQZIgfly7KSV9xjFd311X2Ob2NpJ8x98nx3oekKtr4F1yLTUkUe aLSBJuB3xhAo+hzmvJdV+L3xAupZbmw8T2s0SyNGrXkUUDnH90EscV88Dx1qkkv2i7WO5yu0xzor Jz/sgLzWbq3i241Zfs5t7KGMNu8u3gWIZA6/L1JrOeN1VnZeRvJJJrl18/6R7hpfxX1vT5TqGs39 pcEsRut7aGX89wX9TVO8+P17DJ/xL7baQCu+OOOAc85xHnP4mvnMXaMSi4AxnC5ApVmVkAYEn0B9 K5q2Ou/dHSg49T2C++MWsXji5mtbSebzPMU3NpDKVP1bOR9a9F8H/tAeI9NjeIaf4cPy5826tfId P92SHbz2AGK+XBeLG5WRS4xjC8frTvtMEgKBXjGMklzjPuBUwxUuoot7pn6BWv7Ufiy1hVbqx0Ka 3aPaYvt0jgA+gkZzz3BrzXxd8UvEnj6xuLDw54f0eKOYFJJLeMTyrnrtkAGPyr5n0HU5NOkea3s9 OuycD/TF34x/dUsK+gfCXxZ8ZRabLa6VaaFEwPRMQMnGMgA4/HrSlXT6G0IyatzM8R1c6hpbmw1u G0gmRATEUaKUjrkgmuUnn0xzui3+YR8wQhkJ7cnkcV02p6Jr93dyahqLRPLLIXkladG5Y85OTVKf w6bb5pb/AE7sCqPn9cVM6jlpYmNK19Dl1nMfyxIQcdv/ANVILtjhT1B7/wBa1wYLefzUS1uO53N8 pA/Wl1LWbS9UGK0s4dvygQo3OPUkkVhJWZUY62MRJZpGIX+tWguoriaIFQP4wehpp1BAC6xruYcn H8gOKgeVfKyHGTx5YBzz+lTKSeorLVEv2i64EnzN/eJ/xqGW6klPznJDd+aoyzozfuw2O54zxTS6 ldqkcZz/APrrNyZfLuy00jA4VwfoP/1U4P13MPp9f8+tUxs2lCwz196TzWxtjHHqOaTbuJK71LWF U/e79jSOFDllGOepNIEdvmTkAd8/lUssTiISLsI745OfTFLmdy+Uhc7iXYgt/ePT8ai2icckBieG J4NPmjZGC9VPPP8AKmBPtDfKFGAAuP8AAUMlvUYx2uIxyB1K1ZghgeRTNOkQJ5yCxA9cYNQPEYmK s4BHXnjP4ZqDzLaTC7SCvUsc/j0p9diG+zLt9HBbyFbSbz067xGyAnPTBwapozHgZYYwQRjFLcxx Kg8mbeeOMEYqJJZYwTAeGTkjg5HeqjK77Fyl1WpIxbIUnIHGG6Y/Oo5SSu3I4446UqPNKBvbd37c E0jrtO3gk8Dv0+lS47k32diFASNpI4/nUyjJ3BXz1JI6/jUYcgjymB65GMEU4tleW/iJ/wD11PL3 LTW47q2c8EZAFK0u75mxgDGQuP0FNRHC7wmeeM/1pigH5pB06gdDQtCJNsgure2vYPIzIFI6Z2n9 K5y88Koi/upZA2MiN/mA/HqK664MMsiuEwAM4HPP1poWIyMSCuR6E1UZ2e5cu55VeeE72U+ZEFBz zzlTjpjuK5i90y705tt0pAPAYcqfxr3eR1RwkSM4PXjGKytY0ddVhNpNlDkMGUg1pKdznlT1ujxl beQJ56DcoPLDsfpUBY7iR0611Fxol7pZdpUkkhXo8ZAI+orNhsFuh5kJ8xRyYw3z/Tn3q+RP4WJJ v3bGQpCtnr+Ff0h/sNGSH9mTw6D5/MM7qqj5fmnfvX83rja5XBHJ+Vuor+jb9j6aeH9m7wupOFFg 7D/gUrn6d69fJIP2r16f5BCdtT6pe+SN/nLc8DefT2FTi/eJsxqWIHBBwPp3rip78s2/DHI/iGB/ OtKyv5GBKGPv97BPP419FVhHuevl2Kle3L+J1q6hcuAZY1APGdxHHvT2vTA3ml4x6qTkCuPkv5mf aC4A4woAGTz2BqmL+XcwWPOfvbhkH15/+tXh4hU9kj73BU6kkpLQ6uTXsl/LaJs8HA49uaxLjUJz xGYFGDjA+Y1ktf3IiJWPj0AAHB6cc1z93fXrIXZRt6YHr9etKg6adkjlzb2sVaT28jQvL68hO9Gz kgsduDWHeaxLctjaqkDkg45+nrWPJqN0AI1AwTjk8+uTz61SfUFEpMoA59AeTXsK3Y/OsXFvW5fu BuIeRZmJOcAA9e5NYV03mTAqjHrwTjFXDqG6Mh3baR1zgH8BmsqW5UrkTKueO5z7U5RuePNvqUJn ZZzhAF6f3jn3zU6zvGxkBkVSuBsUD8cjpVRp0Qtu+f8ADjH1rDGpYYgZYE4wSF598ZrlqK5rSV9U dZbzyZJ81gx67+taSXW9cFw5A7jkAV539uV3PyhPopNWo7lVy6O3PHGBiuKrTle530pXR28k0GCA 7Z4OF6/rWXLdyQISpPH0/n7VgxX0DHYz8nrlh60+a6toVKFi5wcheev865pU3ex3UKrR01nqbuBN Jk84DJgn9a3YtUMSbyZZADgdBx15xXkU95GThBIoHOP8MYphvUhxOZSvt8x7+xrnqULs9WFVI9sO qwSp/wAtF6nGOD+gqr/aEYOFjO7nHI/ya81i8RLAp3M7AcgqST79c1bj1L7Wokhdmb0IO7/CsKVH fU0xFRJJnU32pKhAMLbjls4/xrGfVFVQXhVCx+9gZ6ViXt3OVxMCvJz24rnLy7YrtDEY44HPPpXp 0aL01PDxctWkdVNqdpCu9pFJweMjJ9uKwpdUFy+cKOOMk1zQE5AfYQM8lz2p0zhxnb064wP6169G NtE7nlybdro0PtCpgYj4PfI+n+TUBbzMtlWz/COn4ViLcLC7DAPY8Hp9eaYbp1kChVI9Qeh969C7 tZmGiehsAQKhaY8BgMZwKge8hh3Ac1lefE52lADnn0/Whbkq5kZM8HHI6Gpd1oyou1uXY011GHdt 5AznOODkUR3xMwdHOA2OB6VSjlSY/MAo/i5/WrKrbBMquDjOR6Csou97lyjfS5rf2hIg/e/xc9Oa ki1OORcswPOeg4/WsiT7MyZkfB6ngn8agMcYOxCmMAcfr70/NlczOlkmjcZyvqQBj8+tY80sZbCM uf7vNNSSBRtZgfTj/wCvUZkswcPKuAPl7fhWinbUUovuXUdXwkshxj8PwqSVT0ikU9dpxnk1g3Vq kxDws7AcDDYFUfLvoSQxKYHGTn6fhQ+VrmKg7HSvLIMKzDpg8EHj8anid9ow2fYDFc/DiT5vnfry Bz9auxNKpzGX9OeB+Vcjld2O2lG2rNYXIQ7QfmJ45P8AjVjeHU73ccdS2RxWeLtsbmUKTzu4P55q sWfJ2v8Ae7DHSobfVHXVtujVMsXlHzZM5A/h71C8qAdW9Pu4FVRPtRfMYvwMEU2aWNkzHwCP4m/q CKJJ7HO6tkogWjL7g2eMYKgfrimO8at8w3dMjA7f/WrN+2AHBKlh6MT1/Ska5R3+9kdCQcU+hjOf SxbnvbFRxt54IP0qtJcxSEBFUN6Z/Ks6W7t2P7sFircn8efrWdJOx+9lc5wcDiocB+262NXzJkmB K7wvQjofxGavRalj5djg56qTjFc4k8jYTcM57jJ/z/nmrS3JUElFPbcARXJVgpbo3p1Hs9DsINZa DhVcd9xIrai16ErtnkAB9wD/AJ/GuBgvJGBIPy/hkcdM1LNeHADAkD0FeVVw0W7M6adZrW51tzda fd/cct6c5B/KuYkYxntgf3uc1XS5ibkIQeSCKrzSmbCfMQvb07881EIcqNauq3G3R8wcA8YPGGBq vDdTRME557EVBcncmHlAA4AA/wAKzxCxO9ZCxHsf1rRpNbmPNK2h0n2wE8M6N3APHp0zWzaancBA GbcvBG48/wBK4o3Drw8Qft8pwT7+tXo5RKcMjqf4Tv6f/XrzcVQTWx24eu4s76C63nGcN3b6/j0r aiv5IwViLkH0br9PevNS86JgO5XGecZPrUls11kgMCN2Oc8c14tXBrds9unirJWR3d1qN0PmRjkn Gxvp+lc1NeXs5Y3ZPHQgDH9KjSa5wwcrjPUDr/X1rJn1BTujAdlPBwKdKmr7FYiu7XZK7bMyyAMr Y6c/p1qBIohJ8p29eBjH4VB59phVDgc7vmDED8qGjMsgMMkTDOTtPJz9a9Sinax5laaa0N62huEA fc4XGfm6H8+Oa6WzICDLODg8so/mK48PdQR5RuCcEkZx71oQXNxKPkl3DoAAPlP+feqnDS5Lq2eh 1rXDI+7zV6YAJPQ+x/lTJdf1GFDGjLjHCqxBz61yDiZWxPIy8HI29wfrzTop7MtieRjgYHAB/Q1E cOt2J13bsbkusatJguJAFPO0hhj0zg1FLe6r5Rd3kC5I5III7dQayZbuzU+UkkwGOTnA/PBrCndE yolcjHKbwAR9D0q/YJpC9u1uS3r30khBeT5icEFcjn1xWRdCcwHfIAAeh5JNQyXU5GIUC+hZ+eMe /pWbd3t+QTM7Hj1XA/rXfCg9LHFVqq1+5kzXew4MRb1OQMEVkT3Ss2fmUjp1P4Gqs6PJKUlYnnJJ GBj65qnN8vygLnPBBwfxzmvZVNLY8l1nzN2FurvYhYbuvJxwfbvWS10gU52g56Gp7lF2EnIOcYBr nJboK+0YJHOTmvTw8VbQ4K9S7dzb81eGZOpwSP8A9dTtdRkHLKcjII5IzXPC5YsCHQ47L2oMoGVD ryf4QOa7IxT1Zyym1pY25pIZVwGAz3x6VRfcOAchuw9qobgv3jweM49qctyMAEg5PIx2q9dkROr1 aL6EDDOG9e/HFOIBbcuTkA7TUAmD/KhPA+YmhbqPIAVt2O/cVcU76ikrt8rLJYFPm6Z60wgnjnn8 KiaVWUBcDuahkkAG4EZzwc1qhxj1JyAqnGT154qss235nB9mxSyHoxPUcg8iofLXbtOMHoe4pkzl LYUzgcA5BOenf6UpnYYJKnn36VC0EPDISe5zUMmVHXIPaqv0M1eKuySS4aQEkADrxzVLHy5LccZB qVVxkoB149KQxsck4461pFdjPme3ckt7hVwG9eMHFaX2lf8Aa/P/AOtWWVyu0AZzx2xTPJl9R/31 /wDXrNxYQg0j/9b+LcTB1Bkj989c+lTmURS4jIfgENGCAPbkDJqmETaXbI59eKjjdGYOgLAcdcj8 cetbc+uh1RVlqX0nYMyBduTknqRVxLiKR8ySccYPBPXvwPzrHj3ifY25MgnHOKmkgEPePnpggg0p S1G7W0NYzROpZDuYfxZ/pVbzixILEHI46VnhiPkRlGOTwePzNSxSySAu5BwMDkA8d+cmndIlPqXz 5BAdc8D5smnCaMr85GCOgXHP41mSsoBVAcnp8350scjOnyPs/wDrdQe9JyWxrFaXLUcyjhW289x1 /Op55iDjOOnQg4/LNZIu/K5YqG6ZGc+n6VG01sN2w8nv/Wpc+iCOi0R0Cnao27pMnq3AH1zVSZ4m O4mPPYDn/wCtWCt55eN29vTvTvtEu3a4Ktnkk9B+FXe2tiJPqkbQutikDgEjjHX9al+3vGokjk2Z PAGT+XasIJLw5dSMgDJwabI827yjj3I4xz+tJVGkDlrodD/b10vWSQ9juGePrisyW+8xiztJjOTz 0qssiZ3eWWbGNpJHPtiq3nSSEw7DkcBR1z3z9KarytuNx5nqXc2rr5oZyQcZPQCoXWOWQCInGOM4 x+dVw9sXKyGOIgDg9TTFlDlmCjCHgH/IqXUVhNFhg2/awVccBuATj3pSYwvzc59OSPp61nmRmcZ/ h5Jxnn61NvmkjKxqxDd8D+fWh1NgUXqWB5jDJ3DvtA7D0qt5zBwyttGcAnrzRErMCrIenylmO4fS myo3C4TjhiRz9c0rq9xqPNsTMQjZyGJGeOmajE3G8HnuOcY9qrzYXjdx04GR9RUgSJVDhwvoD3z2 71GrY20WVnkHJwD6f5FCSOSS0oweiheaalsSR5ZLv1OCOBSK21W80Mueox/QVQrEhuHhcMzshU8F Rj9KfLOk7tPJKc9Bn0/EVntcQXM5EOEC8EHjPp1qd0byup46g/yo52tENRJjJG3EZ+XuTznFVTJH jHJBPHHUUxM42H5e/Jzk1PDFKn70HheVZeQD/SstN7l8re4+JgzZcheMc4GB79ars28EptYDr/8A WpqxSXKh2Izkk54HPr9aRkjjYqXQHuBzmruSnrqMaZYjtJBJz+dP81I9uwDJU7ic4H481EYYgm7k srYxxTi3mHD5Hu3+e1JsJK7F89vMJYDBPU1M0XmPttyNo4LHHH4niq4jRpQ/3hnDNwB+GaJo1ExV FKDPygnJ/OpVx2toSNG27YmS46hcHAHoaribZhdwJbgg9RTgZPMBzz069qRRAJOQGI4IxnFV5sJO +qHo7RKAJAefu84xjrQ0rNyNo4xgtz9aZKshl32ykr95gwxj16VJ5ecvhVJ5Kjv+dDeo3FkCzOPl QlSp781akXMXERDYznnBpIJxCGMiI4YbVPGR+eaglcyOG4APXJ5GPSktSLW0IkVE5mIHuCSB+tSy 2ZSNTFLEQRkkNg/rTXjjMJMr529FxyT/AFqJlgJAZwx7DOOvvxiheYN20sC7yCquMkY7kn9KnQSu QV25XqSFBH4f41TQIko44zyN35c1d+1WsSNhQGYcse9HyDUie4Xzi2evDMxAz+VLcOQwEecAdQcg D8qsx3Ki28pI49jEl+AzAd8E9Kq/aVd1VySu7gD09KTVy7W0GxTDbjoO+DinLvMfmhGVTzluMj2q SQ2yljGXQY9eaqPMWOzzD3G0nIxSb8gTsKu4E8kDHUHNOYSs3l56ZwTwTUCMdhIJznsO1PLFlPXI 6cUS1HytIcFZUGM++Dwce1BVpFZ87cc4PFQsxxu7g+vAprO20Bjg9qm1xcvYsr5zckjjg56fnTwn mHcrc4yCDxVFZcn52I74UD5qmS58ss2Rk9CRn+lU79ASRZmiAAUnIPpWHeaBpd27S7fLdf4oiQ2e 3TvWi1w5+ZnHJPGMc+tSJJxuY5/riqWgOPQ87l8OahHJsEDXKZz5h+Vxn1Oa/Sf4Oftg6J8Ofhvo nw/1PRL+RtNhNvJd280eCu4kEK2OeeRkV8Qm4aVdsefQY46+wqFSiSZbeWzzkV04bH1KMuaO4p0k 9D9KdQ/b08Eru2aRrcgHBOIeB9AxJz+FYtl/wUG+HSuyXeh62nOAYxGSR+lfnsIjLwwJ55/zzUci NErKEIOeG44rpecVnuwiuVXR+t3hL9uP4Gazbomo6hd6PO52/Z9QgcbfTLoGXB7dK7m2/aY+CmqT m107xVpkjhS4Ej+UPlPPMgUd/wAa/FaCWGJW+1IsufusTypHtVUKsjgjy2OOMqBmoeZyeskmevhs 5rQSt+p+6a/HD4ayhYU8Q6O5cYAS7hPv/eqt/wALK8L6gzR6TqNhcAHawiuY3PX/AGSa/C+e2sZp 1WVIyMYOEXI9RnHNRNp1tHK0kEIBGCDtw36VVLMFFfCdVfP6lW6nH8WfuoviC0uPmSOKRFOXAZfr zj+tXJNXWTadiRMMnjBx+dfhPZzTW5eC0luEVxh1WR1D+meea3E13X7Vg0OpagjYwxF1MPw++a7I 53Zq8Dwqz59T9o59QRmMqyh+x4AFVZLsodzlQoI4z3r8g7P4h/ELT4x9m1vUkXoq+ezdPY5q1/wt L4mJP5/9tXxOc4aQFT9VIxXY88pWtys8uWFm3e5+sN3qzKBFI6qpO0AHIyahju1aL90F5OTgfp71 +YB+OnxU3KY9ShGxcFHt4yDj1PH86661/aW8ewWcZuYdOuJAzEkB4z7ZGSPesFmtGXdGkMPNLU/Q KZp3Gx1O3nFRfYiF3eVuJ+7vbA49s18Iw/tZeLYIFWTRLeWQHDeVM2CO+NwrsfCX7V/hrWJxp3jC 1uNJnLECQtuix2yfvVr9dpy05jSMWnblPrkwyxriYKvyjoT/AD4qVGJiJV2PtyP1rhdG8Y+HPEdq bnQtRtrlP4vKbcw9yOoraS7ikwqyu3GMnv8A0q5KVuY7KMlfY6NprtUJOD0xkZ61OgkUA9/TBrlo 50TKBkzz8pPPX8a1bbUZlAO0YIxu6gevauGpfsehTlfQ3fOulQmMoD04xmmm4uF+eSRQAMgFgCCP 1zWbNqO2MMUPTggADjHOazft8TS73jfJ6Dt/OojBtXLqVNEkb8twGDbpUYnpg5P61yt+8iSEB+M9 Qf6cYon1OILsjQq3rx1Fc9c6g5Y72BJPJJ54rswsZ9TzsROKXmajNIMPG5YdDtbnFRh5pjsRioxn ls1hm4gUZYkeu386qyaisiZgD4z1r0qcmjzZuK0Z0DS7MhmJOeo74pzXDMq+UM84OfX6Vxi30iYE jHnuw6/lzVu0vmlbEj4G4bTjr/X8a7k72ucDqdEdCjFTljle4xx/+uqc8r+cDC2MeveofPROjnHb b9fWmyXEcj4JIwAME0+Z3uVKK5bXJxdsy4yAV9P6+4q3b312qguCwPX5fTvxWS08SnYG4XqoPH40 Ld22eCUI+bjkc1tbTYyU7S3NxtSKxKbguGJPyqmahXUSy+ZtI+9wyjJH51lNcoXYGTIGDjrTJdR2 N8xZgBzg1MpJK1jTmbe+howXUNy+9Vx068Yx7Zqw9wscm35MngE9axobxX/ebmUE7thx/npVo3LS R/u1yPVqblFSVwcm4monIyx2f7vBYdOlQyJDM3+vYcc5PYVkB7hsmNBwecn/AOv0pohvGxuwGB52 selRPl3NqU5NWsaJMqIu0k9s7+av294qYdWKkgYyxOfzrH3IozJkkdSfyoFxaLiREy3qTj0Fcsra 6WOqE3E6f7RcMwMjoVPA3Dkioo7uNTtfGOnynJ/CsEanuIVUCgcgZ4x61ZW7hKEsRkYz75+lY8je tzsVdOKuaI8h1wN4+gP5c1ZRBF8jyZ4yQwFZA1KJRhnjxnnnkVGNYty+2ORWbrtU56c0le+xNWUU 1K5fu41zw3bsOlUHgmQ5TbjH8Rwc/Soje3Tuf3nGcYIqvNetjbtyTyc8Yq3B20ORVFJu5aM2wYIT vkg1lzXDysY2AGOv07VUkvkfIKkN04GRVNnbdgNgkZGCOn86TiynVuXFxzhs88EdB7mraTMgxuJH XH41z5kuzKGI6ehzV1bm4VvlVlz02niuWtFm9KotGbcUxcDBcNngbetXBdCPaQHxkjr3rB/tB1Hz ufQnrUovLc5XeSen0+tedXU+xvCcG9Gak2oSKuQmcdBn+VVYtSdWPmJ3zmswz5IKFTxyc8+9NeWc pn5fTG2s21azRtJ62TL13fmYYbA9vQ1QN3Ijbstx/CP8KpSySnG4x4GCc8d/5VTYJINzYGepzz61 ooprQwhJuNzZW+duSrHJxyQK0ra4k2coT7A8fhXHNKI+FbvgnsPxq7Fc233JHCnjB3da461Ncuh0 UsR3OsiJbCKhz169fpVxpX2nPyngjHTH+elczDdQRrkyF16cGrC39ngBGIBPGSP515lalK+x61Or oaLXV0RujZs4xtPA706CaSNWeaQrnk55FZb3lof9Z5be4P8A9akW6gjA8uROT02/zxWVuljS95Xb NF5ZpW27lH908fr0qyL3MIhJJZecgYya59pbkuQoJXcc8Zq5AxVsGI/74BAx6V102mkrHJzbo2Uv ZMfujn5slcDp3/CtOKeAg71BPcA45rCjkjOVjXnuRnI96evmhyGdwP4Qc/4dfxqmlsTds6Uz2zfP KkoOMcMDkD8OKhmmssDaCCwHLe3bishTIUyJZAp4xzipJp5RECzkEYHJwD60+XUu9htxfwQHbKsT eoJxn079ayp4dLuhuijUHucn+pq0Zowufk3DnnB4BzxWbLqHz4XBwRuGMdPwrWGuiujCtFaXMK7i AmzEgGMjhj/+qqkqtAMsHAPQ59fWtW8k88eZmNASMLyT+grn7h8MdoD8dgwr06XY4KtoMq3KyTJn DY/Pj1rPlgmi+cH5c9hg1clljA2M5HtuP5YrPkuWkUKPu+w9K64RZyOUZfIo3C7juPbsRWWYg3Hy jNaxcINvHT09aoOVDYYZPY/Wu+lfY4nBPVme33sbhyelV5IJRkgg56DHerrKmCzAAEYz6VnzSxtg biv0Irsjqc9WCe43N0WxvGOOCP6053Yn5sen4/XFG5F+6xI+tN84t9wnHoPWt02c2mzLSTMDufHz A+9OE29FyoHbgdeapO64CkE4PbjNCNBtz8wz1Bpa9iotNtbF8AHliOePzqNosHrk9sVmSPIBkMQK Vbp2UIpBPYmtY3M2zaXfkHPt0H8qgdpDnBPp04qg1xK45HJ6bW9KiDYHzFuOB3oe5q6y2saAkLE7 iDgZNUpDubk55/zimLIFBJ5yOtOZoz82T6EVe2xg53jYljkZcjgg88HHPtUqSBlwx79zxWcXXGwA +hNRmTJwTx0pJsca1ktDTknQgcAnqfxqDzl/u/r/APXrPZMHd83fGOaiwf8Ab/z+FCizCpXV97H/ 1/4q7trYSLHA4Yc75ACM+3OKbgxKFjKFGxkoRk/hWPiELtc7sZIAHrVgXToF8gRoSNvXk05S6nYk 07suO4HG4qB2bjP61KJYiuEUqT90hu/v1rPitryQYQRscHJBJ6djU9ml7K42mJcZB6D+ZpK47Ehk kDGN3AydpAGc++f8KdIHQ7llRf7p4H5mo3tmiYR3AYuPu4I4HbkdaYEjIDujgZI3FRgfXFDQrJFl ruWOLaHA4+YxsSSPc1T+1GWP92Oh+63GV7nNRZtSQRudwcbQflI9a04gjQh90Ma56S4/OhS1HHcq xOMMmwKM8N3P0zmm/Pbt5jliDzwTnHfIFSC7ikYxLiQg4V1GM/TjFTeXI+WVSDjI8zAB/AmqTXUm TZXdojJviARG5GF/xzxUK3EaggtGWJwAxx9eKkkluhH5UrjHYKMfyqpA24iBkZgDkHaMfn1qt9Qd +hpiPzIxO+QO2319uRRFKjNtKOCOvI5/DFQ71fdHN8ozxnuP0py29mbhf3zxrnlipbbx1x3/ADrJ yRq9d0IzzhfMtyN3TJJz+dIZWjcszlcrkkdcn3qV4/LYmOZ3APyucDP4HNZ22Ldvuy2ScAE8H9MV cWZ3bdmSNcRRMLhiZTnbtC85+vUU+W+eWPzRHGoPDEngn0x3pn7mYYtwWAJGQfT/AD71VMG9lJWT Hthfw4zSsraArfaAGWKPMgwMnGeM/SrLsGhG5zgdQpwKgkW3hRVjDuxzuUggD1+Y8H8KnQLIB8gG R8vPfv61Fh1I6FcRu21/M+6cjn+p5xWijyBCsgjZcZBHX8zVeQugC+XkKTyeBj+tV0ZpDtkOO+CO BVK/UGjRuXup4lXKrGuOPv5H1pRbBLYttjLehIyB/u1BHNdAbFkwoPIAAH4dRUEzbQHjkbc3Yr19 sirUmKEUtizbytnyVY8nnbznnpj1qytxLbM0WSwJ43gE8Gs+N1Tm6LYbrtxx/n3pqnktGTg9N3Jr PYt66C3aszluNrdQR1/CoLQQRR5kwP8AZPUZq4LeadQEV2JGeF61E9iY8A7gG44PP5mtoU5vVRZk 5KOlxss7OMO3HTCjHH51Gki/6kFjg5AJPIqeazklwlurOg9Mkkj1OKpq0iK6OpC8FgDk1Ps2hqZK 20t8wwM5yOeO1M8yHzPmAyMHFElxDJhRAAQPvMTn60iyyIn7l13d8jOPxrOyRV29kTuyyHa02AOg OevbsaayxbwsfQ/fZv6Cqoidvn3Zbuc4xn3oaJ4SG3AnPAHOPalr3CNl0NUy2r222Hzd+fm3KFU/ Qg5qAlXZkchSoyMHk+xrMAnwzcsvAAH3RTrckSeeFyOehwfp0qrJuyKjrsWln88eXJyQcBVxx+OO aHdVcFGzGechRkfgaie5eZvmIHPTHIHpkVGiZDM7naD93r+Zo20RO9ySb5pBHCWx0+cAE/lxSyxr C6oCzMRkgdRTPMlRBG3K+rjp9M806eZDEF2DORh84wPwqXLW44rTzHSStJDsRGxnlm4PHvVfLHhA SRz83oagJafO5uhyxJ5/AY6mrM3lyRCObevydcH9TSkioruMCsf3kp5xwCO3r/hVV0DscA+gYHpU sTIEHLgDqxyQcdqdKynMiuiqOAmcZ/OqYN7sUyI4ESofXcOd2KHEaxBgTk8YI6e/pSJKy4MYwec8 7vz7U+R/P2tdEICOMDP48UkiHrZFYyXBAGSQOwGOv0oQAsATjPTBzipkW38xk3NsA3Bl4z9Qaa5Q qEQ5C4JKjn9DTci1vqhuzy5CIxjjkZzkfypiqWb585A4JPpU8b7ZsR/MvQuRgc+1SNHIj4XJAON6 D5fpk/1qG7DkiqrKMsxDHtuzn8gajV5C+0d+S2avMB5ZTC4z1GOtU/NXcGuPu+i8n8AMU4slu6sX I0hMeQTvJ4UjIH41XK5cgnn+frT3Hk7ZGQomTgMCDVUFZCSr9DkZH5ik0aNXLCp95wM+4prxFk3Y BxjgYzT1MMT/ALz5weq5xn8qWaeJC22MKuemd2PxNPWwpRdrFcI2f0p4dAuIywOOc+v0qJZM4ZV/ Xt9KsR5aTdgDHI2jpilNoPIiVnBDAHn04/8Ar1OrMSM568jrTmWZzv4AOSMEcVXUE4z35x61DiCi 7F9ZDHJkMw3fn9KYZfMbc56Dt1xVZwCdxOPb0qMorLszg80J2KV1qTiNJJAM7R6DoTTvKO3029B2 bNRLhflHPbn6VL5xP8PbA+lFxrXUrrGyse2B37VOks/8GQwHJz19/Wolmkjbd8pzkfMM0sMhlbLg e+T0pyM4uSeorrsZecn0J7/rSKu4kY561K3KmZSrAMBgdearmTBzt4bIHoPpVegNKxMFVmALFRjk fSo53SVgSOOhI6/jUQQhvnIwetSMqg5GenzZolcUb7AsiAeWgCjrk9fx60QPh8Mo2nqFOM/jUDqp fsF+mfyqUxhcFlbHvwG96lX6iavdEbefGdyhCu7GQeRQfInxDcKrB87twzgds0siKX3KML3C1LBt fATBH459qqSC5STzvD9o2uaFcz6fPGC0f2ZsbjjuM8V3vgH9obxtb3sX/CRXn2yFJVEsUigMYzwS HXByPyrjriDcNrLgjtjAzXO3fhezvVaePdHJnqnT3yP8K2o13HZhJa7H6rRSqwSdfN2soZT1DBhk VrRalKqYVGIzgndjA7V+W+jeLPiR4JjEmi6lLNDHg+RIWYYHUYOR+FdhY/tF/E95Q1xbxSKp3EGH GR6cY/SvSWLi9zZYiytJH6PSXsxxvJCgZ29c1TN4kj7ixAGeMkfjXx5p/wC1NpMdwqa9pF5bRthW lWUNt9SFKjPsM9K9I0f46fDbW32W98YnZwqRz/umbP1/xreFaL0uayrRfU9subq2GShBPTBBzVFr 1R/q8H2KDj8azbPVbO9TNlKjjnO1w354J5qUyxlSHkB/2VAJrvpS0sjz6sUtySW8um/55kHggjH8 qq/aZnYrujHYeWDwP5VXlu1UgIuBxz7fTFVkuG3E5wMg/wCR3ruhG25xtl9EuCQsrA+4UA/nTnWR ZP3cir39efqaonUQDkj0AJxnFILrcPlxnOBiulST2OZxtsX0kdBgvkng446+1WEmJAZ8DHcn+lc6 11Isnz7v+A9MDHr9asR3Xm4YZUY6OuMdq3jd7Ijm1sa1xNEmSihxggFaqxPF5mOcH6Y/GqRlMkXJ z+g/OoTKUOMjHu3rRZ7BKS57s2mltSoaRdvIA4z7VUlvTGQtuvBGcsMH8cVnJeKpBaQ/KQAetPN1 G7HYTkHHTgj14NSpXeoPsmaMUquN8ijIHHPTNTNNJuyhwCRwDjNZyXXd8MeO/YU5Z0aTaAADx9Kt 23MuZ7dzUW7aJjuDcg4APA/Cof7U8tDsZz7DP/16ikngUjDcj0NQC4tzzzuPX0I+tRy31OuD5VYm fXGK5w+Oew5pV1a3dMSb1z1GM4zwTVVZ0dWwOmVzwev1qsLlY8RoWIPYj86znBbGlOcrps3FkhcY 8xWGPTk1It1AmWVl2k7c1iNLhTtC+uMDiqj3EikqUGSM9MZNZKB01ayvc6hbmB+Tgj/Zqg1xbwsZ rcYHQ8VgwtNs+T5eecnFWIZpEAMjHA5wOfp09apaXscEm3Y3o9YSNP3e5x6Ac8e5pj6lvPKlSeSx 4OPQ1ivdBu7L1yeMfpTBc2u3hjxkEsQaORbsqEn1NSa9g53nnk8Hn+tUBc20oyjBvoMf4Yqm8tqV GwoTnOeevpUzFtq/Kg/3Tgis0rLcHVvtsaCMowR/ezwcHkdhUgTbyxPJ65rF8vnH3c8ZBpuxkbBf IA6tz9OeKxcNdzdT8jYMZVsEg5P3hzSSIo5xgn/PSspi6YYuv3sntSCTAzuJ+p6/jXNUUr6M6KfK 9WW24bo3Ocds1YQzYypJXOGJOOvasljKxxu5PU5xj2zUqyogAZuPz5xUJaj5pN3HTtP5vmIO/TPX 2py3bgjch+nUf5NUy2/5BnJBA5//AF05MIPkdtx7N0ArGrZIqKkuu5cae3kf5jj2qSP7OGx0OOuM 1nCOXzN+QwJ6gZ7VK0wQgSsBx1C/l/nFcc5aWR0xi77m2mzaCjYBHQAgUjW8m/eMsM447fjisSOZ DkJJg47n+tWBM+3aJCevP9O9edOUktzvhUSsrE8sZZ9oyh5OODmmqRFwcg4yTjgfzpvmFfvs2D39 /frTVmLE5bGexGDTjrZM05i6s8kjbNzp75OMVZjmuS4xKxAHHPXH0rMSd43yxBH+frQ12nmAkgex PIq4RWyME1vc6JZbwN5gkz29DVo3VwVwWYjsckf41yAlec/upMY69wc+xrQiuJowQXHsSK1jG25j 7Z9DpRfyowWVU+m7+dSPNFdIWjJzg8A/41jnULnaMPEF5yQcjn2Iojm3puDQk+gPPXtnAqZJJXK9 rLW417NDJ5rtMAMnAx/kVY3L5YXdLjv5ozVS7eUfdHTgDOKy2kMfL5UDklWyf1q171jJpxTaNOed l3YdhkcjA5/DFYr3Bx5bBT32gdKla8hkUP5hB77qx5rxHkLxMpI4yPeuqnFtvQyxMk7NDZ5o0P7w AfUc/wA6zLm8UjEQGMccdKZPK7zDzWGO/FVZRG5IIPBGOcV6dNbXPPbd3YrzXalcMVzn3/pVJ7rn jA9R6euKlmhVT5m4qQcYwDUZl+QtuHB6cZxXdGaS0OOb1abG+aW4BPvgf41ny+VI2dwxnncOavid PL3DGemPX9Ko3Ea7srgZHPTHvXTGRGIbkkiGSFUOVYcHoP0ppm2oVGAT09c1Ew4ITPHUgZFVA8vQ sPpitIXtqczdtkWg4HAYE+nWpeZFKgjp34rOCs/y5BIpShjPJH1U9aamZxdtbF05XLHGBxyaRFgY 5OBjrnvVcLznP9T+lRkuD07da2hK6ZM3pcvHYvQdOcj61BLMqk4J6flj2qs0rsB26ZJpWYBflOM8 569apLZsqXRkvmydRnpngf0FOMqbe/1//XVVZXQ53DHToaa8pI2NjrwKTdtwlBJXbLrIWGQ+PSoC khwFY+3r+NNjlkznJIPI98dqkMrqP7pPPNHtAaurxIyZANuSfU/SjLejUm8uASDg88e1Lvi/utTZ pBaan//Q/iezbXcxW4aJNp9M8fnVG/li4+zBjj+Lox9/YCoEWdyBHGpAGdgx+Rq0wk8kLMjJltxL /wAgAM4q4yOpJ2aIYrtI0JYBs4yDn5vrVqa4spyPssaRlBgoM9T161oJZ/aoDJboiyY+VVRs/men 41jyGK1/cmPLg4JD85PtzT9npYrmsXEW8lUmJZGx1+RiB9SBgVKFSWELLKqbQQVGSDn1yaqJf6gB 5cTSoP7qtj6/Wnh5IFE8sgTcAF5Vm+uM8fjUK+qY5zTWhGEXeXZ92BgADPT09KttJuTDfL65HUj2 qxAbZh5iySO+Du4RfzOf5VUlZpkwXJVeQP6mlyjulYm/tBIm8vy0f5eHQkYJ/rVc3Ku485WOeu4g cfnVZoxjcxXAXhckE89gDxTfKYDKxNt9Dn9c0+XuRLsWXaOXFwrY5zt78etT7rh4hIikbuMZH8s5 qglwzoI5DKSOcHA59sZ4+tOHly/NK2Cox8uOP05oZXKJNA0rBzJlhgbRnGfcetXVSUAuxUk9ef58 cVWD84JfjH+syPpwcYqJWUOVyzH7x2H0+tTe4ctiw0e0bDgqQOp+bPrWc80CTmN5Pmb7qBh/Lmrk rpOyzpgMvRSfufXjmmmeLyjgoXYYb5RnHtTa10EyMu7IBbxhWxjdg04zo5ELIi4P+t3Nk+xB4p0G 9HBXOwjA85sAfTB/xpsaW7SbmuIgqjOeTk+nAzS3WhU4rSxEYpWcbdp79TyDUwE6/OzZAHRj8v4A dKrS3EKMTuVx1GcgfnSrHEcHdtDfMSOc/pQ9EKOuxpWz2s37qeXLtxgEY/M1FIGtZ/s0uTnoCA5w emMVnK4X52UsecHpkCnRTy4LxnGeARzTuDehZIkDlFjOGPBJxx9M0M/lPuVW4HHTOfbFRRz7mAMm /bwQ55J9ic1Osi7SIBtLHJLbT/PnFU2nuJLS4SzKsIwpLdWYnI/LpTfJu2j+0rE6oORj+dXWiNs4 LTRkMmG2ccZztPHqOlV5TNKfLkc564ONpH9KqL6AoCm9vGUKz5K49h+ffNMnvL6ZTG+FUn5uBVdD Mj7bZuckZGSAKWfaXJLHKj5yPmrWWNqfzMn2Ud0Ih6JIzgZ7HpTpIkGVibGeCT6H1qMOCC3zYAxn j+tJcCGRQ8XmLtHAPPXr7VzubKUVvYbu2EABSF6c8fnUzSZG7CKGPHU0wReYgYuB0JyOBj0/yKnk jUJ/o8gX8Ov0zmpk1oNaDWeF1QROXbHzjZtAPoDnmmLFdySbtoKjk46getQQsh+d1Jx36ZNDzBTt AUAkj1xRp0GkyaKdIy0exidxI42j8RVdpZctPHuXJ4w20D8feiYscGEZwOW6cfzpLgu8KhcAJ91c cAHk/wD1zRdLcco6DYPPQNJI8K5Ocgk5B9TwatzedOfM3xjYuAEKgEZ9B1qiqxtgsxXuyYDA/ngU 5IopZTMNwjXgrHj6elEn1Qo3W48xwOBIocseuT8v1FNWIsTuUnA/hIH86me6faY4NwXpg9B78VWk AX5HO7jLNn+X/wCupvfUNtCSKHcxZCB7DrxTpYCQZJSUU9eRk+lSxGKKLzdyhffJOfTt+lV8y3TG MKvJ5+XGB9aEWrXsIXtpIgoUggd+mfeo0U7cbQuTgk8kn0qRhGMRFgfLPUDk/jTfkmTEak4PXP8A OhvWwpbD03wyZQbWXn5QM0xU+X94dx6svfmpZNrlfLG0kc7efzp5W1Xa8Uxcnhht+Yf0pLVAnZWI 2Mn+pjLFBjcqgVAqNvLIdijn5uuPwrVUwGJtpCsGznbuJx+IFRwpNLN5Fj87g5w4G4+2ORR0GldW IiLqO2aR1+V8bXJPIPoMiqkU7RNnL7M9OmferN49ysjR3S49iuCB7dsU1k8uEbWbBYZyAcZ7g1a2 sKMdxItQtjKdq5XphScg+9U5XU/MFO4nOVx/KtKKwuL5SYSZAp2s+QoA/qasR3UFk32SEMOMO4I5 Hr3FJO5VupSgDTHEpO9vlJYBjjHb0NTGH+zd8cbFWcAPnBGPy4qGcWsUha3dpOC3Ixj2AP8AOoBI /lnzc5J6DqfTNEkKLuK0USRb2dtw4AAz+vvUcUqKMSRkjoxPp7ZoLo8QJOecFO4q5aJI0LEIWBPE jLnAH60SFYiKQIuV3Mob5B7e9I8gibydjLu+6rDLGoLm4hjwYw2Qf9YpPzH8atKB5QnlYq5AIYkl uPTGMVLXdDS0I48hsqCuOPn7fhUhaZDngA/dJI6VR89vMaQAysw6nnJ/Eiqy3skf+ugeQ5wEXoBj 1z603HqhRlrbqawuJscY/DFMlZXXKABu4rJs727vZNnk+WO49D7Z7fWrh3ROI5WKgn73X8OKnkK5 9NRwbLFPbOT0qXaka+Zu9hz/AI0yRooSQwbPXaeOKs20cEs6AMyrj5yw+UflyaTVtxR11GxPKWCK Djuf/wBdQuoAPHB/Wlu0IfZFcIVU5UBc5/rTdqLhZBgMuOOrZ/pVO4dBd2w/N1IycDFOlmZ0CqDh RnI7+3/6qm+zMgAtmAH1B/DjNVGKxy+Uw56MB6+vBpJdQfYb5ys+9l29Dt/n3qXdvJYggdscgfjR EqSB3IbaABxx+nekdbmJA8TKAx6A9M+wrTl01EkM4b5l5H+eatowkcNNkgdBn8utUgHRixYc8Mev 4+9WZ2ih2oGG4/w/1rN+RXXQdJK6jyFb93nODj+fWqqOyt5sXylSeR3A9qdI3lxLJOD8xwoUjJP0 pYij4I4JOfwFDiyZ35iw97MYiLiUNnkDHI/GlwsaLcRsJGY7sYzjHc5qo5HXAcYOc4wPr61Mu54l iiQZzksDzii+lxxWtmLdXUlw5iJUjjIHyqDUEcKmUoWU543L2x2zxSSJ5YLSnqRx/hRHhWJjxg/j T5rCcNbFqUTRjN0Ny4xH5gDKPXArL1DSNIuk/wBIhRWYBg8fBH4D+VaH2eGQhA7hGPTI6j2NPZZT OsbupC8oSOMenAov1LsnYwdBt/EOgah5/hK9nj7NsU4wfVe4r1iw+NPjPRyP+Ehs4L2BTtMtuTHI cHqQT1/CuE+1TW0r7F+Zu4J4+hFM8xWH71d59TxitqWJqQd4uxEqUZLU+kvDvxv8EeISsLyvZTcD ZdYAz7N9a9RtdTgvIhNaOskZOA6spU/ka+Db3S9JuYybhFLf3xwB+NcdfXc+hzpH4fu7lGOTtjkO APwr1qGdNK043OSph2tmfpJI6gnBC+pHPNKtzbo2WYHoMjv+dfBeg/FTxRp91bQy3L3Cs6pKs3IY MccHqCK+xBdmWJQ3QqDz1OR/TNezgsVGte2hyVL027nWS3SHABxk5wOv6VK9ypQurngYIYVyDuQP kOBjPH/1qZDLeSKc5x0APFelB9EcrqWesdWdab2MAfNnnpS+fETuLZwOBiuZWUFiHO05+YnnpTvM Vjudm9BjNTzDg09bHSC4QtuKrnHPrUa3bB/LPpzXNibDkqeAOOvNT/atvTGc5Oc0Kd+hM5q6ijoD cHlV7cA01JV2/OoBPo3f1waxHnMeSSg54xz2qE3ZyM8Aen+FaPlS3HzNaHSG4dF2oG4/HpVd7q4G JACAwB9Bmsb7UFGSR171G14cbeD6YHWqUl0HdvVnQpdvE2ZCxUdAOaT7dG7AbpBwTn/IrBS5kwCC eewpzXLAYkO3PIIFc7abNIpvW+h0B1CNCC56dfxqN9XU/LlfoeP88VzzzqQCGY98HjrVbEbj5gc9 mH+NZSsbe0vojql1eINkqSOnHPtSvq8BXyQm3vnkVzcZtVy3JIxkE1KJ4FjJwW479qmMuiE17urN 2O9iCYITA4ADdqixDK2CAucdDkYrDeDPzKFK/wAJz6e2aQxYw5dcdh3qo1N2ZOKZrSwQbsxMBnuD j6UqgFMEu3T+IY/lWRhgvDk57DgD8qm+0ImFO4n1P/1qunLSzKcFbY0TJBH8q4Xndg88/hVgT7lB jfH+yD+lYct2m0kcg9x7Uz7UBx8x4x0zWFWTtqOGjsdG8ocjkHB9Kb9oYAI+3AHPH+NYazo2BG+w 9DnPNWS10Bv3xlQOfpXIo+Z0qS1VjTTynGWz6gqM8ipmXAJTdnH3Spz+YrJVgwUFv++f/r0ySVBg JK5PrnH61nNu9io3SVzWQTMD8xXHVSO1DRyocpIMe4I6evWuda9kU8tnDcA+1P8A7ULscnn24qGp XbRpGrBxSZvI9wMq+D3BU4Bp5IIEkqsONuM5H+RWOlw8mE257nn+lWQ8jru3HGOciuepdG8ZWSLk kWR+7B9M04FkVTsPHI7E471TjuZRg9gDzU8lwshJIAPY8elcdSF3qdVN63ZMLkkbipX1/H6Uov0J Ifgg5Jx6VWMiAqSx2nnI5/TmkMm3D/Lye56e9RCKHzSL/nIwypAwc/h61Gzoww3XP1/Ws9w2PkYc fjwfU9alhJYYyGJ7dDWsafVDc0y+JBFhSij046Ae/pVm2cyEsPl9geM1jt5hOFP07nino8wU4cdM 5JPH51elrGM5JfCa3m3OSgjDL6jINXIoY/LG9Svfk1zrNKCWbkHnOaVZJidrljn3GPbrWvLde6zJ 1L25kdO0oWPC7tvtg4rMuJ12nyuc8fOMVmOZcbguT161XZipIIYZOSRg8VVKkk0zSVVO8SRriWNv uKRxjPPSo3nYAgxIMjIx1/rUTSAoMqw984Bqk0UqL9xgM84PXNdVJK9zjqLTQfOocD5dvG72/wDr Vl+YGGCxyM/iP0qaZSRiNSB6N6VlNII+JAUwMD0x71100nc86pOVxLkZB2kc+oqmCyKV25PrVppI tmN3BA+uaqS+Vjh/YZFdVOXQxk3F8yGPNnCj88Uitngsp9cnHX61HmHBBIJHb396gDLnIyOOma62 7bGDcpO6LpcDB9eOO9Vyy/TnFQyyMMYb/AVGXJXG85A/CqWqFIsFoSARjJwB/wDrqCVxxwMdjVQs SBtz0pwLH5cHpnOMUW2Y41E1ysekjIcnBx+fNSF2PQZP1qJkIUjJ6cY70wNKBtOCPX2qlKw4xRNt zxjFIyMUDEj6CoA2R0IPXr+lK8i5GwkdM7h3pNslpWEYyDjjjrmmkFc5HPX/AOvTDKw5yp55p4cE c8evf+VV6CVO+lx/nAFQhGc8881LJM2zLYOO9V2XA3JtPf8AwoBJG3AHbigqN1KxKsoZjgAe46Gn 59hVNlAOR2/xpu9fRvzo5L63Ivq9T//R/iW+xtCxlk3xkEY6huvbg1Ddma6iKFpcBsqWbv65xRqD G5Xy5Lhgq8gEFgR7Y71WeK8uVV4Z1zgLgoSFA/EVottDrmtbIiiMxLpmQMvJZidrH+tWmgWCYC1K O7fewGH/ANenrbSQuiTmMo5AZguOO5GfT61dluLW1ma0tZ1kGOGUEcdgWP8AQmm27XI5b+7cpIDE rJcMevO3k59garFUmBEQYsMYUjBOe46irl1ZzqwM0bBiMg4bke/5063iMZEbLIGx0Zen07moSdi7 WfkRW1nFb27GUBz1LMx+T8uKsC1EpKkiT5fr27U2SNI/mbKk9sf41QD2rvzuJPcAr0+n+NCve1jR ctjWezlskDyxsiE9WAIFRJqBm3bzGuRjoV/Kqgnjtoy6ruUHrKN5P5n+lRXF3NOQzqWDcKeFA/Lg UWIlbQsR7/KdO5O44HT9O9NMUgO+MkDBJJHeoYl1JxutDkDp6/jg0+81d5YhAURW7srEk/rVxS6k R6qIwW32y4UyM+TwxJJHPsBTmsk3vGFz5fB3ZBI/Sli+3WjfabJmjLjAKOVz7ZpIWvJJd1ySCTls PksT1Of/AK9Ry+Y3d7o0AsbMEjjX5RlmI2rn0z1qlJGsu5oQMDhgoOB9CRSXe55xvDKmOF3Bhgev PFU0jiWUrC0gOc4ViAP15/KnddROJfEGIkjuARGrZIAwx+hIpJ0VHKhcZAGw/ex6nAAqvHFdyyFs M2Oitnn881ca0kk/ezSInGPnDDP6UPXYvk1SINkYcOY1bjGSwxVc3phIATr/AN8/y/rTLq1sYsmG 5DDPPlhsZ9Rv5P1pI/LCqu6Q5HyjjOM9ycAVNrbhfqi1Hb+exMpAyMqc/pg/41YvFlWHyowSMZPz qQPrise5js9weVWdgc4Y4GB9Dim7UdTK26NeyquQfxppqwnp0LtszQ/Lbq+MZJX5mIHrV27jXUMe UjmQABsEDA9cAdqrxRBwBBuHy4L7iM/hnmqssbiQlWZ3AwwXnj3xScU+o03Fam5Hp1ubUZEAcctm UmQY7kcimefEkmJmcYGSDtOfoAP61gxz3UIKrtCH5TGPlyT68c/Stp5/tii3SGKBlxnA4PqKGhzZ QklTLSR7o+cBV5B9SSf8KfDbPfym3hYA8k73AXA9zgU0srP5QHzLwCqkjHr9aqSOwh8iKNSckEkb Tn6mhhF6Er25LMkp3beMKSckfmKSWRlKxFMDHAznPpnvTIjcRn9yzo3dVJJz/n3psslzJ/rQpYn/ AFj9Sfck9KUo6hGWhLLveJQTj32//rqGK5mU7XCnauMg4x9CKdBaXZHmy8Q8sXXLZ9vSo2WBztJI UkgMQecfSpHF9x5ubuRNuR5ZJ3eg/H1p0UiuB95vTkr+NTW+wIVjLOg74O0fn3rSSdDasbaNHzwW B5Ge+cUXs7lNNRMwlZVyzgkZ45H86BLBhYpEJY9eccVWDSu5KHn/AGT2H51OIk4yrFsbiM9vx6Cq URyVloLJKrErb/cPBcKT/KpCgQLl8kYbKcAE+oqgZHjbCIAp7ZwT+H/161oZLa5AW4ZlbGDIDyCO 2Mc1LYWIRMs/7sHbg/eHzbv5YptzaSIgEu0LjIYNuJ/lQJIYtyKr4JHJwf5VOtoLm382IrnJUIQd xHtgGjzIavoivGI7aRXgQggZD8Mc47A8VIL67lYPMRzw28gnj24/lU9rZNcsZLibyI4hwWUncR1F SzS6TGqRWnl3EhJLOFJPPr3p2G1qYhRSxkXc3zZIXgGpB5sqloUCqPvMB2/lU0y4b5NwOeYx1A+l VU+1PhUR354znGR+gqeZ7XGldl62l2ZLkSELtVW+XNQsDO5SBGVwMbV557kADp+NVw8zxmGdQJDw NpB498U6yinO4QiSMsSCcYAX1Pc5pvcFFWuSwLKjBrlFbHOFGT+VWZ7mPzFmQeTj7h27XJx7VDe2 TK67X3uOAEyMfQcVM/2tVzf8kj5POBBGPTih7FJsp3GoSXbKJpGbAwpySOfWonuIo8LIuSRgHHGP wNRSMrKFGcg8gAYwfer4SB5WZYhGBgqCc4/PrTSViU9bshiY22GDbd3RQeCKneVo/njQpk9CBjHt moWllkbL7ihJwdoHPsPapV82RkeMNIcdDzgCk0Gw+G5aOQMyhm4BVxnP4VHISULuAGkY/IOcL+dN n8wP5kmeTwCCPzzU1vOHTa5C4GMgg5/OixMSihhVz5qqcDI2nGB7kdauyXNzBalog4Q9Njd6bcvb KowxXODt+vfNQGRJwAAF2jAUZGTn+dDfVDbd9SiJIJioJ8vsd4GAatfck8wSRyPxjOSMe3arDKPK EyMuQcmPof1FRlgyH5RkneVH8iaq+lxNESNEZP3mRkZO35f8/SlkuI5f3ZLBMYwMZ+vakkjD/vEV UXsvX+uab9mhjGZdy4IO7r16cUuoSJ4VnCtKScKwJAwCV9/SpnuIPP8AOwfWMM24gH1P/wBaqv2b C/uZA4bgqAck+9TwS2duhWaDc+SN+7p+FK2pTjbdlVi142xnZmbOSxyAtSLG0SYTcUB2uc44+lDx xn5VyCT9OD6/41BHaLBNgnd6g/dB+maFpq2RezVi3E4tHMkGB2Vtq5/AnvTpSkk+8ISx6ncT+nFV 54NmEOGXJO0JtyPSrkfnWv76IbS3GM5x7YqLXNNErDZIoQQGJQ8n3PT0qqJYoyyhSXP3JGHQ05mk jZg4+YYJPU/T2qzBAty4JdUbbuO8Yppib1KzsHCvl3c9do27RUi/2hdvmMZUcHcR/MfzrRk0yZ8s 0sBB/ibA/Kqf2faP3bqR0z7981V7IlO7Ky2pA/dkZA+cK2Tik2oUJkBDE8YHb3681eWFVH2pFGeg A4yT7VIsKSIztkEEbVwfmJ681Sa6hN+8rGYzSnn7oBxjHb3pp5PA9MmtWZroHYUKAcHjB/XFQLDL G2QOOxI//XWd7Gs7spyGR4ii9O5B/pSwzPEvlqV6Y46irCsEDFWxk8jGMio1Ea4PQEnIxgH/APXS v0M7sXzCVw4BPYmpVcbDn8hgD+VDIjICgOScADnB+lOeHjIXBzyeOaly0NktbiK8coLXAJI6c9qp Srn5UZh/dNWj8w2SE7VzjA5qNim0eXnGKLk2TK6ySoN2dwHJOKWe9kgtDPdkCNfm2rVbU9WstGjD SEPIRkIp6ntnrxXm2oajdatN9ouCVjzwgOB+H+NXGN2rClJLc09U1y6v0aGxOIj97AxwfU81zDf6 ONoILHqQc/hSyXHy+VCML6f561Uye/610K0djkq1Ls0tOkd7+23HP7+P/wBCFff0F1uhUFV4UZBO O3vX5+6Z/wAhG3/67x/+hCvuRF3xBS2Rt7fSvWyiTXMctdqTVzekunOOCB6cdPoKdb3LkfO569OP xrA8tx9w46VIjSRj5sHJ5GP8K92nV3OaS2Z0RlV2wGU88Z7UpedcKoUtjJwc4/WsXeqKqMRnufaj OeTIQcEc1SqD20Rp/v2bnIBB5pyvOud3vjmsZXwcO59vSneeDkEnuDzWvMloczkr6nQI8JxuySO3 9OaaZUHylSOe3HX86w3uEVR1PT3qYXfHU9fWiUr7G909GaYniwWGfYHk/rTRdHb8qgZ5x/nNY7yt uBHHPOOc08XAVwCcjH0oY4bs2hLK3Hyjdx156VKJdkexieOma583CNz5hXj/AD/nNIbpSSFdgM9W HWs7vYcUk9TXN1Hu2qPzpRefJ8qqT3FZEU0Dg5IbB644+tRySBz+66/7P1qZO+7Jirao3kYE+YQM 55547Ch5W4I24+tZMckm3DHHbrSeZk8t9TxWHNZm9lZXNhriTICqo5I606Mux3MOT75xj2rI3rgF W5A7ZpyTSAHa68Dj1rX2jtZC5Ve7L0u5epxzxjn9KgWVhgjtznkVUN3KMhsE4qF7q6CgK3I7DHf0 qE33HOSasjdEjBfmyFIzx09adFdRq2eTnr1rCN27qqtj06UCdC3ys64/iHH4HPaolLmuCUU7s6SO SRm4wPSnsJCcybfc9f8ACue8548bXDN7D1qZLmYjDEg9z2rJ3bHJLoa4kjBIJBPqP/r01pocYcZ4 OPp6dqymbeQS+M4wO2PXGaSOEjrIT3GO9OaRCXcvs0Wwgjr0J5GaYsuOFxjrn69ai8iYjls/7IP9 Kg8sqO2M8kkYz6Vkn5m6hrojQE6KoIfacnkc1px3zAbQ6t046ZrCCLheMjPOOf5U7zIQeBtySDn3 qZK6szTndzoZJsjjGfTkf400TuXB49Tu5rKTLLu6/jjpTkkxhXYn3IrlcFZ2ZtdmsLnsVPpx0/Wn qzON3bjv2/GsZ35wvPfg9qlEjDBBIx1B/wAKyjSVmbSk0tdmaWEBxxuPUDinfLISpDeg71mPPcIQ ynd74psd0XbD5HYd8Vur20MoxV+U2hujIMfXpyMH654qZJJtvJDDPcc/pWOWDAYcqc9Qc1JFKVYF JOQe4wTR9mxatsajyE9eO/HtSGZ8ZXucAGqpkTqTu5xk4qucFgU45wSG4q6a8jBt9SxcXRDDC8Dk 4yOmOKYbyQgc4z3OM4qKOIudrEg+ueKU2uxMPIvHdulaWRMU90iU3LnP71R3IP8AKs68mcj52c46 Fe/amyoxyVZD6cH8qx4/tMjc5zzgqcDHtWtFpas5qtXaL6llrgKg38lSCcmqkjsQSwxk9R/hSzRy AEEkfh1qnICo4bn3rtjUW5zVuqEaUBdu0k1G8se3aw6c80x2YAjJ64+tVd0gJyT1xyP0rog9jDm5 bJkvmoTnHPrTMjPJb8R3ppLZI/LNNcuBkCtJTtozKSs7kzKvByR7VXPyjIz1/nTC8gIyB+fSo5Hy vHBzk1pBaA25JkxZs/KcdOtJ5jlhh1PHvVfzAo3Hpjk96bvHU+n1pvchS6F0s+DkD86gEpHysMVX 8zGQpx/hTN0pJ2kj060REtzQDqBnnknmoWdSSefofSq8cr5OSMUhkwDnP1FCWpruWR5TjBDZHFNj ZEJCk4z0OarDLA5JH0NOB2gN27im9ESXPNTkMOM9vSkZhw3aq+VPIJ9RmmGTGAaLlKScdSZ5kHBy O+fpTPtUX97/AMd/+vULTZHy9eqg1H59x/dFXGdkYa7pn//S/iOW7uZADM0bNgKC3HA7YHShtSaR vKZVCk7W8oHPvg1m/ZYcF4BJIVGMn29c81dtfsUTLLdRy7s8KnCY+p759q1i99Tple60sTSXtisQ it0uZGXC4bauP+Bc8fhRb3VjbFheIRvIIBLbR9SuK1g+nM7COxuWOAdzZ2/gRWZJe2ynaiCJR/CT u/nRa4Ky1Zcl1E3CL5ZkRR3DtJ+OCaga+nTCrIzqvBErENn6HoPxql9rgY/u9mO+SBx7+tO+2G0l W4AjkMfQKAVz2OMYP41W1tTN310LTjzdv2dUBwcszBi31JOBWc91Fsbeu106Lu4c98Acfianu72a /l3ySJkDBMahVP0wAP0qpbxhwY8oG5IZ8L/OlzJuxq5MmS7a4XMcb7sZK43D88UklqTCxlbYrdmT k/TpTVk8o7oy7yY5IOc49x6VKBfTr59ujnHRmGcY9ST+lTFIKiehSh08w5ZgHXGCSCBg/T0q/bzS MAjmNEjBKlUVyfYnH8zUU9+xCmUNjaFdWYkZ7njH5VUjl8q5E0dv5hOBgnKY9MAfzNTfoE3uXJri 5uV2kDGOEGP1qurRpHvmWVtvbcCAfoegp8zzuxxbxxsePLU4x9Mkmp7ZNsbG6VowpwoOOW75JwPy pt6hAzrpp5QuAyr/AAgY/PP9KWa4S2IeWQ+pwpOB+Ap106SSbI/mU9CcD6//AFsVFbwgoQm1lJ4D 54/WiNuprJvUspeSgFkZh6EZ/lxTxfyyTbXbzBgYJGc+vWo2iM8gMKAleoQY5+vJ5qd4LRYwxWWM twzEbY1I7AsSTSur6GMebQt3k+lxTxm03DPG1lDcfjnH5VJGbWVSqxsT1y79ffaoxWLdRxsQqMkg P8QGCP5UtvPNbsyqsbbhtAkB49wR3q+WIOL7kxNubjy5ypByASTjj1GKqLIssrIW2BDxjGCKlW6k t8t+735+UMoYj35qu98zXQnv9sg/iIKoCPqAcflSUE9GVZ9yzOQXRI5FjQ8sdpc4/Op1ktLXYJJi +TldsYUj6nNEd5bkGbEeXO0eYxfZn8Bmqk32dZgIvKmAB4wwGT3JODUeSCdr6sVmuJ7sRWqlV2kh n2k/gM/1qAJMZC0/XOC3IJz269/rV+OxQwG7JwqYBZSANx9KhaOzC+YyF2JyGbJOR+IqlU1E1bct sbu3lEbOFAAyB2H4mmxeW+6O1EcxPIABP8jWaoWRHZIlCn+ItgZ/On2+bbLRts44YNnPqM8U3GPQ pJ7Mesklqxa4zG2eMYII9MGqz3jiMmaJlOflbt9elWvs0t5KHbIU/LvJIA/H1rQe2t408hnLsnXc wYZqeVITTMWKS6li4MwZTgYVQAD9c4/AVpWmn3s8XlxPH5eMnewPI56VoFkuHEc7FUxxjt7gVn6l HbW5A0mW5BH32boc/SjTY01SZDMssbSfanjIAwAmQpIHYY61NphhZmgwcMBt5OST254pbeOO7Aju 7lUUdNx6euOtNfTvJf7THOpXBw5Yb/wHr+FTayuRGTa1ZJd281lJ9odSAV2mRh0FVBdRI5ZD95er KPyz1H61V+0Gb9wJ2bJyTKTnAPfFTwwwy/LOZM54ZVG047etUlbUcpO9kisZJJ3VGc4PCnkYP44F TLZiMhSGZmY5Ydh+verAecH7K5YovTdzj6DGauXOmNEqzeadxG7a3yY/PBpWQrPciGiXSOTIZNv3 jx1+tVZEZEO/zCgPdyMfQe9Redc3Rwzyf7O085HvTi8u1lcljkAGWQZP0HehJrc05o9ESBo5LVVj XLHAA6Z9s9TWhBeugNuEUtkLnIXkjoMHmqCiJXBiUhwOFJHB9zUgngyZXDpIO6qG6+h4qROWhJND HATLP5kTE5BzuOOvJFO+0W7QDypZ1k5ZlA2r7c1UfyHUsoZe5LsckVSVlBJUsCuMMmf8TVp21sZ3 6IumL5QxeDe7fxt82fTBFX7eC+l3JFDISvG6Bl2/ielU4TEYtqIo+X5dy7nOevNTWzzWbY2MhH3S 6jH1x60opN3Zo1bRATe2V0I51ZT1b5uT+IP9aW5mkuGEyoxz1UktjH1pstzOGZnCzEgMxcZz6Dtj 8KLd1eZnYJGW64JUL745ocU9gi21sSCwZz50WYwBklgcfgapXDySjGVIHOBVp/tg/dzGUqTlVbOC O2BTI0u0zCr8NjcrHC4qUGlx1ldpAD+6eRmXbuJwR9OtJb399E5SzDox+9txkgH3psbrvw6ycHG6 Pnj2rWe0skuc20jqHXDSSqM56445pqy1JvrYoXN7cXa+XcSbivJUjBz7mo0Mo+eAx56bcDOe/GM0 k9uI5GJdcKuQ20jNUrcsp8xnJ5xtXv8A59KSt1NJO3UsMWkGSqknLEEdPahbVJXWONNuOcnkfXOK kMqzum9fLU8HA5/AVufYrT7NutbzypiuMSqVyD24znNXGF9COfrFGFtCzmCWQ4HUx/Nke1a0tjZJ arND5mCD80oAA/ImsuO1jtk8yd0dy2CY88fTOPyrWuTaQWSxW+2TJHIHPXvzUcu407nNqfnaKM5D HPy8/wA+lPRR5xYKdo67hyfXNak5Ejf6PHtGByoIb3qNWJt/LYYCnK4A3e555pfIUnbS4+4ningM VukUZ9QnQUyfS7XyEmSQljhmBU8H69KzjKoYxofr/wDqq6bzy/3MbkoVyMfyoirDm7sXyzJ8zsDx gY61Kmm6iQR5T7WGSSDzipTJFEVYbGAHUt1/AelRzalPI4gMsm08svUY/On6lW6DjIHcSugAT5CB 3NTMqiTzbI7Ax2uAc7ffnpVCIYP3jg9znkUp/dqHVlyeoI/TmoS3sQiVYk3McbiScZ7/AEqqEQ8x ll55wPTtUjSO6hQoyOR2q7HJ5EYkt3O88YUBT+dN21C6W5XWM3O1GQoBwN5wB+BqzPa28FtmedGO cxiI5GPemsbm5/eu4z3LN3qoYg3yrkdjjnNO6ZSemhL9qt0RcJtKrksDnd+BxT7SYGMsitG2CT3z n1x0qFUtymJWwynA4J3YqZbiKHaEXdzz2yKnyJa6sjMzI/l4Z2JBBY5/nSfapYrgybwhbjCknGKJ pY94eBWjwQMbjyPqabIY5JSTGEPqMk1TaRUZakuyI2wky+/+Jz/+qqQSaU7IVZjnkKP1qz5sgg/c OwTPzAcE+9WGnihUQxByGAIJHzKfqKhLqN7spSkwfuxvDYG7I/LFPhDLGz4JA5yTg8+gNWpfKkce QpHHIPJz69T/ADqq3zbncgFeOBg5H4/41NkJSk2KkdzKrm2jJIGQMgHHsDXNa7d6jaWBe2RlcNhy QCwHrj0rpNs7Rea27bwobPfvUDMAfus3GCeMVV0ipQbdmzw9Zlmm828ZmOep5/z9KtXG+YH7LuaP OBzzx7V6he6Npt8CZYlUn+NRtauVvPCBjbNlI3BH3hn9RWsay2ZzOk11OGPsP8aXj/8AVWzdW2o2 rlb+AyKpI3kHoPRh/Ws39zJ90lTuAAPIx9eP5VT8jO25LphH9pW5PP7+P/0IV9qRTrGqiMZAHHPF fGWn20i6jAVwwE8eWXnHzV9cJLGANnI45XuO/SvYymMXzXOateLRrPcysAPLBBGOtJ57nGQQe9Zp m5wuSB05wKiZy7bm/HmvZUNTKU0bJkLcryc89sYp6yyIpJXJFY4usZXJ9OPypod1bcWPXOM0S8zK /vG4ZQU24wceuaYMNxIc/TNZ6yxKM568mpBc7fuZzkc1Sl2CrC7uW3Viu1GwOn09qP3vRWzjjmqj XrsSqg56t7UyS4kxuHJHRcfrmt4vTUx0b3L48xT3Pp2/SnNJIrHcjVRS+JAyMAcD3pzXEijKYyen NZVPI3aVrIsPcsMbh9TinpcxsSzjIx9aqtcMwxJ3x0560iSxj5STk8DjP0FL2rtuLk95Gj5qbcqM HdjPtULSgthT/TB+tVcqWGM+p9Ka5+Ybe3bFKEkmW1tYtMzA/Oc4HY5zTfPI5HGR6VVjkJGWJz1o SVEGWBPoOtTKxMbsvJcSj5RI2PU8f/qpFmI5JJ4x9aovNE65Ab8aI5tkeMgAHjvmkm7EpO9i+ZQo 3Y46/hT4ruNGyqE9vfms4TI3yqGJPeoTOOhA9/WkktmaOfLqjoVnViTu7454prMV9cf0rFLRnGOB 9c8VOkrBQiSMOenUYotZKzHKStqawACYXd+fP5UPLIvChjz0FZvnyr/Fn3+tTJO+cqcemO1Re2rK pyT0fQvNPKV2srYx0JzUAlkCnCBcjkjNUmurjBUAtk8kUqXk5+Vkz/Kle24nZvRllZyknzmQgccH irn2lWXbjjvnvWWl2uGZwV5PUf1pftW4HGOg/wA8VE53exa91aM05JcgbOMA9DjFWLeRymAxfv8A NxzWOtxyWxnjoeOfaphcrINyHHtWM1pYtVOprNMd4UkqT1Ocipo5pY84bp65PFZSvzjAPHH1qdZV jPzEDIx6Vm4rojeD7svNdFwDtz6bR0zSG6K4G3iqHnO2R8v4jg//AF6eGXHbJ9+KUVykRk5bs0Uu 3/gIBAyM85zUy3boMgAkjntislZOnBGfSkLM2NvPHBzjFaq2xUpPdOzN15WIw6j145p8F0MdcelY J8wjEeAeoyeuO1SbZlwGIbjjn/8AXR7PQl1bNm6106na0aHngqeeafDdxlth+U9efWsAGTO1GbPX Paml7yPPIkXoMr2NaKCta5nOo7baHRSXSpwrrnvntUD6jc8+WFPtwOaxN0QIWWLkfxZIpknlSBdr EYORzVJKyuS6jtdMuSztkyMdvqB/+qqDXT8nJB6Y45pZ7dGXA3c98/rSPbuMAYP861XLoc7i7tMj a9UAqd3I44NRG6I4BH485zUbRbBtRunJzn8qqvuPGQOn4V0Rpx6GFRslluRIMuAOMfLmq4uSpPBI xjk8Uw4HHPvn/wCtVVlAbaTkE5/+tVw0bZnVg1Z2Lnn5U5Jz2qMyOflBNQMqj5e/pQWUHOM9M11w asZr1J2mI+8OvABpnmHGzr3P9ahdhjPvzTSeNuT0p2CK13LAbnbnkUz9eKiB7g556VA7ui8c9v8A JqL30ZXLZ3LI5DM31NRo+4nOeT0PaoVmZhyvHWmF8gbh35xWiXQylHS6LbFgpC9c0ZwDz71UEoB4 /Jqe0h2fKBjA/wAmnbQcJt7ljeG4OeOhxTGcEfLjgd81XaRuecdxx2oLnqQaPUctdEydpH75xjki mGTDA4JA60xHXvn2OP1qNXJOEJ69xRG1gd0rE6yAt757VNvHvWbvO7BHftUmV/un/P4U2rGc076H /9P+H1GVUCeYpHTYnB/HBz+OamEkYgMEhGB0GMfrk1NBbWSruRUizwyLlifpxVNk0GUhFVVION7M /HuVGau72Otx2JTfX2zyVY4+6Cck49OKmit7S4jxdlgVOM8qOfoD+tUpZTdYSCaRgFCqcFeBzyCO lRG7vLf/AI92YfMCYYjwx7bsmqirNJkxbasiKaWG2UmR1AH3ehzjp6VNbzpPs8pmQZyTgE/gpqpf ajdykJdCJSveQj5SfZcVZ0+W6jYPaOjMeA0WN3/1qV+wKK3uaqWoDEXTsEzw7Lhzn2/+vUdzPZrn YdoGCQQGLccfSq1/qd1cAC4m80j7wdQRx9KVNSSJRDN5Pl/e3LECc+nOKlKxcnqXIHuGjAZQqE7v lXLY7YpJfKcFYi6HGcO3HvwKz11CN2FvAzohGXdiBnPoK1ZbK3jtklRyxz143Z7Zo5WtBN31AWMd yfsqPEd3RpSAvuMkjBrMlMsDCxiZiIjwqEFfzGaimggRyWcrxzvO0Z9asTX8EEa2tkpYD5i+0fOx 9WqWioa6MozOE/dr97Pzf/r/APrVJ51n9kEC2yO2M7mJJB9ef6Ch5I5499xGEbHLMeh/rVIzeVPs J271+QkHGPXj1q3dtkSaTWhcgAjXErBN38K859OcZq1aSRqwDmIsc7dxJ5HqOwrHkW5jdRIxI7IB 9386vrP8pEyYUDAPUn8Klw6jlJvU2xfXizpJHcRxRA4kZMcY7fj7Gq+pzx3GXFw9zgk7CGAX6cVi +TZod4UmQ52kttC+/epIrqwSUTI6PLnYQpLFj2AXpWnxbBu7kscUpgZ3ZUQ4X5xgrn34/Wp4Y03b kkXr0cZB+hFU9Qu5J7ny54xEycFcBSPrToJrq6YQ2KK529V+bg9+O1Q4toqDTdjdvbtLV1ieNBJj hoEHGfU81UGlLqitLcyYyeNwHzH1wOPzrODXsEotLlcsRnae3uQav+a0ZIZ1ViNu1QDxTadyFbVM qz2clkzQrsyowDsyPw/xps9lNFbC5km3BuCpBBHoMelJe3U6SrM7SStwoYchcdBjpiofPaefdeTu 4Y/OuBgfQDioa00LjJbkVxYrbxx3EyqQw455x67c5H41OpluE3wvHEBxyRuI+nOKu6t/YUQR9K81 8/KyMoBz61lW99EyeWyIp7sytuH1zxmritNB1JWdhqGFrpY4ANx4yxz9T0GK2JoUtVWcKH/v/LkL mseGVS/RcM2cuOT9MDNW5U1PVJGlhR9isFL/ADBSB6ZosTFdbluIG7kKl448rgb8nHviqVw8duWx OJCvVVjOPzPP6U9C8eYpjIhj5PyjBHc5HOPxpkdypRzF/Eco7Acn6elSHJfYrCdXHyll7nja34d8 Vq2d4GCRogIx8xkJ3D3Pas5xCcNMFG8dlwc/hT7iORLYS2bwQndhs5LBfccUNXZcZ2W2xsatHbRQ pJDMCTyyJFgD6Z5rKWWOAqCxkBxnd8p/x/SqyNgBU3SYxvLNgn3BqSSL7ZMDuXzB8uCdx4754qox toZOXnY3ngeeJbqwgwFHLLySO+ayY7lC21C+UOVC8kH1wCTUN3oln5BhE1/5g5/1mxAD2ABrFtfC 9vbKbmSV+T8oV9rY98Uku5p7TojcnuGkl89pPmByXYHI9vwokmhu0BfBb+/IWyfpmqlhpumbmO12 cH7rOznHrkmtw4jG0x4AxwQBwf1pOw1J7FZpoSczeUFxghBjA9sAfzqwYtNKrcKQCD25bFRvNBcO N23AG3Kjgf0q+luZEV3IIzhdoH645xTSJla+hTEAJM8WWJIGGOMk+gqa6tLyAfv4Y41JxtVgGP60 yTTpkk3YLDOMkYH4dKsW1jcHLqS3zAMQefzNTa2yCU1bVlSRlmIacISMBeTyB09uKHjkX+BXRuRs bp+HauitNNlEbi4t9zE4DM3IHp6CmnQZCSVZ0Un7qnOP8afJ1EjIS/vbiMWpjibACqQvzDHTkCmb XEjG9izIPUkYH0FbVroF0kwkRnBJ4wSc++BitJfDU7S/aV8xj13Me/uKtRaTY3JNppnCTSXG/fGp VT8uCcY/OrYEQgzvy/GAFzg+5OBiuzPhtTM5mGfl3HccH8qtQ6DZodhXAI+cnkD8B3p+z7jU4nBs LyRD9pYlegJPT6Y9KSNd0W0Fn4xkgZP4cV6fDo+nAfNCHGOeuPpxV46NbMQPIEYGRgDjn35oUNNy LdUePrHcWrFhHIW7fNkfkKnjgv7lf9UQAevSvVpdKhgcuyodvUZ4H1NTi0sGjM1uV8vgHGDj3zzk VXILm0bPLG0fUphlWKDbkA85p8Xh3UXQn5FBAI2Zx09/8a9MktY0h3xguO5xgfgantI40ZSyYU/w nOPrz71TpaWMXU1ueY2mkyTgRM7E5wCw5962xoUMCZuhPIc5+Vc/lXcR28JugzllLNn7uQQPyq55 Rkk+U4TGVyeo9TjtUeyNI1lazOAj0KzlUP5UiJuwPOwD+lXhoNpDnePlbge2OlbzFfOCGMkYJLgg L+ROabduIGRWHmKSQPL5I/DIqXG2tilJvQzbbSYGDYXgKxLHoPesuS2tmOyGPdgZJ28Y+vSuv2Qy 4eOXcU4II6D2qNUEcTRs6KM8BmAB/P1oT01HKJxjaGs0auIRjOSxHb0pq6PGAEiCA9jjgeua7sx2 84ESOGxghFODkfTtUH9lRb/NhiY5GCSxx+VS7i5Y6HHpommu3zKd2eWA4H4VHcaJBG2+ILsOcsOh I/OuxayDQqkwHByo/wA9apSW8SxlJPnyTnHI9+lOd1qxwZx0+hmVuGVQfutnj+VZVzp93aRkzHzV ByCMcV3A061kc+W4iHG1myVI9MZJFN1Kyu7dkFwqlGGUP8Le2f8AGp5bLYptPqcRDK84EQxgcgKQ G96o4bcYiOc8c88etdB/Z6tcGYrHG2ed2SOPcVjvbTG4dQFfA++uQoH41MotMaV9xCz4+bG3oD0z n8aY6/MNuw4G3qc/XmpBG08fOzKDJ6bR+dQq0ancvOPwx7VNrjT8ySGR43wMN/eyMg1HgeYWVRxj AGad55QblUYIH3v/AK1WZN8+bj5UHQ7e59MZqbqw77EgmuRGIRGD1OGAz/KqwHmS72yD0P8A9apB OzJu3EsAB3pkiSlclGOQCuD+v0oXkCaZE0xibEeRwQSfQ9anXcpW4mjdomzgqep7fhUxs4VgMksR zjjflfyPeqzTW2ERi20ckA56flTlorFNJMaTGMSEFeflNVp1bbgKCW547itB3kmcypEu1euBjj3z mq6XAQs4wMYOAMgfnURWpUn2QLbybSm3coGQVOefY1BKNjYiyoLBeOcH61fjktZreQ5YHgbcjBya ouoZVj8zCoSFVvWnZAn1RLLazROPmVxgcZ6Z+mfzqGRyJBLEhXaeg56Utum6XBlEfGC7e3bvT3kN tJ8rbiRwfX9KdkRFW1K8oadsSAfMcnPTn2rG1DwhpdyvnRnDfxGE4/QiumkjmOC4wdo25Hr9Kkhi ndMyKDkZGDQ2EUranmEvgu6Q74JuOp3DaR6dCavRQeMbGLy7C8JGOV3YxgdMmu6hjBBRjs5znuaB CisS5LEk4ParhUktUZypxbaR56PEHj2zwztK4+9yA/H1Fadt8UtRhBjvrZHYHllJU/iOa7VotyEQ oY2UZIJ65rJ1rQtNv9J8lrZI7vPyXSnk+zAcEV1QxlSOqkYVMMnsaGk/EXTrsZvlNurMQjZyM981 3sMy3UImtmWRWG4Mp6ivmq80jWNHsf8ASYVdC/Ei/Ng49e1M0zxDqOnweXZ3EkbYyRn5evYciu6j mTektSJ4aL8j6bMkkf3l568c08XKjCbSoPXNeIaZ8QddtnRbxVnTcNzYw+D6Y7169p2tabq0JlsG 3jvkYI+oNenQxUZuxx1aLWvc1RMhGRkHvkdKkEiNye1VFnYgAkYx6dfxqTeMnByfYc12Slpc51S0 1LLyoAMd+Px9qa8pxkYPqv8A9es5mlDHYB3NKJJ3Qb1Ue1JS0Lilrc0klwOQM+/NIs2w845ql56p 8pxnNRCZc7ivfr7Vk+7NXK1tDQe4OA30wai85txY5H48VCJlz8qn60eZznn6Y9Kly00FOLZYE5Y8 E49O9IJwD8pHv9Krb1wdyjJ6UhljBHyHFHMmCl1ZZknbPy8DP60glRU5BBBzzVYy55UEdhT2LNjG ffiq59LC5eZtlrzwv3SfUjpTXuxnpz71UCMzA8YphULycfjVRtfUGtLIuCYyEbcZ9qs7gUw9ZSEj IXHvQ7Dqcjns1S9WOCa1epqtOowRzjsKVJ5G46fjWUJFPynP1zTwy/wk88EVlJWJ9paV0ahmYHIP 5f8A6qkW7ccHFZeR3GOajdoV43k9OTSkthyulzGw19nqM+uO1Ekyk5C46cdOPrWUoyc7uO5pyMc4 3EjPp6VLY9W9TXynl42MM/iKbF5e/CjnuO1UDvDBlbt64oabIJLYIOMmoTLsa+XX5hT/ADWYkHkf 571jjL/x5G4jr1oR3hIJzjHHNJrsylLXY2XlI6ceuDxR5hJxnrxhqz/NDfMfrj0qM3TKQAQR2pRu 9DolJX0Ng3AA8sEjHXA4/CrMUwzt3c9v881giQtkHA4604kPjDDIGSRVOKMZT5WdHslQdBgZ6MKg 3KQSQQwP1FYyIuclgx7jJyKsLKwyQOAM8Hn/AOvTV1pcaXNvoaiNjBI59qke9aP5lQ/gcZrD/tA7 sHOQO+D/AFqVLxVcb+Bj5s9PxrRC0SaTNY3sxXBTjrk/yoWYFc7cY9BVMXXTyXXA79OKWa5uCgEh Dd8DHP41mpeRm1ZaE5mD4RiRnpx6daaZQnKt7DJ6fzrPE2MHYAc/xE4qo83HPHOOO2a2T1En1ZcM qk/efng7sVDLMVcAdM+lUPNcfMcdemO5qI3LY6Lyc/SuqLdzmnY0lmcjDDjHc1AzJvxwMdareep4 zz+lN89WJ247cn1NXGbuZuSdrj5HJfCNnHfFLmQjcw/EdKgErEdsgZ/OoxcM3UH8K3XYXJGPzLoD g7ufTHFMbBwdx64qn5pGfmb1JpGmbcdp7j/JNNTd7GUnoWm3kFQSfXOKXGR84z14FVdzhuBx3waj 3ktzkeoNW97mTjfVsubXB3E/SmZG3k98iq4ORkHBwcUbjtOcZ/Ond7m90rsmMm7k84P0/pSbt2Q3 145quD/Ce/SjKoMHP9KbZnB3J2wEGeDSBsAqCCCetRbiQabG4ydw6dec1Lk7Fy3s0OYsSRkfr/TF Rrnsx69+ac0gZsd+3NR7kD7e5o5tDJuzJQxHOSP64pfP/wBtv0qDdGRz+BozF6VXONTsf//U/hxS ZGm33khY5xnJwMegXoPpWvHc2jwl4GXnIKldvH5fzrn0vIRMRp9oW2qB5kx2gZ789fpTQrTOVuTG xXkLtIz9O1EkddOXRonkvLeZwpjJGCPlBK8Hvg1YIkuomjVPIVRwVIUkeozzmpYTesMMFQdtvHT2 6VQvZ3jVgqiU44wST+VaPsKUl0HnTvKVQz7zktmZsnnt71YtrKe6doLSJZTjlQeMevHSo7S91qSz /c20McLHy/NeNS+e/wB7+lP05GsSTHJjPG4nAqZ6MUWral46dr1kMPAqLjA8qLJH45NY13c6wQQD FJtwJDIApx+FdeZLm6tH827AjxltpZuPwrl5xE0Ys4bifyd+9lYbVY+vQGqTsxy94p2yPcklPLG0 gDdyf1x+lackOoWpCGWI7weFwcD3weKpRXaacCkECmQniWQBj+BYn+VPSVmVnnMIZmyXIy3Pb0ol vcTgSw2kk5IVVJYDnvn2/wAirx0qZfmZR05ZmHGfYmmMLyBVeEK2/oqAMentwPyqh59xO5MisoJw wdxwR1PA5/Ok2jaOqs0WUQxOsczRKpJ27lODj2FRTZeRS5eZc8KgAxjsBzxSx2QZmZGj4PA3nP6m qc6qshGCTkZI6A+lDMmrl/8AdvGZSjK2doG3JHsWzUW23YKyqzc5GecnuR2qRbi+t3jXAJOMJ97g +o7VYn1C3RdhjIkYln2qETGe3r+FQ0NNbMzpVA5yGzkYXBA9j0xU32YSRrshwoAAdV4yO7E8Vntf Qi42xosa8Ah2y5+mBip3mUPtTKqRnkZHv7ZqgirIfdaaQhmjeMEngv1z7AcVPpvl2dyJJfN4Q8Q4 5P144pirJKjLKoIC/IW/TAqWzeQRMq4JCgbgSpXPai9tB8ifwmPc3ryXPlLI6u7/AHpF5/DtV6GR okKsyKR95mBZyfyNWrm20x4opUMvmqMyklThv9jHOKrJ5bMRMWC9dqjLMe3WhtlOHQS3/wBIJTHm FvlAbpz19Oce1XdNW0kZvJjaTy/9YHGFGPemfZywx5ZLE+hI/nSPBepF9hEDdeFLbAfwxzVWEnvc u3M3264+0Wu2NguG2/KBjoR/9amRSQ20purhgTtJBkwylvXHU0W1lcPGWSPIX0JpEsrcSnKqoJ5/ iOfr1pbPUhX7lASStI0rI2CS29OF5/KtqHU7+W3FjG0kajAGzH55zW1D4btpog0rnBxwDwfYcGrO v+FYtHVXVFXjny33DH5nJocOppdPc4W4s4nlLXOXLAZP3iQPXGahgs5ZHPlbQS3y9B0qy97pcDKr zJsLEbc4bAPcA8mux03UPCdzteza3bA+fccMPYA804wv1G5Wu0cidOu2J84FADgMwznNWkt5sLDD G0mOGwOtemC0i5uGjjWM4CFySeew9MVbNnNESsQUgYI2Y2gjuT3+mapQ1Ofn1s2eYDR9aaUL9njG epycgehJ4GPatCLQH3LvaEZbgIu7n0rsxbXcNwXunDI46ADjj60QaHZxCO5ywbqdvCj6YrRU79BT l5nL/wDCL3zStNK8eCcAsSB9PpUsfhiSRcvImP8AZGR+ZxXWeQ/Lk/JkkDv+tXpFVE8pkPP8MS7j z9T/AFpOkupTk7nPWvhGxjKi7kLHruICL6jGOtXx4asReeZFF5rEZ3N/9fitMWUUZ3ySFiVLBWIy APpV9leFond2jAQcE5OfXrT5NLsuLTdrHP3Hh+AjdNbrD/dLH73sAKujQYLeIS7Fxj+Ij07AVr3F 1aMRPqEySP1G9xkZ9KqPrujw3Kr+7ESr87oSzE+/FFtDRQb1sZ7WUEw8spg4yDg49T0p8OjTbkKR hfMOVLDHt1NFx4n02OUSwb3jBGD0z+PpUs3jK158qF34wodtgHHtmpbvoVDAzetjWTQ7gxjDDA+U gjOT3JPpQNHFwzC5Mak4RWAxxXPJ4vuljaNIUwykgMxIU1Sl8cXgI85oQM7QgX/65q9L2Zp9Qdtd PU3m0A277Ld5GGcqXPBPTr1/Cta2mudJtXeQwmRhjIG7j8a4CXxrcMPmljXJ6bOAD05OacdeuLq3 XBibac7gM8+9RO2yNaODd2ro62UmdPtAKqX9urH1xWJp+j6oZlu7i4TaeWjRPXsaxn8R3qkIrk/L gBVUDH5GoF1m/LNIsrswOQFx/hUx7g8vl0a0PSW0+R/ljdkDAcHj/ParKaXdxKACj5wowQDx2ryw 6zrkkjuZ3OQBt7ACq1zruoJxLcYJ7btpHvW3uroZxwE39tHqVzYb18q5U5ycqw6/5FVE0iWHPlEb CeVAGFzz15ry+HxTfbyGuZMdATz+prQTxRqTxmKO7AGd23gk/Wk6iGsAm/iR6XFYbGVrrHlrwCO5 6/54q6bUXA2xhQI/mwRke2e3FeXDxFrskYUTLjpkKD9OtSDxTqEGA21mBzkLgn8eaOcl5bK2lj0u WxcZBaNXJ+9xwD2GKq3VtMBGVbDE4CjoR0zgd65KLxbf3DbfIUliOK9Au7+C5sERVjhjUAsynqw6 981Lu1uZV6PIlGSMCXSp23LJkfMeXGAe/B7Vy15oV3cXfnRSJgDON2QoHpWnc69p6TqrTSSMOvJJ x+eP0pqa1pUBB8sx7sndt3En8KThrZslUJvXlMAeC5Jl82a6lQg/dhbuT+db1r4ShtwYBEZd4yXl wzD+eKvHxLo6W/kMhOW5Lpyc/StjT5Vuow+mufLB2lVbnPvQ6etkV7KS1sQ2Onf2WTFHDFlvl+YZ 9+K0WlkKeWwUDbjavABHUYxUxSOPaZGJdm3fvP8ACoprF2lE8DgyNlgSc4/SlyO2rM+ZFNLaOaL7 TIwG3K7B8xxVTFmUDpghyPmwVOT2xjipPs96g2SFmO4AMvCn16dqoieS33xyj5Rn5iD1J+lW6aas TOaT2EupIbSMLtVV52mV8Z9ME5qaG9h+zMsOyUNjdGMMpB/OqrQRylvOUSrn5VI4Oe3JrRs7WPaN 0aR/KcAcc+gxUWsF7mH/AGUupSk6aVQnrBKMHj+6f8ayLuOQZgMYVhweMdfWu6msMpv6tt+6vU/j 1rLazkaAw3CM4UZ6fMCemPXFJ3d3YaXY8wuYbm0LGJ1CjqNob69jXPoZJGy+BgEnIx/KvV7rQZYo TdR73QnBx95fw71yNzpqF2EOUbP3mBH86xcbvQE3sczGCzDnIzjB/qKttKu8RFcAZOVzk59fao7j 7ZbygKEOwEdMjnvVcvMAQCPnHT1x15qbFNovzWot4lmkDfMMjIwBmo1nmkzGp7cE8cVnzXQijVJ5 PlHTc36CnwyW8pBJLJjJwe4pNFR7mj9vYx+SQGXrg1R35fIG0Hp7UnynrnbyVwOf6U5ZflIGSOMH tWfQ0bTLXluQccAnqzcflVq+0h4IVmaQEZGSvbNZcskeAyDk9QOKUSyEEEMSDgbjx+FWmrEt2Hst uIsgsWPtgfzqOLy3OZ1Y4PBBxVoqdm0shYj+HnA96n+xSJai6JyB0AwQPfioj3DrYiurC5CCWUEx rgsMjofcdKqwRMZQsKsR94E9vzqys8zoYwQRn5if6U57m+ltzbI0YjyNw2/Nx7nrWis3roS1bYkj NzJKd8j7QCCScgE1WKywPulOeCFI71Zadja7AU2jAJAAx9MVUYR7Qq/NjPzA8nNJrWw0BwP3kgbB 5yK1I3R5FPlFdq5Vh/WsqJlcZVQoA/j9v8asvdMiiNWwp6KOgH41KqWE0tS8264OJXUhe5HPP4VU NrIJBEu0rjgKP19RTIdrgiVggxuycnPtwKmjtTEPNGW4OGHJx/OjmZd9hfPkEf2Rsbck47e+fWsC +8K6DfqZcCKRhwU+UE/StxnMwUxlt6ng4H/1s1DHiUnzlIYcBfWlfUpRVrHnV14K1S2xJZSBlJ4D cZxxn/IrBltte0tyzxSKMYYx5Kke+3+te4rLD5aoUxgEEjuarnyRu575JA7VrGs11IlT7aHDeEvF JsyLW7JeJ3wrZ5QnuQT0+lexR7SvmRsGVlyGByK4q/0fR9TiCzW5LY+/904PTBGK4+4h8ReH3K6R M8kBPET/AHgP0zXo4fMpRjyy2OTEYdSaaPZXeQAlTz6Gk8xgCF2mvJtO+IjxlYNXiKMOrgf0Nd/Z arY38IktJEfPPUbq9eGJhJaM45031RuH7oLDvyRUm5dmOgqkZgeCw7cGn5y2VYc9RxV3JJt49cCk 3EA4Iz6d6rv+7XAHf0qIOu08Y9R2/DNUvINiysjn72B360rPzgfj9PpVYOmOB6ck9aTzlBwR1/nU 2CO1mWVlkLZUDjv35qY3EoHABI55rNa4Vz8vHY1IZpsDaM560OdmtDOCV7FkTOXCgYPU80jNKOmK r7jncRg56/WkLNzk/QU3NPU0UdGTxyY7kg+v8qlyR1X8qoiQsMgnvjPPSn+cir8x56k0OXmOntYm JVj97GRyMU7jg7semfaq5dCQQMg/gc0shVRuAIxzUOoNQurJFkyNjB59xUnnqDtZazzcOpOM4xxS GdQ37xWJHOaFIbadzQZ4d3Tknn0xQJyBxxxWf5sTHrzjj2pnmuuQ20g+vao59xTNESyBirEgdee9 DSOylemT25BqASsFwfQ85pqnfw3GetJyVxWexoRvtUBgDg/QkirTuDyM8dR1/PrWOdwTgkcCrCN8 mEJOB0+lRKS0KgtbF3Y7fIoA/GoDDOJfu5HvTTICvIznjFAlK9NwHI4NJVbbFuC0LC+euFXPHB5q dXugwyF2/X/Cs/cR86MQc96erS7shgSDiq577kNO5ceWaM7tw9fp/n61Is8u0vtJ7HFU8tgmUHjg E+lSK+MBVPvg/wD6qrnFZptFrfgEt+vWozI0gAOPoTSYZsjnnHXmoiMKF7A9RVKQpp7dyXd83KBe 4OeaVnn2hcMoHBz3+lQFpEfPP1B61ObqRTuBz256YqnLUSVm0ODS42gnr/8ArpkgZ16HrjpUDahl sYI5/lTXvB1jY56Vor6GaSerexIV9OM/55odXCc4PHpVT7Sz4VjzjI9zTg0i5IPHXqDiqc9SZcsn oL8oAXB7cUu9ccZB+tVmnfu2DUbTkc4OOCR2raMmzBLQnZ356nv1qv5knQjA65B61EZpCuVIH/1q RZiOdufTmtlJ21IlG0tC4JDs5/HNM5IO4DJqskjyN8wI7mpS3BH+fyq7tEWvqSBwuDz6+lKJQX9B 61D5xJxjH4YFQr97b261d+pDd3cvlww3DOfU03zMkc//AK6rAj+9/wDro+Zhzkk01LQ1t+BO0jZz SGTI44HeqpY8FzwD0PvSn7vBPJq5dLBIs7sEAEdM49KAcNwe3FUzJyM5/Gnhtwxx+fJqXsSldErO Fb5v0pwYMcLznvUS7uinHr9KaGxzg9/xqOa+wKL6k3yjgD9etG8f3RVYDPT+tGz/ADzScrAmnqf/ 1f4Z5Ib9oygdRCrBmBUA+3PWrCCBUBnEm8k8gqqAdsCszTLm4vQrShzIRyiHdgj2zST2e5DJNDc4 35LyP8q49l60QV9WjtklE1BbTyDzBIqpg4L56H6c/rVo6LfyqrWyE9TvlYICB6D/ABrCDKhSdpnE aHOGAGT2wDyRXZR32r3lh5gecRDoTGsfB9M4JrX5ETV3foclHY6impG3kZMKQzKDu+Y/hit26QQf u5MpwctJwDVSWyuE+aSSddwyDkcjPf8A/VVhrePyCty7ucdzk/hWbWoSbbvYo2u+Mt9kluQvK5j3 KCfToPzpPKu0O+FVaQjkzPnr+fSr9tbag8IgVZDCpyHd14HsOtaFv4f1BpfMjUlWOA20dPqTVOL0 Vy0+qRSjjt44AL64kZ2P+rgjG3B9Scmql29tA4jtgIyMbvOIINdenhyApi7kuG2n/Vxuqbn/AN7B 4pP7FsJ5FhjjwDxiN92Px5zVunZGUW23oVbaPRJbZfPmcsVyyq5A46kbccVhS6rKGZLVAYVYqnyg sV9fm7121v4ZtoropfRyHDDbEy4PP8qml0CIsZNPgMYZvkEx3D8+OKHTdrlN62ucS17cSosCqnI4 O0E5P06URaUHzKVkLEHB25Bz6YOOK72O2u4rTyrmGJXQkh4hnd7eppHglu7fLNOSBgptKDI6D/PN R7NW0D2jvY4G3txGhacTOyD90Vfy9p77sAk/nWtaaZGiowslmun6CbLHB+vNdKbdAvl7ScAcBOn4 1EyzRZ+z4jIBxk4YA8YG0dTWydtSack22Xb22jlsU094YBKGDEW9uFkOOo3seB7/AKVzcenO+oeU ohDDPlw7hu59Tx/SmXVpc73RY5Seu9mJP1wMY/Gsy3sLktlBK/z8HGPzzihy5pJtEKBtz6JGgInl t0djyEO8jHbrU32JZrVbOV4winAEaBWJHdiBms+aOeRWa6iLFem1dhOD3zVJovtR3QoIeQNrYUED 3JFVLTZFQva9zZk8PWMCCUHJX5iW4IQdc5GCay7eawtrwvaNMVJB+UKPqMkYqZrbULe2EIZGEjg7 45AzDb2HWpZtCmSEXs6qGf5VUfM2ffHQfWsJIvlaNuPVdLjZnuVmtnHIXdliD04A/Oq+rXtkYwY3 ctgsfMRiwHtkd/Ws+2065tP9LhjlAjwTIy7sevXPFVru/mvJ83buSOBkgD3+UYFHO7JJD5LNWKsH luDLdHycjKuScD2wOprtNICywiLTzG7eWQcKRn3Yn+tcVBrunWl4sUuyVd2CoYFgPw/pXRjxdHfH 7LYWzxpkqvOA1a8ttX1Hez0OksluQdt40ZAb/lkcBQPzz+FTXFvp2oyA3vzrnasZyV/Ek9a53ydf mTEcRijHBcnGR7d6oT2Fwl0ttPcSKSeF5JOf0FJXuJo1pvBnhLPnNaRNnJA3FsH3FJpg8N6ddm2i sUVjgq6R5H19a1NPtIpYirdASo3tnJ9zxW9bWv2EB4ox5eMKUbn+dVKDWrIslYrXtxfy2/8AopCk gFTtxgfTOf5VzqeHtR1JRNqF4wjL5bzhsC/7oyKvXtpfNcmSGMbSpyN2Gx/tZOK4e7utUjuNkhlY rnCuCQq+o6Ci9r6HSsNG3M5HYzado9sVtZb0hM8oCD0+lSRa3o+iwJaWyvIAfkbHPPPfpXn/APpN x87SP8x5WMbf15P61qW2mWs0ewrIZegLHoP+Bdql1bDUaWtjZufFsLSMEKqcY2ZyeaoTeKrtcLCA M4A2oSc/U1SNqLOYrKxLjBK4Jz9MU6WGSZjIi+WpxtB549c+tOU7ihUSV+VEba1fqhMhkJYHAycY /CrFtDd6vDm1BYqPmZwQq59zwaYgljiMchY5OSU2j9W7VmSSuWWJWlILcqWOP0NTLzNlmE0tkac2 janZnzJnLK/UrtIH+fpWWtrDufc5wQctyCc+wrWaOaYAMhwpGNg7/gDSYkYruLKQemMmpk0zldWT W5BBZJF/qZTg8LGx71NgCU+dEr9MEP5efpkc1oTg3CKzsCR8oAUDn3A6VVSzvXR5vLYqozgMAfyJ qvaWsxxqVPhuPnvdIhjNrbQSb2VlJckBT7Edal0e5gtCzPbiRWAUgsDkfQis5ILu7UGIEgE4G0nH +FNjt7qYlUO1l75wQPpTVTW6Jqz6SZt3IUlpraPy0IPA+YAHqBxUCamlqmIYGXjhgvX3Oaq/6UFL yykgqFGMZNR28soBtpJdqkbVfBwD70230Ij5kyX97JKREqgY9ec/gMVXmvtS8z7O2EYHICgZ+tW4 oY4YcJMfm6lsH9MUyWS8iPmwxhuNu+RgSfwHQVMr20CEraWKUFzqE0/2eVSwOdygY598VF/Z0bXI BwOoYj5vyBxmnrDOVM6lwzElynGfUYzQEI+ZmkC44IbFRZ7tlS20NCGH7Nb/ADRoy5OMMNxPbjt+ dXVt9Jk+a5gBOBwGwM+grn7aWZ5TFE+7b95WPIrUljE+H3Ou05O04zWyV7GXOzqLSLS0iCCNQOCB t/zmrk2lWFzOJpLb5cjB5H4AVgWlxDAMLgkH5ckE/XNXZdQuZUMdoXJYcsRwvrzWyn0ZtGMtotmx cx6fZIDhYsA/IgyT6c85965q5e6vAzHKRDque3uKeyLCv2p5VcqPvMc/h1qA3ErxZbHPIUdPxqXJ Hq4fCcurdzNW1jbbiMFydyE9R70kr30TeXnAB+Zcc/hXYaX4evtWIuVbZEuCzdM4644/WvSrTRtM t4EnVVY84fqfxJpK7KrV4w2d2ePW3h+/1ZlYK8aEnDsMN/T+leg6Pox0iEx2m5TzvIyM47k9/aun tYYLe5JY4B6YGSD9e1aFxDGq7kXfvIy7nIyf54qnFnnTryluecX/AIpdIjDajMg43SgYAzz+Ncwd d1BZhcrIuVyCuMEqfYYr2b7FYzkme3iJxwzKOfwNY114F0y+PmREJkZLJnA98GplFnXTr0dnA4/T /GYg+W5t1wT8roehPU4NdR/wk+hNbDfLGruQfof9r2rB1P4eRQgSWlzJIQSCNuMD681ymoaLNZZi ntmAOAHLbgfyqZcyN/q1Go7Rdj2G2jsLxN8PlyjO/cuP84rLu7ado28kBtrfdH9K8stLi5tIitk0 sfbbG20ZrqrbxVrVqiRyR79pHznOcfUfzojLV3JxGW1H8OpstI674m2iQAfITzgdcj+uKIWJAJPz DkFM5Az71FHqGmXd2t1ewLDM4w0mN+B9evNdVaaRa3UQjt2RlbLK6tuOT1z6Un66HBUw9SD95WMV 4rUSFi+W+8cnAzWTc2GlyZknDPwfmQ449O/PtXTXOixEGHLO6g5BwOc4x0FZhs5Ico0JRSBk54Oe tNp2MXdWuea3GnKFe4thviBw24cjP8/wrkrvTVyfKD56nHIx/Svc1DKpjVVXacgY9un8qr3GjJdp 5yqQzcZXnmo9mZWtqz59uLdmKMYghUYyAcn160bgyAEYYn8K7vVbK6t7hoJ7cY/gYc5H9K519PaP Mjox9uCMf4isKlNrRFRqq+pjiJ1HJBx0/HrT1+UnjtjB4BxVkbVZiqhlYHIk6j6YrNkkVn8scdBn 0BNcziaqSRZEb5V4xznGB39KtXls1pAss0RVj0YHI/A9qrowUkeZlc4HHOO1SJ9mMZgujITn5dvQ e+KuK0Ksr3KaNtwwOAQcZ/xqeOSBdyykg4+Uj196eLgKRDhM9NxHaoPKkZ/Nx8ueTjIqWkybWa1L CCHcCT2HQ/0qys8cEbRRNkE8sVyffFZZKbsD5h0Hbj2qzCd3zY6dQeo/+vQi3sKsKyvhRxu5bpUv kCOLdjd3UE8j8Ki8z5wo+p9ad5ioTuA9yepp3IUbEcUSuokYDluWJNSyCESblGQM59PxpsjvgL94 DjA9KiAbJMnToB2xUyZcXfcuGRSxeIBVOABkceppkrSzN9o43HggH9apmPaFKkEE5GCKsgS5y2Ov TrTFy6CF5F+ZscccVPETISrkrnoc9fX/ADmo9uG3PwAOAOSRSB8qQqj5ux6cUoobui79naNsDofu 7OS1VpnmiyCSq4GF/HpxVZY5t6zBsAcYHUGrRnVny7d/mJ5NNWKbbNFL6cQgOFZscHoQP0/WopTa yyr9sAWMjLFCMn6e9U1ktllDMNwzkhuAR+FS3pEsplgWNIwRtVTkc1oqnQnkumyxrHhjwdq8EZaV kcJjJPOe31rzO78DXFpcltCuw5UZBb5eeuARwa9DnmupNrThSP4Djrn6ULHcSyqsKgH2wpP0zVOf kZuGh5dH4o8RaFJ5OooGxwN46/Rhwa7nSfGdhqGEkYRyZACN/Q1oXlnZvF5N0hnU9UbnGa5S78F6 LOuYTJbt19R+Rroo42UdOhjUwyseiid5vnicMD2FOZyF5GfXmvHW07xHoPzadciWMDJHQDPsf8au WnjW+trjyNajCrwSy9frxkGvSpZjF76HNOg90eqbsD9M+maMAjcSff0rlU8V6A65SU9eflPH1qwv ibQpTtFymcng9sV1rEQe0jH2UtLo3wAenp1pGBU7WJ9e9Y1vr2nXbFLaVHKjceccfU1JLqdpAw8+ aMZ6ZYdqpVI73JcHfRGsWxhQx/pSBpQ2G5GeKzF1G2b5oZEIx1Vgael7C5O1gT9aLpjUWzRiAJ3M 23sP8/8A1qmckDlh9SM1R84MODu/XFN80H7w56DHpWbfUvbQt7zvGTnqTT1kdRsIz64P+f51TE0I +9nPrTWZRznnFDauFraxL5nCHBXinLInbgeprOEsmAfTvTlkJHzgfSlJDT1NAlWIyBRsjQcAj3rJ aZQ2eg6VIsgDBlyKjkdiuZF1pFGAxxn2qYSjB54A69sVT855ECkAjP8AEOaRRHu3DIxxU6vcFuXH JkXAcj0FNE08fKNkjg471GVDHgj0BJ5FNEIbIOfXNKM1bUqVLTRkrXchHDY5H61Ml2rn5mwD2zxV VoQq47YyCaieMDnIJ659ap8rRLi1ZmsZ42GA/wA3tTvMz8pPvmsogbMgnvz3p6ykR4OCBx+n/wBe psO+upseaw43D8e9IZnzkkjJxmsxZSQNhUZ7f0p5aQkFh3ycU4qxLd9TSkuJCNuCRjqKoG4kJyCG Hp6UxrgEfMWB9qjB3YbJwDk1tTk1ozOpLaxZ8yR1BB5PHPFNaVyuWOfr7UxZ1KlFJPsfWkyhOGJ6 cmqUmkYyhdXGibawBxkHOccU15VLBlB/3gKYkcDZUNx2JPWnADBJOB6f/rrXnM4xdrEImyfvZ/Cn Kd3yb268Dr+tMMkUQ6ck9fb+tMa6VR8qD0B5rZyvbQVlct4Axk8n2pAuCQS3rgDNUTcsQP196QSu gAUkZ/GtE+grKzaLigEbgD9RTkJzgYPoMVR89lADEU4TE9cetVN6CtcuKWD5Y9c0vnEtgtjpmqJf Pr6cH8aaJARgnPrxVLvclwaLxdjgHGQOtPMwHABI747VREmME5A9KeXwMHmtYy6EOBZ83OcHjoCe CaXzMHLYPoDVYNHtOM80vJGetEZmcLlguSRwMd6cGBHt39KpOTjIOMdR61D5jk7QOOv4VpBp7FSa 3sajPhccDnvUQlBGMdc5qqXYHv1pS67sYFCZdNWLeUK7ucDofWnCQcc+35VVyB8q01Qw4z+FERN9 C0JFHP8A9bvTvOX/ACaqAkH3B/OneY3v/n8Kta6i16H/1v4ZYbDSbNmMhdGHUoSf5VWQXF7ILa28 wLgnDPkkep444q/FZRQ2jHaGkAwWZst+lbWgaXaRqkuqWwdiThJJChZexOCP1qop3dzsclaxQ0+G PzI5IJE87zAoEg3/AJbhgCtufTr68vgdQLybhtJDZ247gZxVa6urH7cy2Cw7d2EVBv24PTd3x6it 6OUDAm35ccoG2DOfQjp9K67XOdy01JG0+w01hHAwJA2v5gIJJ9TzmrlpJEkTW1vHAWkPzzFSQo9g cDPvThiG1KLHESDnMhz+nP61pWjyyOCF5HKFVU8+3bH4VMKXcFPZbluy0TU7+HZa2zt23kY3e47Y /CtHUNL1TRNJUagkMIY7QZmV3P68flUFtd6ndXWLhpwkeTkDqfQKoH86oXNhaXN+b+Yl2YgfvGJx 9ByAauUY/MfP0MRGtYpRavJHEuNwc8r+OBz9K1oxaRAQI6Ow+cSEANj1xxj8q01tLM27y3KmVFfC BiDt9uOhqqbsQP5VnEQG6lsfnWbuaRWgzbj/AEjBwAfvZz/IUqzxHDGQM/QIA2B+p71WvLPV9XYx i5lCsNjBFxgemT2xWJBZ2WlXZhGoS7l4G1gVOO2Bn8aF6kuOt0bF46u6zhz50Z+UfMV/IVmtaajf tvub9gSSxWNSoBPXNaF9eLdKtvoF3CX6yo6Ybd7H/ECqTJri4tJlMjEYLgjH1461SiuhHMpaM2bW 1eCGVjJLMETezzH5UC9Seg/xqm/iSOSBIYrhQgXZuG3bz3z1qGDRdM8lzetPJkZKkhVH4nJqHTLD w7eSsLRYyFGQqjfz75IrNp3tYvmSRDaT2M05t3neYs+0LEhx+LDH/wBauiisra1kCSStHjgRKwOP TCgnmnWyWEUhX91EVBxgd/YD/GuMurmxg1D7RCsTyo2dyscHj0FaRl3IT7Hp0mk2txaKbeTdIc7g /AUdiOeTXI33hB7uVYppXDpjIYjGDyT/AIYq5p+ofbispF3wcfuyBF9B0I9+DXTJqTqojVjgchQf vcdz1q7JspQaTdjnX8I6DA0YtJLgbR82XAJJ/L8qr6jqll4fkFrZbJZT/BJ8+B6ng5rsYYrkxm4s 47cY5YuA5/LHFZerWFo8ou9R8mFtoAcLtI/Bcdee9Ty9i05S6Hlc13LJOLtJ5C5/ulhj8Ogq7a6F qOoyiZ0wjnLyOFx9cVqz23h/fst4J52+8SSY0AP45xSXuqXtwhhQhFUACOL5Rj9SazSR10sDU+1o aq6F4Q02MyXTK0isC21clz+FXo/EWk6cnmaVajzSQApUbV9h1P5VwSCIsPtH3uu0nHHqaVdQWKdY YI2kJHzGLGQPY9B/Orc9tDsjhYQ1mze1rUvEdw4lu18hN3ynkHnoATWHc3c7wbPPkaT+8B/L1Ndx YQDULdZdT89VX5SJjnI/2eua2msrJ0KW+6IAZBKgN+vHNbwp3V7nBWxEPso8fazvpo99zNNtHPzv sAz3xkUWWpXVoP8ARbngc7Gwy5/H/Gu+n8N2OrzG4mkkmXdycnt1HFbuneE/C8eXaHec4C/McE9y D/U1Toy6M891/I88lvdRv9ouLjAPRR8ifUheT+JqwkGkW8QmuZZ7xh83lROwQEdju5/KvY4vCemS o9qlsipIoDODwAO/GTWG/gLTra5ykjBc/KOijPqetZTozWtjZTVjz6XW7OaICx04ADsG9fUjNZUe ptGHNrbvG55PJdAfUDnn611Wt32geF7kKVLyDJBBKrj8f54rkNR8U3OqJtsIxDEwy3k8E59WwP0p xw8mk7mUqsd7Dba4NvI02oJ9o3/Nzyf8OK0ZtUWZt6mOPC4WM84H0rkFlu3UI5AGc/Mcmuq8MLBd +ck4y5wvPy5HoM8/jRLDyStcIzT2W46KS31SEwQ2+DHy8jOASfYf4CqdvBDHex+YB1w2ct8vfOM1 6HF4YswoZY9ncjqcH3q49rHbptsIFBGOTwOfpkk1g4PoaxqJLUwpvEUFsGsdMgMgTA3qGC5PoCM8 VkTeJpYsr9hRpCeMk4/lmusmulthvaJAcHO0Ekn1NcPqevTTzCOz/d4yGcKNx+h7CrlO24lFX0NW K9u7kCSe2EBYEfL0P9ay7vULtZyptzleNwGOPz5rOfVZI4Ga5uXHXC8Zz+GDWbZXwQlpriRhgne6 5z9OaFGT22BNJ6mpJqEyL5To4zyxP9eagW5Zv3oJJ5wP8TUcl3bTuFYMf7ueOD3pTbxyxFLZQPlw 3ON3sKzcZJWSDnTeruIhW5QMzE7uNoPNSwWrzOEKO4Cnj0/DvVNLSSzbdFkE87en61rWa3iyLKHa Bidvy9f61km+bU0m1y3RFATbqP3QJB7qc9avPPdSHEUalV6Z4+vFQXFy0c/lSyyb+rDack+5qs07 hwA7I2QMuM4FXzbkKN0S7lm+WWEg8lSmcH61HaTW8bN9qjOwD5Sj4x+FSLFNISYZAzDkkHOKsw2H ybWLEn73Hy8+1Ci3bQ2S1KSRWYdprdipbpn/ABpDIwYpBEzt/fLACtGW3iiP7sZ4xyOFz3qSC1eO DzC6gAgBSMsT6g1rGHc66OH0uVvLcYEu5Wx8w3A5P1q39r8yEWpwiYO5Rn5setVC0BlY7dxI25bk /hWzpXhnUtVmb7JCdikB5JMhR7e5pR3sejKmoK8jLtx58/kQb5CSAqAcZ+tei6D4bZQ1xryKWTDR orZQY55x1ret9C0jw9bGW9eNZDy7lhkD0GefwrIn8a+HlCwwXCBQODgnp64FdMKHVnk4vMeZ8kNF 3O0l1SOCONJNvKYARcfl0rHF9cvIFicKp+VVTnb6ZJ615df+Nftd00dpKFQcGVwDu5/hUjOKv2UP ifWFaO2laNZBsDgBcg9hgA1nKWvK0csYvqz05ZobJt95exAHjazAZP0rVgubMx5LgrgkAc5PtzXg Mvw516UiV3QorYPzEnHc816fp1jb6eiQ3BO0AKNxwD9KuT6WBRejZ3qzwSDdGOU5PXO30/Srqw3E kXmL8gbqTxwe1cpb6vEJfLV2WNWwdvOOa25tWJb5zvXbwMHGPXAxWkW7W2KnKKd+xO9usbGOZg2D 90ZH4/T0qzb2+lqmJuHAwAORjPp9KpWt7p10N07NuPy4bIwBV6e40+IYiALZBH/66mS03ClUu72s ZV5o+iXbgeUo4+/Gu0t6H0/OuK1PwbfiMz6e6GMHjeNrDH14r0hTwGulG1jlQvORT5rhZn8osYwp OAFLY9uo5NZxpX6HbDMakFZM8Gk02/ssLdq4BbgkYH1BzyKdFLPaN5toWXH8SHB/HFe63L6fqqeV dAbOFf5ecevTiuS1jwIozJoT/LnAjkbGR7H/ABrOWGklc9jB5hTn8ehy8fizV7dlRjBKpwDxhyM+ uK7LTNe0m8YJuVGXJZJ+Dk9gTwa8ourW+tJnt5kMLqfuuOQO2OxzVWRGSLcxDgc88Emo52nqa18t hNXR7Be6AJW8+F9pbopJ2iqVzpWo6dlU6FQAvYD1rzPT/F+p6TOitIzwFsGLqRx1B7V6Vp+oaffe ZJC7zs3Lhs547HJNbLllqj5vE4SdKWquYV1cqJzHdkP8vzIvqfpWTeaLo91DgowIGdpJANdawink ZkjK44JVefz4p3kiWPyxjkZz1PHY0nDocySlrY8ivNAtgoit0AUcllOea4+70i7t5/lUsOCD6/rX t13oyggqzAYGRkAn0/8Ar1x2qaXcwyldueM98dOawnSv0JhUtdHnsEcrK6JwR1AGTz1q22nzm3+1 bkYY5AYbh74rZuNNt4YPMT90cfOyt1H0rn54hZtuX94GHB56de1YTptG0WndNkaXcccflNBFIc7d zD5sn8aiFwyJ5UTELnlRSERtu8xVGGBC980JIC4DdScZ4qGwjfsQuvmPhOueO3SryQfui7bB2xnn 8qQwGObcrZwc88H3onkhQBrVZVBBDCTnBz2qH5mlxWRI1DowJxzjt7VAJZG7AZwM9eKcxjG10XPb HahMysdm1eMk0r9yth75WQrng9OOtQmMyLl+OcD0IpA77Tkhv4eeMe9N3SD5nb0we1PS2hmpdxww 7d1CjGR147UrIr9CT6+1RnhsE9fQ08jy1DDPPUD0pyfUtSRcjhn8sbfuqeSTyKjVAFxkL647D1qJ wshG0ttwM881L5UCxHknpwM5/PpUMQzO1TGGGOv1+tOeLJC5QBe/Smq0Rj3xg59/UelOUqwYyDBx uIPYU1Etb2FfyWjBV8sSQQQMc9DSKJGXbncR16cf40CJGG9V7f560uYyhUYUk9PUY7UJdESSs8sL lZmBOMkAA8H3quz71Eee53becCpUXCbtw5wNuRn681CNyNlmGTwR0/Wht3KtpqTcCVWmk8xSRkDq APfpxTGaJwwjc4zjleT9ab5kik8ZHHPX9aF8wvt5Hfnt6dKcZ2JaTYzdGZPLLbvUMODSTQW0h/eI gYeozgD+VW/3sU25m+bHBGM8e3NSCW4lJ83Dkj7zKBx9RSsK1jPSyiXhQnP3uOc9qYLDSxKHvII5 sMTskUYPryKu73jYL8vHfOf6Ur7Hb5x8w6ehqoyYpKJnXdn4eui8MNnDGhGVXBBB7kMOcVn23g3S 7k4jhXOMkNITx7ZNdJtUNhAmcYy3QUgUQPlwMsRlhnj8KG3oXyJq5zN94I0tZFVA0fByEY8/zqsP CNhBKHVGwBgKz9x3rvI2yDEdpxyBjk1FLAiPsOAcgsCefxxmnzGTpPexzcWlWFscpDsyPmYM3+NU 7jRorqQSrPOhzhQkhI+vzZ6V2RjhUcYXIxjnk037PERufbj0HPNCqeZThbYwhZX9hmFrlmIUf6wK wHfqMZouBqi4ezuIpuBuQoR+oJx+tbcsFvEo8zOWxgH0NQR23lZEYKLnPGPzrf6zNdSVSTVrHNvc eJlfai25DHgndxVj7Z4gjOPIgY5PPmFc/gRW0wZT1PXkdanycYJz7+lS8dU7iVCN9UcrNrl1Edkt nI5zjMbKQSPam/8ACVBV/fWV2AT/AHc10zQdBgDcc5xSRwkuNqh8dDnAP4GtY4+o9BPDQu3Y56bx VaRANFHdMRzgRsD+tRnxtYKuX87733WQ9PWuxit44wfNgQHPVWzTvLjYgSRrgH7o9KP7Qn2KWFi+ pxp8c6OFDbmJ4GAp/wAKuReNtFCjErDjptI5Hqa2rvQdFupfmt03Z6MA3B9OKpHwhoeXiECAY5Yq dwz6c8fWhY6XYX1VrqCeK9DIDG6Tr3p48UaCyfNdx4JxjJyK5u5+HmnyKWs55VbPCsoYD8eDisaT 4catx9nmhcYyd2V/oav68+xk6Mux2z+KPDoHmC6Tp2Bz9MVXHi/QGby1mwOxKkY/SuUb4baukJfz It2PujJH51zl34T120PzQlwOrR/NTWOfQz+ry7Hq8PiPQZfm+1RrhuCc/wCFaMfiLR5n8qO6iZvT PNeETaLqtvCJp4JFQn0z+YFZZBHXim8ZJu9iVBLdH03FeQz/ADRMG9wc/wAqeZQ6nGOenGP6182W uo3tm4e1ldCDkbTXbWXj68hKrewrLg8kHacfTn+dawxi6ozdNbpnrJuJVYKqLnrTzevtwE9jjtXK WfjLQr5gj/u2I6SDH4Z6VurqmnTELEQxI3Lg8/Wu6FWLMlBpO7LbXCuOFxjuaYZGJ2N09feoDPEc 5DDupzUMd0vPoBgZrdLQm2m5cLFWyST9argrt+YZyR0JFJ9qQ4CjB6UxrhcbscZ71SkzOWw52UMc dPr0ppL53c9emaa8wdegGelRM2Oew/Wt4NkS2uif5tpye9IGK4OKh84sMYPNKGZVwc4z3qn5mTHl znd/Wp1cSDA79argrj3qPPzbkJx0x/n0oSdtCk2nqWi/GR6U4Sepz6VXUsowR1701X3duKvvcbjZ aFkN8mM9OM0I/wAuBVdmxwOMmlEnznP6960puy2M4yt7rZOXJPzc+9IT39sY6VCZAzk46deOlP3j IGQDjFUnbUHFEnmjBzn0pQU7H8PWokYHPbsfSlYZXj86pTT0M0TA4YZH5H1qQY2jHHtVde3NKeuM jr1FLnKcFvYnLsVG7nHHuKb5h9/zqPcQMr64NHmSerVaqW0LVNdz/9f+HG93wyrGTvHymQJuXBP8 OSM5HrXZwzRJaNBdm2UOBueZQWUegZv5153bzh5BBIWUOwxKAWHPT/Oa9MtoNPtlQyxCUnGZPLOT j8/zrogtPU62tL3NjS00KBzPCUm+XYpZOAfbjn27VrWeh3N1AoVM85O3aXwe4yRVYzwtCNkbJ2Lr 8rH2NbGnyvEFeRSpIADF+39Kqm+hM46topDQJnugjpIgDHIYgjr3xkD863V0OASMu4YGNpBXk+gp txBJeFFmxsGCI0Ybce565pTHpsa5SIhsH7xb5R9B+nNVzX6DdLqzXTT9QtrhlnIVAoACfL279M/n UT6FOqmRNrk/MFijL59iRwK520mt4mExmdsHLO2ckD+HJ5q1ca7rVy0iQT+XEf4AMbR6AjJ/Gmr3 elwlFctyZNPntmZryNYo5WG3JOBjrkDjNQeTbXMxZOVQYUAclu3Izx71y91c6lC/2gqZzn5kkBbp 0yc96yo9Y8USEyQxFV6svAXH59KzlZGEG7XOj1MLLhpt0YjPzKGbb79OtUks9MdVktlhzndyuOCP TjH41jXGp3ZnitrqFZSGyTb45z2OODW7aPHLm6ggdRgBmZAN3qKu2mxpHVak8GoWEDmCwht9wBDs Yy2PUh8cfWq/2rUpLnfaSRJHt/iG5mA6jOeK5zXdQsPM8o+bIMHeiPtX6HFS+HJ7UKYrWKBGIJBB Z3wOpwwxRCXcjka0R008mV2zIWQ/wueD7YPH61mTy2un2kzQosTspAUEKWPoCP6VrsfMhdnKxvwc lP8ADJzVXT9MnkRjPIjk5Kb1xkn047VnqmjS3u2Z5wP7WuLhpYohGo+5mRpcDuT710mmaPcFVe6S NVYbizr/AEzXfwaJd2sJeTYm4/eiGTjvkE1jazp1rdMnmTujoMqsZ+bjnleMfj+VWotPUKcHJWWp SMV/pzqLRUm/ugqVVcjngf41bvPFFhpdrt1BkWcdAi5bHfCj17ZqnLe3bW6wKzCNTjzHYMzd+Tj+ Qrnntredi6Rx7hxnb1x0Ld6Up9EejHK5W5pS3N628cS3oP8AZsXkNjG5+Wbj/vkfhWNd6gjwm5vZ d5IzuYncTngc0220PWNXmFjpMDShuGkA2hfpwB+NdPF8M/EMSCTUzDbqoyPmDufwA/nRdvRG6mqS 5UtTzsLdTN5plbHVSjkAD+tdV4a8Na7eXqyFZTbsuSJHwWB7g16BZ+CdLtohK6NcyABiWbJz7L0r rYoL6VVeRZUUjai7toA6D7pHHtW8aLS948yVealdNnPPoOl2iiJ4NzZ5UDt75+Y/lVq3trWLctlA hAQfciG7r1JPNb7f6DckXKBBgGMlvvDHUn+lc1eXNmZBHFcNv3YYwjH09qtwsjlqzbvdlHUbae7Z iPNiZR8rFhhf14qnpGnzWcbfb5/OzyCcD88+lWdRuZJZCUaTYv8AAMYzjua4u51C5hcpHbTSsOWI cKvPpThJIi19TuIb8I7Km12ycDJ/x603SpE1eYm5GzynPB5yM8exrltOllkPn31uI/8AnkgbeVPv 0ArZ+0QLIsdurq33XY4Az1yetaxr3epMafQ7+DT7aM+XazLGzkttCk8jpyOKhbTS10VmVd5bpkkY xzyayNMWS8w0E8yAcNJGC3Pplv6VviO2tiQ4Z5ScFm4X056f/Wpc12XytbHj3jjQTJqBvFDbGAGw DcVx3A5wK88knRiI1LR4G0A8ZI7cd/wr3rxVcNZ6eZNG8tWxtkmPLL7J1zn9K8BvLSVlZy6ng5Df ebNNRvojO7T1LENpbzKzzzIhB+5nlvoB/wDWqxBYWtxIWF0Yfl+XkqM98GsFUt7e3Nxe/LtXABAx UEF3FcSDIXZnOVBz+GaznSfRji7XbR2kEmqrdiK1u55WJCoqsTu9u9e6xaZNbWMS3rlXZQwGNz49 wO9eQeEda07S2WN5DADJvMygbsf3ST0Br2iyuRebJImaT5v9argqR1wBknPvilCkzoulqF3pdvHY tds5RQhbrl29doGefxrwbUDbXZaTTRNASSuZWDFj/Svqa3jWS3VLhUDSfKIgASFPqa4jXvhPfzOZ tGZCrtvEcmBx1wOpqlTV7SRlNu94nzO2myq5kJJcn77gZ/TNaBhWSILIp4HVcYBr1e8+GXi2yjSR rWJlY/eRlJ+nJH8q5+Twj4kmuDaPY3KMDu3CMBSfrmuhNJWRz8rT95HnrMIxlVaXjHXJFTWjTXGQ hO5OoB+77V6LYfDLxTqCMLO2U7Bvkd5ERFHck5qzF8L9X2ESzQMN+3fHlk98HvilJWVy6VO+u552 txcFiGTeQOvGfzrUsYtU1C4P2cEBV+83IB9OK9WsvhPgBpbmSQuwGIVC9vc13Wn+A0to1iGURScA jlj6Z9aycYWsioOVzxBNCuY5R5zAu/zscfhya000C5ncIybmY8EDkele4x+DrbT7UzyKFwSSZcYA z1zmvOtc1WeV2g0cPHlsCfAyw+h9ayShFe8ejh8HUqy91W8+g3SfBTIfNnQbiSOR+ODgV0r+AHuP llcRI/RkGPwryee+1qxkWX7ZcM27ds25wRWiPGXjK6n8172Q44SPYFXHoRzUyrxX2TshlNSMtWdw vwiu5JHmjuFSHd8iuCS2O+RVS4+HF9GjvazJJgqGGSDk8YGeffpU+k+OvF908aXsBugSAvlcNj6C vZWgvb5FVY/LZiDtGAfxPb+ta04RlfQjE1q9BpaanlGnfDy3sZxdauY8KPlhQDDDqCxP8sV2KfZI gIowwVeIwhAX8BwOK0ryytLe5V3mllbO4k4CEjtnvxUE9veX0/kW6eWm7/WZDDavOec4rZUuVNWO HE13Ukrnzp8VbK5/teOcEtG0e0A8YI655OTXmkMMKtskb6KPWvqbxh4OW80CYw7nnjdpEbrnb1Ht x1r5ha2mEmQUxkghcD8+KqnojgmtbEc6xpFhVVi/OT0A/wA+9eyfD/xAt9pg0WWUJNDxGQoVmU5z 8x7148ylpD06fMOSBir2mXUulX0d/ERvjbcAen0NVOCa3CMpRbPpF0ECGZH3HnAPOD3IrCkvvOia SZozs4PHTp+taVjd/wBv6YL+zaFEbiUAlnBHXvx9K1IfC1vs3CUknBJx1J+lYWZ2KCd1seOX/ivU 41T+zbD/AEdTgPKCWbnrwBj2rv8AS72ea0W81BCiBCzbztxxzkkZrqbzR4IrcrA3XqQOePr6Vizx xeU1rMxYNkfMMg5//VUKk0ncynJtpHKXfi7Q7ZGa3PnODhUjB6/U44FYEnxC1NciG1Tbnjcx6dOe KnuvDmnLeNb2zTKFGWkZMqT6A965XVrG9trhrdI3dByHAOD9Otc9SVRas1jZaXPRtB8a3N8RG9q6 sMjep3ID/tdK7y11JHi+Y4kZixzyOOuDXkPha+1IqNPuLV4VCfLLt+V/cnqDXXrp88N6JprjfHg7 Y1QDBPbIJzW1KbsmY82p6Qmp2ipgEgYxuDcsSOwFW4rszsPLZypwo3nH4f41w1tE8HmSKWdmI2Ak DGetbtrJePgBD9B0/p/KumFSVkmbXa1Rsal4bg1i3MVwyIf+Wbn/AFntj0/lXlUPgHUrqeSKV/kj 4WTko49OOhr2yJJZIFW4GdzZwxwR+Axmrwd7eIIihVzglR1qpYWM3zNHThczq048sXueFp4Cjjka KYjcAcEJyCOmfUVmWvgnxDaXYubSVYWDgBoyWyvqR3r0PxH4m1LTbk20+nkLjMcsjkKwPptH6Zri 5/HerJKoihiCj5cYbH+FcdepRTsla3r+p7EKGLqRu3dP0PQbnTrkxp864H3gowc9x9awL3Q59/nw Er0Lgcjj/GuYPj3VlcFUhQfe2rluPz6mus8PeK7TVZDaAujDGYp25J77fUe1aUqkJvlieRjMBWo2 qSWhXVY1VhMN3Y5GMCoXsPtCgwqpDEKd3Qdv6107m0juWWQjcQQu0ELx1/SozPGWC2eS2cblGQPr W/srI89TT2PM7rw++HA25OQTjr+Brj7vR5Y8r5RUBiuQOPwxXulyAZFgdk81gcHGeR24qgdOZTi4 YENwBjHH41zSoxvobJPRnzjfaHdo2+3jOMZ5OBisma3uYkVnjKgHrnmvetQ8PBpMIzJ1OMdQfTFc XqOgTRwNFl5QDkGTtXNUw7SuhKpujzFFk3bpCcDlecmrME8HS4DOp4GCePSrN1p1xA+2Uc+vaqiK 8bFTgDGOvGa4Zxs9Ubx11GzOm5tikDqP881A2AQV6euO9PdMEJjJ9R/ntTBF8wY5IJwQOv4VnJ3K UbCrsDb3Pscg81KrW4yrj6Z54qWYKY8Ql9ued4qELHHg5wP5Gk9NAasWjNC+FjUBgOcf1qeJkKnJ GRjaMfe9hWaCg4Gcc+xNKkzL+6jHRs807iitSw85UlsYHXb3pJJVcYXAz3z/ACqQx7QsjMpz6f1q sF3AfLjGR8p6fnUpPqU+xM8LwkA7gGHIHPH4UwlggTnAOcAc/SrJ2FN8juOOCv8AnpUJKY5B+Xof r71XoJrW1xwG47EBCnt25qWK18wYRMkeh5qLKH5SoxxhuoqMT4LGM/NkgMvPFCDl8y1cmVSCsagD jvnj1HFMKhhuKrnHykcjNMVHycFmBGT2P9asQ27TTbbYFnbjb9Oe9CVy7kkEf7tvN25xuA5DfQVW UzbhlASejA9qtOdhMUykMOuartKVxuIA7becCh6aBbQR4miPmhSc9BkZzRvkjUE8FjwM9afhSuU3 df0p6MhQBhkZyQ3T6g0vMUYsrkhnKsMgrwB2xTZmRZEABxjJI7U4kPc8DO0Y+X/GpYQu/wCUDPuf 0xRJ3FysiDkvnGMHIz/+qpXZ5pAzv7YAFNlHyncBhfTj+tEYwNqKFIAob1KjpuWMuJVkRuhHAHTH SmSiSWU3EgJfPRRgUqB0PJ5HJA7EVYSa4Qck4bnv/wDXov0ZbS3Ki7uOCD0//XS42MZGBJHerxLu Q7bcHJLdcfUVSYhZNjHg9OuPy96m10TKSWg8kEjqTjGD0+uadbKI8+aGbPAOTgVGSd3zgbcDpSKJ Q21ScE8rVLTVEyvceiMzbAG6kcdKkjID5kwcdj1phZ8nGSCMZH59Ke2xE8s7QMck5OT7U09EVG7v qDyxkfuhgdeetSqgCB92TjJxzis+WVJCBCDnA2nGeavOZ5kjRl2jGCfWhpoq/SxK0abg74APBHQ5 /GlOwAcj0PPPB7Gmqi265kAfPIB/z1qMMDIzqmzOTn/ChaoltX1RczNKCzxrx2PB49KCYZXBJPHb p+tJGs00ZkyScZ2k5/OpPs8Yco+4NjrjPNP2ehSqNajRcCBiiKBk/wAR4x+NC6isr7UjHyntwMfW omxGNoAcjkZPXj1qMM0igsir/eUHP60lBEym1azL5vkUEAYGcnkH8qkWdHjJCnB4JIxkVlJAZslQ QM9QO/41egtBgK7kccemfQ+9W4LVITnLcjk8mT5mHU7SCOlUr7w7o8o8qSKBixzlVBB/qKvXBaP5 jt/u4/rSiTfHiQZ56MMDHsaUYX1HKWpyz+HdAST/AEe2jDgZYAZHHTHWsybwnoslwsvkEbhyF+Uf lXYeU6hpEjbbg5VeeR9KsMbiZFBLbFyRnjFVGN9TF+ZzV/4O8Py237qI52jn7rD8q5+XwWTsOkXD wmM4G7Le+e2M1208MsyNGS+0EcZxk1KoeJNoAVcYGO3vijWK0LcVbU8+W78T6S5i1C3+0Iv3povm G319fzqza+JtFuvlaTy2PGJBtH59K7J/mXy2Ax0J9c1j3/hrR787WiQ88yQ8Nn8K6aeOlEyqYZNa MfDPA6kqVYcYwc0NJGTtAPrXL3HgDypUbS7llI+8JRznqMFcVE0/iawBS6tfNCnaZIiGz7+v6V30 8wg/iVjjqYGXQ6kSbmyBwB0qQyBzjBwOPxrn08RaeVCTu0L8ApIpUgn61tQGB1BRgwPI2nr+tehG vFq6Zxuk0uUc0mGG3n6/lTgzj5tufT2pn7tTxkY4FI0y9Dj0NbqaexilZalxmUKD1PT8ajjDk/Lj noSKjV1xhuccgUwSbh755BqeZ7FS11LLSIOAcemaaC7HAx6VVAZyd+OPf9KUSHbgDoeTWqkrWBXu TlsnaRjinEqDznOKrBiOePY+1LuA59KaqNIlxvqWgfnI9OlBcb8HPrUBkJbk4zTSz4745/yadxNJ XRaBHAAIzShiCSe56VTVmUcjjsfrS+aQMHpTafQksmQAGn8HkH3qvvBPJ6+350u/gD0ocrFxTJsA NjJ55p/P96qplK/N156fSm/bv9g/n/8AXpttk3S0Z//Q/idsIrZ1CKokI4GQFxj2Ga6O33QfvJW3 AcbTySD2x6CuRs57iGCS4s2WGBV+8/X6e/5VefxHexwLFFaneVA81uMj19s10mya1todIbqJmwyl QPusBxz+tJLcQmQM0m/jjdxx/T86yLRLy6jTz1I2jOxc8Z/ma1B4Sgv4gl3LJCPvZkfaM+n/ANap atuJJjYtftGiNtbQrGF4Ektx3HfCgH8zWppGo5kKzyoU4XzF5fHVjg5xjt61z0XhrR7Ldd3ETZX7 rMQ+/HoMY/Q0Ra1bWrF7exmjXoWnKxg/TPJq+ZX1HKTjex1WsixgWS4s5JJlRdwLfu2IPXO7I/Ws 601u5eMRTQiGNVzlipZz+FZzeJtNuAZJpAXC7fL2lk+lQtrlo6j7HbNO2ADtBAz7+n51aWmjIVSz sdDaTx3sj5YlTgPy2AfrxnHtUZlsLdiJHVo2OAsuFJ+gznn3rLEHiTXh9nsLNIt4wFXP49SPzrKP w/1CLbHfSomwk4jKOfxwSfpSkr7Cc72utTuGlt/OH2eHYqqAEAIUe5Nc3qeqz3chsbd5pm6SLFtW IL6Dtx7VSutJ1C7kMQuG8uJQvz5H5BRitPTPCe2dbmSeJYI1zKyggH1Bx/KrcVbQbbWjLNr4bsY4 vOm3M3X5wAB7A4/rWhAp0+MR6dalugZlwmffcef0q9qviXRrSRbbSC16QvL4Mca/7PzDP5A1Ho+p 6lqCyTXUJiUdMHAXPp3P1NZ8sYu5XM7aEkUHkktdxrHuGVWP53PsMnH6VM+qaZp+DK0yhkJMajHO ehbPX2ArPvtV+yo0tgzySScuTzHGAccH1/SvPb7SIdRuzqGoNcOSwYfeww9ugAFW2tjro4Ock3JH U3/iRrr91BJFAgzkb8sfxJ6/SqkERnYyW7o2ASSx6/8AfXWsO08KaLazrqQNyY9+QrSDk/ju4rvb KybULkNYwiGHICgnJ9zk4z+FTTp3PYoz9nH3lyowE0DX9bkFtpqOqLzJOw2AHudx4A/nXX6J8NNP gmLa+7LNuyshlYhh7DFdNNBqGk6e9jozKbpsMJbgkqAewQcZ9K8ui13WdIu2Oph7m4WQkrNI4B9g BxiuiKjFK55WKxMpzfI9D6T0+yh0tEtrJWNoi8yADd/30ferFy9nFE5iYAswIywA56cnHPvxXjvh rx7rPiC7ezu4Vt0iIjh2NuTnqDXfWltNcMzsynHqpySPoT+HFbR5Urnmyc23dmrJeQWsO0bUIAzg 9QffqSfrXCa/e+KJZBH4fWIAjmWYM4HsFHH616N/YrzJ5moSiA4z8pHGOm5jx+FYl1q+qxSLZ2SW rAHJlDHAVfQdyc06seXYFKozwa71zxRBekauqzsTjeQyKoHpt6VSGoz3pxCY7difnwC2QemNxJzX tE8VkQ+oXc0SoSxczK2Me3AryXXrrw310W5Zl3EyDaFy3+z1Y/oK45xaTHTqcy94yRd32mzEwSG4 bBG1vmQZ9s9fpUUWo67A2J9ibhkssY49ueaLaS1S3+2pdBpOggCsZOOn8Jqa30nWL+Pe+8M3RpDy c9h9Kwpt6F1LWsVZtU1CMANMGA4+VVxj8q0tO8Q3UkqafLCEeWTHmKodQB04zmqE3hzVYl+dAUXI yhyc+mKpS6ReSosCRN5jHIbd93H0reE5XJU7pnt1g6o8dtnBySe5P0AIFbUED3F20kmUXdhixGSB 0xnqfbpXM6HZi5CWt5L+9WMZdRtQAd8Hmutg06K9ulOmyRP5YGVlUjJHGd2QK1ktXYqK7vcztY0U 6nay2yBkRAGy3GD2ORXg+ueGb/TZGS5VmVmK+YPmX0Bz619YCGOCJ0umVJCwAKZdfy/rXA+JdX0r Qv8AkIxNcM3OyPao3DpnPAH0FbQ03Zzzk2fLj2cMMnlyyLgnC/JuwfxP61disrWVyiyM+cZ2rgj6 n3rb1XVIdSv5dUlSFFPHlxKVAHQDjrWNY3ETNK8COqgfKDxk/jz+db2WjMnKxbXS9PkAtnCswOVP U/rUljBq2n3ynSXkLk7VUMS2ewArK86+uW8pYVCeq8Af8Cr1/wCFVnJP4jjkCO6wozbYxkg4wMZ6 mqV30NYK+lz1HT/F2keHdOhm8XzxTX6rhoIiWKt2yAduQOv8qydZ+OsgBt9Jsy0WzbukJU4PYBTn H41leOPhfdajcnVNCVlkmdnlhkONoHfLYGfavFJ7S7hYwTArtOG7EnNQ0uqIc2le56enxX1Cdsf2 eAMcOp+ZfoWziu40D4mrOjmSGFWt48hdQmRCwPUIW6mvnJYWQbl3MQOv+f8ACiWW5k+8jYzwzDGf pV2S0CNeWrPpX/hb3hl4TbaxamMB/uxDzV+o2YBFOk+JXhTUIl+xKsccPASZfLyT1IFeHeH/AAlr 3iiQCxhYRqRumHCj3JPX6CvcNN+Hvg7wtbRaj4huJJnU7vmGFLA8ADHJzWdRR5fI6KMp1H7h12j3 XnZkiMKNJjCwsCduPXBIPvS6n4l0nT4gLuZnkjJKW6tvJPcsa4zUfFSahcv/AGRH5EJwCVIDbf6C uFu4rETtLBFv3N/rNxI5685HpXFKstoo+jw2TzSUqjXobmq+JJdTl8+881tgykCnCY9PQk96yrd3 lfzZUIdl3KjHpn6c1Qvrm6jiDQQCYZ4y21VFVm19lhWOSykU5+aRTwR7E81l12Pb9pGmraJI1J4k Z9iNmTq7FjsQemOhNbnhzwbqOtzgw7hbkZa4kAAx32+v8q8vu9Q1O+lYQtsj7x4H61WGs6vp0awW M0kjFeAhIRfYc811LCu15Hz2Jz5XcaX3n2Tp3huw0SBYdNgClcOzFvmcerkZx+XtWgyTajcSJfLD tXJWKInqOmTx69a+I7XW/FEd79oNzcrISGJMpIJHTIyBj2rrI/iZ4zt/3ct2rJ/cKKS2DwCeoFdN OPKeA8QpPmkfTl6Yr6c6bPDG0SKHAPQlfT2qW0uLG2QCFyu0/PEiHCj6mvnY/GTWAfMW2tt6jG/5 sD6LUth8W7WVPsWuwE5fJkh+bGepIJreU76Ext3Po651HSryb7KqF1ZSrEfLkHqFwB2r458a2B0T XJrW1t2SFnYwbucr2+avoHTfFvgy+SOFLwCcj92pzGV49P5Vi/EvStC1XSHmglDSWgZgyOp57g8k 4Pt+dKpS+0iZTS6ny9I07KIncAn5uOfwqImYcRkfiM/pVl0RMOpzycKM0xGKjavXqe/51l5CcrK7 O28Aa4NG1eMXg3Rz/I4J2gE/xV9Rw3WpSqJYITCBwu7GSPXvivizdvOGOT1DDt9K+mvhp4yv9fs2 0i5UeZaxqqPuGXTpznuKqlJXsy9Xpc7WHT7q6ykjOpJOMZI/M+tB0SV0Lyj5FJCt14+netWK4ktY Va5ilfL/ADEEcD1rQkls7jE0LPtU4EZ+TcP8/Wup0exUJRcddzkm0q0jdZJyik9BgLnHbnqaxbqy Vw6IiYJ+Q4JI9+K7w2kd7MJTChIz8x5bPbr7e1VDpwM3lgkFvlPOCfbH4VgqFtRVLPRHmwtpFbyY kLBGwSeAc9cVqWGnsAxn2A5/hOOP58V0N9pUw+W2lKs2Pl4yP61gXNpPCDvcqfXjr61PstbiUdLM 2IreEKWGCFwO3pVj+1LW1UvJtUAHJPGPTNca1/5oMULM4xgsPlHH9TWBMs2q28lnrNuUQthSCcsv UHA6VnOq1bQ05U+p6XbamZbr9y44GG2gcKec+tdFpl+lxhpBsy21VbgnPc5FeO6Holjp8hurLzA2 NrZYksB06115me7lVZHGQQCgPXPc1pTrNaNErV3Ot8V6fNrOmy2aGDDKNm8DIPXIIPWvmqbzbK4M FwWV4yVKYwMj619I2N/diQWqRxMuDjjB+pOT/KvJfiVZXRvIrtEXEuVeVeOV7VxY+g5Rc+x9JkWP 5J+xSvc84lgUsbhs5OCOcAf0p6b7eSO6gADoeOMkH3OaqPo84GVnAPXafmrUtLeKLJuZQ2eSMV5E XbVH1NSlKppKNkz2DQvEFpr9kbeddt3Hywz8uB3Tv+FRiJYpA0IYbQd2CQTnjntXk2namdF1eLU7 ZN3ltyp6Mp4IyfWva0vY7kLOq7BIFkUMfxxxXuYSt7SPLLc+GznBqhNSgtGV7WzmcszK5YsG5Gdv 41or9oV8yxD2Zh7mopteuAi+QAoDHIGccfhTReXVzkXJUsc8rxx6V1RpJdTzXWsr9RssMcsm52wQ cKq81jXOlCYebgr83y4H8q37aNoWNwDkZ4XGOa1YrZ5Y/NlYAnnaew61oqSTsJ+89DxnVtGkV8lQ V6EgDtXGXmkxMpKgcfhX0NqGnwCIooVgwyO3WvNdU0cw7kKgYG7J/piuLEYZdh80r2TPB7uBrW6c IMKpwN3vVNpZGlySC3YJ/Ou98Sx21vZgKSXY7SMZP61xioHb7uOOCBzXkVYJbG6vu2SQyP8AMjp1 HDZOc/yqsxV3HmAEnqM0ySSQkArke5qUohYe38q5m7o2TtqKRhiu0DPcdvamyK8bfPwQMfnTXj8t trfMTwQDjH41anjQn5d3Y4Y8fypOJPPvqQDzGTauQR1GcVdiEochfrx3qAIR8qZB6/59qQ3DGPBG 44yfTj+dCH11JHkDfwAAdQpP9elQnJAKjkHHqAKkKoYSzN1wAB7fjT2lDQLGsaLgncy53fjVcutm xylbYjkBCAhs89KRFPmBUXPY9icdMUqpGT8pJAyeeMUMFVhhsk9RjpUxW4+fmVrkxUlspkDHPYik jjeJyqEMB1OMf1qBWkIOQecHP174qRQ6xn5eg9aXN0sOzew+OSPzPKjywYZIZckH696JYs57EHHT g596iid4mV1x+HH86nkmEpBB+oOBV8yeyIUbDEnZM+YnzEcKBxx3zSZBdWYFvVTU7bbhd6nGMdu/ pTsqsm5RlRw31FZSjbc1cuxXEpBBjO3tt9KYVDu0rOfmP8qcY5Jf9WpOf4e5p1xbXMDBZUZAeVzg g+9Uk90hXaYHoVU5OOD/AI0iLLuzvIPT61LFbO67l4Hr93ih8bSWbbjv/h160PyKV3qxW81MMRgZ z1z+NKCxVvNIzjOAeOarKZAS5yeOBV2OGTa80mABjAPf1/Gmu4mJGHLZbjn5eeTSkgvlPvd8HvSb lUFlJzjHI7H0poETYIPI5Jbgf/ro5egpvqPaWeRN+3ZgY47/AIUAsfmUZOOp4qxvQoVDA45Kkdvb NVsh84yQD97oD/n6URpkqSQpVnIcMwGMnaMU9JFU/Mm7sMn+tCyKmMcbskjqMVLGsTOpLFdvPt9f pVKHQSqK9gl5UJEv3eTjoTVbzS8hjZWDFgA3TBq4yIsm4udpP8JzmnvJj7uTGTkevpk03HyH7RXs mRmK4CsDIOBwQATntT7cq1uEJBkQcsB1/Coop5ACijPzFhxntV+O+jeLy9qbiuCdoB/SojYu4y2k WWQ7/lGMnBwCamFsZSQjBs9if0zVcSrHF56+VhTxtbDD8DVR76Qk+WRyegGK0loKLS6ms0DDKvwA OCOf50gWEYGAGHOT/MgetZSz5j2vuyCTgnqKUMQ5ljJx2z7dsmheZnOV9DRLBU6NjoozmoolaRxb xDr1bO5gTSQkM3zsAAefU/h1qWPBdpI8IeRuUY6+9W9EDvcpzW4Eo3Art+9v+9+C1cuL1LgssEB8 tPvE9ceu3oKr3CzlmklYSkDrjk+lQSFghkjLKGADcc+9Qmw5V1JQbhIiFOzPIJbOf8KjEjgYO7OT 9D9alSWLyQWEjk9lweOmain2wAq5GcblIzk57EHoRTtZaFa21Gednhldv4uMYHtVdrvKjajcjB4x UlpLbXMgjiQrlvmY84+uKn+xsJWkBCgj+Acn6ihNLVk1F0GKsM8W4cHoRJ0OPoeKg80QIPs49jt6 +/FXQ1oAIgQR0OeD9eapzRvHKVMiqAMkdef6VUWr3Kilb0JvOgMRBPOOoOOaQPbYOzpgZHbI71We xtbpSJMtznj19qLW0tbZ8xKecgDnOaOVMqUtEMc28zGC4RZAykbTg/qa5O+8HyI3naJI0WTkxOSU /A16BbTQQloJYPN3DJYjBU+uRg/Wqa20gdmilZQx+VQeB6dapwXRkx8zy9r2+0Sb7JqKtg4wXJK8 f3W7/jWja6zZ30/lqdrAZweM/Q11N3ZeajW92FmDDkN/n+VeZal4YvrJjLahnjXnH8S/4/hXVQxs 6ej1OXEYeMr6WO/jbADHNSFkILev868wsvEF7ZJ5DfMAfuvniums/ENnPGGn3RE8AEZUn616dPFQ qdThnRlG2lzps7RjPT86d5mBnOc8VViu7af7sit3OCDSqVC9ec9K6U7nLKDvqXN46kgnrg+1IXjZ goBwPfrmqiSl8ADkHv2o3c4+nPStaaeqKl8NkXlO/GKduI5OPSqYcjA4BzT9xBGfXrUp6mUYvcsC TIx6Z601hu5UE46YqHkY+vSpV5+9/wDrrVSS95DVNsUMM7c/n6U/kjHT19KhHJJz+FORiy9fzqZP W4lF3JN4Aww9KPMX+7+lRs6MQozxRlfRqpJjlJJ2P//R/hvl8+OeNvPDxodzMoO0H6YGa9Hsr20e 3SUT+dtHJZAoB9M1j3VnclPLtkjZs/xA4H4Cp7Ky1iyRo38hUbgFUG4evriuw0hOyNnTdSL3LNDO NwGCV+6oHU5rZutQ0uSDb5asTj9+WY8+3Pf6VzA0mWOzEcjP5b5G2Ic/8Cq/YWr5W1igRI04Qs25 mPrtFJx0HzJ6WNKO1uIsNDvnfjKxAkqPyp02ji/XzZ4ZGYnJa4xhR75H8q257a5vI1CIyY+9wQSM fxdvzqogaKIxFmbsWBIA+o6U+RrQU3FtlIeGrBUDskbHphvkB+nelS9u4f8AQLGGKGIZ37RncPyp Es3mPlmaVRu+8oPI9Bn+lX4ra109xJLHLI0rBSysQuB60op3sKcFe7L1uszIGd+ApAAXAOfXHWsu VTEy+SPmYnaEBK1vjU7GZvKztXdt2Ect6gZzWj5E37uCCExBTkkA5I/HPSto2ewSjqc9DpWrXaPc zq0aKgAEnAGO59fpUn9iNJpv2fVH8xW6KvyZJ6dOa6lUltLQiYsYkbBWbnLH0FUb/W9PhUTpC0rA YUgd/wAQMVryRtqOKlJ8sUcvPZ+HdGtws6HzcYWPHzE+2eg98VVn+36na/LGIYDjbCP4j65xzWRJ bXtxdtc3UroWOSZOce2ea1bi4lFsTcT5RVLHaP4R6cYrktF6H09DAKnaT6dTHjt7va0YQAZAwGOD +A61plJVMRugEx92N15Y+wPXJrn5dTjuEVooJWAXDF32fTGP61PYeIrTT5g0mn73/gZpMqo9xjrS S7l1cwpRur3O307RImQ3upqzDqIAx59M9PyFTav4pOjtHlPmcbYre3QDaB0yf8muM1TxfrWpQiCI 21qn8XlktJ7c+tc1Bc3yXS3d6806p8yo7E8++TXRGooqyR87iK0qr5mze1Lx5q87FHdkkxtARQWH uTjrVLTNE1DxFdie3jmdAf30kpJ3Y6/Mf6VNbz3t1IdRWzVj/CZMEfgMV6F4Xv8AxRfhvMLW0SYC iMDp9T6/SpTcpaswpzsuWx0ml+GY9NsxGEjgcqDkjdgnvwefzroNLs76O6C3l/E3ICW8URHuCzGo EW5cBriWRgq9NgUc9ye/FUodags9USxaJ5Q/BlEO/B9MggDj610cjT0M5SR1t6bWO0KyyAqrEDax wD6nr+lc9FFBHckpgzEfIQMjH0x+tadxZvqMEkEIeKQf6t5ow5GT/CgAUn6mq8FmuhHyb+7mncnJ EyqmR6BVxke1Du02O+tn1OautAivEe31KV2jJ53AKjZ98/yrw3xPpEega1La2KnyyAyHBxj0zX1B qDztGBYWiyH7+Hwuf90f/Xr511m/m1C/lb+zIhIpKF5NzEYODgA44rGrfTUqlre3QydP13TLVFj1 MxQIoJM4OST6Y611Fr46nmHk6RAZISu0SOoBJHPAOfzzXJy3E8EeX0+1IB+8YuOPY5r1HT/ENvLZ JdfZ2iQ52bdrNt9QBwKyhFt2TKU7t9DC0++1Gcsby1kVV5X5iAc+uO1b0MaKVe4CROw3BBySOx9K ZDdwXMvm3CsyqPkWTG4fgvOasGUsBgiModxD4VQvYc84rv8AZtL3mZ05K7sdXZ3NtpttvkIeSTGE jGSFP98kj9K6jRrx5+WWONBgBFT7349eK8cl1qH7XGge3aTof3nGO3Fd9pmrxFfJ3biDxsyenXnN UqauvMyVW53F3aSzRPb2sMxgPDPIfKwo6+9fP/xA8K2NlcrqlsZHd/lKHLICB1GTmvfDrlnCBcxI 7hjhUdiW4HYE4HNUL6S21Cya31SFh5qhSFwc7vcY/nR7C0k+pr7RNSR8hXsL/Y93lBTgnv2/GsjT 5LxoW3pHH3wOTjt19fxr2Dx14R0fSLXzLOaZWcfKko3cDnqMYFeF3QnFwpScJsIJwTz9fb61ry9T mlq2jehuHhykgOOoY9APrXSaDr2oaHqMN/C5VAQCQxAKHr0I7VxovZbpQY5M9A7YyD/uio7mKwhk zcIrMAdoIyP1qlo0ZrmWi1PtBda/tCCJ9PWS681SyRxjJK+rHnA9ar3fgO38Q2Yvtcg+ySK2EMRA O3vu5ya8++EusajBYTRtO0Nu7BUjVQGb1APbNe6w3ANurQuoXqQSPlz2z1zWE5SvZHT7KLR5xpHw j8N3szxtdzM/PllFwAoGSSWG3j1zUdv8IbUXQd7x/s6ncUYLuCg8ksM9fQV3+peNNP0qMXEsyM/a BTzwPfpXjuteKdV14lbCNbaByS538sfXipqVo203PSy/KpTV5LQ9Iv8Axfa6DFFo3h+KU+UmC6bF jT2Pck9Tz7V5lqV7d6hcG6vpTLISWZpjgKCeAAOAKpJZCO2IMr7mHJ35OB1xxmq9rCysNrjnkBuT 9SO/41wSk3dyPqsLgqdH4Vr36k0UUgwt2IijDK7SRgevNV7ySxPzXEhCIcpECMt9OuBVO81ie3cl 5TIwyAAuSP1rzyW/Z7tpGWI7mPVctg+5x/KiEJN2QsRiqdJe8ejw2+p61C0tnG0irnbFFyi46ZPc /jVq38CavcMt1rrCFGOEUHdIfZVXgfU8V57p3irxRo25NHuWgXk+WPu49cY61p2vxL8aaeq/6Q7k NlGKB2JJ9SK9ClR5d1c+RxOZuq21oketP8I9AmjWUzSwiRtsceNpY46nqTWNqvwY1GGEXWnXW4AH Yko2k4PAWvTrPUNV1GxivdUDZmiUojqQwdhkknrz79K1pNL1++VJmZolDDa6ruVuenPQV18q05jl lBdEfKmp+C/F+kW4nntH8tskPGRJ3/2TXFzQ6nDhpVmAPXevBPbFfcp0+zFyYTC5fb5m/Hyg9yAe hPrVzT102RTbmIRpg5Z068ds8DNbvDJO0Hc5va6ao+ExLcR8zgAducZNSfunOSCvf5SP/wBdfcMn wx8L6kyy3NtCwbLghQG5/L8sVUHwk8Dwr5AswzZ3SSyyMMDrhQDgUTwU9NQhUUnoj4thjjVsqTuY 8+ZzjHTtSOziTBPGSSSePyr601H4KeGruJ2snuIMZEeCCCxPv6V5zd/AvVFYrY3VtIQ+PnJ5Pt1F ZTw0+xSsk2zw59pIYgEL6Ng/lUK3JtJCka8Mcnuc/lXq2pfBfxtYLvWFJR/ehkB/TiuK1Dwvr2lM W1CzuRsGclDjHrnmueScWC10Zz8mZW3OMHqOePatzwpq1/oeqpc27iIMdjv1wCeuPasR5Xmxuidy eMKp7en0rX03RNY1KTyLS2kwSOZBgfiTUxb6Gietz6v8LeJItaElvcqRcWp8uVQMg7ujYB756110 tncNGHyvJx83Xj0zXk/gLwXq+j61FqWoTIoS2KuIyWMnpnPp/SvZL6Tzj5ETEqEz7fTr3r0YrTXQ V4pc5iNNLBEzFGYrwvOP5dBUVhc3UkiteFASCxRTkqPfirMi2qx4t5BuJG5Y85PufpUkUMUeyaVk G4YBxzz35rNrXcpVb6oxNXiaAb4QWkYby5YLtrGnieS3BkRmJI3kdAevSuyuzp4RfNMj7Xxxgk56 EgdaeZ7SeMRRRxqGHBbp05z796HR0L57yumeefu44mDozc9McAdcdKyZJY5JcruJPHy5PHbiu1uL HgtA8QGcEKeSc9fpWeIVWQQ3YZQMg7umD3NctShsTKbRStRcrsIhd1I5GMc/XtVyGeGWVoI4Qnl/ MVYdSPc/41blvGxtjk2qo4wMkjtj/wCvTYLOW5TezlBkhR0Jz3P9KtUbL3SVL3i1BqUFpMXQh/lw 2wZ59qxvFM0F94eeG4Kp5ZEyuTk7gDhSO2a17jQioLgu3pliAOK53UdP3aNd2socrsOXwS2Rz9TS qUnyNM7MHUlGtFrueJtMrspk5z8uF5596a08gPyRsfp04otrBkj3qSwPtxgexq4qtkLGhxjjPT3r 5pwsfp1OMpRuZ1yks0JEu4DOeB+Qr27wxIJ9BtbgjJKFDxggqcf0ryDM3lhnCqoyRt6V6r8O7C6u NKIuMqm5jFuOMjPv716eWXc2l1PmOKKa9jGbetzX1COJTh8opHC+p/D1qvbSWqHbHk7k7k8f5Fad 5bqDtlBLLwdvI/CueuLm0huTaLHcbgm7zARs57etexKm09j46VmtDpo7kRlAu0jHTPcVa3OV813A zy/H6Vya3NvCy7oyrBsrnkn3qd9VLlo1JZSdwA9fQk0+cz5mtTXvnuSgSEg7iACR0rOmsJbmDZMA z9z7jrRG087gkhTjOWHIH51K97DATuJbb3BOM0KCe43PXQwrvwhbzhpZM8jhCP6Vwd74YW0/gI5w No7+vvXp0mqKqFoj26nv79axr69YkZ3tkH5Ox79awq0oPoVfVq54frlhJHOI4IRtxkyA8n8K5xVm t3BYj5TkA9q9vmtLR2yFkYkFjkYAx9a4fxBdaWLV/LeJnC7UTOTu/DpXl1sIrN7GyqpaNHDTbWnL kAFjk7cY5p6bmbcxVj0BbpzUcMIl+ZmAIHQ88+1OS3UuVQljzw3AGP6153I07m3NdM1IVt1fF04R cYDRc/nVNvLjkDRHIB4/D/GmRWyMnI+bGeenFTCJjGV3AE4Ix0qX6FOL6CNdKzkvGOe3Qf406GTL 7kGOedvY0+K2VgGzjHXj8+e1Ml80ZjQjAYgMPSpV2wSLM0JvnEgRjtXBxwPr2zVPLFtgHHQ//Wqa 3ljQrv3Fwcf7LU+aQPKZI1A54HODiqQ2tBqRYX5W5A70TRsSeQRj+H1okd5HLhQo6hc0gLHovX0q lC5PM9iMbGj4Hp8vTFNkt1MmUyCDgjrUzCRAdm0Pj64ojj3HMrYY8t0qeSw03cj/AHkREecDO7H9 KaWVGManBBxxzzVxEtjwSTjnj3pjhll8pcjjCn3NTa/Qu7IPJnk2w4w5wxGccUjpOWMU0nyj7o9B +NWp4pvlVvQcjrx1qaC0acP5Y+UDcQzAHj0z/SrS01He7SRQjijVMu0jLnoKe7RJLlF3ggE7jxTG +TPYYA2iopUaTEbZGTw+P8KUYbIzcnfRFssHXjC+2aXAlfasm8EZwOcfyrlpUuLecxPI2OSGJ4Pt TVkkiAaQde696uFC/UHVfY63y3C8Z4OMH1xTEjjZy33cfe285xWFYX0r3nlFl2Abie+a3Xiy4bdj PA7j8hVcttLlRemxPHEkpUBRz0J68VYljUAbQVK/pj+dXYdMj+xG8DggdNg4/wAaooGLbU6EdD3/ ADqp0HBpMlVFNadB7CMxg9XBxtHf86mt4YiWaReAOADyPWs6WUI+3POcf3jx9an84kbyDjPUnvSe trE8utmXHjhCAwISc5IJ/XFPF2QBldpHUdR+tVMEg7WJzwAByKjDID5bk/e5B60khXSY9ZoTKGAP BycnqfepZTGZMoMAZOB7/wAqimRfOHlHIOMdvwxVifyxB5chUbRnjrketEoI0he5BDBDI2SoB6gA 4P5GmyQROd/zbsnC9M/l1pY3jjxLGxcsMsMdPallkltwZQwA7P0wfSojSByfyI/s06kOG2ZIyBzz 6VcVd0WJl3EMT6E1WS4uA4nA3ZOd6jHPbmnBpBG7z849T/Kq9nbRheN7oWI2mS+cSEbf/wBdChSx IBYrzwc8VRkaJj56oScbABzV6GSRY8SMsa45CjHSiL6XG3dgrqZQzMBg9uT/AJNRyXNpK3OXYZJB 9qrKLW5n3YLEcZ7g1dUxwDayqctz64oatqJSQ2F3cMluhU+x7f8A66lSzjcPJeIHkDAgZPH0qqJW Ujoo3Z4449cetK8zMSsRYq2drE4z9R7VOt9BtqzQrNGgCIduDk46ZFTG4eIgOQSxwrKcj8cCoo4g EIbnPGegzTy0UERwA3OfoT+FVZdEPlurkrWaSRmRpRG4P3G7+uD6VSMMasCwYkHvnn8qsp++b92F 3kZ9fxOaTO1387JK/Kxx8o+gp2uwTVuW1xqBw7GHIVuueM/n61Zg+yKpExmDDuhBX8KpRsXIYndl 8AA8Ae9aBhkkhLKRtI5HT26UJO+gJ62KMkkKzvIrMVHRn7+/tQ5ikG5sct0xxj61KksUb/MqjAAB HNKJTJGsaxnqQvHUfhRdrQejWpTlhKyBwTt+6QvUfSrV5axQxo0Eu8OeeOR9aUkRtkpjrgA/dP1q IyEAPyxPBPU043SFOOt1oYmp6No2pH54k3gYz90/XjFcTfeBLhJ82DhR2DngfjXpbh5BkKFz1JAz /wDWqHbKHA35PQg9arR62Jce54Td2upadJ5d1G67TjPY49DQms3ccivHI4A7E5z+Fe6SWqzxtFcB Xwc5xkfSubuvCujXPzMmxu5jO39KScou8SZwut9zj7fxPKYz5iK5z/D8v6VfsvENrdN5UwMTE8bs YPpTL7wJdxjzdPcMpPAfggHpyK5q60bV9NybiMYAzu4YYrqpY6qnY5quGj2+49IG5sup46/pUycj Cjjv9K8qt9YuosDewUdAvQfhXT2muXDoDI4YfTDfjXb/AGpF6cpl9QulyO52RIwDnPtR5mBg+lc0 PECIzefgDcMEcnHuK0bfU7a7XdEykdD2rtpV4SVrmE8PKK1Rpswal/HtVMy989+/SnqwZcKQee1d GtjCEtXdFo89M9wKj8t/85/xpgdiCzevek8xfWodRrQzlFt3P//S/ja8q2B+1RgttB+98o56YHX8 6hht5vN8wF1bO7O3ua0FZZLXzYpIsDoYzjAHfBrFvlvZYAsMsud+WKHaT+QJr0Yq12Z8q6m8lvNd 7gw+ZhjrwSO55H6UkWmSWlyzvjcq5jKthhxyeO9U7XRLa1gF2wdixyPOYlj64BretrFRK9xGycj5 snhcfXim7PU3ou6buZIgneQz5lJP8BPUe5NaKW0wniE6YRvl29eT06dR71oadvZybm5tzhiQQhwA ew65P41YvrnS7dv3Uj3E4HyjAAHpz2GfSlGnK24TqK17GnffYLSNbeDDFASzyAKPoqjnj1JyfavL NQTXdSuWaxhZI48hAhBZz6noFWujhe+kiWG8WLcSW+UfIo9yc5NdJZ6bK7AQNEzY5PAIHpj0quVt pNmc5bSTOV8OaBcQyi81IefcA/Lklgv0HQ/nXcwz3Yy0MBjbfy0uXIx3z0GPSnQi7tJQhC/e5VWH U9h1/nVp7GwtIzc67fi3VWLLHGRIx9s56ntgVbio6o2pRcrRijn77Ubm3eaS62yjn5zgDcegw3Wu OmvJniFyLUPuIwxycnPJwKtajPHrNw10CTGgPlh2yFA7nkc+tQ2VtZ3n31JjQbjliFGehAwc/nWE m2m0fV4DL/ZJcz1f9WK7xtJEU8tIdwJ+/ucn3/p2qpqGiG6iRWG3GMSMe/bgfyrdktLK3UJAdwzl kb5FPp1wf0qxpmJbsXU/mLZwPlIwQN7+3HSsr3OnHuEKTlPUx7bwd5EG6W5j+bhk2HKk+wrj9R0r +zbk7n85Sd6gAqAO3Fe5SXdrPvaCN1bblSeQPxryLW5PDsk8iWLlrnd+9U5ZSf8Ae6Dn3rSpFct7 HxLqe/a5iWML392qKozklgpwMDrn0FdINb03TCXt7KOeVcnM7lgT7AcCsSOC8uXjhnMccK/OQAo3 AfT5j7CqeoNbpMI4cIOi99x/2qhpKNkh397V6HYJ4/u4rYp9khTJwSpGf1Hb6VteH/FniHViDFax rbsCHkiGGbbxwWOPrxXLWHhOa+Pl3MqINu/5Pn69h0Gfzr2rQtI0mx0pbSKZmaNdqxlhGWHcDI/W uvDqb0fQKtt77mtp8Eacs+c4J85t7MfQHB/TFbyyRqPIijKyH5T5a7Dz2H+ORUMV1KzM8sLhdmEB IHzexHUVFbvG07MjuWYgybQcqB0VT3zXfShze62YN8r0Ohg09I4FieG5ZmP3k5fP+9n9anvo9PsI hHBEPPA3FpB5jfgTxn1PaoIbyY20i5+bptRcsAOeWPQVyuqz6nkDTY5GbGOflUEdAM+lDsvMqEeX 3Stdy6jeSPEf3LMMbyQW5HQY4FeFeItBvtBu/OjY+VIcljyAzHt9etek2p8Qi5K66+9fM6cgLn+E Eda3b9XW233C7lBLKjDJPpgGuaVJVF2Lddpnz7cyTIiqS+4KclRjr6+v41JpWr3emeZbIiOrfOBK CNp6cEY/Ku41bV9Pjk+zX5USN963iwW9eSMYrmZE0m5kKaTau8m0by7HYp+grz3RcNma3Tk2YE+r Xs4ZGk8vJz+6/wAetZ8jPOpA3yEnG52JDfma699Ms4plk8sh8bccAH3qM29isXzIQc/KeDkg+1a+ zm92YyaTsYWnaVYSwvHLLGJGbIiReRXpPha1WCQfa2eYKMqCdox2BPevOdWaF0W0hwvGXCZHA9/f 0qtp91d2FzF5EsxUuA8ec5HoB61tFqDCMpNn0T56yMQmUQMCCowBjtk9a6W5v4E043DFFKrv8yVl VQB1YkZI/LNectodxdp+9VEXHIYndyO9SarpN/pWkSTttMaRExLnhiR3HNda5tznnK19DzHxv4gt dW1Ex2cyvGqhd4BO8jqcnk+2fyrgpbO3ZSkpOXP3QBk/WrLpLJLuIxkZLngD8BxWdIzzFRAA4DFj KxIAxxwBRttoTFPVtEdxaXFuqxRrID0ATHGfU1HHZ3DTBZFLkjGD0H512ugeGtU1vPkKUi/5aXE7 ERr65PP5V11mvhnRJmSMi6ljG3z85iJ7lVqJSSvdnVh8LOq/cRueCNMvLKEabeRiONBv82KTCHPO D9PatzxH4lt7OM6bpm0uyje+7gH0Hqa8z1DUL7VZAJnZERvlQnAI9T7VaEDN8kQCqe55Y/0wa46l XVKJ9DgspUfenqc9dQ+Jb+6E1s0SjP33w/4e1bsVrrcK7VaOYrjeo4Bz9KfHEshEYc8ZDCPG38cV eitrmW3Z5XaJF5wwKfrXNypM9uO+g61t7+eTdPb8bcFg3QenbFQ6zqltocBT5YncbeAWJ9B1Na0F pruqWzDRIJHCLtEsn3Seny5xmvIta0bVra7xqjyxOezDGc9xnrXVToKW552YZsqScaesvyLw1K2u XH7wgnofu5qm9xbu33MkHOexx3zWS1kIlwZCW756n2FTo7xQFGVUAPUjJ/nXbCmloj5KviZVZXmS Ye4lLRFwrdhx/MV6X4Bsr7TdTi1GSyku7dn8pXUcK/XPfp715Q19ItwEhLBsZ4XP5c19HeAdbubv RRp2js6yKALgumQCfvFea7MLQjJvmdjjnU5bW/4Y9dubxQ6t5JEpwQ0p43dO3OPSulknvIbNLWJo 1d1x52DhQDkhQevucVyFuNcgAaFoXGB8zjB47buRmq8WrOlwImEjSyHl0BYImeR83qatpbr8TodX V6nRQWl5LdRz3Jt59rZcknbkduuP0ruYoDPHG5aMbgMbegA9TwK8xtrk20pLyEwljJKoGWY+gB4A /OrZ1D7SVAgSOEvhWkY7gCckgcCpp1WruxTptWV7nfPawA5mIkUnEbfdwP65qvcLDFMyx+YY1G4R pwGJ45J/GsdNVghhZbUF/myrsxJJ9APQVVt75btd/mMWDYkVCMgjJxnqAa9NwbWr0OWnN3smXby8 do9gQKVwVZRuY5PQdB+dINRlkvAmnQJ8q4JIAI454qqWmeXJ2D1ZdzZ9vrV6yt5ERipYKSOdu0++ OuaycXp5De7uSSLrE8Rjmjdm4eNwB17CqGrJaQqttqEimVgNyxjJUehNb4uTEPLjY5AxuwD/AD4x 0rmJ7iOS6+0tKWUMVZMcn/P0q5c1mkDcdbf8AxJdPsmHn2EapFtKhjGMn1O481NFou6BVVozgHPq D24/+tWjfJe3UMccIWNccbh8oAPfpzUVsgiZRNIjOR82Mjj2Jwf0rjlCz7s2g2079TAt7txOLMhg 6gFj97Oee2KuvfBBhmZyoy204O7tkD+ZNWLjU5IH2WsDyEkqeNoGR155rK8vylTdGck7jFwWP1xn OO2abXL7rlcHeUNiwpuVOX+SMKe3JOPU1WfdsBwWw3EjnAH54qZorqRxcyDaFbgP94joP84qKa0l uJDIApAHCHJHtyKajZXTMPaczaaCKSK5kaK3ZSAvzSDnpyfwqZI7cTiTY0g2/KWOFz67R6Vnz6bc Y2WTrbZxuK9z6Uy3t9dso8RSo4L4bIyzAdhUqcurOiK+RuSQWvk75x8zNsyFwAKYlhYKTI+2Qgjq CT37+1W4BGY98ysxIOVbI2n9c1ekktkiV41ClVy2On0464zWqpOXzJnpdIzHgsZLdriYeUiAshx1 7Y5p1tp9pbkbfnyodV5BHfk1DPO7ussiK2PmQE/pjvTFmvLtmy7KTzlcHgds/wA6mVO+5dOavZln VbtoYPNwWI+ZkQEhc1xXi3W3i8PXNxYNsEg8lgF+bL8d66WdtQlwrBmRRyxPJz68YrxXx5rF3c3y WEIYrb/MUQcFzwM1zZg+Wk2z0cog510o7I5u1lnii8yUbgq4CE4JNZK69cm8FpJEUc8gMc549qoT 3mvQxNO1uzoDwEGfxPtV7SJL28tGuJwsTbwNqjnAHXmvlntdn30sU7qMHr1RoS3EgQyELj1bIGa9 f8IXNzLoNqZ9qqq8EZ55IrxaSB754rTczNK4jQLwck46jtX0hFottaQR26JIfLRUVWOASBg9a9bJ qUpSk10PmeLq/uQhIoSSZLSuzuOc46FRVdgpkAhTCld2F5IJ7ZNbdxawxIqQKDhN21OcfUnv7VnW 5WR9rEgEYYY5/lXvyTTXc+Mjy9TCktnuG+Xnkhs+nHFNayEcZ3gDuGJwARxW6g2KYyrlW4Axz+GO wp82nm5hCspCqcgnA59Md6mVDq0Uqz7HOWyPuLeYW7+o/wA+lZuvRaq9v5eleWGLjJl9P/112EVl 9nj2/IABtH94nPeqT6fM75ADnopOcY+lZ+xlKO1hykk9dzD0yO9SGMX6whsknYOCBxxWhJbhlOYy FwQGHzfiPSqF0/iKJFS3gilffyM4G2ujhuXQol9EUaTAZRkhSe341th8Otia9R9jGj01GtvMdByM jnqK5u+8I6TMxmVEV88dwffFetLYwlDtGT0HqfwqKDSbUgTSBUIP3m7VpUy+Ld2KOIsvU+Ydc8Pa jHdk2sWIwBjYOvrXONZ3EEjQSoyMefm9vavr280S03FpmY55yBj6VyeoeDtNubnz3fLAdXFeRWyR yd4M2+ucp81yh4RsY4BOMdKr5MUoBA5+6w616z4r8JyeSkmm7WIY5UdxXm91Z3NqWSTCvjoep+le Li8FOlKzR30avMtCtt38hjycY7VKSoUq5OSQAB0quiyvgFcDueePxpWAiHyAk9ckVySjaxtdgtxI N8aDOeWHrTFdjguuFweamDxnr2Hpjn61E0iN91sH+7j9aS2C2rQSBVUOBxj+92pI3kIJUHHXH17U gfKlu+ePSpImb5ULc9RtGM/WnGKFvoRoAy5XcMHBz1zUjOUzgnnjc3P61fdWWM+exDdQmCM/jVCW JcqckLn60+VdRcvmOTb1H502RyQNikEd/WlcEMVXu3HPApxi2kk4BPryKWz2KS00JXmflix56fjU LO7vtIyBycnODUxjRo94bnuOe3oKmCJs2tglgADjihRbQO3Qqk7yVQ4J96tQxJGB5jANuOCTz65q tMq7SeccDI46etCshwzA5HILc9acE0yW3YsS6e12rTuCydztyOtZs+i6cIwwj+7yQGOD/wABrVVm C+WrsFJBZVPX0NRyxkEOytyOT61tKNtSVbQx4bG2tAXgjCbiSSBk1obig3AMQeTg9KsFwGUbRjnt yPamS7lwcAhgSB1/lWXLfZj+0RRzzj5ISPcA84/+vTvMbAbOT1JHFIqxmQbwD9Mj9e1TtHBC3zb8 9QFwetTrYJNCSxERCU7W3c5HUfjTkSR1JBbbjof58UySZsjau32PcVVnlbOYjjHIX/8AVQo3Kva7 bLq4wokcrj0qQyKWBU5IHLd/as0TMy7Blyp57fhUe58gyNtHXdjGMe9VFdCZS6mo7HflyOwwOv1q uxiHUtu77eefr7/Sq77cjPmSkgt6mrEMquhjRSmVGC3b8TSaLk+pPdCJdn2Xeu7h93P61WlMSEkk v2w54z3wKdLG6wkzyHIAKjoKbAWtYmkQLIreoPX29a0i0yJN2RZt57hrYxwuI89Y2GRiqqIiqfNO XHGc/nirflTz4nYJtZcMO4/wqqQsDhAckj7v0odtrExi9dRLeadp/LP3RjYSMZ9qvSQxMAshDMfv D39MVRMkoXy8AjoOR+ODUiOqNh1bBHOOOfesWtbm0ZK1id1YqEj2gc44poG2Ta3Bbpk9aLeeOZWE eQeQGY59qaZHZAsgVNvJ/wBod6tuwrrVodGVweB0PX0qWKHzYyYckAjIXoPXqKgVllHmKMc4AYdR V+E/uiygHHBByP0qYrUIS00Hu1xIoj42noQOtNXyl+VV+fGM9QKdJcAx4VCMZAzx17fjSRgttU8b hnjqf/r1SdmKTa3IjIyPtjBHHLDrUy7mj3fMMnc3fOOmalhxHLksQTx84xj2FQ3se2TcWO3k47UK d3sWttBD5arkLksfu9h7GmLIWby0O5sbhn7uP/rU2SZJQFXgnrx1+nvT3tvLRXV9p6FSOfxpRtc0 vbZkSyKIwXHGfmdf04/SpI5o5EEeAmOBtz/Oq7TDlip6gDGKmVd+XTKkDg+vrmqcVuZqWpFIrBvn O4clT/8AWpX4UBRgjoAfT2qeQSFQcHk/h+tQXEZGCMc9vY0nqaN2QBElx9pbHPB7/jioZUMfQbse n/1u1OVY/KLgKrg4JJycemDVV5wCIrUFjkZ9f85qr6IhS0ZYEbRj5gAeMnP/ANerVtZPcgyRPEo/ 6aHG7HtVPypElDPknGCAffuanYMoyny9eOtNSSaZmo38ivPFdxsV3qTjGwc/iDWe5uHPlzxl1wSS ccH0q+M7+SVIHH19qQSiTKsT+POafMtzOUeiZyt1oOj6juj2CB/4SoxzXPv4OVAfstxtbP8AF0/H HSvWYYpXUTLuKrxuQcD/APXWfNYWd3di4fhh95QdoP1p8qerKg9L21PMf+EV8QRSny5I2z/EW/xF Zl5pPiCwPmSpnuWjw3+fyr1+6063aTNuzqMdC2ai+wt5Yw5c478cUlDzG1K2p5RZXmtXMbRQRTPs GSUXkAfhSx+IZ7YBZgSynDIw2n8+xrvDlLhTE0sbIT904/Pp+VM1PR7DUQGnPmP2ZeGP1PWtY1qk NpGdWz3OfstftJ/3ch2MeRk8fStP+0bX+8v5/wD165mTwXfEn7NJG3sxwf5VD/whesf9Mv8Avv8A +tXVSzKUVaUbnJPCXd1of//T/jwazhMzRQABVIVVUfKAeufWnx6cpmGCxZRnCdPxpocwv5jrhgfm yc4/Dv8AhTbvU5raEtDh84wv3R9fm/wr0U9x1I67aD5oA8bzSHGCMNKQq4HoPSoYJYI2aTeACB8q 5wx9Oc5qpIZ7g/vCjeauVIBJyO3oBTrfQprsfNKgCYU7gf0yRn8Klyu7XLpU9LW0NCaeCaFPOWXy 8kMu0DGe+f8AJrGudPvLq7C2swhtRg5RQHOP9qtl7KNG2uJ5FPyjaFGWH41pwadcHYWCR8ndnqPy OK0jKz0JjTitjCt2lhZwMzBeBvI7fWnTXt8JGWKaVA+QVQ4UEds8HjvXZQrZIxhmuFeaQcRKnBI6 89vxrShgiuvktomVlOFJ2kfTAqleWwShoeUv4a8Q3gEsVy4+XIIYhVJ/ujOSfc1mTwauZha6petP FEcLgquCRz2r257HWIt9vDGjCR/meR+R+VU5/BFhM4TUI0DcEuMdR1ANOeGk7NM6sJiI0r1HG55C kGnOxtog7MGxtQ7g5/2uOldDG1rZyJbIiJITnymOAT7888dMV297oFhptu5Zwi4PyRsFYjHJGP59 a8LuiBdeZoFuYVTLNJMBJKffLZwKipRULXZ6sM9b1VPQ9Aube5v50UQRRKByz9/cgdM1rpbu9rFB 8scaMNrjPzHuTwc15NBqGt7C5uJic5+Xbkn0zg4rb0TxXLpyv/bETkEnbJksQT65PJNONWK0R5+J xVStZS27Hf6tpKXyrDcyuyvklgxXI+g7e2Kwk8HaVHGWKyICfvcAkew9Peqsfja3gufNtLOWciPn 7o4H1NZZ8R6pqObwW+yPccbiDgVXsufd2PN5+V7XKM1nbW963lQX1wqZwcqq++PX86vz6HZaraxS x+barj/VgBmznu361q2uowZeWV03kABVxxjr1py+I5c+TDsIfIAZgpH5cUnTiluL3pCaVp9h4fI3 mW4G4M5eQ4XH4DFeh6Xq9hqKHa8EcZccIVJ6cgdT+NeP69dwT2qLcvHGq4aQnc27Hrzz+VZVjq+g aUyXGnlnl3ZDgcA98DjpVU60Vv0Ks/Q+lZtW023dreMq4bhvNVizew6fjW1DqEFrZotnGFjbG5sD cfoOwr5si8X2PnNdTNNLPtIBdfu57jJx+VOtfGWrGRnsYztz8zTtycHsBXTDEpO6Y2pNWa3PpODX 4DiKDcQx5UwnJI5+9z/SlkuZ72Yq0O8MuGdsqiDtjn864TwjrupT2ZRkBlbLkbzhVPfHXJrsIItS dQVVFGd524IVffcSQfwNdUKierMKradzRv7SPS4Rc5Xe6ABBycnuATx9a831eO4vElluGaLKFfMU jdgemOlat7qDjUHktohLIxx5pLDaO55/lXPeJ7O8121Fs8r268eYEHLccDiuKrLR2ZpFJtX1PEke 1inklX58Fg0kvJcg+taenaxZ2ivCqzoZfmcAZQHpWpD4JSKQpdTFV6lgO3v6Vo2/hfRIX+0bHnJw FLk7fy4/WuSCk9jXRavoULld22XcrxsMgltoGe/+TVC/1KG3gWO0kjZuCSvOAPU+9Y+o2r3FxJLL G28MViXcEVB2wvOahSOJSsOOvBxyBiidRrQVKOl2RmUK7eczEsc5VuT9faut8N+IdA0+5Ek6tE4U nzZELEj2POGrlblLhroNmNYcD7y4Yn8/Wuo8P+HV1FBLfEY35SMJ1z3z0x/OohNp2iU4trY9i8OX mnar5NyJF8uRyfMVdzkDthuprsNejlv7U2Fl5fl87mnUbiD1wM46elczp8a2aLAqRhIFx5ajqc+u P5V26zaZMInleMORtVYxtIU9ckkmvSpvSzZlKO/KfOesfCrXG1Jri1hM8MjYRUfaq59QfSui8OfD HTY51fxFLG+w82sJJAx6kfrg11fiPxppOiymPTVeR9u1gSXBIPXArxq+8Ralq9+fLabfISRGpKLj 6DH86ynioKWmp6FLLJ8rcny+p9E3Xh6x1SwbSViWO3aP5Y7UARoQeD16+uSa4O8+FmpBFk0uS2kR cA+aMP8AjXlF5L4ktdsMKXWSwOUmJI+mDxXUWvivxVpkayXE8oYAbYUIJIB/iArGpVjKXvKzPTwu EqU4/u6ia9DVu/h14usEF/fQRGFfmIQqWH61kDSr/d9q1KCSGMDhXBO704x0rsLf4n6mbkalfr5E aqQ3lxgEgd8tmqGo/Hi0jtGGnwq3JJkmkBYnHUoByB2FCoweqZVXM6tH+LFfI4O91K301N3yQ89M FWI9k5NT+ENe0fXtdGm6q1ztmYJGoGEZugzXm954hXVtQm1G8jld5W3MQCOT3HFdL4R8RabpWqLd XVpuTIVXdQ7KAeSoPf3rSnh4rWWp5lbOalTSHuo+3LC0jsolttPiRQgABTHC4wOmcn8a8Y+MHhGa 4sU12SRsWuRtxztbuevevbtP1zTruwhurN/MRkVgQCM8ZCkDGMVVl/spYJItQaNknB3qEDL9AGOS e3SvRdLT3Tx51PeSbPgB54ogUbkg9eTj8qqPOz/LHwDzuYck+gr0zxv4PTSLhryyBkheVtqhTuTv zg9q87nWJZN7sN3b2+lcq0HJOxClw2DhSDkA54zj3r3j4RT3sGmXckKopeUDee+OorwZnXBdn6cn 0/SvozwLaXE3hiB3OFAZx27/AF5OaqN76FRXc7PUvGtlYWvl6ncwxyv2DdgeoAyap6d4rsr+cCwM bo2QzrkFQeTnPNctrfguzvbgXE6+ZKUG2VSFyOwOOuKs6B4T/siIzFVjdsbXJyW7f/qpTqTbsVTU dO56Ot+9wW+zpvCj7wHpwPpWnJFHHJb+f8hEeW3ZYnd0AHT3rn9OtZLR0tyQzb8uR90d8nNWJUuN TvXkQn5pMqcc88AAelbW7sqnbqSGdBOILNJlkc4aR8KnXv2ArpYdP01ZfMzI7kBm8gEI7dMbu/19 Kgi0yCNJPPLMyHaVOD19PU10bjy2VdoOxFAOcY+vHpXVSlKzi2YukpSUiIXDl/IiRI1UY3dAMDsf 8aDepbxmYbnAX5euTnt3pJo7fnyhjLZGORnue9TsmnhSoYF8g8EnB9CK6owcntch7tWKK30twjTP mMDAJIAz06DnNXFncRbrdAH7u6jgHrVc/YFkj8omQHqMY+bPbFa1xbvs3pgHAC7uoz6Zq1Ftglyq yOPv9Xa8kaylPLd4xzg96ohHdvIlJAQgbiQPzNUL+C4F08qyBW5UHJNJ9ojt7UIx8zgZYAgH3zXB Ubu0jpjC0VcuxpZwmWVjIxfPIOen93OMCoWnDIYoEdWxjc5xjj0HYVjLeYJkWIAqcKzksST9c4ql rUepajpy28Fx5DE5JhAzj0BNNwb0REJRtfodJ9nFvGqBUd3O55DwD6etPkk8mQfMuSMYH3f1rl9N tb+ytvst3dSXL54klX5semfSt4bRL8yszEZOF4zXRRhZPmMKqTdycyufnX5gcjgenrSQrNcc4CqD ypOOlXbVdyn7QBHF1+fqdvYAU3+1LNW82WF/JJ4ZOmD3/OqlR01ZdKXcieKSRSyu2cfKqnH1z60n 2SXZ8wcnbwrcZ554rRWJWxJCp2lfkI69etWrgzfZkSF1BXO+TGTj8PainG+3QfNyT1XQqxoIyIgQ vHOccAmiGBEfzM/Icou7gE9c89TV5bWFrbzJcucdQe3pirtsNKiha91N0EcCk5cYC4966FQfK23Y iE/fUVHfY5PV9astP057yfzNoUrboBks/QZ7e9fNBhnmmaa4ZQzElzznJJ713HibXZ9e1SafzQLU SbbaIA7QMYzx69a46R45DtiKt2wPWvicxxjqy02R+rZJk8aFLmmvee/6EKBPurv29Bt44qrPaLET ECw3DJIHQelW/JDsC27I67T2HbuTW54e0C58Q6l9ggik8sAvcOMAqvtnua5qNOU5KEd2dmInSpwl UqKyXUvfD7wrdaleR6vjEMEu1Azcsy9/cD+de8vYxzO00xZz156fgOtWYtDtdD06OCxEccQysfJy xIHXGOfU1PHZLErGQrIpHdSD6de9feYLL1Rhy9WfkGY5hLEVXJ7djOureCKEAEKHG4bh0x2rmDE7 sUtxuUD75HU+5rpZ7OOWNodwwGzhvzwahkKrGY0PIxliDjHTitZUHuclOUbWZmL/AKMSGPOD05Iq g8z+WFBPzenYnpUkl0kU2xl3ZOScbQ34Cnlo1iAAAPBAQY4pey/l6lNvlsymU8piZsYHKA+h/GtJ JraUeWgBI9B69/8AGs2aK5fJRVBzlQRkc/41Ws59YEzLewrGm3ht4JP5dKu3LZS6kyd9jUYG23vJ gkDj1PPb3rNmubhj50h2knICjnj1q3Ms0xV2JBx94dMVDdRX32bzrcoMHIyec+4HWteRJJmPM5aN 6kkNxO7iQMT6MDxmrgvLqRfIVRtX5sKB+Z96qwG7aNBcFQzDkRDam72NXlIKhZ8YJwqg+nuKqFm7 2DmajqVxbSzuWLSDIyu/Pfrj2qnLply0hQsSyjqPet5bgonllSQgAU5wevr/ACpft0cSCNRkk846 1so3TuS3HS2p57F4Y1S0DKrPKJG3YkOduTzjocelef8AiTwJd314bmKbyiMBUxwPavZdTvdSY7NP CD5uWc881n28t9dxmLUPLPps5OPevLr4SnJckkdarP4keHt4PvbeL5pldsdQCtc/e+G79AWIB2jq p9K95bTZJJW8obgDtOT0NYut6TqFxps9vaDEpOAOOhPODXj4vKYJNxTOmhiZuynszwILJG2zng4w fXvTJBiQKPlPQ4rrH8L6wpIeBiV6EY6+vWsm60yaFvLuFkUk9jz+FfPyw7W6aO/m7FC3kJkKHHtu 7n3p7xv3x1zuHHNDWxhOUPH+3QVdlzGQQOWA/nWS2sGr3FnFwCqyOxyOM4PFMMYWILzjkg1IhHlb MkketSxWjXI+UqWA4yQKpxu0kSn5lIR+WdvBJ756e1NLLIWSYjK/KQ3WntE8chFwvl89/WggO3yg 47Z4/Wk1syovqP25wwO3GD05IFToyBtzEkkYHpzTFMgVZemTgBuePQVEhWRC7AbVPPY9aTXYuQ6S UiARj73OSP8ACnwiHZmRvmJGc/SomeNlLRn5SMAVDsBPmEAY5z1OKl1CIRJWCMCFzxxkHBA9ajMj KgALMRx7mmZjP3G+oxmnKkkgVzhWPABp3vYqUboDLIzAw43dCP4gKdl45NzEcDIHvSuF83/SD8w4 yBj+VT21otxvMBIYcnccZ+macYu9kiYq9rkJmnP73YuCM596kMrMAHYAn36VFmRpTEygLnnnk49q kZULbcHPc5pO6HNX3JJYYgch1kyMgDg/SmAbI2+QFgQFwe3vU8tlJbIGvN4GPkxzj3zVM+WTu3Ak dV9R60T7BBpLUm8sFtsx69l6A4oaOBZNyg9ByaiMkMSecjDqfl5z/hTY7xpDnaT7gY/A1NtR9Gyy ZXGfK2jIwrdKqSyMuA2C+3O3sfWrIhEiBpxxnH0qdjbRrghSAOCRyD7URfRlW01KHk3bxHY2wHnn 5hjtVm3zGcsR1wOy5PcCiWR5GAsCxGMnIx+GKTJCAync3TaRx+FJLV3KUtbA1x5RKSuxJyABjB/O iIRoA65Uk5LHnNOltpJFEgiVRgA85qa2tlmBjwM/w56f41Si9EiF3Iid8gcgA/nn6ip0tJA3lMY1 BOQT1+hqpeJfWhDS283luRtl2kx/XP6GrMXndZFzgc1p7O3xEc+6GSrJE5baoC4ySc/lSmf95uHp 81Ry+XNu2EBsjj0+lRptM3yttAYjDdT+dToW4u+hooyEq0ythuDt6/8A1qlMiNgNuVegOMHP41Xm a2VUMTOCflwefyqCCRS7PcZwDt6dT9DQ42Ypb6GhvXflWU9BjHP1/OlWdlH7sgsCcqOv1rPacuSE GfTt+vNNjhMUnnTyE9DsUdD6Z7inyruNybdkXmvmuW8tVy44yBzirKJjHmMoA6r1b8TniqRvpI3z GqhW7Yzke9KEBkVDnkHBB6e1PTQm+quWiqxt+5Qk9j/9emPG8sbrcBAc/KydePWrMUQaPYj4z8vX GTUZZYcxgYBPXsSOaLLdGqSuVIoWjYIxyCM5Hr+NWWAUgHn34x/9eqpu5AwxtPHXpj2wagubie4h byME5Az2xU2Jpy8i59rUxeWikjGTkdCKg8+OZS7Ag56mqYG37xHAHyg5/lRKFmTMxZOThB0OKS6I Up3HMVlby7UcnjJB/GrccMdtiNcMx+8QetUfOMPywZwCMc9T9aXDv8/XHUA8inELIvNG75IG0nGc jvTAXwd2Djg+tRLLlV3NkqTkCtS8vFuY0mVgdq7CpUKMexA5P4ZpuPW427ozoYIY1O35u+3vjvTj LHFJvK9+ARkVIHCjzMAFh0IyfwqJLhC6rIrEsSOvUf0q+XXRkRRdijjIMiM0APOFOVx+FVyqPIUB Tg59M1GEmO7bjbnp3qaLBUnBx0bA/Wpm9LDirvQGwY9wC/e5FSNA3Mww69Tzg/Q1A8YGNhPXvTii gkjcePu9P50JdCpy1sVpSkkil0VieGz0NMlsoZZMFAARkAHgGru6Ix+XIu0g/Lwazylw86nd8i/x dWo0tZmeumgjWZgUJtIyQc4zn/H86TyP87atebJjdGu49uuGp3n3n/PAfmaiy7lyq2ev5H//1P5E EieBBdT+QecBYzucn2zx+lR3MSXbbzl2/wCeaoAAD9QPxpS3n5u5GEKoMLyCQe5AGKz1vbVXMpnJ zjdLMQufzxXquO9hXbfLcJbSePEk/AC4UKv3VPA4XFMhubGVikXmh1O1iVY8+xwKjuNRjuFHlTRt gkEq24kfhxUKefEVghmYgngcc59AajlZSm0zQVLO3kxDuQrkn5gfx5qG2t7m4UXCbQhbKuTktjvy fz4qzJaPHFvvnG0cAAcEemQOcVvwwaNBbxvYcgj5nkbqT0Cr6fhVKk+hUH9q5n3mmQXUe+WXYu0b tmQ2fwwP1rc0Rbe2dLi2dhGi7cM3zE+o4/pVe4tmaPDglV5KjC8eh7AVQvNW0zT0C3VxbQZXgfeb HsBmuuMIqKJjJtyi+hga1421a1ne3sfLgV3KnzMyPj1Jz1PoBXOv4j8R73e3mU4AG4LtGD2AOf0r U8WX+nSWEH2JGlaT53dV27gOhLfjXKafLCiZnQ7Tw2z5mA9icDNcVStK/LzH0mCw1OVPn5UVdQ1e 9usRSSSmZyA7sT8qnsO1NMt7a2xSKUJCTtK7hubHrVPULJbl2bT0ljTO5pJ5Bng+vQVLZQRrIEnR exEnJB/pWG+5jLA3neWi7DLaW+LGO0JyOGMajAB96uanp0FqqyvJK7tjEXylsep9OaoXkbIx+y7l w2Aw6Z/PFNZNWgH2y6QsrDJk4yfTIHSlbsY43D8ijoZ/mRAEShi/RQOv44piO0pFvbedsPzOrErG D64NWgWyJldFXPGfmyfXpTkKTgm5kwMkgJjJPsKSi97nmOz1RXFjbFismGI/i3cD+VXoLWyik+0J KGZekaru/PPFGn6da+cRNDI6YyGZuV/Ad6vyz28UbW9tGoGR+8YlnP4CtLLTQFLSxTuru1a43XYk cDG1Noycc444FVkjSYb0iUYyeByKl8mQTFiu4HoDVVpL22k8yyQrg4JBJ5+vas/aJ6NAoNLcIvIi uC7rwR8px3981oaHa33iK9/s/TlMca8yyddq9z/gKoC1vLz5J9x3D/lmO/fmvR/BD3Gj2H2S2Ahk L7mLKGLDsSTk11YNRlK09hV27abno+m6fB4WtR9m3sQuNzgF2J9cZArWtNXnuCTKyxo/UKAztj04 /PiuVh1aafdbq6O248zk4Bb0Uf1rWt7Vgy8qsqttRwABj8q9RtJ8qWhzRu9ZdDc1DWUmiNvp/wAm 5drKSFY/XP59a4+HUdJhd1SRd7D5mVgw3DjHHX8KuX+mieX/AEyQLjOQc4OevTpmsf7Lplmf3YD4 O47Bj6DPNc1aD1djohKKSRbv2h8v55mIbqg6EnuTxWTNdmO2aOwKsxxjcQQD0xx/Ksu78Kvqtx9p uDI6tzy+Bj0A9BXQWHhieENFYW7IowS5XbHkepJ5IqIU59iJNJHmeoWlzLcFdR82V8csp2gfQ8U7 T7SZUZVj2YyQJTyR7d69S1HR3tnAd4t7oNvmgDA6kkZzn2NZtv4fhd2kuJ/OaVhkxBvwUccc0nhe o6cn8K0OMttPgmkZJFwVIYsV4yO2TXoWgWV9LH+4CiMgMxAB5HTPpVaeNNEQRRqGLZ8xG+vvnrVO DxcdJSWG3ieR3GEHCxIe5PrxwK10gk2axoyqP3DpNRi+xIX1J5LeNsgPHgs3r36n6V5XHPJaGaO3 mn2MxxuYkkdgM9PwpNR1C/1Z0e6uAqIMLHGOAfwqnMLOxCrO5kkJ3Z5JBP4VwVq3O9D6XAYGNO0p bl1ILZkIR38wn5z1Yj2Jq/b2kUbgZyxHygfM3Pt9PU1kz6iILVdQuJEhhJ4doyMnpgE5qhp2u6Zd 3RNu5kkORkBj9739vasXT7o9GFene2h2Zt5/9XbBkA4Mj9T9KlNotgolnYKCOPmG5z9MUui2Euo3 q6fZIZJyMhRyqj1Y9gK9NsfCFjHDJJqjiaYAx7pcBV+n0rfDYWc9YnNmGa0qC7vseAatfS3yFG+X IOE6gD3x1NcSLW0ikKoibs9QOf1rt/E2jy6BfmCb7sn+rkIwrD/ZzXE3ElsgLKQzgH5Qccduten7 NRVkj4zE4udWXNMSS9ghcjqe4z+GKDeqcNKApXOApzWSHMoy8JQjncSBVgxyOgJGM8Hv+HFJs579 DrPB/j+68Na8txdSytBI+0w5JUjPUjtivrLStX0/xHEbiFw4HRVIBGfp0r4fii/ebAvO3blhkf1r e0HVtW8JzfatJk8vc26QPyrAc81cZ20Ksnqz7iubGxtYxmGN0kXDgnJI6HivMtY+GXhfWWa7KC18 3lSTg5+nTFY/hf4nDXt1pPbMgCZa5TLITnJAz613tvbw30YkEchVSCGkUgN6/gK25Vo0UpXups8X vvhbpNpZyMsrNJv/AHbLyNv8jxXeWEZ0rSI9Kt2ZgseN3HJPJJ4rv7vSbL7OrSl03cDbzt49OwrJ uTotnEHiZjxsDNzwOp9qhxS3VilTurpnmfiC58RyNH/YUioFBDMQMjpjrWh4StNdki26pO1yJG3F 2ICqAeQO/wCVdDG2nXDFYfL28lgvc++elWd0/wAlu3lxwsu1tmNxHPp0rCFNP3mwquUVyo6DS5I9 7AMN4YoPJ+Zj/wACPH4DmtC18lrgr5+CSAUK5YA+mMc+tZOm2WnCUTKXAhO3JJHHcDGfzq1qfiO1 s08i2hCM7gs4wxGfr+ZraMNU7hKMvsm7bWLJdCQK0uOjs2WJ6YA7AVoT3CxRjcyAn7xznj/dH9a5 iK6uLyUFJZPLOCQflX6cVd8yCIyIzncCB+7x35xk/oK6ad0rLUOW/Uuxyw28rysccY/uqBnk45J9 s1bmubYRRrbReaSQ2R8q8HvnrXOXkzmMqgCZb+EbmI9yeBVe4MsJFwZFRioVVcngH2HH5VvJtGPP 71jvEnZ/vqvA3EKep/CmyXYnJtZ2KOAuwqMZ+pOa5pJlgWNonctg7nUcuT6e1a0EFs+L25WRi3V3 bAP0Ga7KMW1dMyq17XTFe0sbcKYyHZcFgfmLH/DmsuW0Yu6xRhFJ7AYAPXr/ADrqIZoCAgCDvkLk ke9KptwMygbc/MCcfStI0FLUmVZ7RPMLuw+xkENuXA5PLZJ4HFP+wS5E0ZOPT+7+HrXqSWtnc/Nh VVThWX17U1tOsvL24UMrZBxuIz1rRwtsjOm73RwEdtfKhkjXJH8LKST9PT61YgQSPtJIJJJVeeBz nvXUzWsi3AREcLhm2rx0689qsW+kiQM0mxMDeCTnb/8AXqY0ZauI5TasrHLW0X2kyMY1CB9iPn5j 6mq11otpqNzH5ilxCSSqsQuR0yBkGuqOnRQJ5KN5wDb9kY5zjpxgfjVU3X2dGh8hoieSoBJGecYo hBv40XUkk1Yns7dwgiiKlm69uB2x1pf7Pit5mheRPMA+aItll3c9O3tWdpmoaZe3JbTHEk6ZTeDt dCxx90/4Vy/jLxBbeGZSLbF1eycMjnGz/afH6DNFerTpRdSTsjTDYKrXmqcFdnek6dp1o1zqbxwo AfmJ7+nvXhXinxXHrsRsrYP9mSTOThTIR049K4bWNZ1fUZRJfTRknpEDhV78Cs2LCrulJ3O2AAMj 3+g4r4/MM8nVXJBWR+nZJwvTw7VSq+aX4ItbUBDO8ajGSp5JwP5msozyzP5YQJGMnCjlvxrXsrCG bdK64wW2ZOMk9/YVaCJLILazBkd3Cxxxrkkn8D0rwI3ufXVHFRbm+VIzLGKeWdLS2hzI/ReWJz69 hX0b4b0608NWAsyT9pkUG48oFtzH37gdgOKu6B4ft/D2ihJbaGS+lOJpH5A46KD/AJzWqIbtj8+7 cwHYAc9cZ/Svv8myP2aVWXxNfcfkXE/ETxM/q1L4E9+5FMVnlRpIyoUZVCw6j1zmq9yt3LbsHlAw PlReevfNaElqilYyd+zO7cD7elR3EkDRfZ7NNnADtgFRz3z+hzXvKk27tHyd7PQx47aONHbaxYqD knPTv25qjcyXJkVn4APC44xjitW4u7RXWGZ8OwyNgySAcYGOP61ZuREIhMEwMZAb6/zrSNJW2IlV k3bocNIksF0ZHLN2yw3bQevHSpRFcMmRhB69CR/n2rVW8tIl3S4TJC5Yg/n6e9JNLZTQ7otsjf3h 2I7DHrSnayJ1ZnNDMI8zMsYDA5znp71P5dqQABvIXG49fqcelOEM96W+0KxjHoNqZP5VZ8iGOPy4 E+VQegz78msqjV7Izje+uxmyZMoQ5IJ+TIAGB370hzJAYevOWxnB9qU27qd7AjbnljkAewp0ao6b f3jdABjaOOmD6VrCmpI0jfWRnPLMW+ZSvOxQxwcDsBVaCR3maOVcbW6cnOeQK2p7AsMEqhAwOcsA e4NUYNNi3eZODvDZJDHBx69K55U39l3NGlrzEU1sysrysCCenTbj/Co7hWgiaVAzt/CucZI5HrxW wdNmfphSem49c+gqKQETeWqgqG2uzHr9MZqqjVrXHCnJvQ5mGXUJZA5QIXAynJHPU5FSBLgSOrKF fIXaB146kjtXVJGtw2xDgqcjoBj61Zk+zQv6duBk81gqd1uBzFrHPDFiUgEHPTt9aqxvMtxtALkM c5rVvZk27YlIAJA78/Xmsp31WfcgXaQchj/d/ChtRVrgrt3Y+5hnSMyARq2DkH9OnSvP9W0y21mU W0jGGaPLq6KSrDuAenNehx2fmQnzG+bcOAT/ACNU7yAx4MMkZXjYMcj/AArkrUlUXK1obptWlF6n iGvaC2lQJM8gcO20YAAArlbiC2Qb0lZyeSACDn0r3y+06G5OLuNXQcqp5H6Vz0/hfT7iEtbgQNtz gnv6YNeFi8otJqmtDspYl2vM8jURBCF3F1XJzzn/AApkR8xMDOCc7h6/Wu6uvBtyYjNG6tk4GOpO K5Da9hM1jMSGBAZa8SthZw+NWOynOEl7rKMLBiVcFipyd3fPoaJDGqnIOCeCe31FXkkSPdHMpyeh z0x149KrTBQuQRg9655Iq/cqFDIpLHHcAdePSo40wCUckHqGGQeanCoq7k+Y9cVZQfJlFAB9f1px j5g7XKv2aVlEgT5Ou4//AFqRpIjtCbiW6hhgD2q7PG8aBMMNyhhjuDVRfKb5eGK8At1BqvZ9GN7X TLHlMqlsBCOACMZPpUTR2/UsemCAc4qbdKRuBzxyDxzULpICMqp9CvH1pKl1Q+dDYmiw3lhs56v1 qzDMRKPJXOT36Z9zUHmLgMqkYHzqfWo2j+XeuVHXAPFKKa1FJ3ehpT7JgCFRHOd2zmqgPlKI+WIz gdx7VDHLMPmUnAPGRwDRNJ5shmxzjnnqfam5Nu4tErItLNcvEYnYrGeNnWqa2MzEnK7ic4yKswz+ ahCHgDIX9elQSTxyADByO3T9R3pXbdmPsx6QsEZ5McZxgYqmZS6MEweBkdwBwCOlSRSSHJbOWzx7 VPB5cm1B8p2kNnpWadtB8ugbSYgJWcgAbcDGaY7xhCjlVyflZxk8/wAjVx7bdGpVmwOARyCPQEUS WcDjC5YgZcEZI98iqTHF6FeIzxMGVlXnBOM8d6sNEPNyOg6sTjP0qNGG1YyBuHQtkdP0pHQzEsp2 HOc9jz0oT7ocFZEqEHO44HXPpWPqtreSFTZXBiK8kAZJz7npW0sYuIwbd427lScH8zVXyHjYGQgK Ou3nI74PtTtbdE82m+pt2PijXItIXSLmRHhVsrkHIPfHPfvWSCzMzbiCxJyuBjNIgWZ/LiJfHIHQ +35Uw742InyhJxgitalecoqLexMbJ3tuOAjjbylBJYYDNzk1cPkRRfvWXcOoxk8/hVOKURrtmIXc M9+T71KsNs8YkV1yx5jGf8isI316lX2M6eOSOZJbaSRsY+Ujj6Grsdm6/LLuUjL4b17YqWXySht4 jslGGB65qjvuWmMLsGYY5OQTn8acpMuMrmi5eH5JU4IBxggH3qeKWLcBIoKj+Idce1Z7yXwKlmLA AKFY5AHetSzgtpXHnyAccgqcEVdNKTSuZydtyv5KsfnCquPr79fSmoxdjsGOOAa0Lm2tEhZrV1dT 0JbPHvWWZ2jTYcqQOCP8aVSCUrFpp6old/LXfIcj09PwqJ5pWXhc5OcGnHcil5Qp3Y5JyW/wqHfL IfMO2JP77Zz6c8Vm2VFN7Ee9Yx+9xgZ+71pSGaMPEm1GOW29W/8Ar1LFDCzERuGKnJYDvVF7xZyI 3JwrYUnPXNNSk9GhOKu7k7zIg2xZGeh45pGlDL++YjHyjAyc/wBKRoRICzAYXv1JqSMg/IFBABbA HPH86Sdpak7rQaLy3tvlbJJ4wRkj86QTSuhkt1xz8wYdBU5gWWPzCVwDnB6j3qOORosrGQAeDnkE f403EcJPsNiCgB5QGLcBhwT7U2aYOwDHaB90Ff8AOaJN0RAgYEEZJJwc0qSMpDBNxHU5yBRLoJy6 ouQxGTEhBJCjI7D3qXyzH0yeOWHOPpUYbcoUNhmOSasgxpuVvl4Od3UnH06UN7MFe2hA1wyLhAMZ 56c1OsvkrvUMP7uD2quj7uW5OPlpGRVG3Lbm43en5VXM73BtJWHyS+cGkBKgDAPQ5oSeR+dxcAc5 H9af5aCJY8gsR34/WovIUt+7wQAAxz1P40TnbTqUrWHDzZ5Rg8EcjofpRIpt5QY42kX2GT+IoECI h3Nz1OeM/TFMUyKc8nByDmktNxqz1LAZAdv7yLPO1+g9xxT8L/z8D8//AK1QPcfaSDMSRjHzHkGm eRB/eNVJq+wQbS1R/9X+LR/EGrG3MVrDhpAN8vXA9lJp1tpaazaE7N7KfmnuMlcn09/wrVj0bVJG ENpEY1Bw0jD5ef6V2ugeH4Le0VdQeQKr/NhtpLN6DBAFejGMt5A5R10MHQdKg02LyxKXCAkqihUG f61097pNzaBL6IKucbeAck1qXKW8LARrGq79ucsd3ud3B/ICq8t3I8Zt7cq8itwJDmPPvj+lbRp3 sgjNWui9b2lwzKJlPlOMSZO0Ad8fWr1xp9jCBa2Z8kqAdzZJx69DiqIv7u8ZUuD0AwsYAXK9SPX8 a2H1HUpLZ3t7fLL8pMhHPvnjn2zXoRopGEqvWxBa6es0Y33Lbc5wo/M/N/Ws6bQdK+1CURKzsctM +DwPWpol1eZB9rKpvOQqEE5z3rl/G8+sW2lyQWhmySAwhyCBznPt9MVDSir9iLc0lzMp+KRBIh0/ ThDIyHeTJIOMeij0rzZ7V5V3iWNMjqCB/Osa3t2lJZlbHAbnHB9ae8BB8mNU+o5wK8mu7vmPocFm HsockY3LitZ27pDJPFJgZ5Oc1b1S9a7gjhs/IiH8bqcuSe3XA/CsSO0E7bevGMYz+lTW+ki0YcBS 3OM5P4+lZxvY74Y72jScepYC3G4xOyvkA8Zz+Vdj4cvkUNaTxSMPvbDhRx1471zkUTF9kKO2eR0U f41o6fJqkNwJghGCCXYgA/jgUUmtzsxNJSg4s6TVtM0qSEz+SIIk/edOv/ARnNcPE0V7IRpkDtzj LrtyPXHWvWtMguNajeV/KBDhUXPOT1Ix1HvWtH4UliDOfLR1Oc4ySo9+lb+x5n7p8nVTg7TVmeYW +i6o5IlQBT2Bzg9+Pp6100Ph3S4k3NG5bBTJPAb2ru/7EghVZEmaV8/wY4LGsuS1t5ZzDNBOzo2w BiduO/HSuiGFXUxVXU4K48OWavumlcAn5UJAHHbitHT/AA8J9lo9v5qFiV+fAHc5ArqWsljUTQQo AhyARjj2yD2rUig85l8lUB2nIVthXPpk8mnDCq+hLvKLszGttEjWIx2scarGx3KqnA9x611dhp1k InNxEEK/MzyKVUgfiSfyrPmjv2lC6dLcb4xgHoAOhyeKin1N4yFeWTbu2tJ2PrliP1rphZSaZLqJ cuups+VBJ5kQhh8rO4uVK5x3z1zUQ0m8Z/tUkkcSbgyqG5YdBxgnFXVu4nX7WHHlIVxty2cDjGeK 3oLLTNRWOSOYpl/lWMEOSevyj+Z/KuqcdUjnpVnyts4iexv7mIh8qgb7xGMkeg5qjBLaeZLJOPMX cAqSDbkjrj/CvWJNNt7OQtcpNNIDwB8qgHoM5/MmsqHQntUGoakyS7srHCsedue+49/85qVhpt+6 dUpRfvPSxDp+nXZj+0iCPdKoEcYX5VTOATknk1ag0aY3IkvLmNohuLQhsbceo4HJq/aB2Zk2/ZvM AR5XO6RlHACqvArlNWisraSaKKcWyAFmYc7iPXryarkcX7wPlk+aDuc34jt7KC+XaY4wXyQcsx+m OBXM3fiHSdGOyIkyjJCgZ9hmuS8SeIbJJ86dK86r/rZJgcbu+0DGfxriSZ7pfNdHcMcBs44H5Zrl q4214xO7D5c3rM1Ne8V32qTeTD0LDYFwgHuSTk/yrKjuP3W1jukYkMXbjPoMVUa0Kho42dUYAuSo JIHYH0pzQwQRxvZtvduZFcHj2GP1rzpKUldnqUXGErGwuoXFtYlrJUZicHAwoA9e5rKhvdSk1GO6 nmL4dS0YjGCAelb1stxPHvkCgKAcDOMD2FbFpbvNLHb2n72WRjtCJu5/HFYxj710epUpOVnzNIr+ J3g8STxC4iXMQ2RgMQAPTZzzmp9E8DTMQWV4UP3m2nefpXsfhvwPbWD/AG/Vg91cjDDAxGnsuOpH vXo7WNmbUXLBI14baQCVA9BXsQwM5NzqPzPmsRjqdL3aG/dnF6Ra6ZosKWunIItwzO5JMjY9u/vW rNc3dxH51qrMoz5ZdQgyf7xzXS3dpE0TbdhG3Ij2ruOe5Y89O3Sufa0uQVitYlVGxs8xtxb3IOFA /CuqNoaPQ8tOc5a6mSfCFz4ls/I1q2WT5gqNG+XBwcnLdB/OvM9V+D1jaufJunGGxhwHOfTgdK+h rKS6uZGhi+Zok/1gGEQDrgDH4VTu7d5YpJIx5bFdi7sEfUZ7mt40ovV6kySi7pHyTqnw91dVT+z4 PtiqSBJEMc9yf6VmXHgfxbZIJ5bSRi3RR8xH1x0r60WOS3QQxzFI1GSOQPc8CrURN1byLFIsu7sN y4x6tWX1ZOTCpF20Vj5Ji+HniOa5to5FETOclZG6Adc4r2FPh/YRWqS6ztuTwTwAoA9T0ANd6sj6 aDIkaCbIy8hLcnr24/CuY1C90bXZm0+a4SaVl2ywo5Ofwzxg1EYRWlw5ny3saWmnQ9OtxFaxwG2x ujEY3EHOOo6mtaXWXnwiFc5wS/XH04AAqlp/hy1ithZWzKCIyGCdV5x9KS60lQB8p3IRhs5JHbOB ShSl3sXeNrOOwtyZQqSyscKSSF4Untx6Cs+50mK4QF2cBjndHyGOP0FasOnXDbZZg2U3ZYjJyBwB nr/KrdsXgCqyKgH94jGeuR2+vFNU3azZDlrocpaeHsyLK4cEEkLnjHbI9a0Li4vtP0qRoowsvLKp GckDgZPar99qsSI00e2JmPOMrnnGazbu5WWAyToFjHy4U5ZjkdPp3onSSsxxle6PE28R+NJrxpmn lTJ/1SINgH0A5r0nw5H4klJudWZbhcjy/l2Kgx0HTJJp0uo21vc4iRCIlDGMAE8c8Z65re0XVG1m yXUpw8UbEhA/qvcDvWGHpKLcXI0qSuuaK0NFo9Riy5mOCoJgjOAuPU//AK60LaMBf3uZC3Ks5ztP XNRyzGKQqQWQYJ4x15A/zmorWWQqyyjcWbgAkYznqe/pXoUIrmRw1JSVy/L9ulOHYdfvKM4GeoAq k0SW05lLS5ADBpFByfYevrV4Tzpbi3t41iXhiwPXvUcVq4P70LhgWZz1U9hj/Ct5NPUrlly2kzSt bpJVHmSuyseC4wT646Vdk/0hY7aJnJRskRrkY/Guee9so52SNZLiUkYG3IXHbIwK3Ge4SHdwmSMo oyzZ6hR/Ouqko6NoxcG4uL1OijtDbqFlYAONmSRlfwX1+tX5reG2AeZot5AJBPb2HJPpXCNfQook uJZCy/MQOMAcAYFXYZ5bkma0UBixbLjLH6GuiMuTUzqbtI61LQXEoijLFg3HlqSM9/pWzFCtg/lh EQHBIkfkk9fWuOj1a7jkMM12sOGy3ljLH2wM5NKNev1uW/suzfG0Zlujl/dscKue1awqpuw42glI 6a9iVCbq8uNqddigKCeh5rGfWLeOBo9PjV5X3AOR+7B7Z7n8qzNUXUZkSTMR43sXY8L3xjP4Vfki VLeDyUY4GCMnqec10SatZE8k5XEg1DWbpBHdzIvybT5agfL3xigrY24kaRmkWMfN5pJKEDPYgDtT /NRLgLuSAsudh+ZyfXvgkCpLiCwtrcvqToyP8pVzkuDwc4/wrnUNGludlKUHeM7nh+tePbpp5NO8 ORW0ULH57hEBlZueAT0A9zk15pcXwWSTzt7vIf8AWE5JI9TXpmq+Are2mubzS7qFICS8duVO9zjO A3T2ryK9s9ZggM89rLbRZ5klQ+vTJr4HMMNiFJurH/I/VMnxWCVNRw8lf8WRyhZWADfOOeBjrVu2 iihk3TBioyd27j8ary3f2nbbWqBiDgFR8xzwMCu60j4bazeINR1N0gjA3tbtzIVHbHbPvXDhsBUq u1NXPRxeb0sMuetoY2iaLc+KNSbT7NghC5Z+WAHYV7f4c+H9xoblraV1cphpyBuAHXHoCeK3tBjs 7CJI9MhiXyyEZVwCuR37k/jV+K81b7W091LEY9uxY8bSMcgk96+8yvIadBKUrOR+W59xVUxkm7tR 6JaX9Sx/Z9yjqZJCz4B9ecfpUy23zbi5zjaOPm5+v+FKuoBZSvMhUlyo53fnx+tIb0youEWMMxBX OWGOe3ANfR06Ld7ny85qMdCW5EcUZAbLkHpzngVzsNvctuyzNuXaFYjAOO471bch5Nm5h8pG3jHf miJbqP8Ad2ieY47kknJ9z3+tVUp6biozcmzGudO8kMWl3leVYHjJ7e/0qOW3eU72yMLg7z6+wNX2 tb15FEu47V4z0De/0pPsjRjH3QOCy9z3wTUuSvZO5sou2xx2r+HbfV7ZLe/XzFBJBJ2/iMGs3RPD MWiIyWcjhGwSDliD07120tmvl+YFLMxwMn+nSqksaxL5cjBSTlvc9hn047V51TBw5ue2pteSjYbN CTGGlLPhclmJIznPToDQLpRB5krMVcBiFHUdBinG+CKPsql8jngjPr1z3qtM7CRVxlioBx3J7c84 FKysZOF7O5blvIwPKSPA2nJ6nOOOTWasM3yo5JUtnbnGeOua1IVlkHlOSoJPyjkj3NVnS4SVtgCg 5AYknnvVOPY05vdYuQwGAM7uAOPzqq19I0m0KqtgjOM4/wA/Sj7JLEDlm4YOxY4GO3WmrEqwCZRt GSA2Dn65NVCF+lgU1fYe8V1IAxTKqCELHH41nQRZfddY+XnI4BY+ma1EMrYZSAv95u+KozSszpBh mBJ6dKJYdct+xjRqyk2kIpUKyoy7mHU87R6Ut1dWyIItzM/3c/56jiq1x50ZDQFM45BXIOBwM9aa kMd5AJr4DeOgHQDt0FZaJ8li25RiQOwMSlSo3DgAnIPvUi2GoxwmaLbuYbTv649PerkdvBGxZEKb huLDn+fSnMJfMyC5UNtQHnj1olRWqZo6ltLWZgJHcW5LzlW3fwqOMCppEgCAxnk8kGtWceWCfQnq PT0qrEiXETbzjHK4Ayf8/WpVPRImdRXstTLiSSdjHvUEEDd0xiiWJjcGRtxK8dMj/wCvVwSW1uD5 S737H36c471UN3KF3FRlGOSffpWc7LcOZt8q7GY+nXDxu8Tk7gdgwAP0rx3X9F1TT5ze6rhskfvF wMema9tilMgdpGxwcY4xnpWdf2cN5atZz4lWUgFWOcY75rz8ZgFWhy32OrD1PZ7o+fJOWDKVJ9T/ AFpbiKDeA3YDGP1rvrzwcbdvNsm3N0KsATj+VclqVk1rJmYEH7pPvXydbBypO0ker7TmXumV5QUb 8hQeMDpn0qMwKsQ8xmbknHt26VM52ICuOxwf50zeUOCCM88niuO9nZFNXVybKhB8xx0+ao7iJIT5 qHORk4HIPTFRlm5XCc85HWlaCdiNh56jPQe1Ja6Ilp3ImJyHXnjk+lOmQJDmFQ3Rs5INOEFyjEqc +vHGasxS70DPgt0PHX61SZXyKUYmzmZQAQSPTHapTCwZcgYfjIOTWlJqKyqY4FAVfvgevsDUcVjd ToXhXjqORzV8jbJ5kJLpdwuLgqSMHkcj9KpBVaP5FwcdfT2xVyC/urRj5cjo3TYeQfwNNnvHvDid Iwe0gGGz6HFSkinFooiAbtynryfUZ7VLFsZiGJPPPrTZnEfyhSPm+96VMrzTlTEpfapLNgZB9azb 7lKOqaIZbeISosRZvr29jU0flx7jGuORuHr71SMju2xQxA6896srKSpiUAjjnPJ5pOJV7MlW4bbg 8AEAAcfmKIrhVnEkqZTG3AJUnPfNVnBLEIucn7oPPTrj6U3Zsi3sTk4wuO3r9aanbUjleyLUrL5m 2EHYf7x9/alihjjzIrEAc7QOOvrVJQsn3gw7ZH6mrhdo4mG8FTgEDODj+RpqS6hJ6WRDKUD5fowI Vl4/KnxJtADFgBk89/T65poKHhM4HU4zSPublT8uc/5FStXc03tcleaOMDYpU9iO9aGm30fmOt7B HdKy4UMxBHuMVkxQPLL8gVQAQFzkZ9eatWkcbnbCyBguDuOPmHv705akfCQyLECVVdhVv9W3OBTp YpNuVbBA4I6fQ/SoZLq4ncs+SVBVV6nj3qzDcgKfMAQ7RgjH5kVei0DlbsytGpA3KCXJ+b/JqfZA y75c5zxjoKhjnwQwXn7wYDp75qWVw7q04BLZPYA+/wBamQou7I1njCeXOeAfers99bTwLJBGNueS fUduOorOODK0OPlGCSR37U54cRHcwCnPbv7U4rQvld9xXltQxltx5bA4Mec8+1VJLpPlWTfzyo7f Sgs4w8a59COOPpV5JvKIZkVlGDukA9aymzSOjsSW8lsgE0wOc4x6n0P0p00iTjK7hk4wcYpIgwZ5 JAhWQ/dPQfT0qBUeBS6SKRvx0BJ/A9KdOndtBJ2srkpiMLs5IzxyOKgZIgvnSBcrz+ff1q0y5gEj EFTySOCRUIj3IXkCpg/KOQcVfJbcyqK+xVkLzKFCDb13DuPpUixtbx7lO7Iz83arEbbI/nxtB69O M1WCteOY0B25GSOMfWsnHbQqNRbDZLgNGdgw38J64NIqvuDXKknqQOP0rREEMKmGHIx83mHkVVmj B7u655Y9fw//AF1pYTb3ZMwiOWO1cdO/X1qwsYkiaNyAeCCOjex9KiaCNYgkIb7pJw3JPrSRQOkJ JfLdVXvj071CtsUvMinths3IxAyPm+nrU8fnlQhPmEckAZ9s81EVzgxk7c55zwfSr8aK0PmqCrAj p3zWqpu3cHe9kU5PlUMvBPYZBHsc09JXkQRgLnqMn8yTUd24jjJjYk8ZZvrUltNEq/OSxOCTtzj6 VNtjOUVfcvfZm8nMu1lPXPtVdzJs2gAdua0HtY/s3nJOM5/1R4znistpSJiobeOxPY0WurmySSuN iZ2kKTHB28EjipooggIIz7H1PcGplSR8eb0Y9fSneW+MpIjBTyB1pKLZK0VhY7JJEZmOTuBX0x6f WnfYV/zilRh5ZL7Rg8/Ngkewpvn2/v8A991Dik9zRJdT/9b+QQ2lzhlupozFgOdzhQB2AAq9542e VZxiQIuTg/Kp/wAatXsmixFXnjCtnKoPnGPUjp+tUXktTEp08upJO9AAqkepJH8q9ty6GVOTbTbK zzbJPOuvMfzD8oBG32zirsCzCRWtY1K443EYB9ATj9KikLyYRORlXyOcMPXpSJFcXTs10drHO1j8 uPUj0q9Nn0KUbbFtmaO4EZWKOR1O8uwGF9evSq8eoNBtV7hUgDcS8bT64J6CsK+Wx0uCS9u18yJQ cyyP0+vr7CvGdS1qDVr0uocxHiMHgBcdhVVayirrcmEbpRZ9C3Ov6bbhIzfRAM3EcBBYgnuSRWqj LKVji2+W6/NvcbufWvn/AMLXnhaGfzNVjeAjGx9m9c+uAOMfjXv1hpOm31kmpafM9wjf3cdz74x7 1vSldNtmdSLTvbb8TBm8H6WZy6L5hYncEzj9O1cnrOgWNtcoBHKI2XDJg8H1Jr2uCy0+JUibzCxK qMN8ox64qPXvCl7rNq8CKPKA3I3Ry3Ze1ceKpJL3UetgKiVSDmeDi2jRT9nCKdwHJxgD+ZraNrJJ GY2dFkK4UlQo/EnJNU7Lw3La3kgu41iML43Mdxz7c4qPULuwhyd0zuvGeGLH8OleWp2Wp95RpRTW lkV7FIA7pqTNu6KcDaQP1/Suk/ta0v7T+z5wohBGyQAKxx/P8K5NpoJ18wxMyuRw64NSJanyDccK qNgRfdJbPbitKcmtupm4K9mtjUu0OnXyy6ZO3lx4KhH6kdcgYr1WDVrTVLeDyLjD7V3xjDlT69fW vGolUQtL5KEA4d2Y/MfRQOeKfp93ZabctdW4mt5U+aMIC/mN0C88YrXDz5XzHl5pl8KkVbc9svNU ito2tIlkwCNzh1z1wWOOmfSkhuQiL5Qlwz/60k7Rzz2z7d65rSfELy232nXESMghgNuC57ZPau3a 6nv8R2rQhVXI3HIwfQ/0r2KTjKLcWfI1sHUoztNDdQhlvW+xWwuDHvXftAwT3OTjFZ8OjrbXgmjV 4ioKMZmz07nbnFXrTTrp7393K3A3M0R6/mDx6V1N/A9lFljuXgJDEOSe5Ynqa6ZUox3OWM5JPlOf ktVt7Y3E7gkNhuASq+pHPTtVHTLKTUbpvs6GS3zt82QBkU+gH3a6OBHvJlsXhZVlJOwsC3+8wyAM AHqa6Py7CLGm6SBMo/dtKGGxW78A4JqaLvKyB0JcrlURkx+F7WNVhCNOWIbKsMKo7DkcfhXTfZLS yKxyoUUDDAHALHgYVeT+NZ6nTNAXY9witGdzb8s53cYX/AVot/Ytg41q+LiRiqojZaRfQsOQp/Wt OWV00tWb0adOMXFt2Ltpp85DfZgwAO4B0PT8SDx2zV0aTaT2+xrjeSCS46+n5U241a3gsmu7uQpE Ry7kLn6Z5P0614h4j+LMsG/T/DoRQeDcONzn3x0FXWxcKXx9TfC5VOtpHZdTufEF3pPh9SEkzMem 49QOOnFfNniXWLi/nFnEY41UnhSSSzHqxNZVzd6hqE0l3qU8u5yPmbkt/MgU2a2hSDdK+VLDcwB6 9smvBxuaTq+7sj6nA5DTpe/uznv7IWS6f7bKkgjG4srcfRe2asx/ZIopjaQmUsuxS5OF7Hb0596m B0pJle4eRRu+Z1Xsew9aqXl/bvcFrUTJb9FyOW9z0rKDsk0c9WCu4szLSK6tICkEbKC3zu5LEn0U /wCFeh+C/B0uq3DX19GfL3bQSwUE98liMfhWVBqNjaWazyQ75y3yGZ/3aL2wgA5z6mvSdB8PSs8G t+Jn3BgJYbKNtoO7kblHPbp+telg4rnTtzHlYjkhGSd4rv8A5HqFtoumaTCwJt41K4EUSBgx9Pm5 P1qWPTbS1P2iOaG1l2ZygXcB/d2jP6ClhvfMT7ZcpbyP0giGF8vHsTzVeTV5SxNvFEbggL5saEgE +p/wFe9UqSmkkkrHzFKHK5O7bZtG3YW/lvcNPK68soCKnGemck/WsD/iW6dE9tPJPI7ZDSKB8v0z 3q413P8AZynCyJy7jnBPrgVY+yO9urXbxPIAGG0fdHcsTWN48uj1NZQaST0INOu7JA7g3YVflCvt TdnuWGSauNd6fMqrDbR7wekzmTOOmQMU2aG5WViqqERd4JGA3Ayc8/lVOwYPH++RdznLFeWPqM+3 tWXLb4jWV3tp/XcZfXWoXs/kiTcFHzLGNik9sCqllY3dxPsuEDRxEFsA5LHt6YrTczwksT5a5DhC RlgO5Jx+Apk9yzxld+wZ3HZ3xyMnP581pSTk73FJxjGxPf26QMTLcRoWBYRHDP07Yrm2VSgazkdl BAAf5RnqT2pJriWe+8lIlI2fNIg5yOnzc9aoSQyRMRbqu4kHaDwDn3NYyg+o/aRi7I0Lu1F1A8Tv zs2hT05HOPeuY03wvpOjM11AscbMNpxyee3+T+VdBBZ30hRrphuLFtgJ79Se3FPnggCBAY9xYrmQ 46UlBKz5dhVU2kr2HS38hxDal1UA7vLXlu2Bj/Gs64N1KyiR5Y4zwsY+U/j/AIVuebaQsSGRmYbV C9vfOf8A9VVHhSGEPErby25MndsPr9af2rGivyasswpOlnsHyA5BzywqrcaZOxMpG9nG4YAHfGMk +lKBfIgu5pozuykbMTuPfp161NvBiVb0yNI3JK8AgdgM8VcKe99zPVpXKrOIxvuUhBUYAPH8+a57 Vo1QfaJNudu1I1HA+tdHcW9ocvNEW2SBhuHG7OePWp5CJE+0TxoiqMFHYbix55/D9KUqXWw6bTUr M8xQz2ozb24mlk6Lt4x/tMeldRoOl38RFzePsLf8sIz8kamttZfNVvLfB2/MkY+8fTvUunmK3jEh hZnZsAsd2PfFaQwvM+bsYxq20ety68qBjBZW+/g5d+efU9u9VFW7e88hIyicBmzhR9B3+ldEllfy kJLhCADyRnHThf506SK5V9pw2Ax4XlQOvJPWtXSGqevusoyzwW433buis+0/LyfoOaS2Fg0LJ5ZY 9VeU9AenA71diEckbTLFuxnkfOx9vQVUgt7m5YKsQjBbcd5JI69hjpQ4a2RumrttmDqmtxeFtLm1 aSIRwxsF3RAMwLntuPU1bsdYTWNLjvYbkRI4Vhuxn1wcc81oa14VtNatxa6qGMSsGWNQFy3ODjk5 9M1b0/RrPSoBp+nW24xoWCOOueOSKapT5t9COSKu+pStVM0pmikV9ilN64A25zgCrtwbryjPab9x IRy3THtjpWtB5ccDG5SOEZUb+F6A8ZPHFcNq3xC0DRUKCZLiQD5Y4iWyc9WPTNb1a8KSvNpBh8vr 1mlBM6pYre3iaQKsQxy0eNxP881lrrWlaXBPJPLJtCgB522g57dzXi2pfFTVpkEdsI0OMFlGWb+g P4VwFxf6rqTG5ncgD+OVuPwBrw6/EMIXjSV33PqMLwfOo1KtK3kj2/WvilbwAR6ChJ8oKrN9xcd8 Eck1xKeOfEpuYb67u5H8psiPPyMPdRXmkVzcStgMZcfx/wBBmtJ/NKBpWC84CjrivBrZpWqSvKW3 3H1uCyehShyRjfzZ9E6B450/Uk82fMU+SDEmMheckH3rrHv57xAbceTGed0oDEjOOMZ49a+To5bN IRHb7hN6ICc/U+pr2Lwfp3jGCALEIkjuCHb7WWMgA7hR0r6bKc6nUag4X80fIZ1w7SpJ1VOz6Jnq lrY2142J4mIX5QxH3ueuSeKk1GDRLq0NvqzRPagbirjeWx0+vtTLRZzmymdywHzlV2KAOM5NNmsL bzNjRh2AwGXLH2r6JUebfW58VCpyO8dLFXRdN0CwhM+kW0cbM5eMBQCB05brWnf3A++EiBIO5gd5 J9DwB/nrWhZQ3bzx2bRFBI6gStgKoHJz9BT10+OaSWRWXYp2ps4z6cc1tShyxairBVlKS5pSv6nJ XaxSyecsc7soUmSPCADp0HYf59a6jTybeUNBEGjZAN7cknqCSew7mp5mt9Nt2KBy6oTI2ckDt2rn o79Z41jGFVRnYGBLe+B65qkkvUxhJXL95PcPMZYSFwSAcjb/ADqvCZbs+XJhI1JOeMEDv+dSNKsU Z2xeWc4VWPY8HgfXrTQ14FbzEAVyNpUbRsX9aI1eVtSLlBSu7Ez2llGpkff6BS3J/P8A/VSJrUAu mjVH3g4Vh0BP0PpWdJG0kuc4XGMhieO/J5qOa0tYi0MDkPIwGV5JYjOTTniY2sEKbT26lsa5NBJ9 nRCFVsEyNuz/AIetM8+e8UyKT1Oxh6duO9ItlYo6w7mbn9Wx941os9vGfKhUeWvyM4O0IvesIV7a WNIUpLVsybO6dIykoO9CVDt3HFZ8zLO3mAOxGep4POPrVmTVdOiu57cyqArBFjXqfr74p8UiSTBC oQFsASEknHXgVnOV29CkrLczrdNS3DeQcHPl9gO2TxU9tbiKR7ibLHoFk5UHPVa1f9exJ4BXAZuu PXFK0SEb5Coxzg8dPWumnSjybGKm3rfQzZbmSRtzYRRyQODz6VTE881z5luvP3juHGPatW4h+0Dd INoABC9gc8c1nXRjtYd0OXDHG1efyogrbbGUF56EjRBTucq7NnuWYn+QquX3KC5XYgwI88D6Dv8A iabGWcESApyMD39OKUn7Ovyhhk5PHAx7Vc6iavE0b+0UWu5ci3gA4GVU8/h7VDI/lbx82cZBb7q/ 41oyPgCVlCE8se/t+dU7jUYMfuMED39DXPVltqVCNiCdmSQNLuJ2g4HA5HeoGmuLgH7OpUBcEj/G oXuZJ5N7svz8hvbt0qW83ogRWX5hyi//AK65p1r7F+zutRi3yJ8jyANuKnjtWgt4oQxIMfwhjnp1 rBeVZcLJENuO2Mjjrmo1ngj+Q/KSMsGJxntVwqJEqLWhpTywuCZZFBP8KnoKw7vXdKtyEeZISxO0 ynqBxxUu1d6ug3HkD0ArA1rwvp2sOk8xcOuQoUjBz14rkxFed/3Wp00Yw5feNuO7jYjynDbhuDLy D+IzXJan4y0WFHiFwCy5GxeSx9Peuq03SBaQiKMRqq5XGeATU7+FdAmQNJbxsxO84A4I7VhUdSUf depVLlvqtDgLDxVpckioGMfy9JeBz712SwNPIp3kLt5AxtC/XiqjeENGnmEk9uU2nCgHgnqK3cW0 SG1UALtwWb/Cuai6y/iNGlWEbKNMyZYYWKxxNtj5/wBU3f196pXGhwyK033t5zknqcYrZt5beMhA oxnHyjPJ71LJLZW8BhR5DIX3e3uTXYlGSakrilzNpxZ4t4h8MtaEXVqH8sZDKw5U+31rkSbkRMhx tJHBGTkdxXsGtaQ+rMZY7uSNv7oI2A9uPSvO9V0oaSqq1wkr45CjkV8nj8Fyy5orQ7KM1prqYkdu Pu5Gcc8c4+lP8uGNjKzMxPGM8VCzZk3qQzEbcEdB60xbd1XLNknJCg5HvXmNpXOtrRM1vPheNFhD K4yHJOVY/TsapP5qjzQu0e9RRwTWhZmDjzFBC9VOPSkKyyJtbKk9QexHtT5vIW7HwJH5hkYMwJzu HGPap7l4mbNtLIC38LDH5YqorTrHsYDBHUdRj0piLdf6wrtRcjOMjPbnsalSYRlpYlCvkbueSMsP XvTC4hGUUH5sEHnio0klJCTD6NnGR7+9W3im2eZtPlnvnoaLX3RpezIRI6/fQNuJG1z29adA5iO1 cuDwecYzVXBVvLiy/PUmr/lTABWwCfyo3M1DbQEC+blwB2+WtC2ayW4AVRInIZZcd/61kSy7ZQi5 HHI5IqUxyDlxswRnHfNCequFmkaN5ZRwSCay+6fugDlc/wAP/wCqqf2YJkPIQ2O4yPX86dFuKlMj Ab5c9KJpFmjXbuLKcH0rVpN3ii3F2V2U95jAK8nHybTzketNjM0jAP8AKSckjp7ZqaZY413THJHQ AgmmK6M2EDsp4OB0NYyXLuCQ9iPusduCMtnOfeoXnRHCwgEjKlsckVYZVjG0Kc9CCelQRyTuC5j7 YIHOR6j+tO8dweuhI6kquDtIPJPOaaUSA/u+McgGpgqkD5sZAOMZ+ufSmDyk+YqABx65NRzBbQkf zCvzsB39KazIcCZVYYxvXgGs4yTSuWwDnOQenHcd60xC9wAgIGDnsAT9a02B6K1yrxHLu3Z5wV/D 1pzJLMM8Y7n0/nQ1r5cRmdzjPzKvr7+1Pt52jjMecKR0Pf3rOT00QJK9mVvKkXkMzKo5HbP/ANar kNz9nT7u/jdkHH6VG0two3BQF3Dnn+lKmRIAOQTtDN+dPlaXMU0t0wkYzsu1ymM7vT8qZHa7QWHT q2OhrVjhjV9kittIyOnIqvMUA2WxkCg/MCuOe3IqoxbRLk766ix5WPa6hlxkc849eKquYmT9wgyD lWPHP51YlDJEXDHdx0qoLuJYd8keMH74z+tTdotPbQfLezpGUkSPYfvKOm4e9NluWGJRyT0Gcj/P rUsbrOfLCgg/N8p/KpZYLe3fEikHOQvUY9qL31FqiikM99G0k2EAPIHf9KvuxSIBMYICle/PeoTd dNqjPTAP61GsglUl4WwDkMOo9zV81txwi1rcnlViu9GJGMbT296bEjqodjtyc1J9oRWzKA20dKsA CZfmzw2QFzn8KWmonF2EMkaSGYZJIwGI9K5zUrBL6Tz4ZGikIwzKcfn2rflWXaFKtgjg/wD1qjMS 5wxBXAyOh571Maeo5Nnn03h3UZcNBdyfJ82GJxn2rs7G+uUgWK9yxC43KOvuRWrFBG8PmgsQPlbO AefpUc6KRsjXHGc9wOnWleyFJNu9xsLQznylYlOdy9f54pu3yyREFUBto+n4GiGEoQuTxjbj2qV2 2KB9455z/WtdGTZrVhNITlN20YAPHAq3GscYUwBSB97Bx+XeqCqLjL+h4Gcc1YSBoxukVgG6AD9T RG2xe7LHmKo256nnH9RVIr5LbUJBYnBFNizvYtlivYnoTVgRNgszYYngnpiplp1Il5jIFgRTJcqW OcqwPP49qsfaLT+6/wCn+NVz5Lp5QJO09R/jUflRer/99/8A1qIyXUOSXQ//1/5J5bsKggwrFcM8 eMEenGBxWOZ9Qj3XHChyAAADxz0NXbx2ubaTUry5YkgKiYWPc3Tju1YKSSfKpBKhsHcOcn617Eq8 tjChSTu2b5aN7Uy3W3KgkIjYLenT9TWXJcLOgaNRIB0UAj35ZutRzySTjy4CnB+bB/qOprPf7cYz BFDufOSS+Nq/Tnk1Lkzolors4rXBf6jK39oxBUVj5abc7h9egrAjtLWH5niyF5CqcZPpnmvSrqG5 ksmW8BRnbAKnIUHtVDTvDCXkixvK7L3RAF/XNJ029jNbu5wLlFQQ7CGY5UDJOfw619B/DpLTTtHE TgxSyKWcOckn15OBmuftNA0qxc3IYqVzgYLED61rve2VtEJIw0jHhU2jk/TpW2Gi4t3OiduX1O+S 6toIz5qzS8blMWNp/T9c1UvNW1wMEsrXaAflZ3DMc+pJx+QqDQ7u+uYf3gSU7cmFTyoqzdzjesaz pCW+6irvf6YHT8a9hU7qy1OOhOS95f19xy3iDw5dX/8ApgkKyhcOqY+b8B3ryC73WNwbW5ieLnaA /U++RX0nvggjwA8h4Lb8Ak+gxXMa+mj6syrqACnONsQ3FR65x19a8qrg4tXifQ4DNpxlyVX7p4+k IaVsbWOAEw/AH0FXjCjIzOI+DhWb1HXj0rTvvDCaXA1xbkyxudyOVKbV9Pc1iQ2tukLEurOTuG9/ ug99ox17CuCzi7Nan0tOtCpBSpu6ZYF5bqubqWHKglUjHTPTgD+tecXPiW4ud7W4LmJjyy4UAenH 613s7QC3aytEijYnDzTHYv4Vw32KOFpPtUjFh9zYuQx9uRgUpxsrnJjalSStTepctfF2pYXzUXDc LH1H1wea349f1O0kWSHIYMBt6rn6dvSues9JknlWeYBc8KpHzfXHWuytba0XNsUQbOQRlse5JOM+ lTGo1qi8JQnUhy19T1Tw/wCJS0hlmk8jcAzYAKlvY9fpXoltq+n38gZWhKIAS6MM7vdef1r5eu7m WOLbAxVehjAG4j2rqvh5pNxqeqR3ElrKlpAS7yOTgsOgPrXqYXGzbSaueTj8nw9OLkpWPpKyVpo3 WNUjVgQj9Wfj09PrVKeay0K4jN5MIVA3MqR8ufTjkZ/Ss2fXfE9+DDpsC2wVjGHK5kYexOAPypJ4 NRiuYW1pYHQDcz3AZpB67Av8zXtwp93Y+UVaKV0r+oieMrXU9UZYbXYFyYp7gBV4Gc/4Vyer/EL7 EGjtpPOmAIaYqRCreiZ649a5rxx4pZd2mmJYbZGymSFaT8Bk15ssuoalOi+SRGBkZG7jtjP9a8fE 4/3nGn959VgcnhJRnXV/Loaet+INS1sr9uuJs9GcZIx6AnAA+lVBY7D8gTavO7d8xwO5xTrnT7yd vLZlSMcBSckkeuOafLZYZUkkdgRj5ASo+pNeVOd9W7n09OlbSwyW4t0XMsnzfdjSNc7frmsuY25A aWSSX+Ioxwpx6gdq3E0rTYm3yNkDO584XPpjGadJY2VpunLxiKTogzuce+ev0rNq5dRu2rONW5uZ 7gmFocbfuqoGAPTNddpng7WtatP7RufKghLf62dunoQo5Nb2g+G73UpE1C9iENpj91axLhmAPBY+ n869Qi0HTpYh9siYurZVWcqgHQDAIyfyr1cJgZNKUkfGZjmclNwp/M4TSvCWlWaLLuW5bBzM6n7w /ug4HX2rtrLSluCLjV7h1U5WJS2Dj0A9BWLr2r2mnqkNnJDJKj5eOEkqo9Cen5VkW2pXlwxvLoZP VQTgYHQAdq91ONKHLBWPm68nUlebuepWljptozG2SNPl3byCZPw64+vWr1ukRm81EJOwhWYD5Aeu M8D69a5mzu7y8iyke3PUDODn3qzcvHESNRl3twpii+6D6HpWV5aXNKfLfQv3jaYjCMthADlE6E+p xzn61WttcERkIACIcAKudw7e+arXN9p+nxoIY0WR2AwRvbJ6DParCtLFIGuCIiRvKgDj0IxVxSjf lQTnzaNjbjVNU1KZ4pAI41wWWTjIHc8/pQ/2t1AU4U90HCqfTPSoJP3jG3twXMj53CMnk+//ANen zaVqETBpmLbVGFz0H05oUG3cyU23KLeiK8zGBgX3P824/wAXB9ucYrPuIJ7sI0jBE5Pl4BUgdM89 q0BYyGTZkunBOw7cn3J7Ul4lnNiFhkL064GP5/l/hW0IK9iXDlVkr3HWctireQiruP3pATzgdc/0 FTCOeRftMhGW4TkAkduazFtJYiDaRkqykLL0A3cfjVRtP1GK6Ec0olViCVRst8o65HAFaTp3aW9x KUYvXodAkLToWnZArOAwz6cdcZ/WqLWKCUm33SKCPL3naD65HXFaNvbwLCEldmdmGwFSFA56Dqfr WtFFZh1hWFmmjTYWc4UAnrx0q40HZaFOuuaz0OeQatGG+y2qZK7TI3b+v9akis9USEG9YOzFgScK vPt1OK7O5kEUEcxVSQzAeWPuhe+O5qr9njntxKC+WBbc+FRfQEZ6mr+rc3QKk9Wk7nNLZxW0puYH DtwinGQPoOKqRyXiGaSO3DynABboAOp9q7iytLaRgGMT8YaRwQBtHbnkUzZbXSutnmaPdgseFJHf PofSk8O2vMh1LWMT7MfKX7VNnapZUQg5LH26VBDpM99KzSxbgTvViwXjGB15JrWnE1swsESJcoQS hyq9+ferdtLEWEFw48zjO4qCOM89/wBKt0m3oD730KC6bYWhFqyQhiBvEWW/MnArUg061eQSMjYX DKo/vD2HHNaGmmyW6a7t4EPB3ysuST7ZOAM96o6trgnZrZpYbZUIOVkBZlPQVUaKiik27cq/Amj0 5pI2guJNsjct5IwQmeATz+NSldN0uQoFLkqFPzc5b61yF94u8PeHT5dxcK42nhGznvjC5J69zXDS /FnTrdmm0u1lLK25Wkxt9vX/ABrCWaYWDaqS/r5XO6hkWMq2lTg/V6fme2KtykDfY2jjL42kj7qg dOMZJqpLEulWon1i6VGK/N5hx19Af5V86at8ZfE+o4W0MduFyP3K5PPfLZ/CvN7jV7zUpftGoy3E zk5dnYt/M15NbiOmv4ULnt0uD5vWtK3ofU918Q/BeiozC9eeThViTkIB7jP5V5Trfxl169DWehQx 2kRBCyuN0mD/ABHOAD6V5SLczOTGFgTOVLkZFVhaAOzKzyBjgN0BPT8q8XFZzWqdbLy/zPpcFkNC m/h5vUtanresapOWv7y4uiTnLP8ALn2FZMgj2lABk9TnmtUQqq7WVScYyo9aa8MFuuGHPXb3/H/C vHnJt3buexGikvdVioIyy7Ixge3anf2dFhZC3mMR0bpj1rq9J8L6z4hLRabbu+7q7jZGoPcmvWNA +D0Novn664c4+6hOzHpnqa9DA5VWrv3Iad+hw5hmtDDr3569uv3HgltYXE+FQHc3CpHkk+mMV6Zo Pw51K4dX1dRaxf8ATQ75Dkf3V/rXv9honhrR3UWFvGrDClcDcSexbmtl7q3jbiEKI9zebznBweSe /tX0+B4XjGXNXd/I+Qx3GblC2HjZ93v/AJHH6P4O8O6PCIre0a5kbA8xlwMngYyMe9dG1pIHZfKE Yx98jPA6jPar2n6m17AGtm2byQu7J4Hp+FWWvIZC9mib88M2N3A/iI/ya+npUadFJUkkfL1q9Su3 OpJv9CraWEsjGVnQocLxz8o5xn1qq0K2NyczjzZfligVcsw9+o49at3ipp0KJdTEu5fMEXG0H37d /esGO7NrP51ujAjIDysWbB6HJNXTjKW+x59afLbudQfOEJjm5O1t2cDA688elZa3HmhWtwudxb5e p9yegrOefUZUaDeSHHQDPP175qO3M4tt0a5KnkA7enNdEaTWiZE6lrNmnm6YiKcxsAN8hYZJ9goq jBaj7ULiOCFWUfuwwA5z6Ci0tNRlZp5lEa7t7s3GR04/zzWitixJO4nBPz9Bj8SKzcE3e5MpcuqR zEt1qCTlryUhScY2gAZ+hzj61ZMcRZpoFdt7cK75HHGefzqHUBPIuVdAqKS5wAMDt15NY9u87Fi+ EXqjBsnZ34PNc9fkjK17m1GErXN8TRo2yVoVCLlFUZzj8OKwEuS08k0AXBOQWXbx2+lOn8yQLsJ2 4DDaB69yeTWlb+ZMwnkiWNSuBg8YrJQ0fKdCnFtRZhyNcyyMqudnG5V/vd+ev1qtcXPl/JMdy+ik nI+lb09tbANIi7N8hbccnJ9ccVTa1gidbiVt+GK44H6D+VZ80kyJUVe6MNETz0nRcsxPzMOM9jzX SWspmgzyrZySTwMf41VuJGc4UYB6Eeh5pYxOF+TAxycdcn61sqTerIvy3LpnvZ3IhQbMbck9fXrV hgBNhV4XpnnJ7+1ZapKHAkc8j5lU5x+NWftIO61hDZzncSBnHrVyi11GopXLssizR/u8kZBZuxI9 O1ZEkqbvKDjliQeO/Wq81zNO32eVOOAEB49z71Gts80mYxjYCAalSSTHJxaaa06jftiRTfIAcdMd 6lZrnmV2VAV+UOeaoXcEyo0kCZJ6884/z6VELWQWrSq7MzkH5lGAfTFc0qmpbSSHyQvMVlEhcBSx I/iP9K53UNcstLhP299qscBepOR0AramtZHiGHKH7p2cZrl7zw/Z6mqyXxDBCQocYOPrxXNiYS5f c/EulOKaUgsNf07U4TLpjbzCm05ypU9uDVkXVwBGrKcE9zx+tVtO07TrQPFCY4oyCflOCSPU4rQt 4reQhTltpO0KcjPbP86xpQlZKWjLlJX5khxSSR282UHHJUDBYZpqNam45HLc4Iycf0qV7d1kE8eM j5ewH1P9Ki2QSqN/zHP38AdvzxRVg1rcFKysyW4uVjlSKJOe3QA1kXa3huDIPmUfdXgcj3qSeW28 za0yrtyNxxWDcato9tuk80NsbDc4BHsK58RNfE2bwu9LHU6fa3sEge4YeV1KY5H5VpyXOWQ2eAoO 0kk498mvM7zx3AX8uxVn2IOVPAB9c1w154x1WcpEhSFFflvvb/Y1xvG04aJ3KVKaldHulzr8Ftkz SglcjB5x+NcjqHjnTVLICW4JwuTuIHc815dq2tG8IU5CEKXUjjI9D71kK7GLAJwD046Vy4nNnzWi bUaTS2PQrLxyxwJ0KYHUEEAfzrj9X8U3l9MWhaRY1OEEbHJ75P1rIUh2MSAgN0J/kfapY48RMWKq BwSOeR2rzauOm/dbOiGHj0L76te3K7HeTGOPmPP5VmSGRkKD7+eh5z+NOSaGL5oizEnj296nkuWn +SIZyBuIxkZrmdSUt9R8iK/lgr8xBbptHUU+KLapbDHIwcnv2pvlSKgjgGTg5DEdaUTzNhpVOTjI 6cdKytcGtCZvtKsJGDbQvHPHHvVlL0faVlVMxodzRue3pkVSaZ2TBU7FPTPX8KmE3mRt5K4J4PvV Surmtk9SW6njmuG8pQq5Jx1wD/SshIpI5W8tyFPzYOSP1q2IY2dZecjgnOMfWoytzFc7gyFehDVl fTQXLrdktrZ3F6xSGPzG6DB/p3qwpEbC2fO5QQ24dD7VDvWNhNbEof8AZPApwtvOT7TIHVSdpcdM +ua0b7Cp2vYjaOSMDp15HfFMRMMPNYgkcZ7AVadpTA0RPCnIK4Ge1QosCgGYM7jPfABPrQknsO7v djmV5UBiPK9ccdPSoW+987bsnhaulkABRQCq48sEncfUVAXjlTdtZQo53DB/OlGL3FKzbsyw6QRo vcAdPw9qiUmRwsRC5wWqJYtzecoO8DjJ6+lXQHCj1C/Mw6j1q1J2shW6sqSWuZi+chu3rzTkt3WI JH8vIwcjp71bIuIVE8mNh6N0OKiYlAzqAQfmDk/pik7NlrumLbrI6Y2/OTheKgae7E6rJsRBwwQd PfP9KRZXiZTk8j5e+T71S25kZSCpxkY6E+n1qFDqwU+ltS4doD5+UcjC45+tRRx7nKsrbOo56Co7 Zi3yToeDu5H5ir0ZV5CUTAY4+bgEelN2uEIrYhMcGS3PttOc1DukjHz8KW3YHpU8bGA4j2/N36n8 KS5nnZRFKGHIOVxxUyRcHqThd8W+HgHJcEcHPrSNFJbeW0YI25IDgEYPp61nJLMsmUOMjbg5Jx/K tIXVxKi2zFSF/vHHA9KTncFBEbHeViMmNwJzjjP/ANarVkkcdwizKrqWwGB6g+uaoukBlEaoSDj6 5zUh8uOLfEpKqQH3D9KtbLQXc29S0q4t0Eqj93n7yMG4/pWQJ2hICD5eOe+f8MUpvIDC8HzCNhuL A4IPqvtVaFndBHbqZBkAFuDn86JzWjSFGGnKTzSlvlc5JqKKNipRj+6JwQ1TvEsr5cBSDyOgBqJp CAQuW4+bBxj6Vi273SGujuSeTEg2xAgDAUjsO4pJGW2lDq7EsvJ6gY7VCwmdkDs2B2XuKvQTWzyZ xuCg5U/0raLtowjFPVGFeSTBs2owRzuPFaZkKWu9nLHqyjoDUrRxrKdq7gD2PGD+VI01s7bfL2qR tJHXPpiob7FK/XQjhUsm9hjA4B5JqQyOXYKpAI+XHaqeoN9msnltRI5TB9Dj0xWNpmvpeBvNjMRX OQevtTiraiT1sdVEzhgPMUngHuAPSownzZAGM9Q3T/61Zh3CbeEOwjru/i/WrkbwBMK5SQjdg9CK cetmS2lYvKIIo8hiScjB7n0pQ8USkMq7j97/AA/CoIZ5I0dmBCkZYE/rTZprZSHEivI2DtA6KaBp tksctkLcyIMSA4GTTVdZH3Pk8Zz2FRTSibEaBc42scDOParKQK6eWcgjnPrQ5aXHGOlhYUIkDdFQ 5HbIJq9uEztbxFRkblz2GelVJJ49u1sKV+XI/Q0W3mLmUj5iCAc9vXpTja97CWi0H31qbXoVZgv3 T1NZtusrMZ3BXIAQZ68Us5aWQoxOSevWrUatj7oPGAR1HvVTvayFOzY6NUjiJ/iH8I6Go/OP9w0+ F4ZjlD8wH8ffHFT4b+8n+fxpJW3NYN2P/9D+R+90+W8G9Gjk8oDyzjkt32/1NZ72cq4MzKOcEDsS Oe2T6V2sllp4tj9mVwFBCyc88c89qx1WMgvc5RUByFbLZHGcV9O8LG15IwdXSxyy+VGzExswjGNw zT7W5t5IzHGpDbjhcYzjp81aFzfWrweZsDA4APPI/kKzba60ueZ4IpIEkRgSQdzAfT1/Cs1BRIlV nZX2JbnT5vKEgQ85AIO4Bvx/nTbewv4EEh/0f5cbuWZsnqe/b2qxFqeim6C/ad8jAjynfYBz16/p VWbxZoenzSKLvzpGwWWPLKMdt2MflRCjFPcqUpPXoW44WuHeO52krghsld1VtVu7HRYFa+cKTjyk UEs3sB/U07UPFtgLfzZJAHZV2BRhh6ZPU/hXmGp6oupamZxvYbcIT0U/j3JqKslFXWprGLvy9DpG +Id/ZRldHtUhYcea7c4+i4/KuHvfEHijV3zc3k0fPPkYjz/3z2onilMu4c5GAM9667SfA+q3sf2h SsSg4JmOCT9OprlVScnozRp7LQ5qz8UeKNDkxDcTTqOPLnJZSD+ua90h1K3toY7i8YCZ0DPHAoYq SMnOcD+dYWh/D/T7W5+1a5OJyDujVP8AVrj+8e/0rs306yNyJbZPuqPm25Df/Xr0cNdazRyVW3bl KMVzYTxGTz5pDIAQso3Dn26DFZF14T024kMsUbyM/IKrwfy4x+NdqY4YkPnL5aKucgfzGKykiu+U tBIYph808rEDHsBUzpRfTc6cNiqlNe4zyHVPD2pW5MlyU8gSbcjLZ+uOBiq8Fvp0cwdI03KOJZXy u71xz09K96ax8hAt/IDEfkS3WPhu2cnt+FYM3hfRFZT9sVDv5giXdnPucY/pXPPAy3i7n0GDzyFv 3y18jzyC3TksXlcjPmsmwY9K1tF8H6vqUpZQYoWOZJMkLt784yfwr2LQ/BenQAXkqi64LGd+EX0U KxwffNbsl9AyfZ47h25IMNsBgc/3gAOPaujC5S2uab+ReP4mjBuGHjr3e3y7nKaR4U8L6TKZm0/f 8oImmJaQ/wC6G4APtXaRXNoIli08LEMEmPBBH8sj8Kp2l3FMuNNt5VWMHMk/Krj3b3qnr/iybQdN luI1gmmxmMI42/V2HX6A16zjRpK6R8nKNavOzle5Prmtrp8DSTMLWQphZXUDp3BJHU9TivEvEHxE hmtBaWbvLMcq0sTElmPH3mPA9MV51q8XiDxXqJu/EV6Cx+YoCQijsMDp9K0oNI0qG3IJwgAw4AAL egH+NfO4jHuekdEfaYPIlBXnqzIj01ZJXvtTfewPA3ZHPfPetZ9V8q0ENnuViOSTkn06VanWSZf3 aKm1dsYY5x746A1zU9rMLny76V5WxykY2r/wJu1ce568I8i1Joblo5SFmPGS+DgjPXnvn2rRmklk AUeYivyWZmyB+WD9BWJJbsiExL78f4/yroPCvhjxT4oYiwBjhQ/NJKDz/u55NVToOTUYq7Ma2NUE 5TdkNs/KAABmmP3QGBCnPqTXrnhP4fte7Nc8RAOuAY4WJwAOmfT6Vv6L4G0bwrbf2hrhS9ufvJFv JVT6ADr7muxvLzR9J0/+2NamhVjl02Nj6KgPXHTOK93C5byWqVrf13Pncbm8qidPDp+b/wAv8zD8 Qalb2E/lW8BjRlG3bxn0AHtXAXd9f6wPK01XQMfmlI5I9B6CuO8R/EI63q63FjCFWMFIlZt2Ae7e 5rnf+Eq1CKRgsx3HlgB0Pp1repmlK9krnlRyeo1rJJnff2V9mn8m4UBXx8zAbif7x9BV2ORLOIrE TMxyqsF6Hpwf/rV5HH4hu5rozXUgznHcsf1FXx4nuvODL98EbQ3AUdjx0qHj4MTyeql7ur9T2Twz fam1zJHcJcTQxqAnmkqv03dhXUsZ7mIq8MMa7j84HOQOg4ya8Xg+JGsRj/SMrGox8vfHU+5rTtvi QrOkl5DI8TZITq/HQ+2auGPoQlzc/wCBpLJMU4pKH5Hpqwww7ppGOxDuxwCT2PTNPtbi0uIs2amS VmKvK3XA64zkD0Brz7/hZGjT3xkit5gDGEYEFjwf1q3cePtOjCrJDJGrD059ema0/tOg3zNieR4p JKML/cek2F1eTSNaRxrAuT5TO2WwPTmrdsk04c3UruoJw3IBx1zXlSfEnSgQI7eZju3NIowSP7o9 q6KH4m6Pb2xZIGRHbe6hvTjHHet6eY0JK3OYPIcXFaQf3ncCB2tBb7WRnBZnPBCnoMcCqg0e7jY3 MaohbGWk+9t9s8CuBPxk09iVS0uFZuFwFVR+B5J+pqxF8QdJ1C5DXlrPJswfnO4YHrgjj2qqeZ4Z bySKlkGMlLmjTbfyO0NpG+1JT8kZO3ad2c9Mce9aGmpZwxszR7XkYj9+Qp2r7dhXmN38SYIZNlrC QvVfn5H0AHT2qjL8RLVgsTWW9jyzyuce3AGePSsp5zhVe07/ACZtS4bx3Wml81/mz2WTWEih/wBG aCNzknaucY6ZJ4rnll23f2i2eWbzThmUs24ryemBt968dTxzdm5ZhDBtyeCCoCnryaz77x/dl9lo dpUFVWNcAZ9Nx/pUSz3DpXV7mkuE8TKXvNJep9KrLO6v5iRqDjCsc7R9Bx+tULm8sEtjPdzKNzHZ tAjVQoxnPPWvlY+LNVvZs3s1yxC4Vd3y+w2gYqO71C91Ibbgu4HTcSdo/lXLPiSOvLD8T0qPBstG 6unoe9XnibTfMeOw1KBj/EJG4B9j6elLeeO9LsLERT30Vw/8KQlmIPrxgYxXzaLBUQyTSJHgZ2gb mPpn0phiVACcsTyRXBPiSq+iPQp8IUFfmbPbrv4raPHt8mKYqBg4wpP161yF78RNQYn+xLWKJs5e 4f55G/E8ce1ebkxPIVIVQBnPQn8KerSygKA7KBxjjJ964q2c1prWVvQ9GhkGFp6KF/XU6W+8U+I9 S4uL+UDuqFh+AxWDc6jP0dnkx08xjn8s1GlkZocvNHCF52k5Zj9BRFp0DkyeZuwcE/dGT0x35rin WnL4pNnq0KcY6QikI87yKGYhPXOKgCSM2dzdORk45rRaPTbUBVIaTdyEGcU+CCa9k8m1gkc+wLH8 qxjc6N7tjIonWNfmVM8Ej52x9KjYqvyoW9FB+XPvgV2+i+Ade1QktE8ES/eklUj8l6mvRbb4QW1v CJby8YkjcqRR9u+STXpYfK8TVXuQPLr53habtOpt8/yPCxLBGgJKltvbnn3q/Z2k90MadZTTzE7i 5BIC/TpX0RpvgLwvYlZRCGJHW6wc/wC6o6V3ltYpaKDBGcupRUhUZA+nAGPXivaw3C1TepNL8TwM XxnS+GjBv8D5zt/hv4p1IJdXzRW8Z5CoMsR7V6RoPgHRNITzmtmu5iRmacbgp9Ap4/GvVVsTIB9q /dhBlCQevfv1qR7vT1AklZjFt+bouDgcV7+EybD0p83Jf1/r9D5XG8R4usmnUsuy0/4JmQN9nh8t EO3IKqOnXv269KffPeCNwpDsF3bc7VCepPbA/GobzW8wgW0CxopwrJ3AHFc/LK21VuJT13kevP17 17Dd/dvY8OnPW0le5stJsxLAqzdDIxIUKemccknrTra+s5oCt4xdwx2lemPbPU8VzlrZypJMqxzO CQN2CQc9a6NY7bTPLV4zLJtA39gfQDsOvNZytJOK1LlHld76D7W5+2SboY2jG07d4+VBnrjjk+lW 7FZo0Myn5gx5bCg+hwOtZyyKg3oq8kkKzYAH1HPJ61bdlMQEAz/Ez8hAfbP8q0utItEOp7t49Rnk xrvkIBJbcGK85PXk96qKLOBS33yWAY4I6fWq7Wdy8hnuZ87RgKp6k9+OlallGVZYsfIq/KZG29R3 781v9YWyRhKjLd6kkas+G8sAZ4B6j06URxBF8ts9uo6H6VFPqDqpayYnA+UqMrx1xk9vpVW8lWGI F32FsZ53sSecY7flSdXQaXMrNG7NPbwWxlkXvtLPx6dM1z014kwYsXIHygZwMHr+VZ97PFcpvkb5 VOcvznrxj0/Csf7THIoBfdkZ4Xbznt7VlOb2G+fVmjPcW5gYBDwnOehJPyjBFY73flxhp23cgAD7 xB7ZA6DpTg8bHYnAI3Er1qiZLBZFuJDh2Ylctuzjt/WuWo03ojSNWT+I0zeQzE7BhcYZccjrjntU tvewmMR4fH8IOQMDtWMdSLXAs4FBZju3AZBHc/SrK75HIuJAxGevAAPf346VPNZWRV7SbfUtS3Jj ZpJI5HYLkcZA9AFHaq8E4vE89w6HhQCMc/TGaYHgdD5khc9sdR6dKtDUWTBhRDluOgH+NKzZfMr6 6jZnCk+WuTgDcTn25HHWraJKg8o4y3DY5wPWq51GWJTv8sHJJVAOTQNQcJu2gNjO5+vPp61Uqlla 4o2k7lgxukj+SowDhWbnn1xVKWRJUJlbYQpHYZwaz5p7m5kCDe55JAOwFiO+Kqx2LyHzL4qhHQZ6 /nWc6qbsVCm0nd6G/Fc2NoW2lWO0KCecZ6mqTS3N1Iwtdqg/xnO36/XisiE21o7fZsM7cls9B7Gp Z5pbmFSDgYKkg8mojdNp6B7Nta7eZOweKPNw6gYyAp6Z6inpeRFcnjDYBxnt6+tYTQx26CeYuFGO DwOO1YF54t0iOTyfMi+QfOu78q56tRRtqbU6d1p16HaSyM8R245PrgdexqhcRmQ7JJQFK4BPJ3en 0rzW88d6dcTmNZtoVSAqZwfoa5WbxtqBVo7aFgA3ytI2cD1xXBiMfSWjZ0ww89HY9Nt7CO1uGeeU y7iT8vQD3qeXWbOxXZEdp77OSTXkcXjLVpMRRxR5Ax82QPf6ZrLn8Ta47tIyoqtznGa895nTXwm0 aTveSPWJvEeJDhSN44Zjxn3x0rgdc8R6i0htbSQop5LL168/SuOlnmmT5ppWBJ38nv2xUUMO5wqu 2Bz9K8+vmMp6I1jSs7smklypcyPKMFn3N3qOOYyBfMBI6AMc4HtVyXTJIYDM4LDHHbNQbHCiRAAP T0NedKcras1jH8C5ZmCWV4Z3EYYHtz9KuGKMukUkfzhMRlBwx7H3zWPHKI1Z2TexJ2+xq1FNK8O3 aVYfMJQ3T2xUyV0l2LWnQqXTTdLhScHaF4BGPX6VPZwylVZVIU92z+tVLiJZm8+RtuBk4PO7t+dW 4tUufKW2Dui5y/GQxNEUn8TBT1tYtzyspUyBQw+QBRjd9RULMhjKfIAz5YDqPYiqk00bZEgZn42+ v1qx5e8KSwH06k9qiW+5o3dJlGSBZGLR/wAJzjp+XrU1sTHKGTA/vA8kU6WKRGyPlHGc98f59aYJ WaPJ4VSR71XNbZEW7k8haRGIK/L16AnPtUMchMZcjceduTjHbpzRbTCAuvlhlJGS/HBqxdG3eQLG CoHG5BkGq0et9SZp31KMrQbVDhh65559RinssaqGhJ5OSaewTJBB4xg4/XFOZjb5TOTjncAQR6Y9 6yvrqXGO7IxjO9zwf7p6mpYf3hIdd4xy1MYBSBGwww6H+HmpmjntV8xSNrDG5ecZotdaD1T3I/sp K/LsCc7ieo9MD3qxHLcxx/Z7ZsxnJZScKQPY96zZiuAwOSeGJ45+lIDIRsjYAHgFl4/KmppEtdUa 6mPczeXvwuQO3vWfPI0rlYVbbjqBnHsas20kltcByodSAuCDjJHXFKSIJsxSHIbnaeDRG1rpDaVi PaTsRsAlc7u9TpC0cmJclQoPPQ+x9vemBZVdZEk53chgCD606aYq4YDlc9c8j/Peq5brcTeqaLF+ baSUzWMZijUfcY7iD3xWbL5ixjBxkcZB5qyZmA8w4KFMkj+E1QknZm/cqeFGP/rUSjy2HzLVotfa XWEQP+8BOAB1GKgLDf5cAyMc7j+lO2OsoWUMgUZyOOtNCmM7k+cknBHehS2QuXQn+yy+WmwbxyT3 PHtQJWZto4AznPX61bx5Mm25z8wDDHO0n1qB45ArNHt2gkcnp/jms+Z7DtqyeA2TweXJuEgbGeqk Dp+NU5ZBIWjbr/D2INBPlRmdVUqCAWAPGOtT3Vxa3UayWUOCRxtORnp9fwq3B2uRzbJFdInhmDuz EbcZzkA/41JNFErlpv4hklcfMR0oiDOgic7c8LjuaYVmjXypCCR0z/Sk4spysrEk8cccYMW0lh8y joPxFV47cSvvl3KM/Kw6ZFLCTGHSROcHOePy/wAKnFzFEgZs9MYx0qeVtlwWoOWtGJJUseFOMZzQ s8csXGFYNgnoD7VA7faZBsT5VOdxPQ9as2tvsJdmJyflB/z+tDk00So6sry6fI3L7CuemOTSq8an YFCKuCB3NQy38hmdTlVU43f59aswos8oWZwEPWTHSr5Wwc0loWbZEGWYbgc4weBUQjwrbgevXNMF ssRaO0lJDcllJxj2zTd87KIsbu28j07mocbPU0jLTQquS85WBs44BPf6VLBbsg3I3BbBYdefWpYr J7tRLCQO4+bAIHpUccLFj8rYwCccAUnF9DNablqCKKFDIxzz+H1oeISNmIAkNk9qhkhNs+XOd/TP t7VCs8uc8rg4+Xp+NHK7lzTLTTSQ5CnBIO4DnOO5qtFFZyRb7iEcg9RjBPr9asRx2uGfJyQTs9Po aveQ8abJCGBUMMcdRx61SV9AS00K4mS3hPkiMp0xj5vzqtEkMp+0ImAo4981J9mlGGUqVXJZ+2KT 94VVSpCKMkjvmiN1uS1rYtq0kmYpCChGAG7D/PvWbE8cGWjRXBBUEDuOmPepmZYRvLjk84qKKZ3I Y45/z1qrrqTKSeqI4hcSMQy5z0I4IrUQrwsxIYgbsc/ypkm0SDduyDxt6evWi5AESrHhWLH7wP8A OlZbIuMrokdIpTuYBVBwQoyTSXDiFC0e7OPlxwadFG8VuQisdw4Oep9PxqnAs7TMsqsGT7yn0PpW iWmpns73HWybvmueXJ5IOOPcVYdmhkwmAvTcpOef0pZZ1huE3ABSn1wD2qOVklAYEbR/d4qOXob2 e5GttIGSNSCepZeOPpVv7HL/AH2/z+FZ0vyRh8HLDbuXt6VUxL/ff9amVNmcpJN6n//R/k5tEjMR nvZWEYJ2+bLtUfReM/TFYdxdQykmBvlBYGYqSNoPYe9X72bTUDXV5FAB3YsQOe5B4HNcrPqSRRpB buJInHVVxxn1r6WtUdnzHNSprlujyTxHY65bXLXtzJI0MjEqkLHYoPQEDpXPxJFHIJULwnu65DZ+ teoeJvEtvZQf2fZpE4kypZyCFHrgdT7ZrzSOUpksQ5P3QBnP1rz5ycdTppyV32NZIYzF5swZgCTk DOfcmn3EUzAPCvy+mdo//XU0urXdzZpGzKsa42oq7Rx/ewOfxqOE/aPnkIkcnIUD5Afx61PP2Y3H UprP5SBVQBj1fGef8amuWuGkWbD52/edgPyHoKvRzortCgUnPI2/qarmS3lnYX0yRqnYAkn6Yp6y sVTdk9DufBMcM9tI19HCHWUGGRmHmEAc4LH+Qr0h4wVMzOojfjG7eQD6Enj3rwxl0OO0Z7WeN5pf 9WpyD/8AWqvpWr6ppAdmT7SXxt81yAMe1d0MRyrlehzwpRvJxW7/ABPdbd77yBbRSJGgOFTgkg9z 1NbViJLeYW0Rk8sDdJK2RknrXDeGNae+tReTWyRy5K/IcgAeldeXvbps224HkbMYXHv6/jXQtbLm 0IUXy36ms0Ntc7rWYI0JyWLuWZiffOAPaoI76TSkaCwVJGcjy/MOFVVGMKBkmqtiseHWQAyfxSEY Uk+nTpXnGrfEdNOdrW1txNLHIUDBRg4OOMc4q6rjFK5ML81rnqcd1qOpsTMpCjIJToPXLEVas7jT LZgIHt3lyS2xgz5IP8R6fXFfMGr+MvF2tRm0lZ4Ymb5kjPlrg+vc1zdvZ3KTpcWzSvKH4EWT8x6D 6VjHHRTXu3Ro8KpaNn3CmqaW1sJ9suR95c5XPpx1rDk8c6fpjm5njlIZjlcfMSOiqoFcVpc2oLbx R6ofLm2DPHCn6CtmHw1ZwSyXUjSXMsjZC7uOeOvGPwH416UJycTnnCEZJp7HS3HiO68Q2f2WOFYw 53hJ3O4gdwlcNf8AhTXNaBF3JEFBxHEildoHfPrXQT2tvp8yXsMZVl+R4twLKDx97k/lVqfX7m3S Q2q5ZwNokP3RjtXPUoqd4s6MHi50lzQerfY8ZuNP1bS3Nhd2qoCciU/NuH1FUFginby5VZdhwd3y oD689a+g7C53iKNERmlzvdhu259WPTNVp/DttrVxJFqZh+TLbVAAUehx1J7muSrlD+zI+jo8V2tG rA8HkvLK3kH2Le52/vJOVUE9lH9TW9o2h6rrABsLWbyyPmm24jH4nOa9RtfCXhG1uTcxKX2d9pZM +2eOvSutFxa2gS4upWYOv+jQHKg7eMhAPyzTpZK73qP7h4nibmi1Shr59DktN+Hek2myfU7drxyc kSNtjXP+yOW+pOK9Gje0sIvs1qsUZ2bFSAduwyen1riYxfz3Uk4MwaQYeMPkhfYdqnv4ryztZLCz Vndx+9Ync+APug8//Wr2qWE9nBuCsfMYrGzqyvUld9uhzHiXx/o2g6qzafCbu/iTyfmAMUf58ZFe H6nrmta/dm61eQEc7GYgHHoPQfSrWpWmrX2oO1zC8Y3fdCkDPbPH9ag/sxYsG5Zc9ACOn8q+RxWL lOV3ofoOW5d7OkoxMkRxDG6XAPUIoHWm2tvbDLqMehYnLfyAq4BG1x5aFsA8gqFH/fRpLmTy3KjY F7DqTWakrXIrRVyD7LbzyKRHG55OU9emOOtF1ZNAiCZFy4yPm6e5qv5sjjZbBhj+LIH8qjlihndI 7cSYAO+R+Muew6nHua05lZ6HLGN5pXL9q9vHGY7gI55xtB4/E0+C7kiYRwrCMKeWO4kH1xTYLa2V BuOTg5ydzUsm6QfuYdi5+Xqucd2x2rgaPfo1LJEsk8MhByzSf3IAUGPc81Gu1p3kkDrkbQXO769e KsI+osi/aGQKTwqAc/iecU3dByrOiuDxs+YjP6USkbpprchdJpzs3kZO4sD2/AdanihujhYkyvPz SHaD9MVAixxHMUhKp1z3JoeadvvO/I+6VxhfTPb+tC7IOay5jSFqtsPMzCHP8IIJ/M1G0rxnbkEE 5yx4FZtxDBGw3vgEc45OajzIciOKR1H8bYA/Wk2X7VdFY0muFSQNCSzbsc9DTW1C5c9WX6cZ/GqI khRtsK4O3bvLDge3rUluAJditLKx6BVz+tEV2Rn9Y0s5Ehhd1LSuV5yNuTk/hT1jSMbiAeOpHJ4/ StB7e/TmKKUnHJWMtjPHtWrH4K8Uaou6OwuAEBZnm/dg5+pFWsPUlpGLZLxdCN+aaXzOWhmWFSRM ikj+PDNz/KjddTDKnK9ckEDjua7CP4d6/Hal4IbaN8gFi4JGe/Q1u23ww1O6RHubuBEUHeWBYkjr jOM11UcoxM3ZU2cFXiLCwSvU+48xDStGSypg9+T+lWH0+aRC125KsMhchSB7Ac168vw6skb7TLcO IkXJQDnPoCOBmt7S/AHh6a5MssE1wSu4+Y52gDpgYGfpXow4XxX2kl8zhqcXYSK0bfy/zPnxFhif 7iMzDCIg3Nj8a0U0jW7mMC3sruRTnL7SAB/LFfTum+DdLsrgzQW8UJA4+UAgHv3JxW7BDGqybCkm Gxlx0I6E4HX0r0qfB3utzqfcePW421tSpaeZ81aN8L/EurIZHEVshOP333s+mBzXcWPwctoysmo3 m4KT5ixjYAR2HWvXn86LLsU+fg+YMEA+ijp9aRr2SWUw2+SNv3nUD8cH1I712w4bw8LNq/qeZV4n xVS9nyry/wCCc5p3gLw3pLg21tGCVJLXBDFgehwea0ojaQkW9kqFmG3y7dAu4+mfarsd88EQvWVX JDHCgFzj+IngVYiniaNZFWPcoGWfAAzk49/wNehDCQp2jGCR5NfHVamsqjZsWcM0caM4MYKk7SQ7 Mfb0x3qCfzGcvhCEPzGU7doHQ4/pWXc3l4F86GYRog27EHBGfTHQVBPNMLghINwYhyzng4rsS5Vv e5wK7NeAQTEBSshHzEqOpBx1OemelWyo+zukchRySDsOMZ9fU9PpXLDWILaDmbYcsQiR46nB4+ve suHVb+51L5gEsxGQsrthiwHLbRzg1EqrurI6aUYKzudNdefKggLMcDAbkZ+mTWdeWhtbWObLyMzh QuNwUEfpitY39jLEn2f94DHlAxKnjjk9fx/SqeoXgwFVEXaQDuOQ2eSRjnFb1Kcp6bMyqytojMIn eY+dL+6XCFUAB3dOM/w0qgWv7xYwqZ2Avy3y/jRF5IY7Ycnszfpjngde1SnfcgyTjgZCgdvzpU8K r3epn9ZbWisWleW5KtuO1M4wSFGevXg0psBNh7uXKk5688e4+lV5JY0hA3L8v3g2WbHb2HFUo74z SiFVJVV3FpOAAe1dknpYzrNto2HuIrdhHasMqpx0bg8Cs9jduFLyu6j7xc7Fz0zgdaoSX1vbqTJz g4VUHX05P5dKV73zDlIjjOFD88+napSWzZNConoy/HatCGWNixbOdgAU/jTI0itHEs8qAYYvu+Yk Z4ArIudSkKYldQvsMAfyrF+1w3TIsfzKrfewQv1JPX2rGdWMVY1V5Xubl5rrOBBZpksPlbHC89MD +eaxhb3EjLNcu5DDc3oaJXuCoWLbkZKuFxz7Cn20F0AovWGMDOSMg+31rknV5proKakndBLGjoke 7zQGJdScc9vrikYTx4k24G3GOpzxU0k1uvzRDcx4IXnp2FUpdQUqVYrwSCT2YDjA9qfOkrJmkLyd yQWsiozS7+gO0ce9MEMRUmONXypRY1A4J/rTjq8TQLLxkLwD3NQjVpXnG8LyQcqMY449KcHDlK5E loXYI2tkChERNpUk9cemepqm8YZJApcfKOVJz1704m5uX8rdtUfe7ZB96J3sreP7NK68jqrHLAev tXJUkkro0oybV2ipJIxi8qHJByMnAp8FvNuwobao5DEDOOvqapx6pCuTCsarnjPXj3964nV/H+nw +ZbQzKz8qRGDnH1HFc1XFRSuaxo2aZ6HFGCWdiNr8YXnb+Jp09/bQ/NHjI4JB5x6d68En+IGrusc dtAgRc7tzflzWY/jjV5eNy8H+6QTiuCWbwtubxwzu1Y9n1PxLa6cr3EkkcWE3ctyfoOv6V5nP8Q5 5pAYYwFORh2OfwrhbyTUtSuWu7tJBvAAbqCBWZDE3nCNweDkZ/xryaubVG9NDo+qwtbc9Wg8byRI WuICny8srA5x35xVK7+J17NEbXS7ZlkfhGY7smuKmstsBkuOVfgHNVbeJfKDJxt4zms/7Tq2tzGk MNHob03jTxDextHeFWIP3kOBx2xXKW9zIt07R4VmXGOo/HNTEkL5Ua8luCKRUEHKgYPLE9SfSvPr V5zd5M0i7MZcRzhjnHzAjpjbVqFoY1i8394AwyFPp1FVrh0aH5w/LZGT6+9TH91EsTYBxnBHb3rH W5rF9yxeyJcsHgjEIHJ2nOPagHdhgWHHIPeqMckkZYsN2Pugd89/pVuO6eHEke08cjr1p89w6XZE QvzecccdqbbytFiVMlsk81elc3MHmhBH1LZ65+lUQyvKBHknr/8AXqWuV2FKV9Uapvr5LYAykq+Q I+vSsvz2bORjAzhuOaUlYtzltx5UCmRuWbdEMnnhhRfuEd0KysbfEWFc9DnqKjd5JAu4gEdAOmRU 8r2/k+Xg+cvYDsajWOWRckbcYC/h61MZvoU4tXZcJ3qHn+XPRscHFNiVJN0aA4B69BUpkWOJUZg4 X8gTk4qoblUz5fy7hk47VUWriVkkWxgvvlA4GB7/AI1W8uePEyMTtbIxxz60RyOu6R2zu7HHar9l FBNLtkJGVxg0oRu9Ak+W7I5HlnxLI+5sZKsOtVYY5ZpN20kA5YDngfhWneaTFbLu3EcZxnt9azGk mHzWmAuOp4/GtatJxlaREJ+7dLUs3d9FKTFsAwflJ+9j39cVVErwOAh6nnd149qZKZJFO0hWU9ex HpTrRn83FwokJ4B9Md6z1ctXYttWSLsTRs0vmup3r8vQY59qZlWVshiAQC2OOegqnIm6bEasD3OM Z5/pT/OKptjbj+If1/ColEu700F8oSXBCHKqOuO/9adcQxLbk7t4GOIz3FSxBZQZJQTg8EHv61XV jbK3lnDBs+o5ou7aAklqyZLTfbCTLEsetOaOVG3YyOAOOP8A9dOi1G4jVoTtKS4JUqOo6Y9Kg/0g OCG3DONnQ89xVcl9yNrNEyzXEg57ZJHQ/p6UgTkGIM6A/O3v3po3g71PlkckHnp60x55HI8ndhmO 7t+VNOz0NeVNXJJcxHEQ3DGGyOfwqn+8CgR7uMEEk/pxUskdxbgi5LKMdxnOafazbGCMFOOoPTip uQg3TPgS4BZsYbgdPWqqZS5KqpGSSeePwrfVLe5iaVZEAU58pv6ZrKd/MnRAVGD82Ovpx7URjKyu PmjrYjk3uMMzZzjI6fjUk1ytvAoUcseT/wDXqeUpEpjV8gj5cjuKglNs0aeWrDPGM55+tPl69iU9 bblYs28klmBAwfcetLEIkBwHDMeueAO/FSuA4VXODnOFGcgd+tSiGOYBEYL1LbumPwo0LSsmzS+w 3NvYG7DgxtztPU/hWJHL8wKgZLHC9MH1rRtNSuLW1a04kibKlGGQPcHqMVBC4jZ5plEoA6Ht6Gqn y2iomcFK2rInDIflIcHt6UrlZJAuO3zEjgZ9DSSzKVKpsJJDFe/sKItz7nAwCcH/AAqYpa3K5dfQ nCQshMUq5HG1hnHvmqCRz+diTaAMZOc8d+P5VqwiBodrIAcEZxyTWc8iRDOT6dMnHpS9m1azJ5ul jSKqsbLbltqgYXH3v/r4quZFXbEr4K5PzDaealtJ5oj5iZVsdT09uDxUlxdx3Q82REzx04HHf/Jq VLcvmRnxLEtwy+WrNj/69I8jhSzHaDnCr0yP8aQ4kJXAXHIPZvxoZY2KscBAudvPWnJtCjYis5p7 acSKCNy/Pk1rRSRCRnYAZxnBI5+lVcSx8MF74APT0oZgkYEinnLZ9fepWuoctmkSpK28rGuV68VL I6Xkiq7lGHyqG449z3FNhjiIYTAbdhIKn+vGDSQraSj/AEmUoeFRtuVI7ZweM1VNX0Ned22GySwn 5MMWHAbqB+FR+RvcHdyTnaDg1ZSG2d1VZG2qcMMcj+WRUdypS884OHjC8N0JI7VbXVdCOa6sLGg8 8lwdxOFz0P40gncgq42Egnnnp71SNwzSGFOQTuG7pU8Msm452jb3I4/rWbTtoVKD2RbEalRiQkEZ I6gH3xT2mmgj80Q78gYB649jVQOnLJhR7dAfpUrTSgqY5CMdVBGCKah1M1q7IoP59z86x4A4AfgV owx20UiRkEAH5n7A96aQwZnOSOqjPAxUbSFbcuoAyTjFJQ5ty7WJJ5GWZo1wRnKEYNSREPEUUnlg SQeB9KyrdJGDO3Dk8D2PrSpDMv3Dg/xZ6jmqhGzJT5ndoteZOZGRcgA5rSwwQvvOWXnb3PoayUld PmViHbnLDKn/AD2qe1la6jKyqyEHlTkZ/wA+1aOQNXdmLKQrbOGGeQRkj/PpUa2/nMIz909zxj2p peL7u5gd3OeeOnPpWgkRREWD7vfvSkhqLuRtZRCTbnK4+7nij7Bb/wCz+f8A9empdKZHglHTI3Dp 9PrSZt/SojF21GuX+v8Ahj//0v5DdRsYNTiMwG0RnkyYZSB2x3Pt+lZR1SxcPpW1ndx8rspVQB+l egvosBnlaVCUf5Ygp4Hv7/WqP9l2dldI0KqXBAIl5z+Wfwr61UZN7Hn1KkWo8uhx9r4XtdQjNteK u18H5Vww98+lUZvBWi2g85VAVSSxMnTHp+HWvS76WfyGuFTylU5OV5Pr9T+lcjqpOp2D2Ss8CSYE sgADFPr2zXOsPHXS5vNu97ni2t6jokk4tNJBCof3kpPDH0GewrQgjskto5ot4mY8hvugHpjitLUr LSfDcYt9PgSWdlyjON2P9o57+grHtoZA/wC/JLY3dhg151SCi9zopTcmmyvdI8Mp80n5R1ThTnoO K6DQfCb6zH9ouA0UYbAZ+N3uB6Va0XRNSa7i1CeEGFX3bpMgH8O9esq0hg8+Q4jHy8LzkdFAH866 MLhozXMyql1bXc4OH4c2UNy8ktxMcABdgAX866O28IWcO2ZYDIcldxYsAB35710tvqcDRhWyoVsA E/MT75rB1b4iaXpbm1dmdgcGKDDEDtk5616EsJTilc4Y15tcrWx0NrpmnWMJjRPKwC23qWJ54qFL a6lhJm3pGw5VWAIwcfWo7TU21dPtCq6u6DYspJIA9SO/tTWllUlnYK5baAvAYD65NVHlRt7GV0+h O9v9nhYK6dyAxz/OvPY/CqSNLNHNh5SWJZQO/Cg1263XmYhuixOTuCg4/M1Qu5Ps0w8tGG/O1uv5 9qnEx5nqKMUrtnHaT4Vs/tmzUD5kjgtgkhF29s967+10+005SLaOOMKMjaMAH64yaww7pJ5MZ8xj ywAyfz9K848STeI7zUZNP8+Xy3A8qOAYBB7MRS5oUkna4NuTb2R7vAbe4KyW8RbaP3k7A53f7I7D 3pRdl4Gjt4tqbjl34+mM141oGn+MdKuleeebyiMPDuJ4A9B6V6fp8reV/prgwgZWJQd5Oe5PauxV IyUeSLv1uYwpq8rtWLSagltGXcNLKDwgwAMdz6/T/wDVWZaTalq18YpAFT+L5QDg9AOO1bZurqJv 3SxRJIv32ALfn6Uouw0QaRUDAjEueTjvWkqdtdiIQtdXNe3gEON7pJtQKqNk7T6kAVsWUaRxC7uo 1R3cluRjA6df5V5ZFrmsS6pcR28G6LACz5yHb0AFd1aXl7Iy+eVjPG1QMsSPbH61thHz6pCq33ub 9xrL5W006B180YGQFHHq1Ejafp5S81YsSi42Kd49lye/0rOv7i8gZpogFbGWaTJIPYBRVBZJLjbL dTB8cbpTtUd8Af8A1q66kUrJo5o1L7I0rfW01VZIdNhSAPwSvDMB2LCpILyXTJCixQqrHKyHJOcc Cuf/ANOnbybbb5bHCpGhUYPoep9zXS6dp0VsiSXKsx5GZT374A6VVFLUud9LMnOrSXWWbnbgtuxg MfXjP/1qyr7TbbWMmSKN9oyPlC8n34rce1TLGJdsZBYY7n2BI/MmnQvYownL+ZtXAyflB/IZNXOg m0uUcMRVV7Sa+Z59rHg3Qre2W3uYpXlkO/ZDwBnpuauUn8G6NHtaeFYif+WjyM5H1UcV61rOy5U3 UgcBDyc9/f2ryy8hhU+VYszRqSxI5z681y1cHTum4I3hi6+q52YH/COWLs/2SFiegBJVcevNSW/g vTTbCe4MscjsVxvO1R71dgkmwW3si5J4Jycdq0NNgtr+8GSzK38J6ZHWueWCoy15Teljq0XpM09N +HugYd2Bk6YZW5APv0q/e/DvRrqHdC9zGM42REsDn1PTOO1dmkml29vwNikjG4hQx+h6irAupJGE kpbYowscPP5dBmtP7Oo8ii4LU2p5riG5NVHoedn4U+Go4WuL6aRADsUtIck/QZPA68VTPwl8OmQy 20k0q5ABZ8Dtk9P516ndRpFGGkSRJZm2oJiHKj3UdKtG2UxbPNPlKuJFjQKCe4GcH61ksuw7XwDj mOJun7TocE3w58EwxZuphEirxmXn8Bnk1Sh8BeFL2P8A4lcF3MC+I2QnJHdmJIAFdrPY6PCsbC1j ZFy7O45JHoDjNXEMGxFVZJTnIVPkjQdh1ArT6hQV37NGUswxLlf2jt6nCWPwy8PWrGTUBEiK2WeW UyNgdgF4rdn8BeFbuwWYxqYySY1X5cr9M5P41vG3vbmDy4oI4Fborc5wf0HvUKvBKgaSXeUYbgoA A2+gHr2qqeDo9IL7jGvmOIldOo/vZg/8I94U0yA2lha20cwGXZkErHn3yBWvpZtlO2wgDyFfnfy1 VBjuWH6AVLFc2aTyOUhwxyIyMEjrznrz1py61PcREpJsEZ3CKBQVz0547V0xwsIrSCM4Yib3kyRN LlglWa4MSSNyCR90f3sd8dq2VEtzn7KcjKh5Wbj3OO3b6VzkoupWaeVsZTc+9s7QORn/AAq3p89s 0P8ArZCZPmkfDBQB2ArsdLS6OenFqWrNU+XaOY0iLlmATIKoo7kn0qq1zaKkwuwX8s7v3YyB7DNV PNtoggtVnaNnyxn3McA+npTptdE0bQ28UkuOQFUDkdAAKtVZJMh1YN3Wti/bzrKFWK18oEDCzkFm 99v+Nb1osKO8yQyzyeWSpOEjUA4wCcDr3Nec29xrt06yfZzbANywwzD/AHiewqa+inMckGoSylTw zK2QAPb39MVcq0XsOFJ25jsZ9V01GkK4eTI3beUUD37/AMqxIphJdSYbKFxKHf5UJI54HU46Vmaf p9z5UklrHlU6GYDn35rV2AqQJE5wdw5JI9u3tTdTmdzGnCV1zEN7egShEkCAEtlQCSe3LVbhmCwG MSsNxDbgNzNjvwOKjk0+1e53N5kxGGB+6PcZP61HLcus4gyqtyWSPnr2/DvUTld2sWm7PXck85C5 uImd8fMMcEk9sY7Cobmze6IFyzEZ3k55J7frT0XawLBWJYFQeMY7H3qxPNMrBpTnOSVJwBnrx9KI Ye+5N/dbRFNc32yO3tolCx4UluSQTyxqM29xcOZ45D5ar8sknygY6nHfHYGhyLhCsG4LjLNkKTjp g0y5WB7AI5IHT5TlpO5xVOk0rFKuru+pkJcWkBa43mWTIKyyAn64B4pixRPmZnDzfeQHrk9OnA+l RBdGZfMnkmIQY2MQMk9c+lTvqGkw7msg7P8AKqbRyDjrziuFuXO9DpqNct5alh9R8iZYQqtJgAsw wQe44q/suZ5Ag242ncFGTmqMLxqRJY20eEG53kJZyx657ZqGW5uJ2dZZhGDgFVOT6n+ld+HqOTaa 2OedPqajzrCdq+Wg2nLOxZmbHTjOKpR3RkjSSXLnJIAOI1I71jhEeUtIWYqNo6EflV0W11IfsyYA bl2kPzY6njtV1Ha1mZSve6RN9vRpCqSeXzgtGMtj1qK4vLJmzI2ccbhknb+HrUjXWi2K7LdFdi33 u5AGOfQVz66hmd2i2bpOiouTj8u1YTrJXZu43srbFuXWraC4WG1gkldmyXYYGO2PSie9vJlaCddo znYgxge5qg+ydChWTJIOTxmmvNbYcuSWXjknBz1rjWKabHHC3di+gtHhP2jnK8AjOB/Woprq3VsR IzKMYBwOPfsOe1YP9rR7g0W/IO0YGBn1z7dqg865vpQ0buq4LAL93A6k+/pWU60XqinDlWpuXN/K pQBdx8wZjBGQO5pt1LDLJ8zliBluccn/AOtWdH9nZTJNGzEL9/IGMdifeqMlzaRQiWcBQOcrg803 WsnfoaxopalyWe6RVO9Mrwir6HgVGYZ4kk3AojEDc49fTvXKX3i2w0xw1wNmTmLdzXI6n4+sLr/l pOzE5wOf/wBVcM8dBfaNOWVrJXO/aa009DcX0xQEn5TgZA/pXIah8TtIsrwR2cbygDDSdAPTFeda 1rF1rsiZzHFGuFDHJJPc1z/lb3Jk+ba3I6c9q8TE5s2+Wnsd1PDxUbtbntkHxEsdRfynZowR91hw fxqjdeMdMtgXQvK6fKqgd+35V5SzSKRGilAe68g+1SwqZp1QsF5wT3rnnmtVjhh0kzfv/FmsXgFt Hhdw/gOSM/8A66wVEkDFFO7C5JYYAP171Mtt5Evy/Op5HGD+NSSyi4DZGwAbdvqfpXDVr1HrNmij FdCrtMiKBJyTlvTJqzOyW2IztJz94c5PbFQLAUiOcBTjHqPYU5ot7KhXGMHOcj2rJXujSPmWobrU JEVJHcKRhtpwB9BViWLTVfcGkZ/7q+9RT3sy2w06IIVJBYoOeD3PWqiYWYyjOMdOpJqnJvzI5PkI 9vJMqqSyrndye9QNFPgBWwC/447mr8U0L7zPGxbachj6dKgtrlZLVpVjwdxUBuM4p09dS3HoRNFK nHTnGT2qrJC03O8oOo47jvWzBMsihWT3OeMYqtOEnnRgwOxQMY9PUUpdhKnpcpyECNd5LDjb6cd8 fWq91LJDGkq4+9g55JBrQLOx3fL04A5OKryFXbc33hzgDj64rHmsmXFaFFhcTPlWwMDGOo9avRwE Avk5BADDHb6VZhVM7htVeeh+8TTGlVV2kAru6dqfMKW4+ae4ul/eHdg43kYqqRIsxYc9ixFXA0O0 qgCjuB3poeUqFC5AHJ9P8acpPV3KsuVWACMOWABAIzjmopRKzhIsgMeHPGB703BzkD5QB06Z9qUb UYhCCCchM0ipScS75JhZm++/QMeMDFNSSCROr7iOSRgD6VVaZ5JF2ZIwAyk9T7Ve81HiEUuCwUlB joBxRZNkNt69ytPLGYzGpJbPGRwfrSL5k8Z8wLEdu0BBwRSZErKyqAwBI9T7U8rNbx+aW+8w24AO D3FJRuDehPJaCOISjI+UcnkZ+hrRttJ1AWhuSoccbcHFUpZW1FQhAUoOufvfUVsy6zbRaUltGSrx gqxPQ9jiuijGD5lJkT9olFRMfUb8u3lw/MgADEjkN6e4rGhkEis8mcKdh7A1PbXQmUsF/iO4njJ7 VLPB5J8tsncA4ya55yursu2o8QgMS64Y4ztPH5VAUvWU+QFwGw/firReRpOWIcqdu7+tZkj3Svu3 MgI5xxux71SinoiWupeM4AdckyH7pzwPXiqpMYUrIORzn1zT7SMqhfIZyNqk85B7/WklilYKsh2g NjHGCPrU6FxT6sTZ8hYMOTjAzUjwSt8xZsnBB9hViLSRZ2azqW3uxXaxzjPOfpUZt5N7EFX290Of zBpNroVa/oQNGVk8xgcDpj1/+vSqJs8k9MAt2FXUgubmFW3Y29WTJ6VFLKrY2gE8glhRPmsOMehV MhRvMJJTgKWqwkGD5xZ2yAQF5H4UggEwzGUOAcoTgimFJgNsZCr9e/rUruJNPSxYS5nvAI52Yrna qsOV/GkkgWzumktXd1wAquMdv6etECr5mTgDggZwDR5vnyGEgnbnGeRj61alF3uJq7sWrV4Jk/0h dzdiOP8A61VruLa2xRxxjA7/AIUtvCFhERw+ThSOox2qzbIXJV22kdQfb061Sm38IOOpRtmZ4min O4DO0AYIP86hRJc7Y24B5Q9cfjT5xNHMgjyYwx34HUdvzq2iAYdkB+bIJ67T0xTSvoTydSo9u78n JU9D0P0qRAIgW+6Rg49vrV8W6GFpwAMHKAkZ/wDr1ltFdPKJQjEdCp7+uPXFRONmFnYlMscK/JyW UnpUVoV80tMW5HUDHbjNX73S4bW4iklkSQFA6rHnK57HjqKqO888hSTocbcd/rUc2lrFcut2RFbK CQSIMs2VJPrUuBKwdh8237p/iHXNMkiEkgDowX0GCcj+lTqEk2/ZiFIGME9/XnmmpdwabldF4NJ9 ikt2CMMBsY+YenJrPijQR/NjdnKrk5A70okhYYlOTgnPQnFVYxi6IkB4wwHrn0NbSeqVyVDRtI0D E0mGlzgkgoR0qrOn2Y56I3GR0596lmuZ8fKpMZYAADLD15pYInuUYAvtHVT29aUuw7JaFB4yw++c dPpWzC++BraVFLr/AKuReGx6EdCKrw29ukxaZGYZ4AOMe9XGkD/OFHfisedu9ylFIzFh2L++Yqoz uLdsc1c+0LIgaNlePGAVpWVp1V0LLg7Tu6GqcMaqfulChO4Dp+HrWmiQa30J5PnyExjGCuPX3qFb URldoIXHCg/KRUkNxFuKnKt7nBYVdghmKMwPy+vUqfT8ahXvqVd2sMe7LosMyDK8B8DOMfrWdLGk kaiR/uv8qZxjPei5RxIsjNxg8EcH6GpYokkG1jgk43HpmnJsjmWyGQxGVt7lVPIHofrnvUkcMqrh VBOe/GQau3ekHS4hO0yyI7DDJzjPt1rINy0mY4mbJOWBxjjvScWtyr6XTHXTJbMI5FJcnkZ457Gn xpG2YlTAU8sp6Z7UkVpOVE2R83APXH1p7t5DbU43EBvSle2jRSXNblEkn2koFOwYBbpmnWEYlkbe uEX36454qks6MxhYnKnD4H6VcUmBdzEBSRhfb6UKetmEotvQlvbvMjNCg3evb8ay7eOeV384sSSC Mfy4qWbLN8ikKDhuxI9q1x9m6x7lG3nd1/Sm5W2DW4jLCLfbGQxzgpjB/CoXufLULCOR/Cegqu8U sNzt3qA3P+FLdpKsoViPuj5h0/MVcb21Mktbi2TwfaRJMM5YbwB1Hfiusu7PTY7Q3unzgndnyQCG WucsbiaFzKqocjb8wyuKtm8jnba+yNwcb+QfoRWsai5XdXZUVJy32KhhLR+eTlv4z3+tQfuv8rS3 slmqiOAyCdjhkblT7iqXl3/of++f/r1i523JlSd9D//T/jNm+KVx5xl0uCUHdtBIJOPX/AV6Ppeo anqMEUsjFHlHIdPmzgZJHr6VvyeGk06BVtUR9xzuAwAPoRk1yLeEdalu21DzTI6SZhLyFU/FVFfX 3qRfvs4YVIS2t/kd9PYXkzMgDlVUKrHozd/r+FY40ueAbw0SuCACQOp6nByM+la9rHM1osN3cGe4 zsdY8iNPUZPYVz3ia/OlwBYwZn/hiXkHH95vStGkl73YHVak7SOT8WeGre6D3+nmWW5+X5VI2YB5 PPX8Kr6FDZQ2yNLZn7SoO+ScD73oo7CuYk13xFfXyQw/u/nx5MK5+gOfX616/b20r26NJbgybR5h GOcY71x0aaqScoo2qzUYO7Io55T/AKTMQNgw2OQO+B/KuR8R+MJrK7bT7K2VzgM7OSoG73B5Nd7J pLTWrXM7NAqEfLjnnsMcms+fw5a36s0wyQAxJXgZ/Hr7V1PCVXpHQidfXXoeLztq+t3W64kdgeVR OFA9vy61jGxtoXLMAW5yx6fT/wCvXpuuXem+HYjDbxDziOEXjGem8+vtXlbrLfTbrrc25uc+v4V5 OJi4v3ndnThZqXSyPafDM2oX+mA3LxMqkRqsIOVUDoSMda6W1hvXAxlcZCqDyAPX0rw/TrZ7NBDb vKnmNnbHxn0rutGbxDGfJvZV8jO4h13Oo9Px9678PW5/dtqY1Pdk7ux27IsUvlNKSWH/ACy5P4ms a91PSLHENw0e1SBhpMljWNrUcuoxCG0meBcBSoO38Tjn8K85k8Nagl00bQtICch2B/P1orVJLaIU uV6NntqzboAsBRVcgZjXqG9T71as7dIgE2LkEk98nr/ntXm1h4Xu5URJrqXaGB8pfug+ma9CisJP LDyyY2sBl+AR6AV04eEpSScTCrUjbR6F5XkhcyzDJPHXPTtjpimGS5u28plXHBwvp1HFNwzPhG3H 7qYPyg9+aWO1vPtIieJmLcD+Hgc5JJ6V6jjG9jkrU3owuxDOyh3YH/axk4/lVG2srvUJvKSTeh+U jgKBnueldN/Z0bqXyMD5MHgVa0vT/s0Ri0yFIy/LySkEfVV/rWMKcn6HTCqoqyWpW0/SVR2+yq0j AYUjJRcdx0Gfeuhs9OkKs+6KMg53ytkn22ii2vrhN0Vy43bvkjjbOcdzt4xSMxuZA4Bw33iOrEde R6V2UoJbMwcude8hL0iPM1xKShJVvITaSenWqL3djIymOBY9ifKZSC/4AdM960r2NpR5D4VBlsD7 wA9PesyPwrdMRNb7OTnc4JYD2qZOd+YqXLflSLMF3EXR5SMYwwQ4zjoBjPSr/wDaKxocBmcHADYG Aeny/wD162bLRvJiZpPlbGPmUY4/QUiT6dGGSZlcck8HHH5ZrqpN6NoU0o6JHMLI67jI6MefvHGf bjvUZ1jyd76pcblOCkUWM5HYeg+tdFLa29yRI9uduPl83CJ9eMHvQj6Za4gjiiG8jcYFPyjvziup zsuZnHV51t+OhyV3d3N7phdoFjg52xM+0tg9WY8muIFxPLcGK2iACA8RguM/yrqvEeoxT3xi8qJV C7UaUnIA71zcV9ssmtYJJGDHaTHgKVPoOteViKsuZqx3UYQcbtmS0U0Q3zlY0DE7Xxkn6dh+NWLG bzdSi+yM0gwPNaMbQPp3NZN7LGz+SiuNi5Vm6Y7n3zVC0VdjB3aNH6Mp+Y84ricJR0tuUuXnVuh6 7aRWwuRJJGJGDkR+YdwUDu2euO1bFxrN3E5igEjJgBTGNuWB6dPzridAFmsKpJOHMZztBJG0cdj1 rsLS9gBDSyhFAIAA29eADzXXSvZXQVLXbT3LJmuLiTKmNCCG3ycsPX1qtLd3hQqSMdV3cA4P51BJ cRyN5Fm7tvJ8x0ViAP7o4qxa6XZRSO2pSKnRi8jfN7AKCTn2qqc7O19iKuyRBb6zGm2FFxtBB2jO c/UYq+9478b2JLcBVGcYqxY2SlvtMUc80QyEEqCMN7nd2+lVdUlttPBCFA0jhWCjcUI/nW0JN9CY tSSakXjY6gsTMJvJBG9y5Jz7VGsNs8TMlwSzYLYH3sD0UcD2qhaeVcXQkCNNldu64Yuceyg4FbQw pFuEyTkj+EADtx6V0rVczVjN6L3DNNpGCIZOWbozMEDDHQ/xYFGm6c9srIZoxzwsAJzznljxj2rY isI55977C4T/AFfVVX8M1JIqW84bK8cEABV49BRDCuTvcuVe2pFJYPIY5pAoRTklmxuxx+Z/zipJ IRaMBF85ZsbUH8yeKtTXESbmuhI2W2xxKOgPc9T+tNivbiPJsYNinOJZOAfp3PNdfJo1EyjKzUns hJtPuWf/AEyR4lc5KgjeR/dAHr3NTJYWlpb8M4J+bYCFC4zzjjP1JqBlL/vrqVfMXaTt5Pucn+pq tL9lZ90bO79f738qmnhWknMiWJim3CJP/aKTyeXbq7gH7ueM4/DOPWqE5vFJku9/ztgKFBx78dPq anZkWVPNMaBRyHOME9vlyaiVZJLgyxBmZQVRsbIxn6nn61cIJ3uiZzco83cS6Bu5lM5ZghAMYbYn Tv6/SrltCkcZSJliTksy9Fz6E+1ZlnbNCGgmYFVBMjRAEu3oCfT1qQy2skYtpLdnQDnzW5Ofcc1j OLep0qUVo9GX5ryO1OY2EiJhFOPMY/gOM1AgG3zniWI43DfjdznqO30qk11Gh+zWilVXkeWMLk/7 R5JqhnbnauX+80jNvPPpngVrOny2aOSlLmdjViuARusY2dRn/V8c9M+tNuNRmh2iYRKG42ry344z 6etUWMkqrsIRFOMk8kn26YqFvsSkF5PNPZVGDn8MmsufkSbejNI25XGxMLlJ0AbziucKrDaCB9Oc VbliLRqFQKpPGwZ5PuabY3EhkEghVkl+6WbGB2z3qO/8iWTzLiZGVTkL2yD7fzNOda+yModtiBfC 63FyZGcgn7yhsZ7fjVHUrK20SKQhMyHBO8jOD04FaaX+h6cy6hp58x1yp3HhmPoM8BfWuPn1BZ5m lkGSZDI0mepJ6AegrkrN2uz04WtbctNqjGAQwGZ3xuYIdijPTJ60llB9jK3d+dsaAu4znp0X6nio Ea02qBHwrggtySDzknoalnvdkLQoQ56hWGQB1+gzXJTjUT5mxTrRelhv/CUXDsZrVNw4K5AH8sYq GfULsxmSe5GWXARPXPc45xWadS+2Dcio3B3BBzkDA9hVqG3iS2SS9+Tjscdemc4qp1G+pjzy33sV 1kRk6qDg/dySx7UxT5JVlD5C5JzlifSmm7sYY/LVlYBfXJz6n/CsC58S2yR4g+9np0yPc5rnlVhG /NKxbpueiR0snmSxRzI/ltg5bPOCOlfPmrJ4ov794WuZEUOSiI3HB613upeIVMIcAtySETnA7815 u+t3VzML1wI1xjK8nA9q8jFY2Dtd3O+nQau4s6RNd8R6XEqSqjqFw7MTluwrQT4jFoxHcxNCSdhK 8jHt04rhHv3n3RxyO4bH3h69+apBCXMcpU7O4PpXmSzGUZWg9PM2+rRkrs6rXvFt3deXY6VJMi7t 7zE4LHsPpWSNb1p/+Pt8qcBT0P1qj5gGRJgjux9agnuUkl80qRtONqn5QPasni5ybbZooLRFW6eQ 3DXGoGR9v+rMjfKSf61PHaRbQykg85IH6VK0qNGEnAYfeGegPb8qsW0beWJJVYg8kjIrjbb6msrL YbbziC6WRlWTacsjDgqKWVpZZG8hFQTPlVA4FWLto9g8lWU44xznNVI7WV49zZypAGfUjk0SjsgT TLGo6dfWcgWUgbhneOQT35qvFFdxZcAFTweeatXN9MsEds7mQLnbgdKrs8u3BVg3Vnbp/kUi2k+p ay4ttnzYc4DHp9Krfu4JlU5ZsA7+1N8sSAeY5ODwvY471MFSQeW4+XqWHX6URJv5i5N4uIwpRBu9 yR9KI7Zk/eTbgM42g55PNNtmWFAbHdGDkFWB79qkaNm/1uQ5YEEdMUOLZV0tExVfyyxH+cU799JA LraFUnI6Y4p1zDGHVUcHIG4gcZqA2ztDL5RdlXG4jpzRFKLsTKf2iRmll/cwEKGPznHpz1olKeUs cbbj13YrPgnZNwjbqu3bzkZ60hwMBCzEfex0GfUGl1umaOelmi2wJUo2G6lj9etRIqnafmY5G5QM fL3p1tarvyGHA5X6961murdYWWONSd33wf0qqUV8RF2tjWNnpTxbo0UDu2TWRf2+m2777V/mKncC QfpjHrVQXNvNE1vGWXI5U/4VkzRRwTIkg4BxHhuc1pUkm2khxjqmXAkDRqUQArk+3PbFZscfymNV YgNufaM/lmtOWRz+4IK7cMQOtPbc1uWTITd6jJzXLLTYpLWzM8wyPlogwC4LZwePQitBt8sY2Z5w CuOuO1Wo7axkMkYmKboyS7f3xyBxVV5GRDHGScEc55+op21HFaaFf7NKz7I2A3ngE8fnUYs5PMMT ruK5GF6ce9XJfKhwkQGWJYgdciq6XChS0QPPDc8g/wCFK1w1W43z1ilBA+6cgHsPrSNcEJtI3FiS mM8D60OyI7TW8RIJzk8Y9arrPOxCsBtHofWrj6EztZk2IC6lgwcNy2c8VrjyWttnTB5OM9fasRir NmPIYjgY4qaS5ukP2Yqd2Mnvj3qkrq7J9rZFpLWMzGWGQglSAvvUc9m0sJ2gE9GLn+nekLwApJIw V2GMVceKNm2hlDEbuuanlS3ZSk+pTaxW3Rdr+YwXBAHH1pGlLujSknjIJ6gfj71KRLIuUIRlyMDp UWWPMwBXG0cYwaJ+RXN3JZYkKsyANK3BGecDvWPBG8k0iznaAwC5HI9eatCe4ikLRgZHAX0/Go2t 5LiYSB+rbip6Z6mhNoOVNXRqafYfbbr7JE6oMjJJ6Ae1aGqeH7jTVHnvFKrcgRHrisuNWRjKcBDw 3P61B5Vq8m1ixycqSe1VFK2u5Erq1tjRW8lMzAjMZQDYB2x3qOaOJW/cBkB6ntk+ppCG3eVGQAV+ Y5wSvsOtQRN5Ib525OWjPIHbP41ENNy+d9C1Z3txYZEJVgwxtbp1wSajuS7SbdygM2dijjNVsojb 4yuemB0x/wDXqRrtpFEbbflHy/8A1zQpNq1xJ21LMdpIk4kbao28H1NV3MaThZzx/F5Y6fQVO93c xrFcNgKDhcdCwHSoZvNuSkibF3HLDnI70WYe0VrIsXkUKRq1qd68N845B+n8qx4XmEhI7k4P+fSt Awyt8ykccjiqkrCRCqqAQTkA96Jq7ukTT1VyaAhP4y2WPAA71ejkTYYRuUg8HjABqj5bIgwec/Ni pooXicB/nB52jPANFOOoXLLRDaQ3ysvIbqpH+FUZXy7DIYg8BQOKkuCpZYgx2nPyjnH1pIrQOwWB ucEHt+NCdmNp2LEIVUY3EgGOPL/iINPluLop5SnEYY4xjPuDVOSOSJnWUFihHPBU+4NR+arv09vU c0XDm00LKTrJJ5bKckkDJyMfXtUF1aDIK5C/Xn8xSzgwRrlSUyOhyPr60zeJ4yYu+MZz2qXdvUrm Vr2EVp2KwwkblXLA9Dz3p0nMiuMIVHf1pqebDOHkCEqME9M5p3nqWYy9R3XkE03toRT3sQeQRlZh khvl2nufwrVW0mMDFSrbVwc8Pz/MCqhnGwN0JbPHt9aRrgwyeY5xnqG7n60Jq6uVJN6JDoHdGEBI Ix3Izn0/GmEzW1x82cknIIwR7Zqdl3sJWCB93Bzkn3rXV4Luy+yzOBKpzG/cj0pRh2YSempnKQ0v mnlQoGCOc/WllM8eJWKqvcL2qq8hEiRySlVBKNjuB6ipnAMhQjI7sh65PBNHkVJ+Rny21xKxdJSq fe+XvnqatrcXELrHcfMEGBJ/ez61bjszcQuoKrgjAz+oNQwxxW0LSKW8zO0ZPHuMGlKLSuPlvK1h TCk7MSBxgg470+O8uLNyUBIHTB69/wAappdPeMYXzEqkANgc54PPepLmLyUCwMzKx2jHb60OK+yU 7vRm1cX1hd2Kuy+U6ZPA4YnGcj1rFe7dkClcHOQBnbk+lK8Tx42qdpOMnofpUBiYuGx83Xrj8qHN vR6k2fRDftkkrCBgNicck8E9qX7P5ZbyioPQHGc59jQbeZUyijJbPzccexqxJEirgnK/e5wcH61D lfYfLa4rQz24POARxkcGs/ygZSpJ+7kn0+lS3Fz9qkCq524BwOox71ddUBDPnaed3c/XFDXYNloU TtWJhCG39csOvuar+Y1zcDepAVfuryBWjC0Um7L7Co3KcZBPoaY0bQyNJJjaR8yYxn3FHnYtNv3S cXbyp9iaUEoPlGM9veo4hGjNuxuPDIOgPrUccU0hF0qhBnPHUACqkamG4e4I35PTFXe+rM6nu7Fp pSQECbsZ5zzz1/KrUAQ/cY4PHy/qKnt7i0uLgwGLyyRjcD/jTm8m0VoYWjIOdzDIz9aIx0CPqVlJ 85wI8LgcA8fl2qG/u44V86NGKBfmJIPI/CnFfKLSrjpzk1A227j8r/lnkiRT3+lHP3LsPs1eTF3c o6MeUDY4HYg+9af2kf3z+Q/wqjKJJIEELjEYAXdwxFVcXfqPzFOyerJjCT2kf//U/lW+2R6NtS4D yORgD7+0HqT/AEqxJqsKKZ7aNFUr0IO5uvQdhVFWe/Ito4/MWJgshfJG70z1NSm2uJna1dkT+/5a 4APYE9/pX3vR66nhwi7WlrbQw472W+cvJGFCEsFiGMH3NNCT3eZFi2g8Nk4Gfxq2NJMV8UeR/lIJ AP3j/dCir/mQ2iNLHE84QHbEgJBbtkitVTW0jVOMI6K5g22gNdyhUjiMhYFjjYDj9cV1clpJEvkv 5ZA+95QIxjsT/jWNc39zFaiaOLLkfdDYKA9d341CktzeWhkeRwCNuxB39R/jSa5HaKNIR5o3k7li a+W1k2DayYOXAJwfQnv6UJe+ZAfM43Exx+SPTuff3pYTZRR+URvOeE57ep6deprN/tJWQxxBHIch sHH1UE+lEr3tIcNIuxx+p+BtHuM3PlyMTlmAY8n19aLXS9LgCsYGViCo3rwMd+ea6L+1CX2BXCg5 OGGBgd/pXnniHxyMhNGKu6qRvYHBP6V59ZU4+/JExi5xsmdC9lArJFBGCwOcgbR7j1qextryN5cO JMnAjzgKD+X868bl1nxRdAyXN5IAeRswMD8q6bwlc61bMs93mS33Fi7EtIzEcYHNctDFq6Sid/1d bs9T8i3VAbiP5yflEQ9O+f8AGqsc8L3/AJMsMuxQS87nA9gABTG1Q2uJXZ1VyMJgA/jUl1eS3UJe JyBkELsHA9cnivTVWLacjkqKSvbbY2IbuSFx9jiVVJJCkZLZ7n0FXb6486IG52GbgBEHAJ78dawo Lm4eBZotsgbAV5O/vjiuvRPPcGFgm07WIXGSPTPau5V21ywdkc6pJfEjBi0++2mdIypQbl3gkfXF aFlpt2bsNqP3T8zFeeMZOT61tiQJ+8uAZV6B3bGeeMVdjtXuIWkk29C3loxIA9zSWHTs2azTVzHi leYmCzi/dp0LYAP+NTJFcSgu0sQjdcOq53Ht1P6YrQsYY3nMOQi5+8x6k9vbHpU15b2iRbLeUyHc A+0bVA+vU1tBO9mHIvZqTdjIijvLZfLs7RQijKsDy34n6VqWEV1NtfUHQAZzGnUDsBj9TUJvrOJh HDCzHBUbm4H0Gas2c90BiNfLGeQB1+podJuW5zuXKk7X8zRARGMul2rNuYF5rk/KvfviliuWdgHu MNktthUkH2Bps8N2+TGjsFXJc/6sA/XjPvXLOdUUtEX2K5IjHbB9l5reUY2sxxrSk0rWOgn1CNG+ yzbTIc/MzZAzyOBWJNdXEW5J5YFY8IGXP0J9arrosvH2mQqVbOYsfMffJ4FWEj0RJ1UhpNpzjduH XnLHj8BXO5yl8KsdTdrRNC1kkjicXc3nhVBAUY5988/hV24hnNiJ7hwilQ3lj7zHsMVVkv2jLJo9 nHApwS7Hdz6/j3rOnke6iNxdziMqW3Z6H6AGuikpcq59GcFSsk2jz3WFt1aUuH3bsKu4u7n0rm5r 14I/JULGFAZm759D6Vf1OK/u74nThJ5YGGIGM577jWZqGlXkMY+1hORhQSMn/PrXBVh7/MjeM04W uZlxFLqE6lnOQuZG4Cknp+VRRfbE1FYnWLao+Xb3/AVFcaXfW6HfNsIHKA5+lX/D8WZWkuJNrY+6 T+X5035jle9jovJ8mILZR7yR87L8oDHsSK2IpdVEqLdywRJx8ijeQPU9aSKKW5Qy73VAMhEGORxg Z7VYsdPjmkZZItrjHzSZOR9ABRFKWxnqnroWYruyMjs8lzMg4+95YJ6HgVuW2rWWnqrWdvFluQz5 dif1qhYaVDE4UqEBzhn/AIvfA6D8at+VYWdy8vnoeBtRFyR6+vWu2KXVXIjVfc2L03+pkSXMkqgE Nt5Vc+/c8elZsixCXzEAxnaGfgc/X1qpPdSXoDWKOGI/1suR+ABOaeLG5uAouG2qeeFzwO9EEpNx t/kdLp2Sd7dzq45rGCMp5iqT2QZ4HoT2xVpVtTEJt5xncrSgMxz/ALNcq1lp0an5pM9gc7ST6460 wyta4MrnIOUG7g/UDJrqjTSVpHLzySUmdtJLdyReTB+4U/ekbABA9FFOZFlgUTu2BgAgYPt/nFc+ t9NGiyEPM/8Ad+5Gue5zy2avWknn5luZ/L2jOIlzt/Eg8mt41FYPZ8+q0SL8cUqqZoFwp6SHoQPd utRyyzSxhYz5rjGAB0HuelSC/i8vzY7eaYnhHuCOffB7fhVGee9uEKs5VgfnWGMIPpv6muiNXlV7 EStKVkW3syq+ZcBR22scgZ9s881WlI6DzXA6lBtGehHFZN1eR2KpczeWqn5UBy7M3asibxLHLIqS khiN21yAB/n6VNSutbsnkTj7qOniZy4+SOOM4B6s2B1OelTuFkYJHubaMZZuOvYDj/CuIfxDf7hB ZScOdgCLk5zyctjP5VZurfVLWV0Mhfcg5mbr3JwK5IYuKfLGJUqWicmdS91bJM1skgbBKlVOR79K oS6jaQocoyE8LvA3t745wPrXIC/8i8FuJFVgu7ECbcA+571fikFmguo9u5iMyMPMbA9zx+VKOIut UOUIq11ua8l6xcxIrbgP4vu+pHbFOilacbJnRF5LKnIB/lWNHqIlkMXmyFmHyZxxn+X1qOaaOBVM XVRzuOcnuaz+stJrcqNON20bDtbLvMjllBBUduAM1ntrqxRsdLt1+YYZhyfyrButQnmildnAG0Yx 1JP/ANasqO7kDqsCSDPB56459cCvOli7pJnVCklc6V9Wvbplt3ZI9wx5a8kfUj0qmpdXeJwpU/fy e/pWdP8AaILcOgUEnuclc1WGqw/xkbRwAxxk+tVPFJLUlU3HZWN+5IkhVB8uAeVGOKzDuaPbCU4A yX7VymqeK7bT0aEzRiQrkKCDkfWvPofH975jEhQpGF8v5j+tcOJzWC0b1N6eDl0PdFuFYkgsoK8n pz7VmT6xptgp8xl5Ubsnr6ZJrwW78aa5cystu/lqRg5Hzf8A1qoSS3l1PG9/IZ4yN2047V51XOot Ox0KhsexT+OLGGN/s7QooHzED5iPQVw3iHx3csn+inzJGx8xGVUD8ulcLc2ybt9ouBnkH0pRAjAM R3yQK82pmlV6J2Oj6tBJIfNqGuXZ8y4nbODkqccEegqKL7URsydueTnknFW3nj8spGAGHYnv+FVT N9qhVpP+WZOAvAzXnuq5O7Z08tluOSOfP2eF3U5AwDnIqRbO4s/nkHyDJA+vap7CzutvnQKcnkNU t1cvIjW0+MqRnjA+lCXchtXRSB4EoOecrjoO9WpmtDKJo1O843Z6Z7moPLKkYC4PJOcY9qJfLh2M ByxO4DkYpK+wpLSxWkbfJnJAB+ua0YVt3cIxwfu49T61A5u2YIkYz0ABA49arrA0j/vhhw3yrnpx Ra25TWmpt/ZbS3kJvDkY3IVPGfepYNfuYXaHOUI+UEdc9qgigNwmGAJHZu+Kr3NlsG2TavTKg8Ct HNq3KEprlsWn1ee6HluI1CchlwCfSmy3d0I8SkMM4GOvP9axbn5HXylbCdCOOPrU8rmOLE3f/Pas XJvUppLVllFdZA4AI9DTpppJDhwAO/pUBOxQYwSQAefenMyyDbKPvHhRSVraEa7FdYdjbgxOf7v+ eK0hKjOqxqwXGSW9RVaWGaOPzCGwVOCMdP8A9VOEZI3hiN3H4VUdUXfoWiAxzGGP+zj/APVU7XsY K2TpkDClXOWzjnpVNJ2iQNgqg5PY8d6csDXMhnQA4B+Y9SaqM/MXI29WMWeCO5Hk42AnCnkgirUP 2lVaFZCqyMSw9cdqyVW5RV8lVznDEjmtFJLiCNnk5OzCn+6Saq6vczu1oVAkFvne4zn19Tyfwqyk ESybt4ZTzjGOlZsUaly94ygDJ6Z69KtNdRw2xQYJHRup+grFK2qOlJPcW+u/Kk3oM7uMqOBj+lRJ GCN7Abic5HT3poWJJQJX2Fh3GeeoFahvYFj+z9DngED7vrVxMpPUdJp9nCgnS4Dsy5MeMY/GsWRG DtnoWGCexz1BqWO+jSRg67j9MAe9aEt+b+xSAjbt4RlGMj3pSiraaDV2U1a8lneXG5QgQyHrn3/C oI0uEdlbBAGFHI4/z7VYs/tIP2NWVYyMt6kn1p8xmtX2P8/zYGelT9laE2behUCYDl2KhsYXvTjK qL5cZIIAPPQ4p08cO3cAyr3B6568VRW8ZsxRglSPvAcbhSnHoi4Qs9XYtsDIdxBDAcnsKakgSXLo cbuD2+nFbi6lH/ZH2eSAZDhS69cnmsUTRxTM6Z2c7AT/ABD1pSjy21KeqJxdiVyxQKXBDDqPqKrK 6xJ5coyCeW749qnU+fIsabUJ+8TwB+NE9qhPlowKq2Djp9RWjexm7kKs4BjB3KPmAHBGKnFyZ8+e VBU5DDrj0JqKRkCrbY2jONxFVyghXcoQL0yD1FZub3NEk1qX40V2IdWb5cow9T/SrUcUUNyPP5Qj awBGaq288jjhlGQV3EfyqWe3slYCSTe4GVbpknsf6VVHe5U4dBl/cWnzpYBgOA27rVAyxYYsT5pA 2I3IP0qbykjUTLj5vlKg1Yht7JRFcocTxkthhkDHIPvV35nvYwj5EsLtBbeZcRkK3HT+I+9QWMok ZxOqhvugDsOxPvVu51T7bcmOUxRlgGwOAT7CqDTPteaQDGdqsO/1qIu0tS5rSyIpALSURyN8wJGw jj8v/r1OZkllyVUE8BR6e1VZI5LqESHs3D/So2a3Q7ZCdwPB9MelNxu9wTTdyrJODe+XsbIXAcci tEeUqNO0i5bCkY6e1VShkJeBgBuBUDuf8mpEgBA8wc9T9f60WbFz9hqlZCDGGOCee2PTHrVm3gaJ G3DI659fbmmysoXaoI9CPX3pyvcFTHKp2ucJjpU3uwhdMmdHSAISPlfPlt2OOtXPNjSFsxfMSNrK c9exqn9lmecG5ba2wZIPbpyPXimSSCB9rsGAwMrnPHtTi7XLd+ZNGgxuWtDuXYM5GOuKzltLeW5E trIwDH99G3cj+VTzOzjCkYZQcHOKzbZ4xc7G+XaRnHcHuKuLbdlsS3b4tzYnuJVcRqgKD7rdCD65 7irb388bCN1Ayo5wKzmkyzbyzAMBtA5we9XBawCIyQyAlztCnrn8aqEHtEU52WrI1k8sDIVgWPQc 81ZjcRvuwBtwNuPz5qlMHiQ5OJBwAB696VWDMHfsOvcVlGLTHKzVy7cSI8+B9zGcDgZFUS1vFH8q jcxx16A1YW4gZMBN5H90YPP1qCGAyhmKrgjci5xwO9Pks7gvQrhSUIC9Gztxx+FXIbeR1J8sIBwD nHHtSXMRGIgWX5gVbrwKsi4e3c/IrblKgsOQfUfWqjTSVmEpt6IyLgKeCOv3h3qWK0t0xvf73GG4 OfpVl4EmG+UqMAkjuP8AH6VDCke7MjE/3M9qJJaXGnYkvYFSQNbF9g/iPTiqVxaiU5+aRT94dRz0 /GtOLfJCEbcQ2QyD096SC3NsCIj8m7kE85/wrGcNdC6c9DPjtvICnkBfvqx5x7GpvtNrHdB4lITB 2qTk/UHitC5K3LbljEZxj5TkZrLuFT5Vfh2yVH0ocdLXuHO9rDZIknzKwKFuRkYzQoaL93KxBJ6g 8Gr0EjzQiyeRQRwoJ45561Su4ZLI/wClkbt2OOc0KK3sEtiyHnQqE2lQMYPGcc1dnhmldf8AViMg MSh69+h6GqVjK9zL5e1cdAzjj+dWpI3gbyZ1++crIOn4GtIuy2Fz7algWqzxkW3JHUe9UA0kAZNm WOACeuajjEcK8Fhwc9vxGO9QeZJe4O4kqMI3Xdj1wKz0tqPm00J42mvLdst5ew5K/wB6rUJuUtTJ HIFwdu1uT+FQEO6gMMqDg47E0wzwQgQsdpHbPBp8lk2S5ttJleK5kYnzRuOCBu44qWUW7wqkbBU/ jXnK/nVeS4DZhTcDg7TjqD6VcjtSq7pfl3x/LnvU2TZcW3sjastM0u9si8Egt5IvnJfHzg/l+VZN hcm3ucJsn5Iy/Ix64qtLfMkRs5Qr5HyMB8wx057j2ptpE0g8wKquB+FdE7KKstSea6abJ57uWS7z hFYEnCr8tXLm7Bj/AHoXPZm5H0rH+zzbjcuQJAeoPy4I9OlTteK8bRSkOD95e3Heudyd9R2aLjWU slscKSpIKvGeMemKopAdOhdUcy5bO1jkip7JvKG22aRT1TJ4+nNOnmWZ2YqolAwxA5ahvSyHCUd2 JDNJLco82FJ+XHb2zUshS2ZoZ0HyN8xGCMH+lVvIZl+YMoxwWHcVUZ5IwH2789vQe1J7PuPt2LFx dF98dqoaP+AN97GPalit0s4RJjLnHOeOfrVKzsljlFywyrHn2q7NcxzKbTPy54Pp9RUx10CUvMcr Q+SJNw83OGX0FHmH/ZqnGqmcLztHHIrR8u09/wDP40nK25VO9tEf/9X+Wf7LqInGWEKD++O+M9up FR3dpHDGElJuJicg/dUHPUgd6jvNRSS3VrpwXJYkrxj2GK5u7mThftTRrtwS/wB4n0C9vqa+/nKE Wm9WeTFSd7PQ1ftpaVoygXB8shSCQfcmpbm4uIozBZsFwByx4P1A/pXHW1kVlbUIRIw6I0rYBb+9 Vj7Prc1yZoriNAF+YJgjpgEnk1n7f3eWxTi1JNS1LErOk5lkZmLDawVcA+g54Gazis9xIU8ySPJz uc7V69Bj0rdX7BYKrXUlxcSE/MT046H0H4VUulN0nmIGUAjk8n6ZPYVsqfu3sctSUoy3KIuJJJX8 7gom1TEpwf8AGpILaKCNZ412ZI+eQ889ePc1DcT6hIhtrYsNowGUAZPpn0HrTRa6h5G66bPy88bj n1xWcYJPU6VU0Vnc4/xrq95YWRgtlKeadjyoMbQfT6+1eWLCixr5e8Aj5gBk59zXrs+l22qSbZ1k hjiOV3gkv+FXY9Bto2zZIItxy7FdzY9h/jXkV8LUqSv0OqlUjC+h49aWFxqcv2aEfLuGTgjj/PWv Z9J0g20ASEqAoGcjAGOv1NaVlp9hBcbPK+dRkleST7np+Fa1wk8jgRxjyRyw7H69q6sNg+TqTKtd 6GM6wS3OJjvJAwqjgKO+fX6Ul9bmWBIwFDMw+Vmxx3zjrXQOtpNDl3SJWXOeFPHpT4haJbiJ8Y6C XAbOfc11RwnNdMylV5WvdMv7RHYweaFadx8qBE+QZ6c+3tWZBqet3l4bfypEjyMyEYGfT/IrdMty itBGTKgUBcc9e5pyT3MTiDO3+JlXDH/61XOPL7t7IOa0ky3PNFGqY3BkGGY5JbPpVYPclWSzJTf/ ALXOT/sjgVOlrLJD5rRzcNlC7bRj6mmTta29u25BuP3WU9c/5611wfciVR23Jbq3u/KFsG3uDl2J 2/MfStO3S4EKpKTjAZmB4JHQAd656K6fy8LgDAwzDp7c0y7muAV3vJIpHCqcD9K6ZKMY8zZE05S7 2Oq8/TYJjJp6tKU/1jyMPl9cAYH9asy65pbwBYpFcbssWUn5h2B6cVwNvLBNb+TdoygsQBjse5x1 rbtLm0sI2toYHcIPlyuASeO+c1zUK/RFVVdKyNvVvF62tvFb2MQm3nMhwWQDPA7Vm3uqy3LxyxQ7 G+4E2/Lu98Hms5knklxMwLtjbGSDj8hgAVPZR3Fnd77tsqrFhtzjd6+/5Vs3r6mdOTd4taInMjIS L8yB2HMUQGW/Xj61csYGIQ2MEsSgklpiOnoB2qpd6151wrW/lgN/rDkLgepPrQt7cqpdBkEZUuAV Hvirk4fzCdSTnaKudYyyBFjlaNVHG1Qcn6mqK29oZwk0LuWGFDc5x/KucXVLx7lLZwrOQfmY8n6L 2HvU6TS3B3ytIqAYLmTIwfpwAK39rCVuTUyjTaaVQzPEGqvZ5QxxRqn3UQ5C+5GOv41xLmbUZfts jArsJUcDA7YFM8R+bdTGC1JdU+8xPX8O9Y8cot0eQYTyhgtnkjHp7152Ibu0dNNWViK5EVzMQ7E7 VIkrV02ztmgEqkswBOFUnkcADtmucSZpXM0Z3GT5iM9PrXa6LfR+V8mFYBlyQTwfQDgVg4c/oau8 Xzsvab9rtrgXVxIVVsKiPlmY+49q6y0tdWVWkZ2Z5GyA/wAuM8DGe1Z2m6iiMEMWJANsQweR2JJ7 11TTQ28TMyFpiATlsD256mvQw9KKXInsYVaib5myJNDSA+beTkkjaAemfYDtVk6XYkeTErcKTlRz k+560Q3N5JCJXjiiVTwFG5iD9apw6zf3M8n2OIQRRHaHccsfXJ/pXbHkUUmtTlrOUXpoi6NHittj SgjC5JbLkfh0FOVIbnHkgkKOJJnyB9FGKzbiXVLrH2q7O08sseOSBWRcXs0GyKMSLnJ3SdOKqNSm tWhXqPVM6lI/tDhAZJcHnACR/pxUbQTLdAQpbw4OMr85/Psa5FrnUJozJfXDbSN6qx2qR6YyMdKk hvoYtxjHyAcZO0Z9SKxddNXNacJOSTR2TGxZ5HvW82QEfK5woAHXC8mq/wDbUsQCWyqEUf3QBmuW i1ASZjtUSQ5xvJwPf6026W+mwpnEb45EIOwD/ePU1MMSle2pvGN4rQ6SXxAJpFV3Uuq4+XjGeDis ibxW9tL5UUMr4yQVO4e2aydNtrCOWR7wzT5Pydvr+VWo9WtxKzaTgBQUDHkA+p9T71MsZKXw9SfZ pWZRLa7qlyskETqf78gxgHnirTaYsTKJ5PMdjgoFG7Of5VUudYvJSWuZCQgB2RnBJHriqL6jF5nn bT5m0bRn7uT29TWDq2vzEeyWyN24xbqIxng9OhyPcdvYVVN3OcJCF64eUH5mPcc1jHW4k4kjVnbj c3T/AOviop71pYlMAUIWI4GPr+FR9ajFXbNJUdUkaTtCbsxrGjyvjBdsjPv0zUs0+/dZzux28bI8 ABvz7Vzct5Bb/MMb848zOePasq48UabpquL3YByy8YJz71wvHRjfU6JYXnav0O1iMpk3QjKqMPkg Ek8delVr24CRhp32ouV8sYyff8K8/wD+E0gmjzZlVXoAuRjvk1xuseIbpsssjk54KnI5NcUszjBK zuzpdGTbtseq3Gq20IWUgOwbI7/TP0rJPja4tGeOSKOJAciZyCWY8nArxyefULkrczzS8DHynH50 mFYAzN5n+05zk15s8ykzb6vFana6x8Q76fMdsFkIP3Rxketc5Nr99qi5IMa9wvU57VkR21uEwpdn J5YDtStJJBIYYlYnIOScH8K462KnUfvM1jT5Y2LD2WYi9wo3EgZJyQBWdvNtN5sCg7em7se9bMNj fXZZRuBPY9j71QuLSRW8hlwV4YngkmspW0L0u0IWklttz4543cDmopLp0iWSMZx8u4DqfSr0duyR GJUDL91i3TNOTS5l00XyBNnmGNEU85HPT0rN72GoXvboQE+YjD5lzgH1BpB5yjYCpPTjsPars+mP borKz7vvMB06dKzI23sxI+Zc8CnKDW5pKUXtsRPNDZAzTg4z2GTz61qxvbMi3GNioQecZY9uKzlm C4VuRyeR+lXrm5S8VWRFhCgAsBxn1NS2tDOGr3OqvNTE9oJI1VCSEIBAHTiuTknWSRSxyofBK+3a mllYZZ2Ef3gcH5iOlSSmKWMquTgcAD86uVXm957lSikrJEYH25iYRtXJAJPB+lXfLt4J/KMROFBL A55/wqnbQkRhMEAc4Ax9atW0yg5ZjnJXnFTGW7HdaD7q9dtqomeSBVW1iPmeawCkDnnp61ozSLEw jGGYDJI796y5HJYXDEL8pXnoPwomtxU7l8zwRxs5bGDkAd6Y1ys1uTIQQATgds/hzVEzbm2SMAg4 X1NSiESBokATjPynkn0peaE21a4mxmRcnGD8oJAHtQYpY4VkZkO4ZCqen1qspKL5SqWG4by3Wpdy SP5aZUE7Ru4AAqGhwnfQSV1c7HbknOF/xq1scR5A2jPBqnEkkThV2lW++wGOe2K0JIpgoaQ8AZAz 7+la8qsE4u9yCGSdxtY7sD73QZzzUxUTOGY5KngHpmrdtdWVtYSQOoZ2Pb+HHPFVrJDcJJOZAEXG B3LH0pQjfRbhzJK8jNv5ZhANv3y3OPTPStKV4vLiihdtrAOwbs3fvVae6juII42jVXVyu7+99ad9 jMQZyWb5sA9Bu9KTj0Y+bRj2vyse2EAEZGT/ADqkROchWGHBJX0q4gt0Uo6fxAsfarI8iSMzW+0s Tt47VShfYHLTUpSW7rEkaHdxls+1V3jKIxC9FyMjirwhIGU3ccnJq2QDkMRnb8oHf86FT01JluzK sDAnmXFwmTjjPPzdjV8PJcqsl2ExghCPvYB/WoEG9RGwC5bjPXPvVORfLkMasykAgdwDWWqd7lJe 7YtMGtWPmFZOrZA4qkP3udmVwfl79avR3yjEtyAo4UjpyP8AGmObcyb4shXJOz0H1p8gOTSKMmYj yMsx+8vAOP8APpSxyXlxGJ5SRsPRu9WXl3XP2WJWdeoIHAqUWwaR33kKRt9cH2HeklYIye9iTyT5 K3kuSrAjGenvUJktFUQwqFVuctyxI69Kje5nhxaHc6qdrDGCCaZLCttIA+7npv8AQ9hSi+pc5dBY 12I4Rmwx+Y4J47UxLe2lmhSVmVM4dvQ+uKiEjKhB3EdV56inJDPLCZpVZUx8wxg57c/WlC1+Yhpt WRfvLaOzuZLZJfMXPyle4qlKZ8homLDIyCOePSoLW1mVWMjbsc89QO3NWGjn2rLLgZ4XHQ+xrSS9 7yBxaQky5jEm1mDHa4HYetQSOjTDB4QFcAZwTV5SYEDOVOTnBP6UsRtXR0QBCfnOD1we3vSkncUV 2Ke7euTgKvQg5zxWjEkBjV3XzABhgx/lSbbaVsAlADgKQOfcmpXZE+VEyCfUcn0ojvdFT3aRDcpA 0caw/wAR6emPeq0hmh2FBk5xuPA96skTXDZgygRiePWnTNOsakkuG5xjpg4qpttkLRIVo7Z5g8qj eIyVc9fw4pqxQS27sHxJkbUboR6/gaGw4UA9F/DB9KSGy3IxX+HkZ/iqINN3ZSuLAjRxbXcEAnK9 R+FV5kieJiVy3p7U6ws7NL9TesY0fIb/AHj0zVy+s2tLrEOHjPXbyTnpzVtSaUkTzpPVlEW3mASq oBGAQDwAB71bjttpV4FZ1JwzdlPv6Co3Qf6oMVIHJY9TUlp9rt45UcFmI4z0zUqTvcvpZkU6wysW tQ25WwyelJMZmVCi55Pzds0y3kuFug0m5WHPoee+a0rK3R5nnuX4IPDH361pZPYyRjvdXLAOz8kc rjJqqrRyyHJIYnJHbjkVoS2CR3LNbvuXOVXdjA9D9ahhtlmuXEnyFQc44z9PWsZa+6bJ8qYpu7WZ lhKhGVeTknmkk2nCug5GAVPTvWfJCTP8j5A7+taEEUs0nkxJu+X5t5xx61pBWWhEmK8U0uPJdlZT zkcn8elWIIVdH9AcYJz83ekkcW6bXG/jBzn5fQjFIwjSDErYQ/wqeeOevvWa1ew7JbEpeRMHhxj5 yOgFOt3tkmDlsgYBBqnGpT5YRgOcZbuPWrK2M+A8xTIOflOc+maq1noNPoTF0SVp0dumACB/k1Jc 2kYiEsbthW3bsHdjrVU7bhgoyW7NjA9MUk6zxBopH4XqAeOntWlna5PWzLcY87DMCyhPvbu/pVkD cwRG27cbm6nFVGVBHGtuxV+6t0q1NJbGLcuEbIDY6fX/AAp82hStsWZbEfZpLxm+TIG7I+9/Pn6V nzxQOq+WMhPmBJzzWtYWtrqUps52AXbwfX6Ul9YxabGYWYMmMgjrUzoylHmWxamk9jLiulhjMk0X y7uvf60u7EfnwMGLHgL/ABe3NVTOdvD49yDz/wDXqvL8jiePIxjAXpn8qnRRsGrvZFlTOBtlAXDZ 4z36irVzLFJH5MfzMhJGRyMikSdShDtycHPuetU7/wA2whaYDewXOO5X1FZ2tbQFsytpVxELt7ae M5xv5/xqyyLdStEGZgDxkfyrGtNTS7BuIgdxOw+oK+4rsdPu7aKzIuY4yd2S4GGXPTp1qpyalYIP mV+5iS/bLd8wDIZDhmHBz7e1WvtVx9nMUpyQu4ZHGR2NPe4E0nltv2lsId27H41n3AWM+ShO05O5 hxj0NYxunYVupHmedViYHkbuDjj0z3rS06JBIEjGxwCVww7dc/hWJtkR08okAj7p5/L0q9JCkTiU llZQAdpzkH196qMm9y1FX0NqS9l3iFhlW5LLjkiufuobe53WhLhC+cg+9XXMTIuW6HIPTBpxYCRZ chiCCFIwGHrVuTsrEyjzblGeL7PNHgjavyn6fSrtyUuEUYaQDjryKzrhXE7W90jK7MXVyCQR+lIY 5YnyMN02mspO6sXTbi20yw1sIwp2s3zYB5OB6mraSRxKTu3Z4x0/Oqv9oIXCtlQBzg9f8mq7MocZ znGCcZ/ziqi7bk8vUvfaVKlADj35rMlzHLujUkgckcE/Sty50QIFvldVOOSr8EH1GaiaLCbgWYYO cDPFOfNdaBGzMzZLPH5uWHOCO9EkLLGJY3YEYXHr71dgl8zEkHzIBnA7/wCFEreTE32hcr1+XsKU U3qHTQfFNdJEElbchGcEcD+orPd5ppD8y7FOQV9PSltWt77akLOysOCDzWsyQ2iBVXDfT861d1oR F+RFJK0kRUAKAM4Hf8qrQxwKnmZ3DPzcf1rf0+fRzYsL6FzM5OCpGBWPJCIV+UfKW69OPWoqRtZj ivdd1YkCrCvmTDKMv7sgcZ96i8+L0Fb0/hnVpbAXVjtmhYbzsbLKO/HY1h/2BqX/ADzn/L/61TJp PVDSml7qP//W/ki1jxlaQXY06yhkdt5UscJjnGO+KnnsrO5iWZnzIx3MuMY9QT3rOg8MwWl39vUv cSs2SQNzHP4cV2a2cz27GSPaM8LNxX6TDDqbkpxu/wAjw61ZqEVF2XU5a4nmEYeQSu2NqoSEjUDp mtfS57zy1ls4QImQl3dcIpHpnrTLgLaxvDKwYGQbR659B2ArNe4uLmHy0VxEjbWAYhcfielc+Jpc nvp79Daim2oP1udDbXNxJveRI5FByGYcL6cDr9KwJtSvrydrWFCSSf3mMKT6ADpWhBcGC1+UhQfu oq8jtk/zpt5LdPJDBp5fDP8AvJO3A/T8Kw55NqKZ04ilCL5pPYjt4Z/tKw3z845jXjge9abW77zO WUrjKwr19ME+nvVWW0ltZFljZRIFL7QOAB05rI1rVrXSgdVuZSgKeX0JJI5wqitayjFc25EGpe69 C8BOreTcBU3dFHUgfSrUl1bRxmyEYiRB98HlmP8AOvINQ8b3butxYQPLK/3TN8oVc8HArmbrXvFG pyNLcTJFt+XEanofc1zf2rCK95fcN4Z3aTPfXvre32qPmbklQuS5PQH0FQ3lxPKgBdUIPzID0B4w fTNcb4X8Q2UlvbWTM7zk7GUAkj1Yk4ruYDMs7x26qQXD5Kglvr14H4U6ddy1T3HOCg3ck0/S4J1e S7UYb5VZjwT6KDVqW20yAZcu+CMKRxuq/bzG5mFxNKrFWKBTgEH29BVfVCzyrsVnCjjaMIp9Se5r oUGk2xTlpyxZbNvIU2XGdp+6qfKB/WopZr3TrWT7Eka54bAG4+5Y1RnnuJPktzI4JUZIwcnqfoKS 78tohaiRriQfLtXlVPqT0NdLpK2m5hCpZN2G3LQ3NqDqbM20biFkyD7cdqqQ+XcNGlqDIvQDIVQP eqg0+/kx9qeNgqny40wAvbk9zVDbbWoSJZtzqf3ki/Nj0C/SudKfVCeIg3aC/wCCdDJFZh2ieZW2 cmKLJPB71LPHa3IzkqN3CqfbvWSv9ngI0MUhTd+8lY4yB16U+HU7Ge7+wWzBAMgllwvTOc10SSaa YlOXM+VFafVBYt5VsiDaeC3UinwvLc4vJpmKrwkIzgn1pt3ZpJcCWGKOUhSfMJAUDp61DBEBHvRw 2DldpyfYCuBTadnHQ6ZQTknfVHUQG2gdd675G+VMDIX61Kt5HGTBeqM7/wCEgZrLuJv3KwqrD5cs JGO4nHUCuSvLmfcWtgwkUbQ79ACe1dsqlkYeytzXPQbq/hhQc25UqcJ5YzjsSeSTWZPrryotrENm DwRyenP0rl7aeSJNy+ZJO2CCF+VP8itGV3uVeMFdzLnOAD07455rOdVSWxUErqzLUU99dyLFG8Ue 4ZeRQGbB47VYlt4VOy6ywjHIY4DAewpNOsr6Xa0CbmQcyqm0Y79a6TUII4tOaWRo0OAGxyxz29fr W1OK5bpDqOSlZM8ovWiSWWCIEbmyZO/PYVkywsseJDhy2Qh6jH96tOeOZrw3cakjC7egXIPTn2rP kWJEe5mYSkk7o4+SWz03Vx1OZ31NJaayMOJHjuxHCVlPAc9OvoPrXoegoqDyZIyrnoM8H0rjba+g kuWAh8pkPJPQd+c12nhzUYjMRO0YZ+WZVGce3XFbYdO/KzGqnyrW52lpYsrCVhkkDc2ckD/PtWzH dNBAZLeNZDvxuYgEAep5P61hvrekQSByeFXYF38D39TVdvFMaXEdvYRl1Y43YwoP49hXqQdKmtDn oRqN6nSx3V+ZyJ0jB27iFHPt796rXsMVqqy3Mixg5yjnBJPb61zfna898zzSLbop3CVTudj7Y71T ls7CB90lwbpt42oTwD1OcGsauKSj7q0KjBNJSZqSapo9u2y03SOPvbR1/GqUtzq2tx5igijQMV3S EDHPbNYV1fRwRMIFEpZjkICqIO/TtS29zLdRAuWX5sqFGQMcfh9K53iE9Lm8lZ6ao2F0a3RvPvJ9 6KQGQZzn2NRrdaakhWxiVgrFd8ikjPc4NZ6Xqw3JkdH27hy55JHfFWH1eIn93GqsT27U24SV0zPl aadjYillucRxBYgQSxAwSD1G7sfpURPkQh9qnqiLv6gVyl74hvYyI1G0ZIwPfrmsObWp5vntQ2VO Cx5GfrWE8ZTitWa0aE5q51eoNbvGLe3lKd5AoPJI6c4HsK52HUYoHaOLIJPIU9PrXLXGuxNItveu 7SOd3ydB6Z9Kgn1fTLEN5I3EnO3OST+HSvNeOivg+86/YuT1Whuar4g/s20M+0cZ75Lkdh7msey8 ZadeExhGjlwD85+UnuK89u7q51MvNOTHuJwx5xjstU4tP3w/uGOSeua8ytmVRtm0cJFLRHrMvi/S 4bfy5UBccZUd89qyJ/HImtjB5TBAcLjgYrzdbeS1UtKd2RnaOcD1NT2pM8J8wEjPyL14/wAa5li5 M29nyq/Rm1qetT3a5smkV+hIGPyFYM7Xsjr57M2ePmAIz9a2Spt4BtA3le3X8aS2jC7i4MjEZGfu j8K55Tb0ua2VmzB3kNhJN3YKoxjvz61oQxIiLPcAcN931q5ItrDHvIUNg5bvk9hVAqgOQM/3S1N3 RmndqyGyyojFmyBngYzj0qJlkldI4iuxTlyetXEw8DRsrM2eW7Yx/OlMEdvbeZbONwHzZ6c96lXd zS/vFkQeXG00Uv8AEF2d8GqsoELNJzu6Bj1qBgFPlhiRgHcBznH9KpvceXdxxvG7jPzNngfWpu+h EdE7s3bG+njlMo79BnAz702S5e7uS7D5wMlyOvtVOSVIpCY1C88DtTF87JLZwemeBmjnbSQ4JdGW opGcEFxx1UHP4VUM11DIEjy4OSQei0savE2/5cZ3bl6lqljDSoTIcO3pxVK91YlzbuakurSpab5E IDjA9T/9auenlmX97IMAEHA64FXnilRXkb58AAADpj0q08KQqs023cQR6kfhSlOT+IuDS2MmItcs Sivu5I3envWt9gPk4YFjyXU8YHrUAlIUuFPA4PQ1Hm6yHYk5HJ9azfkVJrdD76C4j2pwqEDbgjJF OjjnWL5DtB446mltoCMyvGz7jjj/AD2rbMcrKuwqF5HPbFVCL0uTzdTI+zXKrkEbehGeeaT7I6gg demRwf8AIq5dQRW7eZuGc9R3qrNNcOoafkkDZg4z9RTcdLol6MrLuaQ22QD0buelOjsG80XET5Cr tKMePrR+8VTJImwL/F70x0uol2qT5bDOT7+ntVqXUpJLQlKxOcMVPpgdh1qw0UcztLs56Jg4yTWL GSmfMARMAqw5J9a0IHLuqgkg/wAQzx6VEW9mTFq6sXbvR57G6jjcZeSMPgf57VTCiPJfaQMnrn9K tSLcySkksTtKgk/MB+tNhtI7ddjbHL4yzfeA9KiUZLWRo4p+9HQqtOkkZfLAA85XpWiLa5+zpNMc AnCluuPpVZEQXBlkJCIDtUYIyOmaiu7uaQq7sx+Qt6gY+laRkre8RG973HOskZGCpXv65+tSRq6Y LKNp5x/IVUH2tSqXCFFz3HUetWUkEk6xDgheT3BHtWUU0aJpqxXkkhIO8HJbK8dPanyXk5j8mMkj fu57n3pQLdXHnFiw7D7pFT2zRTSO0hWNVBIz1OKaVzPSPUz/ADrmbarxjOef/r1Ij29rIUtzlz87 be341PLyRgZOMAnv9aY1khdZMqhP3gPX0pq99i5PqivHf3H2poZFYIfmDHp/jV+NXmhd0H+rXKH1 PuOKikjVvuMdw4AApIroo3lT/dxkge3tTbauR8SsBuZ3wZEVQoAA6HPc08yKMyRkA5HXk4qCW6mk OLhB3ww7jtSR2c+4SlupHHt9KjmfQ0gxt1p6TCOa45HLcdBj1q3GbRgXtQdx7E8fypJCsimKbIUc GqscUCKQGGR8wxxk/Wr5nccrMvwxyqcwMu4nOCe/fFVJGgach1b5WBz0yaRCoIRQFHVl9TSySqVK jG7qKHJESs9Cy0LSbpo92RlyDzgnvmqkkxlAW8Ysx+6M5J+lXZo3eJUg37iNroOOTVBNP1C12vc7 d38OOTjtzU2tdouUtEiK4EgkCqOBjnHQ5rYFw8kAt2yRjOOwx3ojk+TEqcsfToR71ZyZk8tmKDgU 1TWmo9TL2SS/Kh6Daex59afAXikAfDgZAyMr0qwz/Zw8cS5yQG/2j9apyPuPlhCmQQT6fSh2vYJp tXIWeAsVfGcnrxV2OxZbZb1X3ITtOB8w9RiqMSQSXJVm3jaApHIJz0NaUA8vcgOMsfkP+NNWs+pj y6q5u6HplhqAntJBglSVI4OR3rB1Wxm029+zyRkfKDHL/CT/AI1IxmgQXtvuRg5AUngYqzfaw+pW ix3qAlfusOCCOK1vDktazDkftL82gww2xgR1kaOT5hIMBlPHBpv23NqVwA2QMnjFZtpL5beXIu9T /ePr/hV9JRhllVSCTswcnb61nKV09DTmbe5SmWUwAQjK9QcZJbuPYVPZieeEsyYCL8zKeVHTn1qy tzIrrLhEyMLxx9RUcw8wiZsKDxgZ/OsnDlV+popvZj5p7YSR+YRIFULgjBNMW7RcT7Ay9lHy1Ukl VCY5j8uBhhzk+1T2ZtJoV8z/AJZqdpJxkZ6fWrXNoloZS13RVlVnlErDJDZUZyCPerEd0q7mc4BO wg/0qO9VI3LwHCnGU7getJFA9xIsRICkADf3NU9HYH7t7MV3KxMI8kH+H7x496bL5iwiQLjIxgc1 Hcxz2MjHKcHa239PXirVveCNRKAD3BPf1GO9PlWwJ+8rsqRRTsuQMFTk5POKbNCDtmilyWPI6EVp TJC2BKWXeM8dP8mq4tre4ZWRguSOp4PNZOmxuS2RlHT5mJklJCl+SPfuauJJ9jnUoCfWTqDWhLHi TyImWRMDp/ePYetMt442JUZxj5sinFeQSqMyppZri5IRd5BwCOOPXFOiCRxkzruB4IAzj8K6WCC2 gQxhwCw5459etK1rbs3Dhic5Ppz39qpw0ckVb+bcyLm6EyqiFXQDC5GDgVFBceY+ISUYjafpTb3P /HvGkZ2DBZSeT2zUVvMsS5EZDHh6hLoyamxqC1dVSRpADzz0xj1qjcXESOWmw3qAP1p8l0SuFBYY 2nkYHHX8KpxNDKWjUgHgM7deP6VSvqTbRFmJ45ixYFVI3BlGeff2q2ljM2mM6+W6iQKVB5OehxT4 hasuwjDIRkqflPH6ZqF4284fY2KjrsY5Ge9WkrDtrcdEt3EOV2EdOe2eMVRkkk3Or/M2cjJ4NW5b hpCZMFyDztPIFRpFGdxkU5Yk5b3qVotGNS6NEKO8gWCVQVY8rng+3rVtvKgAiSPj0JyVxWvLpNpZ 20V4dzRtGNyg9GHXkVkW8DXMqiJFIJ++5xjt1NTKlK+oo1FZ3H29iZuY2AyDx3H4U2Nmj/dXGGGM ZHpTJ7WXT7lombIyCpjO4H1wasqRu80k4xxxwaJu25r1MBIrW1aWSGNlYvnaOje4rXs2lfdDcRhl cZHqpqq1pc3LbyyqEBC54z/jTrae7D+SxDbRnIwOO1RPmTuTy3SuStZi3ciNpMsOBgbfqKjWWNCF lJU5788+taVo92y+YyFsv1I6VQnjMpLEKGV/lY9/xpTXVFcqd2i4Id8aYw2MkkjPB9PpVWJ/L/dg B8k/MpJI+oNTQSPGh35Bz254rUuZbGa2V9O2xOQFnRuSWH8Q9jQm9mgcFe5lSRJ5x3j5DjtnGO9V pZWjdVjwRkFWPI471LcD9wZg67h0jU8n6VVtg1wqtMmwZIx3/wAKdtLsLr4Sx5Mzp+8fzAeefQ+l MEAhO3LjnK98j0qcy72AQPwuCMZIx/SohLEWI2ngYA96Jqy03FdMkkhjKqCoDEck9wf5UyFPIU5U NuBBzzilmUyEJGSDj5iOAB6c1CI5UADtgdPM7Nio5tbyYW7bEUIRZDHyVJI2DsavLKwUiAA/w4re Js9PsxCYYrh3XfvGQy57ZrCWKFV+csp5zu7VrytbsIp2uV9OEsDOp2qzkkcYBqpeXDFtvAJGCvbN Tz3nl4hJHBwpHOc1HDCsAa9uh3ztH86t25dAUtdieC1jsYi45kIHA7HFIsnnISwySRkf4U2OcXas wHK9M+hpgiTdttyVw2TgYyPzxmsJRaerKjJWbRM0fm4jiJBByR0NTT3M1i2y5yUIzGDyPzrPlUG5 X5uU547j61NIryMOOM4AzkHFEmXzK+po2txIs4a0kcb1+5G+FOfpWr9o1X/pp/33/wDXrAjtNkTN Eu09l7HPpUfl3f8AcP8A30f8KmdNtmiatuf/1/5SBfxyNi3WTcON/TIqb7Q9rDvmZtzHJjY5K/h3 rp5NFj+yGW7n3BsKjQJnBHXgdSaSOG0tZYrOKyeRx0eU8+2fx7V+r08ZUox01fdng04wmrvrb8Dk o7VLyZppCW3L8oY4Vfp6moX8OK0aOpMQV9z4z2POQa78RBB510IYGBKjpn3wAP8A61MitrO9DJL5 jMxKrkE7senpivNjSUleZsqrh0s2cDf6XcXrG1huAgYAmSIfdHpgd8VVWGx0iAQRztcMufmfqT3x XpEltcKPsmn2xCKuGlYY3HoSP8awbyN4HRbeKIOo4jUDqfc5yaSpR1tuTKpJ3OchuJ52WYhY0dNy 8E5/PpWTdaWmool9forKJNsSgEZx1YA5J+tdtFaszmTVpEAjXlByPpx3qlLe2ZuhJFHK023yxM/C KPYenvWGIhJpK1zrgu7PMb7wq88LSQL5ChWZsqSWGeijrXnNqdQvGa1ghmk2n5iBwuD3r6AV9QeQ gOrPnDAEYI6ACpbW1sLWU2odY8nLsFwufTPc1yTy3mfMtO4va2Tb/r/M8Is9A12/kaS5ZrJOidnY D2HOPc16LpGh67BcLc6jPI+5NgYttUKOgVR+prujYWgkaRJC6HgykYx9OOazZUjcs3m7gnCrJlcn +da4XBqDvciWMlzcq2LMVvbR7Syq+07ycnnFMu72aYmd5CFBwyDgewx/hTbaBWxJcSY3dQgzk+wP 86mlbEx+0QlLSJvxZvY8Z/pXdGE7aET1er1K1tb6xfo87GMLkcZxtX0PTk+lW/s0TxYhBKfdZm+T 647nnvVuPVLP7OSXiQscKgHKpn37ms6XVLc4VHDY4BHONvb610U6KiryZnVnN2jFEc0NvvCkGNVH KDOSc9yf5VQWJHdpIYhGgYHe4zz7CqV3q8t9KFIaNVYZbufbioGFwrs0Dr842iNm6fUVlVrK9uhm 4te6jQu7lJGMDYIY8OxwMD2HAzXP3SWcoWKBTkE7scfrWi2ngWuJ5U3OQWC88HsBTLSwsYInEAZz u6k/p7fSuKpPVpbHdHTluWtLFkqkRtjPyYfoe3A/rXQ2sEcQ3CJUPctgf8C/+tWDBd2tsCkoQuT8 3l4JUDtTJdTleRPs+3a2SWkJOCv481axPK0mjKcdbp6El79okn+2wK+1gV3Y9B79BWNb6kJbkQiJ 2KnlFHX3J9M1FJrk7YHmu6ljuXA554Az2rNn1qUyyGzhlEixgAj7p/z6Vzynyy50/kdXtL+7bQ7W OayFxHaRuN2zdJGo+VT1+8euKk/tXTNHUoiDJIJZuck9T6/yribf+0pAJrtNqlclsEfMeg4q1p6C 4kIvYwsC8ZlOGOPatFU10Rly2ha5248T313tjjIAb5Rt6FfWk1+5t5oSqIzFcAnO3jHX1PNc7/ak v2qOw0u3CQhc7gM5yff+dUvE008FzC9xKN2ACM5256nFdcMS1Fq9zP2d2rGDcTXTyqrfKAAMdgD3 pmowW0c6xWxlnCA+ZsHAfHAFa1qvh+9mI3nbGu53c43fhXJ6rqclujyWMhRTKSSi8Y+v0rinOWrL dHRXILS3l1KOV2PkxRyDzJT1LE9Pyrv9M0zTZdq2t2sKHKszDBwo6/jXjaxXM86JOxaNm8xtpPfo T713dgkYjZXQL1+8T0PTA+lZUouTuy5VVGLselWNnosN2hHl3CnILMCQMdSPWo9bnJhBtYvk3Ftg UDgnPPsBWLHcRx2cYjmQLEAMDtnmqgulKNJeSNKDnocAD+Veg1Fx5VuyalVy0S6mz5/2xPlJAK4J BGB7D0+lUHhjChlDMV7g549PrWNJqSuNtiFRF+4B0rIbVY/MMF1dInBLgHpn1rlrV4RjdyuV7KTf wnY3ksMVqVUbfZON3sfarS6qsUfl20BVdgAZu5//AF15Te+L9Ns9sVkplEfyjn5Sfc1y9/40127f ZaMsXGAFGcVzVcfBJI0hRlqeyTvLuNze7fMI6Z6jrisW/wBWS0O+RolIIKr7V42suuyv/plzKCP4 ieeahKOzl5pGlb+Isa82pjI7xOiNO2kjt9a8c4ka2tY1kYsMuDxXOXOr6jct5dxI20DhV4AH4ViC 0MYJkYAk5/E1NFF3LjbnJbOPwrjqVpt3OiMFa5egvbhFeMfLvyCw61dfSoTAlwsxZ8AsB2PpWSzy hiUOAR0+lSJO7EbeMcEjrmufmbvc0cEzTi05rjHlOv7vDFScnjt+NVUkgDt9tXaobL7c8DtTI72+ hR0tQod12tIeo9/xrOjt57ghHbPzZJbv9a0hYhxS0Ro3P2f7R50BLRn7pIxkAelJAokAkjIXuMcV Lb2EpUvKeM5C9OB2qObEYOF4HZe3t71nzK4a2HyRSSS4HCg46849KrTzNBLhjhScDPv2xWjbTQor GSHLAgLuJxkdz61m3cEN5MLmY/OuWRR6+1Sl1LqNpbF5ixQRyFcDkZHXPSoUfEQaQFmBweOBU7Qt EqrNnfnOD059akuSkDCNUzwMtnIrdJ27GbajayIDFP5QnKsEY4DZ6/SoQybDGF6nPPbmpH84MASW jGWwOi5706SAxgvkAcbif5YrnKUUxz30ZuA6KuAMDAx0GDUKb2diEAUjdv8AU+1NcwDIUq3GWOMc 1s6ffKsAjaJSB0x3zWtJpu0mK11oZE0reUF2EuW5bpwKYkjTLsj6dsnpmrWo3W99xwu3pxxzWdDP CsnlwHlumazlKxol7tkiWOHzJEgckcYGOMk/WtGbTDbR+WkgaRgBt9MVlyLu3Rw/NKuD9PxqYGWe UOCQAMN9auEkvUiXQnRpkYI3UjBP/wBakA3vsIAfb94/561YSy3/ADgZOAqkZNWnAjGyTG/OAR7U +cTj9xkSD96d+SB2rRaWBYVijAbHzMfQ+lMOnzzSCQEEEeuCc1nSwRjakkmDvycHAx0x9ahtO9gd 0lctRXUyy+RAAE28gdcmlklnDBQzYOdyjqT65qBIvIy8R+62eTSs4aZFDhd7fOfakpOOhUddGTwp HHEUcdjtUnJyfX6VFGwVWBHzLgKT2FWL62t7e6c2kplRiG8wjj3oNxZIMudwwd6jg9PX0pXbVr2u OTtdlSaQi2ZoQZCDyoPBHep0nuLiOJFTDtweaZ5gaHMRAXbgADGRTWV18swuSA28Y45xVydtEZuV 32LUgRQPNXleHHcZ6cVW+2yRxCCEBQWBGR0/+vVC4knmn8wN94gso659c1JJBcTRbQPmXLBhxWKu nozZ9rE8jyJEk6HJfnj0BpvnStL5bfKuPvGlSOeML5nyjI3Y+9jvirl6trHIyQd0BQOckdyapyui Ip7FWErcsYBKELfN83f6CnwwpE5guGGCeXHIPvSxJFM6Dac/3+mKtqsSkoCTxjOOtaRstyVrYsXs BRzslaXIAUsOg96z4kiSRnJHmYxnv9akZpkkwzKE65x27VQmeCX97n+LgDsf8+9Q6ibZo21okaiy RwkI+1yOuOlQXC24nMbP8w5wOnJqjFPKcfLkhucD9asrbJOQ7HKE8A1T8mTFtr3kaCxqrF3AOOfT I7UXFt5G2e8Iw/zKEOaruZEY27vwPusew9KbmOWMIMtjOPf6U4SV7SKlbl06E0igs1wvyA/Kg7cd abbwQ5YsRuPzEn0qAwjyMOxB6hfUexpbREOIpASoHfOT6VPLo7jTd7kkkQVBEgOD0bHFRTR3q7SQ Dt4L+hrp/MmWBeAE6AY6nt9KxJvPlYwgjk5+ppzsrWHBNXbRnRpIgBlPJOAQOCKbdRiE7FB3MQBj 1FX443EgjuRujHB7VNetFbsDGu4g4AHJ+ppKz3JU09FucnPPdB1RIySWCk91HetfyUWVQ5HznBYn 7vuakuLTyWPzhWJBw3vWY0N0khDMCSdykfTpUxWhOr+I1kSSOf7NasWJYgH1A6YolgvnxFltxJUA 9c9hms+xlbcHk3KVbbgnnHsam23HmlEJcdxnOKmN+oNNovSCaGVYz1Q/MByc0PcJJjzBty3DD2/x qrE8+8P827kke31ouBBfIBgnqOM0OFldGiqX91l1nhdgN/Iw3PcVVDNPKRjIU4J7fWqDCe0kjSIb ySFfJPA9a0nWKFfl3E43FhnBz61s57GKW6ZPbaZJJc+Ratyw5AIxV+aO7tVMk4XBYbxx8wXqKqRT GGSK9gLZU5AOMfTFP1XUptQUuQqYHQdf/r1vFwUJX3DkldditeTRzTMISUjP3EHIFVvM2RLyDyRu IOajE6LujkUSLtHzrwVPp+FWPI8oRqcHdk7lORn69K5Zz2YNO5bsrVrxvIhCsxDMvbG0VUujcJJs faQq4Hb+VR213eRSA2ofK5yEHzEYwaSWYMB5ZyGO3nj396tJ2sOXcB9oZcrkKvYDIwfrVuKfI8uY HaPmwePpVGadtm2MnIATZz271XinmmH7xclflAPpmo15S5OzSZOJYzJ8wxk+vH0qe1+zkOd2ADnY RnJrCWeOGYoykgDPPGK2MM7eZHjJUDI6/QinFoXO9LEUk7yEBhjOVX14OBmrMMglBRxtKADPv7Cq tvEZpmSU7iAGUdxVqOaOFSoQE7uST+tDnpYU421HwP8AZbwSXW2RVOSvc+tOvJbaZ91kpXnLKemP akFulzPvQEg9T254zUtzpowqMwXH3lzyfpVpu1mTa7ujDkvL15hGgeRQcoyjpVsyxxkLco3B3bQO CPrWpl/KWS0Q+RGwQyAAdexp087TQ7YjzgBgOSQevSndfMpSd9dTGna0lm3xqyRbvlGeQD1q+ht3 jMEUrBzgA46jt6VTXbFG0iHcwI4PP1FRrG90Tu+VBySvBzUSlZMaeqsjSEc/mBBjcoO8k8n1qiXn WYICNhGQehxUpkYRCORjuOOnXHv17U5F2Q+YxLEHGehA9xWUXdXRU7simR2IEmevzFuM+lMZ3Bwn GDySO/1pzTvKxMshZhjr2FQrKpZjO+4ggbV6f0qJt3He+5cSVC3lsuWI2qR1J71SE1sshjYMFK/P j29Pelh3eeGI3AHOFPYVNNHE6maNcDsM5JBP9KqL6h0sb/h7UdPjWW3vI1CyHhpOcj+lT31pZ2wL 28gkUjeuw9M9s+1chFZXrO8jbPK27lxWrZwhYhzw3JXOBn0rd1U1YUF71x9hDOivPCA7Erhcds/M Pyqy8vmZdRyCRj0Wo7pxEVks9wx/C3qPXFVbt5QBE6mNnUONvPB6c1LSbbKirWjYvQTQFcTyOqH7 m0bk9/8AOKpXNwhzFDG8iMfm4wMevtT7eZGC2spwo+8cYNbdsLCZ/JUszds8bh6CtIvnVuxm/dk3 bcwYoljhHmyFscoCeQPTPsanmblecfLgHOc+tNngALRSIeCfvdQKbuRbcrgEH7p/pWEm27lc1ndE dvE00xUtsKnATHVfxqEIzjaR25DDoR6EVXeR532EnsQxHIx7VKiOmZWk6+vTPqPrUyfRmkUXUvJ7 AtApLBwOmeCaWK+iiXa8W4kkndx/jVCW6mX5+D/Cfwp0EsbSgyHcOSMDrRF3sDnyqyNSJYmUzXBb cTlU/ur9RVW5itpYJFyckdqiuCxjEoZgW+X0wDTN6mHy1BP+0vXIqlpqS2tbFa1tEUKoGQBwTnj1 rXktbiEfKFZDwvqM88VXeZ4l8s5AGSPTntinSTIyCNWKsOACOh+tPnuRCFtSJ444FEyl1YEEHPSp ZAiEzHaxYbhjoOKZK5ljUkZwQuT04/PrUMn7uRXmHB4z/d+vtU6rfqVGMbXvsVYxGsf2jzGJPGzG QP61bCtJa+cMbUIO3OM+496nhaOBBGUA+bhkyeo7024uts32VIywZSR+HrU27M1srO5Gn2qWD7QW ZVVtoEgwQactxPIhuJRwTtLZBH41Xk16An7LcIFkHAz9MDHrVB55p5BbRghAdzEDII/xrdQt7zMm 1y3NSyiS8mDXqqIUOd69fb0qa9SV3EdqWwWyD7e9TvfW4CrbRhSoAwOh9zn1qz50oh81sKTnA9KI wV7kQckrGDcC5hURAAEY3Ad6cLlY42SL5pO6459OKuyswJMhBZ13ryKpFBv3nKgchx19aiSW7Kci qpkeTMq/L2zwc9xWt5tzBHiVMrgceg7EUS+VeIsyOWzy3GOlWLi7kkVIpWyqjavHNZqK3NPaLQpp eAPhm9CVYcfnVr+0I/8Apn+ZqpPLI4Xy1UheNmOffmod03/Pt/n86JTlfQpJPY//0P5epC91B5hd 0TfgQqcFj6jHarNqFKAiQRHPDgZdvpnp7d65/T766lhlkkfLYbkgdiPatDTVE9rJNJy+Mhhx1PtX 6d1bkeW6fKlGOnUvXFrbz3RhNxMHK4VUAyPU9Op71pPPcWdslvpw2AYDyyEF2A9z09qw4mYDfk5X hT6D2rB1a8uY7jCORlcn65FdEqcVBSfUxSlKThffc6u48QXNuD9mXLP8pbJckD9B+Fc6L4SzMRGR KF5JGOT3OO9ODGWyW4kOXBGD/niue+33cFvJdRPiR3O58Angj1Bx+FcU3d6aGlNO9kaktlcRIst8 JnRlJQZwM+gxzVC6Lvb/ALmELtONkjfMQPUD/GpNPuLi7nja5kd/95jjj2zUl6iRz7kGDj+Z5rJy bdmXJJv0EDbLXz4owJnGAScAfSsqzjkUPDeTRq56bV4XPua6O9ijt2CwqF+QVwqxodVkyM5UMc85 NLlvKLRUuXls1ojfto4Ibs3JaWR1j2opBCk+vp+VVLqaTeI1IJJ3N5XUHvmp9aZo5Y4oyQoPQfSj TAJnLy/MVztJ/wA8/jTcL63MutrFy0hBiM8si5JIUEgHPT9KxbrTJPs7XUsqth8LHuOMfQfzrWgh iubstMoYpnbx0qHW4o3tHhYfKOcDj+VVVh7upVFe9c5i5fTIYVaUATdk7A9j1pujx301uYjG+XY4 YYAY98DjgepqLSrK1k1F5JEDGMfIWJOK6i7ZoFZYTtG0Dj0PWpwmHdROTeg601Fqy3KB8JyGMrZy DePnZnb+VUIrK8tnK3HlFueR8xA9T6GrIRRYxvzlj8xyefrzWBAzDUmUE4bgjPXms50FF3voZ87u k+prrZNcSja+4btvy4AH1NW7iwgB+ymUEc7tnI/MdaLSGN3WBh8mNxXkDOa6JbaCPKoijBIH4ir+ qpttFxrPSBy914fhSEScl2YfdOPl+lQx2KojQs8eAMhTyVJ9+1JfXd1EgMbsMttP0rnZyyWiOpIL SfMc9eap0YU7WQpQm7pvzNWK2tYcuVTBPy7uD79uPpWjbXDKVFvCrdwGGAcf1rp4rG0gs1eONclM kn5jn6moJ4kCmT+ILkHJ44rnlVdkooVON5amAg1FpGllkj3HIVMZ2nPGB2rTs9LgkgLan5hJPMj4 VRjnAzyalQbSpXqfmJ7k561Uu7q4kQl3J2thfYVpGmn7/QhJpyj2NMNa6bam5dWmdTtijHyqFPdj /SvJdb1kalIfOWNArfK3cjPc1oa1qV8AYRIwXaW2jHWvNL6R/MVs8nGfxzXNiKlpcvqd0V1R0Ftd xvO9wpDRopUK/AYn2FZd3qL3EyxYATH3VGATWdCzCXaOBnt9azdRnlgjJhO0kjJGM/nXn1a/J5hy uWhtw+VDMcPsBHG7gZrasJLcLma4iYs3PzZOa8g1maWcqsrFhszzWfCzAEqSMYxg1zfX5M6FQSbT dz3ufXtKscSxlHIJUADPI78VwmseKbrUVENoDEhJG/8AH0rhYSTqKx5O3J4ya2XAdQG7VhVx1STt c1o0Y35USXst7cIMSlETkDJ5Pr+NZ0KXB4Qhy4DOSMED+ta8HFo/0FNtQCDIRz5oGfbFc1Ryctyo Wad+hnJEgJO48kkbumP8adbtGpD7SFz3BBFXb35A23jAyPY5rKe5ndV3tn5fQVjKWjuacnY32KEG SUO3mYwenSmJMsMZjVVAZwSwOcYqlFLK9uC7E4GBk9BTJpHSbKn7o49qz50wknFslnmivLhlLHcB nI6Gst4vOxuXIB+bn0602Bmjkdk4JA5q6JXFvnPU88D1rW+o6kmtC4BAUDIQoUZOBn8KjiKKW5IG c1KVVcAccVbiYxo5XH3SOQD2PrUW1GmypbgvKRE24nGB/ntVjcscm6Tghh05yO4qoCUyU4OAOOO1 OJJRc9+v51aaRMo2uzVtNYikmHDHqu1gAAtQidI5QyYPzDH17VBeRRrKxUAfdPFU7IeY+H5w38qj n5hrXQvzG4mmJmIUgksM/lVi0gVZVkYZ5yN3tWasjiQuDzk8/SrMjMkBdTg7gM1pTk1qwq6po1tS kFxgElWHOfQVhw3YMwUqzMp6N0OKYZZGXcxJOR1571O4ClyvUt1qlXcpOUgceVI34573VozaWwjX 5TuCjHH1rCn0yezU2l1wzZYuTk/nWlpEjw3AaM4JQ5/AGsmSWSeB55iWcyYLH61o1eKb3ZinduPQ ovGiERo2RjDHufQVftyIwzSMcdhjpjtVfAF4mAOWXPHvV2Ni3mBuev8AOuZxvqawnZWIZne7cQAK IsZZm68duajlaKMLJbAMR6dePamsxNsSeznFXLUAW7MOpXBNZN+9Y3bsmZwacksgZSRl8etXIZmK /OGIXOAOSTWrA7R2xVMDIYnj2pmSnCcfKTx65qndO7M1G7EhuJnAmKsFUYAPXFVZ7uKZisu5gx3D sc1HfzSxxb0Yg7T/ACrF04tJZLcuSXPBY1d7hy20RqQJC8oV5SzNxgHpj2q9PpceRvXdgbuucfU1 k2kUa3fnqBv243d63reWR1+ck9f51NOV9EN0kZ0211MRwOMlh6+g96SCCOI+bEDkj5g1KUUXhx/e H86hjZlgkYE5BNaSj0ZLVtSvdJLKpt7pioIwu3qM+9SvHaROka72JUBmHNZl/NK1q8hJ3bgM/jV+ 3UGMk56Dv9KwnJpM2dG7LaR3NnEY/v8Amcgt0x7fQUKJdpWQKQeV29QKru7tJkk8HA9hUtozGVpS TuUnafTim5uyMbJXdgt0hh/eEAhlye5PatvS4rNY5LrU5HQY2RRofmY/SucR3+0QjJwZMEfhVrUC eG75HNarTUGrokv4t7MYGLRjoOhBrNgCWxQyDIC/MTz26VeICxlF6Hk1n2zGW4kSTken4VDqJ/Et xwTUTUhuIZVBTK85HParUMjT3LWsS5cqWUr1+lUHghi0/wAyNQrZPI61LbyyQmN4yQ2Oo680oSTa jYm73I0hnjkaOUg8EfN6mql3DNZMBLHlcYDjofetRZXeZdxzukXd75NP1b/j6a3/AIFZsL2FEkm7 FpcrsQmGIRK6vwV3AYxk4pbS/e1dTA0bHJGxxlcn+tZ7yyNAkZPyqvA/E1Z0+CEwq5UZ8zOaic+V O6HKN7XHCaabd5/IZhv29TzwMVamCBtkI24OcE84qtpoDSuG56n8c1cKh7PzWALbyN3fFJPmswUf dIsBnTIO7BXb1HPepoJIgwW5bCbsZHQH3qGT91aSSR8NkDI9DU1tDFNZSJKAQJF4NdHLqZxj8LuO lvHBMUYzg5V+g69xVcytgNKxyxwTjr6VdKqWxjuanCq8LBwCFQbc9q0dNKyQKu9UUTOVbbJzGBxn r7Vnz3Nu0n3mBY4J9KFdihyT3qMRp9qYYHAz+Nc9WFryKjrZFyO2NwolY7wvADdc/wCFCxsXBRDt 5JJ6AjtTbl3CLg45x/OobdmN2QSeuOvrTUrWuOMVJu4ktq7NvhGVzyO9X7eK5sJHYxHzMZz7HtVi eWQbnBwdvUexqpcTSq3DH5sbvepjO7asV7NpXTHx3bXEwTYBtyjnv+NRs9zaSBLZTgncRjIq0FVT 8oA3H5vfis+9llFtKwY5EmAe+K25rJ6BCBG0c0coklkAVs4wOtWop8ux2k7RjPase2JG1snOe5z3 qW3mlivnWM4GwnGM85pX1sRKGrZoiKYo8hBAI4b0z3qrLDNbOFcM28Bg3UZNMWaVpdjMSCnINaF6 7tHECTwMDn2obM5XstTJeRo0AByc88dSetbq6bdXujmdAEEBySD82D3xTL23ijchFGOPft71m2M0 qxuoY4LMCM9qj2d7M2UXdq+xVdZoZ1e1laIgYLL3HvW5d26eSpYgkqJMr6muekmlBhAY8uQfccVu zHKoT/zzA/Wrpy91iVOUtmUZSpTzHOGBK7h61Xcy7doOWIBz6U6+AESSLwdwOfzqvJ96OTu27J9c Ul5hKFveY6Hy/MP2hT909e9aKmBY1VmwducL/WqlwoHIpkyhPLKDBKnNYzir6Dpra3U1rePSyT5p KOVJRz0OOgNQ28NtMx25DZ4Gfl/Oud82RshiThqliJRGZCQSpyc+tXF2dh1Vqkb8168EnkIRgHkr 0JH86L17p4ENqoZyNwfOAB3U5Fc5byP55XPAzj/vnNdVGNyBG5BAOPwrZp2TZDXv2KSG7mtGh83a ocNIgPfHBx7VblZC/nDrGo+dTjJHfiqEgEKlogFJk2kj0xUG4rGoHQ9R61h0sikvesx6o0rF87FJ JL56k+takcUNpCyzlmyPl2HqR60y1ijltn8wZwAR2/lTQAqKy9cD9aG2rN6kX1sX30uHb5yrlmzs 78GqDQzRxN5gPOVVW9RWpYTSmCZCciMHYD2+lZks0sqtNISWzjP4VdScU9EEE3rcqlBJbJaXGInJ +/2YN60+bTJLZPs82x8Y2sp4I+tPUC5ZI5wGVl5B+lFqoMKRnkcDms27ormaZlSxhQVXMY7Aev1q yguJLdbtGyjZG0/KTjqfwpLpQLgr2ByK0GijIVCOAMgZPXNaRtflsZNvRkYt/N2zF1iG35t2e3Xp Sx3Nvu/dJxuAyD973p8cETvLuH3Fyvt0p8EMSSLGqgKAMCpUFuacycuVIbK6RykqsgO7Hrip1njY gH7wOG9x1wRVe/dob2RYzgBeBVe1dm077Q33zJtLe2a0jC2qG03uXwLd5d8fy7QcIx4J9qhl/cMr REKVORgngjrWXIzC72A8BgAPrVm7/wCPGOX+JnKsfUZrPms9CnZ9DWF61625iN+dpJ6GoJLaSOPa cbhzg9D60ljGm4pjj0q/cjCEe2ah1XKVwjbYyLmzH2RXVykgbBwPvDrVNrpfJ8uR93zZwP8APNa9 380ADc/L/SuWiAd13c8it3SuLmtJIvxQi4Dbn2jGRnjmrlm3kkyIFJxghuQc1lszD5ATjcOPxq3u IjeIcDAP45Nc97uxNrGqxQt5W3K46A/xd/wqCQQ26l1Uj+LPT+VOhAeHLc/Kf0qWVjMmyX5gQODV yjaw4O6dyWZoJYBIm1lCcg9c1mCVbhQHGe30xSSsUt9iYA2jjA9cVEPl09SvUk5P51TirGkNdCRQ 2zELYwxPJ46Va89biJYZFO9VO8Dv9Kj0/ATOB1ParAOHfH+eKmTvuZtaabBYrFOp+yFmCZ4f5TwP 6Vaku7J7cFI9ko4Dg8H1zVOP/UM/fzM5HXOaitEWS2mZgCVJIP41dKi+ZxuVGomtTEubZZbkCP5m Jzz1Ga6BP+JfCqNw+0EleQeah06NGRp2HzqAQ3f1ouHaSclzn92TWaTcrMpNJ3JFeO5B85MLj5XX rnPQ/wBKtJE8h8szK4+XCuMZGPWsUM3mhcnH/wCqty7hjS0hlUYYnrk+tUpNlJe60Vbi0lI7DBwA B0qovkxSslwGwfuEdM+ma0bB2eZlfkYzzzVS85IHbcDQ4XJgop2YoYvEUBwQd2Bxn60RPHK+xSoA 74Oay5iY13Jwd1WInYgZ9+wrOcrXRCavZIt3cFzAyy/IUPfrmoPtLei/lVaR3K7CTgNwDVenGyWq B1X0P//ZCmVuZHN0cmVhbQplbmRvYmoKMTQgMCBvYmoKMjg0MTgwCmVuZG9iagoxNyAwIG9iago8 PCAvTGVuZ3RoIDE4IDAgUiAvVHlwZSAvWE9iamVjdCAvU3VidHlwZSAvSW1hZ2UgL1dpZHRoIDI4 MCAvSGVpZ2h0IDE2MCAvQ29sb3JTcGFjZQovRGV2aWNlR3JheSAvSW50ZXJwb2xhdGUgdHJ1ZSAv Qml0c1BlckNvbXBvbmVudCA4IC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ae2Z0Xbj OAxD+/8/3bEdywQlkoKcxNLpcF9CSpcQiG2725mfn/wnE8gEMoFMIBPIBDKBTCATyAQygUwgE8gE MoFMIBP4gwn80jvRJA3STz8P/v6yW9AkDT6/Lf3itgMZDE3SIG3yefDYgUqGJmnw+W3pF8sO/W8l mqRB2uTz4LVD91uJJmnw+W3pF2GHTjA0SYO0yedBtUMYDE3S4PPb0i9WOwTB0CQN0iafB5sd3GBo kgaf35Z+0djBCYYmaZA2+Txo7mAGQ5M0+Py29IvODkYwNEmDtMnnQXeHJhiapMHnt6VfDHaogqFJ GqRNPg+GO6hgCPL1GwQB/vR/13g+CnyxswMEQ5AbsmkT4M6gi+Xq7g6Xf4I8kH4sm+SLXC6NyxC1 7EFT5CB02VivoDbZbVPgKLReHpcjbpW/EMz1E+Ha3Sl2kIvl+BlJomOYYw2OP/XzefcFsn55LEAH c/6sHNuaoH1/rxt2G0KHkyI8I8IGiDNUHS90SMQIdVusdOECzv+MrBZ3EcPcFZ3ut5KA8yt/scub j1A3l85WhAMIzq89q+DMQ6hz0NnKYESD8zvbqvJlI9Sp0tkad6gG5/eW1cqVhVBnlc7WOmMtOP+k tdp4ahHqpNHZDsxBC5x/Vls1HNUI1Rs625ExaoPzT7VV049GqM7U2Q6bYQ+cf45WHTeIULWjsx1X 4z44/0asul4EoSpXZ7tQAhE4/65YDZwUJP4MBOQKJORwzepllfEGSxklowBfMRw+k9p3pN43woAj SqJA3IOFXvwz/vuExc1/1x58fdTldx9eW73OAvu1nX/ZHQZR1V9+eXH5KgxoFzf+ZXsQRFV++eHF 5aswoF3c+JftQRB1+eWXl5avs1D90s4Hze2L8SMqhrohZcZeJEU/jJ2rbb/nksJ1Fqpn/hrw9f/M DEk6+gYGWzFO498DDrHNZZixvPiNfT6kKSbLTp7wsWuF+62fMc54b00/R5NH7Tkivk5qLVtKUzYz /VSbDIIxwP6RtV49ZTHTz2qTR2+5MsH+YSvVzrTM9JPW5HHS+nLA/nEtZU3UzPTeMnmc1c5csH+h pWxeM9M72+Rxqr0FYP8KpTwamem1Z/I4R3ch2L8UKZ8VZnrlmzxuxF8H7F8XqYgszPTPyORxVxx2 wT7wkoq58tzkz9jkcctsQ8jsyC7VQycHMrAts01v2/O+H0v4C9VbmbG/De+/03HrMNtwShT11vbu 8L6te4kXlMcpELr8XL2twolN2Zl6lPM/RL3eJUYog7Mgwv8g8kdyob/kt3iY74/yL7ibZgGX/dz2 7S1x/Xeji8qWHU0BF64664JznozDBsm1y+Bfb2WcJmmwemCt1t2isUmTNNg8sdKBs4VhkSZp0Hhk nSNzC9MeTdKg+cwqh8YWjjWapEHnoTWOmy1cWzRJg+5TK1xUWwSWaJIGg8fmX6ktQjs0SYPhc7Mv YYuOFZqkwc6Dc6+vLbo2aJIGu0/OBM4tCAs0SYPEo/OQYwvqeZqkQerZSRD5h66bO5qkwUkr57OZ QCaQCWQCmUAmkAlkAplAJpAJZAL/ZwLnH3C8Pm5EoOaxGdTC0bYeFPP/JpcWUh7oKQHVPDaCUBWO tjUlAVCrcJ4AE5dKIUbNWzWPjUn7hzja1v6cfdMqnCc2bpwqBeO+d6TmsekNVvc42tYV3G1bhfOk O1kApVAOBz7VPDYDGjuKo209KOar0ULKAz0loJrHRhCqwtG2piQAahXOE2DiUinEqHmr5rExaf8Q R9van7NvWoXzxMaNU6Vg3PeO1Dw2vcHqHkfbuoK7batwnnQnC6AUyuHAp5rHZkBjR3G0rQfFfDVa SHmgpwRU89gIQlU42taUBECtwnkCTFwqhRg1b9+dL6JKp2kKxX5qAXYKOaWAF2St5qUhp1tMJPaq vedO3ldRCtyjilLz0ihmpBGJvRqZRFarSIdMXMvMPRtqXpr40eBWJPYqAMMrrSJdOKQuZeaeDTUv jXpjpBGJvRqZRFarSIdMXMvMPRtqXpr40eBWJPYqAMMrrSJdOKQuZeaeDTUvjXpjpBGJvRqZRFar SIdMXMvMPRtqXpr40eBWJPYqAMMrrSJdOKQuZeaeDTUvjXpjpBGJvRqZRFarSIdMXMvMPRtqXpr4 0eBWJPYqAMMrrSJdOKQuZeaeDTUvjXpjpBGJvRqZRFarSIdMXMvMPRvvztfulN6HcqnfYHrlgxmo mHfnK7nqN+H6lu2Vq1vpKgX2WeDUPDbAjJQo8anvo5H3C6t8lMOBTzWPzYAGoiiRuUgymYtkgVXm gmlInblIFlhlLpiG1JmLZIFV5oJpSL1KLuIoq0wgE8gEMoFMIBPIBDKBTCATyAQygUwgE8gEMoF3 E/gHCVWjKgplbmRzdHJlYW0KZW5kb2JqCjE4IDAgb2JqCjE3ODEKZW5kb2JqCjE5IDAgb2JqCjw8 IC9MZW5ndGggMjAgMCBSIC9UeXBlIC9YT2JqZWN0IC9TdWJ0eXBlIC9JbWFnZSAvV2lkdGggMjY4 IC9IZWlnaHQgMTIyIC9Db2xvclNwYWNlCi9EZXZpY2VHcmF5IC9JbnRlcnBvbGF0ZSB0cnVlIC9C aXRzUGVyQ29tcG9uZW50IDggL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB7dxpV9pM GAZgW2QLCSRh3yGyo2EHwy4URUVxQbS0//93vM8kkRoPVn1Pv5h58gVy9Jyaq/esmZm9PbxQAAVQ AAVQAAVQAAVQAAVQAAVQAAVQAAVQAAVQAAVQAAVeC3x7vl7/gK57TeG7dpEbuh7/+Wm3DBbLvnpZ LN+/04dhYLBabXa7w+Gw26z7FrowVAcoEyQNhMHhZFwsy3EcyzhsVpowQEJzUBkcwMB5eMHr8/m8 Is8xdoLxXIjM/UkkIA9WmxoHlnMDgz8QikRj8XgsHBDdjH2fEgsiARB2KBWc2wNpAIZYIiVlsrl8 LpOOB0XOSUkwVAqbg2HdvLhlyBfLR3K1Wq0cFg5iAd5FSTBIKuxO1iP6Q9F4UsoQhmq92eocK8px uyHnUyGRpcMCYrFvc3KCP5JIZwslYGh1lF5/OBqPx6NBt10tShGRdVBRYUAsrA5WCMTSuXKl0VZ6 w/FkOjuFa/ZjMup1qsV0mB6LfRvj8UelYqWpDMbT0/nF5eLqanF5MZ9Nht2mnE8GBbW+MH+rCkXE 7uKDiZzc6p+cni+ub27v7u/vbq4X8x8n/U6trNedFgr64aqFEEoVasr4bLG8W60fHx/XD/c3i/l0 pDTlQjrq87jU3pbpNUjVyfDBZKHWnZwv79dPG7h+rldgMRkc1w9zqaifZ512MiqBYYmpCwqpO51u fyxbOR7Pl6vHza/fv39tHh9ur+bTodKQC1I85IN+uINomJyDtKl2VgynS43+bHG3/vkbrs0TWJzP xr127TAvJSIBL8+5nDBIMzkHBMPmdPtimaP26Ox69bTRc3F9cTqFNrUul3JSIhr0iR7zc6jBcPGB RK6inJwvAWOzeVrf31yRRnXUV1p1uZzPpOIRGji+fVN7WyFSfU4vblaPT0/r1e314vwMelvjYV/p NGtyiRIOresJVUax3gOM+4eH1e3ycn46m04mJyfQE+8p7UbtiA4OtcrgvBEJ6s/pxfL27na5gAIy Hg1HZFgCnypHlQYOfXzmix6Um/0f51dLKCCzE3j+Y6XbG2jDNGo4NAy3L5o5bA6m88vLi7PJQGk1 avV6s33c1UetlHCoGDBEg5a1NZiezedq3+KoXCqRyYwWXRzPLWs8K7f7k9lsOoIhajErSVImVzys 0MVBWlZ9wNrujyeTUbcBY5FYJEImu7KUcejdjGAyL7d6w9FAqZcP4iG/F+aCwzHaOPRuRohgKL1u pwazez7erc6NU8ehdTPEcCp/VG+1YNY3GRI5xul0why54KWLQ+9meMPJbFmuHBUPYn6PCwan6rsT 2jj0boYYSkjwmuggAbFw2mCYrr9KootDT4YQiMSTiVjI64G3hzB/Q961am/WaOLQMFje6w8G/SKU EPUVu/7qmTYOFcPBwGt23gMTe9vVBlRyAIbFaoPlFwyZ4ny58IJCDoJBlqPYdizIoY5DfWBoPHYv 1KKNA56XrNMhH7tW4Wg/paZlIQy7ITQc+CGdDe2ubOztIYfBBTmQwyBguMF0IIdBwHCD6UAOg4Dh BtOBHAYBww2mAzkMAoYbTAdyGAQMN5gO5DAIGG4wHf+eY+c8m+Gf+So3/yQdyGFYdYwcyPH2QkpM B6YD0/HBdaVUFpa316QjB9YdmI7+gOxZ0HcsIIehKkUO5Hh7mS2mA9OB6fjgMtu3C8tXmdx5/+/8 xPQPcrxbd5jt1Lj/nw47rO033alxwAFLBz+0kPJPYRE8LAMaEI33S+PX+o1Pchyk4nBQmocl2z7+ tj7zayH8+Ws/xwEHNET8AtkDY7piopF8gqNSzkuxgMCq2x3+gJrq28c4+t1OQy5KsFGMIcEwlYDh Yd7lGMH4vg9nH+VTNBwP9g7HYAj779u1khTxcg6rmXOhheRvHB2l21VaYBGlwwJE3uaoNZpwggkd ZWRbf7zBUSiVD0ukIeHpOYuVmOzgiMJxrFI6GYWjWM3cpm4T8fLLKw6yrTQcDgehr6U2qSZuU18q bL+/4vAIgsC7yfl51BzdvKUgX15wkGO9XQycFkdGqoZfoudmy0H2le7aWUoPBXlSnUPdWEqmL2iN hf6/TjjIXkmU0EBUD8ozoUcDP1AABT4t8B+jWWHfCmVuZHN0cmVhbQplbmRvYmoKMjAgMCBvYmoK MTU3NwplbmRvYmoKMjEgMCBvYmoKPDwgL0xlbmd0aCAyMiAwIFIgL04gMyAvQWx0ZXJuYXRlIC9E ZXZpY2VSR0IgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBnZZ3VFPZFofPvTe90BIi ICX0GnoJINI7SBUEUYlJgFAChoQmdkQFRhQRKVZkVMABR4ciY0UUC4OCYtcJ8hBQxsFRREXl3Yxr Ce+tNfPemv3HWd/Z57fX2Wfvfde6AFD8ggTCdFgBgDShWBTu68FcEhPLxPcCGBABDlgBwOFmZgRH +EQC1Py9PZmZqEjGs/buLoBku9ssv1Amc9b/f5EiN0MkBgAKRdU2PH4mF+UClFOzxRky/wTK9JUp MoYxMhahCaKsIuPEr2z2p+Yru8mYlybkoRpZzhm8NJ6Mu1DemiXho4wEoVyYJeBno3wHZb1USZoA 5fco09P4nEwAMBSZX8znJqFsiTJFFBnuifICAAiUxDm8cg6L+TlongB4pmfkigSJSWKmEdeYaeXo yGb68bNT+WIxK5TDTeGIeEzP9LQMjjAXgK9vlkUBJVltmWiR7a0c7e1Z1uZo+b/Z3x5+U/09yHr7 VfEm7M+eQYyeWd9s7KwvvRYA9iRamx2zvpVVALRtBkDl4axP7yAA8gUAtN6c8x6GbF6SxOIMJwuL 7OxscwGfay4r6Df7n4Jvyr+GOfeZy+77VjumFz+BI0kVM2VF5aanpktEzMwMDpfPZP33EP/jwDlp zcnDLJyfwBfxhehVUeiUCYSJaLuFPIFYkC5kCoR/1eF/GDYnBxl+nWsUaHVfAH2FOVC4SQfIbz0A QyMDJG4/egJ961sQMQrIvrxorZGvc48yev7n+h8LXIpu4UxBIlPm9gyPZHIloiwZo9+EbMECEpAH dKAKNIEuMAIsYA0cgDNwA94gAISASBADlgMuSAJpQASyQT7YAApBMdgBdoNqcADUgXrQBE6CNnAG XARXwA1wCwyAR0AKhsFLMAHegWkIgvAQFaJBqpAWpA+ZQtYQG1oIeUNBUDgUA8VDiZAQkkD50Cao GCqDqqFDUD30I3Qaughdg/qgB9AgNAb9AX2EEZgC02EN2AC2gNmwOxwIR8LL4ER4FZwHF8Db4Uq4 Fj4Ot8IX4RvwACyFX8KTCEDICAPRRlgIG/FEQpBYJAERIWuRIqQCqUWakA6kG7mNSJFx5AMGh6Fh mBgWxhnjh1mM4WJWYdZiSjDVmGOYVkwX5jZmEDOB+YKlYtWxplgnrD92CTYRm40txFZgj2BbsJex A9hh7DscDsfAGeIccH64GFwybjWuBLcP14y7gOvDDeEm8Xi8Kt4U74IPwXPwYnwhvgp/HH8e348f xr8nkAlaBGuCDyGWICRsJFQQGgjnCP2EEcI0UYGoT3QihhB5xFxiKbGO2EG8SRwmTpMUSYYkF1Ik KZm0gVRJaiJdJj0mvSGTyTpkR3IYWUBeT64knyBfJQ+SP1CUKCYUT0ocRULZTjlKuUB5QHlDpVIN qG7UWKqYup1aT71EfUp9L0eTM5fzl+PJrZOrkWuV65d7JU+U15d3l18unydfIX9K/qb8uAJRwUDB U4GjsFahRuG0wj2FSUWaopViiGKaYolig+I1xVElvJKBkrcST6lA6bDSJaUhGkLTpXnSuLRNtDra ZdowHUc3pPvTk+nF9B/ovfQJZSVlW+Uo5RzlGuWzylIGwjBg+DNSGaWMk4y7jI/zNOa5z+PP2zav aV7/vCmV+SpuKnyVIpVmlQGVj6pMVW/VFNWdqm2qT9QwaiZqYWrZavvVLquNz6fPd57PnV80/+T8 h+qwuol6uPpq9cPqPeqTGpoavhoZGlUalzTGNRmabprJmuWa5zTHtGhaC7UEWuVa57VeMJWZ7sxU ZiWzizmhra7tpy3RPqTdqz2tY6izWGejTrPOE12SLls3Qbdct1N3Qk9LL1gvX69R76E+UZ+tn6S/ R79bf8rA0CDaYItBm8GooYqhv2GeYaPhYyOqkavRKqNaozvGOGO2cYrxPuNbJrCJnUmSSY3JTVPY 1N5UYLrPtM8Ma+ZoJjSrNbvHorDcWVmsRtagOcM8yHyjeZv5Kws9i1iLnRbdFl8s7SxTLessH1kp WQVYbbTqsPrD2sSaa11jfceGauNjs86m3ea1rakt33a/7X07ml2w3Ra7TrvP9g72Ivsm+zEHPYd4 h70O99h0dii7hH3VEevo4bjO8YzjByd7J7HTSaffnVnOKc4NzqMLDBfwF9QtGHLRceG4HHKRLmQu jF94cKHUVduV41rr+sxN143ndsRtxN3YPdn9uPsrD0sPkUeLx5Snk+cazwteiJevV5FXr7eS92Lv au+nPjo+iT6NPhO+dr6rfS/4Yf0C/Xb63fPX8Of61/tPBDgErAnoCqQERgRWBz4LMgkSBXUEw8EB wbuCHy/SXyRc1BYCQvxDdoU8CTUMXRX6cxguLDSsJux5uFV4fnh3BC1iRURDxLtIj8jSyEeLjRZL FndGyUfFRdVHTUV7RZdFS5dYLFmz5EaMWowgpj0WHxsVeyR2cqn30t1Lh+Ps4grj7i4zXJaz7Npy teWpy8+ukF/BWXEqHhsfHd8Q/4kTwqnlTK70X7l35QTXk7uH+5LnxivnjfFd+GX8kQSXhLKE0USX xF2JY0muSRVJ4wJPQbXgdbJf8oHkqZSQlKMpM6nRqc1phLT4tNNCJWGKsCtdMz0nvS/DNKMwQ7rK adXuVROiQNGRTChzWWa7mI7+TPVIjCSbJYNZC7Nqst5nR2WfylHMEeb05JrkbssdyfPJ+341ZjV3 dWe+dv6G/ME17msOrYXWrlzbuU53XcG64fW+649tIG1I2fDLRsuNZRvfbore1FGgUbC+YGiz7+bG QrlCUeG9Lc5bDmzFbBVs7d1ms61q25ciXtH1YsviiuJPJdyS699ZfVf53cz2hO29pfal+3fgdgh3 3N3puvNYmWJZXtnQruBdreXM8qLyt7tX7L5WYVtxYA9pj2SPtDKosr1Kr2pH1afqpOqBGo+a5r3q e7ftndrH29e/321/0wGNA8UHPh4UHLx/yPdQa61BbcVh3OGsw8/rouq6v2d/X39E7Ujxkc9HhUel x8KPddU71Nc3qDeUNsKNksax43HHb/3g9UN7E6vpUDOjufgEOCE58eLH+B/vngw82XmKfarpJ/2f 9rbQWopaodbc1om2pDZpe0x73+mA050dzh0tP5v/fPSM9pmas8pnS8+RzhWcmzmfd37yQsaF8YuJ F4c6V3Q+urTk0p2usK7ey4GXr17xuXKp2737/FWXq2euOV07fZ19ve2G/Y3WHruell/sfmnpte9t velws/2W462OvgV95/pd+y/e9rp95Y7/nRsDiwb67i6+e/9e3D3pfd790QepD14/zHo4/Wj9Y+zj oicKTyqeqj+t/dX412apvfTsoNdgz7OIZ4+GuEMv/5X5r0/DBc+pzytGtEbqR61Hz4z5jN16sfTF 8MuMl9Pjhb8p/rb3ldGrn353+71nYsnE8GvR65k/St6ovjn61vZt52To5NN3ae+mp4req74/9oH9 oftj9MeR6exP+E+Vn40/d3wJ/PJ4Jm1m5t/3hPP7CmVuZHN0cmVhbQplbmRvYmoKMjIgMCBvYmoK MjYxMgplbmRvYmoKMTAgMCBvYmoKWyAvSUNDQmFzZWQgMjEgMCBSIF0KZW5kb2JqCjIzIDAgb2Jq Cjw8IC9MZW5ndGggMjQgMCBSIC9OIDMgL0FsdGVybmF0ZSAvRGV2aWNlUkdCIC9GaWx0ZXIgL0Zs YXRlRGVjb2RlID4+CnN0cmVhbQp4AYVVW4gbVRj+kznJCrvO09rVLaRDvXQpu0u2Fd2ltJpbk7Rr GrLZ1RZBs5OTZMzsJM5M0gt9KoLii6u+SUG8vS0IgtJ6wdYH+1KpUFZ36yIoPrR4QSj0RbfxO5Nk Jllqm2XPfPP93/lv558ZooG1Qr2u+xWiJcM2c8mo8tzRY8rAOvnpIRqkURosqFY9ks3OEn5CK679 v1s/kE8wVyfubO9Xb7kbLHJLJfLdB75WtNQl4BNEgbNq3bSJBobBTx+36wKLHIZNJAj8osDlNoaN hhfb+DVHk8/FoDkLLKuVQhF4BXh8sYcv9+B2DlDAT5Ib3NRURfQia9ZKms4dQ3u5h7lHeTe4pDdQ s/PbgXXIqs4dxnUMtb9SLMQFngReUQuJOeBHgK81tYVMB9+u29Ec8GNE/p2N6nwEeDdwqmQenAeG H79ZaaS6+J1Tlfyz4LeB/8ZYzBzp7F1TrRh6STvB367wtOhviEhSNDudB4Yf6YBZywk9cpBKRR5P AI8Dv16tHRY5wKf0mdWcE7zIZ+1UJSbyFPzllwqHssCjwL9yPSn0iCX9W7eznRxYyNAzIi5isTi3 nHrhh4XsSj4FHnGZbpv5zl62XNIOpjv6TypmSvBi77W67swocgv4zUZO1I5YgcmCmUgCw2cgy415 0U+Bm7TgKxCnGi1iVcmgTVIoR0mK4lonE5YSaaSD4bByMBx3Xc2Es8+iKniNmo7Nwpp1lO2dXa1C ZbAGXXe0KsVCH1EDnir0B9iK61OhGO4a4Mr/46edy42OnxobYWG2F//72Czbz6bZDCnsKfY0O8Di YGfYPtd3Fnu6FYl8biBK28/LiMgd3QJqv4gabSpg/QWKGlmuh76uLI82xjzLGfMFTb3yxt89vdKw s+oqJvo6euRePQ/8FrgeWMW6HthwfSiBnwIb+FtHb7xaap6902VxUhpOtNan23oWXVUElerOziV0 QUPNvKfmiV4fl05/+aAXbZWde/7q0KXTJWN51GNFF/irmVsZOjPuseEfw3+GV8PvhT8M/y69LX0q fSWdlz6XLpMiXZAuSl9L30ofS1+4+rvNkHv2JDIXcyXyFtPVrbC315hYOSpvlx+W4/IO+VF51lUp 8og8JafkXbBsd8/Nm2+lt3L05Siidftz51jiWdFcTzgD3/2YAM2L2DcD88hYo+PwaaLfYt4MOglt 75PXqYiF2BRLb5nuaTHzXd/BRDAejJAS3B2cCU4FDwncfZaDu2CbwZrozQ3z4Sr6KuU2PyG+JxSr 1U+aWrliK3vC4SeVCD59XEkb6uS4UtB1xTFZisktbjZ5cZLEd1PsI7qZc76Hvm1XPM5+hmj/X3j3 fe9xxxpEKxbRyOMeN4Z35QPvEp17Qm2YzbY/8vm+I7JKe/c4976hKN5fP7daN/EeG3iLaPPNVuuf 91utzQ/gf4Pogv4foJ98VQplbmRzdHJlYW0KZW5kb2JqCjI0IDAgb2JqCjEwNzkKZW5kb2JqCjcg MCBvYmoKWyAvSUNDQmFzZWQgMjMgMCBSIF0KZW5kb2JqCjI2IDAgb2JqCjw8IC9MZW5ndGggMjcg MCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AbVZ2XLcRBR9769o3jRUrGhfHsFA EYoHB6uKB5wHZ7CJgyeLxln8n+F/uL2c0y1pPJ6AbZdLci93O3fr1nv9XL/XZZ12fdbnumzSPJM3 3eZ92suPrqtMjxf6d/1GPz3e5nq91bn93a7n2/Iy2la6/Ur2Xn6r+7qo9SfZ99pROT7Vmf09PRb2 WZrJT9u1VZZXdvhoOtTkrRVQ160VUK03WpYUdZ31TWZes7LpykpvhFZdZFmdNTqvi0rI6mt9Kkoa NUmm6vq06iqdF5luurQpqr41klotTy7G9cW7mw/n13q8kl1mkfm1C+usXJIRaZ4+2+T6h7eOkTrY noWxpyhiGKSVFpsKP8st122fWijqokm7rjI6fz/osrfT8ujqtOjzrNBH8s8gIgxDIZuHS/2HTk7G lbWQTt6uLIPkpX9er5RhmFxgwQYv2q84vTnH0M1yFUfe2OUquVnpohV8dCIEXujhF/3jYM09V6Rq qlQA006RvElb62HGttE/R0WlnDaCj9Em+Walh9eOKFzwHpMFTkpMFhGPOOVFWldF3Whh6M0nPrOD ocNIZyrbjU9gZvARYkYheRRtRNrEjEPmZ2dblQze3HienAIAmv8dcODLNUau8LI+XykTC9oAYZ+c EujdjEDlXsDhTwwQTc9BJeTA3bcbriIh8NqCIldfeilu5n7GvdjyCkJQ349khDXOOCr5FWuNkXY5 WZ41LlwqyWHBywIckiYs0EriJKDxBXShECUYN7QjJaegbrUKQUSD/gOC0EDiztn+FiOkgoHxAhAG A4xbSoJldIKRxv5MomeRP7kA/w2MT85WILGlTtAXT05Q2b/cfmXCeupXXIIZYB4E4xLQd0uVSUfO HNgjE/vxzNq78fSZIuAJdvSthRVp/TXWfoCinGIMQEHOEAO+cC0t+J8icmKGOL2pZUUo2y4yye70 Zty9T9va1HCfTtWu7GYresxvRwU6hF+UTj1bj83+pCqpcmfRm7BUIYptUp3qFcD/yTsqfWzcgZ9P lvvx8z4KDyG0pOz9WyVMgFxD1wfzrXcwnazplphj3mAKWApGpgclYidzFGhgBWXoy3/fHRsU6yOr C9Va0PGJImophOXemC4r2wn4liagixxtepkAK/WPUoZNSJDkLdJn0IjSQnum4SVOVNZPqYS7qdoT 71ogt6VQoThiLuLgnQ2Cc9O4IQpQgru4iFI4wpFYBI4v1IH+CLokB/FewlrcLDP74crrKN/M4Fqk 4DU5bjb0fOpCNSVLzqKMIUBlIDLsF+rLBlNQk5HltQpla/DQTVoI6z9M3RTlljZh6kAfQ63u42z7 YEufZBnT72B7st5jD06RNa3oZLA6BuTMCSJLG/s3SarsjYou7o38Wcs+pDdy7fghvfeBbHx4Bza5 SFgXeW06Md/8u9J0X41Qh6jjj2nyKNq0bOtsyUdyinJd+FlC686MGvrouUsFYNka0V1IhCMj0SfW 8Jzg+mjygrdyFynefkKgcO7WdnQx8uEEuaNfKGrbQkmpt0fIx28YDmL4wB3DlOehLcMznxxobWAU 8orP4QQWK4gGSwvQ1KGArGfborqMpLagh4EtZCAnSukzpEo4NS6SZihMXMT9rBJMLZf+uAbmJMcV y4BhdcQmCPwKaY57tk9CAQ1+G1rbkKKK8itqDaUkI1gVT9pfDlm+3ngr2JsLm6chPolsmLAZu9wd zEprokTQzrADCdKI3EMEGN1+cXQCJ3MISHVJDzPkBNZuQiXcwhWwDJ7UbGGhkArl0mh2iBX6Acf7 K0/e247PpCB7JeNuSaalB+eUnbcw/pwyLT1yorG3R5ruE/ExtzEH1x41u2XCpc/8fHIXo33FZ9Eh DT4WguVHosNkQvC5SvsQBXB0AvYqpEI3gzuQCFooldDHwxwdmFKQIsXhCEjLFYT6KldobDfJarTL FR6iC8k9n0dvQ8DIl9d9ruBdPHdHcbmn/Q4BTIsTVb4QTKyF5f2K0Dws223uJch8YWaIRnyUg1HU ytNb6Ajc9vn/u8Tkzi4ErT0PPlxfmjs2j+8QE3UO8Qf2pc98aggVCAGrk3A5SOgAFH3FwxRFN6dG uM3SS3YB6O78UNpIBRxZ++kGII8V+J9t9BWKCJ2SRJbVMKi9XC0cXih8Zzig9rgbxMdPOJ7P4/vX VKFDHIwJh1Cn8yKEAeC3ZqRzj8c6uokAyNxEd6C7cTfqFgeWF6XcDXqsSHRacKRb3S1UzGh218Ap OjbdbFLOQoda1/Z7XKc7+cQoH+Yan+7tl8pCD2tpQlw3Ih+Zqi6tyk4OoHk2rf5JIZrha9bzfwE8 It9ACmVuZHN0cmVhbQplbmRvYmoKMjcgMCBvYmoKMTczNQplbmRvYmoKMjUgMCBvYmoKPDwgL1R5 cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDI4IDAgUiAvQ29udGVudHMgMjYgMCBS IC9NZWRpYUJveApbMCAwIDc5MiA2MTJdID4+CmVuZG9iagoyOCAwIG9iago8PCAvUHJvY1NldCBb IC9QREYgL1RleHQgL0ltYWdlQiAvSW1hZ2VDIC9JbWFnZUkgXSAvQ29sb3JTcGFjZSA8PCAvQ3My IDEwIDAgUgovQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9UVDYgMzIgMCBSIC9UVDIgMTIgMCBSIC9U VDEgMTEgMCBSIC9UVDQgMzAgMCBSID4+Ci9YT2JqZWN0IDw8IC9JbTEgOCAwIFIgPj4gPj4KZW5k b2JqCjM0IDAgb2JqCjw8IC9MZW5ndGggMzUgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0 cmVhbQp4Ac1ZyXIcRRC911ckvlAimHZX783RwhGADWEzHXAgOIhGAtka2+qRN/6T/yFryVe9zCLJ HKwJRffUkuvLrKyca3pO15SXSdOmraG8SkzKb1SbNmn5j8oipeGcfqVX9PB0a6jfknGfbT/fZvLR ttzvV7z34itqy6yk97zvhadyuqbUfdanzD5NUv6rm7pITeGGV9OhytROQCprJ6DqN8RLsrJM2yq1 r2leNXlBG6ZVZmlaphWZMiuYLF3RmpW0aoJM0bRJ0RRkspSqJqmyoq2tpE7LZ+dDf/7m5u3ZFQ2X vMsush+3sEzzJRmW5uH3G0PfvvaM1K3tmVl7siKWQVIQ25T5OW6G6jZxrigrk1RNYXV+1FHeuml+ mCwpTF7WtOIvHYvQdRlv7i7oN9Jfnjiyuj9xhiL9Ogy8ck+ltzJxLi9+huLM27AFSykM3AgxP6D0 +zAh44PQfCkvslVWCDMZv/k7yAVxeOZ36n6gx53z3cIqprRWoblVWvZsaprKWkXNrfImyAn5RJw/ wsRVeEKKjVdA6X/DjAh8Gb7PFVljq9AWMzLtrG6UPqJYUXAwQjFTJbWLQ4vA0ZdVVgTtGMXW5/qL E+peeGtJoB4BVuSkGFgj4iNODLKyyEo2Z1YEkHFk7WDokUypSnejODKzKGZiViF+ZIxfkLaZxeP3 T7H7cCYQuggWvwnPVY+pDTvW5gPS7Ej/Ajew2e2I0uGF9EoosIf84pfYxm71Q+xX/xIkGW27OlF+ agtK4DZsVqnsxMvE41OnqDmuC5vqbuH+NqlLm589xBkE6p4guAW/EQgC24C9w1BgB+9MaBMV1QwK U70iIH4Sq8LUnHS8GyQkvxO/dAEh8nwmKzjJ+C0gAgjBzWFK6eGbQEZ2PxB6ETegA7isHs0hpDRo z6dI/yUSrU7lDdRBU/B6Lgp+kJEHItt2KYmskSUSP0NgoPSGp3blWJNW/ujJm2wExugpPnLHMWuh x2eOmEeeP4tGsL+IBBVFNsTfmajYv1xqBDvKNngP8Y8XhD1sHtOFiIEpyAOTTyxjj+Y0qRT/TxEd DVXmI0OFIsY92FAhgyNSOcWp3enasbGs7sjGsIRlZkrrFs/tXgG6Wx0V6h9+ZHWS12U64hPyT4zT kSdDrEVoVuLcQpDBZ6MPyCFm56Xfe/gHCEAoYEQwAQE+iptBUJZEia49f6UhCBYDCj2Gvp4lBGQg 5JVL0bDHkDAF2LYyIvJhKRj5FUpHxaM0wLxsxy6sWSyBWDAk1oowmOE0UTCIaF+dYvI8JIfMFSqh Lo0gsckhXeBCpN2nLOmLEw4wPsIhCSCBF0zB8rAqFAoZ1dVZjt4875HLe27quFCdc7nSTwWoazHY Dt9ABrikFw6Q87UgBIuFIICL3bIZ2mImvCi9oCJ79tu5hzkhFKIJ5ISMCAdIYcU48HYeIsBJamxu vCVOBuj4Dm9DDFgvj9LI83Kakf7wkSejJGnScCbl/1kuFbGy2hVaQSxb4sQ6O35ZZVmSm0mhtaP4 dddiZsYAPsow3Fh2M7SXl6rNDIdQ4Hu/RD5T0vNUxgrHxX1DWZ6YzN5lwWcRsF1Idoi58YEcCmBB x6LmGRU2ABmQg5pHnPksOlFwB64xzABb4frLCCCBi4rZA+zuhorSgZUN5u5EEQhstvhlbrWDd7Aj qABDey8a8Rgx/N9RMeb52aLiCdxrA9vla0Q90lG8Hm6wXDAUBriSx5F7Nyz4A+5gwNrDbhqph7Fw OCWB4X7wLbEQInfPXUzZBpP7TO5iOMUz8HT4O5AhQiYKpZ5+/ORHtqa0HEKJfKB25SQaS2S1u9tg rTm9AB605rGqfMLyeIPjU+62KJ0nPCeXW1c624w71TCWzmsUoVKyyBP1W49sCrQjzwnsJVhkM1Lp 4GdUbJIgjO592woHAXIz5LvrbYvjW2lRASKLLu8g6ZITChGsuQmVJGwkZIT+/uJojT39ylcTataA ROSYqoiAHnW0Zpfj0NDqQiEJ1cbHabgELXsHtL93oGLvQNRbqgWTwEjQz6IhVEvquUuvnCb29aC5 zzzS9WjwhlRxMHgP9rwjv1u1JqcRdbdMKG32yHJHg3LKwHDXbtryGBC6W8GYOOVoWa80fIIXBLVQ EapLF8sKAZh/kl52XwAGUAcqhAiE/Uz7MAwarrH3/FBi/EVDzuu9nfPoTMW/mXwCSMf89pxotqAL /fPI1v5Uswek/HsQd9DtZ3JcA6RjlqOc47roUwZ8rty6L7ddQgOJ3CNPaQz8A5SirFqiEgQBMezi xOMv+gy6eF275ta/VdtQWbofvhpq+Lc8/gWsCg51Pwlm1PVkvIX4YYomKfKGG1ImndUnOZOX6uT5 f5a1yfMKZW5kc3RyZWFtCmVuZG9iagozNSAwIG9iagoxNzY3CmVuZG9iagozMyAwIG9iago8PCAv VHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgMzYgMCBSIC9Db250ZW50cyAzNCAw IFIgL01lZGlhQm94ClswIDAgNzkyIDYxMl0gPj4KZW5kb2JqCjM2IDAgb2JqCjw8IC9Qcm9jU2V0 IFsgL1BERiAvVGV4dCAvSW1hZ2VCIC9JbWFnZUMgL0ltYWdlSSBdIC9Db2xvclNwYWNlIDw8IC9D czIgMTAgMCBSCi9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUNiAzMiAwIFIgL1RUMiAxMiAwIFIg L1RUMSAxMSAwIFIgL1RUNCAzMCAwIFIgPj4KL1hPYmplY3QgPDwgL0ltMSA4IDAgUiA+PiA+Pgpl bmRvYmoKMzggMCBvYmoKPDwgL0xlbmd0aCAzOSAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4K c3RyZWFtCngBjZhrc1u3EYa/n1+Bj1THgnC/9JutqmmdydSuOG1mMpmMw8ipbDG2KceJ/32fxTk4 pEjqIo5IcA+w2F0s3n2Xn9Rr9Un5qEs11SqftDWMVLZVV/5UDEZtrtR/1W/q7PzWqtWtsu11u9pf Zv3OMj+uH1j79i+qRhfVH6x7N2o5v1SmvS7P2d5ow18uORgbmvj0rijZ3AxUMTcDh9VaMcXFaGoy MjQ+FR/UGl3RGRNNUja6gFp1oy5xUtyc1YRSdShBWWdUKjq5ULNY2rx8dbVZXX38/PubG7W5ZpVM klebGI0/VIM1Z/9cW/W3D+NGw5Pj6SSeOCIb6KCIKfu13azKVbejiDboUoL4/GKpfG2P+bDF6cyZ nTJeYsFy6Vi7fKt+UIuLP09agNTiTR+s++DjySA7Lm5O2s6LqxPlctZZLdSJ+lEtX6qLJX6MTt+x KMZmUlGFKGNbUqv1gE3tsJxarpQdV/FhQ9HBl6hO+TKaJ3mDeYvAPst34y5bd1Me3fUxifLJ3dFb eT/tXnY1D2sJTQsGErRhTKc9C1G5bxqR+8E8U9Y/U46PEJ6plBlU+WYqbydDDmphee7KM5UT/5Ev HonnizVMLyzncOSNOTbIyIkqviWeZQTy7yxLrSxNqHY7un17gCWZhzax1qI3immysJofd0/qSAxH 76cYbg8lpaizy8cO5Wg0SxzPJLiycyY2jRkqH6d8uXO6hHB5oqy1avGhZ9x7Ukyuq1r81genL65P 5Fh2Zb/0h9d9ME//tUtOz/to1j5NGhaftwk9av6zS/46PcHJGLVXi+fPTdczK3x/8epE5aDdsHj+ c3/6elr55T1eNXMvvsxWvfxmkvV9+pz+ffP1X9Nle9tXd4U/9R0uL9714fezm7N133eVaZw0LEKf /fIfffSxD15cfN38fdqJ+Gwv8zZFHjvSWAFu31Jk72QFHg6v7azP1J0Uedq1PduHWnDT2GJLyy8X yY7kgEXvgs7JJ8lngDaMQHv276ubN5+vv1ydf7j5sLleX33eXK8EsnudMtoW46sDXbXLJpayMxpA trNvKGi/3ipuhZQ/5T1L+CTbTZbihyVj/dqzlIVOFhLWHVurY0Mu/r698RF7pWTZmEoWIMVexmwt xaAbWPcMtEYXtp6K673GJZ8JoUByi6U1JHfzc4qnoCPxTNg3vFb3xlMqU/vfNQmkuxu05CbG8Lhd udVrP8JI9TqpmnUgdhkkpcRIDEfT8tBqqoOFmM4fHjx2IRY65RK8MAntE7QieKJ5eT48gWhYY+96 hRlj8fA+tnPB9JhMsiEOa4oDnx5AqakWqEmdyMZxEzhQC/y0VHORZBHGtW6V0oRQB+iMzjkWlEj1 FBkHtyPLOoaQkCUIU4XhhKy9o8aKJJlATiCJyXl0ZfRH+NosY9YkE/0U/JpckyUToULs6CsUTmYV crBJSrW56YolZ9GFt8mD+WKXz5A6dCFzLiFLZHIpzf57ZLZ4/ExWW1/Zk1mxRllpIWGGPWPQNiSs EEny5MERWZ/VNLVZXfLwOrE16MRhtXlAAvcMR2zOo1WuBjgUEucgN+JPDqTpSv1PSOzePfskOMH5 h9iuWKrac/vh0FBn38h0wE+X/QRb5REYeEJ6eufH9AmGrUeSJOmZK+meoYKMOdXivGmJlaonzVRK 1gIhfspOUnlKcok2eLduyGdMcQMXRockxypgKCJ4zSziiifvpU0AgLIRZEYSqRae84Ib80iWYQKa uEpZbvIsa7OabFQfUlPvIPLeM4twkdfMQuKK4LHVIadRlfOxqaJEuFroPbKuxUuyebqW5Ny4sKYs ft4ngzCjzutQ247cn4gOkeTCBh7ELEB/kyTys225L+uzmqY2q0seXidmwYol7ZoNcmQiISPFKic0 n5giiS6P7vhYxIZ78s9p4JyICcRbsi1L2uWIdzKwJQCAc9msj+Tfg+US/KTaSUY82KiVKT+lYu/k p4+hYp+sTzkXQ0dFzmUShqS0uJjp3cY+7UErpGiXNCavlZohOLVWNEKgM2DkqHDAmsDwPTKQm2wF arRL2Q3MckYOXiSlgDdIKB+pIKHVhCwT/UMZ+j13vxrb5gXSb0CSE41kk3iKhSL+QGsQCdpDlLuA +WJhQGYBDKajC8CgxIF6zKvZ2OGIbJwXqyNUYhuFh7oJszHEtEmowE4kqQSppMwhp9ywOpQ9SXJk HXZVLmnKU3xM5YYg8cETKLE+wGIQGKFrTWBMu7djAp9Dm6ThVWYwd5tdMLdlsq1BaCR1q3W7E71q H6e877ca/2mEHsY+dxib27l72O8Q1GKnD2hcfu44NnOb/HYi7J3CQ3rb1FPbSbY/TqyPeCC98dYD C7aYTIE5cOQ4s+b+jDEhNXao9VahdF+HIekNw4tu+bdzbL520as3vfnaOr6ep3XXZ8Hmdj9w86PV L13T7RzCuR1xPWSxD6YuZu+nhp3COsDfKawwCkGuBmw0JJZxUMGR0S5DWjyXj8I6kUT628YSjxJY UbglsE9DMcjjVCCnhmBkgRb2kgENUGyigGBPDkFodab1DzaB7COMbXuQHe4cpLoIXjv6c47XQiED vvB7lTAxnKb7QsFxGcBU5VIxL1s24s7pYg1IRX5QNNwg6yBio6RB0arpuisb9WcqbFtJ7fHMQgVE RlRRg0QVRCkKqRPl0jmJqgzLhOG4KECOTFTB+gXrZB6XXurxgQzYIEoao8VNoBfS1ySQXdkT2JCV gQqGmmmOM23PfdlwOOtQgq3768QuqZAB7iC21pxy01XHHfEy89NOm2OF/BHmIh1JL75b7CIrqUPb lpoqNF3U4Bp49d9dxt6wXdiDm7q4+Pa7nYb69f8BI0CE3QplbmRzdHJlYW0KZW5kb2JqCjM5IDAg b2JqCjIxMzYKZW5kb2JqCjM3IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jl c291cmNlcyA0MCAwIFIgL0NvbnRlbnRzIDM4IDAgUiAvTWVkaWFCb3gKWzAgMCA3OTIgNjEyXSA+ PgplbmRvYmoKNDAgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IC9JbWFnZUIgL0ltYWdl QyAvSW1hZ2VJIF0gL0NvbG9yU3BhY2UgPDwgL0NzMiAxMCAwIFIKL0NzMSA3IDAgUiA+PiAvRXh0 R1N0YXRlIDw8IC9HczEgNTUgMCBSIC9HczIgNTYgMCBSID4+IC9Gb250IDw8IC9UVDEgMTEgMCBS Ci9UVDIgMTIgMCBSID4+IC9YT2JqZWN0IDw8IC9JbTUgNDMgMCBSIC9JbTQgNDEgMCBSIC9JbTEw IDUzIDAgUiAvSW03IDQ3IDAgUgovSW04IDQ5IDAgUiAvSW0xIDggMCBSIC9JbTkgNTEgMCBSIC9J bTYgNDUgMCBSID4+ID4+CmVuZG9iago0MyAwIG9iago8PCAvTGVuZ3RoIDQ0IDAgUiAvVHlwZSAv WE9iamVjdCAvU3VidHlwZSAvSW1hZ2UgL1dpZHRoIDU1IC9IZWlnaHQgNzcgL0ludGVycG9sYXRl CnRydWUgL0NvbG9yU3BhY2UgNyAwIFIgL1NNYXNrIDU3IDAgUiAvQml0c1BlckNvbXBvbmVudCA4 IC9GaWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp4Ae3QMQEAAADCoPVPbQhfiEBhwIABAwYM GDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBwDQwxoQABCmVu ZHN0cmVhbQplbmRvYmoKNDQgMCBvYmoKNzkKZW5kb2JqCjQxIDAgb2JqCjw8IC9MZW5ndGggNDIg MCBSIC9UeXBlIC9YT2JqZWN0IC9TdWJ0eXBlIC9JbWFnZSAvV2lkdGggMTA3IC9IZWlnaHQgNzcg L0ludGVycG9sYXRlCnRydWUgL0NvbG9yU3BhY2UgNyAwIFIgL1NNYXNrIDU5IDAgUiAvQml0c1Bl ckNvbXBvbmVudCA4IC9GaWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp4Ae3QAQ0AAADCoPdP bQ8HESgMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIAB AwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwICBq4EB YI0AAQplbmRzdHJlYW0KZW5kb2JqCjQyIDAgb2JqCjEzMQplbmRvYmoKNTMgMCBvYmoKPDwgL0xl bmd0aCA1NCAwIFIgL1R5cGUgL1hPYmplY3QgL1N1YnR5cGUgL0ltYWdlIC9XaWR0aCA3MSAvSGVp Z2h0IDMwMyAvSW50ZXJwb2xhdGUKdHJ1ZSAvQ29sb3JTcGFjZSA3IDAgUiAvU01hc2sgNjEgMCBS IC9CaXRzUGVyQ29tcG9uZW50IDggL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3RyZWFtCngB7dCB AAAAAMOg+VNf4QCFUGHAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDA gAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAED BgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDA gAEDBgwYMGDgGhj8GwABCmVuZHN0cmVhbQplbmRvYmoKNTQgMCBvYmoKMzA1CmVuZG9iago0NyAw IG9iago8PCAvTGVuZ3RoIDQ4IDAgUiAvVHlwZSAvWE9iamVjdCAvU3VidHlwZSAvSW1hZ2UgL1dp ZHRoIDIxNCAvSGVpZ2h0IDI4NiAvSW50ZXJwb2xhdGUKdHJ1ZSAvQ29sb3JTcGFjZSA3IDAgUiAv U01hc2sgNjMgMCBSIC9CaXRzUGVyQ29tcG9uZW50IDggL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4K c3RyZWFtCngB7dABDQAAAMKg909tDjeIQGHAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAED BgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDA gAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAED BgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDA gAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAED BgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDA gAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAED BgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDA gAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAED BgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgw8DQzNWgABCmVuZHN0cmVhbQplbmRvYmoKNDggMCBv YmoKODI0CmVuZG9iago0OSAwIG9iago8PCAvTGVuZ3RoIDUwIDAgUiAvVHlwZSAvWE9iamVjdCAv U3VidHlwZSAvSW1hZ2UgL1dpZHRoIDg2IC9IZWlnaHQgMjEyIC9JbnRlcnBvbGF0ZQp0cnVlIC9D b2xvclNwYWNlIDcgMCBSIC9TTWFzayA2NSAwIFIgL0JpdHNQZXJDb21wb25lbnQgOCAvRmlsdGVy IC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeAHt0IEAAAAAw6D5Ux/khVBhwIABAwYMGDBgwIABAwYM GDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBg wIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIAB AwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYM GDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwIABAwYMGDBgwMD7wADVqAAB CmVuZHN0cmVhbQplbmRvYmoKNTAgMCBvYmoKMjYxCmVuZG9iago1MSAwIG9iago8PCAvTGVuZ3Ro IDUyIDAgUiAvVHlwZSAvWE9iamVjdCAvU3VidHlwZSAvSW1hZ2UgL1dpZHRoIDcwIC9IZWlnaHQg NDMzIC9JbnRlcnBvbGF0ZQp0cnVlIC9Db2xvclNwYWNlIDcgMCBSIC9TTWFzayA2NyAwIFIgL0Jp dHNQZXJDb21wb25lbnQgOCAvRmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeAHt0DEBAAAA wqD1T20LL4hAYcCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCA AQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMG DBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgw YMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCA AQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMG DBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgw YMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCAAQMGDBgwYMCA AQMGDBh4DwxjQQABCmVuZHN0cmVhbQplbmRvYmoKNTIgMCBvYmoKNDIwCmVuZG9iago0NSAwIG9i ago8PCAvTGVuZ3RoIDQ2IDAgUiAvVHlwZSAvWE9iamVjdCAvU3VidHlwZSAvSW1hZ2UgL1dpZHRo IDE5NDcgL0hlaWdodCA3NyAvSW50ZXJwb2xhdGUKdHJ1ZSAvQ29sb3JTcGFjZSA3IDAgUiAvU01h c2sgNjkgMCBSIC9CaXRzUGVyQ29tcG9uZW50IDggL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3Ry ZWFtCngB7dAxAQAAAMKg9U9tCF+IQGHAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDA gAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAED BgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDA gAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAED BgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDA gAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAED BgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDA gAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAED BgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDA gAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAED BgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDA gAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAED BgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDA gAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAED BgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDA gAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAED BgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDA gAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAED BgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDA gAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAED BgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDA gAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAED BgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwY MGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgwYMGDAgAEDBgxcAwPdNwABCmVuZHN0 cmVhbQplbmRvYmoKNDYgMCBvYmoKMTk4NQplbmRvYmoKNjMgMCBvYmoKPDwgL0xlbmd0aCA2NCAw IFIgL1R5cGUgL1hPYmplY3QgL1N1YnR5cGUgL0ltYWdlIC9XaWR0aCAyMTQgL0hlaWdodCAyODYg L0NvbG9yU3BhY2UKL0RldmljZUdyYXkgL0ludGVycG9sYXRlIHRydWUgL0JpdHNQZXJDb21wb25l bnQgOCAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHtXYdW20oQBfduufeOe8e9yhhM CxAgBEJ5//8bb1Z2SCFOZGNpvWJ0TnI49mpn58549u7saLWzgxcigAhIisAuuSSVIHvngkrz/2SX LZnA3V2VSk0ulUo59gKl1BqtVqfVatSKUQuU0mj1BqPRaNBrNQpRiyilM5isNrvNajboFKIWuJ/O YLE7PR6Pi7MalaHW7q5aazBz7kA4Eg56nXO1JItLcnVMTGWyuYOxVDqdjPpBLS2EDLmkSyUHflV6 s8MXSxfK5UI65ndYDFo18/EdtDJYnMFkvtpo1EuZqI8z6yFiSAWiTP0KWrmCqVKj0+s0Snthj92k Y94HiQeCrVLFRm847DaKyaDLyr4Pkmhh5vyJ/H5vNB5267m43yH4INNOSCK70eaJZKrtIc8P25VM xKsAH5wHwUCisN8bT/h+s5QKuUh4ZzsOzo3lDqfLrQE/Gff28/GAw0LiINs+SGYszhfL1TqjCT/s VDNR4oOMh3eBM5Epq9AgPjhoQnh325inGCQMGm3u8N53HywkAk72KQYEDJ2J80Wztc5wMhl1atmY AigG+CChTd/j4KBVToc9NiPrFAN8UGu0ukN7pSaJg31CMZTig3ZvVJiLJ6NuLacMHyR00OGP5+td iINAMdIRBdBcIbxbXaFUqdknPtgsppRAc4U1sR34YAX4IPhgPa8EmktSTbAo9sdz9S6hGAqhuQsf DCaLjb6SaK5AMTyRdKUFPqhAmiv4oEBzOSXRXOKDSHNlSh2tJwZp7nq4UbkLaS4V2NcTKlAMpLnr gSf7XUhzZYd8fYFIc9fHTv47haWWkM1Fmis/+itKJHEQs7krgkarOWZzaSG/jlxhqYXZ3HWgk/+e 37O5Dczmym8EsRIxmysWqW1oN6cYmM3dBlv8cwxCHJwXLWA2959o0W6A2VzaFlhBPmZzVwCLdtMP kc3loXAGixZou9pS+Uhzl0KzhV8gzd1CoywbEtLcZchs4+dIc7fRKkvGhDR3CTDb+DHS3G20yrIx EYphwtrcZfBs1+eLHQWszd0usywZzYcpWgjhI2hLXID6x0hzqZtA/ACQ5orHinpLpLnUTbDCAJDm rgAW7aZIc2lbYBX5SHNXQYtyWxIHsTaXshHEioc4iCctiAWLejthqbWozYXTPvCkBeoW+csAFhRj cdICFi38BSr6X2HRAn0biB/BnGL8UpsL50Uq6EAxhT+Chtlc8b4uc8uPk82FHQU8UExm7xInDmmu OJy2ohXS3K0wg7hBIM0Vh9N2tEKaux12EDUKIQ7++gga0lxRyNFohDSXBupryoQ4qPRzczGbu6Zv yHXbW5qriNdDEIrxS22uIl4PgTRXrp/FJuQINBfqwxfn5nbh9RCYzd0EsFL0gTRXClSl6hNprlTI StAv0lwJQJWqyw9Tm4s0VyoXene/SHPfDaGMHSDNlRHs94pCmvteBOW8n9BceBPfB3gLGhYtyOlX q8jCooVV0KLcFrO5lA2winikuaugRbst0lzaFlhBPtLcFcCi3hRpLnUTiB8AZnPFY0W9JWZzqZtg hQEQioFFCysARrPpYqmlyAPFsGiBpmeJl400VzxW9FsizaVvA9EjQJorGir6DZHm0reB+BEgzRWP FfWWP9NcfsL3m6VUyGU1atWqXepje8cAiA8a/0Bz1buMq6XRw4ZxLFeDkxYmw041E/XaTToN48ba VWsNbx9BU8BT7n86UEzDvg9+L1oAHxx1atmYjzMrwAd/O1BsL6zEooVCMui0GLQK8EGT4g8Ua1XS EQ+Ed9bnYhLera6fDhTD2tx3UBtpb/0ARQtIc6V1off3Dpm0j0JzrUo4zAlp7vt9Xp4eYLmPNFce qDcgRfG1ub3xhB8izd2Aq0jWBWZzJYN28x3/M5vLZvZzWTZXtfvTtXk0pe5xKc0FvVQqlRr+gX5S j2LT/S8pWtBp1HBptFot/AF6bVqs1P0JPmhzh/fKrQE/Gff2C4kAZNJ0Go1WpzcYDHod2TNhUK3X R9B+ZHMtBr3eYDJbrVazUc+iWm9pbjrs4Swmk8XmcLlcDpsZUqDsbZqAD/5+oFjIw9nsDrcvGAr6 XHYzk2eJv6W5iaDH5fYGo4lUMhpgNA3/U9GCQHPblWw8FAiE4+l8IZ+OBeYHv0sdtjbe/4JivGZz m+VMIhpLZoq1eq24F/HYYO+YvTC4M6e53kim0h6S8N4o59LpbKne6rTq+biPgyw8i1oRimFx+OP5 endMzuprVIrFcr3dH/Zb5VTQaWZzb2ExF4f2Ss0BfwBqNeu1/XZ/zI+61UzYJbxRYeOOL3mHc+Lk 8Meytc5oAmr1O+1Of3wwnfTr2YjbSmK75IPYtACIgrD7Y+Y8YTBWn58eHvCj4YifHs2mw0Y+6rEa mNRKpdbojBbOE0qSX9b06OhwejA9PD45ORo3CzGvjUWtyIQFStldvkgyX20PD2Yn5Do9Pz875tvF uA9CO3seKPifhXP7YeIt1ECr47PzT58uLi6vLk4OOqWEz86gViRUwA6JJxhNZvKV/c5wenx+efX5 +vrm5ups2i0n/RyZhjf9Y5a4v3lYdwVi6Xy51oB4fnh68fnmy93d3ZfrT0f9airAmVjUStjMiqaL 1Ua7NxgfzM6vbu7uHx4e7m8vZ4PaXtBByIXE2G66eyF3AcQiV212B+PJdHZ6cf3l/tvj0+O3u6vj YT0dcgC5YI0yzbUKxPO1NhjqcHb66er267en5+fnx/vr09F+JkQoE4NakYqtWLbS7MNcdXJ+CaZ6 fH55eXl6uDkbN7KEMjG3HCYxEN7XCTMwGIufHp9dfAYHfHr57+UZtOKbuQiTRFBwQc4bSeWrzd7o YHZ2eX33QIz19HB7Pmnlo0wSwfks7PCGE7Cmavd5iOwkXDw9Pd7fgFYFNomgwJgMQC4C0VQOllWD CZhLiO1fr88n7UKMTXo7V8tscwC/SGXLQC9gzrq8vv1ye3XKt0ArJuntjrAU0RvNNidkllLZkqDX 2cXl5fls3MyzqpWglkarN1psTk8gkiS/rwF/ODueHfT3c1FGbbUDakHMIHoRPwxEEpBgavWG4/EA tovDbjaXjYSE/dDL6oBFSSJTqOw3W41qnhTmMrnEn1PL73oZzFZhsbWXLRSLuVQEasMZ1urVXjqD ycq5fMFIPJmMh/3wiAybqbPXdQCxF6RmQC+L3enx+QN+r5PsHzDHbl81+uGHJDtDAofd4XBwVjb3 en5Tizgi2AsCImzMmc0m2JeDxBlrq8Y3SsEHC710Or1eR/ZQ2Usx/UmreeBQwY63Zr7frQRTCYpC 4CDVCUzWJvzZUotPiWLk+msj/BIRQAQQAUQAEUAEEAFEABFABBABRAARQAQQAUQAEUAEEAFEABFA BBCBtwj8DzRX6DAKZW5kc3RyZWFtCmVuZG9iago2NCAwIG9iagoyNTQwCmVuZG9iago2NyAwIG9i ago8PCAvTGVuZ3RoIDY4IDAgUiAvVHlwZSAvWE9iamVjdCAvU3VidHlwZSAvSW1hZ2UgL1dpZHRo IDcwIC9IZWlnaHQgNDMzIC9Db2xvclNwYWNlCi9EZXZpY2VHcmF5IC9JbnRlcnBvbGF0ZSB0cnVl IC9CaXRzUGVyQ29tcG9uZW50IDggL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB7V1p UyJJEB2V+xTkvm+UU0TlkhsRb8d7nPn/v2Mzq+imx9kNoKqM6WCbLzAT4Yus6qrq169fZn779j/5 bJEP12AJwjYnztbW9vYOfrYRiTEeANnR6fUGg14HQIwwAKLTG01mi9lsNOgYYRDEYLLYHE6n3WY2 6gGGYUwwHL3J6nR7fV6Py24x6pjGBKEYrU5PIBKLhvxuu9nAEszW1o7e7NgLxtPZbCrqd1mZgsFZ se76Y9lCubSfCnscZv3O+pcJB2TbC6ULh/WjSj7u37WwDAlQTHZPNFc5aTaOiqmgy8qGojc5vLH9 WrPTPq1kwm4yMete661tQPHFD+rtXrd5mIvs2XB6GVDMDl+icNzp91q1fNTDiTLot4/2ox47Yyww IojljKDEWFF0MkrnaD/mZYwFUeIklk79AFBMTLM7R+kM+pwoXrjSFCXOHoudogwglrjXwToiuzeG sQw6x4W4jxOlPzjjQTFCLPtHHYKSYI7FaPcASltG0bPsI50CpZjwOc3MKFEay0kx4WdGsXmieTKi k2KSD6WG8yIIpcQTy14kX2thLKVkAOZlh+Gsw3tAJDdHSQV2eVAOW71B97TEjLJDYlmgWJhGhCjh HEUpQyyMKAarO5w9bOKIyukgF0pVQnHBLXb9a7S1Q2IhKA2IRQBKhQsllKGxVDIhEsu6QwIWZLC6 QplKA2a3gShAGtYmMAuU7qDHhWIhsQBKs5oJuVljsbiC6UqDoGSBwDCM6BvMiziUsjIWhuMbYtkN psunOKJDOiIWFD2gpOYoOSR2DLwZWLNlN0BRWpTYsaOUcERcKGaIhaLUmEkmPAfsBpKlEyB2QDI5 qKrTL6NE2QkvoBQxljYX4RWFkqCx8NBms9OfKM5pMzv5pg8CnOQbH0oohUfyzUPhJfKNFJ6VqhIK L4p8U9rMHAsl330h5FsUChf5NiH5rquOfBdEkO/jjSHfe9G8AAqvIN/4OMFA7IgAo5HvzwIN6HVf Qb5R31qXqX6TYtlE8t1VBfmmDwL85Dskk282Cq9e8l3VyLd0RKB8LpNvdoVXDPkGFAX55qPwMvlW DYU/AuWbUSfGedk88j2n8PVNId8OQco3UeFFUXge5Vsk+V5QeGbNWqmf/13lG97PqVD55lLhRZHv hX6+Icp3hF/5NoLynZsr3ylByvemkO/sXPlOcyjfbqV+zqITL5TvTdHPv5B8r/1egcQiK9+c5FuI fr5QvsNAD9WhfHOS79Rc+ebRzzecfDPbTsSQb6dPpvDMmvVC+QYLDDOKwrzCT75By+e0naAFRlX6 OdhOBJhXQD/nJd9ggSGGEXYLDDWMqI18cynfQL4FmVcEaNbwICAABfXzue2Ew0ijoPB8tpOaamwn EvlGCwyj7UQg+VaYV3iVb7TA/HXbSVgm3zSWdcV8Qpt/I9/4RoAJZaPMK6oj32CkoYYRDvItzLyi HvKNFhhB5hVqO+Ei35trXkHlm4t8EyMNn3lFjeR705zjQswrYsi35hyX3vDhN2amyLQZyLcPElwY rIdKlM1xjosn33/VvCLO8y2CfH+Jc1wl5FsNFF6pfKuDfPP5zzfUOU4832og36Kc4/y0WSD5Jv5z zTku3/EhbRONNLIF5q+TbxHmFdnzLUb55kWRnONa2qa07EjisnrSNkWaV9SWtsmln6sqbVNzjkvb R/4Gh/Smp22ymVe0tE15jSh/LMwr4PnmStvUnOPKeZ3/xhRSUeYVLW3z8wRT/7mccMnq+f4S5zgP bRZDvuco3M5xfv1cSrjkoc0L8wpv2qbmHP9jH2HVIOI/F5W2yW1eEZW2Kda8wlztRKmfs5s0VOUc Vxf5li0wfOaVRbUTthRSceRb0s85aqYINK8QnzWtvMKrnwuqmcKnn4dk84panOMqId9QBYYn+fML zSsMrxwFkm/NOf4HaZgnfwowryxqprBS+E+atZa2Sa8W0fKFmldUQ775neOLgoU89VsWKCope6g5 x5Un1WfzihDyzVn2UIDnW5BzfFGwkKtmiiDyrT7nuDrIt0DnuCDyzVewUHOOK08o/I0qPL955QvJ 99q+fC1t8/M1nv9bZM0UIWmbQp3j6ihYqFC+Nec4WXdor5BUeBXVHEfPNz/55nSO08orVPlmrtCN 9fJJwiVVvkE9XKvlAzaawL4IEgqUPcQigbRVw4qHL0JAvwmdAcpk0lgQBRoJGLFzxIrxIMaOTqc3 QIsGrN2P+jnU1g64bGaT0aAHpBXaNeBYAMJotljtrkBijlJKhTzQOMJqMZtWakGBINhuwu5wujyh ZAFjgerPmYh/z+1yOR3QggKj+Y9zVjpuYeUbzDan2+P1+gLRdBGShYfdRjWXCAcDAb8PWlDALC9F gRp4ZrvLGwhHIpFoMlcG0WPYa9YOMok4fGIhn8tmWtoPA59FrLu+cCKdyaTT2cJhozsc9dv18n4u l8/ns8mI12lZGgzeQOx7oWSuUCoVC8VKvdUbjYdnp7VyqVypVkv5RNC1/NRDFKcvmi0d1utHtVq9 0RlMJuNe+6RePz45PakV0+G95YVEAcXi9Mfz1ZNmq9VoNDv98XR6Puy2W612p9M6LmdWRIFY4vuH jbNer9vt9kfT2eXsfNTv9fqQH36CKCuNCLZPNFcFAXMEn8n08vr6+nI6GcMHsqlX64aB18jmDmfg Cg8n0+nF7Or27v7u5upydjGdDOAFZhwL5y/LU4SlC+/9/YmDo/bgfHZ1fXv38Pj4/eH+9uZqNkGl d5VpAVYIHTTsexDMaW9yeQMYzy8vL8+PD3c3szGcnLi3V2jvMQ8mDnnPo9ntw9PL2/v729vL08PN xaBZyWIokM+xZB+RNBATNigpnfanN9+f3358fHz8eHt+uD4/WzkURIGd5PTFIPF5fPXw/P7x89fP j/fn+8thE2cFdtGyvSjdz4xWVwBu9L2Lu6e3j1+/fv18e7qddiH13gebaOm5QFFg/UK7lEi22hpd fX9FlI/X71ejZiUdci9fcdLJg0cMXG04LbvTu+d3GNH78920CwlaZK2sNCDAAhiTzR1KlxvDy4fX Hx8/IJQheWBbp/0KmWDYB/laZ3Lz+Pr2+nR7fgYeAO96bWlwH9AJ7l/cPT4/3s8G2EqAtsiRBr70 G55ryArOVprDy9v7u6txGyqVeGDBLdtBv0GTFYwnxFFnfAE7qEvvayteZRmK7u1gCgpRD8ejLna2 WXHtyxDwA8dkdngimfJx66x9Ws3DVV51wSlw6KLxxXKlGjT82U8G11hwCxgywTZXIJY5KBZyyRBp PrTqglPAAPcw292BaDKVjIfgLsTSHYesYCAfbl8wFPJ7nFboELX8WFkEIf2CYw9u2fZdN9zmHdbl t1Xp7z59w6IBGKvNbrfSXlVLT7hPAPSfCAOds0zIflbhPv8Kgkc54gB/WolA/TsIrj3aUQx4HsvM yrBIN+lH/i+mHwSD6S+1P9JmQJsBbQa0GdBmQJuBTZqBfwCkfcojCmVuZHN0cmVhbQplbmRvYmoK NjggMCBvYmoKMjYwOQplbmRvYmoKNTcgMCBvYmoKPDwgL0xlbmd0aCA1OCAwIFIgL1R5cGUgL1hP YmplY3QgL1N1YnR5cGUgL0ltYWdlIC9XaWR0aCA1NSAvSGVpZ2h0IDc3IC9Db2xvclNwYWNlCi9E ZXZpY2VHcmF5IC9JbnRlcnBvbGF0ZSB0cnVlIC9CaXRzUGVyQ29tcG9uZW50IDggL0ZpbHRlciAv RmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB7ZdLkoMwDESZCP+B3P+20xJDYmzZqcpySr0JgbxI1kJ0 L4tpPoGfkcbYiHjf11h++piIn3fcydBY+MOeE4ponYio59AfIOf8SM65lVDw1iafCpQPIURVIXjP 3K1PbhEUmJSyppRSDN4R9ZjzMeYyUgZ3lnu3KSdzqFW2bde0bQWcly7vGHpMGdChad/BRZwOh2sw H/McS+hSxQpqPTUdB8oZVo/GRlJPQ65tJDaSRbYrVpDtktdatpHYq6PeDLYn62n8n1fH0KqNzdN3 Do+N4cxPwhiuncN7ENwrOICKSsk5hd6Gslf2sK9Zt72AIrvQ3itzObhlmGxFuA+H3Trz5Xx5IAbA 0es6/XyTA4D95QfEBF2rpIfKKctyZg7BY5BXJPpwyHkt8utCuEmgkmTUY9znJ10lms851vzYvt4n 8AuQpWpaCmVuZHN0cmVhbQplbmRvYmoKNTggMCBvYmoKMzI2CmVuZG9iago2MSAwIG9iago8PCAv TGVuZ3RoIDYyIDAgUiAvVHlwZSAvWE9iamVjdCAvU3VidHlwZSAvSW1hZ2UgL1dpZHRoIDcxIC9I ZWlnaHQgMzAzIC9Db2xvclNwYWNlCi9EZXZpY2VHcmF5IC9JbnRlcnBvbGF0ZSB0cnVlIC9CaXRz UGVyQ29tcG9uZW50IDggL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB7Vxne+JIDE5C tem9hA6h9w4GTCghkIQU0rP3///GacZmKcuejfE+x+XGX7AdP280Gr0jTZFOTsglSgOn/CXq4999 BBhn+IKb330j/B6BKBRKpVKhOJMOBCgKpUqt0WjUKiUCEv7HO75AKCoNRet0OkqrRjg7PhJ8hVG0 tMFssZiNekqtlCbO6SnIojPZnG63y24xUGpp4kCT1LTR5vEHQ8Fzp0WvVSkkaAfapNTqre5ALJGM h88dJlqSOKhNlNHhi6XzhVwi5LHqNaAdQY1uf4BgaLMrmCxUauXchc9u0KqkwahpizuSqTRbjVIy 6DRRoJztfyb4DNKodRZPNFdrd9qVTNhtpqXDeKO5eqfXqeWiHgvoeP+uQtLQFm80X++y3UY+5rXo pMCcYBhoVL3b7zULF+dWqTDQU54IhmkV4z6bXiPFjpHdmN2RLEjDtkoYRpLhnKkokyucqXX6bLuU 8Nsl2h+GCWWqCKacDNgN0swYOGV0BtNVps8ylVTAYdBKaxTAOIKpCsMimKDTKBnG4Agkywzb71TT IYCRRKozpcZg9yfLbYCpZUIuIJUUbgKM3u5PlDBMNoxgpHATwdh88WKr1+/WsxGp3IRBVGc9vyg2 EQxw04y4KTgybH+ARwqAKSCYRv4Qiuss3li+0ev3Dqd4viErxc8JxVf9jtzmH6C447tSXOpIQSi+ srn1O96LE4qvK4W/P5XTi4fk9uIHUhyCgSP14oTinP1x0wbixXcw8+SE4+ZxBepLiiflCtQJxVd9 D4GSTIG6BgJ1Pt4ngfpKwXCHV034KT3Mxb9loO4/aC5OKL5hMPwD5ubWXPxf9eJ/juK7mv+P747S i3OrdojiVt03Wm7Dq3blJKH4mkUibv6h5bYDKF5qsfxym8RVOwWh+Fonb9xue3FC8ZV6uOU28OKw MM9UjiRQRwvzy7m4xPX9/wXFJa3vo723X1bUVwYh8o548X9QFD8Xz8q0aSaXFycU/6XPNgP1DN40 OyovTii+7DO0MG9em4sfhRc/GoqrYNPsGL04w+2LH40XJxRf8gn9Hp0Xl4viNH/0pcefoJFmf/jo C6H4usXw92jaAEdfcKAuF8WrMh19OQaK620bK+r/fS+ORgoajuwdvi9OKL6DT/gVTBu+qxeHQ3Lo WNo3pXgETrcRii/Nej1Qbxa5c7BS5lToxDJ3gJV48aVu+V+8ard2gPWwfXF5vDih+FYn4UccYR/N ctuf8OKE4pv9vuHF4ai7TGfU5aH4AUfdYUWdUHyzq7knQvFdWuHf4b03Gbw4ZLNAGsoxzsUPpLhz lYZCKL4yJLwwD2fUZdgXX2Wz5L5ToI7OwR6ahrKaix+BF0cUd8tEcf4c7CFHX9bm4oTiK2LC3fFt mslBcT5hbTPTbKPdYh64YMAbQzAHZJpxgTqh+E6Vo9TWnzmpmOJanMG+X+ovylynTMtNszIkkxop lAl/tkdSPSoKAHaDYSpcTmrQZaI1KhVk5yOgnfJvvUQYKBdfQ5u4YACtk4XdFj2t1YpPzudB1BpK D3ne3AmaWjbitZsNer2OpjQq2AMRlgeaA5JoaZ3eaHWHUmjVDtI3Y36X3Wq1Qna+DrLhhXHAfJVq SmcwmS1WhzecrrTZy26jkAide+ByO20mDmdLE9uPMNCooTlWh9Pl9gZiGVDxZa9VSsdCwVA4HPJ7 7JBVL7i1A8KotHqLw+MLBILBSCIH2cODfruaT8XjiVQqEQu4rXrhBGAkDG1ynIdicbgSmWK9ezmE VpXz2VyhWMynoz47WJBQkisePK2eYDyTy+dzuUKl1RuMhmy7XilXa416JR8PiMmqBxitwXYeTRer tVq1Um10LkdX40GPaTXbTIepF8Ul56PJqsHui+UqTYZpt9oddji5vh4P+r0e2+93m8UEpoXQ8h2S BrY8Yrka0+uzLHs5nExvbqaT0RCuQa9RwBUHhHsKjmZCXQAoL8Cwg+FoNL6e3c3ndzfT68lkPOiC OXssOuHEcehwRMlgsthih1eT69nt/OHx6fH+7vZmejVgyuJUg/0calUUZh2DCQJ5Wjy/PC8AaHbV hyxilA4g2CYEA1snJmcgUWz2r2bzx8XL69v72+vz0/1s1K2kId9bXGkI3nKATZ3hdP708vbx+fn5 /rq4nw5aUG7AJjIXHo97RrvvIt/oT+6eXt8/v358fbwt5pNeDYRBedpC3Y15CuJA+AhaLjHD2ePL x9ePv358vj3djtrFC59YYfAWNKqT4YGIrXc1X7wjmI/Xh2m/jutCiBQGaxkKZaBmNS9nD68gztf7 892YgdIHUOxCRDfxgw9uFjKeMjO+fXr7/Px4fZztKwzXLI0e2XKNncyfocMXEoThm4UYCs2aPixe nu9BM1lUMUO0Zvje4owQ99b9w/3NCDQD58L3rFgAXgZR1B1OV7uj6c1szNb266alltGYDONXDMpc DMYjtgmFLvYWBrA4bjn88Xyd6Xab5VRob83w6kHNcgUT+UqtVspEEZskFGHgXI3VHYync9lUzO8U SW1eKz9/ULMog80diMRiYb8LatCIN+CfIHCDjdlodXl9Pq8TKuIg373+d5H30CylBsrz2Bx2mxnq 6kgTBvcWDguMRoNOcpUf3CwILzRaiqI0kmsOIRgu7lLjAkjCQc3vlYWBFFCO6RAQLBBCAhApnbQu HopLDwZZByT3RANEA0QDRANEA0QD31ADfwNmCZ2TCmVuZHN0cmVhbQplbmRvYmoKNjIgMCBvYmoK MjAzNgplbmRvYmoKNTkgMCBvYmoKPDwgL0xlbmd0aCA2MCAwIFIgL1R5cGUgL1hPYmplY3QgL1N1 YnR5cGUgL0ltYWdlIC9XaWR0aCAxMDcgL0hlaWdodCA3NyAvQ29sb3JTcGFjZQovRGV2aWNlR3Jh eSAvSW50ZXJwb2xhdGUgdHJ1ZSAvQml0c1BlckNvbXBvbmVudCA4IC9GaWx0ZXIgL0ZsYXRlRGVj b2RlID4+CnN0cmVhbQp4Ae2Z227CMBBEQ30PSfj/v+2sA8KWF1UWE6kPOy+0ruvDnvhpsiwWM/CX gRszH2FMSHOWwpO//rAjhw6sE+S4wTcfYUJyzrPjXIV1g8Gd8yGEyAzO85XVoOpMHpyUMi8pxTiw gHIuxJRLKSstpeRUWe3VkAflA0jrnZkVLBlrQEUhbdtOy3YHKwZcjebCYyo8qQzSvh+07GABJWO9 70VFJRmKjSopqiiQjuNBy4GxDPWFThP4hTz5VxNoAhUDdi0UKTNLJnDGlrLXBCpSZpZM4IwtZa8J VKTMLJnAGVvKXhOoSJlZMoEztpS9JlCRMrNkAmdsKXv/j0Bqx/Sx+LmoOVPqLA8UvQ9USzrnI1o6 tJwbLfd1RXEWpChu+8AbCtWY0XMSK1V0nM/msUdJeYueGDRa8rMl7rrbZTl7dmm/iandd98SwyQq VcwlpT4z/mz0G3/y0CpL3ojw3lXIaeN7CkEJjB459n39Xj/J6hV5nd99XgDqzrdfzMBo4BdBsRQj CmVuZHN0cmVhbQplbmRvYmoKNjAgMCBvYmoKMzg1CmVuZG9iago2OSAwIG9iago8PCAvTGVuZ3Ro IDcwIDAgUiAvVHlwZSAvWE9iamVjdCAvU3VidHlwZSAvSW1hZ2UgL1dpZHRoIDE5NDcgL0hlaWdo dCA3NyAvQ29sb3JTcGFjZQovRGV2aWNlR3JheSAvSW50ZXJwb2xhdGUgdHJ1ZSAvQml0c1BlckNv bXBvbmVudCA4IC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ae3by24TQRCGUdtzv8H7 vy09oyjETlDt/gg4tUHQi7JOFh/T49xuhgABAgQIECBAgAABAgQIECBAgAABAgQIECBAgAABAgQI ECBAgAABAgT+HYG7IUCAAAECBLICf/5vRPZz2EaAAAECBAi8C3yV5+vwYQgQIECAAIG0wNXgT3Fu /9o+SGcIECBAgACBtEArcOvwS5uvMne9IUCAAAECBPIC3Rdtbs/MXdcPw2gIECBAgACBrMAw9F3X npufHpvPMvf9ME7TbAgQIECAAIGkwDSNQ9+/tPm8zu6GoXV5WVZDgAABAgQI5ASWZZ6nYTjT/OG5 +fwKWHtmnpd1MwQIECBAgEBWYF3m9tx8vm7+faV93WeP07xu+34YAgQIECBAICew79s6T+PLjfZ1 nz1Oy9bC/MMQIECAAAECOYHj2LelvW5+ftl8pfl6aJbm3M/CJgIECBAg0ATONLfH5j+keW/PzD8N AQIECBAgkBNocd6lOedtEwECBAgQKASkuQByTIAAAQIEsgLSnPW2jQABAgQIFALSXAA5JkCAAAEC WQFpznrbRoAAAQIECgFpLoAcEyBAgACBrIA0Z71tI0CAAAEChYA0F0COCRAgQIBAVkCas962ESBA gACBQkCaCyDHBAgQIEAgKyDNWW/bCBAgQIBAISDNBZBjAgQIECCQFZDmrLdtBAgQIECgEJDmAsgx AQIECBDICkhz1ts2AgQIECBQCEhzAeSYAAECBAhkBaQ5620bAQIECBAoBKS5AHJMgAABAgSyAtKc 9baNAAECBAgUAtJcADkmQIAAAQJZAWnOettGgAABAgQKAWkugBwTIECAAIGsgDRnvW0jQIAAAQKF gDQXQI4JECBAgEBWQJqz3rYRIECAAIFCQJoLIMcECBAgQCArIM1Zb9sIECBAgEAhIM0FkGMCBAgQ IJAVkOast20ECBAgQKAQkOYCyDEBAgQIEMgKSHPW2zYCBAgQIFAISHMB5JgAAQIECGQFpDnrbRsB AgQIECgEpLkAckyAAAECBLIC0pz1to0AAQIECBQC0lwAOSZAgAABAlkBac5620aAAAECBAoBaS6A HBMgQIAAgayANGe9bSNAgAABAoWANBdAjgkQIECAQFZAmrPethEgQIAAgUJAmgsgxwQIECBAICtQ pfk4fhgCBAgQIEAgJ3Acx77O09A97vfb+9zvj24Yp2XbpTn3s7CJAAECBAg0gVbmbZnGL9LctzSv 297ibAgQIECAAIGYwL5va0tz/+mp+dGP47yuW4uzIUCAAAECBGIC27au8zj2j5cL7fujbzfa83LG 2RAgQIAAAQIxgXVd5naf3bcyP71rbi+brzbP82IIECBAgACBnMA8X2U+77M/pPl2O78I1to8ToYA AQIECBDICoztmfn5TfP5Re2W5kfX4mwIECBAgACBtEDfdc9vmq/foTrb3OLc8mwIECBAgACBnMAZ 39bg59vstzafcTYECBAgQIBAXuDlPfNV5vNO2xAgQIAAAQLfJPBW49c/vunTWEuAAAECBP5vgdcg +zsBAgQIECBAgAABAgQIECBAgAABAgQIECBAgAABAgQIECBAgAABAgQI/L0CvwBwdT0CCmVuZHN0 cmVhbQplbmRvYmoKNzAgMCBvYmoKMTIwNwplbmRvYmoKNjUgMCBvYmoKPDwgL0xlbmd0aCA2NiAw IFIgL1R5cGUgL1hPYmplY3QgL1N1YnR5cGUgL0ltYWdlIC9XaWR0aCA4NiAvSGVpZ2h0IDIxMiAv Q29sb3JTcGFjZQovRGV2aWNlR3JheSAvSW50ZXJwb2xhdGUgdHJ1ZSAvQml0c1BlckNvbXBvbmVu dCA4IC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ae1b13LiShC1lyQEAkQUOYicRJRA AkQ0xhiMwcY47P//xu0R+FbtviGGuuW6Mw/47bjrdJ/p0czpmxuyrs/A7S3u/3H778KHDJC/fv0y GOAHX8CAaTAYTSaT0WgAWDxEIFCj2UJZKcpsMkK4OEhAoCaL1cY4GDtNmY14SNBAbQ7W4/W6nXYr gr08WAjVaKEdnkAoEg76WDtlAm4vhkWhUoybiyZ5PhH2u2wWHMECqpl2+aN8vlTMpcJeh9VkwBGr 0WJjg8l8tVGv5BKcy2bGQAGi1e4Jp8tNSWqW02GPHQcFR9RIptqWFamej/kclOnydJ1izQhSry+3 SknORWMgFmXL5g6lq1Jf7UnVdMiNh1ioATbIV8SeOujWshEvHmINJqszkCy1eqoqNwpxXMSaKIc/ Xmgq6rAHxAacOCoWpYvxRnP17mDYFyt8kEXEXqrZ73QJUn846NQyuCoWSZZLlcXeEIjNx7wMhWEr uEXp8ieKLUVVlVYx4cdFLMX4YvmGDOkSyynQgfnyDeak2WytA+nCpwOkLjYEOoB0deu5KEYdcMlS G9KlNAtxP6YNhuiA6EDriBGiA60fqKQfkH5A+oFKdEDORdc8F+H8PrjmuYjogOjgejqo5X6KDsh3 MtEB0QG5LyL3Rde8LyL9gNybkntTeD8g5yLyfkDeD66nA/KORt7RfsQ7WlV7R7taP/jf6gBMBeQ9 +Qe9JxMdXMdXQXTws3wVRAdEB8RfFOKJDv7SwaWG05PP7tr9wMdoTl7N263fGvi3zw4MjGYwX2u2 bv0GbHDE/eGzAwOjBUzdYOsGaN2wf/rsBDAwMjRlgQW+buQX18cCQgWfHXKxaj67mN/F2G2wwNeN rNJ6YJE7HlCRLfLosysmg17W5WJZ1snQFn0ObMBEpnObK5Aoan5TsZKOcn5/gOM4n9tB67Efo0DB cW+x2tlAvIBskeAMzaeikWgskYhHAm4G/Kxn+4+PmBRtd7q5eB5crCNVbpazfCqdzeezqagfbJdn e0QRpWaKZpysxx9K5OHyfATumlqpUChVhFolnwy6dRiFkVitEKcvEAzH+EK9MxiPVbldF4R6SxQb 5XREh5/1FlRF2V2+YCSWSPLZUgNQJ6NBV2y1O7Iii0I2qgcVmeOd3lCcBxYLJaElq9PZdDRQZKWv qv1OTScqKn8ulilWhVqt3pR6o9l8PhsP1eF4PB50hExEh7Ndk6o7lCoILVGSpI6iTuaLh8V8Npvd zSYDqcqHNE/zeeLSUD0hHghVev3+YDi5e3hcPS4fFovFfNpvl5Gx/WxD7zHWYKrY6PaHo/FkOn9Y PW02m6f16vF+0msWdJnwUWHRrkAcCrU/mt7NF8vVZrt72W2fN6vFRK5ldV0baZXFeMN8uaUMIdDH 9fPudf/2tn/ZrhejDrrqRQScR+vNDaLA5vLHsoLYn8yXALo/vL+/H/a79b3aBve1rkGMowzcHBKr OntYb18P75+fnx9vu/Vdr5HTU1doi9cky3hCyUK9O5qvnl8PH19fXx+H3eO0Wz155c8lAFCBA7PV 4Q2lYHMdL55eAPX318fb9mEklhK6ff0aLO2AjMHkwXT5vH//hFj3m/tBM69nEzj1OARroZ2+SLrc 7s8etwD7eXhZzxQhrUdY350TMgaF4PRFMxVxcLeCKjjst8uxVL5ssOEIC3M9maqkzlfb19fd04UE aIUA2yxqh1C20nC+2jxvllMZCLhwDAXqC3ZvNhDLCZ0hbDDLuSpimOw4wXLxHKhhcjcbycjTf/Gw xBEW9VkBDcworXIKnbbOb9rfNXD8i2CtMN+VyFWbotiqZmM4JjCgbKHdAmw8U6xUyznUszFMixy1 y7gD0WQ6k06EvXCIvZQAoOEEy0Ifj0aCPphxg6Gp83eWP4n9hoUzh9fngzE/PPN4R1gTnLkcTgdj wzaSiEgwmMyUlbZa4QiPaXxSixZNeppPR/fLWT2VLQpXW3BwxwWqlQIad8WLiSLWvt4wxnlkgfwS BggDhAHCAGGAMEAYIAz8pwz8A2vu0TMKZW5kc3RyZWFtCmVuZG9iago2NiAwIG9iagoxNTI3CmVu ZG9iago1NSAwIG9iago8PCAvVHlwZSAvRXh0R1N0YXRlIC9jYSAwLjE2ODYwID4+CmVuZG9iago1 NiAwIG9iago8PCAvVHlwZSAvRXh0R1N0YXRlIC9jYSAxID4+CmVuZG9iago3MiAwIG9iago8PCAv TGVuZ3RoIDczIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGVVE1PGzEQve+v mOOmUozH3z62aaW2p1JWqtQPVZAEGposkIAQ/75jO+MQtg0le1jHnnkzb97z3sAx3IC2IkQZEbQT KGkFHqOI9ANrJKzn8AV6OJpsEKYbwPxspk/TUD9K0yW/odzzVxCtsnBPeZcFZXICMj8nEyovhaSf D95INHl7vL/l0OcGwfrcYDNdAYUoa2V0Mi2ldkEbWBGWVVJa6QCtMgQLSzghkolmhTEhChMMoJLg gnDKRJ86zSw/zdfT+fXt3ekS1gvKSkHpyYFW6iEMdXP0YYXw9qoUav57nirNk4ikAsIAzZTq5WoI PooshUUjQjCJ85uuzEpBR9OPOZBeqKLw3hoY05+Omuk6RTDdOXyD9vNd3y/6C5hczeYjUD5AC6Pm B3Qf4V1H/RZye5WtzaUDBJom9eDgaW0sWfRCE4TRwcIYZVNqJ39Q7dbCCLrLUmXPZYgJlxiyyTRa 4WSoRttJ0GQJamAquw0ms7JrGW+rw06IXchfjV0ln2wOCYHWCa81OQpdmgddgiwFuqJUeo3R7bOn yX9vX1+Psk+hPeXF9BevSI3k4SRHtkB7zxuLUVNObrcnNYdCd8rtrPJ8h9GJqH1Sadjn6ooLz3jx kxfcQQ35XdvuucsafMZZC170vKjIw6ML4tSwG1/CSZGoTpIKRGpre7JeU2zPQ609rSuFO26KKpc5 1/ky3ZLdtPy/5jLsQ92paHxUKz7wznueVHVBncuGYl6iaPrUSakauv87+xm6T1FFvz+IfAe/nvaz s/mSePBNPDDh7SfmEbDXAqPVQ+Bk7xHz+wcHrXS5N9GXz8gA39GBNS4O8dOlGHb8PKJXh7GO/wAW 13KtCmVuZHN0cmVhbQplbmRvYmoKNzMgMCBvYmoKNjQyCmVuZG9iago3MSAwIG9iago8PCAvVHlw ZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgNzQgMCBSIC9Db250ZW50cyA3MiAwIFIg L01lZGlhQm94ClswIDAgNzkyIDYxMl0gPj4KZW5kb2JqCjc0IDAgb2JqCjw8IC9Qcm9jU2V0IFsg L1BERiAvVGV4dCAvSW1hZ2VCIC9JbWFnZUMgL0ltYWdlSSBdIC9Db2xvclNwYWNlIDw8IC9DczIg MTAgMCBSCi9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSAxMSAwIFIgL1RUMiAxMiAwIFIgPj4g L1hPYmplY3QgPDwgL0ltMSA4IDAgUiAvSW0xMQo3NSAwIFIgPj4gPj4KZW5kb2JqCjc1IDAgb2Jq Cjw8IC9MZW5ndGggNzYgMCBSIC9UeXBlIC9YT2JqZWN0IC9TdWJ0eXBlIC9JbWFnZSAvV2lkdGgg MTE4NCAvSGVpZ2h0IDUxOSAvSW50ZXJwb2xhdGUKdHJ1ZSAvQ29sb3JTcGFjZSA3NyAwIFIgL0lu dGVudCAvUGVyY2VwdHVhbCAvU01hc2sgNzggMCBSIC9CaXRzUGVyQ29tcG9uZW50CjggL0ZpbHRl ciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB7L1tcBRXmudbsf1pPsyn+eC4sRs3Yns2dmO4sRFd 8xobN+ylO3rdoyIuM65teXqYdpseXbW76ekdsHrWV109bUsWbZDLNshCuOkytoESryU3ksvCghK2 jCQDokAYSgZBGZBVEhIoQTIUMeV23ec5JzPrZFbWi6QCyap/hkJ18uR5/Z2TWedfzzknXS4cIAAC IAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAAC IAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAAC IAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAAC IAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAAC IAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAAC IAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAAC IAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAAC IAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAAC IAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAAC IAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAAC IAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAACIAAC IAACIAACIAACIAACIAACIAACIAACIAACIAACIAACcyTwB3/wB4cOHRoaGvr000/jOEAABEAABEAA BEAABEAABEDgvhEg0UHSgwQIyZA5ChhEy02AqB4/fvy+tR4SBgEQAAEQAAEQAAEQAAEQAAEHAiRD IPFyC7U5XiHh7MAaXiAAAiAAAiAAAiAAAiAAAiBwnwmQGJmjjEG0HATINnqfGw3JgwAIgAAIgAAI gAAIgAAIgIADARIjOWQKvOdIAGvuHPoZvEAABEAABEAABEAABEAABO4/ARIjc5QxiJaDwP1vNOQA AiAAAiAAAiAAAiAAAiAAAs4EcsgUeM+RgDNl+IIACIAACIAACIAACIAACIDA/ScwRxmDaDkI3P8W Qw4gAAIgAAIgAAIgAAIgAAIg4Ewgh0yB9xwJOFMuD99Tp04FcIDAIiBAXbE87jnUEgRAAARAAARA AATsBOYoYxAtBwE737I5j8Vir7/++vDw8DQOEFhQAtQJqStShyybmw8VBQEQAAEQAAEQAIEMgRwy Bd5zJJAhW2YuetfGhx9+uKDjemQOAjoB6oqdnZ1ldguiuiAAAiAAAiAAAiDABOYoYxAtB4Hy7FUX L1586623JicnITBAYDEQoK64Y8cO6pbleT+i1iAAAiAAAiAAAl91Ah999NGBAweCwWBLSwv9p9Pi a5RDpsB7jgSKJ7+UQr7//vvd3d2LYWCPMoCAJEAd8ujRo0vpLkNdQAAEQAAEQAAEyoEASbkXXnjh Z1kHeRap8uYoYxAtB4Hie93lEyfiW1799Kkfxb/zbfpjx5ZX2bOI49K5j+JH/Z+G/v7yG39Gf+Sg U/Ys4uiPffTrXv/fhFf9l31/Tn/koFPyLCKqc5BLly7t2rVrdHQUygIEFg+BRCKxc+dO6pzOvRa+ IAACIAACIAACILD4CJDR5Omnnza1XV1d3YYNG0wfcnR0dBQsdQ6ZAu85EigIXA9wqDP+szW3Vlak vvc/v1j9D/RHDjolzzhdyntcjr4Tf/sHtw64U53/7fdH/zv9kYNOyZMv5T0ODr7z3Xef/ONDf/l/ 9Sz/0xPfoT9y0Cl50qW8UXNe7O3tpcV3i2dgj5KAgCRA3fLYsWM5Oy4ugAAIgAAIgAAIgMBiIkDm OVPKkcSj/eJk6U6fPm36k6OgFW+OMgbRchAopo+wke5na+5V/u0XVT/4ouqJL/5R/JGj6gfkSZfy WPHYSPf2D+6985df9nzry/e/mfnr+RZ50qU8Vjwy0pGO+5OjD//FqRV/MbDiL06KP3KcWkGedGlu Vrzdu3d/+umn0BQgsNgIULekzlnMLYkwIAACIAACIAACILDgBMhUZ1ruyKGWhybLmZdooqZ6Kdud Q6bAe44Esgk7+Gx5lUx1FnGnSDy24m151SGW9DrqJ1OdFHe/P/rN33eLv6NC6PV8i614R/254tI8 TDLV6eLuhOcvjos/cgiJR5coQK64ufyPHz/+u9/9Ls/AflXWQUtE84THJRAoIYGDBw9SF7X13vfe e492X6EdgeZ5vPnmmzQF9OTJk7b0cQoCIAACIAACIAACsyVAVjlTwUmHmgLZ8tSrZNFTr9rcc5Qx iJaDgA2v4yktteNpmdJy98MnvjD/SOVVPUGXeC1ejoOW2tFsTDLbsbiLfPP3R5bzHzmExKNLvBYv x0FL7Wg2Jqu5E54//yjzR6fkSZcoQI6oOb3379//ySef5BmQk7xTr9LpT3/60+Ik3tTIyMiUGhlu EJglgQsXLuzbt8/WfUnc0QvQz5TioC1cSOJFo1FbFjgFARAAARAAARAAgVkRoEG1quDIvX37dpmC bd4mXaLAeRLPIVPgPUcCeVBnLn3n27zmTtrsSNyt/j7/kUP6rP4H3nElx0G7qdCCO9Z3ZLmT4k7+ 72YTHl2iADmixmk3FVpwx9Myjwtx11/x5/T3kbDinVxBlyhArriO/vTTAQ2e84+4s/UdJVWUxEt0 Uxt0J+zJJy6cOXdtQvdNxOnEHmKW51Pn9lQ++VuZj+qeZTILHbwUKO53HW5fO7mj5eX2k1dsGX12 /ngkcuzy9Vu6v3bj2qXzdFy5cuXGTc0WeLan1EVtv3G98847tLtmKeQdp0HroNva2hxvEHiCAAiA AAiAAAiAQJEE1BmYptCrr6933EuTAudJdo4yBtFyEMiDOnNpqeg7mplJ49v84+1sfUfhCUVBiTcz +eEjrkc+nJyxpj+1ichv7JeeU/31Llf95IwtjDVGobPTv610rd4jDYWqu1C8xXW9JCjuc5VGO579 EbV7S/ewJaPrMZroSD9DxUZlI2ifnT955sK1G1OaNjU5Pjp66/ZtNfwzzzxDUxRUHzolT9VHdQ8O Dr799tuZuy8eHxgYoBfKsDYr0UGr/CgXNQu4QQAEQAAEQAAEQGBWBLZs2WLKOumgrVRoRR4dtIum 7RIFzpN4DpkC7zkSyIPavLQ05meeO3eutbX11i3D5qIOqRV3tr4jH/NQAtqdUt/tPBTyPb5ixeNr dvZcmJmZPLRpDTfMshU1GztGYh0/8TxMJ6vX+EJnEvGewCsH+vpDGysrK1fXbOq/pk/tjPeHfKtX UBL1Ad0YqI1cPHPBtAtO7XzctTp0QWSvuyfOhHz1e0aEbBzYuXHjngFxNb6zvr7j8L5clw7Fzgd8 vkMXON+Jcx0+XyAuop0JUQoZFXz6wCtramp8fNTX++pDZyaoXh2b6nd2hDb8pHLF4zWhgfiF7gAV ufLJukPnuJwUoG/3K6sFh5aOAcpARgmEQhtXr1gT6KfsVBTZWXBBEmcCvjUEIgNn4kxL/aZQR4B8 K5/8RWjAsIQmzrQIZGvqA+cMS6moiviXdXXqQvf6f/3N0C1W2Z/furDdvz12g92fXb5wZSLTPS69 1/ijZ/e9f/Dllq6MvqOKDAQCXWcunu/Zfz7BprqZ6Zsjly6N6603PXV9NJOEyJ/UHPWfV199VZxN k4NObYpPXpL/qYtSR6Xuat6Aly9f3rt3b39/f4nk3ZnDhw93dhbY9tbMHQ4QAAEQAAEQAAEQyCag 2u9I09EEITVMLBajAOYumrDfzVGqzSma2hA53Utif5V33333xIkT6kDa0U1jb0d/8sxzia6Svnuc m2DFK7t3v/I067hDI1MnD7zyCPk9siYQ6hmLf7ipZoXL9fgrv919JjHds5HcdKlmT2jnmmXkWnOG NEI8xK5Ne9oPvEJ+D285SYKihZN4nGUSHVNnKJc9QpRl3PEOCtFxjWTUxRpyuepZqYmkDkVzXxpJ bFzmqtxxmsJ+sIEK7Np5jvJIbHSRefAc5yWOCz17WloCgZ07W3xc4JYBUnCJTVwkly+wc8NPOCIV r2XPTq7cso10ma2KVIjAnj0tXJxXTl43o1T+YsOe7gvapxYUDllMneGYy9bsDO0R2T7en2DCItsV gdCeemb9eD+pualzHPKRmp17Aoxx2UapUvXSO11N9Gz82tf+6wfjn1OYz8ePfefr3+kbn/n8+vG/ +qu/+ubrURnx85H+73//+91XtKtHXnpR0XejZzsDgQ8nZm59cmj/OaHv9Iymb9NxS7s5kWW/owBS 09F/02HEcv6kLVCou6r3I703ob29vVT6jtbfkYQcGhpSs4AbBEAABEAABEAABIonYO6vQta6XLFo jzhpyMv/igQayuEoIYFczaH6L4H3I9CeKrRJxdSU1EjOg2rpm0fE5blEcaX6aBmQBqRzq0ng9FyT 6uzhV/pk4lMDJJ42yfmZ/ZtIDtXoOmqin0429ly73vcKNe5Okn90TMQvfjpJn/H+jp3CCkbuqTMB 0n8XhanOdM/MjNC8Tx+Z++IhVoquZaT1rnXUuJZtSuS5ND090LLC9fge1nRCOK0OnJvRWEN1WDQS l4VKUb/M9fCGiHCzvlsREFbCqX4KL2t98yQVfgXNUJ24Fo8nJGoRsoWmp0qHNCxyGioKkSb9y2Qx 0U+gdElLotXnclX+9rQkHBJlk+UknSuIPa5Tv8Zi9pW+zJvrHa+O9r3yta9981iCbXYzkx997+vf 67/++czM9dPdXceHx9lzZuK9jX/3/eApcl967+UXuy6Rg46ZGxdbW1pOXblJxT9/SLffyUu3bozQ +jt6wcHoKDdZ9iGVHXUhcmRftflQR6XuSp3WvA0vXrxIm/yQ7iuVxAuHw0eOHDHThwMEQAAEQAAE QAAEZktAzsPM84Y7OYczjwCUOfLoFUfpCBTbjl/x95vThLQPP/zQNop2PM0j4vJcoqSE+jDX3yU2 LWN9J3XNwxs+kHklWLawhYuOvlfI8rVRTqokGSjDk5ZpWS0kGimap7cMGJM2ZXT6LxbcheSp6iYD 3LL67nN7Vj9c1x7yLVvTcabbt0zqyjyXhEKsOXPh0DJXTU/3RteKnZ+wRhPmPzNL1juTO1eTdGuR JWc9yLXjM7XWpJvIkEYqk6ZfrhGCUfbTFRt71CgyYRUFp2PNgoXnI5tkdqReKbtlG3v0vMakLvuQ FDERHghQySwHyWSz7I5XVX33+Y3jpO/IfmdGIcfY8V1/93fPnhWesfDzL3bJDVenPn7X33Lo4ykW 1zdJ350bJaGXOWhepTTgabcs6+9kiFnpO4pC3ZU6rXp7khwjo16p9B1JRRKMJBvVLOAGARAAARAA ARAAgeIJmPtkksSjiUZqRNosztxoJb/xjmJZRnI4mTcBtSHyu9mKt+VVfhUC7Zb5nW+zY8ured5s rqbGLzE/6qdXIdBumfTH70Q46s/zZnM1Lr3EnN5zR69CoN0y6Y8cdDqrN5sPDw+TNWRiIntpVmZw brryiLg8lyi6VB/G/plSAQl9x2avPpk+ixoxg5FOWd+RfU1ckPMq67t1YTKViA/0hGpI560JWS2O DovvZMpsqFq2pmbFso39E4lun2tFDclEaVbLc2l6+swa17Knf1FJgpCseStcK37xk4cfrpNGOpkw /z/J8y1X6xNE2cOsnaXWUt8dGxsjrepaEzh3jSoXJ0ufkLeZKJwAJaGgoFNbFte62SCZEb8iEZWw cLPFU4Rcc2ZiaiKRmJycHBsZm9QyYs3x6sRAy9e+9rcnb/D8TLLffUfY77hMxnFu788ef/xxmp/5 ox/x/iq0F4rPF7mhXd7t97fwXNWA3F+F3lV37AKpzZujI4kpc0+VWzdJ5xkp6Z/mtEzTYQuQfUrd lTotdV3zXqDplDR3naZWlkricfmPHTPThwMEQAAEQAAEQAAEZkugo6PDXGRHDtJ0dNAumub+KhSg YJrzFjRIwEKgIPAlEIDWe5LtI3sI7eiTR8TluURJqepDUUBTe1az2Lk4xtP2Ej0kW1Z3X4iTBul7 hReprW7pvpaIH2qhQMtoVqTQI48fupCY0UZ2rqEpijtpMmd/oGZFzU5Wgo6L72Q1pgYoCX1JWqKb bFuUKy/o41i5L01Pd7CMdNUfolmPLB7pkPMbzUyv9beQ58ZD50g7UWcQ8y4zYk2tdUbfPeJa5guN TE6e6SB7pUux32UsayoKhyziHVSs1S2H4olrPTt5gd3OcxNqXqa+mxZrD9cEehITEyK7Rw5dozV5 ocqHn+StY5yuUtzl/+7fbew4MzZ25Z0Xv/v1r1efGJ+ZufXpjtp1O3o+JWA3x6/RTMvP6Bj77NTB 519sP5WYuEH+k2OJxPj49fHrN24kzhzaf+bTcTbV3Z4YOnFi+LMJdt7mBXg2+91s91fhJhMHdVrb UmXaFIWMeqXSd7RhC22kSZu3LIF7HFUAARAAARAAARBYKAJknqP9VUxBZzpoWmZBy50sM430cJSQ wEL1hAeWLw1faR4avXncGDUX+Mwj4vJc4kR5DR3PThSHOT9z+kIHaTre94OtUde6xVYqPLFQ6rtH jHmMGzvEUrypc5uM+Zlkj+uOk0KbCpHQc/lozd3UOWXxneIWOU7toWCrWQ+SjqTpja4afRonpZD7 0nT8EBVPL/a5PaSkVsu1bGam+j4wRp/TFxWukLNPLbUW+m7Fh2MzlyO8OQwfj6ypX7OM7He8DtGM IgkpKLKzoCAXulv0REh+hng/T6nvKH1OQKxYlFL0k04jO8K0k19FMSE0qdgKZjr7KhXmXf/3/vAP //CP/uiPvvXDH+r67sYZ31/91S8OnOfElePTyFZz/Z3iPRXj/VX0nTJvjl+9cOYM7RPF6++u3zBN eTL8bN+PYOZCnZYMdqr+Onv2LO2LUip9R+nQaxeKfPA+sBsWGYEACIAACIAACHwVCdCIgt4eRUMX WnNH/2c1wJDDRvwvFYGvYv+ZVZn7+vpoKwlzzFzQkUfE5blUMNnsADw/85EWkmM8sVCZUkghtclJ skZlR1EX3Knu7JCLwGeKZkvOuxiciA2OY5oz2mQioW/pkh3A8ao2OTY2Md93kSt53ab1d9kzM5UA c3FS16UOrHZ4mtxewned9/T0kMRT04cbBEAABEAABEAABB4wgVLpGqQjCTzg5nvw2e3Zs4csIMWP rfOIuDyXik/fDNlDm4Y8Yu5YYnrnc3TUrBATKTmM6s4XB9e+ygSo61IHVu8aWq1MPiU04VFqlKaa BdwgAAIgAAIgAAIg8CAJQJeVlsCDbLsHnxe98K6trW1WA3wScXmOWSWVPzAZ6YqxTOVPBFeXPAHq wNSN1XsnFAp98MEHpZJ4kUjknXfeUdOHGwRAAARAAARAAAQeJIHSqhuk9iDb7sHnRXPPaNfBJS8B UMElTIA6sG0K5alTp2hrTdp6pSQSb2BggFLDixIe/NMJOYIACIAACIAACEgCUGSlJbCE+9Xg4CBt D7iER/6oWpkQ2Lt3L0k59VY9fvz4zp07aWfO1+Z9UCK0Ck9NHG4QAAEQAAEQAAEQeJAESqtukNqD bLsHnBftREGj4jKRAKjmEiZA3dj2zlC6lc6fP0/vKCehN8+DEqGkHvC9iexAAARAAARAAARAwCQA RVZaAibYJeagISu9FkHTSrhB4hIWEKjaoiZA3Zg6M1TYEntGoTogAAIgAAIgAAKSQGnVDVJbqv2K 3gRN791Y1KN2FA4EiiZAnZm69FK9W1EvEAABEAABEACBciYARVZaAkuyL124cIFWJ928ebPo4TMC gsCiJkCdmbo0dewlecOiUiAAAiAAAiAAAuVMoLTqBqkFluJBk9muXbu2qMfrKBwIzJIAdWnq2Evx fkWdQAAEQAAEQAAEypoAFFlpCcxyjIngIAACIAACIAACIAACIAACIFAyAqVVN0itZA2DhEAABEAA BEAABEAABEAABEBglgSgyEpLYJb4ERwEQAAEQAAEQAAEQAAEQAAESkagtOoGqZWsYZAQCIAACIAA CIAACIAACIAACMySABRZaQnMEn+5BL9y5coHH3xw6NAh2pQeBwiAAAiAAAiAAAiAAAjMmQANKSOR CHb/yyUkSqtukFouzuXsT3cf3b9TU1NffvllGgcIgAAIgAAIgAAIgAAIzIMADSlpYEnDS7IglPMY O1fdochKSyAX53L2px9Y6B6cx02MqCAAAiAAAiAAAiAAAiBgIUDDS5oeVs5j7Fx1L626QWq5OJez P9nQYbmzPI9wAgIgAAIgAAIgAAIgMD8CNLykQWY5j7Fz1R2KrLQEcnEuZ3+yns/v9v1qxL4pjq9G WVFKEAABEAABEAABEPjqE6BBZjmPsXPVvbTqBqnl4lzO/tB3X/3HJ2oAAiAAAiAAAiAAAouOAPSd o8SAIistAUfIZe4JfbfonoYoEAiAAAiAAAiAAAgsSgJ3xFFk0YrXd7dv3zYH5Ldu3b5165Z5ql4y PYtyKGnaw9/OpG+/dP/PS6tukNpsW+z69eu/FsdsI+YPf0kcatfNHz7PVSrh22+/TWX8mTjI0dra Sp4yyuuvv54nrrwEfVfkMwrBQAAEQAAEQAAEQKDMCXwkjiIhFK/vaFB6W7tx8+r50fP9o+c/vHS6 d3To3O3E2NTkZMGhbJ4A2vXLtz776PZInxY/ql3+4MqZ9z67ePL2rSmOkkf95UnRuESqs08cc5Cf UGSlJWC0SVGfUtyRbFq/fn1REYoORPJuaGiI/s9T4r3//vs///nPpbJT/5MnXSJxR54FC1VQ32l3 Z37Z2fJnr/wD/ZGjqDv63uSp05H2Y4c6Tw+M3isqxv0O5Lz+7ovEG7vqXvv42v3O3Z7+PW18XDM9 pyfHJ6cXByazTOXtuKONj46Oa05t4nDpC+3i6ZPHjvWf/jh+x8YtzyVbSJyCAAiAAAiAwFeBwK/E UWRJi9F3Uh/duj5y9cPfxQ51/a6lv+/t9z8bOPa7I6/XH/jV+/2HpsZ1s0XBMa0agMbY2mj/3Us7 05/+Nn31jd+fe+n35xuPvPbjjk2rb3/8xo2RM2rgObhJ260SBzlmG7206gapFc9fFXemOaz46PlD Upebv8QjBSc1Hem4Tz75ROZIDinrTLmXvyR0taC+873b/DevP311aoz+yEGn+W/qidhbDz37qPrX 9HEif5QHcNVZ390Z/Pazj367YzC7AKOx3b6OnrvGBdup4T3Hz3jH+uee65jWY2v7nnvuxcNX55jW Io2W6t9et+HgpUVauvzF0k5T89DRNmQ0kRk+69K98ZMvisDGvzcvGpHyXDLTgwMEQAAEQAAEvkIE Lly4IEeY5Cim2MXru8nj+y+/s/fF2v79gfO/rf/4N7/Z9s3miv+1/5kVW/7nyY+6b2uzmU4p5l5q Y0MzpxvTn/0mfe7X6eivvjz76/THGz8/tV774OfJIz/67J2fTF4SumyuVjzou8WjKwuKHRngvoo7 mcU8JR6VUFruSOVlV+qll14qob774/V/Q8pO3sXk+NOXVuW9oxPPk7hrfOGjyRkKNj058PR60nov jOaN8wAuOuu7e4OPPfvoY53nswsw2PnYQ8++Zeo722l2+Nn43Ol88bkXOy7qUbTTJA2OLRIz52yq kTfs3a3LXMs2OwjnvLEWw8Xpzs26Vus0pZperuxLX5x8kwJvPj3OhjstfoyEodGyeS4thmqiDCAA AiAAAiAwawI7dux4QRzkKCZyYX0n5NWt8Ws33nsp1Lhj03O9d25f3//q0E//5eXlW/768NnDX1// l6dPHr5+TbwnfTZabOqTti8/ebn9lR+EfN/+/fF/+bcTvtSxfz651fveCyvG91dO7a4Yaf+nm6OX s0fRRfpgfuZXS989AHE3f4lHa+5IwTkuryu5/e6hZ/+HegvbTtVL7L4zQBaxxzoN8UIS7/Kh5/fu viSmuqW0wcZtT7Fpb/1TTSczYUZjoacaSU89+u1NdQcuCmPfvYvPb1p74CqLRDrujkeeaHxhiBIR /q/1dzRueeKhZ9eeEsPqSOcL32CL4WNPhTpGv5Ax7P/z6Ltv73rrjb1rKfdvND4TvDiZTic7Q3xK CT626annez+2nB67mP4i3khliw0e0GOtDcYMA+UXk+0ddUSAC7M3dElO17unxS9enTYLdu8iCYiO i/JaWvuYzHe/pWIP7a9duXa/NP5MD+1fuXxtz0SKq5G6tGHlyjcGYturV9YZFrH+rWutgWuPnzm4 avna/kyU5Wbgge1rV204kiFyd6h25Uo5qWDVqurq6lXVGzpJyVIBarcf6dy6lm7Y5SvXHrkydeXI 1pXLXK5ly9ZuPmJYpaaObK1bTp6uZSvXbh6Q2d0dqlu5auvB/RtWLXe5Vg1MXSKHCLJ85cras8np /bWrLPmtqhsUyaUmBjevXcnPh2XL67b3yCzuXjq4amXt/oPbV4kkVtXuumLI7NTEwIZqGX7l5s6h TI0U15WeXTLz5avqevSY0wdrKUUzvHJqa5p0eryfBdvRodMt3EZGpUX6Tpfune4ItvWbttd7pNyf e/OkaOo8l5TiwgkCIAACIAACi5vAyMjIRXG8++67NPiU6+/IcfToUelPAXLVoKC+o41UaFSsXbtw s2P9xb0vNfyv3/3650c31Bzq3bNrXUvV//GMe+vu5xIff3Rt+BwPnovWd7euX0h+/OqXsZe2//yv 3/7VX9/re/rusZ/fiazpfvlvX1j9F2Md/6jt/X8Sr//3xMl9ckz+gP/zyAdH6QgUbL4HJu5kSeZs xaMlgXRnmdMyzXrZxB2FMS/lcuSfn7l8y49I0Nn+vrn1qVw3cjot7HfPPvHaycGJO0lLsDuDT7Dw eaqx863nt5E6e/Tp/jgFmDi9hcVUY90bR996qpECPPrG5Zm0mDnZeFFfpDZ9MfDQs098RJLoDlvc OPymOpKNV+4lD7zJp0/tDbwWqhP+uy2DcqMEufSdKNKjD215OXg0INyPRW4lB/tlSZ5q7AiEYiPq 6QGScmYZZJnZQPnoa1zUVGQXq1RfZ8eBwy+LwoRImlxs4+l+5mS/O/FOsvgY8i798b71z7UcI0Uw 2llLuqpflL5/w3Lq9WsPXqHipy7tJ/f2TyZ3rSLxtF9onSsUlAL3THH1BrYud7lqr0z380cnW0rv Dm3n6yu3i8RG60g/bejnoPJIXdm1ecPmzZu3bt2+eS2LKMqJlOTgVimd1m7dLrLnC65aOqlezo5O KkyKy+hyVddt3aWHqeUiTg+ImJTj2rq67VduUvp17LOsesPWXVeSd/t3baXsKMPtW0V8V/UQ5Tfd L/PbsH3X5loRvLaTvQe3ch6U42YKTnWm4rE/5SJOVm7YurVOFGmtoXb1elFfOrKBw6+q3b59swi8 /MgExxTGxAEjWObU1jTp6SHSZ+vbSAleFRpc6Up5LunpfjH+MbXscy1HTblnZJjOc8kMAwcIgAAI gAAILC4CN27cIGMdDSbNY9OmTXL/THKYnuSgYBQ4u/QF9Z0cnd7Wpibe2TDx9q/PB1/sePk3H+9r Odfx1padJ1qCp04fbr/x8QeJTy9yyOL0HS28mx5uT19oTJ985vPuNTcP/Vg7/NPbkZ9NtFdNHPrp zKlnb32w7sLrK8cCj1xr/5epmzdyjZDz+8N+xyOuxXHkbym6KnWT2mMd3bRNZcGkzAByqR1tqJL/ oGBmlIIOWaqCwYoJkF/f2ZSdeZp9C5s+E7HdwoAlVFjj2saj/UKFpIeOklFs7SljzwohhV6eSE82 kj7a8pYMk05fe77x0Sc6B9P3eGVck6nvLtOavifYWidmVH5jV4QH/KQ3RjtIRj1/moxufEzHSAY+ +sZV3eonPeX/XPqO1OI33jwkU0tPRih6Y4xF5dDhpx5an5mfaTkVZXhoW0gv8xdxH+nNLSTltNdI n755SOY4Pdrffvo8yTFt6HDL5jdPj+s1j9P8vxc7detdWmsjRXBMTF+d6iGttXmANMXEBqG6XNX7 qWBX9leTwrmUSl85SJa1arZCXWHFR0cdq5dplnd1PeTYTiKplu10g1uFuHGtHKDsp45QYlulwUyW LPN/ejsHrGONpus7odcorf7NdGGD3nRCIW4mhZi61NPZM8iSiY67AxRGCNK7rO+WCXUmL1HI7ctd y7fa52deOcj6bpdY1zbEeUv9xZEGd1E1l1GFpL7bOqDT7anjiZ50MiT0LddIHEdqqVp1elF0P8Ft 7UH9LDVEKa7kMjCi5ZsVfWecWpvmXv9vSZ/99iqJ7XsXSegp9rs8lyg3nnBrHPsy++ZwOfJc0ouJ DxAAARAAARBYtARIzUmJR8a77EKGw2Ep7ihY9lXyKazvxFq525+emW6rvRH65Y2Dz02Ef33jvZdP 7vtN3Wu9vw6cOPnugZH+g9oNsYtmcfpuauKzmZMv/dvxZz7rqB4/+MObh9fcOrr28w9+drOz+sbh f545VT91dF3vK3/9yUt/PtK6emoiUcxoOTsM1t/RiG6RHNmtY/MpUt/NakfNctN3fIN/oQ1d7Hmj 4+XHhG3roU1vaWTb2ss2u6d2veB78wXfXjmj8onjN9ke98ThzFxN/fmQV99JCUYhp1n3PfrtbXU+ SnbXC08Ls6B5VU9KfOTRd5n1d/fOU2GkqBzsfIL0nWm/sZwKfffUMTY+yuOj0GMPrQ+QBvlQ1JFm nz7fsfvDq8akTSOY+LxzWF18N81beRiL76Y2LyNNNJSePkLCZ38nqadVl8hkxvJOGLBGO+k+2j+a urJ/lYumQ25Y7lpLam6ItJUUYkIB1U0Jc9XaXSylNgxMT/eT+W7VoCGL1LL0UAqksIy1kYOkgpZt lVUWIks3JrJyNAQRuQc692/eUFe7du0qnru5kvWo0HeGGJQ52CQVe04PsGFu7f5LIkSKBdpyPTvy SV3aRVc390/JrDlZcbBVkUuVOlJHpXVV19bWrq2trWN1R4WX5k49qG5GXElBOEwtgZOC11YY26kR +2IHaTR93uwXcbLfdcZ1ST6d+5KI/MXVodOnaXnAPtaHz715zPgNgy7muaTniw8QAAEQAAEQWOQE aLUd6bidO3eq5ZSe+RfiFdR3vHnmzevagWfu7P/nG3t/fn1v7XjoudG3XxgPv3Ss9bUP9rx++8T+ 8aGTNFyX22zaxu2OpzfHr9zs+dVk+KlDfu+V/U/e7Hjy6v4nPnjZ++mBJ7UjP50MV029++SN0HdH Xvmz4W3fm7r+mWMiBT2h73iUtTiOgo1F8zOlxCMLHbkLhp9ngJLPzzTLQ4VvaWmhZXqmTy5Hye13 6r1Pa9k+7OC1bO3XZw5sY4ve06EtjXtffn7vyzT1sTG0+9KU0HdHc+k73RIndJxuv8uy65FmfLkx xGk+T4mHApFx67xQUaA8+i6zf6YiKi2CjqxLqtwT+s53MiPflKupoY87nn9TLt8jW16HXVfdY+GQ vfhOQmOFtXL7IE2CZEVziexb2wcGSKbV6hqM7WhrDw6QIWvV/it3B0kA1g4M0FTM5VINkfBjvTZ4 ZLnLdWTqbg8ls/lIz+blxqxOS8uMdlJirg09GQtYtr4zRJYpiCYoMTqWr1pbt2FzHdv+dH1H3psN i5vIxoxiZDolZmNmbHx32Syp6jthlKREsvQdq86ZtAhP1d+wYUMdHzTBdMOG7ZdUvlLfLa9Wg2w9 mG2/m7Ka82QJ7xymhnlufcfRY8fo7zDNmn2uZV9n/8ekfvNcMmpnfF7kzVkyk28Nb/7Mc0kNBjcI gAAIgAAILEIC27ZtI4ln2unIQafkmb+oBfUdybaZqcnp6MFbb/2/U60/vbFn7cS+Z8ZDz47/7tc3 3n3p9vu/Ge1ro9mbxYs7Gu5qNycSPS/e6lx97cA/fhZ68kb7k+ffqPzVij85/tpj2qHqG+EfXtv3 vQPr/tvZf/2T+NaVk6Ni55Zco+Tc/pifySPCxXHkbqXMlQcm8eYs7qisefZXkTWRC/EcN2DJVFW4 Sqvv7l4NkYhrupiZISnnTL52eWawk3ZW0acC8tPgzuSVSZrLdo0nNxpzGkkPRjq3vHY6Ltff+YyJ l1MxWqOXU981XTYFXfLKeCKzk4ny0JmtvjvVQfa7gGFESltO9TmiNCVSHjNNNC2z8a2ZdHJ0ND6h G2/kWryneM0gTfe7p/vmWnwnE5Lr5pbrswrTB0kBLSM7lb7OjsKIdXl03bWfF8PxrMjlHFqus6Pr V2gG5zLa2mTZBpJtUz288I7iy3V86dTdu/o8VDKWHaREVm23zJ8srO/EEr+1YokfZTZ1hNLPq+8y 8zNHN1A5l2/OiEl9OqhYiCcqP8GpufZfuuuo76ghxPLAtXIqKceYnrgyqs/hNGrGyxKX8VRV/bhL QSZIAU7zysKV23UtKKyNK43pmkbT3Dncsv659bxS0nK82DlN+i7XpXtx2oZFXXA3epRMeC8O8UTi 3JeM4uETBEAABEAABL4qBMhORy++o9LSmxHkyxHoNL/xjgIXo+94NHpz/NaOqts7q6Za/4kl3t5n rof+dezt9dfffWVqZBYr78wh7vjZg9d/992bnT+YePeHk+1PjL39D/H93x/vrL7ZWaW9++S1fX93 4sX/+9Jz/zHW9N2b1+c4P9PMaw4OGvDgKCGBIpvgAUi8+Yg7qgWVsKamhn45cXw/gvlqvKtXrxas cmn1XfreebFLyRNN/f2XRuMf9b8ltkNhWZca57VyD23a8uHVi6dOizV6jbtpyD109Bnyf2xvx+DV 8wfExpVPk2nsi/jTFPjZZw7EzuuBn32K19+JfVfMdXlpuXzv2SfeOD04dLm/cRObCCPWFVDyyems 78ROKY72u0vHeLeW54/2XNJYPFpO78mNYh59ItQxeHngjTd53qnv5DXSqk9xmesil+OXrvY/z4V5 gSp+lcf8NNmPlR4vvlvvtPhOllIsGaMOv32ItYjYcYVlkS5jeIoj2ezoqBNzKu/yijSSabt4TZ48 xKo0iiF2UzE2MOkcJV0nVue5qnmiZuoSr4JzrTw4MDgw0E/HwBCnV1jf3R0kneRataFncLDnoCzJ KrbxTQ8sd7LfuZatPdg/ZE6tXLurR8+vf3AqlU5dYY3pWll3ZIBT4/mWK8lqKdffZSZemqUS1kkK s6FnaGjgCM0YJTIs2WQ6tPqPqyDWE1ZvPjh0afDgVp6fuUpMBx3YzAWv29UzNNgjdn5xSX2nNo1O UH7ckevvhDi3XKAeqF66c5QEHln9+ofGJ8eH+vm9hrS4UvwskOeSLUWcggAIgAAIgMBiJ0Cr8Mha R1M0afBJBznolCbM5C93YX1H41TaQvPW1PQ7z3+5e/U0SbxdP77RSnM1n5kI/epGx6+1a/yK59ti mV7BMa0ZYIrMcl2/vBH6zq3wY4l9j13Z/90b4VU32v/+6r7vxXd7J3b/j0Tzf73wzH/4eM96M8ps HbDf0chqkRzFt919lXjzFHeyFqaI2759u7mRJq0ColN56zlKv2wC+fWd4/6Z5Jnndr472iO3wSTV w3+NdZFR3ZxHbwk3t175xpYtxp4fyQ87xdaXIvzTnfpbxScuZgI/f/itbz8rbGFCPyr6jvTAeaGk RF7PPpV5VYG1iM767t55UmRPHD6vh1XW36W1/qfE4sFvhMS+HOqpsN893fmWUHOc71Od/dIyNnGx 4wm55JDqsv6ZTlHx0aNv0qj/MOs72+K7j5XFd7IIqYO8oWUt7abCx1TPchY95sYgvNKNNyXZoJuo 5HYlNFVTRqb/Ez28gaSxm4rQdMKWR5iEGFzLwtHc7tK8LcU8STaQGRMm7/JqOH3aJ0UwJzSO9ggh xhGX120gASXtd4NUKuv8zPSVTrGVpWtZ/7TM2syMHCIWCdj+Xay7xLGsevMloYuEEVPsDCNqpZZq tF/IOhl+1YZBoXtTo53LuTS8sQwV9chmlnXyWLv1iI5mmt7goHuurN1AjFdtZ1GsNI2Ibf67dzX7 /Qj6RdulO1fbyLpnHOtb2uKm/TjPJTMjOEAABEAABEBg0ROQszFpeEkvX6Y9VeiQb2EmH3PGpmMl itJ3Urt1N/3bzh/c2vfPt95aPbXzxzd3r72x/5nP312vXThOY9fZ6juKMnbt4qmdP+579j8Prv8v 79f96ejOh28d+NbBZ/7sJe9/jPv/08X//R8++uW3Pj3HK/vmdmD9nTHaWvjPWbWgKvFmFbFgYLnj Cv0noVcwcJ4AZHmRVjwp6Mz/5FmkuKPE8+s7x7u1GM8pbXKC/zITNY1Yqek7M9P3jJmChm/6XpL8 79LWhZbD0dMSQp7cpTRtr2OwhnLWd9YwxZ7JZXpiUqhjXXIWJu/iu2JzX/BwNBsyM9Nz/qVJTU/f pb+iE6LwFDyr/yjxU5SeUxD2zhtRSWN2zjvTGh/TDva+PJdmlwdCgwAIgAAIgMACEThz5gwNMslg Z74EgRx0Sp5yrmauchWl7/hLe3p6auL2+NXbI59Mb//7ZPAfP9/9k8/3rU13PaedPcJX6ZUHsznk er3Bkyd3PFs9/NI3rr/89fEt/+n65j8+/8v/M/rzfz9U8++jjY+fP3aIv7rnekDfLbyuM0ow2zaU Em9Wu2UWkwUpu/mLO5kRlZDW4sk9YUjWvfTSS3RKnsUUQ4a5T/ou152+UP6l1Hd3Buh16o67dOav 3Z047dC43nzz3RC92Hwzv/kOBwiAAAiAAAiAAAgsWgL0TnOSeNnFI0+6lO1v+sxC34lR6e2bkzNv /3+f7/2nWwf+93TnxlvH992enOP6OCnxpm5OXjvV/mnrTy9urzrX/I/DgarPdlVfatt4bThGGcow xY+Z1ZCYn2moq4X/VNsFbkkA+s58ChXt0E6djAxp+UxIOZK6Rz8UmZe+uDM9reykb/rDAQIgAAIg AAIgAAJLgMDs9J14vd3tqRvTtKOmdnP+A3VTvt2cnBwfGfns2tXEyEjis8/06XPFvU1v/sXITmHh FdHSKkE2YfhA3y2B5yeqAAIgAAIgAAIgAAKLjcDs9F3ZDMqXlrpa+NqUTceZRUWh7xbbwxDlAQEQ AAEQAAEQAIElQAD6znFEvvCKaGmVwBFymXseOnToyy+/XALPEFQBBEAABEAABEAABEBgkRCg4SUN Mst8mO1Y/aWlrha+No6Qy9zzgw8+oL1HFsmjAMUAARAAARAAARAAARBYAgSmpqYikUiZD7Mdq7/w imhplcARcpl7XrlyhazndA/CircEnqWoAgiAAAiAAAiAAAgsLAEaUpLtgIaX165dK/NhtmP1l5a6 WvjaOEKGJ9199AML2dDpTsQBAiAAAiAAAiAAAiAAAnMmQENKmh5GFgSMsR0JLLwiWlolcIQMTxAA ARAAARAAARAAARAAARB4AASWlrpa+No8gCZDFiAAAiAAAiAAAiAAAiAAAiDgSGDhFdHSKoEjZHiC AAiAAAiAAAiAAAiAAAiAwAMgsLTU1cLX5gE0GbIAARAAARAAARAAARAAARAAAUcCC6+IllYJ3n3n XfyBAAiAAAiAAAiAAAiAAAiAwIIQWFrqauFrs7C7xSJ3EAABEAABEAABEAABEACBciaw8IpoaZWg nPsS6g4CIAACIAACIAACIAACILCwBJaWulr42ixsayJ3EAABEAABEAABEAABEACBciaw8IpoaZWg nPsS6g4CIAACIAACIAACIAACILCwBJaWulr42ixsayJ3EAABEAABEAABEAABEACBciaw8IpoaZWg nPsS6g4CIAACIAACIAACIAACILCwBJaWulr42ixsayJ3EAABEAABEAABEAABEACBciaw8IpoaZWg nPsS6g4CIAACIAACIAACIAACILCwBJaWulr42ixsayJ3EAABEAABEAABEAABEACBciaw8IpoaZWg nPsS6g4CIAACIAACIAACIAACILCwBJaWulr42ixsayJ3EAABEAABEAABEAABEACBciaw8IpoaZWg nPsS6g4CIAACIAACIAACIAACILCwBJaWulr42ixsayJ3EAABEAABEAABEAABEACBciaw8IpoaZWg nPsS6g4CIAACIAACIAACIAACILCwBJaWulr42uRszWRSy3/M5Iy6BC5kVT5Z8kolouHmRr+/sTkc TZQ8cSQIAiAAAiAAAiAAAiAAAl8JAguviJZWCXI0ejLgLlhPd7T0oidHcR6sd/JsILvygbOlrG2i 3admUdMef7BVRG4gAAIgAAIgAAIgAAIgsCgIqKNiuOdPIFejJme0xHAsWOvJzsJd3dw7lNC0LL2j RRuqfb1juZL86vinkoloqMpa85Lqu2Sw0pp6RTCL5lcHF0oKAiAAAiAAAiAAAiAAAnMlYB0W42y+ BAq1g+a3G/I8UeeZmbpmKakOKlS6+3k9VG1hW8p6peIW6x3n44un7mdlkDYIgAAIgAAIgAAIgAAI LEoCljE3TuZNoFAjZ1maXN6Yk6kpus0ry1JKHVSocPf1emyHxYJX0nppgQpry1UEtPtaGSQOAiAA AiAAAiAAAiAAAouSgHVYjLP5EijUyEXpu0RXg1mOkuqgQqW7n9fvp75L24yDrnXh+1kVpA0CIAAC IAACIAACIAACi5SAqSPgKAmBQs1cWN8l+prVkgSHnMx7hbJZhNfvq77L2l8FW2guwi6AIoEACIAA CIAACIAACNx3AqqUgHv+BAo1WAF9l+j228rga4smRhLx4UQy94Ky5CQFiNv+EmMsDLURuz8Fk5cS SpRE1nTGxFBvsMnvq21oqPX56v3BrqhmK0CKdoyxJa6rqkQ0EuBXFXAsU5066zvaesWeSDw+YilN ciwW2tbcUM/vPgi0hqNDiWQyEWpqjk4qsMciKrfwEtiURqkcnCAAAiAAAiAAAiAAAiBQJAF1VAz3 /AkUwp5X3w0F8xTAn5FKtkySDq8f4IQCyVTMvpuLnkHQfqkxmklUi/lt21HqsdzBvoxdLHnWYmcU QWgtYTJca82zNiJTdtR3jq9OcLk8Zl17t1lW7ekFER/NljcsqBvXNGRKmakVXCAAAiAAAiAAAiAA AiCw9AmoA2a450+gUI/Jq++0GJm9qqzyyF3d0NzU7K9vjuaxSSUTzVkbjCSkuS3rknebIeWSiYDQ ce7acMY2NxJRXuHgi4m9PaNN+mYvxKemNWbWURvprbGV1m09Z6BeKdYc9R0nlUpG6o08K/1RxVKp zLr0RobZEpgci/qNmtpWJkab9ETc9b1mCeEAARAAARAAARAAARAAgbIiMH9FgxRUAoU6T159JyLH Wy0Wq+BQoSTF9eRZq+3P7TdtWMkTFkObJ2Oqk4VRXtCQitcolfH3GfMkUzG1TAHTupZO2188R9Hd HqvGq5IbhObUd2O6ovQ2WXWZUhilzFRb3VRn03fJqF7Nhm6j2EWRQyAQAAEQAAEQAAEQAAEQWDoE lOE8nCUgUKhnFNZ3OXVQgaTVCYpckYz8SUYz5je+YkxfHAvzmbLVpFVaVsUyC+6sxXY3GwrK6k+p SV05HOKU5VEdkgV3rtdYRJbNLu4oTjKmFNsbUcyXclZnsyIzOYuxiNSVoRGZIf6DAAiAAAiAAAiA AAiAQNkRMEbh+CwNgUIdKEsQZb3/zlkHFUqXrifaVOOby2UsfFPftiArKbcfka/YyxjjFHuZCGZ5 MV+k3mKUM3b1tFcnY/KbjEXaQmFlVxZbvYLDZIjrlVMq3Y1Wy52sbErVd1yihtZeYx6pFtkRjBki U2ejh7cUuwhsCAICIAACIAACIAACIAACS4eAHPDjf6kIFOoZdkFEy9Ns7ze36aCMGa5Q0umZqLGM TdZGLnxL2t/9TWvo2mjyZsLHoQxbHiVusZfRJX3dnMzWVqoqfRWevTpBy54nlhLbUvC3Bc05n97W uCWoPLFOCpVV4hLviBgqzxZJWjB98YzZ0RYApyAAAiAAAiAAAiAAAiCwxAmYw2Y4SkKgUHexC6JS 6rt0OmLdu9LXpaUnxSRM27Yn68IJsVend0dms5SkbfdOt1+1j9nUmXebjGivTh41akvBRjsotk+x 0TO3TLEFpmmgwRNq6WS8ZJBsjO6A+UYGW2o4BQEQAAEQAAEQAAEQAIElTyBr5AyPeREo1GHsgqi0 +s6+y0p1c7CRF7GFRrTIOrVecg8Ud0R5hZxd31UGVaFkU2cl13cul6PdTQtWq8W2uDMzSw3o8b5w qCujWA1vfIIACIAACIAACIAACIBAuRCwjJhxMm8ChfrN/dV3vLdkdhUqmkmpaV0N9ivVFgWXVjdF 4aA+/Q0Lokol13c1Tc3m/Ey9YLVhR3rR1qySywhWC6NjXHiCAAiAAAiAAAiAAAiAQFkR0IfW+CgR gUKd537ru7R1D0yuVU27eFWCfXWeK7MXiiy0fT8T6/o761sbfDLNtL06xc/PDI6kzTcamOx9XeZb HahMyVhfNCFewJdOab2tfssOLxzHUsIk7ejSHgq1R2JjquGxUIPgOgiAAAiAAAiAAAiAAAgsIQLm 0BqOkhAo1DXsgmgW8zOL3DZkRt+U0qiOKYKSIctcx5qsfUgSVgVl2fglvM6irox3ENirU7y+kyFt 23LS8rnMlNFklLKs4q1gjINU3jZ1j9BMCbVowKgvfwYcVucZieATBEAABEAABEAABEAABJYuAXVU DPf8CRTqKXZBVFDf+YVU0bp5jmKI3ilQxBFWltq56yNmDPVFCdY3hutBtD51JmRGPZEpzfIec+OV dnZ/l8t4b4KZZ8YhX8dgEtaVYEpu42l68xv09J1T5P6ZmXft6Ukpe8iYJUwGK5QUyFlhnXqaKQVc IAACIAACIAACIAACILCUCViHxTibL4ECfSUVU+1PIjPFYiUix3Yor/XmEDXBtmY2nmUpnVx5JRVj lmVfSmWKpmGAs6WhqS9TqGkzXlugRLSY2NJpi+6jNXuWCZaWxG0hg0PG1ZGwxTTocnmaonzNeD9C jf4uBj18tNF4C8Q6Q7qm4uJdDwKn/i/bOmlkh08QAAEQAAEQAAEQAAEQWLoE1DEx3PMnkKunJIai kfZgjc3MpOfnbW6LRKOxpJiBad/H0ihTyOkNAjmyS+h2OLskNKZoVuR+iUAq7s8U0hOMJpIz8WC1 qcDcwbPGiwmSici2LF3l8vhbs1bAiZBmErJC7sqGCCeVjEcjNbZrpBPbYqa+4/AUOBrTJhO9mb1W PL2ZzT+t5kUKD/tdjp4BbxAAARAAARAAARAAgaVNQA628b9UBHL0liwB4pBfVcxYYRfdZtta0hse mt2eIdIIqO+sopQp0cWKLNtfCULOZK+DcCOR5Y9mJFU6eday5E2tkEd/O56R6nBQvZpxVwTTqbjN WqlfJYGWFK9rr/b5qg2DnRnTXdM7ZiQuPpNDIfMiOfJME7VEwwkIgAAIgAAIgAAIgAAILC0C6qgY 7vkTKFnv0BKxaDR6IhodSsxO2skSkMmsK6oZgjFTqlSit9vJPxPCcCW1WLQ30hWJdNNf7wJsSplK Rrt79SrMaPGz0dhQLNodISBGEa2fMwmygRI0fctN60WcgQAIgAAIgAAIgAAIgEA5EJi/okEKKoFy 6DOoIwiAAAiAAAiAAAiAAAiAwOIkoGoTuOdPYHG2MkoFAiAAAiAAAiAAAiAAAiBQDgTmr2iQgkqg HPoM6ggCIAACIAACIAACIAACILA4CajaBO75E1icrYxSgQAIgAAIgAAIgAAIgAAIlAOB+SsapKAS KIc+gzqCAAiAAAiAAAiAAAiAAAgsTgKqNoF7/gQWZyujVCAAAiAAAiAAAiAAAiAAAuVAYP6KBimo BMqhz6COIAACIAACIAACIAACIAACi5OAqk3gnj+BxdnKKBUIgAAIgAAIgAAIgAAIgEA5EJi/okEK KoFy6DOoIwiAAAiAAAiAAAiAAAiAwOIkoGoTuOdPYHG2MkoFAiAAAiAAAiAAAiAAAiBQDgTmr2iQ gkqgHPoM6ggCIAACIAACIAACIAACILA4CajaBO75E1icrYxSgQAIgAAIgAAIgAAIgAAIlAOB+Ssa pKASKIc+gzqCAAiAAAiAAAiAAAiAAAgsTgKqNoF7/gQWZyujVCAAAiAAAiAAAiAAAiAAAuVAYP6K BimoBMqhz6COIAACIAACIAACIAACIAACi5OAqk3gnj+BxdnKKBUIgAAIgAAIgAAIgAAIgEA5EJi/ okEKKoFy6DOoIwiAAAiAAAiAAAiAAAiAwOIkoGoTuOdPYHG2MkoFAiAAAiAAAiAAAiAAAiBQDgTm r2iQgkqgHPoM6ggCIAACIAACIAACIAACILA4CajaBO75E1icrYxSgQAIgAAIgAAIgAAIgAAIlAOB +SsapKASKIc+gzqCAAiAAAiAAAiAAAiAAAgsTgKqNoF7/gQWZyujVCAAAiAAAiAAAiAAAiAAAuVA YP6KBimoBMqhz6COIAACIAACIAACIAACIAACi5OAqk3gnj+BxdnKKBUIgAAIgAAIgAAIgAAIgEA5 EJi/okEKKoFy6DOoIwiAAAiAAAiAAAiAAAiAwOIkoGoTuOdPYHG2MkoFAiAAAiAAAiAAAiAAAiBQ DgTmr2iQgkqgHPoM6ggCIAACIAACIAACIAACILA4CajaBO75E1icrYxSgQAIgAAIgAAIgAAIgAAI lAOB+SsapKASKIc+gzqCAAiAAAiAAAiAAAiAAAgsTgKqNoF7/gQWZyujVCAAAiAAAiAAAiAAAiAA AuVAYP6KBimoBErYZ5KpEiY2r6SSmqZNatpMMmcqqXRyRktSAFnmlFNIR8+cKd6fCymqilPZSpXb TKmT5wJryewikz+3SKnKPdd08hSPip2rA+fyL6YU2XFzlSFHasmxhKYkwhiL7xKpZGJMaYwZ0Z2U 1HLkOW/vJGdkdoOcYOedDxIAARAAARAAARBYAgRUbQL3/Ank6hKReq89cbfXvyMcm1SGi0rk5Am/ yx0wr8V2VNmjm+ff3bK12m2eWRyVQTMFJW3hTCUCSixvfcQeQJwnTgRlud0VMouqUFSzhExpkW0+ NVN3dY3b5Q6PWUKl05rf5Wo+aylOoi+glNsbHrFFmfVpIUoeKqe7KTrrdIuJMNlbIxA1Ry11LCZq rjCxtgYTbM22XjOY6u9tcm44s7+514XNiKYjUs8o6HBXNyfmKk/UYqjFi3dRU7vclZxFQ3vczJQc yZFoc7XLozRBcijI5bAcVTEnhNlxKUFZBm8151W1LWfLxrapt09VTFQ5ORTKdL/K3BySUTWyt1XW KBlp5Ew9FfwvPJxV4pGwjpirZgRIJfwcng937dtvVkunw/+qHTHJTRuK+IwoIpynhm7bWudGV1HD DQIgAAIgAAIgULYEHMYW8JoHgTwdKbaDpZKvjUduZO2KdgXkCNBpXJoMirFfaFhPL7bN41oXTJCh IaUFxJAyQsJwRuulgauQgdFtnHjzCY0taPyXTJxoJo+scaelgDJWQ1fC4mucRMWo2NMY0e0dKS0s dIE5+EzPxKS0a2g3huQzieA6HjUHrFJOH8ZXh4y0jc+ZKJfb3eBcAiNUkZ8FKE32EnDvNn3kXGSa xQfTGLi94sVHt4XUSOC73MHuaLRLl9g+0UzJKOXii45oGmmlSsrQFZm0RdVP4601fNnlsmttLSL9 VZ3lnERu39zFC1Di3A+pk59l7SbddJrobq6q5tZWmyBEVaj2B1uD/NcWZCVV4fCjhGNcrY+FpLxH ZAeranVq3CT1MXdDU6C5qdnf2BDsFn1tJkrdNBhNaFoi3MjZNkj/rCrH6M6qbghsa25u8vsbg1IO R+l+dHnkTx3ivtbdltjJGNfW5bUp/sg6l6ue1HoyWOGqaY2yEXZS3gWsMZOT8QBJYNFLY63i9qpo iBq/AiX6hBx2QmTJGicgAAIgAAIgAAJlTIAHIDhKRyBPV5LWpeCQIrno93xhQqhpt+qbsbAskdv4 oT62rSGi282SQR7Vew1BlWio5vGwTNyqqpLRbtvQ0l46hyIZQZJRHqi77BZAmbtL1EJ3Z8nDJCkQ vzVnHtPy4Y7Y7HqpGI+t7bkYhZjlZwFKKR5vewzLyCzTLiL4cIiqYm2CImI5B0kG3O6McBMpyzF/ vCtkNH06LYxfOe2ew0ILsKnIYu6JNumWJVVnOZcip2+u4mnCIus3TLxJ/i3C3Wyc0s8OcWpuWRFO OxVrttgfKVlXVZvF5Jcpgi2u0Ecut5lXOsx9rCYubHOZWHRrsBZriE1mSkFXk8ORiHknpmIUwn4P yiSSfMlHP18od216JkqebtZo4kiK08Ys62GOvk2CsaGPCpMMrjPI2EKOhGq2xaQ6zv7pQwj8Ar/b 6AXDBwiAAAiAAAiAQFkSoCERjhISyNOJnCRYOj0ipZxfFXiRWldNW2+AdZyn1zIspeRt+k7P0FBq Zv7J5gp9Hprple1wLpIIJ0bLLr8wxKgRpZXKTfM5dfngYHpLno1EVR3HBiNfbzebt9yNxqhYJmob 2ao5zcvtREnqu8ZQuIk1JbHlaXU0T3Wd1+N2+1hWaM3VHk+F21MbpuF8YigarK+q2RGJiPD+7gTN VqWQXp556AkZ6kCfjugWQp1MQtJwORNrpnl0bg/5umtD3IapeEOFx1td5a2sCrNZVguuq/JUeChZ x4pqhsmGrwpKGVlkRKB+kmeqHgkET7VPmJDcxo8DnJSHzILtLN5NfZccilRRYcWMSt2+PBaL7Gjw rgtGu7jVyIZr5Kl/OhdPWKzUJtZtW+Y6QdkEuUyo4meNjKq1ZWmPK5pYEY+xVm5WNuelEg3EfV2I NZmIRf7yaBDWc1vCiS4ykzWY81QjtRTZJ+dwSpu7HrmiISYqIpWXnzWaPOwl0b1z9O1Yk9f264ds X9uvHOJnHJc02hoZyU8t0p6lJa0hcAYCIAACIAACIFDOBIyBDz5LQyBPX3IWU3IQqE7iStLMMQ8N LzUedtIg3DaWc1Iuhv2uqikU6YrQX5CnnNknhmWXzblIHE7m4mCN0mdaVgTGxew426A0OwvyiTa6 3Tyk18RsM2upcoyB7ekMh7xuj7fSa/3zeGvFGN4ems6dKOmoSa2Eo6TUCK6c52YRDmL6K/tr4Uah jUjd8IpCV9XOD4hpTTeP6iO1HjlEF9LAFR5hJdHbxOGl/U6oY2Fa0ngeoLDXpKVJ1LT72JZYOlTC 9BI/AqiWwUQ0wmViK1JEtSyZMciRPNtMU3/lFFxzKma8jWYbRjRhENT1XSrB8ziFNUrMunTRTwqx dp76yEdFFUk/V/bEWjUno3iyb3gVC6m9g1lQq0mwO7aDpGdmzan9sj0uz2+kxjENxXGh7wJ0LjWd kZQ2Eo92hxuM1abqPMzkWDSwjjsCmcniOkdrsjNafCga3sZ6URz8O4wUkrqQ51Lqnc0siV7yHH27 OH2nScu+xdxvJ4JzEAABEAABEAABEHAgoA9b8FEiAg6IDS/7WFf6G/rOnHRHJgO3PtcrIQSRzQzn pFwMfedZ19Dc6Pc3+X08mjXncBolyPp0LhIH0/Vd9vBS13eVwdNixZ/HLj+z8uDBtj4IT7RzhSyL pHKMge2pjERqKqtq1tVY/6pqGnOpGydKYthvsJXT+YTVxiIcRER9fZMY6lcIxUGz/ngZF1uFWODN RCNsp+MGymzYIgyaUoXxHEi5sclkL8UyTG9SO3ijwgwUqXb5hFq0VzbrnE050holL6USkdZQ0NjW RtVTalTSd56mWHomIrSJlNUs5YJk4RJFNex3WjMtBBMzhNUlhLzurIifCChHs3jSsGUky2WxdzAL arWw5OYdeIzdS2yXxGlWXJk4m0dp2dpIrzDK6mx511HTaGgklugWolVZvBZtD4VaA9ysdJiThJNa QjWeyuipBFGig9pXkFF/+tA7Wyn1nexsxD+rFkZt8AkCIAACIAACIAACzgR4yIKjdAScKQtf+1hX BrXrO13TNdQ3NNTr+2NYVwY5KRdjIB0cMvMnY1nGtGH62hzOReJAMhdjtqEaTW54WBHUeKMPwwSm BrC6pYWriqvTUCNGyDT5zZwL5zgzzZrA3M6cKAmBYKohYYURiCzCQUQ09R0Jq4wcSIbEpjck6Zq7 xD4eY7xRSY2xXkwqX9PKlpykKZrCNkSyxZiRKAVUFe/BSPMkvXISYP4ainJmVplZAo9EWJsIBRpt 9TfU0wYg/obahoiwJ7K+Ez8UyKm2tK4tGSWBI5ZuiUY0S0VpJs6GjdbRlYuYmmj8RDAZ9dc2UOK0 P0nDNstcTUvxJllLmoQpWdHBlIWEFtSWqqTl5Ex1Wq/1urTKGUpZXkvKDX+4H+pHTX6kYu2h1YJM KaXiYlvLLH9bAcSyOyqAJnSi8tOH6DNuyxRrjir3V5G/DyhJFWm/E9soqSpSSQJOEAABEAABEAAB EMhNwBgX4bM0BHKTzrJliKD6LgqGiND6aEt8X6SvN9IdiXT3RtrkNDl1eO+kXAx9Z4oLSpvfRsf/ 85TIuUgUiVZXiVVIDst/pA2O5/vp6+/yj6jZKONrjfRydSKRvghtj09Hg2m3ymW/s709TYuF28Jy 6mnmf3s43O20XyLX2ImSVVxk9IvUfboEy6PvKFktIvZapCoQgeRZsYrNmI6o6rtEF7/agHeese8K kuAL7oZIV4Nt2xPHdhKbaRgiyykE7z8pFAS9EMFTwfNXPW6PlB6mvjNaijJ2yVVj+kRKQ3VG6kmW ia1vFBNkhg/lS0JSnx/r8SiWRHvxBEl1SaBIWdFN1iZQKySyM/YbUS+Y7lxx6b1wZL8TitWchmpG sjnEXisOe7CIuZ2Ffg8R+6iwTBZ5KdsKiV2SjFtYyVFrZtOpvfmijfrk3kxIh7tAdmCrsTsTAS4Q AAEQAAEQAAEQyEmAx3w4SkcgJ2hDgik/+/PmD2IGpvkrPe8faJ2zpw/zzE3mnZWLY+KkRrpqXPW2 5XuWAkr7nbKSiK9yrNpeaU+xbH7IF8XOFfo2mHK2YfYKQZIDvRGxd7xQQA3mPhQUX9ez5rYYDiNb zsXncvcqylQqKadWyrWRYE59Z1qXhOFJjL2FncU0DPFsw4og11WKRHPcnow2iBe3Jcd6xdo3X3yy l8fvYv9SDi7EEZtQU3G2vMpdK6V4NDQghZICma4HlZemWbZn5LTEMUbmMGWG3lik2fo6OQpEa9Ay E0T1aPoH/VbA8zP50HsR7yIiL6r2uxHe9tPXJVpJ+EsrsEXfyVi2/w7FGxK7gpgtLie4Ku87yKJh JCkmZyqUDH/lM2dcCiNUszqbNEWr8JS4hjPa5HZVZr2kg28fsrRmlv45v0CcF8aK2a2y05qvjJQF c5ioLG8Q2xZJGgn8gLE5j14up7vA6PNKB9BDJ3vbjVeWGPXCJwiAAAiAAAiAAAiYBGhoh6OEBEyw 2Q4xYKY3XvGQm5b4RNv199/5jJd2if03eGcV9ZAv+SIbjaGSpMJSbCIitPEmuzi9+Y4PTYt1s3Up ewNMNXFLLIpIperiWPIl3THxAjW5voljpejddoxKbrHIPmJxGflUNRkDzlQyKrbmEJqR5arYWYXD Goe+cUSzfHmYXGfk9tPuFqLcycQwbXlB1qTMYFuPSFgc/4x0rZ9OlMQ4XF8Wl5br78QMSSnHXFWR 4UQv76VPuddEWHwJ+4uu9ViM04xKuR4qznKAjKq6bqKXjGszZNrjuN7aYGzkNE+bdNeEo9GQeGOg pzbYe8LY9l8O5pWN/eULCzJvFZQ10cRyP5eXXrtmTtalN9nF23zuyoZeoQ2FldD5beCUBm1rY64p E4a2zFRSaV6U1i5pjXJXB6Jne+Xbt307wtFhjcxMbHuy9sYM5BzFk/pd7mEiU+YNT8xDNoGpjEx/ MTnT/p4+86p05Io7I2dXujMvGdcJszWQcFEtgn2sa7UovzBCf53EcMjjrgr2caMkR3haqfErh5yF K0RZKs6Ra4O89UpK41dSrtPnpop7WZ93mpnoayuwqeXdDTF599IbJGnLU1Nlm+FZKet2WNOPHHLH Hrq9IkP63U8bwnAbmUsF1dBwgwAIgAAIgAAIgIAgQMMKHCUkkKtbRcQ435qRx9cYjIqlUhxLmFEo gLvSn1meNhL28shPHDQvTq630s/dfvlectr5wdgbUL+S+cj+8d8oYL5YGclAbwSQu094xOb5NNQM nzWEpkwpGQ/WCk1kZlrpj4o3bstlX1QhvZwiPE0jNAMG9r1iVs70lA7TymYUdzafOSgFDEr8yoMd 0nBKLy8IU9Lxdp41SYen1k/bdLirfcHOD+Tbw9lzXZDf8C5Vg8tTxavqPEGpT2diDfqiQhHf5ZZt aozMXQ2tIT8ZBGmZnqHiKTtjQ1G9UkJJUa6qpDUtbjJZ8V8YCk3zH3lRwYxdH618qHErDbQVfvFK OK3BrTdrxNgXlFJwVzYnkvrOIayD2mVzu3/x9N/oGVfUyNa0ZpCzeBSM3kUuUuZeQS++NyNqfUFv hV4q77pAppPr5jN1ErIZSXc4xtWGIv513J08tQH55gI9tKLvVFyuCl/vmCE29feScC3dFT65YlFE t+s7DiEO3w6LKTwitkv1MGdP2GaPU4ofbdV7mp6K8ZIFM0iiS87BFtfd3siIeYUd8W6x0asemT8a 2izFsITGCQiAAAiAAAiAAAik08rAAc4SEFiEfUobSyQmNc3yl0iMWWVa3nLzboR8GGPj7MAzWmKE 08wTJDvS4vKhNVyyfrksVrK4HMzOgX1kLDWu6UkRVX/xngjbW954FxrDNlQYiyyDJc3CkfKHyNSp JMkKI7K11nnz5/B5AzhdTI7FYsMJ57mU6vxMadHOTl9gdIyuerJZmZayOmLha9npZpWV3nUijyLC ZkVmD76FxxJ0CztehScIgAAIgAAIgAAIqARKIGmQhEJAZbso3GJTCKWAprPQbhKLovRLqhCx7mCw qzdC7x2wLQFjW5JX2gOXVIVRGRAAARAAARAAARAAgQdOwBzuw1ESAg+8AZHhV4VAUrxPgnuZzXhH qzF5/icOEAABEAABEAABEAABEJg3gZKIGiRiEph3gyCBJUtAG45G2iMxcwnYkq0oKgYCIAACIAAC IAACILBgBExhAkdJCCxYQyJjEAABEAABEAABEAABEACBsidQElGDREwCZd+hAAAEQAAEQAAEQAAE QAAEQGDBCJjCBI6SEFiwhkTGIAACIAACIAACIAACIAACZU+gJKIGiZgEyr5DAQAIgAAIgAAIgAAI gAAIgMCCETCFCRwlIbBgDYmMQQAEQAAEQAAEQAAEQAAEyp5ASUQNEjEJlH2HAgAQAAEQAAEQAAEQ AAEQAIEFI2AKEzhKQmDBGhIZgwAIgAAIgAAIgAAIgAAIlD2BkogaJGISKPsOBQAgAAIgAAIgAAIg AAIgAAILRsAUJnCUhMCCNSQyBgEQAAEQAAEQAAEQAAEQKHsCJRE1SMQkUPYdCgBAAARAAARAAARA AARAAAQWjIApTOAoCYEFa0hkDAIgAAIgAAIgAAIgAAIgUPYESiJqkIhJoOw7FACAAAiAAAiAAAiA AAiAAAgsGAFTmMBREgIL1pDIGARAAARAAARAAARAAARAoOwJlETUIBGTQNl3KAAAARAAARAAARAA ARAAARBYMAKmMIGjJAQWrCGRMQiAAAiAAAiAAAiAAAiAQNkTKImoQSImgbLvUAAAAiAAAiAAAiAA AiAAAiCwYARMYQJHSQgsWEMiYxAAARAAARAAARAAARAAgbInUBJRg0RMAmXfoQAABEAABEAABEAA BEAABEBgwQiYwgSOkhAocUMmNU1LljjNQsklxxKJmUKBrNeTk1oyJbxSycRwwnpxyZ5RTTVZa1sV CcLkLFpNG9NsCczxNDWLTOeYhWM06qWTJeioySKKn5yhzIoI51hO1TOVLIB9zpVKpYkFAclXnTyJ 06X8FUwyATNx/b5Tq7aI3UktEYtGZ/F4oWbi2i7iKqFoXxEC3JNmZtOTUprzYzyXf0k4FPP0mE1G 2nAsNhTXZvmFbubAz9sZ5WkzG37plBZXBgP0vJ1VbCoDN9nkfL8ck5Px2NmYc1Oa9Vy0Dn7aG4Or 7EI6Dj+yg+XwsQxg+Ek72/bJkW4pvGfVaskZ0U8EjeRcu3opSp03DfldNr8my5uBw8WSiBokYhJw QMxeyWC1GcTuqNoRc4g12VtT4aag7qaow9W5ekUavfbs3V5/aySjU1JRztUVKPJW1/oCHg7vjooI sW181ixP5lpIGc9S1Ar/R51+zsdyuGsag71DOZ//ia4GS3AqZUVNsNuJ9uyLmjwboMTtrZNKBKqZ gN0/R/q922q4hO5iaedIRnprBKj5bHHtNhLJ6gcub21zxICZ6Mqm7fE1BmOT1iKMRRsquQYut+g1 Lre/3cA7EhEdQ1w1/nnX+cMnYo5F1PooR70XWfMwzrRYQ4WRkLumd4z9e5uqDC+Xq8IfL+bhSW20 TvbZHNjtlXL524q8B5PRVr3L6Tyq/dHiiRW65bWhiM8kwNX21FS7XbURa2N5w8PJ2A4FSwYQubyx S2GlXTwUmDmmEn4jZXdtuLPeDOL21of0G2wkUmW0ckjG4pjFHlT4GvE88zVRL0o0V8oOkymcp9oX 7IurycXaGKZX3FBV20QTpOKZPuByNbTr4SP1Rnd2+4rqA2o2ppsgZJXKXelTnhjJoOztmVIbrorg UbUrGt7is+qNX5k8vZExrTfzEKb7RVQhUy/3ztbMreepbIhK+qm4v1JPxNemUspXJMcbLdGdSd/t 9vi7+Oe4RHezR29cl/QxqZDDcpdZq+Z8M6uRVTc/HvV2bxD5yotqB17/4jNmDv7uhFpab31E1ihi 9E/f2x/5zX7k9jS06g8fStCojegPRI+7t4cJuhtkmS2Vsj06UolmUU77YzyXv1rHubvtTw939tNj lonzc8DtNTufAOtwg2S+KN1VEfFcpXxiXfKb3WgNt7emUv9eM9F56iOZEikPfO+mfRKg/GrTv+by P94zCQnXTKzBbFmXXiq1n9CD4e333jQKl/1ZJVs5eTZITe41Hm4yXOF+ZTxYbIUqfGr9YqUHlGUY I7O3jbhyJZrSQuZjjTj2WX42T5wI0yN+PgOtzAAm16CFenvW89DylM48tbhiJXwaO7aahKf8F02c SgTXZToKNbSniR8Clq5CvXoyTSNVM5yl39r4K1+FlFdVUy8lZj616BlC35jm84c6YcHneXiEMtDC 3JTuKv27jNJ8QIeCC84SEMjRbMlghaumNco/o01GeSzibk6k0vQbRaDa5dlmDImtkZMjEeqQ3hxX rWFncaadaKb8PUI20s/pETksqQgagwEt3OjztzkXyTGbaBNVyCsfp9rZsG9dcyyn5HJMIKenXtRG /XYQd72Lxp9c1GQyHjWGu9WBjD61JiYfYrKy2lhM3qduI0Fr2FmezcSa1/lCZ7OqqnH7FttqKS1A Xz0Z+LMsgxI8OURfZC5XdUjxy+/Umvlbz8sDSDI4DkWkJAiY2lzr5YFBhWCb1GJd3G04vPH7mHaC FS6pqpjhE2sX6qY6qENJxbiru3zcN+jHq+FooFaONap6bapH6+WALv1L2ancrF7dtcFoNBrUv/Ua 6A6iIxkVQlsdaTjFt/gl4zwsdMJeuFKWhNQTLSAG//4u494hQSq+UYL6GD1dMPE8t3ys1ceEKhqi hmk40SdaXNZCNpa7WZDnp42nMcI/xxIi/kuIyC79p6SkbBev2dSyGpF1Lle9fq/FZVMqzU1hYjuo PX1mc6uVz++ObuPOVbXDIpOjTdwZmk9oVEJtJCqFW40xshJ63xUa5oRl367SR++6oglYf8pIdFEV /Vl3Y/5yOVy1lGos1iza1KurS+ZG7cs2U/k3EuZGcbmCojCyK8qnjQyQHOv1ujzEOVLPXaGmTR+k SQHuaVSAJPmHNRqHcH2Hw6LjEBzjqUy+4gYPDSk+5ClusTxF4uSyj2RM9ge9qCJAqJqeHsGcD1Jx lzlWLTv5/D6xNvGjFkFT68Ik3b3iSaLLjeqwTEc+9ukbU6l5kh5Gvm4JMxmuFbQqZOfXI7ESXxcS UcQz1rw1yN8dkP0k36Njkp9+Do/xXP7561z4au6nh7WfF07JDDESoqpGqaNq0YZ1/tigeFwQt3aL UqDLuuCvMH/vSoYEUk99SDe1p5Ly2W4CoVtSdlHjrhS5iueMn+5oOlLi+0U+nVJySKwPEswC5nZo 1L48XtK0aLsoXa0hJJUHnfhy90VH+AEiBiEuP4mgVDLeR98IfNOlU3F67vjZpQXrfYHf/JLv1WL7 Ve7SFbgiv1g9vcbDqNCIyzm5aCO1ni9yIhrZof9maErvSJOvSigv2zPQOaFcvuoAJnevtjwPs57S 9KySP3nZSjKvp7HSam/+dAV1hDxNLL6S3JERvtGTkzH+GcccAg3L78dMrxYjGJ/9F1cnPvwwJCOH 8QWZjHJUX2vmcT2r53m8lb839eHKMN2V1kefUwFK5cfVwFE6AjnaJRlcZ3z7pGI81qk09NRIqCaX ghPf3bnUX46MCnvLwZL5oKbbgiWGfB4Wju0QIt5GFSr+0e2QQi4vvaiGfdN2KmPpv6Ws0wcDtqTs ldUVh31ka4s1r1PxdCqq1eibN53mJ4mT0JhtGXhwzofb/BYolIJ8MmcazjI6pci2jkrD+20s1/Tf DGfEzxSkyEQtzLxkGP1LPysFCmb8IK/+jCy/ECntnPouebbZtc74ik+nw1xZvREde4VZnhwOUfds 7MVUKkeKUQHHbotPKpSKSTzHLW8McRtsIzPxvSPGvRbUNFvAr4aUZSOpLoa7Di0r60Rt19BnDErS +pApE4uHiy5z0JIDg4N3rJUfeMoDRw8jNU5mYGD5OmaJStZgszSixWuEbc7eb2VyNNhzG+LUoRBF e9lLJVtQoktGa8xxJicohANXTf/etz9tRKaJvgh/s0/yj3WZGiXFt4By+yS6alyVmYeYHBNyJ5c/ nqTiJIrU1tErVKhIerDsD/EzFJVIjmF6G6l0xjdUdmD6khDq0taIetWcwufzkw1NeZu1o9Dc831G p9WEVc4cIeuzXzJ6cIzEYJUcL4mM9AeI2RAJ/krSO48cm/mNji2fclKD5Ht0iDvRa3z1ZKqTyz8T Yi6uwk+P2acq5I8383xOxbgH8mF5jEg+7G2MScSY2ZV9N/Ewtd4Y4qZi8qc6ihcwfr/i0X6FO6xb AC3PWJFm5rumQG2SsaA5DySd5keB+f2uPOioKf3d+hNC3rbyZxZKPFzr47F5MkqFDA6Zuc22X5kR Z+WwP6Cy7p0iRlwpKnmmmeJt/HtM5lFJxRE3kcVnVmW0BZbfO9m9nX/T46d3JiPLU5pSsVdWJjyv p7HSaoWaWHxNuMwHBT2SI3TjW77m9F8YNJ5B5/YrDw0bAsup/M6StdairBPJ5msJMZvneaSWEjAe buLGmY/h1VKMQieUMY4SEijE23lwlRwWk5fECKBhR6/ZP2k8LZSCFqyt8lZ4PBVeaabXTgTl09VN E3j4cZqMtgd9lW5vY1C3blQ05PqZ3f6lloqJn1P1gXpiKBpsqnGLR31yhNw+t6sq2B7kkT310Yxd LyknHhjTYMTIfCYR7QrStFJxX+QrUqa+NFdhRyjSHrZP/BMcbQ9G26mOOhUXv0W75U/fNv72KOI5 RuOKrjNkBqqq2RGR5kt588a7eUaKaARvUE6HGKHJbG4Pka9me2tan0HnjXyajJ2INK/zVBnanGrE iAwc5sAgq6VkxWJ++hnZDG18sdoKP4tTfqz5erv5V6Zs6yTViyrFf5U1wfZIuF1Ox5VP5oxAk7+r e405Tqa+M4qRDImJEHKUlWhn6hYDhAwnf1+V303Kd7GRCH+GRToNxldztMlN86BE7pkBQHSHjyaP eWmKsluY/2hxgCIk4ywZ9MD2JlZzIneSTOSUiIemn1XV+rzr5O8q+tiDrke3+byVdGd5fNt6C1cq Z3+QBjLli8YoRrSR79QGmmlWHDHHW17+RupTprQZyWuRdjHiyoGaAfAMJW6rjDTLETjW5BW/dRtp p7VmvhlcVa00IVCjH5GrzF/+Z2Jijitf9tYHE/oDi+Z0cQwPTyx3B6Vpe0ZYgV2eEP0Q3R6OKLNz bSOHpJhXQCYkkZhoIN3mwuWRX7jCnJdrRNGc6Y00aUe3FLsb5I+uKS3WHfJVeJrbIwHR/dzVgcSM Fmnk0QtVQv4CzBmJ8UxmTDjEqtYc+ppoOKRQ9C7FbKR3RWWYFKquYQOKOORvwoZISUjbrnEXJOkW bZCGDz14ulf0HAJCHr31GbuDcd3hM7tI1P76DA1qEprvZwpmalEJ3FXVzBBy/rQis8lXNadbLEGP x1qvu9If1mcse0KGHYrGflVNkbAwaPKIS88g6jV/f0in48LGZ/5aIn8tdxs2+tg2d0ZoyOj6Y8cV HE6nZ3qpxUI8LYoP/Rd+c8KAMF7LiZf5Hh1yxFsf1KccuKv0qRq5/Ckn5iC/QHjhQKQrHDmrJUdi oW0++vqIdMnpYTzRThumqc7crbyNYsapbl5X7lBRcvpnPD2UZjMuyc/ephoaFVRVemuawmTooUcZ MaevqrDe/+k7RjxCqRMmo1UVNT7+3iE7l5lgkuxwvtYQjwHk15B8ONDvhCaxTI7JxJhxq1NqlYFe 3crvMQKTcjF/O9WfsTKCru/IUn8i6K300vOWHsVisJ2MyEUKRGOdP9QVCdsWUIzQVxsZaIxC5Hp2 2WQIdSG9bBSbEHjklPIi+xWPgpThwT/V/JieaZ51PDeGgLsrPG4aX4n7OkEjMbebsNNjz7Ct2x9Q 9ntHHXGNhL1uT1W111stFhdM9voYThU9jjSziSjXLDUn08zIrlxfTJcSkR3NNK/e3xaWM/A9tcKo TQZZdQAje3VjKKxPMjfm7RvPQzMj61OaSmavrGwn+j028zSmRxA3MY2j3DS9s6qyhqR3gtb1VIiK r6NbI0gdmChSKzu2mkzT9n0hPcUPU3wnhY2ZVJn9H+RgrzpEU714sEIzkWQc+V/MSvVUVlFvpC8F am4qHs0AV/MKDifj4ls7YH0yyzDFP88TcsZCZSCR1MSjrMDDVi3mPN1UbxwlJFC4ObIeUElx8/rE D1ZxuWRM/lol+qd3Bw+u6PdMT31YDnE1NhZX8e+6WlSMTuhn7cxDsqY1EhFfqblMSPLJ4KpsjvRF wm0B+UXj75LLQLTIDj+PR8WPHroKYzo1kRMRMYFKH1SLXyQa+Od0nqRNAdifltj4xcomqe/M57a9 SMLCJRWQPrXG7ZPLqWz0bN+/tlMjsHzCKD8xGRfoU4+ij7hoqCN0avWOsLEExlPNq4JoBCuskDQf jL6OaDIJf/vKqWJynpgY4nK60Ua3l4a7WizYyF+J+g/a/HsyzXthhlofiyzp79RSTIyfNrXim32S pm852O/ibQ3uCi89eSx/pEEy+poLYx5UKjcrTU1IXfMbVlwXvYt/2CQhLAYVNMtRfrFK1eBvi0S6 I0E50FXXoehf9FWh/7+9e2lt5OsTPC+oVxTvYqylpv0KhF+AEcNgDMOQaDEkmqFJDNNkaZWDkqbB WWAQRbsIdzU18jxkg/5MLpQDSbkXCfIDudDCCy1c4PldzomLQhc7Q34yFf+vSJx2KC4nPnEi4vzi XOJmkl5fDqxDirT6K9yvW1kYm6UkRIVeuVbJ6j6bl9U9f2rFXKsvF947bfsX4zurKkq15kKKweXd sVVobU4SasA35Aqbz6lPrUGvPwcIdXah7CEzaSk6GXiLYiuE7Nip9fkhtnj0Vsq27fDD70qys89Z udViSAJWTnl/7Ly1UccG6qdQTyQBZuHmtmHmSnz39BTaH0oBppBLvXxiqrElodXG2sxexyQZ0itQ 5jehcVFy2u9pOwEpRob7rMtokyp5LnQTHlhpc039hAezsYHMk0X0Xtm0s0ShYWnH2oJ6u9CedFiT JmqxL8nFzTS7NHXejae31tIsVuZ6qjrvLic36eUHD8LaWfQXDmq8sEihLpZsLdFWyZVIYf4mTa9T KdhLls52YfFZW5p5kGJ1K65h2fiHFGK7qz0HQ7G/1daoIV9PloaVX/xEWEmSninH1l7arlGt41L7 7awjiXUSWVlf6U9f+Zpd23CK+TMl3cPTkQhn9xRZqZb9tI/MPOSMM6u1lHrSYgvM4mMie55vWF4u 0uunxnHljz8/kd2PT0j8a6/7ixcWmeaZ329w6yolw1p9NnF/N7r8YJdVaT4qeXPTdGmJIeeIhUgx JYk8JJzKldySLtl+OvUuqPJ3Z/x56o8g9F75jKtHeV9Lf/lzAGmturiRdMYaiselTW9P7pcyRoou IMLHoztrZyuNXcPl4Ls8/DmfP9gzXo/vvGIiuxT7ph50pJT5/XxxP7+T9pC+tmQo/6feOLbl7TGe Ed9p98/2OHb0zp/UfQ9tks+zVtwP83iettOsw++ma1clvpNGm3Pt0926kCuMjNBk4djTs/KVdFGx coIkNBQPvmodYrxETHWQATsfrSTTs0tretaOD8dWL1DhxFxb4tIHjLqt7Ppst/JYSer4cqpcSWGj Xby5+DqzsEtm3HBj8mcOmgVHtxK06omoS60UYGKubr8dT73uIO7s1qu05gMrRRTOL0tzMb7z2itP /FhrssLMnmAtCOnVT9odWS5de9RsnZ6S4i7rZC9B6f5JCdkLNja3/Ig7ZV/mlaHxay2Jee/d9MdS ExmDO5nBt2ULttY9VtV1vOR6vih0EvRWKHkqXvU33wV+7ktg98GqXKDsOUDeEskvmPLowAt7yelA iuW9vGC/sMqY/vhaihD22M2bzNlqY0ynjXni76spisWATv9tv2tDuMi+X2SdhqQ5RKEs55dfL6LY Uwg7N62okFUx55do2VTxQdOGJHkCwnNsjz4qN2tPtM+ZNQpa+TPuWGi9s3ri29dxZ+0Znh3jThbd 6BXbWqxplKoN9fOar1Cy8rotL4fY9UFns4b9snJ/5GX1d9o2MhsjJd/r9UfKmqbHlZS14x5J7+CL 7kmvd1r+d9INozFk8/kvmpKwQi9aFPtEZA9OZd5wpPxOF67MMqxKv3/qUb6UTy7yal/PqK2k96bf 0xKmfjrvsvhOHy0UNxQSFZayfOK/V2on8wZ7VrDxErJNDK2JvPR7bjWJy2maJ8m3YXkmPiyNIXys SA3JsP/8thgL2CGm87KOZvKkdyGFk9BJRxfwq/qOnQrl0nJ+CHvdy1tDxXT4OiUPP2vllqlWT/nQ yDM21YtrLv2/nnrpzxiTUqvCeOOrHpfV+jvdQrzTtbMuk9b4zcq6loKY5SSGmkgu8dZZ1h1G86TX KEn1pc0bTtWe1QPGNVvGkh8nw1lWOxC3m5xdykOt5feJPchygR0lCm9v1v84Tq8kwrLlWtaE1bJN iB/95I1DV2ntWLk80zru9d/02qFo3k2LPcVkT8IT+NVbf7jaHPUG7waDt4Nzi8vyUll2ajw+pSfy +GjiHTbThTzcaGc9Hw0q/Ih1r8UKl+L3hd/XJsmfk4SKmKX08fdzKl/sm3WhleLlmqrhfC75bdOu bT7FSvcRzYdROC/7/QhDMNnTs1kpvpOrkyxicdxCWq6ejVMrBp9LWVqPY367LKQyLJIHL/pdJbf4 UbAr/4Ybiq2ynENmH+1pnjwn3Do9PO+yTdhTGl2V3U+zZxoafXo3Q2tLZoXtkDG2XT0sTRt+xOcA uuYQtumc4crvz+Pkb42gJSLTinj5eLtcuXO19WmSdci1C0J48pDVq9o2F1/Svj3fkwVD/JXH46GQ 7P2eRhvr7/QGO3gnjNYew1Ybjs6x1lDLR6Hi7/LnYpqOPo36MlE/scrDrarXrmp8J6uw+L1cMHhm vrLnS1nxwHNRzMA5rF+ZT20EqodpGmqoV7NcLIRsKHH5SkLl9VyA5IJQ+tguF0qA+qWvs7xrGwoq dt0Lc9oFIfzuOdnvm/Z7ErsDW2P40L19+1V6zfllSc/P8XJZMdzlY55MrSmFHN1ChfLao6Yr9ZSU d9k3lrXWkDXJgCc2UX6E00pzj3x6WcOk+L3+Hx5gSt6MTzzs2/Je9/JreHHZsH4ttOy8nsfGEpqS 6gBWxbXu93fdHp/9Cew+OisXKL84F65X3oRAs3GeP/NGdP6sT9phSvOPsbR30gfFE20fZWdoDIX0 6uTx3fTjoP9GCxv9s37oheoPLbNGRIupV+vExxTFYnD5HqEL6kMk7/9ebgATnsmULjsbkuQxYLgV 6qObUPW2Mamx6L7hduyXU13JpjUkb8bzH/L4sTjOcGk3/TQv1kZZwTg8M7ewSJ8YL6eD1knsBZZd Hh/tulroIBAeIFvwUj1S9jgre4ZTTsbu3LNmDgsYW903/b4EYl5FEjvzytwh8XbrWWhlSvYY0N3y rBVG8JCmlR4AxowaNinDeXmbHwsWnlkbpcXrQt72VXmSOu//0IeiZ6l0ol/IOD9aZyrPdec6BlEh 51eL1rLOYkekDblCN2X3qayjX5E6FgVLvTM8t++ov5PVrskPW57Ax95nLxDTy1F+XKSkYz1kw2ni hqs/48GKd079PtYjZAJxIU9tKFHEiXIDXRff+YWleBCLz2B1Yeswnl15ZlcX4VmAFcn8RplXD1lh w2f2r0ZfF96FP7bMzNIj8Uhck4LIxwvAnm9X67OyEoVFlN2RNPS6GutDMLlCTjW6LF+atA4oewKm hyZWB8dUhWQsvljtnhS6smJDyFeFPkExySErZpfWp6dh0s7GI5K5vGHA+XtpB96Wdpvebqf7dmQV UsVDF9eYhSfhmYw2b5PTXK7nAxkvotAlxLL6apJCz+i4bLbS8ItfuMIjvlJF5KYLafEK6bu27RQr PCcsCmdHSpIRRhySW8D1pbT3KxLYxarVPruQdiNaM3JvDWVPBtK8tpiM0k6t3Nrsu4leWErd0DTS sGf1Wy4d4X6aHcpFHOvMb2rrpheudRpDxdxVvOzIrVMOdbhX+ib0Rr/r6hFXVdrX4h+xf24IlPwr u+DEbcmkGJGFy4K0W3uYioQ+/ipePUINV2FBX12cJ2xX1xaPV+zL2f0wvjjurnueJu2rNUCWT9bm 1tfj91l/LKZ3xngahq3of6EnSCjYx2QUs4rM5KdtmCcuXDrl48Tn5avSUQtRTDW+ewoP0DQ8uI7D amXnbEzi6mVhtcQVWuFqlbQ8b1kVsJRUehav3bU1N6bV654G8plkKKiITDlXWxQWnhjH6+HGq7RG 5ZXWBdk57pltbVlRD4jHtlImKVyj1u6azLv2EOtK7DOfWiMBzWK9lQLMzDrQyRdrn2L5E0hr/hTX lW3r8yyMe5/EQlE+i/72zOu59/kdTmU0YG3cJZ9Cl9XyGvf9l2+On/sS2H18Vi5Q/ty12DY4e97i c3rK5Grsq/aoIbu/+EQ5O7JwQ6fk8Z2MHC7t87XFe9L2KrNwtYlBk8ztl4V4Eyld2Yr3CFtQowM/ I2JHklIMWDo3NyRJ7up+1kiz50stwoUmJTuTWk257auPVKD3o41rWOFyokLxw8uoxdHkzCSWIR+0 m3YifTFOvGuhLp+D+zUqi2KyvV5/pLxvdVZ6L2nbevXH4utEg3etos3/6ZTYyDybU+aVNijnH1Np TqZF2dv0wp57Z+09nh68EW93fJtqU6G8EYJtunhlDvkt7vVKRpVNWs70Sk8PKlcrhmQefyDmT8Oq a9B0h9hq+N/+EqpHVs49f4ooo3vFJ8axzZ4sq1Wi7fLRXJ8rZNb7v2r8mAdKRWrfd99w/tjcH1xs 3KksIFqTH/zZaTa2gO6nf7yzoVR2v0Bs5ZQPBYZ1taVxK6USmk/09nhaAxLLGTJdBszVVq/esW61 CCedfWITo2y95bKfTQ6PPnQ99rGjrFcPjxesD7ufPnqtCN3ZYhqymbN76BdZSejol3WwCmuW/+TV W1J/Z+X27PT0BmmrZbnpwHt8hEtWocDgaytdmuwKmd3TZ1J9FotV1VKEFWBioUiiZi2iyyfPNprM H/MsnTHUtc1Kw7DCJ6uPC4P4hbK0rG1thZSu2ItPIukfHflf+i5Jy+2jJKuM25SkP/6DlODWdqTS lWloZkVWi4BiYwbbzMYLaeGuoW3ejHHbKZYXiXPhrOzne+TgRhrjBf8iRD1KbS1XQyaRv4ttYn3e sITHd8VEajYzhCw8t/aHfrPbfOmQIRm1JBzvieEssEy+Ybo0tLOs3pV+cPpej2ycq+Jlxy+h8Qmb jbSg2ThUwG2+eqzr/lPa8dCVMtTK+VfFe7dOeYwtYGNVr0iGJivFC7X/bjWnxU2sXmGytdlMecZu tWJZvbTjhaNcamfug1e0Ti4m1og3VvSXtlxtFFR83OSzVk9bmV4+5eM6n5WvSokPp2GemSVrZBfP rA9vGJO8es5Ws1m5xBUGX0reXMoTLa2hLnz02VfcbmHyhl1bc2Mqz5llOVlXMYcXfw+nTNjBCCsL rL9K77gaW7X72rKi7s6Dv40rH6JKpq0/avn9Il4KNUXTYd6wTdfmDxHC40TPyUf60CN7A0i1J510 /7eLT6l5TNjrr7poaGAduxXIpOyTZ3sflHXD9TyV9iHxYYgvkt3LslW90i+2a/zYm8Duw1S8lurc fgfPG+z5zVrPCDvpuh+nEztH4piE2vZSSxcxm0szZs0tpTM0j++q6alebXxs4VgsKV3ZivcIW1Af hMaW3uGBVSjLWYGqdG5uTpIucjpMry7Ht9lTr2pKw5mePa0NKS8V78OgHzHxqytZt4jPU9rNcPPK CvDarUCQsygs62WgPcXCJ9877x4Vy3t2fDXNNuRd9Uj59TC74mn5zS5Bcb36/8yGjq9mytX3MUnu 0dfwFVKlU6SaVa4neXsD2UT3/eX402X5XYGe8bL7lCypYWx+51rNqPK9tebySDbsXalFkKQ8PNHy 5l6VNcgMPhSY36ClN8f8u3brkNpV64nZHn+ZS7/y5XQ0tJHh5943KtaNysqLF8b03VBy4/pDrPXC /f9s/SizyiOntvPG9v3kcuaveAhjesgtb/0wKaWd0uOzJj/4g8r2yqs3QmcWe/r3PDEpOqye8uEo 66EpVgZZQpYTHy1nlTrclVaelt996NogHtb6qNyaS26WUiodrjRElG2srjk8DsqaZz/daxW8ZHhv eBBa23pvSrkmWLzvDTI1wVZf771ZY8nBDki8M1YGb5dlPHaOjx3k7LDrYalJj5Su34TSuCej0BpH Tk9dtnRp8gcFMRDQq9zG+M4fyMT47t6GwdRq33j91b2SIf460uhufVa0GcKP2JQuS7wFy7Ebb3HO 8HvlJK3OszlJ/znV/kedLE/K1pNwmSoNehwL/Fkv4+pGNu2ax4YbT7FYNC1G0Ivbvr+jKm5FruGS zDUV/T4mcHZO+ZGtlu3jekLLrpV7gac8f95lMaC3Tly/U3bpWNjlPbv1eL7VNzJsmi6J0MdfvfH1 +PJqUhgMqnSjscbD8ZJrq/Izzpq5ynBVk3xf5Lfs6lGaWvljqUNZjm70hWjamS4+2Sjeu3WZRdqO hUw/9WTuECmXz/HwbfbE0jdYnqe4Nv8+HB0ZGSCcGaUdt8T0pt+sv3mh9GKXl2R4Nb78tH6MNV25 HrIkDiRbHn7ct7228C+XTTvWK6eqLPGMfFVKvKypcO/wZ1ZWI7yc9v09U/cTe7ln6ISoM+cBYLws xKuNJKBc4tJ98MeAulQ8fDJRo5LCk//59TC8rnTLroXukHmRwBGKdXbhIp8XYEKsl+X2YivKnVfp 7VdjLytmV/XsuZ/usz0dksEZvJl6dg3ZdNRKKbHlpaAgPa2LYiYf3qqzcufK8nzx5a1WfOql/u6n WMyQdZe2FZ6QS+uIWMniW5efz7qe2x0kP5vs5pu9xCFb1ev8opcEPvsT2H2U/HZcCCX8FIjPrq3G 32+L9jTGB1uwV5WFMVqte69c8HqXt/JuFHmYbJc+eZ5mpSxNgF+KC9m1mKrwNha5lciVJH+vWf6c v3Qp06JUOIP8oZOehvEJ2MXNTFbg4zKdf0i1majfPa01oD4wXJskKxCev79MbyeT28l0OtMXda37 5Em1b/3E17PMUn73eeyve06q511cmwc7a2pk/GHUUd6gJY5UZh2FrMCTP7yNl1MdqCH7FC6P4dJx PJwt5D1xWqZqHffTL/O1Ryrshbyz9dtCBlLzkEreoVwykB3c9C9LgP6iw+5l1RDxmzAcx4UNlmeP C9rDT6lQq/aXu7ih+Joe6fQkMbu86ssq/vLXx3iR+8gGDpUX5H0JL8jLCoHx4dV5Nijf9IM9e/Dx TCQ1RqQRrja5XM6z99/JkJhZ7U9MdCiNyF7LXknQGosiWgdnrVOmGjJIYfViYC1RdSA4y+Eedcob S7UCRT4yFMCXVNIhsbCfWRIwpV9m4T1K4TK71HEe7ej7rVbGjfGEbN6p0rXdD2IpP8jdygCzWhV5 06U/Tsy7CoahLDeLbTjlJW0THxpI9iUOTbC8n+qp53vkBysG9f4MIdSMh4y0lKHeBNBv9KGNlrzr 2R9YPC6s1eW6TujhepU/LpB+dvrEM441PdOx6K2rnR2g7vt0+vnScnVbGkneLfxRSYhMi2VOb5YZ 3pYlxc9YB5ENcq5H5MHfTJ1kBRudGDpNJNnbJ2c2ylkorMbhOLrvLqefU2187jXCWbsIWYPlzKy/ rQ3CFvbdrwP2Ii2t7YyDT3pYFLoahWu1wy4X04+h0Z1nxXVXG021f2z9+YMj76Tvr/mLsxT/9zi9 1Miz+LWUAX2IgPVJWnjbhlb79OLyk46B7COgeqvIYrlXYi45pHJQi4Wf4oY27dqWU0zP3HiBtTA2 jBCuY+/kpR3bSGgpGkZMyrbrWSJPp2W8bvEinM1qv/hT+uIjIJtshXNpJaJ/2Ekary1bLh3+sCu7 KdvZYXWslrvWTLeSXnI2TG/0Mjv5PL2L76ks3U/1HIl9V213Yn2NvEFJD0D+jq3s6lGsf7f9Wfkx jq/QDbsvd3b72LmWVSP6cBAx49l1Jn/pwGqZJDSw0e7Y8YHm4sulnfWhjtXybVxbTJANHRCjVyu9 ZxnATvaO3D7DAIxHsdGOtsk8v7zx29N09s22J2NhHcnb6id6o5dBMLJShGyofKGLWw7PFbMXloXp VhqJHU+yecOlZmu+srqqmHtlSW//PLyZ3dn4aZLo4c2dXEba8ZmbdqENtfDxxprR2ZVNg3fZnXUl Lk2ZXZ2K76QINZvH/Yu32vOifyY5Jw/evaCVP7WIO1e9MXmHyjAgsG0lPG0rFGDCnTqWGG1nQ6lv 91V6+9XYbxY6wsN0NvX7Qsgh2o/bC7qe/eLNy3etetT8KWvpEPsj0+wNvAu/4cbY1o5+GGPBfOJw UnF0UFvcb4j+VXzs5leMQm24p1COuhQzIrX//5zruZUD26GFv70mKX/gWV7b3v/Sawqf/QlsP0DS uibflI0H6/PP/CWex72u3hMHWgS/D0MoS9lpeDvzlxHIslKOlWtcYTSejpZ85BooC+onGV5P4tjg a9obZ+vxuf2njEscxqeyMWN9Yvt0+Mc/hdQmp8NJHOBOkidPCJdfx1razj7ymoP34z/+Wd8vYJ/2 8F/+2JgkaySQLWq/rN4phKWU1KPBX/7BSyCl5bpnF965Zi17Vimvy5RGhvQxP3Vy+zR7pe/SR83q nJ7LXmQDRcY1S+1GvC/LJHleF4em6b2X+6mOXaCri5/u2WD8WQoUlSNlqwvvAY8zJyfnw6v41DNu 7zn/+01HDnqxx660rYortuFAv4YhFLKJEsHJe7TzmbIv9F0VoW93KaPGGfT1CnJTK37uw2up2ydd L9JffIpjf+mIzasfGR55dL1+T+3xb+hEH0Lgo66eDolFQ36t1hJG/pEb9CSM55xPzH7zMCGf4dj2 WAqWmsnDiuTYzXQ8N/vEIseT7JQ+gG1JQzj7IhkUXsYU976cH+LU6cdQTm7b+agj0q8MM75FbNsp rxu4y85BS5b86Jt2+WDJ0Hz/MX5f/T8OUyDPkDUqKXzWvVFlEocu1/mSdtbhK57+nXPtIB9Ht/sR M9VRNiq+B/IL60mXdO2xtvYC1kF382Mpo8S7n8fasikZitYG49VD1j4bVp8G6CjrmqbsI8Pvx+KU nHXT0GlOvg5D0Ge2SXd0O/FXJMi38lTKHpHpepLu//6//Ls8VTpJPzrWvScgDHPtk1d+Ho/+SzEr 2hj1MVOU/pfWidkblvULvRjGVyOVZrQhxPOtJL135codm3l7kuQ2Ime6Vevoino2MmF2XZUXhoRh 58tXg/NKAJWfRLKWyq7l32anWOHq3XufC7f/1/+UH/fiBVn2ReqqiuNnOoXi9Cwu87/1cdZ45YQK c87thR3BKznqFftLWn6Tr5KOHN6Yz/Nkh4Xy/+zSkQ1JLaPrt2Twn1gvtnF6nufimqRpdHw+IPnw chpekSAJkfdW25MHnTPRAR7tE64eOmC+Xnmk76G9/Mi/XP/Ty6Udq0UKj9dkwTepnLkxK7cvbuaF nW17RcnkrB0e9WQXQE1MN3ObXWd3c/1CPp2z4dReJF1dW0ycVLXbs4jCNVbusFf/PuRB+X0WHmnK +mRYWqmLX71LaDul8M4j26qUf2I/09ULnSWmUPixRMaLiY7A7yuQnP8u9pr3hG7PV2FIcF04Kx7E gYIl/5wP5Dle0tV7ZRid2I9XeyQPOsunUv/qLjvdYlr0/7zEFeHkTJX7UKhlk4n+iN5e1pQtmDXG mH44j0M/yWWhvGvaDKNYUAlDGMllbJxnuXY6LRRg/sNVfkMsXg//5/8rP1vtQuqJLV6lfcr2q/E8 RMS633ZENL4LZTNr9Jhfro8Gf/zLuqOWl29NLx5iQZOHSG07WQLVkYzErhFYKaskXRkcTBMZy2ya lH//n7zh5YW+K0QeaITTpf+PWcFVt9XVq66U4vTKET+FIVwkBc+6ni8urVTmJQq5JeX3Khd8tZ8x zfy/H4GfP1CPS22uFh/67VyPvB9lsanea+fCe5nBqkv0kdQLP/qG6yN5FchSd+GH/LuTio81HX9e uNr9zP6wkBaDpVfPPH+91ldIZy+brD9SjzK3rbo88/O39sw507dtufsvJXcpteyddMfLGwM/cyXb Z/OOJ3L+VJ6cb19u17eewXbNtft7rdTTuXQA89hgbOdSUg/on51zrs7g1LJwpY4ym7OOmF4lZKDy H/u4RUi9rX88K2bpe94vCxuzaGXekKtl6krG1qPwgs0s72ezb9qpbcvHzizZgXWrlaMgX6z7ZssK /zZfrabq9ROp15qtknV3/KdOsdWNrnVYmfi48vfqOrb8LWlcld8yt3/lTQKq26xOv5eCdMdeRuA3 tYWc49mAhDu3k88Q3nkkV9NO1i5CvrWyQVizX8nXnn35evb0W36KPTP/PHM2T54NUH8hD0KlLOC3 Jx0Kw0a7lRl+4ng9f69Xjulz8pUedNvAyj7u5T5lb7AtPMp4/p78LnPmWaWaIint2MW/3D6zOt+L p4R7il3t198IXrzKFy+welVZyVrZ+gxh+x0tm3dfv+wnqmEtUWBfx6Wx67E68di+xfZyMTuPjRwa u9e/asdsPORip/XF18s1z8lrJ2+mQwrY5+RiKm1sVu6Atde/lxUUG0rtZYV1VnIQYnV2kGX/hAK/ 1Sn2t/SXRpLZQGG6XRlt+DQZWCfiFyfjYWavmtXL6cXVVB8TxSbHdoUt/tjzk7oXJ7XeAv6mlfDi M1vV7FOv8F7sems/jKUX6cfR+HYqfdD0vbpN/4T47rcsHjTSvnix4Pf6Ao3MJPvdKalRCs7W8kXa OowKbav2u60/+9rsAalrJ64tfd/2UfOzBnY5n16PBm96naN23vRrzXy/ZlLWf3AYW0P9mnQUt/p7 ixVTyu8I7BT4HU+xnYne0wzaKKV8Vzsvjuz38q0svk5H7we9k45ct7t5g7SXr+h3XkIrPUtq+r7L 3znBe0/bUl5R4Z91fZ/3vrlfukLp4z/UxyAy2pv1rPylifmTbDxkLv7bk8CfJNvU3M3F95mN5z8J /alrro7FtwrMv0z1PQu3eZf/rbM38cvHRfrpUt8fcZOON3QAbOJus08I/K0EOMUW86ldYXQMK2oo npnvHhezzxO5PU0+z7Y0aH/myg5xtrvPckuyVxgfYupfkubZTXgh6fgqvdvceeElq2TeHQJ7CmtY TRDYwc3XCCCAAAIIIIAAAggggMCrCRCY7Vfg1Q4UK0YAAQQQQAABBBBAAAEEdgjsN7phbTu4+RoB BBBAAAEEEEAAAQQQeDUBIrL9CrzagWLFCCCAAAIIIIAAAggggMAOgf1GN6xtBzdfI4AAAggggAAC CCCAAAKvJkBEtl+BVztQrBgBBBBAAAEEEEAAAQQQ2CGw3+iGte3g5msEEEAAAQQQQAABBBBA4NUE iMj2K/BqB4oVI4AAAggggAACCCCAAAI7BPYb3bC2Hdx8jQACCCCAAAIIIIAAAgi8mgAR2X4FXu1A sWIEEEAAAQQQQAABBBBAYIfAfqMb1raDm68RQAABBBBAAAEEEEAAgVcTICLbr8CrHShWjAACCCCA AAIIIIAAAgjsENhvdMPadnDzNQIIIIAAAggggAACCCDwagJEZPsVeLUDxYoRQAABBBBAAAEEEEAA gR0C+41uWNsObr5GAAEEEEAAAQQQQAABBF5NgIhsvwKvdqBYMQIIIIAAAggggAACCCCwQ2C/0Q1r 28HN1wgggAACCCCAAAIIIIDAqwkQke1X4NUOFCtGAAEEEEAAAQQQQAABBHYI7De6YW07uF/69XKx WCxfulDN+Zf38/nDy9ax/LFYPtoij8v5t/nLFv5d5158m82+3i1eSPGivcndXrTYysyPy4C/Mn1f f8r6/9Z5cF9JZz0IIIAAAggggMCfToCIbL8CGzLQcnSycTvdD7M1S/2Y9I4SWSZ5N13z7c9OSt92 VtORdAYf04VHZ7Lax6lutTV8Zol+cTts6/zJ1BaYvde/LvyPn02kL1dK6tHgL/840O2UPknv7Wjy dbFpO5N33dLs8sdR9+Lj5Dm7NvvQbSUd27XW+PumLfz89BW3n17R8ttYjld6/9MreMaCi4k4jL5s dH7GKpgFAQQQQAABBBBA4G8ksFoA5u96AhsO23J01Op9nGpl0I+phljJxfzxafnjbnjSar9fF989 PS2/p1J072z4dsOGdk9efL6Q7bctbFwu5qkHQUejGPUsxm/PB5/WJ2nt2qfvZIc6M1t+8WV8fnox 21MoEJL6duLbXX4ZqdzZWDe1XN5N0/MjO1onwzw+LSexvLN3ozcWsZ2Oy3NV/vp+qRGrxLyLaf90 MHudKryiWyUFz5rgIK8b3HlCllML8WIeeVbqmAkBBBBAAAEEEEDgFwhY+ZgfexPYcAiXo9OLEPQ8 zrRW6TjGU98ve5siuMeZBE6bor8NG9o9eflVo6RC2LgcapTU/uk6t7tPskMhvtu9+ZfMEZIa6zdX /vQ1pVtDttWddfxWZ/vOLr8MdY+yOs2XpPn589Z1e9CYa/B5T7H0rnQvPkv9aXv6OqHuro3zPQII IIAAAggggMBzBfYW2LAiE9jtvhLf2QLLb2lP6uq0ZWTS/xAbEObx3WJ01u0ctdtHneGt9m5bfB5Z RVQrOe5PtW3ecno1Oj9OOm9HozfWAvOov6nWaTVKepz1NOVdD2fmX6ejd73Ews/ld/n9PGl1R1cj W2nrPK/XW3r7yUTTbItL3c7DfHo9kmalwy/yx7Yk5fsrrUM/XKZX49mPNXIr0dnKn2GBx7tzTUCS PmMNTxYTZTu7TvJpfOa0rUT2LTlXlsf5KExM+h+tuaztaffoPP081mj9f/jf/uv/k/aPO8ObyfBE RNpap/ZjGqoXk+7oc9YncZ3bml3fPWmqTWH7Yb3Lefrhopskg0/jgdVpts8us8q2uxttQ2uZqzOy /PO0df7pBxOVEPfNSGqZ42chAd5+WwvHNfM/AggggAACCCCAwN4EtGjMZ38Cuw9MJb5bftMKtfMr bRJ5d93XtHgDQovvOh/uJJ4bJK32m7G3QlxMpYFlV2tSFlPrYNa7e1ym7y1Ka0kr0DT9qCvZVPHn UVLr+CK9Tcefhl0L0AbXshUJZBbph4GGN9ZcM0RhmqBe+jnta+AQ6unSM/m9f2exz8VxmL74mg5O dWmP7zYm6fFOK/ysVm58ZptPzifrepCtBHQrf0bq5UgT4BuN0+L/vkj77WT5uLz7kkqwKh9vmyqz rJMUhOXkrexFe3K/XD5IkLS4SCS1GtZN36t379OdNEP1gFdm62lA9z/+T/9O1yyf7ql+M/p//yKr GE2lcm0xtORdWie+tW4xsfb/t8tO0u4cd8r/2p1CvKbzPc7leOfR1lIa+qq8bvp26s1Q7Sg8WS1h 6/KbRtzpG93/3tXd0+b5p+/aUrms6f4slZgxK1rSrHNleA5gE/iBAAIIIIAAAggg8NsJaBGOz/4E dh/gSnx3qUOvDLJmdqmFPCMpkFt8l5wOJCrp5RVni6EU0pP++DpNry89qNPxTGy1Maa7k+nx99UU hfiu1em/7XdtCBfZ/MV13uFOw6XYHe/uo4Zi3ppx/knWavHd/VgXiW0cfR7vf/dksapHFpuS5AkY fbX6JZt/9G01kf73SkC38mdcJoxdEzYapxbXUDi83fRLVpW2QfLpafZBYrQQyS41mm71P47Tq/TS 4jvZdU26tuGMQaXGuYXGtI9PGiW12qPrVA6TdLGUj8ZiW9yyZH9Pe8fd3mmv/K/be5uaV5xvqZvz GDlMKspr/0FLm4XSSezAKFGh1cxZjLZ2fqvfTN6MUsldV7rjkvB4nANL9mdMCv8jgAACCCCAAAII /EYCVoTjx94Edh/alfjOi9xZdzypwtMwygvn1lNPk1aoNPGC/VspgY/HV+P0RqK8yVyK/l7ZF7ry 6XAuHt9NPw76bwaDt4P+WT/9riFCiJJipzapxPJarfNrD3ysOizGd8VI50k77rUljptbJaNXSMkK i/P4yrP4TmOQSpI8BgyxyY807KzUjm1KauyfuDG+i/V3m9bQ/TizqjrZVC/vQbZJsrxHs/eyE12N 1K7GGlML+FShSnsqf1f8W8cDmV+PkUbi6fT7coubrOBln2I4aUuW0mPf6lH4rpF4MQy0hwkasK+d 3zoetgYazErusp29CYG7bKR4oF+WWuZGAAEEEEAAAQQQ+FsJSPGPzx4Fdh+31fjOur8dDbP6u7wK zOf0xJ3E7lTVihvZ5Er90VMe36VvOtJrTxr7tZO2V5lVoySrgMvq+zbGd7agxncW8rRCBVy52F+N GmI1Yp4kafrnb4u4kBoxHR1l4J28dia1mnLVXnoUrNVt29dgrS6lPmoQ+6xVqsBcsrxHIagR4fKn tKe6YKH+TvytDrS0xOM2t3zOxWz8KYSEHhhaVdp4fJNXsOrMpXBSJ5TS8zgTVo3vvmlFXtYeVWbL KmTXzu8TR191hfkn7jvxXW7CbwgggAACCCCAwO8qsMfQhlWJwO7jvBLfeSxQGL5yfq1t6DR6sjJ8 9+N0olVILamE0pU/attLqYfKqlUWtwMtwK/EF7H+rpoeL8PHajX93gbqL1S0WWzirQGLRXpbUEeV lC3m6Ykhgw/PshI1SLrXxXcWZZwO06vL8W05bCknNyQ1VjWu/GnzLi9PtU9ZcXeK6wiLhBrAxYWN PZKcpTrPJslyfOfVqT3H18WkL2Sl/kvXVozvnqyaLA+Bn+QVcsnwr5vddMX28Ro0PcKrH2sUGmeT zUnD2WirU6vyQ8tC2mPwKH+boXUA1Org9fNbPNg6iYO7Pj1N3rSzhrgzbaz78+OsZmnnFwQQQAAB BBBAAIHXE1gtRfJ3PYHdR+pe32pXLHJ7uJS8saDjaamhgTePtM5QPr6KByaDG616soETpR6qd3k7 TXWow0TbHD7qa/VCSzwPITe85S1/qZzUyywXs2vvZtXSHn/2Kfa/s6q68KYAr+bTl31bHaLsxIU0 3lvMfMDG8w+pNhO1ly/E9pkbknSvbTLP31+mt5PJ7WQ6nS3Cllfx8qTaNx6StE4vl5byu89jH6Ay kSmri4a/4xriO+LtVd2ydY/X1kuG+C4J75WzV7/JIt13l9PPNkLLW13b0l4jGPZU/n7Ql4BnYeZy aoOTyGsOP6WT65EccX2RwRa3Yvpl79b+K87z9DQ+lSOfB24eGIaqN+tb17uy3KJjxbT6lnMkKsw6 Zm6Y31+W0UpOLtLPk5F2BY3v9fAtxoa75bTwFwIIIIAAAggggMDvIiBlPz57FNh+XOfXWvMVPkkn tTEVZZHZlU0/7nWlgulocCfhyn3qI1tKjcnwduYvI5AF2xoGLkZWaWXr6Yx1JJa5B1la4r+WYrkW 6eXTD13q8kRl6/EZ/GfndJB6cPc4z4ZhbJ8O//inkNrkdDi5CW9kkOTpm9m/ZgNI2jrkNQfvx3/8 s47Db5/28F/+2Jgkaz0YZgz/FToYxsSWkno0+Ms/2MiiK4udXXhvuLhQ6f+Jv7rdFznWF8rLJwwL KVJn8pbziqTUWL3XV1XYp31hYdFiqgGafzo2zsn8JgTFckBGErjdp1rDap+ejbQpG5p9DG8ZkMlh eFKtZVvjpnHxyz8e7Wq4LZ/7NMgnvbEHoZqYtmWw5fitpq5zei7ztH2cli3zx/6YuoKjQVZNLO+7 kMX7t3k74pcnmSUQQAABBBBAAAEEXl1AS3F89ifw8wfscbm4n89/PLesv1zI57kz/3yqtiwpUd5S Qsstc6z/an4zkOrLuSwse/BD/t1Jd7zBrxuW8VmScnSE+6Xetota21j8/KxbcR3+eypVeCcSpT7j 87CYf58vnh2c6d7quyHyz/Rtko2qmk/lNwQQQAABBBBAAIHfTGB/kQ1rUoHf7PD+fsmxXm+xMaol bzE7l1cwSBNTPi8WmEsNaxz49MULP38B64R4rq875IMAAggggAACCCDwewsQle1X4Pc+2r9F6lLr EabsiTd7TEZfnl2x9FvswW+VCGli2g2tNF8pXdJU+HS0ILh7JV5WiwACCCCAAAII7FVgv9ENa9vr wWnsyhbfZxN5kdzNZPaNyK6xR5kdQwABBBBAAAEEEPjbCxCR7Vfgb38E2SICCCCAAAIIIIAAAggg 4AL7jW5YG/kKAQQQQAABBBBAAAEEEPhVAkRk+xX4VceR7SKAAAIIIIAAAggggAAC+41uWBs5CgEE EEAAAQQQQAABBBD4VQJEZPsV+FXHke0igAACCCCAAAIIIIAAAvuNblgbOQoBBBBAAAEEEEAAAQQQ +FUCRGT7FfhVx5HtIoAAAggggAACCCCAAAL7jW5YGzkKAQQQQAABBBBAAAEEEPhVAkRk+xX4VceR 7SKAAAIIIIAAAggggAAC+41uWBs5CgEEEEAAAQQQQAABBBD4VQJEZPsV+FXHke0igAACCCCAAAII IIAAAvuNblgbOQoBBBBAAAEEEEAAAQQQ+FUCRGT7FfhVx5HtIoAAAggggAACCCCAAAL7jW5YGzkK AQQQQAABBBBAAAEEEPhVAkRk+xX4VceR7SKAAAIIIIAAAggggAAC+41uWBs5CgEEEEAAAQQQQAAB BBD4VQJEZPsV+FXHke0igAACCCCAAAIIIIAAAvuNblgbOQoBBBBAAAEEEEAAAQQQ+FUCRGT7Fdjz cVwuFovlnte5a3XL+/n8YddM5e+XPxbLR5v0uJx/m5e/3Mdfj0uRWD5Eivj/Plb9K9axM/2C6Z7V 1D1antj0rTkt4/rDQamu5HWmLO7vptPZ33ijL9gVp4s4L1hww6x6JH4sNny5YfLj0/LBcnI8X4rz 6Qr9fJcMXz7EW74qruHX//64P9+ywLN27ScWedZ65Xxc3L3Gle05W3980mzx/GvyYn53XzkK2SXU ibJrxHMSEOfRTJhdhONE/kcAAQQQ+A0F9hvdsLYNh3g5Otlo0/0wW7PUj0nvKJFlknfTNd/+7KT0 bWc1HUln8DFdZOWix6lutTWslA/Wb3JxO2zr/MnUFpi9178u/I/1S7xw6mI2PLMt6Fb00z3ttlr9 V4ghX5iwn579YdJqtWdbfadvWsn7Nbni7nogAsmxgvSv7opJWHxNz4/UJ37avZOkdZYW53nR7+mb yJ4kg2xb92k3sQzSaqff8/XNroeWWTsXxbyUf2+/Pd71CynsX+kxnF/3Y4JbraPBXZYPV5bd/Gcx SydHXU9V+q4Xktnq+JTZJ91Q50R3qvvezqnHed93RUiTzvhbOCTzm4swOenPN6XnYZYtK+tL7zen L/vmcZG+P893VjZ60ktaydiXvZ/IH/HTllRefIlZZO1Xq5ghM6Rv4gmenN89zORUWfvprMtdIaWP a5YaZYnJdmf9LwvJoHnK18/zjKkP8/G7biuJV6HH+VAy89rP8ciZlt+nFyetdna1LPvYoknv7Wj2 wnBc0/o4v/CtW3pKOdbXe9Qb3aw5W3fuZzHrhp1buRo/Pc2u9JTvnNiRPBlqhtyya3p66ppKdw25 hJ7Gc9k20zntySXoRRfpxdexZKzkuGsr6k2+x8y5cyeZAQEEEEDgVwjY9Z4fexPYcAyXo6NW7+N0 Ic9gf0y1BJZcyJ16+eNuKGWSDWWt5fdU7tXbSmIbNrZ98uLzhWzfC0LLxTyVcpR8jkIx6elpMX57 Pvj0guLK9J3sUMcDlsWX8fnpxc8UotYlevllpGlrtS+/hHhu+X0iRRPZ3IsKJ/m6v0/SWIzPJz7v t8nVZC9lmtlHBe99KkVnpSSEAnZvJdhZToey4MVnLaG6jP8uf84+WuBw1J/+CGmc3xpdflhLW8j+ mN+md5v3avJWS3Ptt+UnDD9Syb7pj7gOLXvLXK3R5+fE3MvRsc48LMQLyy+6X61YUI/rfcH/y6+X XvrPHyw83kk+6X4IKV/caiH58puuc/lVZbofPYfPB7bk4HNJYXEtnoPN+7OQU0hP58ViasXv3XH0 w8xDu/5VjOwf5qNT3bZR6PVBn1pYOCknkbh3Qw7Z+lUFU3ZwbomXXLL8KrCdVM4dDQp03+0r3fvZ 5sqgO82f3eGH0eij/Lsc6CY6083z63rjx21bJ5dxwk/9f5/2TixMKWeJ6Xu9cF7cLsLuSFOBz7KD F3LkJCTvnui35aulZ7bOVC0WsxvLZsWs+/zUPS4u5ADFs8lzrF9CF/czjz2Tt5Pnry+bc8fV+Jvm 1bE/SFnOJEt3Qr7dvGs/JpJ5Mod4anQup/ES+mNqj1nCFTtLybZfHu8kT/TsgYxQXsr5fjTaNj/f IYAAAgj8agG5ffDZo8CG47kcnV6EJ8dees+KLt8vexviu6fHmRRZNkV/Gza0e7KXwbICgNyvh1q2 fNnj3OJm7j7Jzf8lpYXiwlt+X+ruayixUjmylBrGUF24Zek1X1l1xsWXNd/snDT7KGkZ7pxt9wyP c4tPZb82VkHOr8Is59fFCGNhNWSDkIv8qCWaqUIULJVN5c0vpxKFaOl308cWTGZW8l8/z8PUHte3 i8V7raLNqwVDxXQxXlu/qjA1lEtjkKNTQ4ZcW4u9dV3FL72cLPnQkqq1SEkellqIlGR0T+NT8Q/h sylJeTWenpYioT6/idLFzfjvy9noKn8AoqHZ6bg6V2FKiGr7pQMq3y/lCA3kUYVndTuavtTi5rz1 xoLTLV89rcHUlX4ZJm801pAHAl5J6ut8erAnS5KPtz0cWY7fWSVRWOZp9q7dOn5uvJYqrHwq52xc 2/P/1+cAMZ7ypWYf9MFIOactp9dxZywGKV8tV31mH/SKUp7nmSmyVcX0rF5C7UKteW/LybZhO6ur Kl+NPR4PNbxyuOXCFyooN+9a8a4RLqHt/GmMJ0Pneckl9H4sbtnlSK8AWdXqhv1iMgIIIIDArxWQ 6zafPQrsPpor8Z0tsPyWaussfZyf9D/EeqL8Tr0YnXU7R+32UWd4q6X4xeeRFbylwUx/quHPcno1 Oj9OOm9HI2+gddTf9Ih+tTj9qI+F9ZG+P+H/Oh1J2zYLP6XJ0+jdedLqjq5GFmq1zvN6vaU3Loqt 4LpaYn+YT69H0qzUqyS2JCnfX2mP9OEyvRrPsvqgKGj1CK0kDyXiF1JddZ16TUe+ntxtA0XW6kxS fGQVJT+moUFj0vW6p7m0NT1qS0VA5/QivR51jzvSbE9a93lK9NhIVLZaRM9T9ZzftNx+epm+15Lq QGoi1nwW561k9DnVOQoFfg8BinUEVljVyMtrxLLSV2GVi/QqVGDd3Wh0qP+Oe6OrdHyVLv4/rRrQ jSSt9httxjn9cJ4k7Y60Ck7Os/hr8kYzZeFpwFzqoUaxDjREVUeDyefJ+Go8/Zrv0bpDIxuJ5dJi UGmVFL4JbfwmiUjaF9ez6fteK5E8n3QseRPJluL/D/999jntH3eGNxOrN2ln4f9UIhH5HPcHUr+Q PT9RDttoAdOrUL06T04mr8LLAwetoOwUwt5lqOMWq5OBVgYVP9+tNtNqWBbf9HxpHw/ST1pdKJ/u u1SL/LaDayP65ZfUzt+QhtbxINR9S2+v776lLV9FzHJYsfxysVrlqgn2mQstGHWatB+Qw91uJ0n3 7LxzmlXi6wL6sccRHuqKv1x/5KTovRunH/qd43ZyPPDT0Od9WgjF+eRGmwcUM6qvZ3TWTo46bcls p5eS3lQaXet22wM7ofTgxnxoa7PUxnjK1+/x3ehr2NrT09158SjnV8tshuCThV2+hvb/Idco2eO2 ZoAfE2lvLH+cb6lP1/WV0rMalNmmJc9c/9/pxVlHWMYfvdWxNDzQYzP/vH66rtdqkzvZw43y1fjp +6Xno8n98s5aMo+++sHesGvyqLDgEC6hFuzrThQ+0slaV/Qo1ZqX50fti6t0eKpneiJNQB8W6Vu9 /Mgepd4O02rD5e+L27mc1zJfrP4urJFfEUAAAQR+JwG7jPNjbwK7j20lvlta8e/cagT8Jh6qA+xO 3fkgDfm0jNd+M/Zecgutl+lqPcViardhqYlYplIYtk/vY5pa6WLTY2ovUbSOL9LbdPxp6P01BtfW XFC6CH0YaCnZSlahiK6r7aVSqNZqvlBPl57J731tQCidU6wFl0QE0gVsYB09PL7bmCR70u5FmvGZ FiokoJisVNI9PXnjwLzkU5Hd4LaRYn6jpe7BzZ2O02I1UyMtrC+Gmv7WpRfRrSGf1E8tvRWiD1Pw aK34ji7uFiujXizHZ532cadT/tdOOpehGLaSaK2vGUoBVVcuyLF7UWGu5XQg4Z1MSE0mq2pZLQdK kBuqM/7q4Uks+BXWlf1qGUy7UD3eSbgun+RsNJc8oz3spBud7NWTlyRTbYYnvdIKNRH26D6v7dK2 lHlFWGrRn6yw96bvDxw6Vr+w4dDIyr1c2r78PJt9nc2+yM+7qTUujSGk1yZ75Vq5EKto5/PFzFoM 6l50T/WpQxZsSlZ0Cp2tGD/KRss11F7uzWznV9Z2MrYqnL1PWoUisVb2HY801nKKrDLrYR5zeNsb /UqbWEdonQwnt5fen06aWXrr0HLImR2b8Mv8VsMi//Q/lhrEbv4q+GTBuK9rbXznuaVVqMQULt3t 07GV8+/093I8JWuzXJfX3vopeX4z18cU0n61hPw0fZtYp1F5QCGfQhaSLHUlF6qeGv5Ik8TrlP1g xUbIWinfLTRItl0rp8d3ofvuMr1O0+vxUE6Q4gyFuCaYhswWQnVp7u4PqS7l6YRFVSGit0vBpqtl aVVxc+WTUcJ/W/HJpT9F0b0/HU09M9gim6ZHYclg667Gtu3ph1jhrw2M9VjZJx56OwSlXSs4eBfa eGaFJRff7+bf5/P7xfz73eKv0/6xXREkdruZxvzc6rwbS/r1i7jLi6n9qfu2tW152Aj/IYAAAgj8 YgG7YPNjbwK7D2clvtPuDMUysxXstdRqd+rkdCBl8l5ecWbt9JL+WAs5l37v125HttpYStHOR/H3 1RSF+K7V6b/td20IF9m8VJdk8xVbRllJOBTV5p9krRbfWUE36+vk84RCpoUSoeC0IUmegBCPeOjx Ldt49ouX87e1JdviJqXJuPsFikKhzup62qPrVBi9+1hs+PSU2nNsPSR5/dqa0qYlVCoxe93TXq/8 r3vcywbryPZHf9EEhAaTY9tKJSjTSEQb7MknRBOhSsUbYRaLaiG++29/scLlth5SVtMXSrnhYFmx sDjduxSdW++e5TQtVP5adxsJmaz3jTTA6+Q1HV7IjH3xrH+QuEl3oY2HJhS5pY4u/8gi8sl2bXGj dR8XVk/mkZEfCGkV1vZqjkIJdmWU0TsJzfSThC5L6qgft0rOLuUJiXThtKciBTE/JSXl+pBBG9CO sqFjrAIlNm9bjt90nEjmW0zT0adR3x4OSKzp+d/yVWwou9CeUFJC/sM6jrV9UBdNzvqPJMyjb92D I+2fm302fBUL+Vmp3xZYE9/ZWSYsWV2nzGjNgLNW2etz+PSthB6FxpkeEmr62hOvXcySqAclrM3j 5WIVz0wFktEXXWYmdce2lB/ovrWDnX/sFNrTytdr0uMHsX3av3g7GLwddCVmj9GHrq+YK2z98WGC bFnqBu2TdEbW/sEvQdllShIXLxdhycp/pfTES2i+4o4+MNGFihdP76fmB2fT9LiqjVdjfxLlye+8 tepg3Y4f+jW7VnAIl9D+TaHhtg7yE0cGSs6n0mrC8kboyeuGcYyayZui8CKOOiRZ4mfGQdJU80EA AQQQ+FsJ+I2Dn/sS2H3cVuI7LzIVGhrdaRhl3UxisVNLj1lhz7pUSDtMeYItLeLSG4nyJtrUxm7N sZCsYYKXWKYfB/03Whzqn/W9sY2XKPJ6scXUS5WxgV+pJBNCAC+jaHiiAz/6CHJe4SX7W5ynWnCq JslLFCEBVpPlBa2VpNqwLa08nSuyW92kwFbdbiFtVqEjzagkvhNDjZTTaTYi3NK7KbVz83WlzZXk POdPq/Rsnb/p92Nt12q/rXur1zs5l4PVj6OGhlBFKj5kp7J2XCFmkdhqYd0nV/ollZLj1VU+BKIV qsPoncUD588H7CzopuXKRw/9tLHociaN6gp98byQmVeW+YaGf/x3rcFZm6VDubTY+tHD3ux4aU7W +OtEe7RZnOi/L6Sx5sRH+Shl9cKe3itRolV18l9eyWhzSGgW6tbsa/nRKxzfJwtAtHOT1TzmnRZD 39Ls7CtsLf4aGip7Hp59EKGslWM4lazCvVhUjouu+38amvat6dNX+cr9SzVlssrV+E4qbW2f4/gY YavWCfE8VpmVzvowhzfOLDdIjp09V4fX8J5iXcvbPT8EhVrUGMVI87+L/NFBvBJKkqVmPfYy842v SY/Hd3n7zMdZO1QF2iIb47tk/HUuNVbFF80ULgVrA8MAUPivlB5fPHkznv/QirDCmyxKs+n5FTLD pumV9pkrV2PrMtl5P13Eysf4lMBWKM8xKrtWiO+evMVyvBLmexMuCF91SplCq3SzULeQ/oXWgB+N 5g93Os6MfI6GK/F9vnZ+QwABBBD4DQTsYs2PvQnsPqSxVOMxk9yONZwr3i6zKrA8vpMirnZa0Y/H d4Vyvk6U8mepeJPHdzJeuvSakQaE0tXFa4v8hl686fvtPt7WK0WR2CbTFtTQwAvDWd1TMUwolxaK 48PkSZKqD39bhHT6uNRSd2jotZJUT1XrJCst647mn61uhQfy+XYLaQv7mK9NfsvK8A/+hgiJOLJm ciWT4lKzG4myNTws/ht/WtOd8GkxkZ5Oo5uJhuQ36eTm0mqRYuWXrVQ7u52NJrc6Q3o7ubShTRPr febHtzCwyZO1jZSyvZf0tvaIefB2vN3xbarP7n2F5cBct/8wC+PAS/WZjdIZ9zQ8utdakNPiCxd8 04VgzbPuH39szNJZfBdys26hmiGnOm5nJ5UWYsn5yEZnHUkbTov4dIFSVtcJ+rF43/KwDq4in8Lh 8zlkS9q81jeXD6TvX3pdm1TISOAXxgnUL7ziKdbfxfWs/J+dsEpaje+G3lp1JaIsrkMav40LMXWI oVoafG35StbgDSZDPVRcozTxLfa/84a++QXEZlt8/6u1Wc0eHK3J4QZVDOd1yaWNviu8WetWX5+Y n3+UXO1ZN5VXFcjH6+ZsBmG3LqU6OW/wGarRry6SYk2cbadY4eVrCBXWxZFXC7loXa6o5E9fUcxy Nevvig9bshUXk13IDCXewvQ1mb94NfanMaH/4MNUT6vEA6uNu1Z08H6m1eFMi5KFq6LshF4tszez 5OksPIWLV+/8IMZ9538EEEAAgd9IQO+3fPYnsPvQrsR3ocSbNZQKY5hr9GTl2O7H6cTad4X2TqGr ey+0h5Tb7e1AC6ulQm8e1FTTs6Y4bf1HYsS3UhTRqjDfli2ohXlvNZe1v7ICSSjkl0oLm5Oki5wO 06vL8W3eLnQ1qaEeTUqSq4+K57djeRGAFqVikzBZ1msQMrc8XI1VmZ42D0u9YigLUSX4aocR4ZRO +jB6p7zYzC+YrKZQBruTeGDdJ2u8mi1SHnZSJ3uYnAcaSx2sMrRd88UMMJaHfX/70ULT6e3TQv3a mkHslxNpC2dxq1h131+OP11OCkOghMDcZlhOR0N7R4B0ItN9Kg8Imb3zayWU8KE+o9KTt7gbfVts PDQxvsuGvJAdDRmy+Mji+9hRe9J4b6G1cvLJN13KVy4Vxmz38r6vUBYZffNviz/nNvLFap2XzBHi oJjbfRnP6p1s6HuJIpNSxZ/OpvXaIQ7Ki8T6hW1LBwiyg7U25JQXdkwXOoZnXuunAazF/to3bctX sgHPQoWGxLpVeXlizPzy4gAf6CM0H9Wv5SPrTwb/xfpOZseuGJj4XNo4cyXs0grc1uhmbMnL620t B2Y5U5eO1XxhVNLZe290vJxYb7I8gr4f+8Ht522hfeOlq5BPivV3xaDOv7GflivKMZefMmuG9vXk ZfGd7E55wcJqw6+l9KzJsetmK2SG0uKF6THzF4ZQDu0WbIpeNCRDxkdPdsKWuqZmd4E8xcWzYxle ZVgOxsOAUb77vi/x5NLG/1nmyerv/AqTXy2toXscnijfMr8hgAACCPw+AlZ04sfeBHYfWWtFVhxb w8uQoZomvl1ICzHW8d/HV/FWMQPrSTG1d4i3kt7l7TT9IA1qrGz5qK0KQynFy4flInqWsPDGJSmy SrFBXgt1HQZ2yMapKJb0rAAZChj+YFkLhGHYbemSP5MVDKzFzvmHVJuJ2q0/Fpw2JMlaIZ6/v5Qq qsntZDqdLTYU2RZx0Im8e6C8+Fgrd/QFXhvdNlB4Sab7fiIv4/6Pn/5PO+TJxad0cq0RzcBqrOby rgcv0/phCoMuekFRGi7KAIk2HkWmKYZr/2Uz+C92KGMhKn4XIpfQEUwPq42sEr/W/yfWqtBjQC+U em+aUCqLYdLER3iQF23H8G15P9XjYo0kLfJtD2VPHfxLeOVdeIx/O0vfD//4b8NszHONHAsDjGg6 wlOFlUaPMt3G6Diy4Uc8drMtbjw0Ib6T7nX5IQ+xQKE9p+Qwa3TqrQcdv/A2uofSG74kdeENjLEY bG4eN+QDgepePNxZXk3W9460rnbxNNTZ9RNLyO3Ti8tPOopsV2r3pMXjUbv/caIN82RQl+y80/o7 mSX0/pt91PqW0Ozwx0S+kI+MqOkR99OjDPSqNY3abvabDpPYjr2rpM5OZ/WRY7d8JckLgXByaV3b ZMLMxooJFY4/UjlV5BN6YFlGXS7uRqcauP3VhxKSPPNlFt7iVzwE1jgzD8TU4mkcX9bp8X47hL36 lCOr9LEZ5UcY9tP7UWrfyVAbrhFiIZrzgxtHWYkLy//2iKAUM3owu3EAW38YEuumbU2+8lKvw7AF H5fyZDiTt9fZ5UvGjbzb9o6/8DjFF/ccu25o39Js9hDp3Dq/bZouIyHr5Vcl5ehUrsb+yku/7MvX emKGCvTNu1aM7+QweF4q9rB+XFxaF+9wDhZqn/0hYTb26eStnETWmdQuX8nbUHdvLyLsFTr1BVT+ QwABBBD4fQTs/s+PvQlsP7Lza287Zpuzsfd9/pm/Jfm4Z4MGDLT8fZ/6yJZy8x9KCfytFw99KPuF vxnZ1tLRwqoUMq2Uos13ricyFLnvT7UslK2nuMOd00F467e+qzos2z4d/vFPIbXJ6XByE8cGPNLm lMuv45AgX5G85uD9+I9/HoaFJc3/8sfGJEnHmeLm9fesndiqn4zhGd5iEBfpvNFRMja6baOI4yse 6Ru+wjvBbbU+fGiopTrWFlBSLvIIoWX7u7CxN2VeGSF8NYk7/44doCQOkLcthM/j3SCOXCct9/7r P3gfqZYMoRDnkBrJOB6kzGGjmsh7nCUNybH6yZuysznll7vsANke6QyfYvtSfc91+ePNfa1Pn3zR eTfxgLF11NUcKAMvxGrCbBNWRC9tMXz1MNOBVZNOR7wKo4KsydKPdzYEa0iJv5otqxnUqUf5uA1S M5jVI8hojdnvcl5kGa8nry+X4VtDzm+1j8OYJKWzrJXIqIM2sqsu1z4b5v2/sn0Lv2icMiy0k/TJ MjihVVdpAnWL8skPqK5yWBi/wkNmndU+o2Iz1+VddmKGr48HOsCFrlBbMndsqBbPde04Xse2r2xR eVVKBmKrlTH5w8GzHnZhUyv/+YOgiTUA1q+ObR2F+M7ejd4qDqISBmO0wTeyQR3lzRpxK4m/6cAS JY2H80SJv7O0T7qScWXXiplrcdv3t/X5gvrzx+TccrikKznq6SkjR/kknI4ysXiO+FKL25G+18M+ nVN7f99qZrPxgfNtyMi34SJ0/k6rOLtng+zZSD6X/6ZXxbDy9unoj3/0KlHbWCHHyrzZ1bX3PrUn bzqPEO2cbusKP/KrsW199sk2J+9wkO+Prffill27l9c9+HqS3nt9B6J+FrPhWX449OukM/w01acT 2V1G3hFzO/FXJMj38rAuS7++MUHabHy5tFV4Orrj+BzJt8BPBBBAAIHfTcBvBvzcl8DPH9/H5eJ+ Pv+R12tsX9VyIZ/nzrx9VT/5rUR5SwktX7y0vqdAIixZWPbgh/y7k+54YdDIDSuTOXVM7x/FoQzi rC9y0zTHBeV/S0JheITCV9Vff2pnq6upO+VR4Dayaxa6n4tqcSvp27a8tmApUKotktIdL7YHlrUV j6Af0+LC2e8yW3HObLr9Iq+c0LdOrHxedGhWlt3rn8v72ezbvLSna9f/WNmFONsaczsO8fvwvza9 s/pfBVnL9WA5+X713A3ZUjKkHKNyRdKWr7Kt29Xgpy4Ishe2uUuJLoutMbfkhGyrL/1Fs+5Ll3nN +eVw+zEKP5d+7vhpEn6+5Jr8WmmVYyHZqSadn/6S72qsZ/1p/lq7zXoRQAABBH5eYF9xDetxgZ8/ En+SJa2lX6kV3GJ2vqbv2J+E4/V305qiFcdIX3y9jO8ge/2t/8m24O9HKEXXByJQbJV9IEneczJj P9bKrSz0zN3z5lgdAggggAACrydQuZkxoZbA6x2pxqxZqpMCcXgtVXgxVmN28Pfakfyt3/F1Xcn5 7BAjkN+LdU1qpC2xN4MbXE+zJsRr5vv9Js2/hDaow59ofvz77Q4pQgABBBBA4E8uUCuYYeGKwJ88 Oz1z9xffZzaU+mT2jUjjmWa1Zpt/meobHG6nd89uAFxre3/KhWe3Y3mjorzbQl+QcUD5Wt55/enS X9sxvi4MfPOnPIjsNAIIIIAAAg0QqAQoTKgl0IAswS4ggAACCCCAAAIIIIDAgQrUCmZYuCJwoNmA ZCOAAAIIIIAAAggggEADBCoBChNqCTQgS7ALCCCAAAIIIIAAAgggcKACtYIZFq4IHGg2INkIIIAA AggggAACCCDQAIFKgMKEWgINyBLsAgIIIIAAAggggAACCByoQK1ghoUrAgeaDUg2AggggAACCCCA AAIINECgEqAwoZZAA7IEu4AAAggggAACCCCAAAIHKlArmGHhisCBZgOSjQACCCCAAAIIIIAAAg0Q qAQoTKgl0IAswS4ggAACCCCAAAIIIIDAgQrUCmZYuCJwoNmAZCOAAAIIIIAAAggggEADBCoBChNq CTQgS7ALCCCAAAIIIIAAAgggcKACtYIZFq4IHGg2INkIIIAAAggggAACCCDQAIFKgMKEWgINyBLs AgIIIIAAAggggAACCByoQK1ghoUrAgeaDUg2AggggAACCCCAAAIINECgEqAwoZZAA7IEu4AAAggg gAACCCCAAAIHKlArmGHhisCBZgOSjQACCCCAAAIIIIAAAg0QqAQoTKgl0IAswS4ggAACCCCAAAII IIDAgQrUCmZYuCJwoNmAZCOAAAIIIIAAAggggEADBCoBChNqCTQgS7ALCCCAAAIIIIAAAgggcKAC tYIZFq4IHGg2INkIIIAAAggggAACCCDQAIFKgMKEWgINyBLsAgIIIIAAAggggAACCByoQK1ghoUr AgeaDUg2AggggAACCCCAAAIINECgEqAwoZZAA7IEu4AAAggggAACCCCAAAIHKlArmGHhisCBZgOS jQACCCCAAAIIIIAAAg0QqAQoTKgl0IAswS4ggAACCCCAAAIIIIDAgQrUCmZYuCJwoNmAZCOAAAII IIAAAggggEADBCoBChNqCTQgS7ALCCCAAAIIIIAAAgggcKACtYIZFq4IHGg2INkIIIAAAggggAAC CCDQAIFKgMKEWgINyBLsAgIIIIAAAggggAACCByoQK1ghoUrAgeaDUg2AggggAACCCCAAAIINECg EqAwoZZAA7IEu4AAAggggAACCCCAAAIHKlArmGHhisCBZgOSjQACCCCAAAIIIIAAAg0QqAQoTKgl 0IAswS4ggAACCCCAAAIIIIDAgQrUCmZYuCJwoNmAZCOAAAIIIIAAAggggEADBCoBChNqCTQgS7AL CCCAAAIIIIAAAgggcKACtYIZFq4IHGg2INkIIIAAAggggAACCCDQAIFKgMKEWgINyBLsAgIIIIAA AggggAACCByoQK1ghoUrAgeaDUg2AggggAACCCCAAAIINECgEqAwoZZAA7IEu4AAAggggAACCCCA AAIHKlArmGHhisCBZgOSjQACCCCAAAIIIIAAAg0QqAQoTKgl0IAswS4ggAACCCCAAAIIIIDAgQrU CmZYuCJwoNmAZCOAAAIIIIAAAggggEADBCoBChNqCTQgS7ALCCCAAAIIIIAAAgggcKACtYIZFq4I HGg2INkIIIAAAggggAACCCDQAIFKgMKEWgINyBLsAgIIIIAAAggggAACCByoQK1ghoUrAgeaDUg2 AggggAACCCCAAAIINECgEqAwoZZAA7IEu4AAAggggAACCCCAAAIHKlArmGHhisCBZgOSjQACCCCA AAIIIIAAAg0QqAQoTKgl0IAswS4ggAACCCCAAAIIIIDAgQrUCmZYuCJwoNmAZCOAAAIIIIAAAggg gEADBCoBChNqCTQgS7ALCCCAAAIIIIAAAgggcKACtYIZFq4IHGg2INkIIIAAAggggAACCCDQAIFK gMKEWgINyBLsAgIIIIAAAggggAACCByoQK1ghoUrAgeaDUg2AggggAACCCCAAAIINECgEqAwoZZA A7IEu4AAAggggAACCCCAAAIHKlArmGHhisCBZgOSjQACCCCAAAIIIIAAAg0QqAQoTKgl0IAswS4g gAACCCCAAAIIIIDAgQrUCmZYuCJwoNmAZCOAAAIIIIAAAggggEADBCoBChNqCTQgS7ALCCCAAAII IIAAAgggcKACtYIZFq4IHGg2INkIIIAAAggggAACCCDQAIFKgMKEWgINyBLsAgIIIIAAAggggAAC CByoQK1ghoUrAgeaDUg2AggggAACCCCAAAIINECgEqAwoZZAA7IEu4AAAggggAACCCCAAAIHKlAr mGHhisCBZgOSjQACCCCAAAIIIIAAAg0QqAQoTKgl0IAswS4ggAACCCCAAAIIIIDAgQrUCmZYuCJw oNmAZCOAAAIIIIAAAggggEADBCoBChNqCTQgS7ALCCCAAAIIIIAAAgggcKACtYIZFq4IHGg2INkI IIAAAggggAACCCDQAIFKgMKEWgINyBLsAgIIIIAAAggggAACCByoQK1ghoUrAgeaDUg2AggggAAC CCCAAAIINECgEqAwoZZAA7IEu4AAAggggAACCCCAAAIHKlArmGHhisCBZgOSjQACCCCAAAIIIIAA Ag0QqAQoTKgl0IAswS4ggAACCCCAAAIIIIDAgQrUCmZYuCJwoNmAZCOAAAIIIIAAAggggEADBCoB ChNqCTQgS7ALCCCAAAIIIIAAAgggcKACtYIZFq4IHGg2INkIIIAAAggggAACCCDQAIFKgMKEWgIN yBLsAgIIIIAAAggggAACCByoQK1ghoUrAgeaDUg2AggggAACCCCAAAIINECgEqAwoZZAA7IEu4AA AggggAACCCCAAAIHKlArmGHhisCBZgOSjQACCCCAAAIIIIAAAg0QqAQoTKgl0IAswS4ggAACCCCA AAIIIIDAgQrUCmZYuCJwoNmAZCOAAAIIIIAAAggggEADBCoBChNqCTQgS7ALCCCAAAIIIIAAAggg cKACtYIZFq4IHGg2INkIIIAAAggggAACCCDQAIFKgMKEWgINyBLsAgIIIIAAAggggAACCByoQK1g hoUrAgeaDUg2AggggAACCCCAAAIINECgEqAwoZZAA7IEu4AAAggggAACCCCAAAIHKlArmGHhisCB ZgOSjQACCCCAAAIIIIAAAg0QqAQoTKgl0IAswS4ggAACCCCAAAIIIIDAgQrUCmZYuCJwoNmAZCOA AAIIIIAAAggggEADBCoBChNqCTQgS7ALCCCAAAIIIIAAAgggcKACtYIZFq4IHGg2INkIIIAAAggg gAACCCDQAIFKgMKEWgINyBLsAgIIIIAAAggggAACCByoQK1ghoUrAgeaDUg2AggggAACCCCAAAII NECgEqAwoZZAA7IEu4AAAggggAACCCCAAAIHKlArmGHhisCBZgOSjQACCCCAAAIIIIAAAg0QqAQo TKgl0IAswS4ggAACCCCAAAIIIIDAgQrUCmZYuCJwoNmAZCOAAAIIIIAAAggggEADBCoBChNqCTQg S7ALCCCAAAIIIIAAAgggcKACtYIZFq4IHGg2INkIIIAAAggggAACCCDQAIFKgMKEWgINyBLsAgII IIAAAggggAACCByoQK1ghoUrAgeaDUg2AggggAACCCCAAAIINECgEqAwoZZAA7IEu4AAAggggAAC CCCAAAIHKlArmGHhisCBZgOSjQACCCCAAAIIIIAAAg0QqAQoTKgl0IAswS4ggAACCCCAAAIIIIDA gQrUCmZYuCJwoNmAZCOAAAIIIIAAAggggEADBCoBChNqCTQgS7ALCCCAAAIIIIAAAgggcKACtYIZ Fq4IHGg2INkIIIAAAggggAACCCDQAIFKgMKEWgINyBLsAgIIIIAAAggggAACCByoQK1ghoUrAgea DUg2AggggAACCCCAAAIINECgEqAwoZZAA7IEu4AAAggggAACCCCAAAIHKlArmGHhisCBZgOSjQAC CCCAAAIIIIAAAg0QqAQoTKgl0IAswS4ggAACCCCAAAIIIIDAgQrUCmZYuCJwoNmAZCOAAAIIIIAA AggggEADBCoBChNqCTQgS7ALCCCAAAIIIIAAAgggcKACtYIZFq4IHGg2INkIIIAAAggggAACCCDQ AIFKgMKEWgINyBLsAgIIIIAAAggggAACCByoQK1ghoUrAgeaDUg2AggggAACCCCAAAIINECgEqAw oZZAA7IEu4AAAggggAACCCCAAAIHKlArmGHhisCBZgOSjQACCCCAAAIIIIAAAg0QqAQoTKgl0IAs wS4ggAACCCCAAAIIIIDAgQrUCmZYuCJwoNmAZCOAAAIIIIAAAggggEADBCoBChNqCTQgS7ALCCCA AAIIIIAAAgggcKACtYIZFq4IHGg2INkIIIAAAggggAACCCDQAIFKgMKEWgINyBLsAgIIIIAAAggg gAACCByoQK1ghoUrAgeaDUg2AggggAACCCCAAAIINECgEqAwoZZAA7IEu4AAAggggAACCCCAAAIH KlArmGHhisCBZgOSjQACCCCAAAIIIIAAAg0QqAQoTKgl0IAswS4ggAACCCCAAAIIIIDAgQrUCmZY uCJwoNmAZCOAAAIIIIAAAggggEADBCoBChNqCTQgS7ALCCCAAAIIIIAAAgggcKACtYIZFq4IHGg2 INkIIIAAAggggAACCCDQAIFKgMKEWgINyBLsAgIIIIAAAggggAACCByoQK1ghoUrAgeaDUg2Aggg gAACCCCAAAIINECgEqAwoZZAA7IEu4AAAggggAACCCCAAAIHKlArmGHhisCBZgOSjQACCCCAAAII IIAAAg0QqAQoTKgl0IAswS4ggAACCCCAAAIIIIDAgQrUCmZYuCJwoNmAZCOAAAIIIIAAAggggEAD BCoBChNqCTQgS7ALCCCAAAIIIIAAAgggcKACtYIZFq4IHGg2INkIIIAAAggggAACCCDQAIFKgMKE WgINyBLsAgIIIIAAAggggAACCByoQK1ghoUrAgeaDUg2AggggAACCCCAAAIINECgEqAwoZbAv/3b vzUgV7ALCCCAAAIIIIAAAgggcHACEozUCmZYuCJwd3d3cNmABCOAAAIIIIAAAggggEADBCQYqQQo TKglMBwOG5Ax2AUEEEAAAQQQQAABBBA4OAEJRmoFMyxcEfi7v/u7m5ubg8sJJBgBBBBAAAEEEEAA AQQOWkDCEAlGKgEKE+oKiOrf//3f/+u//it98Q76BCHxCCCAAAIIIIAAAgj8/gISdEjoIQEIwV3d QI7lEUAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAAB BBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQ QAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAA AQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEE EEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBA AAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAAB BBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQ QAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAA AQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEE EEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBA AAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAAB BBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQ QAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAA AQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEE EEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBA AAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAAB BBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQ QAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAA AQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEE EEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBA AAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAAB BBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQ QAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAA AQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEEEEAAAQQQQAABBBBAAAEE EEAAAQQQQACBJgr8/5zYegMKZW5kc3RyZWFtCmVuZG9iago3NiAwIG9iago1MTUyMAplbmRvYmoK NzggMCBvYmoKPDwgL0xlbmd0aCA3OSAwIFIgL1R5cGUgL1hPYmplY3QgL1N1YnR5cGUgL0ltYWdl IC9XaWR0aCAxMTg0IC9IZWlnaHQgNTE5IC9Db2xvclNwYWNlCi9EZXZpY2VHcmF5IC9JbnRlcnBv bGF0ZSB0cnVlIC9CaXRzUGVyQ29tcG9uZW50IDggL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3Ry ZWFtCngB7Z35dlzHda9FTRxAcJ7EEQBJgPMAggTnUaQGiqQoiqOjyPEgyZYs27J9lZVkZXY83Pu3 8xJ5AD9A8i72U+TuvavqnNONBnAA/Oi10P3VH00AbGzU+YD61q59quq88goNAhCAAAQgAAEIQAAC EIAABCAAAQhAAAIQgAAEIAABCEAAAhCAAAQgAAEI/OUIrKBBAAIDT+AvZ5w2P2ngfx0AgAAEehJo 44+X956eXeKLEIAABBoEXp6BZo/c+PF8CAEIQGBOArObRP8/c3aE/4QABCDQg4DeRD0i9vi5c33p VRoEINC3BOYa+z3+r4dQlF/q8RObX+rb3wIXBgEItCTQNEKPj5U+6ozV44elL7XsOG+DAAQGhsCs uui0iuqz3j9uYGhzoRCAwIIJ9LaGykl1nF4/Z7bOvkaDAAQGjsBsPujljtosio9m/oSZfRm4XwcX DAEI9CQw0w4zDaLwUooxI3bXj+/ZxeYXX6dBAAJ9RqA5wnt+3KWJGRoRGao7bvPHzuhXn/0OuBwI QGABBGYIoWmLbpMoBNUVs/njmn1pdQlv0CAAgWVOoNVQb7qh6YwunSzZUJ3xGj+p7kBnf5c5fLoP AQgsmkCnC2pHNMTRaZQlCqozWPVTqh9c96fXJb1JgwAE+pxAr5Ffe6FSRSWPTqcsSVAdoaofkH9k 1YdGB/v8V8HlQQACcxJoyKASRBZGJZAOrSxBUM04JXjxYf7hpTsdfV5JgwAEBoxAhwKKF7ImijWK RZpmWbSgmkFK4PSDOuRU9avr97GKBgEIDACBroFfCSFJqkNRxSNNtyxSUI0QJWrTTumHp75UHez1 y1hNgwAE+pBAr9FeqSCZoamoZI/ikoZeFiOoxrevyCEbdoof23RT1dVZfw1raBCAQF8QmHWQVxpI mmo4KrKoDkM1DbNwQzW+u6mn+DG1naIbqVOlz3P8AoZoEIDAMicwxwAvDkhGCDmEokIYtaGyUBqK WbCf6u/taSf/qStXRjeiT6nPNfi1NAhAYIAI1GM/uSC0EIJYudJt4Yqaw1ALFNTsevKf43JatXpo eN269d42eNsYbVPdNtMgAIGBIFCP+k3JA6GEkMO6dcNDq1e5ooqhYpI3I4VakKDm1JPbcOXqdVt3 jew/cNDauLUJb4dSO9zVjtAgAIE+JNA10A9nAYQM3ApuhwP7R3ZtXbe65FCeQi1ZUN16ioAeuSRP K1dv2PPtH//0vzQIQAACcxL40x+/3bNh9cpZUqjaNe0zqPp7Ig1r6slzp5WWPe39w5x94j8hAAEI ZAJ/2GsZVDFUZwpVu6a1n+pv6dBTlTytXDW07VvYQwACEGhH4NttQ6sqQXmdvJ7j1bZpKaj6G7r1 lJKnVatWD+/5Y7t+8S4IQAACf9wzvHpVbaglCaryU6Unz8jybTtfU7B6zfoxak/80UEAAi0J/Gls /RoTlBnKchxTiRvFU6hQTCWcVglU9e6ZerIMzey0evXQhvGW/eJtEIAABP53fMOQiSOnUEsSVPFT pafXSvaU9bRmzdDGCZBDAAIQaEtgYuPQmjVdgppZg5o/gSp2ynvuPEStJ5/brTY9rd10qG2/eB8E IACBQ5vWZkHFHC9lUG6XSINerbQzn6GqN1bpU1NPYaehtcObD0McAhCAQFsChzcPrx2qUqhSg6oE VWmnrZ/m1NO6LUfa9ov3QQACEDiyZV0rQc3jp8pjxU8zsqe1a4eH1289CnEIQAACbQkc3bp+eHht meP5bbxqiheqqcQzt6DK2+bS07p1G7Yda9sv3gcBCEDg2LYNtlO4haDa+8knh5E++ZaWUhlfO2xn FmzcfhziEIAABNoSOL594/r1MwRleiklqJIZzemn8qaO9KnS09CQTe5MTxs27TjRtl+8DwIQgMCJ HZs2ZEEN5XUGPsVLguqY4c0hqKKnWFyQ0qd02JOd9hTrCoZNT3bU0+a3TkIcAhCAQFsCJ9/avHHD BsugrEoeC6HySvKZCdSK2QVV/OQ+K3qyw+hidufLnjx7Mj1t2rLzdNt+8T4IQAACp3du2ZQElWpQ aatL1Mjbz/C6/NQsPjX1tHnrrkmIQwACEGhLYHLX1s09BVXP8Ip95s2f6uqT+a3UxuvsafOWbbvP tO0X74MABCBwZve2LU1Bpa0uaZGBJVDNCtSsfioCy9O7On2y4pPVxvPkbvOWrdv3TEEcAhCAQFsC U3u2b60FZSvJTVBpFVTrBKpLT7a2wIvjVfEp7txt3GR62rZj39m2/eJ9EIAABM7u27EtCSru4nmN vJSgZpbIe2dQXX4q6VOsfMqzu6Sn7W+NnIM4BCAAgbYEzo28tb0IKi2Dihle5xqDYqCWfqqqT2V2 l/W0Y+fo+bb94n0QgAAEzo/u3NEUlM/wIoEqt/C8qNTKT1GqqleOW/rk9+68+FTpadfYBYhDAAIQ aEvgwtiuLkGlGV6VQIV2sqDmzJ/8jVZRTyf6WvXJi+O2Jzj8ZLWn7Tve2rVn/8W2/eJ9EIAABC7u 37PrrcigbJVBXqaZSuQ9Eqi2forqeHXvLtIn09PO3XsPXoI4BCAAgbYELh3cu3unCSrXyNNhK/Ut vLzEoEX+VKVP6e5dTp98193GuHVnetqzb/xK237xPghAAAJXxvftcUF5jdwSKN8qnNYYVBO8WAOV BDVH/hTTwDy9s/Sps/rks7udu/bsHZm4CnEIQAACbQlcnRjZuyeVoHyZZvJTlMiToDrWaM7vp8bi gqg+5eK4F5927903euha237xPghAAALXDo3u27vbS1B5hhcbhf0WXpVARWoUCVQvP+WpXzW9y4sL mjfvbGFmzO5Gxg5fhzgEIACBtgSuHx4bKTO8jgTKFpG3qZBnPZWTVaq1414dH7YTM704XmZ3o/uP 3mzbL94HAQhA4ObR/aNlhhf7XOw0zVgDVTa5dFbIZxyy0ttPVXXcD1VJ6ZPN7sYOHLsFcQhAAAJt Cdw6dmDMZ3ipRF5VoHyJQUcBqnioe4rXmN6V1U++9a5M7/LagiiOj+0fP/52237xPghAAAJvHx/f P5YTqKhAVRXymODFHry6ALVitvypUX7Kd+9s511aOu7pUxTH9x+YOHEb4hCAAATaErh9YuLA/lwi 3xZHQa1f5yfV1RXyzgneHPlT5+qCtLXFjy2ItQX7RsYOHDx08k7bfvE+CEAAAndOHjp4wEvkvsbA E6i8xGAJfqqmd2lxwbbtvnJ83+j+A+OHT70DcQhAAAJtCbxz6vB4SqB22kEGUSFfn44i92Og/EEJ C8qf8slPsfWu7LxLSzMtfZo4cvq9tv3ifRCAAATeO31kwhOoWKRpi8jrCnk5pm4BfsqrC3zxeD65 IE3vcvp06Ojk+xCHAAQg0JbA+5NHD5UEKiZ4ZQ15c4Ln1e98o272+lOj/JSOLojFT7a1xavjI2P7 D04cPnbmbtt+8T4IQAACd88cOzxx0G/h2SJyOwjK12h27cFLCdTC/FQWZ/riJ1tc4NXx8UNHjk99 AHEIQAACbQl8MHX8iCVQuUKeJnixRLN7BVRrP0V5vJre+drxmN5Z+nT0+Nl7bfvF+yAAAQjcO3v8 qCdQsUbTzoGKUwxSAtVZIJ/TT83lT7WfbHFmNb3z9OnYiXP4iT85CECgNYF7504cSwlUPcHLh6x0 +ikXoHrWn1xPtnrcDy+oVmfawZnhJz8207e2uJ9OTt9v3THeCAEIDDyB+9Mnk59GbQmUHwNlBaji p9jiEo+ZCgFFBtXGT6k87qufyuLMUa+OHz1+avrBwAMHAAQg0JrAg+lTZYKXl2j6CoPGIXUL8lN6 bLBtvkubW/zoAl+c6XfvfHp3+vyHrTvGGyEAgYEn8OH50z7BS3fw0hJNX2Gwdq0/JqFaodk2fyp+ qja3pL136e6d+enCw4EHDgAIQKA1gYcXwk9+By+OqfMl5NUWl4X4KS1/Kk9GiOdKeXk8lZ9sa7BN 705OXsRPrX8zvBECEHh4cfKkT/B8j0spQDX99GbXDpfZ6k+mJ3+0VMNPGzaYn9Le4FR+OnHqzMWP IA4BCECgLYGPLp45dSKvMEgFKMuf8grNtMOlesz5nPXxHn6K8rgf7DsyakcXWPnp1JlLj9r2i/dB AAIQeHTJ/OQFqAOjI/4gFzvDoFpBvjg/5d136blSuTyeVhecnrqMn/iTgwAEWhN4dHnqdF5hYAWo 8JM/Zypu4KWHJLTOn5rLn4aHu/1k5Sfz08etO8YbIQCBgSfwsfvpuO8R9gJ57afh6oi6WGDgD8Gb b35X/OTLn+Kx5ra8wMvje0fH0uqnybNXHg88cABAAAKtCTy+cnYyrYAaG7UzVmyFZt7hUj2lcwF+ itOf4uzx5Ke8ObiUx/FT618Lb4QABIxA+KlZILcV5HHEylAsgGo+I2H+/Kn4KZY/bdzoywv88ILw k5fHz119AnQIQAACbQk8uXrOC+Rpi7DfwHM/VTtcOp7hslA/xfKn5KfxCV89jp/a/lZ4HwQg4ATc T75Cc2I8FkCFn+odeAv3U/P0gjj8afeefXlz8Okz0+RP/NVBAALtCTy5On2m3MDz5whb/mQLDMoO 4WoBebv6eHN7S9kd7Lvv4mw6u303fe1p+57xTghAYNAJPL027TfwyhEr8RCXjgVQ9SMSWs3vVpbD x5Of0tm+5iff3YKfBv2vjeuHwMIIuJ98h0teYGBn/DYXaNoJKxI/xeEqk1Pnrz9bWO94NwQgMMgE nl0/P5UWGOQdwko/lWcj+O7gE6cmz+KnQf5T49ohsGAC5idbAOULDIqftjU2uCwxf8p+isPpbHkB flrwr4dvgMBAE3A/lR3C+RkuCj+t84dL+el0tnx8BD8N9J8YFw+BRRPo9JMtILdHJHh9fN3avMFl cfWn9Ozg8NO+8JMvz7T86fmiO8o3QgACA0fgecqfYoHmiJ8AlfxkJ2jK/JSXj9vyzAs38NPA/YVx wRBYPIHnNy7EAs2ygFznp01x+nja3hKHj+Onxf+a+E4IDCSB4ic/gjxO0PRH4PkJv0vOn/LD72L7 nT9bivxpIP/AuGgILIFA8pOfAFX5yR4xpfJT2R4cfppifreEXxTfCoEBJOB+SifUJT+lDXg6P9n2 O6s/4acB/NPikiGwZAJdfooNeMr8qctPL5bcYQJAAAIDQ+BFZ/70UvxUTh8/d/EmfhqYvywuFAJL J/Di5sU8vxs/YPXxl+YnP30cPy3990UECAwSgeynOMDg5frJji8gfxqkPy2uFQJLJmB+igMM/IAV /LRknASAAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAAB KQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoC EJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECah IAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlh EgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCT ECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgA PwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASE BPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhA QEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASD AASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJ MAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9S nASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8 JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJAS wE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAAB KQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoC EJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECah IAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlh EgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCT ECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgA PwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASE BPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhA QEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASD AASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJ MAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9S nASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8 JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJAS wE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAAB KQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoC EJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECah IAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlh EgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCT ECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgA PwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASE BPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhA QEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASD AASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJ MAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9S nASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8 JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJAS wE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAAB KQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoC EJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECah IAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlh EgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCT ECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgA PwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASE BPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhA QEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASD AASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJ MAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9S nASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8 JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJAS wE9SnASDAASEBPCTECahIAABKQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAAB KQH8JMVJMAhAQEgAPwlhEgoCEJASwE9SnASDAASEBPCTECahIAABKYG/nJ9OT527ePOFtPMEgwAE +pqA+enc1OmTx48cGj8wum/P7p07tm3dvGnD+nVrh9asXrVq5ZtvvPH666+99tqrr766wtsrXS2+ aP9pb3n99TfeeHPlqlWr1wytXbd+w6bNW7ft2Ll7z77RA+OHjhw7iZ/6+g+Ji4PASyCQ/XTsZfpp /8Hspws3yJ9ewu+QkBDoVwIvblzw/Mn8dHD/y8qfGn563q8cuS4IQEBP4PlL9tMum9/hJ/3vjYgQ GAQCXX7apa0/bX+r4acz5y7cIH8ahD8qrhECIgLupzP1/G7XW9t19fEt2xp+OnEaP4l+Z4SBwKAQ SH46UepP7qctmvt3GzfVfpo4fAw/DcqfFNcJARmB4qfDE1EfDz9t2qhYX1D5aWT/QffTqTNnz19n fif7zREIAv1P4Pn182fPnDpxzP00sm+PzE/rNhQ/7Q0/HU1+etb/RLlCCEBAReBZ8tPR8NPeyk/r lrg+c7jy0278pPpdEQcCg0ag00+7S/60bnhp68c7/DR2YOKw5U+TNr8jfxq0PzCuFwJLIOB+mjx1 wvKnA2Mje8V+2mr37yx/Cj8dPzU5hZ+W8JviWyEweATMT1OTp443/LR1i9XHNflT5afxQ0ePn5yc mr72dPAIc8UQgMBiCTy9Nj01efL4UdsenPOnJfppZewPTvO7rdttg7DnT7ZB+LhtEMZPi/018X0Q GEgC7qd8fIH7aeeO7U0/rVz4+QXFT+vt/l0+wCD8ZAcYnJm++mQgIXPREIDAogg8uTqdlo9b/pSP V7H53fo8v1u4n+yAFT9fZXid+SkOWIkNLuMTR2KB5tXHi+ok3wQBCAwkgcdXbXuLLR+fGPfjC/L2 u9pPby70/KeGnzbWfsoLNM9d+ejPA0mZi4YABBZB4M8fXTlXlmdWftq4VD+tGbL8aUOnn2KBwaV7 /72ITvItEIDAQBL473uX8vKCtL0lji/w7S3DQ2vs/MyVC8ufXn/jTc+fbIKX/LRl2w47wGDv6Jjl T0d9gcGFO38YSMxcNAQgsAgCf7hzIS8vODg26svHd9j24Oyn1clPr7c/3zf5yQtQw8OeP22xBQbl Bp4tMPAbeB/+1yJ6ybdAAAIDSOC/Pky378rygp1v2e0799Ow5U9x/Pibdvx4y/PH/QByz59Sgbzb T34C+Rl7QsLD//wfalAD+KfGJUNgYQT+/D//+dCejlDdvvPlBZWfyvYW95M9+6DN8xGyn8oNPN8g HPnTnpHRA34Cue9wmb508+6jF59+7weff/HlV1//7Jtf/urbv/27v/+Hf/ynf/6Xf/23f//1r//j N7/57W9/97vf//73/ze1/0eDAAT6hkAe1jbAf/e73/72N7/5j1//+t//7V//5Z//6R//4e//7m+/ /dUvv/nZ1199+cXnP/jepy8e3b15adrLT37604HREXt6i/upXj5uywuW4Cd/gost0EwnaKYdeFPn Lly+fuud9z+4/+FHHz959uKvPvn0u9/7/g8++/yLH3355Vc/+fqnP/3Zz3/+zTff/OIXv/iltV/l 9n9oEIDAMidQRrOPbBvgNsx//vOf/fSnX//kqy+//NEXn3/2g+9/77uffvJXL549+fijD+9/8P47 t65ftocjpN13pTy+3Z8uVba3LMBP+QFTNr8r+VN+wlQ64dd3CFsB6sy58xcvX7tx6/Y779+9/+Dh o8fmqO+4pP7GLPXDzz43T/34xz82VX311U9S+5oGAQj0DYE8rG2Af/mlDXXz0uef/dDM9Deupu+Y mx4/evjg/t3337l968a1yxfP+/Qudt/F8icrj6en36XjC2o/2RPu5n7+nT8BLz0Ar+mnuIFXdrj4 Cs2z0xcuXbl+8+0771oOZYKyJOq5ZVF/nQ0VivriR0lSX3qzC6FBAAJ9QiAGdVLTj74IOWU7/bVl Ts8tdXI9ffD+u3fevnn9yqUL02djdWa1+85v323y5QVRf6qWj7ueFuKnNWv9CZ12A89OII8bePEI FytATVUJ1Ht3fZLnGVQtKMuhfviZZ1FfmKOsmWCj5YviHwhAYNkSKKM5hrYNccucPvuh2SmSp6yn x498anf3vSp98uldHD4eu+/i9PE43XftGl/+VLbftfVTvQBqrS8w8AJ5owDlEzxLoC5f9QTKZnj3 HjzMgvrOJ5986imUzfKyoj4PS2VPxRXxAgEILHcC5iU3k7WQk83sfGr36SeffMezJ9PTwwf3bHbn 6dPVy5E+xfSuLj95eXx9pE+N5U8L81PnDrwoQKUtwpFA2QTPK1Bphmdl8sdPnj73IpTN8cJQpihz lOVR1uJCeIEABPqGQAxsG+A2zC11Mjt991NLnkxPT588tsJ4mt159cmmd1Edt/TJNgf77pZUfqp2 t8Ty8Vj+NI+fVvj/2yKErgJU7BAuR9TZESu+wiAmeFeve4n8vShBeQb11OZ4YShXlGdR33dJhabs QrKr4rp4gQAElieBGMr2EkPbhri5yeWU7fTM9OTZkxWfYnZn6ZNVx/P0rjr8ycvjlZ+q6Z2vfkrl pxWvdLUVqfX0UypA+RFQ/gzhfAfv7LTdwkszPC9B+RTv48chKDOUJVGmKHOUScqaXUS0uCJeIACB ZUygjOYY2jbEbaC7nCx38rnd08cfJz1Z8SnN7i6e9+p4Nb2Lw5/K7pbO8rj7KYuoS0+vzPRT7MAb sh148YgEPwLKVkClM+oigYpbeNdu+D28ENSHdhcvpVCWQ7mizFHFUnYV3uKKeIEABJYxgTSW/TXM ZG5yOdnMzu1kc7tHD31yd/c9v3cXs7vps430KR+uEqszbXfwUN59l5aPL9hPcQSUFcjtiJU8wSsJ VGOGVwnKUyif5D1/4YoyR5mkkqZcVSEruyQaBCCwfAmkseyvPrptkNtQdzllO31U6cmKT2V2V9Kn 8mwEn97l1ZmpPN7eT2UBVLUDL60w8Dt4McHzQ34tgUproHyG5zVyq0Hdu//AUqgw1NNnVogyR1lL mrKL8ObXQ4MABJYzgTSW/dXFZM2G+vNnz55G7hTJ0z2rPb175/Ytv3eX1j7F4oLxA7Y4M5/tmw4v qHffhZ8sfZp/fhcF8jd8h3C9QjOf8WtnrNgELypQUSL3RZpRI79jRfK7H9wzQUUZ6vETy6LMUdas 70lUWVZ2STQIQGD5EvCR7C2Gto9xG+pPnzx5HIUnS57ufXDXSuOmJ8uefGlmFMd97fhBfzRCOjsz VhfUqzP99My0Obiln143QYWffILnK6DKEk2rkEcC5Wug/B6eLTKwm3i2DCqnUKaojyyJ+vixOerJ 06euqSQqvxAaBCDQLwRiaNsQt4Fubvr4kZXFP3zw4H4kT1YaNz3Z0gK/d+fF8VhckNKnWJxZVj81 V2c2bt/Ncf8u8if3U3OCZ37KSzRTApVneCEoz6Devu2CshTKZ3mmqHCUSSo0ZRfgqqJBAAJ9QsDH tDUf4R+Hm0xOVha/F8nTu+/cdj1Z9mR6snt3PrtL6VNUx/3sp3pzS+fhmQvIn4qfYotLPCTBn9KZ EijbJWwzPFtF7hmUCcqLUGEoU9T9+w/cUSYps5Q1639ufjU0CEBgORMoo9m1ZM2G+UN304P7ljrd tanduz63u5n1ZEsLbGeLze5sbWakT2Vxpm2+W9tVfmqZP1UJVDXBi4e45ATKKlD7D1qJ3I4xKIK6 fDXmeGEoT6I8izJHmaRcU9bsEmgQgEBfEYih7WPchrq56d4HXncKO8XczkrjsfJp8pQtfbKl4wf3 5+pTpE95ceaM6d08+VPHCvJYAZUeMhV78OwU8riFFyXyI8eSoM6dv3Dxckqh3r59x5MoU1Q4yi0V nrL+h6v8WmgQgMDyJ+Bj2pqP8HvWzE1ZTndsahfJ0+WLF3xy53rKs7u4eed7WxrV8a7VBUVPs9Wf uvwUd/DyEk2vkPsazb0jXiKfOFwJavrCxUuRQt28aXUoV5Q76n2zlGnKmvc/Nb8aGgQgsJwJlNHs VrJmw9wGuyVONq8LOZmdrnnyZHfuaj357C7dvNvuR6vY4idfnJnSp8az72b1U2MBeZnfNe7g+RKo VIHaudsXkTcFNXVuOqVQ12yWZ4Z6+7Y7yiRllgpPhansKmgQgED/EDAruZfcTO++4266/XakTteu Xb3iyZMtLKiyJ9PT2Ig/NzhvDc5HP5XpXbU6s/ipe3uLfx5bXHyJlAnKdhM37+DlJQZ2Cy9K5KkE lTIoW2Zw9tx5K5NftlneteuuqHCUScos5c26n5tfDA0CEFjOBMpodit5s4F+O9zk8zpLna5c9sqT ze1sYUGa3KXiky3NtOJ4qj75k1s6quO2/CnUExLqZadOP6UjDNIdvKoC5ZtcYoa3bzRq5C4oW0g+ aQuhvAplirpyNRR146ZN9cxS1qzn1uwSaBCAQB8RSCM7BvmtWzbgb4SczE6XLnrlyZMnW1jgtafQ kxWffGnm9ji5oE6fulYXpPxpDj/VBaicQK22p+Cttcd0xjGatkvYSuR7bJGBC8pqULbM4KRtdZmy SZ7P8i6ZotxRnkdZs15bu1W1uBheIACBZUygGs5uJWs+0i1vunb16hWTk9Wdzk/b1C6SJ1tYYAuf /Nad6ynN7uK5d/lk36o63rl6fC4/1YKKCV6qkLugYhG5z/BcUCOVoCyFOnl6cnLq7FmrQ6Usyhxl kjJLWbuem18EDQIQ6A8CZVzHILfBbkPep3UmJ6s7nbUDCyZPn7TkqdKT1cZdT2V251tbZq+Ot/VT qpBHApUEtcVneFaCSoKyu3iHYo538lTM8lxRlkXZTM8TKWvWaWvWexoEINB3BNL49pFuaZO5KTIn k5PP7E65nmxuN+Glcb91F8Wnam1BOdnXTx5vVR3P9acVkT91VcjrClQIaqcLyqd4B2yhps3xPIUK Q1mp/Ow5d5RJKjTlokrNL4IGAQj0B4Eyrk1LLiZTk8/qPHM6U9nJkicrPbmefHKXik+xtiDN7uzm Xak+dVTHV8xY/JTyqXxEXXOCFwmUH0MeJag0w4sauQvK10FZESoZKivKauVTISmzlHvKm/eeBgEI 9BuBNL59pJ8LNVnRyeZ1kTrF1M6SJ9PT6EgvPfnsLj24ZUb61NZP1RIDn+HVJagyxTNBRQoVhvIk KrIoq0WdOZMsddaadTyaXwQNAhDoDwJlXPsYt6TJzGR50+TpkJPXnTx3CjvZ3C70ZLUnm9z5ykzP nnxtQUf61Nx7185PZYnBylWWQFX38PwgAxeUzfE8gxrbn3Mon+YdO+6O8qneabNUeMp67a6iQQAC fUfAR7c1H+s25C1vOnnixPHjx7wqnu3kpSdf9+Sl8aKnxuxu5Ztl7XgLP5Ul5PUELyVQdguvmuFV UzwXVMzxLIXyWZ4lUaao7CiTlFnKmvU6N78GGgQg0B8Eyrh2LVmzAX8iuynJyXOnKIynuV2tp7T0 KdIne25L6KlzccFs5ScrQtUPSageM5UrUNUMr0tQdQ6VFWWOMklZJuW5lDfrOQ0CEOhLAmmM+2i3 QW9D/0hkThPjXndKuVNUxrv0VGZ3nTfv5trbMkuFvCRQaYYXJahKUDHH27M3DBVJ1MFxK5Yf8jzK mvXVPZWa958GAQj0E4Eyut1LJqZQ0yErOo0fjNQpZnbZTtXkrhSfcnF8YelTyZ/KBC8qUOkg8hmC ykUon+S5oUbHvBJ14KA7yuZ6oanDyVTe89z8QmgQgMByJlBGc/7XhrlVm6zZwM9u2j82Nup1J7dT Lj2l0vhMPaWbd22qT/X8Lq2BsvPKc4k8TiJPNXJfpukZVFTJo0xuhrI61L6RhqNMUtasu9685zQI QKAfCaQxbl6ydjDypuSmkX1Wdyp2isq437lzPfnCTL93t9KKTz2L47PcvYsZXnMJVDpmpZ7hRY08 78Tb5LfxPIWySZ4VyiOJCkVZHmWJlGVS1qy/0aLzvEAAAn1GoIzwGO427G3wj1ri5HKy1Mnu2tlt O5/aefLkCwvSyoK8tKCrOF6qT3PpqaqQN2Z4TUHlZVC2FS+nUMVQriif6JmjPJFyS4WnrM/eov+8 QAACfUQgjW1/jeEeZspucjkVO/myAkueKj1F9hTp0xs2ufN7dy1nd55B9UygSgkqpniWQaU5nqVQ thRq23ab5XkSZYoKR5mkkqZCVNbp1OISeIEABPqCQBnX/q8nJS4mT5t8VpflZDfttm8zO6XkyeZ2 aV1mWpgZ2VP2U33wk+nHLTR7K36KBKqa4XUJKp22stEneTHL82meKcoclSTlqZQ173DV4hJ4gQAE +oJANbD9gxjue6yFmixx2vmWT+xiZhd2SslTLBufR0/z+GlGAmUlcpvhNQVlW/FyClUZypKocFSW lFvKmne4anEJvEAAAn1BoBrY/kEa75aeJDWFmzx1yrlTFMajMp5K43ly15zdtas+WV41I4HqJSg3 lB1Y52Uov5VnSVRM9MxRlkhFKpWyKe+xt9R/XiEAgf4hkMZ2vNpwt+Zj3xRgyYq7yeXkZXG3U9y3 8xOfZmZPUXyq9DRf+tTlJ5/hdQjKt7r4aQZRhQpDZUUlR3ki5ZZKnvL+Wkud5xUCEOgvAml8x2sM eh/927KbspySnaLylO3UK3tq76c6g4qqlfupISjfK1wEZZO8nESFoiyNckdZImXNOxotus0LBCDQ pwTKSHcxhZosbzI3ReaU5eRTu0by1CyNv9aZPs1eGK//p+cMr9SgQlCVobwOZUmUzfNMUTbT87le 1lQxVfSaFwhAoH8JeF5iLQa/W8BkYEowMdjEzuRU2SlOfKr0VC0tWEj2NFsJKgnKV5KnFComeVEp T4pyR7mkwlLZU9Hf2lfpIniFAAT6gkAZ35WXwkyuJndTyClSp8idovJUVo17aXyxeqpLUNUig3qK Z4LqNlSa53kaFYlUspSbKqvKhUqDAAT6lUAMdn9xM4WazE2WOaXUqcNOljzZppZy565zcrdi3uJ4 nuRVM7wZgrJ1BslQq70MZTmUVcotiXJFWRplLSyVPRW99Zeq/3wAAQj0DYFqgMcHeeiHBtwHMa8z OVlZ3HKnMrVzOy1RT3WJvHpYQiqSV3O8lEI1FOWOCkklS9Wiyp3mHwhAoJ8JhJbsxc3karKak9fE s5zMTja1q5OnmNstMntqVqBSAhWrDPwunguqSqG8DuVJlGdRnkZFIpUtFb2sXFX6zr8QgED/EUij PV7dTKEmd5PLKaVODTtVpaekp7o23nZ255O8rhneqx2GsjmeT/IaSVRyVJJUpFLRzXhp9J0PIQCB PiNQj3T/KNKUUFO4yeWUUyfPnXLlqZE8vbo4Pc0jKE+hiqE8iUppVJZUzqVST/Nr50XwGQQgsPwJ dAzx+MRzJmueNkXiFHLyiV2xU3fytFg9zSWoMsmrFZUcFXM971jqZK/XmVfEVyAAgeVFoNfITl/z 0e8tchZPnGJeF3IqdfG0rCDP7Ravp6agchGqnuOFoSKJiizKJ3rWUqdKLpU62vU6+5XxPxCAwPIg 0DWom58WByQjeOJUyylyp1nmdgupPc1YZJDv4uUiVNTJG4ZKisqOamiqdLX6t3kdfAwBCCxfAtWg 7v4giclew01JTpE6New0M3lqvfIpuyn9UxfJSwaVUqhkqKSolEVlR1mfqv41Pui+Bj6HAAT6gUBj kFcfJjGVxCm5Kckp5U7FTo253SKypzBUQ1A9DdWhqFwyr7rX21XVZfABBCDQJwQag94/9Ntn0Xw5 UqzGLNtZ8nZgO3qg6ZaOrGghnzSDxHEG9hInGuT1mnlFlHeidCn+7eovn0IAAn1PoEMB7gRvbiZr xRrFIk2zLMRIXe9thqlSqKKo9JPtNfUkXjv6yCcQgMCAEWjIoBJEtlORU0fytNjJXTJVh6BmGCr2 DedeNPpVfThgvxouFwIDSKAa7o0PKjVVmVNVd+q009L01LHMwFxVGbCe5zUd5b1qdJIPIQCBgSJQ e8k/KrO6uuxkAulMebombAv/tDNc01Blnhe96OzYLJ8N1K+Ki4VAXxKYZXB3frlWU4ecuuy01Owp dNZlqFkV1d5TnZfCZxCAQJ8QaHopPm5MubrlJLGTKapbUB2Gsp8/o0/dX+gT9lwGBCBQEege5TM+ b6ppxsTOpLLwydxs3zHDUN2KamOpGf3nCxCAQD8S6DJTLzkJ7eTWmmmojmp5R4f6kTjXBAEIzE2g QwKNT3q5Y7ZMaPFf7/VTZndUo3t8CAEIDCiB3tZYvIXm+s7eP8u+OqDsuWwIQGBWArPqYi7HLO3/ Zv2R6T9m7Sr/AQEIDAiBeSSxNAPN+93z/PTu/x6Q3wmXCYGBJNA93uf5fF69KN4wTx/4bwhAAAIz CCjc0zbGjB/OFyAAAQjMQqCtV5Tvm6UrfBkCEIBARUDpnIXHqrrBBxCAAAQaBBZuk5f5HY2O8SEE IDCgBF6mY4gNAQhAAAIQgAAEIAABCEAAAhCAAAQgAAEIQAACEIAABCAAAQhAAAIQgAAEugn8f2XP Z2gKZW5kc3RyZWFtCmVuZG9iago3OSAwIG9iagoxMzMzNgplbmRvYmoKODAgMCBvYmoKPDwgL0xl bmd0aCA4MSAwIFIgL04gMyAvQWx0ZXJuYXRlIC9EZXZpY2VSR0IgL0ZpbHRlciAvRmxhdGVEZWNv ZGUgPj4Kc3RyZWFtCngBrZZnVJPJGsef900jIaElVCmhN+nSpdcACtLBRkgCCSWEFFTsyuIKrgUR ESwrugKi4FoAWQtiwYpg7wuyKKjroi42VO4bWOKe++l+uHPOzPzef54pz2TmnD8AdZAtEuWgagC5 Qqk4NiyQmZySyiT1AQIoEMAT3NkciSggJiYKsDLZy/l7eX8Hi8bKTTv5XN/1/4nUuTwJBwCJwaLT uRJOLsZHsdrFEYmlALgiTDddIBXJuQ5jhhjbIMYn5Jw5wd1yTp/gP8Zj4mODsJiPAEpUNlucCUDF YzqzgJOJzUM1w9hRyBUIMY7H2JfDZ3MxLsd4am5unpzbMbZK/9c8mf9iNjtdMSebnangiVywkdjC wQKJKIe9aPzj/9nk5siw8xovJlhL5YvDY7HeAjuzuuy8SAUL02dGT+oCLKNJ5svCEyaZIwnCznJi LJcdHDnJsuyEgElmizH6J0YgZcnPa3wtcV6sYn5hzkz5/RjX+TyWgnmSkLhJPUMQyprkQn580iQX CBJnTrIkO06xh0J+kEIXy2IVe84QhypyzJVgI/9Zl8P+vpaUHx8+qfMkyYr9cHnBIQpdmKDYm0ga qJhTlDN+18dz4eWEKXRJQZxirFQcr9Cz2BHyuzseL5LGKM4H4oEPMhACF3gghnTIgxyQAhOCQQAS EGFfbMCuh5S3UIqNh6A80SKxIJMvZQZgr4jHZAk59lOZzo5O7gDyNymPAXinNf7WEK3L37X8dgDP Euz/lz8HpjwKgG0KcPwZAP39d830LXZdNgKc7ObIxAUTcXh5RwAKqAIDdMEQTMEK7MAZ3MAb/CEE IiAayyQF5gEHyycXy2QBLIGVUAylsBG2QBXsgj1QBwfhMLTACTgDF+AKdMNteAi9MAAvYRjewyiC ICSEhtARXcQIMUdsEWfEA/FFQpAoJBZJQdKQTESIyJAlyGqkFClDqpDdSD3yK3IcOYNcQnqQ+0gf MoS8RT6jOJSKMlAD1AJ1QD3QADQSjUfnoploPlqIFqHr0Uq0Bj2ANqNn0CvobbQXfYmO4ACnjNPC GePscB64IFw0LhWXgRPjluFKcBW4Glwjrg3XibuJ68W9wn3CE/F0PBNvh/fGh+MT8Bx8Pn4Zfh2+ Cl+Hb8afw9/E9+GH8d8INII+wZbgRWARkgmZhAWEYkIFYR/hGOE84TZhgPCeSCRqES2J7sRwYgox i7iYuI64g9hEbCf2EPuJIyQSSZdkS/IhRZPYJCmpmLSNdIB0mnSDNED6qKSsZKTkrBSqlKokVFql VKG0X+mU0g2l50qjZDWyOdmLHE3mkheRN5D3ktvI18kD5FGKOsWS4kOJp2RRVlIqKY2U85RHlHfK ysomyp7Ks5QFyiuUK5UPKV9U7lP+RNWg2lCDqHOoMup6ai21nXqf+o5Go1nQ/GmpNCltPa2edpb2 hPZRha5ir8JS4aosV6lWaVa5ofJalaxqrhqgOk+1ULVC9YjqddVXamQ1C7UgNbbaMrVqteNqd9VG 1OnqTurR6rnq69T3q19SH9QgaVhohGhwNYo09mic1ein4+im9CA6h76avpd+nj7AIDIsGSxGFqOU cZDRxRjW1NCcppmouVCzWvOkZq8WTstCi6WVo7VB67DWHa3P2gbaAdo87bXajdo3tD/oTNHx1+Hp lOg06dzW+azL1A3RzdbdpNui+1gPr2ejN0tvgd5OvfN6r6YwpnhP4UwpmXJ4ygN9VN9GP1Z/sf4e /av6IwaGBmEGIoNtBmcNXhlqGfobZhmWG54yHDKiG/kaCYzKjU4bvWBqMgOYOcxK5jnmsLG+cbix zHi3cZfxqImlSYLJKpMmk8emFFMP0wzTctMO02EzI7MZZkvMGswemJPNPcz55lvNO80/WFhaJFms sWixGLTUsWRZFlo2WD6yoln5WeVb1VjdsiZae1hnW++w7rZBbVxt+DbVNtdtUVs3W4HtDtueqYSp nlOFU2um3rWj2gXYFdg12PXZa9lH2a+yb7F/7WDmkOqwyaHT4Zujq2OO417Hh04aThFOq5zanN46 2zhznKudb7nQXEJdlru0uryZZjuNN23ntHuudNcZrmtcO1y/urm7id0a3YbczdzT3Le73/VgeMR4 rPO46EnwDPRc7nnC85OXm5fU67DXX9523tne+70Hp1tO503fO73fx8SH7bPbp9eX6Zvm+7Nvr5+x H9uvxu+pv6k/13+f//MA64CsgAMBrwMdA8WBxwI/BHkFLQ1qD8YFhwWXBHeFaIQkhFSFPAk1Cc0M bQgdDnMNWxzWHk4IjwzfFH6XZcDisOpZwxHuEUsjzkVSI+MiqyKfRtlEiaPaZqAzImZsnvFopvlM 4cyWaIhmRW+OfhxjGZMf89ss4qyYWdWznsU6xS6J7Yyjx82P2x/3Pj4wfkP8wwSrBFlCR6Jq4pzE +sQPScFJZUm9yQ7JS5OvpOilCFJaU0mpian7Ukdmh8zeMntgjuuc4jl35lrOXTj30jy9eTnzTs5X nc+efySNkJaUtj/tCzuaXcMeSWelb08f5gRxtnJecv255dwhng+vjPc8wyejLGMw0ydzc+YQ349f wX8lCBJUCd5khWftyvqQHZ1dmz2Wk5TTlKuUm5Z7XKghzBaeyzPMW5jXI7IVFYt6873yt+QPiyPF +ySIZK6kVcrAzM9VmZXsB1lfgW9BdcHHBYkLjixUXyhceHWRzaK1i54Xhhb+shi/mLO4Y4nxkpVL +pYGLN29DFmWvqxjuenyouUDK8JW1K2krMxeeW2V46qyVX+vTlrdVmRQtKKo/4ewHxqKVYrFxXfX eK/Z9SP+R8GPXWtd1m5b+62EW3K51LG0ovTLOs66yz85/VT509j6jPVdG9w27NxI3CjceGeT36a6 MvWywrL+zTM2N5czy0vK/94yf8ulimkVu7ZStsq29lZGVbZuM9u2cduXKn7V7erA6qbt+tvXbv+w g7vjxk7/nY27DHaV7vr8s+Dne7vDdjfXWNRU7CHuKdjzbG/i3s5fPH6p36e3r3Tf11phbW9dbN25 evf6+v36+zc0oA2yhqEDcw50Hww+2Npo17i7Saup9BAckh168Wvar3cORx7uOOJxpPGo+dHtx+jH SpqR5kXNwy38lt7WlNae4xHHO9q82479Zv9b7QnjE9UnNU9uOEU5VXRq7HTh6ZF2UfurM5ln+jvm dzw8m3z21rlZ57rOR56/eCH0wtnOgM7TF30unrjkden4ZY/LLVfcrjRfdb167JrrtWNdbl3N192v t3Z7drf1TO85dcPvxpmbwTcv3GLdunJ75u2eOwl37t2dc7f3Hvfe4P2c+28eFDwYfbjiEeFRyWO1 xxVP9J/U/G79e1OvW+/JvuC+q0/jnj7s5/S//EPyx5eBome0ZxXPjZ7XDzoPnhgKHep+MfvFwEvR y9FXxX+q/7n9tdXro3/5/3V1OHl44I34zdjbde9039X+Pe3vjpGYkSfvc9+Pfij5qPux7pPHp87P SZ+fjy74QvpS+dX6a9u3yG+PxnLHxkRsMXvcC+CwFs3IAHhbC0BLwbwD5qspKhOeeTwCmfD5GMv9 vrzKy3/xhK8e/8UNoNYfIGEFQFQ7wE6smmMs99ZyyxTvD6iLi6JiirxIMlycxwGhijFr8nFs7J0B AKkN4Kt4bGx0x9jY172Yt78P0J4/4dXl0UQ1gDJLbQYFudbiMD78381/AF51Cx0KZW5kc3RyZWFt CmVuZG9iago4MSAwIG9iagoyNzcwCmVuZG9iago3NyAwIG9iagpbIC9JQ0NCYXNlZCA4MCAwIFIg XQplbmRvYmoKODMgMCBvYmoKPDwgL0xlbmd0aCA4NCAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUg Pj4Kc3RyZWFtCngBtVlNc9w2DL3zV6A3bWesiNR3L53a6SHtdBrHmumh6SHd2olTr52s4qT5if1X BSnikfrYXW+cescj7QoEiIcHEKTe0zm9p7xMmzZrNeVVqjO+o1q3act/VBYZbS/pN7qlJ2e9pnVP 2n369XSYzqNh+TBe8dirb6ktTUmfeNzbQcvZBWXuc3HG5rM047+6qYtMF+7nk/FPla7dBKms3QTV ekMsYsoya6vM3mZ51eQFbVhXabKszCrSpSlYLd3QBTtp3YSaomnToilIm4yqJq1M0dZ2ps7L55fb 9eW7D/evbmh7zaOskP04wTLL52p4Nk+ebTQ9vRsMqQfjaSye7Ig1kBbEmLI9Z01T3aYuFKUu0qYp rM+n3YCVoY7Rb50gX9osrQv2n074S8eT6TrDaror+p2SF3f3r9/Q2d1tf3nb3/crMnWjElrRH9T9 RD92DpmpzaJgRjBAg03mQunIYGGIvpyYRg3mGEprLvlmRd3bQamw5YB3wZJi7yLlkSUGoMrZO9N4 7zi4C+YGMC0oahHIYMoCycqsO3wxdaTaknsA7teVjYxKbleOa5SsL+WO0bNuJZs7+WWLZ9/5ZyJz LSI9rZQb9cFLvJEnscigeCYC9aJ2e71SNgUoeS1qoE9Gi+wrkXg3u9l6D1QCoTX0fC/irCiwxRI1 Syv3P8JZZ9XA2EKbiLG6SuvAnvDlxLRpbXnlg7qXQwVD9wCTQthghWkkX3hWZWHKiqPtLXv2HqLT OC+nbg42lRkqF19Mnea1LRSw4z0M3DoTZO/lZhsYdCuRlThOKfWnDAox+xsEAV3/GqRcrjuiQHpO gxvRCCquIS2zAOFAepgSon3EoLlCPx0SoqlEFGPqnCEPpX/nJUHfBQBGrA11Vef5QNO85lUFRS7E jxcUU3hqhJCdAhq4DZfmj5CUkvS/BC97oAQpPBQEwIs+0j1NeBEWIJG4M3XracwW0P9H1IjaK4+x 1Aiud/JI4B+uKnkh/HnOEnGp4CKb2kI7LhSIQNFGEfBrv7twBIaqsXuBsdX7WMWai1dpdGkjPNK/ UAKWGDOar+8L+GLyVJsym6sN9PkZMcEN0vAg70MOj4Hn1T0G3mX5PPMkrt7wZPF38dkXI8MSyJKv GaMdih8bo5Hao2IEMBGiWd5wF4CEjJD2mYnKgMSWhEHKQwTFQ0R8yqsEvIAIRksoMQeom1ns72UZ gT7coBpsRSE8hk2ZlhRWlXyWn6AH89ribgNNM9Vbz3OVwAj8kFojVzxYoxICblHMpTWUmihbS9+G mFZHzA1MsPU9myzJKvkkmQTTYgdlVfzHTICjiKLHwxNxSMYCKICIG5QBkR05eLjtMlW8nqHtsVUy +oKmZHdlDa37oU7Pm/R7k8hKZHLedu3v4pXdEi3Udukux26GZXveds3W8B8QOQkY2LpFJiFCIuMJ oZKPkJ52ZJ1fKuWKSmLXQ1eW49bIVwsQDekwMw2D4IZMypNSJRARSzIHUFAymMJWRmTjpsbPCpPB 9IBMXGMWM0/WdZPHG4AQItdZTTKPkge1RmEJBEiYF6YsbiGlINv3wAk5+qVA+e2gt6qS/UC56D/z LHgqReZl0r9c8XQDjLzK8h5nd69kMncMIDucYbcx7pU8sryRUpPN+FI+IVg7FD9yHR7PN1TfB/RK F0B0g0gicxHHrURbSuydLHh4gvBDDW5sQo3A39uo6tqdh0id2w/+9GhiH/i7FM/B3100o6VPYjpW uw/8WTZeYMEFVv5GJSgpR/QNtNg3+GJzVN9AIdN6zORGgo5YS4UEUWblQSSgRJjU+RMaqQyjMn4E W4rKNh7/A1t2KH4sW0Zqj2ILChqw9LCrBEsW6jRkJACCe1ihEDSQTzbQMgbdGERFi0RNrqPo+b3R dOkVrbGyONCHGiBtT6ZDqOWoaVfPFSr0tEhEPdeBoy5vUhaCRZPznsv3Qgv7XLYcTk4nG3XpuUY2 jzvqOp1FnSPoIVbneKmwVCQXrVNoJ/hlAJ97axMO2ryXtT8f/nd0HP3FXurMHbDrYGdcNe1puhx7 H9pON7nlS2a+fnHYqfmR1WGi96jygBREfvkyrRIs6Lj5HJ83u3xlXEMyhmWuLN2rkYYaftvD70gq D6Z7aeTejeiBTnzRRZMWecNHM/xleFnhD2WSKgrb+X+8mW7cCmVuZHN0cmVhbQplbmRvYmoKODQg MCBvYmoKMTYyMgplbmRvYmoKODIgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAv UmVzb3VyY2VzIDg1IDAgUiAvQ29udGVudHMgODMgMCBSIC9NZWRpYUJveApbMCAwIDc5MiA2MTJd ID4+CmVuZG9iago4NSAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgL0ltYWdlQiAvSW1h Z2VDIC9JbWFnZUkgXSAvQ29sb3JTcGFjZSA8PCAvQ3MyIDEwIDAgUgovQ3MxIDcgMCBSID4+IC9G b250IDw8IC9UVDYgMzIgMCBSIC9UVDcgODYgMCBSIC9UVDIgMTIgMCBSIC9UVDEgMTEgMCBSIC9U VDQKMzAgMCBSID4+IC9YT2JqZWN0IDw8IC9JbTEgOCAwIFIgPj4gPj4KZW5kb2JqCjg4IDAgb2Jq Cjw8IC9MZW5ndGggODkgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AaVXS2/c NhC+81dMb9oCK/MhilIvQeL4kBYB7FhoD0UPxmb9SHaTWLtB0n/f4WOG0moftmsBJlcazvObj+Qj XMEjGFs2rWwVmLpUEmfgVFu2+Ae2ktAv4S/4AmfnGwWLDajwbBa7y5QZLDNxvcC1t79Ca7WFH7ju U9Ryfg0yPNfnaF6WEv9c4yqpqvB6Pn5VKxccBOuCg2KxBhTR1sq2ln4qTd2YCtaoy2opraxBWV2h WljBNQbpw2Q1VdOWVVOB0hLqpqx11TrvaYjyctkvlt+2329W0D/gKi/knyBopZmqQW/O3q0VvP0a DYkn51P7fGIg3kBZAeYU7QVrClxbhlLYWpV1U/mY33Rg2vAZh6YqdWVqC3P80aELXadxcXcLf0Nx PgsJguL7LOgvenrRz4RPHRRLevMliWwhTV7Tl2/pBY2s5Gv6cEPKFrTkPn35DZVp10CB4z/Q/Q4X XajBJDplfXSwWItRdEoqrKRVe6N7l4xsyCpPYrgiB8dfztKaqzRSYjgNLLl9SCIxSlFQglBCO1e6 k0FVxpUK4RhLpmPMYZgbKWKtEH2+VsUvM+g+xexQg50ARNbuU5a1+0y6RmtMmUyAwC7YYySiLuBo L+KSAUJchD/q1C406tCA54KIuIufiJKIrBVNbmjyQDjBVEYZwto25RpxswNLkuhZS5QVBdYnymKB 4oTVsiz7QGpY9jZZhJkIffCZEcATjoQtsYE7Mkl6yanDAXTJII0fSMUl6tjXG0rWsfWRDz2OUiEC J2rokHi5JEh+XOxUi2L1cHe//bH0/9EAgSuACiM+wDJIJAch65AudkErSO8TQXtI/wC0aCb1xstg OzIhco4GsM2RZOAymVBFqU4JMaLICGEYkOybKUI+Unmnn+6oDWj5Zc+wjDiCgl8seDbB8p8JqaLo N2yFxSdO8gsGOE/Y2SW5xm/IR9bb45ujcDVaJwwFLj8GUtyikIBj827YG2pN/rQir16R8MiHE0Sp GzwtHKDhDLaXE3HWf5CIM+Behulk4hgVZxMZ0xd/vKfyMXgYMwwH5jLCHnPY5llprsyApfJ+5Lkp O/c/0nxA/5g6nrPjid1TCB6kBkh5MnV8IHgyghc84yxTcrkQ/1JpuLOSrPCHpbAn0RouCKsliTXv dEwAbGC623KlaflAlrqQbKJI7nLcL3DPqNGrenw65T0KT9uD1OG1wYZ7g2/+wY+5qUpH9H4UCngB eIq91BEDEwN7qiprYxB+3uhJYIhIVKOj0IHwdBNOTTjgpmKcvw2MjChEVjwOXXPFFnNKOtEb1/0k o6bkpmA11gEfHJRBvDbK7Vjnw1iXcMSWaAsLh9lIu/Pn7l0JKPN0txB5q5pgnYP/Sag6ROCh3AFi +/Ov6hG8mnhXAhUnc6NLbfw9NZ1PYv73H6pPIeuYKWVK2zi8z7DFFx1VGFYjWyIXdgCrcWSZ29+/ 5ssdAYuSfD/hI5KYEgnzB2/4XLQ+FSvwUeaCR4RXaGuwNtxNG2jwuo2X1DrddPIJVcWewkFVTVmZ Bq+piq4+KZbCoXd0jLz6D7xyWPMKZW5kc3RyZWFtCmVuZG9iago4OSAwIG9iagoxMTY3CmVuZG9i ago4NyAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgOTAgMCBS IC9Db250ZW50cyA4OCAwIFIgL01lZGlhQm94ClswIDAgNzkyIDYxMl0gPj4KZW5kb2JqCjkwIDAg b2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCAvSW1hZ2VCIC9JbWFnZUMgL0ltYWdlSSBdIC9D b2xvclNwYWNlIDw8IC9DczIgMTAgMCBSCi9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUNiAzMiAw IFIgL1RUMiAxMiAwIFIgL1RUMSAxMSAwIFIgL1RUNCAzMCAwIFIgPj4KL1hPYmplY3QgPDwgL0lt MSA4IDAgUiA+PiA+PgplbmRvYmoKOTIgMCBvYmoKPDwgL0xlbmd0aCA5MyAwIFIgL0ZpbHRlciAv RmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBrVbJchMxEL3rK5rbmMKK9pFOFDiBCgcqwVOVA8UhDA4k xFk8SQX4Q/6Klkat8UpSFPZBspZ+3e91t3wLx3AL2nIfRJCgHZcCZ1DLwAN+wBoBixmcwBXsTToJ bQcyfbt2/ZrUS9d0f5/h3bPnEKyy8ID3LnorkymI9J1OEF5wgZ/a10ZIk5bHq0tO1slBsHVykLVz wCPKWhGciFOhndcG5mjLKiGscCCtMmgWLmGKQcYwixnjAzfegFQCnOdOmVBHT1OUR7NFO7u5uz+9 hMU53oqH4jcdtEJvmkFv9g7nEvaveyAWfObTaG5NkB5s0JFPj5wpXhvjCqnrcDb0FJSDG8Zi9BFP FcB1JXYLqKKAyFyMiBuGImKAKTwJdeBJe2sNR2IBYV43vTgKGpQ7pIM4KBF47ayBMf5o0JumUUxC cwbV+9mPuxE0F3DQIBmUMgUREDEtxgwgNwCzQPCgHaYIIi3YYz4teRIMV6GWS554DCh68ju6wciN 1cCjGwKRHo1+QNLCch2Cikgsx5yRYAh403Pj/RKbOb/TMMbEauYMycNMTC4/GwxtZe4R62ywLlFd q6SFHiQqhBWxDrLTXkwx1D5nPg6qTjWK0Senoz3Z2/sI1WSUqhGqU5pcDhMWCxUq5CiNZ3m8phML 2nn1hZbK3g2tYErhbVad00I5ckUrZOYzLfyklf4yVN9oZzZac+okO/U2jy/pJJr4BM27ksybWXSL eR+7w1A+xi2XzyAJ9illeJ26ap8/67KzHQWzRaYdGEuyZ6icqlvExwzrw0n+b+0EK6GwrdmwGtGQ E/tEYVGK5Oiuif75jA7R3gMtlFuL77S3okXpHdtbmMGHbGhhT9OA/bVpbdFgB8b/1mAZ5h81KGXT tffEcNfBiKWSLFVLhUKMH+ZyOGjy5E0e6UAgY4EkpZ2CuFGfR4uC95WuF6dyQrDYLobCG7i3Nr1R Hjy+8/hYuY1HSvaPNQ7SeG60xxYoRa6CnJ6VR/OkNj48JggZXHyCNmYrZWHxf1L/Qsa/I8663CYH TKxx/NFX91ALT+AxNyRNjBCPY5o8hTaoXiSBEn1J2tKZf5VSa0sbJNMfCLScKX33nnQtXbV09qJw i3YGrY7/AOwsHbAKZW5kc3RyZWFtCmVuZG9iago5MyAwIG9iago4NDQKZW5kb2JqCjkxIDAgb2Jq Cjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyA5NCAwIFIgL0NvbnRlbnRz IDkyIDAgUiAvTWVkaWFCb3gKWzAgMCA3OTIgNjEyXSA+PgplbmRvYmoKOTQgMCBvYmoKPDwgL1By b2NTZXQgWyAvUERGIC9UZXh0IC9JbWFnZUIgL0ltYWdlQyAvSW1hZ2VJIF0gL0NvbG9yU3BhY2Ug PDwgL0NzMiAxMCAwIFIKL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvVFQ2IDMyIDAgUiAvVFQyIDEy IDAgUiAvVFQ4IDk3IDAgUiAvVFQxIDExIDAgUiAvVFQ0CjMwIDAgUiA+PiAvWE9iamVjdCA8PCAv SW0xIDggMCBSIC9JbTEyIDk1IDAgUiA+PiA+PgplbmRvYmoKOTUgMCBvYmoKPDwgL0xlbmd0aCA5 NiAwIFIgL1R5cGUgL1hPYmplY3QgL1N1YnR5cGUgL0ltYWdlIC9XaWR0aCAxMTkyIC9IZWlnaHQg NzA4IC9JbnRlcnBvbGF0ZQp0cnVlIC9Db2xvclNwYWNlIDcgMCBSIC9JbnRlbnQgL1BlcmNlcHR1 YWwgL0JpdHNQZXJDb21wb25lbnQgOCAvRmlsdGVyIC9EQ1REZWNvZGUKPj4Kc3RyZWFtCv/Y/+AA EEpGSUYAAQEAANwA3AAA/+EAdEV4aWYAAE1NACoAAAAIAAQBGgAFAAAAAQAAAD4BGwAFAAAAAQAA AEYBKAADAAAAAQACAACHaQAEAAAAAQAAAE4AAAAAAAAA3AAAAAEAAADcAAAAAQACoAIABAAAAAEA AASooAMABAAAAAEAAALEAAAAAP/tADhQaG90b3Nob3AgMy4wADhCSU0EBAAAAAAAADhCSU0EJQAA AAAAENQdjNmPALIE6YAJmOz4Qn7/4gfoSUNDX1BST0ZJTEUAAQEAAAfYYXBwbAIgAABtbnRyUkdC IFhZWiAH2QACABkACwAaAAthY3NwQVBQTAAAAABhcHBsAAAAAAAAAAAAAAAAAAAAAAAA9tYAAQAA AADTLWFwcGwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAtk ZXNjAAABCAAAAG9kc2NtAAABeAAABZxjcHJ0AAAHFAAAADh3dHB0AAAHTAAAABRyWFlaAAAHYAAA ABRnWFlaAAAHdAAAABRiWFlaAAAHiAAAABRyVFJDAAAHnAAAAA5jaGFkAAAHrAAAACxiVFJDAAAH nAAAAA5nVFJDAAAHnAAAAA5kZXNjAAAAAAAAABRHZW5lcmljIFJHQiBQcm9maWxlAAAAAAAAAAAA AAAUR2VuZXJpYyBSR0IgUHJvZmlsZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAbWx1YwAAAAAAAAAfAAAADHNrU0sAAAAoAAABhGRhREsAAAAuAAABrGNh RVMAAAAkAAAB2nZpVk4AAAAkAAAB/nB0QlIAAAAmAAACInVrVUEAAAAqAAACSGZyRlUAAAAoAAAC cmh1SFUAAAAoAAACmnpoVFcAAAAWAAACwm5iTk8AAAAmAAAC2GNzQ1oAAAAiAAAC/mhlSUwAAAAe AAADIGl0SVQAAAAoAAADPnJvUk8AAAAkAAADZmRlREUAAAAsAAADimtvS1IAAAAWAAADtnN2U0UA AAAmAAAC2HpoQ04AAAAWAAADzGphSlAAAAAaAAAD4mVsR1IAAAAiAAAD/HB0UE8AAAAmAAAEHm5s TkwAAAAoAAAERGVzRVMAAAAmAAAEHnRoVEgAAAAkAAAEbHRyVFIAAAAiAAAEkGZpRkkAAAAoAAAE smhySFIAAAAoAAAE2nBsUEwAAAAsAAAFAnJ1UlUAAAAiAAAFLmFyRUcAAAAmAAAFUGVuVVMAAAAm AAAFdgBWAWEAZQBvAGIAZQBjAG4A/QAgAFIARwBCACAAcAByAG8AZgBpAGwARwBlAG4AZQByAGUA bAAgAFIARwBCAC0AYgBlAHMAawByAGkAdgBlAGwAcwBlAFAAZQByAGYAaQBsACAAUgBHAEIAIABn AGUAbgDoAHIAaQBjAEMepQB1ACAAaADsAG4AaAAgAFIARwBCACAAQwBoAHUAbgBnAFAAZQByAGYA aQBsACAAUgBHAEIAIABHAGUAbgDpAHIAaQBjAG8EFwQwBDMEMAQ7BEwEPQQ4BDkAIAQ/BEAEPgRE BDAEOQQ7ACAAUgBHAEIAUAByAG8AZgBpAGwAIABnAOkAbgDpAHIAaQBxAHUAZQAgAFIAVgBCAMEA bAB0AGEAbADhAG4AbwBzACAAUgBHAEIAIABwAHIAbwBmAGkAbJAadSgAIABSAEcAQgAggnJfaWPP j/AARwBlAG4AZQByAGkAcwBrACAAUgBHAEIALQBwAHIAbwBmAGkAbABPAGIAZQBjAG4A/QAgAFIA RwBCACAAcAByAG8AZgBpAGwF5AXoBdUF5AXZBdwAIABSAEcAQgAgBdsF3AXcBdkAUAByAG8AZgBp AGwAbwAgAFIARwBCACAAZwBlAG4AZQByAGkAYwBvAFAAcgBvAGYAaQBsACAAUgBHAEIAIABnAGUA bgBlAHIAaQBjAEEAbABsAGcAZQBtAGUAaQBuAGUAcwAgAFIARwBCAC0AUAByAG8AZgBpAGzHfLwY ACAAUgBHAEIAINUEuFzTDMd8Zm6QGgAgAFIARwBCACBjz4/wZYdO9k4AgiwAIABSAEcAQgAgMNcw 7TDVMKEwpDDrA5MDtQO9A7kDugPMACADwAPBA78DxgOvA7sAIABSAEcAQgBQAGUAcgBmAGkAbAAg AFIARwBCACAAZwBlAG4A6QByAGkAYwBvAEEAbABnAGUAbQBlAGUAbgAgAFIARwBCAC0AcAByAG8A ZgBpAGUAbA5CDhsOIw5EDh8OJQ5MACAAUgBHAEIAIA4XDjEOSA4nDkQOGwBHAGUAbgBlAGwAIABS AEcAQgAgAFAAcgBvAGYAaQBsAGkAWQBsAGUAaQBuAGUAbgAgAFIARwBCAC0AcAByAG8AZgBpAGkA bABpAEcAZQBuAGUAcgBpAQ0AawBpACAAUgBHAEIAIABwAHIAbwBmAGkAbABVAG4AaQB3AGUAcgBz AGEAbABuAHkAIABwAHIAbwBmAGkAbAAgAFIARwBCBB4EMQRJBDgEOQAgBD8EQAQ+BEQEOAQ7BEwA IABSAEcAQgZFBkQGQQAgBioGOQYxBkoGQQAgAFIARwBCACAGJwZEBjkGJwZFAEcAZQBuAGUAcgBp AGMAIABSAEcAQgAgAFAAcgBvAGYAaQBsAGV0ZXh0AAAAAENvcHlyaWdodCAyMDA3IEFwcGxlIElu Yy4sIGFsbCByaWdodHMgcmVzZXJ2ZWQuAFhZWiAAAAAAAADzUgABAAAAARbPWFlaIAAAAAAAAHRN AAA97gAAA9BYWVogAAAAAAAAWnUAAKxzAAAXNFhZWiAAAAAAAAAoGgAAFZ8AALg2Y3VydgAAAAAA AAABAc0AAHNmMzIAAAAAAAEMQgAABd7///MmAAAHkgAA/ZH///ui///9owAAA9wAAMBs/8AAEQgC xASoAwEiAAIRAQMRAf/EAB8AAAEFAQEBAQEBAAAAAAAAAAABAgMEBQYHCAkKC//EALUQAAIBAwMC BAMFBQQEAAABfQECAwAEEQUSITFBBhNRYQcicRQygZGhCCNCscEVUtHwJDNicoIJChYXGBkaJSYn KCkqNDU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6g4SFhoeIiYqSk5SVlpeY mZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2drh4uPk5ebn6Onq8fLz9PX29/j5 +v/EAB8BAAMBAQEBAQEBAQEAAAAAAAABAgMEBQYHCAkKC//EALURAAIBAgQEAwQHBQQEAAECdwAB AgMRBAUhMQYSQVEHYXETIjKBCBRCkaGxwQkjM1LwFWJy0QoWJDThJfEXGBkaJicoKSo1Njc4OTpD REVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoKDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ip qrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uLj5OXm5+jp6vLz9PX29/j5+v/bAEMAAQEBAQEB AgEBAgICAgICAwICAgIDBAMDAwMDBAUEBAQEBAQFBQUFBQUFBQYGBgYGBgcHBwcHCAgICAgICAgI CP/bAEMBAQEBAgICAwICAwgFBQUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgI CAgICAgICAgICAgICP/dAAQAS//aAAwDAQACEQMRAD8A/nFGxRjGO569qeq5GSMVNIoztOfU/XvQ mQCowa/0nS6n8kpa6jOfQ+ppwQ7dh7VOVBQ8duee1TY2gYJGRwBWsRN3Idqk5/l0qQxoTuOeAPbv 1qZF/jzn6dsVPGdw2gdOT0/StIKyM7u5TkT5t2McHn/61Sxwtu4XpyMHmrSREyDdk5G4+596nCYY qB9a3pyI5L6lcJuyACCepFSONuGfAx1I96nOfoBwQOcfjUoj4yo6jGOP8RWsZag42RWMaspVgckH nPahYshWxxznHAq2ACuTwcDgY4/lUgTPygZ75961TMZRW5W2KRgDnk4FWCmF+bOO/wBO9ORW34I4 7+pqd4wCFBP4+3WhLoTNXKxXnnHGMcf1qTyBGfYnJU9BU3lspyepH06VII1OdxA4wTWsQcbkPlDP Hc5+maUxNgBxnrVkRnBJXIAwSeCPpUxRS+AMHGOuSM+lWOUdCn5IUdCeOue1TKiqQT3P6f59qtGI Oe/sOn0NOiiBPQ5HBz2GP1ppmEqZHHCmMHn0x/n2qYxKOc+uD6Vajj2jG4DnGR649Kev3scn3x/L 6043ZTdiCKInqQD1Ix69KesBViB74PT6irKrgeZjPGOOlKE+YEcepNbRbE7MhEf4kd6sBAThQQfQ d6mVVCnA6d8dv0H6VMsBdiyn3HQED3rXmMHG+hCsXUdh6+9ShMgLkA56+nsatquEy478f5/CnKoG WH8WOOv4VDmy5U9imseM5A9/8akSIP8Aj0wMc+tXPKyRu7+h/pUiR7eCOMk5GeTWsJmclrsQpHlv lIOO5GfyPFSDYD7jjGO3epliLD5uASOv5f5zU6oQ5IGQRjB9Knm7mjSfQp7MDPAHoOecVJHCVwBj Hce9W/K2+wPHPp+tPUKTyPYn2FaKxCja5WEQUZGDgf5Gak8tFT29e4qyAHABz6Aj+dSqpGNwHXoP Qd62T8wlG5VVNjBueG+gFTpEP4jxj5hVlIV5/PHPPrzUwi6Y5B7kVTnrciFOxTEbAArx1GfapEhP fOcZFXVi5y3PboKeqBs9M5IPH6Uc5pyJMq7GOXPTrgfrTxGyEAY4xnpVraRyBk+lTGMD8B0PWlcT WhR8os23rnkg81JGjKdy4Ht2OfrVwRsR0wBk/WniPHB7dzz9K0Uuhm4EIjHUdCBn3P40BM5GCQBg /T6VcEYAOAD3yO+evf8ApT1j7gE8cdvp/Wpi+g6dNJalJIeAQM5H61IsSkenf0NX4oxtwvBPvn+d SCNScj8D1p81tQ5OxSSBN2FHT+I/55qTyoyhAAOOmfX/APVU/lpwwXjOOc45Hap1iKryD19OOn41 op3sSkkUxbqzDdjAweO5qXyo9+Aoye//ANerqRszcgjoOf60sURJG3p19Pxq3KxEoFRFUHbtPJ5I OKsJEu3kd/x6dKteSwyVPOMHI6VKIhtyzc8jaR29qPaCjAprFhdp4JP9KlSLnkHpwBn/AD+tXQp2 7cKM8DNPERK7D+ffp3o5i7FRIlPyjJyPpSpBuk2qcY+v/wBetNIgBuHXHJHcHNIFYBRt+boB3xS9 oBUjgXnGTzxxUgt1Vhu4z6+n096uoNz7uOfvfyqVbY7flyRjgk9+vQ0lLzAppDGoLNjkdF6CpTbK VRiOPUk8e/NXFjKnY3OF5xxU5QbwCQe+ff8APtimpajsUFtArA4OM9T1PP6VYEKbcY5B+rfjVooQ AoOcHr/PHWp4oznGePpz61TnpuN9kUjEj4J685zxUkcBwFfkYxV4RIwC4H+fwqYptAJB9Btz26Ul JIagykkIPfnOOn9al8lchhk9fvdcir4gkZgBjpkfjTlXaDnng546Ue0CcLIqeTycZBz6VILdtvA9 9v07mr4iDcbvTJFJ5TBiH4/OlziSuU1hXcMc5/PPSpfKQn5OhPXHr36VcMGTuAx6571MIyoyQABk Hr07cim6hFuhmGID5eT23VYjiUnGOR3Awc+1aSwA4UYJ9v8A69PjiJGNuCGP3al1NNyraGX5WSCQ fTH+cdaciHBV8dcj1/KtNYjuLD6HGcH6dKeLZxlSSsgHU+/anz6EqBRMGANg6evTPrTvKCgZAwRn 5vrWmsUjYj5yDyOxFPkgB56nPyrnIx+VJSezYuSyszOWLjB9M549af5KbsAc47cEmtJYhnC44yOf 8TzUhg2fONuMdsZFPmHJXKAhOdw/AnApwh6HnnoAOtaDQtt2kDPTk1KkII2suOduOv8An61N7Gbg UYoSVJPC9Cen4U4QqDkdSOlaHlcn5OnGep6+gNTLDlgMA4PT2/Sk5By7GWsL8heADhif4hUoiABx z256f57VoeSpHmJ0Hf1H8qlEC7e+MDr0/Kk5JCkjMWBmb2HKk/4VJFGA28HPXHPPStQxDcFOMAfd x26Uht1UD5RtwBgcGjnGl2M1YiRjHfPXgD6cVKIk25Ix3OPatFoy5Cj68/T/AD6UCLAHTBP1wTRz EFAwg7gQOzZHpQIdo6Edzj3rUEJ2jhR68479qcImBL5AAPy9f/r0KQ07FKO3LcH6fh6fyoKAqxPp jjOeT/jWgVRcADoRk/TFSrBnJ9eeQD+lDYlF3KIiAJOOcYJGKcqYyFHGcEN6/h+laSwjaV7dT1/K n+UBkjHXHuffj6UKYrGcsR6DIwO5PFKkXLEZI9u1aHkbX2uSAR06/nUiwhm7cdQOR9aLobRSMbgb 8Zzxn1p8cPrwegI7Zq+Y2HUkdP0p8UQZcHoT1PX/AD0oUyVAoeSpZeTnGM+hHJ6dqXySgJbJ4z9P 59+1aKW6qcYzjlRn+dSNBznkZH3j6Co9oti+TVGesbAcjBzlh6VL5DAc9yCPp9avLBvO4cZGOfb/ AD1qRYW6kY+bjd275pe0JZS8lVG4jBxxz+fPNIsPlnK9M5B/WtBYvkJx3AABzS+S3A29ODn/AOt/ jTU+5Eo3M8Ru/OOmeR2qZY9xBAIwuPr+FaYt8ruVuTnjHHPepVhZSQmG496h1SlSMtIV6AZUDH41 IkGN3Ix05HetKKDBXcvPfJxgn0p6oWbcvqB0FT7UtQ6GUIcAg88jJq2YN7jOQCMZ7VpCAscNgHHI 6DI9O+KkMeQFyMjuB6f59aUqhfs9GZH2cbCVACk5I9acIP7q4PpxyfethISQQi9+g64pogXgOBkD B/x7UKohxjZlKOMNkKfr61Mbc9HJ9TgZA960BCcEgnHfjH+FShF3ZYc+3T/6/wCdJ1C3AylidQNx I75Pbt3/AMaesAIx1Y9d3r9MVqNDnHGce5HT04qX7OWXc2Bj1+noOc0OqLkM3yAOo5wvI560zyAV 6YJ7cflWuluM8jovVTwe4/z/ADpskDZ9x0Xv7nj/APXSVTpclR6MzgjKducc4A9eKkWHcMFQO/Hf uK0Ut1GSOMEHr1FTPEoPAyD2x3z+VEqtrD5LO5kvFhfLHPXGP6/Sn+SM7u+ccdMVpNbkEbcYyBT/ ACSCAADjqcf40e08yHqZ/kcqpHXnGOeaQQqzFsn/AHevtWw0T/LuIwQGyPb07ih4AASDj5gOByPW p9qVKFjLSDcflzn0Pp+NOEGHwwGCOAfX34/StgxqWyhy2QvrwaBEVUE5wo+7jrj8c0vaXJcdTJ+x K7KQDzx3x/kVJ5LRYXaBjqOufrWwIgCc4HOfTnv/AJxQYSQzAdf8/lR7V9RNGUIVdSq7s/w54I9a k8hVkEsmOOxOe34/59K1Vt+pcdcjn+npT/I/vYbn09s85qVVa2G73s0ZiWu5ONuOucck0LCWQKVX qOv681riMD7vXrtxxx/n0pViO3GOc/oe1HtRONjIFoAnTP8AeIOCPbAqQWoGCgxgHA+vYmtcw7H+ bBJ54/z6U50AbYcngcg/lUc7Qchlm3jI+TI6fTODTlgwwPORkke/pWqqYyW7cDj+macIjnew78kn n+fNPm03K9kZ8dupw/U9SD6fWiSJfqFP5dP85rS8nOBg8nke1SeWisM7g2AuT7Uua3UHTMuODavl qMnGeuOP609bcFWGcen1PY1oohJDEHA65xzUscTO25uMevPep5tyeRmUsXVADnPJHGKekG1Rv+gF aXlAj5iMn7oH6dqljUGMqR2+93/zzS5upapmT5HRz1xgYwOn5YpWiJBB+6BjPTFbAjUoVwTgE8D9 M/8A16jMLIvPB6/d6flRzmbpameIG5VmyCoxU3k4G7JB/wA5rRS3LuJAR7f4VIsCMpdt2QMY7HP4 VEqiRbpaXZkG3Un1yM5+nb34pPIj/wCedawg8xVUjGBjr+fH/wBenfYYv8//AK6bqpbi5Ef/0P52 vLBPTBB44pVQMBkjngYHSphE2ee/9KkMfGASeemK/wBI1Nn8muGupAkOOnc8nvUvlZYOuMDr+FS7 SBkr3zxx+AqYRnBBx7DpwPStoztYlxsiGFCQCSDnI68cd8mrAjBUE9Mfy71KFUKFHTPbnr3qwAVb PB/zzVORKjcqRooIJ3E88DvxUyoMnA2nA460vlhWAXnnOD6/n0qZYc9hxx9a2TszGUrDSgJIHQn8 PSlEZ+6c+uR1xVlF6IVGPVuetSiJkbIJAP6GtIysK2hAi84cd8f5FSrGNwOOOmB6n2qQJgYUHODg 08RFjt5POc+mfatU79SEuhHswRt798YwKd5Q3ZzwCc1b8heCOvUcUoAJDAfgPXpVQkmU6aK5VE+U Z5HUelS+VkjbjAHI/wADVjyukhHA65HftUixAtjknHX0zWsJilGzsQ+U20DGPYf40qx5cqP04qws IJLYI565p6xtnb6c8VpzoiSewxYyCAec5IANTCI4LH159zUqR4PA+pPTmnqgIycY5JPcfWj2iHy3 GLFxsxnB6fhT9ihsjgg4B7CpljBbHTBHfvUuByfXtjHb+tbJ9DFoiEShMjpg8dvzpVXcwA4I64Ha pxG2MLjGM8npj/69O8pQASQcjIzVxM1ATYuNqg569M/Wpti7SX+7jOB6D3qWELg7Qe2D0/Q1IVVW 9s59PeqRXs7EDICMDrnOR6HpU6xgncByeAvfp7VKU5LAYHQe/wCNTRxAEEY5POP5UCa6kKIRwSd3 BU1Nsx847Y6HipcDJ27sDIPFSqM4JOfp7/WgzsQIqkE5wM8//rqaNSSQvbGPrUkagDd0z0zg/wCT T4odhPHHvWiS6jiNK5I3j3C9/apPLP3iDnPOTjpVnyjw3HU9e+akSNcBxjnoapND6sgKbvmb249P 8ad5YCAHB5znH6VYEat3HPP0HrUwgAG1+Oe1ac2lg5CHac7ev1p6RsFAJ5zyfT8KsxxHcemT+H41 L5SJgjtxu/HvSuXOJAYcKOBk+/akjVWwMdeB3/wq6YFVRg8dhUiwAAFj+nfimpEON3ZFYRApnsB+ B/xpyxM5+bGdvDeoq0kIBAwO6kdKsOnrgYAGOxpEyKO0DgAce/HuKm8pcM7DJPBNWTEdm7JPA4HU c9KcqgtujO3B4z/QVopaXTHOJA0O7nGOTwOfpQsRODjrkYzzV1I2c5b7oIU8dTU4ibOAD0+n6U3N pkWZRMOR8w5I4xxjtzUxh2kIM9c8dxVgRjOQfunHPOPXB/8A1VaWJSueuev09qd7By30M8IqqBjI z681Z+z7FUKT9D1qwsQjzxheoIFWViwAcdQSD9PWnzdUL2din5CooIKgnnOc1JGp6yc9hx/PNXUC soRsHHOcfhQqJ5ZYDJB/Ojm7jS1KyxYYjHU9R9P5VY8g4wR19qlWHGCw56dM1dW37scdi1LmEoGc ISWGRnnoR29qdHHleMgnjIrQEXTGRjPJ/qKlAX5WbKg596rn7EumZ5iOQMfXPb/69SrGSM49yTzy aveSC4QDA7Hjr71MsY3ZwRgjHr+Qp36BGHVlARZO0dc4/wDre9W/JCHJ4APDfzqVI5CTjkdR2znm rBiGAG5x/KmVyIppDnAYD2b/ABxTvKOA6DPPYZ+vFXkg2/LnaRnk8nn/APXUgiXHP4ACrcyLt6FZ YAQWUFiR0JwKl8vA2gYOMe3+FXUh+XkcE4DYqcwbT6jHU+9Z8+o2nujOWJ3O5upFTrFuOGzgY/Wr kaDHHOM//XqwsD5LNgdqFN9C3e5TSEqOQePT9akSHYc44HYjr1q2IAAN3yjsPb0q0sOQG24GTwfU 9utS5EKk2UVQEggemTxx9KeIVVsSD64P0x/k1oLEVGB17AEA80/7OzdQVA57cj1oUle1zSNNrUpi 3GSzc85OP6CpFt+doHcc45/KrQiwRnGCcnA6+lXFi3cgHPUA8+n8qqUkiZQuzNFsWOAeMYHIqYQg EqM4OMEY6Cr4hdnG3LZBB9hSmJVQOMZbn159h39qyVTXcUIamesQHyg9+T1qT7OBng9fqPw9eKv/ AGdgwbGRk4GfXvmneSodtvQD0wOfatXWVtBcrvcpCMqeck9Aev6cU9oCecrgY4HetExP94gn+gpV VcEHg88EGl7TqXJaaGfHEu4jB5OcnPQ/1/GpRbyl8sucde4/H+VaMZbcNvpzn+XNSCFgAq/MD1A5 5qXXfYy5dDPMXyZUHpkEjrmnCEblA6qASfb+taAtyzEqOpB9efapI4cnCFTgZBx2/wAaTqjilYpJ BtbAI6/r2x1oWLa2RnnkjB71qLbshDnGAc1N5argkNuI9ay9r5i9noZaRgcHpg4wMfiR7VZMO5MM McZB/wDr1bEJBDHaCR0+nrUgj2pz9MD8/wCVP2hLhfYoNE5G7IwSPfipBDGSXODxjIPpWkIuuz7p xtx64zSpCOG47DjnB/Slz6DjHSxmCIfxEegB/nTxbl1JHzKoHB65zx0rRe2+UE4z0Hvzx+lPMLlg OvHHsPfp703U7E+z0KHlNuVQc5zx/n+dMWFiMqO/Qjv6/hWv5O2QZAx7djT1iAOWwBk9OhFNVBun oZbxAELxge2alW3G0Mcc9Ox9K1Ioo+cY6Zz6U7ykOQxIyMc+g70nUYKGpmrFkEEgNjpjpjr0pwt9 x3qMgDH+elayxjPOOoGcc+1KsSFsHIxx/wDqpe2FyalAw/u8sASOM+o9qakDFt2OO3+ArRVFBCjo fbj/ABqeO3I/dgAfy5/lR7XQp0+pktbtnCgf73XrU62wePv0656Y6/lWiIScYB4HP4dqkEBGSeo5 NDqicNL2M4R4jXb0+nJx/SpBbB15yOmfr+NaHk7VYZycgcdfz9KckJU8kE8/Ng/iaj2hMYXZSSBo 9ygjj/8AXUgiI6AdTyf89q0fJI+UgcAZH19KVUIxxknoB70nUKVNLcz1tMsOh9R3pwtwnysOckEf WtBIG6jkjkVNHbkHzI+uM59+340vaMapGekIQYXPJ2j/APVU3lqACPoPrVxrZlJjfJ78fXHX2pzR KE2sMDGfQc47+tHtB8hSWM45+vGR0pUgxk/N7YPQde4rUMGQG5B7AU9bXO4gcHueOPap5twlDVWM 8RgnB+9jPoMe31qVYuCccd8envV4W+V+bp7c/j9KkWNdpIG7I29OuT6UubSw3ZaFFINwwueMikS3 2gk9Oh4/xrXS3JjPHT5gOnTp1zT/AClCkDjpkjg5PNLn6By9TKEYOSuOTgemamMII7Y29v8APStb 7Ng543Z59SPw9Km+zqAAAN3Q5HP50uctrqYscOcZx67RTjGxySRkjofQDoO9bAtW27OoB59falWD jOT/APqoUkTZ6GUIgiDPA9MVLtywx6cZ79sVrJApVlyx75pskahcnuMAYycUlJESpdWUFhBXDAAg 8n3pXhLfMgPJxx+FX40cHOOT/n1qykRVQwwD/E1EpWKjAytisSG7HPTnjoaseSpQlVHBwD15rSji AJPXGRgHtSxwFo8E8HnHSp9pcapGYtqd4QkYboSO+e9ItswmZf7vXHIOeprYS22bRgkZ5JoSEbj5 Y4J69fxpe0KVIyRAhIYDAGOhzk1L5Z35xgHn/PtWotuWPAyA2cD0pywYAY/Njr9f50e0F7IxzCu7 94evOc+tSGNg2eecYz0/r6VrtGDgntjj685pRbYO5RnHHrTdYiUNTNETKxOOccLUqRsDtX7vGcjr n8600j3twMDOKUoekoI67c96TqFezRnC3yNoAJP3m9Kk+zDILLnvk8f/AK60lh4PI5OcdqUxDIIH TpjgD0rN1SvZ9jPFsM5GOQMCmmJlk6KT06enpWzLF8xIGf4MD1H5UCPDCPI4/hI7Y6dqFV6g6ZnC Dk5znOf/AK1BtvObaRjkYPStbCucsuMjP0pTAyqdwPUbcjJ5qVW7jVIyntgihuR/9amJCzsemOCu fTrW2sGH4PPXrinJH8uMDOcH6+n8qPb2Bw2MqOAcEjOD075NO8tQwIHtlfQetayxeaMHHc80iw7J OpJrNVwcEZiwjdle55JGO/YVIIDvDKTls4yMHFaQhAOADxzz6k9aX7K7Dn5gCMBv8aPbdxKnZmaI Nhwcse3b1I/rUjRKwJGR649+xxV9o9uRwcrjIx+VSpGq8Z55wD/Wl7Z7hOHRGd5YK7m2gYwR/wDX p6wHODnnkEf0/CtP7K3BOOOff6YqUW4GA3vzWTr+Y7GT9mLE7cA55P1pPscv9+toxHb068c9D71F 9lb0jpKq31MnTP/R/nr2AdcnI4B+lORMHb1yM/jVpIsnn7w6U8RZBbJx0r/SBH8p8xGIy7HHHHal 8ranHr2/rU6RFVKg9OeKmEak9+o/yK10sQ2QLGSvOf059BUxxjCnHOelTCF0Ick8nipQoLfJ1I/X 61afQmxWEe4jr7DFTrF8x3AZIGR+tT+UDGM8HIB9807y8Hj5iv3eatS1IVIaqBWDde+ccU8q3CjF PCfKAOOMVLkAEY6mrT0uyXG6IwmE8sAHHf3qVARyo4HpTgpXJHU8/wBKnEWcj0x1FXzDhAgUEkHk npg1IignLN06fj2qwYioxjkd/X+tOSMHao5Oe/HNXGY3FXI1jY8r1yAP6/nSruC88ZOBVsRuFx0/ z9aFRVU+nQ45+vt+FXCYnHUhSJSTvJLHp0OKl8njC56fnUoiPRcEcH6Y6e9WwrEDn6VXNqQ4W0ZW jhMnXjqQKckRIKvwc/hmrYjyBnr3x2p65yew/QH6+1VGo2QoldEZeeR6YP6e1WdgwGPHoxHJ9qkR HAwc4OeOen1qcoxA24zznI6/StlNEOFyssYIyQB/ex/U1Iqbm56Y6ew96nSJt24DI6EAVOkZC4Bw OoI45rSFTQycCqqMp/XPbj07VYEY3cf/AKqnSKQ/eAH+f1qdFXcB7Fdx9BWntPMSi7FUpkjgjHQV YjUBTx8wwcn/AD6VOsQbhsHkbQAetOKFuFyf4sHpn601O4pRQyOB3zuwfwwMVKY97DgfL1I4/Mc1 OsTZA6Z9OcenNPWMFsqpJx19Kak7k8l0Vo0Kvk9Oq44/zxUoiO7L8HOc46+4qwsPQj+9nnpnHpxU irxzzjt+NbOWovZ9iqISGOBtzyQTxn1q6q4ycHnGDxinlWb5sZH+etSKG8wHr79P88U1M0jTs7ka xhgMjIxz9M1NtcjYT+nI96mSPDH5egzn/J/Spo4Q+AevrTUxuy1KwTq4IAPP4VOsbyRgEjkZGPWr AhXqR7EY/wA/nU6pyF9Dwf8A69EqglG6uVVidugGegxgU9YcuF9O49auBBlsADB4Ynj3qVIyV2t1 DcHp+dHtO4oq2xTVdzFlOCfwz9al2j7hHXHbj+lXAvylQv8ADj1xj88VLHGcZK4yO4znHP4U+fqS o63Kvls6KAB1pVhYKysuSO4/pitERbYgy5yAOh65pywtu2jpkDB9/wClKMxy1dykkGXGBg447/8A 6ql8pSd4By3AGcjA+tXmiHVDznj34qRYxtLsOnUjtVc6e4nHoUljaIjHcdx16VMsZPy47nk9+35V bEeAAQxBGfX/APXT44FX5cbcnBGfT6imp9TPksVFjAUFc4HJx70/7PuJbkEnjP6Zq+sPHy8AAkcd Of8A69AhZQAxyeufp0qnO6NpRvuVBCw+5/dxgetSiPAGQACRkEZrSMOT8w5xlQBweeaTy2RQqg8n I7/4UvaWM4xvcrCLlt4wR39qlSNV+Q4x2yOuPxq8tsxIJ4GMdjkfh0qZbcFi69MnGe3vj86ftVsV yJFURBWw+MZxyO+PrTfJKnj059ifatLyV3c8DOTnvxTorbzAHY7R6Y68801PqLkuU0iVTkHPJ+U9 TUvlkMPb/P6VeEOJFI9xkdfephbBmyepHIH5UOoHs0tDNVCv1z2GM/z9Kt+UXAD/AHe2OOvTpVoW kkR2nB+UbsnGD7GplglIwOAQeV79vT8qXtEOKRnJEyvg989fp196s+UuOAOTx0x6cVoJEEIOByuM 9cfSpTFhdq8npjHpz05/nS9rqROK2RREBAC4xzzxUzITzjPHy+n1zVlI2YqW9MYz19O1WDGOAwwy 4wAccetJzHZbGekQ4U+2RzhSPWpPJY/KuevJPGPrWikTCYdhgnDDqcZ9cVZWENiRQRg9ef8AJoVT uKWjuZ4jDZPJ9MdOTSxxMw254Dfka0I4N2GQE4649KmaAZ6EHBJ44OaFVXYlMreQqITgD1B5z396 1dR0bXdHv20/xHp2oabcgCRbXUoXglaKQB45UVwN0UikNG4+VlPHFMjR9oJG4eoOfb9elcx4V8bX Hjsanf31095LYa1e6KskoYMqWLCJI8szcIPlHQEdAK+UzDHzjm2DoKUbSjVbTT5nbktZ3SVr63Tv pa2t/oMFhFPLsTVad4yh2sr826td7aWa87m/5JMm4ZGeo9cmrHkjA2nHHzCrnlLINjjn1GcjFSrC QDn7o6GvppVdDwvZJ9TO8ts4AAx2PXJ7/wCcU8QSFgrZ4J79fy/StJY2GGYenBGKcqhc8Dkhuufx pe1siXStqikImIwScZB47en+TUixZkKknnoOucVe8rHt6DrmlETFtvTBHQZoVTTcIwunYolSihVG QDn/AOsamW3yDkHpyD1/pVtoCwwxAxyBg/h/9arC24X7qsSepPr2NLn6hGm2ZqQY9eBjcTz9PpVg xKR8+MDn8qveQhfcTnjOCO/071L5TY4HftUuo3qW6ehmeW4GRhsHkZ6//qqSOFfL5wMnnHP0/KtI WyKDvGB14qWOEEBVz3GMc47+lNzMo0tTP8vnJBJx36UeSE5Iz2B7YrUEAI2qD8vfnvUqwBSTjAye DyKXOaOKsZiQpt2t0HQ55/OniFCd20nBHP6VfESnkjjnP51IIRgZUg4yOeT9abmSoKxn+SdxZeuO TnHHpTvLfcM5yOg9M9fWtPyTt5z69O9TR24C/MOc49Mml7QFHYyjCCWP9454OaesRwNx9eM1orG2 7AAH8Iwc04wtGpUEbumcdP60vak+zKBhIbaBxxzyOexzS/Z1K4cAjPJ981e8ptvA5447fnU4jYrh QPy5/WmqguToZ/khcYJAxxxz/n3qQRdSV9x64q8IArZwwwMNn0/nU6RfLuUADgcjt1o5x+zMxYGf jv6VKkKn5GPPf6j861ktyFDnHvn39KGi2oAvUdePy5qHV6C9mkZSpg7269u/epVjHGQQ3I/PqAa0 /sw8zb0z0yPSpVhYEI38JJBAyT+tN1EaTp6mZFESu3gHGR1xn3pRbknk8YwOgHAzWmlsgYYPzBiT npz+FWFiLHJ4459R/n1puoZqLMZYPLC5GM9up9e+fWpDbgsBncRyM9q2FgUZXpyOe/61YFr82Tzx nHUHPTAqPbIIxVroyhD8nmx8HuDTPIdgSrHsMt/+qtdrY5weAQDx04+tShFPCdQOw6Cj2thezuZb W4HIOeMD3Pce1O+ylF3Pw3bHfsa11h25P/AsdeR3/nTjE0nIAOP7x/8A1Uva6lOmY3k7OWIB7dcV cEB2EHnIx02jIzV0QKQVA4HPOSc1Y8jL7e+OSemO1DrCjTMtYSY0DA5zwD/UVYiiO0qwzyRg9BWg sUhUDbnHcd/WpUiJJ3euc44/pUur0G6epnCH5AjYI7D6Drjp3oFszH584zwfb8a0Ps5cBy3AJGBx xVkRsrhB69hkY/8Ar1n7a19SnTT1M5YSRyM9zzQ0DNgP0GMZxwK1EhRjhccfXrzSeUzfe5ydpzzx TU/MpxRWMIwG75/H2pywHhuhByCc/wCelX1iPVcY5BJ57fpUuwFdr4/z2FT7RhYoiJWARsj6Go0g VQWUDqevv05+nStZbYHBzkD1PNPSEHLHOS2d3HY4HFR7SwOJmmN1jBXghccdSAaeIz6cHrxxj+tX jAx7AqPcdfb+tS/Z0GSo44461TqoSiZPlYQR4IxwATjH6Z6VOsJxznoc989q0vs/Q8EHnr3qRoiC OSfX6+9JVl3HYzVhyoBGO2OtSBSoOeNx5xg1fWFE64JyPf8AKp/I+YbcEE9T6/hWcq5VrGYYy3Xo TkHr9eetOEQDFQDx1PtzyMVoJGwOcAAZ49B71ILfnrgY4P8AOk6ojLSDH3Qfd+nB9af9nLcEkevf 9elaSIwBDHnuw9enSnNbAn+PcQAD2xR7fUbSM3bgA4O3HGOtSNAWIVsnPtgfWtIQbpMFfYc8e3FK 0StH6npjtz9al1rvQHCxneSQwbr2/H8amSLJz1bOckflxWh5OGBwpGcDp+lKsTLwM5HXA70nV0IU DPMJbjnd1APrwKXyWRuSSOOMen+e1aQt1ALHJ9x/LtThCGGD+WOelL2rKtqZ3kEkBAQP89P8Ke0G 47wO2OfT/wDVV9YgT5hHOOcGpktSq49SMFuc/TFS6jG4q5ni2Ei7eegxwO/fpmnrAdoK9AOPfHvV wIRllBOTjPP0/SpfJPGc8dc9h0zQ6jEkUUhO4DGGx19KXyMHzG+9x+v+ea1RagfdB3FRnuOPWmyQ kAjBHHPGKiNTsW6dtzKihySWHPPapTEWGDg8cjgVpeSSccjHc96kEK9FIPu3t7Yoc9bmfszK8pSM jpjjHSnBHAxgDI/PNafkjaFJPHO3GfrS+U3cfd6dz/nrS5+g7GetsMhT+vb39f1pBGR9xeg+X/D/ AOvWoYQfu8DPH9fcVJsAzuBOTzn2p+1sgULmaYt3LY3Y9MH607ydx7jHQ9c1qmP5Mn7pHY8Z/rUi 2xBzyD2H0zWXtddRJGWsJfjjHf149DipPs0fo/6f4VfESqxHAPTOe1L5S+v/AI//APWpuoTZrZH/ 0vwEjiYNkYwB0znP5VIF+Xg8kcE9P84qyqFAQufcdcelPK5JAXJHb6V/osqh/LMYK1ysse05Ye1T LF0Vztx0NPUBhg5ODnH4VOi7jn09OMDHSumEyHBEQQbSGHA5xjipNhwCnX0PFTBM/eznpj8KkAIw W5yOfx6itU0S4EPOwLjGOam2DI24OQDSsnfgcc1KilV2jjPP+GKslRdyIIBjkjPtzUoixgjkjsDm pVjLrleCPfP6U94hsy3rVqdnYXI0MWIZyQcY5HYc9/T86kWLGB1yMD1qYLjC4yAc/WnNhVG4HPqv FCmw5bbkZRiNmMH7wHYnFSRZj+Z8jGe9SuvGDn8f1waljjOOMANzzVKV0Mi8sccdeOalSMsN4HDD v2xUqQqRlucc/X3qf5ScHt0z0AqlMiUL6lZUB+bjk4Gak8srg447fX3qwiqQcAYH8u/NPCDgsAPQ jP4Vo6iRLgm7jACAFxnkYz7VKsIY+WD1OeOv4irMcRXJY8Yzge9SLCUHBJIGcnjNWpIjlepCw2+/ f2J/LmplAwQuRk9eT/nNWEjAUNggntxTliXbuPPbBq1MNtCtFbjaFUjOM5H8qsKmxCinpngVOqkg YwAfy/nUoix84GOOvriqUxSpoiijYA5bqcZz/wDW61MsalywGDUqx9uMCplU5IIz3B+tNzMuXTQg 2kksoxyc96k8rGS3T2NToG53ZJOckVIIjgAHJPH+TVqVtglAj8rcwUcZB4NSxxbtq9DnOe/0qUrl trjPA/KrKR5xu5AwQcevOP8A61WpdmROnbUh2KXPGfl/On+Xh8IMnB68YPY1OqEN8ozzke3/ANep xHzk8/Tt9OlJT1ISK/kyMSBwzYx6cfy/KnCFyAFUH0boTj1/OrYjAUA+hWnhMMOQeR+PbNWqrG79 CFYhgAZ5AHp+tSCDcoGDx/CCBk+lTx8Da3Qn7wHapzGSjbsnHzGmpPuRy9BnkZUjqNw/D15pXiTP y8BT37irSKCCV5zgge/tUoRW4fjDdAcZPvT53fUhMrrCVJ2kkHrnt6/zqZIiYyWxwTjHH86sruBY D5ecDI5qUIAoLlcntjgUpTvoy4x6laNFTnGSO/Q1OI9kjHJ5GR7frUjRMuUG0jIXOc5NTxocbyAR g8Dr71V0i+TXUrhWb5U6kEYJ6VZiXjcAeDgDGOPSpEQ4zjaMYx0p0MQJPHI6D61TZM9rMAg2sRjH Xp7e9LFAy5H69ateXtIA6Y6444qz5W75kBwDjPX60e00sQ1YopB83IyPpUywgnMeCFPOe/8A9ers aBxhQckj269selSGI7cA8cdSPpxR7RtlRp66lAREoNueBjgZ4NWYoiifN7DHByP6VYWNySDzjkjt U6xnrjGOuTwfbFX7XdFKN2V/IUL8wPI2leP/ANdSpCV+UDB9+MYq4LciP72TkjHYCnCMoPkBzgjA HBye1ZqbLVNXKwjIPmBCOB04781OsXI8xQfr+vtVtYvmEbHGACo6j/8AXU8cUisS3I3evr3/APr1 XON6aFH7Pvb5jxjn2+tTLB8oGcnsOmR61cECsS+Pl4IBGMmrCxspBIxu549M8fhT9qZq6M0xZk2N 8wzge3pU8cJWXLfgccDsa0HixIcA8gDj+tLGmScA+mSf0p89wKggBB478euB9KlMOR8vXgfQ9cVo mIA7sAfXtmpY4lT5Tx/P/IqOeyuiYw6GeIC53fgd3IzUwt1CkKDt4yen860TbkN6AZGSO5/n+IoE RHTOSOABinztkun2KJhUDcRwBj6DPGan8gZCAc9eOee2far3lDac+gJzx+f+FTrECSWBPIOf89KP aB7PsZaxkNwQecce9WFhL/OnOCBgDvWkYVUYCjGOO31qWOHGA3tgD9KTqFOCZQjhPQ/T1p6w5Jx1 78cVpLCGXoefw5qaKIr8x6568GmpvcOWysLp621rdre3gQW1ojX1yZHEamG2QyuGdvlQEKfmbgZr 8+/2NfF08mqeI/BWrSWs91Ncy6+81ncCdJJLiQ+cQR/vqOBjivubxXY6fqPhfUrLV7lLOzlsJluL yRwkcUeMsznP3RjkHr0r4T/Zx8G+CdD+P+qv4c8SWniQDw+Z7e4tVVFiLTRxthF74/Dv71/MvGeK zH/iI+UKlJeyhSel7azlOMna2uijb06H7jw5hsG+DMwlU/iSqdv5VFrr0bevmfoHHE2ctk7QM5x0 qcQIfvdO/vmrSDJKnOcADP8An2qYpgBQBxz+df0rzn4WqbWxT8oA4bH+FKkJOc5IX5jgdO1XvJXe AfU5z0IqcQtsOePcc0+Yq7M5YSMOOeBzU+3aR24Pucg96txxg44x3z7dahup4rO6gt2SQvcSiNCq lgGClssR0GB1PehzQnB30EZFxu6ZHfmhIycgDkgDjmtAQkkKoz0OB15FSrCmQrcEetNTRShqUY4p CwDc9s8ZHGfxpVi53kHHTNXPJ/hAxg478nv+NWkRw4I9+AM4qXUBLuZjQk/Iq5GOB171OkIX73Un r169q0TbANt4UNzwelSi3AGW6k4GMZyf8aTrdinC25n+WV/eduAR/LAp6xK4Ktwdu3r0rRNsEXGM c8cZ4H8qlS33A4OWzwTxgH+dT7QhR1Mzy8nJX2/Dt+ealEWGycHnOPY9a0Ft8H5hyRhcY6etW/Ij ADDGSe4zntiplV1KcVHcxRbNvGBycc8nqOOanEJK5bggjHHf05rS8pVb5eCR0Hr9KsJEgjwAc/yH p/8AXoda5m49THaEDr65PA5+ntTlhwPLkUkBgS3+f8/pWr5JxsYZ56HP4VIIivTjOOc5GaSqItx0 0MtrfG3fxxyM84/Ck+zOqbM8E8/QVri3yM478g8VKtuoJUg9QBjjn+dCqikktDK8jIG7AzkcD+X4 U5omUBsEjpz3z/WtV4X2AKB1/hPp/jUgtioyeSFxyOn4+uKPaWKS0M5YjI22IgkcHHNWGVlGP7x5 z1zV8QAgKwGOmPTFSrGFGOMlehB/zms1VuS4u1zLFvsbIPbABIpwh6EAnBxj/wCvWoIeNxAJyR+N OS3Ysu/J5GeSMjsKftRJXMyKEAZxyo4AH86mSIsAOPmGOBir5hYgAkfhUqJskCcHt8vak6guRmd9 nI479OP0xTmgOAQMk9Qa1jCpHYc9Tx+FO8leoOQcH/8AVS9qHKZyxZXOOTx/9cA0gtwFBABYZGew 74rVSJicgbvlx7ipPJK/LgA4xtH8jSVQfKzGELg/JyQM5PAqyI4z8pwp4+taHkCT5QcEdv8ACrPk gyFhwAven7QFAyGg67M8cj+RqVYS+FAGdudvqa0WjPGNpyMc+lOWNtwGOOoqHMbh2KKRBWDgcKef f/GnxRfJvPQZz09elaSQv1QZIJyOmcU9YGb5cBcDAGf1+lJVAUOrM6KF8kkccHOPWphA2847jr39 ulX0iwoIbo3GehzUjxHcFGRnAbjtnjGM0nPXQfLYoiB1y2ME/lTxApGCQvfNa5tgyliT6+oB+lRp bqDt4I65P6cUe1CNO7KHknGBjjnj3pyxf3Vycge5HetdY2D5Axn8vY0w257DA59jk981PtRezZRF uvUZK8EryeR/hQIlB6kAdv8AH6VpLH82CM5H45p/k4+ZR+f61PPcHBvoZyx7nAkBGRwT+h/GlEe3 hh6j3Na0cLrGc5IweOP0pvkoCGXJA5wannH7JpXKSQMfkGfX+lOFvkc+4/l+tXjAQMt/F0GM4H+F P8pFbc3QY45z+VHOJ09SiINwDEd859cehqVIcAr1DHjjqf8APFXY0k5c8ZPBHFSiJipXjn9R6/r6 UnM0VO6RmvEd4IztwSB3x64qQRZYjHUfj+IrSSEsobIIIyKe8OGGOvU9+nfmp9qi/ZaGUYPm6HIF SC3wCvI4x74rVW3YKGYHpx7flUq2xb72fftkVLrKwvZ2MUQ7X2/e7Y9Mf41J5BbOcDjrkVotAeh7 Z4/rzT1jQ8twMd6r2oKG5neSARv5y361KbcMBnAIxzVsQMHO36df51OiZG4jqeR6+lS6vVDjTS0Z nLGQOnpkMcH8vSkCgcqM5B5J9T61rJACpLY9vb/61OW1BJEnB6EjsPWo+sIXIjK8kDDMBnAxx09q mEIccDjoCf8A63c1rLbjd8/XA6HpjvTPK3Drkcce361P1m4KEdigLUbgGYcDqBj8SKeIYwoZiMFe nfjpV5YEznGMEdPXr/8AXqc26lSjAnnkHoSe9Q8R0KuuxQMQQBR37+/vTVtpG5C5HUZz361piHnD dONx6dO1SspLFscCp9v2BSa3MbyWJ56n09//ANVSLFgjjp97jP8AX+lavkEZHPQdPTinGLsTgeo/ yaFiA5fIzooAFLSLyD0/xpFgHVRnqfQVqCJFbK4Hp260eQhz26g/5+tL25PIZ/2dTFvYdjkHJJ/z 60vkMV5wPVh7dq0WiXb3Pt9am8kBDk5Ix1pe2JcTOWHOA3THQdqf5Krnb04zir6w85AOMf5xUhh3 YUYHy9SOKn2oey00MpLb7yx4yTzn0xxTPsMv+x/n8a2o4Sc/KGwe3+elSeQ3/PKh4izEqfc//9P8 GQo+4D3wPw96lVRkr75pzJkgdAeD71ZCfLuXrj8/r9K/0Mcz+XVCxAq9Ax7c+vWpgnAJOPT29s/z p+CO2fYd6kweARjvjHPPWtqUiXErIoD1YMYAPGPf68VKq/LjAPpT1x1IHTnr27/hXU59RuJC4ZgQ Rz27d/SnohyQ3pxj+f1q0VDKGA44P50oQDAH6c/5/OhVTPl1sRrHgbfzPtUrZCjjvnHTPvzU2wgb 26Y9alKbl2geh5zSUwUSuqAttwOOc0bCE6Yx3Hb9atKu0/Lnhsew+tWNoK5PHP51sp2JkuhUKsQA 33j7cY9f0qfyz157D/6/1qVECryMY7Z/lVhAMZXOeneh1Q5CFFLnOOo+bpg05Ys/Onr3/l71aRFJ G04A6fh1pyr8wGOeRx6+9XGWpk4kZiIyc8cbgMEe1TKuzAIG3p159vzqwYsKSeo7Y61IkQI+YHhs 8c44rZTFJESRYBjJPXmpMBgDJ261LyVAHI757c05E2yc/Q1bmheQixtk5wc9Dx1PpU8UTEblHtj2 /rUixZx06DgdvpVryyuDk7QenfPtT9oTJXK+3IYHhVPBp3l8hSe3UdP0q5HGCc9/Yen41KI8kKnX 65NWp20M030IFtsDHA+YsxHensp2nt82eKsqn8DDj7vPp7VIFZWC9+g/H8qfPcuzK5jKjeTx0OB1 9eKWOAuNy9+nGOD61oKijDspJ7YPPNWFjXPIA4OcflWtyZPUpeV/CAfUAdM1b8nLZI+8cY47d/Sp hEfvAYOOhNWRuyMkD8OOTzRzkJX0Kwth2IyTz/T6U5bY4JJJPoO351dTYFKn2/Opo1JY7MFcd+en bihysDpqxQSPdy3A9B1Hp9aWOGRd0ZBKr0q/siC7uO46d/bmp4o/4j1POff04q1MTi7WRRWI72A9 NuR7mpo4SDlwwOMY/wD1VcjTadwHB9PUVOA3LY4HfP40lLoRyFVYXCbc5GMKR2P0p4QKpLsRhsbe ozVtYC+Occ9Op5+lTomPm4B657UOSJVPVlUxlOnBx0xg/nUkaFcbc+ufX8aumIliqDGeck8YHepY 4VLfNyMdM9/wH9at1C9rIp+UQTtznPIxwanSMhQ7H8Rx7Y4q35Xy5bGRzz/9apimF2oeT1Hcn1+t L2qY+UpJbkYOeBycdjUmzad2cAcjjpntV6OMBecZz9cVN5W0euec8/ypqfUHG+hT8vcSDyR3qUWz r09eFI46Vc2hPkx3A56/X61YEYfjBJz+AxT59bMz9nqU4olGGAwcep7+tTeWrqXxzjIPPHHSrSQP nMf8h1FWfLxkZ69CR/Khysy2ncpxwhlCnOANuOgP41aSMBQAe3pnB71J5XOGA7EYP/6qsCNRx6nN HOhK5D5fB25YEggf4/4UCFz9zPB6f/rq6YWDDkDGfu8/jSxQmQlj6/KF44p86DlZEsKqS2MEYGT3 A4/z/wDXqwIvl47HkDP5d6tRR4O7+Hn6/wCfrUgiVmO4E4IOOP8AGpVQp0+hXVO7ep4PQZp8aMSA 3Tqc8/ljFaCx7W3gDr1Pr/LNSIgxtY98+/vUuoHKVDApIXjnotL5OG2tzyOvTn/PWroiEjbxjjnP vnmp40Hmc42Hj6Z/GhVbK4OGpSEYON/04HJ96srEr468HHQVZWABzknPXj0H1/CrXlDACjB9M8j6 +lOVQagihsZmG7Axz16/h7UGDnb6ng+n860BF8x5AJ6ZHUVMqgAjqAcY/wA9qftbaByXKXkbRtGe TnntzVhbfPGP4seuPX86tbMqM42nOSSB1+tWgg/EHnHaplWtuNR7FEQFJAT3b14/lTo0J+bHA5wP bvV1YuoUbvw/w5qaOEjh8feA75/yKl1hcupREA6sexwc9Mf59qWMKQHhZWUjOVORjrwelQ60Y49E vpSwijS1mMrnGVURsSe46V5b+ztdQap8FPDl5byecslgH3/L/eIx8oAwMccZ9ec1wTzZLFwwlvii 5X9HFW/8mOxYDmw8q6ezSt6pu/4HterfCX4peOvhL4m8SfDvw7p/iWPTbb7Lc2Oq3n2O333CHy2Z wNzbDhwoxkgDIFfjh8HbHxr8BP2tLnTfijpOlpNqWm21qzaRciZbN71InjKqzEtxhX7jJxxX6D/t Op8UdU+Gh8E+ELi/Gk31wl3qNpY3TW4la3JH71UKs6qvz85xjjsD+F/ifwd4u0vx5b69pTXFjKZd PEMs7SM0W+UxxnL/ADNtdDkY7Eemf81ONuMc8fitjMdUqQ9lhXCnSjyNyUYqE25S57e9Kc2vduk4 3krWX9p8M8N5euAsPhVGXNX5pzfPZXfNHRcvRRinrq09He7/AKUYkf7o9B0zx/jV6O3LPvwSMBQo HrVPSbe6jsIFvpRNcLbxC4lVdgkcKNzKvYMckDt71Nrl1caZoV7qNuu+S3tZZ1UkYZkQsB8xUdu5 H1r/AE0q4pKPO9NLn8Qxw7cuTrexJ5e3LH5gMjFSxxB1wMk/wj/638q534bavceKvh/onifUVVZ9 Q023vJVUbQXlQMSACwAPUDPT8q7doXK5YAAADcR0NTh8wjVpxqw2kk16MK2GlTnKnLdafcU1i424 5A59OuKr3jWUE9r9pjLyTXQitWDkGKTypW3bRwwKqy4PTOe1bXlt8pwMk4LY7frWP4iM8CadNCu4 NrFvDKcdFkWRfXjJI5/T0+U474mhlWXyxk9lOlHe3x1YQ8v5vnsz6HhHJXj8csLFauNR9/hpzl+h o+X8uQSOeCMZ47fSkEGWbHOcEE/yrSiifOAAME4BPXHWpmgZiQgyVwPr9K+v9rY+b5NDOhiZ8YBH BHJ+vf8AyalFud29jhQvfGefT/Oa0Ftx/wAtAOmRnv8A5xTzEXB3DjHQ5FJVddCOXuZpg3g7+fc1 YERZckc7RyOmKuwwAKd+SR9c/gKspE6ccEeo4onUKava5nRRNjzGJ6Z79/pVgRbRsJDeuO9WWj3Y YemfpnrVtIRGm3jJ6AdKzdTQHHsZqIiKCeeQBj3qXytwIU49jyetaBiHG3+9nHPX/GplgwckDPTn /PekqnUrk7mWbZflU4DAfMOPrUn2YFN2R7/4davvFlf3ajjgc05IQfmfBAyM56enFP2mgnTd7FBo gDsHXjk0/wAo7cIo+Xp/StYRDONq9hn1pET93xjnp7+1JVLkuD2M5IN2cdME56HHpTvKBU7cdwMi tPys5Dgg9cU8QsvyucknhvbvR7QSp3MxIWZcEZbHQDjipPK27WUZJOevPb6/zrVWFVGcZ+vt7jri pNoUAsSoBB5HIP0qVUL9mzLMeGHHUdTzn8KUxkHax6jJ7nP51sJBkAOAM88f5xT1to2k+XOQO4/M cU/aE8jMyCFAMLwT04znHc5+tTtCwUBGPTv1xV9INpIAOCeFJ5/zipRCdu58Bd2MD/P51n7XUqNK 2pjLArSB2znpxwKtJCoPXqOOP84rQSAEYbB7HvmnhH6gdhj1UHPfnNE6o3T7FKOIHAYc8k077KCM DC9s9f8AP1rQ+zsnztkdyO1PEROMYxntz+VT7XzJUHfUpi3whIDAjowPJFKluQQFGSQCe+OtaKQE qcHqeAOPzpypz8ueB1yKHV6FKPUoi3Qk4AwO/r/On+WAcE+lX2g2AZHTkAfn1p3kjPA5POf04pKr qKUOxmtC5DIo6fTjHSlS2RhkjDY7/wCFakce5iq4ycAcYz/9epFg3DJ69j2pusHszN+zbvlHf/I/ KpRCrDaR04yfTt/hWg0Pfb07jpipREq84B5wM1LrIbpPUzYoAF2gMMHjOO1SrEjEdyBwehFXPKw3 oOmP85/KrH2bMisQNpH4CiVZAqSKAQ4bbjJHOetKsZBwfoT3z/n2rSECjjhQB0Iz+dPMXAUZ2j17 c1n9YNHBmZsdjtU89+hzj0z1qdYBtwcdcn0xjgVe8lOi4JxUohLDJ4HCt2/TFDxHYHCxmiBmTcO3 OPWrBh7nB9x2/D/61XthRdu4HHX/APXmn+WPvAYySMtwMg9cVn7dhyalEW4DbcEk56HAz/jQ8eFH O0/QkdPWtJYcAF+cE9Bzz0/CpfKES/NtIDZxnkZ/SoddpjdPTQyzbNj5geoGD6dqBEXyuCMEnv8A gK01QtwpAAHGM4J+uKWOBnGG4PX5T/PrR9Ye41C+hnR26BmLcdTjHAx61ZigSMdCRyM4q5DA2wh8 dcAenuam+zlTzz3XPbPrUVK7bsTGn0M/y8p07nb+P14pwt2U89AOWP6ZrQ8oABffAx/L8amWEfn1 BPPr71Dra3NFF7GX5cioMjv83oPy9alZcD5sYAzn19eMGtIwNtCgA/XkUqoQ+M85z+H0/wDr0vbA 6avsZscQfOOhH8R709rbJ6FeB7960wiyHjk7eOMUNExJGOw6e/8Ah/k0lW1G4W1RmeRjcSuQSMj6 +lP8kqm3HQdR6e1aPlBjjtxn3qRYC+1sden4mkq7F7JvUzEjyAw7gEc/5OfyqRYsEtyf9mtIW7KQ Mc45+nrinrAgJyMEE8EetJ1hqjYyEhPJ9ux7YqUQ5xgDJ4OO1afltHGWGMj7o6808wBRk9c5yT/9 ap9rfUU6XkZohDE7zwRnPp/Kn+QVVfrkZrTWHgAg7T0H8x0HNOWL5TwMDH1zn1pOqCo6XMsW0jj5 sH1GcClaA4IyOmMLwP8A61afl5Ygjg8Zz2qR4N8m3nI7dunHaj2rD2OhlRQLuDEtwf5f59KtNaiW Vi2Mux3ZA+p9KvpbsilnAJBxjtUoQiPPUHHXuQe1KVR3ughDuZUVuhGVGMDPPGDUogG7gdst7da0 /KBQhfmwQfcj+oqRopWUqmOSAdwA6Ak1HOyXTZlm2XOFO49eB2705bduAcDPGB/U1pxRNt5wMAgn tnjn0qVI8nAyDgYDcfyz0pOoNU31M0wOrjJJAHqD+VPWAbsryT1UDj3OK0/KJwQMY5GM/wA/8/0o MKlj09M/r7VPtSXT0M77OGBDZJ78dT+ntSfY0/uf5/Otjy9ynHBPp9Kh+yy+slHtV3DkP//U/CxF LZ5z7e1SsiD+Hn1x/nmrGzaMsOM4/wAmnNHggkY69T6etf6CKqj+ZktSJVXOV6knP0/CpAC43PuP Tbj8qlCnClsDn6ip405wgJx1+taqdupDgVkjYfOeOOfQnFTLAQdyg9f0qZQwO3OR09xirB3ZAA6H r9K6PaEWsVCrbTjcOmPX1qREYn9PpVkKCOvHXNTBFxgAA5yfSlclwu7lZVDHnoO1SiMlc/e7Y/xq cRLkE/XpwasfIMp1YdM1Sm0K2pU8tlBOGPIFPVRtxxk9fc+1WgjY6DINTLAqngZ9AMf4VaqdwdO+ pTVdx5z6Y6nNSqoaMADoMHPWrQjG/bz0zknpTmjAY9SPyPX1pxlfczcSEbsYboOC3bBqyqjYVHJ5 ycdR9adHEuMMO+QParKLkY/IDp7VpGrqS0QxxbQAMcjuelThePm7Dk/59anCse3Pr7VIsQyGBPqe P85rdTtuxLzIliA+YE9OR0p4VznaeM8n0q0qAr8vJwSB/npT1XJxgD06+tUqjJcCsIsDbyCeBmrQ j3AAHjrxwOKljRmY4y3Thj0+lWo4VPTjBPBJ6UOoJQIIoMDdkg+n+A605YssHOcDrg9vQ/jV9IRn CA5OfenpErcBR3I+lNV9bsPZIqlBzt6gYAPT6DNTqoLYfp6YqcR5Y5xxzlhViOLjLBeOMpkZx9at T0IsVVhGQEIJAz61YEZGMAdOB7n/AAqbySTlscYwBxx0qeND/FgZ6H/P+f6aKt0E0iARLghs7vVa lERAwePUE9ffFTeWoUIc7epI6fWpkV3X5ehAPPv9aftCJLsQCM5GQeGx6dqsLGFJHB5OAOtTrDt6 YPOc9DjtVkRELs6Y9eabqITiVFjy20ggDsehqdIlA5J44yeM1OsI2/LzjHtnPXmrAUqVDduq+v1x TdQqMLECRumAD2HHHf8A+tUqxCR+BgjGT29uKseTgYXnHTPbNTRxbVGAD3H+ev4UvaiS6FYQFcA5 OemT196lS3VV44OemKuiJe4wDzx/OpViDQHpleT7e1T7QOXXQqpGxIZRjA5/DnmnrEGG4jjPy46H Hr/nFXViUnD4OD/PtUkUfdhwM7Rnn6dqv2gOGzZWjTGf72MHPpnrUwiZmGQeeo/z71aSFTnaCD3C j3qVIl2iNjgkc49v8aFU7kSWpT8oE4bnOTmpo42xuT5mPIzwP/11d8ssnyDA68Cpoo+FyeGGD0B4 4o9rZaiUG2UltwwyG5PXsPwFWRCowr7gDnIOSPwqyo3P0wcAnjPXt/n/AAqwkanAweuR6g+lS6vm CiVI42UDHfIJ46/SpfL2rgAk/mT/AJPer/lDoVPTPAp2xQMgbeAcelV7VvUuULPQp+WGOeh4znk5 qcW+flwAMcEZH51bjgwc57Z4HPPvVpY227SBgYyQeg9f85p+17ERhqyksTYCp+fvUwjJygU8Dgn8 6tpEuOA34+x65qRIyCAAGJ4445x+dL2moWKyxrjnIOc446n/ABqZIgy4Pccjvmryp8x3KTyCee/r VgR/KS3Uk8D+lL2z3NOQprCCo3DOc847in7O465259avJCxfIJ3Z6+9PECseOuec0nUBwKYj7ryO ee1TIhYgsPX6ir3kuvUg7TnA7VKYskMB9Md/SkqgpQsZ+xVYMe+AQPUdas4U/Nk46n15wOtXIYGI DbRkEk456Va8nYoyCCzcEAHGefz6UOoEabZmxJtIxk4Pbrz+tWUiH3SSuTxWlFbDzFSL0OM8jP8A h+FSfZwsoQH09sDv+dS6pcYPYorGO3IHRiOuffipFjbeQAB9a044cRgR5I9SQT7ZzU4gQISc4ODj +VTzjsZqRAPl+eckelSrApJlUBTnJrQjtfmycZznp3qWO2IwjYyASCOuKn2qHyni/wAb9UPhz4P+ J9abavkaFetyM8+WQP5/5614h+wve3Nx8BbfSrm3u7SXTdQu7Rre+iMU6gv5q7lZV6q4I68Hk123 7ZN+LD4CapaLy2oXVrpqqRnd58yhlA5JJHAx3rtP2M4NG/4aP+IHg34nanNLpuieJLPU9QutcmEU 0tn9ij+Rn3ynJ8vaBk4HvwP5u498UMNknF8HiruNPB16klG7k1BqbUV1bS0W97H7LwnwZVzHh6ca Okp4inFN7e8nHV9Frqzmv2nfit8D/hR4AsPEXiDxFHDrS6gLDUtOso5bq8hsp97LiFXSImTYwyW3 KOe4r8G/i9+0FoPiv4lLd+FrrURpSGweD+0IPLkeW1ZpAxAcgB5GJ69zX77f8FJtN0zxh4hg0vwX 4Ksf+EVvZIr638R2umX82np5VuXd3n+zRuxlctgxEoBhmPp/O3+0RN4Vv/GiW1r9ht2tYVDfYrae GJlbkYEvz8Ad/Wv84PDjxM/1rzrGcUOnVoyxcpT9m6kZxhH3YqLUYR1XKlaWq89z+v8AifhGeSZT hsnc4TVBRjzcji5PVt6yemt9NH5bH9QXhrURregafq6bB9qs4bhgkiyqpkQEgOhKtg8ZBIrhfjp4 hl8HfB7xN4iceWbbRLiWB2KAMZIiqFck5+Zuhwc8Y6V+cv8AwTg+LMdzr9/8MbGeW5sLqx/tK3t4 VldNPuoG2ShiyhYkuE+YAHaWA/iJFfVP/BQDx14NtfgPrvhHRdas5b+e20ax1K3trgTG2N5PtkyE YngI29eQCDkc1/p3X8W6GIynCV4+5OuqseV2upU6U5PquqWqT3Ssrpr+LMN4f1qOYV6VT3lSdNpq 9mp1IxXR9G9Lq1nq7WPRv2RvEjeK/wBnPwpqFwwaVNM+xSsCMhrd2jBIHQkAZ798V9LrH+7Oc8HG 49/xzXwL/wAE2NVTUv2cxpKzrMNL1u7tVYEjCOscq4Dcjlj0AGfWv0KSFWPLEHjGOP5dq/SeCMe6 2T4Ko3d8kV80kn+R8ZxVhVSzLFQS05n+LuUTFkqACF5PHTFV/F1rs8FtehNwi1S0lxkDAjfJOTzx xwOfaug8ncc5I5IJHH58Vq+ObNtN/Z91bxBICI43u5mJGR5dtFG7Y9x175xX86/TW4teVcEe2i9Z 4nCxX/g+E/ygz9h+jLkKx3FHs2tFRrv76Uo/+3GAIshgwI54P8/pT0QKmBwBzn6+lXoWSa3jnhOR KgkX3DAEE/galSNlG1eevYYr+s44hSSa6n8/yoNNp9CnHGFUs3PJPAPPHHWpI0OCAuWNXEjyOBnP ryAR6U9IsneT8x7/AE/Wh1QVIpCEbigAHqB/hUvlnkZ/T9Kv7Aq5XOR6+tADldrHGD2H+fekqtxS ppaFJYAcAAE9s+3pVkW6ryoO7JUD/H1qyI9pVk7LzgYxx/jUywuAHPf39qHV8xxplNYckO3HOPbg 0ogYNhc4HYHv61f2MNu0cY5z16n61OYGA4GQeufb/P8AnmodfQHG3QzSjElwM9Bk1JHCWyu046/N x+NaHkyAAEY9cc9f8+tTGBiCxx0yc9+al4jsxOJRWJWj4Pfn6jqKVLbJHmDnOSCO/v7CtNYF47nr gDt9KeIfm2pnBPIPtUKuaOBltD5ZAj5J9Pb3oWBiOOh7f4fWtPymDAn5SOmOvP6ZqwIsNu9s+o+p 7Zqva6IzUTNeL5Bg4AHc81OkS8AKcds9Mnp+v61eSJ9wWHsCDnBzUywkkblIwcjH9an2w+QzvIVQ ANw3H5jjPWn/AGYE7SeBkAfhWkISpw4znjv+efWlW3w/1GVI/wAKPb+YpUyosUe4be3Yf4GlEWG+ fj09j7/nWilueoBz26H26VO0eECjIJ4HuT2rP2pUKZkpBtOM8Z/T2qQRrjIHX2/mauxwlcj3xgdP YZp8ULYPXkdacq3VijEoiIITnPzcD0qZovTGccg/56VoLD1Bwfrx+XWnpblvkHPrn1/Oo9qDgZ4i LHkHPTjvQkCY5xgcA4rVWAlto52jANPjiViVGOeV/DvxQ61tCnSMsxHG3qDjqM4qxHEWUEA5IB9x 61qJb8DPTv269fepyihg2OD1OAah4jTQapmP9nbIIHPTj+lIsLoBsG7Pbv8AnWvs2DcowSTk5B/w 4+lJHFu4YZyfTk5/Gkq72L9joZxhVhznk4Az0xUhRVwWz39s81qiNVJRQevOO9PSEHnGM/ypfWL6 EOmZMlttPmRr04659KmaAAbiDz/KtJYkzhRkD5cdh+lOMQyCFwSNpOcYxS9ttcagZ6QsoKgHpnA9 8ULbMVzINuedv+e1aohzkAZzxtz2PvzTkj3Lk5PHTvUqsV7MzGtmLbcnnk/XpT/IKKVTIHUZ61qN GcnIBPAGP608W7sPmHrk96l1xciM/wAlPulRjGAccYNPWAl+SMenUf5/+vWksR425JHJ/pT/AC+M Y45wx4JzU+1EoFFYRn5umflGOB9ac8QXGMcd6uiNjk9iOntUgijJO3IHTnp09aTqmkUkZ5iIXeo6 DPXj/wDXR9nGDjg55+vvWokI6EYPI57k96Vo2DgDA45xUqoxcnYoKm7hsEkfrT0jXYScgfp/n2rR W3+XgksRjnpTo4B0fjjpjOBjrR7RFcvkZjRkMOeCc56j6U54/mAQDA/Pn/69aYhzyoGT+Q7/ANak +zHABwO5bNJVUJxM0QkpsXI9+frxUgjDMBjI/h/wNaCW5DBFzgDJPXj+lKYmLAc+meCcelL2q7jS bKSw5XDcZPsf/wBXWlER578cA9Mj3rUjgbhcccsCRn8xT1jkztG314HcD2qJVhSjoZgiZeW4zg/X 3qQw9CvoORzk+lXBbAtlhx7VYKYYdz1Pr070nV7D5ehnrBhsNkfL0/DtR9nb7p69/QVppCV65xjk 59M8imoUmdhCd3lkqfqO1L243FmaI8L2PXJHTj+dSi3/AIDknucdB2rReE4MvTAzj1/HGalMRxu5 BODnsaftwcGZsaYIxnngnOMH8qmihc7nbGe4I49s9Kv7COoHGcj/AD6U4oQnQ5PJH+fWodcFEo/Z wepI4Bz0P+fal+zHdvGf9odxx71f2Dbypx3z+vrS+WV+Vg2MnP8Anmj2/mTydTP8rO4MOvb/AOuP /r09IivJBzxx6Yq6sTZ2j6nJ5AqTyyDjJJ6kd+O1N1gUCj5PzsTzk8n29KlWEBtxwcjI9f8A9VXB COnckE/54pfLcttVT+A4x2rJ1iXBp2KZjbzAvb1yMflUwh3gAZzzj1/EVPDCSxGeO/8AWpjGCcAe /wCX880nX6C5FsURAAcHnnOPrUwjXcBxkZzkc/5/wq0kJ4ZRwOo9M/4ilED7trDAJxnrx9az9rru PkRWCAHqckflTvL9z+R/xq59nOTkZB6c4xj61H5Psf8Avof4U1VTFypbn//V/EPZ8vz9M9B9KkMX HmD6YJqZYyRg8H37fl1p4TDZ7e9f3tTnofzbyXWxXWIM27Oe2P51ZUKTwOvf+tPEZJyoUEdO/wCl WI4mHY89z0HatHVDktuVgjElRz26DOPzqVUAwemDk8+//wBerAj6rnODjJ9KeIzuU9ecfUV0QndE umQLDhsKMg/N9Pap1RFUjAyOp7e9TKm0/nyf8KcImAIyMep9R9a1jMFAYEVhlhnqc5/pUgidjkDP uOOO9TCB+GwSOuB0/wAirKRHJ3HtnirdTsYKn3IETjAx/T+dSqFIw2f8/wAqeEI5Xt/T+dTKnJxg 889uRVe0Dk0sQbVzj9Mf571MIxjd6Dj05/KpyuQDjk8bvepAm1AwyfcdAfenzkOA0KoALEcH3pwU kDcoA7/j0qyeAMkfzqYQgpk9T2/z6VpGoQ4FVUGNhDLxgdO/0qXYRzx249/r/wDWqxGB5Z6Z5yRU qR7sFR7DHt6/Wr9ohKNkQoqq3TIyccY4NThPmbYO2SevHsKmEeM5GBjJH9atrEBntxnjn6elDn1G 9irGh6EYOCCPrUqROMbQevPGf/11bVBux+Oc8/57VMkZAO/aCv4U+fUyS6FSMMQFx0GBjuKlVHJ5 HNXdqgBmxye1ShArZPbA6cepoVQmzKyKpfjOT68dPTANWY4cvn+EEfrU0Yw2R1xkA8/5zVgKyHC8 jHoKvnZCjqVlgKvtH97njI+lWDGxIP4Y61OqDO1+OOOKk8ooMcDHGKv2ncpwIlRiTwMcA8fyxUqx nfg9MZ4/yasiMjgdCe1PSLaQBzgematVSXTIxE3rg9eeR0qcYx5g+p2/5/GpY0AP7w8gDH+BqwsY Ixt9+elDqj5bFdYiCAAPXp/WrCRpwT+v5VKvACv09O/H4VY2HdgruPG4Z49qPaD5dLFfC56/hipE t1GMg5yQDjnnpVxbfa4L4PzEkY7VYRMZDZJ6DBxR7S6B0+pSjiIfHO4AADn8f/11Y8r5SFUE9M+v P+f8auCMYDN+Zz6/rU4iJXEXTNN1elyVTRSCZOAueB/P2qUAMMBTuGAMZxgVcWMh8kAcdhVnYDgH A55P+NUplTpq1ioYwgHykDGD7Z6VL9mJGTyMY6cE1cMRHK5465zxgentU8cQBxJ3GRnpn8Kj2gaF aOLbwwIyuCBzx9DThDtJPHu2B25FXvL8vjAJYcHP5fSkSELINo3DIzx0pqVyYESwPjacZHbHXtVg Qk8YAwNw47mraQE5cYGACc8ce1PaHMe4HA65I5z/AJ/rSU1clw1sV1hKnBGRngH3/wA+lTrHlRu6 5x6fgDV3ycAg/Mdvtnp1qaO2fbhsdyoPb2FN1g9mygIQFIYHOfXH86lSPBOAAAc8DH5//qq6kLbQ D6g896kjiA+fHUYGecZqvaj5NCqiF13DgbSOn/66k8kK+Rtz6en+TV8Q8AZ6nA74/KphbFW74xg/ h7nv/OpVWxPI2UzD8w4+h9j+GamhjIUqoPB49f6VdWHHUEgcg9voKnijB/L+Lik6pfJYqeS3Eacf N17GrHlIG6nAPTBz9amaNWbAHTjJ7/56dasJFhiEIz2weM461DmwjG7KawsoBYZyf59qk8p/KGc4 ycZHOP6c1qBApBHBByT0HTmpTCCd7A9zx2qlVYprUz0hG7YGAz1P/wBb/P1q2sAx1OA24HPr+HBN WI4AhDtknpkcZq2UYghflxnqeaiVYIweiZVWHDccKpyPX86lEO19vGck7gCatCFQq8YGQAe31qUx MFKqenGTjp71m63Y1jBrcrGJX+6MZwSQMZFTKoA+UZx8xzVxICSDn+EYA65/n+dTC3OR37n6VDra WCVHsUgn7zcozjvn19DUyR5JDAdR17VcMCNhNpwDg5PHH9KesKhvn5+vXNR7fSxSp2seP+L7r4aX PxQ+H/gX4r+H7nxNpWv+JDYJpNpd/YpTetEy2U6yCSPiGdkdlJwQDyMV4T+xPrPw91L9snx94e8T 6C2n6DpTyy62tzem9hurezuWS3tZJzK6tM+SgO4lgxxgAk/QngP4KwfHr9pkeCviLFNH4bGka1Jb atE0aT2d1HYQzQvC24vEzSKURsYdWbjgGvaNB+CX7OHwX+JJ+BGlWNyUhPhxrm+e4js1nk8RC7EL OIIw7SIbbaGZ8OZMYGOf8L/pe/SiwuU+IGaf2VKpPEU8M6S5W2oJ81Oc7c6jzxlNpRtfm5W9FY/0 88CPBGrjOF8FSzFRhCVT2jTWsvtRV+V+61G7d9rpWvc/Or/gqD+0j4W8S6y2n/A/SvGejxafFBYQ RJdrD4eza2+wRW9v5fmkYYqT5iow5AFfz96rfeJPFBbxC9vDPKW8iRHjbK7OOGGQcV/cl+09o+oa x8LNOtJfB9nDp0MNklvKsUDOY5bGVZpXV/mHklVJyNxznk1/H38LvEWj+Hk8T2um+GodSvIraH+z FmgnYJOLpFLJFHzMWQkY6d6/HPooeKeHxHD9eODy7llQcE37RTcudtXlJ25bWTa6apbWP0rxh8Oq kMbhp1sa7VVPTl2cFfS1+a+1++59K/8ABMv4raB8L/ihfeH/ABCLfTG8QWcTWl3dqrW4vLAtIkcn mDbh1ZwA3BIA7133/BQ39qCX4uW+gabZ3PgW4g1SwsdQuLnw1pcdrNbywyzM0M8myNo5A2Ny5IIx zS3qfCX/AISL4KWuoeF4Il+IFtHF4oh8+8hEE41F7NmiRnxAwCbirgjJIxivcP8AgsN8MPgt8P8A xJ4a074caPa6VPDpcEt0bYbfMVvtSqxUsATviye4IA71+sZ14zYDP+I+E8tx2VTjWovE+zqXi0lz KMk7NvSpBtNb3Wh8jlvhLi8qy7PMdhsfGUJqjzRs1ry8ys9N4yWlt09djif+CUmrq/hLxX4XLiVo NQtdQUKdwAmh2HoCucrz82QeMcV+tqIBgDjue/P+etfz/wD/AATw+Is/w++OGveFZYd1veWdlZMQ 8bqkr3SRqxdCRlvMY8EjjBr+g5LVgCMYPcn8fpX+w/gxnVPEZFRpqV3Tun5Xba/Bn+dPiblc6Oa1 JuOk7Nedkk+/UaItyhVXn1+n+elfMX7Uv7U2ieG/AF5+z/YcXMzPaXMgdVLnVIgsu3OT+5TDNkEZ IGRzX1dDGGcRJjPQAe/fJr8VP2oPEuhWnx+v9UGmRTnVNWttGhfPyRvbRRGWfG3J3MGBUckgnkV+ C/TUy7CZlk+W5di6vLH23tUv5nShJpaLu0frv0X69TCZljsbTjdqmoX7Kc0m/uX5n6kfAbxhF8Rf g54b8aw5CahpiNGufm2xM0Sk57lUBPTr2r2eOEjG7AyOOf0/yK+Tv2F7601X9l/wvb2EUa/YbZ7C UxjhpY3LOzYH3ju5+lfXgjBUKnPPQD/OK/q3hXMfrGWYSrzXvCN33fKr/jc/nfiDC+wx2IpKPLaU tPK7t+BSEPzLjoWIB6cY9MVMttklSQCOBn9avQwsXUgDIJGMGrBgPHb5j9cegr3pVtbHkryMn7Me Tzkcc1YWFcsjgngduTzz0z1q4Y1Clvugk8n0/LisXw27XcF05lmmC6jdRhpMcBJWUAY4KjHB9KX1 qzs+pMaN05X2NQR9TgjHVeCTwRx9KniiYgHHPPXt75q0saggHuSBn29KmKDZnP0qXXuDpso+UMYO eucjnipUiPmf7JG3nt+dXEhx8qkccHNWyN+CQOmCOM59eKmdUr2ZlCJxjnoDyB19qtiIsoyDzwSR yRxx6596theffBz15J6etS+Q3UE/7QH9alVbaB7MzkjxjaOwByfbH+RmnpDhSGz67Txkj/GtHyuC WAODye2frThFnIP8Q6fSiNTQORFHyfnCueMA+vXryBSmIZIJI7cD16VoCHaRv7H/ADinxW4JbAJ2 joRwM8U/aidK+iKSxkc44Ax+NSmMkYUjgZOM/jnJrBtPFul3XjK98DRRXf2uysbfU5ZWgdbZorln jQJMRtZgUOQD6+hx10dsdue3bHtyfrWVPERkrplTptO1iiF/iyB3OecfQVYEYDrkdeSDxxVwxxsw A65PHfB6enpU4g/hYZ7k9+mMfjVe1Bx5tSioBUDkeoI7dKNhIzwCTjpxz+daRRlURjv04GOPTNI4 XAhc/MVL5x2zjtU+1QuWxWit8EgAjOVAz3z/AIVKsHZR6ZOMf5P+TVzyQWyc5HzAc8VJBEeRJhux A9RS9qRZFPyMNuXrxx/jzjjmj7MygKTjHUr159K0ViGcnGN2Mjj/APUacYgCG/lz06VPtS1T7lPy VblRjk47fn1/KhIQxzjknqOOf071oCM/e/8A1fhU6xtkqGyT6dRUSr2LUGzOaAnrnO3PP+f0qSOJ XGMdVwcZq4YQFAOOo7/pT/s+PmOBxnr1+tL267k8hS8krlV6Y6Y7f560ohKEsOBxxnj6nvWg8SgA EA5x045pFjKEnHPQ459qPb6CUXsVFiJwRz/9fvT1jJHI4+nNXERmGegbj6H3p4gYgFSSffnI9hU+ 27srk0KQhVVPv83P+fWpvKAUkYJI/ke3Srfl9hzj+VL5Q+8Dk98dPy7VLrXGoaFLy0IOCT9O1PWJ SMAdeSfr/n/PWtIW+FZc5DDH1pwjRGOSO4wf51KxNypUmkZ/kleORnnOPT1qQQ7CcHAb1HOK0ViR wFIGCMHn15/z/k0qxDb8oHrzj/PFL23QhU0UEh9eec5H+TTxDjB6A9SfUdK0EjQc5B+mfx/On7FP yjqTn159uKXtkUqZnpERxwfXIz/KnrGAMN69Pb860IkwpGc9cVIVHAUck+hxS9sL2ZnLEQv3enTu aesQ2gAZOQAQM4B//VWgqkPnrxkqaegBGQO+Mj/PrR9YHyO+hUWDHBA9j6UqwqpJ99pIIPHrV1VO 7BJwen+NS+QzZ7nrgDnFR7YrkKccSLyQCeAAPU/XNPEWW+YAAnsOAfepgOOPXof8fpT8EHJBx0/E 0pVRxp9yBgh64BI7f404QqWDAe/PfHf3qwEIwxBAJ6DrVpIRge/IYfTtWftrFKmVNq8jAz3OfyPF Rqihen0OP51fWJnO4ggKOn4077Ocnoc/j09D0/nSVYlwuyqY1Ve/PI/+vTAoDnORx25q40SmTBJx tznHT8KWSIcDPBPPv9aftRumVu5P8u/tjmvNfh14o1XxXe+IodTt7O3j0rxBc6VaPaT+e0sVuFw0 owPLkyTlO1eRftmftN+HP2TPgbqvxT1Vo3v9psvD2nlhuu9SlBESgf3Ux5jnsoNfgp/wTY/bY8Q/ Dv4xTab8XtUluNI8f3zXWqX13IxW21e6Ysl1ycKkjN5cnYAg/wANfFcS8c4XLsXhMLWnZ1HrtotU m/K/ps3sfWZTwfisZgMTjKUb+z163aXxW9Fr52stT+pSNNx2RZySMAenp7/rStHtwvc8Ee/06U+J mWQKQGJHJHTp1BFXVRyQSACfUZz/APrr7JVdbnycYp6lWNMthhwD06YqwYtoyAeOnPH+fxqWOJgN zDd3BH6fWpwhkTy3POeCegPof5VDralqmUzDlsKR0HB4pzoEAB4AzjJ5P/1vyqyibV3E7jnr/OpN iOGBwSynJHJB6/8A6qr2tmDpdiiqZLMBwRyCeppRBIG2EPg87h3+vHrWiETG5Pb5se+MYo2MyjcW XHTHX/P4UnWJVPyKYhAYg8k5wQe/0NSxxx5Cck4zg9f/ANVXyoHzYyV7nvg/z9KX7OCRuXPYdRUO v0GqZmpFnIC8jt7n0FSiLjYoyCOeo+n/AOqr7Qll28nOWyozyO1SJAEwvA5JAHb8Kl1zN0rsyx8q gBSM/Kdw/wAP51YEWAVOBxx681ZaLzPm4wDzg8D8asCIDgZGf4u/0+tJ1tBez1M1onGD1Bxgr6Hv /kUeT7n8x/hWoYuByMLwATR5Z/uj86XtQdI//9b8WEBHKnHX6+9SlN3+yOozVhVUnIHU/wD1+9TC Ehc4PXHvX90qsfztaxW8tM9OCM596kHOWOTjt7VKqsSd+OehFTRxZORkjjb+FUqiJ9mRBCck9D17 f/r6U4RY4Xj04zVnymY8no3BHp2/KpUjBwzHnoa1jU7D5CssTKNq5HqT2q0I8YByD2xUm1cfIB0/ /XUiR88joK1VdvRESiQmI7c9Mn8am2k8t0z19fypwUtnb17+341ZjjyoVzgegrX2wmr7laOIbcnH 1H8qkSNiB2HQZGSKslUBx9Oe2PwqRI1HXrnBHXPqar2xFiIK20KPXqPTualQZyG4I4GfSpRHkZHY HIOf8mrCFkXae/XHOf8ACr9qKUbjEVVwcgE8nFPVGXHTB9fQVP5RLBU7Y46//rqVo1UheM9sZP50 KtqQ6SIY1yeR7Y/Tmp1j+UkdOoYc85p4RlYluMjqBiriRAqDjHbpV+2M3SXQrmNkPzAHHVfWpVTJ JA57Z71aVflyRwe/XH0zT1iHKNyAOP8ADFP2ugOlqVhEA3P5emKswoO3Q9P/AK1SqqLyenI55x9B VqKIFgAMZIPPpR7ayD2S6FaNDuBGf59KmjT5wWx+FSqigFQPr9RU+xd46AHkY9Kr2vYh0xoiOcuO o9aeIj93AznqM4welW0UHkMAFHA9vSplQL97LLjnOM/WqjUewpUyrHBhDnBU8DjPSp41CfgPlz/O rICjnGM/KAR29zSrGQBwOuOvpWjrXREoO9hoVSPMTtxUyRBvm68Hr0qykWAE78ECrAjCnDjB9aPa qw4Ue5WVASAMZ9frU4icfNkHjg++P1qcr2GcKOo71PsYjA4znI+g/wA9qbqilC2hWaJlIKjHOTip o0VexHpx+lSpEigO2SOOT/Kp9pJLHr398dar2vYn2WgLGB1x2JI4H0qdYwpJPTsM4HWlVSSAO4z0 GasBHbG4Yweee3b8TSjVaKUbCRxqo56k9TyQBUgiQkyHAyemRj/9VTwxDIb05wvHTtTxExbk/N3x 19s//qodbzE4JjViO/nDY7Z6Cp/KGDySCM7h2qdFbg4HTG89MD+ufepjGm3cqkDscU/b9heyZEqF gO5wKciA4cDP9ef/AK9TqpbhMFuOOmP/AK1WhEQQynGO2fT6dql1rCdJlVU/hGc8gke/Y1MkQyQR 0Bw38vyq0I23cAe47VNHFlumDnGe3fk0liQVMqRxDIC+uBkf571ajiyu9udp7d6ljiLbd2OScccE 1bSE+WSMgenvnoKc8Ra1iopMq7Shz/D246evAqwBtXL8DH/6hVoWykbVOcEZzznI+npVjY0m37u0 DnHY+n0qZYhBKkykIyP4QRyRxzVlVBOASe31xV5F27d3BPPFOWIbwOPXP9OaqOJbZSh0I40jBC9c HknkD0qYW4D8jnn5vp7VZVAwAjB3DrnjipVj3MC2QNv4DnOR9azdYIQTKYhO7gg89D1qdLYBePXn PvViNCSFAyP7p7Y9DVry0HCAgkgkHvkU5VrDdMqNHzyD3y3T3/yan8p1GCRyRgn1qykQK8Hvxn1q 35OF4/4ED6n8KyWIZnGmr6FCGBtzL1P96pI4OFMeBg8YGM/hV7awG8AevHSpFifoc5J5IJ79eM0/ bPctUktSBYgWBGAG6N3P41aAzkjgkAnNSJCxGcHGcDrnBH8qmjh7HoDjg9aHUTQJFeRF2fNgL1IB 6j8qnSLI6feODj9KmSEg/Qdv8+9Wli2ZCc8c+/1NQ6o7dihHF0OTj3/X9aubcgEj0P071OIVyMnG QSeP1qfyhkEAnoOehocyuXUq+X5g39OcfSnGMKRGOhxgnpir3koQxHJycFTzn+tRXd7/AGQkepLG ZHiubdY4h95nlmSNAPUlmGB36V5+PzCGGoVK9R2jBNtvayV3c6sBgZ4ivToU1dyaSt3bsc78HP2z fhppfxy8OaBf+G7JY7PwRrUV1qVpCi3OoG/WKWIzzFRvW3kIUHJIXqAMA/vr8Ak+F3i/wl/wsLT9 J02LUfLSzvL77NE91NFbB1hDzEbisIZtg/hycdTX8rv7SfwO8RfBvxBp+vafp+qIbK0kutTXULmG d7eLVJYPNuRDEG8uJ5HiwpbhccEAY/eL9mvyfF37PuqeGNPudWtbq7059RXVIHEc1tfID5D2uDt/ dSRqcFcEEhgcc/8AI39KhZZmeaz4oy+paGJnPmfM2lzVHN3Wj3kmlZaWsrH+6/C+RYmhk8Mqqtqd GNNJ7XSio97fzXfXvc+Hf20vjD4w8YfA/wAZXl1qjQHTrPW54JrXEcxW3jgSBfujbw5BI5wx6Gv5 aPhT8Ur/AOGfim38YQRNNNp90s5UOANgUZwDkZ2k9a/oa+MvwZ/tD4D+Nvg9q3im/nuvCui+KNcu tQYMLi8WG2jvbcT5J3IxjKOM4wMjFfyi+PNcXRdAL2TbPNmiEKx/xttDu5xyQOBz1J9q/p/6IfCu XYrKsfldG0oymrrlcU4yT5Xsn7yu7dFufL+OmdVstxOExMVyckLqzWjvqrbaOy82f0KeNf2gdM1X 4T6b8S9CzBcW8N226Tyrpbo2DxTbHZeFAM2Pk5655FfHH/BS39pyy+ODaBrB0947eCwMcioA5MsV 1cwqcnPG0AsCOd3HavmP9ry78Z+GfBnwz0DWPIsL+98K3PiXVrexgS23XGq3A/1wjA8xligiQluf l5yck/GNz4v8V3AVLq+kuFRQEE/zgAEt0JPck1+z+EngNgadXBcQUZJunOry6v4XJxspdVomm1ta 3Y+A8Q/GHF1KWKyepFpTjBN6b2Ur26b2aT3P0k+Ai/DnWNf0nXNMvXsdZbXLOPU7Q20JteLm3mgS MoA6I+CZM52lMrX9CexJolubUq8bqssbq2UZWGVYH0IOR7Yr+MrRPHfizwxeJe6LdCGUTRXIKKP9 bCco2DxlfpX1NoX/AAUA/ac8Pafbaba6xbSQWsSW8CS26kqkKqiAlducKijnrjnvX+gngVxPS4Xo 4yhjZzqRqyUo7PlVrW6aXvbfSx/HfjHldTiKpha2FpxhKnFxluuZ3vfqtrdtbn9TAHHH3h82Rx26 ++K/m58dfET4fan8WPE+t+JUuJZoNXjewJYKTdQywpKw+ZRnaHIyKzLL/gp3+0vZriU6RNgbTuhk X+Hb2k9P15r5Q/tGx8Q6Rqfi6+CR3cs0ty6IuUNxPITtUE9M89+K7PG/jfLs5p4OeGi24c8Wmv8A n4lHo/L8jzvCbhjHZZPExrSS5uVqz/kbf9eR/Qz/AME3dY0q+/Zctmt3jhS11m8tZGdgAXRYix57 kmvsDW/il8O/DTAavqtqm5xGoLjlm98gc1/LJ4U+Kfj7wN4Ej8IeFtWvbGyMrXMsFqwjzNIAHYv1 5wBwe1dX8O7q/wDFfju3uNZuLi6+yo93LJcyNL90cfgCa3w/0jYZRlFOhhsHzOlG15OybXZK7/Ic /A6eZZlOtiMVyqpK6SV3r5uyP398X/tn/CLwjdLY285v7ht2yO1+bheCTgYx+NfOni//AIKE3aEx +GNHfGMK87BMn16GvzV8PXkeralfaqx2m4ci0Q4Gy2jU4J7/ADE5/EVWu2+0uWHOSWLAFvl65yeK /HM6+lDxTiqjp06kaK68sV915c222h+qZL4AcO0IKpOnKq/70n+Stvue5+P/ANsz40+I4ZWF7FZx KhciEF2GOeCeP0r61/4Ji/H/AFj4n+Gtf+HHjK4M+qaXfSaxazTHDy2d4/7wdv8AVTH8pB6V+QHj XUY7bRmj5zLyoJ52r04HqcV0n7MfxTufgF8a9K+I6SkWdrqEdlq8YyPM0+9QRzcdPlyGGehANfXe EviZmUc2pYzMsVKopPlfM21Z6XS2VnZ/I+O8UuBsD/Z08Nl+HjBxXNokm2un3XXzP6uFTCFzgH/P OKmjiP3FGc/hTrOSzurdLm0lE0MqCWGVANro4BVgc9CCCK1DCUAOPUk4HOfpX9/LEKx/G6p3Kflb QEYbc4IFSLGuzcpByO456/nVrylYFkGcYxzzx+FWvKUou7ORnnj09aHiAdN6GX5Sh9xBxgE5zwP/ AK9TBc5QAk56VcMSEk7eoBGR/wDrqRkC/My4x6DPWpeJHJWIFhEa7m5z04PTJPX8aRYt4DcjnBHP NXEhUnLDOM4znjJ7f55qZIdpyeuc/l35qXibDVLQzvLULt2kgNxkf1qbyxg7uAeR3FXRCjcuc+pP X3rK8QaxZ+FNAvvEuocQadZTX8wY8FIELkfjjFRPFpLmbskVTouUlGK1Z83eCLzV9T/aO8U679oi fRm0+28N2sCqwcXelNJNLJuztIZ5pY8AZynWvqCOLY44PA64711v7NP7Meu69+ybovxC8hjrFzpP /CXXbAMGeW+ke9kXPushFYKoVC9cDnPTjt+dfj/g9x/UzzDY6rV3hWny/wCCTvD7tV8j9C8R+E4Z ZXw0ae0qcb/4krS/RlIROCGAP0IxnH61P5Z3Arwfbg4q4MBAW4Dcjd6+9Ltyytt56Y/ya/XniT89 dLsVViZQCcjr7n/PGa+aNY1fS0/a80fw8ZbkXT+AL28SMTyC3YLfIuDCD5ZfHOcbgK+pQNw3KBz1 Ffjn8Wfi0NA/4KZ+Ew8223QxeGZcH5dl/AUwf+2zKfrXynFPEscCsLzf8vKkI/i239yPockyR4qO JlH/AJdwlL7mj9gxGSAfU8/jUqQ4Xbz69O9WYUCrznt2wOfT8asmMldvHXp6EHmvqniGfPKjd3Kn lrndxtA5JHbpT9igDaMensO1XPK3Dany/j2FILeTdnIPJz3GKy9qE6fQrKhI4HIOP/1//rqYRYbA 457dasiML+7J56g8/wBKnEe0CMnIAyAMdff1pOqyvZW0M8x4J4yORjHH5mnYCjcOoGPxq3t28oSM c4qcxAe5BOfbjn8utP2gKkuhQMSkDaDn3z39KkELL94Bu/AxxVyIKVJII5PXoO/4VaSP+IDjbWUq zuXy+RlPExyTwe3r6+tSAKEyRhTjG2r4CIS2Bnpn6/4UpQPgY6/hmhVTNw7opLCHb5c4PUn/AD1x TxAoJBBz6j6e1WwByFHXg+malKORh+Rj64qVWLUCr5b8ggA9vcUCFiSSMBep78VbRcfeIGBzz6el O8kkEjJJxu9PXvQq43G5WEGenTGeR15zmpxHtULzjoD/APWqwE2DhcnA5OTkelOCE846c5PP9aHW 6XD2dyGOLLfKVAGO3enrEn3euTnPp6mpdrghQMVIkWXOOBjp25qfbFxpkJRWIHIA68d/8iiOIKow PqKtG3PyluMng9iR27/yoWI5JHHPHqMfSl7ZC9kQ4OMHPvjv6Zp5wdrNxjp/n+tWI4SpyPoc1KsM hHQ/MeSfSj21gjSKIiG7zCenUH/PepDGN2eeOCKtmHaSowcgj0AP+cVIkKbCrbiecbeQTS+sdSVS 1KjIpIx1x160qxnb82BzwTxg/SrccTMjlef5jHpUoUyYEg4OMHOcDp+dS69tivYlFAV5yTle9Thj 9xjn9Mds1aWIghiH65PT/PNPeDcck4HsMcYqZVivZaFLYWYM+4Y44GQf8Kldf+eYOSCfc/5/nU4t 2GefTJ6/kKlECEBpOCFx+vX2qHX6iVLyM4coSwOePwz7VHcBEiMjuipglmbgBRyWOeAoAJJOMVo+ SnVRkdWAGCT29a/GP/gsD+2Ifgn8LF+A/ge8EPifxnA0d5PC+JNP0fdtlc45DXODGvfbuNceZZxS wlCpiartGKv/AMBeb2PTyzKp4vEQw9Pd/gurPxT/AOCm/wC1zJ+1d+0BLo/hWfd4S8KNPpeg7T8l 06nFzfEdMzFcJ6Rqvqa+cdO0cxaTbKFOVtoj6fwg186aBIg1IwsGkklP2e3RB1Z2A/LGa+8NR8NX V1p7WukywrMkaxxyMQwDRgdh6gEV/B/iTxPVxONjWrOzm36JaJL0S0P7b8NOHKSwtWNGOkElbr1/ F2bP6Jv+CZP7Vknxx+GLfDPxnNnxL4Vt4oFkkb95fafgpFLzyXiwEkPf5Sepr9R1iPl4AAGeQT+t fxofBDx34w+AHxK0j4k6G7C90qZWuIgfLW6gPE0L/wCy68ex57V/YB8LPiJ4W+L/AIE034h+C547 iw1O2WZCpBaGTGXhfH3XjPykdcjPvX9GeDHiMszwbwFeV6tH/wAmjsn6rZ/J9T+cfF3w8lk+MWJo wtRrar+7Ldx/VeV10O82sYBsGMsOQfbuaRYSAZJNpwuRj1654q8qZAGBjjPH+e1SBcENjjnoK/aP rDPyL2bKfl7nUKAQfm547VM0IZvM7Dll9/r7VZI28sO3f19akAPGAenIPQn3o9u97j5Cj9nAbefm AyPQmp1iVlG4AZ/zipWRUJAUD/H/AOvVhF2ABSR8vQ+uaJVrj5NSj5akiTaMjIyew7U7YMZPJP8A F/n8KtpGWbAIAx0qSOPcAEGfTrgn86HW8xOGpV8s7lUDA4OR6etPWEuh9zg57DvVtY2BAOOOxHTH +fSnbMpt2YOeT2PvUOt0M+TyKJhDYK8gn6dOOlSLGcgqDgdfX61cFs68ZX+g9c1KyoOGOcjrjnH/ AOupeJCVMoeXk7T16EEUv2U/3W/KtBoWTufXOetR5b3/ADFNYhEukz//1/xsUDccc+hH+NWBG5AO O3Qen1qQIFGTxzjI9utOUBVznI9K/thVj8ClTIjGw5CkDpkfyqUKwJJAyevP+FPVSegOeoB/yKmU cHcM+uP61arJA6Xcaq5BGMjAyamELEjcucHp3HcU8Bn9cA8HNPVccdj2rWNe4vZWY1U+Y5xwMYHF LGpI3Ed/yNWAoBwuD78VIsa7jhefTOc5q1VQKlfUi2njjgcEnP8An6VOoKqGyM8Z/pT0gXPJbk4P sOeKsiMhAc4IznPNaKoZOkyqiA4bqCcEf/W71ZVW2ZIyTkilRduWPAOOMVaVMKF9Ogz1P40/ahKn dEATB34IwMdqnCAruI4PH409UIXOe/BFTIrEYH3uvr0/zzV+1fcy9kNTMfUg9h688VOIy3zHr7en pThEQvmgbjnp35qdVJbI6dPb/wDVTVW45UNCJYzuG3J+nXipwEdtvJGeg7U9YyfkHQdccZq1HCoA yMA5PIq/bXM3RZWVmZjwMf5NTlCD8vH1qUIRyckc/XFWl5GTjGBjHtVSn1Y40G0VhG3JYEgcnIqy gxyO3HHSpljyuMDAGaeAOQATgE4GM5+maHU6Ecj6kI6knIboKslQfujgHqB/jUwjL5yc8dO/61Os RUhcHJ6g+lP2hHs9RiqNuccfT8z71KqYwSBjmpY1J4A74BJxwKlVAcLghRj/APX9KaqFezG7B2/B R0I+nWplRV5I57gfXvUvkgsHbkdCM5BpxXDYXAPUg9Kaqu1ibCiDOffIx0qwEw+7qD27D2xSBfkT cchh0PpU4jyMHIHXJ6g9iK0VUThcaEAOO/bv+vNPKkt8pIJwM1JtYEFs/wC16ZH1q3ECMjOc8j/H Iq/amXLqQCJmx1z61OkbKPm2/wC0B1q35bHnB5/zwOtTFBGPmJ4z26/Ss/bFSplOOMs21cYJ5GRV xUk+8R6e/T2pYwFUE5zng9PrV1Iw31HIz7+tN1SOQhEZ2jaBjGQB+dSRIOZAM8Bdx+n9PWriAKpk HUjG3t9OeKstCGIGSOOvSs3X6IajYpEEcL06HkcfpipvKIOODznnPFXdjlwyjPHPHerHlMBhuWVc DtVe20sOzZRUOGGD97satrFxkEHB7HrmrRjWMAHHU9O/+fSpBEoBADYBwSByaSrIbgReVnhue4x3 ycGptsnCYx6qcc8+vSrEaEHgNzwDnpjoKn8tsZwMZzz2xUuqiJQZGilxs2jAGDjqfTrUqQjG5c+n 0/rUkcQ2jccYxg9s9ashNwBIAJ6nNL2uoKm90V4oyw3Me55I5wKtIinh8Yxwf89B+tTeWSCxAJ44 z+pqcxMTgge5H9aPbluDREkPUHgnk84H8qesWFOcY6cDv+tWRDuIRskjqPWpFjyAxx8xHH+farhW JdPqNVVR8+uOMdDinGE7yuODxgdj+FWI4gV4xu7Y7mpEibepwMjqAep96l1kEYdhkcCqfMBPHT1z VlOTtl9ffIqVVYrtxk556dvepNpJ3kcjrjnFL2w3S0BY1X5Rg8c9P6/zqVRgFmB7AA9MjvQEXPAw c8Dvmrhjynz8KBkHk0OrYFRuQqEbAUHPt19f6U/ywBvwSPXpyKtLEDjIxjkkdOOn/wCv/ImRDjGe Byfx/wA+tR9YV9BKgyrjaFY/l3/L0qQRuF+fpkYAHWrSRq5D5AGe3r1/GrIRsYQ8eg5x/n0qZYmy sNQsVRCZGJx7Hj3qZIgpJ/hGRjqSM5zjNTbVTIKhcHIOP0qYRjOeTxzjk46/pUSr3Zp7NdSCNWcF o1yMFfp69SeM1OsDx8pyVA/nmpY9rJgZwDlTnirKochV5Pp3/Gm8R0EqNxkaNkNxkdxgHP0riviR JpUfgq5k1W9k06P7RZFbiFQ7h1uomUBCy7uRkgMCQDg132Cow2eR+R9M1wXxO0XQ9d8JtpmuRX0r LeW1/Zw2DbXlntW3iJiVbMbgncODwMHNfi/0huIVl/BGd4tyceWjNXja6clypq+mjfU/VvBXJ3i+ LMqoKKd6sXZ7Pl11t6Hd/wDBUHxf4es/HOhaRCIoZ/GvwqstEkmbekBn0y+tvNmULuO+SNwzgk8K o7k13f7Leu+KX/ZQ1nRPCM63upWHhzWoIFCmJrnULaSQoY5IySFmkUKjMVwcbsA1xP8AwU7i0g+C Ph75sFrNKttOnnyxhpod8lovyyHlQ3QgenNbf7O3ivT/AAT8H9R1OPzLWCS1u4p22l3RXmbdJhSO DyW9V7V/yrVKzxXBGW1OTmn7XW+qk4ScFotVeKiml1V+qP8AcHJ8t5MXVpqeii4x7pXvfW+qabV+ ll01+KvGJ8ZeLvgnqnxR0fw5f2GpeIL3X/CXiqG5vW2afp2sWpVJJssA5t5FYFRnk4AAr+fH9m34 Tr8ef2k/DHgPUADp+ioNW1kuNy+TatHlSPR3Cr+Nftz4k+Ldxp37KHj1RczNFH4pCoVVl+Xy5pWY BuASV9cmvlP9iL4dWvw2+G3jD9pLVPKs5tQ0rS9J0+S5/eRlpo0uJHOAx+eVo1x2bg4r+1vDDPq+ QZDntRRUKkpKlRtzN801Zbtv3FUduyir3PxnxFymnmmb5ZScuaCXPUva3LHV7JLWUNe9+h4X/wAF UtTgv/2kbOzthtjs/C9pbqoxtUmadtuR6DFfmQPl+bueG9q/TP8A4KWNHL8WUaOSE/ZZI9OaHrOu 2wtJSzHGNpMjY7g5r8z27lceg755r+xfApxjwllcYranH+vnufzd4qQf9v413vebZVZguWPrj6U0 bWQuuSABj3B6GoNSH2W0MmcbSpB/GvQfHPgzXfBPiA+G/ENqLO6itrOV4Awb5Z7aOZGyCfvo4br3 r9XnjacJQpuS5pJtK+rUbXdt9OZX7XXc/PoYOcozmlpGyfrK9tf+3X93qcGW2A78DHJJ9KqWkoOp SBSRkIwU5xxnFdp4Y8P3PiXWU0m1tZrt5Emdba3BMjCKNpDjGT0Uk+wriNLiln1qeSNWZktg+1cc YGTn6U44mEnUhfVJN/N6fkzGthpwVOdtG7L5LX80ev3FykVqT1CBVyAT3967rRfFMXhrSdQtLdGN ze26xJLv+5HnLZx1J6Vwum2Q1K2niUgFIpLmTzM4OwAADHcn8K6awh0qXUJ47yfbFbw2yISw+Z5J BlSAMkbTjjnmvh8YqTi6c1e2rXzVvxPusB7RTVSDSvon8nf8D2r4eRXWieHBq9+sn2jUzKLdXIU+ XGyABQe3zV0OpXAsy+mKFM0loGQDL8DKE+nXFaNykmpahYaZo1jJeTWiOpaIBAjuuG2lyAFJIAY/ 3ao+NrjXLWCK3D6cJlkeSJjKZwUwpVSYVOGBUkrnAGD71+STx6r4lVGknO7avay1tpq7WS6I/U6O C9hhnFXaikk7bvS+u17vueHeM5EvLmCyOcSXa2aSOdqsISHcDseRjirNtoQ1afUNPaFhDdWo2lWJ ETHKLuPQEkd67S/+Gtx8RfC+jW1zrWlaPPoM2oyPJNbTuLzzfLcSY3AqqDILMqgdyK6Pwl4L1fT/ AAxrem2+tW0l3MbCVdaFjIV08CRyImhaT94LgbsHBPy/Jmv0vC5xQo0YRhU95NJq0uskr3tbaz79 LX0PzDH5VXr1ak509He2seielr33utdOt7an67fsT/tMx+JP2cfC2n69K76t4cv77wrqsQJ/eLpW nXFxA0hGcB4415I+8Pav0O+FvjJPiN4Xl8S2yrj+0bq0UDgbYGAHJHPB5Pev53f2TbiH9nTU/Fjf EfV5tV0nxZpP2ae30e3kgaK6uVkhSaRJgMoFmYExnIPc4xX7yfsj2drD8EbKLT5Fkhiv72KKYOJB IqyDDbh1OOuea/tnww8Vf7WxEMDzc3LF666qMYa2avu2vU/lLjrw4/s3CyxTjy3a/Fz0unbZI+hC DgrjI5HHrTkgYgbckdOcAflUt3dWdjPBDcPte6l8mFe7uFLFR+ANaJiwSenbP/1q/e/rC2Px50nt YoeXtznJIxx/hnrT2hwxHUEcHg1dVQSCB36896eIQBsOPl9KXtrD9gVBGApVQenPX1p8cZIY45zg D/65q75WTkDkA8+lIsJjYhuh45/lUush+wRV8pduFOPQnt+tfOv7Sky654Ck+FulTINV8TXNjpMN uM7xBdXKRyyDH8IGQT719MLFnHU4J5/rXwP8ULLxx4n+J/ijxt8P7PUdSvtA0aHQtCg06Ca6X7ZI rSPMEiDAlHkQ7sjGwjI5r8h8b+OY5Pw/Xkvjrfu4+s1a/wAld/cfpXhPwlPM83pcq92l78vSOy+b 0+8/qQ/4JbeJPDPxs/Zn0XxDpstvfW6QXfhmea2hMVu7aXNJYsY0JbapEYIHfPpivyO+IWgQ+Ffi N4i8GQupbRtau9PkC/w+XIcLnpnbiv3L/wCCZeh+FPhz+yr4K8OaLot/oMMGg20L2l/pzWV01xGg WaaeOMMPMlYFixYswwSa+OP+Ciug/Day8VW3ibwpZ2VnqOo6nN/bNxbwmGS8kmUGN5iQod8qy7uT zzX5D4H53DLq0aEvhr2Xo9Wv8vmfZeI+WvGUpz609dvv/wA/kfmeyZXdyOc8DpUmxS3OcHg4qVYQ AdnHbjnPFWBFtxHwM8c9ef8ACv67eIPwP2C3KTGK3ia7mI2xqWZscYUZ5r+Uj9rPxxcxftC3vjW0 kPn2Ws2moQnJyrRMJkHr2Ff0oftA63q+i+FLDS/D8nlXWp65bWRBJ5tVDTXPT1iQj05r+V79rHT/ ALD8ZdYmeQn7VhwhwNgicxqB9QM81/MvjHxPCpnGEyynP3qcXN+smlH5pJv5n7v4bZBKGU4nG1I6 VJKK9Enf8WvuP69fDOtWvijQrHxLYkGDUrK31GHBzuS5jWRf0YV0aJ3xyf8AOK/LX/gk98ctT+L3 wO1Hwr4imWXUPCeoW+mxkFi39nNboltwSeVELAkYGe1fq0EXAAUYyTn/ADmv6EynOYYvC08RDaSv /n+J+G4rAzoVJUJqzi7FQxgEbgOT05qwsWFyR3Bz7VLhVhyeOM5NTBDndjk4NdzrHM6bsQrDyHIw OhHcDHekWJWUjPfv375q8sZOM4zz0qQoMYOD9exNJYmxXsiqLZepAOSWOP8AClSHHyYAHYeo/lVi VvKiLAgEdMfWpSv8XOTwfYe1S6z7jlS7FMRKrFm5HH+c09YmDYY9emf59asDkkp+nb/61PXBVk4P TjuKPbMr2VisYgIy3X1bFSQxgNkNkY6nvkUl2wjtZpJDjZEzMSegx361NCoaFHwclRj0PFT7Z7FK HUZ5eSVkPHXr/Wp1jQnIxnGTj1p4U+h6Zz6Y+tSFWVAWAxkepPNTKsPkIVj+bb2x355qTyVQBgv+ e1ZFzr2gaYILfWL+xtZJ9kcMd3cRQvI74AVA7DcWPAxkmt3yGQ/LndnHzdRnvR7ZbMinFN2TGKiq OCRuyScc59efpTli2HDHIbqKe7iCJpT/AAgsQOBgdzUkLx3EXnoysCMhlIII9iD/ACqfb21NeRX3 IEVNuSD6r68cVIANx4+8OOR+HrV0I+Ax2+hHHOfrSsCF2rzwO+MHnrn+VH1u41TWhX2bRsHVv6dq dxvK/Mec8jv/AJ9ateWXxkAkfMeO4H49ak2KRsXB64B9azeI7Itw8ioEYSHcoAJyPTpn0qVVU9cZ 3Yx6/Srapt+VcnB4B6fnTgFjTav4Dp+NDxDtZidPTYqGNvu/xA8N/wDWpyowyvGDxleQCPWriowb IPOOSOMmlWMZx/nGaz9qynC5T8pQSmPTnpnP40ohHQL+Pb8K0Ai9AA3THtUbxg/K44PX8OlP2zIU CuElbA4wB047f5xTxb+Z/X61aEYkUMAR/d5oUZ4yAegP17U/bC5LlUptYkkk55GeT/KkOBhVU8nB /wA/pVsqvVhznnB6/SpREWJAz2xtHTPb+tT7Vg6aPza/bl/4KLfCP9jrRJdAUxeIfG1zBv07w1ay ZEOchZr6Rf8AUxA/w/6x+gAHzD+Oj4r/ABC+Kn7Q3xL1T4peP5Zr/WNYuPtF1Kw8uNFxiOKJTwkc agKijgAeua/Rj/go9pPh7Q/20fHcFhaQx/8AEzSd0iGN0ksEbMx5/iJJJ9a+CdI1S6iu51kGUNxm FSANqbcce2a/mPxC41xWIxVbCctoU5NWvu1pd93+X5/0dwrwbh8JShNTcpVEm3bo1e3W36n6W/8A BNz/AIJA/Hf9t/wb4g+Jvwx1Pw5bz+HdUt9Jl03WpJoWZ7mBplaKSNHDNtUjbjj3yK/Q5v8Ag34/ b1ljT7BF4QuZZAzIkd9dRnandi1rtGeyls9sV+mf/BsrFc3n7M/xTv4ZXil/4TnThEI8HPl6exOR 1AbOM8dOtf06aZq2qJpVuGm/fhomjwoHTG7LAZ6kDnNfxPxLxjmH9p1ozn7qdlotl0/q5/T3C+Go UcviqVFN663ldvXV9O21j+CTW/8AggP/AMFDrKIT/wBleGZgSRtTV3DLjGQQ8A6VsfA7/gn1/wAF bP2Q/GUetfDHQrGezu5BJf6LLqiSaffxocHzA4QKT0V1IYGv67fg98Cf2h/h/wDtT/H/AOMPj4yy +GPF97oTeALaXUGu1jjt4HS7P2ZvltSzsCQo+brXY/FeXW4fDck7OFmjDKscDKuwjhskchQcHgZ9 s8VhW8RM5ynFc+CqLmjZp2a7ea9D0nw7led0J4fH0FKLdt7rumtN9d1sz8qPhxqnxE1vwzFdfFHw veeD9aXCXekXc8VyofH34ZomIeJj91iFbg5FehiIk4GB/n616v8AFhpbjxSk0+8kWUClpRjdhfvA ZPB7E8kdq83WM/wkhSQAevWv9RPDvPsRmORYDH4tr2lWnGUraK7V3Zf8E/zr40yahgM3xmCw1+Sn OUVd3dk2ld6XKIiPAXj5cKCMCnqmOSx2kcN7+lX/ACMAIPQD2/8ArVKID93t329c19i6/mfMOJle RkjAwcZ+bHFTxp8pzyOAD347f561cSF9xZxgjv70+OMxjafp7ClKtdasmUbrUrCMggZ49fX/AOvS rH5WFHt9Ppz/AJ/WrRhJ+YnjP0qXyM5zyMbsj6/561CqonkRmrGH5ZWOcY7EN7VMVyFHI+nP8qur GoAYc9x+VO8tW+YjHPGe496TrIbgUgGf7ucZz75H9KeqYHPJJJH9as+WByO/QGnmP+FR16d6JVUJ 00Vigzxk8dT2/rSeX/n/ACaslQenHb/9dJtX1H+fwpOoJwP/0Px82fNk8nqCTVgBePu+p70qLxxz gf5//VT1QL+A647V/Yaq9j8Vcbjtq7ge/b8aUKFbce+fXrUyRgfMo57c/wBPepgqt8jE4xkken41 Sqi9mQhT1zzgYzSlDjH0AOM1NFHk5A+XHbqKlWJsnGOePU/0q41ezE6asNCnBI4z271II3U579cH +lS4dWAPAHy4I5HvVsRFsMmQeCM+351sqplCn0KYiYLk+64q0sWBtJ2j0/rU6opOSc+2OM1ZjQnP GfUjg1bxDB0rFHaBuIJJ5Jwe9WUXcP8AgOV/DqamEO0/KDwamVfm/ljk1qsQZ+zZFlvuAZOM4Gf6 8VMqCNM9yODzjniphGwBL4xjgjqPp71HGig7F7sBg4z+dNV0xqhclUIQCox6HNSjDA55UZHPU98U 1W2AMe/GMc49KmULnP5kn/P50KuHsugkeMkMc9wOTVkKCcnPXg1CAm7cDyM5/HvU53IM5zzn6VTx Gpm6V2S8j0BPXHXnvUiDCjuMEUwFC2Gy2Tgf5P6VLx97Oc8e5pvF9AdPsTRt/CQMAdB9akTbyVzg HOevWokjIx0wT3qyhxwAf7vPvQsSkSqN3qSRNGy46kH2x27CplHRh67uP51WAAcDHKnJOT/+qrmQ +VK5757474/Sn9Y1uTKjYeiBgVPJ9AcYParEXQBu3zZ68/jTUjWNgWz3J5HFT4G75DweKtYkXsb6 jkODkgYzwRx1NTIOQzZ+nc5/lSYO/bx9SP6ev4VMkezG88cc985705YhGcaBMUQEHHPPAFSxLsY8 Ak4ABPHSkREfrkZ5x/TpUoj55ODkA4A5H/16UMT3ZXsOxOv3zuAHGPpU8K8lSOvOT+lMETFhv47A fTt61aVG5XoAOcDPShYjzJ9l5DkUGPYOOM4PbNTCJCOOMHIGfanKPMHzk5HAJ4yKlEagAE4/zjBp LE9BSoXYgjGN3PPBIHr71YSMkjK5BAHzY4PYgU9EVY/L69x6D8utWFHybMAjPr0q/rNkZuh3Hwht ufw57+p/Gp4Y/mzgY9QPzH40qkbRgZycH0571MEKsWzwOq9v09KzdcapDwmTuyDjp9BTgpYHCnGe cenWjaS2Ex6jH+fWpgCDgk4APHb+dP29hypdh6RtuG4556k449qlRQSRjkHGR/PioojxyQM9x2/G rCc5J3E5xkdv8/Sh1+5nyFhIguOADzuHH+c1IiqSocDABxnuKZ8oCnPfg56fWpgg5UN1zxjP8qn2 /dhyjgu0/LjB9Dxn0qfywx29/fqB2/lTFEfIGSAO9XIiNo3YzjBx0zim6xSpsAiqwY5OOh571MAS 25Rx059aYzgnt246/wD66kiKqpGc47j/AA/+vQqxPI9mTbRsHXgZOetSBSvzd+2T/wDXqNX2OCAM DPyip1dWGCOh7dKXtvMTpNLUlijD7uO+cH/PepYeSBnHPAXr9KZG4b5V4+o9asgKg7ckfX8PT6d6 SxGu5XsfIeigkMRz0P49/wD9dTpDulVcYwMH6jvTBtJ8tMY4Jbof/rVcjO8DjqcNxTda1xukxI4y Of4sk59PrVoRgnt6fl+FNjX+JSflOB157VbOSCnJIGSDjGAPes3ibdTT2WpEsJzxjkjIPr+dWVhU YV/btjv2705stgjrj5hj19KfEgYDdnk9+ox7e1T9Y8x+ydyNYipDDOQOOcDj+tWkjMYJwOfx6+mM 4pio28E5GOAf5GrfGQij0OT1PvSliEJUBPKjOd/Dbug457fnU2ws2SDjvnoD6cVF8pYscgnOCf8A PvViMbGBH1/yKj2/Yv6vtclVIw2McjqQKeArL5gHHIxx0qNHXcR1wcHjjOAev5dqnJ3cLxxnjpn6 1l9Z6Fuh0G7wM7Rn1zyMn1qufAlv4x8Q6BHeat/Z8KauLae18gyC4jmgkZnLBhjyvL+6MbgxwRir SrtYqx9f89q6G3+DsPxE0rTPHttrI0uTwjrr6jqlmsElzPqOnS25heC3WMf6wu4ILEDGec1/Iv07 uI4YLwszycqrp86pwUlHms5VYJK1nu/d20buf0P9FbAKfHeVucbqLk38oS1+W/oj59/4K46h4cs9 c8KaT4Z8mGWw8PpJdRxMzMym8t/L3ZLNnYGxkklAPTNQaVZ6zov7Lus+ONSg1SSwttJ+3afFAY1D +dM0Ze5iZjKsEbMhZgvIJ6V41/wVH8b/AA9v/iNomtSLc2F9J4esre5ju0aKaJItTmiVXiKjGYy2 Aeec5IxXsvib4m6X4c/YP1zU9Nlhkn1nwdqNlBaiVI5ZWkXeXA2bnMUXmSHGPlVs9q/wGyfLMTQ4 U4cw3snJzqpPm03km9fLWzvt95/rfSrJYvHS9prCF97vS+uvf8T8xPBHhyy+NHgrxl4COo22gWet 3aXUWqXa3FzGuyGaIxrDCGPmqZ1PzYGATnGccL8WpvD3wtl1r4I+IDqYS1gtkS3gaOOGa6jijltm mQklOSmVQjoQck175/wTs0pfixo/ifwwYra3utL13Tddsru5uI4Cs7R3MUDlpSqtArS75kxl1AAy xFfO/wAdvij4Pbx7PJ8W73Tna2hQxXNjPCJMqFcQyJAMyJkKTv554Ar+n8sliJ8SYvKYxlOFHlk4 RtzKTjDkmrK70Wt3vrFK1n+Z4lYd5TTx7qRhKpdc0vh5by5k09Frezt5PuecTeAdC+PM83ivx7Ya 9NenWGS+Gmu0c8sssQxOFEEykbYtgVQAMjJqy/7FPwqn0z7Qy+O7OVLeKYo6wyJ57OPlDSQRZVVI 5/iOducVz8X/AAUMsPhzocUHw7lnkure9leB4YmhzDJMZeZG6nnGCOnvXsXwg/4KFftx/tC6b4l8 LfCKLTZJ/D3h6fxTqt5q11bwmDTrGSMStGLgBXPzhdgJOGJA4zX6bXyfj+jT58upKhQg0lz1nBRj e3wuDsvl5LY+KlnXAs5OOMre2qta8tLmcnb+ZNa/O3V2ucHe/wDBPb4c+JvC8uqaT4o8S2kTX8lt E17plq4dElaNJfluFYByjEgqCuPm25Geo+Ln7B2v6n8SfFy+OPFum6RfaCml2riW1DQzwfYYBFKW ilZYX2FGkjY5Tdk98fLY/wCChX7Z3hbTL/4aWGv2el27aneX15/Z1jZSTtc30hlm23RjkfDM5ICM AM4FfMPib4lfEj4x+KbzW/iNr2qX5Z/tOq3t9M7u7IAnzBuC+AFUEeg7V9tkPA3H88W6uYZrThTi pKDilUnaUqb604RV1Fpq8tWmmra/B5vxzwdGgqeCyuUpSa5lKThFtKSvpOT0crrSNtnc+8vg/wDs seIdF+MVk/wa8X+HfFmuwaXqcq6TYLdQzPBHDJDcFHZQjFY2ZyA+Sg6civGYP2bPAuleH5vEl3r+ oXt3DJBHc2tnZi1hktVcLM4kuD5gfbyoMfU55ANeb/DX9pHxF8B/H+neP/h1G2l39lY3EGn/AGqN ZI2tL2F7eUOrY3CVHbJ655HQVtS/theMdcu4bKy07SxZ2dukBs7lDPBOqx7B5kZwDgkuP9qvoMdw zxdRx86tHEKpTcKd5PkhN8sqjcJJQty+8uVxs7uXM9Ezz8v4l4Xr4VUsRh/ZzUpOMVzyV5KK5k5T vfTVPTRWWrR1kXhnw/Y6/a6ZHpz215du/N1JLL5u5gkSOqbUQY+Y8ckds132h+CdYm8OX+n3y2lk rXImW5jWO3W2jgDF2Zl2sS+QoyzEmvmab4q+OvEHiWTxNcXKw3TxlN9tGqBQQq4UY44UdOnbFYus azrWoRGXUrq4mZiAPNkLcn2NdVfhrHVeSFSuot2vvOzTvpe2i/pW0Lp8S4KlzypUG1rbaF01bW19 f631Psa/134f2fi+5tINXh1S6FnHIhh/fSttjBdeNxGzJYgnOc1303hDwtoWv643iu2vNW0bTNO0 7UIb1Y5WEaXEIlkkkI+5Hk7QzHkqRzivhP4M/GH4e/CySXVNY0uRtR8u7jhukgS5RvMXYFaNyMEg kFuSvBAJr3Twza6r8ZPiRoVl4S12/wBQ0bUNFtj4h0+xZ4/NfT43eSCWInGAz7F3cckjqBXz2c8G VMFGuqtSdOlCCvUenNy2bceX4XyppXereq0PeyXjWGMlQVGnCpVnJ2prpzXS5ub4ldpuy0Suj0D4 PfDr4uePtXv/AIgfD7wnf6r4Y1PVJ4tEiWzMyzqrIGWGIguRjHIB6c19EeHb3xJoV7rPw88c+DRp uo+INEePSE1C3FtELuzMkiFlwP3mWmYOSGUg+1fZP7FelXfw/wDhNJ4x23Ns/iHVdW8KaNHbyYNr p0c6veW9rvJeEtGIlM27KRq2NxyDkftd+F4/G3hDXPGMs/nahptzoE97qphKT2/7+SAIyORvl8id UdtzbyMsQwIH5LmfHMa+dPBOKjTTUIyvK6asot2dnaStJ6XaaS10++y3g+pHK3Xcm5u8mvds73ck rq6TWy1sndvSz+W/ixZeC/h78E/C2u3PhC4kRxaadqviNbKdRKIZoppJvMwVlGFIJU8gnqTX6s/s xfGv9n+H4fw6F4P8RadPEL37VbW8bMsjxXsiIuwSBdzByQyrkrg5AGK8e+I3hmKb9kfwFoNhqUms 6bpGsxm8uLkNAq2VzPvit51AdWXO5RsJLDKnaSDXxb+278LvB/7NH7RBn/Z6itbO21iSx1LxF4Pv oTd6fBHfTRxw3UMeA8CSSOVjeJwyHGODX7Z4AeK8sHnU6tGg6lSMa105vlcVOCu01zRlazjZNWvd L4l+P+MPhq8XlEFVrqEHKnryptPllommk1und3vZpv4X+gmkfGqbU7H4TtBGsTahqkk96l5kSPFJ c3FgFQg/K+/DDPBHFe/eH/ihBq/jn4i+G45vMtvDkMMsQOT8zW8iTbDnGwSREcDG7d61+KvwBttZ +ImneH2g1q8uvFWk+M9B8OWfg6+mECyQ/wBqSX0TadcNlJYnIw7udyluSwzX6C+DfEU/ha7+I/iH xbDBZ6vqnh/UryLTI2DSs7XVzM0QZciV4wcELnHPbFf2Jwx46UcZmEcF7S03PWL0ajGg7y7OLqR0 fXSz6H8x554Q1MNhJYlwvFRVmtbylWSUX1UlCW1lY+2/ghqM+t/B3wzrd2rebc6LbTSiQZYEgZzk 5zXqqxsCWYA98t7V86/C3xMND+E3w5069doJNSul0VlBz5kkNvcsynI6b4hg8dufX6YVOcHP06/m P/r1/Q/DmdLFYKhV5rtwg3/29FP9T8OzzLXhsVVp2slKSXyk1+hTHC7sg+hxnmmYc8NkkjH50WxQ aeR6eZ7fxN3p95d29hZNczgsEAZscnBwOK9uNfqeVKnrYcUk655A3bs/qK9y/aT+K3wO+D3xj8F/ CLxHZai+s+NooptKiGpSx6fCYYFRilojBSRjcdw5JPNeLZ/eyAgEISOvU4H6V8rf8FDY/gDqn7V3 hHV/iTqnibUvFL6esfhEWV7a2lppMaRqJEjZF+0szOC7Ddk7sZA4r+R/pV0qdajlyqX09q9N/hj+ HV+R/SX0dKk6csfKLS/h77fFL8ei9T9tP2hf+Cm/w6/ZC+B3hvxp44sp9Sinkt9DYW7bJIytvJNn kjI/c4A9SDXzHdftp+Ff2lfgzbeKfD8EkUXiCSYQRXjGV41hnYKy7shWIHbnBxX4sfti/Fb4OS/D 7Stc+M9jd63p8t1Daw2a3GUikSCV1l2tkFtoZd2M84rzP4FfHv4NfBb4W2PxP1G81PTPB9lNckWk xa68lXneNDFDGCcu7gEKOnNfkvBWPlLFZfOaatUp3b2smr9fvPouKMFGFLFqm7+7PTW+zsfsLsZg SCc53H0Ofy61IkZ3AHB2nnj8cema5qy8d+Db7QtP8Rpqenw2WqWcGoWM09xHEJYJ4xLG2HYHlCDg 9K+SPjN/wUR/Zf8AgZ480f4e+KdZa8u9XKH7VoypeWlijy+VvvJ0k2xAHLEckKCcev8AoRiczpUo 89Waiu7fc/kmjSlUly01zPsld/cjsP2kfBHijWrzTvFlnrun6RpmmRSpKdVnSzhjll4eUSlJGZ3U qgQAYwcdTX82n/BRfwroXgP4y2lhpl+LuW88P2d/Pexyu8E7ThmV4i+G27SOvWv1G/4KI/tyfBHx 38O7T4G/DfU4NUXUNVstTvvGOm3cDafp0cc2xonTPnyPgb28tGwp4yeK/GH9vj4heCfiV8VdPufB Ot2Gs22leGNI0SS+sBL5Es1lbrHIY/NSNmXIzuKjnNfw3xBHE1ONsZipSvCXMlbVWjGmlqm1u3ZO 22x/W2TYmhDhXDYaMVzJJ9nduTej8rXaPuv/AIIgTar/AML/APFdnDezfY5PCLXM9qpHlSypdwrG 7Ag/MgZtuPWv6dVGABxjBHP+Br+OX/gmv+1p4C/ZF+Ieu+NvHWm6nqkN9oB0uCLSxFuEguI5izmZ kAUhMcZOTXunwR/4LE/HP4e614jvfiRFeePLfVZl/wCEfs9SuY7JNN/eO2AYYWZ1ZGVSuQBt4r+i uEuN8BgsFTw+Iqa3d9G+Xtf18vmfhfEvC2OxOLnXo0tNPK+iTt0dut395/U9dKYrV3yDkBcH34z+ FXxG0gGwjHYEdDX80/jL/gs58etdgOg+FfDvhbS7y5wqSOtxeGFQQS7GSREOOwK8187fFP8A4Kxf tf63GmjaV4og0oK266n0Gxt7aVsDG1ZSrsMnk4PFdc/GbKudU6UZzb7Rsrd9WtOxK8Lc0UHOpyxS 7y69tE9e/Y/rtSJ3IRAxbPAAz7kYrB13xD4c8NRibxFqOn6cokUMb+6htuM8/wCtYdq/iB8bftzf tdfEK5SXXviB4pKpC1vHHBfywKI2HzbhEUDEjqTk192fsX/8Ep/HP7evwUl+N+pfFjw/oF5qXiO6 8JeGNE177ZeXur61a263TwOyEiFTEyt5h39RkAV8txN9ITLcnw31vH0/ZwbSu31d/wCWL6K99vQ7 8u8JsZi6vsaNVN+n+bif0K+OP2yv2UfBFq48S/EPwpEUZd0MN/HdSD5hnC2/mE9O1fPXiH/grX+w Z4dVlg8YXGpSAH5NN0q8kz6AM8aL+tfx1+KfDOpeFPEF74d1RY/tFhdy2c5jIdDJCxRtrdxkHB71 9pf8E/P+Cefx2/4KI/F//hWfwbtovsmnyWk/inVppI1TSdNuZTG10Y3ZWl24OETJJwOM5rlzzxxe Cws8dWUKdOKu27vTp1V79Fu3ZK51YLwtVSsqHtJOT0skl+dz9t/Ff/Bcz9mTS9yeFPDvivVmAIVp Y4bRGbty7MQPwr5q8T/8F7dULOvgz4cQRHBCPqups/PYlYox+Wa6D4l/8EX/AITfGD4K+Mfjd+wN 4g8SXOl/C6W+tPGUnxEjjgTV0020kuJrrRhaxeYH3RMptpV3AOh3DOK/nz034ceP9eHmaFoWtXiE ZBtrC4k4P+6hr5Dh/wCkDLOaM6mExChyO0k4qMovompXtprufQY7wio4OahWi532al/8io/il9x+ qfjn/gtn+1h4t0y60fSNN8J6NDdQyW7Pb2s1xMscilTh5ZcZweu3g19n/Ar/AILp+BbfwRp+l/tB eGtWk121QQ3ep+Hlia0uQnCy+TIytG7D7yjIz0x0H4Pa7+y5+0r4Z8HXPxD8ReAPGGn6DZxpLd6z e6TdQWcKSsEQvNIgVQzMAuTySK8AYnBOD7mvoMq8R8bUk61LFKott01+GzOHM/D/AAkYxhOjKm90 9bv/AMCvdH9gumf8Ftf2Kb1Fa5k8V2xJyyPpZk2/ijGu4tP+CxP7At3Gsb+KdTtifvefo94MfUqj dK/je8PJBJLL5oB6YzT7Xwt4i1m7li0i1kl2ueeFUA+pbAFe+/FDGwV5xhbzT/8AkjxY+HWHa92r N/8AgP8A8ifpN+2x8ZPg58ef23rb4r+Adal1Tw7v0AS3rrNAkJtSn2gKkqq6hME5AHqM1/ULpH7d 37GPiC4KaV8TPCThm+Tz7zyDx/12VK/hHsra+tLyW3d4omTMcm+QbcjggFc5x7Vm3dtBaS4WSObA yTGDjPpkgc1yZZx7WoV61bkUnUab3svT7zszfg9YiFFRny8i5dk77ea10P63P+Cs/wAdPhr4v/Y5 udH+GPjPRb+5n8R6WssWgarDJctAHdn3LBIXKZC7sjHrX0P/AMEl4pI/2GvCmZJpV+16kQ07Fz/x 8tkZYnj2r+J+0uvsknmoMnG3B4r9G/2fP+CpH7Un7OHwu/4VH8PZ9DbSoJpZ7I6nYLdTWhmO51jY soKs3zYdWwenHFethOO6cswWLxEXFKDjZa9b36Hl47hSssDTw1K05Rne9uXRpru9vU/tnXLsUyTn pznNcZqXxL+Guh6jcaRrviLQLC8s9oubS+1G2hliLqHG5JJFZcqQeR0+tfxXeNP+Cpv7d3jXet38 QdT0+NwVMOiRQacuD728at/49Xwp4h8UeIPFet3XiXxNe3eoX99M1xeXt5K0008r8s8jsSzMe5Jr 3MZ4m4dfwKTfrZflc8rD8DYmX8ScY+l5f/I/mz/QL1H9pf8AZx0dQdU+IHgy3A+XDaxZn19JCe9e Xa7/AMFA/wBibwvvbWfib4Wymdy2tw90T+ECv+lfwUmQN2zxUe5QPlAH0HWvLqeJ9XXloL5tv/I7 ocBu/v19PKNv/bmf2w6z/wAFg/2ANJzHb+M7u9ZW2lbTSr1gR3IZolrzPVf+C437EtizJZ/8Jbe4 bAMGm7AR6je61/HU0rZ6n0qNZM8Zrgn4lY97Qivk/wDM61wHh+taX/kv/wAif1vXv/Be/wDZath/ oPhjxndHJzmO3i5HuXrmL7/g4B+Ay86f4F8VzHGcSXFrGM/ma/lF3lj8p/GnLIPr1rF+IGYvql8j T/UbCb88vvX+R/Thff8ABwjoNusi6R8Mr1z5jeUZ9VjQbMDbkKh565xXnurf8HCHj2aNxo/w10iF yCEe61OaQfiFjGa/nNJVgevXHNPLYGT6VhPjnM3tVt8o/wCRtHg3Aae63/29L9Gj94Ln/gv1+045 P2Xwh4KjBGBv+1vjn/fFea+Iv+C5n7a+stnSV8JaSAeltpzTHH1mlb+VfjQsh8s5APt60wuQeeT1 rjlxbmUrr6w/w/yOqHCWXral/wCTSf5s/WG0/wCCzv7ekGt2mpXniPSZ4La4SeSxOk20cM6KeYnK jftYcEggjsa/bn4M/wDBan4W/FLw6SfCOpR+Io7bedFhu4sTz/dCwPJt3IzYGeqjr61/HLvO7PPu PSuh8P8AiTXPDGsWmv8Ah+5ltbywuI7q0uYzteGWJgysp7EEZ6V52O4nzlQf1XGOMvNKS9Gmno/K z6npYHhvKIVVLE4VSjazScov1TT3XmmfpN+1b4r8VftEfG/4jfGW30efRZrPWIrbUdFnkW5mgEUK pIfNj+VgpUE47H2r41s726uJlj3HAOV2jg+te7fCz9qqC88Ra9qvxakeTUfFGrS6tquqLEqwzSzo Fk3xxgBAcEnaMc9BXnvj3wrpnhLxUt/4fuI7jRdTzcabcwSb1C/xREj+JP5Y96/KqudYyrj8RTzG naU3zRaWktPeSfrdpb29D9pxOT4FZbhsVltbm5fdnFv3o6tRbXmrJtaXt3P7Xv8Ag14swP2aPiZq Edu8k7eOrGI/vQnyJp4+Ujdk53HHHXrmv6irC3sVt1K7I9uRhic7ScKo3DIbpnqMiv5cv+DZC+j0 /wDZN+JU8cHnGPx3bs54DCM6cmMEnnJyBx1/T+n6x1WG4thN5BVHMahExlV24JUZwG7E5PrX81Z2 1LMsS/7zP0HJoyWCppf1r6/5fM05r27vHnml82eGK4VAhZcDy1G3PGeCeCK+MPi7ZaZatduryWhl kEn2aZiEZ1yFXzB13AEnkHt6V9FaF8QtAv8AX9Z8LaLdWs1/p08Ru9Ohl3yW0dyMwmVRxGSqk5Jy cHHFec+O9P0rWNHuZpRLPJnzJYITvCqgyzMU59RnHTP1rx82pqUU7/1/X/DH0mTVfZTa2/rqv69T 8/8Axta6hBrCi/bcWgjliYtuzC65jwCW2/KR8ufl6dq5oRfKoXGScHpgelfLv7av/BQ39k/9lj4h 3Hw+8deJRceIbPRbO8j0OwtZppsTQCaGJmRCqZVhyxLYOTk15F/wTV/amH7VH7Pp8TavPG+t6brN /banaG4knuIIpriSa185nVSAYmVExkbU4I6D/TrwrzjD/wBgZVho1Fzexhon2ivu+fmfwH4k5XWj nOPxFSDUXVkr2tq23p5afl3P0BMblcZHJ49MGneSwwOlWCOgPP1pxww2kYUenX/Gv0z258G6V0Vm jYcjI9+3FLHCwBXBHcHPGfSrWxm4HTrzz+v9Kl8na3H0znv25odYXsEZ4jzknv0B9KBER9zHHH6+ laiptbLBQD1oEYAIXIO3kfWo+sidDoZ4jJO0AZ6e/FNMbK3/ANbFaCJ8+TjOMc0G3UqTnknn39aF X7g6NkZyxtks2Bg8egqTyzwTyB1+tXRbYXaB7cVIkS7eMEdPTt0705VrjhRKHlseMA56GjyH/ur+ QrTMQyDwT6cZqTHsfyFZe1JcEf/R/IwRkZ7H6VaEXTBPHOP/AK1Io9gSBx6f/rqysYIGBz/n1r+r vb6XPyNU9dBojz0zk8c8VIibT8oJGOPw/nTo0YoAvT16deKsBQp3LiqWIE6OgxVzhl49cdvX/CpV jY4Y+nTHOfQVJ5ZEe4KTgDPGMe1P2qW544xxnt9KuGJRk6LsRtGuAc8n9KsBSV3L24x9aXaAMcZz 1HI5qYgFMg+5ArX6yZxpNginPzHj+6e3rU4Xa3DYABGfX9aQA8cA8Z57+g/CnCNlTbxkDuPxoWJV zR0HYQEKQp54xn1P61MFXBXn1B6E1EOM479v89amQjauQvH5c1SxXcapAAFJLZz/AC69qmRUKCYA 9RzjNMYKCGAGM9B6/jViPBiIXHHJ559M0PEdbidAaVUct164pxQFcqTlex/z7U5QdwY5K+hqfdx8 oIGQpz3z7VX1jXciNJ9iJEL/ACscHHerIjQqEJ5x196ckQQ5B7Y49BTyU4747+lDxN2HsGlqhFRC Ny/N0qZEXkkAbuRj6UqquT0AyQSf6UqZdT9cc9+4FS8Sugey1HKFTGenUHp9KnQADpjGeOf0pAuP b247dacu0kH0OMZpvEAqbHKCcHHU471Om0KCMFt2D7enPWkAHO7nPbof84o2jlu/b+XFCxT2B0Ni YlcZG7HAyf8A9dWUcjbkADufQ+v4VGrANknn+EeuKmQbVDNjBPP5cfyqvrXmP2PQtAB23c46bj/n rUq7ejAD36jgcnjmq6/d/wDZexHfrVhUIBIz6dKPrmjJ9h0LMbIIyFBx9On/AOurEYdkDMecZOO/ t0qku5l2Nk5GDjjHtirUI6YAHVfxoWL0J9iXYmUrtzyevH4VZQ7ccY6DnuelUVLg4OOPb1/+vVpd w/d5Aycfj/8AXpvFXJdEtqynPzEepHvUqLyST93nGe+P6VWQB14zjOCT6/hViIFV45z3OPy96axf Yn2RcQqcIv5n8asCRerDHoBiqSgDIfAbJ6dP/rVbT5SGUdevfFCxRDo3epbVztKvgEflViLCkpnP qe34VXjVsDnOOw6jNTNESw4z7A8/hTji+4PDFhdp+bPfkVNlenUcHpVVIiwEeSeDx6f41IASdwwe e3tS+tq4o4dlwHaRtG08cCposKp25PqPQ/5FV1AbhMfh15zUwwfkB4Y5OOnH86TxXW5XsG9LE4JT hRnPIB65qdCAx3Zz149KqxsqA5wOSpHr7/59ahjl/ePEMsUKn8fXNT9a1FLDmsJAoP49OpA+v+f6 TJLHwrdOcEdqyoA0rSeWrnEv8PIxgf5xWL4p8SWnhXRLjVrh7QPChk8u6uY7VTjAwZJDgeucVhj8 0pYajPEV5csYJtvskrt/cXRwcpzjShrKTSS82dryMMfoPy9qkjcOCYxwAR+R9M18f+Ff20Pglr3i u/8ADN7rWkWI02DfLfzX6C2eTIDRRs6RlypPVcg4OMjmt68/bK/Zb0WN/t/jfRmIZyBatLcE8/8A TKNq8rLeMcDiqEcRQrpwls37v4Ss180dmKyavQqOlVptS7b/AJXPqpDydvT0H8qtIqycnjaeAenI r4Nvf+Cjf7J1hdRQ/wBt6ldoXVZGstNlbapPzMBIY84GeMjNeD+If+Crvw90TxzdaZoug32r+Ho5 nS21QkWV5NGAdrG2YyohJxkbzxn6VwYvxByyhWjQnXu5Ju6TklZpatJpPXRN3erWx0YbhrGVYSqR puy76P5J2b+R+tu/DLnPzMw+oA/z71OA3mhSRwep5Oa/FjxT/wAFaoZbCaPwZ4OmhudhFrcanfLJ GpJHLxRxqWGAeN3WvbP2Mv8AgolF8cvjVpXwj+Mug6Fp2m6rZasLnW31FrKC38jTp54mJcqFbzUU L+8GSQME8V81xd4xZVlWW4zMW3V9hTnPlineXJFy5Vdbu1lfS/U9bJOB8bjMVRw3Koc8lG7asru1 3rey3Z+oW0/xdeOCOvvVtJecg44/AV+EPir/AIKX+JvAOpXHhr4VWNrqumwzkJqWuyz3E0r8B/L+ YERZHygn34zXn9x/wVS/aKu2KRWvh61Ug/PFaM7Dg4xufsayyjxgy7F4OjiqlOdNzim4SXvRv0dn a69RZhwLjaNedGFpqLtzJ6PzV9bfI/oggmHlpI3U4IPp35rWVywI54HbnH4e/tX4LeBP+CqmsXPw 61nwh8S7VtP8RLpFwuheJdKiDxNeBCYBcWrcLkgDepI9Vr9Pv2MfiF4q+KvwB0/xx4v1EajeXF7d QvebETcsZUBcRgDI57Zr6vL+McLi6sKNBtuScvSzWj89dOh5uI4axFKnOrVVlFpb73vt5aH1YHQ4 U5APGTkc49MVICQNp78rt7frXZeHPhr458ZeHdV8R+DdP/tGHRUt31BBPHDLGly5jjZRJgNkg55G BzVrwz8P/FHjfRNev/Dn2PzfD+jvrF1BeT+UGijZUZUkUOu4Fhz075Irzs18TMkwX1361jYx+qqM qqvd04y+FySu0n00/I2wnCOPxHsPY0G/bNqHaTW6TdldHFK2FBXJ+o/OrG/5M5AwM8fp6VR0eW41 PR4NQiiVxKm8fZ38+PqT8kijDj0I4Nfl/wDttft+RfBbxBrPwY+E8+naj4gsbmOGXX7GZLuwgieJ ZCFAGGnDOY2XJCFTk54rTOeP8uwdOjUq1G/apyhZN8yXL1tZfEnq1e+l7M0y7hLGYqpOlShrB2d2 tHr8+j2vbrY/U6ElwoydxUfe6iuX8f8Ai60+HPgrUvHOpW11dW+lWj3lzb2uzzjFGMuV3sq5ABOC ea/nI0r/AIKZftYWQVZdX0ycIAP32nxc49SuK7DWP+Cinx4+I3gzUfBXiWTSBZ6rbvZXMlra+XKY pVKuquSwXI74zX5/n/jdg6eCrywkZKryvk5o3XNbS9ntffyPuMo8IcdWxVKNdx5OZc1pa8t9bXW9 j9mW/ak8I2PjHVvAWprb6Zq0WiQa/olvqV7Gn9qrc27zrDEqhmWRUiO7G4A4GapfBP8AbW+Anxp0 i3Fj4h0iw1hrWGa/0a7ufKktpZQcxpJOsSzbSCCyA479RX84Xi6G28cNYahruoalJPpOk2+iaeRO oaKztgVijDBQTgMcknJzya4S3+CvhnVka4a+u48H5V2xvyPTNfmOR/SExVOftcymmrWcVBqz5pO6 klf4XGO1vdb+0foOZ+Acpr2eBjZ3um5J6WWjTdt03vfVLpr/AF1J8X/hKdQudKbxLoZurSSGG6t1 vomlikuW2wq4DcGQjC5616Lb/tEp+zpda/4pt0ifWNF8Cax4v0eyvUdYLs6ZtLqSpXcqMU3gHKgg 8ZFfxy6f8I9MtYyml61qtrcm5jkjuIWEaqkYyoaNWG51fDK2fl7DPNUvilrXxa0XT7ZNa8ceIdWS S3udPhivLqclLWfaZ4fmkb93KVXevRsDI4r4rxz4gyzxG4crcJVJ8iryg3pJ3jCXO1st+VLdaX8j 3fDngzNOD8yWf1aXtI04Tjo4qznHkvu725n07eZ9c/tx/wDBR6T9rP8AaM1f46aN4fksY9SuxcJb atePduIhDCqQnaVQLFIkjJsAyH5+bJPkfxB/4KN/tOePPhlpPwfOpWGl6BosMtvZwaVYW9vcuk8D W0glugvnSB4nZSGbBDHjnNfBfAIGckdvrVkKuMn6+wrxct8HeGcJh8HhoZfCUcMkqfMuflsuVNOV 9baX3NavH2cVfaWxUoqe6i+VfhbQ3117xFIBaQ312AyqroJ3VSqD5QeQCFHQHOO1ZM8zqhtQxJLF pCP5e9NRxbwPdORuPC57VveGfBnizxfMLXwvpmpanI38On2s1yT/AN+lavv2qNFObtFLrsj5vmqV Woq8m/mcrJFchlVkYbgCmRjKnuPUe9frP/wS1vrXw/8A8Lyv7iDfInwD8UGOc527vOsQE5O3IPOR yM11Xxb/AGff2r/2j/Avw/0bwH8LvFFva+F/AGj+HNSv9StEsY573Tlk82SMy7G2bWXk8nFfRH7I n/BPn49/C34e+KfGXjjx/wDB/wAA6P448IX/AILvX8W69HJeWtpqLwvNPBZwMGMwESheSOea/G+J /EbKsXls8PPFU1UbS5FNSlpLqo3eqV7WPtcu4ZxWFxSqqnLlSerXKtul9N33Pwq8R6i8uuz3NsT5 rXHnM+f4856j0wDXW6FFDdWqa54gQfYI5mZY3zv1K8Y5O89TGpOXPT+Hqa7f4yfCL4d/C74o6v4P 8N+NdP8AGekaReC2bXdKiMEGoMVVgLbe7MQSSGcjC44ySK6Dwp8Lfi18W7mFfAvhHxJrQTCWsGja VdXEUSLnaiMkZUAfXk5JyTmvu8TmtH6tCpSdlJXu042TX95Jp+q09Tycvy+pUrS5le3Ra3+6+n5n zB8Sb+41PxRJc3rb38qNc9FUAfKqgcKqjgAcAcVV8JRiOKa6YE7pVjUJ1J9vzzX0H8Vf2Tf2l/Cf iy5tPFXgjxFYXCrGWtrq1ZZkVkBXcgyRkHP0rpPhJ+yp8dfENvpVxb6Ja2ltqusjS7W/1a6WKOK6 fcqrPFH5k0YJUqC0YyenrW9fO8HTy+DdeNrL7S7X7+XqZUMtrvMJt05LV9H6djgtPsZreeICPO5W aRjwFUYx3zknHWrusxgMkfpgn+lfcXh79gz4s6r4+1j4YeMfE2kaFqOlWMd9/olhPfpcpLnaI3zH jn+8B69q5HRf2I7nW57q11jx61pe2muz6DJBDpLTp5sD7NwfzkGDgnGOBX5fPjDKY1VKrjI6JPRS lo9npF6eh+hxy3FSg6dLDyevXlW2+7PzU12COyvLm1mK/LMWVOc7s9j0wR19xXS/DT4m+NfhP4hH ijwLeS2c5URSqh/dyxEgmOQd14H0x1r3nxl+y7dWXxe1L4c6v4jtLS6toLe5jubm3kdJVuWCIWEZ JQklWxzgN7GuC8RfADxx4Kt5zqUmliCJxPBfSziNLiJSy5jVssQSOFK9+tfpkM+ynGYaOFrVYzVS K0ktJKSW11Z37as/PoZVmWGxMsTh4Si4SdnF6xav2d1Y/aj9nP8Ab10/xn8KvCHwy0Izxa7puq6r faxZFFcyC/uhKvkhg3nR4YggjIOcjHX3/wAWfEBPiP8ABLxD4R8YT3NrqXim407TdNmmQENJpjWT yKmzCAgM8gXIJDNiv5pPClpqmk+IrbVdF1QWWoW8ontZ7N2WWCRORIrDbjb9a/WrSv2/tA0P4Ox/ DPxlocninWrLXLHXLHxHE6WCI9pAsDI0WJS3mRgq5DLnriv5L8UfBaWFxlHEZBS9pzT5nG6UoPmc rpySi4KTWjfNZWV9z+nvDfxbhiMLUo53Jw5Vbm1cZaJNNLVSavqla+umz/RfwreXfgj9k3WdN8TX 8F9DF4nsflIkMNlvnCAYcAbJI4y+RwoOCc1wn/BVbUxZfGXwd488PhYtNji8NWdvfWvlmONLa5Lm ESRuSyn92+yQcbQVyMkfj9r37e3jm48TnXxLqOoKkM9rDol/cK2kW8E+0GJYI4034CL87Etx15ry HxP+1v8AEXXdJudFsLTT7Kzub5L+2gMX2lbGSMghbMzl2iTcAdmSue1etwj4HZzhc6jm1TlXNzOW tvjUYtLs1y3vZqSbVlu/F4n8YMrxOUvLIXvF6WV/hd0233bta6asnfovrv4b/Gv7V8NNDPhfU4dP 8a+FfiLJ4g0NndlmubNLVPNWQrkbY7iFfLyQdrsAK/XvxD43uvBWk69pXxDhgkuR4Snun0yeJjA+ sPcWohezmYMS2HkKtG2QNyvzxX8lQ1XWPtT3sM0scu5nd4SUIL53HK4xmv1W0H9j340/ET9iJ/2v h4/0GVLe3vbm08D3l7eTazcaZp11HY3VyobMShJ5VG0n5uSDkV+uZ1wRgMBjcPi6048kpSilJbzq c1lddFJuSvs9bo/Lcv47xdfC1cPFNTSi+ZP7MXHp3aXK/LSzP2J+K37dHw1+A3wZ0zWvs+m6xrOm ySCz0q6mKjzXYgvHKFLI6HKjOCyZIODXzzr/APwV1bXv2cLbxj4F/wCEY0n4gv4gezutA1H7VNax aXGhdbhX2nc0hKpt3ZGCcDiv5unstf8AEmsx6dFC013JMlrFBGMu0sjBFRR3ZmIA96/SHwR/wR5/ 4KiePLeFfD/wd8XRRuCyf2hHDYABTglvtEiY5r9sy/jatkuHVKtjIU3KMY6tR0hGME1eV7qMVd7X 1tqfkuZcNYfM63tlQlJKUn1fxScmnZLTmbt16XP0V+N3/BYP4fx/A59K+D9zf2/j24trd/tkumq+ nW9w7h7oJ5z7mH3lQmPHOTXzR8W/+C03jvxz8IH8FeEPDUWg+I7pYI7rX4rkXECrGwMnlWskZwZA MZZztycDpjRk/wCCAP8AwUYh0ZtX8ReEdJ0h3UK7aprVqBARxgLEZCxPdjx2A71oeEP+Dfj9qrxB qA0/xF4n8GaUyAPLtmnum2k44CRrmvOxn0j8BSjJYjNYR0tZWfzVk3fzX+RFHwmcpJ08K5Wd9X+e qX37Hllj/wAFtv2mtO8O2mlDRvC1zfQwql1q15BM8t3IvWR40kSJS3cKoFfn2Pjv8cvHPxF1X4m2 iXGq+IL/AFO41l75beW8ks57ksX+zg7xEuDgDHAAHav2n8Vf8EjP2cf2UPDZ1/8AaN8d/wDCQave yJHovh/SInhuJGBIJjgjMs82SMDCKo7mvnS4/Z78ZahK2l/An4f3ViZnEkFr4g1WeynvliBIxArq pIGcK5B9hXyeP8dMHnFPSo6kI7SnaEH3s5OLfnp6no4Hgd5XNqnHkb3UW21bbulvoflt8QPj98bf iLZppnj7W9Qu7aGYSR20oEcaSKpXIUADOCRXnN1418W3mlroN3ql/LZKwK2Uk7tADnIPllto556d a+8fiXJrPhuGbwp8R/hOdDmRvKuJ7O3d8kHk+YBIc8dQ1d58C/GP7AHh+3Fv8StBNze3DRQqbuCW YWzbyGaQCRFCgYycZ9q7pcVKjhlVpYKU0tlT5ZfPR2HLAKUvfrW9U0z8yJ9f8Qagsdvd319cJGix xRyzyyKiKMBVUsQABwAPpXRaH8O/H3iNgnh7QtYv2bH/AB6WU8+c/wC4hr96/gv+2B+xF8NPGF9H pHgbTtQOjE/ZhYaNBcDV5EmKhLVnWUg4IYPJgEDpnAP7ofCP/grymmeFvDt78HP2d/iPqup6pKYf ENhaaZPbwaZbxShUkguIbMrdPNGS4XEaoRtJOcj824q8Y86wtRQw+Syaf2p1IxW19mu3nvpvofVZ Bwhga9Nznimn2jBv8f8AgH8Rniz9mL9pDwF4MHxJ8ceBvFmj6B5sVuus6npdza2fmTAmNBLKiruY KcD2rwwkyTfNzxgHNf3Xft4/tT/tP/tX/Cpfhff/ALLHjrUdMT4k6dc+FrbxIslta61ptvDP8moq u2aCaQtv2xsVVAcvkZrxP4VfsOfta3Xwps7X4cfsZfBzwx4wOqSzS+IPFLjUbBNL2jYgs9QuJmM4 kDZkZyu3ooNedlvjzKGFU8xw9ONST0Ua1OyXd3k5etovta90d+L4DpyqL2FSfKlu4Sevk7RX4nzH 8Ev2OP2dfFH/AAT00rwFqvwba++Ieu/BbX/i5H4ntZLg6+0um6oLS0FtAWAMMlsDMyYIZOQDxn+e zwt+yp+038QblB8Ofh/441pdwEUmlaHfXAJPTBihYZr/AE5PAem/8FHbrwXbacngj4EeC76PSY9F /tlr661Wa2VIliCwwWtvEEiR8MkG/YoAB4Ga+cPBn/BJP/golNaeJ9G+I37XviGaLxlYtp+rRafp M8piiaRZWOns93Glo527A0SqdhK96/POBfFLG4VYuTcZOtPnSnOcuXmb0jo1ZdNV2sz1c+y7C1fY xnooK11ZXSS1dr+u3U/nA/4Jz/8ABtx8VP2ovhddfE79qfWvFPwhuDrJ0nS9E1PSFF9fQhUbzwLm SNkVyWRFK5LLkZHFez/tv/8ABub+zT8JPg9c+J/2e/jRoFvq3hnXYrDxxefEnWbS107TYJ4WeNGW wilkjumYApCylpAflGRz/Q98Pv8Agg78O/D+g6N4W+IXxl+MPiay8NXj6toliL6PT4bK8lcSPPAc zusu9QwYsWX+DHNe7+EP+COP/BOTw412lz4Lk8V3VzqH27V/+Er1y+v/ADr6QlzPcwrKkUk53Fg7 oW+Y8808Xx7nMcZ9ZnjHFXuoxS5bbWtdt2Xe7vdnBCGE9n7OEVJW7a+t3yu/o1+h/BNZ/wDBKL9m rRPhmfiz4+/ak+H0+ni/Om/2b4N0TU9U1Wa5VN4SC0uhZSMNvPmuqQgdXzwf3y/Y88V/8EjP2avg B8IfCXh/4jeMdZ1fwL4nvviDeWmneF7ye+1TWNUg+xyR6jbQxXEUCxwKqrFFcE4AJY5r+pfwp+wv +xB4CC6h4T+E/wAOLERoR9q/sO0kmRQARmWdGbgnucV9D6P4W8KeHI0tfDOm6Vp8TbWh/suyt7ZQ Aqnjy15HzZrz+K8+x+a0lRxtWU43dknCK1TWygr6Nq7fXoLA1qGHlzUadnbs/wBXI/gd0v8AZS/Y 4+JHxo8b+I/hx+xv8b/GWhXB1HUfCN9eXOqW9vfajLKJLeKWz8m3jsrCTc3/AC1lljUAYJOB+hv7 C3w7/wCCjHwC8L61J+z/APsd/CvwTdaxcLDNqcmqT6MwtrRnAgu1lvLi5n8tySreZGvU7TkEf1zN DdXhe3nllKJsAdZWR2+ZTgqoAwPXNfNuvfE/wP4S8Oav8To5rU2ml3DQ3we4Dxi5WfyZRlS+xmJy UAz7DmvieJOJcVVpRoYpc8JNaTnUlt2XNbS12rWf3Ht4B88nOkmn5cq1e17RT1/DqfjFrXgb/gub 4n0e6lgf9nb4cacUuJZ7a3hl1Q7nQmZ28xJVd25Zstlj1zXiPgr/AIJW/wDBRePUbf4ieKf2v9Ys JLtFu1h8MaQ62CiQY2RWomFuEUNgL5WAOccV+63i34vWcGs2PgbTLSRx4l8N3Wrme3tp3htQtuXT dMsXlIXzgeYyk46VieHrrxDL8VTon9ma5/ZVv4MspRqjJKNNe5cwkwxZYRtNtySwGe2eor86nxFX oRccLCnFNXf7uD62WsotvTX/AIY9v2Upv97fXX4pbel7H8sn/BS//gllq3wO/ZQ8U+P/AIi/tDfG XxldXN/Z/bdO1CRptLv5ppl5uLcyfOQOYzuwpA4Hb+MPxd4b8NaTdTWmltfOY5CokudqZAOOUAOD +Jr/AEU/+CoXiu6+Gf8AwTh8b+NfjJ4YuNEf/hLlXT9NvHWV5/Mm22sxZJZcFyN2CQF9B0r/ADvP 7YvvEXiQ366XLqCvcNKLSPdiV2JIU7Rnbk8gckV/Y/0d8yx1fL8VVxVS8YzaVlGKdkuyX522Pzrj fD0Y1acIpXa8++57D+xt8H7H4n/tDeD/AAN4jEfla/rEVlFbzZ8tkIJMkoGDs4+UdT16Dn5v8TXA tdRurAsHxdzIPZVcr3r6X8M6T+0T4S+IumfFv4SaJ4jt9V0wG7t7y608hLe52shaJACpRAcLnp6V 8ozeG/FMzi5ks7xzM7Hf5bZd93zY45O7Oa/a8oxXt8dWxEsRGUHCCUVJPlknUcr9rpx9bM+Vx8fZ YaFGNJp80nzNNXTUf1v6XM+SVIYxDH1HBqkzlvlAP9a2NP8ADOva1dLYadazSSN8u0KcD3JPpXrs P7N/xXXR/wDhJJLNI7QZ2zlxtJUEkAg/eGOnWvosZm+DwzSrV4xb2u1qeRh8JXrXdOm3byPClf5j z0+Uj0xTiwIxnHbFe3+EPhhFc3j3XiRXeOP98yxZJfb1B78jvX6o/CP4R/sfx+B/D3xD1Dwzeagm u3smn2M91Li0S9tUXz4Jdwy3zEEE4wD7Zr4ri3xLwuUxU3QnVu7e4k9bN296S6Jv5M9vJuGK2Lbj zxh6322vomfiAI2JznPrQ0b9cED16/0r+939iz9k/wDYy8b/ABw8Y/ASb4R+EmvPBFpbXWr3Wp7r kB7zY0IjJJVo2DEqSAcZHPWvNf8AgpT4d/Zi/YP8Z+G/D+n/AAZ8E6lJ430/UZ7SSO1VYLNoCkbs Y2VsofMBBGCMcGvw7KvpXPH436hgsjqubSa5pQjo48yd9V8Ou/46H6PiPBuFCi69fMIpLR2i3re1 t099Nj+GjYy4J3HPTIqZdOv5Lc3aQzmMHBkVSUH44xX9GnjL4Pn4a6r4H+NPjPwd4dHhjx9c3GnQ KdNX7PZmFDMPLjGDIyopbJxkVq/taeN/Anwb+Cdz4W+Fx0mTVNU1yDTtQsF0uKJYLYxmRZd7ZCmQ hcrn68AV+mYTxnliKmGpUMDd1dvf0VnaV2ovZ6eZ8hU4IhTVWU8RpH+7v2tr1P5rDFcsMKj56cKc /jW7omgnVb6GyYtA0hwZZEYov1xX3j408IpoXg99Q0K5jvJ30+TVXuY4EVPLM2zORnI29Mcc1y8a xRfCK3ScWzzfbXnluE2lwMBfLGBnHOTk9eg7195S4wdanzQp2vLl319bNHhrIFGfLKXS+34bnzLc fDtLZiJtQtwoOASuPxxnvU9t8Nbae3+1nU4mTBDFELAH0rq/GVve6jbqulRlmUqf3YHG0V0HhUak vhR7XU4289pXb5gATnHOBxXqzxVf2al7XX5f5ChgaDq8ns9Lb6nmtt8PdAuLkWSawjSscLGsZzu9 MVr3Hwy8I6bn+1dZaI8KN0eOeuORVrwh4f1yw8cQ63eW7JAJnkYkrkBgccZ966H4k6HrnivU1XSo CVA37mYDHyhf6USrVPaqHt3a2+n+QU8ND2Mp+xV09Fr/AJkNp8I/A89kL6K/v5Yn2lJEQBWBOCen TPStDQvhl8KNd1M6PYXWo3NwgZmji2khE+9k9Bya9a8O2OoQ+ArXQSiG4jthGYy4Ublfd16Vz3wf +Hfifwh4zl8Q6yIBFJbzRjy5AzbnYEcY9q8WWKqctRyxDTW2u568cHT5qPLQTvvpsYerfDv4G+E5 vK8Rf2vEQ4QCRh3UN0Hsc16ppfwP+D76Gnib+ydWmsnjSeORpduY3I2sM9c574rG+KXwo8W/EbU1 uNMa0hUN5gaaQ5PyKmMAe2a+kLHRNXg+G9v4QjaI3UNjBaMdx8stFtJPTPb0rycbiJunTccTLme6 5noerh8PD29ROhHlS0dlueSeDvh7+z94t8QSaL4Y0G7u5dPDS6lDKxGEU7eH3Dnd25zX0Hdf8E3/ ANoX46aNbeKf2bPhzeSeGdhjjvrVywN2G2SZ3E/MrYXGPrXCfBT4VeIfh94p1fxLqlzay/2nbPH5 cG7KEuZCct9a/pK/4Jk/ts/FPwR4u+E/7IOhPop8N+LNf1NtSkuYDNqIDyyk+SWG0g+WOW55PFfC 8T51jcFP22AqOpyr7TlJWUW27c0dbr7j6nJcDhq1GSxtFRV/sqMXa9lrZ/ceif8ABvf4B+If7PXw X+JPw4+L0BstUsPHdpbalbwypKYR9hU7Hz92QZ5Ttmv6C5PGbQKTo13FEpdwqzHDDJwTnHHPyhen avx1/Yc1C00rx1+0Tax3SwzN8cNYXy2iEa+WPkXaOg7jaBxgc1+ikviWzn2wR5eWOAJNIVAjeMHP KnscdTn1r8IzrNqlbGV6k1Zyd3bTXrbV2X9XP07LsopUaCow1UXJa6vRvc8mg+Lfwj+B3xX8WfE/ VtdEWpeNjptnqsNxPC1uTp0TxW5jVgqwKqSODu+8x78Vgv8AtwfCnxlc3Gn+ENdsrqGOf7EFtSHW UsBI4Zov3ZIzsZicA5FfAf8AwUIe6fwNql1YPZTxS2zzPbT24cG1UHEiqBgsM/dx75r8E/A37V2m fCc3Nqos7eOwuY52VX/ciaaJWXagHzMMZk28DpnPFe/lmT4jH4eVSnJya0/T/I48zxtDB1o+0SSZ 4l/wW217RtT/AG+/EXiKdbYzS6Voe5bJXBhI0y3xC4b5QyHIJHfrXyH+xl+2P4h/Za+M2k+LdA1j WLTRJL+FfE2l2+Hhv7IHEivCx8t5FUkxluVPQis39vb47aN+0h+0fq3xLht/sP2yw0y2dEfery2l pHC83qPMZS2DyM18IsQCcY4PX1r+u+DKNXDYHCXbjOEY/JpL/hj+dOPqlHG4nEwspU5t/wDD+T6p 9Hqf6Ln7Nv7U/wAI/wBqnQtV8T/CG9a7stL1FbCRpUeKY+ZCkqs0ciIyZLMmOeUODitH4r/tSfA/ 4K6zpvhXxrrFuNX1a5lsrDSrV1nnaaKNpSJgDiBTjbvkKqCRmv4Tv2bP23v2hv2XbPWdG+EWvzad b69ZPZXkTqJo1LrsWeNXyEnjBOyUciuLX4heJde8XX8fxU8R6rbrfzSXV/eWpF3LLPK++Ut8yiVp CfmO/A9DjFfvGG46UqMeeHv9ei/M/Bq3CdSE53n7vR7u3mkuj003Xa+n9gX7OH/BYb9mr41atJoX jtJfAd28twbEa7MrW0ltbIXMs13tSGN3OVjjBYtjjqK/Vfwd4t8I/EDQbfxT4L1Gz1XTbuMSW19Y SrJA6nkYZSex/AV/n8eGNf0m41W0t10u31C/sWuIYLnWNT+12RVImltnMEaGTzd+WyMoSQrKBuNf vd+xx+2/8FvgLoGla14O8M+OL8eN7eO81iwguoDoWlzW7Ot1OhMahJyUysAIGzaoPSnh+NKVNS+u 1YxS6t20+f6foedjcjqUp/ubyT1ta/4r8LrXvff+kP7MOAOf9r6UJaYGAD0zj3r5bg/b0/YunsUv 3+JXhOAOGHkz3W2ZGQDejR7S25SccDBOcE4Jry7xr/wVO/YS8Bqo1DxvHeGRC8a6RY3V1uHswRU/ 8er6CpnuGilzV4q+3vLX8dTz6WElU/hwb9E3+B95rDhj3HqR/wDXqMwqT83UDGPb8PSvhX9nD/gp D+zl+1F8Rpvhv8P5dTtLhoBNpFxrMS2q6mUz5qQJuYhkAyAxy4yVHFff7W7nnBJz0xXRg81pV4+0 ozUltprsRWwk4TcKicWujVnrqtzK2/JlAce/Bz+PaneUTyDzmtDyFDlJFwM9+CD6Vxet/ETwPoDa nDqupWkc2jWovtRs94+0pC0bSqywn5n3IpK7c5Ix9N/rDbsSqB0Sws0nI6en+f04qbyW/wBr/vj/ AOvX8fnxj/4Ks/G7x58bteuPh/c63aeF/wC3Irm18K27G3e4itFCIlxcJmZFfbvlWMDJwuOpo/4e cfHH/oS7n/wdar/8RXiS4twik48z0dtjurcP42MrRp3+f+Z//9L8mgDt25wBzzxyP8+lSRltnAPX HX0qMZzt5479cVLGSOcAnOT2zX9LLE3R+cewtqTp8mWCnpkA1cwR8/6fWo0w33V/P0q2tuVAwB+P r6/Ws/riNlhG0IE/dlgevPv+ApdikFWA+6Dk06TA+Vsjjr70AAkEDPr+HTpVrFWM/qwmP3mR0B4x wauKdp6/1qvhuvGMZ44xj+dTD5tyrjjr/n/69OWJuSsLYmZyXOTxjIx709CcgSYJzwf5VXCHJz1I yAaXEisEAwOx74oWJKlRJSQUwe+SeOfpUjHcfm47YHpUIZxnrwc9/WpVyHHfuf8AP+frVfWDH6uP WNF57dNtTJtALZ4wORUR3kFl6jrz3+lPU7UHBBI/Hp1q/rAnRRP0UFQM8Z/D3/8ArVPnK7scn8Ki U7s9u5H/ANapFySAc4yME03W6Ni9kWAzEfMD6ZDflUu3cQDz6/4mmkOrYUk46N15+lOOcZOMnoPU 0o1yXSJow7D+Y4xUuwdc5OelQxZztPHOM1Zyp47Y6D/H86ar2B0yTarEHjv+XqMVIImxxjuM+/0p Y+F6DJ4Bx2qzGQMBgDjnHv8AhVe3F7PyItpA3DOeuehHfinxxZ+Y5HdQKkwdo5B7U5dpGSMH+79f 8/57uOJ03Bw8iRIFMgXGQOpH86mAKMA3PJGcjP0pY+TlvTGR3/8A11ZRlz8/A/hIGaXt1cPZeQka DaFU4wPm75qwqnGRznpjqBQGVT83XPTueOtWUyDycexxx+vem6/UHQXYPJ5APccinxw4HPbp/wDW /wA/jU6AnknnHpxz9KmVcJgYOT2OBU/WSXhvIjEO4gv26dM8VbWL5tpB4OT3PINSQpz79j0FS7SW wpyePx/H0oWJ7lRoabECxsO2eeamWLLZAOM4OfWpsYyOM8cetPRVY5JJwc++T3/zxTWKF7Bb2FWM gcYxnPqTirkEGduSQWBYjPYUg25IzjPT1/pUysNwOTkDIHXj3p/WrIU8Kt2OjjRPQhe4/XmplQmU Etk9Ae+T1piv13AEfTP1q5vHBPTkZPAz7U/rJi6FmaOi6XPq+o22kW4LSXdwlrHz/FKwQfz9a6Hx 34Puvh7431fwJqJYy6PqNxpshcbGZrdymSOxOK5nStUn0u/jv7M4ntbiOaIkZAeIh1yOeMj9K3/F HjjV/iV4n1D4ha+yyXut3kup3jKoQebOxdiF4CjJ4A6VzOrU9unf3bPTzurP8zp5KfsnG3vX38rP QwEiVyGTIGOnb8qekaKST0wCe3ODUke5k+UAZHbv16Y7V53+0T8StN/Z28E2PibUrS51K+1Sxivt K0O05ubwSyPHlMKwRRsYlmGBjHXFZY/OKGFg6uIqKMV1eiJoYCpVfLTi5PsjU8deOfB3wy8MXHi/ xxqFvpunWy5lnuX27mxkJGp5d26Kq8n+X4BftE/8FAPin8RvFLxfCrUNQ8L6FA7LAtnJ5V3dc/6y 4deRkD5UU4HfJqn8c7j9rn9qrxiNX1fwzr5sIZGGkaJZ20pt7SNjxtGPnkPG6QjJPoMCue0f/gnN +234g2tpHw08WzBscpYSkc98hTX4Jxh42ZXFumsfTpQXV1Ixb+96L+mfpfD/AIZY+f72phJTfZQb S9dNX+C89z0z4B/HXQdb+B/xIsvjTr+o6h4luZdFPhWfU7q7kEKCWX7cVdJFVC0ewfN14/H87r7V NQvp2ku7ieXLnmWRn4z/ALRr9ENM/wCCT/7ft1ak/wDCB6naQSsPM+2stsvynjd5pXofWur8E/8A BJv9or4k+IpvB3haXRotT0y1jk1m2u76PMLuxXKBM5XIxxyD1r+fafi5wrg8XjcXWz+FRVWpNOqp xppRjDRJvli7X85N9Wfqc/D7OKtLDYenlcoOCcV7nK5Xbl1tdq/3LyPy2DsWKsM+lSBGc4UcnG0D qT6V+/8A4Y/4IA/tHXXg3UPFl94r8OraWTMmpw2BmnliSJd8hIMPO1QScHpXoHw4/wCCBtrrfjLS /D/i34jwQ218sdzcXlhZNMttBIjSqX3ywnLRhWHA4J4ypFeVifpPcD01KSzJSt/LGctvSJuvCnPd ObD2v3lFfqfzmyx3EDGCdHikH3kdSGH1BrU0rQLvXrg2NhJbJN5Ukw+0zx26YiUsRukIXcQPlXOS eBX9qn7Pn/BuF+x/8Q/A0Hj/AMT+MfFF8GlmjvFhiSHyzET18xrg7SuGXPJBBr7a8M/8G5P/AATm 0a6W1v8ATPEupyGPzlW6njAdAQC2Ugj28n198Yr4vHfS/wCGIprDwqzflTsvulKP6HoU/CjHf8vK kF83+kbH+d290m4qzLkH1B5+ua3vDkFjq+sW+n3d9b6fHNII3vbkOYoQR99/LDMQO+ATX+gdcf8A BD7/AIJ4aN43ubK18IS3Vlao+9rm7uEWJ4VLOp8uRdw46kV9M/D7/glH/wAE87WO2GmfDXw8ztKs MH25nn8/MSTbl3k5+WQdu1fMZh9NLJkpU6GWV3LVbQVn/wCBP8jqo+FFWLTqYqCXlzP9Ef5r4sZY Xe0g8y5WN2UTW8UjI+D95SQDg9s1p22kanIP3NjfSHH8Fu/fv0r/AFZPAX/BO39itLGW10H4c+CA 9ncfZZwNNtyVY5JzlScjFe0f8Mnfs0eArCa+0/wj4Vt4bUFmEGmQFwF6AKqkn6CuGp9LevKDnQyW TX96rFflF/8AAE/DvDKfJLGXflD/AO2P8hzxB4f1yx2X+o2F5bRv8gluIWjUsOcAnA6V1/w3+Pfx m+EEFzafDHxLqujQ3Q/0iKymxE5ByD5bblDf7QG73r/Uc/a++E/7Na6L4Ms/FkXhLS7TVruUp/aF tbRKYfJSRhtkxhuQD6Z6en5Qan+wz+xN8YNOu5n8KeAZLg3VxF5tjb26FbeKEyl8x/MXI6c4J71w Yf6dKwFXlx2TVI8tvep1FLe214x117npw8FaOOo81LGJp30nDt83+R/KD8N/2tv2o7n4Wy6R4n8e a69prrFtQtprlUjuLcH90k6gASIuNwVsgE5HJzXR2fx5/aneC78JaT4/8Q3Fl4iRNFWzgvGt7ae0 ZlVLcrGRujLKMhiRx6V/cJ8PP+CWn7Emg+GtO06P4a+Fbic6dBcBp4I2ZlIUbju3Nk5znbj+dfkF +398EPBXwP8Ai1qVn8MtA0+xXStKh1LTmtUEVnprwvFIGdIxym7AI2k85r5/IfpCUeIczxilgqkX VSk+dx11Sinq3omvkreR9RX4NoYHDYenTnF+z0Vlto7tbbv87n4Y61+xx+3HrHgS68YG51tLDT7d 5/s5lu7hpTGDiJUP7sAgepyO1fkzqnw78Y6VqFzbXlpcpOZG/dupWQPu5BUnJOc/jX9sOt/EvVdd +DXilbzxFd2CRac6yGzgijgjMKlQAXLMwDfxFfrX8n2vyaFc/E6+1u8uLy7uI7qaQeZtdN3mHEnQ ZznOPWv6J8M+L8ViKNdV6KiopWSTv6N6HwOf5ZSdWHJN3b8j560H4X+PdVhC2tjdB9x3B4nJIxwe B0zXpekfs+fGG30qS4j0q7RA4MbtbzKGcnkf6vBPNfR2gapfQ3sc8WqPEFwIhtUjryMbhjqeK+6P AfxS1+70S006TxJF5VuDtWWFDy3I6EnOeMn8zXt5txbVg3H2MWvWX/yLPbyjh6lJxbqyTXX3f80f lLcfBr4tRWlst3pkjpMwWQjjayucdQuOP1pi+CfjFbOY4NLDoMK3KhwCcdCR3r9vdL+J3iUaX9lT WrHyBcxOsc1rId8gbcxYhcAZAJHQ9qs6v8SfEep6lF9pvNE1BPsnllhbeVuLP94x7cE54ByDjriv HwGbxxWKp4aeESUm18T8u8Evx+8+ixWCqYajOvTxTukui/8Akv0Pwll8KfELRblLy+0qUyyHlRIp HBwfkB4+ua81+J9l4k13VLS2urQWSQq0SvctsRnJBYAnqR6DPFf1Waxq2tal4RgMfhzwdN5kKOJM 2zOCAuAFaPcOByD39+a/O/44/sBfE/8AaY8US+Kv7V8J+FNM0i2tmFtcSrGZmvJChNvHbRtuKlcs pG4D3NLK+MssoYv2+JiqXJdJuXN5fDFX/wAjLO+HcwrYJ4fDzdTn5W1blXf4mz8r/gR+xz4n+POs 6loXhbVdMa70rRrnxBfw/aIIRFZWgBlkaS5lhT5cjgEsewNcN4Zf9n/w6WTxbp+ra1PHMyMVu/s9 u4U9lRVbHB/5a1/Sp+x//wAEIPAF3ouv+MvHHinxlqBg0RltF8OWsuiwXc9y6QrbR3t6kcU+9m+Z AV+QbiRX3ppn/BFv9hL4Qwf2t4o0bwjpghmU48feMopJ3QSyMSbfThdEsY/KG3cPm3jHQ1x4zxlw U6taEJ1asVa3JH2dt76txevp954tPw6q0o0uf2dOet+aXM3tbRJr7m9z+Rtvjh8PIUgt/gr8M9Dt bqJgFnlhbU55fm43eeszA9iFcCvrD4X/AB+/4KjaPph8K/B7QvE2mLqbhIl0/wAP7TzgBYHnifZ1 HKY6+9f1heA/2fP2PfAtyLLwFJbXKj7GjWnw08A3975726ygn+0b8tB8xmYlmC/dT0OfsXTPgjp3 ijSRdeEfhj4+1hrYxyW934z8UWmiJ5iR20W4w6QLp8EWcJ2lByG6Fjn8+4g46yyvD2VXAQqre1WX tW2vJn0WE4ZxFFqbxE49Pcj7NL57fj8j+GFv2bf+CuH7UE9reXGj/EnX7fUpktrO/wBRvJotOuJp slIoZZpEt2ZwCQsecjoCKLX/AIJQ/tQ2fj+7+GPxQn/sjW9OR3vNG0+KbWblCtvLcKgFpuQtJ5Xl L82DK6KTycf6AWk/s+6nrfw38B6IthovgwfD7x5pviuXw7pbz3tmsFgkoS0t5Zgkm5xIpLuoAIIC 4wK/Kf4r/bW/4KEeKfDWm+K7rww+t3cVjPPZai1iJNkIliSQI6F8v8qqT1YY568WL8WsRhKUI4Oh TpQf8kNVv0en4HDHhPDzq1FVlKUlr70vS+3+bPy2/wCCfv8AwTEsfgX+1Td6gPEcPiFINJv4nttZ 8OFEWaG4ijEiC6yA+3cPl5UnnpX9R1r4RgXTLZbHzYBAySrBZ/u0JTI2sEABQg8r0r8gbnwo37BG pfGf4nx+Ir/xFqkFppl5pUGuyPcGz/tWZTIqozMSu/JBx3AJNffX7ZPxX8WfB3wB8OtV0KSe0Hif xzolhcTWjKp+zzsrtE7N/A+drAckcVw4rMK+ZpYqvN1G7WbSXorKy0vb9Wd+FVPDR9jRjyLtdv56 9z8kP25dHdf2qvEEc4OTBp5x1x/okWeMV4F4Q+GVnqPhz4feG7GO1gufFnxrFrqF2SRIttbzWohQ KDt5ZpsnBJOBX6B/8FCtFs9N/a01+MooY22nPt+tnF0618U+DZdSbx58PrG2lZIrL4j2l5BDk4Ek l2A7jHGRgD8a4cxqL2SpyWia/BO342N6EU+acXuvzsfa37NvwJ8DeMf+Cifx80jxtawrplppj2Om 2rFYkt1kkjWKSJjtCyJsLRMDwTnvXyD+xB8Ivhx478BeMNX8QLZXF/4o8Za3bwQX8kYnjijuSoFu GIJlMg3Ar8xwAOhryjx34+8T23ib4ieNLS/mhvP7Y8OnU7mNjvlX+1h5nmAZJG0c9a7zwf8AszfA jXfFlro/gjwj8dvHOmxaVNef2t4fmuNLiOs3xku3iiiTT1dIoriUwm483ft+YA4G75zH0oTw7nK8 ebl1S2UUnZ6pdVbXuevluLnSq20lvo79Xbs+z6Hwl4I/ZZvPjb+1X8UvE3iXUNC03wV4W8J2On63 491VJJdH0kwRW4UTvBuJvJCVjW3RhIzk9ADX5lf8FA/2fP2gP2bfiNZ+CPjVapbW+rWq6r4c1NZ1 aHW9Nbi2vbZTh1gdMFFZVYcgjIr+339gX4QeOP2cfgr4i+DPh39kfXU03xNrI1TWRqWtwvZ6lIqq sct3/bs0krtHtGAPlz8wAOauftlfDn9uD40+MD8SbXwZ8MPh5b+D9CiMza5e6VrmqyxiRmjT7VJa y+RAC2BFGAuc5J4x9Vw/4mvL8xp1JU1OnThGEeZqLXLFJSVuZJyaba95Wts02fLZpg3iaFWgpcnN JybVne7u1q02le3T8bH8Pf8AwTh+Df8AwsH9rzwp4f8AE/h1fEOgR3k9/rcVxDN9hls7O2kmYSSg KNgdVyMjecLznB+uf21/2QvH3jJ/BvxQ+GPws8RaXd+N/DdtqWpQeFtO8nRF1Iyywy28VrgG0nO2 MmEkAgl1HOB+xOjfCH9vr4mfH+4+PLfGDwn4VedWgsfDnh3RLnVNGs7d1wIbayeNbc4+9uY53Hdk 19NeMf8Aglx40/aj1TS9a/al+NXxN8T3GkgXNpY6Dpdh4ftbR3OS8SruXf8AIDvwD7jpX2eL8U6U s2p5g68EuRJxj7WevvNqyjGL1a1utup8M8FyYaWGina+jvFfk5Pv95/NH+xz/wAEofH3xh+P0/w+ /aPz8NfCmj6Le634t1PVryyi1LTre1iDK72c0qyKrSMiksqhQ2SegP67ax/wSQ/4I0+HvB+nafY/ HCW/17xfo2o3HgW/1LWLKDSjcWcbkT3gt4WeOBZEIbe6lsELk4Ffrb8Pv+CKP7A1h4mk1/xloviz xdqmqsj6zfeKPE9xJc3X2nLubpLYr5gkZdxDHBxX3r4Z/wCCcf7DvgPTbtfCfwd+HNuNNQAS3enG +cg55LTFvTPUD61yZv4l4jGVFVoYmqkktIxUFs3d3lJu+/S6Vjho4eFKNnGP3c36R/rU/gc8M/se /sbDSfFmv6x8fdNvpfDtsjR6P4W8M3lxNrDSSCEJpbXj2y3DbjlmYKAmXzgV++nwl+Hv/BLiP9kz RvDej3PxL8WS2/wo1Twbc+D7Dw1fHUL271q6XU555JIIJUgvVuwgi2ymGMKM7gK/pz034dfBnwLo 9xf+CfC/gqxl02z+1XVtp+i2NvhRGXQ+Z5bNGGwcHtjPNdp4e8VXh1/S/DcVwtt/aenz6lELdzDI oiUErH5MSoyfMMlmU9MKe3i8QcZ4nHOHP7T3WpL34LZK3wwXfR7q56mBrRpp8iW38vz6tn8TfwN/ YH+HVlaeGvF3w7/ZC+O+v+JxrSXF3H411W6sdMtY7edGtJI7iK1s0mnlPVGxGjDB3A1/RD4j8e/8 FzPiRoN9bfCn4WeBPh3JJrr3Wj6r4m1qyvriLQwD/o11b+c6tdNL8zzKNqrlQufmr9SU+KOh3Phf S/EGtXcNxDq3iqPw62zeYzKly6DapnyrI6AlwTg87fT0/wCNGpah4S+F1lf+GbLUpruSUwrFokMk l0VknbeQIo3bZj7x29O4rDFZpVxs5V8TBScE378pzaTl0u7W7adNdSJP3oUYK3Npokl/5Kkfz3/F n4Z/8FmfFvibU9d8YfEX4M+DdE1Gyk0+28O2McupxWMsihWuknW3MslykmZF3vsBIBQqOflnwr/w T0/aW1vUtP8ADf7Qv7RnjTVtP0y5lvbmx8IWs2nahdiRxlJtQP7xok2kqvlnYGO3rx+y/wAb/FPj 2X4o6jZ2Oga/LoSaKGg1FIbhdPlvpHdfs6bnWHzj8oLbN3Yvxivk7wl4T+O8ngTQLO98H+Vrdpqf 2nUbDUb6zjW1snllImDySXAZyp+VVJbOcleDX53mWcY2F44f2dPbVU4X1i9byTd9LXve73PdwlKL UXO+vnK2vzseN/FT4DfC/wCB+iPN8I0WwuLqLde6vcaWmqa4yjO+S61DVLqSYgY3YCLH1IUYr5n+ H/7P/hr4hz3HjHXPEPiO/urOxlnsLm2utMt43jiBE3lPFbSfdXkYIJGR1r9MvjV8Iviz8RJtXltr HRLbS76xW10a4e+la7a5kDjzLqOOAhIRngK7Nx05r5P1PRvH3wE+GVlB4o8ReGbPVEgnsNTmkt7m WC+gvw6KImkniZHHQF94Jxha8PIcRWmnKpWfO2tbJuzjfezfkY8QpRcIwtZ/1+DPwH+MVpp+n+J3 vtNfVLjbestyuo6ldTMpjK5ClFhRgVYEbRx0969t+Gk/w48aRlvEuieEGuDY40+81XSYp7hpYzxE WnLMXkBHHXg81r/FP4AaUbPUPEjeJVkuPEEkN2dKjSFTYwyqqCVMszncUAywwWzgdq8G0XSvhN4Z 8AJrOq69fmLQrlIY7nzBE0NyG2ETbI9w2sApyAB3r9qpVKGIw8FGc29FpzdV8uunmu58u5PpbQ+4 f2V/iDo3h/472ekeHoNJsW0kiS7NlaWMYnCq8ilo0jZk4GCSBnqK/rh8IfG3w9D8M/D3jTxLcSQw eIZYdPtI7GZpIvtE0skcYVyiHGV5JAPav4X/ANjzVvhrqf7R2lXF8k8z6rIf7Qkkml8i6hAZHjLB hsxkDHy8HrjNf2y/D/VfhlB8DtM1bwr8PpHsdCIktvDepW4s5rFoGLTSW3nLJC7fN5kbiQRyA5Eo zmvxrxCy3D4fNo3jq4x+LrpK/e+v3baH6Lw1VlPA+/d6vb006pI89/bLitrbx58D7O7meOO58fRG 7kkmba8cenahIVdi33MoCRnHFfR3jzxb4T0bwXD4+8JXkNzGzwRRX2kKLxpGlkCui4Wbd1O7g4AP TGa8X/agk03U/iT+z1rFvGl7aS/EGKYeWUkWSM6RqbYHJQ+h5IzX0RB4y+Iek+HLuW40TQvDOqwt Lbaat/dLLpbp5mbeZzH5DoJV+Vk4dGzjeMZ+No4ChGEHNK75deVtrWW1u/42PWw2Km2mlzat7pJ/ f6fI9c07Xp4viLp/h63t9Ra2udKlupbiGBzYo6uoQSybNgkYElQXB4PHp7Ba+Jb250w3djousSTW LrCtpPF9nkuCp5aIylRs/wBokCuR0V/iVepYXUC6VaWu0HWrF2edvMlUH/R5gI/9XICAWQh16qpx jq/7I8XtFqP9q+ICYL/Bs3hgSGbTkddsiRzIVZhnDIXBdTnLMMAfs3CtGpTpXpKTTs9IpbPSzk7b rzV7p6H57nFeMqiUklbTdu/ryrs/u2uO8Xaf451eTTJfCcMMbLfw3GqR3U/lsloEbzI12B975IwM hePvVi6FoPiCx8Q6tfatfWNzDeX8D2dpbPI0logjHEwZsBn+9hQvHr1r56/au+NHw0+CnhHQ/C/x i1C51SbUJY9t79ss9KdJLUeal/PO7RLBhkwGi5LZwuAa+cP2Gv8Agoh+y/8AttfFLxZaeBVt9P8A GOlXQ0a6tzffajqem2xMiTwOFRHWN5GBCglQRztIrtzTlniJ3jK6avd6Jt/3YtJ67c2r26J81ONS GGi3ZRadrLV636u9tN7eu9z7p8PeGvDdp8OfEei3/jFL2L+0r+TVtW0hYIp9NkyGlt9iebteMD+N S+DnB4rZ8Q6l8L7LQPDniDV9W1C4sYbm0Gk32nTzPFO0qKkU1z9lGHibuXHl5PIFeraJ4P8AC2j3 ct7p9hZ276g0dxfPFGE8+RFCiSTgbmwSMn86h1fWvDnhW8sNHuDaW/8AaNwbCzQlIwGKhgI1xz04 Ar6Opw3KnQ5qyhBfDq5St1V02rpt+t+tkeasxnUqNRcm9X9ldNej7eluiZ5dd6t4K0X4gXGzSb3+ 1bvTQ7655TtaSiCRVNo0uSqSAkFUIG7PGcGuV0TVdQjbxDa6T4Ps/DQsXxpt1di3bTb5Zsst6RCy FcEYkWTa4PQkEE/P118d7NL3xf4HNw0154e1zTrydf3jCSG5kiIKsq7F2lT8oZiTmvzd/aJ+MP7Q njz9k3/hD/h1o/h/w3f6nHeeJ/EcfjGW4to0ggnM6IbWSK4cq+xm8tmTPy4ABAr8UxvGGHjXjCrO FNaa2ivebel2nrpq+vZ6X+/wnDFeacYJy2vq3pp5rTy6d1qfq74q+Jnj7WNIsPDVjqXgix12bT57 jxL4VN/BdTz2nlutxLYPHOs4CKC8Za3ZWHyvt5I6eHUPH0/iPRtD0fUtAOkw+HYjqehXKOdSRwqm 3vIpUJARpCqSROnKncrAgg/wqWvj39s/wT8ZR+214R8VfDkXHgzw9Mt3pelQ3FvFd6K5MVzA9qbS JHaRJWBVXVsAFSMZr+5P4b6x4i1S4sviXf3WmDQNT8FaYLFftrCR7qSKGV3a22kRpwQCSX9RXZmE IyalDFe091qXLryu6bi/djZWae3U8z6jOjJqdJR6xvpfVbe89f0Pz4/af/Y7g/a91PSfhv8AtC+K L/xj8PtX8ZT3Ufha2tlsGt54bRplgkuI1ie5ggkhl8regZd/LPgNXzwn/BM//gl58FPjv4e/Z40T 4S2c3iHX9Iutcsp9QLyxfZLGRYpWaVnIWUM67QPr2r718UeNdY/Z/i8I33i5F8RXsvxAZYotBS6d PL1fzbZT5s64P2YTh5OcFVYgDoPoX4lfs1+H/En7SHh39py41TVINT8M6Bf+HLfTIBF9iuIL6RZX ebchk3q0a7SrKPUGvkqsMZiMPiKeHxtWKi/hjNqPa7Wzb63V3ZXPq6GLjhq0FKnGzTs7btPutfyW p/D1+0f8TvGek/tp6d8DbTU/s2h3Xhu61M2kMaJKskcs6qqt1Zdkag5znGa/Dfxvq0eifDvSLjT7 oJqGo6nfWUqyOrulvE6lSiEfIGLN05Nf1K/td6r8P/AngrWfiZqOg2kutWUFxb217FAHvJizyeXE hILAfMScHGMniv5D1+JtheWNzDfWIlfTmknPmsgCqz8ldy5yCRwOT+Ff0b4A4eGJwiq4fD8saapx la3vyXPd7L+aP3bnj+K2J9hVUJ1buTk0v5U+XT8H2K+hJcWHj2w0RLiRFuWdpAuFJwD3Azzivtr4 a/DDUfFPwo+JfiXVbbUL7TNEs4LSzEsk37u8ud4V4kUbXYFcEDt+VfHWleLrKedNft7Jm8kjbPMq kjI5GTjAPJA7V+l3wR/4KFXWh/DWx+EOr6PY30GnTMUGqagtlp0iSkkNPhS4eMn5XVuhwciv2bjC jmEqdOWCoczTjzapNJS5m/nbl8r31tY/NsixGHUn7WpZa20v0t/wT5r+FnwK17TfhxrmteK7S402 +sNMCW1vqUTQTXD3TDCGOTEgHkh5A2P4a+mtN+CfjHw7+wx4G0FprNboeNrnxIZogJpDHKEhEZiI BiGCCJCSDnI6V9r+Kf2kv+Gxvhbpvw1l8M+CRq3hbWjqupa74Y1WbU9Y1DTrbSJPvxtHHG1tCG2M /mr+9wu08tXxxeftJj4efD7wBrGhRLdSaz/bvh+4iuQjLY/anNupKOWRNkZLJggqORivzHMswzbF 1vZ8i5/aKbho1H3J2V+zSk/nbofWYSOEpQjJtpcrjfq/eV3ZdtLenQ/pN/4JKfCTxH4m+MXxQ/aE 8eyX0mo+P7PTIrTTCFj0+Ox0pIgkwnRs7n2gHtyema9d/ad/4JxeH/8Ago78SNI+KfxUbW408EXw 0/S7WzvFtbeOFpFmlkZHjckKIwoTdhsE968c/wCCS37Vnw78XeJfHHw+8N6RqEMPhSz0PTbDUJrs zrPHcWZ84xwCIFUfyQPvHdu3cdK6X/go7+3v8Y/2NvF2g/CiytbNZfipZyXFnqcTkPpE1s0VvFFF EmQQzS/Pu5z3yTj+a8NLNP7YlRwqlDEKL+FqPLBUlyK/S0NLau2/vXP0J4iE8HOc2nTcuqvduWun X3v6tY+Jv+C2epfBfVn8C/s32Nn/AGm/ga9OoalJBcyQWUUt3GkcduqW21nmdF5A+6TwOTXxr4/+ Bfwkf9izVLnxbZ2niDxvrXiHT7lbPz2lvLCOBG2iWNH3hEhOza+eTk8ivzn/AG6vjT8RtE+Kk3h2 /dftekaw9pOy53XN5Kpae6lbJzKWwoyflUYAFdD8W/G/xB+AHwKtviB4cneLWPE18ul6tJdRklYv KZmQHhUGcYIOT74r9ly3hPMoYPJYUsS4uUrxXM9Xfmd30XV23aSd9zwKua4VVsYnTuoqzdltZr5v 18z2H9i74T/DT4ga34h+G/ijQoL2XUtJ/sjRLMiSaFA8wLMq7i22PbkdeByTXx3+2B+zt4f+AHib WPAHh4gw2O03GMjY7MB8y5O0/wCz1HevqmyuviP+y1+x8P2srHWH07xV4j01LLw+I0jZ4rV5RmTB z8rKCCSpJB9q/N3Xvin4x+MHgPU/HPjS8+16ndyq924UDzWEoUfKoAAA7Ada/QeCsNmNfN8TmlLF Xw3OqbjeTvUjZNq6tZbXvq7nlZxiMJTwVLCypfvWnNPTSLvpp1e9ux4ZdrpumIBPKycDnHHSrWny Ceye8s52MakrxntXIeMbPUdQto47WCRmLAkIp4wK0/CNvfW+hPYzwSh9zZUqcj0/lX9Pzpr2alfU /L41H7VxtpY6PTNbnu9QTTba4zIWKBHXIGPfHtVrVPFEnhy63XyxsQxiO0YzjB7fUVxfhn+2rXWk a8sLgQCRm8wA5A5I449ar+PtK1HWruP7DBKy7mb5+OSAMc/Sp+rwdVRk1buNYip7FySfNfzPetJ8 R3n9kxat9mk8lwCpU9VY44yDWx4O+J+ieINVOn2VvKJI4jIzfKRhSBzj6iuE0bUmtvCFvpM8conj gRPLweqnOMnj9a5v4NaHqXhbxPc6pqirHHNaPApDZO4urdvpXlTwtNwque628z0liaqnRUdnv5Hv mtfGrQ/CMhhvY5yfM2qBj5gFBzg/XFeqJ4909fDkPiSBiRJDFOImIDYfGQeO2c18p/FbwffeNJ4T ov2UbZC7SzSqg2mNVx69RmvedOjSPwXb+H3ktnmWyittokXaGVQOCe2a87EYagqdOcd3uj08Pia3 tpxfwpaM+h9buda8FjTLnXYUCaxaC8spYZw26Nv7ykAgkV+rv/BMP/gqx+wL8M7Lw78K/ib8N9V1 T4g2vii8Gh+MItPtbiWF71gII0uHkWeMIdwYgY5Pqa/Df4u+JPBOuf2E97pdtbJZ2EWmXW+5QvJM gJMg2HhfT+VfV/7B8n7K138UPC/hr4m+G/Bcmlv4jeXVrrVZ2E0lqkDsIxK0iqibgCSSGJ4B7V81 m2X4R4WVTEUJTaTas7Wdn639D04Yuu6qhh6yp3tfz026fif0ff8ABPbUtI8ceL/jH4ps7oRyXfxh 1q/8psMRHLtKKcZPLE55IGOO9foy2o6Tpl0NY02Zo5FufIlj5E2UznhsbQ4GR+tfhL/wTD8VT6V8 ONVXwrBEltqHjnVrm1W04SJEddgLHcxjCkAA9B361+wXg/UvEOrT3B8QRmKdnbES4aORt3UFsYPO Mg4ORX805vhXTxVZPo3/AJfoft+DxPtKfO+rb+9tnx7+1n8SfhfLb654Y8W3s9msFnK5lAUtK8kU hCIcE/dUknIC8etfw4fES9tLjWpdO0hmFvhYjJI2dyqxXcOOARz9fSv7ov2qP2aLv43o+g6TJ/Z1 zHDNHLLHEJWnE0QBjLbipAIAbbjA9c1/G7+0p+yH8VfgT8X7nwJ4wQ/PbT6hZajJ8sVxbwRmZivU bgB93txX7d4TVsNS9pBztJpOz8tz898SMPXq0qcqcbxT1fXW2/kfnn4pi8zV5l2sVAXDD2AGciuX YYGxt4x0PrX2F+zbL8OD+0R4VuPi5psWr+GTqcP9t6ZdS+QlzbkHcjSHAQZwc1w37R0XgO0+NXjG L4aW0Vn4fXX77+xbSJvMSCz81jDGrAsGCrgZyc1+84fNk8V9T5HpFSv03tb10v8AM/E62V/7JLGK a+Llt12bv6dD51iTzZQBnJOAoB5Pbj3r7X/Z5+Dnxr+Nnjaz+GGjW1ut/a20UdjFqUVqiLb3LGTc 7yLlgS24uScKOeAMfJ2jBPPgkYDzC6FWB24bPBr9jP2b/DGpfCrxzbaR4mv9ItbnX4bjTLPxDced dysk1ujFFhDIYsxvtjcgnc56ZwPkvErinEYDAVI4VpVJRdrpvazbsmrpLdb9tmeNhqUXOLl0M3xz +xf45/Zk8SXPgDyvC+sR+NbRjHqGmNNquoaTD5OPJlWFdkBnmdQuXBY4/hry79kn9kX4veNvjNF8 K/Hmpaz4V0fTSb6/GGDnzPkAhil/dNJI2I++CRkV/Q18L/EEXgPxRqvjDViJbqfTrJdQ0opHDbND Eqsj3BKYgKoi7QC7Lkc8CvzCtPgt8RfjTr/ib4j396/hvWrvVTdaFbvfT/udFt5QzEPEoby2JzuI DN1+XBr+Xcn8VMxxGFxdHF1YwcoxXtWuZub0UlB9o6N6qyUt20ermGHoxSnTXXa+3/DkH7Qnhj4K fs12J0W3tZPEM11qRe6geW1/taWdEQGaVYhgq8p2KgXpng9a8p8b+DPh34pttO8R/tAPf+CoXtoP L0+4ja2iP2cMqRIHiHzlWJcDrkE19F/Dn4X/ALOVx8Xpv2jvGenSJ4J0fT0huZtSMltpt5qQcw3N 1DdXLHesON4UNvY8BSc18m/8FM/26/2dvj9bx+B/gtY32pGx1JbiLxLMn2e0S3VPmgtoHHmNvkO5 pWxkACvf4GpYzEY/DYTDUqs2lerWenI39mzcoprS/V7LZmFPFwTcm7dlYz9ObTfDfjnUYPDu2xsf DdtbaxYatY3Jt7uGIgvBMrkcOuAflzg/lX1Dof7WHxd+J/7OE/xT1L4peOrBPD8N69vbNrCITckF YftU0USPN5jHCrIT6KBX88+u/EHxjrmoz6nqOqX80t1CsEzPK3zwoNqRkAjKKOAvQCm2HjDxnZaB N4Wt9RvItKupUnudPErCCWSPJRnjBAJBPGa/qrCZNisPTSo4qUG3G9m1dLfruzCviMNiKyqYjDRn a61Se+260sf0NRf8FJfHPwz8Dnwh4J8c+J768sYLbyIL25ivIgrRqyy/aJY3fZzwN2Sa/NT4oftu ftBeOtY1XxB4z8Zatc32qxfZ7ieCZLcmEJsWIpDGDsC/LgMOOtfCy+J9cWJ4orh0WSNIX2cZRPur n2rByzku5JPfPNephpYyC5ZYqbXnJv8AM5K2W4JxioYeMbdopHWy+Mtdiv5LzTbu6hkcuTKkjLIf MGH+YEH5u9M/4Tnxt/0FNS/8CJP/AI5XL9MdaXA9W/z+FdUJSSspMf1an/IvuP/T/B79mj4kX/xT +Hv9tazNE93BcfY5YkUgqIkUAsc/MX+8TX0Rt2LtX8cjkGvy9/YX1aeDx3c6VIhcS2ku/IOyIIc5 Ug4y54JI6dDX6u/YfPUyLjAOR/kdK/UMizv2mGhOpLVaM5Mxyh+09xb6/wBfcULXlh154H+FaDKq EL17/T8KSxtALpICG+bjJPf2rqdZ0eaziDcjgkFuea9KpnEFKMb7mdPJpunKTWxxrKQwIAz+n+cU 5VYDaMdSSV78YqSCwmkYbxkZ4IPAx61JcRrHlM98EV2LMYt8qZw/2dJRcmhEdVXccnjHGaC3Hzfz xmqLSuvI/P2qLzMjOeSetdFPFHFOgjUDDG7d2/PP8qUMpU59MnPQVltIScjv2NSJK2NidfT+ddEa 1+pHsE9GaG9DnsRz6VOkmfu84J5rMSTI2Dv9f6VaUuOFOT6DgEmiWIS6i+rFtZN/y5AOc8/5/rU8 coIy2OBwPwrPRiOWPTkZPapY2JDbOvbj3pfWPMj6ujQDnHJA9c+o7f8A16soZDwemM/h/kVnKy9Z MgAcDPXHWrEeWBPIHbd/npR7bzJ9h0L+7DAI2cDj3xUpc43P0HbPSqAbbx1OcHFSq7YyxJb1P9KP rIvqi3LyMWbbkjJyR1q18/G0jI9fb/Pes4FTjcCo456/hUgyQN3Y9feiWJH9V7F9ZmLqnI5wMDP9 anUsBtOPr9TVBOfnyTg4JPb8KmWXYmT90ISdx424yaXt13Mnhra2Lod2JXPA42//AF/asPxB4w8N eEzA/ibULKxW5nW1tWu5RGJJm6RpnGW9q8K+JX7S3w2+HGmXd8119uuNPvbO0vbS0Us8YuxvUgna pzGMqd2PWvyT+Pvx71L4o+P7rWvDV5qkGjC9h1HTrG72I0FzFEkfmAISARt+U54HvXz+b8UUsNH3 XzS7XO7BZROvO1rLv935pn9A6yMrbVJ3N3I/pVoMzsEIxk8D8K/Nr9mv9r3w3qOgaL4B8YXd9ceI 7zU3t7m8vUVISLgu4kEgP8JCg7guN2c4FfoVBr+hNCv/ABMNPfAGQLmI44/3zXrYPN6eIpqpTlf9 PIyxWAdGfLU0/X0OnH9/OcdTmpIz8xPB6cn+lcxc+L/DVjE1xf6lp8EW5UEk1zEibpDhBksAST0r oopCy7o8MoOcqQefwrsWJTurmXso9zcjX5dvOcYwKnMZ27icdR+Hes/7StnE891+7WJDLLK/yoqr kkknAAwOTnFcR8G/jZ8OPjrNqFv8PLie5fTBH9rWWBogBISFKk5BBKmuCvmkKclGUrN9Duw+BdW6 gr2PUbSPzG2EHdjOD078d61mjVTuwPlXgDiud8V+K/Dvw2+wTeK5Ggj1PVLfSbVtucz3JIjDcjav HLdq9Z8S6FJpqorJtdgO3QY6Vxyz6l7VU+bU76eSVPZSqcuiPOCGkckEDHOPpVuOL5TuPGevPFbV ppPyGeVTwcDPHTrj/wCvXkfjr4xeAfCNxHpN3fI1xcNcR7oGVxbtBE0h87nK527RjJ3YrueZx1s9 jzpYBx+JHojH5+cA4HfBrlfG/j3wv8ONFfxR4uuvslnHKkTy7XkOZDhflQFjzjOAcda+Bj8Vv2gd a+Jes+Ivhhomp+ItPMZt9Jiht28iQEk2/meXGG8tS7ksWJHHHNeZ2n7Hn7dnx2+INtr/AI3VASbh La21a4EcFij88RyYwqbuTgtgDNeTV4gxLo1HRw751zJc1ktOrba0Z6NLhqc6lNTl7rs2+1+nr+H5 H6jeCviD4S+Inh5/E3gm+XULJZZLdp445ECyoAWXEiqc4I7d60viD8RvDnwb1dtB8cy2lvqU9v5d jY3Z8xbs3NjHdp5TJuUMIZ0bLFSrcHkV+L3x1/Z/+Mv7JOvad4a+Hvj99X1TXtLN7rWk+Fnk3WBN zNDHBL5e6NpGSISZXDAOAa88m/Z2/bg+PGowarD4I+IOvTBIoVmg0nUJULJEsXmFtjDzHVRvfOWP X2/L+IPFGnVw08P7WNNtVITbdrS+G8btbO+vXRp21Poss4Jqxre1VNyUXFq2t0tWno1rp+OhN8T/ ANvr45+NLq7sfDl2mg6U84+zwWSqblUj+UB7gjeS2MtjAP0rI+EH7a37Rvh/xFpGjy+JXk0mDUrd 7sahbw3GLUzL5qmSRC20rkdeB0rH+L/7CP7X3wL01dW+LHw+8T6BaPAtx9o1G0eGNY2O1S7MBtyR jmvWv2bP+CaP7bn7Rmkad4q+DPw61PXtHurnd9vZkhs5zEw3R+cWXgdCQeDnuK+JzHxRwaw88RPN IqLvG/tElfV2vzWv5HuYPg2oqsaSwbdrSs4t/N6Xt5noPxe/ad+LPiP40eIvDHw08UXLeGpdeuLX w5b6XHHCrWhl2W6Iyp5jF2OFJOSCK/u8/Y6+C/hD4Lfsp+EvDvjXT7DU/EOg+H0GpalfWS6jqVzf EG5uIg5V5mUTSsFRTwDgAV/Mz8B/+DdX/gpboOr2XjVT8P8Aw1cWWp2er2DardSXMtrcWcyzxYCx OCN6hWBJyK/s9+Dsmq+HPg7PceImjhv7a+1GTWJIjsjN6m43BUgfKiuu1R2Ar/Pf6UPG39q4XLMr weOdalSTctZO7jGMY32Wzls9z968OsppYP61iZ4dRqTlHZxW7k3td9t/I861DxVZi5TS9K0/VvJv 7D7Ubiz0q4SOAgqvk/6obHKkkA8jB5zXzb4i8U/Fe4j0bVU8PeJ2nXVxHqccyWkIGnLMxcndIqtu QLgDDfQ5r668T/EKP/hO7LwOZC8l/oE2tJmWQsyRTxxEj+Ej5wM989O9fGmofETW9b0rwhq8Ns8j ar4uGm3qRWk0oSCOeVNzBvmjXCDLt8vPpiv4RrZS41U4UIv1vb7W/wCP3H9D5FUcoOU7r7m+29vI +H/2pfiF4x+F/hqXW9S0q8s9Ln06XTw0uoQ+cdVubmSVJDbo0gZAhGWznPGDxX87Hwx+Mnib4e/H W28S6nf2umw61e2T+Ir+9uH+y21lDFLJMzFVZj5sjFhgcMoQCv2R/wCChHxctLr4qaX8CZHvo0l0 GO+kktJIbVYpnup2VzJKCJWMaYWMDPQg8EV/Ln8bPEa2fjHUNC0G+vdQtrW5gjE9/gSyywM3+sVS wdDk5Bbrz04r+qPAThGOLoVaNalGLrQV7J/BdpPXRO+uu9lurn5P4p8YRw2Mp+yqN+zbt5Pr8nt5 I/tS/Yz177P+w740+J3hGS1nt73T7q3tba+gupbiEmIxeZMPlZhIG8wYAwpHUV5D4V1zXdZ1H7BH bi3WXRNH0TzobVNwu0to41kczy4XeAxUgDHHIFfg1+zD/wAFJfi74R+B2ufs7ePbZLrw14i0a8ga a0nkj1O3vBH+5uLaZQPLVHRcIVIwODXZeGv2nPjjpnw8m+IdheIrXPiLw5oirq0LzJLaWFqy/a3N vlsFViSeXrIzAn5utY7wdzOnWxUJVoq87R2d07JapbpXT06eZzYTjTB4tQnRu7Ru1rpZa/i9P+Af 2ufs6pYPot38P7e7vXt7awikvnaOG1kkvfmjuRGqA4RAq5IPU9a+kPE+m22naZdapHdzwXkVk1vB czTqiqpYKAcKBjfjnGa/ED9iT9u+18bfCa8+Kfj6wn0a8ltbjQra2P7y1ikh3GWXdMVyjOvygHO3 GRmvxo/ax/4LV/EDXPjZ4ltvB+uxar4Y0eyi0yBLexcWUg80Sy/aCSj+Y23yhgrn7ylWAr4vhzw9 zTH1K+XUIuVSndS191a2tdXV7vS3bQyzjiDD0pwr1JWjLyV/u0e1tz+lK31b4M+E757PxX4n0Qrq M2pS3LprPnLPLb5NwDsk4BAO7gAdDV3wt+2h+wv4X8GN4m1/x34JsdOS/htbB3vGMkYlsbeWIrHl pQGVgAQvTH0r/Ol+K/xs+IPxW+Lmt+Mb4XYn17W5m+2aZu0yLy5X3zweVHlAoyCVYnkgtuyDXpOv +CviV+y1ZXt74hvLDSp72zi1DRFkvI7q/Wb/AFaKY2SRQ6LkllxtO3DjGK/aKP0W6NFUli8xbq1F 7sLLXa6u237t9Xy99Nj4mp4g1Jyl7Kjywj17b27b22v8z/UI+CPxU+EHxJ+1WXgO4guJIJbMyo9r Jbs630TzRP8AvlUsxjQsy8so+8BXpfiXxR4K8HWd5rPiW8sNJs7W8Ngb3UDDbxmVmVY1DuQpLM2A Ccmv8o74N/tyftU/D2W+bwJr19DdanqkGoC9EkpkttSVVVbmORZAyylEK/MWDBm3Bic1+wfw8/aY /a1/bJ8MX3jj9obxul54b0u3iv8AUtDnvI9PXV9SNtsFrFDIrMlzKGz5ohEbqsymVetc3Efgjicl w6depBwTSum+Z3tpZLdt2WvZ3Ry4HPaeOrNx5k3d67L5+nl95/cL8atC8G/EzTvDM1rcWmo2N5f3 Nu89r5E8TK0Cy4yA65z2r8uNU+CHgnWUm1C60jQQvl3aROthHHLmC3kmbcyBDhtoHB9c1+Jv7Lv7 c/xf/Zu8c/Cn4IePND1Twxo1j4h1LVbmxska+sr/AE68tUFobeDTY7iSRjlpJiu9lG3hck1+vvw+ /aQ8E/E7xRpnh/wVrUN9a6vpesarbWMlvPDcwiGykVj86BVZgRmNiHAUnAIIr+YvFTgrF4LHLExp PlqK/NC7Vo2jq4tpXUZPd2vqz9n4HzKLwzoOfw9Hpvd6J+qX4n6s+CtAtb/wvZ6gIYYynh+2uw22 RhjCfu9xbGBkcZ/Cv50P+C3fg7UJ/GieFvC3h69vnuNNvIb64tJmgMyZh2MQzKuxPmBxx7giv6Pv AFrLb+ALTVdhKS+Gorb/AFnCqPLP3MYySo5zmv5j/wDgth+358I/g58fNR+HSzXl/wCJbCwudO1H TrKPb9kW9jhkTzp5AFXKNvUqrjgDHNfoHgXltSeaQllmHlOryJ21XV7tWsvhsz57irHwhGSxdW0O Zro9rbb676HUXnh/VfAfwV8Srr76BBbwaRDcywXrBFSIuC3mShcseu7r3NfyceLPFGlzeINV1q31 vRUtnvLl4Us38wyYlztjPV1XjHTNdX+2p+2j4o/amtDLdfZrTT7C4aDRBpzFme3YBGhut+wclTIH K7i2cYFfnNBLaajqca2MPkLAoYwl9ynYBvIJ7sQT+lf6O+G3h7isLhZ1cfUtOdrpLRW823dv8Nj8 Sz/imnLEcuGj7q2u97/13P0g8P6rY+KbhD4aFpOiTKksc2B87IGBPynHT+nNfXXw803W5Lr7FBp2 myy+WHVVeLygDgEnIHXBx35r8jfg34qsND8UzXUm1LGdCZpJNykFcmPZtbdjOc4H17V+o3ws8RR6 pawaqba4nS7iBjmsZZowV6A42NwOD15PvXj8c4StgpvkV420uu/zXmfo3AuYUsXTTm7Svql5fJn1 wfDeqvZwI2iWjnzI4pJY5YSSc4CKN2eTxkD8cVyl7oGqaMUb+wPs1wYyTyjEkSPz99sADpgAZqE/ Gf4cx65L4Sna8nvrTT11O6FnOPLtBENzGYOD8zAYA67yMgV4NqH7aHwnubP7XaL4oecxhDabI5GH zMQCxKAckdM8nmuXhOeMniaU5UrJSu99mtPtfoenxNmGXUqVSDrpNq1rro9em59YWuuN9q0u1uNH u2njldtRuImkCopAKbUR8ZxyeK/VT4S+M/AmjRnU/hhrvi3w3eSRW0FzPYWMt9PcgbsRp/o00sYD d49oPcnAr8U/hR+1T8CfixHYeAmutc0bXLjVXkNreafE5njIyG+0K/OFBOwgYHc9v1u/ZhvPDWka F4h36tc6hDCsEpW2QW8ykGXZESrnOW68ivxTxqrVsJQqYicZx5G3ZXXMm99U4+nT5n6d4crC4xKN Kcailbto0tmtH63R+q3wY8H2vxM0fU9K8YHxxrMWoaNPa31/4ukmW3nAZXQRQyTtJG6MAdwhj4BG 7nFel+CPBWp+CfE0lh4K8H/DnQ47VxHFeSRXN5dzIMAtILWO2CsQTkNI+D3zXD/sNfEeHxhrU2kJ aLFDc+B49X8wEMTcSOqSggjO3ptByRj3r0D4/wCNA8QTstwyQPp0M6wxsVdZnmw7K3ZnX5T6Cv5a zviuvhcNDFuKbm0rS95L3pK+t107abLy+8wuV062NngIXikrrl0vpfpbv8/z+4fjnp0Xhz4XP4ks rw6Nc2tra3NzqVjGgYBiu/Y0yTeWjM3LYZlHfrXzp+y9+0r4F+KnxUudAXxPcXVx4e0W51LURd3s pt1tYyqm5dmSOBojnIkXgEHmvq343Po83wNv7m+khaI6DB51vO67tm2PIYdeR/jX8Fv/AAUE/wCC wPirVfEmsfA39nDwj8P/AAr4VQxWl9f6JYM+o3628m8wTXLeWwhDDDx4KtX9DZLk+NzHN44PAq0a cIVGtou8pLV2/u7b/ifgONzfDYXJ5VsXHmnKUoJ6NrRPq79fTz2P33/4KT/8FcPAfwT1gx/s5fE7 wZcWpBuJxp0tnqc1xIq7VgQEOS3m7tzcYwO1fyP/ABy/bG+LXxW8b237SXiTVlm8Wz6zBrn9opFD GoubN1aBvJVBFhNi8bcHHINfFdlrukeJPEh1TWdOsIba+1BJZljVxEgZxuEYZiwUZI+909TX3dee NPhX4a+JVzf6XY+FLm0tvElkIobKwg+zrbxuolWFpRI4DDnOTyTX79g+HMJlk1KcHUnLXZWS/lW9 lr1b2PzaGcSxyS5lC1lfq/N3td6dOp9eaPpHxq/aK+A/ib48+I59W1m+1DTbZb3WLxpJSjNfxO7y PjasakhVXpnhRxX9VH/BS/wTIfg/8FEnAbyfiF4dZieBwsXJz718XaF+1D+wV4s+APjP4LfEbxtb fDHTdf8AENjq9nFpdj9pjtbG2YS+RFHCFj8ssMYJGPQ9Kf8AtV/8F4f+CTPxNvfCnw/1m/8AFev6 Z4R1uLUGu7bS5ILeaaxRfInjIlWSQFlyFKqM9eK4cnwlfH4WVSjRaT1iknde9a33JM9HiDNKWGr0 6bfwqzfd237bu2723Kn/AAVCtobX9sbxEY8D/Q9JAYdBiyiJr847XTNTtvGPwx8V6ZcTRI/xFurG 5iU/I/2eS1miYjkfKZGx7V8kft2/8FlNN/aS+KevfFn4S6MdOXVnSKzfVtjTQWtrGIIsxIzAuUQF izcEnjFdZ/wRY/bD+HviD4y3kX7VvjDTtLs9HXVfFOjL4q0Q6xpdzc3MVvbzgFGBhntxGksIVCDl uVOM8+fcEZhSw2Ix84qEU3o97O6vbpbcywHGGD5qOHbbdldra6tp59v8yD4/TT/Dnwf8YLbwla6z e3t14ttINJu7OGRgk66kbhTI6ndGoKlQRzkgDFf3MfCTxhe6zovh3QdfuXjvpfAul67eW/mOHSaS OPzCSXzjdngr+NfjLqH/AAXH/wCCa/gTXLrQtL8aRXUkd9FA83hrwTBaQSecFP2j7TPLkIh4csm7 IyARzX1v4k/4KVaL8Sr1I/2Pdf8AAXiE2dlfXd7NdXPnzsunRQXQmnigXzUsnjkcNPGrfOmxQTkj 8U4rpznhaUMXh5Rs2+Zwlqmkt2kkrRXXqfU4fEUq1STw9RS0tbmSta7v57tH3z4Y8X3+taHot/Lb 6ncvqUsi3bpaSHbEhkw04WJRGuQu0kLkkdeteDftBWPxK8faUttovhvVzNq9xp+natp0VtFBMlmk sxSe48+VPLiyAxYMWyRgZ4r49/Yb/wCCl3xZ/aJ0/wAReI/Hvirwt5Oj6sFuI9D0DU9t/ZWKkT/Z pLmOJIUnEsLxCRjKDk4KsMfWN7+1LoHxS8P6/rHhnxLqdpBfWOnahpeqzWkEVyUa4k2WUttln8sb DvdlUlXAyCM149LBUaDlRlfmjL+VL+e28r/097K/HVrynNSUEk/Nv8o2/wCG9beCeDdA8ZeCr2Lw RqfhiOP7BE0umag15CkN1cSx4i2gBphHkHLsvHpjFd54Y8PfGrxDaaWl1/wj9jqi39vPr5lknuo2 t0MrmO1ZViJd0HV1wvoeteRta698RvFc2v8A9t6rbwvplvYjSY5Y/Kgig/1c8bMu4P8AMU4AyvUE 4I+j/A3wC8MXttZaLfTatqf9iGOewmu72V5lliYsjmRSGJUnCnOdvykkZr2csptpNQv8Pbs/U+Zx 9W7S6fM7TSvDmvW+saprl54ns/s05sYbWytbdXm0grBIRJKGZ/MeQMGClADgYBzVyz8YeGbiytpp PGWo6qdRMtjDNDaJHa6jeBX/AHd35cIEEqlXVY28vlSCN3FfIn7cfx+0j9jj4bf8LC+Hfgn/AITX xff3tnpv9j2Ub3E8iuZZXe58stJHbQorSdMbyoGN2a+Q/wBnj/gsRZeJfFlj4Z+KHwx1DQ9L11rf T/7d0XTJ1hs9SvnKxLKkmT5bHGXUnPJ5xX1dDCVfZOrFRS2+K7+F9NO9vW61PDq0ZuLfI2l5frr/ AF2P2ts9C+CuqTavoWq2+tX97qujxLr1nHJdeVeWyRtGILR1ZYkcMdjKro2WBJ2ncPRfC+g/DRNR 0LWNC8Gam7R2Mmn2WqXELR3GkWZRStvNHcSBwsgUoxBY7gM5B3DQsPGl3EmsaXo1hczy6FaxTWfk WkzG4upI8lEJVVlIfAIRvqRXteg+Ibx7OJdT0q+SS9tI7i6uXVI4YZlBLQvvfcHJOAMEDua9PA4e M7Jzjp/dv09Xu9PxM5OcIddfO3b9DHsl1zStLkXwd4K0q0nhut0OnTyQw28tsX3STRPEh8uSRTn5 kPzAg7hg1xfxm+JVn4D8C+VYeLNI8K6gdMumj1PU2jItmLsYnaKRWV1L4ypHI4BrQ+O3xY1XwZ4Q h8TaBZ3Ml9bXduTpds6yz3CJu3xlYFmO0rliQONuMjIr+Mr/AIKKa1+21qepaXcW2vfFAzaj/aN3 PbaVYtaQwWkk++BUX5GBQuVLEF8AcgYUduOzehTxkMBGvZy+1yuKSvfRpaN8ttXpdad+zBZLVrU3 iXG6j0vdt3ttd97+Z+zniv4633xfi06++HHxO8L6vZ2d1Pp+r6To1ss6XV+i/aDPHKcvE8coOI9w BQ4IPBrG1TwV4n0TVdS0zW/HurxWVyE1a3vFZFnssIJY7SOSQb3QOHwrFshipyAK/lw/YB8J/G7R f20NE8P6nL4rlbUrO/vruPXFWKYysxXzD5joJRuGSCwJbiv6g/8AhnH4w/EHQ59A0S9urm805T9i nkitLKO4mlVkjjuAsk/lxJuJLIS5x2r8x4zwVLB4mNGGI9omotel5X87+fbyPdyeCqaThy2dvwON +MH7Wn7Hn7P1lZeI/HviLXR4litxa3Om2MyLLNaXIMsck1sZwEAMb+W7op5ITd0r+ef45f8ABR79 kbxf4l1zw94Z8P61f+F7m3nljstc1XyyrSN5oEGPtBA81dwT5QueNua/WTxv/wAEJv2lfHt1ceI/ iFrPhEahcma7uLmZri7mk2AZVswlTjPyj0OBgV5un/BCSfRLSzj8SeL9GtRqsmxBZaOQkbeYVVQx eLbz6dV4r38hxvDmX0U8ZCo5pJ7yWyvdWT9Ua4rKsVWqJwqx17Wa7d/+HPw0+Jn/AAUx+GfiPw7p uj6L4C0dNUsFNumtSzTvdpZuUkWFj8qPsZeAAozzyeapeMP2wfBPj/wHB/wj+jadaz6xdNZX0EKB Gja725eQOXYsMHBB59af+11/wTg1D4N/GDXfDl/4htXTTb+WwjuZY/s/miCNHLgO+SMOO5rF/Z/+ COgeDvEWraHrWr21/HHoFnq0MixwqSZZD+7RpVk55zla/W/rfC88DQxmAi5cvvJXlr01uuja7anz f1DG4etUp1rdr6fLqfQP7HnhnxDqeoP4g8G28GpXmg3Es0lt9rhgZ5XjzFCC2GXcy4zzjk+1fS3x l8a/8FK7b4oeJtM1PTNAa+127hiaHV9VluorSC4t40htoLcZtREIyvBjySSWOSa/Xv8A4IrfA/4J eL7bxVN4y0u61lrVLUw20F1ITE0jSlt0duYQM7f489OO9fq54x/Yg/Yx/t65v7j4OJqkzXfnS38V oJYwzyHG6SS4VgwHXjjtX4Vm/G9eOZYjFKjTcF7qU4ty91J62kla7b2107a/f5ThMCsNTpS9pzbt pxUdbrTrt+J/H3/wSl/ad/aT8N/tg/D39lL4k6leah4b8PeNGex0FZYpo7bVZIbqz/0aWXBWL98w MasEbrgHmv7MLWP41eK/gtp+meKLayh8Xy3PmXdtrF/ZIkdvDeErukiWSMnydu0KhIPU55r+fv8A Z3/Zw+Cnhn/goP8ADzxD4Z8Pw2c8vj7UkmiiLSRGKKC6lVTFKXX5WjX/ADzX9bmhQWtreta2GntE QsgWKOGOJht5zhccV87mvFuGzzFLFYSl7JNpSVkrzjKSbSXMtWr331Ljhp5bF05NSt7yv2a2vp31 8zqvDWu3YZraBbCS1kRXeWOdpJlkTkqI0Qgrk9d30Fc3deDfF03gDW/Dk86X1zqNzdXVqLa2mUCO ZzIkOZ2AyOFDZC47CvT9EnuRZjEbfeG4s/IzzjHfHeusjuDM4kt5Idw+TfEwkKMc5B7Bh6Gv1fh/ LfrGGpwrVJWSsrJppSvs9F1dr9euh+e4vM5UazlTgt0+6bW1/wBbfcfzmft9fsCftKftYeJdD8R+ JvAOk65c2mmTWlyNV8QfYwmf3cBS3t0eJSiFxuHzHfnPFeCf8E4f+CdPxE/Zj/4KNab4p0vwpoXg zS7X4dXNjrtlY6nLqa3l9M64mVnCtG5G3OBgAY71/TZ47s51v7DSb6+1bNzcG3E9k0SSDMUs3z5Q /KAmBtGckdsmvy8i/aJ+GXwy/wCCj9j8FNR8SLJeap4XudzahOjSLdC4ghity21f3ru4UJjIzk8E V8NneVYnJ8TTo4etWlS9pyTU583u/HJtXtdWvzW06H1kc7WNwtR1aMIvlvHljbW9la+tvI/WOPwe kMA0RHgFs5MjxP50xycH78shPHHHT2rD8V+HYZbKLULm8KrZS+WpFvblk3gDKO0bNGQMYIIJrtJp hb3KbmJ3gbgzgffAxznj2r4O8PftOeFPE/xA8R/Du4jDWlpILSCYNvAnNxHBEPmPUEnOeQACM9vt eNM9wWB5cNUp8sqspxWr0cIc2tuifyuz5HKMNia7dRSuo2b0T3dn87fgXvG/hzwHFof9mapqt15F 1btJDHcXzxB2V0I3iIqwI3ZDeuB3r0LwV8CfgF4z+Htn4g1XwdZ6xNqNp/pN5qERvElGSMZuZGJD bQMAYJr598b3gk8LW8ziLdbaoiease12CSxEhmP3sH6V7X+x748vfFXw00nVNW1K4u7V7e4eCe6j FrGIo5gp3xoDEcfwuG6dutflnAk8NVzSrRxlGDi6StdKSTlZp+8rJ7q61V97Xa+2z+Felg1Uw9Rp qTvZtNpXVtLX9P8Ahj5F/al/Zn/Z80v4L67Po3wg0fRmaxbGpf2fpsW0BlOQYJHk5xxgflX3z4++ LXgL9nb4DJ8UfHTR6ZomkaNayXN1gKv+rjVEUICxLMQowDjOelfljofxNXU/2d/ilB4kh1nT2iaB LaPXLjUpTKx1XVQRbjUOPuBG2w8bXjHKCOv5vv8Ag4k/bH8VfFnxVZ/Dn4danrf/AAi/ha70TTLS aH7VbWH9orZTG9limhka2nV/3eGbbIMHZkb8e/wfkFGvnuJwmFrKLqUqdmkrJ80r6WteyV+u3Q8n PIYj6tB4i7VNyve+ukWt2+/poz90v2tf+Cy8H7Ov7UXh3xDqGh2niT4OC1t7mLxL4auBeX8mo6hY BhHEC6ROirOMr9/OOmcV8M/FX/g5gj8L/tCWun3vhqey+GGt6bd6ho+qXWnSPrSzwRmEWVzbiTy4 ytyrCZ1aQ7drDapIr+M/UPjfreq/BOw+GW+JU0G8u9St9XSWVb/9/t3W4LthodyIQAuVYdccV5NH 8X/i94uvtOum8TXTT+GdPuLLw9BLIN9vBdMzTxwELgFi7u249zj0r9vyTwX56NWONnvKfNZuF91C atzWb0un7qX2bo+QfFlGnKLp09UopXs7Wd2umj189dz7b+Kn/BR344eNfiPa/EbVoLSSK00yayh0 84mtZRJ5gF3NCwKecBIQTgDpxX576bPpfi5ryW/aKzvEgmvYgWRY7ibIIX5+FwMnAyWOAK3bbUND 8U+F9K0rV5YI7yyuPssR2GPdbSMS7SOCELITncRkjj+EZ+rfg58MfAOvaDf+Fp9Olu9I1CS7S18X Q2bXE0F1YIZViKRsSkTR5aVsdAMlV5r9N9lluQYZrD4V07Wj7q+zFvvvo27bvW2x8tj85xePnevU c9W9e7tf8kea6L8JPE2s/DE/EXxdeaHHp+mXMelxWcd3FHfhJUZ1uPIUcx7sAu3JzgDuOJ+Fv7PH jf4teID4Y8H3Gnn+0Jli+13btHHESSCWVVdyq+qqfpX298a/2VNb07XJPEngPw9u8JXNzb2sF1aW slpai2vFM1vFFO8jGaRoELM2Ww4ORxmv6F/+CV37JHwU+E3wvm8a+JPhxYan4otWbxbYar4jtzfX 8dnbM32dNPt9zQzvkbWUqCx+YDaQa/NM98cqOT4L6zTqe0nWklCCily311Tle63fe606npZHkFTE 4lUmrWWvQ+Yf+CIP7DfxC8D+MP2krXU00zV7/wALfCDUPD9pc6dIzRNf6i6gbd6hwpiSQEMgPUdQ cfg58YfD2peHPDWifCi+mlSbRdVvLq6la3EX2icy4JDNyVUqVByRxX9rvw4/4LC+A/hx8HPiB4C0 fw/a+EPin401O88S6NpOu6fBo+kf2H9gabzo5I9m9dlu8cKMoaSZwehYj+I34sfFnxp8fviDHqXi CR9Q1S+jjS1uthRrx5cuAiDq+5tnyjk4z619DwxWrYzHf2lVkuap7007LlcU6cWvWKcmul9L7r1s wr06NB4aC0TaXmnZvz3tbuf0jf8ABtv8WfD8f7UfiD4fRQn+2fGmn2Vo0t05eER6XHICsACkq5Ql iScfLiv6OP8AgoP/AMEufgp+2r4s8K+O/FtprYl+HunX0WhR6VeNbM9xJ+9RsD7zCaOMhs89+OK/ jK/4IMfFzw58G/8Agpn4IuvGZbSbe5vLrw/P9rJU213cQtAFlzjafN+Ugj5ScGv9ObVr7wfYR23h XUr+ztL/AFS0uP7KspZQs9x5S7naKMnc+zcCxGcA5NfDYvguTz7MJYau6TShPmbS91xUeVS3Sk4W etnZR6no0OIqlKlSjOHOndWtpu2211avddtz/MS/bN/ZW8Pfs7eILjwt8ZdGbXtduLma91CdruVb XT76SNzHAZrcnzZkHzHc2C7YI617B8KfhZpn7WP7O2s6T4s0+e70vRJ7bVTabz5st3HCY0YOCvY7 eTyD04rlv+C9Hxq+IXw4+OT/AAm0XU3bSvDniecSRStC73+praW76gbry3ZnjzKiIXwVO9UwBgfk n4N/4KO/EjwZ4csfDfhzTLe2JvA+tIs0htL+3XISMRf8s2RDt3ZbOM9aijwBxDm+SYTGYeXLWjJy Tc2uRJ7W0UZNJJ8uz9Ln1VXiXLcvx9XD1FeFrOyXvNrvu1q7X6H7g/G6H9mX4Z/six+CvijpzXOs 6lCLfTdImaV7XTIYmykNuN5Z3wAXkY4HQHtX89viXUtI0/TbjR/DkaQWssy4hiHAXeGA557etfR/ 7TNzo8ngy1+Iln4oTV4buWJ49OaR5bmBJ1MmXUuwiUAfKudxHNfDcmr2+pmKa3y0UpVlVh/TP9a/ R/CDg54TBSrSrSqOc3KV7pKV+kXt6637ng8YZ/GvWhThTUVGKStu15tHbR3TR/eOBjjOKS2v5Eum YN95Q2OB0rkvE2pLolgLuJF5IA47n2q9o0w1DT4b3gGSMv0GMjNfurpe7zW30Pjva2lyLc7WO+YL taVOf7pA4+tS3F5tiyGUhWD5G3PH45rjtMuTPqKwXKIylGbZx1A4rH8d61JpPlf2fGBv4IQA46+x rGGH5pqKNJ4rlg5vZHt1rqaFBIWjPAPJXPH411FrqmnNgSGAnHJyuc/nXmem3UB8MxTMI1ka1Vix wDuxn061y/w18Tzalr99DqTFIkQ+UJsBSd+OOOeK4fqblGcl9k6Y43llBP7R9Gw6ho2MSG2OMjAK 9u/atq31vSMKkb2xwR3U4FfMvxP8RajYT28WgtNJ5vEn2UnjHrtzXuwurV9KMivhhCPuqxbJX2HU 1yVsJywjN/aO6njOacoJbDPHPiLwzEtlJdQWUyrcknzIhIuNjZ4APev2K/4JmfHX9h34Ufs/eNdV /aB0Xwzdai3iEPoTap4cuNRMam0KqIrhbSVVBlI/duy5PPvX8/8A4PsfiFr76j9qsNSvESXzisgO FhG5QwLYwMuv6V93/s6ya0Ph2dMn8N2GpvLM1rayahqNpb3AcxgDy45W3YJ2nIHpzXi8U5dTeGdO Utmtml59bndkeOqPFRqxVt+j7W6H7yf8E4tR0CD4WSw+NpLTQrs69qWs2wmkjtRLDfuj28kcYP7t QFPyMqlRjIHFfph43+P/AMIvBPhe88VaxrsBGn2Mt0Lawngubm5EY3YgjVwZHPRRgCvxt+Angz4B WXhu1/4THS/BEOpNDELuKWe1mYSBQH3lj13dvWrn7cus/DD4Zfsj61f/AA38FeCteje3uLLVJraK 3luLCCdCEnQQsJARIVJcH5MDg1+E/wBmU8VmCparnl5Ld+v3dz9Zo46VLDc7kvdV9te58dfHf/g4 B+ISavqGn/Bbw7pllo72t5pWlSXksjajA2fkvbhCPLEhzxECUAGDk81+Jnxl/bX+Mfxt8LaV4Y8f yW850a4lksL4R7bgQzRiNonfOXBAHLc9fWvku+uBJOZ2iUKzbgm48DPQHrjtWdeahPdO292cOBzI dxAXoM+2K/qrKOD8uwfL7Girrr12t+R/N+ZcV47EOXPWdn06f1oj0iC+0+/txJ5p83YGKYyGOcYz +tJcWbJEGyqoeeR69q5Dw/zfJbvlQw68nd6D6mu01f7Alv8AuvPjcTAFGHybccnOc53e1e648skk eVSqqUG30GCxRADE481GMhUHBCrjGPfNe4/DL47+P/DEEvhfTy+oxXq+SkLbjcI5YsvkyL86tkno ec8g14QTHP5SszjDfvXzztJ68+gFZNrq15YarbvpT7pjKjR+quW4P1HWuDM8rpYuk6daClbXXy2M qy6xP6YP2PdVvPBXwoj1z463l1v1SZzqEGsTCOOzs4sFJHuWOVyQMRseE6jOK+Z/2k/+CmfgXw9P qui/BmwsdZ1yQf2bF4ig8xdNisFYP5SK2x5mDDqAqYJHzA18J/E7xPovijTba5+L/izUtRkjhUJp FvKu1NvHMMQ2bjjq5zXyhrviT4dwM0XhzSWjj/hnvZTJKfogIUfjmvwbhnwjwWKx08wzGEqkpO/K ly01r5tOSXpZ21ud1TBezprmqLXpe7/BfnYk+I/xl+J3xgu57nxtq9zdxSXsuoLpysY7KOec7pGi tkxGuTzwOteYG0cf65gOemeamn162YlbZEjHoOW59+34VU+17/mVJGPspP0r+kKOEpUIKlQioxXR KyOKMU3dlpUROVHToakLBQS355qKFr2U4jtbk5HaNj/SraaT4huMPFp142DxiNh1+oFDqRT95mvJ Jr3IlRndATKQvPA706JpNuZep54/StH/AIRjxfIQw0u63c7d6/ryauJ4O8cy8jTJV+pX9eaeIxlD Tlkl80OlhK73i38mYwIz0/8A10/c3t/n8a6KP4fePpyALNF7/vHUVa/4Vr8Qf+fa2/7+CuV4/Dre ovvRt9Qr/wDPt/cz/9T+bz9kXQfCHhTQLcNqwPiPWyztZLw0UUWSEZDweFyxP061+ifhrUGimSDW Iv3edvnxAlT/ALy9V9+o96/Cn4d+JNBs/iRoniHTIp0aGS3+2IXJaefP7wgjJ+Y9u5r+iTwHp3he 9u4ZL+Rolfa5yfmXI5HtitKPEUPqs4KLXJ2/P1Z93gcmdStCpdau3ke1eG/2etX8WW1tr/heP7TF vVn2DdgHrj0xXunxc/ZO8YQ22jw6RaSSNeQ7iY1yqhcbmbHQDvX7G/8ABLz4U/BzxpcQ6MJLqcuV lmjC7VcoCQGPocV+wf7Tvwb+E2ifCy71K0s4tKlit3gjnskAbYwJIweD69K/kXP/ABb4vjXxWaYP D03hMFLlm51HGpLmsvdhyNPl5k/enHm2jqfuOJybIMHiMPlFaE3UxCi7xS5VfbW93d722P4MvHng y18BA6PIAZkGJZD03d8V8+XlwpJCHJzgHpjHvX6IftGeC/Aw8RXU+l6hLdgO4RnwTnJ4IB//AFV8 LatplnC5jifcPbtz/Ov674B4njjcJTrybcpK7urbn43xvw88NiZ0opKK2s7nAuZSc57Hnp+gpqu6 ZIAI9v0/z/OteazCk7cY/P8Awqn5K7R94Hp0x+Ffp9PHXR+YVcHYpHeB147A96mTd3PYZNT+Wc5b jPGfp27UqqUZgoI7EHvXWq7tucjw9ugyNxu+YnGPUkcGrsTliOcDPINRLFGeOTxnjP8AXNSKoLHB J9iMf5/Kqda+txOguxMMk4yc/wCfU1YiJGB29fQ+vNUkUE4J/HHGfz+lXogF2qx+91z7+tDq3Rks OizsUrn7vOMHvXOW3iyxm8XN4PgSd5YrRruWfyyIAFYAIH6FznOB0HJrpgAM5ye+K8t1r4y/CTQd Yk03X/FOi2d5ZSeTNYz3H75WkXJ4xtG3Azkg8jGaznieWzcrFxpU1dSX4/1c9cQvlc/dPXjvU6oC Ny9CM4xjHevHIvj98EpCHj8V+H+eRm8jH6E1swfG34NSKCvinQGYnnF9Ac+/3qTxsHrzIxVNbNnq EbOQMHqOQO1SLHk5IP0FedJ8YfhOQGTxLoTZOABew9un8XFakPxR+GkvMfiHRSOv/H7Dz9PmqvrK 6MlU49WdFrOqaX4d02bV9cnjtrSABpppDhUUkAEn6kCvy1/aa/bFuV1jU/BHwxutP1LR9S0VLOe8 RpC0Uzs3mNEQV2yAYG7kYxX6h6n8C/Gv7X3gjVvhT8HFtLybU7RUbVpZ1TT7VRIG3PKD87ZXiOPc xOM4HNct4p/4Iu/BP4BfCuTxP8Z/Fd3rWvoS8tjp7JBbRoo+ZBk4jYNxmV8noBnivxLxD8bMnyiv HAVMSnUdrxj70lfo+i+bTP0PhvwwzHMqTxUaXLTXWWifp1fyVvM/nHju2lj/AHshJfBbLdcdM+uK RpUAyH4rvvif4c8LaZ4v1DTfDlkbSztblooULtKxRejF2PJPsMV5sdLt2wyhiDzwSOtGHxEa1ONV Jq+vmc1WjKnLkdtC7lNvJB7H8ao3oEUA8otksMkMaY9haggIWBzjljXoHwv+HmifEPxK3h/V/EOj +HEFu00d9rszwWzyAhRF5iJJtZs5yRjANVWxUKMHUlJ2Wu36ImFCVSSgkrs85s55zLtdnI5PLEjO K6DS9V1ncWN/eRKgDYSVwT7DBr6U+Fv7FXx7+NOsazpvwU8P6h43TQ5RHd3PhOJ7yEKxISUFlRzG +DtOwZ9q9gX/AIJhft4IjAfCH4ikqcKqaLcOWHqMIa+fxnHOV0ajp1MZCMla6c4prtdN3PcwPB2Y VoRqxwspRezUW18mlY+Ml8W+K5/Mtk1PVVgkUo8P2uYq6nqGBbkHuK7T4f8Aif4g+EL1pPBOralp 32llMyWNxLAJCucbtjLnGTjPSvp5f+CcX7cWnTDz/hH8SlUj7/8Awjl8wz6cRVTvfgR+0R8Fry1v PiF4D8W6LvkYQf21ot1aLIVGWwZY1B45OOnevncy47w0oN4XFQnKzsudf5n02WcGVoy5sRh5QjfV 8jP0h/ZP+AfxO/bft7bRbLUtSn1vSLmC/tbPUrq4mR3RvleMMxBYGv3U/aR+Anx/+E+nL4v8Y+Fd Nh0jT9NjuL64nlnhd5fLBZVBQjqMmvEP+CDX7Sdr4X+KekR+MBpdnbTahDawIYY1neaVtmAxGeM/ hX9cf/BSn4teCPDX7J3xCsL+aykvdLs7MPaX8YdHe5kjaNBuBBLA9ua/hXE8d8WKpn2b0s/WD+py UadGUYzVZypymoRqylG05ckowSjNxa2lol/SuZYPK8LiMmyp5TGvTxUYuVS8otNzUG+WOiUeaLlf e62uf5y/jX/gpb/ZPif+zbjwdGNPin2XEtleM0ixg4ZkV4wGOOcEjPr0r54tdR0Dx5401rxZBrK2 VlqWpXE8EbW0sk/lyLuVtqjOQD0z1rmv2htbufiF41u3tLKztZXlcrBbWu1WJ5wvlg5PtWl+zZrF 3p2qvp+u3CWjRRxs/wBthcFAMjOwlCBjGc4PTmv7y8N+PcZj8tgsZpLlTeqb6deWz+4/nvjHhPC4 bMJzw8rxu0tGl+fl3P1w/ZV+C3wv1ZIbvUtR+JXiLZZ2bR2WjaCVjLq6nmS4lZGPsFA/Gv2I+HX7 Kvg6x8Wxa/Y/Dbx9cyvdXF35fiG5sNOgaXA3O8cCg7SADsfJA7Yrx/8AYD8V6TeWNppq+J9Uu0a0 ZDZ6bpjSchwwR/3UpBJ+62Qa/eoaTp8lslzbweMbkSyi5eN0NpHl4yhG5xDtbB7kE96/Tp5/Uc3T lezTW7WlrdFFHyGYUVTtKCX3f8P+Z9P/ALP/AMP/AIc6H4H07Ur3wp4b0zWpIXNz/ZmmQNI+1yEL zJCpkfZjc2OTz712fxr+OHhf4J+ANZ8X3628TaPo93rIs7x47JZIrRd2TvG5UYnaWCkZIHcV6T8I V3eBNMhRZIUEbhY5H3svznqwLDP0NfwXf8HWg+IHh/8Aa20bVrfUtUuNF1nQIxAJEkisIDZrskso nU4lJdvNk6YLqCOK/jDifKK0q0MNh6kYOvUcE2vh92Um7X95+7ZaLz7HqYavTqVJzrRclBX331S+ W992fiT+3B+2/wCIf2rvjF4h8Q6lr/ia68My6vdXukWGu6hNqAhhnnd41CO5VRHGwUJuI4yPSvJf hT+2n+1T8FfC2rfC74DeNte0Xw7eGK71rTtGuZLbzgqgFlKMCnyqFO1wSOPWvly50zw6LPydWvxF emQJdacEX5F2FkcSblUDnBDEc+o5rnNO0SbSJ4NSS4khtrtPOt7maFwkhUkbOeGC45IJGeM5r7rL ODcppYNYSFFOEbWjKN4tr7Wq1ejd/mtjir5riJVefms31Ttp29NtD+nv9k7/AIL0ftFeHL7S/h78 ZtUmuvC8sSWt9rcFquoapBK0ChpxBMzGQSMjCVQ6gO5kGGGD9P8Awo/4OLPB3hz46W3wl17SY7P4 ez6tqX9oeKr3c+oOl2ZJUuDA4Ko4kYI6MHB5IOeK/lw8IeJdT8MX1pZ3aQB5jObW8jXZcSRhWzIC DtCxhm9S3TtmvK/iL8P9L0DX2a11mOYCMyXSTAPPbz+YFCNsZgQwbcrKSMAkjjFflVXwjyLMcbUp 4mm4KUGocjdr6+8rbNdL6X05bo+spcYY7D0YunaVneXMlrto7/prvrY/rb+DH/BwdpfxV/a2034P +LLGOz8EXGp3Gm2Xiue6S1vGLE+RJdrHGtu0DNgABU2/K+cgg/qH+2h8efC/wK+HFnr9oVur7xTd 2txbWWt69Mi2iELNJcp5cjMyRKCwihKoTk5Aya/z+PhT8EpfitruoafoF6saaZBHe3M0kbsoga5i t3nLD/lnF5oeT+IKMgcHH6vfA34s/s0XPxE1zQf2kLDXb7R/BfhS00Lwhd200c97azWhLSJFBIQG +0DcFbY4iU/MMZNfjfix4GZRQxNKWSuo3RinUgryk7NcrV5R1k5ptLZJtK+j+64R8RMfUoyoV3GD qN8s3ZJLW6sl05WlfXVa22+Tf2+Pjj8WPjX8W5Pizql1CLeAmHStQt7kyD7OpwFjCkBI9+9kTGQW IJOM18peBNWfW7yN9WurSLdH5rGWRcylsg4zyDx93ParXxi8Rv498V3niJLBrM3d1cOthcOxjjil ctFHF64DHnv1rwzwx4c0gRTS6rLD5LzRpbo7EhpFcZOBztAOM1/XHCnCuHw2RUsJZQdOKiuWN2l2 317323aSPwbOcbOtjKlWUnLmbbb6+Z/RX+wn8Mf2M/E9j/wjXxa1a4Hi7WYbtoEtZTax21vZxyTS xTSSkRlbiFSFMZyGAGGyVPlFrq2keFrfVfgvoGsWHhvRbe+F1pmo61KoZLKcRTfZp5QrI8QljSQM oJ+UAdzX52a++v2ujP4p8PabutFaCOW+jbbHbOwKxLt5bJCZB9vevsb4K/CLwn8d9OuvC980/wDa 72kt1eX8s8KabGhhXy/N84LsPmsqnDg4zgFiK/A8yyeOA+sZji8VKdObTalyvkceqWySTsk7vW+t z9Ay3O606FOhQoxjKOzWnOn0fVttf1Y868N67f8Axm/Zx8XeDPEHj3Fn4d1ptU06GXUI7cywSny7 mRLZ/wB4/mKEPyK7ZB7E18t+NfAtv8L9H0PVbG/S/k1dGv4tc8siAtCf9W0EoO9w+CGk6Efdxg1+ wXwM/wCCc/jH4c+BE+Mviez057O4urrTmS5MZt7byUEWxknC7icl4xuzux0PA+MvG/g/9nXwJ4ym /wCET8WahfaUUl1DTLTXYo9tmLSXHl27yuyTxyMwJXETDa3UAV7/AAx4mZfVxuMoZXOVSEZczUYq zk4pON4rR3XPrpJX02PPzPA15UoVMVDkkkldvW2rT1eqtp5aHyH4J+GmleJfjfongz4h6zqE9vrG pW0u3SI1eZ7i9li3eXExEJZ9x4wFO0L6Yl+NHxDXUL+/8DeOYbWa48O31zaWV48LRXlxtEdt5FwF JGbfydyYbG4tktu4+6vhb4J/Zu8R/HXQrjxdr+iPoWv35g1bUbWCGaOy1IgzQxrCWaOP7RjYSW2B geVUkj8zv2qPEOm+JPjZrVp4cminsYdRmEMlrGio0oCpJ5exn/dEoNg3kKOPUn9E4Rz+WbZvDD1a Ul7OlzXceVJ8zi+XTd2aa00Sl2PBx0I0MJaLV3JrTW6st9enQ9B+GuveA7Pxtoeo+CvDbeKprOSO e70nWpZLa3upUjOYnMLkeRDLhwcb5BkZXIFbHxD/AGm/jJrjtb3sunaa2i62U0/RtNf/AIl1nFaK IVgjsCjxzoFTZ5kjNJIuNxc8148/ib4XeDPhnpl54H1HV08W3DzJrcTYjhSIMpiMLoFZWbkOp3fd DBudo+hfDPw+8UfHW2g1DwT4b8S6dY67LZGN4r1HsLpLOZLVpw86JJJJDeSqCI36MVLAgtX0OYfV KNR47HUbU4txUqmmzd3aTtZq7Vo3aWrtY5sJOrNeyoy13tH/AIC6eb0voeueOP8Agpb+0B478X+G /HUNn4P8Oa74deF7HxB4ZhbRbp4dMto40tlkO5YywUbti7pSMPnCiu/8Aft5DSNUn+LuuXmr6j4j bU7vWbq5sJhZj7TIrb1jUxmGKN0LBjCys4YqY+BXiv7eXxK+F/xA1bQ4NP8ACf8AYWueHbFdBv8A WtGj/wBB16PT4Y7dbmWPaF84vGXlZC24yHcxwCfzvtPEd7aWqeRHJ9nhlM2CGEWZQBggEKM4OO5r wsq8P8ozbLadV4D2PMmnFNapt6cyveMtHZW80tl61fiHFYTESjGvz22fy3s+v3+rP9Aj/gkL+3pP /wAFC/gH4s+HvjvV7+z8R2OiXGlXMulkWd/a2Mwt1t5ba7jyzSgLITKVVwwHy42k/wA9X/Bb/wDY C/4U98YvEPxvg8Y3WrDUL5JZLLxTfi61aQARxj94zeZIu3GCw3H6DNeTf8E6f+Ch03wg+NNnH8e/ DPhvUfDGoRGO71gJ9k1KzTfCv2i3ezA89kWML9nZdshz/Hk19r/tj/Bj9jf/AIKK/Eq9/a4+DfjC +sNNj1C6h8dDXHImja0tvO81BJOyRLJFEY4RGpTcwyDzj8n4W4XxPCvFmIxkovD4WUYpcq9pGzv7 nNo1drR8t1orO7Z9pmWPpZpllOjGXPV1b5vdelve69POz1fkfzlfEbwvcaT8H/C/ijRra1/svWLi 7Se5SNTc2+oWhAe3lmXnDo4kVG5wM8dK+dxujbPJ9ccV9P8Axejm0LRP+EWuNeW802z1SabTtENx 9oaJ7ndvniljLwyRfIoJ3hjkMAQTXzGGaVkVDjBwD2+pzX9qZNUbo3bvdt38m7r5pH4rjo8tSxqw SXVtex3FkZIiCHhGScYORzxX2Z8F/jr/AMIDoOua7qU0e9oFW3s0Tb5lyDx5YUjCDGXOPXrXxOjj /VyEHjGScYzxyfSt/RtD1DxBcC3tSMRDcZHOxFX+8S2AAf1rhz3KcPjKTp4n4dL+l7/idmS5vXwt ZTw797p6tW2Pb/Avji58UeKm0pLeK0TUZGLtEkrqQxLktFGQXwRwTyByTxmvsvxD8HrS/wDDh8US +bE1npEYm3RLHAzM/wC5ELEkM0x6uSSpzyeo/PPwv/amm67ptzpsxF9LebYwpUDduAXa43dewI4P Y1s+O/iJ46vZ5fD97qN3LaI+BayswWNg5kw4Kp8ytnJKjnpxXzGZ5DVq42k8JUUIpa7tvXUyhjY2 n7ZXb/pP7z608OaD4l+GGuWdzrL3WlyS6jHDpr26I2ox3TBWAjkj+YqVKruyeGOO4r9ofhX+2F8P PgyNT8PeOrm81e4n0JYTa6dbm5upLqJfkE842IJSzHPQcEmvwT+G37THiTwn4otdUvimqSLBFa3d zNYRXU5iiYFUiefHlt28wEn8q/Sj4e/tY/s3+EPAD6zqXwr0LVvFdzqX2O0fVr+a5nvDcNuWT7Ki gJ5WQAUOGJAK9TX4x4q8Izx2GdDHYWVVTtG1Nxju97ys0lZXtd9dNT9t8NOL8Ll9SValivZPtOMp Wttbl3bv1SS8z9hv2Gv+Cjnhj4ZeLb7Vdc8H6+bb/hDI9D01Ip7Vpp74MGJkQSZij4xu+Y/7Ne2f Ff8Aab/ak+LPjK/+MPgrw1o+neGNIsodRbTb2wvdRuJYbDbPOJZj5EKiVUKfcbaDnk15l8N/2mf2 gPhv8NJrH4sy/Dn4Tzf2dBc+EtKn8NWcN1qjTO8Sm4ZwJUw6gFvlwM5xgV8TeEP+Ckv/AAUK/aZ1 /UfgZ4f1XTprrW7G/wBN0mw0DSrIG8eOGTfHCZUZmMkattIIJ4xzX83VuE3j6k1luXU3TotXdScp K+rbj7slK13d3010Vj9exPHWFwsvaYjETc5pr3Vy6efw26fhqf1k/wDBMP8Ab0P7eWn+K4tS8GXn heXR4bS7gtNSjVgbDUVcWxWXA37lQsDtC7SMGv8AMt+I2owXXxd11IFMTxa7eQlmClQUndQTnPTF f6X/AOy18aP2Wv2M/wBjXRvir8YLm30bxpF8NtIh8a21y7fb1tdHiaKDzLPLMHhVsFVTc2RkV/Ch 8ZP2q/2b/H3/AAUj1r4lNpD6J8JW8Z3GvRWmh6fbHU7y38opFGiurRR+a/O0ghN2SCRX9CeHc6dJ 1o4ODqcsLuzb5X0jdp3k+2rW7sfzTxBUnV5ZVpWTlpdb93bt+Z8M+KJtJutB0Ow0352FtNazRHcY 0lilLMw3cjzC+7A4H1ya9w+Cn7F/x3/aAuv7N+C3hDX9buWmRI/7Gs5LlQ+M7WYZAPB6kcZr0/wr a+NPG3hO58SfDWwmS1tri7/tm2vljkDWc0ourNyDEuyMC42naRywIOGAH9of/Buj+zj8TPhv8P8A xD8TPGWlXvh/SL+O0sdJtNQk/wBI1CeNC0l2YikbRokZCoCuTkncy7cdlfPcUq1PB4Z2k5a3d7K9 22tNltvf5nm06OjrVNkvT0tufgT8Af8AgnN/wUY+Bln4p1Dx38BovELa5oMVhpK+ObSwvbfTZVdg 11F5pYRSHIznoMZFfNq/8EBf+CjHx/8AFP8AwkPiGz8EeHVlGwJJcxQRRrycLDYwsoA9hmv9Iz42 eN9L8LeGvsd/JEp1BxZIJXVAZJ/3cafMerMwAHJJ4FfC/i8a/wDDv4YazrmnyxWl/Z6ZLe2806LI iOgyu9W4wT1B+uR1r8c488VM3yLOKkMsqQd4rnlyNuNloleTjqtXpvufsfDWWYXM8sj9cpu6l7q5 tJXeraSUtH5+h/A7+1D/AMEQfit+xp4GHiT4leJPBdqYj5dxrTaqsP2hbgZMdraTFZGZEDLyo3HJ XtX5g+Gr74j/ABCk0n4WfC/Sbe5kt1aytn06yMdzcxXLiNkuACwCFm+YsOc5Jxiv1c/b01D46eIf 2wNR0z9o64n8T+IdKu0vfEVn9ueO3g0uzVJFjtyNsY8yJhxGOP1r7WtfiZ4O1C11fwP/AME2NU0f w1oPizSoPti64tpaavpWrCaBrqC0urj/AEifzGlUY3bdrOA2xePo8P4lZlRwlKvmP+1VKj54ykuW nTT097lUns24q0U0mo20Pip8NYLFYmdOi/ZKGjitZSf927SsnZPVtbs/mj+OHwuvvhb4gbwbrBkj 1qBfM1G2jgiFskm4h1inidlcJwCcAA8ckGve/wDgnz+0HP8Aso/tPeG/jHbeTLY2cgtdbaeVwn2O 5/dT4EWGOxWLbeQfQg4rz79oO28VD4yaj4HtdT8Nav8A2Hdf2NFeeGXYaVJPCQkpgM+1h5koZndg FLk44xXpf7FH7PGnftL/ABv0jwT4t1mLSJtc1x9GvktbIztYWkMO6W9cNst3jj6lVkMnyltpU5r9 6x+Ipz4eqf2nLmjKm3Nq97NdFa601V9n3Z8NRoVKeZJYRWcZaX8n17/qftV+2r4Nbwr4Q0+8+Fi6 l4o8MeHtMlubS/tNS0+Sx/02V/38sFpH5k8jJGqFZ1yrLkBVOa+XP2Nv26tQ+APh66+F3ji91qaC PVIruwt7G2td8KMC9xDI93lAkhxwiblxgOM4rif+ChXxAl/Zy+LWpfsneBY9Z0nTdP0zSLXVILm7 jZbqGC2ifyyYGaOSGTZGy871UiNiSua8eg0n4MfEQ2vjrU7238G2mpCGyFvp6S3aidAQ8kyliyLI c8kk8fKuBz+G5LlX1XKaUsxpTqUqvvRkk5S7xbScneV5P3F0d99fsOJc2cswk6doyjo0rWvs1t00 3v5H9BXw6/4KFfBK91l9etZ/FEpurWGx8ppZVtYlVR81ssEKlHJGd5ctzjpX61/s+/tP/BXx2dH8 H6Vdzy6zdRvNpkmr/anlSeLcGV55btTNIR8yB1PX8K/kRi+BeseBtZbU/BMk3iTwtDpraoNQ0wPK sVqjpD5s+0bVDOcKQTkdQGyB3Xwk/a1+G2s+Ko/DmgRajHqlhexyWbR20yfZjvQiZSwDt8y7eg65 6c1x1+HaeKwyxWVylKFk3tomtOZWumuz1Oeni5wkvbaX2+7pbe5/bw/7MfwZ8Xm48c+L9Y1pdd1C 3eGW206VLWMIU5IEcbOGKZyfNyce+K8K13/gnf8Ass6rp9toPg+/8ZJFFewapIDqN1EBJYZkgxuA B2sM4HI7EV4F4G/4LSfA3wz47g/Z98c2hs/7K0iwm8YeMJry3ubUXdxbCRYbG1sTNPPM8jqhjC71 YtuQBSa/bPx14l8M+I9I0XVPDl1DcRzWTTL5Y2SBZIcpuQhWUn0cAj0rgeQYeWBqV5U4xnGMH1Un d3utdXrd6aeRqs6xPOqUZtrbo0l228v+HO20Dw/4caC1hkEk4RPmWZppiMAdDIzDv6V18dloltbf 6PZID5nLLEi4XsDkD0r8u/2iv+Cnv7MX7Jeo+MtA8eeIbNdd8KeFY/EZ0iW5VTNI4229opZwEuJz yqcbly2a/G3wH/wdvfsz6r4js9F+IngPXdO0i8kla91PTZ1uri0MaKYR9ndY1lEj7gxWQbRjhjX3 +S4CtWoOVGi5cq3UW/s3X3+SPCxdSFN2cz+tzULxoFneBI7Ux2zSLJOu9YwqE5KIQSMdRuBxX87X /BSj4+eGfhl8QPCWo+OfHOh6BBrCX1vba5cWb/Z3iWTeEWFpS2R5ZyxbBPHGRX6Ofsp/8FI/2W/2 7/hvqPjT4QeIrTTVWO4064tPEFxb2l1buyiKOR4xIxKM0i4K55IU4biv4Sv+Cw/iP40fHH9rGD4H fEl9LsNc8DWo8PI0UksdlNby3TSQ3cKyyvKzXiyo+1VPHsua5MZkdPNa8cPUqOMIyk5Oyuklpo13 fVM6KGJdGnKpGPNt/Wmv4n7lfCjRLrXf2tvCuty6naa5LLp0t1ZapbQrHBJaPvZJYgjNuQg5B3c5 zX9OXwe8DwaTC5uJldjKkhljjVPMK/MFIPPr71/MR/wTO8WfBfX/AI++Bfhd8Mtfs9bbwZ8NZdA1 e48maNYL+2Yqy5dV3opcIHRcMRhelf07eGrXS/B/hy009b5Z102c3LtDA4aX73yqCeOHPNfjuW5N Gji5VcTBtR2T93T3t1p3Xbr3Pp6eI9tScaatd9Nfx9TsNS0jw8fHWqG1urh9QjsJZJbeW6lljjik wFZYWcogypHCivgT4oweBNa+J3grQfFNjbX2pzzPDpsk0HmhZY5/NBDAYQgKSCcfnX0P4p+J/hrw 94g1bxpDHqtxeanZ/wBnJCfLASNTuUKgOeCxOTknNfBnxU+MHgyz8Y+H/GepaBc/bPD7qYvPuTHm VmP7xY1UgkAkZJ6E14/FmKpYiTjSj1d130sv8/06H2WQZbUotSqp7JL16/ifEv8AwUF/Zi8DXfjS +8f+M7rTo1l169islv0Uo0r20JC73IUEBWODnpnFfjR4Z/Zs1bwH+0H8Qo9ajgEOmeALe8jt7xDI SrOzIY9vCldmdxwMfWv2f/bI/a1+Bt3oWq+IPizpumNo9lqDaiX1Fg0MMkscaEZLrljjaDjPJHfn +ZD9lv8AbFh+J/xP+J58Z2bXtr4quLj/AIRmWVpVhtIY55pltQfMDMhjI2ISfyr0+BstzCWAxeIp QfsqWjvs1Kaa5dtYpNtb2Z2cSVcPCeGo1rc8/wD5FrXybaS8z+of/gjJ4reP4YeMtW0pZ0uE1bTr ST7CrW8hUyybyZLfc7qF7EDjg8V+kvxu8Xaxpn7Z3hbSbO11B9Ka0tzfX8E2pJZxyNfOQksdvMlm zbDn99E5x1O3ivz/AP8Aggp4U8UeG9G+Imsiwt9Ptb290uKArH80xRJ5HdixIz8w6V+yGv694yiv po7a7fy3uiQeQBufn6cVGdY/6vGc6MbpuSWmmsbN79/y6nNlOWOrU5JpXUe9t9uj2t87n87nwe1q 3sf27PBEUsgOzxr4gIVCcgrYX2MkYIOenfNfuLYa14gufglor3Om3kt/cSDzLCZbqeZSs8hJcyzC YkDBy8h69CMCv5XP2a/iP4pj/wCCqvhyG8v726soviDrMFvbliyQvPHdR+YvcFd3rwK/q+1nxRqp +eO+nV/LweOSO3OOma+Eq5ZVyqMaLkm3ef8A4FOTXVar+mfU08L9anzW+G0d+yt2fU+utD1eS48a Iq2U3kpZMDemL5d5IYJvPOSOw4z713nhl9StI7h9Si8l3vZpItxQDymJKsdgXt14J9z1r4q+EnxJ 0zXNf1DwxHqX2nUNKa3N/aHJeAXSs8JcjgF1ViB1wORWrcftufsraT8fLr9mfVvF+mL4v03Q7rxF q2liQH7DZ2kMczm5cHajtFIHSPlmCtwMV+z8GZzVqUoyTtZr08r/ANI/LuJsm9hUdPdNLo+l9j3v 4uat9p1DTryHWLXTrnT7j7c0n2N72KQeTNCU2b4yBtlJzuzkD3r/ADkP25P20RH/AMFYfHnxp8Ka pZ+IIdPklt9O1edbjTI7b7EYmUxbCsgZZQyDO5mHAYna1f3O/t5/GfwX8Mv2XvFfxtmuFOljw9s0 y7j3Ynl1NBBaBR9753lXGQMZ7ckf5ZPx6a11X4q+I7yy1G4u4bIJplvNrMTx3cyW6ogOwNJtIIZY 8sRtXJOcCv07gHLnmuOx/wBc1hJO27Tbsm/ut236nkZ21g8DhnSfvX8rq1301+8/vp/Z7/4KUePv Hen+GVvYPJvtV8L2vhW91N5VvLOz8R6RZR3MEd1InCxXcUrCRm+UTAjlgQfmf4x/F74g/BLwlqfx s0C50rxTf22lR6HqMGm38sOoQ6jfxaexmiZAqTuhs9sp/wBYFOAQN2f55P8Agl18Sr34mfGLw1+z evim48P3OsaPqWkaTqtowsJbXVHh8+zMswLh0W5iVGUof3bMcAk195ftGeK/j7+zN8ePEv8Aws22 k8Q6df6boV5qUT2Md/pE2qxTS2pu7vaiC3a8t7WUJIQCVbeucA1/F3F3htmOC4q+o/WedwvWVObn 76lV5XZu/LeN1o/srTVt9uCz5VMP7RKy2uull5dv8z+lb9mH4vP8Tfgj4Z8b+M/Df2C48R202tzW Vxey3Ly2UzG4V5AVSKNnjUMyoDjGA3WvIvFn7VPjjWP2FPiV4W/Z4nuhq1z4nuvDXh6ZzJDY26Wq xC7jtHCgiKPzdu2PcA5I3EnA8Y/Zp1zxZ46/ZO/4SnUJrSC+vtHupoNP08TNbaRCbfyrS1iEojd1 hjZNx/i5O45zXmWv2V78LP2cvg7qNj4lsta03RtPvHi0iSKPTbW6ubqQxRiOaSRpI4iEXacjzPNL SYJxXkcTZm8tw9WeGtGrKfJFdGrSvB91JLk+JaPmbsmz9CzinFYOk5LmTs79b912et/wPm39tX45 /HLxf/wSo07xn8SvjSdf+IsV3ZW0/hS+ez0u4064nupLKGSKGGGO4laWN8lp3AWMguCVzX8qXx3/ AGj/AIu/GebRtDuY9L06z0OwttOg0Lw3CYdNeTTo9rXU0TPIs1y/LyzOTuYnGBxX6I/tJ/EbxXq/ gnSF1DUfDOqaXqXxCbxv4ia3tJp763utPjEVlbXx8gMlsq73jSEtHNg8fLx+MWueOPEcltfyWEtq sU806308SiOS4F5IXZSuQcZX+AfKOOAa/wBBPBbhyP1NYqrSjKq23dr4b6cq0WitdLTR6Wu7fifF mOdoUoNxVrWXXrd2dr66vy1OBvrK/eC61O6LMsUqo3zLkyS5bkZzjAJyARnitbwrbSaxrEQsRBDL HGSn2gxmF2APDh8LtIz1z+dcuLZJlE9pHIFVFErOQRuPXB4wDjgHn612en+FdJvPD0usXtw8brcJ AsITPyEElwc87SAMYyc+1f0TiqqhC0nvptffyPz1ay2PVPgVpGhah8QtOg8fw2C6Ve3K27XN8zRQ RkttDEqVAXcQCWIAHUjrX9UXwB/Yi8Lfs1fGzV9AuLjQtd8OeOPB+tp4BdLqHy7jxKtolm9rBJKy 291iS4kQMARI0aAkDFfyZ+A9M8JX86NfyXsaxTmUqQHQpH9xRg7g7d+MdOR1r+oT/gmF8EPF37aN 3ovhrTdX0rxRB4K0q70HSvDHjG7WJ9Btrm6+2Qrp4Yb51MytISBnflThOa/lv6QlXEUaf1qnXkop OLgouSk3rBpXXvXVt0mnbrY97h1fvkklfu3b18tj9xNB8CL8dNJ0f4GeIvCmo6N4O0rTx4dtrrxH iaQ3VkgY3H9oQP5jIqkLiIvCq5QZwTVX9tr9lnxppv7MOi/s1fsV6lNFaaRqV5qH26eS5m1O2e3K zTta3yybkt1G9tmdrFioVSQK/of+Ff7P6eAPD8fw38Ty2uq6PY3lxfWZngRIoEkYSpBEFO5PIbft 67kIzjFdZ8UdO8Hw+DJNY0OxMkltJ9uVIGS3W6fHBkdmUNGerf7IyASBX8Z5d4X8UZPleLziviIY eUHzunUcnOTglzxUXzJpXV5p6pXtZK/11LHUPaKjC8ubS62s9tel+x/l2/Gj9ib4/aHoWveOviNB f3C6Lhb65tB5myTUJ/KtYkRj8sbOoDMuNu/JzmvCfite6ra/DfSLXU9PXSPE3hXUY9SS3soJfNh0 6zijFtcidgYgsjlnUJ8rOPm5r+kT/grp8bNS8dT+H/CI0w2ur6hqT20ekeH7mBY9WSxmO4zbZFZM sjhUK78qCznG0fg7/wAFEf2oPgF40Tw78JfhBdeJtTtfDluP7Y8Savc28/2me7VJHjR4AA6WqnyA pC4KnKg5r9k8EuM894khl+IxuE5k5TleGihGKUdejU5cyS0b0t8Mr+NmGHpYedSMJdOvV/8AA/rc +kv+CVvwwguv+CnXw31j416dJbS614zsfEQ0WRWurmVdQtWvrS4k+b/VSyMkmecEnPSv9Gr9pT9m 8/FHx/4M+NsPiu48NSfDxNUu5IobWO4ivLe6hTzY5XdgY1URZJUEkZHTg/48XwR/aI+Iv7Nnxk8P fF74c6lPb6j4c1e21fTbmQiTcsLhlV0JIZCowUJAIJHSv9LL4Af8FoPhj+1d/wAE8Pil8TBJe3fi HwX4W1mz1Z/7POnwX8i6efJuIVEk8cQmZwPLaXcpzjIxX9MZ7VwOVTxNPiCLlQxMKajJXSUoN2g3 e6cnKPIru7UrvvrgZYivVpVcE7Sg3daN2ktXZqzVr3dtND/O0/4KQ/ELwl8W/wBtL4kfELRb2e80 rVfEd7daNPLALYzI0py5gHEe9tzbfQivzm1CTNxsg/gGcgY4HNfYXxQ8H6J/ZMGu6rdLPq97qD3j xo5GbSSNXUEMOCjblPcnHavlXUfDl/HZLqMlvIkckYnR2BIkjdygccdCQRnua/XuDMfQeBpQpt2i lHXy00v6dtT53OnOpiatW27b+86bwT4h0HVfEJtPiHeXcGm3VrFazy2MYklxDgIQrEDOBjPb0rYM en2VwYdOZhbxufJ84hnCZ+UHAAJx7V4i0NxJKVjQsx/u9q7jT5LixsoxqYdWH99TnHavqKuCUZOU Jb2VumnVf12MMNiHazW2t/0PcvDGj/8ACXXd3aRCSVbTSr7UpNigbBbQM4Y56jftGO+cVzNvqVrE qYaTbtIyq4xXN6f4kuNKuXurDAZ7O5t9x6BZ4HiPbuGrEt9SJVI5RhsckYxn61jHDVLtvY9F4uFk lv8A8Nb9T0W11DTzP96bPTjqfyp95fWDpuVJc/cG/k/z4rziPWDDcsSflwQOevp0qG41q6uFAiHl HcM5G4kY688VrHCSbIeMjynsWn6ro62ab7eR2C4LEDB/M9K2dO8QaXFIDHAenQBR9a8Qi19be0Cq C02RkEfLjvyDms628R39uXKsGZiCu8cAc5Hb2rF5fKVzWOYxjZM+mLrxlYW6rEsMqsMMpUjH09si tb/hO47a3M8SzZyCF3KRz9OlfMV94uurgRCILEVAMhQ/fIAHIxxUk2tap4gjlhEpjiVA6Qxg4XaR zngnOe9cssrno5bdTojmyu7a9j6NPxD1/UWZdJUp+7Jm3vsUx5UY+Uf3sde9e5fBr4LfEn4xSLpv gQafJcWhuLh5XnZfIX93hmOCG7AADjn61+cNtqep6XcyNZyYaeBreTPIKMwJ4PfKjmpbfWdbsFaW 3u7qPDM+IZXj5c8nCkdawzDh+pUpyhRqKLfdX+9XQYfO4qanVhzeV7fjY/W7xp8N7fQtFsbfwpq1 rLrW1ftMeRLG3yk+YoZgcMQcc4zziuD+MNr4i8BfslQePL7xjpV7P4016/0A+G4bnbrOnQ6asErv dWi/KltMzgROGbcQQQMV+YkfivVo7+21ITSNLZoiWxclsCLOwEHOQM981mXepX17K1zcMWeQks3Q kNyc+3tXj5RwTXo1IPEYhVEnfWOt9evZOz+VjtzHi6nVg/Y0eR2a+J22tfpqZMy+dLvBzknJ9PbF RLahn8wuqqF3DJwWx2A9anHHOMAdF9KsKQzZ47Yb6V+jpHwb1Z94/wDBOH9gb4sf8FFf2j9O+APw iNtFfz21xqN1d3j7Le2tbWMyO8pGDt4C8c5YV/Q58Wf2ef8Agmb+yf8AGu2/Z0/ab8DWB1iHSNHM 00d9c21u00seJ53w8u1WYbxzwpzX8rfwo+Onxb+Bt1d3vwk8Qal4duNSs5LO8utIna3nlt5Rh4zJ Hhgpx0yK4TxR4y8T+MNUk1zxXqF5qd7IFV7y+mkmmYKMAF3YngcAelfIZnkFbF1pSqVnGK+Hldu2 /d3v12srbt/S5RnccHSnGNJSlLq/6/ru9j9sv2ovDf8AwSi8ReK7Ff2f7TWdOmjvn03W7KO9YaeF xtE0FzIzl9rc8JgqDwDXw5+0L+zh8KvBPxIks/hjdNc6PPaW91p12l6Lxh8gSfLBEXmVWKeiFevW vhi0MMmXkbjGP1613vhXWLuKUaOJVSG4uoiWlJ2IPunJAJC85bA6Crll1fDrmpV5NJddf6/yOqOb xxM/39GOvZJNfd36/eehQ/DrwZpp8zUGMzdT9olyP++FrRtdP8HRt5cNpC3zfIwgBGM4xlhXTan4 e/snUZ7B5beXyJmi8+3JaOUKcb42IUlW6jIBx2rN+z2yHdvOfRRn8q+fqZjVqbzb+bPp44OnTdow X3Eg/wCEfh87yrLBgIR9sKLyemKsPf2tvCkq2j/MdqoBGp//AFU+KKBi5CS5dgXGOD/jUt/ELi3Z beJt2zCqSBzj61yOcm0mdajpdfkRS6t5Gwi3OJAScyKAvTqQKkGo3LT+THbptwCWMp4z7ACue/sW 5/4R5dLZF84JtJLDAywOPyrpLdWtoVjKKWEaoX3dcDGaVRW0i0/63IpSm2uZW2Kf9qXrCdhFCrJI I0BLHd/kmkudUvrWFJH+zrnPmEoTgAdRzV4SjLKyxDJBzuqrqkb6jZyWkckKFxjc3OPes18Vnsaz UuVtN3K0+sXKXUbCWJYXC4YRjkt71f8A7R/6bp/3yKxJdJjbT7bThcIqwhcsFyW29vb9ab/Ylr/z 8/pXSnT/AJv6+45pe36L+vvP/9X+Nj9nSysNS+LGjx65JHHZi4c3MtyqNEAFJG4OQOf061/RL4M0 +C5kguLVlkhYIYnQ5QrxggjjGMYr+czTPFvh6KztLCPRbZWt2cyXEU8sck2/gbyARhRwMD65r7X+ FH7aUfwwt1spNBm1BBHFCFOryRgLCu1QN1tJjjv7D0r5HEcSfVaU6MMNKbf8vL/7dKP5n6dkuEpy lGVSuoqPfm/SLP6qfgj+25a/sj6RH4gikkWG0MbXklsA0qhmEe4ZI4UsMjuK/Vj9rj/gsJ+zJ8av Bmk+DPgXq93c6tOk17e291atD5cGxRkvuK/eJGK/hw8S/t5/Cz4teF5/BusfDzULW5muYpxe2viq UIoh/gaE2OHVickFuvTpXHz/ALRHhX4f6xN8QdE8P3aMIjDaWj6rJLFaCRvu8xKZ12jGHK8/NntX 805zw9Unm8qMaNWFHFcirRfs2pOE+aLVpvld3aTXxRVnsj9vwWb4WtRhj8RKEquGv7Nrm0TjZ83u 62+yuju+p+zfxlvLTxBqcmv6a5gklLMwj6MxPJK9D/P3r5IvtWv7a6FneWk0xYtieEKEOPUOysDz 7geteLeBv28vh34zs5vtGlajp0sEOXWV0nSSU/dUOnIB/vMBjvmvoHwJ4p0b4q6Hd+IvDgYR2s6Q XMczoJA8i7gQobJXgjOK/qbhbNMDheXBe2UWrJJ6N+Wuj+R+QcQYXEYxyxcKbknd3Wvz01XzOcN4 wOfs1yD6BU444/jqr9tRuTb3fXvHnj8Cai+JnxC8A/CjSRrHjjUIrOJ2VUiwXnfccZWJPnYA9SBg V8j/ABK/bV8CaZowf4ZyG/vPNiffd28kcLRFj5i/MVIbGMHpX6k8ZCHxTSPzGtC8tFc+i/G/xJ8H fD6xTUfFk89rG4fywYXZpCgBYKoGSQOTnFV9S+LXwz0KyXUNa1W3t4XQurSpIpI27gB8p525OOtf l/8AF79rHWPipZroGsaLp0FhBqC39nNljOUj4EbdQNwOG24r5Km1mykuGkWKQLvZ1XdwoPOAPQdK 86rxHONRxhFONtzNYO8W3Kzvt5H76w/Gb4TTwefH4h0kgxl9pnAP3c45HX9ap6F8cPg/rMMJt/EW kh54xKsLzqrDOSVwecjnjqa/B2LU47sPsHlgLtYu2OvpXKtbrHdqkxypbqncZxkVceIall7qIngm tpfgfvDrX7U/wF0G5hgutdimaYbla1jeYKN207iBwRnoewP46lt+1H+z09z9lPia0QCMytJIkqoc HaV5TJbuB3HNfhFZ2UY1qa0tMMFLLEW56dzTJtD1OZ2lKblDYLH5R+Gf6VnLiWot0iIZbK107/I/ Ub48ftu+HLWOLSvgxcyXU8YkE2oSxFYSzKAnlhsM23JPKgZx1r8t9RTUtVvpb2R5LqeYm5mkz5js 78uXPPOeualTSYrePdMDM/8ADEh4yfU1o2L+LVYLpEflDOAsKjP9Sa8vH42pW96X/AOjCYOMHrdt 9banH7fYZ/XikMaf3QfTiutt/D005kn1aRkOdzHjJJ6kk1Tm0lfMC2Rd04y7gBa5XGyN1BnPfZ16 lEz06CnG0Qgt5akD/ZGP5V6TpHgzXPEM81n4WtDezQxCWfaBiNDhQcEjqxAz6mu5P7NnxniiSS98 N62JXtxepHDAGzbld4lGDkptG7cOMc9K8ytmmGpy5atWMX2bSPQpZViZrmp0pSXdJtfkfVH/AATR 8Z+MLj9qHwj8O7O6ltbOSS72pE8ke3bA8pUhXVWRivzBlJx0Ir+vH47fCT4QaN8P7fWfiIwvryfT CLK3u2aeaaR2O0Q2sQLSYOeQp6Ek8Gv5av8AgnZ8FZ9G/aO8M/EP4gfadJsxfSQQrLEE+0JPbzQy NFOwdVliYrgbW5I+lf0xftZaJ468R/CKTQvgT4dh0TSLqwT7XrN1+4kmaRyzFri4LXcoIP3VwoAw AMV/F/jriMLX4hw31edmopOS0V+Z397va2177bn9L+HOGxNLI6kasNeZtJ6u3KraaW67/cfxL/Hl 4IvjJ4nWAGKH+27oRRSLsZE3/KpQj5SBxgjjpXjc90kKZz/ugd67j4utPF8QtatL2YtcQalPBKwV lDtExQkA8jOO9ef2Ud1KdokYHp87Y+nX61/YuVrlwtJb2ivyR/M2Kq3qzt3ZVtLS61e9FvApaRz0 7Aep9hXqtpoel6DAj3aicqQ8ueN2O2R29q9l1iTwnov2G2+Gt3NLbDQ7F792BWQai0CG7VSesayk hD3XHWuZk+I3i2fTor601K8RYG3RMGAZSh9cc47ZzXztTOMRiYxdOnyxfRtp69/ddmfQUstoUHJV Kl2uqSa+XvK598/8EyviD4q8M/tieF5vBd5c6cky3VvMtvIUEsJgclHUHDL3wQeeetf1++Bv2s/G cfhzxbqEnjbww0sGqRQeH57uO7gitonYgR3Rkswd52tjaGXjrX8on/BKTxf4+8XftmeFtFm1C+ks JRfT3kXzTBgLR8s4wzHoOnSv7WtN0v4x6V4Y8VvatqMNxPfQyeHcXkafuAcNh5E2Q4HZ+T71/E3j zglLOYSqUI3UI682vxvduH3+R/UvhlOCya6ldOct15R21f5fcegSftW6b4PvrDU/EXizwhFpNr4Z XW9XQ3aR3ksirv8ANt4mjG+FlDEHIOB0r+Uv9sb/AIK5eLP2ifHfiLT9U1qKLw79q/sbTPD8Udvb 21zp4milkM9xIonSSVEYGZCgBCqAwOa/r2vv+Ep1DQItR1m8a10T/hFJU1y+1C6iisI5/JJZ52fa SFIyXU7cV/n6/tPf8FRP2qpfip4l1X4d+MtUOj3fiLUBp91fxWl2ktiWVbSNIp4HSJUjTKbApw2G yRkfPeGPBlfH1qiw+DhU5UmnOo4pO/lSnq1s0r6aLdrj4xzrB4CUJ1KnI9bqEVJ22196Hnvpbvse I+A/2rvEXws+MFv4p+GDJHZ6drJv9NjuR58Zjil3xq7AJngAFhg+mK++f22f+C437Xv7TdvrPhTx dqOkQaP4newn1PT9NsxEnmWATyTE7Mzpgou75vm79a/I3xJ+0T8f/ipHp1x8UfFN9rdhDdlILO9n UxwPOTuEcChVRflBGFwvGMVwPjXUjcoWUDgYDd8e1f0q/C7BYqvRWY4SOjUmlJzi5Qb5JO8YXlFt uLcbpt2ep+YVuN6scPUlh6zl2copSSdm0rOVk7LZ9EfpJ+xP4h+M3xL/AGkvDmqfCO5Ua3pupQ65 5012lrbxrbOu55mkdV2HdsYdw3pmvp//AIKg/tFeNB+2F4h8YeING0nTNYZNPimsrIxyECPT4FUv JDLIhHAYEN3wcHivw7+GXiGfRL5b61kCzxk+UjRrIGLgqcq4I6H0/wAa6tdU1bWfEs8uqovnysfN RVVcAKABtXjoB0+vWu3A8KrL85ljadkowcVprq0+9mtOx4WK4qlisBHDyvzOV27+Xbp95/V5/wAE t/2k9P8AijoVpYy+Irx9W0yz3a1a2tr5VtaG4lxCplcAEE/KPmP1zX9IOseL7Cw0uTT57/xAZQqP PFIyiIOsYypdQNpb+Dnk+tfwI/sPfs8fF/40eOrPw/8ABKfUJINS1K10/UTYXDQi3umkBgknTI3K jfcJGA3TBxX9oejfsL/Hfw58EtE8GfEvxrqC+KFvbubVdSnijnu7uOSJzCnnXJZWEDKpZUClkBAI PNbZt4+ZDk2IdHMZS5kteSN7eu1n2V7u91oYx4Ox+NhTULLm2cnZO3Vfr0P2MWTxX4p/Zl04/D68 t9JeaZYtR1S/mEP2LS0mY3sodiV83y1KqScAnPFf5zn/AAW+/ax8dftZftNXbw6U/h/QPCOoTeHf DWkzQSQXt1GjeU97eCdVZpZWj3BmUERkA81/f3+xleW0XwKuvhT4zkN3b6VPMix3MplMqxtFOYw+ ADEJG+XP8BANfzjf8Fnf2HdZ/bx+N+pSfAnR11Pxb4b8Nw6p48Ohsfsen+XGVigeaYIjnyoWwFG8 uxLZG2v58wniNk9bO8HnNNXjPm1au4pc15OK2stG9W+ZvZJn0FXhTG04YnL7axd9NndLq9/LorW3 Z/HbcfArw7ongWHXvibcatpGqarZSazptzJEslndWCxuI51ztaVJJwqExklF3EqcAHx74dfGe78E 2F14Wks9L1XT9QiUeXrMTzJZzJKkokhIYbSCm3jhlZgRzka/x8+JPxM8UR6T4E8d6rqGqW/hW1bR 9I+2jBtrSNyVt4+NwjjJbapOBk4wK+ZbhWSfYDgZ4x04r+t+GeH62LwMnm81UdR8yS+GKUm48rsp J25W+z+bf5LmGJVGtahHl5dHfd979O59B+LPiPrNyT4nuZLaS7vbs77WSHY0IgU+WYgANkRVsbQx yRzx18vTxjqd1qjapqxW4d2csGAVdz9wFwPcdq5SSa4uX3Ss0jnH3iSSBVq1tJZomlA+VBlieB+t fZ5fkGFw9PljBdtlt0St22PLrYidR3uz9W/2Y/ip8BPC3ws8VWWoXWp2vjrU0s4LW4EkcWmSaWCW nh2x/vPOYsA24lflUgAgmvEvG9pZnxoPHHgS4SIw3Ec0DQLmFrmHa0jqJyS67sHBBB5GMV8JgtE2 MkHviu40rxrJpVkbeSNbgqAITJ0Az0PevzmXhSqGPxGZYSvJyrNXjKzVuWMbLbT3dul33PWq59Kp Sp0pQS5dmtOu789d/Q+mvF3i3xR49vx4n8eXlzqV75CwSS3CKiLGi7YwoQKqrgY4rwC4n8NeFru2 1W1iN2fPR2g8zcqKGy6ZH97+HPvnNV5/i3ql3oF34fv7eGRLpGUSoSjKWH6geleY2xYxNFjIyCDX 0nDvCVTDxlTrLkitFGOiat5Wta+x5WIxjqz5m7t6tve/6n7x/s/fs2r8doYLzw/ef2XOI4tRjGrx qsEdqEJkR1BZnYZBGFxxxmvoyXwN4j+Ex1Lwbc6TZSy+I7bT5L6G6tVikgezDm38kRBdiNuSbnhj tyMDFeYf8E/Pi/8AA34oWVx8Fj4qvPBfiDR/BFnP4K1bWXiFpqfjSK8jW3s5UaOUyQSLMyIj7Y8o rSEKK+kv+CxnxX8Z/s0+KdI8Oa/fWU3xFttM0nS9f054IoLqRYLUI800du7oPMKZWRCodGG1RzX+ fvEmWcTVeJqeTTpfu6zahGSd1y2kpOSTSi7J+9JNNbNXZ9zl+Oo0cM8RTbTWj+d09H1/R/I+Cf29 /wBoz4g6h8M28G+K9e1XULg20FvJo0E/2O30OYOsXm3FlEixmaZbcoxIDBxk/e5/FO01/VJNUh1D U7g3X2ZFAW6YupiQ/wCrwT056Umr6xqviTVbnUtXuGM91K8888zMzO7HJ3EkljnpmsnR9A1PxJMm l6PH5twzpHFbhv3krzOEVY06ucnkDoOelf3l4d+H2G4eyz6ldNu8pO1lqtbLZJWtp01et2/j80zS pjK7qybb83c7vQfHuvaN4ttNZ8OBdKZ7uCeOOAkRI+7ZvG7PHzMfbmv2e/Yq/wCCe9t+158K9a8U fC/WdN/4TqLxPd6edB1Yea1xpJWOSC7TAILOzyRuRgZRQMZNfi9Y/DrxDe+FNU8TafZ3E0OkyxwX z5XEG7O7K5DcFeoBwOtf0F/8EQrLwpaeNtIs9f8AE2reFfG/iKK+0zwTNdRH+z7tVUM0CTxOZUlf cxjaSMxhxxhmBr88+kBi6uD4dxOPymq4VaNvhipuSinLlkt3G2stbpXZ7nCWHjUxUaeIhzRa9N3b TzvovuPP/Hv/AASN134W/ECPwH4m0/UBe3Ojh/teq2/9n6ZaXs7yJbie5dxGiOFDs7yBU3Yzxz4P pmu/GP8AZ7XRfgf4whiKeEtQ1fxB4cv9Sl+26LLZeS8skdnbQoDPHPcW3mly5XcE3ADJPqv7Ufib 9oDVf2pfGH7O3i3xZ4w17U9FnmsNZa7kuby7lukcrKjoxeWYW8DlVOMhNwX5a4rxv8a9V8DfC/Rd L8KaBFpniTwjear4WbW75LhEbTdWs5LCSMrfsCAFm3qBHjjJABK1+MZFVz7E4fC0s4rrFKsk9YuH JzQlyVNXopX5eWz0et3e/tznh4KVTDwdOz9b2autF0tfdHiXxw/aD1OXwT4Ut7nW/ENn4i0HSdT0 +HQp7OGLT4bLWpmndrB1jUeVIHBZXUscbQ2ABX5qyXUtuh0UTyR2ryK80YJ2l1BCsy55K5IHoM+t fe/7YXh/4wf8K/8AA3xt+I0dxFb+LbW/0zQQTA1pJYaDKLUzWxjwxR5i+CVA4BDNnj86WLk7uc5r +o/DHA4dZaq1NJNuV+VppSjOXNFNJaRnzd3e+r3PkuIcRVlXtUb0Stfs0rferH0v8EvFPwis9K1r w78QtMv5NUu7Nv8AhHfEGm3TQSWF2ilVWWIKVlgcE7xlTnB3YyCuifEmDQfCT6ZcS6jFBr0kg8Vp bzRqZ0FxujW3twNqMoUEl1xuHy4Gc+c/DDTfDV7qM0niKaa2hhhkffaoJbg/I2BFGzLuYtjPIIGS ATgV6J8df2fPFvwWk0bV/EccSWfiDS7fVLKIzxyXURljWQx3UKkvDJhgwVwCVIPrXvVKWFjjJ0py d6jTs22rpfZT26Oy0ur2vdvJVa0sPGSStDS6S2b69/V9NL20PnqYnUJ3Jl+VRIyGQ446gd+T9apG FYVRgwbcmcDIx3wafIfKZRHnj5uegNV8+aQs5IA4GPXtxX1qPFepNE6MzO2D2HJyPoa+4fhR8D/D vjvX/B+j+Kp9dvofFcSOX0FI7u5gCSNbrE1uGDKyP5W3cAHV+GHUfKHhvw9peu39tYSyvbo8yedO 0ZkjihJIkmlZc7UjwO3IJ79fq/S/D/xz+EXjrw7oPhmz1ebSH1IeJfDF1EgRdStraXyzf2jlQzRH acKQRkYZSQRXxPFeMbp+xo11TnaT1dtLPZvS6dn6J3NacFu0eqftOWH7NPhTf8H/AAPYeMtN17wj JKtsl5HHDdXOpSsvnyTeXuKrEIlMezAYEuCAQa+ANa1bXNVhkutTvPtJupUubozMDMZ+V+Zj8zHH XB7881+wVh8I5/iL8VdY+Mni9fDdzJLe2TX2i63q0mm2umwX1pFHb3N1eryzXYUt9mhUskfOUUAV +eH7Qfw08O/DXxnq+j293YXQS9SaCOxuPPMasFb5JWA8yGRHDRyAZPUgGvz/AMNeIsNeOXuUp1FG MpSb5velZySe6V2paqzvdNqxwzrwc9zwnTtWurPbaW0jxASEyfxAE8Z2d8LxX2V+x/4K1u9/aK8J ro2uRaDeXGt6cLTxBf7Qlk006obgZDBfKJyDg9PUV4T4J+B/iD4h6ykfh65tLW1nm8lLvUrhEiW4 kY+XA84yoZgDh22qcH0xX1zZWPwW+Evj3w9D45nk8R6cLGPTNZi0y6Fld6e+8LLcQSIZUNxaTb5E Y5SVQOOa9zjLiCg4zwWHblUnGV4xjzPbrfTXazeux35ZioLF0lKVtV30t6XaP6p/26f2H9Mn+Gvx N0Dx9441Lxj458J+HtE1681zxBFNG97cJdNMbPTy6jzIpIwd2xSAduDgGv5IPGf7R9x8L/iRPqHw tu76zu9OcPY6zpsptZobkKVYRPHtKhCdu5dpbBOOa/YT9uz/AILn+HPjBayfCb4Wab4gOm2lnpOn 3Pj3xNdW91ruoHRDJGJbcRIscIu0dt6yA4yG6jFfzceI9Y0/xb4qvNftLcWlrc3HmLbGQSFR1wW2 qWz3OBzX5/4QcFY+jGtLNKTVKWsE+ztuul0lp01ulofdcV57SryjHDtPRJtdXr/Vz2XVvGfxB+JH 9r/EPxtqV9qmsalIJrqe4mkkedyAuWJLE9B7VwmqaPe+HdRaLxFDcw3MltDexQzcSmWX7mMg7l9c fnX1J+zt4Dg8eXdrpkKOsiobmQkDYqBhgnJxnBBHFfZ3x8/YX+LOjfCS7+I2sW1pf3uiiPWLbV9P SaC8h0iNipLjBjZYmZFbBDrw3Iya9bH+J2XZdmtPK8ROMOd2Sbs9WkrdGl1666J2OClw5XxGHdem m+VX/VnzR/wT+8Q6Lb/HzRLX4itq0ujTXrJeR6ZJGsjKoVRHumDRGNcbij/LheOcV/pufCy38Q6l afAXxTpWjz6J4a8NWviOy1ANfLPb2cX9mJbWrTzEoJfNkD7SF+U54Ff5R/we8QaZoPjvS38Q36WV hHfLJes4aQtA8m51+TDElScEMOT1r+yP/gvB+0Z4Zh+CHw1+AXwna9tPC32BNXa+lubi1nvrW2t7 aSK3VUkXzHlhkZpFlBOcYOevzPiFhvYZ1QlS0dZcq00vGSlfz0WqTV9NTryRKeFqKf2bv701+b0e vXQ/QP8Aai/4Kw/Af4s/tnWn7Hng690y5h0LXdAvR4yNyRZPq1vqKG40wAqQz7F+R0+UuCpIxmv0 w+Lfjnwf4q+FfiN9U1rSrKObS5YDdyyebFDuIALrFuLckDABJ4Ff5lXhn49eLvgB8dLf4v8AhSxu rS8g0xW0KG5aK4aeC7UxCWdtrx5G3IBX7wI7V/R1+z3/AMFQPB3xK/Zz07wF+0hd22g+JfEst1C9 1bQSQxxBfns3RI/M3Ixwkm4bSf4cV/NvjD4fZxg+THYCi60ayXMk7vns7vlV3ypLu9dO7P1/grP8 JWwsqMny1aN3Domrqyu+rfS2qPIf+CnPxn+GmofHO/8A7JvLYfaDNezXeow29nJqTCIWqKjqpnNu IyAjEgEqwILA4/DDxD+1L418Y+EU+AWg2HhxdN0+4F/Z6hZafEL2OQOrSSfb3xKFZgMszAdgNpxX 7f8A7Xn7Nf7DOpi88T/HX4x6LeeMLjWLO0VfD9myGCwmhiUTXsaI4Em8uTHCCQCCeW4/BH4rXvwl 8A/HvVPh/wCEL64j8CJc2ljqNzpUrSS39sjLLNLP5gO4kcBAu0ELlSQa/R/A7IcFLDQoyoTnVhFS vKL5FJWd4N6yfvWStfo2un51xFVxVOvKpOvFKd4uz1s76SXbT07XPnk+HvEfiQy+HvBdvLM93fmW S3EkWHBcJGDgjexdvlXnrkDAJr68+C/wX/af8LardeCvCPgXzdW1W1iOovc3Ya7UZLRQ2ojcCG5I JQw/PIwbYVAYV6L/AME0/ix+1b4X/aL1T4X/ALCOiR63rnjWzvdK8L3uvQWVvdWdobhH+2ie7V4k aOOMBzyOWwK/Ur4D+Ev+Clvxy+MnxT/ZYf4k/YdaWxtfGHjX+ydYjutNuwojlle1EczXMn2hJUcL YIiiUguqouB/ROeY7EwlPDTVNQST1bcneyu0mrWfR9Ujw8pwFGUI1o8zne2lkuuibT3R8G+K/wBk r9pL9tX416/8YvgX4Q8YeIvBOtvbQ6Nr1xoF5AJrW2WOAmMYlRWUxuZAjyYCN3AB7az/AGCPAPw+ /aFtvCXxFvPFvh37NcRLPb2ix3OqQSsu1EWMqqu6yMGClAWibPDZI+x/2Rf+Cw37XX7OX7AfxD/Z +8OQ21lo3h3z/Dfwv8QWOn2sWqG8Sd5LqPVImbbIhtTI8lwmHikULn5lNd38LP2gvj54r1W18J/E PwB4e8PvYfD2bxNql547jkW71Oe3S2ddQsLqSKJo3+zsFjkkkl+QybWIIA/NeL6WY0aapYPFOEKc XC0XFPRRSve/M7bvljZ3VjWhKlVqutUi+Zvm7pu7v0Vl82fEX7Y/iH47fsvfB238I+EIPEdh4V8c 2to2kz63DHZyXujadMk8KxQpNI0Fqsz7lY48w4znpXwT+zP8ZLDQfF934l8XQQz6r9k+zaYjyi3h knDoWMsy8uPLDYToxx2r91vjR+2b/wAEyvj98edA8N/Eez8Q+HvDWi6W+n65qdlZy3McsqwBf9GE SyNIksm7LLs8xvnyK9n+GP8AwRf+C37UHwO139o/9gm58b3t7ompW+q6L4d8Z6KmjSX1vMN86WC3 AVZYpI1jMM3nOUdSB8xyfjsq4tWEg8ixOV1uarqqkYSandN6yS6Rj73aPnZPkzSvUrV3VpVFyx2V 9vv833+8+evgPoPxk/bK+N/hjx18FvEHw2+HMfhC1aNZdFhgstQmmvDKd0wulQXE7AeTIQQu3aF4 NfcP/BZ7/gpR+0N8CvD3w60n4O+LtVuLHT4rzS/iN438LpbXNvFrhtY40sXmUGJbsfNKY8ghWyM4 r7MuP2SPht8JPF143hLwa/hi0stJ0l47bxBYwxjXJWX7VeWyvI0SiWPczSee0pBUNCy7dtfx7/8A BY/wn8a/gL+0t4x+EWuHVtN8I+LNXtviLZ6DdXMT2oudQiLfaEitnaEE7iF6nbgnGa28KK0c+zKV OrSUYU9OWS1tbWLfWcW21e68tGzrxM3Twkqsld331v5PXp007n52fFL9ob48/ETXZvGvxK8TaprG ra9YvBdapfXZnu57Ql4hDJydqbSQqY+6eODXm/hjT5UMOq6la/atO+2CxIS4iiZp5I94Xcx3KAOd xXbxjOeK5600lmtbnybea8uEsheebAx220YwzSOMfMApweRtNYdlZ3d3cLawxNI/3iMEkAHnPoPr X9mUsLRhTdOlFRS7K2nTZ6aHwzlJNSep9XfDPx4PBHxPTxJ4Jn/shrO4E+km9l+0RLMkyyRxXLps V4tygu2MDGcHAr9JP29/2lvC/wC2n8R9C/a3ju1tPFupaLYab4i0LTt0qWM+jsbVJrJmjQFJ0PnK hJMe4ZYnIH4srp2pJdPJBbT28KkNsbcwUdAdxABBwcV+lP7CHiH9nqy+K3hKL4+a2+jaFBqzS6nc rbfaRBGi5R2iHMqO/wArRgjg5NfkXiBKOW4epm1ClKrOEXpFXk0k242Sbd7adb7b2frZbiZSfsJt RUu+y216H6F/8E0/2d/2kvDvxT0r4j/Di41yylv7qOPTZ7gqD9ld3MNwZgphHCkFGP3+xFf32eIf FNl4H8D6VrN/fW2o290UtZL+2lSR3nRf3paNcDAYHJXK+lZf/BPL43/8E/f2gvAkGhfsv33hzUZt Os4ZbvR7WHbNaBOPMaFlwnLYypIHCg8Yr8Sv+C4v/BUD4U/sZ/E/Vf2e9A8MyatqrWseqS39nqDQ W2n3OoJvZDaxZQSlApJZcEkFgea/lfL+H+Js0hT4nxVSnNYn93GjTcuanL4rT5lH30kk4uN433V/ e++yvM8Fh5vDRk4qOrlJaPppa+l/W590fE744/CMWJ8X3PiK0htbOeeMypKir5iHDIVzksD2AzX4 o/tSfthL4rikvfh5bNeoVLR3l0xj3GM4wkYOT06n8q/lR8DfG34heJPiVe65ot5dOtxLdTzWcxeV vLmdpXkAUsqnJ4HTOSK9M1X4mfFWLUdLfQ9SN3f/AGiUC0lhklMSywMwUIONqJl2LD3HSvp8V4VP DY2NOrXUm1d3TSWj3s32321PdoeJGHdNRlTfqvzOx/b+/aV8SX+iD4WBHE2vob/W/OIfy494McSA ZwcqGznp25rgP+CdfwQ+I3xg8dmD4VWLX2r6PdW+qsk0yxWsVmVMMrSKEZ3ZmkAiCchuSMc18NfG XxpqXjjx7Lr2uzLJcyQxRyGMYQGMY+XpwevQV/T7/wAGrnwo8L+P/wBr+/v9fubqOPQtDbVo7O3W UG4mWQRx/NGQCAJGG1sggnjOCP13jXK6uT8JrCZfGKq1ZQjr8PPUnGHvPtqlft0ez+Eq508Xmv1i q24x272Wv39fU/rm/wCCZnwvn+Fv7LtnFfP9pury6uryeeOKSJZAjeWjKsqq+1lUMpI5U5HWvbdZ aTzUMqybQwYEcfnXuX7RXxF8O/s++FLnxR8QtXS3srrUvs1i1yoURxTJ8scSxKNwjKn5cE4r86/C X7WHw4+M3iCDwX4KvWlvr5LiZYYIn3x2sGc3DiRAArHCqTwSe9fynxzhllU45TiZP2sL30Su297J yS5t0r6Jo/beD8f9cnPGO1p269vl09D+db/gnxo/h/VP2/8AxP8AFfxvf2enaV4SOvaw2oalMkNu lze3JsYF3uQN/wC9dgM5O3gV/Su+u6F4r8PWviLwvf2l7p15AZ7PULVxJDNGCQXVxwy5BANfwz+P Nd+Jf7P/AMEviP48Ok2d5p3xP8dXXhTw9f6rG8NzYvYzvLLcWRKpGYpRvj3I+5GX7u1jX9IP/BNv 4s3viv4XSeDZvIutM0XR9O0+y1WASW8c0yRhJ4EgkLKFifK70c7juLAE4rTxGyWrTgse7OF+RWfS KV/mpSatvo2tD3eGcyU6zw1rS+J/Nu33pX+Zj/8ABTb9s+L9gL9lvXviB8INTsNG+IPjHWLC30qQ x+dcXk0LoJpQhyP3drGY9xAUBsfeIr+Tv4K+J/i18QfE+p+JYpNfOs+KNVS91yLSmeFHuo7iV5hq Mso3RwxQo0nDqY8tnKqBX2r/AMHE/wAXPBvjrx14X8N+B9c1i9l8L3lxp+taYlqRo1nelBIhjvCi 7rwLkSRB2Crg/Kc5/PL/AIJx+IM/tBeGpfGOpX8uj3WoLeXOntcP++eORQTvd1jDSyOyHOThmB4b n9o4W4c/s/gKpmUYXqyU5u6d2o/DFbaWimvwaPzHjTOXUz14aL92Nlo+r3frd2P75f2tfhb4l8Gf 8Eq/HHhr4kan4n1e1i8JSXVrqGpOl/qrwiCOZt0gjSOZIiWAcx7do6Eiv81K5v8AQ7bwte+IFZdR 1C81v7A4v0Algt7M+bC0LoQuLhW2TBl42/Lwa/1Ef+CvfjXw540/4Jz+JtL8PahbXNxNpc+s6aEt 7lIbW00SJZZoJpLZvMALL8rZUMcDBAr/ACz7u6TRfDeo+DdS0uGa8vNQstVttTScCNEjjlLIOoZZ d+WGQwZdp68fYeCWUYbC4WdDDYv6wmqUnK8deaN3qna2qlZPayavdHyXEuLnUoUJ1Yct+dfc7bb+ Wul7n6l/8EavFHw98JftBahrHi97e01jV7GbSfDGobo/P0u4nI86cJOCjQvAXifKsdjHlcBq++PH PjD4Qf8AC+PE+vfEhvENroUXhHSrN7GK4W3eZ3nvLba4iaaMpHDlYQ7EIduQcba/P3/gmF4F8VH4 h2fxasdO1tdP8MQW9smtaLsEdtJqkpSSaQlS2BgCYg7khB5xivff2tPGnwpvv2jfEnh/XbzS9A0z WrLQrLT764BsbeaK2lvFlu4hGrqIVKjcCrBiBlSeR+Ace5TDH8fY9YfnlKVGmpODu4cs4e7Fa29x qVuj5nZXcnxZZXlDCQi7L3tL7fj56dvyP2z+C/7SPgvUf2FvGfxJ8JedZiXUIfCZ1mwaBrvU7u6u 4rBZ44YsKl1IPL3Hb8zHd0r339q8+AvgvYtb6Dot94kubb7LAmnX0nmx73ijW4is8N5RaB0TKjjg jGW58H/Z7/ac/wCCNvwmtPD3w0+MXxA8GWvhjSNLstahtNOs5ryHU9QtQwiNybWGY743dplDkOsi oVxgVlftU+J/APxuj0j41fADVj4z8Kax4gj0PSLrTJLiCyAbUYWaX98sc8UvmOqsAu445yor+feP OBK6qZZV+rVKVB1JxXMnF2ai4p/DbSL1Ul15bWP1zEYyF6eHp1VOVOCvy2dn1a320/U/F341fsDa xp2n/EH44avr2s+GS/hrU/GR8K2tsFtDpbXkFokazk7Wlm892VPLDKF4GDk/l3+zb+xP47/aj+MG hfDnwRpyW0WqMWE+oS/Zx5bQzXUYdzuP7yKFiJNu0DBPrX9+/wC2l+zjr/gz9gz4g6ZdwWeq6nL4 b0G31u5v5xDB5l9qD3l7H5saowt4ikO1Ou3jNfEf/BGf9h34b6P8OvEn7SnxS8P3sOopp7WPhXV4 2eKeMfZrqDVWtfLyojZJBEpZSQMlT3r+l8D40ZlkXDFSWIklXaUYbWj7vLH+VvlfWV36s8Crwhhc Ti6XLH3E1zW1bvyv8b9Laa6H8UN18DLiTxT408HeGdRkSx8OvJ5r3YEX20wTGNVijBIfk5jJOWXB H3sV5V/Zl3Yw3VrNbTRxLi3nkuUYLBKD8ytgcHIwOh9uK/rn+HvxW/Y3/Zj+FPw88WfHq28P6RZf EX4ieMrzXH1Szvrh30LTA0FkitbRuJ1juFiQxykgE78Z5H5KfFX9pH/gn8Pif8VdWE2teLI/Enii HWvCus22niI28VwzyX0ZhnMahVkYeW4CuyjBABOP1HhDxnzfMqldRyerUpxtyyirqbjP2U/e5VG6 lGUmm7qK0TR8zxBwPg8PGLWLhGV3eL6KzlHS97NWSdrXZ8ufA/8AZ20O30DSvid4q16xstK1LT72 ea1LET+bA5ihhVQG3NNKp2kYCjBzzX7U/wDBOn9sDU/2bviBrXj7w5pmtW8FpqdjZaT4a0JEvZ9X lWLb5Fy0qtKs24oQYwMIGTnrX88/jf8AaGj8QTwaZ4aSe10ixmuUtQ5UTyW80rupbGdjlWAOCQCO Ko+CP2oPiF8MfHA8Z/D/AFHUdKuorxL2C4sJ3gnhuEwfMjlX51dcHa3v9a97izwuzPPadWWLlaUv hT05UpcyWm0tEubdLaz1PicDj44Ssp0p3/Lz33+Z/qefsyftvfHn9q3U9bsfFPgHU/BUmhnTp7ab Wo2itr6GaBXnjhjY+Z56OxDFSQowDgnn61+Mnis6J4OsX03T2u4YJFllso7Y3BWxVQsmAysPM+YB VwSew4Jr/OZ/Zc/4LjeKPg14p8Y/Eb4lS+PPEXiLxD4RvtC0e9j1SER6TfXMbCK9jSdZBvjfa2Qu SFAIOBX7IeCf+Dtn4V+EvBmk6bqHwx8Uatqdpptpb317faxZ77q5hhVJZiyxjJkcFidi8k8CvxLP vBvPsbPGLGqpUliLRlO6lsou6u9rq1tm4ptaI+rlm2AbXsbRSu0tv0t/TOh/4KJaL4P+Fmj+K/jP +0N4YlsNATw1Y6j4bgJi/wCJjqWqSArbCRNxingL73EWwFEPJy1fwj+Pr7Qr3WZl8Oy3TxSTSyyQ yBRFHLJI3yw7S25QuAGPJr96f+CtX/BZ0/8ABRj4JeA/hf4e8Ay+DrPwndy3Ut9Pe/bDfS+UYYtu AgRY1aTqGJLcEY5/AC98Tag2nW+l28VrDHbxsgaKILI7OxYyO55Zx0U5+UDgA5J/obwD8K5cOYOp dPmqNXi3olFW2V1du7bVr37JHy2fY6nVnaGyv+f+R6t8Dvg5c/FrXksLJ7dYYJYjf3GoSNBbRROW LbpMEBtiNsDMu5sAe375+AP21/2cf+CfPhD40fsUaZosGs2HjrRB4Yk8XWV7b3OLm3DrI6lA7rG5 wrLllDqXDbWAH8ykGranbhxBdTxrKwaRIpGRXK52lgpAJGTg9sn1qv5UlxG9zuywbcQTyc85z/k1 9xxp4YRz6vH+0MVL2MbNQjp7ycWpuV9XFrRWtZsrKeI44Ok1RopzbvzPXTXRK3369D62+JniDRPF 2tjxFoQSS0jkVY7KZmLlEyREX+UHAxnHrXD/ABJ+KOi+LfB+ieEdO0FNIl0hbhJ5o7hpPtAklLxp tblUiB2qMnPJPWvJDPeanYx2lgnlW0bblgR9ztI/BY8AsePwHFbWgaCNRE9xcIRFaqGk3tsJJOAB ngDPXvXs4DhvC4SNF1G2qL93V6aOOtnZuz63163scMMdVlzxX299PO/y26HHLHMMSBAik4DdzWnF ZX1zE8z7NqAEeYwBOPQE5NLetPPfyCKISfLwidI1+vTisGfUJACIht42jJz0x0r7uMpSSscDkkTt JMhKzdcEYWoDPJjYTgevqagSdApkc9ffFVZJlGeK7FAxlV7FuR2B3ZqOOd1fOckDGD/jWcHOSR3J 9utOEsiN0znp+HrWns7GfM7mkpfzN68HvzTiec4x34qhFewk4kBBzjIqx5qqQy4/CpcEV7TQsjJy TnnPGetbugXsdnM4c43wtGSOcDIP9K5cSruJH40/zDt453Dj/GsqtHmi0y6ddppobcX1ws524GDk E9f8/wCeaWG4upA4fBXv6/jWbLE6ygycgt2/wqySIQduRnvmrUVsZzm73uJO0iAheVz2/lTVe4Jw /IxjHp9artK/3F57njvSi7YoAAM5GT/jWqpkuXQsEKAF656jNOjIJ2Z9cbqqK7OwaXkHngVIULSY 59RnmoUCbmvFsjXhhkZ3Yqo0nmOWIPFRoHU7cj6Yqx98YPGKnkKc7qxJCT2HU10Hh/W7/QtctdX0 2d4Li1uEuLaaPGY5UOVYZGMg4PIrBjzwo6CrLFR8jMvZh65qJU4tOMtUaUpuLTR9TRa/qXiZTr2r v593es09zM/LPI5yznjGSeeKc7SZEbZAz0A5+vStT4Q6fDrcml2cil0lUKR6g12PxQ8OReGPEUOn w5xJZQ3OG6/vQx4A+lflGLxtKGNeDSs7Nr0TsfrmFhKeHjXk77fkefGSTeMFs4xnPap4La4ugxQ8 LyzM2AM1GULMPp069K39BtxOssTAYLRjp6nrWFR2TkdsVeyMoadMwO94yP8AeqtcWz27eW+CduQV Pavr3xH8MIrXVtLsdqDz94OBwQiBsn86+bvHVgNP8TXNiv3Yn2Y9MV42T51SxduTqr/jY78bl0qN +bvb8LnFKPvZFWlgjNs13PIsaIcEnkdM5qFFJZj36VHq6F/C90g5JLgKOSflPSvfpU+aSi+p5VSf Km0tg+3aD5H2g3kbJu2ZXkZ/PrTP7S8M/wDP1/45/wDXry2zsb3/AIR5UWKQt9q+7sOcbcZ6VH/Z up/88Jf++W/wr6H+w6V3ep+R8vLPaunufmf/1v4fopIo4fMBYe2P519BeA/hHqWq2K6/rKr9nkQm O2klEUrL0DgZzj8Oa+f/ACU2jZLGCT0kypx75GP1r6a+B2hanqlzeXGoW9zqSxWwit/Im8zaScgf IxIAA6Yr8z4hruhh5Voz5bb/APAu0fqfC9CFbFKjOnzX27d7vR39De1PwFpXhqOG/sYY4y/V1nMp Uk8AqSMZHtWtf6LF4o0v+ymkKl/m54GV7Ej1r1DWfAcj/DPV/EYtLuAWWpaTBmYsQn2oXZAyR/F5 VcFBbuLZZI4xK2VAXd5Zz7NXxbxTn7Gtz3fR/wBN/mfeLDQhUq0OSy2a+XovyE8J/C3xB4WsbnVt A086gyRrLfW0TvI628bDfKAV/wBWgOWOeOvQZrpGX4k6fFJJ4Qm1nRZ5X5m0yby1decK6gjcPTni vsb9nvx38Nvh9aT+MPiRqMmmxwRyRSWqFZJb1Z4XUWsYKuHWZsI3Hyg5PAr55+HjWHiAaZqvju5l 8OaRr2pXdlpOpoEvRJLaShGhktoJBJCV3r8zABgMqCOa+YxHFeOpTrY1QsqbtzWk29HeyWsrJdLu x9PT4cwjlTwKnpOKdrpJa21b+Fttb2/FHyj49t/EEzTQfELUJtW1EKJIxfhnmTeRn95knBAzgN+F eJwaKtzc+dcCVh0jXIYZyOvoBn0NfpX+1h8In+HHjlvC6SG8tEgga2vzjdcI0StkdOASQP618T6p pp064SNgFDSMFXIyeV96/SOBeMoZjgqWMpSv7Vc33rt081uup8Dxbwi8Di6mHqQt7N8v3fn6/ccL D4JuNW1KaG/Mggii3RywY27+CVOQecc1nz+BtJt3JjmlkXgjJBUj04ANe8ado6W3n32JA7RspBY7 Tt4zt6A49q4W5iW5iIxtDA8dx+fevtcNmcqkm76HzmIySnTirx1d3/kecz6HoStKhjcGGMSPtJxg +nPNZF5pWiR2++IMJHhMsZJJHbrzXXusQ1B7Fi4YICzEAgj0OR/WobqKwjwjbGO3glf4e/Tt7V79 Hpe58zXjGzskeXxae5b5ZgDjOO/PfrVk6VKVz9oGMgDJOM5+td9eWFtaWsN+8aok5dY22EAlSAQC Rg4yM4PGRmse4jto1BwABgcKDznvxXaqqkrpHnSoOPus5yK1uEQRyTgAHHy8mu88P61NoyMmnud6 bZI243bwpPU54Oaxo9LMtvHfQSxtNPeC1hsUAL7TxvJz3bgDFVrfQvEUNw97FABCZjFMxZcrtbae M7gB61DqxlpJjpxq05XgmNu9N1LU5zc3UmAx3bVzjr71Bqt83lLa2UbKqoI2YA4OBg4z696+x/g5 8B9Z+PF5H8NvBflJqV5Iskuq3lzHb2lrAjD7rSlFLMf9rv1HWvAPH3hTVPBHiTWPAsd419Pp1wLe O4VCgbHJYK3Q4PP6V5081pSrOhCSc0rteW1z055LXp0o15xajK9n3a3R2X7NfxJl+H+vXQsbOxvb /UbMWVvFqdlHexbzKjAqkoZS+FOCRxX6q+If2p/GUeoWUk3w/wDBRhi8Mrbun9gQqGuvsx/elwAw +bjywdmOMYr8VdH+IHiDwdrkeq+HmhS7htmhRpoklETuu1nRXBUOMnDY4PI5rZ8OfHH4v+ENOfSf D+rXENvJI8rRvEkuWcAMcyIx7djxX5xxXwJ/aWI+tKnFu1veclfp0Wlla297vY+04c41WBw6wrqT ST+ylp971u277dN+n7l/sSfFK78XfHvwDHruh6TpVzZzamk8djbx2MFx5sMhSR4uI1ZcEbuB3PSv 3G/4KX/tGX3wp+AM3inRY49QfTNLhmm0y3uRarLFvEZY3MiNIxUsDsijQkdHr+F/S/jN8WNA8THx fo2uajZaq25vtlq5ikBdChI2gYyhI4x1rpPiR8d/j58RdQ0+6+I3ifWNbuE0tLOzN/cPOVtW3ARk NnPVuoJ561+dZ14CTxma4fGutGNOC96NpO/vOTSd1ZO9r3TXTsfS0/FpQy+phY0pObeknbtZO1t9 Ntn36nlfjTxI/irxZqPidYnh+3Xs14IpJDIyGZy2C5ALYzjPU1jW0yxwPeTrvkWZNqscDBBzwPpV SQBstMcH+8fWux1rwlcWGmaVeRbC1/ZG5dN43qRIyjK9RkbSK/o9KnSUKey2XyX/AAD8UUJycpW/ pltPiDcRxrFa6faQgJsby93z+5560608S2v9nSxzxxxtyI7dM7M8EGuUl0W+gH7woPbPc1SFldB9 u0g9eSOayll1JO6iafW6vVn038FP2ofin8EPGVr41+GOpyeHtWs9xtdV0/5Zo1ddsiDO4ESISrZH Q1+/h/4OgvjzPo9zp+ofDPwtdXjypLaalJqd95lqyKFJhQghN4ByBjGTX8tEqywN5Un3j1Udf0rp dC0KLXpprSyndXSMSr5gGD/eHXselfHcQeH2TZg1UxuGUmuuqf3pr/gdD6LK+LMywsfZYeu0v67/ ANPrc++v2sP+CkP7U/7bPi3VfEXxV8UapDo9zdRy2nhGwupotGs44l2RJHbBgjsq5zIwLuSSTzXz b4a06PxLpVxaazJC1rFH9qlgYNuPlfMNpB4Jxtz6GvnmK7ktDJEuT8xDeh2nFb9n411SwgkjspWj 85PJlVUBLRnrz2rsqcMU6GFjhcBFU0rWstrW8t/NmFLOIus6uKvO97+f4n0guk/Dfxn4HufEmhXP gzQL7R9UxFpUk15BrGpwNl0aGJ/OglVd5QqGRl2KSSOT5D4jd4Lct8pIJOMcVgaPNpBu7QwmUyNM qhAw+X/eFdF4pyLeQDG4E9egrGOBdHERg5Np669DpqYtVcO5cqTSs7dfMy9BlR7hL7TU2rld0LNn BHXBx0P6frXZWHi+PRvELXflR3R83qeVIB4GeOnSvEX1i4EccMbAeVkBl44PbtmtKyvFmQM7YZTu CdmPt6H2roxGSQqNyqK/T5Hh4fGtWUT+rL/ghR/wUN+Df7H3xYbxD8Y9I0wf26Bplh9jgzeBpZAx mlmdyqRRAbvukk4A9a/WD9oP/g5H/Za8XXet6trXhjxrJa2cDL4Wfwxc2SSNebGguEv/ALUrCJsM xikVJVwQdoPT+CDw34zv9P1Jbvf80ZxG5yGQ+xHIxVGbxBfNdTTFysErklCf9YSc5x39zX5Dm/g7 DG1KlHE126EpKp7NWSc7WvdLmdlaycrJ3dtrffR4xXJRqQp2qwjyKd3dRvfa/Lq276bOx/WH+xJ/ wcXeCPgzd+KLL9pK1+IHiDTbrV8+EbLRodGVrDTifLDXsjLA090kKqp24jc7uBkEfMMH/BcR/hn4 P+Lvhv8AZwm8a6bceOvEE99p2q61NZSltLmiaJ4rtFjkdJSCu1YnEa849K/nD1fVZb+d74qBvKhv LUAKQMD+Vdt4M+FHxH8aKs2mWz29nIf+P29PlQ477cjL/wDAQawxngnwvhY/Wa0fZLRfHyrToku+ qa+0m7p3NMHxLnOKqulQbqSf927fm/Te/TuVPjb4v8NeNPEqa94UtZ7KOazgF7bzS+dm7VAJpEIV cK7fMFOSMnk9a8x02bTLa6lm1e1+1ApiKMsVAc9yRg4xX2PJ8GfCvgDTftOqA65qTsFjimzHbcj5 jtB7DuT6VyV38DtA8XWbah4ZmbSLsEiSyuCZ7cOOflf7yg/jX3+TcZZVRoQoU3JUo+6pO/T/AMnt 0u18zkx3AOZ+1c5crqPVxv8A1G/lc+bbfU7aLVo9Se3iCB9zRDLKVxgjDE8V1F5q0Oq2x8H2SxJa LqDXWnOo2mJplCyJ23K5C/ePy44wCQa/ib4ZeNfCatLqlm0lup5vLU+dDjtll5X/AIEBXD20zQ3M co6I6sD9Dmv0TD1cPioKrQmpJbNO58RicPXw03SrwcW901Y7bWvAWveG51j1i237kd8QyK2QnU5B NcG4kEZYggV7p8TPEk1xaabdRn5pYZN5P+0BnFeKqQw2t3HSu7CSk4Jz3OHFYeCm4wehlsSowBXT xrpsdmv2dZPMb77ORjgdqxZoNsgI4BYZHt3xX1B4W8D+A9ZlktBFMwhhjfzfNI3FgM8fn0rPG4pU 48zTaLy7Lp1nKKa+Z5f4NuvAlvY6pc+LbrULTUI7VZNClsIzLuuw2Nsp3oETad27k5GAOa5zxn45 8R+OvEUvifxDeXl3eSLGjXF1PLPKREgRB5kzO+AFGAW46DAAFdX8SvDGj6BM0WlxypsuvJDMxYbd u7jPfNeQbvrXHhcHSlUeK1be1+i027J2u/MyxSlB+yfTsRMgY5bJz+ter/BHxd4X+HPxI0vxx4pg uLuHT5pbmO0tJPKczxxnyPMfGfKZyN4UhtoOCDXl2xVOMjpmo5Uwcnrit8fgKeJoVMPUb5Zpp20d mrb9Pkc1OTjJSXQ9C1/xtfXmrX2uaPJJYrqQuITbW021hbzEgxy7Aof5GKkkfMOtfqJ+xT8e/wBn f4H6pP8AGy80XUba/wDDHgqSx0eeG7ikE/i2W3lKXbyXGDBEhIEcUG4sQAwycj8eEXnAxV1HkWFo N7BHxuQH5Wx0JHQkV8zxHwZhswwX1GcnGD0dm1dbNPXXTTW56+U5tUwlRVYJNra6T17+Wup+pf7D UPxD+O/7fXhrxZ4h1TWNS1HVtRj1zxHr9jc7NRiE20T3TXW7KmLcGd26YOQeRX7P/wDBTP8AYg+J +kfCLxp8RvGU9x4gbRH0q+h8XalrP9qTGS6mt4XtXVlhYBzMkok8s8qyYHU/yn+FPiR438GeI9P8 WeHtRuIL/TDCLGcNny1gIaOPHQoMD5SMHvX2j8X/APgpd+2x8evCereBvid4zmvNJ1wwtqunxWtt bRTmBkeMnyo1I2tGpGD2r8Z468J86xmf5fmWXV6cKVFQjKL5k+WMrtRsrO8brWy6Puvssk4pwNHL 6+ExNJylJtp6btdb67+p+mP/AAXm+BFj+zz8Ov2f/hP4cuIZNI0PwtqtjAkcWx2vGlglu5nOSMSu 24KAADk9WJr+b8wscjr6V9T/ABr/AGuv2iP2hrDQdO+NPiS78RL4YjaHRJNRVHkt42VEZN2MuGEa 53ZJxya+e4oBO7O/G7J4GOT2FfofhVwxjcjySjl+Y1FUqRc25RvZ805Svqk766+dzwuKswoY/H1M ThouMZWsn0tFLv5G14WhRNUS60LT7y+ltys/lY38RrucsEBwvDHPYdelfpN+194HsPir4S8P/GzT Z/CPh2KXwz5s3h1Nd/tC8+1WKxxTCd3uLmUXU5wY4pPKLBSqxgKM/nb4e1K/8MC8fTord/t1jLYS PMpLpHNjc0bAgq/GAw7ZByCa+sPAnxy8D237IWo/s4a9YzLc33jaHxPNqFvBC0k0MMBhWEzs6yJs JZwACGJ5I61XFNPEqvhsXhouThNJ2evLLSTd9NN9r+a1FllOk6dSjUduZX205ltt/n8tj4Oi0ia6 4yqDP3mOKhmtGgmiR4yuDyTyr88cGu3kEFrDJBPCJd6ldzEjafUYqpc3Z1J7VbmJNtugjKKSocAA ZJ9cAc19vGvK700PElhGnY7/AODPxgb4X6hJHqmnRazpV1b3sF9pdwdin7TD5UcqnlS0MgSUIylW K7WBUmvu3xV+3zr3iq4+HMPhDRtP8Mw/DTwZ/wAIx/bXhyQade33myXDNdhgMRzTeeqXEceQ+zJY ZJr83rOLRbbbNdWTXDh2Lq0hEZQjAG0DIIPOd3PTFe4H43+GdTufDNhr/hq3i0nw8t151lpbrC97 LcKEWSQyRupKhVyCp3Y7E5r5LPshoYqUr4T2immpars9k3u78t1bR63SOmlhvclGdTlvbTXX8Om5 4j4j8ZxXXizUPEGj2jWYuriSa3h+0S3Ih3tkktcF2lIUkAuSRnqccyarqnhq58N3M0OgTzXt0Uij 1a6uZ5DbsgUkoqBY2dgDkMCAD8o9Om8Z6/8AD3WvFaa34d0R7TTktxHLYySgGWULtMnyABMnBwBj P1ruPgb8XPB/gfXZrLxvZ6hc+GrqKSeXTrKVS0OqQwTR2F+kchEckls8pwr8FWbvivSrqcMOqlPD ybik+Xms3bpe+r06tp9d2cCy+PPaU/n+voN0fwdP478C6Vd2f2CCdBbaX/aVnd+V5lzcSERQahFO yBGUEBZYvkABLEnJHt/xE/Z/8RfCP9lGx+LHiPTbzT18R3c+jBNTtGiaW4tJgRLayyDEqOhOWhbC 9HB4NeMeBfiz4I8NeHLex1zRJb++sVmNpcK8AgLyMWBnjlhk81RnlTgV9V/Fz9vnwL8cPgB8Jf2e vHng3Vm0z4VazdXVv5euuLW7sNTuUuNQhWz8gJFNNs2pKrEIuBtOK+LxeXZtPHUoRpP2ManM9Y7K 7S1lezdtrWdrKyd+zDZbho05TnW97otbfPR/p69D8o5pXmbzG+YnBGPStzw8FF4Gk4x0JHc/nX3x +3/8av2SP2iPjE/xL/ZW+HNz8MtNuYVF5oBuIZrMTLvzJCkKII92Vyo444Ar4HsJIbW8S4bJCyKS o43AHpX6bg8TPEYVTnSdNtfC7XX3aHHWoqnUtGV1fc/az9gv4b6x8RNbsvCWgS21pqN/dWdhDqF1 KkSxLONrybpQU3KpLKGBBOMg1/o7fs5/sH/C6X4M3Oi/tAaDpWq3V5DJpUy3D/aRJpihVVpGXajP MVMuVHGR3BFf5Tvww/a+8Z/CHxZZeIPh/BDClrJHK0F0TJ5pjHRugwSBxiv3j+HX/B1f+278O/De n+FLLw94Vv4LK5jmaTUzcyTTQoCPs5ZZFCRHj7oDDHBHNfxnxH4RZxiOLIZrjcqhi8LyS5YOUbxq NJKTUmrpJaWfuvVa6r72HEyhgvq2GquEm1dq+qXmtvPTU/ol/wCCvvwR8D/syfs+rqfwo+Gnw0sv hzZ+H57HXdb1Pw7Fq+q20sBH2JGjkEZUSSYAuDKzLuJK/KA38O/7SP7WGu/GbU9O8B+MrGz/ALC0 W6e6s9Z0+2b7a2nmP/kHpI0jbLNDuEMe4BAx5xgD334pf8F2v2xfi98EdU/Z+8djQdQ0C/DC1S4t 5ZJrMPM877ZXkZ5izP1mL4AAGMV+aD/tKahcy29udE06O3is47N4oXkj8wrDJEzMVPzCRnEjoQVJ UDGM19D4f+EeaYLFYrFY3BRV5NwUZq0VyrVLo73SWyX3vy82z/20IwVRvvfrr3vr/meaeIZFfUbn XPD0flabDciKBXdVaMPuZF8sOzDgHjJx3OTk9V8Nb3xlrnjzRtP0aUXF+btLe1e7m2RIXbjcz8Kq 9ST0Fdf8LPHvg6wg1e28Sad4ZhW90qHTRPqtrLdSBlk3+fCQHKyjbtYjHynA7iuSsJvBHhbUVMGr rIfOIW5tYJcqMj5gWVWUY6gAnGRX9ARjNRqYeph37qSTtzXutbtefnqfOcji4yU9Hufq1o37LHgv Sh49+I3iy8/tG/shZzeGUjlZkjnus73l3DbOIlw42t0UnkV846B+xlaeI4dM8SJfTXP9o67FZago VREIpHVuSQWJbOTyfSvm34jftD/EHU7yCHw9q0wgtoki3QqyRSeXE0Ku0ciglwjsu4jOGPrXnOlf HH406Jo8OhaJ4j1Szs4Lr7dDBbSGNUnByJBtx8w7HNeFlPBePpqrXjiXedtJX91KKjZLpqub1bue xVxeGcrOlov1Z+sHhr9mvVfB37Tlzovw1k0i41Tw/oet+JY7q5kv7BfD1lo0QuYbuCSykSSS4LRk LAowRkscGv6AP2IfCn7Mdt4u0H9uPx/qGn2Oj+NdH1qGyjvFvZNWj8bW5sR5lveRSM0cJumcW43I 7W7GOcs45/iK1H4ufFrUtYuPEd94m1yS/uoZLa6vBeSrNLDKNskburBmRgcMpOCOtf0K/wDBMbSP 2Zf2qvh7beCvj78VbjwdeeGfsOh6JoUWlzyNcrcx7pJkeCV1d/tO4PJIiZBTk8AfJce5HjMvwcMU 5qajpK+1ut3LTfu0l67+xlObUeaVOEeW/nb8bP8AW+xT+HHg34L654j/AGlfhD8ZPhrLH4mtdVm8 WeH9XguhZXugXEpNzJbtp80vlyWpUOWSJTNgbec8ftB8b/2lPhN+0BdTfAT4O/Etx4Q0b4P3V3P4 Vu/C8bXs6WejtA9q11cAyozOkbpFvyowwzuzXwD8IP8Agn9beHv27fFHwT+IXiqKXb4I8PeItNuf BsH2621HSYjcWim7e9kiYXAdY/NZSwDsR0FfW3jD9j79gH9nfXkh17xR4ls9Z8TWOqzxj+y4HQmC ENc75IrkopAcFS5G7OFyRiv5/wCMfFChh8VLAUrVZOnCUeWUesE5PV6q13dXslvoW6eKpxcoQVru 92u+i6f5O+2pa1j9qD4GfFnSLDwl4X+Et/oehaJo8FnZyWpsYLq8vbSFGRTOtqfssNwwCTSec7jf 8qlsk/VviD/guRb/AA/+BWn6H4cOm+F/iZodglhDam2vLzwza6NDGJAUjsXC3VzvBhUOQqBS7gHI r5G0b4ofsu6L8IdMs7Xx3r0V9L4XspmCaZH9nW9e2j+QMtxkkPwWwMYzk18W+PfC3wqt/hp4i8Yf EbxcdN0lNL1TVL7SfC2n2097cCURqPMvrqaEvcXOArrGEVBuILE8/jPB2f4qhj6nPSdP2klGPLLV u6+Faq97WVlZ63WhxYitjKq/eyUrd3H/ADT/AK6n0n/wWK/4K9/C79o79hvRPCWo674mt/HpBg1i 38OWLw6Dq18qRSqHm+3YjtoJgXBVZ5Cy7V2KST/G/qXxW8aeILzw3qfxOW68QafpNxm2TVpJJRd2 qOhktjJKXBjwoTheAeh4r+8xv2XP2B/jf+yJonwn+IHjHwNp+i3HhaxlW4vH0+1v7KeW2ilaSGU3 AkSbf958/Nggk1+W37PX7Fv/AATM/Z78B+KPBv7YPxN+GXjWOfWy/h6PSb03C6fZYIEkDGUSxzyb gZACV+Qck1+7eG/jvl2Ey7EfXcFVqYhVXouWc6kZXjzxcbWklrJSs30bZ5OLw1blipTVrdGvXa+q P5VGvZPEEtzrVtcJHeM8uLV38qKO0iUNHGrOVDKijYkYyWAAx0z+gv8AwTo/ZXh/bZ+L1z8JpL6z 8LT3OiXN/F4maWGC3s5tOQXMr3xllV0hliR8+WCQ6qQm0Nj9G9V8X/8ABGbU/FWm/EmC0svD8+g6 rq1g3hnToDqFlqMEDi1s7uWSbyyFlhj89IlQ7ZH3FmOa/J342an+y7Y/G678Z/A/WdXg0DUNQv2G kW8LW7WlpMrGGITLJmVQxCuPlyM89K/d8t8Qa+cQqYOll1fCzUbqUqbaTTfu3jeL0Sad+V3t5Hn0 HGlOMnaSXQ/Qv4j/AB1/ZltfgVL+wfLoen+KvGGk69d2kXxn0rU5Tp9xHN5/2WM2TW7yNDE8hKrG zM78KwBOfxX8PaJoy3ds2syyMw1A29xE2UIjGQW9QwI6H6V31z4g+DXh+8tX8K33ii6WKzMjvcLH Ay6kHZo5YyhzsQlXG7L7h94A15Lf6h4cfc9u+ovKzb/MnK5ZicszHrk8nr1r6zIeHZYelUp0FNKe rbVm5a3dvs37LRWVh5li5VuW9tNvJdF8vvP7iv8Ag3X/AGof2Qfg7Y+K/GOqeDLzw/qOl6JcQjx2 l9JPbNb2++5ntZoXYRRSSqUdFwQzr2Oa/lW/4KIftH+HP2jv2rviH8VPAN/eX/h/W/FV9qWlXGoR mCaW1nlZoS8LO5QhTjG48V8v+G/jJr/gnw3qnhXwPrXiLTdP1m3a21S0tbny4ryMkNtm2kblyB26 cVg+F7v4Ql5f+E3h8QFdg8tdImt0Yv8A7RmRwB9BXx/CPh5jsrx2LxOKqyq0ea9KCV5JytzynJvm nJtJRbb5YpLZRUbxGL9pThTWj6v02S7LX738y/8ACrxVdeHfEkGoyzPb2kE6S3P2c7XkTcMoWALY bpgDn9K9j+Kf7QOq+NvH02veJYtHB+aO0urjS9tzZRKPkQpCYll4ARTIhGOwHFeS6p4g+AzRxSaH oXigTRrhmuNVthG7KflYqlpnkYyN3Xpis34rfGTTviLJpgs/Dek6Smm6GNILWYYTXcwkL/bblxjz bgqQmTxgdK+2qcMRxeY08bUwTTs4uTcE4ruknJvmtr5b3WjyhCEack62u6ST1/BWt/Xc86164a+8 SXN1czQztJJv8y1ULEynptVRhfoOnSv1T/4Jj/tW/FH9kz4uaN8XvhfJqsjaNrER1S0gfybSa3Yb kguJMhgkh3bgflwCT0r8h7e5mgQ7QvQjPOea+o/gp+1d8Yvgn4duvCfw/nsFtNRa5kuYr2zhugXu baS0YjzVOCIpHC+hYmu3xC4UnmWVTwEKcZXstW42804ptNbpq1nqmrG2T4ijCsp120vJXfluz+wT /grd/wAFHfiB8dP2Z/DfxU05ta0zTtTvZltIkjeOIskSI/mTJsWRZPmCMihXUhgdwr+dP4SftPfG m3h1PVdG8U69Yanq8So8y6lcwPdkSZSKWZG8wqC3TOABXhXin/gpP+114v8AC3hvwVrmvWbaZ4Vs DpmlWY0218ryPIW2AnQoVmKRoAhcEryVwSTXy1afF3x9aTRXFrexrJB/q28iIkYOecrz7Zr8Q4Q8 BcwwuDrUcfONWpOXN7SU5Tk9XZSbhfone9229E1d/Q59xBSrV4ywkpRgklaySTSSdknbc+tvi78V PjtpPhaw+G/xLv5Nc0ibUWvdK8O3ss95ZWqljvls1cbVkkJKs4Yuc4OOa/pZ/wCDdHT/ABC3hjxO LDQJ7PQb6Y30a3FtLd/bBHIYw0ckzNHbmHYVcKC0hI5GBX8e/iv42fFfxz/Zy+KNdvroaOHOlIWC pamUhnMaqAFZiBk9TgV13gz9q/8Aaf8Ah1Zrp/w/+IfjLQoURo0i0jVrmzVUdizKBC68FiSR6mvs eK/CLHZnkccshOnSm5KUmubl0b2Vlq1bVq613dmdnD3FtLA4tYmSlNRVktL3t310vfby80fvD/wc 4eKNLT9pjwV8MdNS0txpvhWfVbr7LbG2imm1C4G2ZgqhHlZYtpkA3bQAxr8pf2K/g/4n+LHjmytr NYNPH9o6fpEWr3KqLW0ub+RoomlxjBymV2nOQDzgivh34i/FD4k/FXWk1/4m+INa8R3sMIt4r3XL 2a+nSIHIjV5mZgoJJCg4rlLbWNTtIzFaXVzChwSsUroCR0OAQOO1fZZd4dVsNw3SyKjiFGcY25+W 61d20rr8X954+bcSxxWZzx8qd02tL9lbc/0N/FzfDXSPgV4f/Zu+IXjE3kwhk8M2OsvNFcSyakPM eSScxvtERCkbpNoYYDHjNfxYft9fs2aZ+zZ8SrXT/DHivw/4r03XIZdTtLjQrlZ/JUuRiVASYiwO VUk5HTiviB9Sv3TDTzkkcnzG5+vPeqqQszdOW6n/ABr4fwr8B5cLY6eLo5g5xmvehyJKT1s/idrX 6Lv307uKeMKGZQUVhFBpJJqTdkulrWZ6n4a+OHxD8KaFH4V0jU9fs9K8zzbnTtM1a7tILgkYYtGr FAzDgsF6VxOt6he69aW7TvcTyrIwH2iZp3CnkAFuQBnGOhPPUmsw6dwCuffmoYw0JLA8+x/wr9zw +WYajUlVo00pS1bXV933Z8RKUrajLu1fT/KYEZZdxXGMEV9o/Dv/AIKP/tsfCn4T6Z8Fvh34+1fS PCmiX7ajpukWqQeVb3cky3BlVmiL7/NjVxluCOMZOfj5YDcrtm3MMbhk9O+BUM1u/k+TGAQpAJHr WeY5Rg8bBU8bRjUSd7SipL1s01c3o1alN89KTi/LQ/SD4mf8Fm/+Cmfxf8E6n8OviH8XfEuoaNrU SRarZEW0S3KIqqodooVfoozg89TXha/8FDf25bbwjB4Ds/i38QbfRbe2a0t9Lttbu4raOFxho1jS RV2kE5GK+VjpVuhUMwOQScDnipBp6+QdoHUENmuJ8K5RZR+p07LVe5HR99joWYYpbVZfeybXPG/j bxZZ2mn+JdW1LUILDzTY299cSTR2/ntvl8pXYhN7/M23GTyeawx8yAPxg1rQ2C7XWQYO3Kt2461l lMHGeScc17+Gp04R5KcUku2h583J+9J3H7/Jj3L+XvRFO8oIYd+pqa1ZDHJEcYZerA8EfTpVFMRA RsORyTV8t20ZKLNFZJ93B/CrMASR8yMQij5pOuPQYrM84RxFlJ3HgY7ZqFJQ0e2TcDnnB4+uKSpP Urbc1Hku7+6YI8rqwwFYnAAPA9KTULGWzSOS4GQwIVh0yP8ACq9tciFiF689etWZL6O6tjAybn3b gfSp5Zpqy0FvocxcfvHG0BQABx3xW7o+hSao3yyJGM4YuwAB+v8AjWPKjKQH7U6G5aFw3XaRj8Oa 6qkG42i7MlJLc9U0zR7Lw5czLr97DE4KNCYgZmZj/d2cfrXbBLrUbG9jkRotPiAmE2PKluHYELlO QFHUgn9a8Ss9cMNybyQlpP4Cf4P90dj71aufEd9dJ5KuyxEDeDklhnncc5rwMVk9SpLmb1016L0/ pnoU8VGMWi3raw2cIsbDywXQSu6ehHTPf8a82Nu2eWO0dBmu21R7WfD2SmJR951Y/kAe1c0tu8+4 wg4HRT3969vAxcIa7nFVd3oUY3jUlZl6dPxqX5H+ZAy47dKmmtWUjzeADnj+tDqQMDmu9yRm10KQ B3ckcdRSbyjDoevHep25yOOp98VEFU8Ywc9Tyea0epBC7krlcHjoB05qNZZXYKxz3x6/pT5F2uCC evzY6/jU8UTErzjAwMikAwLI7KFAG0nJPSpVYBsADPHH+FTSIAcg/pTSA+RL34pDGsxZdzDBx35p m+Mgpktx/OnMyl1DYKk/5FaumaJcakGubcrhDtYHjH49KnRasuEHJ2W5z8igKdvB6nqP1qt5aDjI wTngc129/wCGtRtIPNm4B7gcVy6wrIfmyB0B/wAK1p1U1dMupScbqSKwik25B49QamLEfMDknFXw qqBwCenbBqKYDAOMdBx0H+FKMrszS7hFno5+tTAMRgcc9v5VAQBwewHJ/n0qXcA2F7fnms5K2o3A ntZU3FeOeD68VDMGLsVP0z/j/wDqpFOTwPXP1pGlC8v6d6hbls+5PgFbXM2o6FDagGVkXywehJB6 16F8ctP8Sad43tbfxK9rJcNpNnJGbRWVBCysYwQ3JYD7x6GvPfgXr9n4Xm0LX78MYraJZGCruzjO BXb/ABm8f6d8RfGUGt6XDcW8UWmWViUuNu4vAhViApYYPbmvw7HUK7zxVFD3OSV5dnzbfcfsmAnT jgIxlLXTT5I8wMZDZByMZ6cfzrrvCdgbu6a0B272QZz2rn/Kz1B444qzYatqGhyNeW6wrgqEeQtw eTyAK7a6coSjB69Do+FXZ+4XxJ/4Jha54YuvhpHH4htJn8cpfPGJLq5f7NDZ2kVxJLIzqm1ArnJX gYr8l/2lfhmnwc+OHiP4WrdR339g6lJp7XkYYJKUAywD5bBJ4zzX1J4g/wCCpHxL+IeqeD7X4mWu g3lp4QsLqwgtrJXgnuIruGOBgzyGRQojjACqoHJJ618W/Ffx3ffFL4ma18Q7xFj/ALZvpNQSAt5r xiQ5WMyHAbauADgdOlfjXhhk3FWDrRjn9RSiqT2ad6jqya6X/h26W9Xt9Jm2ZZdVpP6rC0+Zfdy6 9X1PMtmGJB9ORVfWJpbXw3cTwsUdd7q46ghDg/nWiYuoXue9ZV7YXF/pzWFzcMiO5yI1XdjHqc8E V+44erGM057I+RxMG4tR3Z53pmu61qnh22Wa5mab+0dvmqdrGPGSC3f2rovL1H/n4vP+/n/16W38 IWVpGIYbm7AVt6qpRcMRjPAq3/YA/wCfq9/77H+Fe/PMsLduKsvQ+RllOKaV307n/9f+GmO4b77c kndk+vSv2e/4J9ftqD9n3wvZeCNX8L/D67iTVJ7/APtHxZpsF7NImoQ+RJG+9fmQxndHub5CNy4O c/i1bwq6jziSM/w8k1+o/wAJfhz4cb4Q2/h/xbE9zBqwF1PMwXdbl1Aj2sMkbABg54PGMcV+acbc L4bNsDLB4padGt09dV6H6hwPnFfBYx4mik7LVPZq60frY/Vr/gpH/wAFK/2Z/jR4av8A4Afs/wDw 80DQ57228Ozar4j0OO3t7eWfRUm/1EMaEqrrOVY78sRlic1+P6aPc69pj6fHPDatIhfz7g7YxtUs QxHIyOM+teI6t8KfEHwo+IzWOoB5rGaORtP1AD93NHkYBPIDgfeX+ld/4yNvL4CaO4k8mN7q1WaU cMkZcBzn2BNfm2V8D0cnw+Ey3DV5TfWc/ek5O95P59Nlsfc/23PGvF4ypT5L3fKm7JJJJJvXbqee XnxI8OeH4T4dvraa/ibTLmF1miCvb3E6YjKF8khWwd390nbg814hpWtmxuI7hfMjVHEhIwTuHTB4 9OK7+HRfh5qa3NzZ3N2k0EgRVvJkkWVSCNwIVDxgY9jXBaloN2dV/s5GAgDHy5GPyY6nGO/tX7bl uQ06dLlUb829/n06bn53jM0r+0U3L4drfhqfqN8Yf2y/C37VU/w207XtItNF1nRdGtfDGvao0ojt dT8lykF44YZifyyqzMWIZlL8A4Hp37Yn7IWgfsx6boHjuTxh4B8S2Pii3mudIXw1q1tqM1o0Z2Yu UjdvKwcHnrzjpX4vahps+n3HmBlZQQN6kHGehA60Xd9c3MKQ3FxJIiAYDDge9fnT8KVhcZh6mXYl 0qMFJSppJqXNLm36W1Wnf5H6BT8U6tfD1qeNoKrUm01N77W7/P5fM9wh8b3/AIa06603XVluLiRh JBLaplQH5OW6e4FeYr49vbjUjJc4lgT5mTZhsY55XBrjtTvrjVLn7VH8jgbcKTkqOh59qn8Paze2 t8UcmdGUq6StwB6jdmv1DC5XSi5SUVeW/wDXQ/OMVnVabjTlJpR26/f3Ok13xdomruPIjngK8+Yj ABuBwV2n881zkF7YSyYfUbiEZ/5aRCQD8QR/KoNRdyHmuoYlYLjARV+n3cfnXNtNbHmSInuPLYjH 55r1aVBwVo3X9eZ41XGOUrys/wAPyPZ9GOkajYx6PrniGGWx0+R5bC2+dCzXBDTYLJhc4Gck8jjF dzceB/h7q19qA03VpIbSG6hhsjDE0hngcfO7bN33T618vM1rIu0CReRxww/TFaWm2MdzOGV5Aqn5 igIb2xzXLLCSs7Tt8vO72tv19WdcMzXwukn836Le70/Q+0vgtZ/B3wh4q1e08W6rpzixv4YtL1G+ BXfC4O+WNXVh8vHGASe9XvjNoXwQ1jxVpMfg3XNNjGpXkkOp6navhYrc9JJQNqDd3Xn6mvlWfUNS SDyYriaNFPCOxdCo/vB9wJx3xVa21ozW0tnNbWUsXmk5MCqTjuGh2GvBlw9OWJ+tRrS5rbX027W+ du56sc4iqSoOmrXvt+t/lfc7i1m1PQZLrRNA1i+ezFy8SG1uXSNgmfmCxtt5HOR+deVNPqkviPN9 c3E8huMSTTOztJj+8SSTxxzW3Enh2dgs9tJbsDgCCd9p/BwxH51halaafYXZtnluY2ABG5Q4OemC GB/Svp1ScUpOO/XT8bHh1p81ve28/wDM6LWzptybbUrMhZ4pkDpjgrnkn1wa7OK8uFhbc0LhhnAT HX3zXBy+Hvs2u22nSTp++kVtrqynAbuCPw613F14aa103U7y1nimKXAa3SN8N5fVlVSf9oflXK69 K6Unv/mdEKVRc0rbGbcWFs0y6+0hJiVEEapnocYxnnk80y40KewMHiuCTdIkyyw2tx8gyGJHyknC 8dO9S2Q8nSJGvFZHSVVfzgVA46c9K43xddWst7E9m+cIARHgr+JFehLAr2XOpmM8Ry7x/wCH7kEr 6jdxLHHYJGTKzCVVOMvxjJOMelUjoOsm6HmghiPvsd3A6A1W0l55dYt4zI5BlQYzxx7V3Wr38MEc pklwcFRGTjP/ANeurD4alKN3c8+Um9TnZNK1e4TKsGKsRweCfc1g3dvd2MvlXKHzCA2Qc47V2Hhm 58rRnMgCqkvc9iM85rC1TWYWvPOtVV3C7RJkkD8Ohq6lCl7NT5tWROWpz7zTvIHaTpXVLpV5awrd iYYI3bfbH1rj9zu5d+WJyffmupnk8PArMssmQATGF4DAdOe1edGkrvU0p9TM+0ahJO3lsqgnABA4 Bqaw1h4FnS6aI5XaOB1yM9vStD7focduWjZd4HQDnkVwbxEEuO53KfXJoaSW1wd76M9G0G4EmvWv l7NjXChVx7+td14ng3QSjpuBrg/B1uqatppPObhdv516X4khKpLuPAbH15r5nMJ/7bST7fqfQ4Kn /slT1/Q8EjtgzAbjwxHTvUkl3bRK8Bz5g+VSPX1NWDLaKhD7twdjx0PJrBmBkkaQZAJPy/jX0Flu fPShbRHS2N9FdFIZ3KzH5Q/r9f8AGulutKjsoYrrUlmkWddqiIjeCORjPHT9K4TSre4uL2KO1ieV 9wxHGu44H0r3DW9Pa38PwvebI2t4zKysw3ckJtUZ5PzZwOwPpXHiOWFjuwsXJOXY5TQJfKewvLQi O4guTIkjIsnIYbdytkMB6EV90+CfHvhfxvqqaX4qjjt7hLYvPPczuFLLx8g3BQp4wMDHT3r8/tPv VsljeQZRJdwcdDz7fyro73xzZMU8uAl0YHeGKggHkZUhsEdea+T4r4Ww+Z01zXUkmoyWjV/u+5n1 nCvF9TK53jaUXa8Wrp2++3yPt3+3/AFz4c1LV5rOxFzaTBLe1kZy0wOMsAT7np6VRvfEPgK1j0pr S20//TcfbVCk/ZwSoyR9D39K+frn4p/CvVZIbWy8MXlsjRLHdFdQmeQSHhpI3dsAc8Aqcd81yvjd NK8Caq9vYvFqcco+0W0huDKohYAKHaNhlwc7lPSvzXC8L0nVVKrCrCTu0nJbWta6m1o/e/4Gh+j4 /i+SpOrRnSnGNk5Ri9He97OEXqvd0X3M+jdS8b+DrLxFeeHoJLK3gmtHW3uVBUOzpjBIGO5618xa 14BnvW26dd6RHDGvMhch2Pq2E4Htms6+8QaFrFhBqF1osFo6s/myQzO0cmR8hCMxZQp64ODXqeke Ovgho3h+3tbrQE1G9+VZGeZgXz95nJAGR2HPFfS4GjUyuCeFoVJSlZP4Hqr6tuVtfX7j5bGY2hml S2MrU4qN2n760dnZJRvp+m7PGb34deIkEQSe1uht+UxTEqB2ADAfpTrPwhqNsw+3WbORxhWyPzzX U+JPClppRj1q7L2lvevJLbWYbcIo2OYxuzzwa5N3t4pd0F3OroSo/eNkE9uvev0fLMbOvRU73v5f 5O33H55j8KsPWlFxtbpf/NX+83db0Tw1bzC1hhkV2RGDb+BuzkY9sV3PgvWrXT52sdhIhiVQd3av FL3ULzJU3Uj4H8RB/wA/nUttNrLRFBc7Qw5ZVAOPr1/WvQnRThySMsNjHCXNE9D8a+OPt2rDS0t4 JobeR3YTLu3PIBx7bRXjq2tuysQh4569s1Pny5mAbcd2d59a1Yo7JrQT78y+Zho8cBT3Bzyc9Riu enOFNe6jacHVvOZmLa2vB8vOOvzZ/Cp0tLSQELEg2qWO5yOlaMFh9owS2FdiobIwMcn9K9S0n4c+ HNRtPt82pzKu/YyLENx9MZ9TWWJzCFNXk38k2a4TL3WbVOK+dl+Z4tLbWskYKoIzjJ2kn8DmoBBH EMP8xPT0xXonjXwrZeG5IEsppJxKC26RQvTpgCuIaAKPn/AU6WLU1zJ7nFisJKE3FrVFJo1SXevC 54FWY3KjIw3PT1qErubG7t1og4fDZOPQcGtpS7nByaliaPn5Bg9c9eRWjaAFhxjp3yKgRGcgKCxP YVfhgYttKkGuatPTU7aVJ7na2WnLe2+FznA479alt/CtyL+IYbDOOnHBq34XS7tp1eIeYBjI78/1 r9L/AII/s3Q/HbRYrjwikja1bujNpaxsZJlByfLUfeIAJ4r8f4049pZHCVbFStT2v29ey8z9R4O4 LqZvNUsOvfWtu9ux+evizwc+mRIs6n5wBt24OOtcbZ+EnU+YwIXPylh696/oQ+P3/BPPxVoeqwax 4t0670TTILKOWWS8jaMSO0e5VUkAZK9R2PFflD4o8OWUni9tH0aFpERzEgVcAjt9a+B4E8c8HnOG TwdTnsrya2W+l9r/ADPteMPCXEZZiPaV0uWTtG3Xz9D4/wBT0t4XZd3Qc46ciuJms5FcKhz7ivpj xz4Mu9PvHgKlSc/Kcjj0rgT4KuYIBd3KlVIzkjtX7fk/EtGVCFTn3PyfNsgqqtKChtueSm1miXee prN8uUElRgHp2ruNUgELmLGO4I7g1zLxsWOATj06V9fhsRzLmPlcVhuV8qKUZlDbXx7VdkiUxY6c 8elO+zl2DMPc+w+lWGjIUKAccAcdRW0p32OaVPSxz7SzjMY6dwKiCsHzj+lbhszJKQpx35pWtGX7 2MY6/jWyqIzdFmASY2BABx2qTz5N27nNXHgXdkce1NEQPApuz6GPJYp7nLeh60IgHzjrWnHbHdz6 DFXUtCxBUHtyaiUktjRUWzGlmeTjBBGT1qWaYXSpgYKjn86uyQ9cqTmrFraliAFwaiVRJXNI0m3b uMa+ZZkZx8oXGKnfVLNgQqsD7DirE9go+8OMdPrWHLCSQAB+ArOlJS1NqnPHQguZmnlLgYHoK7jw J408T/D7W4PFXhS/uNOvrNxPbXVq/lukikFSD0ODg4IxXIizbqR7mkl3bPLwQOmMd6nEUYVYOlNX T3XkcrhJO59D63+2H+0/4i8bn4j6t498RNrrae2lf2rFdGGcWTyGZrcNEFxEZDv24wDXm/iX4y/F PxXKl54n8U69qE8asqSXV9PIyq/3gCW4DdwOtecGD2zj0FMeBRwQeDzxXHhuHcupNOlhYRaVlaEV ZdttiniKjTTb18zTl8Wa/cbY7rUdQkQKAEe4lYADtgtioJdUvLhf3880nOcSOzD9SayjCi8ADFME KY3ZPHOD6168MLTivdil8jnu2Tu7yNuc5Oee9RTIIjuT7p5GAM/5NWxjaMZ5HAFBO7BA4FOMFF3S MrWKokkbBIYdsnpmqUlzKkhUgjHc962HmCgl8EdvasiQK7Zz165x0reOu5TbsVDd3HAPP/16Ybi4 zkn/APX7V1uh+GbrXJ1hswh3yBFLnAye1c1LGEcxsCCDgg9fpTt0IlB8qZWWWcjbuNTosq55wT+F PQhFPPJPbjiumvraKzvvLgIwqxsCORkqCf1oatqFOk3qTaT4b1XxAFGkxO5yI8RAsWfOOg7+1adz 8M/HELTtJpN+Ftz+9ZoHXZg4O7IGPxr9wf2Uv2+PBnwy/Ze8SfD7xHp3hbUIfEOlN4clW5sbaDVL a4tYfOt545TbzOyB2K7+CSSCwwCPSvD/APwUvtNY8I+JNB+Jt3oMllr2k6Hpl1badoFtbSed4dMJ tn85IgCHEZSRxksTlwc1+T5hxzmtKpNUsvbUW11u7dumv4fKz/RqfCeAcISlitZJPS1lt5301+77 v53YvBPii4lAg069csN3ywOQRnGQcdM969E0L4M/Ei+immstIvWSNQXkMRCqSwA3E8Dk45r9T9Q/ bA8K67G/xBh8NaTJqWhXWmWstqbNRZ3MEkryTPLGqlCisMEMPn3Dhea+m/Bv/BXPXvAy+MX8E/Dv wBa2fxBg+watapokQis9rcfY4xhIs5ZlVSdpA4GBXDiuOM7lGMaeW2b3vJWT+9Ptr+qs+nD8LZQn 7+MbXlH+v6+8/D26/Z6+LSwQPdaVPH5674zJtQSDP8BJG7Oe2a8x8beAvE3w/wBYk0HxVbGzvIwD JbSnEkeRn5l7H2NftF+0Z/wWI+OfxY+FPgT4Zz6X4W0+LwIv/FP6jpVh9mvE8vhTM6uVkwQG+6Bu 5r8i/jz8dviX+0T8StS+LHxc1SfWNf1aVZdQ1O6O6Wd1UIpbGOQqgD2FfW8MYnOar/4UKEaat0d3 f/JbJ7tatLY+ez7DZXSjbBzlKXntb7t+vltrueNCZYjhgW/lV2Oa3ZNzRBgRjr0NYzEc1Zt33Ose DjOR9e1fdclrHycJO5ZewZt0q4A4BFVxaxjq5PPaus8RosAhMaeWDCm9Q27LdyeTyfSuRLP2Ofc0 amtWlZ2RrQW9v0DYx7YpGdFf5DgZqvHy3/16c0TAbsHFYTS7k8mmiNKOaIfl92i4G1RKVHzH8sdK Syt2liPXHcg1q38BLGKPlRgZ6jAFcTqRjLlOz6s+XmKaNHKu58DjjHbinr5StuXPJqukDJEgYYJ5 /D1pwyHBk4yfwyKm/UOSytYtSDchfvg8nvmmK/lqRyM9M9DT5ZlaTtwo6VQllJQy8/dxg+tTD3h1 tNiyJEVixJYYOM859aZa2cMyGf5FUdSwosXjKFuMjpntntUM7v8AZBHGSNrsxXsR712UWk2mYxaS uy3HaQXDrHAHIY84XA571HrGj2tq8UNiryO4LPnkqB646UzTbuQJnJ5wDu6VJeXCxXLLDlCwG4Z6 cdjWikuZpA+W2xmvpM+MABgcbfTPcde1M/sS9xu2qPqR/jVxZCIFJcA5PDdTj8KtW1ym1gTtIOfe tIeZn7ODepUh8O6gVJBiAI6kjk+2Kq3ek3WnxG4nZQFO0bT3Na1r4hlExtdNIJc8lxxx6V0EjWVx EILwB2J3H3NErp6m8KNKSfLuebxW0dxC0zzBAD0I5NUpbaAEkSZ9CB1r0eW78O6fKLe4t492N2Qo OPY1hy69oluZIhZg9wTj/IrRN9jKpRit5HFbW6ZyCfSjLopZ93qM/wBK3LrV9PlbfFblWzkqW4I9 OlZ13fJdwY8sK6H5Sp4x6Y/rmuiN3ujhkkm1zFRJCeuMe9Sx3BdcMcDpxVNFZQOvTHNOcsuG2t9P ar9mriUnfQ144LSSCSdpgGjICxvkbgc8g84xWfLGAx2dPbvVVjs6Hsc0RsQAhNJw6hz30EcDdsXg kfX/AApyoigsc9eDWhHpzyBZwVAbO3J9ParD6Tcf6olATzgHB45pcy2KVJ7mHiORwG5J7Z6VOsYD fIHPJ5GSP5V19laabYQmWWMySjGWfpz6cVvG6toGVMD7pcYxxipc30R0U8Kras83ZJsg7GIz1IPH vVN0ZMbiMZIIHXPp+ddzc6r9qcxINgchTgfrTtP8O207eY+SASWycDHqajn5dZA8OpO0GcVFY6jd DdBGXUd+1dlo2k3T6ZLYBQJpJ0ZFJ6gA/l16Vtag2mWlj5cDncHwSuAMD29K5X7bKrnySWA+YsDj n61hPEPoUqapys9T0XxnDNHocNmMExhTJ9VGDzXjKltue/bvXZXN9JqNiWmZiUGB82ePf1+uK5XY PugY6DitcO1ypFYyftJJpEW1v8ac6kjnkU8IVBDA8+tJghccda05mcrhoNjs5pF81M7V6+mfbNMZ cLg/jW/bTl7byGB4Hb3qtNaSyDEMLnng7T1qXM39jdXO7+G3hGPWrl9Z1RD9itzs2njzZW+6gP6m tLxz4BuvD1yJrCP7VaygbXhUu0bd0bAPA7HvXZ/A2914TzaLqK4sIY/OjDxj5JnIHDEZ5GeK+kbi 2VIw0oYrnvnHrx718JmWeVsPi5J6rt0t/mfoOUcP0MTgY2Vn3trf/I+B1bxZBD5NuupIigAIiS7c ewxXofg7xBrazxaXr1tdMGYCK4eNuPZ8jt2NfWyxJJwsfAONyKck49elc7qtmDNGAhU5BXK4OPWv PqcURqpwlRS+f/AOulwvKjJTjWf3f8E5+303Vbu3F40DwQnIV3G92B6bUX+pFXbbw5bSHzL9JZCD 8vnjj8EHA/Emun0+1t4LV5ZEY/vDhgpbGB6HIrSSGzuYC8QYFf42CqBnoOeK+d+tfI+jWDvvqcte 6Lot9bi0vIFmAzgTKmB/u8gj8K4+XwfFaP8A8Smea3XP3JGWWMfgWDY/GvTZLexiBctGOmW3pj+d U5xDGyxiNhuAO4HPXp3rani5QVovQzq4KM3drX+up5Pcx6rpl+kNysLxyLzLDJ092U9KfLqFpE4U uoPUkfNx+Ga6/WbYi7UxrtAQsDgevvV0PBHafbLmV4lI+82FHA/DFafWE9XE5nhnG9pff/SPOW1S xDnZvcf7MbEfypv9rWP/ADym/wC/L/8AxNdY+q6Qg86TUFKk7QQ64z6ZBqH+2tD/AOf4f9/f/r10 c/8A07f9fI5nP/p4v6+Z/9D+Ga1l8iQspzxgA+/8q/Tj4ZfHH4Z2XgTSrLxBq9ja3EdmIp7d1ZNh GeCMHt781+W5Z8/e68nAq75hEJ3dBjbn36141TCKa5ZH1GAzOeHbcVe5+nPxJ+KXgfxf4fttD8K6 paag6XPn+VC+XiVRgjB5wc8flXkvxMxH8MbwydjCBn13Cvmb4TbJPE7Nnj7O3PpyK+mfiqw/4VTf Fs7v3LDPqXGa/P8AOsMqWZYaCf2l+Z+h5XinWy7E1Wre7L8EfGDTqFyWGenBqo90N2AxwemCeKyp JvmAIAFVndx93p6j0r9RWiPy6pVZ12lTRz3Yt5ZjGHBCuRuXOM/MMg4rZ1uLS7S2haPVoLmd1y8N ujFYl9GfON3tivMGmb+mB1+tOWUMdqjIJPt35rOdCTalzO3y/wAjajilGLjy389f8z1bQ9A0660a bX9X1WHT4432WqSRNJJcuuMhFQ5GMjkjHvxXaeIfh5faT4dXXLm8tEaGNJZLeeNra6KS42EK3Egb PBB/lXhmlbLq8hhuySm7BXIyAPTJAru/EeqTWuk/2JeahHfCNo47dYufKjT5gA3decAZ4NcfJVjV TVTTtZbfdf8AH07HZHFQlSfNT1Wl7v8Az/JevcwL/ULidPJwGXHGVOR7g1jwW9xcS+XbguRyQpr2 Lw38VPFE2jf8IqEsBZQ22N7W0ZlVEIOd5Gc571xV/ZDw7OL22ZZDMOXXBGSe2K9bC1m21VVu1nf9 Dkr0IcqnCTffS366mJa2M1zuiCkSAkbFGWyO2B3Ndb4Z0PVpJZkeCSIDBLyqQo6+3WsvRvFVzoms Qa3p6RiaCYTDI4Yr6819C6T+0Ve3YEV7aWZyTwwIwT6N/jUYv2zfLh4p+rt+hvl1PCv3q9Rxfkr/ AIniGtpJZ5iuVwTxjPGD6HuDXLW8kUCMtscAt8u3NdbrV7Y3cl7HGWeY3ErLC77E2ZJ4J/iBxx3F efaU0gnQoCSJh8p7HNdUaPK0mcWIqLmvHY9J0fQNWvQLjUGWJM5RXXc5+o4wK7bU9O0rWCsd7CpI HyuvDAjpg/41Q/tOGTD7wc+h9qbPqExjLWzKZONoJFe39UhGLSR0UqkVpuWNR0CFpIdTWWdp4QEW UhSoGTyRjOOf/r1HealHaSNaWEtjebRhywO4MwwRhTz0FY3iEarfxJbwXJjiaPLrGOWPcE56ewrl LXwdczyKttIxYjjCgHjtya+Ynl0efmb0XQ7J4x35acNWXLqLWrm7Mr320ytvMYBCEt32ng/jWTeW klsjy+VDdBBvlMcbRlRkDcSuMdRyRXWx+GdbsryCPUZJyu5flAByoOe2cV9P+Hvh9beK/C3jjxzo 837g2tnokFj5bedK8rRlXXoAAFAII5zmvNznNMPg4xlU0TaV/NyUUtO9/TQ68syavinKMN1d2e+k W+vol8z4gs7ixjuUuwLi3kQ5UjbMue3B2H9TSXEcN/cee92khJwTIChA+jAD8Aa+k/ij+yh8VPg9 oeieJ/iXoGr6Lp3iS3F1oV1ehUjvYfJhn8yHkkjyriF88cOtePp4PsVbdFLIGGOGI4/IV24TE060 FOjPmi+q1Xbc8/F5dWoTdGvDlkt09GvkVIvCKvaZS4maPhmCAbT78GrUPgXT30ubV2uWSC34fzCF JPoo7k1pweGvIysc0vPJAkx19sCi48PosYV3lYD+F2JXPrg1u4yukhxpwjrKH4njUqlZWCNhQxCY 6le3+cVGRnl/wH+Ney2vhbQpYbiS88tWSPdCp3/vGLAbQV6EAk88cVRfwpo7kFY2B+rEfzqJOV2u VnM8E7J3R5OqZPB7cfhVhIyOBnr/ADr1eDwjpUjBV257bsqOffNNtvDKyaydKit7ZsMAXE8fIPQj c4H4VhVrxj8WhpDBTbSMnwFCJ/FVgpJ/4+V4/wAmvcdYsbP7dF/aALwmdRMqnBKbvm5xxxUXhbwV c6VrdpfG3gVVnVt5nt+APRfM3E+wBPpWz4stt6uFZVJlGHc4VeepPYDuRXw2Z4lTx8YxfTo9tWfZ 4LAypYSTnHr1XofMuu6dHbXciQZKqxwav+HPAuoa8n9oTuttZBtr3Eh5O3qEXuR69K7PW9N8QBPt sNvBLCPvS2TJcIfc7CSufRgKjm8W6rL4ejsJY0ESRlACgQ5B+8D3x6Yr6PB4y9Jckk2fN4jDRjUf tE12VjubNPC3gzSBdaaEZX+Xzc/vJD3ySM14n4o8R3OsSmJiTErllV8Z59eKy7y7nlGyclh2DHis FyH6knJzST3bd2c9bEOSUUrJE0d35cmFw0ZA3xt0OO/saWWMTA3FsQyE/Mv8SH0P+PQ1W+bcEIqb 95bkNAArDkNTVTojk33GT/u48q5DHB4P6H/9dZY8xTg5K5G5m6/gMVrXC2xQSR5DMfnHVfqveqjI cYBIrRO61MW9bETtIigoSQPu5/8ArVYiLSYLErjpn+daWmppLOF1WSRY92GEShnGRwRnA4OMiq26 FI5Ap5DfKCDgjtz2NZc13y2OiMNFJs6nxB4k1bXFi1DXJTKxSOGMggDbAoQDA6YAH1ri2umDYJ6t n2rV03Tb7UllWxglnaCJ7qbykL7Ioxl5GwOEXjcx4FZF2Y5iuD8wOGUDpXXl/JCKpQVrdunyMcZK c5e0m9X17jkm3Hgj3wa1DdyshAc7W4wDis+wsXuZvLt1Z2IyEUEk1tHRdWCkNbzAZOSUYf0rprV4 x91uxphMHN+9GLZUEhxwc+9Xra5aJw68EEcnp9cVGulahjPkyj6Kf8Kd/Zepk/6mX/vk1wOrHbmR 6UKVVfYf3GzHfTTSSLOyjI37jgYA64GO+e1dl4Z1ryby2Ny5YQyqw3fd2g9Dng1522n3yRbrmGUK BnLKeP8ACtrQZllkW1lIOThexXP865sTUioOXQqjGcaiT3ZteLdSbUfEbzggxn/VAcAA+wyBzVCf T57gpHGvPllxkegJPNdrfeCbuEw3RH7t2BVgCd3uMCvT/iH8Pbzwrpdjdwo6y3turwkg5ZW9AP8A CvlK/E2Fp18PSjO/NdfcfS0eG8TUp16s4P3bN/M+V4LWe4b5FOBwzHgD6nitmG2tbTEs58xgfuD7 v4k9fyrurrwzPpFoJ9ZbbI67kRs5/EYrgrjyDKWmnRfYhjj8q+iwmZwxF/Zyul17niVcqeHtzrXz LjaiWYlFVAe0Yxx+FbFnqsagJOqsqnv1/MVladp+h3koS81mC0XGSzW00nPphRmvcPDfw0+Bd4kM mtfE+3tGf/WQp4dvpinX+LzVB6dvWuTM8xw1KNqil8oTl/6TFnpZdgK9V/u5R+c4R/ByRX8I+JbW 0u0MMMb8jCuo/ma/pP8A+CPXxo8MeEfjl4c8TeMdO0i106DUIImeeMNIZDIAAueMknk+lfjPonwJ /Yvs7xCvxzkkjW2E7yDwZeqpkEW8wqWuxl92UGQFJ5LAcjuIPFXwD8IvE/w8+Jmt3t7aTRPp1r/w jhsYpJBKAd8xvpDGcfOrKr9McGv5S8Z8pwuf4WpgcPTqKX8zpVbLt9jl6at6Lqf0F4cYuWWTlLF1 IOM4uNlUhdpqz63W+nXsf37/APBdz4k/DvTP2fLLwzLY2dzqcXiKONhJEm9Y/sryHy2BB6EV/HJp HwauviVr1h438CaSs9uL2O1mFvEWCO5wu8oGwT6nFfN/jX9q/XvGPjJtY+Ieq6trU7lMtc3UkrOw AGTvZs8cCv6X/wDgih8S/wBnrS9Xm8V+OPD7aTYXKJbS3+o3XmQ3lwxPlhLbG0lT3zkV/OXinmua 4HE189xEIUpYurGN/ho04Sagudq8nyQs5TjBt2b5e36rwJhMFgsneX0ObFfVoynype/OV7+6tUte jfpdn5l+EP8AglZ45/ac+L+p+GIY9O0aXQ9Nnv7uTUpVtLeUxDlEdwAWORgDrnJIGTX4i/tL+DR4 A8W3/hI/ZXi0y5ex3WrpIjspOW3oSpz9a/uD/wCCyvxP/Zp1HQbW98DQXUy2ryRahJoNybVY7hlP MscfznKnGc49q/jJ+KmofCbVL6SysNMuPLmlIknjud8gkP8AEQwyT65619f4C8Z4nFVZU67+sRoS lD2lKXNRnZq06bkoSs9d07300Sb8DjfL6eKy+GNVNYaWIXM4TTVRO7Wtrpp6W0jbrufmbrEU1zcb 9oRVBChfQHgZ7/WsU2bj5+g78V9TeKPhPFa3MEkFyHtr1Xksp9hCyLGdrrgn5XQkB17ZB6EE8NqH w8FlC0stwiKg7pz7d6/vHLeJaFSEeS+vk/69T+W8fwxXhOXOtvNHi1zp8kCRyyHiUApxgkVlzR88 DHHf1r0nxJo0lnpltM88cyFmWEquBhcZya4SdTs3cE45Ht2r6bC4tTV4nzGPwrhLla2M23RpZQqc ktjPFLPbzI21lOeuCOla/huISakgfsdwA9QOK6zWWglkWS5VS4YBXPB/H1rs9r73Kc9PD3pOTZ5O +4HGPXjH51ApROqZznkitjUIDPfSS2+cFycCqqWkm0ksAeANx/OvRU01ZHnqk02iBJV3Y2jjBHar 8VwoJ2Lwcev51RltbqCQRPnJUMu3kEN0P41Ztra5kJVSOP72AayrWHC99Eb8enR3EfmQgkHAPset W9I0w/2hHC4bBfHH51qeHNS+w3AivISAWwXxlW9j6fWvq3Svg42t6ZbeMNAt5Z7aOSM3BhQvsyQB u29Mk8V+f8ScWU8vXLiHZS0T6X6I+3yHhmpj9cOruOrXW3c+afE/htrBDK4bLDt71D4A+GOreN7+ aKwtNQu0to/MeKxjDMS3Cgu2FQE9WOfYGvvj4wfs9eILDxFaaF/Z9xbs1ml9NuQqBCy5DHI4BBqL 4S2Vl4Gi1r7A4SMJAruMZeNS+eCemT1r4LLvFWlVy1TwslKpLVdVZu3Ty2PusT4aVIZg6eKi4wTf 3pX0v+J836f+yZ8X9V05bu00oLvYoVuLmGEg5+6FZgfz/KvFPiJ8K/Gfwu1GHS/GdqtrLdQm5hVJ I5QyK20nchYcGv268Gaut/4Vt7+Cbcku8KFbOXDDIGM8fWvgz9tyxEutaBMuGY292DkEFVVowA2R nNeXwT4r4/HZ3/Z2IjBQblsmn7qfVvy7HscZ+F+X4XKHjcM5OS5d2mtWl28+5+dEglJIUMe+AOar sm1z5gYE84bjiunksbkMVgAGOMgHJH5VXNjPLLgox5HJBJx+Nf0hCvBLc/nyWXSvY5aQKOzev1pl vAs5Yzt5YGTkjqB2HvXoUulTNpsrNbk4A56Y9COh69hXHJo+pXM8dtGoBkdUQPwMk4GSeB9SeKul jISi/etYyrZfODWm/kaHhrRIvEfiC20MSiBbiURidhu2g98cV7/rX7PGoaB4Ln1+6uI7i6QPLDbW +RIYh91mU8HcOcAkgYz7fVPwS+Bfw0+GZtdf8Vy2+peJIB5jAXds1tbM6A7Y4xMRIUBI8w8c5ABx XpPjnxpa272+raJcw20tveJK0ri2uBtwQ3yGQg575r89zLi+pUxMaWDfurvs/R2bs+/3I+lwnDtN UW8Ru/nZfgr/ANXPyi8PfDTxt4rtXvdD029u1V/L/wBHiLAMBk5Y45wRx1rntW0O/wBBla11m3lt pgSDFMm1uDjv2z6V+tnwKk0qfQLxLFlMkt497dIdu8y3B+ZjgnaCRhRwABxX5pfGqeV/iVrNlK7m O31O4iijZiQi+YThcnpk5rt4e4wrY3NsVl86aiqSTT1u79zu4g4Oo4LLMPjYT5pVHZ9vkc/4T8T3 XhR49QtQkiJcCZrWUbo3KjAzjB4z6itey8H+JvEGm/27pekzzW8sjIsqINpYHJ5PpmrngDwHN4r0 u8vLlzHAimO1x0ebrye6jofr7VUi1XXdGtk0qSWVDbtJGkJPEZ3BmAz6lQfSvrcw51rSav59vvR8 theTRVruNult/mmcxrfhnUtOQPfWjQA5Kl129OuK7DwVqHhuGdY/E1vNJbNFIrPbBWk37G8vh8Ag PtJ5HGetcnNrlzPch7wF0ERhAfocDJA/E5rI1S8VdtvaMNsYxlDweOvOKKVeo4KMkclWdOLc6f6f 1+B9pfB/xx8ItF8JeJ5vHdhbzaiNBFloQfzf3WotPEXuQInTc0cIfaGOzPUdx8yeMfFdlca5dW+g SmaxWaVLecxtB9oQuW8xomZihYY+XJ29MnGa83+2zxtkOw65I6HI5/OqW8NkIG65FcNHJYwr1MRK bbn0b0WiWi6bfizrxnEFSth6WGUUlC+qWru+r6/d0PTdD8f3mlCO1mijnh+3LezI68ylFKhHPdB1 2nvX0n8Dfjp4X0CXVtJ+Imktq8F7o1/Dp5tliR4tUlspLeznIIwVhkfecYYnmvijbKQHx15GeDWx bxPDbeduOdgwAcHOe3vXJm+QYfFU5U6iavbVNp6O+jWqKyjiPFYSpCpSese6TWqtqnudH4itNQtr eSW8QrIn7sxYz5QPr9a4FbYzLy3znqMgV0F1f6jY2q3UTMvmEK+OQyn+8D19qyngh1Pm0IjmG4+W ThCPYnvX11CpzrmZ4Ved5bFEaczHaCvr17VajsFXDh046jPSm6fpktxdxLOMK+7dhugHHJ7c10lt o9jpOnNqGqD7RMG+SBG+Rc9N5H9KmVeCly8w6cetixZ6Kt1am7vpEhgDktK+Wz6KgH3j9KzZbHQo ZVaC4mk+bBXysAc+571Uv9TuNQZTdNkAYRF4VB2CgcDFUlkQt2IHv+VTORcqq6I6i30/TbeVmZiy jlRjBPvx/jXXabbadr0R0+zUecSAgI25HoK4KyuELbi2B3xXqPhGLwrJfwHUJJ0+cHfAvzj1xyOa +Xz7HOnSlNJ3W1lf8D6XJKCq1Yw0s976fidHpPw/uDpN75tuym0AkwASOTg5xzj0rmb7w22nwNe3 i+Xu4RH4I/DtX9uv/BOj9k7/AIJg/Ev9iDUPFXxs1MR+KptPlQvqW22nlSM7rfMcbYIMgCgkqSOp r+RT9rHSvB+m/E7WdO0XUbi4hhv5YoImthbhFVsABAzcAAAHPSv5p8PPGyWe5rXwShy8rd/eUmlG Tg1KMW5U22nJKootxakk0z904v8ADOjl2XfWYybcGo+9FxTclzJwk9JxS0vG6vvbRv4qupB5yJnp wMd6qbsuFPHJwK2Z7e0BDoSSB0xWRONsmR67uOtf03TxkXoj+fp4d3uwwxgMnp8v4EmqdwT5HYgD 9avld0Z4JU/exzVOWAuuB8o6D6100cTG+rOWthn0I7H5yC+Sue3TNadyFSJ1QDBOB9KrwRCBRGcE 54q7dRMsPmOp6YA9SelaSxCck+hMcN7jMpXzJkkY9KjvJG8/5ccAKferMUZLcZwOv+FZ11HJHKxc fMT3rrp1FfU5pwtEklbzYwx5wMD60QMWhIckDv6nNRZZVCt90jPP6etNQHIznr2710KWljmlG+w/ 7D5F2v2bAxhvmNbl3qTQwMVVEkAGGEhJ/AYwax4mkkd5EBYlen9KwLm5kkBD/wAJIAHrW1PWxKqc q0NCdm1Bzczy4JOGwvp071MmlwqrTStuP3QCMYNc6tzKPlUH5TnFbdtdyT5MzZyOBnp9K6+SzI51 f3jLa3nZ9qoTzjpTxpOpOTtjYjr+HvXY2epRW4Gfmx/WtRPEFpDuMqkluCBVSvbQr2EHuziI/D+t PhhC+DyORQdF1dn8pUwRkEEj8q7tfEoY/uY8fUnpUa3rSy+ciDJbJOcAfrWfM1uaKhTvv/X3HFw6 BqH2hUmUAFgDznjNbV9oNvGSlpgEctx+lWrm8lEhLORzjAGcnrQ92/kl9zDJ+6f8axxFZxSY40o6 oktrJY4fI2KwHTjnmpbuGC0nZJwQQcKQB+nNZMV3Ik5xkHpwc1pTF77DPhmDZJb1Pv6Vwe3ka865 bJFUItyucdeeew+nWq5McrLEo3Atwc4/nWbFJcLKZMc9GByM/SnSS+aNqKynO4Z5/wAiqdZ2SRCs V50ImFue54PORVya5njQpCSDnGQcH/8AVVQXQWXzFK7lUYzzz3FMlmZ4gGZQxUnA4wc9Oe/pTq1m 9exnHdg8rzJ5kxO0HJzjOegGals4t8TOFITjd0PFYOx7gFbqQ4XHy44z36VpCR2QCJw67f4OwPY1 NSXRMenUvQbobX5cYYnODnjOPyqsGL5K8k81p2SRzhfPGQxCKRx9a2Us7GzkJ55HQ88mtYV0om8K Ll10ORdH4Zs596YsRznGTXSzSRXJwEAxkgjqKhhsn3g46+nTrUvFW3NXhH0MqN5IHDpx2xW5a3Gs uM28ZfHZR/nNbNx4cnS2FwUPPP4CptI0m9mjYxK2I84wOBmuKeZU3DmujspZfVUlCz1PXvgAmpXe vX9pqCv5X2eOdVfOA4kVRj8DX01pF3d6x4nudJuQjQ2qkxqFAPVgST1PSvC/2dLO/n8T6kjBnCWc RAOcA+co4r6m0fRdLsfFVzcQXEktxIHM8LR7VQZYjBJ5OeK/NuI8XB4qomt0v0P1XhbCz+qUddOZ 3/E8L+Lutax4PtbNvD8ggM95LHJhVfIXnA3A459K7LXIY3hgmcEs0UJJHq2S1ZHxms/D08NimvS3 MSC7lMRtgrEueobceBiur1lVFpBt4ysOM+mT+vSuOrCP1ajJR111tvr3O6EH9brpyurKyvtp28yT S7Qf2TMzDB3MSOvasWSHbpF06hSFAI9MqK7nRoFk0q4Y5GCcgdPu1heRHJpFxGy5V5EUgZGQeMV5 lCa5o3PSqwUYNnzd8I/DN3400bWdMBM0zSw3Fqj52vJCWfy2bqAwzz9M8V7bc2lyt1El5EIZVEYk hBBCN3X8DxX6/eG/+CSOpaBceBtB0TV5XPjfSJ9fhg06NXeHyPs2FYs/zn99kr/s4xzX5s/FrwdP 4H+LOt+Cb6V5pdJ1i502SZ18tpHtpWjLFRwpJGSB0Neli+IaGNvLD7XT7bq342PleHstnScuaSa5 Vt5tvsjxLxHFtvF8sceWf1OK43xsuzwNcMR1gkUe3vXpvii3Ed6q45MPpn3rivHM0Nj4Mku5o45P Lhc+TJyr9OoB6e1b5dO9eCS6o780ilRm79GfK94qQ+HLJUG7dqLKO2cgdqi8h/8Ank35Gum1HxFE nhuyvbezs8vfMixmM7Rtx8wycg5rN/4TG9/59LP/AL4/+vX6zh1Valan1fU/H8X7OLiufouh/9H+ FHZ5m2RTyp5B5q6wDxbV6DnHaq8YTZ5K4IOOfar1pbPdMYYBlmO1dxA6nArzqbbkj12zvvhG/wDx Usu3BxbHOB/tDivpn4sHPwnv9x52wt0/21rw74c+Dr7w/rxup9jB4fLxG2ecg+lfRfxC0+fWfhxf WEQAZ40AL8DPmLXwPFMXHN8LF780fzP07h6k3lWIj15ZfkfnaSXU7uh6U0nIIc859a0tb0u50S/b T7sguFDEocgg9Oayy4wG/i6HpX6RKLWjPzKxGcZx9acu4fMR/j+dRBgZSc/XNPBDdc4BwDzzWq1V iGh6nByc9eKkw5+UAdcAj2oihZmBYMM85+layFQoyP8AJrNOwOx2vwxCv4mME2GDwSbl7Y44Nd94 v8CSvbNNoZxHnzGtW6D/AHD2+nSvN/B13La63HJaFQ7/ALvn0brX0nFeW7P9nVgzKo3c5x+f41jK TWqPpcro062HcJLqfIkxktHaCeNlZW2lWHOfoTTI5j6N14B96+mfEvhLTfECbiojmH3JkxnPv2Ir 591fRdQ0O6NvfIQCfkcfdYexp0611bY8vGZfKk77ruZD3JlPzByRznpUYdF5CsMnoeKkBQtkc0E+ vWtbs5PZoTzQBkq1Hn9vmAx9P60x254B+tTRReYVUYyxxjtzTTe5LRcs9XurNT9nLAHruAPI+tdT 4Y12/u9Zigmf5WRjwo7CprfwvZtqEMsx/wBHVEaVSQNx7gfX+tQ6yv8AY3ie51TT7Vlt43Dqm3AE cgwPz7Vjh8wi6iin0udkcNKKVSW1zuNc1KSARnc2SSoIPPI+vtXtWm6brNt4fg1Twrctb3c9giSb ixikOAVcp03qQNrYOOlfKl74kS7BV4nwDuGTyODxX2V4SnjPhiwPODaxk+3FcueVlNR00Po8gtOd RJ9Omj+R5d8cP2nP2jPivb6P4O+MutT6hD4ZtxZ6NbyQQxLbwiC3tgF8tF3DybWFBnsgPUknwJPE WrKf9b2xjANfYPi7whpHi2xa2uxiVP8AVzLjdGT6eo9q+O9f8PX3he/ktbtllRJDGsyfcJHUZHQ8 9DXLlM6UKSpUYqCXRaLXsY55g68ajrVZOd+r1fzLg8U6wBkSDOf7op6+JtYKhA659cYxXLqQRk5q USEc55+teo6ku55EZ33Og/4SLVCcFwSDjlQae/iG+ddsm36qNvSuYR8MFXucHFSrvJJk5AP44pOU u4Rldm//AG1d+Xtidl464DH+mKW7vozP50ZRJWAYTc5Bx1PbmsvKmPB4J/rUFyiSfc4YAA+hrNSb 0HiLrY9K8AyXF/430tp51lP2lflz2HsfWvbvG8RWwnB/2uR6DtXgHwzkUePtJCAA/a1DGvojxrIV spmU9NxANfEZ0rZnSS7L82fVZRK+X1b93+SPlVLqSEBmGTngrkY9/apzqM5aOViz7H4SQCReOeQ3 UVDd6teXkwkKpkNwAOfzFRm6d3JmBHGRt6V9DOy6Hyrl2Y28nhupTMYlQknKx5UZPsc4qmIUkZlW WNMAn95kA47cdz2qcxkg9h1NZ4iYAptDDH3gev4VhpsiZN7sjuI5lLqQWUcApyD78VUV43JCqcj1 HBNXzDIF3AMOpyOKSOcKoU7T3yRj+tUpGbVzPxtBc8kDPTP4YqPJbDSLtJ5B+taSywrJ90geq8/p Uz2rXfzWxVyT8yk7fpgGtOZWuzNQb2MYAhcHn9KmjjHBfPuT/k1euLSWIGJYyTjJI5x9KmtIG6Eg YHOemPSp9poV7N3I7We9ghlNm8kbtG0coQld0TfeU88g9wazILKS5mO4hTgsWbua3ra8eBRHbouN x+fmvTPDej2F98N/FfiO9hBvNI/s97MhmxtuJmSQkdD0HUcV008ZSoQ56j3cV/4E1FfizejgJ4iX JTeyk9f7sXJ/gvvK/wABbZj8RoEccC3nzkZ/hNfe62sLoSig47jtjvXxD8A9QkuviPBAyAZt5ucn oFzX3/bwiZT5cagoCTz6j+dfJ8YTtiI+n6s/R+B6d8LL/E/0ObFggOCFJxnpxj3/ABqGO0gdSVVc 9Bx1rpfIkKlmGOOD9aoy2vlrgMQA2QevWvlVUuj7CVJpnKeLLGN/COomKNSTaSY3gY6Zr5Q8L/BP xT4g/wBN0yB5ACDuh/h3dAS2AD6DNfYWvRS6hos+g2THfeKLZH6fNM4QfkTXzd438Sarb+O7zwp4 edrPTdEvZtL023yeFgby2lk5+aaRl3Mx9cDgCojmOKpqWHwskpO8m2rpJWW2923p6P0fj5rgcLUq 06mJi2lZWXd3b+634r5ftZ/wT4/YU+IPxouYfhT8TfDslxpWqNts9XtdhntJSAFLpnlM9dv5V+3X 7ZH/AARKh+C3w10P4m61YNrbeHtIFrFpmkx75Li9PAaTOMKoweT+Ffgt+wl+0bZ/syw2/wAU/Gur X19qcNwiaJo7zMVeUAYZkzgKvvX73ftL/wDBW65+JHhLQvh78VNRMNtqmn293FdW+7IuY3V2JKHh WAwQTn3r/M3xYxnEsc+xM6HtpSbj7F0bRo3T/wBodSEuapK9JpRdKUfevppc/rTh/DXw+XxwjpRw 8V++VW0qlm/3dpWtvqk9tL3R/HF+0h8J/itpni6/XxLo0+ksszbbe4TZIig8KR2wK+KNR0O8snYT qeM5Hriv0j/bj+KfjPxv8dPEfirU719Qi1HUJ7yG5jkcl4pWyp+Zmzgev41+eWoXpuMkSMWPXf1r /SLwux+NnlmHnWUVeMXZJ6XW2rb0P5K8QsJhFjq6pc17v4mu/kkjDt9Fup4xJBAzBjnit2w/t240 99Ps1QQx/vJlSJFb6tJt3keg3YqxpurzW+mi33NhWBQjHy5PP5jFdl4B8eJ4OXVWG8nUtLm0tsAf dmGCTkH/ABFfouOxVfkk1BStsj4DCYajzpObimtf69Tzhb6ZY9kLYxnOa2dBkuTqMBbvOgBHuwrB t4fkA6c4J9667RLItf223n/SI/Y/eFc2NqxhGWh2YOlOTWp9K2uoWUeoefq8bPCh3M6EeYuP4hnj 8Dj619hfC/8AaI8Sv4h0az0O7kjsNLnSW0jjciNnXuwB+Vs9jXwrr8d1cxT2sabtw2gD6969S+D3 wq8eXd5BeeF7O/ZpDuXyY2ljfacHgc9RX4HxlkeX18G6mNaWjSvsrp3frY/buD87x9DFqlhItptN 23dn+R9veNfjp8SNa+Ns0OpT3EtvrkyxzQyZ8t2JA5B718v/AB28LXOi/EBLGGJ1k+0b3SIcryQQ R3r+kn9g7/gnJrf7W0NhZfEXQrvR9c0y5g1DTNZMZW1uYoWDPFKCAysVHBb2619Bf8FIP+CYem/s /XOu/FrTdJfVtU1BGOmQ2sQaCCAcblJGBIxyT6DnvX8nZF40YPKMXCpg8BP2NN/V51YxvR9q+Xki 6i9zWLvq7q1mrtJ/s+fZBSzCtLLMVj17eo/aRhK/Oo2bkrd77LrqfyhXt1YaP8CbrU9TZnks/G9s luGT5o0urC485Qcj75ijJHTKivkXxJ4+0m7tJbTfKrOVAIU4AHrzX2X8YvAviuD9n67utUtJrSa4 +IS74CMKEgsJMDpuLZl+mK8//bI+FXhTwd8O/gjqPhTSbawutZ+Edjq2uS26BGvb+S+vFa4mP8Uh RUUt6Aelf2JwHxRhZVqVOpLmlXqzSs1aPLDmfydnt1Z/PXGWW4qEKjpq0aUIt3Tu+aXL+qPi3WfE Vpqek2emwM263dyxK4GGAxjv2qDT7L+0oRGCC4zj3+lYkGmTmUZTPOOtemeHvC+rzDzbFJPlPPyk jP1HSv3HG4mlQptqVj8jwtKpXq+9G/oUvCujS2WvJCytukOxARx83Bp/jqzNnqq6faxuSvLg+tfu t/wTu/4JreJ/219b0+zs7C9sNT0+8t7ndJAws760Rx5yrMRhZFXJ5rf/AOCkf/BMPXv2KvEl9qOv 6fc6hqGqXMraVY2UDzra2YHyvJIPlJb2r+eV9IvLlnX9nOMnJP2d1F8ntLcyj7S3JfkvK172TP2y PhBV+oN+2ipNe05G/f8AZ9ZcnxfErbfhqfzwX4s7S22yxET4yfT6dc/jXIXd4rsCUAIGOD1Pqetd /wCK9C1+C6Y6hbT2/wAxG2RGBHtyK89fS7uaQxwRySMOSqjJxX9L5Zi41aanzXv5n4RmlGVObgo2 sINUP2iOaVVYRhQFPQhegqzDfRNcmVlUAndtGSB7DmsOG3klult1GGJwc9j71upYLBBcJcMN6EbG XgHj616Va19zgw7lvY9b8Laj4fcJDqckkcZILAKCB+BNf03/APBDvwh+zX4p+NVtp/iS71iSxmhd NXt7u2iOlSW+OfNLvkMDgqQOtfyk+HkhFyvnENyOvSvtb4fftL+KPAlnB4V8ETGzilmja/lgO15Q jAhMjHy5HSv5c+kDwFi89yyrl2AqtOe937llq+ZKza8k4vs1ufvPhVxPhsDUlUxPu3i4qUfjTaav F7Jq9z+7z/gtJ4A/ZE8KfAZrvwFqJ0hrmOK11S90G0jvp/IRcwRszspjRuckZr+MD4Y+E/hJrfxR tfDMGvX72Wp38UFx9ut98c8e7G1hEzMAcnpXS/HP9tvx/wCLfFoutTvp57K90mCyvLGVy0bCNcDK k4yOo9K+GL/xgfD2pt4i8Kt5Fw7ExypwyE9x6H0NfiPhX4X5pg8Jjfa8mGlinzRhQjy0abcVHljG XPJWcb6zab+FR2X6nmvEeCwywlCVWWJ+rtqU6jbnJXb6O1rOyT17to/q0/4KY/8ABOT9kv8AZi/Y +0P4rfAbxxDcaxthikthcyMkK3ALu+2Hdl1b92C4XGOa/kJ8cX15qV2DqupTXxiyImlkdwoPJ27i cZxzX1dB8e/Hnif4SeIoNZvrm6j0zStOtRHO7Ovly3vzcMTySetfD18ZrmRmtlTBJOT1HP1x09q/ Y/BjhDH5ZHEwzCspSUtGnJ/YjfWpKc7yd5Nc1k5NRSWh8L4j8QUcVTw6otz0bbajF/E7LlglG0V7 qdr2WvkyOSOT5Q33ejE9KkS2mhnG8E5PB7EVStNPupZAI1bcD1AzX3z+yD+yx4p/aa8a2nwssrG4 W51GQRWGoxwtLFFMcbBKE5CMeCe1fq/FHFWFyjB1MZiqloQV5Psu/n6LXsfCcO8PYjMqyw9GPvPb t8309XofFOvWl1ZhFkzllXGPX0+tYEsDRRBpT8x52k9ua/oj/b//AOCOfxY/Yy0Kw8d+OLJp4m0m 2jgsdPjedmutuLiWRlBVIkJAyTknAxX4A+JtEvrHUXN+jqfvNG6MuB1x2rwuA/ETCZ1Tf1eTi4O0 lKLjJS/lcWk09Vujt4r4XqZfyVXJTjPWLi1KLW11JNp6prv3OHSKSSXaxABOAxIGapvNbpdmISFg D0J7/Wvrv9l79k34pfth/EjTvhf8JtLnvtZuJVe0tUU7Z4ww8wBugZVywBPOOOcVyP7Xf7KPxF/Z B+J+p/Cz4n2U1pr9rcyLPYlT/o8e4iPc3Tc64bA6Aj6V9ZhOMcBPMP7L9svbWvy9f6sfJ4vh/HLB fX1T/d9/w2330PDPD3jjxB4Ykki8NXt1ZtJt3m3fYW28jOOuOwNcz4hvG1jUJL7UJnmnlYvLPIdz tIxyxY8Z5rkLe6uLW53SKeTyDWlISWYkY53ED3r7ajhY06vtYpJvr39T5SnjJ1abpzk2l06H2/8A D7xR8NU+C2reH7Kzmn8S/bdMfQrjcUggtozJ9uSbDjmXcm07W6dVr5l+J13Bc+KZ1t8K6ARygnGS oHPHqK4Kx1C6sJRNayPG2OChIPPuKzNUub2a8N3cMzs/Vz9449T61thsLCE6s+aTdR8zu20vdUbR X2V7t7L7Tb6hmmMlOjShypKCsrJJvVu7fV62u+iS6EV1P/pGOcAgDio2ZirE9GPy59BUHLAvuJ4z yO9MkkkMZXOQO546V6FKfQ+bn3Hg+ZJjnPt+lPjDLkAHk+v86hhYl+uc+lWVBViVz0PH0robb2M0 rGiy4mjyTsA6HnmpTcNK258hQTkgZH4VlbsqGJPBxjir6uBDs6c5z0rFx1uWi7cMt5FHG7HAzlcc H0IPtV61tLC2kjUOwMpCOXAwobjjnpWFE0rSBUIHYHrj3qzqih78quSEQZOeTxVyb0hEuOzkzo9T b7LO1iCCsR2iSMAEgfTrUa3cVxvSYArswc9iRjIrlmuGkYlizZJ5atWyZXiKuccZb1x6VzzpWSbL VRyloUNW+S8by1Cq5yo9Ky03K+zPUda1r+JiBO64B+Vc89PWl0Sxh1DV7axnJCTTpGxHUKxwSPf8 K7oTSgRGk27LqU4Y5w5YN9MV6J4V1K10m5Wa6UnHQH19a6L4jeCPDng+5s4tDu5rgzJI0glKkoVI AHygdcmud0Y6ULgf2h5pUHkKAePxr5vMqkK1CV4uz+8+qwOBqYbEcraUl56H2z4D1H4o3emCDSbi 8kttbeKyBiZvLyGyiccDBHArzb4reAPGOoa7ejxDBIkmmgJdTygrluwJPVq/pM/4ID+D/wBkTXfG Mtv8YhqB0xxHLOurpCunpdA5g8sljIJN+MbR0zV7/gv34b/Y88PePrKx+ENzqdtpMyvcTJoUdv8A Y57s/wCtaadj5u5SMAMOnTjmv4bwniz7HiqpllDDwj+89n8SVb4FPn9kld0+VcnPe3NY/qzF8Jwr 5TGOIqVJNU/a3tejbmceX2jfxcz5rW2uj+Qx1Vrg2aYyDtUdenrXWaT4B1XWLe6ktYJHNvGJHAU/ Kp713dppPwduNWWJ31VEaTb5jNExHvwK/sN/4Jk/sV/8E3PFX7MmpeMfjH4nki8SNpCvbHUES3Zo 5AzJGVyTKA4VS2FzuwCa/YPEvxfp5BRoyVJuVRtLmcYR0Tk7zm4xV0mkm03JqKTbsflvB3h5DMp1 p1qnuwtfkTnLV8q92KcrJtNu1kr3P4uZfAWr2XhOPXZYXWKSZ41J7ken51zEWl/Ygft4wWHK9x6Z r/QD/aK/4I0/snaP+xDL8dLDXNNtrq383X4bK4mMNjHNLH5YRmw0giQqJCu3PqSOv8gXjP8AYq8c akk3jb/hJvAb6NLdyW0eqLrlrDbPMgDPFH5jK5dVZSy7cgMueorxOAvpBYLNIc2Oj9X51GceZxfN Gorws4OSu4q7i7SXWKO3iDwqdODq5XP26hKUJWTjaULc11JJ2u1Zq68z8+X0C6jeO62lo2bIYdOT 0zXV+I/CGpxGKKKKRi+FBwRnIz/Kv10/YU/Yl8I/Ff406N8I/GXjTwRe2GtXYs57Oz1VZbuLzDgS wOqFC6k5AzgjOfWv1t/4LI/8EovhN+wz8P8ARPEngHXrC/vb+0t7Dy764SERrbR7XkSPkySykA57 DPFehjPHjDUs0WCp0pTUOVOaSUU6jcaad2pauMr8qdkt9THBeFinhl7asoVKilKMNW2qavOzScVo 1a7TfY/j01HRjpQ8mXhx94ntmuLvp0nuMDnjBNe0eN9BuYLgyz3MMrD5WCt8o9PbGOleRS2SxsFB BOe3Nf0bk2KVakqrlds/GM5wbpTdPlskQ3VxE6D5VG2ILgDrzye/NUy2IxgcAHGfTNTToobHp7+t UTvUAA8DpXv0ldaHgVPMfmSO3lMfDFflPH0/rWrp+ieG5fD73N5dvHfbHaOEYxuHIB4PWsi9GIlI I5yGx6g1mDeTjggnOfSvTwtoq7VzBRSequZvlRI7B8gjjA4x71KkwjbK5AAwMZq+8aSj5hz6ismZ Xt+G5Ung/wBK3jK7sc9SlbUui6whCA88Z45xTxK0jqqgsWIG1Rkk/hSWenzagNykLGMB5GyB+H/6 q6aCO3sYvIsvvZ+aVvvt9OuB7VnWxUVddTfC4GdT3nohlvbNaL5l0RuI+WJTyP8AePIH0Fb+nX92 sPlo4Uc/IAMYP1BrEUEqSM9vb61c04kXIRRy2QPX/PNePiJuUXc+kwtGFJ6I2nvJI428zZjHXauc /lXJXd2rlwGIGdy4wOnNa+rzCOIQqeeSa5WFIZQ08rDg4KHqRj1+tY0aenMzz82xPNPlT0QgnYzL ICACTgDtXRRH5NjlsMPlZe3uKzYJYltVVdhYjbyBnI9D2rTuPLIRkUhlUKCMjdkd+e2KqpUvpY8y G9zKeVrRy7HKgHDdSWIzWVPKoQthgvG4A85qSQFZC0m7MZO4H0PTr2qCCxlvUZrZWbysuxAIxz1P t61pTVtWJ3eiM6MtMPkHAO4gDoKsXETi087djfkYPOc/Xr+FK7iMPjgFhu5x+HHasp5bl2W3XJCD 5Qeg+h7VsovchR6mpBbkW7NcZfkkoOML25JqxC6W7A4wrD7rjn8xUcV3cmDyzgljtBOF/EnBrspt K0q30O0mlmKXjoZGt2YPvG7AKgAbVIByCxOcduvLWqqNoy6nTRoOd3HpqYFvO0k4FvgKACCT07nF dxZaba6ndpBaNcyBwoAKgnJ69CcD0rgVjdJUVkKFsELjGQ3TGa+r/wBmj4leCfhD8R9I+I/ivSNP 8Qw6TqENxL4e1ZS1nfrE26SCdUdGMb8KcHpnvXkZ7j6uHw0quGhzyS0S6vsexkWFp1sRGlXlyRb1 b6I8uj0Cw0q8MepQTDa20gtgkg88d+K948KfCaw8aWC3vh9o/MjdWeIhmYgnABXNdt+0l8e/hz8d PizqnxL8K+E9I8LWGoXPnReG9BR4rLTwqBdtusjM2xsbuTnOc19dfsB+I/hFp/xU8NeIvGmjzSaL Zapb3Os+ZP5Sm1Vx5jkhWLDaDhccmvxfjvjjMsFlMsfGhJVIq9lZ3aT01116afI/aODuFstxGa/U lVjOm9nZp+qtpdetvM8Zl/Z/12wsLa3ubNxHMzEO1s4TCD5sZHbPeu68GfsheMtXgvb7w/YXN1af Z5JlntoGYEou5sEA4I9K/ts+I3x3/wCCYf7XN54E/ZS+FPh+3e48X+I7PSJ7m1kezuIbSR1Wf99C TIWIIIBIDbcdM10Pwi/ao/4J+fsCXfjX9nHWfDVlHqPhPWL6zjMrG7aa1QFovMkuNzb2VsNj1x0r +TcR4w55KEYuUY05SSlWUa0qSbTly8vsY13PTl/gqnf/AJeX0X7fR4Zy1Q9pSy2rOqldUnKnGfLz cvM3zuKT3tfm8uXU/gw0zwFefs7W2p+JviHHMkt1DF9n08oyyZMm4EqwBAIXrXCeAPitZ69rl9rO pRvZg7lUSg/NuLsPboRX6tftbfFX4R/F/wCNnijxtp+g2Nvp1/ffatPl82eRWEhJAbzmIUqMAKuF AFfC+p6x4JiWQsunwqgIj8plIHTGRnr9a/oXgLirG5lhY4nG4VupO13eyXklZvTzs+6Tvb5PjHhf DZfiI0MHiFGENbNXd3vd6L7tO1z4L+L/AMRrnxRepYWtpcLBa3LSpMyEFy3B6Z49K9M8PfEuDxdA ltNbTW1wskaJFIpAKKOu7HJr3Aa54KnLK72g3cAblwfzrndVuvC8mwWstv5vnKAUIPT6V+t1MdKd GNKeH5eXbX/gH5XLAOFeVZYhPm30/LU1NL17S10ebMjKd7Lgq/PGMgY5HvXF+IfEgsfD0sumRSXE /mxskMcb5bac46cYr0PRda8PW+kZvZoCWlYg4B+XgZq1ceJvDUbb4biMDGSfu4P/ANauDDxnFqfs r2/rseliHB03B1Ur/wBdz1Twp/wVb/aw0PxBpGtaZo15YNoHhqTw/pf2KNuHeWCQSsZA2OIdpxzg 4BHbxjx/8Vbr4kePtS+JniK1nivNb1GbV7yGGByI57qQyyKOBwGY0L4p0QMc3EbDHyqCePxqQeN/ DMWYWlGTjcNpatXhrv3MMoXte1+mx4+X4enh01Gvo7LW3TY898Qa/b32pq0MVyB5BI8yIoODnv8A WvIvis/i3VtIt7Tw3azSQmNluVKAE5x056fhXtniHxDpGoahD9kbnyivK9wf51zOp6jCiKLmb5V4 RR159B1rpwledGqpQp6rvcvG0adWnKDqad9D5Lj8HfEafTobC5sWSOO489SzLlc9RjNXv+EH8Yf8 8X/Mf417xJ4i0Nrk2YmVJV/5Zygp/wChAU7+07H/AJ7Q/wDfYr6KPEuOjp7NL5P/ADPlZcM4GTv7 R/ej/9L+FlrS5ChZEZDjoVIOfxq3pkqNqVpEM5E6cY7g8/UV9Rf278TbpAbjWLhjyAs7GQcEj+PN Vn8QeP7VlkeaxlK/MrPaW7Hjvkxnmvl8Li8VdS9nF+kn/wDIH27yvDp355f+Ar/5Im8P30suqNEU aMKCBIeM844B/wDr17b4ijVPA17MW3fulxnt869D3rwz/hZvjSyujBPBpkxKFtzWsKn07IDWrL8W fGV5Yta3djpksEqBZIWiADLnPYivGzjL8Ziswo41U0lBxb97XRryR9dlucYShhauHcneSa+Hv8z5 08Zr5msGVU3ARqrNjpgHvXJDyj8qjp3Ir6ZuvGenrHIuo+HtOMboYpBEZRlW44xJxWVbwfCaa1lb UtG1GGZR+6S1mPlnOOpYsa+uxOaSvf2Enf8Aw/8AyR8d/ZcJP3a8V68y/wDbT582qeqiocI2GPH1 HbtXuUmjfDGQbmsdbjA5JWdT+hSsq20H4Z3rO6y6vAo5UsVcH2x5fFTHHaXlSl+H6Mx/s1XsqkX8 3+qPIGmKtg/dAyfSoJZhgFWA9xzxXtEvgP4c3C/6Nrl5GT82yWBTgehxtrJm+HXhqRPMtfEEB+fb +8gwf/HZOn4Vj/aVN9JL/t2X+RnLK6i6xf8A28v8zz/Sr37DeJOvVfmXPPJHGa9P0HXZZpooIy7u WaW5LDhieFGewArH/wCFZEDda6zpcwzjJ8xD+WGrUtPBWuWrfZ7WfTZmcD51uChPqMMorpp4yFtX +DRVLD16UtF9zT/I/e39hT9jv4KfHP8AZus/it470zVtRvr74nL4PiNpcxwxtbraLO6IizCUuWcE s0YUKBtZiWA/KP4v+E9H0jx54g8Jwwbbax1q+sIIZTudI4J3jQEkk5AXGfWqHws+In7Q3wxFtZ+C devdIt7HUBqtimnahCiwXgXZ56ZbIk2fLn0qDU4/GfiG9uNZ1mO5urq8uJbm5nd1mllmlYu8jbWO WZiSfXNfnXD2Q47C51mGYYnHc9Gty8lPmb5LXvZN2V9Nkj9ZzfiDDY3LMHhKOC5J0788uVLnuorW yu7NSd23v3ufNXiTwZd6SzXVlulgHUDllHYn1HuK4dWXJIPOOn0r63n0bWSrF7K7x6+S5H54NeP+ JfBBYvc2SNBL1KONqk/Qjiv0qlUUtpXPy7G5ZKLvBHkjEnp65B68V+vf7IXwW+AnxI/Zq8W/FD4m 3MdjdeHCkUEMUa+dcblOTGXK72UKWIU+1fkcltIty9pP+7dD8yn+n1r3nw58cfH3gf4fp8O/Dd2s NjLfC+u7UxxtHJMqsgZ8jcflcggnFfL8Y5TisbhVQwlb2cuaLvdrRO7Wl91oexwfnWHy/EVK2JpK a5ZJJpPV7OztseneMvh58N9A0e98Q6HPrF1pcmsLHpmoGANHLYP5oBcxlkim3RrtjdgT8xGQCaqe K/CmieHfDMWowXxnNw1qLaFhiVY1UlzIvQHzOMZ7Z6GvFpPi949u/DVz4Ma8H9l3WqJq8tlHGixm 7iV40fgDhVdto6DJxUqeKLy/sn0aeR5I2dZcuNzFgSSCfxzXnRy3EwcXUqXSfe91p5LU0nm+Gqcy p0rXXa1n167djzXxBNFLrM80AAjZxtAzgD05A6V9a6Nr9jpXhTT7i+Yxp5EMeSCfmPT9a8xu/DMc 3iE6nqQV4UVDbIoGGUDq2PQ59/WtfxVqV2ugTNbqsgAAaJhkFOnbkbeoIr6ulS9pQhLvY48O3hpV Zvc/SPxtc/sieDPh/Na3miePV8UQfD/T9XN/JKq6auu3sodXEbJveykgICsMASN94gc/lk/iyxuN R1GwsrWO5tdQuElCzcEM55C++T1qt47+OvxN+JehaPoXjnWrq/j8PaNH4c0iGRUHlaXHJ5qW5ZV3 OqSfMu4kj1ryG3u2imyjMuP3gZeCCPevIyTJJ4aEvbTcnJ31ba+V9vTp57jz7iZ4qqnTjaKvbRLS 73tps7fI7zxR4Om0hn1DSX+02O8oXUZ2MDggnuAeM964sHIwK9K8G+KGiSLT7j/VyyYnwN2Y1U4T HbJOc9zTPEvhVJdXnTwvHvEUKzzxA52kn7qj1x2r6CE2tJHlulGa56f3f5HJeGbaK58Q2VtdKHSS 4RHQ8ghj07V966t+z94W0/wlqPiYR2R+ww28qw+W6vKLnAGPn4255ODz6V8AW8s9pcpcRExyxMGQ 45Vl9q931L9on4jan4duvDc8tqsN7HDBO6RESbIOU2ksQOevFfO59hcXWqUnhanKk/e81deXa57u RY7B0adWOJhzN7aeT/Wx4lcoq5H6egrMYgjgfTmr9x6EljjJrOaF5hkK3B5Ir6Kg+585iXrod78M WL+PtKX1u0x+VfTHjSFv7NnHGSD15Off9K+bfhTayD4iaTlCD9qHUEdjX1L42jMOk3PQkoRgdvav geIK1s4w67pf+lM+xySDeW1dOr/JHxA5ddwHUnjtVmGK6DFi2BjgHv8AnVdXCzsQeQTjjvT/ADb2 YsEQkEgFsEmvqqiu7HxVPuLI08jFcnoPmHQeoFTRgA5kJ9d2PT6ZpixzRAtL07Y649q63TNDku/l RX3MMgMCevptFebicRGnG8mddGi5uyOTvrltnkw7iewHSoFBCDzArHAHIGfeuq1rRb/SJ1gmt2WR ow2xTvPJ/THpVF9Jvo2VZoZF3dMrgH/Gs6eMpuCaegqmHqKTTWxlLDGw+ZWAZhkq2Dj9aupZQM2A 7qevI/wI/lXUS6BJZ2RuZhtUAcsR972qi+nXsqidmQBhuPYgdjxXO8xhLRS0N3g5RdpIwriCdZA0 Dptxk7TtIY+ucfzpttNqCZ81VlQ52hgrkE1q30URASQhX+6QOvWtODT9MkzxlfLyrE91/rWlTExj FK1yI0G5OzMaIoDungKdBuUkc5x3Br0XRNWt7Twb4g8MqdkerW9sss0sZPkfZZfNQhlPRjlTkVx1 u1pqun+RbSTIElLFgcYIwQPfFeneGFuV+EnxCtNSKO0UGk7HOMFPtJOGK5OT2/WuXMKy5FzaNTgr ddZxSevZu/yPUyuD53yP7M3f0hJtfNJo5X4Lrdad46TUNNVb947abFvbsd53Lg8FQRjPpivscfEH xPZH5/C+pjI2A7XP8kr42+EWrP4P8QDxHaqzSPA8MQBwoZsHLH0x2719ixfH9rSC31W80+aVXG1z A2FyM8YIrl4pq82KjBJS0/z0PqOEq9KnhrTfK7t9+xFN8UNcVQH8P6mCQOgYD8B5ecVxXiD44jTC ILjTJoZiy5S4fB2564255Fdhr37SI1Dw1dX+j6bcx+VGQJZWBRXbgHHBPNfD3iDxDe+MtUk1nVAT IdkW5Wwf9kYORmuPKsGqt3Uha2m5159nioqMMPUu35dD7d8E/EU+KvFWjaNaafMq3erWMKyscxqW nTk4U8ZrxPxfYXVp8WPETMEaZdf1BdsfzguJ3zjGc1q/s4a/qFt8WPDWiW0zSW914i02ORJQd3M6 8KRnp+VeefEcajcfEbXr+y80Mddv5lMR34zO5H3SSPxr52pSvm86MXaPs1+Mn/kaVsxcsBSrNXam /wAEv8zvtOt/Fmr6vBe3CXRWFgyr5bBV/wAK9m+Jur+LfE2k6cl19pcWUflx5R+F68DtXgfg7xHq 7+Hbh72eVsDCq33BtIznvk5xXpep+KdN1SwisljtoZWZOMPkEMPlB9+lcGYZPSliqU9P3d0tNu59 DlOaN4SpBX/eavXfscte6f4g1myW3uopXIG1W8tiwP1rzLUvhh4jM5L21wOoB8l+frxXuPiu1h8M eKLvw4t5b289lcNE9xbI7IHUYJAbJ4PSui0T4gQwackepXpnkAKFmDByP7xGCBnHY16mAxCw8VOh Ncstdu/yPPxmXxrScK8GmvPt0PlY/DXxHGSPIlB7fun4pq+AddU/PDIMf9M3/wAK+irfW/DrwbLx Imd5ZWd23ZILEjkfUU21/wCEYbThDLJbmbynDPl+W5xzjr36V7Szp/bqfgeUuH6Tfuw/E8Otfh5r 7fMsMuPaJz/QV2OlfD3xDbXMVzJHKFjkVyTExHynJzxX1obXS/AHhjR5fEkjf2hqunw39vab2VIr KXiGaQ4yxmALqvGEKsc7q6r4ceIfhbdazdax48s47m1WwlSzh8yaINdCJzGXKH5l37eMj34r4jPe MnHD1MRQvUSvpFK8raO12uvXbsfXZXwjR9pGnU91+benr/l/S+Prtb7VNWezs8s5LN8oJPHsM8V9 332l/Ezwt4L+GNlot3dWZu/Ctzqj/Zw8bA3Gs6hGAdoyx2wrjPT6V86/AfT/AA5cfGeyi8U2i6jZ yCTzbNpHiM+MHYpj+bLdgMZ9q/ef41/B74exeB/BviLwDqEdnqL+G7TS9C8I3Nyk95Z29vczyXLX zAZ4M+6Iryy5LAYzX4x4y8d4TAZhl2XV6btO8k+VON+ScbPdq1227WSW5934bcPTxGHxOKU9b8uj s91L8bWWt2fW/wDwTy/bNv8A9lK60u38R6tf6v4h1eVIyl7O0sdnaNw3ynILMM9vlFfUn/BRj/gq Fp/xy8Pal8JtO1gaDrFgrT6a9qV8ucN1RwSeT0BOM9q/ml+GfiPw34g+NV7oM+pTwtE3lJrsi5t/ NVSgiCHBBZ2HOSQvOMV80ftW65qng74oEa9BfSXrW8UqSm6jMUkTD5WUxg5U44+av50yjwZqY7N6 mWxx9WFOvy150U7Up1IuLjJ02+RqKjFNWvpFtXSP0vOuIsqpUI5/LBxlVpP2cZ3bajZrda33s9tX ZnQ/F7xz4o1f4Fi31yRpXPju4MlwrY3bbJezHrk8isL9tLUU1Xwh8FbK1uEmax+DmjwXCIQWjka5 u5NrYJw21lOOuCK5LXfFiX37OOkavJDbfaJfGl9mKZDKCsFpbEF9xIYkvtxjpmvRf2kri0K/Ca9e G3Mtx8JtEurmBUWNWkkkuOVCgDgAALjoAK/qThXKVhsxy6PsuXlq4jbuouP3b7M/EuJcw+sYXGTV Ry5oUd+zkn/kfnDLYzwT79p5OQwGBX1n8NtO1p/h7qGoWRZWEgw465yBwa6qX4N6hrmitrGj23m2 kxLmSJP9W/Vo2HVGHYHr2r6s+BfwS17WvgT4g1y2hYW+nXMSXBKdCcnk444Wv2biLP8ADPDJtX1S +9n5ZlOAqRr7taNn2b/wTU/4KHap+xB4nsma71DVdT1O6itWiuJS1rZWzHEjeW2VLsvHsK9G/wCC ov8AwUe8R/tnaENTs9VbS7/S9Tu9MSyt5sCe2gSN1dohjaD5nykdSDX4u+EfA3ibWNe1DXDBK0Vs zMJX4VNpPfPYeleMfE7xDdwagYLVyYkd5CW/vvtDnPXnaK/AJ+A+Cq53HGUsRN+97WVPnl7L2tuV SdK/JzcnupuPNbqfrsPE+FPBuc8NH2nL7ONS3v8AJ25t97vfy20PG/EXjzXLLVWOpPJOC58+KVi8 UqN1VgcnkdCDkdRXN+N7VPh74wutI0hzLCYba7tpZR8/2e9gjuow3uEkAPuKyPEOrRXjtIxDSHPT gGvWfiD8KPG3jzxT4n1nRUs3i8G+B9B1/XTJME2WhtNPsx5WR+8fzZ4wVHbJzxX9Q4atRwVWjGo1 CLi73sk3zQjH8ZWXm0ux+IYiNXF06soXnJSVu6XLNv8ACN36HzD9pjt7gXcSlnYkg9stWnHbRXbr 5rZZiASSQCTxmsuGKV5huBOD0Hc9uK9U+Hvwo8ZfEDxFBpGj2OoyBz5jS2drLceWi8liEB6cfpXv ZvmdKhTlWrVFCMVdtnn5NllStUjSp0+ZydkjpLf4f6HomkNNrt9It4ZpYYrWx2yFwmP7wz9ScACu b0mBdMuPNgZnl7ynooP8I4GeOp/LFfTUfwK8aRXM2j6XoupGVmJu5ruCZriRhgtvPlAIMn7oH1zW 3B+zt44hQNPpF31xxDKD6Hqn4V+OVeN8GuZ1cSpc3dxWnp2+b/Q/YcLwJiOaPs6NuXye/rbf7v1P mPW7ufUPLZyWKjAP+fWsLy7meMqCR2r3H4ieHbbwXpjyXsW2WORBKrRuAofIGTjgkjAz1GSK5E+I vBBjiTSba51C5uI8x21ohZ9wyGBXkjAHHB9a9TA5kqlGM6FNyjrZrbTX7jjx+WQp15U69dRlZaPf 5dW+h9qfsKfB/wCEPxK8C+MtL+Ld5qUKXGp6Ppbx6dfWthK1vIZ7nzUkulZDtaAAg4HPUV5J+1V+ z/8ADv4RfHzX/BXw21aW58K6a1uNP1W+nhnnn86BJWDPDiNiHYrleOOtZnhL4n6T8ObW7X4dXzw3 ep2QtdYuV3YgtnJLQbgPmYkgEA+3WvlHxb4ibe2k6VO9xBNIZmkmJLcD5QDx8v1HXk18XkORZvWz /F49YmUaNRJKm1onaCctdmuR8u/MpN20R18Q5/l+Hyuhg40ozqQes0+l5NLu/i17NHRW2hagqtJp M1vNCS2S+3zlGe2Dz7EDpmvvv9jz466z+y/4vsvi9p9xcXWo2ErSWdmJXREkGAsjgdQp5x3r8r4N Wl0iZWtyyupBO04JOOf51tw/ELXJZUed8CHIjI+XBPfA6mvveLeAp5vg54OvaVOatJWs2uqdu/fQ +Q4Z8QaeW11XhF8621uvuenyd0f0v/t8f8FX/if+2bZaf4B8dXc8dva2ltLb3tpJ5eyVhtnDgFVd HPI3dDg1+K/xa+BXjuwbVde8SJcx2llZreQ3nmII7pJZzBmJi378LP8Au3Me4Kchsda+XtY+MXiS +ntWu5EfyojAxVApkQ8jf1BI7Gp9c+Lms69Z2Xhu+lmNhZxuI4HnZlUs7SnYGJCDcclVADEZ618X wj4VYvJeT6lKyk7zcm5yb0u+aTvdpW1vv5WPe4i8RsvzGEqU6XKoK0IxShFXu7cqVrXd++nmfT/7 Hf7XfxX/AGKvipp3xN+GN9Na65byCNZWbckET/f2r90sy5AyDge9c7+2F+138U/2z/i5e/FH4m3c 13rV3cv9pmJ2pPED+7JXhQVTC57gV8c3GsxBzJbSOpLBSG5/HOM1myXsk8xPmABjk46Hn+tfpeG4 DwUce82lSXtmrX1/LbbT9T8+r8a4l4NZepfu+2l7Xva+9r622v0OivfC6/aAVdXbaGxGdwxjPOP1 r7F+CP7M/wAM/iD8M7Pxx4r1jWYLi71ubRTaaYlptieKJp98huXUkFVGNvPPTHNfNfhTwFPNYprt 5IsZkJCKXxgE9x2ORjmvVvC2reMvh+Z28H3otDcuryqVhmUtGGUMFlRwpAZhkAHBPOK8/ibG4mtR eHwWL5Jp7rra6a2dl107W6s+t4XyijSlHEYvDc0ZLa/o0+na2ve55F8Y/hrH8MPjF4k+HmmzyXNt oeqy6bFcSKFeYRYy5A4BJPQV5Vq9vIkSuwwFJBOcqfbHUGu38Ra1dv4lvbnVneeaWRpriaZi8jzu dzsWPUknNeema6uxtVvlDMRnjk9R/WvvsjnX9jRVeXM1GKb7u2r+b1Pz/iCph3VqqjHlvKVl2V9F 8kYzGTB2ducLzijkAHkjgn/PFShXEhCn6lR2q1BbxyKzFjjIwQM5r6WNRRZ8goNkEcbE4GffHb8K m3AHuT2HerHlG3deN5IznJ/LtSOF3F9uDnscjmrU9RunZajwYzHgLnJyAOxprB2Kg9jyexpiMpww +9kjHanW7fNl8nqOc/nWsXbYwsdLaWfl27T4xj5mY9Bjt71kXUkrS+ZIPmznPTI+ldVa6jp7xrp8 su2NYyNwUt83UD2561zF63mKsp7DAI7Zrz8JUqOb51Y78QoqEVFlRcMeMdSMtxV8RR+Wp87kj7gB yOO5/SsyIF2G08Zx0/nWpDB5bBB1JBA+tdtc5aa12NxNLhm0Zpp5GUpggbeB6kn3PSuWs7iWxvo7 uLG6JxImemV6V2NpNJIiW0hZhuHyPz9zn9TXJ3MSDU3WHIHmZXHXk1y4Os05xm79T0pQuoOKsaM1 9fahdte6lI0kjf3j0H07Cux8NanJp5kjba0cyFZVfng9D9QelcxdWFrDEZIyxKjqWqoEuYxGRkI5 xnPXP0rgxE1Vi+XQ9qjOVGom9WfVfg349eJPDWtaWNJuZILTTbgXEaRMQDIvRyPUdqtfFv43a/4o 8VX9vrNzJcW18kNw6SuW/eNGMsM9zmvmqCCGCMywFt2N2M9aqeLrwz61vHI8mEL+Ea1+fw4Iy+WN jiYUVdJq9td0739T7HE8Y4+ngpUJVXZyTtfTZq3pboaO+CzvjeQkhN25cd/rX3RqPxy1XwFq9tqK TyNJL4R0XyoS3yblgDjjpjcc/Wvzo+3uFIY9v1r0/wCJ+uPqGu6aVJxH4b0qDnIyY7cDvV8Q8KUs fWo08RHmjaV/vicvDvFFXA06tbDy5XeNv/Jj9DPE3/BQP41+I/hRYeH9T1++nePUbi5uVlkLLLHc R+U0bDOChX5cdK8++JulWWofsT+D/G1ruV774oeK4XQfdCw6Zox4/FjXwAupyPbeRuGCQee34V90 +MNU2f8ABOv4eRxt8w+KvjVuD1J07Q6+D/1BwOTYnALL6Cp89d35UlvTqvWx9LPjnGZnTrrGVXJR p9desV+Ol+5538JPjZr/AMGL9dX8CzNZ6zIpij1GHiW3V+G8tv4WIOM9euK+lPj1+2b8SPjdqEOh fELV7i90ySys4Vt7ly4iltovLEi56Nt6+ua/Me11BjN5rHLHt71f1fUZXeKQluF4HvX0eO8LcsxO Y08wr0YurFNKbSclts91a2nz7s8nAeIWPw+Dlg6dVqnp7vS3X7+vfTsb/jafbcP9kk3xK+1A5BOB 06V5lJI8E5ScFSCCR0961L7UGkCiX0xzz+dYE8hlmJc8nnJ9K/WMsoSpQUJan5xmWIVSbmhXfzRk dM/rTdq5yCf/AK9KIxgPkc85xj86dFBLI6lQfvYXHc5r2oNJbnjtO+xYisRqF19meTbgAjHf25r0 vwv4B0plN/fFphG+3ymI2tnrnvXAaroWu6QqaheRNHGTiN8jk+1X9K8Y3Npp02nzk5dxIjjAKkf0 /CuPFSnVo/uKn3fiexgZ0qVRfWKeu+v4GV4j05bHX7jTtPjIVJMKgO8jvgGoI7G3gTfeESOc4hHK j03EdfoPxNad3etcSNOnWbDSMv3ie49hWJJJ5I3KMt/KuqnUm4RjcUoU+aVRLQ0C5kABwQBwAMBc dgKRdpOMD8P896pwztIm5xjnoPSrKlc7eR361Dg0dFOopImAA4GelTx4jQytgY/OoY2VjgcZ71Bd XUcfysQVIxtHrnrWUl0MsVWUYsoXM7XDZX7qHk49ajliW3BKn5nXlTxwatTzi3nVVU7W+YrjHXpW TeTmcAuSAq7Dk8deMVSu7HhTdr3GrErOrnswL7CM1sSlyAsp+8flIJyPTPqKwItsUm+dTgjgdM/S rsuqJHiG2HQ4csOgI7USpvoSpK2ug6V4YWIjzJI427n6ce3as+3u7qOJ4AxCfeZRwCB3Iz0FEKqr GTJPpgZHIP61QunRSBCcHd16H/69awV1YlSsMvImmKzlhtztwDyT2H0qa2tCqOrBs45xzj1H/wBe s4B3HqEP06+4retZlMMrhSh24G3OAD1HtmtZt2JvY2PDmhxazqkWmyNMwmJSP7NH5rmQDKrtyODj kjoOcGvo74WfCzwP4xu9bh07WtIW68MWL65GdYSZLXWILSbEkcXIYM6MrBSoJUHkV87WHiF9E0ea wto4WOowi3nmmQM0aBw37tvvK2VHIx6HPSulvfGUF9dy3PhCzSwe40+PT72SIgxSosaJIwjcNtaR lLllIOTxivjeIMHjsRzUsPUdO60atbRq/Mmr6ptWXrva30mTYvC0bTqwU7PVO93vorO2js7/AKXv +mHx6/Z6+DPi3wx4Z+PvwXOpX2gatoJbxL4fs7SSGLw3dwBI7iS1vpzsuYjPnYMZClRknOPzGvxp NtprafbGWS6N5uiuSAqNa7flDJyRJuJzyRiqmm+MPEdnaNo8d7dpbjcFjjndUXON3yqQGBwODxwP fNWe5Nxcia7kaR2fAkkPIC9//wBVeLwXwnjcrovC4vGOvGLfI38SjduKk/tNJ8vNZOSScru8n6/E vEWGx8lWo4dU5v4rWs3ZXaXRO17apX0stDbsJxbyxyHO5M+ZvPGMe3Ar2LRPiXqOnW8ek6QWEOUM jjIbg5wx7gdMV4FHJc32otGuSgbdlRxjPJI7iu38O2TT6oLVC23eSzKCRx0OOw969TPcto1V++V7 a2M8mx1eEkqDtd2P3Y/4JffF3xDF+3x8H5fDMdpcai3jnR44ftLMkPz3EasHKjIBXOcV33/BTX4g Nc/t7fGSYSB0bxzqUS7s4UIQgz24Ar44/wCCZM934X/bh+FmoXDZA+IGjSbiCqhRcx9jVj/goD4o l1f9tb4paikjFZ/HGqycHhszH/Cv5MrUk+J6uSQS9n7GNX/t7nlF/gf03keOxEcL9erfE7R/N7/1 ucx8P/FknimK60fWI4Zo7b94szqrMxzgA7uOB+lN8V6Ho8Vk0qRR4BBXCpz8xHRV9MGvJPhpJBcS XaTyBcSxSj5sKx5yD/hXpl1qmma9G9rHA0L24k8xlwVkxgAgDoAexzX6PhsoVOupUo2XW2xxYrMf bUnGo7voc7bR6O8SxvFEXUZYGNT+PSuX1vT9KN1CbQJjzASQijHHTgCszxP4ji8IzQMlsk7XDyKN 3YKQM/qK09ansku4pYEEZ+Q5UYyTknGOtfY08FOFpdHsfD4rEwd6el1a/wCh1OmQWXlKbnoHIckA YUdMEir5OhpcszMPK6jJGf5VkWdvb3ejtIQGIVjk1RtBt052hIVvPjTOAcKxAPUH1rmqU97m0Z2i 5PodKl1oYLb2yp+4d2CPY0Q3OilNjMS5J2jeMj8M19Y/8FBv2c/C37KujeAx4Cvb+e78RaXLqOpt qjJJEpVVZViCIuBgnnJzxXxLAy3V1ayXCgGWOF2H+8oJ4+taU8NfD08Sl7stjjoZjGpJwh0Sf3mJ 4wXTHvreKeUgtHjar4ZgDzs68474qd9Gs7NFfSYmhBGGdQJJHPrvIJH4V3Oq+EtGvYv7QnaUzwxu YWyABken+NeXePLrUfD/AIFW4sJXSeMbllbDMcso5zwfyrXAVvbSVKk3vb5meLTpJ1JpbX030I7/ AEq3vo/JvY2njHVbhVYH15K5FYv/AAiXhT/oG2v/AHz/APWrxPUPHXjCOx0uT7a5a5unjnOBhlWQ KO3pW9/wlGvf89z/AN8ivqaeUYmK0ml/XofJVuIcMpawb+S/zP/T/mt1n4MRadZI97qejQEs5Ja4 MgB3HsitXGaR8E7DxRqi6NpXiCwlu5ARHBBb3Um447t5YVQf7xOK9k1lZr3SzqEsBmgsy6TqCi+X uc7N53ZGc/jR4b/aXPw80LUfDcujaLei6t3jsppFkgmsLkrtS5hktJYi7oOiy7488lSea/mPLs8z irhH9RxPPVWlvcSXrdSe2ttLrrqj+hMRhsuhVTxNK0bX+02/xS17667o+FfEfhy/0bX5NMv4vLlt leKaM4yrq2MZHX61yUx2Hqeg/SvTtW1TUPE/iRT5txdzzRGPz5900jyFgQpbksT2rkdU0pdPuHiv w8cqOVkRxtIYdRg4Ir96yvHOSVOo1zW/p27XPzfF4dO86fw3OduVzGVbnIB59yKWVvJkZc9+Klvk ggtBdIzSAsqrgdcHtWleaTPNKJpI3QMMqdpwQfwr1lXipcrZy+yk4WSMbzjIBknk1R01JLa0ikUj JDZH41qSaelsSzSfKvJUjH8+lFjb/bNNhkgG1Ap+ZuhIP9atztJGEaN0yJbxgTsC5PB49eKyrRYl 8wlFP7+Q4wOTnitp7FlYqCvXJIPUVVs44bqCUWw3ETuGPRQcjvWynqtBqm9iAw2jyFmhTdnk4qvY WNoWlUpk+bng4wMDpitpdMuNxKrkMe1WtFsluGkSIFz55XA6/dGKyqVUtSeVvYmttIs5JR5Syq3G dsjDH5Gr3h/wvc6rJLBLLdYW7aJBu3YwM8dcmvRvDPhG8urkMIXYEKDwTjGenFfQn7O3w0j8XeML zS0USNFrEse0Y3HbGWwB+HNfNZ3ndPD0pzf2Vc9PB4SUpJdz5BttC8W2fiC4sLG5u0SFowmxsMA4 yORjtXoi+FPjBLp11rWlX13JZWMCSX0jyn935rBI/lL5bcxxwDiv0r8O/s4LefFjX9NcKYrK/wBC t3OMhjd20jAAgfLlhj8K9v8ADX7L8+q6H4m8KxpIjzx2ttGsEImkYpMHG1NyZwF5O7getfjfFPi1 gcBQjiavLZOnzNq9oylFN23vyyufZcO8NYnFVvq9Nyu1OyTtqk2l82vu+8/Cm88R+MI3/wBJks7w rjP2q3ifj6urdK56TxFqV7cOk+l+H5NmC/mWMPOfdUVhj2NfaXxZ+B/w1+GPjXUvBni7xJqYvNMv ZrO8i0/R/OCyRNhgryXUakA15lo3gb4Ka5r0ej6HP4u1Ge7eK2ijMVhYeY8nCgF5Z8ZNfoGD4gyu tTjXpYeTTV7+zlFWte95KKPMeCx3N7OVePb40/ybZ80SSWVxzc+H9GAHA8hp4R+G2YD9KjsLjwrN MLm70OZU6Ytbtk5Q4/jDmvqD9pP9n5Pgjq9lDaNL5VzDGtxaXdzb3NzZ3WCzwyGAKCCuCrbQOo6i vl9BssVZf+ekmMf7x4r38hxGX5pg6eMwkm6dRaatfr/XTQ8zNcPicFXnh66SlHfSP+R3mpeM/Atw m670/VbVlwoaKWN8gjjP7tc1y+uReBNfso0j1DU7GbflTLbK6qD1yVfofpXP3J862ZSCWBU8nPO4 VNM8kczYyOeFFe3SyxU4ezp1JJLzv+dzjrZnOabqwTv5W/Kxk3nw50GCL7XYeJ7CRzg+W0E6Pz1z hTXOt4Gu2Ba21DTZ/ZZShPPfzFFdQ6Yv0k6nyjkH69MCtBooJ1Ikij6HPAznFVTwVSK1qt+qX6JH BVlSk9KSXo5fq2cda+CPF20C1ghlUHG2K6hOT9N6mvQ/CHgr4jLrpeayu4YU2tdTIDJvKn7oKZzu /lWFFptitpF5keSVDbgSDn8DnirEdtOl0kdtPcxAhidsrdvxqK9Cs1pJfc//AJI1w0qUJpuD0/vf 8A9J1n4W/wDCQ6x5pt7my2Li6laMorMRlQAwGTg5J9Kz4fg3o77lmvJlO7bxtK8fh+lR6brvjPT0 xpetalHtBIQSE8gZHeul03xP49v7DdJdxXElyVJE8e5txPJzg5J6V8lisBmKk+Wskv68mfX0MXls 43nQfN9/5Nfkc9N8FbOJfN+2y7cFi+Exgd/yrzfxh4Pt/C6QzW0zTJOpYFsDoQOMdetehXeueJbE v4cu7VAI3fzFjkZOQxDKeg9q4jxbrsWtQKb20nhECYQRspXGR7Z+ld2XUMbGSlVnzR+R5uY1cDKm 1ShaS9fmJ8JIln+IFgHLgq7OhX+8qkjPXA9a+gPFSXD2lx833w25c7j+oryrQpbfwbZ2upW1jJbz XX7iS5lIdypBYkemeOABkVsSa6tyGe7VSSDhi569jgZ/Kvmsybr46OKgvdSt01s3c9LBVI0sI6En 7zd+vVI8COmXE13ImTHEshBdhyQD2zWraS6bbyLp1uZJmYnkYHTnvxzXp9xq+gXPhyXTb6G/a581 2W5gWJoxEcbQQ218jnuQfSvMdD8Mw6rrUNtc30VsskqxpLLuUMWYLzgHA5ya9+Ep4hVXUi4qO3n5 nzlXCKk6apyUubfpbyIbmGGW6WzgPmSO3zHGNo7dP511Vvp+qTXKeRNJCdhUsG7DjgVm3VvLb3bW m1oijspYKcNtOM5PPuK7LwncTeTPN9mklEbiL5CC5OM9Dnp65rw8xxDjT5o6+p14SipVeWWha0bS 9V07UJ9U1GbzCYgFYDLOTjHHYUmreOb2PTpdIu7d43YlI5yBuKgdQfXPeuhsX8S6i0t3fwPbwYbZ wCNueOhB56Vx/wDwhd1rer/aLu5BslmPlHcdzL/dAPTB4Oa+epSozqOeKa9223lslbr5HrVFVjBQ w6fvX38+v/BNFZLHxB4dXT4ZYp545UdhKdrYLc5x2P8ASu9/4Q621LTLqPTpYjcQp5ZmZdsaui5A BPY+gzxyawovh7oiXL2hdY1dMAIdzZB65zx1wM1sabpOnWWkPpFtJcz/AGiWR8EHYuAFAOOvIPp+ NebjcXBr/Z6jWt7W77/ltod+HoSX8aCelt/67nikHhjWdblluUAaRXEUidD8o4PvVrV9PvtL0iV4 l2GNCxzgkjoev8817r4e8CQWzgTXkkEkhzII8cAdM5zzj3FW7vS9JW7m0uSRWRiyukqkkhhja3fB /lXb/rUvbKK96MdbWe39bHIuHZKm29G/P+vmfDcdxNDloWYZfdgEjn/69fo58KPhdqul/D3xrp2t S2Nwt74e0TUUfTr2K6icNdxlI52hLbDhyrocMCMEcV8WDw9osOp3mlXf7smXFrPDmSJW3DaOcHbt znPINffv7Inw/l1T4Z/ErRobgyXM9ppMFvOrLHGjG9UqdzkDtnk4r1vEziOjTyx1Iy5Xz0t13qQ1 +XqdHhjk062awoyje8ai3/6dzVjwTxB4CvdG1i5aS1h0+KxleGSJBJJFcKjYMkTyDqOnp+NV/CMa ajPILaVJdOttzSLuU/RSr9B7j39a+hP2wbH4q+Gdc8MWWuvpzwyeHQouLNlljaFZGT9+ULqrZ5J4 JPJz1r5X0LTtQ8Na5GLW4JtLxA6yyERQsRu/dvuDKSx6f5x8XlOYTzDLY4udWLlNaWd1o2nr36q/ 6H0nEeWwwGaVcLCDtCVnfTfVaLp0dtPvPadB8H6fFdvo+tW01xpmoPuje3I8nYPmCZ+Yjnj7o9jV jR/2eNF1/XdT8JrHNYql88tlfYJQiJcqvT94CGx8uOcGqumP4l0VTe6NDcLBYBb2+e/EZhXzBwke 8lXBHfAOe1ej/DzxvBr+sRapYm65s3K20kgZDPGNsghchQpbP3MMOwPSvl8xx2Y0YVa2Gq6W3T2k tU2tr2Xo1q9D1cFg8FUlCnXp632a6PdJ9Vf5p7HoPwg/Zks9M+KfgnVdBvGn+z61ptxeYjdZJZ3u doVd4CqBj7oPqa+LvFXgj+yfiRqxN1FI0Ws3aktmNg4lclSDwCPr71+yH7NeqjWPHvhixggvog3i a1mnt3mW58uRWTe05ciSLnnbg47eteM+IvAE/wAUNV1/SNFt914t5dTTO1sLUv5heOO4O8MXxyGK ZO3Br84yPxJxeHzTErHyulCKbdtE5z3aVt79fL0+5zfgfDVcBQ+pxs+ZtJX1fLHa7v8Ah5nxf4P+ HPjfxV+703T7y+s3kYTPaKLj5sByoGc5AIYrn9Kg8T/CzWNJu7S/XTr+K3kuVijleF1jOxlIAZhj oeeara98LPjJ8G9WfRfE9tqGmKsy28WojeLG5DdHjuFPlncp9j619MeBfjVqWmadb+Grye4kJIhh glYvEkqHgMrKyuB1bjkenWvvMzzfGUnHF5fOFam/5bq6tvdOSf3dDwMjwWEk3h8dGVKS72et9krJ /wCZ81/G7wxLZfEfUL2SQAajdzXduo+cNDuIDZUng4J57da8rGmOVVkYOdo+4w5zz0OK/ZP+0vBP iSyTw/q2j6JqUzW7xw3NxaEMjyAbgWiKbBjcfu8D3r4f8e/C/SNK1GZ9Jg07yTM0cUNrOsjrtG08 ARtj0J6+9eVwn4j+2hHCYmk4SitHpZrpbZ7fqfWZ9wOlN4jDVFJSbdtdPzTPmCDQry4UeXHLlh8p K9v1FTrosIlJUu4K8kcD0wOufrXs8PheLT5T5cdzGcjBXcvbBxnP866yw8K2d22ZIHYEKu4rtf8A 76XHOT/EDX0+I4oUby6HJhuDZTXK1qdD+0tp8T+PfDt5KjRwz+AfCZ3MCcR/2VbJuVcgHG049a7f 4y+MPg38MrfTvhx8Iru41nSLhY5Lm9vQq/ab64i2CYW7p8hjLkKATgDqetfcukfsr6X+0ZPpWvXE l2bLwv8ADHwxFf6fYxb7+VpbZ47bZllQKzRnc56AEBSTx+WH7T/gHSfhF8W/+FYeIibvWdM1ONFu wzInlMwES7GHBKkEghT9BX47wXn+W51i8LlPtpOph4NyprbZWlLTXlTTWtvfTtJ2t7/F2V4rKcJW xsYRUasklJ7rV3St31vpf3bOy38v0/4g3nwc8e2fjjTo4p2tZykkUqgq8T8SLzwOOh7V0Pxr/a4f xveWl94ca5Roma4fzyGPnyLgybuCNpzsUYVc8V4D8a7xordo48DM+APbn19q8EsWyC07OoAAPGcg 9M81/UNPgTL8bUoZniad6kY8t+613XzP5yzHi/GYV1sBh52hJ3+f9fkfV/hr40eInmhF19ngmCyv LLKvzytIpG7JzhiOh/Ou61zxje/FvwZNBeSSF9NSKRIi4bBB2M4B+6DuAO3jivjCMyS/M7bjH905 x8vb613Pgfxvq/hG+kubJ44/PTy5i/Ro+6knPGeSO9aYzguhCaxWGppVIar79vmtPI5cJxdXcXQx M24Sun93byP0G+G3wfk+IvwI0/RG1ax00afrmr6k9xqcvlxyA29oBHG20gu2PlGQCa+lP2qvhv4F v7z4b6b9n1mKG0+FPh6O1lshHJK6mNnJlWSQAPluicYrG/Zc8dfCz4jadq2jfEma70vwsmnXGpXg 0pERpL5xEApKxSiKOR0UAojbTk4xXpn7WV3qOm+K/BFrotvrRNp8ONAihEUkAMZMG4CbcASwH93A +lfzPh+I8a+LKeFxDlT5HWklokudJv3tOZq+q+ymu9j+ga3D9FcP/WsPFT54wV9XfllbbotNH1af Y+kf+CdHwf8AifZ/Ee2tI/DV74n8M37JBdWs8DJdPbZGGZSPLZ16rhvxPQ/19/D3/gkp8OtJ+EPj Pwx4RZbe08bpZ3Vjb30PlPpzDImV0AB3ANx16cV/MB/wTY+J3xlHjK1t7rxP4h8P2MBjkkNtJAyh QwL+c+/90oTJBCsScAjHI/sL8Cf8FJPghdfCXXvHFjLqF7p3hG4ttNmvrt186/LfK86EnoD64z6V +i5HjsnxGZYqOd1OWyVnG9m9bar7SXlvbrofkvEGBzPD4ai8vpt69d1qunRN6b7X9T+S3/gpn+zN Yfs32Mnwa+BnhXV206yB+36w9u6LeTAfOzytj5CR8qL0HU1/L78QPh18QdU1CRbu0nBQsfLijbC/ pX9l3/BVb9r/AOM+rX8nib4Q31h4l8JarD5tskig3UIYbtgG4xttzgq6bvrX83sHx8+IOr+Jzb65 EbGKdJRJHBbW6EuBkHbGnXj+8tc2R8U4nBUMRiMHShUSbacp+87d1aTv89T1v9W6eNnRpYuUoOVl pHRfPQ/LGP4ReKr6aD/RpNs4kZG64WMZbI7elfdFjZ3Wm6b8bxc2vkJffCrRNNt5ZAQ81ylzo7bO OhCoxxx0qX4iat46up/7IgvNReKItcokriERqd24AqQOeOGY+1egaizWekeKrbTLmKae903ToLmc Fmb9zFbTEr/CCHUAl1KtyBzjHNn3GuKx7w9StGK1Vkm9Eq1GV27LpFLbvby+uyfgGhhfa06cpbO7 dtf3c42S9ZPrsfnJ8MtT0nwNfPc6/pMF/NJIjWs1ziSOJkJ3AxvlXB68qSCPc1+rP7Lf7WPjD4RW t98S9M8RRaJPp2tRalqNrq9mMXFqYmXyjGgViGRm8tdrKXCE9AR+a3xY1pWnijvNNT7VbEG8WIBY ZoZApVpCD949MDGKofB/Wfgr4v8Ajbp7ftDzaza+E/IZpI4JmeQG3iLJE77WfynZQnAyoPXjNe1x 3wnhs/y+viMfh3KLi3KMUqjajb3IRejcltotddz5vhziCrk2MhhMPVjvZOV4JOV1ebS2i973002P 7Mf2N/jn8CPEdj8Sf2hbTx7Np3g++8UxWsWv+IbSNvNuZLeOQxr9qcsFdnAjRY4wgG05INfoT4g0 DUL/AOGesa7ZfEfToJbiwe+sL23060WC0gIDQNJNHISqncvmyAjAb5cAA1/G9+zd8EPhz+0xo+v6 LofxQ0Xwf4O0i4nbRPCXim6laN9Xv7K3iNzHDJJEoRJFY/aTIxIUfuVBAr5/tf2gvC3wtt/EPhfx 3ceIdZ04+LL+1RfCviee18y6hga3e4EhtJLS4tJFJCRoqHG08Lg1/nVxD9EeGb5viVlOZT9tSdPm pSw8JSjDlioRcp8kXO0W5uLcb2irW1/eV4mTo0KWIxsYRhJu0ouLjJxvzNe7OSi21a+u1rIxf27v if8AFLwv8Zde8JeINR8O63b3EVvEl3Ytb6paTRWc3mRXEW57j7PM7KfN2sN4YgrtOK+ef2S/2sfG n7Nnxcu/iHoF5Z2Eus6bc6Lf6xJpsN9NYW90wd57KBgqLMGQBcAAAnivlW+liaea4CssUkj7A5yx UnIDdecYycmuTkkQl4kxgdQvc1/q7kvhnl8cj/sXF0o1IygoTfIkpaJXcfeXRaO60s1bQ/jzOuPM ZUzV5nSm4tScopybtre19HbV9nrvfU980K/03xzrOq6v8SteGnfarW61P7TJbzXL3t6o3RQhYfut I5xvYhE6mvO5ry3tY0Nq7sXTEoYAY5yADyenXpXO28si2qgZXjk1RhkmlnInPAPAr77D5XGnOUoy 93RKOllbTTS/rdvZWsfF4jMZTSTir6tvW7v31t+HV3uat7cuXV3J+c9/U1WmnKDrg9ce1F1Mkh3L 93GAfcVkSlvMKMemM+tetTWlkeZJ9TTEvmgbR1HeqjXTiTy89TQ8qxbBnAwQf8iqe5R8+Bx1I681 vTpqxlKbbNaHDA+ZgHk4FbGg+IbnwzrtvrdrHbSyWkglRLuFZ4dwHG6JwVYd8EYzXMQP1AOSR0+l WJDGQ0bAjpjtjFYVaMJxdOa0ej9DWlXnCSnB2a1R+tfib/gpJqfxI0bw7oNx4P8AhzodhpgUaxFp 2h2/nalMAB50zNC21c5fy04LdeABX2r8Gv2/v2cLL9m+fw74z8C/D7UvFtox0yxk/sHZdTQlCyX8 swiaFnHV0yrluMHINfzr6bDILQyQrnCsQzDAJXkgde1b3hbxBFHe20Gsz3Udj56z3AtCPOAXgFCe Nwzwe1fzrxN9HHh3F4RYahRlTjCfOlCUk2022m/iad2mr7WV0kj9syDxuzrD11UrVFNyVryWnRX3 SVrX2te7adz9H/jP8V/CPjbQtW1qx+FnhbSrnxDAxjXw+0lyLa5t0KPf2sDr5kMMwjJdfuo25lIH X5y+F/7P1x8b/h/fJ4Ej8Px63YSf2pcnUNSFjK1jEqRuFSZRCfnkBCl/MkP3AcEV9FfAL40WPiLw Xp/wVj8XeJ7S4v7u3sI9JttOtJYpEluyZo7W9lnje2SSIlpi2A74G3aCa439tb4Gzfs1fHvVdE+F k8FjoCT2gt5hfJfwzHyxcozMuY3UMSAnzbSNrEnk+Nw/i5YDFy4coS+r1tZ03J1ZxlCm4x95TcZO 6kklFyTaetz6PO6FPF4WGd1bV6SSjNJQjJSkm7rlutGndyUWrrRmJ8edM8A/DbR/Dvg7wR/wil1d y6Jt1CZ9OkkuIwC7i58+WCEN5g+Vf9Yw4O4GvN/gB8HY/iB4gu9HE+kypcWdxCbi/mihtYgsRlMi yzPGInAX5GbGDxXgHiO/j1bVY7tL6RwqDzCcjy8klo1zuyD1CqNnJAAr1TwI9/N4oguPBN5p2lX9 zBvhtp2222+3jZzv812CtMVXYrjYzNtO0V+kzyTE4HKJ0aWJftJKTc5Lrdu7tZpLy2S13ufD/wBt 0Mbm0a08OuSLSUIvpZKyvda9fXQf8RvCNt8N9ItdOu7O3F3dhbq0vIrmK5SexYCRHeNSWim5APIU joM5J8AlxOxf5VOe3p7ivcPjN8YtU+K81jqOrQWyypEwubz7LFBd3dw5zLNMYlVSrHhEHCAYxzk+ DkvJiAALhTyflyAetfb8IU8XHBQljdKjbcrNtfK/9eS2PjuKamGeKnHCO9NWtol0W9v683uVNw83 CnIzjirAdVZg5BJB+8P0qqNiZ55PB/CpVbMbYAPHPTP519t5nyPUmd42kVYxhcAZAxkjrmmz7pIw oIwOTjpmoEkVWGAfw6mpVuGUnywAPT/GnGL3Bas07SDYgkOM7c/QV23g7SbHXPEFppEreSby5it4 pT18yR1XnsBycE/yri7JTIFPLBuNgySfpiu78DS6bHqkV3fuY2injKsVLsNrD7g4BYdgfzHWvFza pKNCo4N3t03PWy2lF1YqVreexPd6TdafqtzaXls9tcWcktrMkisuZImZSxBJwSR6gVwyWLi9LQh5 Pl42g8nufoK/SX9rX4b6rpOuWvxv0mxgl8O+NbR9QtJbZzJHBfKkbXlvOSFAkDsXBH3g3HQ15P8A BvwVH4iuX1FbFbmG0hVrphglQ5wGI44+gOK+alnNXB4SVfGQ5GkrptaN9L+rsu/Q+zyvh2OOxcKG Elzpt2aT1S628kte1nc+OZ0uypjaNsMOuOaSVrp4ki2EbMY9eK+kL631G31q9tv7PaS3S8eJGWJg VTcdp3dNvr7Vbn8LXlxB+5tCJQpwojJ3eh6frXG+LFC0ZQWvXmPQlwrKbfLJu390+ZE+3ZKhWOQR 27/jVDxKx/tN2OfuIM/RQP0r2zxFbz+GbKS81GyiZjG8qJcg+XhcDcVyNxBIwM189+IRetfyyFcg tv3IDtwRyRxgCvocnxMa750lb13Pms9wkqMfZttu63VrblB7hU5Y89gOta+o30klxF9oMmVtoVXz CT8gUY687fQVxJb94SeuauG5y4YkthQMnnGB0yfTpX0MqKbTPl1UaT1OmguwT827p1HrX2Z4qnI/ YW8BIZXKn4m+McRnG1c6foY3Dvk9/pXwv9o2xbkPJH05rppPHfiefwjaeB7u+nk0mxv7nUrPT2bM MN1dxxRzzIOzyJDGG9Qi+lfO5xkVTE1sJUpySVKpzO/Vck42XneSfomexleaxoQxEZq/PHlXk+aL 18tC6rhbrMXzJwVzwOOuav6rqD3nlH7qxJtVB0Xv+tcRFqarhV46HJ/wqdtSM0QRhjnt3r1ngXzq XY89Yy0Wu5euZ2KqDzu656jmoGIaQg8jt24qq7bxz161Pbw+cWb+6M5/lXbyKOpzObehr2tuZVUD hWbbycf54rsbO9g0edkhVWKo0aP94nPBPp9KwQqQoLeEjgHk9Cf/AK9M2Ss0YiOXKbT6A/WvKxE1 UTUtjvoydN3W5vap4h1HWtOt9LvGDQxMZEVfvb143E/TjHTFcDfWhicyBWwTgnqAcZwK1H32gdWP 3oztI64J5qu1+htWhDA/LkAjkN696vC0/Z/w1Zf5mGKquo+ao9bfkRwTs8HlzZyCBkjnHtVdo5w5 VQwz2xUL3WD+8Y49K1NNv7dDG90jynd8sZbauP8AaYZJ+gr11KS1SOSNbVRuZw3oMOr/AIqatwrL INqLI3uqsfyrvrDxRZxuIfsFrKXJAOGwqj3Zv5mvefBmm+HobFrq9tg6i4KxhE3sFZd4BEecjnqC a8/MM2lRg5un+J9FlWBjiJqEan4HyvDbXTLgQy8gjlD9etZN2yfcZNj9Pm9q+oviNrHhK6gjv/BW 2WS3bbcLGjeSyvxtY84fPIzivnDWNVGpK32lI96NgErtdR6ZGAajL8ZOvFTlTt5dTlzrCwpT9mqn NbqtmY0c6PCY3O6ReQCBiszyjJcrJckhc7iQM8dfu0pgmji3pkgtkNxWgljOLfzZNoUjKngkk9uO hr0Jy5Vc8BpydrEl7OpDBEJVArZGNoyOv41zqRPdSkZXCnzA3PPGccd6t3RVIw0z7mfgop5yOOaq pIIBI5O1dmSoPJz/AHfenTjZWQpe89SCHUiJWL8lnyFHY9BxTnJuJwZyFk6D/ayelZJiRZj9nLYB V1Y9SR/9etD9/cP93nHU9/f6+ldPKr3RKS2EiizeFIywO4Nx2HTjNdRZRrbJIpwFkUjB5JxyDj69 KwogUl84ZDdVOcgEH8q10uEa3EzkRuuThQeOg/WufEXa0KjJJk1/GZ9txM2wKMiPjIAwM471lyXS PCRBlTjnPQ1a06Rbq3/tCQJwDxkjhTgfnWSqqZGZdoCynC9BwenNKG7T6FSstTpEuEnhXbhnVcDH ByPX1qkWkM5WYqpHAPbr071DcXAZFMCbWRiMg4zk9T9Par+mxxT3AWcnLsse8j5QXIG4n0HtzWbn yx5mjSPvPlR0Wkanc2EjLCYpcYUhvlGPbGOa9GbxZp9nojXGloIruRtgUYJDdS2fQV+k3/BN79nD 4IeMvitfy/F+OHXNKsC/9mX1pLts1lg3Oz3qOVkjDojFFIIYbgwHBr89v2jdb+G3ij41+JfEHwh0 pdI8Nz6pL/Y9lGG2rbp8ok+Ynb5pBfaDhd20dK/LMo46wmbcQ4nJKOHn+4hGcqjSULyekN73dm7N K3K7n7fiOBcdlHD+HzqtiIfv5ShGnq5pLeae1k7LRvdfLP8Ah98c/iZ8MvGmlfETwhqJttV0W+h1 HTrhoo5BHcW7h43KOCrYYDgjB70njf44fEf4i+LNT8ceLL/7RqWsXsuoahOsaRiSeZizsFUBVyew wBXjwdOA361IW7sOtfof+q2XfWPrf1aHtLcvNyrm5b3tfe19bdz4RcQ41U/Ze3ly3vbme/fc7i1+ Ivi3TifsVyF34JzGp6dOo9617T4w+P7KMmC9QA7s5hjJO7k9RXmCbMZY470jOj4TPb1/IV6P9lYZ q3so/cjkWcYq9/av72d3q3xH8Xa75UmqXCSGHcY8RKuCxBPTr0FSXHxQ8a3Egea7BI6ERIP5CuCd 0CA8fQcVGpQjqM9TzW8csoWt7NW9EZPMKzfM6jv6npUPxf8AH9pbm3hvsRkncPKj5z6/LUcPxZ+I MRyuouMOrgeXHjcvIONtealgWxxwc05njUEg9OtH9k4Vv+DH7kKWY4h6Oq/vZ9D/ABg/av8A2gfj zPYy/FfxLd6uNLga3sEljgijt4m4KxpDGigHvxXl03xK8cFQp1O4HyBBtCr8uMY4HpXC5XAyR6kk 0x2DEZxgd6qOW4dQVNUlZbKy0MI4urG/LNq/mehv8ZviNZWjPNq908aLgxHZhvRfu5OenWvprxLq 2m+JPhfa6lLcLBb3MCStKQX25IyNq85zxXwVqElldj7G0hVlO8YBxkdCa9M8NeNxB8PJPBerN5Zi Z5LWTlgyllYR4HTnOD6V4ebZHBunPD01Fp62SWnc9PL87mvawrT5lKLtd9f0OxvtP8OPbaT5mqAI tyxgIhf94xkGRjjbzxzXV/YNB/5+z/37P+NeCnX7W4h0y3kDIbOdnkLejOG7eldt/wAJboX/AD1P 5P8A4VccBVstX+Hf0POqYim3fkXTv29T/9T+XDxPLoBtbjTrDxFHLcyE+Za+QwVnA44CAHHsa+at V0lS5N3fQNL28tXUdO4z1r7U8QeF9dvHXbpjwPA77v3qY5PH8OcYr538TeFNUNxKklg0bbt4dGUg 56c1+N8IVMNTpqEKmu7+H9Ej9ZzvLcVzXlTf3P8AzZ84SS3unajHPBMUkhcSwyISGVx0IOeCO1Q3 ltqGrXUupXsheaeUySyyFmZnbqS3ck16pe6ZJZEiS1cNjbltpAP/AOusS4kvNqQrbv8AuFYkocgJ nJr9RwlOk3z3V7bnyVbDVFHladjzWS1vLRDIGPGMckfiK6bUdf8AEt/p1jYX19NLHaRmC1QTHKIx yQcdfbNa/wBvBtjHLEzDphq5y281b3faxMDztVRng9q6KmCpVJxnKzcdtNvQwXtIJxi2k9zNuDqs KnzJZDuOdpcn+fWtHTvEHiqLRJtHjmItJ50lKjG9XjBA2tjIBzyB1r0ezudRhtP7Ou7KXO1gR5WT z8wz6cc/SsuWaOzkdZrdoi6nCtFjoe3HaumvltKpbns0rPbqtvuCMpQfuSa6HAyHWkzIZJeVHO4E 0/QfEut2EV/YW0UMqXMRhdpowWjbOd8Z42t2z6V1jS2U7GS5BAOSfk4/lWfaQaVbX0bxIMFv3m5S Rj6Yqa2AhNJPVf5aoVNzg+aLf/D6GbBN4kK71knA7cZ/rV3wj4s1PSL67ggtPtgmt3TncvlTMMLL xkkj0rbsP7PaVjcT+WM/JkkDHT2rtfB/hrw6109/BIZC6suFkOHfPBGPSuPGYRODjLVetvyKoVJR mpRf6mh4U8XfFuxkF1aMwjjUMTJbSMvy/SNulfTH7K/x++LHw68XarYeAtI0nUGupnv9Qvr7T/tw ju3GF/etC7xDGfkwK7H4YaVpSa9DKsZnjMMKGGSVgiO5Xew2kHOAeDx+Vfp14G/ZZ8F+B9E8UeO/ h1rOvaXqmoT3+pXCRyW8sMn2NGeNAs0DEdlyG5zzmvx3jrOMNCjUpYiknzaLprdb21PqMpVSM41I T2vf7vMT4W/tC/FvxFd6prOs6H8PLKSX7JeapqlzCum/a57VWEG15oERjChbIJXGRzzX2p4c+KPw s8ffBe98TW2jmHXNIuby98XmaeBIZLCIBbY2k9pcuqYcOxkfy0245bpX5KfFX9sD4kaZ/wAEz/Dk uqa9PJ4m+IGv6nHcyQqkJW1sZomkddijG47I8DAxnjmv2/8A2YtV0n4xfs2WHjcTG9Xxn4dXStro rrGXtyk6uFC/OJD827gleuDmv408csFRyfK555i8KklVjSVpStaE43aWi6Stdacp+z+HFTFY3GPB Yes7qLk3ZXu4trWze7Sfqfzd/tdePPht8QfiPqfjnSjc6dLqkhubuyCQ3ka3LffKyxSuxVj83J4r 897PxHpA1yWHWJ2SCfjzBCSq7FODsHJz6e9fa/xn8EanpurX1hqkWnRyw30lvOEtlUloyeWOc9Bz 6V8QeI/CrWurMy+QVPQBOuR2+nSv7t4Nwl8DThSqtxsuV3TsraNaa/O5+DY/EyVdylHW+q/zt/wD L1PxxZ305uL+OWWXyxEssmWbagwoJPJx2rM0rV9LfRp2u54lmt3EixNw0iyN/AMcle/NVJ9DjIMT RKCGx0I696w10dLd28xQwzuyCRgelfof1SWkYaW/r/gHkfW5Xbkrm9c67pTwFLNsOWX73oDk1vah caPELe8ubhCt1H5qeWwbCglTuA+6QR06968/utNYRMIkKE9Pm61f07wzHeGKKAbGbggn8+1auhPm Vi4Yl25WjpYZbS61dbS1YSB4dkbHuS3THrVtv7PhRws8bMgJZcjPA6cVwR8LajNrTaeuSYiwYoQv zL6Hit7/AIQHV2RikbF1UPt47jI6HvSjSqa9v1CFV2+E62308Xum201vsIMShvm5B9CO30rd0jQT ca9b6YylppoZCiLyTjH5V5/ofw58b6jb7UtrxEdt4QRsR8vfjNdvD8LPiJF4i07RNPiv47m9YiCc xyn7vOBhcjPtXn4upKMHeVtztoO8oycOx9tfB79mfVPFtwDNayLGIzI0hwwAAPJAJNfUPhL9kGH/ AIVZpXiy1jinE0cdw8tuodRkJIoLDIzhhzVX9n39if8Aa6u7JvE+heIdVgDRlns4L8wtImPmj8ub ZjI7Zr6e/Yt8W/EvwzcWetT6bbeJfB9lssYvCjzki2icSeXPMgnLJK5BUREMmwBhjpX88cV8VYly qvC4mMuVq6u1bf117d/z+6y3DUrqNWDV9tE+vqvTyPzl+Ln7PGlaHpk/xC1D7U0F5d3Uaw2RiYqY yJJMsQQB84xxXxHeW3gZ7r+z9P0a/vJHKxxrcXwXcxPTEUaY/P8AGv2p/bjm0n4e+Jj4Ln0/UEEF rHJewLIWjE06KZcAQsqyDhGwcfLnGa/Cvxx4i068nni06KSONyQrHn5SemSFz+VfYeG+Z4jH5fCp WnKV1dO9lbpszzuKeTD4upCEFGz2aTf4pn0v+1B8LNK8A/DHwf4jS60n7VqnlXEmn6RqMOoiFMYA mMc0kkMqg7WSVVyRlehJ8M8PaP4a1jX0sJYZmj8t3JBwRtBP6HFebeJvFw17RbDQ4gUEbxlnxyDH wP05rvdKWXR4jrOnOsjupjEsqkjBxnv3HavTwmWV6GDjRnJ815217vT+rkyzCliMXKtGK5fdvp2X 9X/QpS6J4Uls7q7JnUxfKgQjlicDIz61x+lWOn208d4BMX3tLCzjCjYRtI96372NPC2jSS3h81pZ BIz45LjoMewJqpYLBPua6ljjPlK6xMchQ3U9OPevs8rqJxstU+r8jyMZH31pZo7mb4jeL5bwRXdx DcReXuY3drDMzFW4G5lJ/CpW8ftZxqsmj6HcB2VHdrYxMSehJjZRx9K5O1hivNVFrZskrm2ZvlPH BH64zSX1obaSBZxjdOqqM5JJz0pT4ey+S5PYRXpp+VjqWeY34nWb9dfzud3c/EPQhK9xd6Egjdcy rZXcikEDGVD7sc9ua5Bb/QVszFavrNtGyYbeYp9o3E/Kxw2KxLy1mitpAwwcEfMPTjrVaSOYJtAH IOR26VFLhjAxVo0/xb29TlxObYiTvJ3+SX5WO+0Dxh4U02EJIt/cKAQ0phHz5JOTzkEfU1qWXiPw PFGv9kXjRYOWinDjc2ck5weO3WvI7HzYbWNVOPlyR7YqSwIihMbIjBnbO5Qccn1rz8VwDg5tzUpK /Z6fc0zfD5/XSUWk7eWv33PbNG1+1vdVe0uLi3ZD86zB1CFeu0cgk9ucZr3yLwbpOufBvUvHVm1r b3lnc+XboDvkugAFbeudwGMYOD+lfCdva2TvMJYkOZWIPIx7DFJbWqxSTPE0qEOQnluQRwDivncy 8L41ZU50MQ4crTel7pbrdbntZTxr7BVI1aCnzJrfVX2a0eqOxsba2ha4uZhFEC/2mSOdTtI4BYAe hOOPWv0W/Yl1TVtKsfE03g7TNM1jzdMF6uj6hJFJE39j/wCkyyXEcro5i2t8qoSWIPB7fl493qn2 ZpXuncLHkLKA+cckc/St/S/F/ifwxIdU0W78i4ELW5ktt1u5ikBR0LRMuVYMQQc1wcW+F9bM8HPC uqvetunbRprquqXXTodfBvGFLK8dDFyg/dT2snqmr63Wz2sfXPxt/acf4+eKtN8XT6NomivpunXG mLaaLbGG1mjeRpd0kbs6v8zEjvyeK8xs47q6P+i38U9u8DOvkLtjS6OCuI8Zwu0jIFeI3Or2LW8b Xenx/IERfss7R4AAAADBvTmt6z8W6VpdqLS1tb22jdlyqSrKNwzjBwCOpzXkw8NqmBw8MPgqPLGO iWjsrt7t36/5nbieMXjMRPEYytzSlq3qm3ZLordDvNT0/wAS6tostrqU0LyvKirJF8ils7cOCRwo Oeme9eY+Gl8R+GfFsHmRsnlXMZmjRyEkCkZXK54I6EV3Fn418PzCS3u7ucecgBiuUbhlIIfK8Fh3 4Ga6GXxNaXen3FnoV5ZiZyrwF32kEtlgA69TkgEnpXPHC43DxnRnhrxl5WSvZdO3/BRrDD0MT+/h iEpQ13V3a/Q+zv2WfFOoaT+1F4TtoHuymoeI47mWZzgmLPmGOQcByrfx/wAQ6+3pnh34qalqetX8 H2i3jW+886qTLEZ98m4AxKx4DZU53AngY6ivLP2UdVtH+N/hK712XTrKKHVmnlvri4jEcSrE20uW ZQATgEKQAecHNeWeDPDPxNsvFs2vLbvbw2rCJ53hEkcyS/MQsZ2+b8uSQD07+n89Z3kGHr5hinXU YSjSprXq+er/AMDRarR2P2PJ80xNLC4eNLmkpVJ7LZcsP+D+J9dfFDwZc/E7wxZeDvh9HqOsyaef Ot4iqxx2sBX5pL2aR0QMXyRJgrjjPOK/L6C/1PStcl0OaZJXtWk8/wAtW+eQcFSfukZ4DqcnHSv1 sk1TxBN4Uki0a01KFlt0u0F9aGGO5GeI5GjztiABKqxbk5J6V8AfEmfVNEivdf1bT7SRvOjE1vbr 9ngwG6wfxKfXb0PTFdHhhmdSCq4KaUo391XXNzN6tvZ3v0S13be0+IGUfw8XK8XbV2drJaab9PPT ZIb4b8Uz6ha28Nvc3qRxzBnuDOI4xLg+WGiLKDg8cn5u/everPTtC1uzh1CKa41C7kuit00UAEce 1vnZ5N5jxvO0Hcc9uK+F7zw5retNPrOgiQLOIgIJJvOncSEgqwB5VTyGbJFfXX7NPw1+H2ta1o1v 4i8SfYheahFY3FlBDLNOZC4wwUbUJ7jJ54r6Xi/A4fDYaWLVVrlvdRjzPa7Ttd/dZaHBwVmuIliI 0fZp36ydlvbS9l+p7roehW1qyW5im4c71A5BHLDjjrXr2iaNo7vuvLFZdoCFnhGcjliTweDgV+gf wr/4J3XPi3VdVaPxPqCaekkNxZs9vB9rjLSTRtHKgZgnMW4Dqa95sv8AgmSbZML4u1gHG0E28JB7 +nXJ/wA8V/F/EXjpkEKkqc8Y7q17Rn1Sf8v3n9k5NhPZQTlTWnnH07nyHqn7QOi/sy/DBPEdjoD3 lxqvhvRbYTwysiW39kXNyYDIMPlcSN78e3H8y/xT+IWv/FP9oKXxhrd5JeXN3rUU73cw/wBZlxhg SB8oA+XIztxX9kXxE/4JrR/ELwGnh/XPFOtLZ6PE0EqQW0Qe6W1mkmCN0PIkK4z0r+YX9rz9k7x1 +yz8Rp4vEug31vp2p3Xm6FcSDy08qQblVnUFTIgwCoIxiv1j6KHHHClfHYyGFqqWMq3V3dOUVZJR 57bRSbUeiu9T+dfpE5TmNWFGrSX+zU2m0tbSe7fLfR9319T4r+JUs9zqUkdwsTRCQ7CDznJGOtee a7qafZ4rGwSLCDbMfLCvuBwAzfxHvmn+IW1GG6E86SyRpJu3MSQCD0JrnL6aeZpL/keY5kjOAOW6 kYr/AEWwOCSjTu72P4tzLFOc6jS3L0Nrq8aLqADeWG4lxlRjr+VR3aXtwqCNTIzZy6juT/h2q5Za ncCzS3IeFI+eCRuJ5zjvmmPfS5Owle/5Cu2Dlz+h59TlcUrnq/wg+I/iv4XeIkv7O5Y20yeTd6e7 FobhM5VZEBwQDyM96/a7x940vvFeseHdT0ySXbH4M0S2lnhYiLfFb/dDAKpIHbt3r8AbR3iuFRzh G4bPTketfbfww/aaXQNOj03xzbvq9tbJFb2yeYYysUQ2iPK4IGMc/wCNfj3in4fvGYqhmmFpp1IJ p6atStb1tb7j9Y8NeO1g6VTL8VUapyaavtFq9/NXv95+nqftC+IvBmljSfDtxEu8BLhgiuZBjkMA ACD355r6R8CftKeK9O+B2r+CIrvEd7Gk0qhRgyglhlQMYFfijcftJ+DptdWS10+5W2MoDLK4Ijyc g4xlk/hI4PfPatKD9qTUv9Lt0hjSDc5CoBhlJwo2c4IHvX5jU8PsXOK5cKk9G27dGfo9bj/L43Tr 3Xlc+zz+1v8AEPTZJ/DOvajENLVDI8QUZKMCTtwdu4N0AGcmvmmb4nL4n8eG+nN01lBbXE0bLKzT /d/u8glugAHHvXxR42+Nc+vX0RS2EYt5ZGSXjcRJtypAA4G3j3J9at+EfjnP4Q1htW02CJjLaS2o juF8xVEww5I6HjgV+gx8M+XC1KlPDJVJRastFfvddWtb6nxEvEqDxkF7Z+zUk72bf3eX9eX0rL4k XxBrE730dzEv2cok0QMyMN3z5yUO5MjcK+v/AAFB4ai+FHxC1e7nN1s0rT4In2eT5avLaoJ2ByxA XJ8sc84zX42+LPiZreoQR2tiy2qJLJKpgJDnzTlgcYGPYCtmP9pPx2vhi88NPOVS9EUd48O1DcRw 7SkcnynhSoIxjJHNeZnPhDjsXQpLDzULSjdX6RnGT181Hvu+x7uU+MeEw1SbxEHJ8srO27kmtvL8 V+Pr3xu8Z+Cba2k0fwzbi/kuII4JNQnhKhGi5ZoVbkFicEkngcYzXx1Pdy3combcq5VeuchevPvi rusePtV19o11BjKUGAjDCqcBcgDAyQoycc4rnxq0DN8yADB+Xtwc4zX7Fw5w1PAYdUmrvq73v+X5 I/G+JuKFmOKlWei6JK1vz633bOw8Klb/AF218PatsW0vbqLz5LjcscbyEIruyBnCJkHgH6HpVvW/ DOqvfaxeaaDd6fpd20M8tk/2m2TfJtQiXA3IxxhgBnjOM1g6P4tstC1ZdYigtrhhBLE1tfJ5sTCV Ch+XjJXO5fRgD2qvaeNPsF19os4hEu1v3EZaOIkrt3FQfvfxHtnnFdtTAYpVnUpxtotHs3fX0dtL /wCR59PHYb2Kp1JX1eq3209VfW3+dzLlt7y7doXR02N5aMwwBx0/CoRpllbIGdmdj8xJ6fpXUah4 pufEN1NqmovJcXVw+6WW4bc7MRyxY9T68VzQjuZQxf5QMkA+v1r1MO6nKlUXL5bnkV+Tm9x38zUZ rSSEGFQq8AZ55H+fasKSMROX79l6nPX9Kv20zQxeQ20oTu3DkjHofT1FNn+U7Rt+Yg5H8q3p0+V2 uc89VcypyseFHGT37fShSgQbMc/fz16c0TJ54+QHavQH19akFu0iAMpwvLE8CupbaGCRVMZlAXoF OD2NQMhMz23BwRgir8xjijCDHIBxig+X5YnbG8scAD8hWkNEQ10KRiW2ILkEd2PbNWl8mZGuVGF3 BVBPU/jnp1NQMEuCWHT735etMcCGMr2HIqpQTIT7nV6n4rvL7wzZ+EzDZRQWM9xcRzRW6C6ke42b hJMPndRsGwE4XnHU1gx242RnPBzuweeDWanzHcTgfxf0q7GwTMoI+U/z9qxp4anTVqatdt/Ntt/e zWdec3ebvpb5LRfgdFanyD5gcKOhGTkenT0r1FfiXdX/AMO4fh1qtpBc2lrcS3Vpdyl/tFtJNtMm xs4KsEUYYEDqMZrw+3bdPuc5HbNdFCVuAIJFbDPg+X1KnqM9q4MfllGvyurG/K7ryeuqt6v1u76H fgMzrUOaNKVuZWfmn0/BfPUyJZ5ba9LwHaHGH9DnqDXW20ut280mt3Xnt5ibZZY28vdHMu2LHbBK 8cc4rIm0qNjNFEVVkiDyCY4bcGAwnqeRx/hTtM1S+jvrGXUR9ristsUdvNnaIlydgxyByeevOaqt D2keaCTstb/p/XmVQnyS95ta6f8AB/ry0uatzDrEmm2n9sykW0YdrYykfe3fOAvXOeWNYN3eKVCY BC4A9VHPA611eu63qGrotu1vGgaGOMlm8yRvLzhi55yw4I6cdK5K3scuwmUrsUg55GR0IqME2oKV SNn2Rri2ubkpyuu7uZaoJSQq5UHk44HpmtE6Z51sJI94kD7Sh6MMZyvc4H510Xh+6ZLGbQbexScX hjWeU7/MCxuJPk2kAfd5yDxXSal4g1b7IvmQhI0R7WJFQZKKCoQsRuGAc5BBNXiMwqqoqcIrfutv T7+3cxo4Sm488pdO39f1+Pl3kFSr5BBXd8vOB+mKtjTmRBPIjqu/Dh/lGOoGfUj3rS0eGKNRqcDb p45QI7Ro94Yd2bPGB2GDz9K3db8U3epaYumXTuzIMnexYbs/MzLwAew4OOxrsqYyq5RhCN11d7W+ VvxOSNCCg5SlZ9DT8P39noU6SxNFvihkkj8+PMZlYYQjgk8dzgZ/OtrwppOly6jaDU76OyLnzBKu dqkHIBbryOMjkV5fJdC6t14lby0VFVm3gKOgA4OM9B2pseug4gnUtGv909PU/jjFeTicsqVFN05N OWj2v1tv6no4fMIxcFKKaWvXy/yP6Gf2WPG3wM+IXwQb9nr4j6gk+h3kkug639nT7TNpM0jSPZat p5b5pEs2+Wc/LugkYZJAr84/GmrePv2FfjLrXwr8V22m31/pz/YrtrC5W5tLq1kUPDJHNGSVZkIc A4ZScMByK8D+FXj658LXeoaN4S11dHs7/TVu72WS3855LlFBFpFsGWALYG7jjJBIGcP40fFf4hfE a30LQviPHY/adMsDa6bdi0+y3q2jOQkVxKdpljVgTGXB2ZIBA+UVj+HqOPwVOhi4upGSSnzaN8qS i9Nb20e2yd202duQcUYvK8TUrYOp7NwlzU3HXl5m3Ja9Lu63W6skz6i+Hv7Weka1q9//AMJOH02y hj3Wuxt+eDvVySMs38IUdfzr7Q8O69B4q0Sz8SaXJNF5qh4d8gZ1C87XKkj3Iz3r8VvB2g20WoyW evWIu2ji+0W8lsTKZBGRvSMRB1dhnJLDAXOe1fY9l+2E3gzTrbQ7rwutuYoVWEeaF81QAo3qiKqt gZbjOe3Nfzt4heFy9uo5Nh25dVzRta3S7u7vc/rHwo8bGsPJ8Q4pcutnyybve9nyqysvhWmn3H1v 8Wp/h5e+C7xPie0USmIRLKYvNmB6KYlUbmxnkdB1OK/GvWfiHqkGnv4YsTGlnbvOBKiBJ50k4Cyu OWXGDtPHGK+sfjN8aofjisOheD9D1BLu4ljRwhaZXgt0aSRUOABkndIQOgGTgV8KawmL1gsZBGc5 6bvrX2vhDwhLCYWUcdF87alyNpqO6uktr6r5H5/47cewzDGQnlslyJOPPFNOet2m2le2jtbS+t7n MyyGSVpdoznJI4689Kr7ic7T2JFWZkYP85PJzx0zTAh3gA5/Dmv3hNdD+b5LUcoZEyxPAB6Gnhyk YXqvUg+/tTo3MjNHzgtx17VY3QiHOf4yPYZHehPyEyrHEsgYj+HuOpz061oW0LbnXksnJ4zgev8A jUKr5CbYxkk889u1PJ2v5qHGflYDuD16VpfQxdRWsW459ow30/P0rTtr2OLIA5cbQfcc9K59yiOz dPrwBSNKV/eYOFHSomm1YyhNpnVS6kSMqQMHj29q1DcRtcRxoQpwpBB4A6n8a4CKUvGZM8qCfbPp U8ErHD5Hqaylg4ONi4YmSep2txcWa4dskg4Kk8kdgD6VkXc0eWnyFOeEA49gKyZLolgSx442+3r1 pyyG8UgZwDxjp+dFHDKK0CeIchktxkFgMMW4HOf8moNk/ljzSRzksccYNW3gMZDIORkE9ABVQCZm EJzyPmI+tdb20MWaTwXKbVn3gEBgrZ6fQ+tfXn7KXxD8U6b8ZvDotpbGFLW9edxeQyurlbd1AKwI 7jj0Xr14ya+T9Es7S5ux9vn+zxgHMn+sI7fd4PWvsP8AZU8D2d78V9Iun1uy06Z7qeFLmSbymC/Z 5GLI6sGVyPlyD1ODXx3Hc6McnxqrK69nPpf7L8n/AF0PsOB4V1mmFnQdvfj1t1XmjwW08SarpEOq DSyV+0X8ss8JH7uRdzHay98EggGvPJ0k1J5bgmOIv8xUjqT6enPPPSvTPHvhW203UrpbDUYCVld3 hBIw2eRkk5POepzXhs0s0Mu6Qnrg+hHrzXt5e4Th7SOlzy82VSFT2dTZX6+fQ3oUkggjSXiKRlLL j36/5NRXImAKx/cB2s46H0P5VFaXMVwvlYYuflRCeM96s3cUsUQlgZsBUJDfdP09fxrpnvY8zl7G O1oceaAdiHcWbjPsKqysJkYjK5AMY9T6H/Jq/wCbdbMzBZVAyqtwAcdh+v1rMLiRzx2P3Rxu7Dmu iEWYuPYhtIPPuUikO0FgpZvX39K1yWRjGQAM4OfX261DbW8abppN28DK9vxP0q1Z2sNxcCOduXJO 7OMHr/npU1Km7KVihPHJCQi45P3iMYyfp3pru8sZiQ8jqw5IH64rVu1yBDndhsKeQce9VJjHaqsn I3ZBRTjI9T071V9NCeUguY7SOLyrbcSFBPJ4J74H+FFisSuqTYUnlu55przB4yYwVGR9/v7UkA3R /vBk87SR+n0qb6FtaGi01uQDGr53Ywf4vpWvpEMF7cLFcERbiByRhfxIxWE5WJfOYAlR3469aljf r02sox6g/wBayqRurIunPW7R+6n/AATB+Nfwp/Zb+FfxG8a/EabSpb51todJsrvbK1w4SQGOAbWK 7sguW+VgOM4Ir4L8RftFW3jvwj400fWdJ023bVo7RtP+wW8cSW7LdrPOECqMJI29towFLYHHFfGY e4Fs1pM7InylwScEjpx+JxVhJ44YPJjbIwO2M4PvX5Dlng7l1LOsdntaTnWxM6cr7KPsuXlUUu7W ve7Wx+zYnxlzB5Ngskw8VTpUI1Ivq5+05ruXonp56n0t8EL34XWuj3n/AAmTWEdwboGP7VGXYoFH 3flbgGu5sdb+Cz+O7+Wc6V9jWyhW3laL92787wo2n5hxngV5H8LrW8vdAFv4FjkbxUmo3E8MiAbU sfJUSCbcCu1m4QHnd0r6G+Adp4YufFGqyaLG3lx6ZYx3C3SgzLdHf9o8zI+/5mc44xXXxPllKE8X iJTndrZStbVLtonbTe+vY8/h7G1J08Lh1GFr7uN76N2vdXa6rS2mutlal1T9nu4ZTK+inY24Hycc ++F6e1RXGu/AJ7d4S+i7WUjC23OMHGMJ+vavqOPTrbHzwxH1AjX9eKpXNjZwwyuYIh+6f/lmvoe+ K/LqVai3Zupp/wBPP/tT9GeW1lren/4A/wD5I+P/AAL4i+CqeE4E1v8AsqG5UyCVJbYuwBY4ydh7 Y71n+BNZ+DKabdHVxpscjajcGMS25YmHPyMDsPy46D9K4HQYLW70W1v9HtrmTS7SCNfGn2b5VmUT llVeMlkTlyv8PFfUXwEi0u48GS3dmkRhl1e9eAIgwIy42AdxxjFff59llHD0sRVUqj5pq65krb6b O3e3azufC5JiauIq0aVoK0dHyvXRa769m+90cP8A2r8BGuTdKdMDFSnFo54HfHl4rk/H2r/Bm88I 3UOkpYvdLGv2cRWjRkOCOd2wDpX2X5NuSY9irg8Erxz16V4/8cBAnwy1bcoUrCvO0AD51r5jJ6tG WLoJe0+KP/Lzz/w/qfTZngqkcNWb5Phb+Dy/xHkc/iv4GDQtpWxObYIStm339vTd5YGc+9fEmr3k V86QQIEiiZtgQYGT34r6gYWUE48QTW9z/wAIWbqQ2kTH9yL0x7ROY8Z8lnztB4B5rw3wJBo1wbyP U7c3UssSxWkX8XnM3GPp3PpX65w1hKWBpVqkHKV7Xu07b6bKzX2l07n5ZnuLqYqdKnU5Y7rRNX21 63T6PqeapbhJdy55GOfSrYAPAHQDg+lfQum+FtATxHp2j6raIdRa7m+2wsuEMYTMexRgbMd/XNdf 8Q/CfhPStDjuzY20Q+2QKzqm3Cs2Gye/FelU4ypwrU6Psm3PZ6d2vntdeRyU+HpypVKnOly/8OfJ RBZiTj0o8sf7NeyatpXhq1jubi8tSli8cr6PIy7PNwwB3MMEnH3Qe1eb+Z4W/wCfZP8Avo/417eH zlTjzKm/6/rXs9DzauCcHZyX9f19x//V/BPxX4y8FIx8rVNP8wkgg3CA9OCQT69PavmXxJ4n8NST P5OpWJJ7+ahz+vr9K+Uv2sdKs7X4v3K2KRpEbK2KKigfwkZwBjn6V4Lo/hv+051MoxFn5mHG7GeB X43wzwlQp4Olifau0knt3P3LPuMKssVUw6pL3W1v2Z9iaxrGkTq3lXFu3cnzFxn3NcDe3tkVDJcQ 56HbIBkdx16Vk+IdBsNN+HcscEaqTErHgddw7186m0Xk4A56mv0DLYRlDmi9D5LNswnTqckorVXP oqW+tREdskRz/CGGT+VQaJOkOqJPhTlR94ZGC2D+OK820S3srUo8WAxIyxHeu5W8S01CKaA4YIHG Oxr28LJt3SPMdWLSkz2DXdUleSWKzV/MZ1bcO4WMdR9K5a31RdQITUA8gjt5ANrYIO4Hv7DFcxde JL+5aVIyFWZvnJHJ+prmZGljIkDHJ49uetezUbbucM8XFaJHX6nqGjJIwsC7Ak4LkErjjAwBntzV C0n3SI+CTvB5PasGKAKi7MjnHritm0B8z6OFGBSdJXMY42d0dt4ogN/4hup1ICNMWQBQMKwBAqxp OkwxJ5kXmKTJuEaOyrk+g7ZPNRqXuLhi3XKL+SAGt61Y29u7K3Vww9APauHF07XY/aNybZ9SfC7w /p0s0FzI1xmcfPieXO5QcdGHQivusvb6T8LNdvtV1PVbWCHw7e3T3KXsyujhCu5WLkbiSF5BB6Yr 4L+G2pi1srd8YO84xzx83fpXvPxVe48YfBLW9BsJ3RhpEt2BGxHmeQ6zNG3qGCHI9QK/FuK8vdav CM5WTkte2p79Cpy05SW9mfjr4k8Y6/r2mWOkXd1cGw0uB002waV3htlkIaby1Ynb5j/M2OM9q/rw /wCCWf7RmmeLP2MtBgmEVo/hxJ9BvIoJCqkwAFJWjxj54yGLdd241/HNeQSKqBgwymeQehwf1r9a /wBiTxVrXgX4A6m9hK6waxqF5ZXCKzDAjji2OB0wDvBxyc+1fHfSY8J4cVcNRy6D5ZRqQlH72pfg 2/VH2PhLxp/Y2ZVK1TWMoNP10cfx0+ZH+1ReXnjn4pa/4r067vLeG+v5blIY5D5eCxXO0cfMBk18 K+IINSguXE8zTRl9pRgO3oRg9q+z/iNf25VnOMiMLz1yxxXyZ4lVPOdt3AkyPXvX7JwZgY4fCUcN Be7BKK9ErHwWaV3Vqzqt+83d+rep5swi3BiHBZS/EjZ4qugtT0kkGeDuY9DW1NEihSMcKx/OsO4g KKOASwzX3ccOt7nnLENPVXLMFhBcXQW4Z3U9MMR9KtxM1gVMbyKQec4OPzrDhR45CImK8jFXBO/3 ZgSeTnvjmpnSnGOjudcK9OT2sPRpxP8AbLWYmRiZWJGBvc8ge1bsOu63GWdJIy5Xy8lTnpjPXt2r gNRvrjSNPa+tjG4EmDG+e574qlo/jO/v7pLf7LFudsZDHH171zyqyS3CMobH1d4P+JGvaZYx2zQw SmIMPM3sM8Y5ABr9Avg1+0X4ksLO00eDSoHkWPyzcJcEH5nDBuU4I6da/Gxfieuk3b2s9jvMUpRm jlxnBxnlTX1N8OPjroGgeFp/GmqaTdvb2dxFbSpBPGZCZslSoZQMDbzk18txEqs6LUY81/zPdyur h3O03ovU/rqh/wCCm+m/Bv8AZ+13x74q8LXsNvYaG8EDxXFpcZv7kFIAFdlYhncAkDOAeOK+af8A gh9+0h4Q8Sfs3+I/h54y0S2bULTxh50GopaRsJVv0WUi5kUbgY23+UX4IO1Txgfzr/tK/tweHvjh 8O9G+G3gyw1extbe+N7qYvzD++ljQRwqnlsTtXLNg98YrZ/4J5ftj+Cv2Z/iBrUXjia+i03WrCOB Wt4nlMd9bTK8DlEySCC6k9BnPavxPO+CcfW4dzGMaVsRUvyq2qS2676t/cfWYXMcAs3pOM/3atd3 6/F1W19LH6yft96l4U1P9oPxNrHieGa5itbi7S1jhabbJPIylPMEbAMAM7Q2RxX4B+N4rVrl4ZFl QAOTlWHPbqK/Xb9qD9pL4Y6P421i98YXUtvcazqL31nKlvLLDNC0aMhEoXBIDDIH6V+ZvjD4o+Bv FjStoV99qOGPlpFICAemcrx+Ne54UUK+DynC0ZUX7sIq+vRL9T0fE+OCxeaV69Gqle2mm9kn16vU +X0jeKUPbnMiP8h2g5zx0+ld/Yaj9skh02QlNm5SwUHLZ4yAQBjnk9Kwl0C51OXzNO3STFmYxp8p U8t1PoOTivRPDnhlW0yHWNR2kqS+GGMkZGG9ee9fomZYmlyc0nr+Otz84ymlUcrRWn4HE+NtVg1u 6WysmIt7bl3cY3PwMDjmuZ03QNT8W/a9Rh2BbSMeYzMEOzJAIHevV/E89jHcKIYSzToHlwOAc9Og H/1q8v0y+v7Wa/hLsizxiNkAwNobOOOK9Xhv2bpxSjpFfP8Aq5GZwk6rcndv/LQz9N03xBpmrRXe mySQyxMJIpUPKn+E+nNS6vZa/p8aX7GQ75SUlySA+eT9fpV1JblOFdsYx+Aq1LezvbR2ZIKxEuAR 3bqa936vSbcuvc4vZS5eX+rmHrms69qLSX980a70VWigQKh2ADO31OMk9SeauXHirUZ9KtII7VIX hhZLicMzG4LMSHYHhSq4XA9MnmrclwzY8xUJHGRmrEV2kTB3iQ8bcdRg/hWUcHSSiou3Lt91vn8/ XcqUq0nJt/Fv+Zm2niixttDithaO10Jm3ysQY2h2jaAMZ3A5yScYxU2m67o0WkTPdGQ3KThY4Qpw 0bbizb+g2nAx3z7Ulutr5+xocKxzhCBj9afHotsJBbpE2Wck/wAXB6dKcMM2rRn1v/wPT+kQqs7p tdLfhv6/07lvRtU0i6sr28uLiGB7crMsDsQ8qyEKBGP4mXqR6c0/SZYdQt7+9R0C2w8472AJjbao IGcnnAwOaxY/D2mB5AXwfMG4MMYB/lUr+E7RNLutYinQiFuIm6kZA4OR6054WrFSafX7lp6ef3+Q Uqy0vHbz331/L7jSlns5dG80SLu8rAj/AIs9P0NM1BUhtTKzow+U4RskjPpWQPDkUkv2WKSMHGdz MVB7nHX8K05Ph1qju8VhNG7rt6OQuW6YJFaqlUS2DmlL4Ylu7s7mFIxOu0O0e3/ayfSrWoWNzZzR xTqyEyoQrDHXpiotS8EeMrKNHcmVoQka4kDbF/hxzVTU4PHVvJHc3SvLJHsRSyhtu3hTx6Yrkbrf aibOMFe6f9bmnc6fImrRWSnMmcc8HPoc0ognutU8oDJWFvmYcfKR261ljxb4ns9fg1e5ghkuoyCh ZCFG0AHIB9OtdNB8Ubi28UnxKdJsxM27dDGD5W1jkkId3OehrzK9bERjdUr6d+vY7qCwzfvVLK/Z 7d/+AUtOsr6SS6ntVISBEkkKtsABGAeo6n9a1LXx7410zT/tdlqWox+XKUWVZ3wmPugZNTeGfid4 e02XVBqej+eupJscbtohXBwI8Y781wl5rPh640pNNgkkidZpJpJpFbYwbAVQqk4Ixya86q415yp4 jD6K1m0nfTXvs9Du9sqVOM8PiNWns2mnfTt01/yPoXwT8afi5eRNqE/ijXTLKipKPtkoVlBOBgN0 GOnavYNP8d67riCDV9Y1VmY5IluXZTn0zmvh3wj4tstLtfJuCA27aCOh5444r0i3+I+noOdp44Jx 9PWvzLP+DKEq0nSoKPa0Uv0PuMj4tqKjD22Ib01u2/1PriLT3u3SO8vb2RV+dFEuACDlSMDjFPgt dRsvElo+i6rqlo7xM0jxXLoSyuNvzDBBXHHPB6V816L8Xf7JlE8RymMmJiPbtmuwf426PdXaX0qG EpFtxvByxbPBzz9K+KxPCuOpt2hzRa8vyPq6fEmBkk+fld13/M+3dK+Ivxh8O3MlzpXjPxdBJclZ Lp4dYug0rJ0L/P8AMRk4znrVvxJ8fP2irqyVpfiD40iMMAhjeDWLlCApJGQrrlueWPJ9elfICfHT SQ2HO4Y4wyqeex+aor3436Lc2rwkA5yCMoefX73FfLUeBJOqqk8HFtf3Y/5H0NTi7D+zcY4h/ez2 6/8Aiz8Y7HQZtSs/G/jAOyPcvJ/atzuaTZkljvyckc5OK4X4gfHf47/ETTbK38X+OPFmrxQRCW3i 1PUpbqKFmHzMiTb1X8K8f1D4r+H5tGk0xEkZ5IGiY7k25Ixx81ed3fjnSvssMPmsGjQJg7TwB9a/ Ssj4Mw6nGrUwkeZPRuEbr52PhM04pk04wxDs1/M/8zQ1vWvEliZLz7d50hjZC1zbW0wOev3ouc4r yXxQ7JqcayLA6iM/8s1TAHHCqAord1jxdZ3FkYQVO8YOSM4/A15l4wvZNSvVu7VcxiLBOflyCea/ WMJlUErxppO3RL9D8vzTHuV2pt/N/Mku9TldcZ4X5MEc4A/kBWQt1JI3lIm52bGWOcfSqjXrQqFh cSqyYcY4H588etWbfUFjRiE+Y5546+1d+Hw3Itj5+pX5n8RtG6it4dkyh3zne3J/Ks9rzcRk8HsP XtWVdXTuPPlyA3CgeuetOiuIZBgqNxbqe3fIFbOlpsZOp0R2OmXEK6gsmohmUAHyh8u7H+12rZup fL3yWSNFCy8bm3nkdNw7154LospUAkkkc1tRCeOyWHkFzuI9vauGthop8z0OmFVtcqMzU5izCRzy fX1FZ0UxLFGPfIJqe7SSQFXHCH5Se/oaycmNiV5x3rthtscE3ZmrLcsWCvnArIlUljjPfirDyB+m AQeD+FVjlnKnrWsFYybvuQ4blWJ6duDVKeNyvlr0Pf8AlV8rnrzz1rVi0Ix2jag5Iyc4PPy4645q 5VowtzPcI02zlpQAyjBwOcn19qg80rIGwDt6f41bdd5Bbjqce1VVTLc+pGOK3T0IW5vaDua9XjJw cZGfr9OK7KKFSzDg45Pr1/HFc34duEF6kS4yAd7jr06V0n2jZIyswCFcsD1PpivBx826nKj1cLFc l2Zc5aWMhuOc9e3oKyZ9sbhHXp8wPf0/nW3cMsiebwqnoAOhH+Nc1cl5GLSncx4Y966sPvZmFXTY 0CC8TLFxkcdBgU9IClqVkJPPzemaWy2vEBKQWxgfyp0paOz+XnD4OexFaN62JtpcoXUQdQxPOdoA 9qWOVYlMbAEjJwemav2ME80DM/GQdhPY5zu+tUogrDfMv8WRnucVop9DNp7lSzCtE0y4wVIx9TUP l/LvTJOcEMOhq8ci3CEAbn3L64GajTDyMN3fPTGfXFac1mZWvYpRwSRxiWU5JOQfbipkJRTx1wBT 7mQqrB88jOcdPpUGRt3LnHBxjnPpVKLeomieIglmVcAEbfqK27O7ngBkjYr8pVyhIyDz/n+Vc3ay EsY5ztGcnPHXpWrliHC9gOD39jSlTd9R3M7VfEGotdtAZH8uPO0Nx97BPGO/FUW128l+XoowPrVT VrfyiJ0+6coxY5OR7cVkruwcdOxHv+lejTowtsZucm9WdQdavWlV3fIC4H09K0ItZvCSCxzx17Zr lYsqQcjOM464NXN+QTk7j8uRUVKMb2sZ+1d9zq4PEN1bPiFguDyyjBNaU/i+e4CtcqrsMdsZH4d/ WuHUAKduex/+t2oI2A49M49a5pYSlJ80o6mixVRaJnYxeJpBmeJEQ54Cjpz1B4Oaw5rlpJPNJb5i c59zVWBAwzIwH06f0pZgijIYnoOnBqoUIrYUqknuyy0oeYrGx68HpxVeSVJMrFuAYkEE8+/Sklto womhlXd3UdQfSrMdzbhRHEqh/wCNmAyPYGrva1hx3uyG3uksPnKCQ7SPmGRnHXGcVo3muarqt099 qrG5uZjuluZmLyMWPJJPXNZMtziMfJtwSCw6moonEil1bHGRnr/hWjT7kSb3PrO3/aT0Dwzogs/B /hvTk1Ge3tpLjU5IY7S5sb633K0uny6eLeSOKRNhaOUyZZSTnNed+M/j14x8ea6viDV5I7S989Lx rq0Ta7XKIsYmLHc28hQSc9ea+e57srPjcG7/ACjr/wDXqtJ58xJjVip5J5wPyryavDWCnVjXqUU5 JNJveztdeh7mH4mx9GhPD0q7UJNNpPS62fqj6V0/4w3OjSyXGmI809zpUthJc3TFWSS4BSWaLYx5 aM7T03Acg15Rf3CamqR+ZHH5KbV4C5HbgAc+pJya4RHJIRSQQOnX6Yp24FjjII/z6U8HkOGw83Ol Gzf9L8ysbxFi8TBQrTulsvXf5uy112N6bSftMPmRGR5g+CiLhduB8+e3PGMUllpF8k+ZI9uRkMen HbFUYLyRIyYWb5sZweOO9Kl3cKu6QsQxLLzg5rucZcvLc8xV9b2J/sdwsrZABJLD0H1qCWGO3zKx +9wV7GrAuJJ18zPGOf8A9VIrr5LJkFO2eo/lWidtzKU22VsM7dgMcZqTbKy7mIGDwM8HPftVZAm/ ft3svr0OfWlkyMnII3cFT+lBgx85G0rnbhgMn36UxMCT72cj72cdPwpYDJPEWkCkKQTnpxUzIHjx jjsxPbuap7WHfoNgdY0wDnGST60pZYwVXAHUt6kfy/KoFJCFcEnnhR0H86mA2wE5XL/Llh79v5VT Wth8qLfyzxh1OPc9fwqxHJtyinaB3FUf3oK8begCn1//AFVM6/Z0y55zjCnOc+tTLTQTitxbiaRI yxI6/KTUiynGBjJ5J7n0xVSaDzCs3UrwQfTr+lCshBljHI5I6E+hxzV9EFtLkKzyec0fAc44wOnX /wDVXoPw10S58SeI2sYri4t5otOvrwNArO4+y20kpACAtghSCcYAySQOnEPNHDEZGTc2d2/IHT3O aq6d4g1nT7kajp93La3AjePzrdyjhJVKOuVwcMrFSO4ODUYyjOrQnCk7NppPzNsFVjCtCc1dJq68 j6G+D2k22reIUski82aVWhZ1CXJ2twziOTaFH+1kkZHFdR8SfAnw80yZNJ0rUbm5nibZNI9uqqJM /MNygk47DoPU1478I/ife/DPXjrMMUM8c0bRSRzMV9CGBA4INdN4q+Lh1a+XW9Nvp/tkjtJIsiDY hYYwueowPSvkMwwuOWPi6V1C266vz0dkfX4HHYP+z3CaTnfZrZd1qldnCazp0nhe7mtLadSrYDbC CrKDuAPftnBHWsC9vIpV+0sWBJxsU9T7j6VTaVJW81iS/U5Pduuc9aznG09FO1s8cY9x619VRw7U VzO779z5GrU5p+6rLsX/ALei7Nw5GAVBxx+lTxSCaPemDx0HP61Ws4RMdxPy4zj2+tW3k8hdtrwf buf0q9OhntuIfMCsA2045GetFnbzzuRAAcHcS7Yx2qq7sso39xkknp9auQTrE2WyQQcjPHPeoUd7 GSkr6mkVhZmaR1ynyYwTx7Vh30Mt5MZFZdsf7sgjls81eu9RS0TyrUiRnjJGei5HXp1rHc3IQXU2 XVSH9OfpRTi9ZHZYsrH8whZeQMjI7e5reOh6jDZretA4gYK5kxwN/wB388cVhJrNrNMzzNsBAZs8 /Suj1DxdoUyrDCk2AF3KD+7yB0VeuD1571yV44hSioR9f60LpKk03N27GV9inmiZkX92GCnbyMHO MnsaYweBthCgAhTuGSewrTk8WaW8DWkKLHHIykgjoV/iBHT8qp3mo2E4DLKuN3r82e34VpQjW5ve jYJci+GVxyAZKMwd9ucAdu1aT29ytut3KAEc7Iz/ALvX8s1nW95p8LCVnLsF2kKM4zzWgNSS5shA jEqrZwQOOe1a+zmpxaWnUUZR5Xfc+/8A9kKwtF8C6lqUccYuZdSMDzbcuY40VlUn0BJP1rP8W6H4 ai8ZeJ9Yn0+GeSO606MK0ksS5ngLO2ImXJJGTmuj/ZKCJ8NbljnLarNnnGAETmszxujSa94plEgj 3arpSqd20Ei1zgn8a/GKtaX9s458zXz/AL0T9qwdGDyfBJxT1b/8lmzjvFEfh7Q/C+ma5aaHaE3z XCy+ZdXaqpifAAxNk5A5qvcW/hw/EKLwamiWYtpDGrTC4u/MAkiDk8zYyCeOK+t/Bv7N/wAYfjJ8 F7nxn8O7XT76z8K6Zcalr73Oo2lrLFbFmJkiinljeYgKciIMwx0r5+161KfEaDayA71kP7352CQ7 cFcc5IJGCeK1y7OYVXUpqbbjzJ+89HfTr0Lx+TTpxhVcElLkt7q7a/8ABO7+CWm6fZ/CzTYUijC3 UEklwMcSFy27d65HrXyusvhbwtpunxzaRBP9tnvC0rT3CkeXcvGoCxSIoAUDtX1h8KGMfwx0cZwB YjHuSTXyVq0Gu3HhjRG0mZY0LXpk3SpH1u35+Y9K1yWV8Ti3KbSc+9v5zhzWnFYTCtRu1Dsn/J0f qzuYoPCNx8VF8AtosIhafZ532m7348rzOT5uP0rzs33h/wAT6br2n/2PFamxsmuIZknuZDlZkQZE kjKeCe1es2Wm6wPjeb5plWETHEYlBJ2wYPy/UVxk9rfwWPiF7ooq/wBmqghWQNhmuUw2F6fjXtYb FJyjaTbtD7T3vr1PJxdBxjK8ElzTXwra2mp9I69Y6evgafSvLjNtHpjRrCQNm1I+BjGOMD8a+OPg lpVqdea8kQGSPTYpFJGdrOzAke/FfYviwunhS/YnkafKNp6jEZ9K+WPgrDKL6cxdtMs9xPbJc9a8 DJqklluLtLdr+vmepnVOLx+D93ZM6/xzpmnXHiOwvNQgE3kaffXP32Qt5MW9VLLhgM9q810afSPG 2h3Mt5pSWv2eey8opPLKHaWUKQQ7EYx7V6x4zSU65GwYKyaJqZDEgcmMDJPbk+teYfD6K/Gj3P2q aObN/pyqFcNj97nsT1r28rklgoyb1Vrav+Z38jxszj/tcoJaPmvov5Fbz3PRfi7p9sPAd8skK7bd FeHjhGVgBt9OOK+E/tJ9P0r77+MatH8PdTdeSUUY57yLX584l/un/P4V7HBfNLCSd/tP8kcXFkYr ExTX2V+bP//W/kD/AGmtFhvfjFNc3MgWM2NueeCx+bj8Pwry7SLayjvUgWSPaMgAYxwOleuftMXF u/xFWaX5mNhEFB5zhmr56tLGS5uN8aZwfu49fWvzbIsNKrl9CLl9lL8D9LzvExp5jiGlf3n+Z6t4 2uLKfwbNBauGLQKoUHHIYV4HaaO8uFYYwec9K918MWNhbaxbw6lCkkTsiNGwBXLcc9utYOt6aNP1 O6s0AKwzFVA4wM8foa+yyfBKlBUpep4ea4l15qra3QwdN0FRaPfsQfLYoMeoFVlUSXQVs8rwR7V0 NnMEtJbZurSBh9MYqh5YS+izzlCa+jhBR0SPKlYZJEwZG9eKrXCZTA7GtGdkQJk8jcST0rnbzXLG 3JVm3kHlUGcf0qpzUdWzFq7N23ChAMj7+cdx/wDWrRtjysmeDKWJPTAHevLLvxbcOFisk8v/AGnO Tz7Vz0+oXtx8txNI45wM8c+3A/SuaeNh0KVN3ue9nxTotizNPcx5LklUO4gAcdM1Ul+JmkW0JigS d+R0AXj8T/SvAAnl8R5wR047047SNpwPXFctWtz6GlrdT6e079oy40iNYbPTi23vJLgHr2A+tdLc /tgeKX0W+0a20y2T7bZvZmUuxKLIpUsBnGcH6V8gbMKZFz6DFSBCF4GeMDnqa8mvgKNR3nC5q61S 1rnceIPiFe+ILS3sJLeCOK2iSNCi4dvLRUyzdTnb0969i8I/tQeIfBngu08D6dplpJb2plfzXdg7 vKxZmOCB0IHSvmIhSdy5PPI/z6UuM42Z5Pp0/CtZ4elKChKOidyYzlG8k9z6P1H9pG/1Yl7zTQPm B+SU/lzWDc/FLSNS4mjmgJbJyNw/E+9eGeWrZLHjB69PwFBgUnOeO341tTjGDXIrC5pM92XxJo98 pEE8ZOMBScH34NT3EyuqhSDwBke/evnySFwCeOvGeKtWt/qdm+bOVuvRuVPtg/8A1q9GnitdUS0z 223KtcH8xir2E3K/qrZx715dp/jExsRqKEcffj6flXc2Oq2V9Ev2R1foMY5Hrx1rup1oyXuiSfUs S28N3DJpswG2STBbp6EfkayNL8LzaLrkZdt0avnJH3R7n0963WddwZe8oA45610umXW6aZbgBibW VAT14/Osq1GMiqUnGVzwzV4mXVrkkYBuGbBHUE/4V65YxA/BbWFAwBqFkefX5+ldF4g+HVnrWgxe ItELC8AUzwMw2SDb1U9m/Subt5Xt/hfrGkXAaOZdQtGMUgw3G/1+tfOY5WSXmvzPTwb5ee/WLPMP DVsv9pKzc4avb/AXw7sptbi1bWFV2aUvBAemOSC3r9PzrzHwVoup67rkOk6PG091M+2KJMbmOM4F fVegafNpHiaPQ79cS2cjRTIOcMo5H5ivA4ixrhTcISs2vnY9bI8IqjjKUdL/ACO1/bh0Yjw/4BtF A3DSpWlZfugts4J9a+UPDPlaLpMn2DiRkILY5PB6/Svr79si/a70XwhvGGW0lAI6bflwBmvj2wuV TSn2fewB+pryeFIy/s2kn3f/AKUx8Sy5cyrW8vyRat57iR4VslbcwJJQnOR1r1CzuvP8NQiIlGjQ qyk53jPXHvXmFs7QSxSJkFVODux+VdxaOU0MiViOCyDOMnpiuzMoKUYev+ZnldTlcn5f5FvXFs51 sw0hBkTEsfdWC9eRxmvDvFVzJa2zy2rMkqswyMc4b6d69flnG61ZiD8u4jqRgd+K8j8asslkxBGC 7BcA/wB6vVyGm4aX/rUzzepfX+uhycusaxbaRFeLNmRpSrZAIxiren6xqk+m3N3KwLxRb0G31wOa yr5F/sKHHaY/iMVPp+ItHvTwV8jI9BX0iu3Y8tVHfV9C7p3iHVLtZQ6w/u4zIPlIzt9eabYeJ7+7 bAhhBJ28Mfx4rK0FZWLR7AVkVldv7ob09a6Ky02Cyj3RKN2eCeea3pUJNXZi8VLozpi20mJPvg4z 9PSnRXEnmeYjFc988/L1qugO4Hpnn/8AVTpJooBufGBnk8V3KjGOqMp15PcWSJJAAR82Scnqc9j6 1Q1KxU6cZAcNuA68cYqnP4j0yAklyxB/hGe9YVz4sWa2MEcTgM2dx9+ePwFTWrQs1cyTbdzqdPnt 5v8ARymGESbmPXMYKkj65BrpZvOjlD2zyIQFwUYjtivKbPxNDayM5hc7vlBGBj1/Ouqi8Y6VOq7t 8bNj5nBxx6EUqFeLSTZupM9FtdV1KRXtb26lZGkjDMcFiFzj8ifxpqa1duzRzSncAcZwN2Og4zWF Bfadd20skbiV2Chdp6c961rOx04aZNfXxfeBiJUIBz2JznvWleSUTqouTdrkc9zIk3mRsGZlIznp kDPvRExlCtIqZwU5Xn86qN4WvNX8L32pLMITamORFOQXGeQCOnPH4159dT6rZ2NtLBLOhaVlZixI OBwOc14866cpQT2O2N4xUpR31PSb+W1gimeOGPcfLAb2wM/nXHtDaOhJQgMCRg+tYOoaxq8JgjEg bfEGbeAcnPXtUsWpXUmq/wBlN5e09Djn7uc9awqq+xnKcW9S54Q8oeI4EaPzIjJiQbckJ3PoK9Ej 0SZ53UxLsLMQcqCMkn+VebeBrfUb7xNbx6e+wiRvN9PLz82fUdK+nLTwzcTXoEbDk5LbSuR6YzX5 7xVmEcPiVzS+z+rPp+GsvlXoXUftf5HDxeHY7qKNEjy3JYjAIGeCM/rUi+FZYp41VC46DeBhckV6 pJ4buLWEyxyKr5MaDb8uD15qO30S9j1Bba4dWwqyblHQqen418cuI7p2np8z7CeQLROGvyPOH0TU tIYyzxxbXO0ghWHJ69O1bmn2GlziVb5URtvDAKQ3ccYyK9P1TQY9XtWtGOwhwwYDpgZPWvLNQ0aS ykmiV8lRtBPpjg1eWZrHFxcZO0vIyxWWPD6pXj5lK48K2kqGazMbr0bYVOD6c/41ytz4RgjhRvLI 4/ePwcc8nPtXVabHJHcJbK4iR5FDyHkZPQkDrV29muzB9naIBXUozZIHHPH1NfUUKlWE171zwsTh aUlzctjxTUNAjWYiMDYDwwIFedax8l8baIkIg+m4173rVlLGVMiALgMPX8a8G8RiMaq/JGFBz3zX 2+AnzRufE5lQ5GVFnQDCknHU+9TRyu5xgjBrHIDvtOe445A9x+lXI43iLfM2Dzg9BXZLroeK0XOG PzHGfxxVrb9nk+Vw6hvkZeh9+eh9qoKeCOhxT4ron5Wx/dyvPH5VHK2HMX2Zg/GQwOS3aultr2ee LLDgL1POfpXKiVhIV+bBHWtOC5wBExCqBg88fpWOKw6klZG9CrysgnuZm3eYMbuQfaslsnkZ5P51 pXU6Svsx0JAweBVDBVsYzx07Uo0raGdSV2ODMo2g9sYHWkYtuOM44GTTCSWx1/CnFlyAMYJ4OKTi 9iCV124C9cdK6nT5BdWH2aQE5+Vhn+Ed65Qy7SCRkk457V2Okwm5tt0SZVsBs9sf0rjzDSMZSOrB q8mkczrum+RMJ4lKgLgr3PvXNEMcYGcc5969I1mON4Vkk+6MjA9elefMoJ29ME8Y9BV4Oq5Qt2Jx VPlnobGhQMLwyhsEDPP8hXYSxrOXwckjnHYdK4/TIJXlkkRckL82OMAnse1dhbKY1YN8xbIX0I71 xY/SXMdWD1jYxjEwk8gMwGQN3+z/AEpzWkEivKVZypzvJ9fQVZltpJFEUa4fdvLk4/A1Z2JDCQce 7d2Pv9KFU2s9R8m5zKXDteFIgFLjjH07e9bd5axrbrFkb2wx9z34/CsfT5VtrsPJgg8Hsc9hmtY7 bp0MBzjJyO3rXXiLqaSWhz01eLbJ/OkmgQbQDnHQg1ganKA26MDAPI9sdK05GIXBJyrbm/z/APWr IulDxmSQZBHXp+NVh4WZNV9CqhWVQ7k7VHGOfoKmjkVnG0HOWJz6U21dYImhlHGeMVFO6KE45bPA /nXU4a6mCGXH+kDdk5+6cU1Auws4wAe3GO3504hdy4xg8EH1zT3G7MeMrnP41SXQTRQkWdbseWpI YDkdRzitwQTsh8pgpYYyf51CN0hUDrt5H04q/E+0HeAe3Xv61LqbMFE4bUFuYz9ivCSQSxb+8DyP 581mor7T1KkY47Y712eq6fA0b3xLHjBHXn8O1cog2HDHGeT3JweK9OjU5o3ItqTRKTKMnAIA5/xq wmOVGOOcj+lRBSBtYbjjPp9atwBVTysYG3J/+tWdbcybWrLIBx/npStwNozx3pkUvLI3Qfypfvgt x14rFp3MrXEHPPII/lUT+Yi7m3dc4HXH/wBaptu0jae+f84p4nZY2/esGPRcZGPT0rSPkWtySzWK VG/duRj5sEZz7n60wTxhfL2hevzDrxxzzUUK3UyNLEVVFOZC3b/GiPareYW3Etz2496hL3mzZ7Fd 3MkeMMQeVyMirFs/luA2zBHIcce+KR7pnBij5XOVBNZhack7xhQfTPP/ANetXDQi9zRuJrdA0Jhj yDneq/Nn1BqoLp7ZCkDH5mwSOh56c0hELwKCMtkZPOAfSnmCAxfvs7zyuOhq+VW1GpLqUbmfLqdo AHB4xSK2QGPHb8//ANdR7AWKg5K8HJ5+lTjhsZyQKuUVYemwqEqo2544+vrUse95F2r0PQc0xwWb jqDg49Kv6fDJ/rhwORk9awdrXJZNKXChYgBkc5pu1iioeMEZx0OO9TzIrISrcjke/qKhSXaQnX+V Z2e6ByM/cBO8Uecd8danmh2xqDk5Oc9hTdmLhioKkruYk9cf4VOWBBU5IP8AEDxmtLajb0K0e+Nf MT5gT26VM0cijMpO4nAA9KZsW1iYuxOcFSRkAjr0p4idwJJ8E4HQHGB0+lLlEyKFvLBOOQM5Lfyx 1p9yGZlCgnkEdev17UqJnhwDnke/5UrQYRSxbgk/KcDn1zzQpa3G3qWVDCMMpzjkFj/WoWlH7y5l K5AyO1KJXc/uDgdOefqfpUMrRq7Ig3M4+YHgY79aaiCCO6V4wyMN+PmHv6ipV2W6c53cdOw9aqu0 0G1Niqp4H4f57VeUxzovBJHC+nFaWikS3oiSA+H7jSZWle8a/EyrbRpt8gx4O8uTli2cBQPfNNTw rrF/pUuuabaz3EMG0X00aF0gLHChyoO0n/arLnktkZ1iRQhG/bnIB7jn6VvaD4113S7W6Sy8pI7t DDcIqAB0BVth65BKg85HGac6dVU26Grv17dfw28zpw86bmo1lZWe2/Wz189/I5Uja7R4Kndxn8qm CyY3MCCuNwUd67e28eeHGhijuvD9r50KEebBM8bSMWVsy8MDjaQu0LjPJOK5fU9QbUr+51CNRAJ5 NzRK3yjJJx0Gcf5FKEqj0nC3zQqtOEVeM7/JjVUjknB4BzVRI984jJ4Ykn2qwxJGF5/wq3p0a/aC 2NyqdxyPve2aHaxgmaBRI4REpyvTkdRRhVyvHHT0pGk5bjr0qNU3sC5JwOeK5Yx8xXEcBiPM6j5e PTNEkMcilH4AwPlNSyYLE/JzjHtTdiq+1mHT0qG7Mp6kBt4VTaFA3Yzg8/54q07ArtI+XA+vPpTM 4c7B2zk96iyHkO/GMZH51pd9yo3KrabaP82GBzk+1Rpp9hjK5JzgH0+n1q0shZt+ep7e1LzuVyAB wBgDv6Vpzzte5o6ZUGk2IO7aWGOme5qymmWiKU2np1zz9KsKpIO7v0PpmpF5AwQoxjP065ojWn3I 5bPREK2VqkWxsr2z7f8A6qs2lp5ETOpJB7HrTI+T6jPHrVyOV3/dEYUc8U1WbaFJaH3Z+zh4j8Ya T8PHt9E8OzapB9vlb7Ul1FCA+1cptfngd+lakE/iTxhrviSxuND1OGZtStLieOzmgdoCluEVGZyq ncDngV2f7J6wL8KRudN39o3B2swGfujueK7rwA0L+PfGkiuvOpWoX5hyVt0r8FzfMo0sdj5xoq6e 95a+/HfW33JH7vk2XyngcBF1nZ9Pd092Xlf77nnOoaZ4gvNFttD/ALE1yKO0heBWE1qWYM27JBfG Qah1ZNYjvpvEtxoWseakJ3AyWhjQJGVyPm3DAGTivqGZYWfKspwuA2RXEeLHWPw1qEku3C2M2Tux /A3v2rwsHnSdSKVFK71+Lq/U+jxGTtQbdVu3+Hp8j538D+M/F9j4C06ytvDF5PClkqR3C3ESBxjh gp55HavMNC0G98Y+EtL83T9ZCWpuMyWRg2Sbp3YgeY4PBODxX1L4FcH4aaUcbdulxZPJGDH14rlf g6pb4c6dJtLqWmAKHB/1znr+NfRrNlTjXqwpJPnXWWvx+Z8xDK3UeHpTqtpwfRf3PI5u1S/g8TN4 mTR9baQuz+RuttgOzZx8+eleeeL4rzR9B1C/On6uPtywwL9pNuIlLTKwHyOWySMDivrGYOCUkUf3 93UjscYryX4tBT4OVycb9Qsxk9D++TIz9ajKc25sTTj7NK7XV9/U6M2y22Hqt1Hom9l29DmvFHi3 xW3hrUFufDV/BHJZyhpGuImEYKkFiAcnHU+1eC/CjWtW0+8ujZ6XcXhNnaRtHHIilQobax3dQ2eP Svrnx/cNF4I1hGO5V0+fLHIGSpAIzzzXzr8D4fMuNRl+8Vt7BRxkY8tv5V7GVYim8txE1SSs1peW uq87/ieHmeGqLH4eHtW3Z9I+fkX9R1i61XxL/Zuq6ZqFp5+kXUCKmyZ2EpXcwwwGFHvWV9lsPCGm JY2MGpNJcX9q8aTwqhleFtwjUqTyQDjNei353/E2xUoRt0e4bA4x+8UE/lWf42Y/2loKjHOsIc9O iMauljUnSpKFk43tr0u/0M8VhLKrUcrtO17LqorpbucD8S/FOraj4PubO60m/tVk2KZpihRMMCM7 STzivk/yW9W/P/61favxcuPK8F3K4bmWEDjp8wNfIP2pv9r8q+t4SnB4VtR5dX3fRep8jxVzxxKU p30Xbu+x/9f+RT4jaZb+LvGEOqyh40NusRDkbgUJ6Y4HWuQvtNtNNilt7VdgHQk5JB75PWuu1u6J uQ54w5wT7da5jV7hTKVfGTHuJ9+lfO5TgY0oRhDofa47E+0nOpLdu5R0pS2o2eec3MYyfdh9aq+L j5niC529yGP4Af4VP4YuA2s2gk+6kpckcDCIx/nXB+KvFdtFq9w8BMzE7QF5A7c19DCylzS7HnTk uRNdWHmqjMWIAAJ5P1rm9R8S2ttchrLMhRNoI4XI6nNcTdald3U5M7kg9ApwuDVXdx8o455Pp70q mMv8JzxV9zUvdXvr8bZZGCjGEXge9Ze3nqvJzgk0pXJxjnHQd/WhgGYKOuP4eScfpXHKberKtbYY 6gnj5fT36U7ABwcDA4GetMAKseM81KwQEj3HP4UihnG446E4HGe1OkiATacHjBJ9qcVbGCMDHf8A nSkb8np6+34UDsReWpHGRxxS5ZVwTxjjFP24O7A+gPanrhhjHTnFArEK4HzLz7ehqVcsp+v50nl9 1HUE5/pil3kYVlwMf0pAwyx5O7oef/1YpQxIHXnHejcCNq/U/wCfSpcNgHHJ4/DtTQrEQOflAwM/ LSFF37jk/UcH/wDVTzlvXgdv5U5WwpypOaHIbK5jII2E5PRSM/hUUUskE4mgLKcepGK0VUEldvsf WoCiSL360XZNjo9N8VSJ5cWoD5VbduHXOMcjvXoVhqUcpNzAwZCm3dnu3X+deLyRlTg8k85xU1ne 3Viwe2YqSeQPun6iuqjjGtJakq59c6Zq2zwrhv8AntHGqg4z8pr1/wAQeENO+IekWml2hgtriewt 0a42A/vVIClyOcc4J6ivjrRvF0F9ZixO6OQPkqTwTjGRX034P8TNbadDcMeYnSIevr6/SubMaSna UH1N6UruzOO+C3hnV/Bfx80nRdegkt7q3vsNGe/BAZTwGU9Qa9OvbgH4uapLKN2dUu+vpuY5617d YT6H4+v01qXyk1TTbAXFjcN95ZIpTuGcjIZD09a+d9UimsfH93I+SWuJJWLZyS4JyPz61+e5zRlK tKcl9m34s+vynFRjTp0k7tSv99v8jov2p7oXmgeGWTlUtpVHOefkOea+WreSKHRZkUDcwGCeo5r3 r9ou7WbSPDoU5HkzEL6cL+lfO8NxG1gYVx0HXr1r0eHaPLgqa83+bPG4kqXx1Vrrb8kdDpMotriK 5m2sEXO1zgH6mvUykR0pPKjXbt3ZB3DB569+teWaZBaXVzbxzsEjZgruSMAE4OfTFfT2hW2mQeHr myjeJgP9U0mCSoUD6YPtXn59i40nB2u7no5FhpVVNX0PIXu7ZEtM43AHr9OgrxbxhcxXFo8acnzH OM+rcYr6D159Kt47KABE2yEblxk/Kfc8E182eMSkcDsjBh5z5YY7GvouHZqom0v61OHOYuC5W/60 OQ1OTZokJx/y8EevG2p9AW5uYJopFxDJFtY9PTHP/wBan2tqNU06NLj5FS4DHB+8pGK7BbeOCExQ gKoHCgV9nRw+ibPn51L/AAsigt4oYhDEoGB6dR9ac5C27nO3/DimPfW1laGS5YKMYBHU8dBXAahq 9xqO5BlYgeFHf6069eMVYlROhvPFSW5+z2ADuFxuPQe/vXH3l7d3jeddOzkj1+UZ9uOarruDZ6jI zjtQwVRsHIJHpj8q86pWlLcrk1uCnzRhj35PrTkOFXj2wP50iYIyR9R6+lTjBwDk8fTmsSrajGCF duM9qXy96nA7cdP8Kk2k9j9RzU3l4X+QouO5USSe2lEsDFDxjaecfhXaaT4xljUw6jjbg/vB1+pF coIwQVbIxnnPTFQSW3ykr+o5+taRrNaJgtNmfUOh+KbE6P5MpDiTCDupAGT2+lTXOn6P4i8LXOmv tt/s0v2uCSIYCnBDbh3DV8w6fqF3YD5H+UNnZyA3r16GvSbDxF9rsHhtnIEgxIucYHcH8a4K+AU5 c0HZ3TPewucWh7OorqzRz2pKnm26dMRYP13VmTyND4iNxjgcf+O4rob+BJIxN0dR8voQO1crfOsu tttBC5H8s13ShZnjzm7HUeC4r+bxNaCyyWWYMwBxlQw3elfaGnwXMF150jKw3bGKA8dP89K+KfBg uR4ksltmcFrpA/l5B2bxuzj2619v2StI5Cyui+ZltrZBAPr9OOtfj/iXL97T22f5n6f4eK9Gpv8A EvyNLVb/AM0m1jRQq8lx82cc5wD+mayo7meOX7eipt4jO4EDbn1z1rduo9NS3Yg7ShyzhuTkgdvQ Vzly2nfaVtBcSyxSKdqlupHXj1FfmGG5XHlS/A/RMZeMuZsVPEtzLM8PlZ7Ahs569AR0xXMatcQ3 lxLduTvkQERjOAQAOwNdUthoNsouFlYDjksc++c1zBitTayy7sNyFYHGOT+dfQ5VOnGTlSi10PEx sakocs5X6mFZ32nxrsniYnGS2eAf51YutWUQuAEIit2IU8EkkEfjWbPamKZ5Cx3t9zDAfTjHrXJW kzfbP9Jd2jfhi2Np+uPevvMHSjL3rnydfEShaLJ9U1E38QkmART0XPIr518TYOsSY56dT6jua948 R2x2JHa8rtLHaeg968G8SAJqrgEkBVz+VfeZal7PQ+Hzy/NyszVJGAf4h25OPrSiYAlcMQPm+n5V SWZVOOfUY6j8fetCNGaPBJHGD3yB9DXc3c+dsyyp3jcV2k+tPjV05AOSexrNMzwSYlyQ3IB/z/n0 rQWXv2Xjk0n3Dl6stLE2d7dBwc1EZjGCUB249KhV2xkDnv6U2RvMQxA49RUqDE3d2JI7hT96nCQE s3P0/wA9arLCBHlj2zx6ipWKMBwfTFOvBkxbsOD5zgfSnqQG2nsefw71HnsVOTU4dPMEhwMHoB2r FzsWkWYbWS63GLtzj8a7LwtHf26PasMCRcxkc5qrpCWsl3HdbWCElRt45AyfpXXg2tqsd26nGQIh GDwDngj19K+dzXGtr2SR62CwyT9pc5fWrZxC8bhgy8EEnGfX8a4TyXAbzOSD8x7CvStaL3cgLMQW ySOhFc3/AGcJ7d1c7XBB5I9hXTl9a1JORjiqac7Il8OW8uSX4jcbj3PUity5cRsRENqKBljVXQmY xSWshRWUlVGcZHc49s1HeyxmX7Juzn5c8fjn8K466c6rO2klCkrBZ3MEBLSsrBsoM5P5Vm3k7W18 4l3bGUYHv7VOltC7GUnKxghEXg5P0qnqE0b4mjTvtBPoB0rahBKpoZVG+WxU+zO6eaoAGccjkepx W9YJLEGXplNrNtwAO5BqtbRNcadvjO45GSo5HsaQS+VbhMmXGQCehZu30FdNablojJR5dTNuo3eV ljc4cYAPQ981C9rJAhWU5Urxjn/PNWHbddww/dOcnnp7VLqt00SiPHEiEhh6D/69dVOo7pHLKF7s yY7NLncCenJ46ioLmWIEIrEbRt55/Kr8ErrKqxLwcbvbjrWh9gtlPnS7TuB3kjhfpWvtbPUlQ0sj C06BJz5qjPGRnpjH86kkVo5MdsjINPtWFu4GDt6Hb0x2oZgYCcblPQj+tXza3IsuUjmYQozINxKA q3Q/1NW4JWa3DMDu3Y9cjvWLeGTesSnGVBBBx9e1XLZxDGqZIOOceo7/AI0Tp6Kwoy1HahCwtjLb bixJLLuwRge3b2riY0aQ/OffI6V1t1KrxySK5T5TgKfQ4Irmo1aNs44bIPPA9K66DaViJy1HKWIH OQB0Jz9Ktc7SmRknBNVRkALgY28Grio2QMYBHJq3MyaIo5GwdxI98DnNaAwV9uMVSEeSRjgkc/yq 6nT8OMf1rKW1yVHsSKu4HjqOlBh/dHjHfLcZ9MCpMFV2k89AffvUcsQK5PJyBxxiohPWw3GxE5hV NluJCcYY9mqGexvBbGSbavdQThvxFWpbicwi3+VQvPyjr7VmYmlYRkksQMFz0Ppitqbdy09RkAkA JkKqDJtA7+9WVupYogkRADHaQeeCP0qK8mYILZVUheCxHP8AnNRxEkKzDnuprWeuorLqMRHDmQjc ucgE96fPHM/K5PIPXpVryyWwBjjtxxUjKuQffn61m6hDsUkgEeSAMg9aYFCjI7/kKuYCghiOuTn3 60n2dDgLn/8AVQ5vqx7EK7gfN64OMdc10Ee1oRtGBxjmslETaAf4cg4rVT7gUgjjoevrmofQqL1M 7DFiCATyF9Mmoo2w22Ufd5BHqePpVp1VsxqcHPXtn+dK8SSJtUhjjIxTiws0QKhDb8Z7Yzx9BT5I jJHg/KOvHaqySyKf3qkAHIxxU0bvdsdgKBeRmnJWYkyAfKfm3FG7nnB6ZqZ0MbG1kYkEZO0VE07E 7NgDjj5RxgHjJqbfxkgbsYPfj2oT1C4sKyMAgwMAEBupHrWfcrMju88mBkEAH7o749avKrFBNGQx U844I9h7VBPKzS7mTJA+YE+1aqxdx8TMigxt8oBHbPPNOS3ijLSSt94j5Ohx7DNRwwQoROzZDfMg 7HPNQzMySEouGOfmc9fpWckJb7lyaSKS38tj86sCCp6Y65p0ewR7lBOM9eOn+P0qrDEeRxhj3HTn 0qZpkCFlKqoO0sO5HoBUvZJEtdhWVL7b5wCgKFA56DNZFwr2jPboPlL5RsEdR09DVz7YgViykYXh jwG+nvWRNNdXz/Irbf4c+n4V3UuZehErrcYkSqgkz83T+nerVuSVMZ2jaOTzn2/z0qSLT7nYPNQj HbPOfc//AFqsx2haTdt5ON3pwOM0TqIcpW2Gltz7RnqMtj19PpWzany41Vc7d2OnX8qqpZQk5DHI OTz6VdXCnjAG7ArinO6C47aTnbgYB6+lNL+WhwBk8H1pke4MS+BuJAxjoKadzTkZ4x044rG+onEc BkLkn+tLK4DFCR8y5yOMfhTWcrtCgHg88ipJWIAbtR11LuN2kw7ZOu3dnvS4xmZuvQD2qTmUt6bc Y6dfWgSbExjOBnpS5jZMry4SL7oBZeg6mnbQ6CQnGcH6cdqQhiu2TqenHX6GnKCR5Rznnp0q1J8p o0Nh5GzoOoz3q0UU/Ko+U88VBGPLA3denH9amjDLnefvHK57iobE466D0BPPpwMda6LS/DzXNu0p LBipcDPXuMVj2RUPsYA8jIP64r0nT7Yy2YkjZc+RvCs4GwKSASCehPtXNXruK0Z3YXDKbd1c4FIt Ti2wQyyIDydrYGB6YxWrFaXkYLCeXcR/CxGcdya6O30xkCtdgxO4BQ8HcD3wDxzXY6BoJn8T6Zp9 8ieXNfQI9u7DOxnUMW/3h2rlxeYcl5X2O3D5Y27WPKLZdYZmaa6nwCFXyixyD61NdLeyWpjtbu4e TPSRzgjvxX1ZoGq+M5PiVr2iLbQ2+m2dlqa2Fvb2cSRq0S4hIwmWYHoTXCalH4g1D4aX2reM7W3N 3bajZR21ylqlvPtnEm9WZFBb7o65rzlmtRTXMl9nZ3+Lbotuup6Usnp8j5W/tdP5Vd6369NDw6Gz 1RYtpvJ1ULtwGOOnp6VXS21y2AihvHSNBn5HZRk+1du01tFHholHGQxbJPvgdK6f4bw2uo+MxBcW 8dwsVjdXKxypvjZ44iyfKeDg4Nd9TGzhTnUa21OSjl0JzhTTs3oeVZ1xgxivbnA5B3tz9aZa2WuX sBe6upXUNwpcnHPHB719CeFtd8b6n4W12e6igiuYfsptD9jjRVDSYcKoTBGOtcp4qe8ufDWjatf2 sNvezSXcV01vCIPMWN1EbMigDOCecc1hTzGp7T2bSWttNenN2X/Dm0srpuCmpN6X10627v8A4Y8c 1FdciVonupXQn5ldyQRn0yc1pwac1rAskVzKvmIJAU3LkdMHHp0rYurVwu+UxtGeAcglSfrTYbWW +hEKxsAOrDGVHYqe4z1Feh7bRa6HBLDJSelzHeDUFYTGebftIDFjux3Gc5ptxufYXuZSyYYF3YbW 9evFSXtmNPmENw0zs/ynB4UZ7k+3NLLDaPJHHZ+XyMMrHfyOnXGc9a35r2ZzuOrVhrxyXMJSSeaV OCCSxGR9Tiqn9nxf33/Jf8a6GLRbe4heMwtHIoALqP1xggVB/wAIqv8Az2l/L/61ZQxcVpexq8LJ 2fJc/9D+PHxHdr5/pyznPHauQ1vUbS10z+0LmQA7liSP+JgQST64Fcr4o8ViW9Zbba5zsUjoBXnV zc3N5I0k8jO5x7gD+XFcMHybH0FSfM20a174gvZm8q2doUOVOw4YqfU+9c2yleYz+nOffvVgR54b OD/XoaGjLMQrY/h+tKUm3dslFWSPjI69Afb86gYFTx0PUccGrQjTBzwQc4pvlKeVHX8R+FJvWxRX GXA4INPIXbkfhzTmjKkNgjAH1/zmmh9rZPbr/TmnbqBJgngkE8dOgPtS4x97rjGT/hSh9uSeT15H H4UuSxwf8565pAN2Ky5HB4AFB6ckdxnFPbIG1efTb70g24PHsM+tCGxoCg465GKcMKocZHPOf/rU wrkAEf8AfX509Uwu1gDnjPXj8KGIU4K5fuePpUflgMR+eecVNGBt3Y+oPpRs3OeBycAUJoVynzDn bzxx6VbjZdu4deMemKa6gqAOMZ/HFRfMoz146UFN3LR/ugZHt396CocYPrkA8DNMzu+YjPIHuKkJ JTgAjIB96RN7Am4NkHJA57cU/a2cnueM+9EeGbDYP4Zpx3HPf1zU3s9SbdBjED73QjPP+NVZItxL Buh9O1W23AZX1/zmnCPzRgHnr7jNDlYtIymQodwPTkFex9jXr/hH4gtDbjStU4w2VnbjnoAwPr61 5e8e3ICg4HGeOTVCQFDlSxxgn0q7jufaXhXxXPp0uYmILIUyO+/Hp2r6Kt9N0fx1oV6XKx6jbeTN aXA+9kxBWRvVWI59+lfm74Y8V3GmOlpdOWiyMOesePX1FfSGg+ObvTv3kUhCuiuSp67en865cVgY 1U0zahXcHcz/AIy6g17pGjRTDbJCskcgPY8V5NYeR9kYYG7AP455r2Dxhp0Wv6Vays3lvvOD1xu6 A5/CvHYoZ7FJra8ADJ+vOMj2rmw+HVKmqcQxdd1KzqSW9vyO509bUhFYLznr3NfW3g2fSk8HRJet bYEBAHAOTnqfWvh3RdTTT76C8uESVUfeIzwDg98V9A6PrtrqFrcals2pKXZUxgc8cdq+J4vwU5xp xV7Xvfz7H1vCmLjTlOT3aOj1xNGns9PiLRmZZGDjAzjBxz9K+YPFtrb3Z8hRhWuZshe6hq9y1ufT kk01FchV2+aGPI4IOf0+leOeJJ7K5uliteRHLO47ABjXvcF0WpRi7/05HNxJUU4uyX9JHJugjtVi j4VGwBj8qr6lqKWsGCcs2MKD2qrrOpx2EXllsuSCE79O9cG94ssjNMSScZxX6FisTy6I+NpQuie8 ubm5YvK2cdFHQCq6gSAn0HJ9aPtEYQlRnPApnnoq968lu+rNrpaE+1x9T+npTAoP9Kb9pi2bcHBO Bx/+ujzUHIJ79u1NIqw8qRhgeRxx/k05QWYKefTnryaFuIQuAMg9P8acHhLZyaiQiULkbTxngYFK GPCluvGKgM8PLDPJ+lKtzGDzzkcDHp70o3auJotgqo/H/IpoKsTz15z0FVlvFZ8bQAehPerAuIs4 z/Wps73QmnsiOWNZsq2eeozUcMkthceahKt3B6H2PNSi4jkUnng89utQyTRSKFbOT0brTi2mNaaH XDUoru0UofmBO5T1FVNWtlW9ScZD7Bu49q5u2cRkPGcjjcOxFdFfXsN1MZoycEDArfn7lzVk2WvC msT6TrVvfWwBkEwQKy7gQxAPH0r7ZXxdbwJtMfBkJU44ANfGngzUP7O1uNZULecPLH3RtJOc5/Cv pCFWlUSHd3yOR1r8p4+w1OrXpqpDZb33/wCGP0fgnE1KVCbhLd7dv+HO/i8WafA0ivtw53naOR2O enXFUU8SaOHaZGChQCGYdCp/rXFxsqmTJ3Lv3ZJ6ZGKr3E1s0XlMxDEcEY5wc18NDKKN9n959dWz Oq97Ha6l4y0qWSN4MELng+pxmmJ4q0UhpGSJSSTjg/n6VwLJBICwbIAzz/PBqELZLhWk4bnGOc9M c16+DymirJXOGpmtZyu2jq5vE1hDdtMAjo6AfLjOAfSuevPEOlTqVVYhnAAIwM/lVW+awkthHArE kcEqR09/wrl7x7d02xBhzyMY/wD1ivqcBgaelkzxMZjqm11Y1dU1CwKGNdu4DGUGVP0//VXgPjCz mS9a8dJVjkwqSbTsyB0B6Zr1CVowCRnHqeTXB+KoydNdELYU7tpPbPOK+2y6CS5UfHZtPnV2eZrK Y2G0EccZ9/8A9dbsUyugjA4PfFc+oTO1trY5JIycmtq02lPNOOD+Q7GvVqwSR8+xl9vKZCkHPPfv jpSRSeXand1aQA57bc+v1qTzUkYYycjP+zjOKhlhWNg+B06A/XP0pcpKZMksxYDBwTk/WpgFIO3G dv6+o/OmwTo+Y8AD2GSKc6L1TqMY9eKy5hWTHO+yM7uRjoDSw7X4cjGM8npiqrJ0AJbGcnsB3FSB djHbnO3PqRiqb0szKMNTRAA9u/TrV6K2ebDKPlzlm9qy4iQ+5v4umDWpE0axspJ3ZGMZ5U9favPx F1qjemrmtbWV5bIWVvlJB2q3J56/hXSTXaG3ijcuSh+Yg7voR+PWsALawR/u8uWxgk+3YU9vP37A vynq54FeNXp88k2ejTnyrQkYyzBny2Vbfg9PzqrcXEUe2eDkt8pz2I/xoZjcOqhvYnoDj1qjKUEv lIMHcXGeP8iumlS7nPORcF8zzrCzbAPmPfJJ59612t1kV535kUA5I5wen0zXIStvnLgA5OCM8giu t0O7BhaediSSEKHodvINZ42DjFTR04aak3GRfs9KuUgAkChnwSR2GOh964m9EkBaPJKh8jj146+h rsrm7uGYxs2VYkkrn8AfSuP1Ha0agE53YI7ZHT+dTgbtuUupeKtyrl6F7S0cWbruAVmwewyP8RSr OzWQaMAOkhIyc5Xsf8is9ikFr5bMwIbLZ6H8KnsrpVgCJhixzk9B6f8A167JUt5HPz6WZkmS4kug 8IYknJHv1/St66iG1WlBClMEN2Oe1QW6s0yuTuwSeO+Kv6m7SoyAAgsAD+uaUqt2kQoqzGW9pBBa +azEttIOOM+lQFz5flsMd8emKtRyyG1EL/3ti+p4yD2rGu3aJMx4YZ4J65p0bu6kTPRaEUqxxMEV sd+PT0qOO4VZztAAxyCeOe9U9Qka3YTH5gQcgdQBWW98CpeMDDdAfU9a9KNG6OZ+Rp31zGzLgEbT gEYHH1qibpid0fIIHfNUC4chhnJBJzz/APXp3zBQr8565raMUkZvUlMjyKY+ozuI9hUKhdzNjuCR U0IwcY6HqTkfyrTtLWOSNvMXoPl9PXNNXehHWxm+UNhDDGBmrJhkRElIIGT/AE5q6gSKREOCrSKp B9M81fkuFSJVRUIBIVWHTBNXZbFxSTuYjQssuyTAYHgjpVmG0nVjJGhK5znmr6eVMryOMAYLFR0z gDn6mrqXdrHBsizvGcjPFYzTtZFJK1mZCRtg5444yKdsPT0GfyqSe5GwljyRgVWjucQlpQvHT3H1 rP6vfUhpXJJY1cDJ6j9aW3jQXkBAAxKo5+tWBayXEQkZlG75txPy4HOBVKPzBqUUCZIMigYGTntU 8r2RajZrQoSQbppTjOZnB4xnk4pxh8rA9snmr9xYSrqNzEw+5IxK+2c5/WpoLBpXRDwp6n2FbN6X bJlB3ZnkDIPGeTimyJxjPXGa2rjTjFGzoQT346VS+yyBGHOSAcH0qIyuyPZNPUpIqkFcjn+H1Iqz 5ojjEbIu488HmqzWk0S7x36HvnNVSzMWkH04PXHX0rZq6uVy9zSfKMUAABxt5zxVuJVCgjJxyxrL hNxuwBnP3lNXvLKowQH5uvcD6VnKNpBy3bK8g88llA+QkKeox9KaxESqYyAx5b1GfQe4qSOERyYf JDDnHrUDqFnK7eQMAmqW4r21J1KsxZlxjjDZxk9xmqkDMgZG+YnqOePxqy7zzRBcZC8Dt+OcVQEt 4W8hSAByD9R0pvZkp9S1IIkXfhQNo2j2/wA96gt4kDFnPJPHHPrj6U7HlRF49rsD/GfX0qu8gUIy tyeCD6+n+NNJvYSb6F8eU7YP3T0JGB7VRK4C3E3AX5dvUVeeMoAX2AgDIXqM/wD1qhly/wBzDA9O cfWlFtBz2eqKYvYMrJIcIpxjtVGWdWud/wAzJzwTkFfoe1WI7KCaMwch8HDcH6YoFrKgPHC8Ajqp FdScbaFXXQtQxy3MRkaNwByCoPHcdsU+KMyKXm656EcAn0ra+07bAxcjLZ8sHjjviszeDheg4yD6 1yc7d0VPTYaIkB8sENgZP1NSpt44II6A9frScZ47j0qFJGkZsDoCQe3HX6003axlrJlsuwHA5PHT mkLAct681GpIj3YJPXFTRI2c8ljj6Z71OyBw7km7aflAJpkZAXByPm3ZNbq6WVsZ5pyN3yKB+NVb m2+zYDDJK7sDnms5PQ1UGtzPY7wV7571CXIYMRztIIP4Cr8dpLc5MfzOOcAZ6egFVZYxnp0Oc9/c URkiZwluVy3zBeOn5VYcsdpPXbjFQhWLB8/Lj7uMVPjCndxx09M9qcpWJ5dLj48KxJHUcc0yI5OW IGcbc08EoFAIHy4IqNQcL6AcHpmptfU1imJIiiP72dpzjPXFSRgqCVIPPOf5frUiQFieTjHOen40 9Ysx7CucnPApKdlY3hoRRRYY7RyMc9KnRQU5yzZPUY/Wo44yuT3/AMitG3WJJBJckKDwvIHHqfTF ZSehcVc1vDdjJd3iwAE8jIHU89Oa9QigggvVi1aBQPsqifIGBGpJwRwfxFcbohh0+9jvkUSBThuR g7u4NdRreqWmrXdtPMLiOKRdjpbpucqrYJLHAAxn/CvKxDnOolbQ9zBqMKbbevYvRyx3cRaxFosS sVUySDYuOyKcEuRXUaLLZWOs2V5KpiWO8hmlZiW+VHDEke3pmuKeeZY1vITBb2McjRRRgKzIG4Bz tyznGWP8qyUa7TVf7Nnw2AsjP1EoOOhHPQ1xVcJzxav3PRp4rkabVz2vR9L0jTfH2t+Lf7YszDqV vqUNuoWTer3P+ryCnT19KwdThtLDwReaINQgupbm7s5YooyzbUt1l3kllX+KTgda5icXtqEtpDEk shBXAICqc8Fx8uT+Y9azLbT7u5dmufKEYIUgNuOT6YOTnoKwhRbtOc+3bpsdjxKWkae/N3+0rPqM tbDK5usjbjAAyxBHQYBx75rovh5Faaf4muJdRlEEclhdWqyyA/K00ZVcgZP5Zrl49Qb7DLKwRJYp AEjcESSjnJGCAuMd+tZ9l5tzPHBO5VpycKylirHlfm9+lehKjJwnFuyZwUq8YVITir2/rU9d8JaJ pfhLR9X0m71e3kN+1v8AZ5AkmCIiWbcCpx1GKp6/d6RBpGlafNPFfeQbsSmNmVYzNIGXORnoOcCv OJIb6OZZGWMxn5SGyvPfaT1/DpVTF2kjlrUhFOFKS5L59CeoHfFc/wBVc6jqTndt36Lpb8jd46NO HJCFlt1el7/mXpRaWl0Z44UkgyQI8gKT7E4JxWGdUexvHk08RRu+Swfds2/Q03VBbybZLgbZCcmN nO9M8DPYfT9KZsheIROWKAYL8OBnopr16MEo+9rc8StKTdo6f1+BDew3U87SnyTPIwYmPcFYEc4z kc1YS7isY42gt4551cea2SwTPoo649fWpg16bRxAskbcbUVhu244bkYIPesGeyuJ2+z28TStn95J COMe684wfwrZLmVpbGM7x1j1PTbrxk6K0cVtjeuNxwMZ/QVjf8JJd/3P/H642zurrR5Z7ZGIbAU/ aYyE+uOoqX+3tS/56WH/AHw1cn9nQXwwv8zsjmU2tZtfJH//0f4N93z5OQBwxBOT785q6LlIztUk 4xxz0/8Ar1uadog1aCSIttkjwY89OTyD9a5maCS0uXt7oFWB79OO/FebGSbPcje2ppLcJ97dj2oa VQvzEgk9uayCiZ2yDdnoxJodZQhTcw9D/wDXq1ZlJp6mwDHjJHcioXuIFUIeTkYx0/H/APXWQGuP usxxnv3980ofPBPHYkdfehrUFLW5q+ZkDB4YdaidBtyc4x1HY1mxMRgbih54HNI8syNw3Hbimo9U XfUvlig5PoOR1+tWfMYDge2D2/GsR7m4aXBYHnjOOeKlEswxluM/jVcmgrm0jYfp0PUnH+fwpdzF SduOecHvWIsrgeYhYkHoOlNa4nZCQ2Cw6Hk1HKNyubocMcDt3603DbvlHXoawRczFVJbvgkjHQf5 x61aW5kxyePahwsTY10+9sIOc8duMfjSg85/ukn/AD/+usZLuVn45I+8Op/WkF5Iz5cBeOOMdKTg xG2cs2SAc4zimHGNuOp6e2ayheucENjrjcOcYp32y5+ZcA479zjpRyMexp7cOSeM/lQshxk9B3H+ f6Vji/uGfZJwOv19KVriQDc2OM8/0pcjvqFjZMm1twOc8c0vmbQDkepPXpXOm6nR8PkjPp7HpTxP K65BBB6gdfzq3T0DlubqzhuVI4OOBzVlcnnPoOlc0p2sMEZ74q0lzNnB46DrWSjoUdCx3rzzVSe3 3L+7PPv3/CqBu5cFc8+nH+f8/nBNPKR87ZA5+UU0mSnfYldQvzBgTnGB2rrND8SSafiyuCTEeASc mP8AXpXGHy2IYuScZ5HbtSrKGkG/GSOpHNVzWHa+59bz6hHNp9qI2DKAHO09MDqPzrgtRnguYfMf lkcbD325wRXlen+K9W0+3FqjgxjKrvGSoPpxXSrqUc8MflOHwAzn/aPWphT3Iqu56BJaWDwRx6dD I0jkLmQqwJJ4wMCvcND0m/0zQILO4VEdY2bawG4OT06H1r5ztNSkhnWVAcIwbbnuOete+2Wpajqd impKxDvGGKhvlG4//Wr4fiT2nLBX0v8AifVcPuDc297GbffaRbP5gVPly4XHUcnsf514nql2gdmE ILurYJY5zjqMf4V6Hq9/qaSlZVAUhl3c4IryjULyYnziiPs5HXj64r1uHbxbdznzaaaseZXEU0tw 81wXLHrnGQfSqJtRkEdeuSf8K3Ltt07MMKWYkjsKoSOuSq855ya+mbe7Pno7FSW0ZW8s9AOCCeh7 dab5LBct24//AF1bumLMoBGAozUbSbuQRk8YpNeYcvUglh2JuAxz1J/KoU+clOw79a0CT5aowxxz jvSJHGrEAD0/rTtoO5X8lmX92T0598VKluzx5PQHBGcVYUAcfj9M1MvzkKPX5vbP8ulKwNlA24RN zke/U0q2yhcICM47Z6VqCJHBZc9fm3dxQYQoyAMH3oXZEsyjGiYOCP6U5oh9/JPbj3q/wPlYYyQB mgsQdjE+o6UmVfqZqoVYYJGRzgVZMagYBI9COlTttXBA4PXHpU5C5G7gg9xQK5n/AGZsEliPpn9a trFEHB684AA4P1qZC3Q9AMY4z1prjDhYz0HXv/8AXrR7iczqPBtt/aevRSK2Ps+JcY644x1r6Ut7 0wwmRVYk9OeOOK+W/C0jQ61bhGYb3Abaeo9DX0eklzs2kDGcBj6n6fSvzTjGlzYiDk+h+gcKVbUZ cq6khvwm7ZGxB+8p7c8/WoJdSS62xLBtJJZTnn+VQxBxK0QGeCfWpUgYyeY/C56EZwRzXzajTWp7 7nN6XCR/KYKkTkNnv0HpnFN1G53MNluVKLknOePyrWEFwY1cbCenA/Gsy6S8KsFK4KeWTjk1WHkn JGVaLSZzMmr3cgKqgwD83XqfQVWEkrKAyEnoDnpVo2EhQzW7AkcYIwRVKae9igLoAwPLHHavq6Eo 9EeBUlK3vFCdmTKNGM59elcNrzLcQPCwI3KcY5rrpri4lCybdocY5rkNSdGHIzX0+Xs+dzCXu6Hl KFVYbuQOMd6mR5AHVWwQMeo9xTJE/wBIZIxjaTj1xQiks7Z+6uVA564Fe+ttTxL9CzGzQjCkMcYz 2HP1qSSR5f3ZAzxVVWU4EeD0xjitGHbkGQE8/Q8/lWFV2IbZJHE0AEoyQRgnFSNMoGVIbJ2k1paf vlJUr+BrNuF/eEFADnJGDjIPSuRVE3ZlONtRpVyxVjkjhcegqy0bDBOAAOo/z0oT5/oemBzxzWyu ngwq7sM/ex3A+lROryuzKhTckY+8p1574q1Gz/IFHJ4HsD61bNkznMYLEj0rctNFVrYTzFg3oPT3 rmqVktWaU8NJuyK2niOFd1wV4OcnODx6+tNnuTOCsZOCeOvHfpmrEtmrRExnsSoP+fSqTJIgEcYB yASSKxjyyd7HS00rFWHUJVVoivygbl9ST3qEv5qvJjLNyfYZ7Ve8iEE7lAOc57H9aikZEf5QBnLY 6dOlVdJ6I5+XuzPgLMSqdjg/Wug0mWG3iYMFMjNhR1zx3rMiMVvIWT7zDJx6UsJVbn9zgYfzMN1A 61GJ/eRcbFUnyO9zqZHbYDKuDtLbQcn6c1ys+XK4O4hdxJ/+tW/LKzBp5MrhCGB61zRIMAlyAGPA 7DnvWGCj7rN8RJMuXUSTqseeCAPl5waqTxPaSRQ7gM459D3yfpVrTZI0fzJcbQfX1HXvUGs5Lruy xORx2/KuqF+fkMp25bmpCjLM3ktksh27eRn2q2qq8ZkUfOXGc4xkdhVWyjWCCEoCMoSR9B09Khlc W8Yk6YO49P5etYNNysXFdxXmYXarlRsfcVB6k1n3IDy5P94nHapZZA825eCcMD/ntVB5GNxgndk4 DDnNd9Gkr3sc9WYTovl7cDjIIrlWt1QcDGDyfb6V1DxzySDco5bfgetRHT3BYuAWbjGOmema7IVF FbmCT3Rkx24J2AYG3JB4xz+NXBa/ucdyRj8P5VsW1iSwGOo79fapRZ7COQwz0/Gj2sdirPsYEVmy DI6855qdpDaqMkgkH6n2rd+yLv2s559Bjmpv7PtGX50ZiOeTUqrHcbpNnLby8yFRyGB7njNJKJiq sx3Z7HgD09zXUCyRSDBEqhTzk5yaVopAQxAx2GKbqrcmNC27MC2Mz285TcB5aiRRyMB16jjvVY+c XJVW6kbscY9q6d0k2MrFVDLjA4JGc1XiWU8KxA/+tSU7sPZ2MF4pmA+VieTk5/LpT4bW4CliC3GA ADxXRxLcBSqOcMOmM9KTyWL4Dv0wcccU/aWBpGetrcyQhdsgAIwAOv1/Kr+n6Sj2s91cO6SQyw7I 9v31YtuIPYrtH51K0cgVQjP24BNR7bg8B2HsPWs3OTWhpBxTu0T7JHu7idlctO5ydp4Udh9cVvJH bCFU2MPmycj071z0aSyN+7kbAPbtSNDOzYMjZzgHP51lON0kzWFZJ3tc0LieUMUCEZPygAc1RmvY EJQRljkZduvuMfWo2WdY/v5BJHIyfwqAJIcYI/EU+TS5FSs29ESzTNNbs4VAM4Ct978PasdrfzQI Y12DBLH1PXrWhLBg7SSfbrTNrfcjyPXPBJrSM3FHO23oLY21vFNvvmlRAnyPEqyHPTkFl/nS/ZXM 8n2JmmQEspdQhxjOSoZsfnVB45CwUg8DnPH5VZtjJHCYnYAMMt7/AP1qym9b3LhLSzRkfOLgLnr6 8Y96SdpS5JVi3QH29asyqJGIj+faeecDmmsdgwSox+hreHc55FaCbz2aKX5R/CD6/hj61OjFI9gI 3Y4zjIqACNXIUljnGF9+9V5JIUl5zuPHA6Y7e9bzjdkOQToHuQsqEqFGcD7v/wCuobiAT7Xt8DZz g+nfAAq7FL9qDoRtA49DxT23hgxPThfx4NNNopvuVIVON0pyT0z6+lOkKjAGecjAPpx2pl06xR+Z 0AHQ9wf8+9SbmjVXQ4IxtPv64pPXVjkurM60aV74oo2AAkKRn8e1a00FwVIVuvXB6DvSaZZz3AaY kllPzHHXJ4xmuobTfJxPJGcjDHI4Pr+dZ1a6UjppUHKN0zkoHwokGdvbA7VZIc5PP3vvegNWHt2a QlV7lgPQZ9B2qMxyIAZPp/8AXqXK+pyzvcgkYck544wPX3qSONUiySM9gPQe30pSxVCffB4/WkiK n5o888evFVF2Q46aouxLgj6cj0q3bWd1PPmJScfOc8DaMc+wFMtIDMxKsOOfcZrqNB0+O61W3s7u URRSOI5pieiNwTzx0oqz5Yts6KVJysu5YjVW0+e3dhgyxjcCDx8xPXpWDqY3sJIfmCAKxz+hr0rU 9Kjk0HU7z7CNOSyukW3bLZlLNt8n5jhiFy24Dj8RXn2myIq3CSBFJjG1pSdpyRww9/7w6VxYepGU ZTXT/JHXiMO4uMZf1uTeFoGm1F9gPMTHI7D1q/a6BPqTSefJ5UYkCqTjk+mKboEJhu5HJKL5e3J5 ZSTyCP1B7itiBo4rQxWtw6yG5Xa4jBzwRj5vrWeIlLmly9bHTQpxcIqa7nD3mnQ2Wom2ViwXITOR uY9B2qcWUYdblVd0wp/dsCVb3ODzXYRwwOhne3kZg7ZWdApLjA3DtjPO0Hn1qfRNBjuJP7NkMcBm bY0zIRGG6gkk5A/LFRKvaN5dCYYPWy6nF6hp5j5jUgYUY/iJPf8A/VRNphgIYMSAeTjjp6V2UWkw Q3I+2TCPa2zduDDPOO/Q9ulZKI6yvJ5bLBna0YQ71yDgjP5g5p06vYuWHtrLqZJtHeFtqAE4U7AQ cYzk/WqX2cmENktjJ29MH0967ya3tGZUMszsYxIZWXYHfGQG29MdCSa537FE1yLgSW6h2wr7+B+H r9aIzvuTOjsZ9tpcpjeeY7AoDjcMluccCti00K5ZTKyiVXiaTbtYNwDjgjHH1roIdPu5Jl23AnKK PKhK+VJwcgAgFSpPPv8AWqMQv083zJYxIm6S3SOYnDM3zKSCc8ZOG5rN1W/hZ0LDxSV4v+v62Oz8 Pxx29vD51qQq5JkkjBUAHjtxz1q94ns5JZbe4s5EjiNphlUBUckk7SxwBmsbw5falPZF5ZkJ85zL HuZuGA574p/iUWUa2VzfkGEtJujA3ZYDjuMV5coNV7vzPYUovD3Xl5BJ401O20yPR7i2topVUeQg Ug4JBy23gHHXnnvWC0k0Ei3bhUl8rDJkuWVhyVcAANjoKuIbKSMTQs5eTMwy5jKKflbl/lI4OAOa kdrCC6aDVbiE2bIq23LM+V65KrxzWloxb5I77nPKpKdued+i8jR0y7il0sXE0CTgbo4ornIkaRuQ VZCMYHbuf0bum0qQT3dtHnYd1sr7iOvIPODn64rIli1LRp5ZbiW0hFyqzJNBMkuFPC7VO4gn3AIq nJe65eKqancXARAY3SSNcSRlsnpgt9Rmj6td8yas/UaxFlZp3XkjWvpoZ42dIVmeKIeeZJNkqqDj I2ja45AyMnvWc17KbSGS5hAhUkW/lBjlj26gFx71mWN7HCz2N0zloiTZpH8ibmz8rHrtPBp13dyX 4zEkW5SCpWUkmQcNtUHn/wCt1rrjR5fdtp3/AK/r8zlniL3kt2bEEryNFKk5uGXlYHXe0ZJ6FWPT 6DFPlH2y8NvebWaIP5YgZQOOwUf05rn5LqEiC502N3mik/eIBjZ79TkE/gKrRy3NwGUSxxBSWmkz 1B+mSfoKaoc13sJ4pfDY2ykokkjupo5GddohdcEdMfeHUexqC505MJZFXWRssVUdFPA/E1nzLbRl ZAI5ZGXDOGYZ/ull4GelSJvFt5KHfKqne4zhAx6bsgEe3ar5Gtbk+1TbTRDdyXNmExK0ULxmP95n Py846HI+lPtdWv7IfarUSRMRt8wlWTrg4B7VGZLZr8R6kdzcoIckoDtwCGycYpz2i2yPdSmSZl4S NiNuOn6VpeOikYXk3zRY3VUkvrwXd1JIsxAcMSG3jHfHT+VUfLf++35r/hUlzC5yJBIGAx84Cq3o O+eKz/szf880/KtlqlZmUnq9D//S/iY8LmD+zmZlG7zDkkc9P6VgavaIxlt5cHqcgc+oxW3FbQ21 nlBtKqM8kZPAPesydldiWXJIz1PavFpRtJs+grP3Yo4lbc4K46e3T6VCYgcg9cdK15lWKdkXgbs9 fWq08axhdnBLA4ru5DKMjLMQ6jqeefamLG5YYG7Jx7frWiyjeWAyPX049qgJZjlemc8etJ2LT0Kz WoPyN069zQsG3sOBgj6elXVRQu9/vd8+tRuu0c+mfT6VIlJlJYVJ6e/HXpUTxhHHQ9uucZrQfcRu TB4yQarFgRvyCcfT9aqO9mNSuVjEY84UAHt7dKOGAYDtnPNTkOQQe/f0xTUAMRKD8aqdrjT6kZHO 4j0yM9c1LGrZGcAZx/kd6UEAgt3H8qeH3/KBjn0qL3DlGNGuDJwRwcAn16U/ykJ74AH3jmiNlMgA B+v0p7NyBngD0pA4dRpjVz8gzjqT6dPWhYSRwOB3/wD1VGpwucdT1HGfb/IqTc+zJx6cA/z4pqVg 6C+QBkEdeOuMfSkWHgnPpwR2qTzHzt446UpY+XvyASSNoHpS6giLyYyd+3B9e1RmL5D0yPyBqwGO QCT82DgHt+NSNGMYXnOBn/PSgaKbQcbfwINAGAGByT+HT86ueViPBOTj7v8Ae+tQEdCeMHj8PSho GkMRVYbSMDH19aey7jgY64yBjIPrUyLvBVs885PemlWA3YycYpWEtNBi26H8iTipbmyCyDA4PTFL k9Rjkcj/AOtWhLKxtkRhyDyw9KTQ29DPSNH/AHZznqBjpW1pkiwB42GcYOO9ZywqpLKRyMe/51oa dArZ3sQo4zjNVsY30O5sY5LxhDYRuTIflTOTk19AaLpetWGlxQY2gQru3YCqQe+e+a8G8N6kmhar bXjgyLG4bBBwceo5r3z/AIS2/wBQukgjRRG1uLhnG77pOQMYr4Lif2/NCMIrl3uz63h32KjKUpO+ 1jltZlvhmK5j3qp/h6H3rzLUNiK5aPOV6k4r1nUtXYsFZFQOCQFBz+XvXmepRxKxDlmJBJ4ArtyO pbcWaJPVO55VqDh5/MRFUtjKjpx9ayGVfNOTtwc9Peum1+OwRllhV1I+VtxyOfTHQ1zhKk4J+mOh xX2jlpsfLLzEdS4wv4HmkjKoCGGc5GfTHfmpFAGV4x7Ujg4/d4z0+lZBdXsIvIHA65yeakEZ3ZAB wc89/SlhRtnzDnqcUsjeXynPp+dVbqQ276Em1ArKwycde+aFQHAwMEdT6560obcvP49uSabHICRn Jx3Hf8KXKO48LsVsDk/571IjDBJAPb5ar+YPUdetOWRRwp9cZp6Et9yzujaIAp6nnse35VnSY80g H256fhVgPmPn6Z6VEcDPfjn1qrWHGoOGxWABx8wxjtxS4O/6GkBG7BIHTOB6047Q/HOeSRU9Q5ro kQccHkDt1qMLvmBGQdvXPf8AwqWDAchzmp/OiBOMHHcVUok81jufh3aafPfTz3pTfEqeTvwCWycl fUiveYoFPzOd2OQPr618y6DcRJqdszsoxMjdPzr6etp9Pa2d42UMFOBnng/WvzDjPDyVeM1d3X3H 6PwhWi6Eo2tb8SU2w3bowAxi5HfkdDRFbwyKHQEcEFc5Xj8Kijmh/wBbuViVwcnj+lWI72IRNuCk AjkY+tfFzjJI+rg4smdYIR9nD5GeM9qbdWlrNsZiSSoYjsKs2c1meGSM4zuJ68jPJqO9ns0xGjxj BxhCAMHsetRRqy5krO5c6cbNtnN3tnFCXKbh83GTngfyrFuNOBieNiQSp4BwMc10t5dWpkb5kIye MggfrWZcXVkIcyOn3eTx2r6vA1JaWPCxVKOupwl5Y+VBFsYk+YF/n/hXneqph2kyCM9vqa9B1m5t 5EjZWBIbPHQjp/nmuD1PytjKpJyw98etfdZXJ9T4rM7LSJ5bPxcSN33Y5zwKjTPluOfugDv1NT3M bJcHd13E+2M5x+NSyImd4HYcD/8AUOK+i5rHzzl0KCMuVAzkjnJ+n860YptrhQCRjnPI+tS29sJF UHgDoMc8etdBDax26hiPm6njtXLXrJDUHJ6GvoHkQXcdwwUxuucEdvpTfEMtjcThLZNirxlec1RE z8xx5+gA6f0qBwplaMgEg445xXjqknV9pfU651rU/ZpEaJtUMxPc4x27VNCZI5Gkj3dOQegxjNRj DOAAeOCKtKy42DPzcV0uW9zlSd9CwtxtBJyrEc449qu22tbJGgZDg/3f61T2qsZwMttHJ9qpJIFk wOOOf8+9YvlkrM6FXlHqaxv1jkbd0HTHoaj3guGJ3b2CgHHesOVJpn3jnjkfStbTbWWWSOOQrgPu ZiR6+9dLp2SdhUqrk7Bq4azl+yz7QQM/L0Bqn52yEu3VjwT2FWfEksZv1R2D4UFue+elYksm4b2G B2HT86l0U7NGdWVpNIngRnOc9eB/n3p04eC7XccB04X056n8qgE6xxs5xgjHHGPpUlyvmeQYy3+q 27j2wTzSitbsVKxvy3CrC5YquVwF9eKyr5JjZFJNoK4AB65qpKzNDmXcSDyQMGor+8Ek0kAGM4we +do4qaNFJrlRcpOzTM60u5lDPkjkcr7H/Ct6Lyrk+dOxwMLgnngdqw2j2xbwBgnH1464qG2l2RnO eu7cOenSu6cU9Uc9OR27XO2yVocnGRk/rwKzru6AuYw2MFQMj39B7VmWz3EsZiwyqVyT7Vet7WFl 2kEkYVcH5h+P4VzQpqLua87eiLqRxu3nMSpAEeOMcd6ntIIBIQyFlz1HQHv3q7b6OmwM+9gcHB6n /Cr6abKSAEYBjx1OaipXS2Z2RoO6bRnwLGDhwCu7A3DGM1fisrczMjYwV+X175qaaOVeCvHTOO1O SG6m3PCAwVdxOP4RxXn1ZXszqp0+liotrDFlyoOAdiA8fjVMttVQEYuWAYkEAfpWhCXfhADhsZz0 NWHLNIIpSR1z3z9KqNaUG7q4nSi9UU5rS2ERKAk7hye/uKWKJQWUcZPVvp0q5DDLLdeREAWCgAHo R+X51cuBLFvglSNWTk8bj09ayeKknY1WHVrlFNNjkkCls+hqT7NbznyScBCfvDn3/wAip7dmaPEe 0seF3dOe5pf9Ji6BWYnk9MU3Wm1YapRWyGnTLTJ3kHABB+tI1lYKoJ7g8KBxj1qH7bMrgAZySAM9 s0q3kwlOQuRnHoat+00ElT7FK9+yWSp5I3bjxkfrTClkF3nec9RV03G3LbFJz36CnW19t48pcHrm uuM522OeVKFzMkktbdVkTI3DpjOPSoY7mySPLL8/Yr60up31y77GRQSc8D36cVlz2lzbkNKB82MA Hp9aqCd7M5qn93oTXl5FKDFbKQM5JPrUUD20sRMrNlTxnofxqkI2cbgpAzk4HFaVhbYkWbZlN2Sh OMgdiferqysnYwgnJ6o7nSPD2l6pb/aricwsONpxz+uKXTvB66vIoguUTcxX7uTwe/Nc1bxxX9zm FQqqT8rds9Bkn1rpLfSLyJTJbZPOFKsAQcc//Xrz69Sor2nb9D2KNKnNL93t+Ji3enWNldvatIv7 ttpk7kj2rHaO2WQrG3AOAfWugntSpPmQuz8nLAfiaqixuDFkRkKxIVgB0/KuilVVldnNVorWyObl SJpPnwOOp7getZrnc25BjvmukudI1OJDNLbkqBjf2HvWMtvMFDkEdjWtOS6ann1KTTs1YxmQCPzL jacc5A6n/wCvVNwzYfH0AOSK6uXSb6Ntk8LKCMDPc1jfZG34ySRng10wqq9jnqU5LdFdY1B3c5Y7 eD6dKhmOyUsFDAAcAc5x61qJEQCi56/eP8qrm1V8h+gOMDv+NbRqK9jNR6FJGkZAehPcHpTnjaYB SRv6ZA4456+tWPJ8tQIl6DgZ455/OqkyNGmMgAnA/Dufeq5r7FcupE0qzSGJuiEAnpnJ/wAKdH+8 uBHyozkZ7fnVqGzmk/eBXbnO4Dhv8/WrFsiRFmdGDZPBHIpyaG4FgW6xy5ic4C8k+tPM8jxKo+9n kE5BHFTBWKkgMTjgAf1qgyun73byRg1y2e7NU2lZDf3pZuT9B9eafLkYduhGcetOC+aDHkgbeppJ gzDYvIAxkjGDV20REo3RV5ZGVjzu3KBwfepYAI4ShBIJzmnQRr9oXJG0ZBPqa2Q8SDngKeBitUtN CVTehY06FFXdwePXrVqYokZMaqxIKgHtnvWes0VupU5+bJ4HHNZgupvOHzHAPK9uenNHJfdluVlY 3V1F3dUufOn2A7Y5JSyDjH4Y/pVaYILGSXCr8oD7uSeRkfQ1nxZGTIQATgelTuY3QxMwYHjg9KpU 0loXGs3qyexvo4nIb5srjqR8oHQ/TtXRRz6VaWkV2Y5n/fcfvMAbR0PB5zXDLI9rI+CCAo6Drjv9 ea6K11GXyQszCRW/gZQQc/hwRisatK6ujejWsdQqNdRrfxgANk7nf5VQ9Scjg56VrWllF/wjV1Mv 70HUIk3u+cqVc/Lj6d6xNP1axnihS5iZo1VkKpsVfmPVgcZOOldHZR2y+GrtYpN0YvYWSKRdrbQk mMDkZ75zXlVYyWj01X5nq0mnZ+X6GDGgWzU4/duDGSQTyOSCp/Q5+lWo4rgXCm8DxKlqUEkDBWUY yrlQeAPfnHvUNlPfT/6Ta+SLUqsUssr/AHT0zyflb0xWhdWENrFHGhZZZZPLaVCHYRtn5iM4C1NR +9y9wtdXXQyYoJRpypAAsplaUMf3rSKB1we3rgVQudQIto9Ot1iiO5zcAR/ebPX5s44HQV0CSxaf O0FzcSRkMoS6GS0gGQxXaDgfj9azJ7WOO5nvpVji3MXieV93zEk/d75Hsa3pyjduS9P6/qxFSNlZ Mntr/UJWis4pnfyjuCyjIcfewF5wRnAHH1rPs4LK0mk1a5kZIizLsjO4sXByoU4PHvV22F80wiQ2 slyZQYmO0tk8EDGMD61o6XaWl7qR0e6WO7ifDuysVkRgM/K3G4c46fhUzmoqX42HTg5W/A7LwY+m TaaW0tZQXfa7yoPm29QeTxzVfx3DDZR2ViQXaQs0qICN8YbkL2yAeah0/wAR2GjafFYaZbKqozMW ZyWJbuaoeLPEL6xpNnePbqpSeRDM+W4IAOD2zXj06NV4nna0bfrs7HtTrU1hXC+qS/NXMS3nfUb1 reeSM2VmHm2szP8AIB0UZGT0xzT7q7sIbmK9lRBacr5QjDnlT3PfPXnrVeztIrZ2WKSFYFfdvB/1 hUZ6Hn8+npWxai4B8wRrFbjdNBEHAJfupB+8D2PbtXoVEk21/l/TPNhGT0a/X+kQW95DJbrdrbJd xJ8qBLfayPjhm2/eA+mKyr65WV0fVEkeeRmKyTBgqE4AJU/5wK6qTQtQsZJJ47ZjcTNteFnKqynl jHtILdBxnpT28P317Gby3mRjI4LJvIZXYcgD7oHr396iNWCd7/1/X3lyoVGrf1/X5FC4F/A76UAU Cs2x45kk3Dj5cvxjnPtWB/xK4ropuVVBCgKhJBHdjgd/StvUPC3iKGCS01RWKttlMpIzuUYCKe4O T37VkPod5HCJbeK6eOLMXm7VK5boMfpmtqLha3OvkRXjO691/MpWltbmeRo4s5bcqg8uo+8MAnA7 1HbW32WSWSFWY5IBXJRV6kEYzU9raQ/aRJJiJoVURqJD98nktjn8jxVy+WaTfNOrzSuAVkiOI1HR sk9h6frW/tPestmc/srK/Yp3V07WzIEidF+ZmQ4b5uoxjNQwahPcxiDYNidmJIx689Ks2B2t++/e AnEbxKNw7ZLe1U/IIuZbcrMrAl/MwTu29MfX60JrVNENu97iw2apOS0jyx7d4UA5XHPXr9fWpJml 1G0dM/LuwwWLk9x0NQ3U08cQgjBVWGNxXac54+b3pkF2luqwzMZJ0Y/IhIYZPAyOKtq/vEqSV49B Y1lhUqi8KAmHYDGfQE5zS7pv7r/99L/jQLRb22knigbzfOyyTnA49COuDUP9n3n/AD7W3/fR/wAa SqJaMapuysf/0/4j53LW42tkEDNZABflsnitO4haFhGCDkA8dsjPWstoiH2hv9nOK81JdD3Kt76m TqMRUC4U8ngistXLIHfk4zjHeuhvrdmt2UHGAABiueMbRbUzjuQfpXRB6GbQwlsFDkcelMDEAqCR znBHelZ3L4IGD1Oe9MJ3AgYyDkVnuzWOmjJQM5yevU0Fi+A3b0GM1A7bRu4IHQD+XtUzR7sc9BSE 2mN8tQQq456n/CqMpVtykH2HHatDZ8gXvjOfSq0mM7+hIPPfpVNO+hMZlZX3k5GMnipY2/d5IwT7 E1CFBYEc49frUhJ4J6EY4Hany63Lb6IYT83zEjpj3FOaIlMqf1x+tDFsgYI78UZ3fLnIzj8vShwG noOD7ZAffHI9KfJIGOOn8Pr2psWegx/s4606Qs2ORzxzUJDexWx5YBXnnGP/ANRqwJd+AgPU5zz2 qEbmbAyMdP8AGpVf5cn169O1NxsDCRCxIJxzgn/PSpWVVBj5O09fX8Kjdd+STjJ704b/ACyQcZ45 9qVhkq/KdxIPQYFKCQ2CRwe/9Kq4kVt2doJ6/wBaeVBb5iPXPpVOOhKmiVuU3Fhwfz/Co/mADMMD 8aMkA7eeevv+tNkLFdwzyQGPpSa7DTLQlVuAB26evan5UE5HBGRnjmqa5Dnvx/8AWpvzsxyeOoGO nFW11QrdS4ZQR8nXqeP8TTpH3nnvnAHTiqobaCDnnPOeKnY4jC4wBz+fvmsxbjyxA3BT9M/41u2C sIASPvcntWDbr50ueg7rnNdDCf3g4OMYpMzvobqJIQGx9Bn/AOtXrWj61Nb3C3MsTFI7KONgmTgY GDjHFeY2r4jChSQBXQ2ly9188hkj2rtygJGAO+D6V4uYYeNVWlse1l1V03eJ12qarpd9cxXNuw4G SrHnJHTpWBfwxuQ+VIZTxz8px3qXTYLe6tl+1rvJfZu28sMcH2qtd6XtytsZAwBBXdwOPfP868zD wp06nJFvQ9KtKVSHO1ueaa3GRGwYA88Y+tckEwPLPPHYc4Nd1q6yNHJE6gMFOCpz24FeYfa7rqm3 OM45zX2a1irHzE4+87G0I9oySM+g7/5+lIFAXafX1rJN1dso+Rc96hF3e4LKg9jn/Gs7dzNmzl0O zoSQffFTEkKT1OTnmsQ3t4VCMnY5ppu7sHdt4zjArTl0sVJXZtja68Ee30//AF05mUDA/L6VkfbL peBGCOmf8BSre3I5MY45BqG3sLqaaxKRwODzmkQKvPPXArNF9cFiDEMkdc9BSLfz4+5+vf6U+TS4 /I1duxBjFPRFJzjHGeeKxxfT7v8AVnOegP8AWp11GUDmPr7/AMqH3YuUv4G49/6VZHb9P/r1iDUp eSYW4GcccVMdUlBA8ojv1/ShLsSo9jS2OXO314OKcU5+Ue9ZY1S4K8RH6mj+05wobyG9wPeqtdFK Oh0ulxu2pQe8qD8zivor+zpI1G4BeTnHrmvl2x1qaG7ilSJiVcN1HY17XcfEi7eDy1sGHTgnv718 VxRhq9WdJ0lprfX0PreG8TRpQqe1djuEs42JCqWHfPb/ACa2otHd7NQ6lWZxgdMjHavFB8QdTQbf sz4Zg2R2wa3bz4oX0hg2WswEb55/iGO1fI4jKMZdKK09UfTUc2wlvef4Hpn9l3YJVFOM7mxnp6Cq LaTviLTRS5Xdk46n1NcTF8U7gODLazMuDgHrUEfxQu1tGge2lO7eN3XAbp+VYwyvHppqC+8urmeB a1m/uNi50u5n2NDFJ8pXJ2+lU7uMLdeWEH3CQrdevXmucb4n3n2dbeGGRMDG7HJxXPXXjOS5nFzI k28KU3AcbT/WvocNgcVzfvI2seDiMfhl8Er/ACNvU9jNgAcNjA57Vg6hcpFEYgPmAHHpWFceIGlD TLHMcnuO/SsG51OeZSzIwY9Sf0r6rB4dxtc+exeJUrpGZO3m3pU5/wD15xWjLBIboBDhTgfMOPTH +RWCjSi4Mmfm64xxmtaGfZ2BYnqea9Ws3fQ8dLU30t44BnHzdDU5lJ44AxnjOcVji9LLnGe9P+2S BgNnJ4/z2rzZwlc6FJJG/YMr6nFLKQAVOcjjgHHFU4YUiuxBI2MNhm6YxVOC8Pmbn+UAfKW70sVx pwuJrmUu7PJuIzwPTAxR7N2ZommlfuWHiaNyyjcuSNwPb1oBZNPdyMOs64PbbtP9RUq6jYtGBJkK xwCCMj9KV7rTHi8qJyUDFj8wznGMfSnNMSgt0y08sclirA9cBvr9P1rOEYM5Yfd9u9AudI25V2A/ unBz2qwL3SxnbLx/dGKinRcSpwTsxJzFDGpPAC8nHvXPX1zOiJKcp5qHaB6bvWtx57GRt0rgLswM 4OT3NZNxDpVwVzOflyFyRxzmvRoy2uZzjfYxY8yFpBnk4PHGPU1uusckhycBT0I7fjUaW2mof9e2 AQSOME1eZLMsXknCnujcUq7u7I51F9SnNGWZlHTHtituzmRQkXB+TleOMemay1igxgTJj1/Gl3Rx ygq6YUY3Z5OfT0rmq0rqyN8PU5Zcx0cTNIjMBFkngZwTn1ycYrlryIJqf70kbxuz2OByO/Q1bt76 VQPmUZPIU4+vekvhJegbQoYN8pyTgHr1rHD0pQm77M7cRXhOCtuMRIpLCVckMFG3pwCeaZYwL5Eh hXOwjc/XApxs5IoHDMBnC8ZOMc1Z0Z44re6t2b5yobaeM/ga6HFpO2pwxgRtMPLKKMep74rV0MCO QTYDAEZH+elc2bn92WCtnIyB71q6ZfxxwspUjJyMjNYyptIVGVpXZ6O+pxzRKsiYw+F24BC9h701 NRjjhMcbEMG+VhyvFcX/AGpE5xuxg55HU96b/aUBYxBscZ9PwrkeF7Hq/Wzrbt0kjXk/vOWBOR+B FOtr2O3XchJJUAc/0OK5KPUo2QKXAHTv1p41GMKdrg4Oc5/T9aTpacrBYhXubMcyeY7xLls5GecZ q2h81TI/DEcEdq5kapHtI3Dp8p7/AFp6aoNuNwzkYIPXFOUJbhGsjpk1CeBQwwCmcEjJA9qhi1u5 vGbz9hyMZUckY9awm1aPH3geSSKhGpQqdysB9Mc9jUU8Pu3EHibacx0lpJgD5j8udobGP/106e7d 5goIXfxwP59K5pdXiztZgx5APTimnV052SL1z24rT6vO97EvER7m6I2LGQ+/XtSeWhcMx5XIwOv0 rBGsoBw/UYPIAoGqCQ5VslTkDPetFQnfUl1oHQeWrEkkj6VbJjYce314/wAa5v8AtGM8yE9OTnp9 KlF/G/fAxjB71fspWJjViXL1Y4286Qk4IIwBkVGbuKVxIFLDkHPSmmaGUFSAw+venN5H3QAB2PvU RjZ2e41LqicSRhGWIfe+8ff8qWN4cKGk2hm4BH+FUiYCScDb069akd9OUA4JI69euatpbA5X1O20 XTBEdqKj5OSzMQOfw7V6BprW0ZLN5UhG1QiNwPocc14+mrxeUfm4PG3kA1fsfEFpZzLOwUhTnA47 ce3WvIxOCnO9z1sLi6dO1j1E+JNF1SGe2W3CSMCHY9SANvHbp71g2WpwaVB9gleEEMdodgGAJ7jm uLsNasvtckgVFJU5wTyTyasRapaySkTiEcYJKglvxNc39mxjeKWhrLMedptq56OfEtha6aLS9h/c klgy8q3HXPfNcz4kfS9Z0ppdNgUOFDLwN479Afb0qlcpYXNqrSTtFsUAIhABGPQ1itZaepBgmkbc vzHOMY9MYpYfCwjJTjdMrEYyclyOzR0X2X7dp0LttVzGMF2HBx+HevLdduWuL0tJGqOAI5Ah4yvB P412VlNBaSh2kkcqPu5BPtXD3cFxNfySyx7NxaQkdBk8V6mDjyyd36HjZjNuMUvmZBIikAJ4J7VI dhY7BjOB60gG+RUxux1C9QKeU2qVAOMn64969OzaueNbQhaJQNvXrVYxKGwOWz9aussiIGfODypx 1x1FXdKg824Eh5C880oya1KjTblZHX6JeQxaWkBVQAOcdcep96x7pfNlZowck9MHJ/GtY4xgAKvc Dr+VUysSXO9mPQYIGfWuSkrNtHrzjeKizPtbd13xuM55xjPX9Kq6pAkSAx/ezhlHtXULbtKxuSww 3zA9Dwe9Ur2zB3mTncOCOxroVZGDw/utHLadG4lDMhIYcDnmrN7CyliqjB5ArVgs2EKEkgryNxxV eW3YAnJYkHHpz1NaKV2c/s9LGPBDLtDbDtz/AJNSSQygg7Rkt0Per1vDPIvlOcIM9+KFtmX7zDrk ev8Ak1cHoCp6iR28ksZ3JjoQMev4UySKBVRdvzKMMMda0EWZAUUggjk5pvkS+bv3JwM8GtFLzHKm jMuIoxt8te+eR7VHhWXykjQfPu3YweRjGfTvW00kh+SQLjGRjtWXKGXGASOuOuKtPRmU4JFe5hhS EQsvDdWORzWZBHcW0xhHXqHHcj1rWxORyWPtTXjudwD5IPrSg2twexX80GNVXDKXwx4wSvp9K7/S S8vhu8jQhTHf2pQnHGFkFcMhe0iV1ICqzEhsHAOK6LTvEFumi3NjLIoeWaCZOBn5N2T+tZYiEpL3 e/6m2Fmk9X0f5Glp+naxq1g401PNjjYSXChQcMOAcD8qhnW+tFSS6RQ0cR2cbcDPQ9cj2NT6F4u1 LQklh01gq3CqJMDnip77V7y/Kyy4ZnGWbaOe3PFcrhU5tUrdDsUqbho3f8DmvP8Atil5dgWMZUAY HzHnpim3F00xKOU5IJIHXaMDmtxWkZQHTCkjPygZOe2BVVU/fbGjXmTC5XjbnFacy7GPs3pqQW95 PPLH5It0YOQrAY7Dqetaa6hd27LfvDarImI42UEfw45AOOBUzxRFdgiRl3buF749az5GYR+UkahS 2SrL+HrWMUpdDSzirKRTmlmgJ3JAQpAHLcg9+tar6zNeaImjyKoiWfzQkefmbGMk1lKfkcsigAlT kE5A6DrTPtUUUn7uFFweePrWkoRbV1sRCpJddHodXoOq6fYxGC+soLhI5Cy+YGLDcOQCGH61sah4 m0CeVbpLZI9gGxRG4UFe3LN+dcbFeKEkkZUJ6kEcdqvabdWnlPM6R71Qnac49siuSph4uTlZ39Tu pYhpKKat6Hoh8Vw2EJ1FbywcrEQNxdpiDggdBzwB2rlJLw6w0pRooxJtlLBiuCOepPJIPP4VjXug XUcEF8bfdHcySKw5wqgZB/EZrGt7y3W0KIg24ToeuRg9fSubB4anZyi7u/l0f+ZticZPSMlZf1+h 2dnq+uXc88LzgwZUGKVywcqRjHU/iKsMb1PMuJRujwAsMchIA9cY4+prnVvrawtAzW8isW+Q8hTx xg8VXg1S2soRM0TEzKySKHJGO3411Oj2iZfWGvilfr/WhXs71lufmiMjgFFbIVl5PQ45HrmtuSG+ iO0xqMg71LA7h26DisCG/sm1EXEEJUMeQzke2a7CHUWuJvIMirGylCV27V45OSM1pVhrdRMaFmnd nLQ+aInzHceQ0rFAnQEdfz/nVa8V5YkuGS7jVUCD5xgAfhXVWt4IdLMEsh8vPyovUEkgkGrx1CJ7 RxcRiNAAkQOMt2/+vmpc2pP3QVGLVuYwY8RaZ5s0cwRFDRP5gYsCeSTkAYrDvdSW3WOaO1uVRVKk 7lO4HPXrVyWfTI7YwMZuWH7sMCACOeKy1ubKXKw+ZAyAfNkbWHA5XpmuiNJX2MakltczLbxIlnAY oBPgsCFfaQM9fepv+Erl9G/If41TvbO1ErMxdGLAYUA9uvtVL7Fa/wDPSf8AIV2RoU3rY5vbTWiZ /9T+IzUSy3RKkZHH14rIcyeYXbGVz071fvmllmfIAIPQdKy53Z8qozx6968yF+VXPdqP3mMupZGR gMdABXOSuQxaTHy/L+J61vXEckiBV+9059qyb23eKcNtGDyf8a2irkNlEOsmWUD9fSlUxl9p67s5 +tAJ37AnQeuKVSmz5xznPbg1LG3fQkztX5vU/wD6qZv4G3AGKcxh2jzQTtySMdTUL7XkDRLgY5JP 8qdrWuQ1ZiM6jG4nB7DPUUyQ5j3ADP8AIfrUoYL8rKcjBPHX8qrvGyjcR65H1q1PW5XLoNZWK7sY A9Oeppw465yTk98ewoEZZwvTjjFSFC3POFpczKiioTsQccggfr7dqV3cYwACMngj07VJJiVfmXnc OTTNrMSAD19+lU3pcAiO5snsPy5qZuPQY9+fXrTF2ox29zyD+tIyIRuOchuvpUqAK70Ebk5xjuD3 /rUQJX7mM8HJqXkYUD3yeaVdycMMj+I1NTWzHe2oYdgQuAakAbyxkYHGDn/PeldShIiBHGMnBz60 0bmjCqOcf5xVWSNFqrjGU79ik5/kKkX5jyOc9M05Q6PufOSeo9Kaqh2557gYqeboZWtqNdX+6p4P JyeT/hTAQ3GMZ9O9OA2yZHrycd/pSrkttY8Z4P8AnpUopeY6KRtxJ69selIGkBLbeAeeafsUkjJJ PfuKj2kKVPryCKu+jY3sPVsR7ZOPpn+lKXcrtzxnj1NJsAwr855GPcelOli2NtUknPOefwpJEcxa sG6tgk8Bq6OEq3zcjjJHUis2yiWFdp64zn3P861EDY3Dr1yamorXJ3ZvRShMKO4HPqRmu98Ixidn 2qzuOW442kf415zErEAA5716p4CjU21y5PIwAM4z1rwM3qctCbPaydN14o9AjsokjW6WIFN+GYDp xx75xXI6t9kjMs0OQC2VyOvGD07VuxzCOFYASBncecc/jXJ6nPAshiLKScnGea+Yy2/PqfS46a5V Y801QATFWB+Y9T715NKNsrRLndkrkdq9Z1R42YkEcdMV5jexMt5Ih/vnp+dfo1CV6aPha2k2VzuV h5f4moxuCbnPB556dKkKkY2YHPP+NBVe5YgYyDxV1FoZ8txgwVxj3+oppAJJHb+g9Km8oHBXPAzg /wBMVMYmDFnAzycn6VL2KtoReWAcgknoTnr+tJ5ZxhcHjgHPSrgRi25j2wD9KkSMEjJ9+nTNTz3K SMwxckDOPcnrTxEw+U85x9K1lUfebqOv+NIWC8kGpUyXvczEiwuCOScYpPLkDe/+FanmYU4A/EVE XBbK+nUD/wDXVX6C0vsUPLwxAycd+3Wp2gJADZGOufapSQG5J6dhTmmYKDjPQ9v6f4VVymuxXWFN x3e2PfP+fWnOoDb2PXr35/n+tWPM+YjAHPSoXOUAzn0xSuCZd0+NJLiNj0DLmvTGQtk4P4Hn8a85 0gq0gHcHr2zXoaySFfQ+3SvnM4neS8j3MqlaMhvlBSWPpU21Nikccg9epqtvYEsTkj0pCz4BBwPT A/8ArV5MoNnpKSRbGzdxgfU1W3R+Uyg9QelRsrE4DAenAqCWMjO0p/3zTp0dTKVRkch+QDsPoelZ 06LvBxzt7/rU0nTc5HHtxVOTaQTgdOtepSo2Z51WVzOuFBB9SR+BrKu8BT0rRcAjsATmsW9WP+HG e/FetQhrc82ZzpYCdiSSM8VZaZy2cdugwM1nTHEh7ZPNOBYjbngD6+9ek6dzB6GtFc4H+B7VaFwz dByKwudw29SM4NWMsPmOc9f/AK1YTpq5F7s3oX89/mweOnpUW2NpCmMgtkj6VRhmCkFsj2HvSs4L 56c9ayULM0uWy0Q/dqBgZ9f5cVPiEw5CgfNissN0Ck4zzUvz+UAuGGTx6CiUXsSt7F9obcIWAGTj v1x+NMEMJOCe2c96gXODz25/KplYlPnOc9fpRyuyLCSKERhBgDbkD3/+vVYwxMyk7sY7Z5+laGwY XJJOMAY61XZSyhlyB61roHMVJoo1IUDjvk8/nih0QyEkZ7ZPp+NT3CjdlcnjntjFRBXkO2ME+xP4 1PM+hPOQiCM8LkYyKnjtFZ1K4zjd+tEUEhJ2qTV2MMjhWBGBis5tpXHGz0IYtODArnHzA/8A66c1 rHA+5SS2fTrmtFMhMCs6dmZ9wxjnGaiFRydjWSQRIwtZCpI6Hr+vNXbC1iaKaeUnKAbcHPP9ahtc +QQc8jGPbNWbcFImUZwx6f5xWjfQy59dSmEOzaeRtPToTmtOzEZGyQdT3qNY8LgYGOMVNENrADOB WTnuTc2PsluUDLjoc+vSo2s7VPTOPxp8bqFz75FI0ykZyeTj/wCvWO508yK/2azCfLjI659aPscD cjg5646/SoZZWB4bPQdOfxppuD03fjj/AApa2VgckMWCLeQ30POKdHbW65BI9ME1X81d2SQT9KBI rDPTHoP0ptMlSVh72lvuwCD6MD3qEWaA9DnHrSrKpO4kelO8zZ0xyDz04Fax5rEjDp8DjkE9utQN p0ZJzn25P/1qtrcI3yY6d6YzxlgQB6jLVcZPqK5RfTo+xPHrTU06NepPJ/yKvnHLH9OajLHG5eMc VXO9kJtkY05Rj5mwBzk1INOwflLYI6E0jSO3I4GMc/4VNFKRjB7DnJ71akxva45bEp/EeMZwf508 2Kn5ix68evFSOWcZDZ9+9RAzHhXPTlcVEk73JUkNaxYfMrtnHr+tRGynCgiVs9Qef8akeecKfn/E im/aLjb87Lx93C/rVa20DnRH9lugh2y84wSfr60n2W6ZdpZyexDHNS/abjGEKFc88Y5/OiO8uFBy qE5x1/8A11N5W1HzIijF3Cc+Y4I6leauLPfW22V5jtf5QzL39DkYqOK5k3fMoHqRk/4Uklwkg2yA 4zkZHQ1M/eWw4M1ZTqiIC77cgH5lHIqJLq/A++p7/dGMVA2oCSPLl/b14rS8RWE2hvAqTWl3HPaR XKXNjJ5sQMqhjEzYAEsecSJ/CeKwcNVGXU3TbTkuhAlzf5Yhk+6QDt6frVeW/wBQchZJF4GDgY/z ms5NSlUYaPA6ZFZst2zSbskewHWtVQjfVGE6z7mh9qm35OM5PI9O9SPcTdODkcZrMRwZMZ688DFT STAMFVB074znNa+z00OdstC6uhBjGVBG0f571YtbzUMYTbjt2wKyjcFlxjHbk5qS3uXRtu3ODyBw apJW0LhM3Gu9QK85/BqgN3fK2CD9N1Sw3RdfunrVaWaQOflOPQUowtfQ0cm9bkq32oDGQ3HI2tTv 7T1FJN+12IHdh/8AXpi3DjnawPTNNlcFcgkn0PGajlW1hqp1uD6rqzMQVPt8w/Wg6lqO0l1GRyMd /rTYpUI288Dk802eUIPmzjGelOyWlhObGNrWpqufLXA9P8KhOuagG/1eD0GaqrOrsdpfp/Dz07VC kiuSuW4Pv/8AWrWEU1sNzfc0xr99xmPHp34/Kg+ILvd91ufb/IqlGyMx5PUdR3/wqyGwOcbRknFW oxXQmpUatqaNvf6lfkraxlsLuPsPpxWpbrqjrtkiO70xyDWFb3CwOZI3wcYyp2mrp1i75XzZQpG3 hz0rNxeyBT7nW6F4a8SeKRKfD8MU5gdUlTzFXaxBIzuIzWxffDj4iafZtfXlikSpncVdHwPwPSuQ +H2vS+F9Rm1C2uLiNnwNquNrD/aBBzXoHiz4l6nr2nGxe7uVXcG8tXUK2PUKAa8yu8Sq6jBLk7u9 /wAz2sL9U9g5VL8/qreXQ8i1OK4sT5d+AnJOwkbvzHaq1npUsqNMkDSchUCn7uRn8TgVU1BBeyeb IXPONxbOeK3NO3i3x5kgCYXOea9qTslY8ecuZ6GNIxhZWnYR8cAZJx9a6i1tdWMayW9u5jcBlfee fQ9O9cxNpRvZRJNKxCjHPQV2dnql/p+nxWUU5CIu1RgHAHQcilUeisRSjZ+8UdQt9bhiDyO1uu7G XLMOe1bPhnw74u8T2sraHaXGpG3bEzwNtVQRkcH2rntc1DVNWhEL3JYBt5UgLz+Fel/BjxafBMd+ bmYoZ2Rl5I5XOTxn1xzXn46coYeU6cU5LoehgaVOdeMakmovqNHwu+KaQC4fSr2GOUfu5XJ2vk8A YHNctH4f8UWOqNZ6p50nkuPtcMIbzIh1IIxxxnANfWh+L2uzeE5Le11GBNy/uFliLCNiQc8givk5 vEPiOHxjeat9ry9whW5kVmVZj24GP/1V4uWY3F1lU9tCKtta/wCv9XPVzTCYWjyOlOTvvtodF4ks dE1LT7a48KWt3D500it502SVUDkr1HJ4OBmvLZ5dStd0TGSONfvKTznr3rtpPEd2Yv3CwoxGAUyC Me9efyTSzC5bU41meVSI3YnKyZ+9z14r18GpRjyzV/nd/ieZj8TGrPmirX7Ky+5HWaBpt5rl3HZL dfZJJZFjQyEBSWxyzfdUepOK1bzS49NDW818k0sUjRS+XnAKkg84ww46jIPUVf8ACeraSPA02j+I 7aC4ZZGazmjVluoi3UbwwBX2IrnPET6W+gw2ujwsLjzsyzTH59vYDBwAPpWU5Oc3Fpxs7bK3rff8 N+51YaVOlBScVK66t/l/wToPEXxH8Ta/pNvpV8sMSWg2QmAfMRjb82WPbrxXDW0moSho9PVpCmNy kAY5xWZELhEXz0BOOWyf8DWdenUnnC2vCADncefrXs0sHSjG1PT5Hi4jGVKkuabb+Z3OseJtUuLV INWEUaREDdGCSSOOnPT2qr9vk+SNpPkJGN0RAGfwrN0IXFtcvJqarLA8DK8RGcnqCPQg8gjpT2lh kA4kCn+En/8AVUYbC0ruFrWHVxM7Kbd2zRk/tSNi8aRMi9ShGQPXGaZa3F7dPILSRJHUEiLyypyP Q8AmsW6vXtoT9gRwxPVsEDPXvVnw9q3iPRpn/s8eZ5vzyBlDDpjIz3Harq4VQTasx06qk1ds6TTI PEMyHz7WRnKEALGeV9RWm0OqW8PnzQsgRcbmBG0dOtYK+L/EEVr5QV924nzD8w56jGO1SeINc1KT TbKJEkiNxC7XLbQQ5VsKAAen9a86UJuSTSSZ1xnTUW7u6I3Rph+6VXbuQap3iT2J+z3MSq0oBA3A +/rxWRY6nqFqpknJAOAFVd2R34rV/tFMeZJlvXenOPSupYfS7ZySqpkM0d7HH5Elvt34bJ6n8c1T +xy/88R/n8ayr3Wbq6u5Bajy4wd20/KcjgDnNVP7S1L1/l/hVciQnK+x/9X+E+XxLMdzyISW9DVQ eIJC+5EycEnJGa0JraEsSFHIPQYqo1rDyMfUnrXBZLoe05XK7eIpRlwpx2xUc+uSSyYZOg5yal+y QJlwB06+v51RuI0MgyoUKMda2hy9iW09Csuqyq/KjPHOetSDVAuSE6nPJqqIUODz2HoePWp/sqAc ZA9P602o9ilGS3ZKdTLfeQ8noD3pq6oo5KEjPIz/ACqsbYA8jg9/8KGtVyFGCR1z/k03GLCV2TjV YyclGPHrn60o1KHb8y8jnI557VWNqFUHORSeWoPlqNvr/wDX/wD10csSbyLjagpYlUIGeoPekOoR 47479MVTECNz7ckdf8+9K0KuOMFR06nr/jRFRY+Z9CddQU42AjnGR1pv9pKh3ODycexqq0WUwQB6 H/61At1z349P06U5RiL3upbN6o6qR6ClOoIpHynB+9VIQbsnpnnj19+1I8AUEc4HBo01KVy6l+ow QD15FSJfoOQGye3+NZojToxI7ev0NKke4YG489h0qUl1Lt3NJr+JzgnbkYyOvH50+PUI42zwR2NZ TQY4GckdB7+9PW3wo64AB5/WnKEerJi5bWNf+0ISwIznqOP6Uq6nDG3ydzxx6+1ZxtQ7AEn1z1/C k+ysCQOcDp0pKEBuT6mj/aESLuUn5s/KB3+lSpd23zfMc46e9YptW2kjqO+OKlFo4HJye3171LjE ak+puC5tSNqvjj5uef8A6wqE3duin5h7e9ZZtTx8x7Y74I/pTfsZ2HJ5B5HFEYre4OXY1Rc2+cFj z+fSr0M9r5gkkbDehz6VzaWjHHzZzzt6596tCzaRQhYeg4/Spkl3Fd72Oti1Gz3AllI6/wCRV+LV LUvxt47VxK6ayvx6YJFTLpUxByR68Vk+XqwhKyO+XW4EO2NQT6ce9dToHjP7FayiOOMszgg5HBHa vKbWymhkZsKwYY5HTtxWpY6VdywsynOGwfavMx2Gpzg4z2O3DYmcJpw3PQ73xheagmxyq5PXOOlY M18zNukkTOc/eJNc+2k3CjDHPNQLp8nRix59qxwuFpx+Euviqs9ZGpcXUEnIkB4wMZrltTVku9u1 h8gbLenr2rT+zGFgBnI7+9UdVubm9vDPcu8rkBWeQksQBgc9eK9tRslynAtW2yhJuK4UZ9cCkU44 wMU4cY/2uemcf5FRBRv2jgY6etJjTtoT7gM4OSOgpCxU5bt17/jUQkwM579aQkZ+U9fz5pPyE5W0 RY8zdznrSrM/VR0OcdsVWDEEqx6+vWlCqAQMgZyKFoUTu4z16egpVk4wWyM42n3qozELgZ9fWmhu D29aLaAy60uRtGPTmqxfDAntgYznJpu/ALHI7DB600EBTtxyKfMRzW2Hs+1mUemOualCPgMoGc9+ oqkflYYJ68cd6mZm2+WMkD0GcmiLYnJlocMSpGPQH/P86Xy5HHyZ4PHIqER3DHcEfnsRxThE5Xup PUEGtY0n1J9obWm2t1HIGZDjd6jFdnEzEdDg46dOK4PS4rnzfkVyAfQ/412sP2hV6bdvGDXhZph0 5Xsexl1T3WiwwYZcDjp+P0pu51GCDngY61CZ5M44HvSCchSCScnuSB/WvMdCO7Z3SqMl3Y+cN9f6 VC7k5YnjNPebqCOPeqTygfNxnqB6CqjRS2M5VO42RgRx9fXmqr4PJ/PtUpkJ7deaYYp5BmFSxJ42 5Nd0InLORQdVz1rEv1AGcdTkEc8V6Ha+CvGOoaTca7Z6VqMtjaSJHdX0dvK9vC8mSiySKpRGbB2h iM44qPQfAHjPxZfHTfC+kX+q3Gxn+z2NtNcOqqMs5WFXOFALE4wACa0ePo0lKVSoko73aVvXsZrA 1puKjBu+2j19Dxp4wXOPoParUcCoA7AbcZ4OMV9JT/s1/F3SbKLxxp/h3UvFXh63mUX2o6JY30un JLuIe0muPs6eXNxhlGSuR3rzzRvhT8RvFniCPw9oOg3oubh3MEE6fZkC8tgzXHlxjaoPLMM4NRh+ J8DVjKcK8Wo7+8tO6et01u7m+JyHGQajKjK72Vm7+jWj+R56EVl3ONo4HAH86WGG3x87t+Q/niku 7HULWZrJoSrxuUZQQQCpIIyDgjPpn2qeL7RIvl3FuecKCowR+NfRwd7Ox89OLV9S9FBY4OFc+pYg /wAqkS3tCSdhOT/EBx+dVl0dIgHcyqOudnI9MZNaMEdr8wSOCbHUMMN+IzXZTp3esUjmqVLLSVyu LaBwwXeB3CAVILCy27snIHT5s5/AVaV4IkxHAFPqvGPaoG8/O2M8eg61tVpQS2T/AK+RjCrLZOxV MCocR7W44GMmrCWysBuVVx2bAzSxxRwlWlErN3Ab/wCtirEmowBdkcDgZx8zZ/TFc/sqdrz0NvaS vZFdoEJ2/KPcNxxTZLaKMZRgT19v50sl20mMR/8AAip606CLUZDmOPdnptXH86wnCDdoq/yNVKW7 Zny4AyVDZ4PIx/OrCm1KYcRJx3GfbtWxJpusgFxC+AOQU/qayTJqS7g0YUH+8AcVSoODu0/miHUv s/xIJvsoGFZs46hTxTGb5x1wcD5qtJJd9XAU+ox/KoX81vlkbOTxngiuLFpdDooNoduAUdenXpVC Yux24yc8Vdw8YwBxx+NU5WLDcQRzmuClGx1uXYswFtuOBVtOUySO3SqcAbAJHGPSraDv1zV1DG9y YAnrj/GpVGBzwO1RKwPA4/lTx90Z6e9ZWBS1LZZQAADz71EWJXJyaZubH9Ki3MTjP1IrT2betjSU xJTj8+9QM+Dtx19qc3Qs2M1GvuMjrxWqp2M3MrmQE5A6ZH5U9jldwbj27Uw8nIByM4P9KcmDguee 2TVKl1JVTqPQ87ht/AnP5VbQmXnKge4/wFNjiuwP3IULjnnBNTCKMZWZ3z2Ga9CjSkun6GFSqQS+ UDxJk+gBFQeWkjBVIyO7elWgkYciJi59+cVV4EmQd3OOmf5VMqST1Q41H0ZdhsJZvmXB/wB0gf0p 0mn4J4wfqP6VCttFK2AQuTyWbA/Krv2G0jYbbvbzjAJ/oa76WDg46U/xX+SMZ4hp35vwMh4pIztR vrnt+lPQPkZx0rTxEikK0cv+3uOf61mSSRqxQx7uwIH9a5quDjHqVGu2yTzMD95kj27/AKVNFJG4 +65P1/8ArVB5rAYSM46Zx0/PFEMrByo3jjNc0qCTRrGbeo54nMhVc444Yf40yZWjbYQMj0P/AOur RXOVYyk+g4qJpoQCj4z0BbOcVTwytcaqvqVSmeCT1zVm3hmm+aPafckD+tWI44ioyCT1OBgCt3Q5 tPsdXiv7yO3uY7Yi4Nndq/lXAQ5MTeUVbDdOGX6jrQsMknKWvkhKtzNR2PcPhl4K+AvxBSw0bxnr GpeD7uFXgvbyztZtek1CVyWSZLcPBFbxQgbXXzdzZDDOCB7V8R/2Lfhb4F8K6h8TPA/xl+Hfi3T9 IeEz6Rc2ur6ZfzTTAvHZ+W1tJEZ3CMD5dwYwQR5oyCeU8L/Eb4jaV400/wAMfDvQoNP0a811b+HT Y7RNShjuJ4gkiRXSmSVV+zuPMhSYNgfPyuQnxO8O/Bfwl45XTdN0Ui/t5fI1SxvdTMdnHctIshkh MUczC1MeV2+cXBPU7cH8sxFDG1Mwpxw+LnCL97kj7KonG+vM5RUo9lyzaTejSSR+oU6ODjgZVKtG LlF8rk1OGttLJNqXd3hFtLW7bZ8/eLtP8LXXhO11W21Dw/aXkEjRHQdPtL6PUAk7tLmeaWHypRDk RgmYttwBnBNeS3GpapNYx6cZ7h7WBnkhgkZjHG0mN5ReilsDcR1wM9K908Y3ek6n4xvfEsVpayRX lvKnkajf3Oo+W8qlUkjmxFIWhXGwOWAx824cV5Lc+H7iRfOhkDIeMKCBn6k5r9Oy3JsQ6SlOm77q /K2r9NO3fV67s/Os0zCj7WSjJaaaXs7dde/bRK2xxTPj73HOAT/Kq+9ic9R1zW3eaHeQMPPAA6gn nNYZt3hyWZQBwBn+nNXLB1IO042ZzRrQkvdlcsxP82FPPXHfH0qzv8s54OPSqMT4JXknHLZq4qtI SgGc8/j71jJe9ZDfmORhtAK9ScHNNQ7W3DGc8kUrRyqNpUjPfHf9KYqOMFcHnkZA/nQqbIWhqw3a BMgITnHeomvCWHGD+fvxUIRyuMgj0BpgEjEbMZ56MDx+dN03cpzLC3MzMUA7gGnSSSbRjOc5/Co8 vHglQOR1PanSyqdufUcZIrOUbdC1K42N3UZYN2P0/CiWZ2BHIAPT+mO9RIyghWYlenXAqCVw4KgZ +lSgZEJyjY3fRaeJn5GMHPcVU2Nt3ZH5jI7dKmXz8EkFlz2yRmt40xOpZaMvRebIOOp98fhUhjYY zj6gj/GrdhbNt3MM57ZIqWW3jVsqB64DE11LByceY55V7uxUI3E8A+vHSoxLjOOMdMd/arLqMFQM e5rNKK2T6Dg46VySilc1Uizb4yRz14P4Vf3YXaKzo8HkD0Hp1q2pIG3J68Z+tZyR0RJfKDBcYxnF adtFttHY/eLDJz1H0rKU8g43Y9OlaEW0Q7c87s0MIsfFGNpB5z6094o9oA59/WoAWRccnv0pGmcn BGPTis5Sd0UxTFGBkj2z/SkiwpIyV9P85oD4HQe2DTNuTnHv64oa7CbTNJGMgCmR8DnG7p+GaotG hctv5yRSZOe/PpxxUWMP179KIRKbLCpgALITz6VDcofK5Oec8+3erEW0gYP5/wCRTbpC4AHQe/el Zt6DKkAaMZDHn3NXMuUALsRnvVaMcAN1P5/pVpcYwOo7Comxpljy22rnOO3r+hNRiLOeByPyq+R+ 6GAOlRBepP0wP504t2LcNRqRkx56DHT+dVXHqAR9avlgFJGfx9aYTwwJweuMe9VTqNIU49DJCDfu XkelX4JngbdHweQSPemRxsX3EHB6k96s/KDgd8ge1E6jZnBW1K/2kiPy2HAPQU+4vpLiKONwSEB2 j0+lIoUKQwB54pjBRgoOtKTtrYpN23Kxwyjjoc596ibI+YVb2nG0j8agdc5wKpVOhMomVJEGZiBz kkn3+pqDyZfUfmK1iAAQQB/9eo9qe36f4VftB6I//9b+F1iCd2PzqpISGJXqf8+9SBgVznPfFQO7 A8cdc56dOK4pHquXYqTTMUOR7D2781myHJzuPGevatCbzShZ89MEetZrbSd3zcDGcj0rSPUuBB5h XBX06DHTvUiSdvfOfT2pgU8ZK5C5HHPNOwNgIJAzuOfX/IosadR+7cu5gRzxx/8AXpWYA4U59+tM YIylCG9Q3X9KawwSre5HYdelMIi4yobnOCBnqP8A9ftTGDIoJ5I44/xqfCID1AHcc/jUbqW56dcY PJ9qBdSqynOS2Dg8+oqUbtwQryeT0IzTTymADyO56VPtVfkGTkg8k8fpQmNLQq5RiMnjqQe1SL5i 5UHHHXPbpmnbUUZIGfUnv06f/WpVUD5lGTwpA/z/AJ9qAZGgxlTwchcg45p53Mctnrgg/jUiLjoM AdM+o9qkEbbfmHBJOah1ENoqhSrjH06cU/b1IDd/vd/apRC6/Jggk59h6VZjtuCzHIz/AJzSdQep UEZxukycjHFSIGUY7Y7nNXltRtGSSCCT2FSrbRA9zxken8qwqV00FmZyMyPu54FPAlZt2MjPIx1N aPkoHAUDPP608YGeAOfWk69tEhcpmiGRlJ2k9zn+WKlWJgQ3PPJx0q9kBcZGM4BppOQec9TzRGq9 B2K6wfMe4xyOgFTCNEXDrk859KcMKQ2R0PFM8w5DLgfTmqT1HYe6xbV8tQDxgH29DUwCblxgL6nr +tVWJbbyPqKkbjbjnB6H0ofcfKX4nXv/AI1cXYzent61kxbRwCe+c81ox5Yg+mcGsHF3M1Y0FQMD jsRjiuq0eMeU4YZJ7j+tc1AM8ew9zXU6YNqHHQ9ulceNVo2OzB/FctPDDtz39h2rKnjQk4+vXH51 ru3yknseBWJdv8xOP/rfzrmwy1Oyu/duYFyu188dzxXKygmXJxznJro72T+LIH0rl5WZWIz36Yr3 lsjx07sHjbIHUDvimj7xLAc4xkdMUw8AgnjoPwqIuSTyfWpbtuDa6kyqOQw5J46H8abhWGVHQcjP Un3zUSjccE56c0+QRqAQp/Mf4VXK3sKQADG7rz+BpowBuA556dqTzMoAhwO3P5miM5PXr04JpODK uDAZJ96AQvPUZIJ/pTiEz8zEdMYH/wBenKwThSdpOeRSjFilMRCuOeo79xStt2/L0xn+masgwkdC xxnBI/wqaN2wBHFEPr/jXUsMYe0trYqwxbn+XLcdhz9a0/KaFcqGX24pqfac7lYZ7KoOP5VbS3uZ WyqnHqcj+dbQw/ZGcqgivNgJGoB7tu7U8Q3cZDiSIn/aG7r+YpIrS8Q/M5TPZct+I61oJZXIHEhw RwX+U130qDe6Zz1JrcmsbnVApgV0MZOTtRVwT74zj2rqIbdTjzJ4xn7wzx+nNYFlpt8CWjRWGOoY cfrXVWNlMw3tG591IxXm4/ANu3Kz1sBiNNy7aWPhuSCaS9vTFLGhMSRx7vMPYDJGDWFJHaqckSuP xH+Na7afGsha6EoB9FUkfrTmhto8GOKZwOhYDH1x/wDXryqeUyV+Z/f0PTqYqLSSRlQC2V/3cJI9 XPWtA29vIA32WJVxjIYg/wCFOaeBG2vAMdOUH8hmlN3akGNZlQ9NoQgfyrrp4dJbr8EYSqtjootK VMC2iLZ+8WY49+n1r1yL4OfEy18PJ4gn8Ja6bLUbUz6fqA0zURAY/v8AnxSLGI5FCqRnJXBJ7Zry axRLi4SGSW5Ks+0x2cXmSY/2VJUE+2RX3V8EpPj98VvBsOifDfxDrnhy38MQXNzrN1ca3dwpLZhW czRWk1wsbtDGvl+RaJ5j8DaxYV8xxbn1TL6CqxnCMb+85aJJ7arXfTZ3btbqfS8M5TDG1XTcZOTW iik2++j00Wuttnqc38D/ANnf49Xmr6b4nGl63o2kQ6tp9zd6lquh3U+nR2zSfLe3MMsfkTWsR2+Y HyCrjggmv6E/h/8AtefF74NT+Lj8UvEXh7/hOfO0/wD4RDUdL8H3OkX01nDJiK2Fvo2nhLuB42Ei JLduqxNh+jCvgDwr8UPjtdeHn8HfGH4za3Jr9/pKpPv8cWekWWn2FlHJFFY3dtcJcWt6ZB5LMC4l RQ8bxbwGH7n/APBLv4vf8FDvjF8PtDbw1p+keJPB2l2kunS+JNS0PTGlt/ESRztKkbW1wj3NhEJI o0e3ijkZWx95JCf8/fpBcQ4jH4GrjM4pUJ0oNLSXLdX5lyzlRnKXM4uLj7vOtErO7/pfgrLcNl0I wwjlGcld+0aUVdWaaUmlv2e+rT0Pffhr+wN+0H4j+DVx4m/aB8ceLLi71bWBrdyukT6h4VvNJe5a WXe+k2jWthNKN/757gRtIQP3g6H8nf8Agov4c/aN+F9re/Cjwtqnx/8AGtnqUNtqlzFcaXZ2/wBn +zrlJYNbso5ojbeYN3yQJKzZUylev62/tiftw/E79kzTtQ0D4732jWWueJtOsdRtho+k6tdWFqPN Cz3WoT/ZfJQBVJEE0qjy8biTyfw1/bB/4KAap4RuX8HTfEbSPF83iG+YXnivwhYX9q9jZTxBF/s+ GLXFsWiG0hyyq4+blgBX4R4F5dxFj87w9eeEhUpS5nFOElGTjK7cZU6apwjBctlFxlfZysz7XiHF UqWAqOtilFLrFptKSSV1OSbv71m1JNas/nK8Waf8P9Sso7LSLC/stWjuZGvrye+N1FcrIBgFHRGS RG3ZI4YnnGK4lPB0McYZSd3QFGRgfz5r0z4i6f8AD3RvF11H4K1xtdsVneKC+8pbWZ0jCgSSIjSR DzCSV2SyZAyxBOKzLS8091Ckswx/fTP54r/dfhjBYKWFhJX1V/ecm1fXXm95ej220R/nXn9Wt9Zn F200921v/JdPuPOp9A1XcIFXehH3iyk/pirlr4ciGVvoyWOcfdBr0sTRqwe1DDOR8xjz+RFaONQl VQwYnvs8tiR9cV7VXC4en7zuzyacalT3drHkX/CJwCQLH56gnhN6IP0GaW68E6DIu1XhWX1ImkJ/ JcV6lLFZoS1+JkC/3THn9cVkXWsaJARFEJiyf3yOn5f1r53HY3DJPlS+Z7OHy2re8zyqPwdZLcfv p5duf+WClR+PmEYq/eeHXjUNp0UzKeBIqBun0Ndo+p6ffD9zboyqerSY/ME1VW5ubM+bFJ5efurb vxj3yTXgQxtN3Vren/BZ6UsuaR582l6nbx/6SlwpIzuC7R+iVFBZawSDbzSqOgX739K7q4mvdQm8 xZZpGA6SSlsD0xViPUL+3dYJUhY+oIU+3Ir0sPRUmm5tL+ux59WCV0ldnNW9leqP9MacD++wUD9T Tv7KinJjikhK92dSxz9UNaOpSxS5+2wpwfvb2fH6Yqhp+p2lkpkhu5/ZIgdo+v8A9evZpKHMoSd1 5v8AzseZUjo5JFd/CmnMcNIjHHLJHIB+eaw5/DNrCx23I69PLP8AOuubxdLcgq+07OAXJyfw4rnr vXb2YlIjExJ4AAJH8zUY2jgN0r/f/mRhp4hO0n/X3HPXOmwQDiUnnnArPaC2U7t5b6jgfTmtJjcM S9ySOem3J/SqN1OY125+XPGEIP6187KlSTbjH+vvPT9pLZsiSe0TgAkDr0xVgyWr4OQB7AZrJ3Qk B9wxnuKtCaNwdhXPQ4Gf0rjdW97pG6i0X1ktVXAL7s8+n4U/faHIZyQMYyBVNTGOHlx7Y5qBmRfu liR6jg1MpafCv6+YRV+ppM1oOEOfrxTEsprptlqAWxnavJ4GT3qos8QGGj79uP5Ck+0jfuhVgcY4 b1pNwsK7JGtpT8pikbnGR/KjyTGMyROvrkf/AFqi8+5QEqGj9ye/4A1LG1wB5kzB+PU8/wCfpXXC FPSydzCUpdSzbR28vKo4P0/nWxb2wlYRxgqx6ZA/qRWHFfJHkmNRjnhucfhWzZanobY82IOe4Jcf nXvYX2SSV1+X6HHV5tWkzobfwxq15yonIHXy9vP9aiuPh/qeRLMJcHrgLkfXODVpNRidl+xrbwYw csecfQmujsfEaWcge/uImToSsKnH1IbNfQYfBZfNJVL+t9PxseNWr4qL9y3pb/hzlYvCGt2aFrZF fBGMhST/AN9VDMPEttGyPFBFjplY1/kRXrUPi60ZBIj27L7r2+mM1qW3iDw7qH7ubyiR/wBMtxP5 mvUeS4NK1DEOPzOJZhiHJ+0pXPnqKTV5G/fxCQfxFACOfoRWzp9kkspeFPJOeVWMkn+deqXt54XS Qlw6hT8xjg2HP4nmss3mg3UmLWa8VhyD5e1cY4+bpXn08spQkr11L5r8zqnjJtP920cTd6dHMhxK MLxtkR1z+dcTqFhawvnz4BjkKj/0I5r1e+tb6aEiGd9mMYdlz+Rrmx4beUlbmOKRsZyjLk/kayzD Lfa+7Th8/wCrlYTGOOs5f19yPM/tN2pKHyiuMbiqk1o2/mTDaqoQBzuVQK6qbwsjkILR2J6NuXj3 68Vmy+G7i2GI1VPUE7j/ADFfPVMor0370br5/qj1IZhSls/yKxjZFBhjh3Y65X+Wage3uZOXWNT0 yu0E/U5xWRc2U1qzea4B7EjH+NEVteP96SFl46nFccnd8vK/6+R0Ql1uexeF/g9468Q63ZaRYaPr GpNeyskdpoqJd3c3lgFxFHGXJI3DtjmvedJ/Z/1n4eeLNL1DxdpPjO0t7eIS63Z6bYsNXt8swKFL mOJI/MUYG4uOv3h8tfJ3h2/1/wAPalFqXh+9NldwndFc2k7wSofVXQhgfpX2f8MvBHj/AMaSreeP fEXiG2muYxcaWbfUUnuLjBwrJb3NxHLIpfOGTIGD+HzGbU68PfnNKnZp/Fdt32tfZfO+u2h9hw/H D1pqnTpyc7prWNla27aW776fmfaGp/ErwZceH4NV+Hes6hp8M2jGKwsrvVdLstUtboKy5vrZIg+5 icqYn2c84HFfnd8TtJuYNbjvY9TfxFc6e4lumvHiNus8gVnRNkgMrBgd7gbWGOScivsuH4GfGW/+ Kc/wa0Hxb441PQQhmsL61tot7mFl88vGJZ/s4VgwQyEZIBYAZNfO3jr4N3XhKPVtX1hNVvdP+2xi C91BIYtT2w5a7B8u4MIYNwcxOWGCoXmviuCqGWYKu4xqpuSTS0bak7K7lyu+91vo77M/Q+NqmZ43 DJ1KLXI2n0ScVrZRck1trtsluj5T1xvFeuahNq72cFv5zF2isUKxA98RqTjJ59K4W9uNTgiKJE6b eWLZAz9McV6NNa6t/aJbTGuYbeYmS13J+8MLE7C7DaCcdeACewqhf2N3ExF22oMDwW+UDJ+oNfuS wqlSUqTklt0PwKdeSqyVVJv5nlst5qM64dz7jg5/xrCljnEx+XI9SAa7rU9IiA3SCZR7urfngCuM u7QWkm6BlJ/iDNzn6V4OLozT9+7+Z3UKkfslby5UG4j5emMYqZJnXDAYye470NNcjCzLF0yAeuPz q5BbmdfNMabfQSAfpmuNUuaVonTGqkveIfPZmAYsefun1pTDnMgMfUn5W5/SkZYI8gugI7K2SO3t /Oq2V52tk9c9OKznTa3NEzQAdE3HHTJB9f0pm4N9euM4qaG3cqGZ1+ozn8cUmPJ4yrDk8LkGpVGT 3JlUjtcfG5GVKR/72M8UyYJJgOMejD/61J58W3c4Kg/7OOPapGng24iZFH/TQgEe+DThTberFzta oqo8bkMWc+uM4zUgFi2cZ4Hdio/OlW6uFPyKsi+q/wAuKkMlyT5jxlQB0P8AUEV2UqUU9fyMp1H3 /EZHDYF9yqW/2g2R+Nalrp1pPNzIyqRwV3AD61ZsrgKm+a2jZf4WLAda2jqtisYhaEL1xskGPzFe vhcLStebXpZnn1q9Rvlin96LEVlYIAsMkLvkdS3P54p1zbW6puYkED+AjH8qxJzby/NE3PYBwT+Y FVnSbaXZvzOa6KuNjGLjGmvkRSoNtNzY2doWyCWf68fyrFmkRFKoAM96tyKdvzNk46KcVlSAklhj jNfMV53voevRhfdkkR3DHT/63fpVrc3fkjHHPeq8CbSeTkjn/ParYCqNuOeOPqa4LM7Cwmc89qsq 7eV265wOtVxyeMdelT4O0DjPf2qlFPQiEhqzMFAzzUkSh0LZTr0bgnntUQJVffPWtjTND1LVMNaW 88iGQRl4oy4DMQAOOnJHU1lWlGGsnZG1OEptKKuOtILZwElYLlgCx6KPWr9zpFrG/wDojbwTksD0 /Mc194fCT9izx/4muTojf2VZau93b2lra6xIbcTS3JHkrbzcwsxBLEPKmADnkV2PxR/YO+Mmh3Rj muNEn1CUCa30/Q4rq8acMuVEcttFLbszgYUeblj8v3uK/KqnjJw9HHLBzxsU/Xpprovh/vbH6nS8 Jc6lg3io4Vv5beT138rXPzLe3aPhzgEcHFRJaEkCN1Oeo9PrXf8AjXwdr3g7XJtE1wSJLC+2QvDc RAHnIKzxxuCOhG3sRzXEOnlv5aPG4U8OAwB/MA1+xZdWo1qcakHdPVPyPynMKNWjOVOas07NeZfi 0wMAGJLZx8g/mag1DSpIU3MjYPIYVqWhu5ItsCoAuMkk8+3rWbqxu0yzh0z1AOMfgTXr1aOGUG+V nDCVTTUxIoecHj0Pf3q1HEEOe/uDUCyHO+MsT33ev1q/bmeT5wy/QnvXzlRRbaR6cL9S5HH02ggj 071LLBKnLADtz3pSkwOUKfQEGh45UxuXtxk1zqyOpLoVyCF+bjrzUIGMHHqSQatYY8Hoe5pWjJXj HX0qExuJXG7oo49c0yVN3Uc59epq58yjaTj2xmmMpH3u3rT5yHAzivylcZ56mmMjAbVzxVyVxwB+ tRKCwGG7449ferctCHGxVIKjjnt9ajK+vTP+TVuSPHHvTWVR94ZHShktFFwWGQCMepqHBq2zgLhe n4VD5g/z/wDqodRCR//X/hQjQnkDjrzUcxUc/lkd/wD61VvMbACAjnnNRMZSQsnQcZPHSuGLPTSC Ql0IkPB9e1Z7MdxY9xuxyas5bGPz49ajkQ9ween1ArVSRqvIiBZx+965JUjuKciEfPjkjJBJoWFz hUBz646c0+S3lxnLc8HrQ5LY0S1B0GCx6dN2OcUjAA4BUDPfr+pqb7O4XkjPT3oEB27T+Xf+tR7Q LXKpDj5VKp2GaGDlBsOWz1Xv06Vf8hAucjI5A74p+Fxx6jFS53LcbmWsU4YogIB/zxU7WjgZPQ9c +v0q8SGzz9OaMquFHTrj1+tDmwSKv2QHLHGMnjHrU6WsWe2eOv1pS/zfKScdfr2/SmtI+Djp69vp UtvuUkiWNI/7vPcelWSsWOxz19DVFZCCRx7053wAeOnA9ah6oGifzGXGAPUH3pN2TnjIqsXB74xx ikRgRwehzx0pco1KxcD7V25OMHj0zSiTIHb0qicgrzjPbrTo37jPoaORCZaEnz/n0/8A101nG88g /wD1vyxVbOeR0x1pTtYk+3zepqoxS2BdyfIPB7frS/IcEnORgDtVduFJH5UJJgH0xwT0/wD100rI RMjDIPcHilKgfKOx5x7VCp+XI49aQSDODnk5OPehgSYzyfXJNWY4/NGW+gzVSMgkj5lP9a0UZVjy MkZHU0pXsKT0COE+Z85JzxjFacasGz2qol1DkDvjpVqN2HTnk1Rk2+ppQcyY5Pbj0rrLEZiOQQfX 2rk7dsEnjPvXV2jnYM+oHHpXlY9No78EiWfbtwBjtisC5duQM9cVs3DEZz+Fc7dOwJUHn61OCVzb Ey0sYd36HH1Fc9NKDJ8hyMcds1s3jgZycVgvMqk5I6jnFe7GOljyE9RXDeUGwSTzz2NQv8rHI6+t Sh42Hy5XPIOc81E5y+CCcjHcUuS62FJ2FVFckIwJ6joMfnimvG6EKuzIPrk/hinb4IiCsZ3EfxHI FPF8m3EgQ456YrWFONtWZuoytBHuby36nJ6etTCGeIbeFBOcbuSMVIbklfk249h7e9OgfUJ3xBsH OMbR/hmrjTTBzdxYo4nbM7c46YzV8W8bvtVMDHGMD8qjOnX0x3TuDs+YBQBn9adFaSkfvpH645at 6dNrSxhKpre5OITC42RHpzuyfywKfHAd+8ErnnLggD88VeitYMf6O7lh3ZyR+tSmyaUqpZyfQuMf zrtWGv0uYe28x6RJHgtcrj2yKeqQyHCzEn1Vf5kmkOiyb93zD3Vgf5mpDZqqHMbHH8QPf+tbqMlp y2+8Skn1NCOyC42qXz/eXP6g1ceytyN8yhVxzkY/lWHDbZOBuwDyGj/qCK6SO3054gCy5HUlTkfT k12UZKSfu/ezGottS3p+iYP2jdHJGeVyXH4YFb6WVuoKiOPn/nm5z+QrJsba2DhPtExB+6X3EH6A YFdkdLZdotnlxjJClk/kcCuPE1KeyivwPVwlKdrjIbMrH+7Y7QO4Y4/UVn3Gno/zyTAsf4Rj/wBm P9a1GS3Yi3Zpgw7M4H9eaf8A2essojVJGx1ZgrAD6mnyxnGyjf5lylKO7MFtGkcH7OS5I5A5/XAF Ivhu5urhLaNCGdlUCWREHP8AtNgAe5NdW1qtuNiGQeoA4/LcKzJIrJjsmnmBHRdg/rmoll1O21n6 jWKb9D9mP2WPhj+zd4D8Bad8TvivoVqNfguyumTXXjK20S7vpLZAN9jEYxbqiM6Au03zANkFjX2v 8FPjf45f4iWvjfXPFOiWvw60G4F8fDOn+I7V2spWcJGupXVnYykKxYLNOWaPLbQwOBX4O+Dte+BO sfDT/hA/Hk/jN9Thld9MuLT7E+n2azH5mW2leGSSTdn/AJa7SGPyggGv2C+D93+zj8IfiHpHgnxv qDeJdSGi2ltbvD4I0S706CG4iR7G41aTT2vZHnt/mLo6uSF5GQQf4V8deDZSWJdeFSvUkp8q5ZT5 aatf2TXMoO0rcy5ZRb0utD+vPDHiWDhShQ5KVNct2pRi3Np/xLKMparbVNb6n9CWlal8MEay1Hwb aaxq1xJeIwOlzabc2aefEHlik1DU4VW7d5BhWi8yRDwSvSv0W+EXgzwZ8PvDlno2jvdafolzYvJq llJp9lBfCaVjIB9osYEaeZQ2zcjMOvQk1+L/AMJ/FOm/DGz0/wCI37NWu6JceHNI1KfQfEqWmh2m n7LyUkrcjTohCbfe5Zf3jIGjy/y7SR+vHw9+MmheJRZ+JLXR7XVWUSSadp1vrdtcPeoX8oPDA0zJ CJJEJaHJwBwTX+PHHWS43BRVKOIfI5Wkpe0U1JP7abjZ21sle1m9dT+g+IsOsTCFSlTbTW6cd7bJ ytaz1UnrzXb0Wvy1+2t8FPiH8ffgzqvgLTtXsdI8NRpb+Tp0emfa5ZoLeU+TDdRzSLGYXQmN0kYj JyDlQK/nW+PX7G994i0iXwra+BdQ02xsWF5N/wAIpPCS2qQROyW0Nleapa/ZrVozvkKIxRTx1r+s 79ofU9X1D4beIvDkfhHT9E1DWfDs6aqxa3gkt7MAneLm1kRomJyAfLzvPDGv4av+CuVl8avAnx60 XQvHeqXOmmLw2V0qyitJNNaGzumbzgJIpWe5imcuBLNh3X5WBABr+oPoXZXmuZZssrwOZ0oNOdRX i272WtoThzNpL45SUVqm23E/P+Pc8wWFyCpjcbg+dSajaMofDpd3tLq3qtZaX02/M/4sfD/QPBHi KKzsbTWLETRC5az1vTzZzQLISY1AEswkUrgq/Gc9OMnz2LTkZty27OgPAGRn6ZIr0DxPq3hWDwdZ eEtKi0fVJQ6apdeIJ7GaHUknlQLJp5kedkltoiAyv5YYknBA4PE2On22RJMbNFbjaqMRj8+K/wB2 8gjiHQjGvrJaXel/O3S/Z6n+fGdyoe3lKgrRfRa28r9bd1p2JbfRra7b5YfKGOc53D8yKmktbqIE abGEAPVkbkDvkZHPvWzbXdhZ8WtxAh6BUYjj3GCa6DTtX0vUz9jnMMzDA+VmUr/4739a785jShTb lKzt0sLKIynNJbeZx89nfvCrTpaEYzzE+SD3G0gmqLXFrFE1rI9tEcffMDBs9OCea+yPAH7Oo+IG ltqPhV5Vmgjd7g3DF1YrlgsYjViSUH8QAznkV5P4j+FEaQS3byzRNFIVO8bDkHHyqMk1+FYnjbBz rzour70XZrt2vufrFLgzGxoxrRp+7JXTvv37HzdMtlJIfIv5WzycRqF/M/4Vo2v2C2iP2hjM2OrY zj/PoKu6xpFu8RWWaABQfn28/Unj9a8/+zQRP5atE6k/fcbRx9DX0+XYxfHFJ/ifIY3Dte5JFnUd VjSQx2i+WD97am4fmRmrEF3JGgdCQxHaMdaqrpvlyeclzAAeQygkfnio223DkyXROAR+7bA49RxX 1NHESi+dvf8ArueBXpp6FsSWt2zefciMkZO6IZJ9MjNZ76fAJ1GJfLPSRflz+OMVRuhBGykzysR1 Ea7j/OtHS7sLGY83ag85MQBH6V62Hxsaj5Jaed/+CeTVw7jrEiudPtmcC3W7fPQBlGf0rFubNoyC ttOhJ5Z5sZ/Ku6M9rNtka6IA42vES4/IAVXmttPWP92ZCWOfM8vbj3rtrYOM78rX4f8ABOWFRp6/ qeaz210CdkUmP98Pj8uao3FlKFG8MSe5B/pmu6uIyI2kDSOuMDAb/wCsK5m5YTjZGGQd8ls15VXB xTep0qq30OZmiYLsWM8Yy23p+dNG2MjIY9Bk4H6CtfybhdyiViuOrf8A16jItwpSTBft/wDXrzJ4 PW5vGr0M9YmkYttbr94niphEYgWJPp1BFTJF+93jkc/Lnp/KroKOm2eJfq0nH5DpRSwyYp1bFPfc YygUcY6f/WNViLkAsiFj6qRx+FankxSfLujVc4/1maqtYnzMRSMR6x5z/wDXqnQle61F7Us2sccs YFzHKWPAIY4/IDNXI7C5R9sbYQnIypb+dVvt01uFhYM6gjGdyk/XNdDbX000fFtGijktlww/WvWw tKm5Wb1X9dDiqTktUjCl0x5J8kOXI6hApP4CuisvCMr/ALyeSNF/uMxDn8NtNt5lin86C6iDA5KP ubH0BzXX6brdrPIRdSxMwH3fKH88V7GBwOHlL94/x/4Jy4jE1OX3CsPD28JGnzgfxRoXYfiCavnw rpscyssWWzjfcjA/U5rtNP1TTY4Qiw2yStwJDsUH6c9a0rnUrW3nVGutzHBISQY4/QH3r6dZbhXF yTX9ep4c8VWUrWPN7vQbuK4xcTL9nyMJA5yB9ADUNtpt39pMPmbICONjhXwf7xOB+teqf2mndgvd WQiQ59O9TtqTSoBuAlxkRMFU57cKP615uJy6jq4zf9fP9Dtw+JqPRx/r7jzVfBdy33XnljZuI/M3 g/kM/rXWaN4fubZdqKYlX5RsnB5+hJINdFa3eqtmK5mAQ9Fh2gj1yDUcyzQjzbeQRHozMqYJ75Pv WVLBUINVI309P6/I2nUqTTg7fichq3h+4nl8yWNtv96WUuTj2QiueudIWNtixIiIBkLG2/J9ic12 U+rwwgmNreQk/P5Zwx/DNYV9qDSIbjM8Q9SFbP5c13qdDWSd2cUlUTUWjg7uxEblQZUyCVOxxn8z WSumXqOuwsyMOu7BP5mvQIp/tEasJ3wOcsm049ueRUM4gnxNPMrbTjbsOT+OTXJPB05rmv8Aj/wT WNaUfdsclJoWpsuxlBU/dJ5/rVH/AIRq6gm3TCB3HG0r1P0Fde2oQPIUWIlVONxUsD+ZFamj6/pG n3u2+toHjJA3tGz7eRkgZ2/nn/DlxNDCtb/ib4adbmtLS5i6B4c8WXM63un6Yn7qVQsyxLIA2cjc nzZX1JGPWvs7wV8HLZry4tdWtNFv/EN28du1jcmGa3M0zBlaxS1xuyp2sqBmUjAHOBe0PQ/gbrtt pl7ql9q9rM0vlzLbiNYHUYPKxIjKPTO8n61+pP7PH7P/AMH/ABc83iXSdL/tCQgyWosWcILeE4Ml xGxDbgRwWUcnpX4b4kcVvAYZ1JKUUtNut9PeTSt1f/AP3rw34LWMrqMZRlez1fS2r5bPXor3/E5L wfoniHUPhReab8L/ABJq3w61e51E2F14S1W1ZUna1XzUkjuZNlzieMlipUKmFBBJGfmfxz8D/hz8 MrLVdRhubfxbqWo3KwR6Td2F/e3amLa7zGaJoyrFmIJBKPkBehx+xVlf6Z8PI7TSfsEVpKAtxaal FZtKsCEbC3m7WMajPztt3DOBgcD59+J3xt/aKOohbDW1ubfzWFlpXkXUcRl7YC7AwfJZd2QcHnPA /nLgvi/M1jZRo/BJ8zu0m9VZOSg5SSsrOUuZK95M/obi3hrLVg4yxMryiuVWTaje93y86ir3ekY8 r090/n+8UaPp99rd3e2tkdO8y4eQWFtvSG3U8mNRMzyBU6fMSfU15trOiSoN2nNOzMv8LM3/ALKK /Tf4jWvjK81Ca68aWGi2kt3OZpmhYK75yGyd7sC3OQR17V84a/YaU0ZFobbzG3ErKxXaDwF3jg49 f0r+48ozWNbDRnNW06O/43P4jznJ3QxE4xlfV7qz+4+BNQ03V4m3XEVwWJ/ijbOPzrFlsIgT50c7 k8kOoH8zX0R4ntVt3O5rIt7TscY/E15zeWSTRt5ktpEx6P5pPB9AQT+tei8rhL3oyv6ngTxjj7rV jzKfS7OZQUifjoVUZBx061Qi0a1OT5cm49fNO0j+Vd8LAw5SORJUHcELk+561RlEiKYt2zuVQBv6 iuetlkVaU42KjjX0Zx8ugoEDooAJzkAnp05JpiafJASrscN6Cuka1tpV3i4XJ672Yc/TpUK6cynE zqRj7wIyfoK4amXq91E6ljNLN/gYMmkyxgNCrtj6DP61nyWlz8oVXC9yWB5z9a9BtNHuZ4vMjTK+ pbaf0J/lU0dpdQMU8uJsHJ3uc5+hq1kd0nytJ+RMsyV7XvY82exu4XDmRVzgAk8/lU7WN1Ph2miG Dndu7fgK72S2uZ5GN3GSvpHx9OAKnXRpGi+W2Yjt5hAIFTHJby5Y3/EqWZ2V2cZa6NeiAyx3CYB+ UKf6dae1omdt1I/p8hK8/hXdR2dzZAeUic/wMVP5YxU8NheXLCRI7dCOAD94/ic13LJtkk7/ADZz vMNXd6Hn1tpNhLckOs7jjoDn88108XhrS1G6JpMHnbIpxjHTNdxFpN4OZkjwCMsoBP4EEeta50u/ dABBmPoGOcn36/yr1cNw/aL54X+TPPq5wr6S/E8YutHTzD5QcgH7qqen1OKoXNm6SBIopF6bi65r 3S80W9W3+9IO+3bg4/765rhtUhvnfbOspYcncnb9a8nHZH7NNtPXyO/CZjztWPOZLa4Hf6ZNVDBc OckHHQ56eldJeWmVPm+YuOSNp/rWJNBEhALvwM4Oe/4V83VwaWh7cK+mgxIpBjCjA/un/GpkRwO4 GefSmxxlQGVyfoMCpXkkU/MvXgZNcMqCRvCqywhGMf8A1qsuhCgYb1yRWYJZT3PBwAa1ItW1JIPI WaUIePLyduP6Vm1bYuFupVIIGMHvz0NdNo663aQPNpRlG7b5gjzu2q2R0HHP51zT3MrHO7nPXgmt C11zUrZSIJ5Fyf4cfzrmxUIyjy2OnDT5JXf4H68/slftAfD34UTxfEf4l3EPia5vEe3m8PTRywNb SooEchlkLwNG+NrgIG7hhjNew+Of+Cl/j/xJpOt+BWgiewvpz9geO2S1gt44gRFiNU4YnJ3xsNvb ivyA+Ffxg8UfDPxEniKzt7G9kUhlTVLWO6iJ945VZGH1FfaHjX9tLw58Ufh6PCuteEdJt9ZL/aJd e0uzgtWZwSwQJHtWOMdMIOlfyHxh4NYeWdxxtXK/rUZuK5nNL2dndOMOVJKO2j5paXvuf1Rwn4sz /sj6osxWGlBPTkbc7rW87t3lfqrR1s1ofOHxs1XxX4pd/EWp3cH2F50aG1hnknYSOo3NuZBhTywB Jxnb16/OSxxu53icjON2709K9pv/ABTreu2Jsorewtl3+ZIIt5SUjoGUk/jz9K5yz8KalcSmSHDN zlFC7D67c9hX9O8KzeEwscNUgoqOiStt0/4c/nziflxmKliKc3Jy1bff/I5uyW3hiBhebIwcnawB /HNZGrySTuQHk2jq0nOfyFe42Og3aW+fJjXaeRKgBIHpiuP8SWqQyGRDbgEcI3UY9R1r7GWYRmuV M+ZWBaXPY8hRDnAKnPrwKuRiZW4C8dxWs0sqtxBGQO4Xj9aniuomXbJCDn0GD+lYrBQmm/aW+TF7 SSfwlWNHYBiMd6ftXGTndnn8a0Y40kXesewdPu5/CrMcaNg8YPUEY/HBqJZaulRfj/kbwxL6wf4G KYkCgENk+lOVYzzk4/wroGhVE3Io2+pwPy5pjQ2K486Ns+vUfTrWE8C4/bX4/wCR0Rq31t+X+ZjK 0RbnJ+tRN5ZOD+lbIaxT5djDaeMY/LmklOnFTuXbzxkc/pXL7JXspIuW17HPypHjklh/LFVo1HB4 4JzWpIlhuJXcOcZA6j1quwsSfvv17DiqdB9WvvRg3qUPlztI603C5zs9eavulq2Nzn24qN44wMJI D3yB/Oq9g7afmiHLqZjrk5waZ5a+/wDn8asyRKVwJAe3pVf7MP74/P8A+vUckuxPMf/Q/hFXJVvm AH4HP8qHRigLc+n/ANfipEfOevp/WlMsZxzjjPvXn3sexKnYqlMRnO3nkDngH+f6VGzqAeCOmMdP pUznjdwcdfWq+WYYwPag1Ue47eVHAwP8TSbiec+vOKh3EYHUjjNSF2PzAYIGcEcEikVe2o8uy8jk g4z6cUgk45A9M0xZBt59c8Got3UHmh2EmTPJ8pHHXr696buIBK4HOCKjYnPykZ/r9Pf600nHK8H6 0tkPpoTAjBAx1NNGevoOPcUxjheFHP8ASnnnqCPqRVKO41LQRmyPkPfnIpCPm+XkjqDz/nNBC8j/ AGs4ApqZVshunr+lO6Fe6JyrBsk9RwaXtnPc4Gf61EdwbnsM/X86G5G7259KSHe6Q8sx6cDjBJ6/ 560BQAc4yOeO59aRvuleQcY6UgAAy2cfzP5UgHqVwCfw9P8A61JnPBYc8g0u7keoPGP60hc5xjqa YIdjOMEnH5D6f5NPGTxwfY9/5VCWG4KePbHH9KBzy2enFLYBxIxjp74/H3pwxgEtn26VEMDI5/rU ykqcp1yO/wCnWhPyAcoDEn8OKeDuJxwRgYH+QaiHJ4yMfpUnmndgDPr/AJ5oQky3DaBucZyOmcVd WzQbVYZI7A1lDcV7564HatO3ixhju3DjGaZEmWFQLxtHfBxmlj4bv155p7q2cHJxnvnio4yMZHPP epTMr6mjD98YNdVathMjvjvXJQyLkcHPYmujgP7rI68cdq4MZqjuwbtckuHAzv5+nFc3dSKHPXA9 61biQ5IP6Vztywzxx6Vpg6VgxVQzLtwORznPymsSST5ipHcYxjvWpcntjA55yKzOA3JQ5PBHX9PS vZjE86MtyRZzEAqgkAYGRz/WnBkmfErSKeynGOagYysCYS5PTAHH86EgvB+82MzdeRitEnaxMrWu Xf7O35KgHAxy3+FIdNYHO6NeOe/H5VYtry+B2yJgfTP51aMs7cHBHsvP867I0YPU5JVJJ6mVHp8G CxxIB2TqPzFaUNhEo8xQ6g8kbOfzGK0LMQx5zvHsE/8Ar1aaRdxMMgT/AHkya66eEhy3Mald3sYX 2OaM70eTGeF2Hj8zU/lXYwDvHPdOMe//AOutE3N991MyjuduOa0rUyvjekv/AAFP/rUQw8ZaJkyq tFWzsJJMbtuR12Bga3orDawB3HPUMxH9TTXmuk/dwRyY9WG0/wAhUyTaqEAkikx7KCfzBNetRpU4 aNN/I4p1JvUvjSUk+fzlQ9sseD+tW7ayEb+XLMknYEZ/XisqX7aYtgjlB9XAH9amt4LtAHjMv+0A ma6ueCldQFaTV3I2rTT9Oll23ErEA5O07T9ByK+nf2bvDfi658R3Wt+AvAKePfsiQwT2l+l5NBbN PJ+7cixubZwz7WQbnK4zxkDHzfZ2t1LtaLcg9wvT8s1+gH7CnwJ8P/G74oyaD4paxuLeO1ZP7JuN Yg0W6vp5/kgSzluJELzCTaNsayHDcgZzXx3iXi6GEyDG4uu1CMIttu+19tKlN67L34927H03A+Hq V82w9GnrKTstUum+sZrT/C/JXP7Xv2N/2afDmv8Ag3w/c698GvhZ4D8Q6hoMC6p4c0rRYdRlEpYq lzLeyS3TnC8tE8KyRsSGdutfQnxO/wCCbf7MOsaleReKvhX4DuJxBsj1ya0Ytbz7SzMYwkcZUN91 N4yOM1o/sOaEuj+BrPwDZeHV0n+y4VsbJdSkeO+t7OONflmnlaXz5N5ZC+6NCFGATyfsP4hXfiK3 8Hz6bpl7caXDa20giuJbZ5ptz5A8pjuibrgZ3fTkCv8Akl4447zijxBi6mExlWjOVRxjOM5KnyN2 itJzmraaynUeyfNfnP8AQbHqdHFUcBCMeWyunq239puOr12TjbV6JaH8MP8AwUU+Cmmfsi6Fq3gQ aL4Y1STxLqDXeh6mnhCxtXj00lfPje7W+e7t5I5N0aAK6NGAd4JNfgt/Zk8dwRGsYAYjr5Y69Rgd D9a/pI/4Ki2nxp1v4k6jrGj/ABDbULvR7uIab4NtbC402KG0lWaB7mK4u2SG5nI4kSBSz7921VUV /P34g8L3WkanNperwolzbuUmUSrJtbuN0bleO+D14r/pZ+h/CriuD8HXxmIjVxNSKlUlFSi3Jpau M4Qa93lvJLllJtrSx/KXjmnRzicY03GnH3Y3s1ZX6pvrfR2aXQ4CbS7uIRzeZGokUsNh3E4OOeT+ tKLKO5J3z/N3KxAn8yf6V1At2Q5iEXTkZJP481p6V4Z1bXtUttM0pZJru6mWC1trdgXkkc4VVXBy Segr+s45fGKcqmy36I/EXiJSajDd7epN4F+F3irxjqMUHhq01XUXFykS/wBm2YmuBIwLosYXGXIU lRuHQ+lfoz8NPgB8VNf+Ht9471TxtoM1nZXH2eTQvF2rXumahaarbuJLWeW2lANwQcp8jGEZb5uN 1edfBj4TfGzQbS2e71K20awutVkt0stUsb/VDBfW8aSfaVtrOBwJVib5XViwBIxzX9En7M1/dfE7 4YH4dePrPwzrdpb6Dfad/wAJqySeHbiyuo5HWKNjq0E96JZHZpFCwRwKyjD5OB/Gn0lfFOplGGVT BU4TipJX10XX3pRcbu2ijJO+ylsf1F4LcCRxHNLEucZWu1t2+ypX0vrzRtZ3908/0zxP+1J4D+IF 3a6N4cm1nxZ/wjGmyrZw2kOjaFfaekJZ0vLdbr7NdSxArv8AIfeSVUM2HWv6CfgD4l8RfED4ceGR p+h6P4N1VNOj1XxBZ6VavcxxLIhKQ25maHy5FbBkUKWUcFQTk/DXwS0LxLaNY+EvA1x4Yvtd8Han pyeKb3WYZ9UW/t7qKRGtUupVszNcABWDxSvtzh1wOf1T8Ew6z40B1zVI7TStStBOHtbN5be28vd8 q3ESK+6SNflOJRuPXtX+M/iJxOsbUp4enQp0pRSblBSUpJJW6KCjKNpQUXdXavrY/pviaEcNTk3J yUeraai3e14by7NyvZ200PlX9r1/jxZ6JHqXhldT1+6kja0nubrRrK80i0jmUb7i50+SeGa5jRYw hiUs2GLDjNfx6/tCeMvjj4efw7Z+MtS/Z/vzFdRWFl4m8L6JHJFpDTzyq9teTWtsywFw586CMBip AxuzX9oX7Xt/8SfGHwf1fTfgvqR8N6/d2LJBr1/4fkkESPFJvaSJrh5X3BeXMMoCniNmIFfxX/ti /softE+L/BcPxE8T/CS5065kaKMan4fhGkaL5UeEM32OYB55bp3B80NERwGi4zX9UfQyeWxx9XD5 ni8OlOdlJuLm3Z2d52VvekrQk9rSj7yv+Y8a1Mb/AGPGpQoS54LRQTimr3a5YrdNX+FWvdNWdvx8 +Ierat4t8Zajq16NAtXuLl0e38PWEdhYKYzsJt4I0CRo23OAoHPQVycEWoWG2OJQ69sxqx/Qj+Va VzpF5o+o3Wj6lbTwTWs7209s8UivHLG21kYHOCCCCKl+xRzxgG1lwOrxZXGPXNf7ZUaMaVOmqT0S SVr2slpbfQ/hKtOU6k3UVm22797m3Z6p4jt7OayjtdNe3ugouDNaRvNhCCAjkF0z3KMua/WH9nn4 IeN/2qo9KtLPwx4K8D6HrAksbK8trK8lucWUaI9yDcXTiRQ33zu3FmOQQBj8hoNNsg7QxLfo2ckR AEfmSM1+yH/BM7xf8E/hb4mtfHN5Y+K7Pxnp97Fa2nieCOO/063h1B/JCyWEqSqXbJXf8gGeGBzn +dfpHYeusgxGNy6m/rEL8skuazasny80U7NR1cZu2ii7n7h4JV4vNoYXFSTpSWqb5b2d7XtJ7N6X iut7pH9EP7M//BKj4e+HPC63/jbxfdNNJbwrqcemm203TrvyyQ0K28SiSTfgAFwWcEnPSvZ/HX/B P34G3uqJB4V0u0065tInHnazax6fBeJsJiQogE3BBIlUqScE7uh+0v2eYNdlsLXVtR8TafNBFHF9 putU0+386byWO5bcfNCuBlVwFYA8HjIrftea2+h+HrzVrPU9Pa3m06WCyuZLdpPLeJldAFhLl2iz u+8qdFI9f+eriXi/iDFYv2+Ix05VHLlbvJLtpFRSS8uV2srWZ/cOBxtSlmqyui1yvZcukX846y3e s7PqfwD/APBSXwpoOg/HvU9N8Fw6fFFZzyw6hHHNBcq0nXzF8kK+0Dhd8aYAA561+ZF+LiNhCkUc xAzkJsH5jFfsB+1vD8FvEnjeX4jeFvFEl5r2u389zrdommtDFHbqqLCGtJEi2M5DOcSOpUjnINfn ZcWCu2Fy2cfJsBGPxNf71+BymuHcBh6jleEIp8yad0rP4rO107PqrM/jXxZw6/tjE1o296Ta5Wmr dNtFpuraO+586vY6jJl7r5R2QZxj6f8A16rjT2Z8JHHnseV/rXvF3pssBYwI2W7BFUD17ms+OwuX IgFszsTgFlTH5kgV+60cGmua7R+NV+p5JHo0wObkJz3jfn+tPjQB/J3FuwG/BH4mvarTwy+okxrA 7MpAxEEyc9hz/wDWq2Ph9qd+rx2WnXrFV3l3jUlQT1IHOPwreVenR/5eL77HPHB1Knwwb+R4fK9t DbbriQJg/dVyx/M1kvcCdf3E8gXPoxJH0Ne2at8L9f0yFZL+wvUUk7WktnSNiOwYrjgc9a47VdKs rKJPKZfmGcqGXPsPWvZwdeNayhNNeTv+Rw4nBVKSfPBr1PN2AgJKzTF/7hU81l3F7eRfdZIicjLc /wAs13cunXkqHzHJTquXaqY0y5kXy0khkB/gZP6168cBVekU1/XqePPEQW5wTyXNyB5l3HIe4AIG fxFAjlRcAqzHpgA8VvS6PqEc5CwoSP7opGsHkAFxGVB4J8sjp7g1y/Uqjbunf5/qUsRFLRnOC6mD EzOsf1T/ABzVmzWyus75Y856MM/+y1rGx02BwGikfpk8/wAjVySx0iY/uhJCfQqP6U6eAmtW0/K4 p4lbanOSW1lFIQGRwehyR/SrEFoz8quc9Njk/wBK7CysNNhjxIUlHuCD/KrU2k6JMwaFSgA6MdoP 5Yrvp5FO3OmvT+rnNLMI7anMi1tljA1Dpn5SZPmJ/EVPDeGzU7SPLB4Q4Y129rAohFvGqquMZWTJ +vJrRj0IMpMksZ3f89kV+PwJr045NV3pb/16HHPHwWkjj7O7N8wW2WGIng5wD+YBrXi8N39zOsTB WVjuDqQentgV1kOjW42tObdk/h2KQAR7EV0lhaR2f7+F4kDEY+RRj8So/wA96645U3G1V/cc7x6T 9w4+78O3C2wtRGoI4DAhc49Rise20XV0lEk1gZAG/wBcW3KPwAFe8C4k25kCHj78IB/HGf8AGsO9 sI5wJWu2y38LLj8BgVVbK4Jc0X+QU8bN6HKyaJdNb+fKNjEchUP8+v5VBGmq4CFR5PALFiM+4BNb raeY38lLgqW5DYf68jFOWxubcndPYTKRhWkVuM9eWGK8vExUnZXVj0qErGHa3ltBM6WRiL9GDRq5 Hr3zVu1ivJZxDLFbtE/LOC6n8Rlhiulj0WWW23QNYRhjgtEi59PUVoWugyWY+zXT28hYDBLFH9sh WyfwrnjQnFrmNJVlK9jlptL0+KQwWojk7sIpCACf95aybib+zy0MdugU8bmuH6/QcZ/CvWYdJ+yn YsNvluQ0Ildvr1yPyrndU8Oy3U2+5fg9DIkgOfTlT/OuqGIcFyxWv9dzGpQUtX/X3Hjc0nmymRgf RvMeU4+mSOPwpVtrO0b7RBEHZ/QAjP1yDXqB8FqxVmZXPXCMU/qf5U1NDKOY1E7dBvV3YKfcj/Ct I6a1LGPs7u0bnlTaesh8+4sZTjk/Pxn2AIqeC0FxtlSynVBwRkDp+Zr2D+w73YrIdy/8tGc7h+Hy g1Rn0qOE/NGznqBnA/mKn2N7yT/BFNNWuvzPcfhI82paT/ZWjS66tyiF5oBHDfWkkZK5JjlQmEJg EsS2egx1r9Zf2O9O+Itz4rh12+s0/wCEfmtpLfU7ttMtLf7RFERmGOW1YMkkhXCZjAYkljzX5RfD HR9UvNVtjoBubOQyxIt3aySyG2dz8pIhYkk4Py4Nf0Q/sp2/x317QbSyPjmyMUM4jnSe3urppcRj Y+64t44wvGGUFlyOucV/Jv0h84xGGwFSEVFqd735vdv1TUZdduz8rW/pnwQwka+Kg5c142so2tK3 e8o/Pe/e97+8+Mvi9Y6Dpt3baNaQS6LdWcsd+mpaxbNqw+0EAx22n2wkk3oPvIZeDknFfkl8TLuC 01u/t/C0Al0wxl7cXs2qpJGeu/55k2zDONpDKOcA9a/dr4l/A7QvEWk22q2MUHiDV5Y0EuuLatHb WlvbqqOsUkZjVVVlznO4g5Ga/Jn4yWWral43ntbrS5BapCYoVkvb2e3lCHbyzypwxHODnpX8xeDG bKVSbw8Xd/GnNJadbN3b3s9NOiP3HxRpYhUYutJJX918rb1WqulZLutemp+bHjSK31m/N9Y2EFiv yAwaaZmTKgZf/SJJHLOeT8+M9ABXi3ijRGeFkVb2IfeyHUMw68KqmvrLxR4b0m3MrSWqQybnDqyO oHcbct1zx347k14r4hWxtRHJeWpdcbYjG5UjPUAZJ/M1/aGT5hGHI4txt3u/87n8jZlhnOUm2nft ofCfiGyjuGZVbUEOSGUxgtjOOdq8frXmsvhq0ZzJNDeyYOQzI4x+OT/KvrvxfczQSSmxt7hFAGWD 7n59RxjHfrXz7ruo+IZGaG2l1Be+2MdPxya/eMpxGHnSjOrPm+X+bPzLMqNWNRxgrfM8/cxWkpMX 7tB0Z48kfgRmoZNTsdhKyxs3+2FUfhxTbrTvFdxN5Uj3rRdS0p3Y/AAn+VZbeF3jOZJ9jHrmMnH4 bc16v1urL+FC689P1PK+rwWk5a+Wpl3d/DcSbWhRTnAYMu0/lir0Im8slILNyRg8sf0zUk2lwRqo lnDdcHaP5ZpiaXFOnlRziN88FGYH8iDXIoVOZuS1+Rv7SDVk/wAyWyttSVC1vbEHGPlBAye44OKp wxa59q3eU6tn77byB+VabaOsagi7nZu4Vhj88Cs2a11G3k80yNIMfcDFP1GRWk4TjFaNW80HNGTd mvxLNyl95n+lSzLg9RkKD9WVqdPbu9tk3Nw7A9QMgfmBTbS6kj/ewWx3bvmZp8r+INbR1LV7gCNn hjXoyx46fXFXScJJtyevr+ehMm420Wnp/wAEoaebmJALi6RwTjacofpnFbX9tW1n8h2yOBjYDn8i pH8qqpbai0quI53j6bwpIB+gzW3BYR5EUkdxzwXZBj+QNd2EdRLlg/v1OXEOL1kVLK8sZ5fNuUCg 8kbmP4deldZNe6UbfNuI0YYzvLY/AFhVB9FijffFsKjBy65I+oIFTjS0OHzbxt/efbGM+uOa9elK tTTjZM86UaU2ncyrrWNsRIuyir0WJN38yxrg7vXLmTcizFyf7yDOP0Nel3mjTXcTRy3Fk+3oA+3+ QwfzrznVfDI2lvJtN2OSknp3zuzXz+b/AFveO3z/AOCj2sDOhon+hxl5c382fO8tR/tHB/mayJbz b8qwBjn76sef0q3PoxBIlifAHZiR/wDqrGd/IfavmEDGFRf6+lfC4mVS75j6any20LLTSBfNZWAx 2YUJfBQN6txxnNZKgsTJIGbjIHPH065NSIgkbzACo7eZxivKnOd7o7IwikahvN5y5OM+3OfwoNxj Hyggdc1UELKC0bRNz2P+NRv5inLgge1ZVYy3ZSt0ZoedFt4T6leOnTp/jU8ctuwwm8HPUgdfzrJi +zn5ZXZW/D+tatutjGCzSgkjABIFHI90irrZmrE9yyhmYkD/AGsVs2d5L5gG4DnoaxIbaV+bYM46 8YNalrFewtyMf73BrlnT6HTGT3PRLO6tJU8hn2HucYA+hyK7rTY1uIVWK73EEAFiVYr6HBwa8qi8 iYKu0huMnj9M12WgeSkoYyt6hcA/zrmoYZJ+9G53e3bWjPWLfQrqOBzaybWf+JZmwD7df51594kh 1AN5WogzMq8s+GJ9BkAV3mn65FaxMWeFmxwpABJ7ccf1rhPFuv6jPCyyrCB0AjjAP0613040ua2i /H9Sqkny8255XeJ5z7FtXB/4CvP4D+tRx2Dhv9VKvvx/hUc1/OOCpU/3T1/QUkN8C4DRtnuNxNel H2NtXf8Ar0PJcp3NJQtupB3DnkFc1G1w5G0rJt6ggfypJb0yrhdyj+6M8fnVJ5ZsZG4jocH/AOtW VaqtoPQ1pJ6tlpL6IISS49Qx/wD10sV1Gx55HY+lZLFieh/Lk/lSYdSA3XHQ+9eNUlJ3R3QkbKTR EncOvfPtVeZ4mX5QB2ODUcRBTarJjuRzVaRXBOSpHqK5uWzuaykOlZeIyD+dUnKgELnPTk9KjlJT JIHA44qryPmOcE8//WrRX6nPJksix5DEH8D2FRCSLPCn/vqoCWH3eR+tNBIwTxVc/QyZKTH0O7nt kUbYvQ/n/wDWqL5h0ozJS9ouwz//0f4QgzEbueuemKTeSQeSB0JHOffpTULtwDntz7f40rh2TCkN g8DFec0e43oROXYFQOefX8KiLOMOvGfr6c+1POZE5OFwf0NMZiBwOfU+tOMb7CcuhHnjYDwSRnH8 qeWB+XpwcA00BWwzcE/jkUqrknacZ/X/AD9KHDVJlNDeRn0wOBSM+0DIwAc+v505gSSSCT/Lj2pp BK/Lx247VCirakuIgPfjIPHuKaBkhW6D3p7jYduSPoKcxGducgHAHtzQy76WG/UYOaUkDIOSQMkU hyxx1P4HH04p3zBRg9B0/CtLWJimCr8uT34FIcliwHQZ68mlCHG8Hg9OnT1p33TjHbOcDH4UaaWC /UBtDfeI92yakyhTbyc9/wAB/npVYl9xJ/IdB/n8KlQyBANoPbONxqL9hyWhMICYyz8dBk1FtO7a B0/nUonULnaAB6Ac0wup+dQ2dvIOMfUdqbQrtrUCMtudCGJ7dKUDBwccZJOOOKEDHaCcEEnknnH4 0ikZ2MSf896LBrsNyOC44BwMGpQQCWIzk4we1NSMcHHfkYHNTMCOxAx1q4RfUnmb2GnO05Xgngii OPJ3L+J+lP2NtEmDnNTrPGFBKgeu2tFFNCUmtBoHzE7eq8HFXYcM3zA496RCjDO38SasxMBJ/wDE 80vZdjPnLUJjyAEP1yK3LO0t7kbWR9x5UDByaz4YIJwAzEfSt2104QjzIbgIQeNw6VNSjK2hpTkr 6mfdWJt+APXPtWT9lySd8a46DJJP5V1kzvFETJPvHoB/jWDJdQMmFdgwPHGB+lOlT7szqaO6KYgM bAlhznqD/WtuKV40ywIJ6e9MtpA0itIyEr/fQtk/hV66YsgJkyenAOAPxrlr4dvVG2HqLqZczMcs AfzrFkjkPRa9h+G3wb+KHxm8QQ+Evhlod7rGoTjdFb24Vd67tmQ0jIuNxAznrxXnj6RPYamdN1SR rV452gmZ84iZTht23J4I7ZqsuqUZ1pUYzTlFJtJq6TvZtbq9nbvZ22NsXQqxpxrODUZNpNrRtb2e 2nXscnPZGRt0gbjipYLW1iGX3Y46DJrrElg8tuJGwflkz+fGO9WruGxkWCSwukk8yPfJAu/dCwJG xmZVBJxuBXIwQM5zX21HLIpq0r3PnauKk0/I5DyLIcCNz6HHNOSJVIX7NKR6hscV0hs9rb1JP1JI /lTGjuwco4Unpj/9Zr0XlbjrJfgjgeNW1zNFtEYwRbv6DJP+FLFa23/LUGP6g4/lU0tvdyHe0gz3 ODn+dTrBeTKB5rg9MFB/U0o4fWyh+CFKpfXmAW1nEQy7iM8FVNWGgso/njjZ2xznp/8AXrQtrCdV 2zSOc+4/oKsx2En3l3kez4/pXq08vlbSP4HFUxST1kYaXnluoEUajOPuVv2907KGUQ89N6havW1o 4U+YCfVWOe9W47dunlKw7c4H6V14fLqkXzN/gYVMXB7Io+fdZJMcMgHZOorSge6QArbkZ/h3AD9M VZt4fJHyR457Y/rV0CV+Ah645A/+tXoU8I0r3Zyzr3exX865fahiCnOcqxP55rViiuolDHYRxgcE /nkVJbMisY94X1AAHPtWxHAXjD727YAfjIrdYFvVsn26tsXtC1bWtFne70l/Ld4WgbzYo5FKOMEY dWX8cZHYivrr9nHwj+0Z8SrS48D/AAwW5k8Ppf2j63bW8sMcPmXMiRx7pCjSqXKgAp0xngAmvk2w ktEDfbvMIJUYEhQgA84IyMkccg9a+qf2f9Wml+IFpb/ALRPFN14taRP7Mt7O8e6SUhvnM0NukTlV UnaVcAHBbivz7xJjVp5ZXlh4R50rqVRJwXL1leUWrK9pX93fW2v3vANSnPHUVXnJRvblg2pO/SNo yTv1XXbTc/vX/ZF+F2n6L4Z0uy+JXhqDwnfWZW0tYG1jz4NRV40R5pEiWJ5HkIAIbJ43Zxmvvnx7 o2hafocmm+GNUs2tYUUyNM2CGyAYoy4JzjjJOPWvzd+B1t8XvEGiaV4q8ci3u8x2t1c6LfWv9m3m lXBt0V47ZmdydjkgLKN2DgNxmv0CudM8Qa5pyavrx+zRTQeXpNrDaJJJvI5baflZuudyk+lf8dvi vOdTNcSsVVhVbnzXi6k+R3acY80pPlbkm+dSV0nTkk3zf6RcS4eUcVh688S+VfZdrX0taNm7212S Sv2sfzh/8FEtC8d6PovjPXfhd8SNVutJ1DSozqPg65nsHs7RwXQokUcRkgV4jh22MzgEjpx/Lb8d PiV4a+Jl1p8/hjwrpHhi40+0WyvDoc0v2a+aMBRMYpAdjNgkkHnPNf1i/wDBT74leLvhL4Jn8VeF /DVreWkkirriTadp0dtLaSF4/OzqETXYdh8n7qNwG9BX8knj/UPDviPXdVv/AA5okWn2t/eC6tYp pRJPbJj5oozCIYAjHnHk8dAa/wChv9nnh6uI4Ww+OxVBe77sJwlGL0Sg41IwULtJJrnUnbW/Mfzn 9JGvGnilhqVSzaTlGScr395SjJp210ai16WPIVE/lq23vzg//WpMzRsGjDqwOcqdpB9cjHNaP9mr CxLLu9Aecfka1dLJtJHZbeKYNEYm89NwXPdckEMMcHPFf6QyhzRdj+TacrSV3Y+s/wBlTUfEXi34 rfav+EW1/wASxWtiDcaN4VgeRZCWEcL3aq2BH5jBS7HAJ6HpX9MP7O9jJ4mT+0Nc8GeItJ0+zkGn X3gnxG8NrbXBjZTDIIzaRssYcYCxSOpIyVBOa/nq/Zr8N/GPxrqmi2/wu8PabePb3UVnNrunQraz 2yyZk8q7mYxDLgE+ZnJVCMld1f1HfBn4v/FHxN/wjvweuvD9rcxw2z2mt61fWbW1017bjkrbSGSK ZYwuWKFlP941/mP9MdtzjDCxptpNP9404JdeW/Lr00UtrN2P74+jxGVPBznVc2m7t8tk7rX3ld+7 1s2u9j25tT8ZfECxitrKy1mz0+a7AktNFtIZW0+ZxIkkyveyxArCwOzZ5rgMG2kivv34e2Nl8P8A QbLw2DqV3FawiO6lvpXkM4XAeWTYhZnY4OAoDN3GTXk+i+C/FPg/w7Lr/hqe5u4LxY2aW9itRZmW T52nKRspjDMy78sDzyuTmvTNI1zZoUMXjXUXtNYut0rLDI6JHk7v3SuHCxZ4zk5UcV/lDmeA99NK Ks3pbXf5adF+Wp+wcT4n65HkpPmp3taLbd0tW0tdNbt69dzzv44/EXwBqb2Gs6JpPiG2vbWV9Niv PDUTyPPbho45tgybcbSykicozKp2fdNfgL/wVD+FHjnxIzeJXn8dW9jb2kU2lHVtStLxDnKs1ppz I7i6cEv+8lV1OBHjt/Qn8Rdb1e78Ayarb3Wgq8rwLARcmSNXDYdVjVreQPyOcgHuOc1/Mt+3N8fP 2lNNsVsfBl14ctptOvP7QkvtejtzeTXcQCv9gj86WGWGTB3eZGThQu7PFf0b9GPKswq8R0K+FVKM ouz5+aKs9rWTS7XtK93prY+fzmhh6OQ1vbRmoRvG0Xzy9Ltra97abaWP5lPENnPpniS60y5muZpY rh1kecFJ3OeTIrZIY98k896iWxknJJLr7bhn8QOa9N+JnxE+IXxa8V3Pir4iLZ3WpS3Mj3t5bWVt ZmWV8A+a1vHGrYCAKDwozt71xrWU8dlDclIfLmZljCTRlgU65UNuXr3xntX+/wBgKFaWHp/WFFTs rqLbV7dHZXXbReh/mrjZUY16n1e7hd2ukna/VXdu279Tp/BWn+DdRf8AszxFJra3EsgjtjpawsDl T9/zMZ+bHO4ALnPSv2u/4Jp/s06JrPiO+1LUtU1qze2tre5Gm3F2liL6VzIbNoZYfMEybhgxbm3F gcEdPxK0yTVoofsGnwqyF/P8oRCQg9CwYKXAx1wcHvX7i/8ABPjxD4aWytvCnikxXgcm+g/sYut/ YRyBkdUgVwkitIy4IAZSRjjNfzH9J9ZlS4cxTw02lLRpJydurW1tN9fNO9k/6K+j5DA1s3o+1jrF Ozeiv23d32+5q2p/Tj8APCvi/wAJeCLbTLOxg0iONXmXT3ZZjtyrbrhpA05mY5LOJCHOTnmtL9oD UoT4abWPEb6VfW4tJBZpYO1rK8s42bWeGTehT/nouD1JziuE/Z5s4/DOnNp2kXHiwzXd290pmdbq MKoCiMum3ygCpYQnjJJOQad8fJrr+1JLG4imDmKS5adZolKjH/LSEYZWLADMI5z6A5/wJznKaks2 nKcnJuV72fe7tdtpvXqf3hgsHzZrFSskk9lZ2tb/AIF09unb+P79rHw9ev8AFm8lvtP8NXM1oGmh s59Ua6he08rKzSXMlwpLKMbVLLu4AU81+bOvWE73zy3iWaB/n22rKYlz0ClWYAD0zX7D/t9/CvSv AfxCutWXw9qenwXjpNrGr6Yipp1xJIm6JYYZjGyTK2DIp46kZr8jtYsbN7hzCN0bMWXzVG/BJwWx kZ+hr/b7wQxkMXkuEqUqmnJFWs9LLVfFJLXpva1+y/irxewzpZnXjOGvM369n8Ke3yve3d+aXlgn lHyJFUnp8xxxVS006Bpki1ArtLKGYn7oyMkGunvYIgFi2hfRR/UHpVWOPyj5ifIVO7sCMc5Bxxiv 6DwWC5lyt69z8LxVVRldrQ9+8EWHgTw34jD6HqeqhTH5yXJCfZrlE+byXjMYYjcBzyD09a+wLT9r uTQL2DxDDp2ivdwxpbSW50e3igmjHJ8xlUksW5GMAdsV8PeBrnVr66L+bE3n7YVlu1WXywe43guM ZzhetffHhnwx4ZsvCd74elOjNdMxT7ZdyEGMhc7lZ4ywBbgbevTjrX5Zx9wrlTcZ5lT9vLbZbPSV 3y6dP0sfqvBOb46cZRwMlSW/XfdJK/r+tz57+L37aeu+J0uPsmhaRZz3SMlxdwLOzuHJJBSWZ4+Q cfLGOK/NnXbu71a/ee/DHezOu0YC5PQAZwK+uvjJ4b0DTADDfpdThsM1vB5cYY9lJA3L7/zr5avx 5J/dh89y65/pX6z4e8GZVgMInl1H2cZdLtv/AMmd7dj8v474kzHFYh08dV5+Xa1kvw0ucbHFelik fyBTgYdc4+jCn/2VeFt3nkjqWbAI/IVrmeZSW8ksvqI8iojepLF5ZjXgYP7vPvzz/jX6nQpU7Jcz /I/McTKWrt+pmkRwrnzS56Da+c4/CqqT3HmtGVcdD94EfgOn6VqNDcCINDEmMZBHAP4ZGKqFroyY uFjHHGFY4/Gu2UWrX0PMUtx0sUJf55p0OOANpFV5RbSIFV53bGASP54FWYrctIArAkdPY1f3XEa4 U4HrxzW3Jzbr+vvMVJp/1/kc0mkwsfObzMg55jJH5mugt47eNOcgnrs6/hxVsTTyEeZGwxn5l4/S nCHLeZGk4Yc5Qgc1dLCRp6wJqVnLSZYi8pPmEiEHjLoSPx4rctoFkUzyOjdAAsQ5/Gqdublh+8ik KnjJIU/icGuht4YdgkMSKwI5DE5+hrsp3e36nPOelmSRJYxBirds4C/MM9eADW5bw21xGqQKF6bt 8bHPHUcc/lT4Y4ZJQQVjO3PGTnH4frmt6zaIDa8inn/VbiPxAJrqdO6sZQm7pldbLThEeke0Y+RQ uD+K1V+xWS7RFI+7cPnZeD+QrqRZhoGkEjBSe+Tj6DFVXM7Js3naRwGJB9OOlcrwyejj/X3nSqrt ozM+0RQDmUOOnIGB+fSmtqsW7awhww+QNwDV+WwunOJpsjGAGRWwPqefyqrPZz7lWRk8sHoycn19 qxnSny2j/X4nWpwum9yFILe2nRlFlFk7voD3xknHvW2xLsWlm06XHCSDdn2HeshFcMfKW1IA/wCe Rzn3IIrb0+BmYRy/ZgzKDtWLnP8AvbsECvOqUqi2idMZxctWbIt5SifvIMHqy5BIP4j+VQT2jyKS oD7T2kBDfSti2sI5ImlmaMsTgsQOPQc1MjoWCR4LKeDkLj6Y/wDrV52Ip1Gm2tj0KPLtcwV0eedc SRFD0zwTj1HPHNTDw6wI83zAU6KpB3fp2rqTAiKCmVJyTnP8+TzVu1jjK7WfHqF3Egn/AICa83FU 8Q9YxVjto+zW5x76PEgBO49MHdyD6Y4qW30jS/NA1CKaUEFSSFXj2zkGvUfs0f2dVJbOc52jp261 Ua1UoEeVQTkjsQAe7DpXnUZ4lKzenodlWnSbuerfCzRfhbpEsd1r2h6teSRI5tzYTvFu2gAnzYxn 7x5K9CB64r90v2YtQ+Get+DtP0rS1ma/gsVa90+4lWFC6v8Afmd5F83GBhhy2B0Ir8afhV4LgvHa 4udZFraqgEVzGu9hKxB2lXZCBjndgj0Ir9bvgA+o2d3NYK2sa5ZiSO5tps4ZpY8bQHYzGNThSMkj I98V/JPjvhnVpSUXJzjrfmsvTVW6t2TTP6e8G3OlUhKUUoy02V/XR36Wu01rY/RXS7u9udDXw5HH bSxRE3NrY2tz5e2TkNJlZmkLoM5AA55I5zX5zftH6J4X1W5ls9Xj0/T5pVEiwwNdXt3KAWfzZJjc SJvc8BQobttyM19z6t44TS7+LX/s1/YXcsaAQXUbmRzGACjTKWwuCQxUKMckYr4b+L2osun3t/p0 elWUJv1ma1hngu7hpGY7tylRI6nJ+UMMfia/nfw7yvFUsZ7ZQte3ffr3T9VF37n7hx3Vpywbhvby 8vlb79OzPzN8XeGtG05fs1vFdRSxM8sdzOGdTnkIUYnHHqc5PavF9W055JFlkMruV2ncpCqfRQMi vsbxZeQ6DfXVvrNrHAt6kiIt1pUwcxsMh4vPkYRtzwVOR7186a1pmm/ad/h+9aSIrlhdRH5T3Xhi D9civ7j4ZmpU4ydJevR/O2h/GHEOFUJu0vl1X46nzZ4q0VRbtLdWpfA5ZgfyA5HevmrxF4V02eZp fKkT+LYhKKMewH9a+z/EccnnGN5o2xyCgO4/huI7V434l3uhlkuxtzt2MjHce3GcDvX6/kmEjKK5 oq77H5vmdZ/ZbPja+0Zo7oizuLraP4GcAKR2JYVVlX5d10s7EZJdlVgeOxwK9n1mzYySTxyqw3Z+ Ujn8zXA3umNOTvZlXB6YIJPbpX6PhcC0vdR8Fi6t52bOKisbe6iBdZkJOAFAx+JGOabF4ceSYELP k8ZPcD3zW0NOt4w37l8AgtiVhz7DI61NBpNo52+Tdov3tyy7mz+Lc/SuiGDvpKF/69DCeI5XpL+v vCHw5CiAOs6EDGTHyP1zj3qO78O2wXzMzkbcY244+uf1xW0baCGLZi7VgcAsTn9GpTeXaEMryMij kODnjmvTjhaTjaUDhliKl7xkcC2g2DuYIY7sAc/LJF/Lk1Tl0yztZikaNkjOJdp49eM8V6TLdJdH zGIJxziM4HpnJrIcWew+e8C85w8RyPpg15eIymlHWKR3UMbUa1bMm0kuIGWMXATAwfLcjFSS2195 vmW2pXIyclTPn9Ac1otaQyvhnjwF4+QL/jVS50KKcCOOSYFumGOD+AA4rndGSjtf52NVVTersZ5S 6VyLqS4lbpnJAwfc1oiG1jYRu4f5cKshBOfoMVPH4St7kmDzrhWABYPvk5HoSeK0LTQdOsH3SLcE 9mwTyPUc1iqNZvWOnds6PaU7fFr6HPXt6If9GiMYPOTtG38yK86v7rzJyiRIzBvvZPNe23RgETGA ycdd64A/Jc5rz3UtLedmMskYAOcPn+mKxx2FnKPus2w+Jipao8ouGukyJIQueoEgIH4GslwQ5K5Q H/aAz+Vdzd6ZBGrLDLbuxPf0HsQa56fT3iIZxDg9Npx1+uK+MxWBqRff+vI+jo4mDMJ1lDYRSf8A gYqq1s7yfOy88YODXTx2sMPzN8pxyVbK/lmobpFZt0c0Jx0wOa4J5c3G8v6/I6KeJ1tE5J7dwx3g Y6KAOcU0wxoeVlG70wcflW4yOD5rzxAH1OD9eanEKOpKENjqVI/mK4ZYG99DpjibHMNFErfMz+gB A6/mKsRKW6LG3vgf41o/Y4WJZ9wGem0HNRGwtN/7rIzjJHHP4VzTwTWxusSnpct2srW7BsDG77oJ H1xW698bpQvlBMADcrEn681kwWIzuO8+npWxb28ITe5xjjBH61xPK5Sd7HTTxvKmrmlbLEqqxZsd wAf8a7vQ7+ziPzEnjoVOf5GuW08PgGNU475HI+ld7pTvIyooiwD0I7/lW8cpqWv+hpDGxOwhv4po PNtpIVbqd6kMe3BwK5fWH1FpG3i32Y/hyQfxOK9Cs4isaxIqP3I4zjvgFf61k6xZGRWCxwqHJB5G enUcDH4U8PgcS3Zr8DtqV6Sje55BNZ+ecxzW6Y6kgn9RWQ9vJBJiOa3PrtyD+td0+kqjFVZVJI5U rj9M/rUTaLK7MY5FHGA6r1P+Ne//AGNPltyWf9f1seHLMY83xHBi1lHAkwM5zkEUs1nLbjPnofXb iurn0a7AxO6AAY9zXP3WkGLKphufc8fWvPxGVTgr8h10sXGeqZzs8RU7/MQ+nPX9KgViTjj6A1ck 0+Z2KquB/umomsZ4P9ajYHOccV87VwtTV8p3RqLuQrIV52n1696Tzx3B/Hg1JtBOAD+dIY5CucYP +0e341xuk3sbuZSkmyTjp645qoz9xV2SByd0uB+NVCsABK8mqcNLMxcru4zdk9vekwDjPpxT1jz8 o6jqMU8RKDgYz1/Gs/ZPcd7jQc84zT8n0P8An8aQoynkd6XP+z/L/CocGUj/0v4QAhI/ix15H+FG wjHY5wM96RW43HPHHBFI0rZ57Y4Ixx68157PZk+gxyBnfnIHJ/mBTUI3Z46En3pTxwBnBJxn9c0x CMj2PORmqjcdiMq3G78PTkU4L8wPoM/5/CmgpyAfpj6UqsCGHAJ9Pb61TnbQpsTcF9f8/wBKeSSp VBjA6EcZFNVA2cYwev8ASnbAAMnGeCcf/rqEmJysMHzKCVAJ65/lTMKGzyT+Q6VaEe4AFh64APIq sFZVIxnOOcdcVcVZ6Iae44bWAx644PpTgyqCcZJH5UsSEkg55Pb69aPKIUgEZAH/AOoU5R3FzDC6 nqPYd6Tcw4z0yST/ADqUwgAkN24NRr82Q38+RxWahdaBF30JVRWJKEc9MDrUr7goO0gAdevbpSKk mcn88gGmqFX5pBnnnByam4c19x4d8M2Rgjoab8q5HA/z1qW4CFN8fAI6Y5/SqhdwCDzwBnjt701v YlyuScfKQ2Tnn9elIFB/iwM4phZCOTjnPtQiqf8Aez0rWD0RSfUsKyA8Edee/NWDFNMuIyCP19az 9sZIYjvyalX74+V8A/wk960ilexnJ9STyfLGx2AP1/wFTxRrtOPmI4x1qszW8eN6yA8cntVyHzZM +VuPOMnof0reELKyRjUm2rlmK3kk5ztx6VdjtG2j5S2Bz2/GnW9tfE9Iv++fpWmlrOfvKpP+zgV2 LCK1+VnNKs77iW8MgflAv4E/yrs9OsZtm6F1BHfb/wDFVz9vDcngqo7/AHq24rW8Q/djYHGevf0x UfVpRXwP8TWnVTe5Wvo74uYo2iGThmbaTz6AVz91btaklmjc9yvT8q6u5iuov9WwX/YBYfrWJNJq DT+X6cFXIH5E1EYJLW5VVtlXT2nc4QooY7QScAfrUtwXRihJbBP8QINV50uoCjXShg+SPnVhjOO3 T8aiSEysxKhR1Hf+VefUbbsdNL0Ldvd38bKkc06BAQm2RhtzyQNvQE88VmSJqjE48w565HPP1rVW xlGHjnVTjgEfpVO4j1hXz5iMD6KOg9816eCwzjrJP5WObE1bq1yG1S8f91LJIgPHIHerZ0m/24hl BU/3wKjjmvFILqmAfQf0q8t8Yxuc556Dp+WK+pwyo8qU2zw68pLWNisdMvUwElC4PI4xWkmlySLu UgsO6E4qFNQtZ32MhY99o/rV5FhB/dfIT2aQKK9LD0qL+F3XqzgqVKn2lb5f8ErJZ3MJ2zy5BGfu g1bQWkh5mfcD07fyNXykgj+Zo+BwfvUtl9ncss7KpPQ7tv5V6CwyjZR69/8Ahzk9q3e/4f8ADBCG C/LKMZ6bmz/KrnkCRCTIR6kH1+oqnPDGtwESWR8+nIH41ExuIGBiZ85HDAc10qoopqS/EzcOZXTL 0NmhOI5Xz7MRn8BWvbWpU/PNITnHzE4rJjk1MgNHFGx77zg/kK1rO81F+J4wvvkcfoa6sPKnzWUX 9zOeftLc1196NKOA7hI8mV7Db/UVrRwKV+XnjgYzz9Mis5JZ0ztiY+oAyOfoKuWc8xbLRkfTAIPu Diu6lWprRnNOlNrmRaEMK8PG3I6+Uev61ZFvEo+XywvYkYNTtczR8+UCRg4JI/Hg1JHMsvDQAHON wLZ59ga6VUj0MlCXU19A0S21jVIbCaaG3EjhfOlwqDPXLOVXPpuIHuK+wPg54M0Hwb4j1KHUdI1L Vb54Ip/D9xYXgsZ2jUlpDHFBMGmdgPuRzHCgnBOCPkCKxmlwzBgp4BI5/HJr9Cv2TPi3+1L4WjTS fhBJY6jp+mylHstWS3uYY1mxIRFbzsXI2xtu8lScE55Iz+UeK6xSy2tLCzhtqpzdNd786TersrbN N6n6j4a/V3jqSrQldO6cY8/r7r02u79LH9OP/BPiT9pHRfD803hWxtE0aVobp7Ua9PeavaX5Cbje JqBuFiZ0UY/ebcYAA6D9ZYdO+Ndxa2+qa7rMtvPdETXKXE9uTE5OQIXtsDAGAGK9OTjkV+cXwI+K 3xA8Xnwtocvgrw1ps/iHS7W61C58JovnRqVBK3iXRWSPJAG7aQv3VfPFfp3c/CDTdRguIIIr5nLb rpEneKNJGbCIMgICAN2N5B9etf8ALj9IjGVP9Y6lTG4alSdWXN7ijVlp7rbk5u7ut+VN2T83/plh 6tHD4eh7TlXS8oLmt0vqklqraWvp0P5sP+Czvi7xt4j1PRvAHxC0TVL8aS1zf6Jq+h6pBdQyC5VQ RcQiB2VF2jdkfe4VgOv88HiDSPFOjaR/ZmraRb2sslw9wl7dQvFdlI1+aEMxVCgBBI2Zz37V/U3+ 3JqPxf8AA2j+K/APhe/0e6jW8e2vE8XIltbNAf30UFvLqFytvcptTazQq+G4GGr+VzxZ9s1XXZ5H sYbM+Y0ckNuWlh8wMdzB2Z8gnoQ2MdK/3D+g3iIrhPDYKlRpwp0tfdlNtuXvczhJpw5m22vejLdW TSP5M+kJgaVPMPbwm5OpFbRio6WWjSs9vJru3dnmaQamkhcJGw6kYYfyxVw3LjHmrGpPYjbj6ZNd OdEuoF3SHGD/AMs32n/61ZcrhJCoVpO/71wxHrg4Nf3a8RGb939T+Z/YyS943tBgvL60m06wXVLi 7mki+yxaexaJmBIAlRfnzydpXpmv6nf+Cfuj/F7xJ8NtA/4SB/7I07QJgsOhana3Op6o0K3AR5F1 KW5sY2DuG2xIG8tSA7Niv5k/AHjK08J67Y6xNLc6SbZ5GTUtOjV7hMrjjDRMcH0cEA8c1/U1+wp8 OtA8ceAfDPiWT4kG4fUIZZodKv8AUobbVjKrFowImnkz5gBcozfKOTzk1/EP0zMUo5PGNWFouWj5 JT15XdJWcVdLfSS6NX1/rH6N3s6eIq1PatPls1dJWurN/a3f+F6XT6frJYad4YtvGc2mSXmvWx1G 2AsNIvtOuLexFzG3yy+ehlzuU4x54jI5C5r6A+Cn/CcWmjyWvxF0+3juYr+4hivBdG/tHych4czh o2PBZCCByQOa8btfCT6ZZjVfFUsk6TRtDawS3sMckcBOMmSFkVJGIyGLFhnB4r1r+wh4Os4LjSrb xDqsN9aGOziSSOe4tg3yLM8qyDcznO1kckKMsBxX+O2McJJxjG+2r09LXt5brfXfU/pPiGp7al7B 1uZy2bs7tb8rTVtN73T2vfQ5z4s+Eo08Nahut1u/KEpjv7W3ISGQg7WTfHO0ZXs7HaTj5a/kz/bk /aB+Kfwp8IyGXVdN8QX+rs1hYm88PXlhc6TYbvMia3uokgtTMmMSOS7OWzheg/q63ePJfh1qnhfx f4TSbyZxbTS2d9tl+zSHMbXYaR5FlfBBAyDnPWv4xf259c+BniL4ieNPCOv6vfWWsaRdlDaX99rW pRJcDIJWKCJLTIyud20A8bm5Ff139DTh+liM+nHE4d1YU+WTUYxnpe29nJRu1dxttZnxXiBnFfC8 P16dPExjUbcYy9okneN7+7Jx5mlomla90fkPqvibXvEuqXepa/NLK15J586AiNGkUFVYquRwPbJ5 5zk1mxfZSCirGnGflUE/yqnZwBnOBH97A4/xrZjg2sfMKIw9Fr/caPJTjaEeVLov8j/OaU51JOU5 Xb6s6C3164gW0WS/viLdWWNF3xiFW4KxtuxgjrwK/Zr9hzR9I8G2tn8Spb7QPEi6hCwt9P169g8j T5bXBd5Eco8coQgIDu5Ax2NficLq0DL57BuRn5TX6rfsxeFf2RvFNhYQ6/Dq1h4ot3juVivP7Qa1 lJIIYQ2llOWVGHO4gMpwa/njx/wkXksoyhU5ZNqXJBS0s3rrFpXtqte6P3rwPxj/ALVV5QukuXmm 466LTSSbt0f39D+kf4BatqVpNcnStF0X+xNQkjY6il/KYhIGYPlxJIpl8wsoIYKec819J/FnWdZv PBfkSW2hzOJDHHPPco0gePJBfzl8pAi87i5PPT11P2cPBXje+8Hq/g/TtIsTpifZyy2s1rY35fbK WhguYbVwrAkFwMB8HnOBx/7SPwx8ReI9BuNX8R6d4Y0BkhkhN5qM6sknADF5nikjjDrkHKllUAbq /wAE89rYbEZ3yVUowUrX1k9Nm/eV33P9DoZxhqmJhC8eaKv8Wt7bcu9rdk+l7H8637Zn7Qvw+8X2 jaALvxFfWEELWGq6bZywz2t3qEBDRXg+y3KeYjSceW6AY53dj+GPinWxruoS6kYI7XzH3fZraLyY k7bVReAB/wDX6199/td6N4c8I+JpbbwnN4XtHt7gQLF4MeWWBlUk+ZNcy2sPmM3+w7jPevgPVp7u S6863cg7h8zhecDHYYr/AGV8DeDcBgcopVMGpWkr620vv066a3d7LsfxN4v8TYnF5jONdr3e1/lu 76dtLa9zlLgRuAIAWPUkjBH/AH0apC1DFjIWjXGTuHGfwzmtm7fW44xJIIiNp+fAJ49qzIbu7kRr YysRIQWRVyGI6cV/Q+DpJwUov8U/yR+E4qXvWf5WO/0O38QeG4t81iqb/LfddJtlCtypVZFOARyC BjFdy/ijUfsSm5SOEREFWjkZGz68ZHfpiuZ8NaprOtazaaZfarbxopCJJq0rx26iMEqHLAgKPuj0 r9o/2T/2bfBnxT0xoPH2g+EBEJo7f+2BqgiUFwQgETu+/ceMiI4HPYGviPEPjbA8P4T67jqHN/hd nrp1av6K78mfbcC8MYnNqzoYSty/4lp36Jn4g+IbyDV4mLtIJGI2sQXB/Alck+v6V43qtjLbT4eU HPpETj696/pe/a1/4J8aV8JfBM/i+KdVgF89rF9iihuorqXy1KR27FoZXRUOXbaACONxr+e34k6X daZrFzo0iTxGOTfHvHlqV/vCNl3c/WvS8IvFbLOI6LrZUm0tNbq33o8vxI4BxeUtfW5J36q3+bPF JlkhJk3qR/sqV/nVFpJCBsPOM8ru/rVq/nMcuyV2GfvFgcfnis97i1PEMwU9xu/+tX7xSxEW97H4 riKDXmRm4lHzzSgnuAu3j6VH9thlyoMeOm3Bzz9BSq8ZlxMy/wCySR/9env9nLGIMSW5wEH88V10 6spKyZ51WnFatFSWzsmIEbRpnqQOfzNacMDRKNx81McEDGPyqvHbskhkbfxyNygj8quWzGf5mnYJ 2BG3GO3auqhStK7jZvt/w5z1HeOjuRTRAuJW3jHQfdHP15/WtK1Q7g1uCf7xxyfxFRNZ2902FmYl eCC64P4E1sWmnpbbfs4+6eQHAHPqBXQqMrtJaHM6qa3AwsygZkU9kYkKfrwa7DSQ83yFl3YHyyL/ AC4qosCSR4ZWycZ2Y6++DW5a20MieXN5uccMo/nxmt5UowfNczpzc9LE8dtcmUiPEYPPHLfnxW1b 6fNNteadzt6LGQ2D9AKs6fYiRMqkjH1CNn9Qa6ax0+yhcm4E56ZVPlP51wYzEuPw6/M9Cjh77lCW 2R4VEgmbPQ5/9lz/AErLnsr5QFi8xV7ZX5v5da629tbTyz5K3Kc8byTx+VcndW8mTulJwTguxJA9 q4442bV0jR4ZLdmFcSBfkb7VlRhv3fH8qAA8anZPkjhjuz9fStsNdKQnmkoRkoScE+3/AOusm5kK vuvHCKOoVun14qqOJlZybsXKirpJE8AheLMgukOcFlXBPHpg8VqR2/yZDyOOmGYq3/oIrCE7Db9m 3OOxJTP4A11mki+kInmmkZFwoX39+f5CuWeMT1eq/r1OmFKztYv2dpEISQHjPqWAyfzFbUFlLLDs kj3BSeUVSfz/APr1DZ3Vtby5vboICeFdWGfQdK345G8oTWYdkYjkNkH8FPFebWxWtrW7Hp0qXu3u Yslnax3AAXywRysvTPtiuostEh8veJ413dmyVOPYj+Rq5AjGNbie3eVFILbUDgD/AHAc132nRaBd otvZu0EjNuDQgxKM9Rh/6GvMzDMnTp2s33aPQw+FUt2crb+HoJ1BuImQlfleKIk/rJj+X0q4mkQX O0IzxBSE/wBJiGxgOnGWNesxeFNPt7UXiS3PC5IMpDnjqCqlce+au2miW8iRzSWa44YRrKMuO5LN tcE+gFfM0s8i3zU22vT/ADPYll0tpWMzwrqFlf3kdvFPDbXabEMsCFQoBGNoWRcn0GBX68/Dfw0P AlvpXiDSb++PnQos0Ucn2lELLgE2skrSbwxJB3DGQcYr4s+FmiWaTprWqeHraKyti267Fmt6waUD BZB8zHjII9+9fox8GdD0TVNUt7fwkLzxEskZe4iaSdHtioB/495YxtIGRtyc+vAr+dPF3Po1afs4 pqEb8y0afk5bR8rt+h/QXhRgPZz53NOTat30623fbTtud3ZeP/jImnzygWOpKWeM3eoLbWtyqsSr I6HAwfUgnHevkv4x3ev61plk2p6NZ6f5bSpBqmlrI6ls/wAUoYRt34GMAcYzX6KS/Av4a3t27eJL e4ZLhC8jeInt0jtXUHckgYRzYGDjkY9a8c+JPwf+GOoaZLd+HdZhsUt5Yvs9lpbrMsisg3FCkror dwu7gHk9a/DuFuKcso4uM4UrNvdQaXa2j9fs2P2riXK8VVwk4uppbZyTv13f+dz8hPFXhfx9LI06 z6hfQRq95NO8MylVQ7XPzt0XGODj0rze7a6ntW8xLq43HIVItokX04JIP1r60+Ifw+Hhi7utNlGo 3EoQSwSXMbLu3DdnzQHBOP4WOR1GelfI8l6894dJ1WZoWRseYXwMf984H5V/WvDmMeMoe0pJNRs0 0rab3tf9F6H8gcQUFh6zhJtN3Wrv/X3s8n8QrpMV0Jfs5QsWJik3EL6ZKrnn0rxXxAUkjeGAAA5I zuGD9NuCK+ofEml2sMyrcNbgFQ3nxSiQsuP7oUEGvNNd8LwXkQktHWb5STuCkjB6fOy9vSv1jJcx pxjGTb+f/Df8E+Ax+Em7pWPk3V4iBsZVJHX5OCfriuNewePO9THuOSU+Td/P+Ve4eIPDVxGzXG9e vKoBuA+gOa8s1XTnQblkfcp+7j5j74z/AI1+n5VmNOqlySTPhsdgZQbck1/XqcDfQ3VjPm5IVCeN 4LfhkCnx29lKg80SKCN37vdyD9RitmZ9QeExzuwI6F1DCsaSbVI12RFHx8pIG3H05r6mK5V7yuvv /U+YrLmej1KflyWsyqkNyqg4DM+QV7cE1JJHs/eOXOOQWKrge+eOKsRXGoBh58KyKT1k/wDrGlln vJZRGIrcr6BWBA9Mt1/Oh0opPf7hrV/8EZbo7kSNHG6n7rBhkfioxWmLK3ucFoISwGD82fwOVH8q 0YfkgWJN0ZI+7tBXHoPmqWKxZn3QeUSf4mHPH0JrS3dXM4wdn0MKfQ1vCS4VBHwArbSR6ZwOBTYN KtrddvlIrZwD5uc/TI/pXSqkySbXMTY4G1Tkn8Kiu53C7oVQkYBQthuT2BB/XFc1dUPiSsdVNVLc u5lLpcokbMYQdmjk5/EcUi2N5C7PIZumAyLu6dzmtaO98xQhEwPo68D8RVK4kdW8yPz+DyFkO36/ d/rXHVlRWqudMPaW1MadLtN0klzE6EkENGNwx7BqwtQtPtpDQyQFsfxYxx9Oa3r37EoE09xJE+c5 +UkfUY/pXO3VxY3P7qK9ViOBuiBJ/ECs4yptWl+f+bFVjLSUfyOU/sq4DkI1u395k5yfbj+tZN5p t1ztCsueyhq3LmOZH4ut3P3B8oH6VWfU5FHzurDpncRXJ7CjK6kmjX2tRWknc5uSyiuYDFOqM/Tk A4/rXPz+HpxndDC6k8MuAw/DiupurpVUyYBx33dPxIFctc6nPcRMsEYkGSMKQT+leBmtDCpWnq/T /gM9XA1sQ37uiMqXRI5XCI6hx/BLkD86ujw8zJlI1Q9/Lk3A/mKtWFxeSwAbI4+3LgGr26Mj9/Kq /wB5k+b89ua5MJluEmuZrf5fi1+VjXGYzERaUXt8/wAjKj0hoVxKQFx/nkZqJtPKLiN3GfQ7qkBs JGKW00pYcfK7Y/LFZwS9trkmS4m8vtuKkD8ev51lio0IJctO67pp/jodVF1ZPWXytb/M2EtZQFJl Xb3BAJH5Vqww2d0vk7l3YxyAP6Vh223eXXMo6lxz/I1tR3ml4wzqjdcsvIruwcaPK+a1vN/5nLiJ VVJKN/kjas/DqREPAxBPTGSv6j+tdtpSpZuI5BIPU4yP0ya4/TL60JGyVfYshB/DrXZW+8lWWXax HBjyOPxr06GXYSUX7Fa9rr/Mx+vV4u1V/gzt4dStzEoVkPcAA5+nIpXJlYu8WDg43ICv5DBqKwsH ljDSb5Mcho32kfXkj+VbAikhA2O68Y2uAQfxprKp+0UuX+v68ztlmcfZtc39f15HKz2bBW2xBM9x gDn0Dc/rWWtrOrYjzuHJ5xn8h/Ku3htjPuWVEcluWVfT1xTXsyjER7RjA2HDfoa9P+zU/eX9foea sck7HnWowQJ1VSwPLZy+fx61y8+nySEmIonPOflr0PUre2tW/fKpZjx5eMH8zXNXBRnPlADHAUkE /kRXhY7KY3bqfcexgsfK1onEz2j7iqKCT0/ef/WqkdPuo2xKu4Hkckj881pai08TEbEbB53Iy4/E cVljVZU4/dIO6jLc18RinhlNqq2v69P1Po4Oty3hZla40+WHMjwAL/eB6fhnNVYraC5H70FfQ8kV vDUJ51Ii2PnqOv8AOom+1bC0lrEcYx8uCc/jXmV8Dh+fmoybXmv1R2U69Xl99Wfr/mYx0yKQlVMe emTVR9LVFPCZH0NaieWCfPsmHupxQ0cAbfFBOCOzd6whgKck9F+P+QniWn/w3+ZzbWp5Kso57cmo mjBP3jn/AHa15pY1JKQSK+ecE/8A6qgtnR8+YCO5+U//AKq8ythYqXKn+Z0wqN6tGX5XOVz15qTa 3v8A5/CtYxIx3HPPQEgfrS+Qn93/AMfFYfU2jRVLn//T/g7RXUEhlzjimmGQLjPJySf/ANdNDeaN pG0nsR09KawbOAS2eOe1edLV6nrp9BrFiMNk4OT+HX0pAApABzz07fSnAAZYYHUnPGQKYoy/Q9j9 fy/lXQkW3oKQzD5zwf8APWkxzgdQCQfWm5cbi3bp2HSpFLhdyN2xnPr35qOVLUd7qw0ZY7vm9cU5 AxQBh37/AK1KJ5U+U4PA4A/Omu7N6A59B3p3TdhSfQr7VCbCDjOeenbp3qNUd1+8fXnoTzUsaZ4f nseuaeXQR4QZwOB/gO1WFxCChDDOOncmo2ZUJHPT3x1qyZJVzj6fhURXJyx5B/Pj0/8Ar0XEnqQB sgs2Meuf1qUAGMDBxjv/ACpXiRy2PQfUD+daNtbWxUPIeMYAJ4z0qZbFKSRngowKHAOOMjrT1m2o eFx1PHJ+lWZUtPMzERkdCzcfWmNPPBlAY8kYGACPwIrFaWFuQLIm35VwTjP/AOqnp8nzKu7PJWkR pG5JJHXC4GTx3qwJHdgEEgwO5/z+lWlaVyHuQPdzMoEinr/KmLKrgAsqn0HvVt45H++T69c/pTIT DGdjHvjlRzXUodSLq1hhcFdsbE/hn9cU5HmhbcOVx8wFaI+zKCQVXv8AKcZpyTwgbQSef7wrqjR6 7HL7W+liql5bONsqjI9easrPaIB/CP8AZNDnK7oUG71OPzqANcqu84P+zjNVzuO4RjH0+ZqRTI5y jygeo5rXgMyn5JZcH1WsO3vJw2WjXjuRitqG8x14Pbbn/Gu2hUgtXIxmpbJGrG8+7q7fSt21aOJA 84fHseePasCC7mDBtjn02119ksVwoecBTnhWVj/I1jXjGppCb+ZtSbjq0ZN4k92C9n83tyDisBdA 1FszSrIqk4+/1Ptmu21OGKJPNwpGOAoIJ/I1yL6nc+Z+5JhHTduYn+fH+ea5FRpw0nK9+xtOfM72 se6fB79mL4ifGnRPEeteENI16/h8Paab64urC1W4tomUghLmQHdGGTcVIViWAGMHI5r4f/Ab4vfF H+0Zfhr4W8Sa/HpFhJqurPpNjLcLa2UJxJPIyKQkangsTWJ4A0k+JfElr4cm8RW2jpdy+XJqGo3D 29pCMfemkUMQv4Hmv22+BV38JP2TPBUup/ET9p/xVfWt+39h6Z4T+AHiG5hnt0nUtLdX8l6kECWs Zx8kUbl2JyVxz+T8c8R4zLJT+rr2kp25IKnOTXR3cbpt7q7hbzP0jhbIMLj4Qc04KN+aTlFJvdaS tbt9q+h+Dd/p9xYXjRGGaJ1bBjlGWUjggggc59RXpXh/4oeIPDngDWfAMNloElprskJu7270m1uN Si+zklVtbyRTLbKxPziIqWwATgYr9pfi9/wT/wD2P7DRte/aE8L/ABnk8ceELfTYtQvP7D1jSr3x O+o3DfvvtFnevZOVLnK+WsjNyWIr85/FH7U+q+EfiLdeJPg3qN1qFrNo9no63PjvQtEv70QW0AhV FiMVxbxKigCN0xJjlmJ5r1+EOMqOd0f9kwspcqTaqqVNKaaaT5ot3W9+XSyte+nFn3DEsrqOWJrq F7pclptrVN2Ulp036vtZ/EzwLyG38+2OfwqxDY2zECV1Gex5qxfandvM93JKcsS5ARQMk5OAMYqv b3QuwJXiX/ebP8s1+80IUr26/wBdrn4/Wc9ydtIDgtC8fp07VInh9Xb96wOOeAP8atm3WQchPp8+ KzbnTL1H32bJGD/tH+orunQhHX2fN8zijVk9Oe3yNBNE+YYLZ7gD/wCvWktpHbKC6biB6f4Gq2li SNQLuTLjqRyK2jznBQ56fMK9fAwptXjC1zgxkpreVzHKiZgHjIwf4euB1Bywq4jW5fEkXfqSvH61 a8qJvlcqPU04W8S/MoVvTpXRPDW1Rkq11ZoZG1mZSkTqG68Hv+FdFEssnKOBjHTFYSQO2QsSpk43 cN/LpXQ6bbQxtmRlc/V/6HFVh6knKzjb8DOtTilo/wBR8cEsUoY3E/TdtByPx5rSWZTw8745BOwn H61NsRnCZReevzED9avrZIcFbiLGefnK8/QmvUp0or+mcrqSb3G26wBcm4I46Mn+etXUNtuCrIWw cfKO9MNkjnDzYB6MEDfqSf5V0FpptpHa7lu/n54aMDge49axrNQR1UIOTszW0vTYX/eTxTBT/Fjg /j+Nfd/7F3wg+OvxK+I1s/7P2o6ZpN3aXW37brbWhs43kUB9yXUbo2VxlQpJHSvg6G2bAcTRyAHP zNjpX64/Bv4Z/sY/EK2h8MmzaLUT5F9Otr4qtVfFvAVuCs8tuzrGzsreVgNnOM4zX4L408Q1MHlN aMabftE1d041YxXVyhKcFJWb0vbe5+0eF2RxxWPjaok4WdueVNyfTlkoy6rXb/L+l79nX4UftRfD d7W9+LGx7m3t7RlOlQWxa9aFfMe6hgtBb+S5IZSGVldcZwTg/b2q/FDQPDmhS6r4x17+x4Z7iW4i u9ceSxVZUYBy2HZdxXjcGIUnoBxXxR+xH4MtfgF8PLWx8SSppdtPY2j6PcaZrF3qUFwrlpJItl5J uiYkctE2wjtxivtf47618Ntd8CLdWPhs3OpWe3UNHtY7u1jWeRh88kjzNH94ZZhv5Pav+Z/xSoQx /E86GJcHCUuXmpxhS5kr7RbqU462upTdr2tZWj/orGVV08NQq0pS0tzL3uV9ry1kk9NOzulc/LL9 tb9qX9ljx3a3fwv+IVo3iuK80gX8Z0p7q9sxMmZIpDDEFE3zKoXDAEgAkc1/ItrLaZq/iXULvR7R bKzkvZpLe0ZXhMUTsSiGMs2zavBXccdMmv6sPix8J/gRoPi/T/FvjPVvDnhvxXrP2q6hl1C1glsr CCODcbaVp9TvYG35xF5UBAY5IGeP5oPi3o3hPRPHmt6J4a1mDUdMtp5LqC+huorkOjkEjzowkckm TjagwOg6V/sP9BvAZRlmW1MBlPtuVwg25tuLkm4ycEkoJNpK8fitskk3/Mfj/h603QnJRSi3FJfF ayavd3ta72sr6HlMGmadMPMkRSMkDbKAc/zrNutNht8yQKNpzjLD+tFv4j8Lhdiai8J5JaW0T+Zr oPD/AIye11Ld4YRdRlePyBC1gl3u3EYKowYBs4wQM+9f6BydWnFyjB/PRH8zUY05yUZSWvbV/dp+ ZseAvHFt4Vj+xa5o+lapp731tqEwvIEef/RiT5KzcMsUo+WVdwyMYIPNf1g/sL6vbeIfhha694R8 I+FfCElzE9xpGl3M99bCAT7g8+ny31vLHGfLPzeU7biSRgDn+V3TNH0zxV43jsfi/OfDETsiT3Fx YCEBeUytvbIvQjDHGe5yc1/Sp+zZ8I/gt4M8NaR4AkbW9VtrjT3u08anTTFFe2lzhRBbzzq0cbRR YXOFkxyrA9f40+lp9Tq5dRhOMvaSfM+XmcGktdU1B/8ApVtkldn9T/R9oYlVq95R5EuVX5ee97pW d5K/RbPXVn7KWniDTNH0W1hnWd7+5RpYbqyu4rq1jcAEJasF3KgPdlAJyeM17P4c8b36+HbHw/4i RrJdRuGknium2ShVYL5skY8xdjkblZTn6V8dfDH4BeAfCHwpu/Dmi3mu2Gk/ZpE06DVZojcG1kIA ngDEMwI/jDbyOwr1Xwj8Nrq+sdM1nwVHf6mmlWUUtkH85YIiQw2rHdGY9M5Xgc59x/k5meHw8Z1F Scmm7K8UrrXzdrvRq7svI/pTMsDgsRTvWnbld23fSVvd956Kzfp2XQ9n+J3gX4f+KPD1/q2vMl/o kTIJ57lJLqDZAfMjMhYRb0RwCqgZB9jX8Gv7fepeG/hP8fPEXh34Nw6JBaaoiXedJ0aF7Dy5WdiY mvInkicEknySFBOM5HH9gf7S3xQ+PMuhz+FvBZTSVd1hn+zpcNqCkgBikQITLOABhgpBzxX8yf8A wUg+KfxMfT5P2bfDzjVbgmC/vbvVJEu/E7kBxLBH5O9YbXkM6b8qQADgkH+0PoWUquFz1u0aka3x Qc7RjFNPnacZJ8ulle73ukfkninkOIo8OTnXrOLi04OPvPVWUU1y6y6yV1bp3/C8W0k6nbFAWZsl ox8xJ6mpU0u+WPcykKM4I9+/Wuqn+HepaIL+18UPb6XqWnuqS6ReM8d4xYAjbGAR0OeSKx1jtbWP y5JfmPWPeVJ/Fa/2Shjac4qVFp+fTvdPqrdVofwBLCTg+Wqmvz7ar1+ZWs4HVhle2CcHPvX3H+zf c/DT/hKrLVtQ8SanoN5aTBAU02WeOWN8KYpJoJlkjV+QSqnHoa+S/CGn/br95brS7nUrVUzMlpO8 Tx56Pv2SAf8AAlwfavtv9mvwyul62vjz4di2nurO8h36Vqc1rd3MmwllNvBmJ3br1GPxFflXitj6 U8ur05TcXa104Wu9LPmUrX7uJ+p+F2X1FjqNSKTV1o1K+nVWcb/Jn9gf7G11Ya34B26b4jt9Vja1 WFrLV57rUng8pmQIBcxRupkyAC3B4Ck4zS/tAT+EdS8HXWs+P9I12zGmQs9s2nzywyNGhZQ0ESSK pVyCjHqFOORXyv8AsnfFz9rbxFpjaX4t13wj4S0u6ukaOC40j/iaw2q87Y4I5CjOudwLMCSwO081 9Q/G34p3vgvS/wC0vG+uW+rWWnedNFf6pDc3Mzr5RKrBFFGu5CVLMpwRyEY9v8DeLuFMVheIJKEo znKV0oSld+SnGmrtrTRPU/0iym85yryjyxte7vFrTe1kt7XTk7LXU/lB/aZ+OHwu8eXQ0vwn4e1i +sY7aZXOtTtBeWs7E4O+ElbjyiT5bTbiF+XgV+ft1rt1axxLYxQ2Sw52yiNJZ3J7uXDZz6AY9K/Y n9tL9rb4fePfEjaD4W0LwZqGikte29/Ho5XUrdpck5iKwGP5jkxs5BxlgRX4wa+0VzdyTfK25jhl wkZ+g4wPYCv9bfBSlVq5VRWKy+eHVr8spyqPW+90kn3Tin3u9T+M/FSv7PHSnTxkazfWMVHtta7a 87v5bGW2ow+WY5JZdr8OQmck9SRwKyIGsYX82OSbeG+RhhAD64wcVVaO83bcxDjgipbfS3llLyMp OR93Jx9cCv3yhlGFoxk4yavvv+lj8Sr4+vNq6Wh+hX7M3wu+JHiH4j6VpfjXSr6eHUdLN/o39p28 U9ndKnzjc9wSgSReCd6dOoNf1BfAz4XDQPAWiQ+J28PeHV3XF/NpSG1tJHdAYlUQI+xlKksp2vwO Tzx/Mv8AsqaXrGifZNJ+H/xC0Ky1DWbpIrjSEsLv+0TFADKSLiWBYQqgE58w4OMZ6V/QB4K1j4a2 /h4/Dvxz8R9C8a6hqltBbG11CGPTxpjuFZlt7mEtPIXAwT5fXn5elf5w/SkqYvEYqNKNT93H7MaV bmsrpys48iWu7lZ2bUruy/s7wPnTpYRzjF88nrJyhJaq/LdSvfT+W6vZp7vG/ar1rQfCWltqmyKH ZK0mniUWmpb0jYASx2kfl5L9soX2jcD0I/l8/a+1268Q+P7salNO8X2ySW1823S1IUjDERqSyjj7 jE4/Wv3m+L/7Pnw/0HxAPCnhDTZXayu4746xp0e+5NvcB1a1gmBcylN6mTcWyMD5T0/CT9sXwz4m 8E/FPVvDGuDVXSG53LdagBbSOpUYLQBB5fHQHOeua/U/ojVsuWMp06NfnnyOXvxUZWutVG8mt1dc 3W1tz5v6Q6xbwMnUp2jzJe621ezersr+tul79D4d1DTzCBy4RhlCpPT865iawjLZleXA/v8AQ11d 3Asx3LMdxPCiRh/ICsC6sXlYPJIzAfdzKwxX+kjhzRvGFz+D5zSlbmsVFskVQyCM+57Yp/nOB5ZJ OT1AJA9O9WEt5gNryxjvliWqJ45kY7Gicd8AfyNdsVy6xVjzppSTjLUsiKYAMu0cdTkf1qeJDwXk RO+5t2M/XJ/lWUuGflnB9Aox+hq5CbiOQLkyJ6E4/XIrvp4pzt7px1cMoa3NdbO3c+a9zGxPfH+N WobeONxGkkT847A59ycVUVEJEr/uxxyFJ/UA1p2gtTONyc9vl4J/EGumpZO8Wr9upyxh1d7HS2QS DEjtFj+6xDZrp7YpLhYyvvsxj+VY9ojzDb5MbDjlgv64C11tjo27BxFGDyRux05odSEbybCKk3y2 2On0VTD+8guXjORkEcDH+zg16FB4h1O0UPbvbsVAzi2UE+5O0k1laBBcRKYmeMIq5UlwB06YPWtv UnkS2EssUbgZJI8oA/8Afvn86+bxLp1J2lqevQi4q6Oe1XUdW1s4YxEjOPl28D8BXDXti6L+98vj IID5B/EV0EupR53lTHk4/dL6/rVd7jQbmEiRSZP70pwBXdGh7KKio6eRnUqczu3qctJNaxICzFuO QqdPqcg1nTSTmM+RGNrHOSvX860pmjhdjHsYHoF5GPY1o2hjuQY3ZYwR95nbr9DmqqpU1zOCku2h FK83ZSaZx9tBcxT+bGI13dQOB/LArv7K1knRRNMsa7gxI3BefQgf41XuLa1VQlyGyeRIu7B+gBp0 cNnAiukrygnG35gB7YJ/pXFXnSqq1OKj6L9Ttw8ZQfvO56Tp2h6dekCS5i+UZ/ePgMfrkVtWjQ2T NEI7RgowCrjPtznr7VgaLcaWEMWpWsqpwNynBP44b8q1NR0/w2wD6QkpJOWV15HtkcfSvmK1CVST o1ZPl6dvvTX5HvYeooRU4JX/AK8jrtFvYXkLMkCfMM7wN34Hqa9FhFssOJ4TKnQeQrMxH1GcfUV4 5oWn6pJOJLe3X90RyyxsQD6b69o8MTX+m6gv2iDVSzMDut0CKxHYbXwfpXw+e5PCnNyhNt9uZn1G W4uUo2lH8EepeD4LPWIZLbQrLW0YRg7vNkZQOhGT0Hesm88B+JW1QrEl0dko2/dye+D617Ra2XjK OCPUtCk1awjmXB3sQ2D1ysang+4NNnsPiRd+a93f3m5XypICBwOOhjAOB1yf618PQzStTqzdKrHl f80pSd/Wx71bCQlGPNF3XZJI19N+ItxpGlR+G9ctLS/gidGENkiafdRleQBLFE8uT3IOa/Rj9k6T SpbKPxJ8OdLvEv5r4wX51TUjM5hIGA0zwsSo3f3Qf1r4N8PeGNC09oNZ13xK0dyJFcWxs7eSTIOQ wyFU4I6E1+xvwZ8Z+C/AXhVbo3d6Lm5Ktb30kFtJd3KYDO6Ok3lpEo/h8k49TivwPxVqUqOBlSwV DmlUetudRb63XKk+91rpr3P3DwrpVq2L9rXqK0ErfC2u2t2121JPiJ4J13xqo1vxFN4cjsIRHBfW 0jGSd2U5CoWiUlVA4G3bnkV+cvxm1HRvDOqp4e0LUrfTbeZHSW8mjdVj3HL/ALuNI8H+5tUDHfJJ r9gtU+Nvhu5gV9Bub+S4S3k+zz3SWk6NJH97zA0TYGDgbduPXvX5LftQ/ES/+ImqSW2saaw1Qj/S 2/saxidiBxmVSHDAc5/iGOnSvgvCP69UxcaWKpqMF0XTzs42du79GfpHiNKFLAzq0378vnfbTpa/ l8j4Z8R+LPHup+Zouja/NJYsxaWF5bjyncfIJFVTIRlcZ5zjjpXMjQWi08lo9OQs5Z5JY5XfP+yz oHI9Mk1s614bi0eJZtVW+tJWXcskVhGQyn08vBJHU8145r3ipX3W9lapdqny+dPpyK57ZyzEg1/Z +Aw0pqMMLbl6tRtf57M/j7Na01NzxCd+ze336o0NX0TTwqG88q6D5Xeokyn0Xt+VeW+J/BumWUW+ K4vFkI3R4h8kN7gt1+tY15falNcFLceRyeBHjj6E4x+FcxfC6nkMcyQMQclipTp7RqP61+hZfl2I glar8rR/yPjsTjKUm/c/FnJ33h/T5bthcz3SEn/Wjcw/IFTXl/iPTIklfy1LKDhZJUJJA9A1enan JdQLtSdEA5CeZIce2CP6V5lqGoahcSM0rx8ZA3I/17ivvMqpYi9+ZNfI+Xx86VrWt955pdjY5dwM 9sWyYP4iswQ2zgzTvFGB0EgVc/mD/KunvcySGSQwhifTg/QcVg3NlHO+2ZLZhxgGLP8A7NX2+Fqt q1vy/Q+RxMEndleGXT0J+zzW7NnHyhG/I4wKu+RHIU3xMV7MpGD+NVmsdFsuJbS3UuMbo1VD/iPz qzEmkSLhYSBjqGc/TnfXRTxM07Ssck6UWrxuiy9lOUVYQiJ2+62f++a2NO026OHmIyRxtwPz61nW UWmxvtw+O3J6n65P61tp5CEGFWwvYtJz+RFFSprfl/E0pRa0uWJbSFs71fI9CcD8AKz1sLcuWUTP s6DlenoTzXQQxK6ebLCzD1dpRj6fNk0TmwUfJHIc9MhmH/j2cVxQrOc+V2PQlSUY3RiNPGqBJl2g 8bTh/wCeP51AzSSKI4I40G3Hyrgkd+MmrE8ELtvQBeeVww/SiLasoPTPUqBn9SK76WG5buepxyqd InM31kHHl3JkkBOQrjaBge+awHX7M3kxRqik/L8zEj8lI/Wu0vBBcTMGDgKM7mIIx9M1hXOn6ZyB gZ6lRj86TwMfih/X4GUsS/hkcBqtnFeShZY1BB4ZGBJ/75/rWFeaHNZAvapMx69dy8e1dTc2qQzN Hp9y0bAfKvUdfQnFJLZavNF5c0sXT5i8PX8Vb+lee8JGTa5fe7qxssQ0l72nmeaOFuf+PqJVYcBl kKNn6YxXPGytoLlxK9z1+XZGx/8AHgBmuvv/AAxe2l358MayIScmP/B/6GrK2jwqBuiQ9Sj7VOPw r5yeWzqTtUjZr+vI9mnjIQj7j3/rzOHNoY5PMspZFPo6t+uaum31NojvjSUk9vkP6HFdlmyk+SV0 Vvdh/PFVJTdRRE2j27L2Bxu+naulZKoR5uZ/L/JtnJ/acpytb5v/AD0POtThuLb94GeIjjJYH/69 V7XUJJIit27zt043Lj8xXX3Fu9wu66t1LY4Mbp/LFMgsHKAhVCnruVcj+VeDPKarrtU5Oz73/LRH srMIKl76+4wNPsFErTRpIq9cBs/yIrfhjaSbFxHIwbpvIbH5/wCNSNp9nEA0rEf7qtx+RqNLOK6U pDK69uEJJ/UV0vL3RXJbX1WpksV7R81zftoJNhhtY5Exj50Zf/r12Oi3VxYlbe6kJyDjdtP6g9a4 3T9Hw6r+8c9M+VIBn3Oa7u20e+8sG1dYyBnLAjn8f8a9jCKaSnCFmuzT/BWOKtKErxlO6OttJZjz DKFP0GPpwatNdXA+S6hEy91iABJ9uc/pWDbafqSyf6VLHLkZ2qxUj6e9dBbB0IX9+pxgbwXB/Eiv WhiPay5qknT/AK7PQxlDkj7iUv6+8WW6il2mOKeJSMFTGD+tSsYrMB4yjEkZDHkntzgVqeQhTDxq xwCpQ7WH5qf51fVJxGfMhhcMCM7yn5/eFds6FSMnb5MzpShJJ/gcRf6rbPH/AKeixY45w4x36E1x Wow6bcLm0NuB0zggj69a7TWdLjt52mfS5Of+WsEqtn6g4rlLuO0ZgrQoNvO2WMK34kV8vXq1JSlC rZ+qaf5I+gpQikpUrr5r/NnF3fh6ArwzvnrsbjP5iuZfQWhJczFFH94H/wDVXc3jWsDbYoo+OOSC OaxrmMTqHiaOPHXay/qGr5XM8rwk78sbyXa//APaweKrfbej9P8AMxU06GLEkbqzeqkJUc1wsX3p HQc5LbWHHTnNb62aGMLvj3HplV6/8BqldpPANpEEi91CYJry6mWunG8E4/j+tzvjiVKVm7/16GVH qEQXa0kbD1OQf5ipH1NlB8lVYnjP+TQsFpu87aYTznanGPpQ7xv8kLwSNnjcCh/QVlQqVoR/iJfn /n+AqkIN/CZc2o3rrmSMntnP/wBas1xLKORt7gHI/WukFpLcLiVVXHQq4P8AOoZdMBG2O4QEcAHr /OuTE5fiKnvSbfr/AMGxvTrUo6I51b29Q+Skhx6EA4/OpvtN9/fH/fC1LLp91DJlwH46pUfkyf3X /wA/jXgToYiL5Zcyt6nowqU2k1Y//9T+D5INo2gE+g/+vQ/mEfMGHoMd/X9KtmCcKVYOARx82KY1 oSc9B1681xS3uetruZ5EvPB4zyeB7+tN2SY+UZPcDirbGRGIUnnrj1qu7SEYbP3hjH1rSJVyDErb lGDjA+YnnApil0++OP8AOAKnEhABY98enNTbIz15z1OO3607XK5irg9+4xg8D8etINoG4HJ6HHtV 0QQuMndyDnHpT/sMTjIZgCMcj09aIw1M5TSRnxO46hcHjPr6fSnmV1UhVXoSD6n+lTnS8AhXTBIO GOB/9ao20+dFO5hjPOD6+/4U2ilKLFSWTackZ9u4qEv5jbTtHY5/+vj+VAiWJNuT09jmnLGjHtgZ 4AzxSeg1JMbDFvOzJ5x0b+fFXRaxhCHJ49Rk8dxVRbGRySqkEjHcVJ/Z11syzL09ScGokyZS13Jl s4XmAWQD0G3/AOvWzHp4cbS0WMf3QMVgRabeS87xweQTgVoJpN00eBKQc9Ae/wCFTYfNZblibTYk 6ujY7LkVUE1tE214gccAg5/LNOXTJl4bcT/eGapTWU0X3izHudvp+NaQbjqkZWT0uaKahYoMrER2 5HWpBqEDk7Ijj1xxzXNofLyjAsfb/wDVVtHDYVgFGOT0rupYmXZfcZSoI1GuGIJhjz25xjn8ajWV 85lSPI9KcbSLHBb1GelSIjoMCNW56rxXVds5nZPQh82Q8RhQPqB/P/CrULseTge+R/hTlnuAuDbv j1+U1ajQzNjbgn14pxinswn6EkTRnO5uevAFasKw5yOv0FUY7SVDyVUe45q+oeMcuv19f0rsi7LV GVjRinKYCBR9SD/WtyC9nXBxn3XA/lWNbG1IAYsT/sx111pZLNDu8uVgP4gmK46lWpLSEjalBLVo SdZLy22yb2HpwP1zXMSQ2asUHB3Y2n5q6WfTJZyEAlVc8hDg5/Hivpzwx+w58fPGPgNPil4WsbBv Dk7BLTVNZ1rSNJW4foyxR3t5HIxVgVwB2z3Fedjcwo4CMZ42cYKTsnJpXfa76+R6mByyvjG1habn yq7STfz06eZ8jBJjBtjaHucY5496r21xfWdwrrIT75/MY7130ngTxzptxMUsLyU25ZZ3tk8+NQnD EvFuTb75I969a+BPx4b4Hare3j+EfCHimDUFhjvLXxdpY1BRHGxJFu4ZWgZ8kM6HOMelebnOZNUZ 1MHFVZraPMlfyvZpad0ejleXJ1owxU3Ti+vK3b5aNn0p4B+IWqeKPgZO1x478ZaFbaX4cm0HU9N8 K+DA2nT2hmaWK1v9TtbqATiR2y0lymUztG4ACvzuuo7S4lMtxDID2IfbxX6y/Ev/AIKWfFL4ofDa +/Z3+B3gzwz8O/A+u2z6dqXhTwrZS3S389zMrq7PKzy+ezKiLtIyABgkCvku/wD2KP2qLG8j0W++ GvjWK7l2+RbS6LexTSBgD8kUkSux5H3VP8q+W8NswlhFiameqnhnUm3CDnSuo+bUKavd/wA1Syt7 17n03G2GljFQhlnPWUI2lJRnq/RynZeiir307fIpsYJWGw/Lx1cn8OlTrp1oCAvmg/8AXTFa2p6B qehalPpmqRvaXFtK0FxbTxvHLFIh2sjqRkMpGCCMjuKhUyYKk5Prz/gK/orA0oOKlbQ/EMZKSbjf Uj+yoOrOTjvKOlSLZxLksGYe7hv0zVmOITPhmwRnJ6fzq8Ylj+YMDzyCVr2VRpyWiPJnOcXqyhDB aA5BT0xt5/nVjbECNpX8Q3+NWT8pDbB09Qf5ZpnmAjaUA4z8pP8An9K1pKK0tb7yJyZCXUf88/8A x7+malSfkKoQ49HbH61HHtY8jA9WJ5/Sr8UdsvzPngc4BJ+layv9lkxduhctj5xAygOezH/CtyG3 uNwKtGc/3Ce/4Cs3T4x5paKKbk47KP1NdDuuYD8iHHUlX6flW9BGFZdUH2C7ZQXJx0A3H8arGzhX jORnvwatreb3DzxxnBA/esT/AOzCpzcWpbCm0Q/h/wDFV1MyUb7sjtoVBCiVgO4yePpXV2TbGVWl Pp0J/pXOrc2ykHbG3+4f14JrcsbmFRuIlQf7Pv8AhXBiW2j1cOkmtT2jwnpFtrMU8aWK3Zt4GuJm UNuWNOrdBkDNfop+zH+xL8OPi/q1vq3grxnaanemESyaFpkN/p92lxGUkaKS4vrH7D5apnc7zIpb GD0z+YOkXlisoa4UyKQMAnbk+x2mv00+CH7R918CPD+leK/hbN4KXVryIaRrFha29zFrctpu8xln urlDagOVALQOGzjjjj+efGWlnjy6pDI6jjWnpHRct7P421Jpabrl10vrdfsvho8teMhLM4XhHV6+ 9v8AZSau+6102R/Ur8G/hhc/BHwZ9ks/DNyUS5S2inmjsdduFVlUOhntZONnIQlSMc55xS/Hn4ge G4PCGoyadbeKobjUEbS5rmCG9gls5jt2m3WSzk27l4z5qKFzjcOK6X9lXw5+zl+2r8JNK8VeKpde 8LJtS8vfDltdXVra3LEBXM01zj7Vbkcp5MowSeQTivQ/Ff7Pnwa+EDW/i34falLpNnoM15LaRWl7 Lc/a/tEm5reTS5TKJUbJJbczAD5SK/56c9eFw+eOtm8an1lVZRlBK15xbspNVZzabSd1CULNO7vy v/QvCcSUqteNCnF2UVZ8rV07W2umt9m3fZbs/lL/AGwNA8W6q48E/ELxxZQWvhyGG60zRPE0klpe XXnnbu813XY3lkMzKhBBwOCK/MLxrpHhix1pNI8MXkmqQpbxtcXavHLEZmXLiJ1CAoucDIz71+wP /BRJ9G+JPxNsrjxtPNomlajqbzWUtr4fXToHhRCpuRdFGuQUJEckRSQfIGXqK/K/W/BEuhazcab4 a1lNStUKm3urdpI4pAwzj98kLll6H5AM9OK/3h8AMVN5Hg6lVuLlDm5VC0E3bm95RSb5rt31u3q7 afxb4xxg8yxDhBPVLmc7y2ulZyulbTbpsrnks/hGBhuKoBnqxGP0Y1u6LaHw9eJd6TcvbSgjEtrI YXXngllIIAPftXU6nor2Epb7UlwuF+ZwAS38QIG/gHIBzz1x2qMWy6veQ2VnbF5pWWCKK2j+aR3O 1VGUGSTjFfutXGucLN3XW/8AwT8bpYblnpo/L/gH6o/Ab4Sa98F9OtvjZq2veH9RtdTQwwW19bx6 3FK0oJV5cC+iBYj5X5A5yQeK/bH9nj9qL9oj4leFLnwrqekwWtvoUDjT10OLTWjZmO0fYWQ2CtFG 4yQWQgkjBr+fj4cWf7Zn7PNppuk6XDqPhjT9Quo7SdLnQ7W9z5jlcS5jYz4D7ghbB47gV+7/AOyH 8Mvix8OvGnif/hJv+EB8Z6pDEsROl+G5bG6tJJB+6jCfZo7FIWb5pnYMc8K3ev8AOv6QmGozoVsZ jsRRrSl/Dkr35YySatFKKSuk25vdWtof294Z1opUqWHwc6agveU7WU5LduTb11atFddHqfXfw/tf GXie5nvdXs4PDUBm82STUERGuru5G0TJZrNdZmBALBpY0xkAEc17Npvw58bpaW2n+J9eSGytHdRp wsGtIIYwclnlhzNs3ZG9hlgewxXoPhTxHNpPw9m1nxvf2lnNM/8AZ0UMFvZLHaXkAxLArxApKCMH gjAABAqK88ZW2gXOiXWo6Z4o1O2nuTcXkmlaZaujIBxK84zJEFPIUIzPnIFf5/ZhWxFWtKmoqN32 0sv70rv7n6H7FWzSvvTjpF2Vurt9l8qXVr/gXZxer+CPGY1a/wBH8XRXdrZTyQvBcaLGkohtowxg D+XIJJD8v+s2gZIU5PNfz8f8FAv2Tte8XfDXU/EWt6TfeFdN0i5hXTNc1SbR9E0J7m6kAV76U3s1 88rR5G6QYZxgKOtfu7+03+07pfwJ1221C8Ou6zp2qI0c4h8PySOiycos4jczM424G2MJyMkdK/m3 /ba/aH0Kxl1rwl4ftviHf+Fr6CRta8NeIpvsVrbxtN50dwsN7bpcxvvZfL2MwAUDGMk/0n9HDJM+ WdUMTgYrlTjZpXi1F2kovmjFStor3TvZ73PjOOswpVckqRzGyUo7JNdLXaa57X662Sutmfmp8b/2 BPiH8DvBEfj/AFnxd8N9ZtJIYbpLfQPE1nfX0kNxjZJHb/JJKvIJKBiByRgHHxpBpEUUZAlRmA42 uo/TvXpnxF1L4Mtpkdz8LIbywuoG2Xkeo3wvvte/kPAUtYPL2HIcOxz/AA14ada1oDfbM+O2Gzj8 DX+xPCOHzR4RSx1dznd7wjTaXRNKUl80/lc/z04llgYYjlw0Eo26Sc197SfyaPR/B6apbeIbfZex W6tKGka6k/0bC8gTKqtuQ+hUg1+rnwh8feNdT+2+JLjxt8K9Olmu7PzEZktJoIIhtZbXTVW2s7gF VXdG4JyAdy5Jr8hPDvi2+/tSBNaub2CDePNngijmdQO4jO3cB6bhX238N/HXhSXx1Fpk3iHUn0LU Jo5NdvY/DcBjtSAVBW0AnJGM/cK89jX5x4wcOvG4eXtKd2ot35Oa6TTa+CWrt8P2mkrO5+k+E+dx w1VclWy5lpz8urWjtzR0Xe2mrurH9kvwM8e+H4vCmi+HtQ02F7xNFhvb+e8tH0WzupE2us6Ki3Nr lgc7EmkQkfL3FeG/tS/Hf4afFLw7faBq93oOmaWjPa2UkV1eXUE8yuUO9dNWFxnJ2qZFxz6GvCvh R4M+GfjXw5bXfwrurKx1R7C2OirqF3bPfzSQpt/0mxunQwqx+YRxxrtXGA3GOe+LXhr4teE/Al5q Wp6Xob3MtrHY3VlINM0x7+YP8zrJ9rjRgiszbmBbO3C8mv8AGajwVhP7YbeIlCfMrJtU5J31t8UU ui/l2dun+ins6cabxMrSkovVSclqu19W9tF3tfY/D74v+JPhD4tbxBrOo63r/wDa0rIlr5GkvaWV ylunkiMzXV3cTrHGF5/d7m6n0H546trfhO1vJrW0tTcorYRw5KE/3lLRq2PqAa/RP4w/A6Gz0zUr jxHYeFdBuLRYr+0TTvElndXGpW1woJxHLeNK0iNkbUhC53c4ANfnR4mttMsrsR6RY3kUe0BS+Gbe OvKLjb6V/qV4X4PL/q3Jh8TUmtF8cbKyVrODSena9tVpsv4f8SamK9vz1aUE9fsyu9XfSSbWvpff XcxHSzvE86B/s7K3zLzyD25rW0PQtb1rUBpXhiGbUp9jTtb2rh22rwTtALcDrVfTWhvc22oXSW64 3f6UhwcehOea1FiksphLE2m3saNkYdQRX6NUpVIzcIVG+3M3/X4n5lz03aUo/d/X6H0B8BPE+q6L 4xtrrWItSsNNhM1nPfxFVjt3dTkb5ra6jVgf+me4HGCvWv2u+Afh/wCHPj22fXPEr6h4/wBY8+KZ 1jjgjWGKPBRi8tsG83YdmFJTjg5xj83v2SPin8Uzb6h4d8Oa/pGj6fJcQ/Z9E1TT1v7B5y6kEEo2 xmwFZsF2HB4Ffs98DvGnxCvPPhvvAvwcvrix0to5pLrWrm2uYJHOFljt5LgwldxH7r5SM4wK/kbx 8xlf2laFKlGnNJLmVZRdt/ecoRau3Z8lTtdn9KeElGNLC06suarBvbk2e11aTWlr+/FPsjpPG/i6 w+Hf2ODS/BOjPHDLcf2bDqlwLG+81giDy7gSSupff9wRqc9Mk8fzc/tvR/F/V/iBe65440C20O2u bkiO0tSbl9sQ2hpLh1DS9wWLHmv1S+P37Xn7TnhTQLj4bWXgzwRpv2SBTJBpd+t6twg3GKeKCSXM synJUDJUgZB4r+fr4p634r1bxNdXusxanbM+GmivZJAdzAEuVLHG7Oa+t+i74ZYzCYt5piKNJyas pe09rJq976TcYt73s2+55Hj3xvh62E+owlUSve3I4JPzvG7+9eh5XeiMxlAvz5zncuAMdgFH865G W1tWGZfOYk8gHFdY5fBzLjtwx/rmsS50uKZiQ7Pzlt0ox+WK/vWVBy0lD8T+NZVYrZ/gZQsYkb9x E5J7lQf1BqeS0kDb98+B/DgAVJ9iEY2LJCvYYwT+dQrb3vnZikjIB5Bxz+gr0YZe0k43XoedLGq7 Tt8ySRRGNwYqSO6f4Gmwi9z8k2c9th/oTWoYpJIwZEj47hx/KrdtbjePmiHcF8jH1wDXqrDxezl+ J506z3aT+4ltLeTZmcs5I6HIA/8AHTWxa6eLh/LjUFhzgZH/ALLVq1mniG/fZkAc8nP5bRWjb6wQ d7GEMOhCtk/lXXByS91feclSKcrs6DQnh02UG+ilI4GT91f0Ga9Bu7yO/RBYLbx7BjajlGb3O7v9 K89sbu7kfzYXYHj/AFZcAe2MV2+m6fr9980Uky9yTGG/mM1xYrD+97RNJnTRqacpCY/FNr89rFMM jgqQ2f1GaY3jDxpaxm2vbZmX0kAzivTNG8KfECRVezu7oA5OVhGM/n/Susk8KeJZYJDrd0koYfMJ WjRwfUZ/nXG8RTb/AHln6X/y/U2jSktrnzide85C14kinrhTgc/TNUjdaXcgsDKSTgbiP6kV7hf/ AA4huY5Li0jAdU3+X5pdSPYcD+deL6joctpKR5co9jjH1/wr1qFelPZnDWpTVm0TWFussv7vewA+ 7hSPyJrUbTJnRmgjdFXnAiCsPx3YNcdJ9vhG6B2U9MDI5qRdV8SrhZ7t9g/h3tj8q5sZQk9Yq504 avFaS0Z1cdk0TCZzesOgzCpHHfOen4V3ejz6LcRDzoLqOUHiSGHcWx65GMVwukarezTbbiZmU4wi MR+vNe5+GdC8LaiPP1A3zSbgFVrkohJ9MjGPwr5bOK/s4WnB/Kx7mAp80vdkvmaqy2N7apCJZQwB UKFhQ/idv9eKpSaLdo5kWeKYYz8x6exxxmuquPB+iQIJ9M8oyOCw3KzbSDjDE/L+OagPh2a5Us93 bkgfNHFsPI9xIOP1r5yliYbwqb9Gj6BUZWs4fcziYtcn0y5/0y0julHZHQ8jp19K660+IUpdVm0i dI89VydvuCgGO1VB4bubmbyYk35/hhKk8eo3k/pWnZ+BtShn8tfPj3Hgbjj6ngj9aqvPBf8ALy1/ WwU4Yj7G3oeueFPiZoqWf2S7huCucqyzypg98gbc+1eu2GrWHiSB0s9Ve0JAytw77SB2UMTz6/r7 eGaH4D1y6PlwmNscF55UAHPq+BWle+CLvTwI7mW0kBx9yRGx75XP6V8ziMvwlSdqNSz8tfwZ7NLE 1oxvUj+h9E+G11zSGeWGTQ9QDRPARfKs3ysMZU9Q3oQcjtX3Z8Dfhx8SvFfhoz3skaaHcxqIrVSQ weJz8sSTZJQ9AVOCeCO9fkzoXhfQbPUbd71J7kF/ntBKyRyA9V3KyMPwNfol8NdFvNY8BLZWC6np 9vaSCGOW8jjuYIlcbixuZZSFJ68Lu6Yr8k8TctcKCdOai21eTivwV73vbW3zP1fwwrOWJcpXaSei e79bWta+7+XU/Smw+D+o+BfCq/YtVTyXEkf2G2sr62uYF287nS4HynGWYcDP4V8N+Pfh/wCF/Dms Lm30LXr2+aQ38FlrF4ZraNgCGnndUiTHcb2545r6n8Mfs6G5+HVtq17490+yiWbCRW2qmQT45Lqc yDjIHlhgR3Ar418TfDjx1qV3c+DvBOreHLz7deGK1e81OLzp2iJwsKYLAk5GPmORivwHg2rD61Xb x3X3vdcFp3ate2+ju+5+58U05fV6a+rPy1UtbbJPvte1vI+V/iVod3rGpyWGmWF2Y0KJHc6dfSX0 MKD7xJiLbwF64XPFfOuqWJ0u7lsNLvL65hQ/6xYXEbdicSxoy/iK+g/GviP4xeBZLzwhqDXbm3Aj kXS5GMTY5ADiJdwB6kDn1NfK+reMfGM90bjUWnhK5GJV3/gd4Ff11wvhMRKlFKcXG2lne/nqm/09 T+TOKMTT9tK8XzXd9EreWmn9dOu5aaEfElmbExLPtVthKBGzzxnzUrhta8E6NbDF5BNauq5ZoW8w ce/nsB+NWRfa/e2+6ORbgZLAKkZfd+AyK5XWfEHxAeB7BVnRGGCqRsAR0528Z+tfZYTCYr2loVkl 2/r/ACPka9Wlyawd/wCv63PI9U+zrK9vFeSBN3UqDz7AH+tee6lZSRZkhC3QPXaNrfqePpXf6hqH ii2dg7SdOQYkz/48M/lXm2tXuvlm3OE3YOJEbr68DrX6TgqU9Ixkl935W/U+TxMo6uS/P/M4TWNJ u5h5t1YtGh6PLCdp+jBsVxUmiaHbTmWNFBGMhCe3p+8rsb7T72Zt093HMR2DMMfkKxUsrwnG6Mgc ZDE/zYV9lg8FDlvUim/Q+Sxlebl7kmk/MlsrnTg2yZrlV25wo3Z/AyGrc1zYzpyJ9o7rhG4+tVls JgeZIWHTB3A4/wC+6vRWcAAwW6/8s2bH6GuqSjHZ2+Rx376/Mt2X2YL5tn9qkbHJMoOM/Rx/Kt23 uyqDz/MXHAGSSf1NUYdMtZSoVuepyhY/Q5rqoNGgeH+I4IO4gx/ljNeXVxPI2pbdz0qVHm1juZhn LqfKuZD2I3EEZ/3RVD7LcuTsndueVMmT+Gea6qHR7R2KPGyjhtwkGT+a0y9/sqyX7Ptl3D++sbZ/ GnTrYda09X6M1nSqv+I7I457dbfcZRMxxnBH196z5L1Fz5aqo44lDHGfUZroZ9W0rlFt3L8cocA/ X5sD8KxpZZb1sRxRr74yRj1wTXsUsVzR1i16HnVaHK/ddzLma5kbzIha7c8ABx2/3j/Kqd1dQxDy 7iBGkPUrxj8D/jXQQ2/nD/SWUY5+VWH58CsG8e18w7WRwpxjGecd8GnCnzL3H95yzqJaSRzGpQrc pvVRFzjLBMZ/E/yrmrnTdSYZhljbA9AB+ma62cwz/Lsj/EZ/rVA2lwV3QMsYyfup/UCspZfd6r7m S8X2OEuh4hgJEcULr3Jcg/piuduE1VMySW757bQr/wBa9Tk0/UFXLShgM4JyB+ZrBvRqcC/I0OMf w5Jx+FebjsrXLdzl+DOrCY93sox/E8+Q3snyuuw46Mqjr+NSSxattzAqOR1H3fy4NdFFcNI4Dxyv zydnH6iuijtZmBeOOQdD8qgdfpXnYfLudNc7O6rjuSz5UeXzTawQA7pGehU7W/oKSKy1qdd8dzEB /dCkfyr0G50mN3LyqzN2GcH+YqBrJ1jwLZ2UnnGD9e9R/YVRy96bfzY1nEOX3YJfJHEy2XicKBFJ bMPdcmmRWfiGJhJexIR2a2faQD7EGuqNsYP332Ob5c8qBj6dRVe41hIGDXEVwgHbAOB9Oaxr5VQj rVqyj87r8UdFHHVZ6Qpp/LX8GXLNJBGCJnDEcK5UH8eBW7a6MkyebdR7uM5WQ/zzVLS9X0e5TzPt CMpGAsqbSD7jHaut0qHR5n3qzZx1gI/kTiu/D4DD1opc6kvVf8H9DOeJrU3fla+Rp6ZFFaLiPbx1 EhLfQA5rq4r99u1YVLY+Xa3HtjkGs2G1iEW61lY9ypCbvyJFaVvpkMredMwDdRvwDx/u5r6DC4an h7U6dvS//APOxMqlb35X9bFkXsir/pUflc5BIY5/Wtay1DSLqBoLyOPdwQY0k/o3WrWmXVrpsp+1 iKTcvKyJI34gBhjFWba5tGEiT3QDfwMIBzntyRj9a1x3NKPvQenZ/wDBT/A0y6ShJJTWvdf0jjdU uY7KLMwdQSQCA2Prhs/zryzX1NzIJoJixUf889zevbFe+XqaXLpjRQySySbizBgiLnHbqTXiN26w StHIZkAJAxjH5ivhc2qVar9nVTUel7r/ACPs8JSp04+0ptX62OLubvV2QeWLc9s+UVYY/EVmeXq9 y21zGARjgcY/Emutnu13fLNIRjHAB/Pg1T+1Wu4rNIOuMMo/wryqmAU9Z12l2v8A8E3p4trWNPX0 OZGkanAS8SR5yM8fy6iteCK/A/flF68bQf1rSjntP4CjA9Og/TFRPcxqeRuAHG0A/wBK1wmVYel7 8Zu3roZV8dXqe64r7jPu1nUfIY2/4Dg/zrnZrXcc3CkAnqADn9a6tpIZjlQwPsMVl3WnW10fnMnq DnpV5jliqxvRd/JvQjCY1wdqmnmkVktrIrxtUZ7rjn86gn0qN2yFDD1WtO3sBaqQjqV/utzRO7xg 4jB5zwf/ANdZ/wBl0/Y/7RBL0/pj+uVPafuZX9TAkia1+X5lx6gkfnUP2g/3v0/+tU02oyRPlFXH oc1F/a8v/POL82r5iq8NGTiqzXyf+Z71NVmr8i+8/9X+IO9togWMzsxxwQRXK3hhiGNzn2bAH9a3 5tC1UIWkB9AcjiufmsJEOyXdx3615dFabnu1nrtYqRtEz7UHbkjuahlhDEqByT+FTl0icrk8kYqB 7h2wEGBnnIz/AFrsja+pzIpm2k3FgT1GPw7VOIWC7l69Oaika43YY8Z6D/GlMjfdbJO373+OO9No slEMzfNvGMc44prW90AcvkH0qPzyh+dSTt9Og/KnpdSKvzqcA5BB7GtItWMZ3KS2924OWPPTaKli tbzJZt3senpV9L9cEiMkj3OBUp1KHHf3GK0jTg1uL2sl0IUgn27HHPoP8aeieVjcnP0qQ6nYA4Zs E/XHp6Uf2pp7tjzCOcYxmtJUY7pmSnLsWortByFHTripRcQn5gm3j71V1vLEN/rPwx7fSnmezkTa o+h5FYTsuqC7uNeaAn5mUexatC3hTbljgdRhjWX9mWXCKM574zWtb6W5AjO5c9cDGa5Od3N0QTPj KqRx0wayZzKzck8dMHrmuwk8JPFAJxKcEcAuP5Vz0+m3SMSmfwrrg5SWiMqkeV6swTbTyYKhevVs 4/CnppEzcu6NyD7cVcMV6AQAgOe/P8qkWKQffkUeyjpXXCktOaJmqr6MgGnTxHIZPwJqURXigYZA fXk1chtd7FmkOO+QP8KtmMRdGU/XP9K61Qsr2sYyq62KkT6rjaZCwxg4rUtbeSU4uJSoHQkZ/OqK yTyS+XIwRMfe57fWups/7PZRbvubJwxTb/M1VJa2SZSXVtCHypUWJRACvVxu3P8AXk1FFpl1PL+5 ABJ4UZrai0/R4Jc/vCM8EMDx/jWpHdR2uY7dMjqCQC34kCvWpZXzdDnq4m27MxNK1a3AkkV4x0OQ cfSux097e1sylxEzynnernAGDwVI9ecg9O1U4dQvXiEchYrndgnIGe/StCKSaUn5MZ4BJzzkfhQ8 hovWbf3s0p46S+BL5lqHTtR1FwLKxRuCSzOEzjqRuP6CvrD4F/B79n/xR4c1HVfjr4r8TeDbyKZI 9P8A7K0J9ZtGRhkyXEscqeVnlVXBOea+YbK+nstrYHBDYbYcAHkYI711Fl4nsrfdZXX2qW2knje6 gjZYzKqOCy7skDIyA207c8CvI4hyevXw7o4etKnt70OXm0eq96Mo67ar7j6PIMdhqNVVMRTU99JX 5fL4Wn+J/QN+z3+xZ+1d4z/Z9Fh+yP8AtGSWXgq6tri4l8LNdXcF4Le4LBs2lujyRrKAxmiDYB+8 Ca/dH9jv/gkZ8DND8KeHJfFXw+8KQatceDUstZ1/UrG1v7X7cI9jXqC6dJI5rgZkXEW2M8Zz1/GL 9gD9s79hjwz43tJbfQ/EXwyuJdLbSrC58K+ItavNRhFw6+YmOEG8BpPkLLk4CA1/Rt4N8Q+E/F/g HxR8Q/hH4q/4SG0sZpbeXUviPqsMaRLFIvl2shYLdm2Zh8m+MSOMhpcmv8fPpA5txRh8fPC1qdaF NzcmvZ06cppq3v1KEnz2vdyadrJ67P8AuDhjKMtlhYVsHUhdxS57yqRg9uWMajjy73SevSzWp+Jf 7QP/AASF+DH7DXg/WvC2t/F/4yPofiiO3F5feDvCC3mgz3Ns5khgvJbaZyXjALJnaQRuzXid34K/ Ze039nPX/hxpn7VPi2OQtay2Opatrd/a28Mk8Ku6/wBmw2cs0yIp2uBdJ82V2kjJ9L/4Ke/tIanq +hJ4d07wPp/jTxNFfW9/rWoR211qvhBbWWIqlpYo10kiTK2C7w71bgBgBtP82HxvsLl/Gr6smneG dDXVcTtoXhK6lns9NK4R0aOaa4khLMC/ltIcZwMDAH9Q+C3C2acUYWljM0zCdJylzxSVCV3HltKz g5fDs5L4d0nY/M+M8zp5BCdCFD2srWk3zxSvuvdfLve6T32tqYnx38AfDTwprkVt8LPG0/jhHaQ3 eptpd1pyhlPylftZ3ybuTnA/WvBBZ3/RzIMH0/xr1zxFZ+B4fDNo2hX+r3OsSsftkV3bRW9lCqry sUnmSSytuP3iqDA6EnjymS3u/MIdwTtzyTz9O1f6McORlHCxpznKbjdc0klJ262ior0tFKx/HXEt JfWJSjBRvZ2i7pXXduXzu3r2Hi0JG6RZDjnOMfyNRy2ZZA4BKg5wZDn8AKtxWxX7z5PfEgHB+oqy lnZuCHXnszvnr9K+jhC+qPlnfZmGISj7WKJ/vFqm2GIjE6rnj5ZCP51qDTdNwRIY+PUkHP4A1Qkt 7MPuhMQx33Hn9K1cX2RirNPVkiyXK8faHAHT97j+lH2q5VsiZv8Avrd/MVTmihf/AJaA57ZPFLHY DdvRlGeuMVslIjmSNlbx8DzZEODxkf8A1q2rC2gvjhniAHXbgH8q5UQugA3oenG1Sa1rO6ubbHlu QRwSAMj9K6Iq25DO+TStJjURn7x/vhgB78k1FLa6MjeXHNCW6Y3D+tYMHiDUQ4U3N0e3yhO/uVra TV5Jv9dNdcerR5/lU1Jdv6/EunTvqydLOJWAiaPkdiK00tJEHLAnjIx/garx6nbiP94ly3HBZlwf yP8ASoTrUqYaJCB7Hd/7LXDUb2R6FGKubsM08R8vYvHQhOP1NfT/AOzGPA198UNAHiu1Ms1vqiXk hvrc3ekSQwYk8u7toonldGI2vjgg9q+UIvFFwgVWU/KAQdmP/Za+xv2df2j/ABH8NALL4crbWerX d9D/AGlc6herFBqNqu7bayW8wEQjBY7nDK2DjOK/PPEGjip5ViKeEjeck0vf5Erpq7lZ2S9Hra6t dn33A9TDxzKjLEv3U037vNezWiV1q/Vaeej/AKz/ANl79rL9nOS50z4SeH9O0DRV1Ewva2/hm4Rd OjaQnzVe3kESb8DcUcIc4GGNfqf4l+G/wv8Ah5od/rFpe2onuZVubedoFuZYwTw4gDHIxx8qDv6Z r8Rv2T/2rvGerweFIfi18PPh1omgyx3dtY6/pMNte28l4kYk8uWS3inNtJKMAM59ec4x+o3jX9ob wb4q17SbKSA4v7htOXX9Nks/s1jtiLsZvNkQxsFX5Sqn1Gea/wCcrxp4GxFDiOnDD4aUIe+6nLXV VScW9ee3LdWu46u/nv8A6S5VisTioUalOo1TWrtFx00cU4STaXppZ7M/JP8AbF+DHx9utTvvHHwH +FPhDxDpyRXFp/wka+HtIsrZYsmbzxHchpHmVvlZmVVZRgdTX85c/iyCa4lGq6dp6yzXMk0z267V 3McsqxrgKA2eFwAMAACv3r/4KN/Dhtd8Oa3rvh742eIx4S07yry60DxDdpqdm1wvBEC2TmYytKys gltwiKx/ecAH+dVrTRJh/pmoRM2MbFEefzIr/XP6IGCqVOHPa4ipCduVLkpVYTjZXtUlOTjOWt/3 cYxXne5/I3jhXq08xjBwcE7tJuFrbaKOq21b1fRKwuvanpN3OTpnmWgYY2xK21iP94H+dYel6fq9 /fx6dpkM9zPcOIkRASzsx4AGw5NP1DwnoVyofTrvLHIk3smPw2rUumeEfsN5b3d5dxfZ1lBfysTM QvUBfkznHQsM+tf2YoRjSfLvbqmfhVNc1Rc23kz7N/Ze+HPxSv8AxVJDD4a8Qaja2hGyHTJ9P0yW O9Lb4y9zqcDRsBsYiMckgcCv3C+Di/tc/DC9fxR+1P4d8L+INH1C4j1GOLWvFNtpuu6Pa4whSxtl hgaXYQWESrvyd2eMfB37M3i7wFo3gjTtJ8Q+IfhPefZbn7TY6ZdaXfx3kU9wpKLc3kdykEQVj0k3 EMCAD3/XfwF8JfFvxE0LRbv47eHtLmFvMl7pup3GopqMV1LHIu2EStFLcvbNEN4idAONoBHNf51e PnGKliqkcdg6aptuLcoyU3bW9NylDW9nLkXa7aR/cfhXwtyYSk6GNnfeyknHXpLlUumiu+9kj9G/ Dvxh/Zy8MLa6RZwWr29xJLeRJPBceWt1cIGKN9nhP7w44dyWJI55zXoqXPhPxxHaax4U0zSdVkhu Qs6LPLa+VABjyHZpi0rocNtZCMdVyRXwz4n8W2Xhe40iH4cW/hHSbG/kmttVsNK05pEPlE5njuHu Lcxn5VVCynOCAo6jr/CHgq+0r4ryeIL3xCbFbiEX6eHbbT9OmmuIY8NkyRWTTKvAC7pmkJBwwNfw zi8vw8XzX5bpvVNt2drNKCtfvdq27P2CrkTjB11Kal/ibVuuikn13TXezQ/9o+ePx/4DvfAnwE0o ap4ha+kt4JptPjmFlIi5WGeKfaiIWYGNnXDbuBtzX8eH/BRv4N+NvhX8W9Lg8e3KDxS9nI2vQytZ iWG+WVt4It3aPDAgqFGFHGO1f17eOPG958KLuXxT4v1YnTZrWTU5tGjt72y1CYxncN11Lc7DIhjA P7s7lJQA5Ar8Lv2+f+CkH7OnjnQxYWHgSw1j7bFEgXXYtQjnd/v5me5hR5UiPDKsqEsQVYgV/WH0 Tc2zPA5vCGX5c69KTfM4qzXMtU5SilZbqKstN9z8x8ZsnwVfJp0sVjVTSV4uTbu009lK93tdRdrn 84ieD9Qml2gwuW+bKOCDnvhT1rR/4RGaIYnlKdgM8Z/DJr1rxr8YPhzrMl7pfw88G6PomnXSpLtu 5je3ttLxvFveOqSLESPlR97KCQWIryZdQsWUqQFYdNpD/rkV/rbl2Or1KalUp+zb6Nq/ztdfi/U/ z3x+AoUpuMKnP5pO34pP8PkXtK8Hi6vktbVy8krrHEAxBZ2IABPQZJ74FfdHwY8A/tOfDDXTYabp 9/p1gl+EvrrUbA3mnwzKdjsxEcoLqBj5G/SvjLRLi8Yq1rZ3Vwu7kwpjJ7c7q/TT9lb4ifHf4Whd d8OfCOfxfp6t/aMT+JrW68m3YLsM1rNHJEEzu5PzZOK/JvGLM8TSwFSNNUp3VuWo4pN9LOTST9U/ 8/1HwowWGeMhOftItP4oKV/SyV38mv1X7V/Arxn8HvFP9mXXgzXPh09/4eiht3naC6hub3a2CrPL BBFas+SAQx/unIGK90+Mv7LHwp8aeLNO1PwRp+k2mpavcqt219oVvrYuLl3wZZZ42eRUkyfmK7e5 YV4j8BP2pdU8XeHru78Y/DPwR4Pu7xIF0iS21ER2Zdz5chv4LwNMiwM25zCMHp710Pxy8Gfth67p Fvq2hW/wy8SakiC60a30FvskF1c70RWk3+RuX7OH+USABlDZJ4r/AB5z7K8fh86lGnjI4Z3cU51I TWuu8YqDSb+01y622P8ARLC5lTr4OFapTbum7cjW3927lfTvd+jsfhl+2Z8OvjJ8JfiPrfhrW57W x02z1OdIbbS47HT444Wb9yCLIK7MM4KyDcCOfWvzI1mw1e73XFzJdyhSSGkkdz15ILHvX2V+2l8I /jr4b8dN4n+MnhPR/Cc2rqLi3g8PSKlm+5m3SMFknLyOwY7mkz+FfD1zoV5aJHJO+I5smMs0mGwc Eg45x3xX+ofhTSislwtV4qnOTirypqKi2lrblck3vezP4Z8R69SWY1qcqM0k9puV1fyaTS2sihHY 2tyvyx3j4YEt5nA/CuitdMNyVg08TjgArIxA/PNUtP025DeXpkUUxwdzRTSYAHXPArootP1kSpBD Au92AUBmO4nGAT/Wv0GUm5WjW+Tl+h+cuNkv3f4fqeleE7HX/CV/DexA2cxYSxTJdujnIA2nyZEY Aj8a/UL4K/F3wVceH7Xw/wCItP8AIvVj2zXCSXd+HKNkzTQyCQlgnXBUEYyeK/Krwf8AEDWfBd9c sdLgvbiaKWFGuJZpDAxUoZERG2lhzjeGXvg19YeBtO8G/F/Slg8F3s+keILWOWacz2TPuiHQG6to lVpCu7OQueAMmvzTxFyB4mhfMIWjp78buz11aV/d83dX6Lr+p+HeeuhWdPCSvL+SVlfyTdlf0sfc /wC0v4d+DGt2+l+LtU8ReIRK0EsEOt3FhaWMQt402xqiXSqHC4ZQpdyPlI4r8QPjLpenabqaTaFq Ud3p86l7S0nlt21CGNsjF2lsBGrHGQAx+XFfR/jTQfiDoUzaLdabDr9pbIWW4nt8wES9Dvu4mYMD wVxx29/kf4jeAPHHhKe3ufG1hYaet8puraKCS1jd4hkZ2INwHoGAzXf4S8L08t9nTeYOa+yvc1Wr slZNNJ67W7LU5fFTPJ43nlHBuLXxP3tHort3tv6+d9Dya4CD5uBx0C9vzrOmaP1OcdMAfzNbMqW5 INuef7rIjYH4YrNdb2P5sJnGfkijzz365r+i8PioX5Urv0/4J/PuJw0kub+vyMKVnLYBOOuNwAqq EYkn5jz2I6flVqe7vFP70tn3jHH5DFZ7XNyG6M3/AADBP6V9HSnLRJnz1WKRrRLgbZPk9MkYP4Yq dYoViw7Ie/mA9B6Vji/uMhH3Aewx/wCymmOsVyf30swwegAx/KqhhZe1VS454iPs3CxansmnObd0 bn+Ej+tPtbPVY2/du2B13FT/AFqmthpjfeuCPTcp/pirsOkablSl0vXvuGB+Jr21rHb8Tx5Pqdfp dzrkJC4gOCPvr2/OvW9C1zWU+b7NbMMcuuD/AFBrxyys7aIAC4Rh3PXNddp18LPgTL1zygrir0uZ WOqjUs9T6n8NfECDTgjXaXKuv3gtxsU+wBYV6Nf/ABg03eJ47iVAcboy0UyHj3Zq+W4fF811AsUx iYKOBsUYrm9SvdPmyJVRD6AZ/wDZa+aq5HSnPmluevDMJRjZHrfi7x1LqhZLIbEyTuRtuc+wOPyr yK91ae4+SRzuIwehx+tcRczWucQNKBz/AKsAA/pWf9onU5SWTPuBXu0MDGEUktDzKuJcmdPcW2rS ESQOCMdxnFZzHWIm2xbST14IHP4ioI724XAeSX6c8e1X4tQG/a+W4wc7h/LFdkkktUYQ1Y211G8t ZcyRMD1OD0/MkV3Wg+J4LR1doZGOeQWZT+BBArEtbtHOx1U4HABJx+YrWh1QRHckJIXriNmHvnGA a4K3LJNcp3RpyjZntdj4+sGgSSKxnimHO5bxyD9VJx+tbtv4quNVQ7ruaCQ4AXcJFI9CT7V4Odaj lfKWyxA9WETryfbmtKy1pcjYwwvcAg/nivmcVlvMnyt/n/me9h8aluj6g0nwSfEEQmj1J4mAznyV PvyxavTNC8FfGfTLcjwrqF5LbDOPKc4KjndtDGvja11aRyD5wVc5GOpx0zX0h8OPH82myRJJc6kI x1FuDGOvQOGyAf8AdNfGZtlmLhBtSU12cV/kfSYDF0HJJpx80z1P+wfjbqsgt9VlSRSePttusgY+ xKHP41003wj+LtvbrdavbacE4UAWdsPodowx4PUivqD4cfHjR7S1WPS9O1K+kZB5tvqeoRTxOAMk 4ZAR9N1dF4m+PPwu1qOMa94TsbORRsE9ldxq5J4H8ar9Otfl089zWnV5IYOKj5JX+66/M+xWAwso c0qrfz/Wx4D8KNQ8SfDzV7q5n8N+GPEyKAk1prFinl8/dMTRvG2Rzyp+vavqrwj4++Huuas2l/ET SDoOn3MQuntdAtUdUZDjb5sbGVXPXlx8vJr5fj+JPwk07xFJeJpd/bzWs33zcbXQryxJRZRhcc1+ tX7G37b/AOzHqFvJ4f8AG+dFvGISDU7i6hkkuSwxsKMIYlQKDjKkknBboK+A8TJ4qGGnjqeBnUdl dwfK12aV5LTe6V/zP0fw+q0nUjhJ1lHV2UkpJ919l/K9mYeheLf2fbNL2y+GLalpsicXVjqF1a3M cywrwAs4cv5nTGOOtfP/AIx+Lb6p4zh1z4ceCvDrz21l/ptpeWnmMgQFTIHsrpW8tT82Sq4PUYr9 KfEP7UP7H2g3t7fee6W8TLGr2tjIJclcB0nR3aI85wv4cV8jfE3xF8PvG1ssfwB8WvDFcbr86hqV y7SomNk1uFlYvtYtlt0WTgYY5NfiXDU3Ku6lfAVEpac1SUnHbXma1ene77Pc/Zc9jfDKnTxEbx15 YqN99LJvS23RH5ieIPFPx/8AGHiRtb1iysvs0E7HydEKWUjIGztHyMz8dC5Y49a4TxPqutX927SW +vQxvwsNwouQAOqllgGfrjNepfHP4e61oeqv4gl8R2uoz4y11p8SqJSF4/iiPp95QfavkLW/G3xA azBtL+ZgAF6OAuRznZLiv654Ywyr0aVXCKCSVrK6S+VtfWyP5Pz+vOlUqUsQ5Nt3u9X9+v3Xseh2 0drJDI1/e2dohJxFc6dIZCewDpCMcetYWpW3he3Bku5bObdjH7h3UkegXac/iK8DufFviOd/9N1u 5RyeQY7gAfjvOani1LxbppS+tr9byNuclJjz243p/OvuYZHiY3k6qV+i/wA7L8T4+eYU27cjJfGM Xhi6wLaPdkfdjSVQoHb5y4618++K7eBXxZRG3XOPmVT+PC96928Q+M/iJqcP2a/a4itwpPlW1tGQ /uTK5Y/XrXgeqQa9JcSRxWzP1O6SBSw/FWxX3fDuFkornkvvufNZvVUpPkj+B5bfw3ka4Eq89/Kx +u2ufZbgf63yuOj4x1+legXcN5G5bUrW4K9zHB/UtWNetobg+TFqkZwM5hUjP07g/Wv0PDKS2dz4 vFW9DlwzbgoMBPGMtjgfQVpWxnZs/uycjgFjTfselb8qLxm9Ggxjn6GtCMWsABaNx3AKNnH/AHwK 0q1X3OSEE90blpuXiWJeFBI8wp39Diuz07U1EW2ZDGqnavl3CFj/AOPkiuLgSO4IkQso65YEcD8c 11NtoN9c2f2iG6/d9CuTu59jmvJrUYveVj1qFRrRK51cVqLlgSJZFZchSyk8e6sKhvNKUoyT2cqL jjaZCW+v3q5r7Nr2nATxKZBnjd82R+GKlm1XxFE3myRypJ2+TAxjsR0rGGEkpc0Z6HZKrF6SRg6j piplVQIMEje5HH0KiuamEtuxJIAHXy+hH6VvXWv6nJcZu1ecDokvmlfp9w/zqGa+af5jp+0HnEUs 0XX0ytd9NTejlb0OOryp6I5xn0yMbtoU8Alcgn8eawr2903LeXK2Dzgy8D/x2tm+t0mmP2mG6CdQ Vu2JH/fQAx+H51j3Gn2Ty4EF3tA4IvADx9Q1ethedLQ8jExjfcxpZ4GTaGiPTDGUdP8AvkVnS3Mh QmHyhj/b4/QVr3OlbDut/tinOMNcow+vKGs8WEm3a812hz3lR+Pp5Y/mK6Z1KrVmmcShT6M5q5vb 5/leRUI/hWTP5CsGaPUJWKzLcNx94bQtd5NYtEcx3chx03qn/wBbNZky3MmRPMzADqCABjpwDXh4 jCzl8Umd9KtGOyRwEsJtpPMZXIAz94Nz9M1TXWow+3cqHsHjP/xVdnOIIlJDyk45yxH8w1VIb62I KLMnoRJsJH/fUdcNTCOLtCpb5f8ABR1QrJ6yhcoLdW8qhmkgz7Q//ZUj3VtFw0sRHHSJv8asz6dH dIWVImGMsVZF/korEltbOHCxRjI7hwf6GtpOrBXST+8wXs5N62+4sDUdPZtsZR2PYBh/UVbWNZyS g2j1fIH5nNZ1pbSgYUspPYMvX36Vq2cOoxNt3Pt6jEw6/nXKsRWk7VI6PsjrjRppXhLbzLVtpM4c SW00AY84BV8H/vmvQ7C3vkt0e4bc38W1UUAfXjNYenW8kmJ2DApjO6UHcQevX+tdRYm4Mwdc4PGM qw/9CFdGGw0Yvm5ZR9L/AJWNpV3JW5k/X/hy+ryHaH8p/RSI84+tXobi7DZtUcDuF2MP/QTWlplp FOJjKbg7ANoQRKR68E5P51HIRaYLM6F8AebEvQemGr3sPiaTlyvdd7X/ADODE4KpFcy2fa9vyMua +1m0m3iIPgjjy1yR9dtakPiuBoSuoW4ik3ZY/dLY6cKMVrWrFVDI0PrllA/9mrVijsbg+VdLZsW5 DeYUOfTIJFejXhHlvqc9Dn5kk19xyEniDSy2CEAP8QO0g+4NcVqeo213ko8a4PJBQ/zxXoOteHba VQ0EcK/LyPN3D65x/WvNr/wvIjEtCjY7xsD+fIrya1Cn9pv8T1lVrLRJHJXL7QXEsXUHBx/Ssxrq 4HAVG5znOP61au9HSKQj7oye3T/x41UTS2IyX2H3Pb9a8OvhacpWhUt/XmdNLF1IxvOncZ58z/fi jyf7uM/1pqsQc+Q35gVMNNngyfMJ9wSKkxPtxlT7564qJZO0rqp+X+RsszT3h+ZSlulB4DD6Yqob 0kHcAPf3/OtQtjO8R/magMcBYFvJ5POf/wBdcVXLqyvy1DeGOpt/Ac7LqBLbZZEA/wBvP+NKJ488 yx+vy1pXFslwWGYyM8AAf1rAvNHVDlGIPqvb8K+Xx+FxlK8nHmXm/wDgnu4SvQnonZk0vlup+dce 4FU9kP8Afi/75qJNJRgN84POSvIqf+ybb++v/fX/ANavDlCvLX2P4o9JygtPafgf/9b+I/UdV+Ui eJix4VmZh0/IVxNxczsMkGumvtWhniCOsrbRxuboe+K5ySUSjcqkD8TXmYeL5dT38VK73MsozNzn nr0/Cq2wp97PXoBWjhy2Bj3IqnLFMBjeoz712RizjTRUXzwSDgfN1P8AhT4xuflhn24HvSrbyjc5 PfOMgfjTNyZ+c4xjp0I/Cru9mVzJ7F5YIm+9IeBjrTJEtUjJLDnjvVVJmU/IQSR90Ag1A4nIOQ3I 5PYmtkltY57O+5LmLkRnHP6c0LbwYOGDHqBnPaqG5lyCvAOVPv3q7AcneyjHU54/nSik2kW1ZbiN bxKDl1yR+FCoA3y7Dnpjp+dWDMoY/L+npUnmblDCEt/wGtJUVfUyVSSBAyNh2X8AK0I5YiAR9Ooq sDOxAWFcYz8/b8KuRicY3omP9lcVg8JZ3E6qLsF1AOXck1tQXtvIu7cevBrHigD87Ccc8cVdVEbj ySOcZ/8A1VrTU4apBKSely/LdAAEHPr/ABVm3Fyx+4vAHcY5qeSxDDG8KD3xgj+VUzZRKxBYnHUn PP6V6dCdWaOeqoxM+SWXPKH6Cm75ScrGwPqa10tLdV5cfjnNTRxWwP3s+wNd8MFN2uzkddLZGQhn dgrMVHT7ua0orXAyX5/3cVY3KW46VJ56ZCLjk9xXpUMHBfG7nNUxEvsoRbSM8uA/uw/wqxFEkfCh QPYYpAi8MzDn0qwm31X9TXqU8LBbROSVeV73JF9Bg55x0q2rsedoBz1zVeOEMRk4OeSBmtJIcdTk epGK6oQVjGc3cfHI4OCT6VvWt7LGmxQScjDLgEVlw27OQckZPU9K24YownIU9+M9fes50o7NHRQq y3TJY7mZ7uN7svs3jfhAzbc849TjoDxX7JfCT4QfsA6bc6V4zbRvjp8S7DXIP7NtdKXwpa6dareT sIcwXkd8wmmikYBCUMZcgMO1fmN8HbnwNH4gvNI+JF6ml6XqOmTWbaodIOsyWsjYZHhg8+32MSMe aGYqOinNf0w/8E6/2i/2QfB3g7wboHiLxp4ctLHwndTWGo654kcWNylvOGnR008o891AsoGI1ZhG zk5YdP5n+kRxNj8vy/ny3D1qso7xpuUVJSTt76jvzJK0ZKVns7o/oHwXyHCYuvOWOrU4xtdcyU5X i9lDmu0027uLV0rPRnW/s5f8EdLVPiP4e+NX7Lup+Lre9sL4XVn4Y+JdpeaNqOm6jZkEMbrSUI3R NnHDIeMHINfUet/DX9r74TfEu5+IvxT8O/FTxRaXVlqt14m0bSTJruialcqkqxWlzb3EfnmBMqcz RBwTvDEcH9fvhj+0v8Sf2qfgqfin+zdq/h7ULQ35srHXPEvhq4iglsbUlDcIHjDum/8AjUYJJ9K+ Yv2xP2y/jloGpv8AB2WDwH4h1OLS4tT1nS7K41GK6gSBo47q4e5jtJLCEJhpoorlwQmAQ5Ir/LXN ON88z/H/AFfMb1pJyjKNWPLKMFvFu/uuLbfNJt3+J6Xf9T5PgIYGpCGApU4wdr8snJp6PmScY3T0 93p53R/NP4C+EP7fH7X/AO0R4n8e+Fbfwl8L9VtwLzS9Au7RbdrREGYre1jgtyymPHMjKoDZJwBx 8nftUfs5/wDBUnXbX/hKv2jvC/jLVbeDU57GLUmskmjluYQFYxzWqHzUIPyOCytyVJ5r2D9t79rv 4n+GLqz034MfFvxTrGkeJrYyaxYWfiH7ZGLqBwRFL9isrGKFVBASGGSQgDLEZAP57+Pf2vP2ofG+ kxeH/FHxA8aT6fAY5rSxuNYvZoEkA+8okmZgep6nHtX+jfhJw5xJOWHzOlSwtKk0owhKlL2lOMfd aU7qV5PX3uZab6n88eImd5RGNTA1KteTTbk1OPLJvVe78Kttp/w3zhf2Ooxq8Esd4jwO0csUqLlC OGBwcg5znpU2mX08FqbdoIXUZOJE5y3HXiudvJ55JjPdP5kshLyO5bcxbkliRkk+5qi8i7NrLEuD nr1/lX9r4fDtwtPU/ljFYtc7cdDtbmDTpbbz2EqS4OQoBXP0wD+tcvLcOo22+4DPV1Jz+VZ6yIuC vljHv/8AXqN71Y3yiAk9guf616EaTj1PKq11LWxPM1255wMc8qRUIDnhh+T4OfyqJtR8zI2DnpkY qtvc/MqJ75rZI5edEzCfI2d+2QaiSO63ZJYj0yKkRufn2rj/AGSefrUmYN2CFJ/KnHzZnOV9hrRX BAKnoehwOv41agtLiRuCPwzU6lNh2onIx1JP5VKksu8eSoU8YOMVqkkSpNsuxwXkPTOMe+a1rSS6 +9Ko2/z/AFrLWXVwNpc9Nvyip1m1M8OpYY5yvNKaaWiOqm13O3tZbCVAJkLHHOFJx7da3I7bSVIJ R1I5+YED8gc15xFcTEqvlvnp0IBq/F9uZyfKmX3wTmuOordDqpTPTEOkFCIha7uAA5kJ/KvsH9mj 4ZX/AMUrW58OaLaeMmuzeRyOfC2hJrNobXYRI0iuUZZVxlRv2uOMqRk/EGk2dxEyTXCsNpDBnXjI Ppg/rX2V8Bv2p/ib8EvEsF34f1O+07TvN82+t9FleJT1w/2dJYonKkk7X+U8561+a+JNHMq2V1o5 TGPtbXjzbXWu1pX9Lf5n6RwDUwVPHU549vk2dvP5q33n9L37H/7PWvW3wI/tDRbXxQbCytP7Ml0u 3k1jTdVvLq3O97T7DKyxwMrkSM0UpBVgi5A59e8Xfs/6nr0d8NP0zxbYanNpMU9gke1jZJEhhP2l r7UFU3LA/PJGAyjI3d68y/YZ/aH+H/xk8L6hoHhPxXrOt6jqFw9xPqNpol3p0drOV8zdfMbqS2R8 fKdku5uNoxmvorXPE178OrMePtb8dGS1tpriwjGp3V7p9vbzRKI2iV3N1JMACGG0ck7gAM1/g/xv nmdYfijH4etNxxDmnGE6dROV7O1mopptW1jFtK21kf6YcPU8NLLqcsPJSp8vxRtokv5k5LbfW6d7 O5+NX7XHw2+K1xqUHhbwb4Z1DWZ4LSK2ul03QJXSa3iiCK17cRvLaShWUgbJZGwcs/YfkZ8Tx8Uv Bcr+DfHGkWGhN1a2h02GykKq24ASxruYKeMhvY1+jn7YPxn+BviHVrvxJpfiPWfG+uarNPNdaZp+ s39taWSkbWUvewRBUUjesSKwIHJGa/JTUNV0zxo8J1SG4hhtrVIbZLErvkkBGXlkcZOVHbgHoAM1 /q39HjLMcspoVMZhlGMUm+am4z5u6UpXsns3CN1qmz+NvGLMcNPGVFRrtyltyyvG3Z2j1W/vPXdK 5Jp+tWuUNzcW6EEYLKWz9ea6LVNf8NfYlaDU7n7Zv3SRrbL9n2jptYNuz7YryO78I3EV2SWaOJjm MTEEhO25h1PrxWzo3gK71nUYNF0pre6vLyaO2tbeIkySSysFREGfvFiAB6mv6eq0IuPtXUslruvx 12PwSjWlFunGF29Nn+B9s/smfFHSfhr4yuPEWu+I7fT7G7sZLUwXVkdRhedlZYJZ7BWPmCFiWTOC Gx2PP65fs2/tL+CvGN3b6J8WPEHjm5up7uC207V9FtL+20qeWSdyrajFHdbSwJBPyBVjG3nBFfHP wr+FGrfDbQ9E1+7h0TUNZ0aWbT9e06LSoC8cz/MiQThB50qRgh2CEow6nOa/o+/ZZ8KfBP4vfB+z 0/4tvFPaPbPfi01fSJ9BvUgWbfGrylVjucEE78guvIUKc1/n/wCP3FOEqe0xfsHOM2oOdOSvHlvZ r93dpqz1koyVrbH9q+GOXVsDhKcJ1LcvvcnI23ez/maumrfDeLvd62f0l4T+IPgW81GTw680FhNZ Ok66jFHd2QmZB8pMhhaCaJ8gqDwy5Fcmvjm/8B+Itf8AGfg7xbf+I764viZdI1CxtksrZZxtVUm2 Q5jIKgDzAzKOjEYqPVPA3wJs/HBtvgm/h2XUbew5tJI11C5YRnaV8uS6AVVPUbCy9jxXyHr+j/GH wzquv+LLXS/MmlZriOXRrNtHgvIbdMrFI0E8zTTZJTdNCECgMMk1/DdHAQadKVTlVlpOybba01ez 3vzbejP3TDUKGJl7R05WlvF66Wbs04t/JdTlvGnxwt/EP7MOreF1uPAmpywazLa+NDdTXGjwLA8r Yd47d5I4BC5jV5HO1lOScnFfz4/tBQfsf+KPFM2p/Efxj4LbVNOj+yrp/gr+2NWsbkEybnkuvMiB niJUK0TeW0YA68V+1Hj/AOG3xm+JnwTm8RXWieIZNOkieHU49etmtDZtIryO8brHLDOzDaqu6RjA U8EnH4TeIv2ebfxL4yh8KXHxV8C6Bc6KGn+06lpE2n3EKP8AKQ5WzRZ0DHb8ryc5IBHNf2d9HbA4 WlVxdZ4yVFxk2/ZPmsmuvLTmkr6fBHRrlbsj8o8X3L2NKhhsNGspW0mtHLey5qkXe2tuZ9mlc/Oa ay8JRarcSaDOtxYJMyxXEjmFnjBwGMZLlM+hYn1rRu08KygeTc24wMnDM+fpyK6747fCPw98JPiF P4T0fxpoXjJFgiupNa0GArYySzLvZIzIQSUzhiVXDZGOOfMbTTVI3C5jQdcqsaDH5f1r/SrA1aeJ w1LE05uUZJNNqzfm17rv8l6I/gXGwnh8RUw9WCjJN3W9n2W6/F+pr6bfWlvMtvFqEUduZVeRYlk3 D/aA3Y3AdM8V+mvwq/bKt/DHga5+GWqfEjxrdaUtyIND0Y6Ta6nMg2goqm4LJHGzhV2RyfRTX5zt pmkXmlQWVtAkV0rHzL83gIkXngwhcD6g19pfs/fC7x78Lbyw+LvhCTw34jtLm1dNWsIoG1cWMEx8 tFuv3LraTSsQIX6huPavybxUy7K8VgX9fiuZP3IyUbOS1WrjUUW7WTsnrbRs/V/DXH5hh8Yvqb92 3vSXN7sXo9FKF7X1Wq66n7E/DH9obxb4t1nRbLwb4EfX9fuorPT5bbx1PpccdrMimN1FsLVLhIwF JDB22RntivX/ABR8UNZ+LNhJpP7RXw2s/BnhmGC3ms9V0TT9YjuJryFsE21zZ2kqTLKwX5WdFIyd x6V5L4A8VftPeLPE+lX3im+8RaRfXVjayaGiQ2N39rsvMU+WZoZIpkCjkiTAHIKnpX6GfEHQPjh8 SEtrfw94W8C6zpUSi3uj4guYpZbuKORWkzepIYoZFZdxXYTwFNf5ZcYzwGEx9OFPD0oXXxwrTUoN P7MneF3svdsmmpM/vDLMNWdBVp1JO26nGKTXW8dJPu03ez03PzA+K37MXgPxR4L1Xxr4U8JeLdbU 6bLIlr4mvo7HTtNlkkHl3VtBNm+eKP5lOHjGeXODivwY8czw+BPEd14KaW3vJbMiGdreFvLEhGXR XYkHaeCUJUnkE1+ufxK0fwv8YvHXjWx/aG8aWvwhlsIxb6do8GpT3+mahN1USJYh4WWOP7oQckgd Qa/GHx/pvh3w34gm0zwrry6vbK3yX0KSQRsASBhJRuBPXHvX9feA+DxCjUw+LqSqOydmpuKuk1aq 3KnKydvc5b9dUfzh4y4mg2quGpKKbaveKk9X9jSS1/mbt0tc5O/1K/ZGuLWB4kY9ROMDHtitLTvG V4+kLpc2nQzwW0slzPcxErcssgUBZJB/AuPlGOMn1rnY721jkPnTzSEj5yWBH5HitbStP0i/uIoY mLMzACMKXdiewWMZJ9K/qKnRpxX7ynttb/PRn85yrS5vclv3t+Wp9N/Cr4k/CmxmhnkZvDM7Q/Z2 u7a3nvZopNw/foxYbSV4baTx0Q1+iXwO1HQ9TluNW0zxtoL28AWO3kvIYxcXTbgxCWBRblnx1kwR no3evzY8EfBnVrzxXpHhMMnhjUNWljay1PxJKdLsPIkB8uZ5LhBtjJGBJymeM1+7vwT+Cvw08CeB NY8Y+MPE+s3Om+HYLc+Ix4X1SwurSCfaE82JrCW4mFnLPsBKQ8k5JAyK/nHxpzDAYeinRnOc6lrR Vp3vKyteMnq9F71r9Ls/e/Cx4qrNqvCEY093rHp1XPFabv3fn0Oo+J2gW/xN+EFw9tZ2kV5pNzCk Ot3Oj3JlQT7QI1e9CJGsmflaQgq64UlQa/n+/aA0C7huxqfjXSLueKxi8n7eyQRvMofbtEtpNKj7 WB6yHHNf0Va98erR/AWr678KtP8AE/ifQJbe20y58T+Hdd/0RJ/LV9kkd5HJNEyBjGX2jAYMQCBX 4BfHHUINY8c6n4g1rwde21pdXEmL661a7linlGOYpLpY45dhOHCoRyemRXyn0dJZhh8TXp1qLjBS uk5R502lePxRlF6v3Wr/AN1H1njSsJWwtOcJpyejdpcrts9pJ+v/AJMz87NUl0ONmfTFuUO75RNy uDz2PP1rlLnUMnc0aue52ncB+de2eL9P0TYsWkWwWaRt7t5vmIoOfkwqKAR9TXmc2ky8r5CMe4Ut +vFf6B5bOlUgpcrXrufw/mNOrCTjdfLY5A3Rc58scn1NSx3sath8HnP+eDT5bOXcVjjOT/dZv/ia ijsL1SS27B9N3/xNfQxXRHz8731L/wBptpuAEGBgbQT9O4pjWhkJKrj3UH/E1SNvOhyxx2Hykn+l Wo/tAbv/AN+1/rW8NOhk22iaOznYhVDEY7irSaDcnjad3UYA5+lTWd26EeYFznGXYLj8hXoGm64I 0VTNEoBG0Fyx49tproVTTY5VTexx9ho99bnOZYz7xZ/rXXWFrfJgmU47ZjA/rXp2ieKLOQrHdMZd x4KRs2R7YjFev6fZ6Ze2+WtJEDdGMDhjx2GBmvLxWNjDdW+Z2UMM3sz56iY4CtPk9z5f5dqS6S28 rM1xJwPmIhYc/U4/lX1Fpvwz8PauRulu4i3QSRYH4FiKNc+Dej2DFbr7YiYzG72zkH8iRXBHNqPP yqWp0Swc1Fux8YX0EUg/0d7iTqSCCK5+SCS35czIuMcrk47n3r6W8QeA9Ls5vL+0hBjIfbJj6YC5 rzS68O2gciK7ilUZJLCQHP4rXtU8VTa0Z51XDyXQ8vl1Syi4d5246lcf0NNTU7WVh5ZYHsWH/wBa vTrfw9aTLhJLJjjgPIw/9lrUtvAU03zmCzZezpNwf0B/SqqVF3HCnJK6RnfD+58L3WtRWvi6+ayt XO2S5WMuY+OCQvJGfSuc1DVms9XntbGVZokmYRTDcqugY7WwSOCOeea9Rs/hhbahKsbrsOesZEg/ Qitq8+ClhAgZboE9MtG3GfzrzfYRhWlVlUbTSVui81pu79+mx7WIzOtXwtLCqlFcjb5vtO9tHray tpp1Z5D/AMJrc24ClBJjsG4H0z+laUHjW2k/eS28i/3l3f4YrU1T4fXGmN5cLlh/eEZ6/iP61yc3 g/Uwdx8zaeegHH5U2oPVMxpc8dGdpB4405TvjtuvGGJ/pXeaJ4604lWntolGMnazg/jivGLbwzek AMGOPUACu80nRJUZAJnQ5+7tDEN+NeVisKpbnp4evK+h9ReGPiF4STyzLauCp+Zlbj3xjmu51fx1 oGp4GiKsOMYXkE4/LBr520rRNXk2mO6lxjJ3wrj9etdtpf2uzuBFPLCC3y58lVLfrgV8jicupKXN fVeb/wCGPoKGLqNcvT0R3c11dgyNcw3jxsf3jJIFfJ67t/XP15/SvePhd4h+G+tIPCOtaZqc9ukZ kY22nRzyRqB8wLIQcMRzxV34Vy+DxBJZeJ9J0y/88LJGbm7kWVdn8KbEYZOc4NfVWiX37Mvhax+0 a74YuC8Lb31HRpJZZkSRvlVi8YAGejcH+VflHGOdxVOVBUJya25OXfvq+mx+s8FZXP2sa/toJP4u e+i7bW1KDfCP9mS18Px6/oOneJrnzCySwPaLLbxIwIDmXzMlg3QbkA6k4r4s8e2tj4XnupPAd7qK abKrwXkN7BFEyAsONsEkoIIAJI7/AEr9H7PxD8NZkn1O1SWw063m8yEalGF87cmSPPix04ODg5r4 1+Lt59tvJbWG61prW6cSxR2oiMbkk4bzNxbaP9rJ9a+E4Hx1aWLlHETnJf39fls9V3XzZ+lcZ4Oj 9UU6KjB/3NPnutH2+5HwV4o8Q6zExtlvLm7jcBXIuSwIA+UHPPA7bfavJbjUrlstceWh77UlY8e4 Fe7+MrS9l1N4haTxRKwdvtUgkcg9CXTHX8hXFW3grULifLG1ILYK7mPJ7ZL/ANK/p7LZ0IU4tq1/ T9D+W82jUlVku3r+p5a13YctNNfEg4xEkg/m1SR3mkQ5ZP7VDfw7MjP5t2+te8T+BTZ2+15rOIhQ PldGK8dTjJxXlmq+G7y5mMK30BGNo+dUzmvcwWLo1NI/1+B4OJwtSnrI5uXVJFTzkbUTtHym4w4A 64G5q5/UPEk9wjRGeXdj/VpDEqn2JVh/Kub8R+Er2FyiSJOc9nDj9GNeW6lo/iS0J8tPLXOBsXJ/ SvpMHhdeZang4vEWTWx3suoXQf8A1QbrgGOM/wDs9QDUbkPma2hBzkeZb7v/AEFzXlbxazkm5aQ5 65jP8zWfJd3VucGEuR6xgf1r3aEuXdHg4m29z3Fb3UJp/tEdtZyM3UiJ0/PB4rXtL/WUK7rVFOAq 7JpRz9Awr5yj1nUI8HyWX5s/d/pWvaeILg48yLPqNhqrxvu7/wBeRhGelj6HtYvEF9eGGGMRsBzu uZjit1bvxXpjBW84NH1MVxKv8xXhelaopdZI4ZQ4P/LNiv6ivW9D8Q3YVfNWcjqcyOTj8xU1JyXW 69F/kdlCMe1mdrbeJ/EihfOScjOc+cSR+ldjofiGyll8zWrfUJm7jzlYDHoDj9a5uy16PU5hDdRY CjCyFmJ5+ritTUNVhiPkRWayIo+8JmQg+uQSDXh4pRfutP5afievS5lrct67qehXU+YM2Zb5VNwQ oH/fBwfyrzTVlvbreI760aNcbSWfP4DBxWjr2o2lxBt3yFs/MrISq/7O7v8AlXmM0rxsZIIM4H0r vy/DQjbl/H+rnDj68noNuobXkS3MLuOCFaXHHt5dc9NZXJbZaMze0QcnH4qKddtqd0CAvORisaW0 vUPzqPUgjbX0lJabHgV9tzSbTLoqGkMoOeA6n+uKjm0W+CZXZg+rrk/h1qtD5yrmOMsT6bv6U6Wa SXBlgzg5Abcv67TW7ascMYtmfLp12q4fJ5wRjI/kayLi1Y5TCDjug5ropbeV1PlRxJx0eVgOvuBV H+ztSj/1EtryCzZePH03E5/SuCVXW3s7nT7F8vNzWOTInjJESR8ewx+tRbzLnzk688Ba3pLK/Vi0 nklccmK6iP6baYY9p7A4yMyxn+gFW4xkr8rXyMeaS63OYnHlMWiZyuPubVFNWJpTv8oHnowQn+Vd DOoLYk8stjj99FxVdIQOC6g+0kfb8K5Z4eC6s6aNaUt0UotMDEscAjsFj5PbuK1xps8oSG0MbO/U PsGD9SwH60R20hceVIGPpuQ8flWtbwXAIXbA7Y5UlQSPfFc1TCq14s9bCNNLnWj9TrPBfw81XxO8 +nQpG1xCpkxtDKQOv3A7EAc9OnU00+GLW2ma1e7sQ65B2Sdx29c/hWUqazK2LGL5wMM8Tk5yOhGT XXWOmaqlmkuoC6hdm2qBFwV9Q7A/iBXFTqVac3KpU06L+nqerUwlCcEqNPVbv+kvzHWOja/GqLo4 juGdtrLG3lkj3LAA1oDQ7ueUR3pVJQcMokjbH12g9K9PsvDenz6J9o1aC5ebhY/MVgzhh1HAUgdC PfvWNHpGiWNylxqNpHtU4kdw28HkLtCgH/69aYfMJOTcdbPr+mh04nJUoxvpdf1fU4dtDvoMtbDz udoDRbgR36rXOXq6tESZERQOqhAAP04r1J9Xlso/3MhMTs0Yj8zkbe5UDjrx+NVbjUReLhYoQ3bd cf0Yf1r6Nqk/fbPmX7VP2bR5c+rzLFtCR9cAkAc1nXmqXky/NFbsDj5SRu/lXqyxQNF5moR2yIGz lXjLfgScZrkNdl0tsw6XFJJz95jGPy25/nXj4nGUk7Wevloe1TwtRxcuZL56nld1Fdyjc9rDz6dT 9a5W60p2bIhcE/8APPIx+VdxdQXIYlo3QZ/imIH8qx5P3WTIwHP8M6g/qteLi8Lhaj96N/l/wDbD 169PSMrHGHTEi4k+2jnP3iB+vWpGkiiG3/SABx8zjNdGZA5PlsfxkX+gqvPDuGJQPrvDfyrihluD grxTR0PG4qWkpIzF1CzGFYXHHUhlNRyX9kedpGP74U1MdKsZRuLJkj+9iqDaLpqEttRuvKyDmuqN JKPuM5p1J83vK/oI1xZsSUKE9gVUVEJISMkD/gIUdfwoGiWrnEUSfjJTG0dEOEhTg5/1g5FYPByl u1+P+RaxnK7qL/D/ADHbrfdjHH0Q07db/wB3/wAcX/Cqr6JIeVhUDH/PUHrUH9gTf88h/wB/f/rV H9ntf0/8glmN9eX8V/mf/9f+IOa1CDfJIqsP4Tnn+QrJuLqFU2KoPbOauahPLLK0980s7EDDTHJx 6Vz00w2ERwjGffP6mvNw8pWTZ7uIad0PL7wSMjJ+tVpY0YfNkkZpircNyRgdaQzXSjIQAepHNehD Xc4X5EZhjLZ2HP6cUqW7DBZCvfC4FDT3j8BT75A9aiDzbi03GOw5yPpXRyxM5X7kxt0kbDZ69CR/ 9emCwgAy2D6jOcZquRG7YHm9elPSO2QYKuT3yTmuinbqiJ3S3LCW0KqQcdewp4Tb0U478UxJY8AI CD+tWvPBHfP09K64cpztsjEsi9Ez9f8AJNL9pmx8ykew7UglXGcn8qQSBuAfzFZ1F2YJeROkqkZY Eexq9DJH6E/T/wDVVSJooyM8561qQ3NvwvC/UVdCTvuROKZbg2k5CsRnsa1NkRt8RRJncOTJz+QF ULe70/IDv36Y/wDrV0sFzozJtMhXA67Ov4gVrVqT6NFU4xOanxGM+UM46lyf61kyXUcIwqjk9E5/ U11F2dLV/NjZZATn5gRj8xWUZLPdn5ahYJy15kKWItpYow3queVbGO+P/wBVWvNhAy2R9QDinNGj jEYA9/T9aaLOLOSVbHPOf6V6uGlVSstTjrcjd9hRPCT/ABe+AKs+ZbleC3TjIpiIq9Ezg84z/hU8 ZTG1lQ9+TivWpudrt/gcU4x3SI0eLdtJb8Ktgwr1836cUqIu75Ehz15JqbLr99ox2woziuiEpWtc hxi3oTQeUwwEk9c5ArQjfysqFkwf89hVaLcQGEhA/wBzP9a0FeJBgyu3r8pFaNTtoJuNy/aBCwYw znPfJA/nXQxCYACGAJnqWOaxbW4s1PMjEdTkGumtZdNbjaHzyGZST0+tYqMt5M6I2v7qPqX4QfsX ftjfFNbDxr8JPhv4w1y12/2jZahbaLPcWEqW5LGQPJGbeVAVOQSynBBBGa/VD4beOv21fgn8DtA/ aX+Dt58G/FraxLJaeIPCVr4e0eLxBpbW8pt/slxaQ29rJLFOELkwCTGSWI6n8XW+MvxTtPDMfhKx 8Ta5BpUMRhi06K/uUtUiYnKCJXCAHJyAMcmva/2ePFl78atd0j4E/Gj4lTaB4NtkLadYaqdQk0x7 lWLw2o+xHzIDK7HbIAcMenNfiHiHwnjcwoyq5iqM6NOTbj7KU5OnZ3ja8m5X5WuTk1W72P1/gfPs LhqqoYSVWM6isnzRjHn0te+lt9+b0P7JP2Bv2zf2sPj34JDftALqvhueS4uLTTvBej/DfMEQWPzE +x6ld3wjR8kBIjA3yjJXHNfKv7Yf/BPDQPjD4ivdB8cLDpvi3XCddtdc8XaddeE7+S5n+a4fUtVj Wexube3t0bZbQINrgszIPlrx39k3/gm/8d/hZ8VtMuPFXxS0iy8M2fleJPDA8N+ILrS7e8njQs8e ohdPuZjOI2EWZ2jlZQVBboP2w+KFt4rtfB6+MNP+I2g+HtXjN0z6V4q8S6rqGhx+dCRM1gNRjkiK FjuMTQIiL8oYdR/l5x1xDgMlz1YjhvFxjOXwexjypWbdpXvK0VdSsuZ6RalrJf11kOXyr4NUsXQa TT51KN7u1rpwXWV3r2bvHSL/AA+0/wDYr/4Ja/AT4W6DcftE6j4UtZrq7k0+7n046jrD3d5Ft8x4 NTa4+ypCRh8fZY2UMPvDDV+W37VfiX9iX9n74iX1t8M/DPw++JWl6oS3h+LT9f1ORNGso9wR9QS1 isknups7tguGCBQp9a/d6wsvh9dfBPxLqGpfEjwauvEeVoviXxdrlldvZ3aPidotNtZ7iCW1UZKB 33sQMxqBz/JB+0LpHhvTfjJruteH/G2leKpDqD6mNZ0fTXtbK7u5H81/s8TxoixiQ4HyqnoNtf1N 9GTCYrPczxlTNcbiZyhe8XOoqcm2mrcsI8ltv4jlK0ly8t0fmfjZVo5Tg6UMBQpJN78lO8dNVq3z dbXjpp717HG/FvUvBviOa38RfDTQ/EOk6G6mEf2tJFcRG7JLyLbzRxIojAI2xs8jqo5Y14qzsBt/ e+33Px719CfFX9pv4/8Axz8J6f4J+KfiGfVNJ0u4FzY2JtrWGOGVUaMOBBFGSdrlck9D9K+fpLKF FJ2uxJ6YUfzr/RjhihiqeFjTxdNRlG6spynpfS8pRi22t7r5s/i3ibE4WpinUw1RyTtvBQ16+7GU klfbX5IoEgnHzHHY7c1EsSswHzAfQfzqYxRo5KRsPqVqJ03cKGPfkL/jXvvzPn5NbDmtol4LHn1x QbO3jxnnnsw61AomJG/gDjG0UrMFGAcjPTGKlK62M5u2zL0bJHxtOMd3FaNsmmSSYmhySOWMmfp3 rnFYg4LR/iM1IBH/AMtOf90Vd7iskdyltpigMowAcAAIx/U1eit4i2+NGIHILKnP5VwMJgAzgE9P mz+tatpcSg/IVHoF/wD11bm7WLjBas7+JbeLlgB2G5FPH6VYl1W2SMLABweQErhQZJWOGIPXkn+V bFmFQANKBng5Q4/nUOrJ6I2UOXVnW2GqJKodliz6FNp/HmurTW3jiCrFbuME/eC49+M1xKWiiISi aMjpt2HP58itWCGeUBE6cZJTAIrGo5WOilJcx18GqQ3LJFHaxu7EKFWfkk9OPU9Olfs1+zM37eOu /DO80DSfBWleMNDhcW9pp3iuGOK9s5LKJWK2EtxbiZdoZGCKx3MAQDzX49eCPAupalexanc2X9o2 cN1HBPp1pfQ2t9O0n3Vt1w8jN3ysbAd8V+tVz+zJoFn4Pttc8L3HxD8FtG0Ul94i8ValqFtFYPNK FjEtusEcaMq4zIk7qQenYfzH4/5phJ4ahgK1OE3KWjnTdSMWrdIVIVIvbWOrukr6o/oTwcyfEe2q 4uMpRUVspKDad/5oSg1/i0VtbaH6nQftreMvAvgpLPWvgb478K6xcLb2moXVro0Kwy3QiCl1uEh3 SGR/UDCkEc5B9Z+NXwYtvjJ8ApG8ZxakNPijWeDTL6eLS7pmNwElg2XMLvGrhd6sjqX5JGMV5b4f 8KeDvhTDpnjP4wfEy+8feHbTT4Zmkt9Tg1SwMqWzRQyfZZLrzGdHbesgiO7PIzyPJfjf8Uvhp4t8 Oab4a8beJNc17RoXj1bTJhpGl3TC1MR22039pXcc1tKHPKZGFUYBBr/LHAcGLE5rhsRkGE+ryjNT nVjGvJSt9iPtFzRlFLZyi1GW+ja/uBZ77DA1KWOrKopR0i+RO213y6NPW7s9V5tHUeOP2L/ht8cv BGgfD34eadHpem29zJJq72sM19fq1qCUht53JikTBOwAKoOCWbIx+NnxD8Pt8E77WfC3hPwtqN7q 1rPKNd17UtISYWEMZaN44Y7m0CIX3L5kxXcjLhCAST1/xqjs/GvjQ+N9PTxL4Ls4dOhjWXTJ/wC2 YXuJFxLIJLJ0Fs0yjmFUWNCNuea+H/G/hnW9G1tzf3mrtZXckhtZdTd1nniDY3SxBmKk9Spr/Qrw Q4EzLCQVPHZn7WElzeznF3U3JylepGTVTRrS7Wi5r9f5W8VOKsJVlKeGwPJJO3PFr4bWVoNJwV76 2W+jTZSHie0jiS1sgVUE/vHZdxz1+YHJHp6V2vg/xP8ADrTPFGn33jY3J01LuNtRk05IxcxxjktC 7hhvHVcjkjqOteYw6NoEgFsm/wCqR4z9GIGK6Twr8P8AU9U1+3tfBcN7c6gkhu7aG3HnShrcFy+3 GDtAJ6EAV/VOO9nOlOM5cqaeu34uLt6n885fUnGtCcI8zutN+u1k1f0P0j+Df7Q/wQ8O/FjR7f4f 6zJc6Q+qw6nq9x44vIY4D5a5LhUVZ2liH3IwdpfpkE1+r3/DbugX/iyTVdEX4Z32mCEWFglxrFtY pCzLgXs7wRB1l427VckZ42nJr8f/AIVfs/8Ajf4i6dpd3438B+G76TWWj+w3/iS7n0uPUogMgR3V uqWkLlkKMXdZM9etfoJ+zP4F8T/Bu9174OeLPBfhDSZ5rk6ro66dcO5gtypd7WKQWV4L65kjH7lm ZFDAnPJI/hHxj4cyKrKdWSVWrTjZxcqfvLm96SceVtx6+6rJW30P7b8Ms4zSMI03Hkp1HdNRqXi2 tI2ldJPX7Tv6an3z8N/HWu+PbnUfG2n+H/Cem34RYI/HOnXd/EsU823y40vZLeRZGmViPMbIx8ue 9es6F8GbLx34TXTofHuu+IrXVbmYEtqz3U8d5Z7/ADoVldPNaJSWjZImAwu7K9K+JfE/ij9mH4l6 Jr1vNY+IfCWlRSWunxz3dlutZ3eMO8rfatQWzV43XkmEbfugMa7Dwt8Q/hLLc2eieJfEWman4d0q AvorRXsej6IJHQlw5tyIGmdhhhuxvzkEMDX8qZrldalTlUw0J05Ra91Qbskk4pNykm7vZSjbXS5+ 64Go5yu5xtZ6trzv2003va+/W/mHxi8IfCbRbUfBnQvjhZfDq5vLdNO1qeHVr++1f5yPtESQZt44 /MBICsm9kJ5HWvzP+M3wk/ZJ/Zr0BPGuq+JfHfjPxVG5tdNXVLvQ7qxlgmiZobz7Jdi4keHcdwAB 29Qwavpr9raTwPNFp/xG8UQaBrGptcJbCfStTsA32NXfMXn2kq+UBHtZJnPmZGNjgE1/O5+0Le6h N8Qp7N5tRk0q1aRdBi1C/i1CWKxLkqDPCsaN82SMIvGOK/tr6PHDuLzGFNfXqsYaupF8lptaNKSi qjXS0m1a9tmn/L/jhm2Hy1Tqyw8akrpU5Xl7q3Ta+C/mtb26H1h8QvFegeJvAVrN4l0DxLN4tmZI JdbuILTTNMtYi37uG3s7O3jWaR/+ekxU88LnmvnG4F9pd3Jp979pguIXMctvMgDow6hhs4P4V5do +r2Gp2UyeKLzxDJcEvIqWs8bQsI0/dl/NbdkHqQDx05rBttUmjl8xrm4ZuuTIc/1/nX9r5HgHhYz pJ6Jt21tr0jd6RXZK3zvf+RM+zKOKnCs1q1vpfT+bS7b7tt/ge9x6reiPAll25x/q17e4QfrXrPw 6bxhrerpo/g26voru6BZxa3DWmREN+XcMqBVxnLEAHnNfPvhT4izeHrwXtvLG7qhVEurWK6TDjBy kwZD7EjjqK+h/hn4Ii8Va5p9xc+ONF0uy1OUreSi8it5raJv9ephl8obgOAm4Kx4BIrxeLsTTp4W q6to6aNrmTer1SV9N97s9/hChOriIKk3J31Sai0ttG31v20P3G/ZES78JaPFrM9s1leajZg3l7q2 sWt3pu6B2AktLmTWFlt5X6F/L3nLKAVPP2H8X/ih+y/rHw30/Rr2+8U6Rq9ylzLrVvo2h29x9qkG FkdDb28yNFMSPnMg3DO7dnI/NbRfgpffCzVLHxj8Hr7wh8R7PVr/AE0WcniiSH7X/bsYYKlrDZzx SYPy7oGSVXBBIIwa+l/iH8Uvi3rukP4Q+MF/4Q8P3vhyOW5S3tNNm0+0trCeIpJBm+SJSZsDYykz IwO1WBOP8tOOsowuPzeGMpVlK7veMnGatpZwlCpJ8rai+a1umui/0L4axGIo4GOFnBwce9mnv9pO Kd1ro/Pofk/8bPiRoPgjQNR+H/wWvvGE0msNFBqIK/ZrOSEI2Ypbe6iknE+09I5FQKMjPb839Sgu prki985CrFGjklVSGHUEHofWv0f8d/C79nnV9SuvFP8AwsW6vb77aqy6NZaPeSBo1Xaot7mEtFIc YILFCB1Jr5V+Lml/CTTJba18I3moX907PNdTavpT6ZcrG2TGpjF1NEy47qqtxk9a/tXw6xmEo0oU KMKjlLWUp05xbdt3JximrKyaVtrH8q+IuDxNWdTEVZU4qOkYxnFq1+iUpO7vdpvvc8OSaGABftcE IHYsrc/UV1Oi38kF4l3Zao8csbgxSwt5ZU9mDqQRjrntXGXtzp2BDGIuDhi0II498/rVuzspBAst vFAQ7bPkDbsgddu6v2KNJct77+h+Nzr+9tt6n03YaR4y1u00zXdX1aC/tlmWwszfX32pIcyFhC6F i0aO5JwdoO4kdc1+y3wN/Zr+OPxKk1rStF8OaTa2d/Y2Juk125uro6fFApSJwot2OwEEJE/3FKsC UBz+QPwJ0DxZ4gsZ/CvgvQ9f1DVLyUQzy6befZ7VFlwIfPTyHVQrjO95VB6cdT+h/gb4f/tt+JNR 0r4d6fL4+fRtQiewsL3Xr9LLS7UKpDs15hraIxtkIxfIO0dSK/nDxSliasZ4WhjKNCUb259+W6km oxmtbq65rXte26f7pwBUo0uXFTo1JqVrtK6vZppycdrPpts76M/Vm8/ZX+IPw98Dt4Qv9M8Oatea 1pzaZ4ll8P6RHpkjaOJFk2h7NrW1ubhGAJDW5fhQWI3Cv53P2y/A3h7SPjNqHwz+G2peIdUttO1B prTTNZjj0+108XKI5ighkddjg48xhGgcjcARg1+2/jH9m/8AaA07wXo3ie18Q+NNTtNGnuPD+raf p/i/SA9xfYMkk1vq8IdIlhdU3W0oJxjYwJNfk18c/h54TsNSubzXPDkmtaioM2oX2qa1cz6rLK8b SST3VsJZEXCqfnRwCADjtX5f4C1KmGzKriJ5hGu5JrlhGMUpXteScktI6JQto7XlZn6B4m044rLY UaWG9mlZ8zd7q17LlUnv/Nfa7Sdj8vb6W7gaS2uRhonKOiMPvA4PQ4P8q5CVMuZCk2Ac4lCnt9K9 W8TReGraVn8O38U8ckpeK3RWaSKM8qrsRsO3pw5J4J61xTGdn/dzTD1+ReOfWv8AQLK6TcVNvR+T X5s/jTMpRjLl7ed/yR5fePEzbSjjGecYH6Yql5SkECJDgZGS2M/ma9Ev9On5aOeVj7xR5/PNYM9j qaKVjG5jwN7RqM++2vp1FtHzFR66mFHEqxjEEbAc5Xg/mOauWn2ZPnmzGCeckn8uaglstdD5FtaK TwCZB/ShrHU0T/SbaAEHJKv/AC5/pW7o36v7jnnWs9kdTbXOjoAEniXr8zjP6Yrt9FuzcSAWlyxI 7QoBkH6KB9K8iihvQc/Z09eM10GmXOuQMGhjkTJ/5Z7hwPx6VvGCta/5nLKs3pY+ldJjtpikd9e6 iFJCsVkVAPqPLP8AWvWdO8PadIQbO5uLjGcfaL3uOmQNpxXyXp+ueIbNhLG6gk/xbiefrXYWnjPx bDtYzkchlDIzAjPbHXmuLE04+p04Wq7H1ja3PifR7bzrQwwIwK7o5jKTjt80uawj/wAJJqVx5zzB R94thv5LKf0rg/CHxPv0TyL+2sZc5G6e2YNk+hGOfwr2/RvFVp/Zo8600p+WKu8MiMGx3DAD8N2K 8ylKNNtxotv0S/U7KsXNK80l8zirnw9qDW7XYeZnU43LKFzj0V8n9a8u1WfVbSZkhtrosOGJCP8A 0Ga9o1jxLcNGbhLnTYlYYCgbCfcKC3NeT3uuXMs7Ge7t05yAZOeewyRXu4fDzn70U18rnl15xho2 jg/+Ek8QW8gxaTPg7SBbxAba1oPHGqRRPE+kXDgj5SqpHtI91rsxrlpHaCNpLFty5aQSKcf8BbJr k9QfwvewMJtQiiKjJdVBH5rg1E8M3rUlZFwrW+BXM+LxBrF3deadO1OAdTIGXkevIrqLXUPFd4v2 NJpkj3bgZ5EGc+p4/lXkN1d6IG2SXsbhf4iHOQOnQir+k6hpcjCKxvkiJON3zqpPuWOBXHXw0N/a W+f/AATopVZ3s4/19x9K6L8NL7W1WO+u7RBuB3ICxOfoxB+uK6W5+BejKGjhuoTKh5E52jPsACa+ eI9Vt9OlBGszySEgtHBKVAx0O4Nz+VdzB4x1NlSS91A3MIxtE8zkp+O7t25r57EUWnzUsQn6v/gH 0GGnBq1Si0ztT+zv4mumT7BeaS7St8saSnJ/BgP0rpov2eviZpsotQ9gisM/OjEDHpwc1jaL8QLk XKS+baykEBTPeRxjA7ZO5hXuei/Ht7JY4rS2s4JI2z5kN883I7qz7sD26V4GZ43F6RptS+X9fkez g8PQ3kmvmcjafCP4w6fdQyWdg+pgsMx29uwQ/UfKRXW6n8Mvipfr5eo6LBbbTuZeImjHqVZmx/Ov qb4b/tPJfWMltqmurdvn/j1uIFYrj+64Bz/3zXtVp8WdP1AM0mn22pS3MeyGG4iKvAc585FiRVc4 GMSEr6ivgMXnWY0atnhYu3VXX5pI+joZfhqkP4zS/rtc/OO2/Zx8dXym6sCk0Ue03It7mMmNXOMn 5htz0Fe8+APC2v8AhKI6Fod1PufPkprEFkUW6TBAaWWbHkcHkg+wr2i1+JOhwa6ya1oMt/Z3Lhbh Y7GOGVFzjdE0UQ2kehJHtX0BdeGfB3iazt7DwnresTTXLOr6PqlrbRQuAOCs7Zwo4/1gUdjXyPFP EGOaVPE0rReztp899vPlXnvb7ng/LsLGTqUJ3mt7vX5bb+XM79Nj4U1DxJ8R7TWI/DGpaTod/czO ubi3gt2gfcpz89rMkb4/hViTnrzWT4m8If8ACQeHrqPRVvovKgX7faK1jFK5BOdsO1pSvHZiuRnP av0AT9hfxtZWNlLchPDcWqma0vdWvtWs722kiOGQiGJZDbHI+8obdkCvGvE37O3gzwdPp8ln4k0y 31QbrS4m+26e7CQOcymESK5THCsyhsEZC4r5rA8R4SdWP1WpFNfyx5k2r3b5W0lpok21u10Pt6+V YhUpLERk0+7ta/RXSb31ukuifU/MdvCfhOGRZrm71SAtteOLzbZDvVsYbDZXoCCRn2FaWqaB4D1K abz5dbW9cqwuPt8VyhKgBvuxru3Y4+YY96+qPFXwi8IanqGp3FlqulSm2m3XV2t3YwmUbtrPHCGV yD1Y7zjuMc14mnw48M2s5kglE8QzucvIq4B4+eObb+Ir9py3MaOISn7WfMuiT02fb8z8RzihUoc1 L2UUn1vvuu/5bfieN3PhfRWRrGzOqzuz4jSNYiM+4wSc1y994D1mN2a3ivINi5KXNuoAPuAhr7Is PCPhyMEw2jTEr+7ktbiSbZx6KXOfxrL8QeA9K8x7jUWe1BUE3LrdSleMYZeOfToK9PDZ8oVFGUpL 1i3+Wh89iMvUobJv1R8PX3h3UGR45rjTjKBgxSoiken8ANeT6z4UuIA8kkdm+ATmCXB/IYxX1N4l t/Bmlagy29zbTDGDKI9gb1GJCWHv+leOeIJPB7SbQyHdnC2jRA47Ekiv0rLcZezjd38v0Pj8Zht7 2XzPl3VLFYXLXGBzt2iYk9M+prkrkwKcKHI65HI/nXums6ZpVwWktGmCe/knJPbivNb/AEAb2yZA Mk5aMn/0EGvusHUur2sfGYumk2jjBbQSuDtk/AFq0IdMtN3EhwecMmOatTaYyk+SSw652N+WcCqr adJC3zrJnPG0Gt3Vj0OVUnubcNlEr5jk6cZAP+NdXYy3lrGIoVjYd2EW49PUnNcH9gu3G0NKmO5H /wBer2n6BqktwP3uUOMvkHb+tc2IqWWp1UIu6set6T4gkSQLfvtC8ghWA/LdiulsfGNvDbtHtsJR vLZ8gB/Tklia4C10OTzUs4Tdylxz5Ue5QffK4FbkPgDxBHclYba9Qqc5KJz3/u14lWMJatnvQnJa Ed/cw6jK01lFGZG6KsDFV/AP+tc7PbXrlvtFuEA5P+jzYPv96tm80bUrGTy777bGcZLyKSB9Ag/O uD1V9RUtscSRg/K7+Z/IkV7ODdkvdPMxd3sy3PBDvw6LjqAkMoH6Gqn2KEERmIYxuIYyqMdejNXM tLeo42mAtzgc/wDxVRzapPGpEwjHsuCc++TXr0p6WPHrx0OqH2WzkLCGHnOBvHf6sKat5AY38yC3 yrfL86vu/DrXJnV7liDbwQvng70i/TmoftN5P8jW0Q54K+WMfiGrdTtt+Rwcrd7nUTXJdCqafG2R yyL5Z59MZrlp7O4y3k6a+TzvklB49siozHfEb2tZmH/TMg/+z0yIzeZltPvCBxyQMfhk1lUgnv8A l/wC4VElZfn/AMEhjW6Rz5lrFG3GC7KB/MVRvIdRjTIgtifTERH161ptF5q7ns51x0ZvL/maZvgj b95H5IA5LhWA/wC+TWLpO2/9fcPn12OZjn1YKzpYabhR/GiHn8TUrXursAosLIg8fu1TAz7iuilF koBguLF26nzo2/wI/OozvnBVZtMTHQ5Kj0/zxXDWpVY7Tf4f5Hfhpwe6/MTQLHXb+cta21hC6YGW 2rndxgcgHI6iuiuNC1rSo45L6z08LOu6IsikMg4yME5H4VgwWECw7rjULJQDwsROM9jnbW1pujXO pSfZLC7WdhkqkSs7gdTgYH1xXk1faxk+aN/zPbw7pOKUW7/h9x7J4M8O+EfFFhJbK1lDLuiiMqQg lMjLOGGR1Hfn2r02x8I3Wh3l7pf2mLWbWKKN4J4S8ikuM+Xhgnl46MSOT0zXlXhXwd4h0u6aaI7n U7Ruf7Oc9egdCcV9U6B8O7vybTxHJdwPbSRyTTx2F/Dc38Qj4IaFvvndjarEZBIyetfG5ni3Sn71 S8X0bW++9ua+nc/TsiwbqwSjRtNdUntquvu216nkGuaMdPSDVRaTLZtO0UUF3sKiQD5gB82VHuAc 1ympaXFcTi4tYbeDKlXCFmJzyQMjA9sCvrT4gyw3+hJ4p1K2NpP5Qgt9SawSF3Krt2qI5VjV2H3i EZ/rXyibCXSrZRMpjklCzbrtnVGQ8hlB2nB7f1r6ThnF+2hzVKSTWm7f5vW3e3yR4fF+Blhp8lOo 3Fq+y/RaX7bdrnNyeE7mZsxyzbSct8zBQPwx/OpF8NPbD7O+q3CRsQzQx/MMjoSDnpXdWQXYIri5 hBxuCxylcA9OO9Trpdldl1a9izg7Vk2yYOOMblzivta2HpSjzSgnfz/4J+c061aMmlUcfl/wDy3V rDUIEWKO63oCNq3SqQfYgrn9a4DUk1GViG+wgr8pXylAJ9iD0r2zVtCNjGzSvFMG42fNtP4ggj8q 8b1/Q9NkYtHEsDg9DLJj9c15FWj7OTtHbpd/8E9X2nPopfgjmJH1WzUho7Yjq3loG/IE1zV3qAnG wwZI6sIR/PJq5caXrVvIVjdggOcjkY+uarSpqUa482L5vwP864auNbWkWvuLp4ZKV7plALG6E7ZF z1xDwPxxVCZJFOEQEEZJ2EdfqKluTqUBD8he+M7fzFQi86SyyADPZ/69q8SrjoX5ZXR6tLBzteNm V/skzZZkJB9FwRVSSLY+4xydOufSttrqJo/klb1GZVP/ALLVOSW5QeY0sBH93cMn8MVMqVK3MpBG VTaUTMjeBm2sGA9ShIGacyQqDslAye8Rq/LqIRctFC3uCB+nFZdzq9owAMKptHUE4/Q1P1mlTj71 RfiP6tUk/di/wGEYJ2Mpx1+Rv8abvf8AvL/3xJ/jVN9Ust+6DAOeQCxH6Gj+1V/zv/xrnlnFJOym vv8A+CbLLaj1cT//0P4ldRu9NMh3IQ3Pykf/AF65iWVWO5FGD0HpXf6jqNxbxG1MEOwdNhzn3rhJ 3V3O6Mj0xXJgaEv6Z7WMn73/AACu04AwyAVWeZAe30NS+Sp5KH1P+c1G6Kowq/8A1696hRdjzJ1E V2kV+AB9eaaGQdhn1x/9ap/m3Y2jHuc0hJQfcFdPIcid2Qb487iOaaCDxtq2rTA8Ko+tHmT/AMQU /WuiFNf0iZFdD6KOlTIDjOAO1PQXJ6LH9c0jednLbM+xrphC2pm5DmEYHAzxjpikWKI/NtJH4UZn PGYx+HNPUTAcuP8Avn/61N00+hHM9yaJYc52MR17VoRvIw+RGCnucY/OqsPmAg5yO+0AVrROuz5Q fbc1c048uxpHXRsliEqMJGHT0x/QVrT30clusZ88kHjKLjP1FU4L25hB2CIE9nG79DUv2q4mb/j4 RCfYgUcnMrv9Ck7aFMwWTj5mOe6lSc1nTWVnGMgg+wGa35UlUbZ7iKUNz8gI/DkVnSxqRnbwO2eP 8/hTpxHU0MofYgMOhx/ePApfJtnb5Vfr/eP+FWikIBYED8BU0UlqBl2c9uwrvo0m9HY45TS2IVtb UkDEvPo1WlitYxhg3HTJpfOhB+Rh+Yzj60omtw4J3e2CB/SvSpxjFHNKbd7l6OBXXIjlx9QOP0pU tiGykcg57kfzqos6uesg9wc1bjkkDYRpCO3JFdPNHcyV+5L5Nxn5Cw9Of8av2trNuyzOf+BBTzUC QqTl1PTu571t2lt8vyblx1wcdfrWltmS5EkSpCPLcykZ/v8AX8hWtG1upzsuAPo7cfSmW9sSSXef g8gSdfxFdBDZSMoaH7QwzjLOcfTqKdRp6WLoprW5XkXS5NL2hLo3QmyXZcReVt6bdpO7d33Yx271 +jXwi+Cvw5T4G3Oj3fhvUrrx74gRIrC/8QLbWunaVI7qYJ7SeG4Fz80TBmMsexTySFGa/P8AMawp /pcciHnGV3Z/HNanh3/hFRqMj+KzemD7PI0QsCnm/adv7kv5uFMe/G8dducc18jxXkOIxWGUaNVw 5XzaJtu2y0lHS+6vr6H2fC2c4fC4hyrUlPmXLq0kr7vWMtbbPofud+x1+xL+0f8AAnxTr3j7xN4f 0nxZo9nKYF8X6RJb69BG0JRpw3npLHDEcg+cwikJUlHKZJ/oE179qGP43eE9FRfhX8OfirqXhfRr f+zoJvFuiXzX8CxlJLi0tJEm8r7I4B8qaMMUxtDdvxl/Y8/bx+KXxwtbT4NfDb/hXHwd8HQwi58Q 6Xa6na6Bp2tXNlCm6SZY0e7ee42BR5cLlgSCWxX2h+zT41+FPgv4M+LPEPx58W2kGpanPPqcesaQ us6bcQ2kcoNla6Y1/pSmaBAGyAkq5HAAIr/LXxq4YzLF42WOzzDRqYiLgoqHOr6295Qm9krtRkrc 7UUndn9y8F1creCp4fCVH7Jc0k30Uo2dnJRerbWqatFNnzb4x/4aH1P4yXsfxM+B/hKy0S5t3vT/ AG94ZtdPn0e6SANbtc67Np1varYzscbYgWONuFJDH8O/2nvAlxqMureOtbv/AIOeGrzSrz7Dc6B4 I1GZ7jVriXEvnwWSCVFjRGCl8wx8EAFs1++fhr9pLVjfaX498SXGv/GPTNdF5oPhm0+F2t6tql9P q2nusq3Oo6fMlq9o/lyJHjJjchmCAAg/z0/tl+KvEviz4y+ItX+LvgfUPCHju+1yTUtdi1eaVXCz pnYbO4QNEzP84w5ULhVAUA1/Tf0bsFmCzV0ZYWNGMIR1i3eVpNNOM5uT7Sk43T5b3lqvx7xtlgI5 b7SNb2k5SfuuNktFZxcYWXkuZJrbTQ+MBcLjPmRHjn5WP9RWjbtasDubdx0S3ZufxatK2uId/lK8 QI6CNVH8qvvqEcQ2xMwY9y5XnH+zmv8AQqnSsrt/195/ENeT5mkv6+4524jtWGZImP8AvQsufrWJ JaRbj5Me3Pfa4A/Ouq+0XEmQZBk9gzE/rism7guD80bStg89MH8TWkqalqZKbSsctNBIDjzMDPC4 YH+dVDDsO4vx3BUmtySC4YE/Z5H/AOBLz+RrMay1RmxDbMM+tcfs99G/vNue9mn+RTEsakK7rx/s VpwTae5CcE++RxUKWeoI2ZYBke/NSNazhvlj2nuc01CW9ik0dBCdNZSp+zjjjJb/AArRhtLJ2Hkt AfYZyP0rAtLW6x87IFx0Zq6K1txxvlUADsTn9BTae5qpL7LNFNNgdstJbrx1O7/CrselwIxEE1u3 QZ2nr9SKhQWUS/NI7Hrkf/qpEurZRmGWZe2FyCacad9F+aCdSy1Ok0/TFY4lkiAB6KQP6VvRaVpW d0xXr/fP9KwbTWIURWxdscc8sM1rpq9u7j9zcN0+/IcYH41Tw73YQrq+x2lha6LCyTwuY5EO5XiJ 3KfUHPH1r126+JfiDWPDcfg7WdXv7nS1K5tpdjdCGyzMN7kEZG5j+VeKW2uPDb7iroP7u8f41Zs9 ThuSVkkEQONzSOcckdlyf0rxsXl9CbjUr8rcXdaap91daM97CYyrFOFDmXNo9bJrs7PVH3Efhh43 +NPieDwN8E9Z1/4i6VpelwMs9xC+nw2MJAZ7do7ucxRiI9P3m1sZUYBr9Lfhfb+BfCsT+EPGd3ru keJ20S3PgjVfjHBbaNpHlPKBJDbhNNvEmRVdnWWSRIyRjJyAfJ/2AfGHh74R/BrxtrXw18eaYPE1 /puxl1W1n0y302KCTzpJbG7lU/aLghVLIDuCn5Y2zX3P8Ofgp8XLnTtQ+NniPx7c6J4cvrSC41G5 W3u/ELF5WJdrZZJLfyLhiRMDCq+XExIbORX8C+LXi3Sp4rEZXjpKFCjJQpycakKlWbUXK8Y0mmm3 a0afLNKSejUj+ueAuApPC08xhJupVV5JOM4wjdpJXnfTzk2tNNGj5R+Pf/BR39p74HeP5dA8K3/g O/juNMtnj1fT7e01fzzGdqtLdLa2qylDEQIni2ouBg8V+Xfxx/aq+Mnx38aXXxD+K39ja3q91GsL 6hNp0SP5aZ2IqoAqqoOFCrwK/RL9qHxv+xXo+oS6BD4e/wCEt8QW16FfU/EF9q1vLDbYLkfZDJMy tIzbmQsvUkEGvyG+KWveDrrxNqWp+FNKlso7pmltLK1jkt7K03EbUjW5eWZ4wv8AEz5J5r9S8EsB w86NLE4bh/2FVws6rpQi5pW1urySe+qW22x8J4nyzOlWqRnmqqQvpFTb5d3ZqyV0+17dzze81DWI R5saKTknGxOT7UaL4t8V2+rW9xp9rAs8cqGKSVItobPBYOpXHrnj1rkZm1Kc5KTFuwVyP5GrOm6l rFhdRvNCZFRwxjkfaG55Uk54r+mq9eEqTTin5WX+R+F4WnKNSMlJq3W7/wAz9kPgn8QP20dJ8FRW Pg3xF4H1LTzZjWJ9D1GTQLlbKFJGBW3t7yQS+YTuZkt4guDnca/RPQfjV+1vrtpo9t8O9W8G6Oun NBMYdE0nV7nVbnTZJAt0JrO5tVtyI3fzIxHglQfLbbyfxa+Al14k1nUv7d+G2l+B7O4Nu+n2mneI XjuLl5ThTKPNjxu+bIkdlUDnqBX7v/CS9+IWl+FdK0T4qab4PXx5LI4kmvtYbVHuIYkDQve2cMU8 p2r+7iLOpQgBVOBX+fnjNhMNh67qSwlCU7t8vs6anqtXONmpKK05ldq+z3P7t8KqtTEYdQVetyuy vzTceyUZNJxb35Xa9tOx9n6D4u+MM3gt/GeoaR4JutR1Kzu9JWy1nSGsbhNRcAQz28V1CjOJArb1 dwCOBg5x5f4fttM1z4ba7q3ibRvD+na34dvG0LU/Dun2+h6dDHqN0MwOReXIBUSEuoIUsv3Q5DGv sL4OeMfCmkfDu+1Dw94c+Hd3p0tqdavdaOs3MitqcBAlRLWc/abRSVZlwETIzxkGvKPG/hbw98Q7 yxufDXhXWrvw/DE+q3Wi+GbwWmkXd5eMPNjuy6kyq7NveQGVuuTziv4nozviKkalONOPNdNJRaS1 5WrxirrS101u2mrP94oTlGMqtKm09m21JPZaatrrv897H5M/tOfD34965o6/DfwlqfhmfUryKGXT Nb+H/hh4/OhkkjS4t5VtUW0WWIbizrI7sBgDLAj8Q/HP7Mfxw8V+PNU0XxDqC3Z8OKbUXOtqlndv D95WS0VpZyp3FlHzcZ9wP66/B51pfEPiPVta8G+GfBPg/TtatLfSL3xnbxaYjG3XdLLaQ2B3RGHy 28qUuHcfMygDFfz5ftVeJPhX8QvjtqfiT/hLPBem6f4cu5fDenWPw+t5rieew+0+YbuFLiF47wyB 9zE3Ab5cAjpX90/R34szSNetgKFGmowjzOcYxnaUrdaatfo4p2i3Jvsfzn4yZFltWjRr4mc2rpKL k4JqN76SstHreybSSutz8kfH/wALLPwVe/2Nc3st5eAg5jhSG2liJYebE8jCQqSvAeNG9QMc83pn hHcfNYYbH3ZJEANe4fEbwv8ADDStb8v4d61darauZGlk1ewWxnjfecLsV5M8YJORg8YriY9PiT/V fYSccMY1P485r/QfKKM6uGhObcm19pcr/wDAWlb0sfw9nUqdLFThBKKT2i+ZW8pJtMrW+g2duojm 8gepWRP8DX1b8MPgv4j+KWlWU/g/w34althfJp8l/JPZR3UkwXOwR3U8W9mB44Cs3AOeK+c4LC5u ECsyP0+WKFBj8q+gfgPouia34ni8HaiIra81G5t/7L1a4M8AtriNiVRPIDDfISArsDtI4GTXxXHy rU8DUq0fdlDXZyVur5VKN7b79NmfbcB+xqY2FOrrGbtuo69NXGVr7bfNH6J/Az4BeF/D093rHi74 YfFMtbzwzL4p8NQRaZp8U0RAkiMU8rQAwyqwWWO5AYjG1a/XHw58aPAfxAtbjwB8SdR1rwtDqV60 OlX/AMQkt7jTWKosQitNQikuII5sEyl2Y8Z+Y5APwt+ylZ/HD4G/E3W/iL8RPFd9r+j6HazpJoOr 3l7BDfQuoJSGdoN0lxEcOoCfMy4YqSK/U7xH8WfD/wAd/hMsvxT8HJYaYoS60+TxFpV/eQSTTP5a NLGsQmJKfcZd+/n7tf5MeN2Y4vE5nCNeDr09LVITd4yaTtGNRPVWTaSStorH+hnAmGWHwtqMPZtt 6SjDZdfdu3rfXfrqz+cz9uP4ffFv4QeJJX+HvjDwhrXhvU3kGPh9fx3YhEKkCTUnEauk7qxAbJDA EKeMV+SGuXOoa1dfbtXna6uCArXE8rSOQvABZiTgDgc4Ar9iv2/PhDaeD7q81jw5p1/otgltDJDp uj6HfWukBSwSR5JZlVdzkq3zkckDGTX5ISyQquNRMpj6/LEqHOfXBr+6/BXFxr5HQrRfM7JX5VGT 0+1bSTtZNrR2P5N8X6FWlmlShUk7b6yut+isuVeTWnZHAGzC52ONmfmJPHNdnp3i/wAWaZoEvhHT by1+xTzi4bdbQecsgGMrcMvmqMfwhwvfFZ+p3OhTBRZ+eOfmLsAPwyAataG9zcXw0fSJ5IzelYCi yxxh8sCqszgKBuAOSRX7hBurSvUjtrqtrdfkfjV+Sq1Tlvppu79PmfRPw08WeKPASXOraN47Wzc2 RkNvaPeQm6cqdsG6JMM6sTjzPkB71+xH7BPjzw58RvHHg/wD44vfiA1z9la+iuLPxRflYLBlPnSB LeSOBFSQM7CTMiHhwQAa+If2XP2YfDGpeKTdfFQSzy6TdW9xc6Tcjz42tyP9XJFHJGZBOTtXZKjK wyN2cV+v3h/4QfsOfDTx/Lrfg3wH4jh168097BfD9pBfTx2sk2QZpIru2mEBYBTFy+FY5Pp/Ifjf xxl86dfAUYVp1pRfLUpxSUXayvJOOlne+q9NL/014X8HZjT9li63s40k7OEpO9r6tJ3s7q1tPM9q +N/7Bvgn4pW1h4Zi+Jlzq/hjSlvtRgheJteu7eRpnL4soJBHMw6CUq8r4Ax2P82nxT/Z5+JXhTxt qPiOXSfG83gaKW4MWu3kNvY3k9vaKSzPFM5W26HbFINwHChjxX67/F/4fftQaZ8QtPfx9rPxH03S L+2W2iPh2YyWelw5kZLeY6VBKEKKBK6xQbl6Ed6+NNf8IfCbWNF/t341fF3TfH9pDp9/fw6ffXWp QTTSRXEkNsITIu+S4Ozc6SxRHaVIJBzXzHgrmmc5ZDnr5s8XTqJJRhSnPlu5N8soRjHnbW85JdbO 9z2/ELJ8vxloRw/s5xu+aU4RTtazknd8tn0TfpqflDq66f8Aa57nQpblLTeFtYbvypJvLP8Az1eN VXP+6oFcnfXd4JBHERvOVy65B9OAK77xO+maxrs194csI9Msd22Gzt5GfaicAuzO/wA7DljnGegA rlL2ynnchUk564ZT09Oa/wBBMrw0XTi5zkttG9dtnZvU/jjM6rVSSpxi/NLT1V1/kcjP/boO4Pa4 xzuXFRf8TgqS8WmucZB3Kp/Wt6XR7hVzKGAI5UhT/Q/zqnHp0SNnyhnGNxU/0Fe5TjbSM3/XyZ4V Ru12kYEsWrz4b7PYc8cSDj8jVi2s9TO1po1xj7sTYByex5roP7HVztj2jnPAP/xNa0XhxFjG+OI5 45Zh0/CvQpxbfLz/ANfccE1ZXcf6+8yrKznEoxayEE8/vnHHqMV674a0u8v5EtrO2+c/xSThQOe+ 41yVr4agjUF1KgnJw2a7HSYFgwbOadG6MAyqMD1wRV1MHOpdRl+X+Ri6yhbTT+vM9Ls/hlqU8u9p tMBHOyWQ5YnsCOCa7nT/AIZWwiEWpWtosmB+8heTOD3wCf5Vx/hu6vsHfEjJ2knc5BHockV6/pP9 k3ASWO6d5v4okcIob68A815dfCyiv3s1p5f5HTCspO0I/iZ6/CPSViM0mBGDjzGJA47nNVrnwh8O bRHaYs5X7vlZZSx9fm4rZu7ybzfs9jbSTS5ClJpkbPrwM/yrn/Eug60I950iFMkNtZ8H6n93z/nm sKWMjTlbn/Gw5YdyTtH9TmL3w7oEiBUiCjH7vnJwPY5rjr/wbFnFvHx1GYw3I/CqGqrqGmEtJpkX 3uHVQACeg3BetctdeMIkCmSAxugxmOQp+eGAz7169PF0papp/f8A5HHOjNaNv8P8ya+0Ca0OS6Rk D/ngAB7ciqdu+sWj4iuLAjr+9ii4/MEVnv45sXYgtch8fdNxwPpljUcHjy3llWKOSdVA+7JKrj9e a6ZTi1zLf5kqDuk/0OnsBfXFwZrtrEg5B2QRvz9FFXdRtYD+8eSzeNh0ig8o/rjvWVbeOru8kFnk NGMEKoiB46EEAH9a39O10yOFuEuZEwFKxlcn155rgrS+3GW3l/wTqjDoYZn0+0IEr2TIRlQQGP59 ePrWtZ6bbyKblJVUSABWS2aVT7Eq2K9KQ+HWtCs1hc/OMCR1Vj9OcfnSWuieGNSnW0uA1szDCPLG uwf7xGTXiV6kpJ8qa80r/gezQoctnJ3+Zw817NpUiW1mLOds7WQW4Ax1/jAIrttH8bNbSiQWot2U CN/KjDKR/u9DXoWhfCuGSfdpGo6OUVSWEsixEn/ZGQa6qx+GcsF2q31xZWwf/VXMsaPEe/JOTXz+ MxdOkuWdS781Z/cexh6FSbUoQsvLX8RvhfxJ4Lk5utWFiDjKyWAyW74MYY19I6N4y0uGC3h0zV55 4eA25GY+2EC5UfXNeXWvwe+IZ23fh+68L3WzBJVEBI7Ha0eTXsNr4Q+IY0yNtV0Twxc7hhZYg6FT 6kIQPzr5LH8lWUXGpe/TmSt8rR/M93D3ppqUfwf/AAT1DSvGml+Gpzf+LL6++xOvkX0NvZK8xt5i A3lmW32ox7HBI7V9OeBPjN8PvBV6dV8M69cS6ZdlUk0+28Nte6lb24ByZLq5soIsFQN2w4757189 eFND/sGwg8U3+n6BO1g2Vtpw0sMrsSPLJkZfu9cFj+lfYHhb4veP/FFw2jeHIfDGqedpbwTfaRLL axxBRvjdZU2xsBgIVJ9uK/F+PsJ+55ZJuOvM+eMY/dJSV+zuuye5+vcANOrFppS+z7rb+VnF/Kz7 voad7+1f4Qh8IvquleDrqSKaYxeIU1GRZtPvYo1BVWgd2kQMwBBC4BwM5rwfxP8AHT4W6n8PfL+I Oian4cFxHJc6DPp+ixvZxIz/ACqJ4yswDY67TnHHGTX2PZfDOx8F2F82iNe6RqerW63AsdOkWSLC AF41hmjcEIWBAk2EDB7g18x/Gn4M+G4rNPDPxD8T61p1wLSG/mt7rVozE4B2xnyY4iiOgHyqWyM9 hzX5ZwvXyueJjGjGaXMndS5p2XlzSWj0vrorWSP1zP8ADY2nhpTqcrfK1ZpKN/W0Xqtbaa66s/Nf Svih8NH1hodf0NtbtriV0VIDPbzyI7cg4ByzDtg8mvZ9V1/9lIaEs/hbwAumXUolSW71u4nukUHG 0QxqqgOvOdwbqMYrn/FWt+E7XTL3QvCuuSxW8UKQra3Ekkq3jJIAXYupVGwAdwYZxgV82XnjzxtY aY2kC/06K3aUSlvMLtkcD959/GD93OPav6qwGHeLlGajUp2a055q6t1inGL9NfXt/MGZV44ZSp88 Kl1vyxdn2vZv56P9fS9X+J3hPRUaDSYLaGOT5QbCCWNyuO/FeWXPi/R9XneO1gvPnBYm4EqAn3OA DXLSeNfEj/uo9Q8PMPuK4hYYPruIbJ/CuYurjxqL4zRzWF73Jtw5C59MIuK/Rctoqkmo3T7tb/iz 8+xbvZuzXzJfGuga/Iu2x06zn3KP3qxSp16ZkOAT/WvCLv4feI7rc9xbeUwB+UMvl8fU5/Svc7nW ddChp4TLKrh5Fkn2jA7AEk/pXOeIfFHiPVAqSabbCCIHl3349e4Xmvosuq47Rcy83a35I8XH0cO9 Un+f6nzBq/hvUNLz50GlyHuJXZCDn6jP5VyaCYSfNbWq5H/Lvckj+de+ahrul3oIksdKVl+UqURQ frhc5/E1zCHSzcmaWztGUkDbA+MfQY9q+ywtOrKL0u/67pHy2NlBSXY5Cy0GW6QSPBd4PIMUi7fr 8zCtaDw5Z3HzRz3I9Q/lcc9/mNaOo2ukXbMILe4hXPPlyAD8c+9Z8FloVoSsqzPg8s0mf6iqWFrf FOaT9f8AgHI8RBr3Yt/16loeFRBiZGuHTBB/1Q/9CrpbDRLmZfsmlRXblgWXEUJcYGf4Tz+ArFTX NHgi8hFmaPp83t1xg816f4a+JMVrbLBFHLFsBSJ7eNUKk92659+M1niZVYQupRl8/wDhjrwag5JN NfIq6FpWrXDtFFcanHKFzGi7ULe3GcfjXXnwxqLWDS6smrw3a48mOF4pQR6vub9MVz+ra095P5ul zyO7nLxNFh2b1BwAax7W113XZ5GnvZ4JF5jjnlCluxA4Yj8cCvHrRc5c7qpLr1/Loe1GSguX2bbO p+zeJ71Etr97wJDwiSrbRv74y+W/GvKfHMEYujb2serzMijO/wCzLt9cCNWBH41q6xcX1hm0u5Lp sfeCXG7d6HGMGvPZpbOW782S2vc45Lxu3H4Aj9K9jA4dOScayt6/8A8/G12o2dN3/rzOJ1Gx1uXK R2moMP4SUBz+S1xU2j6jExMltebs5JaFv8K9iuLLSJ32mWVT2ByMd+QQDWLceFbicnyZHK54LSyA EewCEV7dOFNaqd/TX9D5+rzNu8f6+88yjjkh/wBdHL7gwycfpVaa9sF5Kd+QYnGfzArs77w3eohI iun4yfn/AJZAP6VxVzpE6qcrdD5j05/litpSknZI5bJxu2Uvt2mStjzIUAPeKRf1BqdJoTLmCbT2 H/TQSjH5imRW91Dn7M94h/2w2P61oi58QxJuJeRQOhQHP5rRf+b8v+CYyt9kYmpK6hIzp3uVWXt+ FQve3uR5EmnKcck2+8j67iKvW+o69I3lqAx5ITy0H67aeU8RXJ3SWhIP9xR/7LSacvhb+4ptbNIq qNTulzBd6VnoTLbomMfmKqyaTrJ4kvNEZv8AYdFx+GBV2Ozv4ZB5tqchssswLA/hmtSfZcJtlgt4 sL/Bbe3uMVnLDtrW6fqzWFZKVlb7kZtvHqNqhH2iwzjqhVhx7YNacNzeAYjvoUJPWIc5/AVnwNZ2 pZywfKFQGtk25P8AI+46VYsbjT7S+ivisbrGysYpY3MT47MFwSD7GvNqwnG91f57nt4b2cnGzt8t j0bSItKMYa+1u+jnUZjCwrMkecZIDY/Mc193+DbT4T2cOkW9jbzeLoxZpcNbSar9jeW5kKhoZoky Yw5/gjw3qxr498DRHVjc3VjFp3mNIZPss0Uy+WB8ysvGAnOACTnHI719C6LpE99qSavqOEhghE0m jNCbWKUAYJQjAQEgfOuCfXNflfFOFo1vcnOStd6TtuvKz+fMl95+28H16tL3qcVLmstY30T1et10 1XK35d93xNoNz4J8Ryva6Hd6DJvM0Vum6eG3djwEFw0xYY47GuQ8d+KdM123jl1sTHVVQNLPd/J5 q4O1RG4wEBxgDjjiu18T+KvDV/Y2GhahIkcCs13Fb2UO6OSWQkZWdma54GAFIwDyRXzZ4nm0ux1q UokcG6DZ5F6Hlb5iSJDhvlbkd+PTmvY4Tpc6purR9+K35ltt1bb81drzZwcZ4h01UVGr7krXXLbX fZJJW6PR+VjYn1PTdWsPsk8Wn+aGGyaNI0+76qvH4muaRprP5yLduo3AKeP+Amsl7XRbi3+1NeWS PjBWOKQFu/OeprPdYAmLaWDPGGe2LD81FfqmDwlOC+BH4xi8ZUm1eTfQ3bvVLW42WzLDNtOWwWJP /fZAH5VyWraN4euP3kYhV8HcjSEHPsFIqjNpFxcM8jvYFv73lSIfzxmluFNvBsmWFyOAIpGXj3yp NebmCunemmdVCpa3LJ3OB1DSLG1RpDcKPm+4pkbge3NcFqMWnI+VkYnggKG/n0Fehapc28Dl/Kj2 sO77ufxWuQupVlQ+THGv8WYyufxHFfD42qr2jG33/wCZ9RhIvRyd/uMdxaSR486Re+HDNisaawW4 U5uBtByqsvX6ZroPlnfy5oWI7sCFNVZLS3tcyRtMAf4dytz+dfO4394tY3Xq1+p7WGfJs7P5P9Dk m06IKRIzEDgbY1/mKry2iIoELF+o+6CD+JNdc8qOmEwx9JEwPzBqjIbh12GMBf8AZGB/M146yyml 7v8AX4na8XLr/X4HKO13v+WOBPXO3+VAsRdA+eEJHdAMfoa6aS0gOHk3AgZwBmqM8cQ/1bN6cADk VMsql9p3XYSxi+yrGSmk20TAowyBnGCan+yL/eP/AHx/9emF7yP5BMu09AxHH60mbr/ntH+a1l7G gtPZtf16l+0n/P8A19x//9H+IjUry5uGwUx/uqAf0xXPSXLIcEP6Gtu7urRnzGZD67jgfpVGWSAD 5HH0x/8AXqqLkopKR6lbVtszRdhW5XPuetPa5B/h/ClmkQjse2agDyZG0N+Brtp4mS6nDOl5DTdL uxgZ+hp63PPAH4UuyUkDbk+9dp4f8AePfFNxFaeGdF1PUZpmMcUVjbvO7sBkhVjUk8c9OlXUzGnT jzVZqK7vRfiFHA1Kj5aUHJ+Wpw5mxyRjPpQJl7K1en/EP4R/FL4S3tnpvxN0LUPD91f2gv7S21SE 280luxKiQRvhgpIOMgZxXnojuG4yo/EDiu7AYyGIpxrUJqcZbNWafo72MMXhalGbp1YuLW6ejRSE sf3djZqVX6GOJuuf88VZxsOH5+lDyYAHP5V6NmtWzgl6DUklfGFK+v41KftHUt39BUaXDD7qk+vF SC5mJyqn6kZq1UXVit5E6KzsF3v06ACpFEoIO49e45pqzz8Z/rVuKWfIITNZyqxemocr6D4vtbDG 7knj5c1opBOIvnLPn7yhDwPrTIZL9XDQKMnjmuiW/wBSjjwBGGwQzcnj2rPnhdLlZ0QTs/eOeKyP 8jo3oOP8aotbXGSSjAeh7VoS/aUbJdeueFP8zVVpSCSxlOP7q4/pXdTw8OzX3HLUqy2uVDbSDpkf gDUi2vTcGP4jinMJH5Ec/wBTxUiQStkeU5x2b/8AXXZToxWyuc05u+5GbTnCqR7swqymnydfNVfY YNaFrpjyNuaEdOef8atmExDAjYY/uDNehTwi+JxOOrXadkzPitWQA75DnuFGKvxN5a5+YDpnj/Cn CXyyMecPZgD/AEqxHJKx+8w9xGM/zrrhQitjGVR9SWJbTIeVnORzlgP6Vu21pBOQkLSNnGBn/IrO jedDgyS4I/uqP61rQSSOQrTTED0Ax+lddGino1/X3mE5vv8A19xsR6XFFhnMnTkBgMVrRTwxgIjO uPccY9OazIoSFPzSMMjuef8AP1rVi8gjDwnGOOQcn8xTqYRLyN6ddrRalyK+mnuEghkuJGkIjSMq HLsxwABnOSa+7/An7ImtaDcXug/Hrwd8QLTWtyf2fZ6NJp1qE3xk4ulvBuUg7ScYwuc8818NWNqk Esd5CFtSP3sc0jENuU8FdnIIPQ8c+lf0rf8ABFz9nXxt+0Hd+I/jP4q8b/Enw/c6Xiw0vXdO1C0m gvPPjIns2sr8XAuPMUglwNiqCCQSK/CfHTjHEZFk1TMaWIjCEFrdT5nJtKKjJSjZb82jdtttf2Pw pyPC4/G+xxFGUpPVWcbJWd7pp3e3Lt8zA/ZX8H+Ff2QfAuk6/wCJ/gPb+JvGGka/LFf+JtS8RWmk 65Z3bRq5S0s4pZvtNjEjDbcK0Dli0fBGa/TPxr+3v8P9e+OWh/Ay58JXfh/xZceGRqFnrc5u9XVz cW8b282mW8LSXMkEhDpKvnx+U2Npbmuh/bZ/Zc/ae+OeqR/Dq88QeC7rQ7+4tZnsfEaahZx6dcWf 7tL21itCjRGRN/nC3LpLksV6Eecx/si/Cb9jjwNo/wAQ9RuvhFB46ubl4rbUbGw1DxhALOJUVJ7W 2uL6za3lkJ3PFcNcRZPbBFf5j55muRcTKGZ5lepiaqlpB1HyTkrptyk3GCafuKm001ddV/a+U4HF ZVy4fAq1NWtvaSWjSSiottWfNK210n1+G/27vFf7FTfB+Lwcup69oXjc+IL/AFZvEOi6BeQNBdTs pIktYHjCLO2WlMzSTDA285z+GfhXxz4n0PxX4k8B+G9N0v4izeKYG0my1nXPD/23VJjIhVZrD+0I ZLm3kyTgqFfIByMCv6updP8AgrqXwC0vxL8V/D2ma94pbVtT1m81ObXNNu7ax+1OhkmuoIVe2iU8 NHZq58krgs3Ir8+/i/8AsNfsT+LoW+O2vftRyaURDN511q01rq15a3FumRAtppiwyoOgjjiJJXlQ a/o/wI8QsqyyjLKscqs1KTSb/fR9pzacqpQ54xbSl700nfRX1PzPxX4TzDGzWNwyjFx3taMuWzvf mlytpXStC6S1eiT/AJw/EngLxL4T1u68Oa/p9zpd/ZSiG7sr638m4ifH3XRgCpGc81z48PS4y11j cPupgfyrtvH+peFbXxfqVloF/c+I7WO9lS11u4jmga9iViEmMU26RC452sxYdDXCPdxXcxH2dk5+ UBW6fgDX+l+WTUqEJ1HdtLo107PVej1XU/gjNKahVnCmtm+z/FaP1WnYZJpd3btseYkeu8g1GbC4 eIEv1OMCRuf0rWSDSVXEyyKw9mz+WKzLyHSOtrNLkHp8w/xr1OWMdvzPFjKUtH+RH/Zkpj2tIFzw MuSR+dVD4dgJ3SSkn1D/AM+tRvGqrj7WyjPcMf1xTolhkTymvnYcZXbwfbnFZ+49eX8QjGUepTn0 uzgbAEjHnhZM/wAsU1bexiXJt8nIJLP/APXrYCxxgGGRmPT7i/1prG/Jx8vXqRH19+KyqUlc0hNt FVJDIwWKKEAY4Y5/rV23/tN+IUth9B/9erNvDMRlyme+CCf/AB0V0tpZ2Eyos0knXBCblH581l7C 7+Jo6YVGlormKY9TC4fyEB74PX86lD3wGTeWoxwFEZJx+VdRe6BYKm+xzKf9pycfr/SsZPDjZ3SI AOSdoHHP51PI1qm/vZvK17NL7kXobyLysSSwMepKqf8A9VaVvFFKcZ39wegIqvaabbLlFRmIwOuB k1tRwXUS5RSF6ZXr+GK54qV7ST+81vG2jX3Ge1tqHmYg8jGcAFd351uaZo+t3kixwrLI4O5vsUPm P5S/fOPYf/rqOKCxch7wXBOegdsfpiur0OzsbUNqtjFqCCE7TNamTKFug3g8Z9M81yZjJKm+Va+b f6I9HL/4iUnp5Jfqz7O+HnhT9j3XltvC3iq3+K7ancTCeJbRYA8sL/IcQpbSjcpBJ2ggggBsgiv6 PviR4c/bf+Ffw10PW/2fdS1jUvAVtomn2reD/EdjHa6xNZKgje4Oo6gEMckv3hvVhEf9Wo+6Pwn/ AGbfFv7QXxB+JfhP4afDHxv4V8O6tchLTT9dtrhF1mK1ZDLLBJc2kTXDcKSYGcZfA4PNf0b6x+2X 8Gfg1pl38J9Zu28SXtnok322102HVb+G4leNTtkjxP8A6U7KP3kk3yvkvjJz/kn9KeOZzzrLcJhs KsbJc05UanPiIKLajzNTpxVO9rRlCXOnezSWv97eFMaM8vr1uRUorlSnGMaUm0m7JqpLmcd7SVnp o9T8lviH4e/bm8WeGtd+JWi+AZrSeaCF7XxB4m8QaZqZtULFC0y3ShZcgMAqQpyVbdwM/lX+058N PjvJd6frnxsHg+K7vNPgYeKJb92ubqK0j2pGYnnfBK7QFigVOm0AA1+5njv4l/Gr4q/DzUvEnwa8 Haqv2GyaexPivxbFa63bMm4rBY6TZSu8yLlWjMqqWbKhcYr+ZT4v/D74teDvEs0/xc0HXtM1TUZZ L1m1mCS2nuWkYl5QsiqzAvnLAYzX7J9GvDYrE4utGv8AVMNOk0lCFpVrcq91t15tKNk7Nct7+5f3 n8h4246jRoRUPb1oy3cvdppp72VOKbd3qrO1knbfxrXHurDUJLCCeC7ijIC3VkhETggE4JVTxnHS l0G01LWrloo7qws9gDNLqMywJjOOC3U+wFIbdncrtlUj+Fif14FW7TTrs7VhiZsno74/nX95zo1V S5YPXvZP8LWP5IpVqftbzWna7/O561omhfEXwO9j490qXSb6OItcwxpcQ3EciRgsTJAHDbCBnDAZ 44Nfoz8BNe/aI+MHjXTJvCV/4HgTVJRemWK2nEdlJEhdwFUSSQOBwdmASAAelfkTNpOu2suXtTjd u3IRkgHnmv0i+BfhT4zeDB4e+KfhnV5dAU2k0el2S3FnPdPatN+/BVGEyebk4LpuYDOQBmvxbxVy StUwEp1HSdSSlGLnBW2bStdu97PRd20ftvhTnUI4xUqKqKmmpSUZtvdJvZK1u77JH9Cfwg8O/tka y6eKNY8UeF9Ygg1OJrvw3Orzzvaoqq0qL9lZ8SryYRMg+6M8GvT7XRf2wJfFMdvqsOn6xoWl6jLO ljLesI3skHyvi7nWe3kjJJUOSvZSoGD8oeC/hx+154h8Fp8WvFvjfWbbSoljttAtm8PaWkrSXT/u vPYONsR3f6xnBdcbTyKNc0P9obRtV8MapoenT+K9N8K/bDr882mzWlzb3EcvlRzwy2f2jzcmMuqO jfLhWc5zX+Z2Nyep9bqQhXwt9Y2UHFJqLdlJ+zXNtFPu97o/vDCYqCoKfJVtdatxk7NpbJydteZ+ Xkfo7/whHxh+MHg/UdV1zxPrfhy+u7lrmVPDslvczm2j3ExrcziZIPMyA/k4fjnKmvyOF/8AspfD D4+an4d8Yjx+vjafTFjtdd1PxVZWdlPbTgvEj3cRjmjgZwAfLQSR5JxxX1p+1j8W/wBrb4R/Bxbb 4FaF438TeDfGN0uo6sYkmg1zTZRncLe4uEnItZlfYGaAlSABjANfip/wUPi8O+JdOs/HXiXVv7N8 R28UN9bxeLI9W1bxDftsTOmvfJbnTmED7myBGp53HJ21+p/R+yTE163sMViVGjiuaMVSfvwcbfxI wftFG+lpXSWvNbU/MvFPOoUqVXEUqClLDuMry0i422i3FQ5t/h9Otl8h/Fr4g/CiTWPEekab4V0W 3vLq9ZW1STWb3WLq2mjlLTPbXQljglEx4ZpIpDjJUgnNfLN/qukk+XbSps6BRMc/pWH4v8faz461 b+2fELW3nLCsKi0tobONUUkgCOJUUck/w5rm47wn/VJKR6hcfrX+rGTYSOFw0abdnZXvKU9UktHJ t20P87M6x7xWJnOK927t7sY6Xvqo6X+/1PQvC+o+DhrsC+Lf7SfTN+LtdIusXZTHHlmb93nOPvcY r1bw1rOo+G/i5YyeD59e0y0muoI7e41mUzTi2Vww86GNtsigjOxTzwBzXz3p9xbyXcaXazIm4b3T 5mCk8kKWUEgdiR7kda+pPgf8O/if8TvGl1H8JdBv/FaadC0kv2zankwtwsp2TApKMEoiSMxIwoNf H8a1sJRpVa2KrJR5GnzWUfJ+97t793qfW8FUcTUq0aVCk3LnTXLdy03Xu+9a19tj9o/CniP9ozxZ f6J49tPibp2sPpotrKw1fUtCkjuLASOI0DLIy7lRsAlRJkn5ieo+mPiR8KPjpBp+sfFLxL8TvDWs axaRLeywa/a3elz21xbjfnT1trl0jO35jKEQN0z1Ffjrrv7MerjwlH40eD4iaLqVnbebfNHbmbTJ IWkKtNb/AGqdbkgjAcKXXcCMCvc/gB+0n+1N4CvLvWPB1rrfjnTLDSzNrtlcabCkbaWjoJZY4zB5 7EIAHaNiwXOMDJr/AD84t4LdeP1vJMfSfs21KLo0qbaumoKpGLirva3KndeZ/ceVcSxoNUczwtSH Mk1JVZzXm3Fy5rLrdSej1PnXUvD0fj+x1DXfDs891q88RuL3S59Ou54zHg4e3W4a5dmdmB3sQpbB HavgvVLC2tpZrWWSUvG5Ro5EZSrKSCGJAwQevfNfR/xu1nx/4++KHjH4peEj4qOlG7+131zefaEl t7dyqRCcscogOFjViSFAGTjNfI99HJeTGae8lkkck/xYOfU85PrX9RcA4BUqfPWxF7qL5dHKDsm4 tpdE9LpOx/M/H+N9rU5adL4XJX2Ulf4ld9eu6IJLO1kkKF2jA5GOSfwz/SpT/ZtujCKOV+xdiuPw HGM1oW/h6NwC1yySEAASDjH1GaWXQ4LKUk3QlZunlEcH1ycDFfqNHGYe9ozb+R+W1cNV3lFL5nrf w98W6d8Pry18Z6Z9h1a7gZQ+j6/p7T2MgYHLMEmTdsbBXkHPPbFfvL4Q/am0m2/Zh8I+LfjTrOjw XzTm3tRpHhi5ur2zVS5tll1GLUoXOYRuSJlkUqMMCc1/PZ4B0rxmdZ/tXwXbNqFxC3kKmyKUBpPu 5DZAbjgjkHoa+8/2bv2p/CXw8+IjT+Nfhp4Mluo3Mf27V5rqZoblWAfAnnmt0ZhuBZ49oznIFfiX jDwdQzSlGdPCutOi+f3XSU7Wfu+/H3U735knLSx+weF3Es8DNxq11SjU0XMqjhe6973W7vS1rxXY 7z4xfEP4hfFbxJe+Afg/qEsvh+aa7uBrmm6XBokt+syrJN5hmuGS32EFVSFoww+8pJr41+KXxG+P Hh3w9H8AviBrc1zYaZ5TxaaklrcrArLuVPtEIYnggsu88gZ6DH65/teW9z8Rf7Dfw34N0PSJpYJL prrwzdabqF35F4fNs2aC0njtljXJTcWcPxlR0Pwf8Q9Y+Jnw20E6tr3jnwV4gtdTtLrTp/DbRwaj JaiIqscd1aQwYhlJYvC6AqCpJZTjPjeGWe4SeHwsaeDprW6g3Fz51f3+enBxu0n9mG6SstD6njzJ 8VGWInPE1NVrJXUOVr4eScouydusvNNn5+QW7JIssbtJnIYOqleRjkHrir81wZGVLeBIlUBSImfG RwWO4sct1ODj0ArO8TanYXk8M1stqh8shk0yN4UznI3qyjLYPUE8Vix3cJf51lHHBAb9ea/rnBU1 NRnGLTfRn8t46o4Nwck15G/cwtKgLRbh/tOR09O9ctPHbwMf3RztzhXbj9a1ppZZI/LgORjcfNLd fwz0rCvYb8qQsKN9D6d+texDDyejj/X3HjVK0V8Miayv4Lcb54nAx2lP8s/yrWbW7CZQscjR7edu 9mx+bV55d2VzjL27NnnahP8AjVBbK5LbltZcY75rb2NS+iX4nI8TC2t39x6uut3ksKpBchoxzjAI 4+rV0FjdXd2BPe3VnFH9wsULsPwXJryC2t9R+6to+fTsfzrudHl122G2C0tz0J83bn8K3+pVGm1N L7zmli4v7H5HosV7ch/s9jMkynoRG4z+BYV0lndarCyhrfIyCSWkQH2I8zHHriuV0jU/FqODFb2y EdCq9MehxXoumXuq3k5Gt2wuGZQVKowIyfXIrlr4arTjf4vv/wAzSFenN6afcTxX90D5scFgsuOD IXJGe+dxFZ2palq0MfmQ3mnyZB+VS7lD3HWuvura2tFKxaYyRbQzOVaQ49SSf6V5vd3ujvdFI7W3 YKTlo41Q/qa56Fb+6l8/+HNZwt1ZzuozeL7p1eS6UR4O1WEmw/gOK4u60HxXqEzSlo5HJ6ZYL+RI A/Kuwup9N812MMLf3fM3Nj3+VqoJZ2F5Azia3jcKTs3kc/QmtKrdlKMdfX/gF4am53jKX3o80vtG 8TWMhivYPLcEDKRhvy5rFuYNajyRDJk5+9Fj+deox+HdWbcwuUGeFHVRjpyDSLomqxnbcSRSDPYD PsOTXQo4iUbwickvZJ2kzx21TWEfzPKaMD+JQMj6Cuw0jVPEcORpl7JGuf7vGPcZzXXzeHLiRFcJ PkHkpKOnqBzip7PwpPLuYSXUbZwMugz+dHspNPnhf5f8ATkk7wlb5kdnq3iW4wBdRyNjBV96iu10 IeIZblTLcNGpIyIZGQ4P1zWZ/wAIJqzDy98rr1O+QZ/QZrorLwcumwB5LWYqeXYbnwfqTx+FeZjc LZPkSX3f5Hq4PEapSbf9ep7ZoejW32NZmNyHJysshyW+jYrr7KSKO4UGdgy53Rr5zbcfTvn8K8X0 yG1gkjkgsZrnPy7XaQEn0+STkV63pOoaZc/uY7O00ydcIplEo5PXtJ+pr5/6pi1fmd16q/5XPdeJ oOySs/RnsfhbxOsE8WZl3RkFZGhYkH0yStfQJ8Y61qlpIb3Wpo5YowbWOztbN1J/uyvNKjAY7gNz XzTqHhDxVrdlbT6XY+Go0iIVporlkabb3dXYDp6dao6P4X8WW+qGeS20Zc5V0ijMgI9iwYflXhYv KaFZOqqtpLp+7fXzvuenhcfUg+V07p9ffX+R9s22ofErwt4Tk8R3OqrLaS/6Kba01m1jm2TAsW+z ssuzOPvADaeh6V618JvH8viHRo9F16/FpbPeLK8d9rCSGQL9yMG3syySYX5S/wApPU18q2EGsaTp Mum+Gr3T5jcoq3MVugTCEZKvHNZjIByMq/0q58P7TxJ4R8T2us6tceH9OtbYtJbxX9p56zGRSrZU KhB9yQV6gV+R59w9LE0K0qnKpXunZRlotFZSet+tvM/Tskz6nh69GCUrPR+9debu0tLdLn2nf/Ej wr4CM3jbwvr2gWN5LMYRaahdwXV7EFHBja4t5CN4JU/w47Divgr4o/tF+Jdd1HULiz1LxHJHeII7 nS2uIpoyYTujK3EabjGCMiMKuM8EAV+jXhP4SeA/ij8PX8VaX4J8NaaZb5LbybPUby/8wYJeRI3m X9220sdpYqPvY4rX8UfCPwf4a8H3ngm61bwwHvwVbTdLkhgkt1Krld/70rICMYMgLA8A84/Jsozn J8DiXGpRlUqp8ru43STXWDne3Rtp+a1P2TE5Nj8Zhb06yp07OWie7X97l37aryaPwal+LOqSCZtW tjctdjJXUm+0EAk42qyDbjPBzn3rybxBq2lWW3FzNM8i7isKAeWSfuncBz9K+2fiH8MdN8E+Pn0P VLiDTykKyfarnUrK+RI3GV2hV5b0XGVPXGDXyhq2i6VZ6jO+qXAuYGZ/KkjlU5+b7zeWH4PsPpX9 Q5LVoVLVcLQaTSeibuvndfcz+Yc6pVad4Yirdpte9073trr5q3Y8Sv8AWHWT5o5FUAElmAOOx44r T0/4o2umYtpUvHA5YBgQfx3Zqn4jllgJTTVjkj/E8ehLouP1ryq51ONpGS4tAjf3kHP4V91haH1i KUoP8j4vE1lTfxI9j1P4yNBu/s+3CIerNHvfPrnNec6p8WtSuWKW88Qc8MrQMB+FckZ4ZcvbxT/Q jHP41QNxKvDW8vUjdXsYbCxo9H955VbFyqdV9xqN4m1i4cmSS3GeQ21wP1B/lUEPiHVrd1Zmhck5 OZWH6ba5O/u5Nx3Bx6Kc5FZKtLvBkYHv8y5PWvpcPiFJaJr7v8j53E09Xdo9lg1a/uGXzIrE5OCN 7kdepGB/OtKTUJCGWKGx+U4BCsVP/AWNeUaVfsjM4jkKqcHK8DPTOB0/Gr2p6r5UiwAAjGWKkE5z 3rnqYlKfK4tjhR9zmTX9fM7b7TBJ+6mhskkz95EP/oIrZtLeCC4jutShiFuzH93ah0Y49MEhfxry mOFL1vmgw3BDZ57+hrptEluLd/sb+eEY4PmKGU/icn9K58SpO3JTsvU6aUkvtXfofQumN4Sv4mbT tPvhcKV2hZpnhUd/lIznjPORUcl5aW94FkjvLJN+1pYk3bgO/b64FeX2GrCyL/YSWBIUxthR9Mcd K62bxZAtmlvMlsg67vJJIY+jZxj61jTwiT0u0+8n+rPQ+tSkm3pbsjQ1O8sU1TNrraToON11Cy7f +AlRWBqOoW8M7XEerWT5PzNGrc49hTkuPD2o2bvca5HbHIARWQkE/wCyQa5e507SkG1NYh4zuk2q c/QKQBn619FgIOLuou67NHi46vzKza18mW5tdUzbob+0BI5Y98+5qhdamlwpEt9GR0YxlhnH0PSs S7skVi0Gs2vqF2DJB9fmx+lY7vrELGP+07EDPy7tpB/z9K+gpYiX2ov+vmfPVqUU9Gv6+R1qpYnE ovsg9QME/wDj9NMUJUvEd4yeSYwc/gDXP2kHim7fat1pMi9QSFX+laEmmeK1O2JLCQ+kbDH6Cu6F STX8N/d/wTjkknrJf18iX7PqDEm2YkAZwHj/AKgVlLonim4ucR3ptxnK/u4nAH1ArZt2+KFoT9ns YApGOHUj0yARSS3nxAZs36ooyMsjrnH0GKpRT+NT+5owcmn7tvwKa+G/HFswMOrRM2P44FBH4sCK yLnSvibGS9vdpKc4wI0B/MCulWPU7z5ZL6VH6hSSB/PFPm0bV027Lq58wf3GXBHrjNVKhfZyX/bz /wAwjWs9bX9DhZI/jblfJUbc5BeOJgaqPffFiFiLiO13DqzRKfxIAr0+K214J+8lun2jr5YIz/wH P86yrjTYrzi5NwX67fLbP6HOfwrnq4CXStP5s6KOJd7uEfuPPVj8dag269Wy3FscYTI/pVxvC/iQ y+ZZxIYlAZjvUlT+BwR9a6iDQtIhuFaE3YcsCQsbt39GGK7vXdOuVtEvbG0ulkDKwneJF3Adtitj J78V83jMI1JXlN+an+lv1PqMuxKcXZRVunL+t/0OG03w54lljLC8jjckBfMkCMT6DkggfWvRYNA8 Y6RDBD4pvLQLqG2W2uJ51lZYwcZZUDMBx0PpkVgx/wDCV3JxFFIoyP8AWwxhQD7k8D9K9K0W38Xe HLx9T1C9voU8seTPa28MoRj0JQsAF9dobPtXx2cTdNpJybe1739E1/kz7/JIU6qvZabtW+d099L9 V6ml4fvvD19NGmpTX7/Z8xxw6GkMEzSKAyvukKgq2DkgBh15rT8UeMvCviu4a18L+HF0qM5WR7i9 e+uVCclgzbCWwOhJ56HGANLUvEGs61dLqGg2NpPLbQhpntZFjZnC7WnK7xId3UqOEPrXn/ivwT47 0rQWu9S0CYW0k+BfBtxZyudvmI+05U9D1+vFeRgqEZ1oTq80JbJOq9+vuppPpumz6LHV3TpVI0Wp pbtUlqltq07dtGvyPPNd8Rac2oQW/hjUbqGERAXMt1bYJlySSqh5CVHTPBPpWRqHiLWY5zFb3sF3 CFAWZ4DHkkc/IV4IPGaqN4YdVWW40++iWQEodowQOuOTn8KxpdP0ZyRm7TjAJLL/APWr9PwkIQjy qbdu8v8Agbn47mNWpOTk6ajfsrfdr+jLR8R+JUXEc0Lr2wjDGOxIxWPd3evXYL3MkIUnO0lsfTnN H9hquXtnmkXAbbnJ/TrWRcR2ZIhKMGzyHYrj860xEk/ji/vOag5L4fyKslncXDECOALnJxnk1nz6 ORIVYRJx23VcvdMsoY96v5Zx1S4Oc/TH9awmtYThRdTcdMy7s/mK8SvgadmvZX+f/AR6eHxdS3N7 T8P+CTvo9nnMt04bA4G7GPfFVl0qzKFRMrfXIJ9OTVWa3tUG6eW5PHGMH/CoVg06QfupJc5HDLj+ RNeVWy2i5aUkr+f/AAT1aWYVEvjv8iB9D2Tbo5UOM/x9fTjNJtkICyFSAOzKDU/2Cx5Ew3e4DGqs 2g6S53x78jsFP9a4v7ClC8qUPxNlnClpUl+BDcT2qZDMVHvj+pNUtlm67vNxk5zux/IVpNoOmmLL LJ68bQKoroFoG4BA9cqf8K5Z5ZiVq4L7zaGMpPVSZnSrbxMS5SUHpn/9VQebaf8APCH8j/hWy2k2 IPJYEccfKf0Jpv8AZVj/AHpP++j/AIVg8qr9Io1+u033P//S/iEvVtvM+RmIAxhyMn8qypI4ApCj Pu3WuxurWeJ8R8jONxUZ5r1D4a/s7/Fz4u6ffa54H0We607TFzqGqzPFaWEDcYR7q5eKESHcMR7y 5ByARXkzrYfD0vbV6qhFdW0l97PpI4atWn7OlTcn2SueLaF4c1fxFew6XotrLd3E8ixRRQoWZnYg BRj1NfuB+yl/wb8/t7ftIXXmajoH/CJ2qSxo39uw3Kzyq/8AFFshaArjncZgvTmv1Q/4JI/Bj9pr RvgUfHfxQ8XXvhbwTLqEXhHR9T8I3egRXOgXELKWub+a5s7x3WVHxCI380kfL1UH+onw3+wh4zs3 0yPR/iX42t/CN5HbmVdMujYeINWn3mZrjU9UaA3JycbY4vLCjjjnP8c+JP0gM+hi62CyWnDkptqV Sm/ayWqStzxjCMrvWPLUXXmSs3+3ZT4e5ThcPDE5jNuUldRkuVXtdxajJy21V5QbXRbn8c+h/wDB In9nX4cftTeH/gL8RvCfx7v7q3ns7LxVdyaJYf8ACPLLeKrxXUupwXBS2t8MTIhZpFjAPDHA9u/a l1r9izwv4V/4Zq0nTviB8OrHxH4gj0fSfHd34AlF1ENOdElh0TUbO8inu0Ztu5WFwHD8ckV/RV/w Ux+E2kah4osp/Gnj7TPDHh+7tStjpuvWfirVr3UtRWPyFu/L0WYSJtX5VYhC7ZYDFfyDftP/APBK X9uOH4pWXiTwZ4q8R+M/D0d4q+E/HfigatowhMaCdmJ1Q79PjhfOJZXRBtDbs181w3Wr5vmEKvEW auEaDfLeXM3KLfvNq8YptJqPIrxa1lofYVa9HD4GLyzBXdW3MlHlVna6V3eTWu0nbW9tT8gv20vg t4d+A3x91rwF4YvvFur6ZC0Ullq3jXRLjw/qt0skSszTWd0WlXa5KqSfmAB4zivkJjbZ6fka9s+N XjP4pfEHxtd3vxh8R6r4p1aymk06TVNU1KXVnIt2KYiuZHk3xZGVKnaRyOteLvaMvSNvqw/xr/RD h2jXp4OlCrLnaS17+fzP5Oz6dKeKqTpJqLez6DRJbdyR9CKh3W442yE+xqVbZifunj0/+vThGvVl I/HpX0L52r2/A8C67jUlth0Dj8M1bWWzPXzPxqFBHj7r/QZqeMRbskP+Oa6aUZeRhPlLEcluTlQS P7vNW/kb7kb0xYkHzA4PuelXo/K6swFdbpu2tjJtX0Q6C2uM744WPoSK6CNJxGQUxgZO0d6yFktU 4MxHsM4q/FNpwX/XHPfbnH8q0TSSTkgV3silcs4PygH6g8VnlZn56Y74Na80lorbxcueOQoP9Rim Pc2zphpjkdA+f8DXXTXVyOee+xnH5Rycn/dNWY7pkA2qfwBFR/aGQ7UePGfQ5/UVdWYyoA86gevX +ldVNdmc835E66tdkbUjZu3NT+ZLJyYeenVv8aqB4kwftbMe4wcU77REy4MrdMHiu6Erby/I4W76 2/MtbZY/uxfpn+ZpDcXh+VkTGO6ZNQI0AG3zWP4U9Us2PV8Y9DVrylYaXdFlLmUcOi9Oqxir0esy 2xG2IZ6cgdPwqGEWkfIjPsc4q7HdQn5I0Cn1Jyf5VrGm1qpEzav8JK2salOQAH5z0FSwy6jK2JI3 PHG4/wD16njiaUjYyj1LY4NX10ydx5gkHuQc1jVjKXVnRSmuw+3+3GRI2twFZgGZeoGeTjcM454r +h79kz9t658IeFNG/Zr/AGSbP4h+K9Tktpkn0PVp7q5tEVY2ee4062tLqN7U7suQTIijOQcmvwlH ie4n8BweAX0zQ41gvGvP7ajtCNVl3jHkyXJcgwr1VAg571+2/wCyF8Aofjb+zybP4i+KtP8AFWjz CC3sdB0DWNG0bUtHa0w227iu7SG9m2lh80VyEYZyzYxX89+PWEwcsojUzam3BTslzaXe0mkkm0rt Rc4dlK5+9eDFTEf2hKjgJrmlFNtrburuWmtldRnrbQ/aBfj5+098MfgXaeJvjBc6vH4m0uFLq2uf D8Ft4ivPD+kudktvqOlf2nBKbhsAq2yQhK9O+MP7TH7MvjD4WN+1B8M/iJ8LtXuRYvpNzdeKfCWl wa1Dqdvbq5lnju57bUD82WIt4pHUD92XOM7X7Gf7Ovwz/Yl8NT6R8MPETWV5KZdc1KxmtoFv9RYw xtHHb6rLK1rLD06TlFGc4Oa4j9pjxP8Atg+LvEst98Ofh/8ADLxhp3iOymuNRXxF4K0/WbrRYbZC PKGqack1vdyuQ3CRExnAbIBNf5eZfTyepnOJ0jTvKTVR8lNSi1dxcJxqJX5dPeUbX1c27/2TmVLH eyo1WlLlirxXM7O/flTaV7uztza7Ox/Pj/wVB8cfAH4n/DnwV4i0rxF8PfEHxF865m8QXfw5s7hL F7WQL5Zubi8jhna4L7mZXRmyWJfoK/Ifw9428VeCbTUrDwtqD2UWr2TafqSRKh862flozvVtoJHJ Ug9s1/UX8fP2Nv2NPhX8Kp/i1+0d8NbtPEE19bRSR+F9QTQdHa/1BXl+zy3Cqbe3RAMqGtonbBVQ QCa/J/8Aa9+B2hfBHTPC3x4+Efh/wj4VttQVdS0Sx0zxTZ+MLlmXbj+0YLh8RqFQyp/o7o3mbG5G B/on4E+JWRvLMPkuEoTlHmlGDqez5JSu52jyyb5U9mqenbQ/lPxW4IzZ46tmVatGNoxb5HLmtazd rL3rXurpPVXPycluZVICGT22k4P0xUS3moKcQrMv+1lq+tPiz+3H+0f8cPAUHw3+JWtaTdaPbTpd xW1pomlae4kjzt/e2drDLtGc7d+0nkg4r5Vk1PVnw0E1uO+GANf17k2Ixs6Clj6Uac77Qk5q3T3p Qpu/ly6dz+Yc2pYWnV5cJUc495RUXf0Upfn/AMGg19qjPyHJJx93OatR3WrBvliC9vmQc1Ukvtfl yoni9wqimB9QAInuzg8nCDNerFXeqb+7/M8q7S0t+JpeZqr/AHo4iD2ZB/jU0guTFieGAjtwAfwr J88rgNeyccYROf5VZa4svvG7ui3oVrrjNWtb8jlqXvq/zGpDak5lFsh67jnj8KnRrTdtS6hHYYTp UcT27EGOWcjPOYgRWhILNzud2Pu0YU/oKSjfZL7/APggpdbv+vkbGny28KYS4RieOBxj04roYrI3 QKliR15BH+FczZ6lp9sAsbL6EkAn+VbUfiGAjao3e6gg/hxUzpei/r1OujW6K7NC506OCHIUZ+uO ayJbplG0Z3dMAgCtZL57hA3KZ9eayrrTpppPOSZ8jngen41zwoPeGp01Ky2mrGhpfnHLsEXI/iOc D34rqoLrTYIwJ7pFIznjOMfSvOZY7+BCxkl/4CB+nJqkpv8Accvc89M7c/yNKdWUd0/uRlCnGTvf 8T0ia9025U7byZjnoiMFP6Cvq/8AZG8ffEvw540k8N/C/wCI2neBVv4ybk+KZGTR7sqOEmjkhngL 4ztaVRjoGBIr4e0T7HBqcM2tRXlzarKpngimSJ3UHlVcowUn12nHpXuXxV+EnjPQPEMOrWfhe60L TNfnkk8PaVDfw6zKIwQBD5sJZ5HGQPmRSxPA9PgeMMHh8dRnlWKjBKtF2c405RbWtuScveaXvW5W klq07H3fDFethpLMMPzNU2rqMpp2enxRXup7LW7elnqf0xfC79lL476h4Ei8Xan8VvgJqI1GzXUD Nf6XpsUflqWikhj1CNYHaMLgOyEEZIBBGa+dPif8AfD/AIL8N3+i+BPF/wALdKvLmBrK11vwZqdw LKf7RIsj2t2rNqFxhJQwWRMArgMQBX4kfDHXvCPwq1iT/hcXgufxNMrbW0rUL670c2hQghZYo4gz FvQsMA9M819keBfjl+zT4luLS71j4DeH7bRxdppt7rB8T6kiQzT8o0yhWIVQD9yPgdTmv4qxPgxx JlOPq4v6y69C6klSw2DowdvhVniYubWyvCzu7J3TX9K5P4iZdjKSpzahNpxUZ1MROcb7tyVGSXfS St12PdPFv7LHiT4bfCLWvEmlfF2yHiF7HF5pun6rdWlvqcKkPJDb3k1rAsw4G1BMAxGM54r8xvEu p+G9V+xXVrLrZu0tVTU5tXvBdtJcZO4wfIGSLGMIxY5zzX7N/AD4H6544+IGo+Of2S7r4ceBNRXz 7Sz+26lqmuQJYzKUf7OLiApgAFi58w7vu4xivy6/aY+AX7Sfwy1b/hYXxrsruW11++nhsfFSPHPa ao8DFDJE6EcELkBlUgdga/U/CDizD1Myr5bjcyg63uyUZKFOreUXeHJBOE4pRurVJyWulkmfJeKO R16WDpYuhhZ8mqbvKcLJ6S55Wak29VyJPv0PmG+1HwxBKT5d4+ScnZ19eaxZL/w3JHmKC9LYAGcq OnIPNaD6dDcxj7bezIe+EyAP1ptl4Nu9avYtL0Oae7nmlEUMcCEs7N0VVxuyfpX9NzpUo+9Ob08j 8Epuq9Iw1fS593fAL4aaR8Z47Tw74Zj8NNJHboJbu90u98xJVGfLlZblFd8nBZRzxgV+1Xw68L3X wL+Ed14V+IWmfDA3VwkGl6JoWk2caXI3fO82oTTCV2jbcxBeUddoYAYr8IvDn7Lfx50fQm1HS9Wt tNtoLZbi9a4vRbNbtc4XyZAQG8xuhUZFe/8Aw0+AOn+C9Z0Rv2gPAmlX1nrxtodEuP7Ym09bpWAj LRwRpNJcs5YNhXTJwB1r+TfErIcFmTmlmUZ007qnGEXUbWuknOmk7atK75b2euv9V+HePxeBVPny 6UJtWc5Sagk9FooVHvpd9fw/dfSdN1XxJ8J7bT28O6bpktrdWsmo3Hhy4me6a1snBs/JBtpo/LQB siAZZSfQ14p+1B8ZvglZeLtF8QeCr3x9pE0RfRZbCC3uoNIjjUKUSzhuop5Mylc7jFgHbhVycfPX 7MPw5/Z/8OeLtW8M2sk2mT2M01nqulJcTtNcQBy3kTQizEZ2FVfc7hlOUJG6v0j1z4GfAbxLqCaD oHwk169m0XT2vp9S1XWbiK4ZZoh5WxXlzGXGfJh27FYDG3iv5EzjDZfk+ZtYmlVlH3mrRVO6mlvz 1JKXS1m9Oh/TmEq4nHYSlOhOKlffn5knH0UGuv2d+yM3x9+3z+zj8M/gfqK+H5dc0XxDe2lppFlP rlt5mn2QmhEiXkhhCxRFvuzBV84Erui64/nU+MX/AAUJ0C01H/hL/h14f8Kf8J811C+p64umLd6X dogw5eG5YpLJJhS7eUqkjjOSa/R7xhcfsaePPBc/hDwd4bu7xJnmsrfwzpN1ZaLq08nmDCao0dtF c3auw3FJHJUrn0NfJ3i/9gb4Gfs62El7+0jpOkSXfiOzMugaTY+LorefSLoMNsd5JGtygjI4Ksue 4ev1Pwl4Y4UymVR4/A13WqS0ptxbqJbrlcotxW8lL3NrOT3/AC3xBzDiDEU/Z5biqSg7tzbk+V20 5ZWaTtorWle+iWp+RvxZ/aR8dfGe/uNQ8VWPhe0a5uvtlwnh3RrTTFabnLf6OgKg5+6pC+1eXW3i O9VBEkKsuMDfx/WvrL9qX4M6B4O8VabbeEvDmm6BZzaeZANK8RDxBDcspJZ2u2jiRXAxmNBjGD1r 5OXSYVbhHIz/AHgf61/oRwesNWwFGeBo+yptaRXLp0+y5R6dGz+HuLIYujjatPHVPaVFo5Pm19OZ RfXqkbNvqkrkeZBaKcckuRx78V+jP7H8ei6q3/CL6t8WdF8H2eqyqL7QbjStRv2kZWBEiC2jaNpE CBgWbAUkHvX5pwWU1rdpOkUThHDeXN8yMAc4YZBIPfBFeqeD9YWw1C51JNBstSlkdZIoh9sVLXrk Ri2nVsHOPmYnjrXJx1kdfHYGphqc5xv1SpPXppVi4+d99NHc7+CM7o4PFwrTUfT31p11g767W1Wu qP0g+NR07Q/iTPN4Q+JXjHxx4baGa81S70m2uNBjtbqWVgkUcU2yMxs53kRIqgHC5PNdX8J7rXfi fHH4a0PVfivqdzZRL/Y8FpNCljb4G2QT3s7P5CiIlU9WIXHNfC2tfGaDWYNFsbrwxoGljS5HlnFu l+TqQZgwS7M125ZFA2gR7Dg8nPNfWFj8QfDnjfwLaeHdM8W/DbwV5txHeW8Wj6Zq1nqVnJFnbFJd xRTOytnHzySjvkEZr+deIuGMdhcHRpPDyk9udxjK1r+9KNGNm2t+Xk93S99/6K4f4mwmJxNWccQu Xfl5pJu9tIuo00l/e5tdbWPJfjDL4r+Fera98M9dfxHoeuyTRW9/pv2u2nsrqFckC5+zg+Y6ggAq 5AO7gdK+VPEei6rphaWS2lt1kf8AdRNknkc/NwT6jNfQviX9oPxPo/iBp9Kg8NSX9pdxyNrJtWvZ rm5gORcm6uGeRnZhuLHGTzgV5b8V/jF8QfjJ4jHi7x9dafPfCzjsvNs7WK0HlxlmBZYUQM5LEtI2 XYnJJxX3HDOXZpQdKVTDUkmryfM7uVla0OV2XrNtbHw3FuLy+sqip16jafurl0Su7+9zavXpFJ7n mGm6Be67ew6eFZZpnWOITSLEu5jxl5WVVHuWA967TVPhr478O2D6hcaZPcWaJ5j3cMS3cEaFimXm gaSNcsMDLCvObm3aUeYJnZgAG8xuP/riprXV9a0uN49J1GW1WYbZorOaWISD0YJgH8a/QpQx8pRl S9ml2cW/xvp9zPzWLwiTVZT9VJflbX7zp9N8IXOtWlxdRxRoYWRFjWJWkd5Og8suH24ydwVgOnUi u88I/C6/XxXZW0d/oazCcMj3uoQ2VqBGNzea9wVCDHHIzntmvOvDvjG30nUBqfiezh10lVRY9Tmu ht2ngb4JEc8cY3cdq6fSvGXgCyt7QeINCmu5o9SW7u54r4wLNbZz9nWN7eUKf+mhZ+P4eTXbVqZl KM6cYaNW0jG2q85Reny307kYally5JylZ76ykno/KMlr+h+sHw41D4ID4U6trnxduGgm0zXFigXw 5etNHqkcrxNJBBenDzTW+VZ0bIWJtyAHmvnr4zfEL9jfWviFY6tN4a8faBokMt1N/adhHFbajqoa BUjQzTFgoSQHfICzFT6nA6b4NftT6v4Y8L3urXPiPwj4Oj1bURcQ6Gfh5aX9reQWilIZhMbbyHdG Z4+ADncWIzivln4mN8cf2tPi4mirc6f4l1CJHTSYdFFppWlrCT5jfZ4QLa2i5OZOAd2ck9a/A8i4 FxUM0xVfG4idKlHmvL21WKinFJ8v7qNN2d25e0lbVq1lb9pzzjOlLLqFLC0o1Jy5UlyU5OTTuub9 45R0tZckW/Rtv5E8UXXh1NRZvCl3eJal3IF+EMiqT8oJTHIHBz1rBXVnjbab1D7lev5V9WfEb9jv 40/C7Qpde8eWOhWccI3vDF4g0i5ueoX5be2upJWPPQL05r5am0qJJNttFOe3zYAzX9HZLj6WIoqW CxHtYrS8W5fij8CzbD1KVRrFUfZyetmkvw7G3Y6pC7ZN0jKOuwLzxzwTVh5rZ8yCZj6+o9OlYa2u qRJvS2IPb5lBouF1mVSkNpKQF+Y7gMfQV7bo1J+7JtfJniqvCGqivvRZeG6uF8z7QoTb8pkxkn8K yXj1eHmGaNucdj71nlNVDbXgueD1B46+lXILS4mbKw327POFUgfyooYWMHrN/ijPEYmUo6RX4GjH faskIXEBbuWz17nrWraarqUcgaW5jC+inAH8qpw+FDe4aWK9De6A5/AVq2ngWym4keRWz0kUriu2 Xskn+8f3v/I81e0e0V9y/wAzvND1rRbkhb27toSSOXcke/B6V6za614Shtykeo+ax6uske3A9AVz +teFWngeNZQ0EYcAj+E5+tdU/hu9eMJFDKFHy7wCcYP+7XkV6WGlL+J97O6jOqk3y/geoaf410iC 8DabKowMN5u0H3OcY5+lN1jUdK1iTd5UEqnvDjGfyA/z0rzKHwe6nzJr42+BnMoJBx2JCCuntxbR 25VrrTCY13eYJjG3H1yD9AKh0cEpc10/nEaq4h6NNfJkV5o3hGzHmX5lRuNqLCjfrurmJ7nRraXN rZI6jkGWMZI9eM/pVuSHTdTuiVvIvXIuBj9RVC70XTnDMbpgcHaY5EY8fUV7kKeHSTUk/K8TgnOr ezVvkxh1zTZh5MtkSvOVjQj8eBWWb+yL7LbTnTrwWI6e5bFRNpB84RQ6mYVxg+dGrEH/AICDxViC 1uLKXYNViZeSN1uCD+Y4q+egk1GP/pJnKFR25pfmasFsby0EzWzqgyuNy4z6Yzk10Wjx2lkV8qz6 fMfMbjPqQMVw8sl1JIH/ALRtyM8AQhB/MV2GnXC+UI7ie3QYyZEIP5f4U4zoW96D+ST/AFKlGqrc sl97/wAju08UXVrJi3tba3+XG9w7ZyOoJNa1p4lklZCrwtIGBAmBKZ+h/wAaxYbrRbnZbWt0CwA3 GVc59SBnFdFPpnhaKKNj9pnkI+cRxJGBg+xNcVX2LsvYyv5wf/B/M9Cg6qXxr/wJf8A7CDXreKb7 Tq1qHViCsml3UUZB7naVavRfDep6VewmeWz1WaAnBMrQuvPUAsnNea6YNAmzHKkSrj92LlWZ92OA ShOPritKSCS0h2ac0NmRwxnkZk57qpGK8dZf7VuKjZ/O35v8D13i1BKTlf7rnqlz4N0C6mbU9Dub jTRgfIwSRvfhBj8hW9ofiPxzAiaZoevBomO1w1gqjjI+ZiCM/wCeK8M03xT4oe4azsLywuXHBjuL cAHHozKVNdppfjD43reBtDstK3ICoit4In47/dHNcmNyTMoLknKm0tudr9Y3LoZlg5O8Iz8+VP8A R2PpDwwPiRo0iNpM3hy7aM/ank1m3ZIpI4yJBFKzqFdAV4XIYk4B5r07wx8Cf2jtcs1vLPSrK/fU Z0urUxeY0LITuWeIyRmFUzkZ3DjquK+Yor39pbS4F8RLaWsREnkrLNZSSRAsMkfP8o46n9a9D+Hv 7Ufxz+GniJbHSvFFrM9/EdPu7bTDdIsaT5BiDLBIy4bBYRg56A5Oa/MuIOHs6r06kstnh5S6/E72 7uFkv1203P0jh3OsDQnTWYRrRj0+FWv1tK9/037n0nrXw0/b/wBJl/se507Tre0glMq+VaW8iWjT AKwzCQ0XmjqCMOenpXnHxD02/wDGfiBPDuuQ+NbC7WzEGvXWm6astkojXEkkcFrDJlWHVzngA5B5 rW+HX7Wvxg8H2mo+H9V8NvqDT3Kub+K4v9OukCEjmdkBYPnG1xgDtXiXxCuv2gfEVre+OdLjtfDm yCWCTS9HuZoTNayklxPP5oMrFCRhRlgMba+EyzhTOXjVDHQw9K2kJwajzN9WuaT37q19Wz9ExnE+ WrCOeFqVqrfxQnFuyV9naK27O9tEfM/iz4e+Gl1t7Xw5q2tCzQ4je8sZC5I+8cmNfl7gYBxWKvhb TrCFvN1JpUQAj/iXNliRnglO3Q5716YPhT4u1nT7HUftkGnIiO91dS391do7LggLA0IZWwcYJYE9 xUFrrHxE0mx83Ttae5nSRo4rC2s1X5V7sxRTyOgBJ45xX7FQqYiMY0oVIzcdHeUvzimvxVup+K4m jCcpVHTaUtVou2yTafXzv0PKRolhe423jL6Yt1Q57ZDba4fW/DV4Jjat/YzkD/WSIm/H/AG4/Gva PGN34v1u1W71aOJpGQnN1Cm4nvgtlhz6mvCdY8Pata2bX0kRRXbaFjQMrfiM4/KvqcuhKVpVJRT7 Xm/1X5HzGLSTain90V+jOa1jw7pFtaGe51DT0lwBiHYRjHYZz+Yrye/0CCT97DqFs4YnHlzLu/Fc j+Vdne6JcysGiiimY8eU8WcfmK56+0DU9PhF7caNCqqMggRj8hkc19NhqfJo5J38pfq2eHiJKS+F 6ecf8kYVz4Fu5IPtC3Nu2Vz+8lUE9+mc1zf/AAjyxyeW8tuGGMEnPP51qy3l7fSeTBp52dCBEGP5 gVJp9vNJPsSzi3DtKqrj8+lepKlKKvUqr01/yPFlVi37tN/gT6RoywzmG7uYwm0BxGVX88nIFdNd aHoFrAs9hI1wRHvfzBEMEk4A+YswxznA+lQ6Yjm4e2urRYlmYbpFkVdzDpnPBFbr+DLqbzZUMnlo QXxcQEDPTgj09q8GvTSqJuvb0vqejTneHKqVzz25EUoCtCwAP3oosD8CBWjo8ulRz7Tc3CspB2bG GMehKkVuxlrNPKs5+AcHi3bI/ECprXTHvWMgmjDZB3OkJAI+jcV6dPDTatzfmcvtYp6r8jrPK8Ea ioY3c1vKcYa7jZ4yepPyBCB+dJe6VpFpAZ7e6tZgjbSyKWTPqMncAe9RrpGrWMBuW3TRH5TLFCUH 5hsGprPUdRs2b+zLgDKYDXO6Nh9ArsGrF4CtF+7Vfpr/AMOejDF0mtaaX3HOzap4f06cRyx6ZMkm CTJGPTqD96sPVJvChlCxy6c4cdVQqFJ7AEiunlsfEGrThprNL2R+nmsm0jv9/wDnXPalp1zbS+UN AQFfvYYEE+xXjFe/gsvaa5pO/pL/ACPExmNTu0lb5GCthorHd5elurYG3cwb/wBCrSGjWTKDFplo 4AyNr8/h81RQJchtp0B8eu8DH510UV1OsYQ6bJBgn5/MVuoHUZr6LD4aKtf/ANJf6xPn69V3uvzX 6MrWHhq+lcJb6WTz92OfaPzJrXPhu4GQLG8XruC3HPuetZkuq6nG22CadR3UO6Zx+BFZs9z4hugd ksz4HAEob+eK9VezgtLv7v8AI8xqU5Xdl9/+ZsXPh2EKZ9upxnOG/fk/gMCsaXSrNiPJGqO+Odzk /h0FY6XOvRnbM16c9UMYbP8AWtqyuJEISazm35yN0bDr9TWPMpborlatYpRyz2bbZbe5Cjg7fvcc 5GTWonivSYCEeK8CsQrCcJz9MnNWbvUL+3A2WUyYIJaOFv8A4oj9K5qe4nu5d16s6DPBkgLfzocp L4X+AThr7xrX3j/SAdkCXGOm0LgD6kGqln420RgEmSNXBJDsz/zXFWodGi1GPyomlLH7v7tQrH8e lR3XgW1AEWpQyiQAhRGFAJ7fMBxWdWOKtdJNeZvh50Vu2aGn6vb6lMktq4IMhQbS5JxywAZhnA9+ a7JtbubfVJIIwot0YiCYZ3Mo6Fk3PtJ7gk49a4RdOTTokt57W9dVIYJLPE8XTGQoOa3n1O6uLCLT La0eOIMOjqoY9ctkc/nXzOIWL572VuvZeex9ZhKmGcLSbv07vy3PbdC8JafrVq+pS6zDAzRF4bTc /mvIeitmLYBzyd1X9MsLO1tTbzXWoCVmw4t4QAi9GCtu2tuHsK8X0QSNKbQxqVV8vKbhgR6hcYBA 7CvT9Om1a2VpNNB2huMSD7vXHzdD7c/jXnUsPJ80qlVtb6W08v6/4B9A8XG8I06CT635tfxOmvvD lhDaJc+HraUqMi4e/wBiSHd0A8rHB7561iy6dqehLFfXWkQSJcQyGJkdTvXmPLAMcYI4DAZ64xXW abqTSAzeIGlR0YANGgcMo+8hZQNuR9fWuUv9T1SbVJn0iOCJJPmjBm2sM9Nxxhjjvxn0FVhakak/ ZuEpJdWr/K90aY2Dpx9tGaj5J2/Cz/rU4HUjqep+RHeWl9IltGLeCMTIBHGhOFAQDjnvWHcaZaq6 yLpuooUOCNwYH6gjGPWvR7/xFrulRSTapFBLJ5ZRCVR1Un+LjDEjtk/WuEuPH+uTR+XHv54xGvlj 8hxX1lGjSinFR5fkvyPicbWqSak5X+bOUvbTTV+aWyvYmyWw2AW69sYrz/UdR0yScwW9tMHzjbKF zj6jNejaj4q1SSIG4tnwR8+VUn8D/jXmt5r90Zm2WEjDJAIRM/pXn4iNVaQkl/26a03CSu1d+py2 ptE7HFoWXbjOBn+lcRewRnJS0kHHd/8A69d7dalqEuSlnKvT5wi549awZ5tRZi8casT2kRlP+FeR iaM5aX/A78NWjHW34nLRvdRkubRyo5AYZH8+lWHvtYk+SHTxjGMKCDW1LfanHkSJF+oqm+uXSsVk ikHPJjJPWvOlhGl71Zr5I3jjL6qmn8zJa/1uJMSadOQRzt3ED371lSahdKSTaXGO4ycfyrozqVsO d14GPJ+Yiq7anYOMPdTrn+9k1hPDO1vrP5f8A3hXj/z4/M5xry5dQY7WcccYc/yxSee+AZoZwOmN /wD9aujh1Rbcgw3bEdcbG4/Kln1+0kXMkp3Adlbn8+lcssNaL/f3+46o4h3t7L8zmBc24bYqTexJ 6fpTvPj/ALsn51dk1yFvliG856uOP0qL+1m/55x/+Pf4V5spNP8Ai/gd0dvg/E//0/4mYppZp9rs ehPFfqj8K/2tvj1+yJ4E0f4d/CTVbFvD+q6jHrmo6Prmj6XqUE93LEqsztPamUjaAoHmcDpjNflT a/8AHz+B/lX2L8TP+PTwv/1xt/8A0WK/LvEDAUMTho0MRTU4PmdpJNaLTR6adD9n4BxNSliXOlNx eiunZ2b1Wh/p4fCLwH4N/aE/4JX+HNW8f6dbRW2u+BIfEWp6Voa/2TayXsKfaEdWszFcRgOowEmX AGBivyz+NXjP4yeFvgF4T/aY8DePfFmi6p4ekjh0zRYJLS90hFkXB3x6lbXdxIeM5e4JzySa/Xn9 jH/lEn4F/wCyUD/0mNfjn+0B/wAo89O/6+rf+tf5wwoQWb5dBRVtdOmlCm19z1Xnqfv2TzfJmcb6 Kq/xlJP71o+60P3N8Ffs46V8UfD+n/Gbx94p8a3/AIn1XwnYJdasmpLZlPIVp1a2gs4YLe1ZmkIk aCOMuAu7JGa/gb/4Kg/tqePvEXx/1z4a/FXQ9A8b23hLxPqPhzTb7xTPrMl5LpsV0ZFguWtNSto5 v7hkaPzSvG/PNf6N3wM/5Ij4d/7Fa2/9J1r/ACy/+Cnf/J4vxE/7KFqv/o41+lcKJf2zOr9p+9fr zOKvK+93d3e5y74etSfwxlypdFG70S6Ly2Pyq+JWtWPiDxrqetaVpWm6FbTXLPBo+jidbK0Xj93A LiWeYIP9uVz71595hJyQD83cmui8R/8AIUuv+ujVzP8A8VX+m/DEm8Dh2/5Y/kj+M+IEliaqX8z/ ADHLLk4CqOvQf45q5CS+e304rOj6/ia0Lfqa+sfU+be5YWIMMknripGt0IYnPHT8s0J93/gX9KnP 3X/z2ruglYwr7Mr/AGaLcMgmrsFvHuC9skflUJ6j8KuQf6z/AIEaylFc2xUHoaEGn20h+YHrVhNK syxO09R3qW06/iKup1b6iu32ELJ8qOb2kr7lU6NZBN5DE4PVjVTybdTgRrzkc5PT8a6B/wDUj6H+ dYb/AHh9TXfRpRUdEc+Im77kk1pbIjSBFJC5GenNVfIgJxsQcdh74rTuf9S3+6P6VRH3h/n+KuhQ Vloc6k7DHtYDH0xyRx2qqYkGeO5H5VpH/V/8CNUT1P8AvH+lXyLsYQk7F6G3iyRjoMVoG3h7KOlV YfvN/n0q+etdFOEUtEYym77hEqjBx+GTirIlJYIAAPbNV4+gp4/1o+tdKWiG9zZgkaNcDn68+n+N a8Mj7Q4ODnmsROn5f0rXh/1Y+tc1V2UbHTQWqNezlkmnSFzwXAzxmvvL9mL9qXxx4WutM+CGuaX4 e8TeGrjV7NrOy1+2mM2mTyzqjXGn3dnPbXVvLhj92XaTyVNfBOnf8fsf/XQV6/8ABb/ksXh//sM6 d/6UpX5P4w0YTyWtKcU3FXV+jvuuz89z9g8Hqko5vCMXZSun5qzdn3V0nY/uO8MePLTVvH9z+xbc 6JYv4RvLqbT/ALVc32sXurW6NCrbre7vNQn8pgeQVQAHkAVgfCz/AIJ5/sy3P7ROqeBbWz8RWqaF dXMVtqMfiPVpbuZ4iW82f7RdSwu79GxEqkE4Uduc8Cf8n8J/2GZP/Sda/QD4P/8AJ4Xi/wD7CN9/ Jq/xphnGLw2YTjh68oKo6fNyya5ruSfNZ63Wjv00P7lyijGsqrqrmcVNq+tmkrNX2aPy8n8A6T4j /wCCpmk/sYeIprrUfA83hO58VXFvqLJd3s2o7NiPLdzI8kixqAI0YlUHCgAkH+Xb/gp38T9W8e/t T6r4ensNH0uy8Ix/8IrpdtotqLWNrazkc+dMoLBp5WYtIy7VJxhVAxX9YOm/8p+tE/7Jhcf1r+PX 9v8A/wCTwPH3/YxXn/obV/Yf0ZW3xhQi9lhFJf4nOSb9WtG92tz8g8ca85cOy5pN3qJfLU+NCEkx 5ihsHAzn1rRhsrUrjy1rOHb/AHv61twdP8+9f6aYZan8G4p6kTW9ugJEanAPX6U+JU8rzQqAkZPy g/zp0n3T9D/Kkh/49h9P616cFqee3oive3ctspMIQcD+Ed6yP7Wvy5UuMZHG0f4Vd1T7p/D+dYA/ 1h+tctWbT0YqcE90dNZandvIVYjAz2FdFpuozT3G2cI45GCP8K47T/8AXH6n+tdFpH/H0Pqf6V0w qS5ZalQpx5loaVzqUkTMiRxfiCf61jp4gvo5CUEQ5I4X0GfWp73/AFjf59a5z+M/7x/kK48TUlbc 7aFOKd0jvV8R33lqdsQJAyQCM5/Grlrrt5LMiMsYBI6D/EmuUX/VJ9BWjYf8fKfWqwc3yvU2xsFd adDuFlkml2scD/ZA9av22nQSzEMW4xzxnn8KzIP9cP8APeuisv8AXH/gNbYxto5sEtGUms4opTjJ 5H3sH1Hp7V0uh6zqehTx6ro80ltc20iT288LFHikU5V0YEFSCMgisSb/AFp/3h/M1Yi/49m+g/nS VKM1yzV0+5tRnKM7xdme9+Nvjb4z+KsOnQeLI9KN1p8UiSara2EEGoX7Snc0l/cookupM9HlLMB3 r7+/Z++OHjX4d+Ebj4rsYdb1bw/CkejDWmna1tkSIxqv2a2lt4pQAAcTK/I544r8o9N/1/4D+Vff fgX/AJIR4g/3P6NX8zeN+UYSnwtONOhFJSskopWUp2kttmtGtmtGfvPhnj68+IKbnUbvG7u3q1FN N+aex9K+Lf8Agqx+3LffD2DxJ4Z8Xw+FSb5rP7J4S0rTtKhEaKHABhtxL95iSPM2n0r8ofGPxM8f fEK8n1Xxtq19qc8kzzs97K0vzyuXcgMSFyxJOABXpepf8kZt/wDsMyf+ikr57X/VyfUfzr2vCDg3 J8vy5TwGBpUnrrCnGL3f8qXdnj+IuZ4mWIVOVWTi1td2+4wb25m8xhkDaeMAVmrql/HOrwyNGynK tHhWH0Iwat3n+tk+p/nWKf8AWD61+s1+x+fUW7pn6Dfs7eP/AIkeL9QtfBPiXxN4iu9DW/S9bR5d Qm+yyXEUeI5GUMDuTAIwccAEEcV+/wBZfA/4M+Hv2eNU/aLfwto2oeIfDUMdzpMepQmWwjlcojMb QMsZJ3E5x97nrX87H7KP/I6wf9dv/ZDX9PGq/wDJgPjP/rzh/wDRkVf5/fScrzwWPwUMHJ01OUeZ R91PmlaV7WvdaO+63P7j+j/BYvLMTLFL2jjs5e9ayTVr3tZ7dj87/hFrmn/tVeJra58d6No2jz3W kX6Pc+DrdtEm/c35t1Je1cGQ+UoX97v9sGv0i8JeHNC8R/BLWYPEkV3qGraRFb6baeKLrUtQbWTF CxSMyXAuQrsiKqjchGAMgnmvy8/YI/5GHTP+wZqn/p1av1c+HX/JJ/Fv/X3H/wCjGr864+xVSnha cKc2lGcEknZJPmvZdPkfpWRUYKpCairu131esdz8VfjhpWk+GP2oPHPww02B2XQFszYa7NdXT6rm 6ijMrPN53lsWErL/AKofLx65/JL4l+MUuIZtKl0nSDObyW2GpeVL9qCW0zquD5nl5YDDHy+fav17 /aT/AOT8Pin/ALulf+ibevxR+In/ACE5v+wpff8ApQ9f2F4QV5yjTlKTb/dL74pv8dT+cfFmhBUq yUVtVfzUrJ+qWiOShk+02pScKwTG0NyBkZ6Vt2FrayR5aKPhQMBR61gWX+of/gP8q6bTP9X+A/mK /qXFxSpysj+R8HNupC7OksfD2kSBJXhUkuuc+/8A+qv1l+NX7Ouj/sh634f1P4HeJPFml3OvwvbX 9wl3Aj+V5Ec+1TDbx8b2/i3ce/Nflpp3+qj/AN9P61+6H/BQX/j98Cf7z/8ApDDX4pxpJ1MbhcPU fNCSneL1i7JWutnbzP2/hL91hcRiKXuzi42ktGtej3XyPivwd+0p8TPiRBZ/s0fECSz1fQDq84mv LqIrqs8THcIZL2JkkMaFcqoxjJHTAHxTdTS6V4qu10xmt1tb1/syxEgxhGOAHzv7YyWJ9+9esfBn /kv9p/2Fpf8A2avItZ/5GrUv+vyb/wBCNfGcNZbhsPjcbh6FKMINc3KkkruUruy0u+r3Z93nuOrV sBga9Wo5T25m23ZJO13ra7PfvF37VfjfxJZWunjw/wDD6wS1gSBXsPCmlLNJsUDfLLJBJI8jYyzM 2SeTXyz4l1q48Z61Lqetw2QmZQn+hWsNnGAmMYitkjjB55IXJ75q1cdf8+lc7D/x9v8Aj/SvQ4Ty vC0IRlQoxi/JJfkjxuMcXVm3TnNtdr6bdjmzbW8M/logwcDJrpPO8h1CqhUAPtcblJHOCD2PcVgz /wDH2PqK2J/9YP8ArnX6o4rlPyWX8SKPUtMvI/8AhO49ZtrTTYf7Rk8iaySyt2skW4XY3l20kbxI QOUIX5W5XBr33Sfh5pvwu8V6hrXhm5mkm0iWKK2XUreyvoWW4tw7+bBcWzxP944yvHB6jNfOulf8 jFpn/X1B/wChCvsnxf8A8hXxJ/182f8A6SLXwGKk24029JQSa6NXSs11Vm9+599hYL4raqcreWnQ 5jVvivq3jjxV4f8ADvj7TNC1nTNGa4sLPTJ7JbW1AvHzLJ5dibYLIWIYFNqhgDjk5+e/jh8UZrrx DeeEPDug+GPD+nWV7JFDDoenLDLiIkDfcytLcNnPzBpSD6DAx2dj/wAlAtP+wgv/AKGtfPnxa/5K LrH/AGErj/0I18xlsFDPcPhoK0FCTUV8KfO9Utr6vXfVn1Gb+9k9fES1m5pc3W3KtL728jir0SPi dpJNzqGJz0Jz044qm1g2QRcXIzzw/H8qvXf+pj/65j+tK3Ra/dI1JJKzPwqaXMyOHSYWtHeSSZiv Qlv8AKzbzTzA4EdxdfMuTmQn+Yrpof8Ajyl/z3rJ1L/WL/uf0Nc0akud6jrRVloc9cWTxxKy3Fzk 4JJf/wCtVSCCcOALm5xuH8f/ANatm8/1CfQVnw/6wf7wrqp1p/zM468F2LiPeRYCXNwM/wC3710t tYsZlWSe4cNyQzA/0Fc2e31H867O2/16fSu1YmpyP3n955U6UfaaI7OxtNhKxyzqNw4VyK66wg81 kMjysCpbBckZ/HNc5Z/eb/eH9K6rTOsf+4a6sLra5lVWrOX1zxBrVqXtUuZWixny3OV49q5K2v5H IkZIyXUlsrxn6VqeJf8Aj4f6GudtPuR/7prLMVyyXLob4XWN2bv2GOOy+2ozBipbbhdv5Y9/WuPn 8Sarbkxoy7cYKlRjHXtiu9f/AJAw/wBw/wBK8kvv9Yf8+lVh5tyV2czVloaNxr91IoAjhTOCdqnJ 49STVMX0kqszKoOOqlh3+tZ79F/z2p8P3G+n9RXtUneLuc1jZthLCxlhlmRhgZDnvj1NbUepatJF l7u4O3DL8w4P5VjxfdP1H8hV2D/Ut9B/MVzzhHsUpuz1PVNDmu3XZPNLKjAbkkb5T+WK6cW0EV40 MKhBuPK9RzjrXK6H/D9P6V2Lf8hI/wC8f50qEmnZHfFKS11K1vBJFdlkmn5yPvY6dOlbNvrepC0Z fNkwoPHmOB09m9qz4/8Aj5/Fqhg/49X+jfyNbSm/ax17GUIrkaNDSNd1SFhLBJsZv4kAyOOxxmvQ NE1e+laOOWSUuDuE3nShwfbD4H5V5Ppf3V/z2r0TQP8Aj4T6GvfzinH2PNbX/gHjZVUlzNX7n12v xJ+JHjLwlbeA/Emv6pd6RppMllYzSK6RHpwWUsRjsTXNX2tWGrRSW2r6NoNx5Ns1tHKLGOCQYB2y F7fyiZFPIc8k9c1R8LdZf9ys7/lpc/V/5Gvx/N8uw+H/AIFKMNW9Elq9W9Ore/c/X8nxlavJ+3qO WiWrb2237dD1D4H/ABm+JEumax8P7TUEtrGHRAVlS0tZrgosoHl+bcRSsFO45xhvfHFfY2kaTrvj 79nO68d+INe1U33hbUrTTtKEEdlHGLa4/wCWbqLXJCHJTBGMnORwPzq+Av8AyM2vf9gI/wDo5K/T b4Z/8mgeLf8AsP6Z/M1wcTZJgqc1Vhh4qTqxu1FX1Vnrbqt+57WT5tipUOSVaTSpS05nbR6dT8+P Gn7S3jrxU83hjV7Hw+y2rvBb3senol1GiHBAcHad/Vsqec4xnFaPgbxTdeMXhi1e109fsSgQyWds ltJ8wwSzxBWY4HUmvmjUf+Rrvv8Ar5n/APQ69x+Df/HzL9E/rXJjspwtLLqjpUYxaelopWvvbQ8/ F5hiJYmPNVbvHu+j9TmfjP4M0Lw9OZtKR42d8P8ANnOeufzr57kjmurcwTTzlDhdu7jGcelfV37Q X3h/10FfK8f3PxH/AKEK+myFKWX05S1fc+Tx7axU0ctq3g7TbaJbmOa73OMkGXgcDpx715HfzXCT mzSWQL8wzuyeOO+a+iNd/wCPKL6f0FfOmo/8hE/Vv517mDqS5W7njYiKcmjjLrV9TjmNukzBQcZA GfzxV6CK4ksxcNc3Ads8hhxyB6VgXv8Ax+t/vf4101p/yDV/z/FWlCpJ2u+py14JKVl0Z2jWENvZ wSStJOQ5c+e27OD0OMcHvXp2kePtVtUn0vTrextYJVMUywREGRByFZixOBXn95/yD4v+BfzqfTf+ P1/95v5Vx5glJK+pjQdti3e3WxzIkUKqG5iCDawHY/xY/Gktj9sVbp8KxJ2iNQoUcnC8dB2zVa/+ 4/1P9asaX/x6x/X+hr6bLKMJQXNG552MqSjH3XY12jMOPmLjg7ZArL0z0IxV+3u1+0LJ5FvkRkHE YAIJ6HGKqXHQfh/Kkt/9Z/2z/qKrMsLS5H7i+46csxFRys5Pp1LkljY6vp7R3MbIrK5KwzTRjjpw rgcfSvnbVIbuzvXtYry8KJkqrSdPyAr6S0//AI8v+Ayfzr531/8A5Cs3414WSTlGc4xdkepnMU43 ZzD6lq0UuVvLkhTgKW4wPbFUL7XtX84yNOzHg849PTAFSXH+sP8AvGsS/wDvn6D+VfYUq8+b4mfJ YmC9nsdpp2q6lcwGV5nB3Y+XgVbivL6aXa80mM44IH9KxNF/49P+Bn+tadr/AK//AIEP517uHqSa V2eTKC10OzsbZEh+1MWd/wDbORXaWEEV5Z+ewKMuACjEfzJrk7b/AI8a7LRf+Qa31X+de5h/hZ53 /Lxf11ItUtG/scsJrgbhyBIcdcV4xcrdxT7Uu7rG4DaZMj+Ve5ap/wAgX8P6mvEr7/j5/wCBj+Ve LTqSe76ntZpTiuWytoV7i61K1wYru56Z5fPb6VettU1N7WRpLiViobG4+1ZmofdH+7/QVLaf8ec3 0b+RqpVpp6SZ5dKKbd10PQfCNql9oo1S5LtL5/ljngLjPQ/1ruVvlhUWTQW7gsPnZCHAz0DKRxXH +Bf+RTX/AK+/6V0Mn/H0v+8P5152Ik7PXqfYYOKtBW+yj1C10ywXMkMYjIUNlST15I+Yk/rV6C5k hZ2hypYFWKswyB64NFr9x/8Armv8qrJ/F9W/nXJg5Nwd2epWiozXKrHVaRI72iwKdoc7t33mB6cF 8+teu6T8DfBuo2GpaheSXzyxQCdW3oMliMjiPgc9sH3rx/RP9XD9P/ZhX2J4b/5Aerf9eSfzSvEz yrKlGUqb5W2ttOqPfyWCqOMaiuknvr3PivX/AABoWlxO1o92Nvy/NOzZA55zXheraTayO8j78qwH XtX1X4w/1Ev+8f5CvmfU/wDlr/10H8jX0uWycqSk3dnwucK1RpHmuoQxwuFQHB9WJ6HFcjelLdyi IpGR97PcfWuz1X/Wr+P/AKFXFap/rj9R/Kulnnx+JGPDf+bO6GGIDBHG7/4qqUl2EwUiiXg9N3b/ AIFTbX/j6f8AH+YqrL0H0P8AWvPqtpM7KMVdBDqsyzqhSJs5GWBJwPxrTl1f7Ov7u2teSeSjH7uP 9quYj/4+k+rfzrQvPuD/AIF/SsMNJ8jdzrqU482xKuvyXCnzba0PJH3COn0am3c8axK6QQLlckBc j17k1h233f8AgTfzrTvP+PeP/cP8hWWJbcU2TTilPRDPte9CPKgGM8rGoPXHYVzMuqvGWZ4beTj7 rpkfoRW2n3W/H+Zrj7n7rfQV5eKk0lZnbhYq70LiXaupkWCBDu/gUj+pqT7Y39yP8v8A69Z8H+qP +8P5VJXndWd8Foj/2QplbmRzdHJlYW0KZW5kb2JqCjk2IDAgb2JqCjMwNjIyMgplbmRvYmoKMyAw IG9iago8PCAvVHlwZSAvUGFnZXMgL01lZGlhQm94IFswIDAgNzkyIDYxMl0gL0NvdW50IDggL0tp ZHMgWyAyIDAgUiAyNSAwIFIgMzMgMCBSCjM3IDAgUiA3MSAwIFIgODIgMCBSIDg3IDAgUiA5MSAw IFIgXSA+PgplbmRvYmoKOTggMCBvYmoKPDwgL1R5cGUgL0NhdGFsb2cgL1BhZ2VzIDMgMCBSIC9W ZXJzaW9uIC8xLjQgPj4KZW5kb2JqCjk3IDAgb2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9U cnVlVHlwZSAvQmFzZUZvbnQgL0JDU1NHQitCYWdoZGFkIC9Gb250RGVzY3JpcHRvcgo5OSAwIFIg L0VuY29kaW5nIC9NYWNSb21hbkVuY29kaW5nIC9GaXJzdENoYXIgMjAxIC9MYXN0Q2hhciAyMDEg L1dpZHRocyBbCjU2MyBdID4+CmVuZG9iago5OSAwIG9iago8PCAvVHlwZSAvRm9udERlc2NyaXB0 b3IgL0ZvbnROYW1lIC9CQ1NTR0IrQmFnaGRhZCAvRmxhZ3MgMzIgL0ZvbnRCQm94IFstMTQ3IC01 MjUgMTEyOCA5MjJdCi9JdGFsaWNBbmdsZSAwIC9Bc2NlbnQgOTE4IC9EZXNjZW50IC00NDYgL0Nh cEhlaWdodCAzNDIgL1N0ZW1WIDQwIC9YSGVpZ2h0CjI0NCAvU3RlbUggMTAwIC9BdmdXaWR0aCA0 MDYgL01heFdpZHRoIDExNzcgL0ZvbnRGaWxlMiAxMDAgMCBSID4+CmVuZG9iagoxMDAgMCBvYmoK PDwgL0xlbmd0aCAxMDEgMCBSIC9MZW5ndGgxIDE1MzIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4K c3RyZWFtCngBlVR/TBt1FH/fu+v1CpS2UGvZseSODjBQUvmxMUmjF9bCKoniittdlR8VCgXpaFjB bWTLuanTRjf/0ajR/9QsgnpINCUa00SXjGwxTFyci4kaw6IJ2R8SnWFr8V3bEYN/+b3r+3w/7/v9 vvfuffteYnIqAmZQgYbuUDg+DLlhWEZwD8bC8Txn9iPuGJxOCHlOLiOuDcdHYnlOpQDImZHxY4Xz zDjyymgkPJRfhzuIe6KoyHPSgrgrGksczXNGQuTGJwYL64x+jo2Fjxb8w4/IhcPhWAQRh0FDIcQn jiRyFAwvIt4Xn4wU9hMZeQIISoraBfcAg3MKOJDAjipgf0CuPxgmwPeBK+f7Ld4/6dMcKgDmNvpV HZdfte/Orty+bGKNA0hpPJgfeMYo3zkMYBrLrmTWTWzOUmExB5iQonpJLC8vK7PZrFaLpbTUbC4p KS4uKjKZOI6mKYqgFfJKimw+74/6/te7YGA6oH7ByKKcZxg8O8+yKLNtm6tUF+OAx+EBuASfwluw H34lR6g1yNBLtErNUBXUDdo81vBF4uXPrr4Ob9QFlmYbzxw6efsX19dPJ+ztG6ufdN7rvPJH5qdU vG7jpaq5R0KZ65PepuB31zo7V38/9mylK3tr+SLFH6/gNxbCVebnfku+PVy8+tGKbaiFWfngxIPO 619Jx99tu/ThSN/P354brL1xYWlnbaziy0i6+b1vDnbe+qu20cTN7Pv49NrcqYetFxZOPtp386Y6 aHjihfXIDFjOnZqoJxfXPW0OQ+/UO1NX7a+97xn+3F41v9TUmO7lrtVOvIm3EIY6iYB72i9odLXf FY46XdEBXwPm3N2VArpbnifkrKKnNgW+nYt4c3R/Hy4XuwXBP+rTyACSEjcq6kScmd1CBxrqOCC7 FCEpJANDSaFDiIaHNKY6h7gQSSoeQYOgPIqyRxY1SeG3phFFaUM7pbodPILbkwpaGCtYQMypPBnc ZHF3YdQ13fJjsqb6eE3yKbwoCn4t3S1raR8vKgrusm5FihGfGHUWYrZhzNY6XC/LWwnKmsRroCST us2g7BI1NZnkk/gdBZ6C9DYFge0KqaDA1KENPaUponajMQSXyOdyLLpEjFPRk1zu7grKfoxUVBqw sEBlVHgK//X5egIoARZ/AEtbGsC6O4saClQsI9Uo440Y4aAkEI6TTJSRYQiwBoamDIwRjKyRUIQG rI+OaU+rEx7yerzWjP4SjzeDJOOFxvtJILqIJrlANKxJB+S9ttZF4DbTe5Vmm2irFm2iSkNGpSCL pfr3eZXVOwKtx8m4YRY7gQ12QECqIDwvVQLDgJkxlTEOp4W1F2NpOu66RnfoNqM/d506gP+3U153 Wm13Ve1uaW5yGP4zYdyh3lBNa3Y69GSoZk/2mRzr6TnU01izJXK5QQGwqUF1brJd6L1nNqckUFbo NyyUArTvCwY72+vbwyPRIey3ek/LDytC5WZh6KqtORFqdP4PlB+A1gplbmRzdHJlYW0KZW5kb2Jq CjEwMSAwIG9iagoxMTE2CmVuZG9iagoxMiAwIG9iago8PCAvVHlwZSAvRm9udCAvU3VidHlwZSAv VHJ1ZVR5cGUgL0Jhc2VGb250IC9QS0xRWFYrQXJpYWwtQm9sZE1UIC9Gb250RGVzY3JpcHRvcgox MDIgMCBSIC9FbmNvZGluZyAvTWFjUm9tYW5FbmNvZGluZyAvRmlyc3RDaGFyIDMyIC9MYXN0Q2hh ciAyMTMgL1dpZHRocyBbCjI3OCAwIDAgMCAwIDAgMCAyMzggMCAwIDAgMCAwIDAgMCAyNzggMCAw IDAgMCAwIDAgMCAwIDAgMCAzMzMgMCAwIDAgMCAwIDAKNzIyIDcyMiA3MjIgMCA2NjcgMCAwIDcy MiAyNzggMCAwIDYxMSAwIDcyMiAwIDY2NyA3NzggNzIyIDY2NyA2MTEgMCAwIDAgMAowIDAgMCAw IDAgMCAwIDAgNTU2IDYxMSA1NTYgNjExIDU1NiAwIDYxMSA2MTEgMjc4IDAgNTU2IDI3OCA4ODkg NjExIDYxMSA2MTEKMCAzODkgNTU2IDMzMyA2MTEgNTU2IDc3OCA1NTYgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMAowIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwCjAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDI3 OCBdID4+CmVuZG9iagoxMDIgMCBvYmoKPDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9Gb250TmFt ZSAvUEtMUVhWK0FyaWFsLUJvbGRNVCAvRmxhZ3MgMzIgL0ZvbnRCQm94ClstNjI4IC0zNzYgMjAw MCAxMDE4XSAvSXRhbGljQW5nbGUgMCAvQXNjZW50IDkwNSAvRGVzY2VudCAtMjEyIC9DYXBIZWln aHQKNzE2IC9TdGVtViAxNDUgL0xlYWRpbmcgMzMgL1hIZWlnaHQgNTE5IC9TdGVtSCAxMjEgL0F2 Z1dpZHRoIDQ3OSAvTWF4V2lkdGgKMjAwMCAvRm9udEZpbGUyIDEwMyAwIFIgPj4KZW5kb2JqCjEw MyAwIG9iago8PCAvTGVuZ3RoIDEwNCAwIFIgL0xlbmd0aDEgMjA3ODQgL0ZpbHRlciAvRmxhdGVE ZWNvZGUgPj4Kc3RyZWFtCngB1bx5fJTV9T9+7322eWafyexJmJlMMlkmIduEEIjkCSQRiECQxQSN BAQENxIEUVshbqwucUPcSrRVVKwME8QEsUatW1s/Yl2q1n5MW6xL5SufVhGVzPze95ng0vb3/b1+ 3/++E+5z7nbucu65555znvuwds265cRMeolAtPMuXtJN9F9YJIRed95la0OZdFYpIcqiFd3nX5xJ B7YQIv3h/IuuWJFJ571PSNngyuVLlmXS5CTghJXIyKRpHDB/5cVrL8+kQ12Av7ho9Xlj5Xloj8y/ eMnlY/0TtEdClyy5eDkgfnMNeBR1r750rZ4kbbcDru1es3ysPm0nxPH7H6etmAJqFZN/kHpyM5EJ I3ZSThZgJvXsOSIhzcsl2zmPz9r8wmJb/ZcGP++GkAf+Wp/L4Qv3LF3wzTcnR+3EkI+6ql6fFwBP mZKaTabZyTfffHOlPdMTLzn1K943v7fRIjxG9iKgYzxDCP0IILTw2IBiqdIGAZ0uHSY9saqh9LDw WHJStZ5fdntV7yFhD1lMqpG9J7mAZ+8Z0Jp49T0D1ZMzsLxSh0lDplhxVQUbA0ArR2DENhabA3gz wi6EZxBkDGgP+QAhjSAIDwsPJFuCaPhBNGRrdAkPYooanq8hpBEEjP5BzOVB8vlYjohR/XxANfPu f65jZQs/B5YNTztCL8JehNcQJLIaz10IaQQBsQdQ9gBhwgPC/Ul70N5oFH5GNiIw4W5io5QE0frO AbtOm7sGbFlVWqNduIO0ITCSEGaRYQSGZm8B2i2EoXprsqxSJ2HrgNFaZUf97Rj0dgxkO7rsx5Pq aQ0xXn/7QJaHD/7apM2h4/0kWRHPRAbsvqo2UOFyQoXlwiUkQoLCBsBxgOcB5gIuFZYRiz5ObcBm r+pFfw2o3iC4wXFBoVHwkCrAJiFAsvVq65LWTD/rkkUlVZjxNMGnV7EJFhJHVYOgJKuCoacETSf+ lgHVxMe3JWl3Vz0tXC8oxIVavajlDdqeFoxYY6M+k/kDqqWqr9EszMc054MsQYyRgsr8qQmXJNFQ o0NoFnKIB2UXCrnEDdgijNPhbuF+0oL0fQPRnODwU8JtOtatvFF0PyXDWlMGLNaq4UZVmILShHAT FuAmvfO+gejEKtIYFYpIBQIDjTcithExu7ANsW1YtW1YqW1YqW0Y1DZwHxG2omQr6pQLV5JuYT3p Q9iFOGcrdxIE5ZvBncwvqhoS/IIPhLE/BVJS5AYGVCsfmS/pzNKr+QbM1qqGp4VLyRwEhimvHfD6 qlY/JZToUykd8GVzhO4k2PVpwZtZGrTk4UvytJADQnDC5Arjku5gojGINGfkIKHsN+wwJxJ7g73F l5u9hjSHvx2Dr47B/8rA9DA7nNkU7PccjjTmsA/R2GL2J7ILMcaeYs+TCjTwHhvkq8/eZUOkAfAd pJcBDgFWAx5Mhl8ODrLBAQCM/Z6kxcMny55PxsrHIsGCsYg3eyzi9FQ1FrDn2LMkB038ATAf8Fk2 TPIAnwH0AQ6zteRlwCdYDZkMuH8M/pod4izOnmQHyETAgaSVDyGRVDjYm5Q5eDxJMqm28uAh9jjb QwKo+stkNIDChwei+UHbU2iPsgfZ2mRu0NloZPfTdvoFKvWTdzgkTvZAspY30pc8FAoOsT7Wp/lq tQKtTHtIqCioKKt4SAgVhMpCtaGHQo12dhMEyC6G/cu241lLQgzcg6Ah9LGtSbE20TiKOfF5MdKL Z78e68KzW48RPO16jJce02MN7HoyB4GhjQ0IGxF6Ea4mIp5XIvwE4acIV+k5axFbh7Ae0qQbGN3A 6AZGt47RDYxuYHQDo1vH4D13A6Nbx+gCRhcwuoDRpWN0AaMLGF3A6NIx+Hi7gNGlY7QBow0YbcBo 0zHagNEGjDZgtOkYbcBoA0abjqEBQwOGBgxNx9CAoQFDA4amY2jA0ICh6RgVwKgARgUwKnSMCmBU AKMCGBU6RgUwKoBRoWOEgBECRggYIR0jBIwQMELACOkYIWCEgBHSMezAsAPDDgy7jmEHhh0YdmDY dQw7MOzAsOsYI8AYAcYIMEZ0jBFgjABjBBgjOsYIMEaAMcLW7xMON74AlMNAOQyUwzrKYaAcBsph oBzWUQ4D5TBQDo9NnROCM8wwcIeBOwzcYR13GLjDwB0G7rCOO4yaw8Ad1nETwEgAIwGMhI6RAEYC GAlgJHSMBDASwEjoGP3A6AdGPzD6dYx+YPQDox8Y/TpGPzD6gdGvY/QBow8YfcDo0zH6gNEHjD5g 9OkYfcDoA0afjvH/e2nY1bTdgLOW9dJiHW4kn+lwA3lHh1eRfTr8KXlIhz8h1+jwSlKrw/UkqkMs tQ7XkqCBJoO1tkYPRMAchMUIqxF2IexFeAZB0WOvIfYBQprVaHmiTZmj7FL2Ks8o0l5lRGE2eY68 S94rPyNLe+URmYUas5lFl6MQLeRm4FGyEc/PEXCI4NmgxxpYHP3GIWdr8Bdncc1xNPR5CX2thD5T QveW0JtLaKPKTqeiLulCpJaBALRdM0enBN9BqI0WToFkuunAZ95gMjohOEgPZUCxFkPyM4R9CA8h XINQi1CFUIZQgBBEqI2WAK1dyxtr8hBgIUIYIYRQSzweqIlOh0EbYhb60MALFqLyfgqLgPdUsrAC YDBZOAfgyWTh0mCjSg+QQq4V0SewqfYA7k0Gj6D4lxnwWDL4FFIPJ4NxgM5k4XiAs5OFrwYbLXQB CYocdf4YnIcF5+kzk8GFqDY3GSwGiCULo7x2CToqQGkxNOojgIjr2PmZniLJ4GTUzksG63htAynk C09lUqYPT0Kcp4UBDOjzIdouUs0UPBq8LfgZxvt3EBbs8W5oUAR4rWCQLtSMwUNlP0PlxmCy0cjr 43zYNwYTHD4RfKhga/AetEULDgTvCo4P3lQ2aED2jRj3Vr2LZPCa0CDbo2UFe4MVwbVlR4KXBmcG lwTPDHYWID8ZPCd4iA+TdNB2tudAsA0NzsAsCpLB0wswFgyxJXhFUAsWButChzh9yUTeNTi57BCn AKnK9F4K+pYUoPdkcEHtIHVoJcoxpU85W5mqTFYiSp4yTslVXAanwW6wGswGo8FgkA2igRmIwTWY HtFi3E5wybq5IHMLi4h63M54HA88CaMGRmaSRJbQylrnTaWtieHzSOvSUOL4vMggNc5dlJAiU2nC 2Upa509NTIy1DirpMxO1sdaE0nZ2+z5Kb+pAboJtGaRkfvsgTfOs67MTzmkoJNffmD1EKPVff2NH B/F5LmvwNTinOOpamv7Do0vP7GqKff/z/TCam9jROq898WhuR6KKR9K5Ha2Jq+eFzmkfYjZmaW4a YlYOOtqHxG5maz6T54vdTR2odkSvBm62ohop5ADVDFNJiFeDPJnKq2GNMvWiQEe9MAeoZ7SQqF4v arTo9UTK6+17J9TctC+EB+oUEPKOXuedAvKDOuAY4Dbti+KBWpEQbee1aHskpA+sWG8oGESVMjxQ hULf0xsKUr2zRPn3VQrGqtR8V6VG70vIjEdvhj/QjKvoVB1XEep8T8j/s9jyqTE6ULluw/PNyyPN XZHm5Qhdie2XrfQlepeGQvs2rOMFoYQQ7Vp63koOlyxPrIssb0psiDSF9lXqeP9S/Dwvrow07SPP N89v3/e8trwpWalVNkeWNHUMNNS3N/6or63f9dVe/x/6queNtfO+GnS8f+mrkRc38L4aeV+NvK8G rUHvq3kV5/u29n0GMrVjGtaVwwFmMoKHu7LDHVM99u4pnKGHJod9G7IPioQ+TEyxjoQ5MjVhQeBF ZY1ljbwI+4wXWZFtGyvybZgczj5IHx4rsiPbEZlKTi0E4fitiZq5rYnwvEXtnFUSGkjwn9bsUv7T i32keVUT/iG9Vg9rL117qkUOCa/577+1/+m3bt26S9fisS52KSGtiZJ5rYkJczESRUFXXU0dyBt/ Kk8Q9Lx9qto8mB5GYQyDoGt5dzwWozFQUDMSmSisX+5XGLci1g4EcqtWPw29YSMCzGG2PglXAi9a P5BXAGsJVcprMhDmKk8nA+Eq9DBQC1QOCzJQc5Qh0lfQV9ZX21/QX9ZfK6P0wEPIDD7Ej9Jk+UMC WRu79BQxEF3bAWJjWLy/+5M5uXrH/TwSi3XELqU6vU7V/x7q+Uh+T1jMUf9dqjfP6a1TGE8eBdF5 KdYj0/s6nuK/TETHBZ11JOSiVialZ/HH9z+k4Co6SHL0sJvkiFHYWCR95FRIrUof4WUcsk8hyeFB 4mHslySPkT/QIhoiA/Qb4iUnqJ9Wkhngzq9gT+wlo+QOmPfzyQ7qJPmwRheQGVREnRi5gd6Tviz9 CTmN3EoeSD9Jr0k/ivKbyYvkBEbw3zgxa8ls1F9AlpNPhA9JR/puYiCbiYlMJmdSD1lC3sbflxjH beR28iv60/QJ9Ooi16C9etJIGtPPpk+SEnKD2Ce9oz5BbiFPUTl9XnoVNKQ8so3F0m+nPyBR0kF+ Th7DmGJ0WJxOwuRCcj3ZSf3Ci4jdQX5BUtTMOoVp0jPoaQZZSC4h68k28ij5DXXSNukd6Vj6J+mP wIVZpAhjWkU+oTV0FntQNKenpN8jZ5Mh8jLmy/+GxbPF3dLZqYb0fennYH0/SY30EH1WqpJuGr06 fX/6cfgro6QSFJmNfpaSa8mz5BXyP+QfbGN6I5lO5qHnF2guDdEoKP4287MNbIPwBhmP2XZitOvI LpIgSXKQPEWeBm3+SEbIh9RFs+lMupTeQv/BzGwZe024R9gvvClS8RHQO0IKQKO15EFygPyOvEpe oxLar6Bt9AK6mt5J76MjLME+Y1+JBvFa8VtxVIqmRlLfpmenv4TNHSBnkCvJRtD252SA7Cf/Rd6C V/Kf5Di104l0Jb2fJugI/YypLI/NYd1sB6znXwqzhVuEZ8Uacap4ofiq+J60SdquLFFSJx9K3Zb6 Zer19JPp18E7VrQfhQNnFbkaXPEgeYa8gdbfJX8if+H8g/Yn00X0XPRyKd1Cb6e/pC/Q1+mnmCU0 DvzlscmsCb2uZmtAp2vYbex29P4a93TASfEn9nf2pSAJecIEoUe4X0gIg8Jh4W+iXYyK48VKcY64 SExjZaqk06V50sPSHuk56ZhcLy+Tu+WPlWuU6wy/Gy0Z/e8USa1MJVID4F0DOOlKUOJnBE5A0OIp 8htQ9L8w4hHyBVYhQMO0EOOuoy20lc6iZ9Fz6HJ6Dd1Mb6U76T30Afo4ZoA5MAVjj7FGNo8tYcvZ dWwzuxG+jP3sIHuFvQ2HylGM3CtEhJhQKcwQFglnC5dgDmvhyrsOlL1FeFR4TXhD+Ej4WDiKVfOK 48R14pXiXeJucb/4unSGdDH+HpCekYal16WT0kmZyQE5Ry6XL5Aflv+iyMoEpU3Zqryp/NPQTXNo CUYeAu9/92N+7MFx7FHmEjfSo8jOhdVhw8xjWId52BX/JA1CCuti5eUYm5v5xSyOLmtiAorgWvoU qaEvkI0yE6AYiiMkSd9nI+Lz7DTyFu2ifnG3cIn0GxYmeyCN+tgh9hSdSvazeraQ3SsQ+iFOxQ/B 75eT2+mF9FKyhx6lk+hVtJZuJG8yjzCPXkfq0w8wkap0Bj1GMAJytbiMnPvdFP5jhNbBO/9J6mei Rfwp5NMg2YEVfYx8QB8h31Ap/RmkmwBptARS5gbw+/WES71O7LON2I9+SJCL5NfIfirDh14rTxGv JMfI1+QT6SA4aiqk6UepVeLPxL+ma9Nl2GHYZeRh7LuV5HTsmA/BJU8jzVPnYKcbIUvgfCRtZBGc Z1dB6t2STqTvTV+bviK9mvwWuN/QUvoN7ceOGARGPfxeL2OXvEu3Yx+e/h+n9/+ZmVpGhsmn1EcL aBX2w1HpMqlPelTaL/1KelWuBLWvI/eAo/8CbjZiBueR18mn5CtqwNr4SSmJY7wTMfZ2chHrEJ4m 02iAdGPPFkGOTx2byaVo5RpQ717s56exN45BTpxDfgX/GaNezOg89G9AO62g82JyKXkIK3gtHUDO MkjtEvJ3zNtKJ8I9UEo0tLQDUmsYY3qf/A3UTuvjKoVcaKIL0dZX5CyyDD1MIG10H1bgAKmDZG0S fgd651M7mUrz6C+A14UdaoXzu076K2WkNDU7PZGtEp7GGZNGfj9Or2xyGu3BKGyYxyhx0zmkJnUm xvAGFcQE/b0+irvY8vRmYX3qIvJb8gjWRBMvU5oI0Rrnaw1TTqufPKluYm1NvLqqsqJ8fFlprKS4 qDBakB/JC4eC43JzsgN+n9fjdmU5HXab1WI2GVWDIkuiwCgpbY60dIUS0a6EGI1Mn17G05ElyFjy g4yuRAhZLT+ukwhxvCUo+lFNDTVX/EtNLVNT+64mtYfqSX1Zaag5Ekq82hQJDdJFc2FNJG5sinSE Ekf1+Cw93qfHLYiHw0AINftWNoUStCvUnGi5bOW25q6mslK6z2ScFpm23FhWSvYZTYiaEEt4I937 qHcK1SPM2zxpHyMGC6aYCESamhP+CFDRjFDQvGRZom1ue3NTdjjcUVaaoNPOiyxNEK79xvQqZJre TUKellD0bkKroN0myPbQvtLhbTcM2snSrph5WWTZknPaE8IStNGccMTQb1PCe+UR3/dJNA49efMP S7OFbc2+VSFeedu2zaHE8Nz2H+Bmh3kLHR1oA7isoKVrWwu6vgEr1cpNqgS7vqM9Qa9HlzAWCvRZ ZeaXsWQKui4IJdTI1MjKbRd0YWkC2xLkzCvCyUBAG0qPkEBzaNv89kg40ZAd6VjSlLPPRbadecWA Xwv5f1xSVrrP7sgQdp/VNhYxW34YWQ6iZ8r0mF6dx1rP/I6ylI8xMgP6eCJ0XggjaY9gThP5Y/lE su28iVgA/DoosBLLsCKrEuq0rm32STwfU6QJqcAeCW37koADIkc/+3HOkrEcucD+JeGFnE++Y7UE XXIqnojFEiUlnEWUaVhTjHGKnq4pK71skE2IdNvhG5kAQ5C0gbZLOiaVg/zhMF/g7YMaWYpEondu eyYdIkuzk0Qrh73EungJFjBT4l7AS3pPlXyH3hUBJ+/nfgviThii3/2z2T1ZzSsnJajnf1O8PFPe Oi/SCusm1Lyta4xrW+f/KJUp5wQF3VA2FktkTWsXshnyeIxlC3opmPKcRd9VQaLdnBAL8E/mg8bu EMCUegYNtSTsXdMzzw5jODy2Zf4dZ1Ax/ABpMH2MY+nge7SxWSQmxcbGmRl1YvKP0j8anXmb0Dof Eoe1zl+0bZvxR2UtkGXbtrVEQi3burYtGUz3Lo2E7JFtQ2w3272tuxlSKLOgg+mD27MTLTd0YCor 6SSwLSNT90Xolrn7NLoF5usQXEyhLfPbk4yyaV1TO/blo6x9KASRq+ey73J5nRBPkVYKRk8yg16U PaQR0qvXFfUMPX0e3Et6XqYS8ig5b5Bl8ux6vY6OjjIo/PBs1RFCPyLnAK5jdelR9ih5RXoJ9tRL ZAfCEmkhuYPHUX6D+FdyH+I7eZ5cRzr0OgvJTOSXipeSGYCbARcAzgds1OFfya3AvQ3prRwquWQD 8m9BOBNhO154cpwK9BtE+kbETWhbBTSj/hqC4eGP/8xEppcBhnBWZXL0bDy4ey7zE3QA58F/+Ek/ yoPNDX2X4OYA/xmhD/KfGcGCYMU5aScO4uSZ//GXBTvNDevDi1IftIcAYDasvlzuvcYYCeywPNgm +bBOoqQQ6f87f0X6sCeQCWQF7IJXYBcNsPMFES/bXxUdYoM0RXpIvlQpMCww9Ku7jQXG502TzY2W csteK7HusP7O9pA9236bw+G4NiuadcBV4nrT/RfPq5734UtFwxL+oJEqZOp+RlOyMsgatCwiiSmB GBUxRYnfIEspJhyiUaLCEPMRX8x+vH60frb9i/pZo/WkAXH7STwqK8KOsKMAD3huycmQMHxSk8i3 JCQOcw46R9hHb4IPQCJTNM8m6SuJydIKaIcCkQRKpS8YEQapQTNxu5HRP8uzpvli6KNz1ihpmHW0 jjqcdXWVFXRNT5ZQE3YLt9TQqvFo0nHiROpz3v661BB9kHKrouEJ1WCSjcogHadly/fSiSajcQ2N Kvk2nS0qMDq/+fzLxpo/MnqUd/DFKHXUEQfvIyvsdsmyUjhhQm3kBuovWbeodsF0toX6X7nyxu7Q 2pyluCRD06Ppj9hk6Q3QbqKWC6fxDCa4GOOaFihH/84CkvB34hdvu0jvZ9bR2fbjs9BTfUP9Zml8 7Cr7rysrFFpNBXrhG6lb/NJn37j4LnoFTf8F9gpfkfFatjCRyvJE0ajuFRiTozQkVUhM2mt4dQ9f hU5O+vrjpOFow1EMG9SnCK9Qf+ojuB4sHJ78J3+O7U9YawfRrpE2DhEl/Y6m1tbF5SI8FPikNLWo Ji5reCD1jtYWLkQZHsWkRCyRiozl5omkVmowX0AuYMuFFdJKw/nGjwXbTJkyg0oFo6qKikppiCiY iCKrohiSZJckyQajFsidYuRdmAK5cWMBEwRZ5O90NKusMEmEk8Zg9noDZJAtwdsGtAEW6AVlBlm+ pgZVWqH2qkw9yPKJiBpqSKKS33Tueaf4w3+8s+eLzh7f6Ozm5U1/A4lBlIb6WUfBMeX1o7GYTvDN V/1683hfDECx19dv/vWv98ls2vz2/WpctcRJrAOs1ZowwW04DoftEBHSqaRBNB5Mp0Cpk/tkcSL/ ddCezozXKxwW8EfDWYIgPZP6Ve/ogStSL7LJtK7kNy/SWakB6eDJbSw0OsL31g7ssqWgfBZkUil5 R2tYX0JXWi8v+Zt4XBTVsFuVi0rDBR5n0D3HzSrce93M7XZF8gqcWYaQqwAHRHZht9wLA7u1qHCv mZq5e1E1xc2D7AYtXDFeG982vmt89/je8X3j+8cbQuMrxrPxrrwQCWVVZLGsQbZ9oKxyXoZYfMfO snf2HI/1gOU7OT+Oglaj9Y668s4e7nMk7nRvMrfOjU6SAQ5692XVYc4dqMT3IEH4jlY27nY1hkCX TtKZFa4ax7BzFA8sEOwfWQpTR3VV7YQJNfFoYTQiOMJjiWhkB5v5+J7Ni1Yv3tTXef9lM1Mfpiy0 6LlflpxxVuvM0tcfpc7+2NR52hW/kQ7mnnPX4vMfixUe2rjs6R6LgYkvpn4pqWed3rRAlUaHUper 5s7ZU88p4RJgSfoj6VzsyAB5W5u9Sd3q2urZRXbKL6lvCm+avhTUArXIXGQpdhV71knr1E2SQclS vN4sr7eYlQgFklIk3SXdqb4ivGCSGugcCKEz7YSOwLRjhJPc4Yvr0Ah+gRWjeX1losGqWZ1xa+ti G51jozbN7YvbBmmRlucsMwq2z60LyedEbypQkUNz3IX9CrUpQaVCESBobxjI3jC2LliN2fbO451Y FKzJ6Bexzp4jMQ55pLOygnTSzs5OKsliJEQcdhIOeT1eKRqN5MkOu6e6aoLYQINTU69+lno/tYVe SePU8vCyqtQfAw9e9vPfvtx/2aMs++xjn9Cb4eu6hN6x69xEy5rrPk19k/r0MzAnhYeSiMfAoSbS p51mkETFUCA7gxKtkPZC3EiqIBZAPzKqBSYCe7JVYNNxWlNTIGSpsGgWwSKqIWz8Ck4ocJv5h9ym T6t+1hf1X2SOih8zmwQuy62TwGVgNg6+ZzZBwj6trKh2hN04UvRwh9hw8hM2MhoSqqWDJ1JPfZXq +Qqj5/urRB/9z7UCVZSMAlONBaJzr0AFgciShLErBgPGLhlC8msKBe23a3mapc3SZRG6Lb0WxifS bxm2iBaGA4hPZRgbNzOZdT/eOmsgdjPnni5m8ICY6dS3jqDPRshsHQ7+ZTanJgQhnfnbQYtYEy1K vTN6SDo4+gxr/KaFXT26EXO6AcuyH3MSyOohAioNVMXjoM/wQKRAh1qDyxsnkia1Sb3SiCQFpS6p Wzomib0SGJcJxMCEdymBJ3eECMOch/mkDiMlkkvEyl2ZOfWsGZtKAyhNO3vWYKOD4I4baJF08JsW jOM+cMaD0uM4tU/TAm0Kb1vEXiEGUQooTPjhssuVQ99TarY9xdcbhMo0zVsNu+/DfEekx7+d8RXn up1YtwjmqNL/0qyqIBv8gtcgOjFy0I4MOE0NnIYDZ3fGOdRK5s2PC1WKwaUoBsHAmCKoImMqEqKG OqKGcrFKfg2nA19fv2ZqM3WZhG5Tr4n1m4ZNLGSqMDGTQR1rlEPNOm9eXK360YobK79fcRweEJcg jL7oSOkHuK6LEOgjm8fz0wBnSuYw4cfGiKZaC+OGEB581E/idDFo+hHDhWhlBd69oVbvAVONoddU o0/stMD4uGEeHpLgEaoETRBbhOsNfYZ+Q9JwRJB/LbxmeM8ghIRyQ1yYbJhjuFXYZegX9hoSwjMG U+borq6JMw0PpEY0S3lVnIX4Q3HVIOdOTQ2Pj7P5eOi1W8aFkMLDwBTFxwSvUsoKlcmsWpnNNOUc tlBRXSxbmcWalbuVPcpvcQvvY/aR8jUzFbIiZaZyubJFeYzJnF84w2R+hFOJRztIJxab8vWmjp00 xNppVuoPo/twIpYJb3zTIhw6CYcW02XOCay+DTr7eq1AloZcQz7hdImeL70tMaejwGK1kmw7Fzw2 YvAU7uX7FuyAk4/LTs0TzK3I7crtzu3NlXLtth9yYs4PBdAse+a001dulG9WnGRcovZQPlAI0rHj KhLxM0jSsdPqDvpHaj1zw6NL75x9wSvPPrD3smnnTq/plw56wn/au3lwlcM9+gfxuVTX+KWNbSst uGmKN0sXy+Nw+rjh0bVpV23K3Ry+m9ztutdzr1e+3H6Vd31ok3GTdYt9i2trtkHOVQsC2a5cV9hf cKH3SmJYS2iHshKkvSJwxbgrQtuUrY6tgU2hu5S7TTscjygHPC963vY4arPbHauUVcYryRWKLNAz 4CC8iIj5nrzCwnyPQgSZRXPKbELhIDvjieicvDKVcYrZHHE2SOdpNuFNVY1Gg/5C1orLPs4xajo5 NUMVJVpJV0l3SW9Jf4kcKjlWwkqChf1majMHzRVmgSsbA8Ubnh+TG7OOntIijoxCdSANXxyN2UdT 0EOxN7y6kgAtgfTgzELoLPB4FagAhfKp04s4XIpcoNMaR5ibH2G4W1TrkSov7r14mmZ9sm9v6vHU 1dACZ+BFx4aaotTBurqRJ574858f0+oWdc679eDs8a+7IspPGuhNeEdwPr051ZO661d9l2jTfvWT 1LcnR1PptHty+JEqzmn8fIB8xcqEyQntmjrbDNtZygWmC8yPqrut/ZED1ndUo2yQjV6DxzjB2mJt sSkGu+pwWV02l32CdYLtdNs66xX2N4ymy9XL/ZflblG3+DflyqrHpZpt1nnWddbrrLdbf26VrCGL 2WWxmG1mt8XrKciyu2iXq9/FXC4SCnNGBku7icHKVd9CYrFbmOXN7MJ+OSEPy4dlUd7cHaGhSEWE RcLuH/JzXuWYrsvlKdfeOsd0N/0E0nm6s2dMP+MyqdMK80I3Z7iuBt0BawBWr9I5HeqZNyssjGeR iAPq2Sl+h0q2+u9v9T73bNdVFwykfvb2mvnnrqj/41sX1M+Znr//I+ngnN9c8+AfciZu2pP6C23Y 0xEevVeYnd8+debZZtiPlMxM/038B7i/lB7WThtyDOYeKHqxVISC5YaC5fbFlkvLi9bKl1vWFr1r fjti7jAusC7I64isNK9wnh9eVXR+6frcTbk7wmZnBBJsYFwwzqG23B+Iz82bG3k279mI2JPXE7k6 7+rIn/P+HJFjxhJLfl5+pM4Sj7QaWy1NedMiF1iWR66wXJm31bIt7yHjbsvDeVmqUbXIeXLEb/Rb PHlKXsRoEal3oU/zh+KrfXS1b5eP+Q6y5SQbZ4E5UBfMptllLoFMp9gc2oxAKF5BNbzG7KJ9tB/W 7zBeVPwvUQvU2fHms6xE9X2e9lKvluWNe1uVwmhgPPaMPWFn9lb6uSOjEfnLfj+m5OEW0D6iTezQ NW/dHPwitoarez2xLzpjRzJwTewINlBGmOpKRR7okZ07BfQ4PAb/msyqywN5AJD7StLJU4c1m7PO EnLWGfVg43kfa1Yz8ix1Rh8Puh4/Jq65oM4cWpp7knGSpSavBnScYZmW1xJ5yPhInpF04rDShWRW gYdrmLoSjz0crYlPmFAdEjPqpyK7XV6PqHMW101n0lBg1+abbzntjPjQ/+ravPHzR/DS0quk3sm6 6qqrZ5SXTqSJ19bdkCbPpD5NvU3/lHPLlivmxmdkO8dPXnjF493Pr/jHbyw959Xk1cULyldc/PT2 De9fSKHF4O0F9JAh7GGFrNEi5WqFWCG1qd2wC/tURaYSK8A7DniTVJiR4kauAdAyzSgrsCTxYhlq KZIOwdqGt8e9rI+JzG8YfSwjy1rntu9jWBXoqNyexgNW5JGx04JroLQTRxlcDrCuP0jNEm9MzRaf O3Hi2ylodkb6Y7znnQIfUxXt0VYqAUOOlOsJzMyenjOj4I/2DxzqBH+L/6zoCv/50U3RW/23BR4K DGW/FHg52yzLFrdH9nsK5WJ3h38928Qekp+QX5TNz8TftbPc/KpKR6klX4uNj+dreUV4+HPjq/NP 5rP8llzOmxVWW/y0XEpy7bmJ3K9zxdzcUlpNNORyLwcjC8JajqMhrGXb8fAF4mHcUXlCVMwWYymX +yjTIYp1iBqlqKFpLtO4yqihWC2ydATNu8wsaKZp2Jya1RM3B+bEabwLq3FTBaW0uji82Es/8NI5 3sXe1V7B669e1XhKrwSP9xzt5Mo/LJg1SB3hrqKjYDt4QGCT6xzPFeeeWIYNk+W5tKfj6ClFKh+q U3ZufH7+snzWGevgVjcMT8EKFZovSQ/szR4KD001F2qCy+MN6+eLHMnT+bN2At6ScesI7hPOovx8 mVA7oYYuT8d+/9qhwVYhuyD1qcmuCNN/0fmLpxfec+sLZ7Stbp1Pz53waX5te9MZzdV2E/vL+Ltv 79j6ZGrwhuvPyKn1G1paklsW3diaUxDKmds8OfV7Z5WvsH7ywqpobf5ykHwzuOF2XaPJIfcNEWf6 hFZpqqvNPj2bORfKC40LPQt9HTlfKXKNONkyOasmu1lstbRmNWffrtylGs1WKNckgEVISoqLr0WW yWQjRm/YEOgeR8fZi5kQhXFZrJlpN+lFf/7chgy9e+DsGK3/22xoOhkXE85hrnbj/KWd09o10wp5 hXGFZ4VvVY7UCf1M1/FBOrwlJCBYoTsLezizxUGyzdR/TfK5VGp06Ox9mjM+44rOa687f/kmGCjH bk99lPo6dSz13tkd97KSB+d079pz4H6YCJQswNwbsBP85M/a3HZbh7PDs9K2yrnKc5XvCv+d7E7z i/YXfX+wv+37RP7E8EnWJ+4TctbErInumc6ZnhZfh3mVWZnkrPXU+oT10nrbZmmTbav/Yeduz5Dz gEe1co71Zcc5fMLpilurLTzHPy6uQ+g3loO4PWAEzZwOE9FQlWioR6r7wKcHIUFEFIW8CuW5NEzK LTxiCc+xUmsgWwm7/IH2DCl1Px3M8BgUGm6Idx4Bx3I7HDAjD0HTjOGtc9WEWkkG03GbHKwoVqb+ bj1vzqqrNl7YtsJNXbEvXv0k9XfqOfrch+yzqnnzb3n06XvPXl3+q+fwrl+kCi3YzfWT+aDdkjG+ 6dPKnB1yh7HDmeGWnWCNE6raPa53HJskxM2T3HH/TKHJPNPd5L9LVTmfJCUT5xrNalKsNiyF0Vts tUQp5xSbjQRu5rwTNvhz2+v1zcln2HM8wzG6lMt4D3UtAbxiWSWvMq5yZrhF7sS72JqxCTqrq7zQ 6X/IKuKS1LeN+xY9mfo29VzyGuofdZY3Xblky3XnL9t879kduKhiwIt2/+3MfrL70TMuefAXT96/ C/NtxHwLwSsukkN/PkTs2Cctprq71LstO+wPS7uNT6lPWQYDBoOLTmenyy3GOeMethyQDwReMr5s ftv4jvmE8pXFkmPLcWuQEG7N6ojb3M+4X3ML3Gk1YBvXoEOrF5DdqEFFc7ZZu6zM6nPyU/2APztO q526Kyc3lHHp5BVnYKwsA305OtRsEKf9ICleRDCy2AlNee2AaHL6OLnzTQoJ03J3honKxy0et3rc rnHiOFvYoFlscRB8TBrGfuTbOYpDXXP5tCJXg08bZ8MDItjHZTVEXKyjYVQ/9J2YCGroKjoq6RD1 OEyeqgqXJ0fRbwriXsIw9AA+qSTU78F0YkA1TtGTjeEG/aJfxxEuQbmjQnNZNVDJyju18u7hxPI2 6JcBO3SHKew4+PqqdZcApAXcTlDccfBzHidCWFcHsrjzSZG97Bvqm/DJ3tTfr19FXW8cpU55VBOu WTJ1UaFw+cJz6uspPbP87vufuOVP4IVY6qXU01dtn04vunLjtGm4vAneT80Vu/QTtJzO1pauz92c y5xmS3flJktvpRii0IWFClrNqgWNTmPThLNtHa6OgoXFC2Md5RfaTjhOZDknW6o9k4uqS6EEelqL mkqPmUe9xptwZpnMFlOJ2VJo9XjdZRYz1BRfPueAJ3QO0BnA6tCJNGAyZ2BRSYYB4GXRyyvjGUZQ 3dn6wbcYroW1yaANFtbapNVYxhnB5FZ8frmk2BQN+PimU/3+QODmSlqJLTioGUl1ftjpr/hu930x tv/sR+2juprBhfXoF2OW9KnzD+s5AMbWV1A1x8EZR2L0O9MKC1kHG+WUiO/R961tlWtVwfnFK2Kr yrFvSadX8nCprp97NZBRYwvorQnDtGGREA7KLH4wcs0OYv8K2mjILVp4SW1BlmXD8NtXLaX0mRd6 qTKl+6mbU//4y8lru86/acvK5de2FE50jwt7KiPn3vPYEze/RU008Ms7Tp5+6OAF9UM3Wdm1j9x3 /88e7L8Pu+ZW6GwdkGsektRiNhrEpTUspH0qner4b/o1VRXJI+WzdsdKh0Qpy3I5nFl4hUJtnKi5 gqIajS630YMLysaoQdVC+fG9Kk2rVAWZoQB58vLjfb5+H+v2HfOxz314M+WKevjW12yo2++mx9zU 7fc2ZMQenBPceoJGgtjxsZQu/7gRdbSuzuHV1QuDrvFBGjpwQMKfDT9GXPezyjxK92x5esm9c3JT H4XmntZySXUKltHoh7umd2+5efQWVrl7UU3T1k2jn2HS4O3bcDA+hih/l7N+iKgYWYPD2KCpbSrr VRPqsHpY/VyVgmqXulHtR4YkyApevQmQ4pruqxNIJ3QCWZIV0cgUnBl8dmo4Py76DWPz0meVkeP1 o7ACdbep7miEkrQmlsUHjXBb5qWQeICKqZPfzhSj376HFdqKFVqMEZrIP7lX6k8DFofuc9Ou8pfF FcEuZMmF6gp5r/EZ48vqb43vGY3zhC6BWRSf2iKfZbhMlg6oH4hHxZPil7I0W5ltWCFfJd4g3iPe K90t363cbTAGRaccE2NSiVyilBjKLa1iq2SETgbDzGCUjPD6iSZJlPmrSJPJoBgFo9EkDrKLtYBU bqgLwuezHC7ZKO0lFB+c4r1dw0/GVEy+mn778R4fXOZ2rCFooJvDDfWwnzYbYAEb6k/tJiH9clIN j73mgT+ih6yBRgmT2IHrlPinOLbi7t0Muih1B70+9Xrqy2vhrTpOL0v9dPRc+qetqcfQ9ferOU/3 yGrFfC3hf2W9UgK3IA9Ln2fcsBulfmTA6YyFN0Jno3wT66uG14H/tmq6MrtGHwvWaMzrugG3HHdC KhbSyUOkGNid6AtS2OyWPea4EDfEffFIE2s2NPuaImZ4BovnqV3FvcW7in8h71YeMj8hP2FOFB8u Him2kuLy4jYUPFP8QbFcrAVy4g1I9+qFkhIWlUCuhwszo8ItBG2cqNgdjsLsnJxooRGsZ7NHnQ5t UU2Xg64GIw2yFs0WyI7m5iBvdQ7twlsN5O0viEYLucaRJKQQsx2wqQ0cahMw7kJULdQaEeoR8gvj hdqk0+Llha8VflAo2AqDhb2FAikMFVYUpgvFQn/RXzMbdsydiAMOLljIynq85YvBQDuOV3AAp7Yu X3quwUA4nno3tSbGzQMaw3tc7GGPV7cScC0Oyx3He6g8Wd/K3+/qDVTYPrxiR0XLA+ese6AIezu3 cO7kleNTH41rmNC4siz1kRi95ZH5CxbMX3xO087RDrb4Z+Prp2/fkWKs5Z5FpS3X3TV6EvxxC5d2 WDMP2aX5lCxv1iLDSoOID6iwWvYmQ5PtE7sk66LNoVgtstlkgqrGaNRDdNGGN8po5P9NtBlNUTPc RsVJeJc4XXUJZ6bHcMr9WMLplPo3IZfZGHhHrGt54R+JNJ1IEHRiR+qj/Ll1M9bG8PZY2v5G591z gmzcY8sntl2XTAXF6L37p6287idcrp0J/e1uzNQCbf9ObfrH9CPDV1lfucWX2Mdw3Polv8o67Auz Fno6fHeynfJOw53mQfUt9kfpffUt80fSR/LHFvtuw2/Z7+TnDS+apXWGrfJ1BgG8BS40eTmJXKLi qlMCXdnd2SzbGiY/Us8zRg6WfMzA4aefusq+AjrrKp9IO3H00c6suBNrT9wuGDj50YIfnHNnbhu9 939oPPXKZ7emvtpGQzsuueSOOy65ZAfLu4HK21Ivff4/qeevSz/8s4cf7r/34Yf5fLenLhLvxHzt uFtytzZ+Ytb0LOaMC3WWuqx4dpMwwzIjqyn762yV23in9PbjytfZ+KpO/qE95zGZcCvzlD3nKLZa bVG7XVfUTf9q0c06Wg+Wtx/5N5uOv2ml/LznNt0P9HT+/tXNOZ2bItyo46q657vTfTuVqx+/YIiy 1Mmh9pvnYIk9N61Yes2m887fgqVtW5b679Ro6njq3ZYFo58IQwN77hvY/cAuMORmQoRafe4Pa0V3 SlS10nm4trFOEsqd7daV1m4nLidwHzG72Zw2swbzHDODr3i9Vqwo4G+BycYiotrVCjhrRDWw0bnL yRY7Nzr3Og87RaedRClufRRrJsZ64WBj1O9oGKI5uGOCqx8wa79j5+Od/llHiI9fn2g4CtFQhxuw nBQ9+NjHi7f2Nfqb6KqJWHywd4YS8Dnzze6g/Zyjp13Y1NVx1umnTT6zXIzeeWFTzZfjGx9N/Q/m WAF+tmOOJew5bVh2yBFDodfhjex07nTdWXhHiaq4WlzM+ZRlyPpS+MPICcvxPLnYssCy3HKH6U7n 7rwhs9IY0fKboufnLYtudm52bcq7Nl+tjTbLLaaZljm2lvBUeB7zC6O15pow97PV5CuyUXKoYZ+l 0JyXlxdR8vO00kvNl7uucF9WvK5ki/u6krvdd5Tsz9sfsfTSm703+O4qeaQkUSp7wx4tHIl7tBx8 a+mhH3iop9oQbiu4uYAVaL7ceEGAO3M0L6RuWymtKKXlpbR0XLjCTu3VNKxrtJDMOkSVzLnE3035 Y5cPcpKfhLTVPTdjEkS/JcBf6xwlmaNUq5EplamHRvMmhFvC82mHdxld5T2OO9NeJgbCeawoy2Jm RYHF8I+2FJnaAjTQkqU0jHbiH1dfT4XOnuwhkpf+7QA07vBgBnKf5sC4fJ4eGQjmx/U0PMA8rWUj cqGFTshrydtpuT3v13lv5snhPLNFFHFvJKPTk2qu3Q94yxoAdQNIT+cVxDnUcnH2Edws4f5csQuv Fo5RfAZg1727ol4zy4OalGqziEgXi8dExqfg0WAueKq9Gtr1arCqvFpNbdzLPXNeraAYD7Rr8wZ1 J5joXRDQoJjaArQtkA6wscnrDl7QlrsRQIge/n5fV/i5TQZvb8aQ0y+h4Ojqwa8z80Y5P/2Kppqc DbYiPMKD6c8OWOrMLnMdjybN3Mf76T5TnW664fOvDjh8Mt5auLpw1BWC6eCt5Weg7rIYc9byG+Kw B6IVNOC85LyLawtc7hmpx87e8N6H771ZlPrKsbh9dUUoJ0qf7Wj/4vN3R2l57MwFRTnlIbfL0Tpl 4V3bDt20vXLK1KAnMs6ds2Jm66Zbf5/ALgqmP2a3SPfhTHhVKw4RmG7GYtsk60xrh03xu4lP8LiJ 15kFb7CTuahPUBWjYobBRDUb8fZ7E16hC2AYfsRBKibhPMFBMEDc/EYafBtmk1puLCeknC6GlEAN rcgnRL3OBe4G1y7XXpfQ5ep19bkOu465JOKyu0KuCpcIt87l/WPq4prWRC3kxGT9do8rPcwdvvzW Gvy99i/8XLTAZQaJC6v6CFQJR7UNPy5jqDvicHGTt9bLicYd4I5ITXVNgYNdOWwqzCmc6Vv60zOu rDOpV19NA2J0JDX/mlhO9nsl1XObK++gr4288YvUVtDnRkiZebjZ5SH3at6zHOc7dkiCKvvlelbv wLfMjo+Yols+DtHkIUa3y2VU5SxX1O2G87oY7lddS/DQNPb8/0ZLUA2c1XX1wECPGajhx+rBDw2g zBHzndqc0Q46M+6eKCYJM1G39CfwqDB70tOrLnz0DOoPntkwfU0J9e9asPTcR3ew/pRvZPnkOeuO 0GGYFJgnbnHiq6co7odka26pKFAeV/hD5g8Dfwi4XjYAqBszocCk+N0ilQWTwWA0m2CxMacQUAPG PFJmeslkxt4+pnngpzESyeQifhM+NDPFySTTZqJmRNJ+I7WY9bZMqjeOu2QqPp4xkoaGeiwjt5nr 6rI1p4kYRXwNoTJGZcTVOu451Hw5RXGTJajfYhEteHdgNzYY58AIGWQVmklkdSY4NeeIgniQVUBB 69VsZvzfCiGIEIH6zb8Gb/n5FcWYb9bRTqionX79Bpqe1vVTrpw66yiGgJcptCeGAwtfnPJfGFfH vPBI12bBAHkyNZ8WvjzJK1vtv6HhFKg3+pcnmj1lZWxchqa4IYtbgFFipn/SKkFZfK/KjIqkZhMP Gyc6cBXDpY4zOsxmZ0yIyRFTnVAnTxemyzuFnbLuPdXWl54OEppEURJVk1E0Z5OA6JFcqt/oNpsj pEgslMrUImOhuRKX/KaoLeR0dro0XZmhrieXi+slvPg0rjdvJlvEzRJefxo3m98l74pvSW+p7xrf Mn9KPhWPSEfUT41HzF+Tr8Xj0gnluPq18bi5bGyN4Ae08A9fB2CFYf2HNTciJhhFccEkQworYAGV rxrOd6ybl984yyzd/udMohQaTM8akI0q4BlalUDMIWAJZtxgFc2CZDQpKv4rAUWRcJeQL7DZiJUm xnJrA7x+WFUD/o8IKwmBaBcTE4JGBGrdH6J+y6+HaCCjbAT8s0YDvtHRgH/Ul1lFDEY3LvQnj+kD wlrikiieBA4DjJIvLOQ34fJ6v0mz1GGaJ5KWOszyBIS1STPznGMQ1sjhAKmRJFYI4JTo5gyhX6Hj XJHF/9GwINCOVII6XnqS2vb9lrpTe1L/eHI/OGM6G+Th2/fYntEF2G+4Lw0PGt9vO7XtRcrLItup DNH36VvKMQuuuAVEn1wk15KJhum0g/6UrlOMURpTJtBJSgudqew0nZBPKGqBGFVKjHFxknGaONv4 vGg4wzhf7DAuEy82Xk6vMt4u7lAOGt8S3zeeNFoEUYH57hFDYomxWmwwtoiqW/QbJxlnGy807haf FF8xHhdV3NU4NuD08V3+zoAbG5Mf4m6zI05F3CvmKwdgIKqBX/YZOVBcFk/juhavZPPkx4Uowx0U pkqyyTRWfAwXznixF8WmKJFwy1TC3S5omAZVNRE45i5OytUq9x2YDMvnWHZZRnAzTeDZrNrEs53H QC5o8fy9rEiWf79/e7B/vzjqx5WG43qMlGdcCVhzflc31sOv+PDbo5kY+EC/4uCty3D3E8YQGJlP MONk4DzBj+TOnp414I2eNdVUX1c8wbR0Y+oWetahF+nM1E66NbX7nfdYhAmp92l+Sh19nc5IPUnS abJOWEgflA4IuNSB9b2PqPv52IvxdSS3SPRfupD8IRP7l2cx0nA94GaNE3fhM7ffi0gM71DLSSX+ +6w4qSET8D1dE2nGl7Gn42u7mfhW7gx81TYHX6bNJWfiG+EF+Hb4LHyF14FvB88mT6JFitbQOX78 K2XS1nrG3PaFscY1q5ZcVDZ19UXLZs1H0f8DvBem3QplbmRzdHJlYW0KZW5kb2JqCjEwNCAwIG9i agoxNDk0OQplbmRvYmoKMTEgMCBvYmoKPDwgL1R5cGUgL0ZvbnQgL1N1YnR5cGUgL1RydWVUeXBl IC9CYXNlRm9udCAvVU5QWERIK0FyaWFsTVQgL0ZvbnREZXNjcmlwdG9yCjEwNSAwIFIgL0VuY29k aW5nIC9NYWNSb21hbkVuY29kaW5nIC9GaXJzdENoYXIgMzIgL0xhc3RDaGFyIDIxMyAvV2lkdGhz IFsKMjc4IDAgMzU1IDAgMCAwIDAgMCAzMzMgMzMzIDAgMCAyNzggMzMzIDI3OCAyNzggNTU2IDU1 NiA1NTYgNTU2IDU1NiA1NTYgNTU2CjU1NiA1NTYgNTU2IDI3OCAwIDAgMCAwIDU1NiAwIDY2NyA2 NjcgNzIyIDcyMiA2NjcgNjExIDc3OCA3MjIgMjc4IDUwMCA2NjcKNTU2IDgzMyA3MjIgNzc4IDY2 NyA3NzggNzIyIDY2NyA2MTEgMCA2NjcgOTQ0IDY2NyAwIDYxMSAyNzggMCAyNzggMCA1NTYgMAo1 NTYgNTU2IDUwMCA1NTYgNTU2IDI3OCA1NTYgNTU2IDIyMiAyMjIgNTAwIDIyMiA4MzMgNTU2IDU1 NiA1NTYgNTU2IDMzMyA1MDAKMjc4IDU1NiA1MDAgNzIyIDUwMCA1MDAgNTAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMAowIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwCjAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAyMjIg MjIyIF0gPj4KZW5kb2JqCjEwNSAwIG9iago8PCAvVHlwZSAvRm9udERlc2NyaXB0b3IgL0ZvbnRO YW1lIC9VTlBYREgrQXJpYWxNVCAvRmxhZ3MgMzIgL0ZvbnRCQm94IFstNjY1IC0zMjUgMjAwMCAx MDA2XQovSXRhbGljQW5nbGUgMCAvQXNjZW50IDkwNSAvRGVzY2VudCAtMjEyIC9DYXBIZWlnaHQg NzE2IC9TdGVtViA5NSAvTGVhZGluZwozMyAvWEhlaWdodCA1MTkgL1N0ZW1IIDg0IC9BdmdXaWR0 aCA0NDEgL01heFdpZHRoIDIwMDAgL0ZvbnRGaWxlMiAxMDYgMCBSCj4+CmVuZG9iagoxMDYgMCBv YmoKPDwgL0xlbmd0aCAxMDcgMCBSIC9MZW5ndGgxIDM2MDkyIC9GaWx0ZXIgL0ZsYXRlRGVjb2Rl ID4+CnN0cmVhbQp4AdS9eWAURdo/XlXdPffRcx+ZzJFJJscEAkkgBKJpjoAICAiBBIkEAblEjgAq HsSDQ0RBd8Vb8AYVGZKA4dglKqvrweKurgderIvnirIuiwpk8v1UTYK67/t73/ffX4aqfrq6uruO 566nmqVLls0iFtJMJKLNWDB9ERF/WRZC6C0zli+NZs6tfkJ0Ey9fNHtB5tx1Bc6vnH3FNZdnzrOL Cbny5JxZ02dmzslZHPvPQUHmnJbjmDtnwdKrM+eBD/H8PlcsnNF9PbQR5fcvmH519/sJrpPoldMX zMrUXy/OFy1sWtp9HsVx/6Ils7rr0zpCzL//9bkNr0Ct0eR7UkUeInrCiEpKyCRC5GflbKLgnF9X 7FN/s/epAdPsVf82ZBlQQMijf88v4sc/PHDZ5NM7OmerxIDxIEZRn1/Affrz0xeRoSo5veP0CjXz Jn6l52/0HjJRKmhN+CNv7pcKyVEkJhW2JLMje6R8KbtlUERrl+KtTk+pfXAvKYonlog8inwh0g6k A0gymSaFcVVFvhKpGWkH0gGkN5F0hCDnV6NIC5E2Ix1F0knZUqglGlEH50sB3BtAf+2Sj3yH1IUk kQjyEqSxSNOQNiBtRtKJerxkIdJKpANIJ5B0RJN8LXeVoe2+ltvEoXXeFaXidHrmdGqDOG2dXJ85 jhmfOQ4bmak2MFOtb3mmuPeQzDG/OHN05pU24+GtJmtpx2Cv5EUnvWj4IuSUHSR2SkmEbJE8JIXE JDRVlGiSszU3Ubr5gCQTKjGJkpkk0tUh0Raro3SwiXWx74iTRNi37HjmCjveanOUbh58IfuU7EA6 gCSxT/H7G/sbWcmO8jFHXo20GekA0mGk75B07Ch+n+D3MfuY2NlHpASpGmka0makA0jfIenZR8hV 9iHHGJFzuBqJsQ+Rq+wDdOsD5HZ2BNARdqSrg73VUlFZukcAyZJuIJLXDfiyugGnt7Sd/aXlp0Jg VAIzDYzaJ+WQ80mZlNOS1zfSLvlbquZG2tnfW6PJyJbBfdjbJIXE0JK38ea3SRRpHFIj0iIkHaB3 AL1DmpE2Im1BSiEBy5CrSFH2GtIbSO+QPkga0jgkA3uzBa9pZ4dbEkMig73sT+wV4sOIH2J/FMc3 2Mvi+Dr7gzi+imMY119jL7eEI2SwGdcJ7lFxVHEswXWFvdCa64x0DXawAxjBCPISpGqksUjTkDYg 6dgBltMyM+LEQ/aR10DDEdZCvhLHJ8mjBqLNi2iJoUDAKM8SA88DhGxzdHOCaYlN9+GUZ4k77gLE s8Qt6wHxLLHiRkA8S1yxHBDPEjPnAeJZYso0QDxLjJ0ICFk7e/j53PxIxdj5NDrYzq7CKF2FUboK o3QVkdlV/Ed+knkbH2gpKsKI3a8lC4sizXtp837afDFtfpQ2z6LNN9DmG2lzFW2+lDYnaXOINodp s0ab99EBGIpmqrX96rRS89Pm12jzdtrcRJsTtDmPNufS5iit0NpZrGUkqA6HGnFoHcyJjsVazzsf 3MfOYhjRGHA+Bp5wAPlhpC5xpqFSNCdTORDmx5zWourMee+BpQsHX8Bewo0vYRpeIp8gyZigl4BG L+EhL+FxduTVSNOQOpC+Q+pC0qF2DvqxQeR25CVI1UjTkFYifYekE835Dk1hZCFy3sQdomElyKuR xvIz9hJ+OfjFWEzLVkNqUr1A2hCi9jAdG+4Kswri9YIvOx0GRzu17v7B+uMPVmIcbGR3sA0kGxOx sfu4oeWn7Eg7vbclsS8y2EPvIWEZWEcrSYLm4TiANInzfiRk4OXlJMSewbG0JTQJt9lbEsWRvdTG 79od+Sl0LPJVqJ0B/DK0L/JutF2mLZG/ouSZ3ZG3Q7dGXi1pN6Bkf6Kd4rA3KqruCQ2IbH9NVL0R F+5vidzAD7sj14dGROaHxIVZmQuXNuFMs0cuTkyJXIDnDQtdFtGa8MzdkerQpZGqTK1+/J7dkT5o QjIDFqGxhSHx0nhYPLC2op3O0Yr1m/R1+rH6/vpSfbE+po/os/VZerfBaVANNoPFYDIYDDqDbGAG YnC3dx3VklzquXVC+OmA0JTIAlbBYShnM8gJowZGLiQplzSKjZowhI5Kdcwgoy6Lpk5NiLdT0/gp KSU+hKaco8ioiUNSA5Kj2vVdF6cqkqNS+nGX1O2k9I56lKbY2nZKJta10y5etCor5Rxat4dQ6lh1 exY/Fqy6vb6e+L3Lq/3VzvMdlcOH/TdZoyhsHJb8+c//M5j0J7NTm0ZNqEs9nV2fKuVAV3b9qNRv JkSn1u2h39MTNcP20H/yQ33dHul8+n3NxbxcOn9Yff2odjpJ1CNR+k/UA8bggHoGCGZej0QN4Uy9 +zP18nA/6uXyA+oZjSRP1MszGkU9mfJ6O5tya4btzEWGOr4oaRJ1mnzRX9Z5LQ918pChjreZvCbq vOZt5nVS54vHhEKoEkaGKjRIQqJKiAZFFdHynaJKSXeVW89VuVW8Scq0RtThGR5jPdpTx3oUdX4x kP8zOGtIMklbB9XPmFozK17TGK+ZhdSYum35HH+q+bJodOeMen4hmpISjZfNmMOP02el6uOzhqVm xIdFdw4S9/3H5an88qD4sJ1kas3Eup1TtVnDWgZpg2ri04fVt44YV17xq3fdeu5d5eP+m3eN4w8r 5+8aIe77j3dV8Msj+Lsq+Lsq+LtGaCPEu4jA8XF1Ow1kSP1QzB8/tjKzCfjamBWrH+JVF50vkHdQ zH9D1l5oK1uJOVmfssSHpKxIHK97De41mF8CTfFLNhTbuy/5bxgUy9pLt3ZfUlHsiA8hyaXLmpYR f83cYZl/TfhD0dJlfCoyeZKX/bd/qFKT0qYP47r1qFTRhFGp6vFT6nbq9ShtHFaPsoE9ZWZzTXtX R6awNwoH8oqSdK4iL6viZUZjd8X/iguiTSjG6OyBorGvlWphupQ01Uup8KiJDKxg4hQMw9QpdXuh S3Eh0VSPDjbRJG3qeRrvh4BJpoSg2009aemybqh7LJZ2H0XVpiRJNvUMSc/jknywRCbGamkSrE3Z SwJIQeUpEpATBPZP1xdIX/Jjem7Xl/w6P7KvwejauxMhW8l2OpdsJwfIi/QE7tpB9pA2wlWgYeRB ch35LVkDsTYFJbeSi/FTUP5bGuhqg2XyCATmI+QQ6k4mN5C9xEv9XV+RlWSV9BbuWkWsJIcMJuPI QnI7Hd21jEwln8g3kwpYOFeSRbS5q67rjq67uh4nT5A90h+7OomZBMkM/A51fau81/Uh6YU77ib3 kU/oXcZdRMNbmlHzIbKE3C81yLRrdtdptCBGrkIbZDKGHKIdLImnzyJfUD+9ThqKpzzWleo6iFoh 0kDmkPvJXtqPjmAxZWrXmK5DxIt3XI2n3kdayG782snvyBFqUU50Pd51ggRIMRmJ/rSRP9EOKd15 Y7oa46ZglApJJa4sJL8nr5A3aZy+wBYqFqVU0ZQVXW8TN+lLatHap3Dn5/QHdgN+K6WX5eFdQ4gN 43InH23yB/I3GqQldCydxArZQvawtIQY8Ma++M0kczHe9+LpHwONdjMLOyw9Jj8jn9Flp4922TAj CfIAeYi8QK3oaZQ20ZvoO/TvbCibxh5gn0q/lbfJf9FPR68vJQvI7eQZ8gN10gF0PL2EzqHX0TX0 TnofPUTfpF+ywWwim8++k+ZIi6XfyUPwmyA3yTcrq5XbdF+m69IH039O/9BV2rWajAc+3IjW300e Rs/2kMPkffw+IZ9ShZqpDb8ojdFaei1+N9Db6aN0K91G2/CWN+mn9CuIpH/TMwySlulYFpQfrgLF 2RJomL9lD7LD+L3JvmE/ST4pR0pK/aQqqV5aiFatkTbit0v6mxyUD8tdGOdSZZOyWdmqPKO8qJzQ WfQ3Qca/cfaxzqLOj9MkvTa9Kd2Sbuv6G/FgDiE9YIJVofXT8ZuH+d4EjNtB3qIWjF2QFtHz6WiM zDQ6jy6mV2Mkb6H30ydE25+j+zFK79Lv0GYrC4k292b92BA2Fr9L2Sy2GMrYXayNvcNOS3rJLNkl j1QkjZAapFnSUukaaZOUkt6QPpI+lU5JZ/Hrkk1yRM6RE3JSHiFPk5fJD8tfyF8oU5XXlc90Jt0C 3Wpdu+6f0GrO14/Tj9c36Dfod+vfNjQCO18iu8jzwMBzf/SodKNUI+0id7AyOQAT5k/A52lkpjSG AVPZVrqWXU/bWK5ytW4QG0QvIifkBMb6ZbaZnWKDpDF0FJ1A5rG+mQfq3PLTgKrkl8hxeT/69ic8 +Wqdhd7AvtNZSAt0pEroSH+Q+shJ6XVyRPqE6uVHyAeyifrocfaUNA5Y8Dv5fKWOxKQHyXPSYno9 2cVqCDGdMawHHl9EnwZfmEhL6Y9SF9Tgi4BFFdLfyc1kPnuPHAcdryX30JnybHIHKaPXkS/Ik6CK QuVKXZHOQ19lc+V1zEXbCJO3oXeVNJdKipvcQhuk+3XfsffJMnJYNpGPpWfR+sPsOWmMfEK5mM4B BVxPVpPFXTeSa5Q6+S90NpHoJJInHwV3u04qlWM4rgRXmQqethvUvRd8YLA0BiV+YM5o4EUtOMT9 +N0LPiEDg+aCxieDi/2JtOkmsnYyW7FRcB14al5PX0ymdD1J7uuaTa7suov0Aj9Y03UdnriVfEY2 kK10Vfpasgim5Pug7dHKcHZYGd7Vi61j77MJbNOv5xejnUf95Gv8nsPMnK/sI+vkd8kEUt21vuuv wO4CcNj7yGVQWI+hl9/iDRdIHaQsfRHb2TVcWoT+fkLGdz3VFaEmMqfrCjKW7CdP6BUyXZ/EHKfo X9Dfa8ksdnHXUmlWei7GYQNGQcNoLQP/uVUbWjtxsFZ9/nlVgwZWDqjoV15W2rdPSe9excmiwoL8 RF5uPCcWjYSzQ1nBgN/n9bhdTodqt1ktZpPRoNcpssQoKa6JD2+MphKNKTkRv+CCXvw8Ph0F039R 0JiKomj4r+ukovy+6bj0q5oaal7+HzW1TE3tXE2qRqtIVa/iaE08mjo0LB5tp1PG1wG+fVi8Ppo6 LuAxAt4oYCvgWAw3RGv8c4ZFU7QxWpMavnzOuprGYb2K6U6zaWh86CxTr2Ky02QGaAaU8sUX7aS+ 86kAmK9m4E5GDFZ0MRWMD6tJBeK4FY+R8mqmz0yNG19XMywrFqvvVZyiQ2fEL0sRriklRRUyVLwm pRua0ovXROdCx0mR26I7izvWrW9XyWWNScvM+MzpU+tS0nQ8oyblSOK9w1K+Fcf8P5/i4dDJ1vzy apa0rsY/N8orr1u3JpraMr7uF/dmxfgT6uvxDNzL8oY3rhuOV6/HTI3iuniKraqvS9FVeCUUyzzR q0z/MlpvXuO8aMoYHxKfs25eI6YmuC5FLr4m1hIManu6jpJgTXTdxLp4LFWdFa+fPiy0003WXXxN a0CLBn59pVfxTtWRGdidNns3YLH+EpiFQc9cE5CozqFRF58bWcrbGB8JTTAVnRFFS+ri6NMAns0a QNbNGIAJwF89xV2pmZiRuSnj0MZ16kBeji7SlJKnxqPr/k2AAfHj3/y6ZHp3iS5P/TfhFzmenEO1 FJ3eA6eSyVRREUcR/VDMKdp4vjjv16t4eTuLxxepsJ+50UDGYWyn1w8swfDHYnyCb2vXyGU4STWP r8ucR8llWS1EK4FuzRr5lY6eK55afqW558q52xvjwOQ2bs8ST8qQOPfPrnpdNXMGpqj3f7g8K3N9 1IT4KKjG0Zp1jd1YO2rir84y1/mAYtxwrRtKuYbWSVkMZRxiWZK4mtGQe6pAXa6zpOQ8/NMJpJ7Z rjcAK0UJjQ5PqY0XZPJ6UyzWTTP/203tXSf4XeLw823d3UgNTHY3NNPs1KBfnf+qeZZ10qiJYDkM mv26daZfXQOqZVo5svsAjIehH4sOTZFaUGYe/sHkGMBTfVZKw5DhykRQkSiuz+o+/VXFrO6b6vHH sbNX8XDwzHXrhsejw9c1rpve3tV8WTyqxtftYS+yF9ctqgG3yyBOe9fe27JSw9fXY8Tm0IEgD0aG 7IzTteN3anTthCl1e+DiiK6dWNfCKBvaOKR+Zy6u1e2JEqKJUsZLeSGvEuUnZBRFJ1uYQdTP2qMR 0iyuyqJAnM+Ad0OUZSqhjJIZ7SxTpvbUYyiTM2WaKOP94zxm6MS67mkRCMFJDziEFRo8husY7F1y KXuaXCdSJXkax8Eo38uvyU2kFukTpCqkSUhBJF42Bmk6EvRXUou6e3Ccokzq6lQmkU3KK+RypIcB Pyr/nWzVVZIFOH8c9Q7AOq3gdVB/k+5pci/KH8T1GSh7GMc6nD8CeCru64OjUX87bC0ccV6I+29D ypebuv6G+y9EWo3njcNxONIoXHPhOARpDX2FrKWvdD2K6ziSm/GuNbwcaVj38QL0dRWuV+O+XJTd DDiI93OHlR0phlSAe5uRsKaFAeNETrAipqPLcYxCovMS7s7q+ZO4ZY4/BQOsh41hJCbYWhbYZzZi xxqTgziJq6cyNBswDVhGPmg/XHvOgv6czV3feHYM+kac5JI82B/50D4ILKEiAusTdgvmj/RGKkHq AxumlJSRctKP9IfFNwD20kAyCFr4eXD4V0PDGEyGkKGwJWvIcDKCXABr6v9/fxeSUaLRHozXXLKN nIWFdQm9hu5kG1in7ISlskO3Xn+V/pDRZ+prmmZ6z7zdco3Va91rC9muslfbX1TL1a2Ol5wG10Pu JR6LZ4P3Vt+BgDswP5iXNSz0Wva87M3Zf87+R2RidGgsO/ZDzjvx5tyr8y7MO5gYl/9gQbCwtMhT dCr5XvFjvRK9T5es73NJ33llm8t39vuo/58rCipWoG1Qv/i0K1h0w8yTmCPmyEMGzyc5G5U6zmoK OUOicgfHl0ulVnYVvAQKcGPZHrgNfmzNyStX2rt+1HISheVmnQmKI/zJiqIzf2s0GCSJEb2hymQ3 NhuZEfxO81jt5caPqSRXMapZHeU0YFn8lD95kXoyWTWms0rtTDZUdVaR6ioVv84qZNThrKzkqW8f mky6pH5lHqlM5BtLD/X6qO+hPlIr9Z04kf4qk3N8vy49njUqbwFvz9NM+XYsezn1BlVtp2WtZLPN gKPm0G+2XUokVYpKkvSs46H1/qR6qqHz1HH11HG8vroKr2ugCeYor+hfUabT4+dRKf3k7j+NmbL/ xmvyz4snaTI9fj/9kdq+PdJ55s36dZv2/S4dSUd/9f5ZmqWAFajMaFIpcRp5C0ybJYpjG9YlL7VB ErWpKqsF8GOb3S6AY21WqwC+0ewmE6u12yI2ZnvW2d1G7uH5j3a64sRRnp/Ar8wLHVtlnTdirHLO y19x4/4pYw6nx9Oj9G/792xaN+UvZzqPfJv+Pm1AK59Of0xvhl/ERC7aZcLkP6Nrp+O0BJWqGKMm WkVMWHSUqohugH7gWNiMC2EBbcHcbzE/ci9G62TDyWPqccwQqea5elztPM4nq2+fMsyRW6fP79+/ YvehcZNLK/tLhw4tvi0xJjD9Erx3MG1n89gC4FuxFljEFklsDB2DV8YJCyqLUCEgL7qd48SxBvVz UjLmeN8+ZDFtcPWLeQazQtq+axef473I1qD1EsnT/Iw3tirTxB1E3oLrW2TRylMNDZhPPII3au+h Q4f4vfB3sUrgh0Qm7CFS18ct7krW3vWxFnVX3iNRJm2WdmDBdTmhYHQUBCIRk/QlYV9i3rbh5XLr CvS/Sj15XM3gyhqld7LhevUgx5lk0kPLKN22MV0XUL45jScwUtv1hexQOoCP2bR2J+TpxDrNFAzL ijtstfpAGF+KueeAFuCTb3QQC8cG4rVYkFt4GSnBxB9Cdgj94T3K2qn7r086iSfpavGkz4FFAvhW C5jNgBxE5SVEtVh4zsvOPfLnZ7bpogE1BLSEqDf/Hsq5F8mJZMfyyGWybg1ba15rf9WmGPVmP6tx jfZcGBiaNdE11TM1cHHWfP188wzXFZ75gcasa9hVuuXmFfY1unv1m9RX/UfYO7p3zB/Yg+c63mTU YvHyPkZKjCr4w8aIo4lwJmFDaRQCgJGN4VduE4SZBF02LE7yqeRdpw2L4awbwP8oUn29S3X2Lyv1 ep1Afl08Jz/hUr1lpf0daiKeo9fVzn9ry/KWpUPmvfXI29fcuWfbdddt23bDdRc2sLeoTM97dlpr uutIOp1+afu9z9OH0vd8dwIesHnfzl3NceUTTOAZzJ2J7NCiEudZ8+WV4N73GRByQY1EpzDJqFAL o6+ZROtNvE+ERnEvlpQEdQP4WnOICQ2JCbWJCcUoawE+XT1zIuYnaFE0cElw1cxI9FFoFF5DpgTM e2kVXUUypLE4CYbV7e3FyHDuSaqrfZXUwTllA2lIxuIOnU7fD1RYxs60DX5r4j2fliyVrz3/ushz I16bxvtWBVzWo29h+ko3LhkdqtXvculqre1dJ9scDgF8qxlVFVDYrYQ5ivp4hXCYXw2HbLgSBoIi b2f7NAsz+XyI0HAwFo2AG5S8fYjnh0jJcd7Yap4fhIsgq5sM+AstTicTL9SMdgegzHuOamani9WG 3byMP7sFj+akYjazWgDfaGIU/7u3cRrh7+NvEy/T+g9SBun2KQd0+/SvGF4N6Uda6i0TbfMtM20r nCtctzr3Oz8LfpZ1Img5YH7exbKw4JqthlXd7+Hi1QP5DTgaMVvBsEk16HSvhYLuUChoCAXBLQzB kGQNq+3s8daxDorlWP8u3gMihsNOmcXU5HsLo81xne5jN0JHUukAzeLYVQ1X7EK2kslsL8vFouuG nRlkB185leTsBYKos6r6eGfDMYeTzyyyNbbeSRtYTYbTChLgFDCANNCGJfX1eZ5YogIz3r9/v3Kg vmDCoAuwYwgwnV7Wn61gvrzH7v9u633X3vQg3eP68c9vnbrgqRcfnRrevn1w1YyOGw5+dvn83zy4 znX4/a+31z29//G10/sCUyZ1fS57gSlJWt89ceaAX+NY7A8RylE1acEJLYybrHaLPWwyFXrCITlc GFIKrXGrxR+A+IuC9bDaqD7BZ5FXT5RwhnaohP+Is7K6GkLkOLDl+Mvqy85K9WCylCcgi1agQCmq sa62yjWOyY7lWdLF3ivUee6Z3mXWa9yrrevct2Y9YTUpUYmv4prNFqtN1lO8F6Lm8VYNHdgHJ1kh sdJ+bRaLR/bvZY+TAJuj5aOVCpppdTZNiy6MsqifY3K0Wd+UELwpQUlCTTC0+OTz/EpiYy9/Ox3Q EniL7qUDIEg6NPPP3Kq4nd7VPYfJ42IWOc86mRQiCPOIaUTnVDGfmekEqYKFgVrp4npXhZfzLDFx +opzYM8c8knUe5GTeE5iUlvk7vkrdzx6fdlot9Pc1L563tz17rbY189d/dr8y2fetDH95TsvdNGb /fetSd103SPuh9nV18+46ZZbortemd0yc9qDvcO/u6Mj/e/PwWKD4AEqdDoTBieh9XfWWeZY7rds s7xqUUZLo62/lSUncJxYdJJeMZklPbGA2F+TZLckyZKVMItV1kv7EKRigCq5RTMRWUYV8ppJbmeX P68oJi07Um7q4YQAuGBitQC+FRLK1E4rNKtey4mX65tj/fQb7RDFGFWru5wwFfamhPOj4h4Ax3bz WWC7bO10vRjpb5LJBsEIT3L2UqV+rgo+qJ6sOlXlqOSDXFm5pndSBsnY7XYMt1ijs0LmOyvB497W zGWVUk6vSknOzq7ij6jHZKCO5rZo5kpL87hKi5aotOSEcOxVySsk66Ee96NljjJP3CE5KNvUeQt7 6Dcvv9yW7kenPSHtPnvhE+lHQNR3d84H4nHZH1OeBI+dlKEcrO2jf1Y+CDRkM4U9npCTc06zXZbD IauNEr0f8kJoBAIQVMblPqcSLv+ARJ0HQRmcMAqdgvfaRT4qeE32uuxNrqdcL1nesXyQZTC6/Lai oGTso/Qx7wUfk0Adqsvkcbpcr9nsbpvLbbNbQSKaizdEs22Bommzax7a3ajn7TJ9i5MPuJoW5c1z TFMXqivVDaqsgkj8gkj8lPhVP0NjM0Ti3xh17qf9EMd2N5BqQItt139HLAgv+SWx/EwuDVyjBI2I jjY4KksawBaOrTH0TiqYRYIZFVQDulkMbetXZANaccU8MQm6APG49dAEErW/89x3xU1t29dPXl+w 7Q72fufzY2+5s4Malt5+8o+dtFldd9vBR+9vGVvtZf98Nr18avrUn1+5s+Uo19rGYOY84HnZpIiO 7eZ6ETuNYBlIolkFYc1KrVaIxCwlJ+y2msKU5KkYgowGp4Z9Khf4PsHzfJgewN0a3KG3D6l/6JnJ huPqwQY+k73mB+gwveYZFhgWneKcGJ0vzdTPNMxzzowuNSwLrTKsDr1jeNvr0Ec5BeRnaEJXGxcM jxfFxAU9v5AfjUdj/IKDt3KclaGdWfStaXwiwfSMPW2GPjtAc5JdeU2qmEjYKCqsEfTixPNcS1Q3 Fps4mwvTSs1b7ZvmW+hb6ZN9UEp1tT4vf6mvneW2JjNKGijxOJdcgudlNLUMpytp4Cobl1KcfDi3 q6d6WCtcNdPp+2OynFxAxXOIQ63AmZe6f+aEOulMq7945PxJg2svY4P3z27rvOrNW/6WPvbQrV9u /6izYuwdFy15/NFrVzwtT7DN6zOmz/nffjijMf3DX9YdvwFLV9fRbS9sffHsRw1P17c/fO+OHRiA 6eB3XqyAW8kizXbQSmX8YwbZCF7GqbAPo7LRYm2C6cqHZKwQ0RIL2g1Nxn+QsZj7aUyqxmEhXQnl MQBGJLAYFmzD4qoxJ49fpJ7i2hi3DLj0rnQIHoT+LxYWjI5IOn28v9NZMV3atT59fFR/+x7ppn/d Kp/evv7utDN9pv2D7fRr+sqD3B6fAAwMAAN98Kj0YSSDg20WkhXuzXkk9DBW27u3MxbWKQVhpzVs tHABC+X/JNgkgKSd25ccDQFkFCcOiIt2P2RlxvgUAK8FoBt9pVyPhetZHvFEj0BfTzf6ZqyQX5gi 4EfJ49xA77ZInhcNEcYHbwgA3pBjwjLhgCjrfj9Xf/Has1oOr8hfy5GLv5DnvKc/96+HZPAuKvhh piXCJuIUVNHPSwu9I70jE59bvuqjGPtgcfF6ep281LDYvMSyzLrCdxtZR9fLqw03mm+xrLbe7nvD 8bLLmQNKaQlFg/wQjZbwQ68oJP5RLVwYtZCwn1jQjC296c8tCTcdMFJjO5utqckmuxaFxg8vg121 M3s7vXN3qb8pBdMZ11tymzw9inzUo3mYZ2PfcybNSdA+sAYaQreC4KxsKOGd40Krm2I41UCzW0wW 19fTRKJfOaePX2gCBCUut7dHb9BJvyQdOm/RFZ8f6Ph6/oI1t6dPvf9++tSdl62eP2fVrZfPXjtw 5MYJN27dftPKp6SswnvnbTnyyZbL7yksPrh2fxehtGPDC3TinFtunjZjzS1nu8ZsHPtk801Pb+2x ZTlOhsEVn8tYDc+bIxABeQ4IgFNikrkkEMIdwAmtgM+o3yGm1CGsT4ffUZw0F4S5Z2OsTbLZ3GQc pUKNtKqwKiiXNGCqipjxg8mGUqBYw/FSMTCYeY6IKueiH/2BI50wqH/RiJ9lp1YkhKdDYPH/x1t/ /a7/eBXe9POLtPKBwdFeLX6Jd3L8cukK74Lg7PiK4PXh9cHbwvd7twX3B7/2fh49FXWd533Yu90r DSycqWP5XO7GgUz+WFQXLQiPtU3jQjbEu0ffGpdhyW28EQi0rCRmcGTHr8XqxmLOp9s4m3acwyWH 5mCOjd2ctyGjbXJU4nz3nOzsYbukAf4TGMlCwTyf9SvP59wWRwJkwnosN5kTVBgMHoFLi7Z7r5s+ 4fpx/Wn/fQt2n6X6lzccv3bFPx999gh7/YmlV7dsu+76R+gEdcWVo1e+t8jinzSfGt77hKr3p/8O 39IX6dbnDkjlD+w++OB6sFxIUrgK6WpEHHEP4wDoEfAy641MVyVLVVQnw3MDvYawKMbiEUO3b2kx 55+wBsSUC3Jwcc8f0h44caT6Q4fOPgVnDkPcEZEt8OWE4Xe+RSvBXGSx64LXZbHLgrOy2HzLdBub AlOP9bcNs7GsgEEvEzXf4SDWQjcNg+Xv0OKxnFhVxBSpysmJVsViYXJp+ErTpb55ueqlURh08+KT pwgfBHcNQkuBpwt+SgxzlXoKxhkw85jDJ2zuhgaINjgN+3GfIR9mSLhu7V3mJGtjet4B+h4Ne/vm 7hvw+FVN9/v3BH54/V1Kptxc1z/I2g/RubnOeWMGDko+cdnAuZs33uc9dOTrJxsfXXrRhY1XpO/h PUYUFFHqobHriY3O3k1tdvgPoRp/39YN/ChIDyUntXpOelwq6GoVkZeofdTZhjnGRnWttFF9VXlZ 16GeUM0GpR4hRuPUOeaU+i/Lv6z/shlli2yVbRKW6RVZhj1l0On1FsAGxNLAg8Z9vnbhy4jqLW5c YhLY+I8a+DfkSFS2uHGXMawohrBO0rWzRZoRO06+0rDGxPZSM1iMWXNaomSWXrp4HEJ2PpGljTKV EcOrmcdZOvSfWKSNFmrh56pdf1jPVuqb9Uz/G/s77wrf4+IAOCf++YEjwYAKvPdXVwWPVx8T03Oc e+SS0BbX9EY4bLe5DFFcuUY9eNB28OAaJXMEkx2VMiPCL4xlzDbZLhn0e2Hqw7HN+W49XcI1TP4X h08vLsUkV0xK5Ov0Eiv7M6v76JnOBx55n/7zvuE5oTJl7+nhdH96GJtCN+256vbbuPzeBNz8CjPl EDqkaw+RMScjuOdNlofHJ8UvjzcZbzHq5gaXKYuMTeablZvNunyvUfLnF4W92UajyxkuKiosJKHs MMYtApcLMfgTOgv3GOtgSWllXGrrnJzJ6XR85HUG/nSAmHGdmwtR3cS8hCXE77CYeD0LxwsPr2UJ FmeHo8JRFeXXMaecfXcDvC5KTsNePgfAU8UZOp4DqCE5aCqni8wAcbc9VB+cjIHBm/kDCXP/BRKI BDRTVVni4K58Cj8GRh7EkixzxOC165FnNhansdKM8yIRh5lVmiEjwJtYYuvrTZfPXrVhcvML69O/ oefdOODCUcNvejj9AV1waWLolIET716f3q7srd8z69Iny/L3N8/e2dhXutjhvXzMyIWFZ7boLQPm D7/4GgQyUXJ51xfKcvCMbPLWrhlsXjaD6OHqkejfl9o0DkVJqXUGonCWZjeTW7I3kvuVZ6QnrHuk Nusr1jfJsex/ZTtszmxHdrZUpCtwFIWikRHWSe7JnkmBOcr87Gudtznvl+6z3R/aSh9nWx1/tbmw ahZU3WpQBmV+3FJQKcRdr4JK1U6onOUKW6SssGxUE/YLSSIKaRiM+BJRAzVAD9PVGgLhGRhtvk7S MIbrmMi5fwjWYIb5QPnmPlGo10uoTyfHc3LBf5y5ZaWyT5/gfIh53E6uJshtL56Xfumz4+l3H9hB h774IS0edKDsxd9s+/vUBZ+vfuxTxvp+d+YFeuVfPoOn+ujrvbbc9Wj6uzv3pb9at59z8ofBe6YA o+0Yu8+0kmiEDjVksNOhhu3EgCYbaUQ4howCqYwmjlFGuFUyiilnEGBJwUi2+n9GvR+Ag2JqfuxB vfB/ol43GnI9qhvl+vYZeo3WX8rSI8JfQYy/rAv4g36mM5tAByZJ5/G6vS6vpMuSfDHqtCHzG0Ix 6jU5YojAxfJJEf5upA0cQ31YVYGJwoCfebHSbu9aPrDyYfrTM1NuqF/adNGKOw+tSu+klXc+0bdm zD1XXLQ9/Yay15M9+rL04YNPpdPbppdu79+35qsnP/+hiO99exScgcfbmsndmkenhA0GvZ5IMidz kzFsJgbYcR3Y+OEs10+ULoyaolZmClpl4/95zDjd/ppcLYMuySCQIM4G7jAWeHTyWPLcoHXTKVZL HDCju9Ojcu7Zh6Xk2b9Ktyh7t6ern01bt3Mqgjoor0IfjOR2LSn6sEFPz3UDXXgwijUExoLm/0O7 NbPgMwLZwWTS/6X5Jj7lHP8zfz+3/1jG0OIaIucxv2z7Vumjs5+xVOc43u6B2zsvR6sXgPb3gPbz qEsLZrmzPKwxn15qcFGnlJtLYk4fyyOYBj78UT6ElOp8YZsEG8tIaSI/LxcLhuhXfqNwTHGjplv6 cgwHaR8RDFNI3yx+P1vSnE/zsxNREzUJ5dcUSMzongkQ8Ri1QXBQ9AeNB3M85+JJApFxzvklEnd6 AKGHyfGsUDAUCEk6S0LN8yQiCUMeguby/NbsGPHaXTFUdruiepzlKHkxGjIDs90OZGFjLEZyJWQi whwYztdYu4cT6A5chxuyX57jV9zD69P3ZmAffP3T7ZTBQCoc0mi2YEP6zS3vpTe3tdJxH2ym9K7E jthluxeuevGq2IA1lN15w4nzWfWztPPokqY99NL33qFNbbPbf9tnUfOY8beMXbv5YPrH5ukV1IH5 eBwcJUdQwnt7iBWjHnR5ymUpbDRtMb1pYiaFMbMBFBzV6yHyvhXjDeB7eAgx4DrhXsE59GvOJ3WU j7muoRm+GWbOUAufShMeSv4HKdeNfkJ6Av1+wXG8GWFniVppFK6URusiqzyo3g8vR4/oA+vFVHXP I1yQYv26ugq2HIoh5yDkQE5IceSPv8hOv/hip07Z2/kkm3J6OGvtHINROACCuhGjIJE3dlEECDK+ /NM64DyxDNRaVp459uqTORYUZo5xsfje0Zodzpz7g+IIq0ctjyoblR0KcBXK2gas26aIXII1tXFY 0DpBFGcUhRuJJFaZxEjChZfRAb7p0QG4fzajDGhilElUSMhH5XfQ/Z7Oc19pSzPUuYb6xUuqOrvV JXhiQZWcFMscB17kqhH6WNH1hTQdfXSQbZo6i83WLWXLdGutax06o6C3NjMnt3Ya1Mxy2G40Jkwm Q8LMXaG8ZQLgDQLAuYMAMkKbl2jCKWVuiLpo1KW5xrkaXbKLJjCXWGrIaDBf9/CUD7vFyCjn7p6e HFcbFmc0Gaj1XK4eT6L5pKHbJ9+/HzoiXFSJQTv0i2aMnFfwYv0LN71wiG7xb71uaNMN0vdnA+2v zfuY80VofcrFHKNpWgtLORWVBuPAfFM/XX/TCNNkabX0rqRfbnpfeh9CiOtiQjQWKOvldcrT8tcG xSTTfvI7Mo+XOKoZnbFyKcozKA2tlkqEEHQdbcW5ofso82N2rBzHjlanl5d/rJ0XwDvz8s4zGAOB 80C6RsTamhRJlqOKyQ2XPEIzonodtHadyYQdqTJlejPC400SMyPuo50N1OxYddyipJQO5agiKxca eJm5j55GoYWn9JK+na3WLOZoFN39H6iqZ+TPCaPvewS4ZdBWrsZ383JYrIvhBFnMjauqKqAOMp7A Dbkiz9e7cPQLLz4COaoMVVDb/VDbs6C2c636vQH1GVcEPznRanHw8Tqh+QDoVJuj3KDa1HIjh0wq aKN7i009J87MH/f4O4w5GLfiQKXMU05WJYjj491egN5KzNTHWI+sNOS4K2XNXcmHeVceQE9mTSDz FGzqgeqweElDknDDgWM/jVH80zs2vcjeo/rO+9hNXaTz1AmQfyF7t/O5s/eyz79OY8uUsBWKgDUK WaBZKAMHVIghyk0i9pRm1zMQ8v9xtE/14Pk5dUn3X9SlzxsyMj9DojEPmvcXkOm/tqMl9yLKzo6W qOxYz4qFoetUhkMabFasxkK6gTkAwAh9qxVwyOLkVKbYLRI+KcAMRrONGIzMZNYJ2kXkgaDX07sF 4aogy897VsYzcS8oOZvhN9y5w116PCahuqNDffPNDr7wmcRyB58t0hP2ENELfqQTuSRyWeSKyDFD 32txzrGYUCogMLk0tvE8YxGbhJUERStjMOOGH7UI5/YJLOdHTc5yu8gUi0SoDSqZAboZ7zh/pgD4 o0z72CTExqlskmYlGe1FvAj9yTyWcFdl8mQJcB1DDqzOdAYu/x7cw/Yt/pelrSTMbnCzLIO83LLa 8kcMpWWkZaRdKpTzrMW2OukSebn1atsaq8HMFEOltb9tLBslYcnAMMY6xGa6l90nbdJvMmyVntLr nMxus/VRGKidGeB566MYABosF9svphpMcIPBaDKD79ts+BCEkTU6m53MuZdtxXpN3xYlihCpvprJ YjRFNctKMzXvRSdt1IwrrB2GuxHOzqh9kUqx6j3p+ajSqDQrECVsa6uDi8YAjw1qqPJDKArbHHDw 3MmxBljqGAZO6j2/IOx3TuhrrhcGOw7gvT8b5r8jlq4zWIN/B86Pd4RdPiplAfUXCOq3dv2402bi 1nr30t7bu2OVtuKYWN7bXVFpK60Q4K5eKO1ewkvWw7IHjXKvGGQz9fr6V9AYBDQ2ajnuxa6RS/p4 A1jNo8q+9KQd6Tpl75nv77xg3APS2dPD5dfP9JOPnuHECCe9EgGlGOn1O52QQhk9w+C3eIUv/Ust xiEDXCNRvQHs1gAHkGQwyowZ9QZZiup0IKCMvAXwfUalUTKUBCVEC3JUUxqiZho1jzM3mheZm82K 2QArAOiFNUQoNf8LT+jWa2QhuX+l13Qb8SY+YT3CHEupQpNZLBjzOU0G7jdElVSukcUM9TBarCU+ D/5qiCIDBoOZcrMJc9Bm0IZXgv927B5eadBKM2BppR7clZu+uwMASzMgL41nYq/M8Uq9zY3k4ucn d7sAZmfAbIAeDv648xy77SYeQTqYwjLK9SvqePAVie195WwaE3ajvBKT1XymmdutM6D1f6S8jWjW LPKaNi5op27V7c7yZWXJsiq7zT5zlrzNt9v2sk3y+fxZLJqtOca6xvq0YJ1SZ5ys1jqmuab4pvkn BSdn3ea7j6mBsCQ5w2ajJxGF0cO1DM7oAGS0JgAnhPQD8LXgGAAyPnEAp4EY4B36YHM2zbYn+Bzq xAxlWEcg1GPrZ4z9jIUANXNMxuIH6+C2Pgx+l0pipTI3TYXFX6HCoYtQQAaDn8yga2n/1+nwZ9rS uw8cTu/d+kea/e4HNOuar+78U/pd9hpdQB96Mf3Eh5+kt+z6I53y+/QP6cO0nGa1UvNv0p9lbH25 E9htRZRvi1Y8yzHfzUapo9yXqJe4ZbMF3nsb8fm5yUoMzoQBCAVcF3FlYKUnNWH9GILRIMW/oN/6 v8qv/zABzykN5xxOgV+KMaF0X6QuFoPDB6bHzyR0bpgywnAPw+3BYjEHjHgeWCFsdlZ415gr7qr/ Nv1qei29dv/DDaP73pK+Vdlrc87avWBfurPzWYmuXzn1Zo+VYw52oCrfAnOwkwpfFLh7WgIf2Aj4 KzzMHMIuPVhj7og7ritSevmSiUFKlW9gYrQy2jcy0aDUxusSC5VrpRXKemm9cjd2pD5OnpH+Sv7q /Yx85vvMHwwpSVKkDFLkBuUu/6bEXxNynrcoUe6tTIz0jwzVRGrioxKTDHWOWs+U0JTsSZHJ0ck5 c5XLPfMT1ybuCN2R+MD/YSJg9lOsML3dklUJnvC2NiCrUva7/UXKQEVmkrdA0hck/F443OG7DCqM nxAlNxy2S8yQG9YbgwmXn5uwrh7MBZDRmAGcEJgLIIO5HNDyOOa6LmTBaFFzESuKJcCdzML2Mgvs NQcK/xN7x3TreQJ7hcOq26b1VRJHmfqq+mpGGsJ9DrYM3F6SB7MTftZfeLE4jqO0fzdyOzimVyTy 5X+vWVL58EOP/eGV9P4dKVrzKkf4Kzs/37rgGeD5++lPadaHc6ZeMuuhhuSaymsv6aBTj7xPZ+59 If3EkV3pT24vaXiQVrZQ02/S76ZROf2n/EH8m0KPgK/DlQi8z6FntZjTbKPO/qEpkcsNCyJw0XEd wSByvchzwesEsYugOa7hcCerKIFQyADO9q5PW53BchxPtObkl2Ml59PW7PxyrLWLI9ZFxRHX32vN TmSuo764jiO/ro0EkGe7MHRhdIJ5amhBaInxats19lWmtfZ7rNvs7fYvbV/YVWg4UYfd7XDYHXaL 0YldtEGvSYdVHqtF8RuNXl8wEEb4XEcmLNTnI7EcQcN+4IHNEE7YHoSymwlIBXBKKGUAjmo5vGc6 He+9riGauyi3OVfKzfH/X+k6w+H+OxkU58bAf7h2us3pwDE/sEYoCt30nYRWAUeyiIfLhMPxqBDO EoUW1ZNxwSDieEwGzV5pVwc6nANRVE8XCy3BBnU+GKh0QCY5kWxaqFKFaq/mRJDOCRmuG/S4p+ED dMWl3gwsJC7YiQjUij3C1h18Y8Vrb40pqB3ddfLF2isn94qN+ht9ZNWmi+55LN1H2Tv2j9c8+E52 Xu5Fy9KLad9b1g8w6zuXSWUV14yYI+JLp2KN/x/wR/VhHi1/hjRDbpKWynJefj+pMjRUGqkfnV0T GZY7PH+CVK+fmj254FaXLc4Xe7i4AeJlgLweINED5PcAqIw5zFTOAKicAVA5A6DyKW04r1RgTeSy XCk/r78dX4vIqymZEp0Ur827wjzPOt92uXuW/xrzCusK+/XqstymvNXSOvOt1nX229VVuTfn3WXd ZN/kCWfUA61XLOHMSgSNiUIY4aQw6JRL+yaw7Z4Ra69rsm7NYll5XmuvcH4ezVO8UH5OaplVqnAv YzjslYRnOwm/V0PGBcYPDXBt+RA/l/khYCYv12Y1KzH4n7OwlRQ7SXU0LzcHZXBGZvUK4omsdgNk z3Hs4RcOPaFZqTRKx9FGuohupDq4G1Kaqxd/pYJXo8UXGhOkkBZysW2zsVoAJzUrf1JhsBR9oglQ 6DfiEgAMH4QegO7FMITtQJYH+nY7+BrGHAPOYYVKrIz87LJHBGDyGM9O8h7BgY/eiVURKFFYq+3B YehTEPEVYQavW0Z65eaLEAAeA8A5JPfre9w+L0Jy+BoK55eJqc9bp/3x+oVPTxg3dVD6ivFzZ9/w /W8f+2m1ste+fVvqkcoB9P265hWrzzz0Svpf99F31StvnzykaVjN7LhverLisVkLX5g5940bbbfd ceMlY8vK5hcM2rV82eGmpV8RdKsP/L17wRX12PVrVVgYAw4nL7bwIhCiqVWYqpQ+r4tSVsKDHyjd RYXJCm6imTm6EkP36tL3gjdCXn3a42I6ixLhrk6jhAN4omH3fT+rpvDtwoxQO481fM6thoy479uH h+JxTzVzpbPldeksxbp9++l/8dYawcOHo7Umen537JZToXCscW0FTg+jQaFMKfkIMQSHHGVleF41 JoFHkeSWKLSIFEh5phJLH0uj5VbDrcaNlg7LCfg7LOMsCOwzG1h34IORWmAY4pHV1WKhGnebjMao QXHDZQmnWJQpbsYUI171VdQES2uWgc5iUI8Q4FhQOc5Amw0b8fUhvsppZVpB5TRGN2DnPYOVRTVH VBmnsD6wrjbCD3NCUWBhrW01N4JZcgtr8TFgCk9+HjULJhkMHMcaKLejuhc++bpnxopyw1JqIXZY rf9sMTpBC/9sgaEJkQ9rCn/1qFYAg6q/MKgQ1IqIeqFkQo2qj2HpU9hHZZQN7vzjX+j1vSM5vej6 lzvh2DvzbvOiq6+WC+Hg44iPbwgu53KTfqAlCknCUehM+CtJf0els79/JBnhGOkc4a8jkx11zsl+ 9V7DvfbugdTKVBoMJD3lSrllmDLMMsozUZloucQzU5lpme9Zqiy1XOuxKx5uiTvhqLJj56EYdDFr PsEZKiuz4G2TYe/q9Bh8E9YTjFab3W7BjnOnx+vz+6EmVbXi0xxRfrQ4HfyoTfHAnIIPjEXx4SeK QEbFYAh7/G6Px++0GI1hjxOg04HdGFHV4VZVh9NoMfg9ih2RLIShSYrkR6CfES41bGFhfqcTsQWG oM8XVAcb6XgSJRbkHiSNKHT87mgUS3uBQDu9bWdG6DUEA2M6YR53BgOd/otqZg37/Jy86zGPuawD g+BMQiSYYmN+aSzzRe6fTWdwjzU2LG8jq+KZgH6ZYbLtmGwHxwmniQftZDAgD4VFP2NAtwFuQ0mr RVM0VOJIsaQBCOHKIITLCbvZhZVxLIzo9JQ+nL72lU9ygwPwtYev/zI2Hur1+UvpK/elX8/X+9zp V5W9Z6vvufsfudLHncH0N/+6rU16DgZaw/rorBFnHuum2JHAHhfbpRWC0wao18wKnYWuAbRCGmAY YBxgHWjr56xwmZwu7hJ18gwbp4Q/FKqXOP7SP6pdgQqy8J7y7Cp6lZkl5EJ9gbnIlnD2lwcaBpr5 Ey8wTJQbDFPNU2wTnbPpLHmeYb55rm2Wc5m8wsDl3VXOq1yr5XX6daa75XbD886X5VcN78rvGd63 veP8Qv7S8KXtc2cxVCTs8bDAFaZ6eW428Byk9iPckay2WyyaLYhLVf0mBDnhhi81G4dUHT4dAq7E wEfgIeJzDNbPD1laA7DZaKT8QwkSmKgLn06wUlW1OhDCC2etkVnNksVlMlOdylxGk8sVJUbsOTJK iPmMWiS3xSKBIyGakbmsEGPEUILgXmBn1IKtGgivmPZ81LTR1GGSEIfdvmtaN/Np10y6Nk0dpx5W JWybm6aZoiTg9rwY48wnedFJjrMN/s8CxxuONwAQaMs9ihxjM/ka5VcoyqN28We3c6ysMgjk7Dlk kPRgPRxkwsnHl6F6RKBQ1szc9xqopFxR82dVQtx+DHMH1gg/wPH95e4sOGazKjH3HS0h7uzp0CKh SheUOgnJavP6qlxOrw/+cECSDAh6+cdab5ghOc5KsyU7dh4l2bEqs4lDjEMWlw9lLh/KOMQA9bQp czzXRJxCq4Skxq6vc5yyhySMrCJt+YKaJsT7DqX5b3V2suSJ9IZIrK8nvZGdZb9Pr11WPW4yXdU5 5uxPzNyr37hwmnJOWghZmwItIARmpxM43qHZsfPoAjrCcIFRMhnMxh7GabMQm5WawxbwvLAOCISA i06xOwTIk3xGxpdDKSJaTbLBZEpgnaDARH/CSmSUyuB2sqnAHCqnPINMeq8VRwzne5qLl+IWJazX 4UNfYaCNaR/dhXbJdJeWRfR9DBrE1oWWath+QUSsK7rxJGDl8hpq/JiTwAK+tIxw2MVV6jH1LDAj EweCkHwxblxIQXKBaYE/CR5Fl3DmAq85ZlwzspxYJfXH+Ix+vAtuI8w8H/X6sn60fwWX+FQf8xSy 78ZdcPZPcvDsq/XS1jbpmZkXbt9+Vj+b+7BvS89lfoyfngzXkrKUpExVdEmid4IQ9LrnZCUPLheu 1UEmG7EnBbc8a3hoDtc3YEegtSe5h/Jcu/v2cWExPI6Q/9vo7YijnKsff/dP79/NZyo/PZe2iTdV az5ZSep1qoRPTFGnToGG8Zws5emh6HwDbyp/27PGB3gwGXa7/tdX0Fg/+LD6xWhbuun99+nt6bl3 6/L5O7r+lsZ3bdL/wOoglFqKULmggk2SQwfz4T7Ws0dSwrBE5G3puTfdxP0WF3Z9KYfk87EDu4L1 0oqNVmNRwBosKrQWFcF17KnIGlg0sqjB2lA0zzq3qLHPOuvqwvu9DwS3WT0F3Pzj7iiYBdiPyKEn A08X7A7sKzgYOFzwF89HBYZhXoqtYCfB8KC2OaFX9wSY9eOWYi0/j/gi/mRxUXmlXFk8Ur6geJKh Pnm5YW5yuWUNNpf8ZP0p6agot1FZLckt95XG3P5phQsLWWGoxFZt22DbbOuyKZttO2zfIT5U7IUE FWRWAgEggonvSLOJmFKbjgcRI6RSQjT607v9d2NvFh/zk1pQKJU1+abSkGQunK5OJ7BeMQt5MVhO 3/SYUN9k/K65Mp8hXDiGzgvgpBgFlHzI9Vddba54Ec4z2mpuO7tEs+VrfIdQNNEnsSOhVIJShW0A 0+qd3dx+SPTlZZo1jBDhyo5KtqWSVsL6PqkN5k/05flzSnIP6A7rWERXrWM6KCywsdEt5H7eHh3W FDI5JAZ4P3IRRaDrO+Bnry0Wz44nsYKZxBJmw7nwK+BY8rPPuCV1DDvhMpuPBO/CQtti8GPOkoVJ xY0OfkHspyCL87ghwSONEejCfwgX5YaGPv98GCKwO7weBIn64gkEstvgXuNBRagkVc3cM2/H/hFN F/Sbf2Q2LatZu/Ka7JT/yjdvXfv0ONXoy9kf8l12cOHU0gVz5zyayL65dvgzqy668SK3zRrMzTNd 2eu8+sX+xbeN0qZf2PvqE2dWnTeAflQQUgvGlFzQeMnY864CRq8GRnNvO99F26w9QBWLPVfpp9Qo SnUkFWGRCKLwQkNCiyIbI7qBripvFYJ1RwcbDA3WOnuD99LgPMMV1jn2K71XBjsi71uO+I4EPnV9 4/sm8Pfso5GuSCCqlNhL3H2UarumjLaPUy5XjmT/Wz6tWlSPTQZnzQpBxTF5QjazP/dNM1XNGjzy zWY5E+1kFjhqFou5EC58DU6seGVcaMINxLEUwFFh6vASrYTPp3kpfNeIYeXsQRbGT5mUx1gHhX26 haboCSpHaDW+AYdt41j55oYUgLNaNkcvKlCFivV56uSoAosEBMv1DlQVwFnNy19NgU/I3fwVNBAe UfFLnwtmH243HoMCXx1MU4EnorDbaVctIvc4pnD/HFmMzaVlDtihcLCq2JCWL8EMBSJkYl5pr6fa luy8bMdiLf397/bPZ+W1dy5/9olly5/Fsue/N4zd8FpT+rv0Ow/RTQdqbzv0+psvHwIfHdf1pXQc /CpIp3Tba+W2lXZqN1MetLAIvE92hsx6f0jGd+Q8egPvvV70Xg/PAWB4npHzxbbkobdfFg4E7KzB DsIGsYNwhNFCI6GhrqG+Ca4JvkZXo+8B9oB0v/Vx9fGgxWANmOaxudI8ZZllkbXZ+qRll3G3aZfF 4sVC3N+ZZMuZZl9oX2mX7NhQ+LR2TR8RSdGIZm1EaMVRRFQYid1uhtDuaWMITc+1Gfhg23Ky0L9c czIC+wLavyYmSBOzc4GYk6CYk5EhT+5hPY3oqxHoauOV9CZeSS/Yq75vVvnBbnuYr5RnooaWdH8k RWwqG1B/fMnJ5PElou9YO8fWKbXhGP4JrwLmrR6hgaBtrBCI3dLnPAh85qSqndnfPXck/cOSr27d /mFkR2DllLVPP37LvDvoKt/zh2k2NT1L2Y07Hsmaf8VLb73zopAxwzFnn4AiEd9Ka7XHTUy25lnL rcOsSj93v9BkNtF0sXtCaDabqcwyznA3hjoibyt/dX0U+Mz1mfs73z8CnwnK80YiySAn11FBTruI N8q19vYOZP2so1iNdbh7ZGiyaZJ1tvUz3Rfe0/SkTaUeyWZG2GQW8MFBQJKS2V/GNyDY81T1TQdV ERzf6Gh2gDQ5TmQI1OHklAO3K4QWZ7IOHccghyBYlGLxjY+4w8ZHHOffCioF8KM2hM+OY6kz9wDi kD/Rd+llPkVjEQURFign+LQeO/k5QoppE2JJL6SPPhAuH/cLSmtYPOb4OeriRIc1UkQMIYjtOHR/ pJ/pjK9QxvpxXgxmnJkw0Bz2Rp2jM2nArIMr/7ps3ts3N24qae2MPrts+RNbr736kdUPrz/z2GYq rRs/mNkQY+R847UXXj7yxkGuF4wCFw2DzjyYswmaL0JCHixWNigNxlrzLGm+stA4y2yAqcy/QiFG 4ph2MYeyQzzPd76vnHafCsp9nQMDfUODnWOCg0Pjndj7H5ruXBCcHrpad7XnFDvlV/GpT7vV5xvn bfQuwkfvQ/aN6hZsLVPlrJBJj+/0PM23QfZwsw5QA8YdH9igd7tA4T4NSvyHwjkEILNRFEAmgkfo 98b8ovIUgryCEYjX1rxEOT9qg7mYjdCIt0zN1Wu5ReU9M4WQAMxOZqbQEcAZAsN2fBCYiPHiM/VL ntiQHNN5DAtMySQ2dOFPLL7xAKfujYlVnYszHycR+xFhtKAOYj96SCyzFOfWx8RWNhoT+9100qV7 i7/d81X6O+r+8K/4GubZL00tq2as7zzCxlsGTLr1um10ku+xNuwxlPDpyYL0x+mf1OiOvXPo3auH znkSXMSFKWyGt9hHrVrYbaT2QEmgTwCf0Qg8YHnQus1qCFoLrKlAR0AO8PEoCEbKsw1WyWIPmaiH Jd0uGf+/gGmzm7q7XJrsy5PxjcW7wJb4IPYdUM6PWjIUKd9IaEDjZBLQrCAT4hb+uwLhv8vhhEOK hSYlCEeILjfHfNzPdTQBfI44MgGcFnsJyWP+wH66l8TIKXxpEFZkJtyKjyzIgG/d5WYDPFnHYUjy 4B++8x0h+yLs0Y1dQUa9zgANScWSBnHo7FkUq81FN+JDJ6CTJVxxLuP7LiCSwNa4X9TD9+e2bN7s Ct68fPTUrAGlFw87fFi6f/3i+eXDJzsfMg1vvGz92ctBEUPS46WvQRF8R9NCrdFsVtzF5jz3aHON W2fMDmQXmxPu4nilub/7QvNw9yR9nXmO+bTp3x5b73hx/vnx8/NH528s3lKs7x/rX1hdPNw8PFZT ODE2sXCufkZsRmFjcXPxkfwvY9/Gv8t3+Lw6Tzvb2VYQcumFJFGjcKtyOdJMOsibMFfa2fVaqRIK 2U01OSGLyespyysz5fn9b/qo6tN8jb5mn1yMlVJWWyyirH2CrQmNUrA1n2BrfHOm+EjC1xm2xmvx zZrdbA3AWe1CTs++pXaaR3IiuQfsh+2f2LvscgRfHRoLQScoxg4ehs2D2JuHPMRnOLPRmJcDDiSL l8Y4e4NLoHsiwd6wR+Y/OFznsVOwpY6DcMTWpGOZr+tgCXuxj4dWCwWSr/bxkHU+gbCDMsF2v9zZ dvkOc+nQpdev9dvo8tQHJ6788+37Vzw564Mtv//6vievv27r9hVXb60Ljs8rnTmlInUbrfroXkrX 39t8dt6Ph69+Rir6c8eBN156+SVusa3B1gwee+2m0/fg8yYdrR4fDxc7yr8noavNk/vhe6l7rbIo GugLlPsMcOu4JXiP7SFF70YAeZ5RK+tf3mWkHUbqxQizWi8YGALcC0Tu5gQC0/UbzcEHDltpMIhG BHOIUkRS8YE0gqSQcwGDOBxACJQX56cQIwXgIi+nRV95//KU94SXLfJu8aa8XV7Zy9ywXfk1FW04 gf7Ax/gmdBAZhacFQ+WA5hNUmlErEdYKiu0JAjmd0QexdR/vgecJLycXeUZgGs9ZFNw4BwFyk6J7 Ynuml3+ChcspiCnulBTUadPZ9Hk2nSWLWg2gS3wkIpm8kYCoM6GvmFEsTyC4RuyH0nkca9pu6Fj+ 3Ki2ZfPH3V4FlfD7uxoef7BzGntkzbUT7ri+cx9oci0mCpeg9enJIe1SY3/eg7HGjcYtxpSxw/iJ 8YRRT4wR4yJ8WWpzd9FRY5fRFMHXZPDNWXyTRSfdABtfwf4ynT4Pn6XaLG+RU3KHfFTWdcgnZEbk qPwmzmQ5oyuzWgDd44a9S5gyGSFSyAVnw7UMZwOQWaMAcJZb9djMc5HhP0cPobBijaI6s4GNm1rc ob5kcVJsY4McX9vW1ib/4/DhMx45ceYI2HrXo/hO00DRZyf5q1YDH4UySC7DR5YVn0FR9LLMZMVF qNXM4NbD94TMet5Ds04fctg3gqPDq4dvM+SZTBvNNGKuNo81S7AyTmsVHBPMmRA8YSiYhU1phvYC 6wObiZAbeD/w2Qzggjngcm+P8Q6do2qhp/D49ItU7qBeTKrHHMfuPPQqs5CfcUuXla1RDQh4Rpi6 zaDaEwbVlEWNNn0WAs45RvBPOGH3WwWndxFPqwfJr25Lz8npH6no31Y2+J6R8ld//vNP195nG3mX PPXMloNjZnJ6BS5IP2JczGy6lsVtY0hs3STdFKNkt/5LOaVDmBwnO/hTM0vtWOXIACCuDABS/lIT S/W10lUm5tRFXSKC9kSrM78ctU604ejEKiQKYqJAuwUlOllWZF2FcQSmQtfLVGe6SlpmOiL9Xad/ UkfjuoQ+z1CpG2Csto611sv1ujp9vfF6+RrlPuPLur/I7+iO6b7S/6D7yeBxmhB8K8mMR+IiENeE xSdDXib+FjG5eZmYXBMQVuZLSbLCFzDMZoIvaFA7NusDF+FdycEqkV2LRYV1IFwA+uBGKEDmPMLy YCsS+IXGgnJ4LHRfQftixvmnhUD7/6+xa4GPqjrz99yZuc+ZuY+ZzDOPyWOSgUkJhoSYgOaKKI8o 4SUlkCgq4iYEBUEEQcSK4quIui24bVdU6qPtFgjhpXWlttr6oKUrarWL4k+0qLVlu5StpTPp/zt3 EqLr/n47kHvPncedO/ec853v/L/v/z+8JQuYIKKv8+kENGip38f9gffLJy0aXtdEY6eIElwfcPmJ zXU2Ag/3FDF3gHekp4F9jOfmyqh2ZbyHbws4d6ANNCB1g0cE84fSwzD3QPsnbE9Ta0uaVQVqG6iw d/tKKLX2SF+K73aVc5iPNDiQB7IMcDDHfyXAuuU8jawvQrt3+0yekIsdP/Lz3S7d/TDQWBgr+ir7 qJcp4Qi+LRwezzf4rtN9MfrwH3Yl3bcjBdBFPyjY6qbsAsitRMruXf3sBx/ne9jz7+YfvRXBi5+w nfmVuYVi2c35+dQub8emiffXD/b6uIFCCzq4u+lcNxm/odHdjz7H3btKeQedNIYbA2mDj/je83nb sTnp85T5liKFcsAH7TxSXXMNPJ2JG/oieDaPCOwgppnicGtPM3zULfVxDgYUQAS3rl1/DKp3qOVB k4XCAJ/XoFCwXcI07xdtF+EAHAGFF0Ymi47oQcnMtwPodCN9GEOlavhMlewXxNpw84Mo7YvPGtCl futcqgca0t7j3uPq+9EPU743fKdTYlRJVaqxZAoBicrSYqmIXAqZSZVgcGqH02xzeltaTMOOBdOb wbz10s+zeHoSJmKA6ahZW2Fq0DiGDhWZZ0ukRm1xMwa3EGMoXnNzx2j2VpjFsC7HH0tvTrIkP11y 6HRJfjoc/9Gx6HRJPkom+cQbz+bdwTkJdEe6DMcu8pfcj/NhDa8xlWl2WEDf2yaIZaAwt2O8os+4 tTG8/3GLK0R4/6OzFKrllBPmTjIfRgDk8y5Zld7PVu3+sgWmegFn6/hg0jyqZBjUh4Mcj8IAmyHn GR4078TorhRIGhyoEQytDvutJLMDRYMDNedh8votIu8ZkT1s3OGa+9HDB+5H65/oWbmlbN0r//qD 3ZWd5y/95/65Cy+5rcVb/a1pV1w195kde3M14vd6r2j51vbcFrFv1arp//JA7m3qK+RzfYT2EmG3 OCGfRwqJT5n7zQ88vw+d9JwOSRhLTzrj0WBWm2yreTh2LDYQ86aUcDAcseFzMSkS0AJBf7Aqxv2s GPe5dO5t6dzbwkBX8LZ0PnTrFVSZHGTj3pbOvS0cf+5WqM69LRyfBguZhj7u0OlsAAGNaQiJgoZE nlfsZExcGtsW2xk7GPPGwPotivC+eRrSaG7PO9sFhztcbhc863DBNUc3dB0uF+Ojr7C/7MBNi3KV O97faMODBBzXhWka/gBJhYITNAYPeWERyVI1RZNBKzGrgW4kmaHZhUomchfMKWJUCGFwfwwoLq9Y t4o3Pnbj0QWPTje1/pGLJy9/0lu9ZcdFSy+tvyW3XLzzuiUXPPhajrM/JwI7qEEtBoQ4W7y3CNgJ UgEpWkAFZKidcJZTKc5fsGUt7p8kTVbmSB3KtVK3ojSYLXZLpDF2kdlmt0UuinX6OtWZZpfdFZkZ W+Jboi40l9hLIgtjN7EiVfIF5nuQBKDN9/d6rvFdo/X6tWixV7ZgMsJVST73SfJmIMMzcyEdmYM5 BSCQRnXqbnj5JL8+XqB64AWqdBQOOqGqdAOILYJsyilAOue8BxtBz08hKAHlYJXgD2IiLHCWNaSt aDjFRWDLIYRCr+X2h+QaUc8OTknmQBTOSRCkwGNKher7DIBCF0Qpz9YmB1g/48EvgZLTHHWWb5Z6 le8q1UtjE70xxGVxEDnm6N3wSdHE7Xe/+DsWWfPpve/lPzvQt/HOvt13bOzDEgg1m1bm388d+vQb rJQFXnv1td+8+OoruKCNiCSVowZtaPpc5Wzym18zzzPbTG9ramdKLEuN8FeW1BfVl0woWZranFJa oi3JqdGpyQ5lvr8z2pnsURb7u80l0cXJg6nXw0djRxOvlx4PHy89lhpIRSq9WTNb1OhtMS/2TjXn mR/qn5bkTd0KAvwh6FyKADoXgvGqwxozNUdboK3XvClehSlenfDbPoIKFu61xisSx2THC1phVJfc s6MqROGEU0k3W1vBQmPEMXZaEL4aMR8Eyrk1LgDlHCoeAspPc2vMMXUXKOeZaDCRaMosXgagnA3L TiRf2AXKvwyTY1ZE/ZFs7SBKHqLuxvsb0lfh7VbXWBBoGcLvNm5vefCf7jrcc+N7a+bdP8p6YuWq Hz65YvmufLfvuXtmzLhvYOvj+TP3XtKSO+PZfujnr77x6itvEYI3Od/tOYY6NIViNtbZpItZcWRs nNgmrvZLrUWt8bb45tJtpb6GUEOytXRiaGISgHfy6tDVyQWl60uPSG/YH0kf+z+JmSPECn8WefWN /inixf55Yrf4tv93sQ8iH8c/Sv5dNKCMFE4AYQ1KYSByQjAaHAOBK/OwwUzDMRYY6w1vKQciIDFF 8AAHImAECviqwYEIgwMReBYDKVWlEaGRj0wF90P421u59Vhh/W98tYq6GeGo2HIMQuYdTOZ4uRwv Kf0i+vAV2GruFE3DvlQxUJOFMibHwalyCG74AqpaO3LLZc/l/3T96+teXPZYrvxHq5Y/sWPljY8j pKyMm8ZGMXlb/vYnNv3tQs+/HTr0s18cefMXNMLdgap5CbViCS874+pCzPSySm+D90IslbPIu8Ir qZaiKmogZKkBwaMwnXcJQVMzm8Hxr0iFWEissP7vmf2Qr/dXxxo2s0dSLR+HhnkUvA1TcBuWyHXy p9mTBiMH3OxgMBkPR6Lr1A3EnaY2S9IYPOFEMF/eGOT0m64biPvuNl8XUQMD2LrjsfO7W+dffv6E CeMuD5d6qx9dNrnlyZpJrQtuyB2hu9CKiMAu3IXRnqizxlsRrmhRp6oTq+ZUXFOxVt2kbqh6IvTD 2hc8ATWaiEVHt9W+GfUlwScTzXqmxTqVTrVT69Q7/Z2BHqVH7dF69B5/T6C/ur/GqKmuqqkaMbZq ntahL6xemFlRuQIJyA9p3/U/mNlS+63R27Wn/Y/XbMf6tC9WRxDCdj3RisFC5WCharDA30N3ib+H Cvw9VODvoUIJpYnYpc3zlJq0X/MmUtVFXn1USYKCQBXxWrr5ZfHWeHv8iviO+K/jkhEvi18ffy/u LYvfHxfjz6FuitAuONbtwCNHchAD/crEakeiwExoC2Oo2R2ONNDeIX4iY6M6S3pLxJLiIhleEYWg OTBBdDkgDWQiQ2QBvcWj9DLktlbFnVCsoZ4+XsfxWu7f0ggM7Ba9BdsUfTKeok/F+cQxzvHuOMLX fXLVSHx0T3Hz4ZEMpY+4vUXBzf/mBboPKHyyl7rpyAT/qnKg7wvqD9aLrfXr68V6wu2rBP6dBZHh lHuXkVlBBboAKrhqt6kqgxtgg1+ekeLWgyYxuERYCM7QK8CMFe8NTmvj5xTAeXTyQToBGrOJ9Nob phVC39nssmHqI/QKQEe8qfWzZYiGccPN024xpSElTvwvhL+BWDg1XyutBPBbbZm2GTI9UkUglRTU jJxkvq9hUxrGYXmwMilUQFZUGQFoI1OjalLWmxTKzBLys1w+PaVAEdwBRn32ttsAgw0+SIMJ9IYh lc+a6hqsE9WA2LnrkJ1N5wUmSrwVMlHVrX3G3WvWrmpMP/TSw+0XnDvygVm3PDfP2ulf3r22JxKp S254fsuc7pdu+fXb7LzixTdcM/G8yli6fspt0yatzpRlJ6+5Njazc2ZTZXFJSKsac8HaznmPfP1H 1E+rBv4sjvQ9DGU5sO41tMHKasI9EEFBYT3EWhFY1phHiJjQbtMwdHt0w6wAHSJgp/1sQFYuUi9a IC8FG3gzBJXgOW0DLfigfBg66QQy08QNBRKj5oU/86QIPEPzMf7MX3lLwzMEWbo+GY39KHHLhRdc r1J+RuxBPunYXcAozsKTGIO5+DggyuNk4RE3g1gChl6k8pov07Q1m01H6f5VN1JkwGqCJau0uDaa aCYuGX9Vb+2GDbv37AllM6WPPmKef81j4tX3Mbk3/837cg9dWpuge3Q7bNkxWiePtR8QErg3Kmbu YioUITLGSWeMHW7IhliVEor4WSiiI65i4TYJYyLpWJSmEwk+V4nyWUrUJqMN3L2QbBLlsxQO2/P5 STRMdwHHBTQ4yiecOD5NyefSZQNRdjDKotMgUgcRfZqaJE4mxKWJbYmdiYGENwFIml7hkDDpaafU w+oxFZnZPA2A486FgaOARmOG4qLNLhis8rkJsgnRx9Vp8S9AAhguiB6fJQHusw+MIHTfoXPARw4O +yW8ZjBgBCgDl0RXMBHx+pNCQLFcCBB6Km5qXyGqWYPKAdIf5REyDgl6Wte+cfnj7aber1vXzZix aVz/d/snL2lvXC4+mNv9zXMmzZh1/11iM+BSJqCKPCdQOxr7pJAvEPUpgqZITBpK766i5ueryw7P 8ib3LLmv0ceECqtZI/sesJpVTDMbFNogKfqT3djDIPM93vFbRy0tbxAy2ODohKMCyREi2ODoHWdd ZhSUJbAx/COEDEQLmoVGbbIwSZsDRa0OZa66iC0Su5VudZWABFRxtbJKvUnbyDaKd3rulu9S7lG/ J2xVH9B+JDymPSfsk3dpLwsvau8Ib2h/ED7QzgintFr8HC0mRLSMUK01ae0CIDSfY0cafJjKNhTw NiiQC/TTBVzTKeQKoho1ko2HDwC0kZ7j7iwlvfNnRZ/Pr8MA1h3NIgMef4eyh7JC3VASfJMGDDKt amFV1RAiBMLIs6N90Asg9QCkOkuypiId21eHFMUKxXEcd40HltzjAMqCfgVLOmpKdFiF/sl/UN8F FTiHZNFE7LPjxOZAZ23GFNbNGLU4qHg2hxlgIQwnz0c62+LcXHSeeoycY/bjfO+/H08jx+wPB/LX eatzG669fvZK8S7C0oH7I/t/H1qH7S0Z5LDb5Jly6+MmgfEtbtcRLkWNkRUsBRKltlK0xQvI5IIZ wwsYWqlkOfxYszwMcsgy7raBuxHw8zxCP4SAsW6fxdP8CsATPoJR59Ah881D5hFOZy/kq/NfRz+M xokkemCYjfSO0MSp1nxrEzSFMSTyOQ7JHvNB3y3gtCcdtay8wSwGcwx9+6Szr6yqwSv51ZCUVOO2 DwusSjq494ptCiFPWC5WknoJZrBpeaSSDTYIjXKLMi440TNJcuRLlTb9QmOSNdWeb8y0F0Nr9lp7 tXSzvEI5ID1j7LX/Ip1RM7qVETKBmmDGqLHrwucKTfZNyp3KVs8W/5PsKfEpHYkywl7pmeAvgXe/ rZ7wnjB+b5+S/qYW65wn5udbk2+DfGvwrV1otkktaHhtwVJkAOJGOkjTuKDsCTB/GlH+N50mslIB tL6RVMBKluGQpOlWtZa1Zntnap1Wr7XWusfSLM2LtkjV4VYMubXUlgepAXUg4LtkG+RL4p87+mOb dBDYI8qA7FMhN4I5imaCObd/oA1MARs+yxRnkWYEUz+zZEhmWLadRQQQwZgg6jkdCIbBoFcA7mQ1 JYyPE4+g0FMghi3bXsWw/MEAvzwbdpxUnqjr2GDaBQUtfNoMsAUQlFkf8AT2syeRZd2useu1WyF7 s1+8zFGhJ3+9dSuEHulIN31sAceJQbVnT+5hp0OnMSgi4TZ+6amurhg0NPCfOllX7Ks5BIVeB18f fe//QSGQkatNf5SgS39tO8tmze1HWnlK/AlELRn+ggOH+4XRRgo52ce4wi+nk7TtbJgFXQ5l4PAu mYR/sWZzOcgFYzi5QBk4tktOuc/aeJak9w7QifbCFcS5Ya0O98mj6Yx9wrkiyWfim4ZOzs9Gn4vy z1lI+9dS3hQp4XN+Ao8YBAeO7LWbhVr8oYPvChHU30Edjibv2JJXxtn/5eAycA5DKMqJDJ4aD2vL P/vM063eMU8feKTxvL078v3PPj3iLRiY7xy3XhGvy2199ZC46Mw74to9f/81LI2Bcei/YGlM9p+F cajIYLoE/RYkKwTQIg3ukRt1kH+gNknSd8l9hs0MJDVTCMSZHm+eZ3zb+20FcnHGQd9B6aD8qqEa TqQ54QmpRYGE2cha9NvYJl2ps7/u7ZA79LnBLWyrtlXfJ+73/1J/Jfia+Y7nDfU3gd+ZH2r2YOcC 18C2jFgAjgW+B1wDKhmca4BlZSTCD7/INVgkQeSdsw0kRJ3ANzDAJgXdwDAC5hDXwNQkqNxq5kvC S6popofYBi8hFpUeTjiQgLiAcKC128yeEljnr9CMKyV1nQOiQXKfI02X1nNhyAudYMqzTqxox72c Yq3lE9WuU+5ggbHC/BDrIHC1kuHcAmSPFwYLWnaFkwtALeC0gp+7W+yo6SIuhbGEAk/9wVhJMwBf UAlKoOcehep7lB8jtASSLaQbisAGQMo5GAPUUOjRwUFTmOmuDkruh18+tqmJokOeGmawDfmH3398 VHFtevdb+QfYvUffacl/LGZY/vNJoyeMOZP3537Fpnbku/C7ypFh8ke0kQT7n0IbKdHCBpaCLY4b tqRLIcdGvoXjTxXaSrwumziaiB1CWIR2fJIOW4aGs9soZrBO7zpLipsz4TnGDg1LkjiokFRmdINJ G4h02pFAzK7Ra/w1gbH+sYHG4MOWnrEzocmRDrsj1FHUbXeHuotWSysDq62bwzcX3RG4x7rPvi90 d3ir9pT+E/NZ65nwJ9rvw38J5MzPwwPFpYMtKgJiQNJrTDQ2IEEkPnT5LojgEjSJs9IE1hWIUjY8 h3g4FErbWhgHWBbC8qd1DdNgDZQsv1+X6PcLxWaxWFf8fLFYvF9s3WPgXjjh/eJsR2+1HVu8wn4e yiT72YS9BqsQLkrCMM527xbk2Ub72/2e6f4BzmSZsLsOOZc4R38ytRaGETcvRwqhaEQkEBozTx2P Y0mhZZ8lQJjjJQiRYOJA7YpCmsrwkCY1KZg8oqq07QzC2sRgbZ6FDskJQR84Qcar0KwOCGFIWjQ1 a9B5QmL6iT1FIBW7BGK0HlgaUBrQfEI1hPrxfOoCewouDHwITFFuDY+rHT85alX79PySF45mK8qy H/Tney+oGr12TkP+2qfNTFVysVHizeQevvG2tSvFxWd+uWNCxyzycjKwPUfQroJshxPAIgIvK6LN 6u0osTl+Be2oaAM7H14rjl5wpqIwQsyodSYy0LUp7GLxYmWK2m52stnibGWeOt3sZVeLVwN2WcNW KGvUe9kdID5+zk6RaG41G6Fk1Wbl+8pbTKbess8sahBhXuGEHHEqMZEWW1RNRGw7zUQQS0RGgrHi lUSHkLQrAwJG81OOykfzbFADvdHox2Dok54VEUrFEiunHB4bA8q3DXSSoBNcEFwfPBn08Vx/wIDI ol0haOsYg4R7O1aiwtrAAhcdEOKGuaKczAZlKxRi11hFbNn446BZUOXmCAQYb36IKeKHPLmSKhvW wwzSCgrkgSGBjHo7jMQesJVBLRy8ewrdSxy9sI/uIt1K/kas1cGIW04j3Lt9BmepuLsT+8BCUiLJ 88g564vSKxBhijSLiEKLichZwwIii1TpElnGjikvyojbl8/Nt3sW5n56/eoe9umDHkV68Kbc5WvU 71A9r/f8N5uBrD9dWOeMXaPcp4gBheVk9q78J1l8jtRxvyP/WBbnyb2yqMi64PkcXoYujGfKuSRT fz+ljmNpryIZ55LPVWqE8VCkAVsx7v/eau5BcPVBzKhpKt3FjgtI9cCdQ+5KMwBBCk3QA+IMrKiS ixsjjVhmF/w0NXJ+bVODx/vz33z/zvHTR1wcnf91fEOv52N2nu9lXO0Kp/p1+QNZ3CX/TBb/rLCH lEcVcbnyDQVCIddgEgHkU/cIyg9lurpSNnTZgohlx/iFCpwuOfwycZWUWuNeYGHJMQHXiKvDA1dK SSZY+oEvP7b2p2XZ+bUgJ3j/ikscN2PEpMgV6DmIotNjoIZUt77icQme80CJi1ZAPLv6YRhY3pfX PKwYttKhu84hrXI4Ciscfnl9Q3d1Q1rb0BEmfGFVQ1oj8BKsTT8N8ePpWIN8JlZvno3V4edg/ei5 QgcUrudjxeUurNroruyNlXRwl+khQc9GuGza9LkTJ2cvuKH7yt5LZ/8DvQFxggplbmRzdHJlYW0K ZW5kb2JqCjEwNyAwIG9iagoyNTQ1NwplbmRvYmoKMzAgMCBvYmoKPDwgL1R5cGUgL0ZvbnQgL1N1 YnR5cGUgL1RydWVUeXBlIC9CYXNlRm9udCAvSUxKVlNIK1dpbmdkaW5ncy1SZWd1bGFyIC9Gb250 RGVzY3JpcHRvcgoxMDggMCBSIC9Ub1VuaWNvZGUgMTA5IDAgUiAvRmlyc3RDaGFyIDMzIC9MYXN0 Q2hhciAzMyAvV2lkdGhzIFsgNzQ3IF0gPj4KZW5kb2JqCjEwOSAwIG9iago8PCAvTGVuZ3RoIDEx MCAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBXZAxb8MgEIV3fsWNyRCBM2RC SFWqSB7aRHX6AzCcLaT4QBgP/vcF4qZShxt4733wOH5u31tyCfgtetNhgsGRjTj7JRqEHkdHrDmC dSZtp6qZSQfGM9ytc8KppcGDlAyAf2VkTnGF3Zv1Pe6Ldo0Wo6MRdt/nrirdEsIDJ6QEgikFFod8 3YcOn3pC4BU9tDb7Lq2HTP0l7mtAyI0y0TwrGW9xDtpg1DQik0IoebkohmT/WRvQD1vy2ChZRoiT qflfp6Dli69KZokxt6l7qEVLAUf4WlXwoTxY5wd+jHBJCmVuZHN0cmVhbQplbmRvYmoKMTEwIDAg b2JqCjIyNAplbmRvYmoKMTA4IDAgb2JqCjw8IC9UeXBlIC9Gb250RGVzY3JpcHRvciAvRm9udE5h bWUgL0lMSlZTSCtXaW5nZGluZ3MtUmVndWxhciAvRmxhZ3MgNCAvRm9udEJCb3gKWzAgLTIxMSAx MzU5IDg5OV0gL0l0YWxpY0FuZ2xlIDAgL0FzY2VudCA4OTkgL0Rlc2NlbnQgLTIxMSAvQ2FwSGVp Z2h0IDgyMwovU3RlbVYgMCAvWEhlaWdodCA3MjMgL0F2Z1dpZHRoIDg5MCAvTWF4V2lkdGggMTQ0 MyAvRm9udEZpbGUyIDExMSAwIFIgPj4KZW5kb2JqCjExMSAwIG9iago8PCAvTGVuZ3RoIDExMiAw IFIgL0xlbmd0aDEgMzk0MCAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHNV31QHOUZ f953d2/34AIHAUI5NXtZoTHchRASQz4kF+BO4KqFQJq7JDZ3fCRgLgZJZIIfGdJojQfpXBvqjFYN UVGMQfdCVJJJO2ksKTO2Y53RjjaptjM4OlaccSqmX0J/u0sYSWv/7j789vc+H/u87/O+77Lv7eu4 p4Uc1E0C+Zp2R9vJvNJqQXlNnftUSxdPEklrdrTv3G3p9o+JxO07Y107LD1tH7ivtSXabOn0L/DN rTBYOlsBvrF19779lp5WBVZie5pm/Gkx6Lbd0f0z/dNl6Opd0d0tVnx6KdjTvmev0Q+udAW3Ze0d LTPxLEQkNMzV04gYojhzUBEdoTTi5ERrNcyfitvhMwRlyS/ViLHJ7enrJhWXkZZoYOjolMFjh8tQ 31RtygdyMVSHGW848JxcPIU5Su0lmn4z5YNZj+E1Lu5zUCCARmaG4qtSR/jNp6qWgw6ZxE5a9KJF L1g0aNHzFj1j0XGLjllUbVGVRbdaVG6Rz6Iyi9ZZtNoim0WiRYJFzPddjOkycAn4A/B74HXgVeAV 4GVgCDgJDALPA8eAp4AngV7gENAEbAdG2MtW6iGLTlj0nEUDFj1r0VMWVVq0waJbLCq1SLZIsohb RD4fenoPeAcYA34NXARGgdeA08Aw8BLQD/wE6AKaq5Zn2bPsqxIjrNNXLSeOy4mjcuKInNgjJ2Jy YoecaJET2+TEFjkRlhMh+UZlkaIqNyjXKXlKrpKjZCmZilNJUxxKiqIoNkVUuEIK6fOFIA/Wl7Og fr6Jgo2q/mW9NsJS6rboklbO9MwgBRvKc/XSQp0fHmHUEBph00nGfvSQS8+sCJ0hxqYfOuKa4XCY cgr/88qdYwrWdp2jhWwVybiXDMsLfyXDH6yHNWFaE4Y1YVpz2alaWh6M9kSupzlJrlXYtYZv1Jm/ zSi3NpRUqDxcsc3iYZ6agnoiLne4PMfZXmYWt9ade8B1ViQ2SKmFYd2hlevzAKNu7wbvBsMl4jWC Kw3m9BlX7oG1btdZNjjjcsKcgak0Xqz/q+utbxxNMRVTEwvxg3wLWj+jRtwfB5qBx6iP+vgwWoih EkBHq4Y+ksZoOXWY9hK6H1xJf8PE/dC0rKNG+BsRPQoug68JzOBroj7Wa/ID9CByf86H+QV+wfSu R94aI8ISPiyNwW70fIheovfZeWS4j47Ce4beMp5C5j4aoitsMaSHfcgmeC2sjNA/8uxCdB/G+wt6 j/7KslgZi7NziMnkB82xWL11I2YU8paZxch0G4uxPayDPYKc41zgK5F1Dz/M+7nOLwhhsUwas2Xa VskxZGH4Ty1QBio0st1O9ei5ke7GN8rKamQepd8xzupYA2tlj7J+jGGUTUC+4F6+HrNuyE+FiOgQ P5Z2SU9Dxmyb5CcVG3JLZKM8UimfVqAqP/qoQ2XNdCfda8p9qPF+eoB+QMeon47TC5Sks/RLo0+6 RO/TFcxOOsSoaxVbzTZDwpAOdoA9iPno+ZocYU+wYXYW43uDvcMXompLYqjeGuUh/jg/zd/gv+Ef 8HH+Cf9cIMEubBcahb3CgHBCeFN4U6wS+8Xj4mXxssQk3ZypTFuW7Q5bD6RXtsu75AflH8tPyq+m LKUFqMuDumpoM6rqQiX302GKm6uWRCWn6RXIGH1i1AGZnqnEqGY1q2QBtgkSZltYhO1me9n+2Yqe Zc+xQXYatbwDeZddYn9mf2GfmXKF23gOL5ytr5bX8818F3+UP8af4C9iRw7zc/xd/j5qHOeTqDFV yBSyhRsEvxCANAhbhf3CIWFIuCBcEiawbg7xFrFM3CTegdoviuPix1hJLglSvrRSWgNple6SDkg9 0lPY0RPShM2B/WPIfNta28O2Y7Zh23u2r+RsOUdeBFkqF8v1ckzulE/I4/JHykn7BnubvSPFQydo Gb12zXv8Cnb36/wOWxHlsUvYDXcL6YhSMZ+j3CHH7G182BidXM8WY6X+SFcEOwXFi7RZ2EoxqVFI lT+lQbZXPMheFAJ0kgbkTnZOiAgTwoCUb1tr7Q/+uHBC7pIj8kcY6RfCUalVXso2SD1skK/HG93B 6uhLNknfR8/7+BK6SI/QYdaJD06fcpLNwxs8yheyHulp4ZTYL/ilA+wmrKBLGhMeopWUjdPKYlqE vS5RFkC+VaWrVpQsL15WtNTrKVxy0+JvF+TfqC1yqwtvuP46V963chfkZGfNz8xwpqfNc6Sm2BXZ JokCZ+Txa4GIqhdEdLFAq6ryGroWhSH6NUNEV2EKzI3RVeO5KFxzIn2I3HFNpM+K9M1GMqe6jtZ5 PapfU/XfVmo4WmypC6F9pFILq/qE2b7NbIsFpjIPituNJ1R/bmulqrOI6tcDna1xf6TS62HJ1JQK raIlxeuhZEoqmqlo6QGtPckCZcxs8IB/TZKTMg816jVapV+v1vAo0gj5/mizXlsX8le63O6w16Oz iiatUSfjm1VohlCF2Y1uq9Blsxu1TUc51KMmPefjvSNOaowUOpq15ui2kC5EkcOvZxTqt2qV+q33 jud6PSPsuYaQbq8wTwhnqGa6O1ndXVkZNnrD5/JhM3wBwhfcO+4S4v7cNlWHGo8/rOr9dSEj2VWv 24gJh5HU6wluDLkxas3fqxplbAyZFSApyy3CwA2bUaZVcIvmNyyRO1XdrpVrrfE7I1isvLhOG7vc p/JqfGem/0Q1fjXeENLc+nqXFo5WXpfMovjGruFqn1o91+P1JJ0Z1kwn09JnGo55X2+0YBUsn9ky w40WRn11qpkxIq1a92GPNakYSUjTeX6pcWsppXhTKVYEV5hhRtswf5G4cw2q06V8p6bGJwkbQZv4 dK4lOmOx5TsnyXAa22V2y+kserWtFxbqS5YYO0WuwNJiZGWmvtLr6dSDWrtT1YOYMqoN4aHwmiJM udttrHLPiI8aoejddSFLV6nRdYp8RTjq8IjhOX/Vk73J8HRf9cw+HtGwnU/jc0iUrSsFs3/pzpz5 /tY1Osv5H+4Wy4/Xx68mRSk/XhsqiMZ7XAWReG8YuzqAtzoeD2hqIB6JR0emuxs11anFk8FgvN2P t9EqaWT6fI9L9/WGWxkmVS+xZkOfXxESXNzYmWhxlxD2Gqe4bunvODmQ+QU3/qE68J11gN2zFqIC fJfw6wjfchK6cRIRcITVfOny20x8mz2DH5XTJE0LZ9iHREVTE84JWv8Z7sXLSjLcGfnuDHe3QF91 c5oiaewfpd3imNHbEPVJt0srKJWyfk4C7yU72dg/kWACf8XL5q+gkuWUnUXaIhpiWycn2bapZycn pwb4+CTbOjVgNNlWjMm8pktxEvhvF/yMy01tHU2xlpvNAEaZ5uLglyvlElV/p+Z79VWFm9vu2tkM 7PVubNl5TyzaQfRv4YypZQplbmRzdHJlYW0KZW5kb2JqCjExMiAwIG9iagoyNTMzCmVuZG9iagoz MiAwIG9iago8PCAvVHlwZSAvRm9udCAvU3VidHlwZSAvVHJ1ZVR5cGUgL0Jhc2VGb250IC9WRE5I VlMrSGVsdmV0aWNhIC9Gb250RGVzY3JpcHRvcgoxMTMgMCBSIC9Ub1VuaWNvZGUgMTE0IDAgUiAv Rmlyc3RDaGFyIDMzIC9MYXN0Q2hhciAzMyAvV2lkdGhzIFsgMTM5IF0gPj4KZW5kb2JqCjExNCAw IG9iago8PCAvTGVuZ3RoIDExNSAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB XZDBbsMgEETvfMUek0OE7TNCqlJF8qFtVCcfgGGxkGpAa3zw3xeIk0o97IGZeTAsP/fvvXcJ+JWC HjCBdd4QLmEljTDi5DxrOzBOp/1UNT2ryHiGh21JOPfeBhCCAfDvjCyJNji8mTDisWhfZJCcn+Bw Pw9VGdYYf3BGn6BhUoJBm6/7UPFTzQi8oqfeZN+l7ZSpv8Rtiwi5USbaRyUdDC5RaSTlJ2SiaaS4 XCRDb/5ZOzDaPdm1UtRpOlvzT6eg5YuvSnolym3qHmrRUsB5fK0qhlgerPMLftpwSgplbmRzdHJl YW0KZW5kb2JqCjExNSAwIG9iagoyMjIKZW5kb2JqCjExMyAwIG9iago8PCAvVHlwZSAvRm9udERl c2NyaXB0b3IgL0ZvbnROYW1lIC9WRE5IVlMrSGVsdmV0aWNhIC9GbGFncyA0IC9Gb250QkJveCBb LTk1MSAtNDgxIDE0NDUgMTEyMl0KL0l0YWxpY0FuZ2xlIDAgL0FzY2VudCA3NzAgL0Rlc2NlbnQg LTIzMCAvQ2FwSGVpZ2h0IDcxNyAvU3RlbVYgOTggL1hIZWlnaHQKNTIzIC9TdGVtSCA4NSAvQXZn V2lkdGggNDQxIC9NYXhXaWR0aCAxNTAwIC9Gb250RmlsZTIgMTE2IDAgUiA+PgplbmRvYmoKMTE2 IDAgb2JqCjw8IC9MZW5ndGggMTE3IDAgUiAvTGVuZ3RoMSA1MDY4IC9GaWx0ZXIgL0ZsYXRlRGVj b2RlID4+CnN0cmVhbQp4Ab1Yf3AU1R3/vv1xdyGhJgHkknDsXpcjv4VEpUAoHMddSEjAQIDeIchd kouXmEgGQypY6I2ClQOpilAFB6U/rECR5cLQDVQaGR11WhV1tGqdUeqvTkfG/qKjotl+3l5yEkaZ /MG4b95+f773Pu/z3r3dve6166I0muIkUsOKSFcrWdeYxyDKmjsjXSk79w+Q+c093WrKlouIxI7W rps7U7bjQaJRrps71g+2z30P/o5YNNKSitOXkNNicKRsdh3kpFhn9+0pO/cYpKNjTfNgPPdN2LbO yO2D49M7sNVbI53RVP6Yn0BO6lpzW/egXQ85tWttdDCfBYHvZWLwCvQAZdAtZIeWjbKKyP73US6S EOVxXGu8WftWXzXrPOU4LHv1wp9b8rW7not9Fv2yMPN+x+dwZAzlc2krHigmymKIn8u8Px2x2uEm GNRYalAt6hzU61FLS+c6Kc4ep/tQH0MVqY1to/WoW1EfRpXS2gFYfWxbUnJ4T7D1lM8WeDMlZenY PMU5KlN51WC2Y/uUt5zvn2R5WL2zLC85mjLmjmKPsUephRT2G/KwDVRDRWxPb3GHEkboAHWhxlFF 687YgeTESuUUKyOPxNBmMk2U2HHl44py5cMKQ2BJ5XShIUE8PRGW9yql37VP+aPrZuUU6qFU6GAx Mo4rB1wdys6JBtuTVB5wGQxt7k+JdS40Pa50Fu9WWiqseP1uQziUVGYgvtybqUyb7laud32gTCk0 HAx2uateKal4UZmEhkhT0anHm6NMcO1UZiI00RUonIl6kh1ke6mE7U16FignoGK6vbXF03cb7I7e mqIKj8E2eKfVFO0urin0FNcrnuLqwkLoy5+3b7bfaJ9rr7SX2ovsk+1ue4F9rCPXke34niPLMcrh cNgN9rvkHMV2kh2iOaDlUK/D5pAN9iSc0kl22HIe/r1DcggOcow1zPeweRmNNdihY9lcg3LcZmk2 gx3uTbkOexWJa5IVyBa4jhvuJDCHQAtIZ/caNtpydc8c55zc2Tkzqv3fdgtbkaF76bdfTubSd9c1 BvWDrpBeyRXTFRpKdw4p3yq71yEU9ZWW1i1Z39vT1d4aiGqBsBaIoob1bT0xpx5vUtWj7V08oOri 5HBTc4zLSFTv0qJ+vV3zq0d7rHaXhFt5uEfzH6XWwNLg0VZv1J/s8fYEtIg/1NvkW7tq2Fhb02Ot 9X3DWD7e2Vo+VpPV7pKxVvFwEx9rFR9rFR+rydtkjcUnH2hr9N3Wjd2pBtrqVL2oUa9dvCKoq5GQ 32CPw+lfR3I/ZctPUZEcp3xpCilE5luob3M5sMz8SH6Osgc6zX+JVVjUPl6FgTmzqJ/upb10hGz0 BPQiuokeohdYO37bK+kYvcEm0jU4eyUyqJ7+zEzzFWqlXyO/m07TLjpKWWjTSeMQ3cE85gbYXuhN tNn8JU2i6XQ3PUUz0OsOOmceMHsRXULL6CAdQvs/MU04Ko0xnzQ/IActRp+bEXnFrDePUC6VkY8a 4N1Mp5hHfNuMkZOqgO4RepT209P0CbuTHTNjZo95xjyLreqkCdSIspEdY2fFI9Ld5iPmP8wBMFFE JRg1TDvpV+j/CEo/jtYAu4V1s51sl+AV7hSOSVvk8QNfgYdimo9SQ2voHjDQR8/Qv+lz9qngFLPF bvFZ83rzP5RJdZgln0mUelB+hrIDczrJbGwqm8ca2Eb2INvFXhNKhGVCUPixcLvwkbhIXCmuF1+T bpOS8nb5IVvmwHnzpPmc+TqNJxfdSGtpE2Z3ms7Qf+kLJqKvCczDqpiP3YQSZ3uFPraf9QkNrJ+d EQ6yd9n77FN2QZCFLGGcUCp0CzuFQ8Jp4SWxTdwlPiy+K56XZsuCvF/+0Oax/3WgaWDrwEtmlXnW /AxHrIPcWBkfLaLVFMFsu+g6+ilmcRjlCFbtGXqWXrDK+2wCnaPPwAKxXJbPKtlClEXsBtbK2tg+ dgLllIXlfwIWQsgQcoTxwgShUWgSOoW48LoQFwvEEnGBuEI8gvK8+IZ4QbwgydIYaZw0X6ql7VKn tAflcekJKSm9LM+QZ8uL5OVyXN4qbxeb5VfkN2ybbDtsSduntn/iWKy3r7Fvx+q8gD37NPby15fE JgF9Jd1KzczPmmg3VmM/i1ACu6uF3QO+uqjIXCVuEucLU7EbTtEd2K17aCNtFVfSfvNN8SD9BTul A13G6beSj1zyL7A6d9JU7KLB4i0uKS4qnOyZpH3freLIn1CQn+ccf/W4sWNyc7JHZ2WOynDYbbIk CozKAlp1WNUnh3VpslZTU85tLQJH5CJHGD9lVa8enqOrvF0EoWGZXmS2XpLpTWV605ksW51Fs8rL 1ICm6i/6NdVgKxYHod/r10Kqfs7SF1r6fZY+GrrbjQZqwBnzqzoLqwG9uieWCIT95WWszws6RpWX 8YPDS5m8Y53mRTbigKV5PCOg52v+gJ6nQUdM9AQiLXrD4mDAX+B2h+CDa0kQY5SXtenASduyWrSW bYaXmsJci6wM6mIkpAth3ldOqT5e8+vjN3zo/Noc0gLbLwrqgqc6Ek1U697wNpDLzTC3Itth1TWq 6FbYEgrqbMsgCI6xHUg53NQzwRNuV/UMzafFEu1hkEtLgsl8b751+OrUEEzmefMso7ysz7mpyo3Z 95XPLZ/LZZXbuSklP74r5X+1n0vnpmfeg6xbkiaAcQa0WuDU1WZrEA1gp/NbdDolmqeDJ1whhmm2 Ac88XcCeET267KmN6PHGIRgxfwpcuN2fzMjLtx5CvhDyw4nsmVgp5GdrauI8ntZh7dwnwz2RQY/N k32eeJAvdHqv6CwypPfwh6UHs445tRhf3x5rTWFrzsBFDticGo5ZH4sHeEPQrashOPA2WVZnUEZD 8ChjO0IGM7cY5Hf14R1VXH0TwmV8q7X5MT6M8jI4StzQrilTqzFyNd8rakJN1LYk1Go1hs0keSyJ QDQRmgIGG4PgiZZiRG+oIK1GQ6GZ6GcK7wdNkJ4IoYf2wR4gLdeUr5A0tQwPU3FyQ3BxUI/7C3Sv P4RVwPbtbwjq/di5oRCyKtJIgXhjm3MQcyUwV5Qgfm2qF7y7xNFFKJHgfTYGNbfen0gUJPjvLWUb jC51eAcdBvEUTrnB4g1oC6G5C6w1cGtuwApxTq/Dlh7aUXhnvzzD09K40fIHQDvNYnj6FWJ4xkgY njkihqvSSIcxPAuYqzjDP/zuGJ49jOE5l2fYm8YNkHOB1msx7LtCDM8bCcP+ETEcSCMdxnA1MAc4 w/O/O4ZrhjFce3mGF6RxA2Qd0C6wGK6/QgwvHAnDi0bE8A1ppMMYbgDmGzjDi787hpcMY7jx8gwv TeMGyGVAu9RiePkVYvhHI2E4OCKGQ2mkwxheAcwhzvCNaYa9BTpdfA7HLzl26YofzCsvohxvSnIu +ZgLCv98xgc0rix8WWRButMe/N+Ewv//8RFJZ/DtJuI/oHmp/2UcUwySUB3ZBtEZVG5DF9+BDmmH FCEz3qETaEW0vPQEepIhp1Zcm+POKUT1STuML/8mP/XFPENaeAHf+ciwLjOK75ZvuhBngn3drW2V UyurrQSGL7HUDGz4b4qW+xfVLG8srYl29ES725ojyElFeTLiNMEcvLgjrTN1Crf/D+tqZOYKZW5k c3RyZWFtCmVuZG9iagoxMTcgMCBvYmoKMjcxOAplbmRvYmoKODYgMCBvYmoKPDwgL1R5cGUgL0Zv bnQgL1N1YnR5cGUgL1RydWVUeXBlIC9CYXNlRm9udCAvUEdHUk9TK1RpbWVzTmV3Um9tYW5QU01U IC9Gb250RGVzY3JpcHRvcgoxMTggMCBSIC9FbmNvZGluZyAvTWFjUm9tYW5FbmNvZGluZyAvRmly c3RDaGFyIDIwMSAvTGFzdENoYXIgMjAxIC9XaWR0aHMgWwoxMDAwIF0gPj4KZW5kb2JqCjExOCAw IG9iago8PCAvVHlwZSAvRm9udERlc2NyaXB0b3IgL0ZvbnROYW1lIC9QR0dST1MrVGltZXNOZXdS b21hblBTTVQgL0ZsYWdzIDMyIC9Gb250QkJveApbLTU2OCAtMzA3IDIwMDAgMTAwNl0gL0l0YWxp Y0FuZ2xlIDAgL0FzY2VudCA4OTEgL0Rlc2NlbnQgLTIxNiAvQ2FwSGVpZ2h0CjY2MiAvU3RlbVYg OTQgL0xlYWRpbmcgNDIgL1hIZWlnaHQgNDQ3IC9TdGVtSCAzNiAvQXZnV2lkdGggNDAxIC9NYXhX aWR0aCAyMDAwCi9Gb250RmlsZTIgMTE5IDAgUiA+PgplbmRvYmoKMTE5IDAgb2JqCjw8IC9MZW5n dGggMTIwIDAgUiAvTGVuZ3RoMSA4MzYwIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4 AaVZC3xUxbn/Zuac3c1jkyUQCASyuzlZCGRDQgCBsCWbx4bHIgkQYJeq2RDCSzCBBHxcMFiLYkBB pSitEtSCVLCcbMRukErk1vaqtWB9VL1q8IrP1pb6urZCzv3P2QWlv957f/d3d/K9v5n55ps5c2ZO 2tatb6JU2kyC/I1rGlrI/OXEQIY1bmhzxWXHPiLrm8talq+Jy1kbiSzjlq++cVlcznmLiN2woqlh aVym86BXrIAiLrMJoHkr1rTdEJdzdFDb6ubGhD3nFciWNQ03JPontEeu6xrWNMX9XeiPvC3NrW0J uQ40v2VdU8KfhYjSA5fLaQgJXpw+Ix89SFZwDiqihejIo/yRVMjSrqa+uChrV3F9uu9L21Cb2fzD 7404KZlnu77a+U3bhe0OsqExSjL9pQH1rO7+AC1y0Ddtf+9zxHuSlos/3kN14k/dYoyzrDxTnKWI +Jg6xfvUB1DIAY0DXBmgBbwBUI1e8W53IFDij4EWjDVpNH90SY80RIcNL/mleJcfplHkhKIvOjjb tLwTrahIMFdMjjPdYwpL+sqTxTv0FwAX74g+yo/X6s4fW3Ku3A4FEzdTOmPkpH3ibdIBnPzize68 kSWdJ8RvYX9ePEdLzWrPRe0DStDgb8QvKIOc4klxNGE52p02oITKW8WdyEkv8GnAGcA5gELN4lFq B+wAHAEolA7sBBQBaqRGHBKHEOd+1E8HLgI0A3YAFKTwMeivlVgcFKsoF3W3i12UCbpN3GvSn4IO g/ww9DmgD0GWtDMh/wRU2n+c0O+BPBjy/Ql6H/TZkHdDlvRHCXmDWG/Wa0vQfaI1muN0lOfA7gIU AwS4XeB2IXW7IBEwE7eK1WYEXaAlaHFNnGLWNkXdmjlHm7qHDC3Zh5RuQuo3IXObkLlNpMBn40Wf jXGfQrERPhvhsxE+G5GVYtGK/loxYQTsALgAAnlvRd6lXgfuBZwGCPoh8E7APimJ65HH0YjqDrEq mu/EYlvePcVfUvaUWIZU+8Wy7qEjSnZ8KyUly4W4rDspLUHTpW+T6dvUnZQqtU3dw0bEKbyuLU8T jfQvAE6DgPMAEwBVAEU0RvOKnMfEHFpjI3+as523i3alXVWKq1jGCVFCtXgCnZQhCskHh9HOeh+b FElqSdqcJBxJrqTiJH9SbZLaLNrFDiGcokiUiRpRL9SY0Ru1lo4H8U+3lI7fmbIvRU/pTTmdouqW XstpyxnLOYvqshRb/JZaS8TSYtls2WnZZ0naadlp5ZGUlpTNKcKR4kopTvGn1KaoTivbV75FLMEw CdgBaAHsBCjIcT30LnENoB6zUY+0XQM9ARMkB+A0+DOgKqR0+KXDLx3adGjToSVgaakFRAAtAGm1 XLJcrCP9z0kLYBSsaWgpjTjaSYMeHGAWJDskOyQ7vE7z84jQAewC1AKEqTsDDqsG+KKtOGGPgFpI 2s8BuFlP2vwAwc/7G0b1jmb6aLZvNNs5mvl9ZeUl/lygjIyMeq3eU59fv19p1po9zfnN+5UarcZT k1+zXynTyjxl+WX7lSKtyFOUX7RfcWpOjzPfuV/ZMfvI7BOzT81W6mc3z26fLSZh6rqjBcUlJs31 SHo0OnRYyaT08qn8CIZTD9wJ6AMIcgIXAcoAzQCFHwF28sehfRzax6kGUA9QUeNx1E8HlnZpk/pO gGpyfeD4ZXa8DPnhaOn4mvJZ2HLrAZ0AgbYPo/5h0zvOHTH1OvAZU18DLP33AWSUhy/VEdjgFss4 gJ2AMkA9oAWg0imxCC+HRbJlYCegBXAEoIjFKIvEIv44ymF+WHj99nGZTho8GG+bjAE2R7mDp2IN 2NlBE99v4jtMXGbiPH/aLPtXs+xPz7LfNss+CgzPp3JU2GVitz+l3P5Eub2m3D663I7WhpCb7DzT xBaJ2R9NPMfEXv8gt/1vbvvnbvtf3fYH3fa1bvv33LLecDy7dj7IxCkSs90mnmXikf4Up/3XTvsi p32S015uZ3sZYqAKE+eYOFti9tkT6VXplPQU+4yq0B6L+kY7Y5xMwoyor9wZY/1R33SQC1HfXpC/ R333Oo+zvzHzlca+iuaddZZnsi/YTAWvOPZ5gv6VzaRDkM+BLgc9QD7mAf1p1HeL9H8E9X8M+WHK tcl6D1GtWb+TzTT1DybqPRD1LkGvP4l6b0SvPyYvk973Rb1nob036r0D5J6odzXIjqhHBrgq6hvj LB/AllMel76N5OEyktmJHmeg5dWQp8crB6JeWatKdhBjlVFtHMgoGeVxplGt2Z0zqpmDHEGaGdxw 0sygs8lj0jSWbgZvp1yT2qLaLWjF8oTnrPM/fU/JgdOXLD261/necYxvIcT/YDOjh5wv9ch0RZ2n vDHmedL5O+0p57N5MbYw6uz1xmwwnPDGODvq7EKSdfhy9qTziHe583HNtO7XYMVUd/oKnT/RFjv3 eCBHnbd4j8swaA1GvBDmsHeac7bvkLPaE2Mw+33ozJ/sLNXWOadAPTnGZnYfco7Li8lQitHGoSed Y9DjSM0MZcGkY3wiWdl6v9faZl1iXWida51qHW8ttLqsI6zDrYNsGTaHLc2Waku22WwWm2LjNrIN ihln/AXyuDbIYp7aLNi2GSkm78DWyPAAmqc5zmwcz44+UAR5cH4F0zOCFKyr0CcVBGNWY54+uSCo 22q/H+pi7K4wJJ1vjTGqC8WYIVVbsvWMylAPMVa05c5sSTduuTMcZkG9t5GCS1z6V/MxjuS5i3VV q8iiwRvKssoypg2YUl31T1DEVEaqCr79ZX3Lgssaoe8Ozg/pj40I6yWSMUaEg/r0+a6rQj18LW8O VPXwFknCoR52E18bmCf17Kaq8CU3yuUtcCOfJNKtm3KlG+WybtNtttkalmluoKorF0g6nWQzpROW z0nTabnphDW+VrZVKwnceA7lmW3l8RzphvUQbyz9u42lEks3G0tPJbOx4dKpy+NBf16gcKhrkgcO XZ5JpvnQt2bNNPewMEmHHvKwsNkPM/uJN5Ef98EqSPhwG3wuS+P/V2iq+D+0wLob3lraGGjSAhEt 0ASI6Ns2rMjSNy9xubqWviUNLl2MjCxpXCFpQ5P+ltZUpS/VqlxdDWa9fzA3SnODVtVFjYG6UFej v6kq2uBvCGgNVeHuA+2Vwcv6uuNSX5Xt/6SvdtlYpezrgFnvH/oKSvMB2VdQ9hWUfR3wHzD7Cs6r YMHaUJeNKsKVmEBJu3lKMp6HSLY7XDHY0TLNfDimurNuzj6mEF5bKQVhPVWr0O0A+dwUlheWSxOe TmlKgzo9Ycq6eao7+xg7mDA5oB6gVVABZQVWVl36a21tbZOwfn0BcNt6aQSDh9Y9P6hXz10c0n26 L6D7I1VhJmdtfeJXGfI7TvhO+Xizr923w9fpO+JT168PQ51xIvdULq/Pbc5tz92R25l7JNciDVeF nvT7OnP/kivWYzWxNvwCsit0DYo/KbatRzCtrYROWgHx7grWF1SGynOpEaddhpN5IQ0EaIDxgPkA lf4V+GXAe4DPAQrdCnwv4BFAt9SIQlEYyFpZJXsMo8UeyhIl3cUTSybHQBuWxen8xXEamBOnvvKS LNijZeOTy9Nx8GZ0DPh5wJuATwB/B6iiRJSYjSNm+Qu3UmsBQ7YIQptErQVtrAAMk+luay0ogIOU oYCE3JrphZz4EWtdT0gFJgQETqa+VVZDH6ib+EkDtmL1LsBscgKG43aVTWS8CzgL+Kh/lnFevZa0 /lXGGTEQzo8ngMhDu6mT8ugcG0cnqRc7+QEcdWppF02nU3SE0uhG9gKyqeGEcRD7hRP7fjUNYSrt oTfoKlpH79MZ3JqD9A7LQDsBasGtcYrxMXCQtho98EqmSvo5HWOr2Xx8V6ikGdyLTHhoh9FLQyjf eNF4HdKD9D7LM7poBrgPaABO5+10N67Rq+h5Q34lyaMl9CjbyD7G2SpC25QJSodxLU2lo/QqC4K7 km5UX086itPB3fQIG8J6jT7jQ3oa79ImtPQD2oqIo9TLx4pKdR+5aCR9j+ZQA6z/Qm+wgWyc8Buj jApjD7SP0me8gP9aWBFHAc2kerqTHkI2XqOzOAqksInsQXYI5SX2Z/V1xBak9XQTbUbkB1D3MPWw cWwcH4LzIccIR9MC2HbQfvTfTadZkIVZL3tG7FeL+8uMQUam8aFh0BgKIcJOegZ9fMGK4YMeRK5o U3KUNrXkwi0Y4VJ6gE7TS4jjHeT9S/qajUF5l9/M241FxkHjfcRiw9lhMs2lxdRMG+h6ehizepJ+ RX9l3/AkeJ5SnlVvUs8Z9yC3I6kCsdfAez7a3oZZilIM5TWMcgBzYRST2Rw2jy1nO9huFmNvsDe4 hbvxqvxE6OIF8ZZyhaoapWhpsLzJY5UsohWYgZuR7Xsw3oP0LD3HMtlIVogRvYb6X/GpvArlEX6K vyO2iB3KefW2/jP9f+z/xujAt6cqrLsQsvkYsvAXNhgxjGarWCt7D5Hv5E+INOEQmpgoykWdCIut Ypf4N/E7ZZ1ySHlTnak2qIesDf3X9b9kBI0fIhcMd7UcrCQvTaBJWD/LsJquRXwtKOtoI91CHXQX 1ss9tA/n3RidoOfoVXqb/oQZIOZGzCvR+xqsui3sLpQ97DB7hj3LnmPvsq9k4bko+fwKXsYreTVf zreg7OKn+Wv8IzFcNOL+vRllLz4FvYFdWlEMtQRlhrpNfdTygjXfOsO6xPbb859eGHMhfOGdfuof 1v/9/t39z/R/aCw0bkT8HiqksYj0dkS5B2twP8pjWIlP0q/pt/QHM9bPGGcqVnwW07AavJi1MjYd R42Z7Eo2F2UByiK2GKWBLWErUNrZZvYDdiv7IbuT/cgs92Ns+9nP2JMov2DHUF5lfewD9gn7jGMR c4HV7OGjeBGfgpFW8um8hs9DWc6bUVr4Or4BM/Qo7+Y9/DUxUHiw2zaItWKP+Lk4KV4Rf1O44lWK FJ+yUFmu3KqcUl5SXle+UZ1qQF2h7lVPWrItEywLLKss91uOWD6ynLdarLU4rm60vmI1bB7sWL/B uI9iTr/9FVlOsVZ1kHID78NzkSVa1NvZAmTMwuvEanGX+L26jJ0TLvYm6xArxbXGI6Kafy2a2UJ+ guUKp1qKTznbyWCH+Lv8C/6hksnq+McsX7mb/YI3i0qObwzYU19WMpVb1Y/wNeAPVMo3sV7+LL5c 3Wr8kkrVvaxP3ctfIpdyhg+kPjzVt/P7UOl3fCXfRiFlgvoNrUTef6begHxP41vZGPGKspfeFxr/ HLer3dg1XmSzlDx+DZ/CDmHHvcBy6FO2llrYj8jPnmJvsxjOxAfFo2w2T8Vs6dzOJuFjy4vCzV4R yRSWMbKRPJPV8nN8gThuOS0m4tpzmn5PNzHBirF2Lv766To8Abv4KOxpAewmL7MSyqL7sN9/0X9c 7tjq6+o2rLOHhJfmUTFdzV+gUjwb76OE6DZ8ozuGNbiVivn9tNHYzJZi378S+ycn3NuoiKVgtxyC 2NrxvhjMc7EX1qPrr7H/P49dP8j+TNczF56sXspXpGW7EsDOFMH+uw1lKV0N6QG6x3JUfZlq2BAi xdW/F6v8LboG75z30P8wfKG+GzvbQ4oXUbuwM69FjQf6Z5Af5TZ6gXHahJin4TmvVWZg591trMII V+IdNRvvxOdopXEfVWLu5hm3Gtuo3njIuAo33PnGQey/G4woXUG3q2G+UC1QJmCPfY79Cu+jf2fb sG/PoDexH3lYFn2C8nPEP019ijqUP2DvLDO2G6/iK2s+vrzuwT4zC7vXGvoz8jZD9NL4/jm8y6gW LXhD9dFc41HDyZJphbEaO+9x2m9Vsfdsphx1P9buNmUZL0a8o2kwK4L2KrWTyF+xoM5fNu17vqml UyZPumLihPEl44qLxhZ6C8aMzh810pOn5bpdzpwRw7OHDc0aMnjQwIwBjvQ0e2pKcpLNalEVgau0 N6BVR1z6yIiujNRmzCiUstYARcN3FBHdBVX15T66S9ZrgOkyTz88l/2Dpz/u6b/kyRwuH/kKva6A 5tJfrNJcMbZ4bgj8nVVa2KV/avJXmvxOk7eDd7tRwRXIWlHl0lnEFdCrN6zoCESqCr2sKyW5Uqts Si70UldyCtgUcPoQraWLDZnGTIYPCZR2cbLZMUR9mFYV0IdqqIpmhCfQsFSvnRsKVGW73eFCr84q G7UlOslTc4HpQpVmN7qlUrea3bhW6hgNbXN1eXs7tscctCRSkLpUW9pwVUgXDWgjoA8oQL9V+pCb zmZ9K6JxnM9v/641W3TghOiSzh0dt7v0fXND36mb7ZYthMNoQ+ee6khHNTrejnkKyuubzreEQzrb gg5xw/CYY4qPLn798URWufQkrUJb0bEqgokZ1qHTvBvd0WHD/D3GGRoWcHXUhTS3XpathRuqhncN oo55N3YP9buGXm4p9HY5BsTT2pWWnmBS7d9lmpDyuM3kTHfJBeddyiuTMWozcWnQXY0uRBLSMKbJ EjVNpo7GyUg/fmGGWvpSzMdKPaky0uEohd6BITJd9Tg0V8eXhPnXPv3T5ZqGhMbicXxJ0ihXyaWF puMll1h0ekGBPmaMXCDWSswoYpxmyhMLvRtiXNdaHC4Q3B6pFrltCJcWIflut5zebTE/LYGgb54b issuWpIdJX8Rblk8Ii29Fy2ZC6Rl80XLpeoRDev4CbzDiTJ128hLf+mOwQMDK0p1Nvh/MDfF7cH5 WhB3MFegI5JYs8G6y6S4XSYUeYMtwbF4RSRcVzy6xTNTw9Kbh8scFPhTPdVaYGVkBh41xKgPrAyJ bI4GJMezhdkU1u9Viy+2J4VQqmxL8VjM9b80ZrVhAZsa5qrWHZEZcRxOdrsTj9f/VilmnJO1TPJt tcSY9dKCxKjiY9SnXiZfFl5qhwjWYXfiwbrFHR3Jl9mqse91dFRrruqOSEdDzNi8RHM5tI4eERKh jpYAdqz49MeMY9uy9ertYQxlBSvFIudU0aWxrXO7/Gzr/MWhHnz8cm2tC0U545WRinBXHmyhHhf2 Z1PLpVYqpYtLCnjn4amIcpvpn93jJ9psWhVTYcqN+Bpm6uJO0DFqxEdcU+e46MehU+I6v6kL4yd3 isq6UCJf5swjY3IlEP53O4UNx/+IPgCLoyww4b/XFgDhLXhRQ7g/HYeGs+E46QyX/27BGfzKLs6e 4k/D28pPRElVYvzpJwQlWyVzlNFQm0U9ATsnwUZTEruWXUNZBY6vfBd8cxxf+K684KMy8I7zQOOK 3QPcAzxAbLhC512i97xfpW9wYupFXx8YZ63D8NZPwS1Jo/v8LS6P34P/r1pS/RlZ/pycjAxLSrbf 7a+c6PaXTex097l5urvGvQOM0uw+4Tbcwv16uj8TDpnSIbMvk6dn1mTuAKM0Z57INDJF5uvCn7S5 dKIzqT6J1yT1JfEdEiV9nff+2zLqq9euK7hg4ovkU4Tv8Dk+lWVcMbvaUzI4c5BFyx05ccIV7v+G ZwuK/OVjx5aX8zeAvsv4T5ri2IT9OxR5l9OCG7obp59/9pP2Q6aB4Y4Vn0ULzmxUO336vJr5BXUr 1zS1zmm6fl7zmobraudfif/2/xc7Q0aZCmVuZHN0cmVhbQplbmRvYmoKMTIwIDAgb2JqCjU2NjgK ZW5kb2JqCjEyMSAwIG9iagoodG9rYmluZC10bHMtdGVybS1pZXRmOTgucHB0eCkKZW5kb2JqCjEy MiAwIG9iagooTWFjIE9TIFggMTAuMTIuMyBRdWFydHogUERGQ29udGV4dCkKZW5kb2JqCjEyMyAw IG9iagooQnJpYW4gQ2FtcGJlbGwpCmVuZG9iagoxMjQgMCBvYmoKKCkKZW5kb2JqCjEyNSAwIG9i agooUG93ZXJQb2ludCkKZW5kb2JqCjEyNiAwIG9iagooRDoyMDE3MDMyMzIyMTY0MFowMCcwMCcp CmVuZG9iagoxMjcgMCBvYmoKKCkKZW5kb2JqCjEyOCAwIG9iagpbICgpIF0KZW5kb2JqCjEgMCBv YmoKPDwgL1RpdGxlIDEyMSAwIFIgL0F1dGhvciAxMjMgMCBSIC9TdWJqZWN0IDEyNCAwIFIgL1By b2R1Y2VyIDEyMiAwIFIgL0NyZWF0b3IKMTI1IDAgUiAvQ3JlYXRpb25EYXRlIDEyNiAwIFIgL01v ZERhdGUgMTI2IDAgUiAvS2V5d29yZHMgMTI3IDAgUiAvQUFQTDpLZXl3b3JkcwoxMjggMCBSID4+ CmVuZG9iagp4cmVmCjAgMTI5CjAwMDAwMDAwMDAgNjU1MzUgZiAKMDAwMDc2NDM2NSAwMDAwMCBu IAowMDAwMDAxNTI5IDAwMDAwIG4gCjAwMDA3MDY1NjkgMDAwMDAgbiAKMDAwMDAwMDAyMiAwMDAw MCBuIAowMDAwMDAxNTA5IDAwMDAwIG4gCjAwMDAwMDE2MzMgMDAwMDAgbiAKMDAwMDMwMTI0MyAw MDAwMCBuIAowMDAwMDAxODI5IDAwMDAwIG4gCjAwMDAwMDgzODQgMDAwMDAgbiAKMDAwMDMwMDAw MyAwMDAwMCBuIAowMDAwNzI0MzcxIDAwMDAwIG4gCjAwMDA3MDg0MTkgMDAwMDAgbiAKMDAwMDAw OTA3NSAwMDAwMCBuIAowMDAwMjkzNDYwIDAwMDAwIG4gCjAwMDAwMDg0MDQgMDAwMDAgbiAKMDAw MDAwOTA1NSAwMDAwMCBuIAowMDAwMjkzNDgzIDAwMDAwIG4gCjAwMDAyOTU0NTYgMDAwMDAgbiAK MDAwMDI5NTQ3NyAwMDAwMCBuIAowMDAwMjk3MjQ2IDAwMDAwIG4gCjAwMDAyOTcyNjcgMDAwMDAg biAKMDAwMDI5OTk4MiAwMDAwMCBuIAowMDAwMzAwMDQwIDAwMDAwIG4gCjAwMDAzMDEyMjIgMDAw MDAgbiAKMDAwMDMwMzExMSAwMDAwMCBuIAowMDAwMzAxMjc5IDAwMDAwIG4gCjAwMDAzMDMwOTAg MDAwMDAgbiAKMDAwMDMwMzIxOCAwMDAwMCBuIAowMDAwMDAwMDAwIDAwMDAwIG4gCjAwMDA3NTA4 OTEgMDAwMDAgbiAKMDAwMDAwMDAwMCAwMDAwMCBuIAowMDAwNzU0MjgwIDAwMDAwIG4gCjAwMDAz MDUyNzkgMDAwMDAgbiAKMDAwMDMwMzQxNSAwMDAwMCBuIAowMDAwMzA1MjU4IDAwMDAwIG4gCjAw MDAzMDUzODYgMDAwMDAgbiAKMDAwMDMwNzgxNiAwMDAwMCBuIAowMDAwMzA1NTgzIDAwMDAwIG4g CjAwMDAzMDc3OTUgMDAwMDAgbiAKMDAwMDMwNzkyMyAwMDAwMCBuIAowMDAwMzA4NTE4IDAwMDAw IG4gCjAwMDAzMDg4NDggMDAwMDAgbiAKMDAwMDMwODIyMiAwMDAwMCBuIAowMDAwMzA4NDk5IDAw MDAwIG4gCjAwMDAzMTE1NTUgMDAwMDAgbiAKMDAwMDMxMzc0MCAwMDAwMCBuIAowMDAwMzA5Mzky IDAwMDAwIG4gCjAwMDAzMTA0MTYgMDAwMDAgbiAKMDAwMDMxMDQzNiAwMDAwMCBuIAowMDAwMzEw ODk2IDAwMDAwIG4gCjAwMDAzMTA5MTYgMDAwMDAgbiAKMDAwMDMxMTUzNSAwMDAwMCBuIAowMDAw MzA4ODY4IDAwMDAwIG4gCjAwMDAzMDkzNzIgMDAwMDAgbiAKMDAwMDMyNTg3NCAwMDAwMCBuIAow MDAwMzI1OTI1IDAwMDAwIG4gCjAwMDAzMTkzMzUgMDAwMDAgbiAKMDAwMDMxOTg1MSAwMDAwMCBu IAowMDAwMzIyMTE5IDAwMDAwIG4gCjAwMDAzMjI2OTUgMDAwMDAgbiAKMDAwMDMxOTg3MSAwMDAw MCBuIAowMDAwMzIyMDk4IDAwMDAwIG4gCjAwMDAzMTM3NjEgMDAwMDAgbiAKMDAwMDMxNjQ5MyAw MDAwMCBuIAowMDAwMzI0MTM1IDAwMDAwIG4gCjAwMDAzMjU4NTMgMDAwMDAgbiAKMDAwMDMxNjUx NCAwMDAwMCBuIAowMDAwMzE5MzE0IDAwMDAwIG4gCjAwMDAzMjI3MTUgMDAwMDAgbiAKMDAwMDMy NDExNCAwMDAwMCBuIAowMDAwMzI2NzA4IDAwMDAwIG4gCjAwMDAzMjU5NzAgMDAwMDAgbiAKMDAw MDMyNjY4OCAwMDAwMCBuIAowMDAwMzI2ODE1IDAwMDAwIG4gCjAwMDAzMjcwMDEgMDAwMDAgbiAK MDAwMDM3ODc0MyAwMDAwMCBuIAowMDAwMzk1MjEwIDAwMDAwIG4gCjAwMDAzNzg3NjUgMDAwMDAg biAKMDAwMDM5MjI5NCAwMDAwMCBuIAowMDAwMzkyMzE2IDAwMDAwIG4gCjAwMDAzOTUxODkgMDAw MDAgbiAKMDAwMDM5Njk2NiAwMDAwMCBuIAowMDAwMzk1MjQ3IDAwMDAwIG4gCjAwMDAzOTY5NDUg MDAwMDAgbiAKMDAwMDM5NzA3MyAwMDAwMCBuIAowMDAwNzU3ODUxIDAwMDAwIG4gCjAwMDAzOTg1 NDYgMDAwMDAgbiAKMDAwMDM5NzI4MiAwMDAwMCBuIAowMDAwMzk4NTI1IDAwMDAwIG4gCjAwMDAz OTg2NTMgMDAwMDAgbiAKMDAwMDM5OTc5MCAwMDAwMCBuIAowMDAwMzk4ODUwIDAwMDAwIG4gCjAw MDAzOTk3NzAgMDAwMDAgbiAKMDAwMDM5OTg5NyAwMDAwMCBuIAowMDAwNDAwMTE5IDAwMDAwIG4g CjAwMDA3MDY1NDYgMDAwMDAgbiAKMDAwMDcwNjc2NSAwMDAwMCBuIAowMDAwNzA2NzAxIDAwMDAw IG4gCjAwMDA3MDY5NDAgMDAwMDAgbiAKMDAwMDcwNzE4OSAwMDAwMCBuIAowMDAwNzA4Mzk3IDAw MDAwIG4gCjAwMDA3MDkwMzcgMDAwMDAgbiAKMDAwMDcwOTMwNiAwMDAwMCBuIAowMDAwNzI0MzQ4 IDAwMDAwIG4gCjAwMDA3MjUwNTYgMDAwMDAgbiAKMDAwMDcyNTMxOCAwMDAwMCBuIAowMDAwNzUw ODY4IDAwMDAwIG4gCjAwMDA3NTEzODkgMDAwMDAgbiAKMDAwMDc1MTA2NiAwMDAwMCBuIAowMDAw NzUxMzY4IDAwMDAwIG4gCjAwMDA3NTE2MzMgMDAwMDAgbiAKMDAwMDc1NDI1OCAwMDAwMCBuIAow MDAwNzU0NzY4IDAwMDAwIG4gCjAwMDA3NTQ0NDcgMDAwMDAgbiAKMDAwMDc1NDc0NyAwMDAwMCBu IAowMDAwNzU1MDE5IDAwMDAwIG4gCjAwMDA3NTc4MjkgMDAwMDAgbiAKMDAwMDc1ODAzOCAwMDAw MCBuIAowMDAwNzU4MzEwIDAwMDAwIG4gCjAwMDA3NjQwNzAgMDAwMDAgbiAKMDAwMDc2NDA5MiAw MDAwMCBuIAowMDAwNzY0MTQwIDAwMDAwIG4gCjAwMDA3NjQxOTQgMDAwMDAgbiAKMDAwMDc2NDIy OCAwMDAwMCBuIAowMDAwNzY0MjQ4IDAwMDAwIG4gCjAwMDA3NjQyNzggMDAwMDAgbiAKMDAwMDc2 NDMyMSAwMDAwMCBuIAowMDAwNzY0MzQxIDAwMDAwIG4gCnRyYWlsZXIKPDwgL1NpemUgMTI5IC9S b290IDk4IDAgUiAvSW5mbyAxIDAgUiAvSUQgWyA8ZjY1MzA5ZjMzNzhkZTNmODA5ZjhlZGMwNmM5 ZjU3YjA+CjxmNjUzMDlmMzM3OGRlM2Y4MDlmOGVkYzA2YzlmNTdiMD4gXSA+PgpzdGFydHhyZWYK NzY0NTQ5CiUlRU9GCg== --Apple-Mail-093ACE67-BA70-41B3-810A-FF4FBF374113 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit
--Apple-Mail-093ACE67-BA70-41B3-810A-FF4FBF374113-- --Apple-Mail-BD49AEE5-480E-44F4-92C5-3558EAB8E3EA-- From nobody Wed Mar 29 22:01:21 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 01F7B1286B2 for ; Wed, 29 Mar 2017 22:01:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=telecom-paristech.fr Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xk4Yj3XoNezu for ; Wed, 29 Mar 2017 22:01:18 -0700 (PDT) Received: from zproxy120.enst.fr (zproxy120.enst.fr [137.194.2.193]) by ietfa.amsl.com (Postfix) with ESMTP id 281D01204DA for ; Wed, 29 Mar 2017 22:01:18 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by zproxy120.enst.fr (Postfix) with ESMTP id 95E12FFF3E; Thu, 30 Mar 2017 07:01:17 +0200 (CEST) Received: from zproxy120.enst.fr ([127.0.0.1]) by localhost (zproxy120.enst.fr [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id VpRkZc0RCNB7; Thu, 30 Mar 2017 07:01:17 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by zproxy120.enst.fr (Postfix) with ESMTP id F34D9100605; Thu, 30 Mar 2017 07:01:16 +0200 (CEST) DKIM-Filter: OpenDKIM Filter v2.9.2 zproxy120.enst.fr F34D9100605 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telecom-paristech.fr; s=A6AEC2EE-1106-11E5-B10E-D103FDDA8F2E; t=1490850077; bh=49Z+D8vGM/iJf5n2LY8SMuOxERJp9/+pdgg0fJ2pgEc=; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type: Content-Transfer-Encoding; b=zMmj1TQeeghL/589kvwyrRpdoF8zUpS28yaTk6+G88c+HXoVPzkCwuhXd5ogp5bJ4 OzyWm1ao6v3SpAzUu2dEeSugqUO36LjqCjBxZ5MJMrowLno4J3cPyqL5ef9OwvsrtU RR07zT6Kjn4ifZ4fO/yEWFqu926CZUSmwf7jsrsg= X-Virus-Scanned: amavisd-new at zproxy120.enst.fr Received: from zproxy120.enst.fr ([127.0.0.1]) by localhost (zproxy120.enst.fr [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id qJ0y2WFBbpbu; Thu, 30 Mar 2017 07:01:16 +0200 (CEST) Received: from zmail111.enst.fr (zmail111.enst.fr [137.194.2.201]) by zproxy120.enst.fr (Postfix) with ESMTP id E06921005FD; Thu, 30 Mar 2017 07:01:16 +0200 (CEST) Date: Thu, 30 Mar 2017 07:01:16 +0200 (CEST) From: Mounira Msahli To: Ilari Liusvaara Cc: tls@ietf.org Message-ID: <1586810299.54149710.1490850076772.JavaMail.zimbra@enst.fr> In-Reply-To: <20170329141901.GB23157@LK-Perkele-V2.elisa-laajakaista.fi> References: <1575133442.47281418.1481107447078.JavaMail.zimbra@enst.fr> <1260834683.47309360.1481109342289.JavaMail.zimbra@enst.fr> <1BD268B1-1501-4A89-A243-3222B82D294E@sn3rd.com> <225960635.46624063.1490006387696.JavaMail.zimbra@enst.fr> <851B7D2D-C8E0-4D9F-9259-877D0666956E@sn3rd.com> <50700431.53802914.1490791293494.JavaMail.zimbra@enst.fr> <20170329141901.GB23157@LK-Perkele-V2.elisa-laajakaista.fi> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [137.194.2.193] X-Mailer: Zimbra 8.0.9_GA_6191 (ZimbraWebClient - FF47 (Win)/8.0.9_GA_6191) Thread-Topic: ITS ETSI/IEEE-TLS extension Thread-Index: CmhtiWuAhi8CdYGi3zC53x7Po3k6gw== Archived-At: Subject: Re: [TLS] ITS ETSI/IEEE-TLS extension X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Mar 2017 05:01:20 -0000 Ok, thank you=20 Mounira=20 ----- Mail original -----=20 De: "Ilari Liusvaara" =20 =C3=80: "Mounira Msahli" =20 Cc: tls@ietf.org, "Houda Labiod" , "ahme= d serhrouchni" =20 Envoy=C3=A9: Mercredi 29 Mars 2017 16:19:01=20 Objet: Re: [TLS] ITS ETSI/IEEE-TLS extension=20 On Wed, Mar 29, 2017 at 02:41:33PM +0200, Mounira Msahli wrote:=20 > Dear TLS list members,=20 >=20 > I have updated the draft: Transport Layer Security (TLS)=20 > Authentication using ITS ETSI and IEEE certificates,=20 > https://www.ietf.org/id/draft-serhrouchni-tls-certieee1609-01.txt=20 This uses *certificate_type extension, which is well-known to be=20 extremely poor match for TLS 1.3. And for application like this,=20 one wants something that is usable with TLS 1.3.=20 Furthermore, it doesn't specify how the certificate message is=20 interpretted.=20 Also, as of currently, the highest ECC performance in TLS=20 is X25519 for key exchange and Ed25519 for authentication.=20 -Ilari=20 From nobody Thu Mar 30 14:54:39 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DB7A12940E for ; Thu, 30 Mar 2017 14:54:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.702 X-Spam-Level: X-Spam-Status: No, score=-2.702 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K59UahUvQtkf for ; Thu, 30 Mar 2017 14:54:35 -0700 (PDT) Received: from prod-mail-xrelay06.akamai.com (prod-mail-xrelay06.akamai.com [96.6.114.98]) by ietfa.amsl.com (Postfix) with ESMTP id 84DD31295E7 for ; Thu, 30 Mar 2017 14:54:32 -0700 (PDT) Received: from prod-mail-xrelay06.akamai.com (localhost.localdomain [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id 2909E16CBA4 for ; Thu, 30 Mar 2017 21:54:32 +0000 (GMT) Received: from prod-mail-relay08.akamai.com (prod-mail-relay08.akamai.com [172.27.22.71]) by prod-mail-xrelay06.akamai.com (Postfix) with ESMTP id 13AD716CB3B for ; Thu, 30 Mar 2017 21:54:32 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; s=a1; t=1490910872; bh=4FCiNqnFyJn0O5b4PLWU7Yx8lyUgXTJZQSkdR5uEHWA=; l=1239; h=From:To:Date:From; b=I6YiQ2O0aPJ6mlOhnCcwi7X7XIyNq9qygtXyeclSIwPcbdVKlnuNdT+V0sfumsd7A rPRuw27FaN46LbuGiV7VBdZU7h1oxbMxoI413ozSHsXieFdGU2esJff6m0BsgtuX2G 5MkuOdSUk4ZlSndpD/Uu6zmpie1oxgh31PGjQ2H8= Received: from dhcp-89ad.meeting.ietf.org (unknown [172.19.41.73]) by prod-mail-relay08.akamai.com (Postfix) with ESMTP id 9DB6698082 for ; Thu, 30 Mar 2017 21:54:31 +0000 (GMT) From: Brian Sniffen To: tls@ietf.org Date: Thu, 30 Mar 2017 16:54:29 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: [TLS] security considerations for draft-rescorla-tls-subcerts X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Mar 2017 21:54:37 -0000 I'm trying to understand the adversary model in which Delegated Credentials are helpful. It seems like if you weren't going to sign off on a cloud service provider getting a certificate before, you *probably* shouldn't let them have a delegated credential now---but if you were going to do so, *and* you don't believe revocation works (wise!), now you can offer a delegated credential and be safer? That corresponds to an adversary who can compromise a cloud service and learn the customers' private keys---but can only do so rarely. Now instead of having ~ 1 year of use of your certificate, that adversary has a few days of use of your credential. But if the cloud service is regularly breached, you're as bad off as before (but no worse?) It sounds like the first years of delegated credentials will see them used in tandem with split systems (Lurk, Akamai and Cloudflare's various patented approaches)---then the primary benefit of delegated credentials is lower latency for session establishment. But maybe the idea is to avoid the first circumstance and emphasize that these are for the second case. Authors, can you describe what you have in mind? Thanks, Brian -- Brian Sniffen Akamai Technologies From nobody Fri Mar 31 04:57:29 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81BA01296BB for ; Fri, 31 Mar 2017 04:57:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r5RcNAyFFVBa for ; Fri, 31 Mar 2017 04:57:18 -0700 (PDT) Received: from smtp.ssi.gouv.fr (smtp.ssi.gouv.fr [86.65.182.16]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 567C71296A7 for ; Fri, 31 Mar 2017 04:57:17 -0700 (PDT) Received: from smtp-switch.internet.local (smtp-switch [192.168.3.9]) by smtp.ssi.gouv.fr (Postfix) with ESMTP id 779F590B914 for ; Fri, 31 Mar 2017 13:55:59 +0200 (CEST) To: tls@ietf.org References: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> <58D8C395.8090707@ssi.gouv.fr> From: Olivier Levillain X-Enigmail-Draft-Status: N1110 Message-ID: <58DE441B.7010203@ssi.gouv.fr> Date: Fri, 31 Mar 2017 13:57:15 +0200 User-Agent: MIME-Version: 1.0 In-Reply-To: <58D8C395.8090707@ssi.gouv.fr> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [TLS] WGLC: draft-ietf-tls-tls13-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Mar 2017 11:57:23 -0000 Hi, > I think there is at least another issue that still needs to be > discussed: how to properly handle post-handshake handshake messages. > > The subject has also been raised several times on GitHub > (https://github.com/tlswg/tls13-spec/pull/680, > https://github.com/tlswg/tls13-spec/pull/676, > https://github.com/tlswg/tls13-spec/issues/572) and on the mailing list > (https://www.ietf.org/mail-archive/web/tls/current/msg22038.html). > > Bottom line is: > - handling client late authentication requires a lot of state in the > client stack > - currently, handling client late authentication is mandatory [...] > Thus, I believe the current text is inadequate. Different solutions are > possible : > - remove client late authentication entirely (this would have my > preference, since it introduces other issues*) > - make client late authentication optional (compatible clients would > signal it as an extension) > - rethink the client late authentication, as was done with KeyUpdate, > to limit the state required on the client side. Martin Thomson proposed a PR (thank you) corresponding to the second point, using a simple extension in the ClientHello : https://github.com/tlswg/tls13-spec/pull/921/ I believe this proposal is a good trade-off allowing simpler implementation designs when late client authentication is not needed. Best regards, Olivier Levillain From nobody Fri Mar 31 05:08:56 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8EDB41242F5 for ; Fri, 31 Mar 2017 05:08:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CZOP_fhayQdV for ; Fri, 31 Mar 2017 05:08:52 -0700 (PDT) Received: from mail-yw0-x229.google.com (mail-yw0-x229.google.com [IPv6:2607:f8b0:4002:c05::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C299126C7A for ; Fri, 31 Mar 2017 05:08:52 -0700 (PDT) Received: by mail-yw0-x229.google.com with SMTP id p77so37340284ywg.1 for ; Fri, 31 Mar 2017 05:08:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=TcQpW0p+C705ZIYZWfdgGAFrBJoNzlZZn5qL5CmvLxM=; b=Wz+5t6eagsL7Wzw2BAjeBwcHouhksAonprFh81X90vNNa2bSWBk+b+y8GUbQUQw8Zo QT3AS1ZdDnF9lZKKCGrNvpKf+qhsrm6j/WVKFvSEI+6/JOVezKKl2Xtmz45vg9BROsFA VOVlk6BUUMGd+L5BEeWmr53FFhFyXlXkpmAqHuD2IAxlnuJQy8K9f1WIN4JurMJyM1QY G52Jp/0HYM2PAlPxqbUWVU6UxLCGy35AkfxNubIzXBr8JDff9pJ8Wh+4oVKRxzKULJOL IBTXtEnyoy7vOxI4BUYBN6ekk8b9dw0Qhy512lpls4+hrkq0NGfgMhptTn/M3uVbL2VF c9ow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=TcQpW0p+C705ZIYZWfdgGAFrBJoNzlZZn5qL5CmvLxM=; b=fLNOd5ijGEjwnzphPBSKCEfHRud3CrsF/j294EZq/r/NtHpyaGJmUcHCJL7qfIs6iD CP4LjPDZyFRqgRYTQWlDc177+VAP4URt6DO1chid0s+BnpvSMP2bUQPHLdAc0UqqABuv uPp5pG/r+eohhv+pLwJcgIsiJaTJ9YqPP+qkJBLSdRiV3tiIahV2RBoOqu6f0A8hjSXl sJTzHTsY+XOuOtLTI8jpYUT/pPoB5CkSVVEmfp4RS6UaBRcVF/fgzN8OdBS+xdyUBerW yvIA0nYJQ6DA2fzZ6Hed7vSPZh9uz9GixP7fZv2iPm3JI2se+39+xD5woCIKMcaWC4ia FPIA== X-Gm-Message-State: AFeK/H0iymC+bsCB0z710OxWk4a/icIkgMik9762nbMkODF47CA43/ErpJrOkEbS92JK+o9xIb6G+xCDmnJGBA== X-Received: by 10.13.204.206 with SMTP id o197mr2014363ywd.87.1490962131482; Fri, 31 Mar 2017 05:08:51 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Fri, 31 Mar 2017 05:08:11 -0700 (PDT) In-Reply-To: <58DE441B.7010203@ssi.gouv.fr> References: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> <58D8C395.8090707@ssi.gouv.fr> <58DE441B.7010203@ssi.gouv.fr> From: Eric Rescorla Date: Fri, 31 Mar 2017 07:08:11 -0500 Message-ID: To: Olivier Levillain Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a114e6b3c3890bc054c05acef Archived-At: Subject: Re: [TLS] WGLC: draft-ietf-tls-tls13-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Mar 2017 12:08:54 -0000 --001a114e6b3c3890bc054c05acef Content-Type: text/plain; charset=UTF-8 Yes, we discussed this at IETF 98 and had rough consensus. I'll be merging this PR this week -Ekr On Fri, Mar 31, 2017 at 6:57 AM, Olivier Levillain < olivier.levillain@ssi.gouv.fr> wrote: > Hi, > > > I think there is at least another issue that still needs to be > > discussed: how to properly handle post-handshake handshake messages. > > > > The subject has also been raised several times on GitHub > > (https://github.com/tlswg/tls13-spec/pull/680, > > https://github.com/tlswg/tls13-spec/pull/676, > > https://github.com/tlswg/tls13-spec/issues/572) and on the mailing list > > (https://www.ietf.org/mail-archive/web/tls/current/msg22038.html). > > > > Bottom line is: > > - handling client late authentication requires a lot of state in the > > client stack > > - currently, handling client late authentication is mandatory > > [...] > > > Thus, I believe the current text is inadequate. Different solutions are > > possible : > > - remove client late authentication entirely (this would have my > > preference, since it introduces other issues*) > > - make client late authentication optional (compatible clients would > > signal it as an extension) > > - rethink the client late authentication, as was done with KeyUpdate, > > to limit the state required on the client side. > > > Martin Thomson proposed a PR (thank you) corresponding to the second > point, using a simple extension in the ClientHello : > https://github.com/tlswg/tls13-spec/pull/921/ > > I believe this proposal is a good trade-off allowing simpler > implementation designs when late client authentication is not needed. > > > Best regards, > Olivier Levillain > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --001a114e6b3c3890bc054c05acef Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Yes, we discussed this at IETF 98 and had rough consensus.= I'll be merging this PR this
week

-Ekr


On Fri, Mar 31, 2017 at 6:57 AM, Olivier Levillain <oli= vier.levillain@ssi.gouv.fr> wrote:
Hi,

> I think there is at least another issue that still needs to be
> discussed: how to properly handle post-handshake handshake messages. >
> The subject has also been raised several times on GitHub
> (https://github.com/tlswg/tls13-spec/pull/680<= /a>,
> https://github.com/tlswg/tls13-spec/pull/676,
> https://github.com/tlswg/tls13-spec/issues/5= 72) and on the mailing list
> (https://www.ietf.org/mail-= archive/web/tls/current/msg22038.html).
>
> Bottom line is:
> - handling client late authentication requires a lot of state in the > client stack
> - currently, handling client late authentication is mandatory

[...]

> Thus, I believe the current text is inadequate. Different solutions ar= e
> possible :
> - remove client late authentication entirely (this would have my
> preference, since it introduces other issues*)
> - make client late authentication optional (compatible clients would > signal it as an extension)
> - rethink the client late authentication, as was done with KeyUpdate,<= br> > to limit the state required on the client side.


Martin Thomson proposed a PR (thank you) corresponding to the second=
point, using a simple extension in the ClientHello :
https://github.com/tlswg/tls13-spec/pull/921/<= br>
I believe this proposal is a good trade-off allowing simpler
implementation designs when late client authentication is not needed.


Best regards,
Olivier Levillain

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--001a114e6b3c3890bc054c05acef-- From nobody Fri Mar 31 06:49:14 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 123CF129801 for ; Fri, 31 Mar 2017 06:49:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.922 X-Spam-Level: X-Spam-Status: No, score=-6.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e9ji6xnCbP_x for ; Fri, 31 Mar 2017 06:49:11 -0700 (PDT) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 503001297D0 for ; Fri, 31 Mar 2017 06:49:11 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 4F28E22BA29; Fri, 31 Mar 2017 13:40:44 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 4F28E22BA29 Authentication-Results: ext-mx09.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx09.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=hkario@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 4F28E22BA29 Received: from pintsize.usersys.redhat.com (ovpn-200-48.brq.redhat.com [10.40.200.48]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 0407418A51; Fri, 31 Mar 2017 13:40:44 +0000 (UTC) From: Hubert Kario To: tls@ietf.org Date: Fri, 31 Mar 2017 15:40:35 +0200 Message-ID: <2454705.8d2estPYRD@pintsize.usersys.redhat.com> In-Reply-To: <228B1CCF-088B-4F4C-B2FD-A20036B9224A@akamai.com> References: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> <228B1CCF-088B-4F4C-B2FD-A20036B9224A@akamai.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart4879030.lEqOSujmGg"; micalg="pgp-sha512"; protocol="application/pgp-signature" X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Fri, 31 Mar 2017 13:40:44 +0000 (UTC) Archived-At: Subject: Re: [TLS] WGLC: draft-ietf-tls-tls13-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Mar 2017 13:49:13 -0000 --nextPart4879030.lEqOSujmGg Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" On Tuesday, 28 March 2017 08:23:33 CEST Kaduk, Ben wrote: > On 3/13/17, 12:30, "Sean Turner" wrote: > Do we want to add some commentary about the extant SHA1 collisions when we > say that {rsa_pkcs1,dsa,ecdsa}_sha1 are only SHOULD NOT? =20 There still are non-insignificant number of Internet facing servers that=20 require SHA-1 being advertised for connection to be successful. SHOULD NOT is a good compromise for it. =2D-=20 Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purky=C5=88ova 99/71, 612 45, Brno, Czech Republic --nextPart4879030.lEqOSujmGg Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part. Content-Transfer-Encoding: 7Bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAABCgAGBQJY3lxTAAoJEJKo0bgB0vX1nC8P/2Hgq/hMcua9yKp6VBqpmQxO +t48w2ePEbMPT/aeHPMy3nNB86hB/4U8nsfOG+5srm2ZDLc3oDEvUMa51GyJkNal Vbwn9TkgexEmlDUzwl68GHIFhMaiwVIu67fCf4a28eYhvrDNBRk1VkRrtR64ru3d DGmhkZsyrZAN+fEu4WWshLV017rgHk5/dmyvD8A+3OP1koLjyfy5IoxjTnrvl7V1 rOqwqMjMe5DdH+1ylsQQVI8G78mehn2yJMkCD8PajFWaySKPQQaw65KkAHZBrzVl p8hiMvp5UFUDBulE7WP+7mIJo5WJLNUrlfs/HAyYI408bUTYoAnVImDXJydSTx66 IK3NDRR+BTQyinMNnlxjtmdiBE8b4UE0WIW3q+q+S5zxkEmwKYXH4ulqWjJV19zK 98q94n5eUMWTbTDbKt8TeychFmEeCS9BHQHRqi3vj1XG7V+r/UAT3OTSVzoZb/XI HMH+cQS+jwzkhgLGZub6gv6kfHnaN2hNumrfOTA5OSx2MQ/duFwnHRocSeCVYLf0 bRWwM9UPczMwXJeeKFBaiFfXGMFjYAWMJ9tq++ZEO++/esdm1JuXvbPFRS/Bv2pL RLNh+DLQIOzsZd84NBmYXX8baGWpi61jFxUT2ZLwVAi6ypQRBLMO64vk7NuC/OXy bWmKgMHGQeqtPHpRHKP5 =2UgU -----END PGP SIGNATURE----- --nextPart4879030.lEqOSujmGg-- From nobody Fri Mar 31 07:12:39 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BD771296AA for ; Fri, 31 Mar 2017 07:12:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.609 X-Spam-Level: X-Spam-Status: No, score=-2.609 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, T_HK_NAME_DR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M5DXDuvHwScZ for ; Fri, 31 Mar 2017 07:12:34 -0700 (PDT) Received: from claranet-outbound-smtp01.uk.clara.net (claranet-outbound-smtp01.uk.clara.net [195.8.89.34]) by ietfa.amsl.com (Postfix) with ESMTP id AEE4B1294C4 for ; Fri, 31 Mar 2017 07:12:33 -0700 (PDT) Received: from host86-161-70-64.range86-161.btcentralplus.com ([86.161.70.64]:34237 helo=[192.168.1.64]) by relay01.mail.eu.clara.net (relay.clara.net [81.171.239.31]:10465) with esmtpa (authdaemon_plain:drh) id 1ctxHx-0003bH-4o for tls@ietf.org (return-path ); Fri, 31 Mar 2017 14:12:30 +0000 To: tls@ietf.org References: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> <58D8C395.8090707@ssi.gouv.fr> From: Dr Stephen Henson Message-ID: <2d2675c3-4495-a373-560e-b9327aa595bc@drh-consultancy.co.uk> Date: Fri, 31 Mar 2017 15:12:25 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: <58D8C395.8090707@ssi.gouv.fr> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [TLS] WGLC: draft-ietf-tls-tls13-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Mar 2017 14:12:37 -0000 On 27/03/2017 08:47, Olivier Levillain wrote: > > For a longer version, post-handshake records of type Handshake can be of > three kinds: > - NewSessionTicket (sent by the server, and that can safely be ignored > entirely by clients) > - KeyUpdate (sent by either party, requiring only a bit of state) > - CertificateRequest (sent by the server, an arbirary number of times, > and requring the client to keep some state *for each request*) > > Of course, this last item makes the post-handshake client state machine > explode, whereas the first two items can ben implemented in a trivial > way. The client can not indeed ignore all this state to answer, since it > is supposed to answer at least with a Finished message, which will cover > the CertificateRequest message. Moreover, since each of these Finished > messages must cover the initial handshake and the current > CertificateRequest message, it requires a forkable hash implementation, > which requires more memory. > To me allowing the server to send multiple certificate request messages and the client being permitted to respond to them in arbitrary order adds quite a bit of complexity. Is there a usage scenario for this? Would permitting only one outstanding Certificate Request be too limiting? On a related note in 4.6.2: Note: Because client authentication may require prompting the user, servers MUST be prepared for some delay, including receiving an arbitrary number of other messages between sending the CertificateRequest and receiving a response. I'm assuming that once the client has responded with a Certificate message it MUST send CertificateVerify and Finished afterwards and nothing else is permissible? That is it can't send application data or respond to other outstanding CertificateRequest messages? Steve. -- Dr Stephen N. Henson. Core developer of the OpenSSL project: http://www.openssl.org/ Freelance consultant see: http://www.drh-consultancy.co.uk/ Email: shenson@drh-consultancy.co.uk, PGP key: via homepage. From nobody Fri Mar 31 07:21:01 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E45F1294EE for ; Fri, 31 Mar 2017 07:20:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hk8qhXPvgrSa for ; Fri, 31 Mar 2017 07:20:54 -0700 (PDT) Received: from mail-yw0-x22c.google.com (mail-yw0-x22c.google.com [IPv6:2607:f8b0:4002:c05::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 19AAB12986E for ; Fri, 31 Mar 2017 07:20:53 -0700 (PDT) Received: by mail-yw0-x22c.google.com with SMTP id d191so39050866ywe.2 for ; Fri, 31 Mar 2017 07:20:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=PiT2oJeITM7rcUIRhoUIcM3C0pEK/iXrxOP8l9/rETk=; b=E5Np21HX+VfUEy5mWYu3DG6Z1OQ4Q8FyPpDvCAP8rNkIE/qQqsLSqz9zThh3HZT+NL S5D+efKYCaXV/k7B5pwLtukbjUj37/91EmRuSzRBsDBfWchbVjZ4z6dFOcim5xxqwDl8 d4WbR8/7MfXn3cpPUOAyeMPjWFC06ShUvu8PwGIOw9844iqGFySqAvEPQ9LNgxn8SV1b veHFW70i0v+fBQICgQvF+hrDWCcI4Y8l6szLwi2uqMcmksB9mi0ec65yL0jpjGtW0SVj vN70KQTgVE7T9Y9pFQhw0WF+zZPzZHcKy63iYggcH6Nzfe+fMBvJGce1gucpY3ypejm/ jU/w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=PiT2oJeITM7rcUIRhoUIcM3C0pEK/iXrxOP8l9/rETk=; b=cUeRDvcCPIWnJw98J4pGrUxrdu6IRG8YcmDTHIiNWqEFo4PVI8FYgBXAuQj/0NB5sX 1YSqLDdOuhycXzvvutd2xUeWOMud55bUnv9kdpkupvNrLa0NsFacpF0HliFCM4r/e+EN Wy9IufnWbiZqlQVI0IsCPwu8fOt3Zt1IecIxNqFZFF9HwqIMpr+Y5EFBBPH3+fYcAS2S f8i9chDZFyIdzY1bn9AX+SutOk3UGVxN31FS+j6SydgvD0Cc3fDpF1GNz3umSXIbWkik CEwXhXQLDoV6yWDGDlfGuUVPO+7i+RSLtq+NQbwQ46zmuquFF5+obh3XqxLyGjg6S3IM eAmw== X-Gm-Message-State: AFeK/H33VkMFcXGD+tAvNnUgN853E3H+/RL7dHsrP/Z77WrgFCUboT7KzvY9dN9KWqPbhUV5MeCdadcqaIaniw== X-Received: by 10.129.125.5 with SMTP id y5mr2377772ywc.120.1490970052249; Fri, 31 Mar 2017 07:20:52 -0700 (PDT) MIME-Version: 1.0 Received: by 10.129.154.210 with HTTP; Fri, 31 Mar 2017 07:20:11 -0700 (PDT) In-Reply-To: <2d2675c3-4495-a373-560e-b9327aa595bc@drh-consultancy.co.uk> References: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> <58D8C395.8090707@ssi.gouv.fr> <2d2675c3-4495-a373-560e-b9327aa595bc@drh-consultancy.co.uk> From: Eric Rescorla Date: Fri, 31 Mar 2017 09:20:11 -0500 Message-ID: To: Dr Stephen Henson Cc: "tls@ietf.org" Content-Type: multipart/alternative; boundary=001a1149364455fd24054c07843a Archived-At: Subject: Re: [TLS] WGLC: draft-ietf-tls-tls13-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Mar 2017 14:20:57 -0000 --001a1149364455fd24054c07843a Content-Type: text/plain; charset=UTF-8 On Fri, Mar 31, 2017 at 9:12 AM, Dr Stephen Henson < lists@drh-consultancy.co.uk> wrote: > On 27/03/2017 08:47, Olivier Levillain wrote: > > > > For a longer version, post-handshake records of type Handshake can be of > > three kinds: > > - NewSessionTicket (sent by the server, and that can safely be ignored > > entirely by clients) > > - KeyUpdate (sent by either party, requiring only a bit of state) > > - CertificateRequest (sent by the server, an arbirary number of times, > > and requring the client to keep some state *for each request*) > > > > Of course, this last item makes the post-handshake client state machine > > explode, whereas the first two items can ben implemented in a trivial > > way. The client can not indeed ignore all this state to answer, since it > > is supposed to answer at least with a Finished message, which will cover > > the CertificateRequest message. Moreover, since each of these Finished > > messages must cover the initial handshake and the current > > CertificateRequest message, it requires a forkable hash implementation, > > which requires more memory. > > > > To me allowing the server to send multiple certificate request messages > and the > client being permitted to respond to them in arbitrary order adds quite a > bit of > complexity. > > Is there a usage scenario for this? Would permitting only one outstanding > Certificate Request be too limiting? > Yeah, with H2 it puts a lot of complexity at the HTTP layer. I think we already had consensus to allow this. On a related note in 4.6.2: > > Note: Because client authentication may require prompting the user, > servers MUST be prepared for some delay, including receiving an > arbitrary number of other messages between sending the > CertificateRequest and receiving a response. > > I'm assuming that once the client has responded with a Certificate message > it > MUST send CertificateVerify and Finished afterwards and nothing else is > permissible? That is it can't send application data or respond to other > outstanding CertificateRequest messages? > I think that was our intention but I agree the text ended up a bit unclear. Absent some argument, i'll update the text to require it. -Ekr > > Steve. > -- > Dr Stephen N. Henson. > Core developer of the OpenSSL project: http://www.openssl.org/ > Freelance consultant see: http://www.drh-consultancy.co.uk/ > Email: shenson@drh-consultancy.co.uk, PGP key: via homepage. > > _______________________________________________ > TLS mailing list > TLS@ietf.org > https://www.ietf.org/mailman/listinfo/tls > --001a1149364455fd24054c07843a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Fri, Mar 31, 2017 at 9:12 AM, Dr Stephen Henson &l= t;lists@dr= h-consultancy.co.uk> wrote:
On 27/03/2017 08:47, Olivier Levillain wrote:
>
> For a longer version, post-handshake records of type Handshake can be = of
> three kinds:
> - NewSessionTicket (sent by the server, and that can safely be ignored=
> entirely by clients)
> - KeyUpdate (sent by either party, requiring only a bit of state)
> - CertificateRequest (sent by the server, an arbirary number of times,=
> and requring the client to keep some state *for each request*)
>
> Of course, this last item makes the post-handshake client state machin= e
> explode, whereas the first two items can ben implemented in a trivial<= br> > way. The client can not indeed ignore all this state to answer, since = it
> is supposed to answer at least with a Finished message, which will cov= er
> the CertificateRequest message. Moreover, since each of these Finished=
> messages must cover the initial handshake and the current
> CertificateRequest message, it requires a forkable hash implementation= ,
> which requires more memory.
>

To me allowing the server to send multiple certificate request messa= ges and the
client being permitted to respond to them in arbitrary order adds quite a b= it of
complexity.

Is there a usage scenario for this? Would permitting only one outstanding Certificate Request be too limiting?

Ye= ah, with H2 it puts a lot of complexity at the HTTP layer. I think we alrea= dy
had consensus to allow this.



On a related note in 4.6.2:

=C2=A0 =C2=A0Note: Because client authentication may require prompting the = user,
=C2=A0 =C2=A0servers MUST be prepared for some delay, including receiving a= n
=C2=A0 =C2=A0arbitrary number of other messages between sending the
=C2=A0 =C2=A0CertificateRequest and receiving a response.

I'm assuming that once the client has responded with a Certificate mess= age it
MUST send CertificateVerify and Finished afterwards and nothing else is
permissible? That is it can't send application data or respond to other=
outstanding CertificateRequest messages?

I think that was our intention but I agree the text ended up a bit unclea= r. Absent some
argument, i'll update the text to require it.<= /div>

-Ekr
=C2=A0

Steve.
--
Dr Stephen N. Henson.
Core developer of the=C2=A0 =C2=A0OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: shenson@drh-consult= ancy.co.uk, PGP key: via homepage.

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls

--001a1149364455fd24054c07843a-- From nobody Fri Mar 31 09:11:17 2017 Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F60F129406 for ; Fri, 31 Mar 2017 09:11:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jXDKMI68dilB for ; Fri, 31 Mar 2017 09:11:15 -0700 (PDT) Received: from mail-qk0-x235.google.com (mail-qk0-x235.google.com [IPv6:2607:f8b0:400d:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 673F8124281 for ; Fri, 31 Mar 2017 09:11:15 -0700 (PDT) Received: by mail-qk0-x235.google.com with SMTP id r142so70990046qke.2 for ; Fri, 31 Mar 2017 09:11:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=t470mcSGESrn3p2yJlL8N7UHiPMedGeaGXgBz4yr83s=; b=cYSLPD7eQxPS/LeZPKWKW+8Rqn+lvialhbScLvaALufEfOLHYNo3jh+6HK2ifIQNy1 80JpwtjhOCrzJXc7WnZTks4Rolv92j2W7bFjY1M1RzE3hDgktuDdcBMznDpNlrnzTVEI Jf7Udqt7wGkGetNOrsOaNrqBuo6OTA6Nui8Qim0HC1QiB+/hulmEM6i6CFjStGHE6PaI jy7Z6eGWy4ex+M5Ktg0EwpIzpwgNrRNYi3a5vOuDw93fjFSFLv4P+HaBcnZIEfgXpOdU 6pmXb7z4QhGiRzJ/PZFHTLFDUZP9p6PT5Nn75pHRxNdOJKfZGP3ECPyL4KCk0geqzcHj HzXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=t470mcSGESrn3p2yJlL8N7UHiPMedGeaGXgBz4yr83s=; b=TqLm1dhZX8Ve5p+1DgdlTMo9uI55yJMijzfVnzrkECytkGSUlJ/+rudAO/3f/FIUxr f/w7PcSLOqEYk7ulVPnAi4UWI0lWNB5X3hD4kdWPUPpQfaWAd3RrzyHYp7gWA2JP5f1f +HGMXaUfmyTPRSOyPBOZMIqmMSMagi+2RvUZwR/sR0yWWYLWa1mwjRRmXe3cxsjuSp9s B6gHYnfV20FjHcFAb+8cesA+TZCBzceyhhskbExvO4uW1cHnd+pxbnp3+65FRkf71oaS 4jLgQsalE75oiy+jVx+Mwa0yYju8iP7FLgEe0YolfAWe48UO51TV3vXjOVtjk9gG2Gh/ RNFQ== X-Gm-Message-State: AFeK/H0X9u6Yg7oXkej2itOkSYhn/2tl4KFfgE3vUl/0k6QvYCF+IfgJNJ6kWXDK7LSuW01eQ6+hmhS7mce+Mw== X-Received: by 10.55.126.195 with SMTP id z186mr3651678qkc.144.1490976674571; Fri, 31 Mar 2017 09:11:14 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.27.194 with HTTP; Fri, 31 Mar 2017 09:11:14 -0700 (PDT) In-Reply-To: References: <025D3ABD-199F-421A-9265-6F960135A3B7@sn3rd.com> <58D8C395.8090707@ssi.gouv.fr> <2d2675c3-4495-a373-560e-b9327aa595bc@drh-consultancy.co.uk> From: Martin Thomson Date: Fri, 31 Mar 2017 11:11:14 -0500 Message-ID: To: Eric Rescorla Cc: Dr Stephen Henson , "tls@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: Re: [TLS] WGLC: draft-ietf-tls-tls13-19 X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Mar 2017 16:11:17 -0000 On 31 March 2017 at 09:20, Eric Rescorla wrote: >> >> I'm assuming that once the client has responded with a Certificate message >> it >> MUST send CertificateVerify and Finished afterwards and nothing else is >> permissible? That is it can't send application data or respond to other >> outstanding CertificateRequest messages? > > > I think that was our intention but I agree the text ended up a bit unclear. > Absent some > argument, i'll update the text to require it. This is a great idea. I don't think that our code would enforce this constraint, but I don't really want to see interleaving here. We don't have interleaving anywhere else.