From nobody Fri Apr 1 10:50:48 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9775212D6EF for ; Fri, 1 Apr 2016 10:50:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.91 X-Spam-Level: X-Spam-Status: No, score=-6.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vg47CkHvsxte for ; Fri, 1 Apr 2016 10:50:45 -0700 (PDT) Received: from zinfandel.tools.ietf.org (zinfandel.tools.ietf.org [IPv6:2001:1890:123a::1:2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3AE4C12D0E2 for ; Fri, 1 Apr 2016 10:50:45 -0700 (PDT) Received: from localhost ([::1]:49024 helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1am3DV-0006O3-NM; Fri, 01 Apr 2016 10:50:41 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "trans issue tracker" X-Trac-Version: 0.12.5 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.5, by Edgewall Software To: kent@bbn.com, eranm@google.com, melinda.shore@gmail.com X-Trac-Project: trans Date: Fri, 01 Apr 2016 17:50:41 -0000 X-URL: https://tools.ietf.org/trans/ X-Trac-Ticket-URL: https://trac.tools.ietf.org/wg/trans/trac/ticket/124#comment:2 Message-ID: <068.4abf294cda8edc7127adb5efb1069c38@tools.ietf.org> References: <053.d435128a5d6cc5448161942e0b2eaade@tools.ietf.org> X-Trac-Ticket-ID: 124 In-Reply-To: <053.d435128a5d6cc5448161942e0b2eaade@tools.ietf.org> X-SA-Exim-Connect-IP: ::1 X-SA-Exim-Rcpt-To: kent@bbn.com, eranm@google.com, melinda.shore@gmail.com, trans@ietf.org X-SA-Exim-Mail-From: trac+trans@tools.ietf.org X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false Archived-At: Cc: trans@ietf.org Subject: Re: [Trans] [trans] #124 (rfc6962-bis): introduction needs work X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Apr 2016 17:50:46 -0000 #124: introduction needs work Changes (by melinda.shore@gmail.com): * status: new => closed * resolution: => wontfix -- --------------------------+--------------------------- Reporter: kent@bbn.com | Owner: kent@bbn.com Type: defect | Status: closed Priority: major | Milestone: Component: rfc6962-bis | Version: Severity: - | Resolution: wontfix Keywords: | --------------------------+--------------------------- Ticket URL: trans From nobody Fri Apr 1 12:56:20 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84B5A12D5E3 for ; Fri, 1 Apr 2016 12:56:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.211 X-Spam-Level: X-Spam-Status: No, score=-4.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oWSYeZLDi6JO for ; Fri, 1 Apr 2016 12:56:16 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A53212D5CD for ; Fri, 1 Apr 2016 12:56:16 -0700 (PDT) Received: from ssh.bbn.com ([192.1.122.15]:39706 helo=COMSEC.fios-router.home) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1am5B0-000OUl-1E for trans@ietf.org; Fri, 01 Apr 2016 15:56:14 -0400 To: "trans@ietf.org" From: Stephen Kent Message-ID: <56FED25D.6070308@bbn.com> Date: Fri, 1 Apr 2016 15:56:13 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [Trans] revisions to Section 3.3 and 3.4 X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Apr 2016 19:56:18 -0000 I'll be working on these revisions in response to comments from various sources, while many of you are enjoying sunny days in BA. Steve From nobody Fri Apr 1 17:35:42 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D8ED12D141 for ; Fri, 1 Apr 2016 17:35:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.11 X-Spam-Level: X-Spam-Status: No, score=-1.11 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_ADSP_ALL=0.8, T_RP_MATCHES_RCVD=-0.01] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8r3WZXOpOVgA for ; Fri, 1 Apr 2016 17:35:39 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 74C3612D17C for ; Fri, 1 Apr 2016 17:35:38 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 3qcK6J2qzGz37Q; Sat, 2 Apr 2016 02:35:36 +0200 (CEST) X-OPENPGPKEY: Message passed unmodified X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id sUf2aEXVBxZk; Sat, 2 Apr 2016 02:35:34 +0200 (CEST) Received: from bofh.nohats.ca (206-248-139-105.dsl.teksavvy.com [206.248.139.105]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Sat, 2 Apr 2016 02:35:34 +0200 (CEST) Received: from [192.168.1.44] (unknown [181.229.86.204]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by bofh.nohats.ca (Postfix) with ESMTPSA id D0318600BAE6; Fri, 1 Apr 2016 20:35:29 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.10.3 bofh.nohats.ca D0318600BAE6 References: <56FED25D.6070308@bbn.com> Mime-Version: 1.0 (1.0) In-Reply-To: <56FED25D.6070308@bbn.com> Content-Type: multipart/mixed; boundary=Apple-Mail-95E9B4E8-7BB0-4C87-9CD9-C6EE72DA9445 Content-Transfer-Encoding: 7bit Message-Id: X-Mailer: iPhone Mail (13E238) From: Paul Wouters Date: Fri, 1 Apr 2016 21:35:26 -0300 To: Stephen Kent Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] revisions to Section 3.3 and 3.4 X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 02 Apr 2016 00:35:41 -0000 --Apple-Mail-95E9B4E8-7BB0-4C87-9CD9-C6EE72DA9445 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Sent from my iPhone > On Apr 1, 2016, at 16:56, Stephen Kent wrote: >=20 > I'll be working on these revisions in response to comments from various so= urces, > while many of you are enjoying sunny days in BA. >=20 A bunch of is waited 45 minutes for a taxi and none came because it was rain= ing too hard --Apple-Mail-95E9B4E8-7BB0-4C87-9CD9-C6EE72DA9445 Content-Type: image/png; x-apple-part-url=0152ECD4-0571-4357-BFB6-2321E4C24059; name=image1.PNG Content-Disposition: inline; filename=image1.PNG Content-Transfer-Encoding: base64 iVBORw0KGgoAAAANSUhEUgAAALUAAAFACAIAAAB1GargAAAABGdBTUEAALGPC/xhBQAAACBjSFJN AAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAB72lUWHRYTUw6Y29tLmFkb2Jl LnhtcAAAAAAAPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iWE1Q IENvcmUgNS40LjAiPgogICA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5 OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPgogICAgICA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91 dD0iIgogICAgICAgICAgICB4bWxuczpleGlmPSJodHRwOi8vbnMuYWRvYmUuY29tL2V4aWYvMS4w LyIKICAgICAgICAgICAgeG1sbnM6cGhvdG9zaG9wPSJodHRwOi8vbnMuYWRvYmUuY29tL3Bob3Rv c2hvcC8xLjAvIj4KICAgICAgICAgPGV4aWY6VXNlckNvbW1lbnQ+U2NyZWVuc2hvdDwvZXhpZjpV c2VyQ29tbWVudD4KICAgICAgICAgPHBob3Rvc2hvcDpEYXRlQ3JlYXRlZD4yMDE2LTA0LTAxVDIx OjMyOjQxPC9waG90b3Nob3A6RGF0ZUNyZWF0ZWQ+CiAgICAgIDwvcmRmOkRlc2NyaXB0aW9uPgog ICA8L3JkZjpSREY+CjwveDp4bXBtZXRhPgoWggBMAABAAElEQVR4AZT9d6CeRbX3D2eX9ISWEEoC IfQOUqQo0osdAbFhwwp2AWkK6kEEFDiWI/qoR0XF4yNWRCkColiwUJRepCT0kpDe9+/z+a657r05 Pu8f7+x9X/fMrL5mTbna3H3jxk0aHD2ub1TfqKS+vr6hUUOkfnJ9/dQNDa0eAjo0RHkU/0OrzYzq W73aDGn10KpRo0QHFwzqoervh0/fkPkhkEnWwMuaJkvmFnIgEwRL1g8N9A9ENKz7V61exRFyYaSo UXzAVBuhAKJqaoSqUQ/fXNhiVB8M4b8amuLZGMq6GEo+atTA4MDqVfAMF+zp749viill3VICQgW8 PwYO9Q8oRT/qDHF0puhqG8Xw3qCuky2MRKYechwlhqqFeVwH5wnjx89fsMD6+Lm4FHewIxr8kqW/ V69e1VNY7+Md3dPTmTbqnzFjwxkzZtz4l7+tXLki/pJfIYG5YvnSQTWHpslJnhItjscjTHjE+q0V lMJqgFIIacEoq2wSpaYkWqMUyCbEih4Xg5A6YgtwGl6WZAm/EIOqTQmwOIhy6UOGtBpk/8UrfSwk hi3CI3gxi9oIVLlAQB3VN2bsmGXLlilsyGgm2gUXr3C2UHwsmoImRYnQqBRSVquCBIppAIdo+6AI 03f9mIgrYouqt0yJpRBzjBdSs7fQVg8tWbJUiTGyZCV+NM7gK2awJ0eyFfjwx//Q4MAg9i5cuHDA Zm3MCd4nnnxq3vz5eDkcIjCsJfSfHjJ63MCAUcIffbS+Qcz40Tc4CMiIiqnpEwlVNdA2eWCsxOpp BmR5F305IgrDAv5grV41RLT2D6BqlOjZTDxHVnGLiRDRKgwkqr5s2Yrly5evXLly1apVNBX1Clea KY6zQfmoXAmVY9+AjKOrTCG0dtXKVUuXLaO/Do4ehNWy5cvACKYMV61ajSz9nAZevnwFUseMGS37 mIkA+JSvwzuYOgEzIYvOymyK4BFItZ9MHCco+totZBHvpUYRMM9oiJ70IkxGVei0fWBAEZIra/kK 9LQOUvDQc2BgIPhkBqWKlitWrOSfIiD4izBEQ6xavGgxRYdqU1zXGo9RduVgvFuK9kECf1AIt5Wr Vy1ftmzixIloQnMCGBgkDBGMtnLClajC8MsgTFvDgkFnaOUqY4thdoUDOCaAoiW4OZJWj1o9YeL4 XXd50d//fhPdl8YmBMeMGbNy5XLMW7FqJSrCDhErV6+AD9IxacXKlRPGT3zZyw7dbbddx40fd9dd d1/x66sef+IJAzrJaBnsX3fdqWuuscYDDz6EIiuWr8DlMSxGZ2iNChKg9vobrLfffvvef/+//vKX vyJl7z33mD3nkUceeRTHodLWW22562673HrrP/75z9snT5r0qle9YsmSJddde31cjUHGQX35TfJA rX3G9sgka5tTjUfs9Bnc7AxOIto1yrmnEtRQrFy1kkCcOnXKOuus/dBDD2P94ODo3XffbdHCRWuu uUaafOi555676+57B8YM2mP01eAuL9h2zpw5c5+bT3njmRuPHzfu/n898IKdd168ePHd99y7/nrr ERhPP/3MlClT9tpz9/HjJyCaDkJDLVm8kO4WJ6khii5auPiOu+6a/9x8+57m9TF+jEUJcgwy06ZN O/TQg9dZe62nnnpq6rSphx16yLjx45968skNp0/f+QU70Wzz5s3fZObGO++8I+xQdPPNN91hh+2x dtGixdg5dtw4aKdMWYeQnTF9Qxy6YvlK8NdYY/KiRYs4Llu+nEmUNHbsWFp3ww3WX2eddeimJ57w wYULFz/22GMzZ85ca6010Q9kDDMyVqzALzM33uiir3xh3WnT7rn7nscee3zWJhu///3HP/boY/96 4AF6TkXerrvsAuNJk9fY9yV733//gwR3BjEbDkcTcG24shkh6v/PCz9H2L35mDc89NDsww479Lxz P/Pggw/Nnv3Iq1/9Crz5+c9/9vEnnvzQB4//zW+uffe7j91xx+1fsMvO66+/3p/+eCPRAwejoKLE gmOvR9yIIwJFruX2b2VGolTXjCDMSojtyitWTJ8+49i3H3PWWZ+679777rzjLgSNHTtujxfuduqp J73j2LcdeND+hM5tt93x2OOP0zmhQ4MXvWjPk08+gSi//75/bbjBBqeeeuImm8wktt74hqNnbrLx s8/MffWrX37bP++gLXbdZedTT/3Ym970+sMOO/iQQw+G7S8vv/Kaa69/ZM4jDz388OyHZj/yyGPo vt60dR997DFtZCm5aoXTByoTeqPHjD7llBNe97rX0pYf+vCJrzn8Va985cuffvrpU075BPPWnXff vc1WWzGcoOK999635RabE9Frrrkmam2z3VZLFi956umn9933Jfvss/fo0YNLly0fPThw5133PPvs 3B133G7SpEnXXfu7HXbY7keX/vTAA/Yj+DbaaMbEiRNest8+C+YvvOmmWzbffPOZm9yNlAMO3H/6 9A0u+8XlhxxyEMPqd7/7fSpx4uIlS7/8Xxdtv8P2++77Yoab+++///wLLpw9e07c63C/ztrrzHtu 3pNPPME0MG3dKbvt9oI/3PDn5SuW9Y0aGHIAap0cQ+EGFR3owgu/fMut//j+9761xhprXHnF1bNm zRwzejRuHzt2DP31pJNOpxvMe+45XPPTn102Z/acD3zw+IkTJsCqRjXHaGCuJvwju5rvLL5Tg1/L sWYMhCApmAjqIgV1Uuqbtu7U1x515NFHH7nTTjswsl79m+tYLkBP0Eybti6aXH31dWPHjT700IO+ +rVvMpavHmBuHUVbMLr88vJfg4nbDzpov7/+7eZx6L+IsWMxY/P+++9z7bW/mzPnkYmTJjDS0GR0 vyjkTIQyK1YsY65Ce6LBCXTc6Fe84qVIvPLqa8aOHh0/RX1Uhp4hiKF+zbXWXHuttadMJT96raRl y1c8/dQzS5YumzRx4tKlS5966plly5ZPnDCRFdNTTz+zcsUqpnAEjB8/7s83/vUXl/36gQcevPji H8Bkzz12/953f3DxxZdsudUWjz726O677cIUQLBOmDiBJqdP0xL33HP3TTfd+vvf/2HpkqVPP/U0 fLbYcguGjW9/+zsYlrYcoP7mm/85ODD60kt/9u3vfHfevHkPP/wIwyxQXI/HaStIVq5cvWzp0qef eZas9V0q+zOEpqWGWFus+NvfbjrjjNNuv+POyy//9Z133pWJchDTLvvFr4A+/cwz02dMx4O0wc03 3fSKV75s01mbfOGLXxk7ZgxzGY2KnvUfQZG12qbX1aYAOfpfqWVKDfUIjhj9fQyfP/npL45+3Zuv vfa671/ywwULF9bUyTi35lproc8zzz49a5NNsHfS5EnaO2oU0fyKV7zsmWeegTsD/4477bjttts8 /NBDtO68ufO++KWLHnjgofETxu/9oj0OOGA/xmDQmuhSJ0cD3FTHvoG+wbXXWXvq1KlixoEA0gT9 fTTPBRd88aKL/s9pp535619fdc5nP3fRRd/4+Mc/9esrrmREoUPjwZtv+cfyZcsPOnC/xYuX3HTL rdh28EEHzp07b97c5+ikWWS4pIU7EYPY+Qvm77jjjrvu+gIi6cYb/3rwIQcxIM2fv4AZjaXm9dff sMGG6+/7kpcwlmy44YaveOVL11hzjefmL2Ai02n9rmui/Sh4Lly06ML//NIRRxz+2bM/fckPfnTX XfeMJsDjYob2ufPmQjJ58iSC++ab/3H99b9ncYMXWdRpqa1hQ/BPUFKHLeed95mDDzrg1lv+MWvW LOD0V3Bmzdrk9NNP3nSzWed89j9+d/3vmcvX32D9N77xDZ/4+Km/uea6LbbYnKahJ0Eelrq1Flal CcV4FUEK6xWy7Pe0BUKcQ4aP4AQJ58D459FHH6Ox//GP2y+//Kqx4xg8gNG/V15xxdULFsx/+9ve MnPmxjf88c+33nzr6LFjFNzXv3DBQga/F+2959ZbbcX4MXfucwccsO/W22y93vrrbTKLeWbje+65 n+l+t9137e/Tk6xNI5esPcrF5opV9KqVfly6cv7805/84sc/+dnowTEoivf6xo1fc/y4SSBDsZy5 fiXLOlYSY7Fk+YoVzHM0A1wdhVyZj1q52nxGuH6OqMXR+pWrt956S8RzUrD2Wms+6iphk9mzH2aq g8kvf3nFU888fdihB99xxx1Mitttz5LqUeIMJ/z8F5eDudFGG+Kagw8+cMGCBbfffsfkNSbf9s/b 6VWrR63q4yw5YwQqzZy5ESvQ2++4yz7Ux4jO+WJaBJf399Gl0GfBwsV0vrq0kI4eV8OBCPbcATuG Rg8OHnfcu4lLQvDKq35zw+//8PL0RUYyZsPFixcx1BPWt95623cv/v7rXn/UlltuAd0dt9+J72gS 1vy2bc6/WcqldxIPDh+oGimeLuMwzgsSA1QO0DwFLzQRu0rrXcQPbr7FpnfdeZcLSFT1fMXPNltv feCB+z79zNxf/eqKufOeGz0AW6gdBSHbYfvtFi1exBKEVdW6U6bAgRlq9912ZzG1euXKl7/8sJtv ufXmm29lbcfcsdaaazAo0vbExH333f/Ms3Pjv5p/+6i85777H3/0ccYtBCxbvqRv/IQ1x4ydkHim xobQp5hOFWw0pSX6jS5uEYg5gRrmbeTCTVVykh7oJzw5D2JNCgWTOi3BEOVMxAnRihW0JNMWpMxi BC84IJDJ8APr1YQwS096ei0sI5elhOdMrNpA8FJJn6d6Y1jxLF2eLlGqWov0nvJ4hP7NuRaim/qj 7LJeQWLkQINBlFnmeDXoCSGVy5bm0sioUePGjWUogpZ4HBjsHz9u/FprrsmICUO4YrIrGpj2/JGp GiX1T68SHFoF/xg0OehqWOq85siAOKXkvI9a8Y1k/j3fqdNvxhWuCkiKQXgZck70Vq2E+yC9kIFt tb16NBkbR+YMDphFYmlUwzL8cSKkzJWEZLpN/OY5I0vSFb3K5cuWeH7rGgle/qmyBcQnQgNIv6CC 4DD1MM1FjZCwFBwYDCEtra2ccKLEuLFji4JG4rQFrogbPWYsATQObIeloTGjx6QtvYyj5XFKgH2r 7FdytR/hev2QgGHswD3A+lj3TODyBKMLlJaTenrCzAqNg09fRQ3lCRPGC5KruGPGjDWqiOww5Vws vmBZOYpwJBS0VJH94ydMYN3qPGXbaamc6c4dM6VoRNShEhm2saaDytBgNuZEuu43Y6Pz7bxMMuT4 iuKEL38Jl8DE7Kd/gA8SPU3dnD4UQVEPjyYcba/Ro8c7TbjQCBZczEE9irX80JCnh5HfxBFlyQFX vhNZl6ILEhKaxU0UqVW8TOLbNWEqBGWoKbgoUZQMCRKLEqMe0aW6JQ+QLCoVBmihwnk2KHHt6qHo xS5gjq4hIshGgC2r9SqHqycIdF9lwT9ygNKaCmgSk+0E9jgLLAGFNwKheQCe/a5yQESz0qFpFtKi pxciCU4NFM8ZX62shgUudYbRtFzZagG+zjSP/kVdIKpaxrBszMQNnkGGel6HEo+iNTKSjkwaIjwI a65cdcxEzqBFnIFpK1dbQ2MqfcICSZhYcSRItn60K+Kjnz6SOT0iMIEqpaCgWx0Mq21TaRsIJRAo HxmHLPRFUCZpMKaCV6OHiCpAUMRh1aejVrQKHJbGDXoMeobmuoxCbK5qeRg8DEqVwNcqcdQ+8V+Q FEV3Wk0VHmT9oYGVlCtDwMrNWIy25Qe5+tfzhsqLVv9K7amBMyFHCEdTiiLyUXmHE/8Cct1tTnAj CGaq0rJlSi5RGgSFhGg1gzaEXtzMeU2mK7nBTjNja0o6KeoqplOiRDYFiyz8GofiE01TQ1vKq6na 6iOnURW/1IS2PI2WCEQbJdd386o6Vcypa4FFUNGOPVlroKDOaBqQV8E7pIwiXr3tkVWUQBg/dHgy kjodq8xunDpEXVYRSXywQHY9ozgVIKNy5VOqutTlQMofNkWgLu/hl+4dRkea70bPV49TyysuQxTl 5h7UobZTSUEixXIWWKPHVMGajhtw7HUOAlnG+erFfYdo48ZKOVhpx/BDqFlOMnBShV9wUFXWUeoy OPZXS8SVUEdHWYmrDn63yvrqNVhwh0HDgqQJnd8ilIhWhXtc96QX0jc0xVRoGWakLmSO/gttmjV5 3YhRoJiTaICLjOojWUbVURMncc+BIcHpH8FiwEjRbcSVospmoALMmqnTzTExKHgslYWr3FYPdSEU Sbjk0MhkJ+MsHbqA7rBgLv+gst5Ht0mTJhaw42pJFMv+V71koctX6MszXftaFfRQR7euhmqdaTS5 OvGyglZR1d3QF2IqCo8WLHqxIXyNMvu09Q3KanxwMFOAiHwiOhn7aFVwpEbWIRshI7UMn1xiD5RG M7XxM6sOZwY+wttwVVxlqn7qIpsSTi0V6Q3JWQh+1yG5rfP3v99cazqAKulfKV/qhVCWIayDTIgm O3ZGtdaoVOKcyAfif4+m8vRwZyur0SqzKjjle2vLLsGJGKlrFBQYFtD0bkUpIkJ0beMqqe5NokcF blXamIvFclGAeGYrbzlZ/ZOqGF8CCJQMMSLljDPIii6lSkboNCZzYWB28WBVC+QcZ9y4cU29EWQM CbR6k6yKUvlfCiYXji4YOW+KkVmsOGhGSuRAk4DptbgqW1nr5TQ+MP1SkGrEJlCPiJ7hokQzYz/8 8MPIoFLPREq1DRxs/1AEQN5GEIdPUqDILzROPmkFWbWkaqG3nMKw4s1JDu5FP6JZFQBd+4rEsCFH KHO5ucc0fMEEnSgracRdZmFjQnngJCpUJneo+e6hGqNq7FAhpoz8InEyvcrTSIWVIW0SKjDH+Kf0 Lg5hm0OICAhQSngqOBnzFnGPYenR5wVTrnQ1MdXZOiGhyziR5oMhI5BhjqJZtQUxWB70pTUZLMJe /RIYERtDUqWaIPYoJS6qsFGaLq3hSrLMX8ZG0eA5RlZ5FJ+wwt+anLyXeVy6RkrX3BZMMcDAhVs5 vBcIiO9cILQhNeWaXaV18S4bSim1Kd62TUGgrOG/VUiFB1y2yr9W0w6iSO338YJ2dhC8BJDSLJni FAqWAHqimLw4mmMKyI6qBvoxzC1IaK3fpsHRXiiTIgJWLl/BHTgB6lrITkMDA0QOF7z1S/gGGi00 Q0xF85X44Jqb3hQTGCa2RVKhSZZkkSSpde2rAzUdGP9F0cwOCZYVf1WlfBcO0Itc7IMLoUkdSJXz aGVGfqUDoKJcE1xAUYvvWCuuA0++ZRYOKZstQFUGpzi2eq3yuoCei0PifZk03qqoniJ04lOlydhZ 4aEjRbAUzmnX4CtZGB4vezsMiGVJUnC+u4zR55Mpq1cmCJvGiBPL8QLKOJKWK8+llYa4ub9gwUKU SR9r3OHEJU0uuaoeilSj5zSP0bhjEDV07CguHlGpJLE9ILBpWBVWxiUWtS2IwyYLDysBzchiqNLY xlVcAVKH2LwQ8YtnjlVdx54C5bXmvKLSe9IVDoVVzDQ+ttO8JzghGH1k3dO/uHXMVQAQXPnjSH03 wJdPi1CNahRIR1IyH6OID03C1T+FRGYy4a/Ydq3GrJ+ErTZEGuUMOroHk+wwLVnfgotvzZFCYE9j dQokoAL2cRdwSRZowaRSLJLEXRNLxKXfsWPGpTIwOZeEWjEpSklG2RAXxTMmiaCeer+SGbmD5RFW HSTUVvg/XN+Di95RybHjmZzPRoWtOMOZJkuGJNsD+d7l8rZLJ9Bsa6ro1LQtwVGcbE6LWkHlSvnS 3oaQSVLTvI2XUviRv/4Ez//6KkEqDkbqsuwYxdreANHYNLcshkXYwWUZKr+S4gWEtFT2EOLxkvwL VMt3KulghdqRyEWfitsdYgsVna8DK2h80EYbKYbGjB07YQJXuLuoSRMVQce12OIFp6LmIGnVjf+e ZFVpuH5ZElrMzJjU2xppYyT5xqMyRVYjdu4upaJjEv0ZauyIUbU8BksYkid5yhM5xV6heTzRVcuI uSyqRRNVUqHhUbsqpG9yU8FBZiRzjrgkcSBMvs4PrGimddTRmptKngsUZsmMc4phzaNUj3AK5Izo 8ip0pXYsw8Zos7L0StUweQkqgta3cEFOCCXwv1L77moY7nJ7L3r18cDRosVLtLJiTKzS2FiM9zv6 Wp9y/7pjbGNw3t8JgqwHitYRb62pJrYeMoNzc+IIGtH8dBLj6M4/OioiFFOSqGmVSugYdeSpAzWd qxDaEqYgjaIh5AQEnaxN6vFLTZE4VuEUA6JzAoBqk0bVaEXrtZXu5aadw2+76UOL01JiGF12usHG MQ6AJfSR6VTYC5DKICI69XFznHUDRnFdivUAs2cEddHU6JVRJKloB3g450lA04NjryMDplcprKbN BnjEDWW4NuJEVkOiBmsRKZlhhpiX+9GalVqOw8pYqBKiW04u1g0NcXbNE0+Nl2SN8HmYRMAIjtAu XcrDzLEh5vTnBJsnHPBtp16PQeOoYcjThwjR0iSy6tFTIBlpnQgUWwhWhxTnFY94TyYF8qtER4CV ZYtSZGIKjxAIT9+jd40enQkJYTRl0wQkr757txK85lZzcLEGniU5jATUhxOQwYGJPMIEtE0pwRAe jMrI3YRKUa+DKj3S5B8KEBL1xqup4UdeNKg6bJGb9GHbzICbJxIEetlRciAuXinmbpnSEhFAIreJ Ei+MewxDE5TKBd0VQaMM7xFINCIXYLheo3NjsMKjaQ8r7KIVSGV/49bEKqQJSlvqu1w3ex4LkQqr 4equYNiDVBD2lVIMUGVUzOuEwGiXDqcZlemlxg/7lx4xGSn8D4weMz7PJ0vVhI3wdY8X95ersVEC X/D0F3IU66UVWsl3WMK2BJQh8qtGlXkUTUauFqNxhEqKSxwG0iOLPhq6vgZTC5UTxWVg4oE4eKxa tYIn3HiQudNfNxVVsNpBGbEfEtqzFPYxs5FJY0aWe6alMv1+JOeOZ04pMwoqI9Y9j0unT0GLl4Eu SZ1Q6pDQ+c3HbtrzXRNeOPpGoJVNlnkeoBn0jTIrAybPkCCrzAVUIqnHknp9yekO7lux3LMeJTOr yNPEsnLVCh9GwF+2lJ+CKaDHCExqpfWBA7svVywgomx3CbitSIq6KQiFJEUuWhJsdYv+ErthKNxk hQcpBTn8CIog8QvFXBLW89jpk088xUNr0oQqFha3wqpa8uGfOvhQAKn6XI+hTaPkpPpWCQdglIiH tUuk4NlBfIvEs1Onx9hFTRRtbHrM0NbmSln9yhitlVcOKGWyKo8up1Ag6Upcw9Ye8QGEmQgqKztr k6/hlnKwBfnXSxD62G5vuWaswrU1LGh2tXBX2ZbC33yU5hsQ1/DxES2r+Lr61IkBq+4jR3prYKnj 1iK3WIHZqFqU9ISiA3zxMtNe8WmgnjKwiP1qm3zUEzdB3/G1pN7E8bAjIOiarAJCHiP0B9+OE1l1 jDA9oKsgL+QciZSUawUjUIUANYZ+UWGqmoDyyFYcWhY1ZL1UBKggVZSnJmcIYVO1vW7dTEltsI1Q zXFVnkwTIOPKRhcOxnhnTJMLRvwVlDSRj4BkmImGxkenqhzwDp7VudZTasAROAw7gUZ5+foWDc+h UY5QZ2TRa5wIgiLKD+HjpFAiSgY4qA5RWaqR8pKL3ShTWKtJozStmgI1FoexSLZWk9Vp2GBxV1SL 9NI3JBx4+N7n7SKXoxmla5IpGT3ZPXykiA4kcmRxcCCxHGAqBSUDL6wu61oNiPAsS83YX/lKUBZN mAVkLkOU3TtjcNTSaSUQ3mpEWYZ6QYRARUid3z3Z1FpUZFKCZ4TJVBofpIbQY9JVomuvY1GH6Fon hmujgpbpXGioFEmVqKrb42z3TKFqBKWsrWIKbsiYVFZRYVWAw8wtptbL22Jm1kNkMagWKlaNobKk R5KnGGEFcvqkWjPZsRDhpCxKdmoAMDvMg6HJUsF71SMqqCtbIIWvFgW5cLFUcOenYkNF6yrRSplh AlZPwjCfZnoH0k/ilZwmhb6t95roGNEYgFDqkNEVxFNNnfE/mDm7f57gWhzF7FItLCKp80UKJRDN XQCXZR0+IN83oQu1zmEbFA4gVZA4ayRFt+WYIDjoi3xhgiCFUYH25HtypFexqEIm/9VZKqubqg/H Ohc3hZsjsMSqGP41NohqfYlQQWIntMaCpp5aKM8jXSU0Klyjo5wat66VkJWaIhIVjABxiwNvUQBW EUdylec6R4ClRjO0cU4QVGfrPNAJjfekhtNIx7auEq8oPU5tdoGMQ0qNygStValpsiUi40dNNwqh khrpyeuvDGRAGk0RybWkRrO804CRhVUiS7xI8nJC4faM2RJY9MWntBkJiiJKVHB9i5SSJ7N0/BZ2 qlHuBa9TslFFeILBHImpiu/nC6UkvdyDQsHlhaVGVbBYVwJKpWCPYKh44ZGqrCpbF87hGW/01OhA hRGsGFMSqxyGxKJP45cAGQnr4CkrLXXBqVJEBysmW5TURKbzBrBW0Xj0liNxTZqrSYzIvM1aFAmT GoSHvQrz4q8MveF/6ZaaBFfJpBYW8SEojS45JY0AySftBLA6n1R0alnLXGKPXmkYM4a1jjODddWy hSUPa23hNj1HNVENpzAJna4GjXHdRQ8kTEl0BCttibwGITd1qBTGbfVATUClAceoUfwdtzQZnpKY zFS2QNRYF4D5Vk4bprpoyjK98XyGMVlgDwQDIrzJEZxs1p2qU4na6pkWVQishmfGShhC3LoHsCjm aBFIMMi3NQ51rVtBXOeiBhYpivcyTtgZzIGlWVRV5krym0+SFkR3K/8NZLclhW1pC7ZFF3TFQCpO 8fsnTODxviAWRszqjEaIaE4ipIDiuk4LKssuQVU5rCE0IVNR+PAnj9IKLFaXvOzClxTCYlBQXMcR PVALCrg4iUySYaola6mCz0BPUu0mLVV2lFKjMRQLXxvFSubLTJFnZm98qoYC7EY4j5YtBJmEuDTs sQg7NWhoYeDbFmhRkzKy5ej0hHDwRorKg3FcTOFeTtMpZ5JRUHFpFemkjE+a7nJpvKjJreDSycrA CrF1+pDGNlcsTVS00sNMLTwXkhmgMSnWdYdZwTLFAf2r3T/H4YEj10gwu545Qj/2O0CpMYOjs+DA HWA1ZbSj1FLtllRJ8wDxv3rpUk71V/vYm4kHtLz6wVVIKvOkAW+mFEOYedNALkiVH+R246bn8EgO jiCVr1BTod5apWnEl2Ob5OKz5wZN4esqdEyuCqxYnuuckcQgkNuBHVduetd+DeoCMLNlscXtkSpP Vcyn4o8ar5+OGxzI255M7BInMpvHZEev0A+rV2+w/vobz5zBw2oOxd6o9E32ENnLYZx8SUWOFyil byn+ifSuhm+bPCmY6ZwUGa460njDRrPNmVzYr4JLpbmWWoS2QfmeMrmq5YU4OKAAV36mrbvua48+ 4sUv2hMlH3n0MV7dO+64d82YMZ03s7mRhMUdVcl6HsMaOMPZViHxst073/E2XmlkaxDjpq9vs01n sVfCdttuM2PGjAW8Jbx4US1jUUeSrDoLE3J17Uy2pzEmUam1XbWoCLQm/yW8M6zM4yWowQHexgZr 4UJeVx7ceecdjnnTG/76t5uwsXlPLoRcR64lNpkadd1uJP8ur/PtXWkAQt/r6+wBYsDEM+xS0Atr aMi7R5R79yw/+WMfPeGED1591bXzFsynhk6ZB/u41r6KLWzWmzbtgx88jnejeYOebs71NE4XOV8y aLhIl9d/ebebYOVkGFlYQkek6+EPcChSgCdUPDzGdjHsFoRxufLGc5pUe4FO7+WaaQZJn5NbvnL5 QL/NnBPUFYH38x4iT0LCbNasTX/4w+/Q1+F83HvfxU4vf/rTjWxz8MQTT86dO/eccz79+xv+SJMi neBDKy7SM+yQT0PArB+2JDzL8EPrH/3aI1716lf8z/9c+syzzxrUQ6s/esKHjj76CO5y7b3Xnm99 65tu+vstvGkNQ55JwTD0plvzYjBXeEnEq28Z9vVjEZd1eBdSe7Gf7rR6FDYuX76M6Pd1ajrJqtVL li3lnVjgdQuQ9jZwhoZmbbbpJd/7b/hed+3veRBzcMxoApFtYThHp2lXLFtO8GEIPoxEqH1v1DN4 LzTLrxcQIzPxXvpB7G/xgQEK1VqRJVcHUbgySggyrE2btt7hr37F0mVLnn123t133cu2D3vt+UJ2 UOHm5447bT99g/UPOeSgI486nM19/vWvh3h9+YAD9jvyyFezoQp7lUxec43dd91lu+23OeLIV3MZ 6tFHHsVR668/7Q1veO1++72Y17WfePLJTWdtusOO2+6zzz6HHLw/27Tstdcerzv6SOSyaQwxtOee L2TDE3rqgw8+uGzp8v0OeAn3DJ6bP3/ttdfeZ5+9Zz88e+Lkia9//dEvPexgBnu2T5k0cTLBhjs+ 85lP/vWvN33wgydce+1viYwPf+h911zzWx5OY18J3gU/9ti3YizNs/kWm/3rXw8ySr9g5x1nzdqE HSjwATGB01/60kOICXZ5uPOuu7facosTT/wQr+befscd4OAqXLbfvvuwEcEZZ3z8sst+/cIX7sa+ GA8+8ODue+z20IMPEwp77rk77n3yyac2mTXzLW950y677Pzww3Po9C/ae6/p06cfeeSrdt55p/vv f4D9W3gI7pBDDjzqqNesO3XKffc9QHNOmzblLW9+0z4v3ovtHp5++qk0HgHiBgKHHHzgOlPW5sXS P/7xT7yayxsuPMb77Nx5++23z1ZbbH7QwQfeddfdG200/Zhj3rDjDtuzKdKC+QvoFUcd+ZrDXnow pmXjDMcWb5kwBiTr0IZJDGfGAYk3NLn/8rz4yYkBVEUASkiJ63322Qsxl1zyfwkLXqPdYIP1jn3H WydPmsi4cujBB+y330sIzSVsWLRg4dKlS971zre9/W1vRqfXvvaI4497F7v/fPacT2PnwgWLPnH6 yWxpst56U8///NkYwK35L37p/M0322yHHba54Pzz1llnLXYxuOT7/73nHnvgsvPOPYs9cV7+isM+ 8fFTeCV6jz13P/vsT7FNCszZUISLLsTlu991LE8innnm6ZvM3Ig9iT704fdtttmsxUsW80Yum65s s/UWl1zyQ161ZUOihx6efcybj3388ccZig84YL/n5j3HK9oL5s/HQaed9jG2NqGvfeQjH9hoxnT6 HK7Covd/4L3wnz17NtsMfeykDy9auJAHU4Ay0NF++jCJvWV23XXPQ9huadz43/72dzvtvMPb33IM 3Ohcr3/dUTvtuD395PzPnU20rb32Whecf/bkyWsc8+bXn3bqCc89N/+Fu+1yxidOYbXxjmPf9p73 vIPNc4466ghkjRk98OlPn7H2Wmuw2Q7bGK23/vqQV7NMmjiBGe3ii78/d+6ze+71QvoP2wtAy+ZN nzzj1COPeg37bWy++az/+I8zGCrWW3/aWWd9kl2BjjvunWwh9PjjTxz79regEjY07duXweEJY5s+ EiQ8KG4A8G9EtKgJPtjOVpWnB+y77z7XXnP9jX/5CzHIJgswYSyUh7uTrcLRv73++r323uPSS3+K Gfvvv+/ZZ593419vuuLKq88956y72BTq0ce+/OWv3nPfA6i7ySYbszXFo48+ft55F+IOGu+Vr3wp WxzdcsutX/zCl6fPmPHtb33tKxd9fc6cObvttsvMTWa+7rVHfvm/vsq+FGz6cOml399yyy0ZJGke NGcoZohmztxgvWlzZs9hr5yf//wyZhYWjDzEyi40TGusV1ydZa5kfyyiiqfwQWBbh+OPf/f//dFP 6dzvfc87kXXb7XdMmbrOVVdfwyIDw2nLV73y5e969/tZalz/uz9873vfvPCCLzHHEx5XXXUtG400 R/X3HbD/fgwG6647hR7CzijOeiuc6XAsmZWrVhx22EF07iuvuoYdJRhv9tpzD56zZDeli77y1T/8 4U+fO+/sGdOnM3icdvoZf/3rzdde89uLvvqlH/34pwwkf/7zXy677Fc/+MEPaQyGjczWozbdbDO2 Abrxxr9NmjT5wAP3u+KKq9oafNTQY489cdZZn33wgQfe8553PTdvPiBGvt123fnFL96bXX/Yt+K3 v/39L3/5a+xnbFP/XEKgGV2k0pyMHnUejOoGYx/bnD0/aVYvMFj884L3ypmbbETobTRjBjPI9ttv x0hw41/+DksjiE/SWF/JZ6+Esf3sHbJ6iE1gJk5gv86FzOi8v8UOJ7xhP37cGLcFG9XH/mvMTQga PWbM7NmP0P9mz5nDzjD9LIfGjH7uuQXMcOPGj8W5zNxMSZjNDkl0aDai4fVXNPYSbS7moi/NfcKJ p73j2Ld+6YufY/r71KfPZo8y6pmAGEvZ4uyZZ54lRJhN115rLVq3OgJBjy/YvgE+v/r1lfvt/5K1 1l7rllv+8dRTT0+YMAFCRmwsY53B2MOqnBUVCK4qOPfx2WmTzlo99J3vfP+CC7685pqT2J3rjDNO +853vgshEUxsAMXrU9ZZmw3Z3v62Y1jZMN8xn+L2uc/OGztuPL5CJayj4z719LOTJ09kkesabqjv xBNPY5MSNu247777P/e5CxmqmfNYSuy374u33W7bC84/B8XWWhvO0+kNpQ/T/ZIly9iwgz2ANt54 xtveegwPZtxy62333nf/737/x/e859j/vPDcefOe++w557PHk8ssuzi6uPrkaKcb4iZfMePYez7I YGlJKPZhfC6h8grCYYcdcsMNfz75lI+feuonPv6JT++xx24s1tZaaw02m8NTDG5clmApOm4MW2X2 P/PMXJ4o2GbbbWjCHbbfhpamzWpRQ7iScPG999233XbbMB4wv7C2YLpFJmNSFs8e8Tt/IPOkFo29 914vZI5jFxlWLWybxLCxwfrTqEH0GpMns+Hd5ptvdu655x9+xOvpLmzZZvT09T/7zLP0vw9+4DiY 07G3227biy/+Oj7FuGpXJiYU5vFVFiWwOurIw+msmIbxxCUxgfQX7r7rggWLWCXAhNHOZWwSRRJK qrXnVq5jiDku37HgXXfaurBFsa222pJLbhhINzjxpNNOPOn0q39zDdsk0n0ZD7rhvI+JZvGiJXvs vsviJcu23WYrFKOvz9hoo4+dTIh8aMstttzlBTuzGkMYU/Auu+x08smnn3LKGSd97HTGNvatM+iJ L93r4zm0833sWHf/AyeedOqpp57xm99cxzZgm246ky3XjnnzO4kzYo6VcNRPW6exY0savmxLEAxW Z6qjaGwMgBY5GWeBTTdgDyvmSLZ0cgW3ehVOP+qow9kp8L77/sUmf2z2xeR60823PvroozwX8h// 8Ykzzzzr/3z9W7QK61NOib/8la898cQTdH0l93mnBiN+e93vd999F3YQRBNOCH9x2eX77/cSjDSG R7GMD7IPFTCFjfril756zmc/teuuu2y44fpsFccugz/96S9OOvGjBx10AL5gG0V69sEHH/C+972b tQWO/vOf/4qbCDda6ML//PI3v/GVX152KfsZsbr8+te/hTJED3MQe1/de+/9X/7SBYw9d9555+OP Pc7ikU3JiAy6FJyXLl72uc//5+mnnXTkEYdvuukm51/wRVa1KIkJjhtJYHI1JavIFzEUcW3mnPM+ f/ttdxGOP/jBt9mej7MJbixcfd11Bx20/6WXXsJEsHDh/FNP+zQ604u8QMK2TcuXMnZe9LWvn3rK ia8+/FU47atf/cbcZ+e+9pRXH3/cOwnKhx5+6JZb/8lIQHRuvc1WzOasiFGk/+mBa6+9/mUvO+Se e+9jlYoyuI5xnQcdr7vud5xP/eQn/8PgyvB5zrmf3+fFLz79tI/RapxDXHXVbwhkoxsr7CtZcNKV XVQZBb3VRd+ESWuPGzshCPaqrFGqKTnhkpLOzILjscefqIcuufIyZd2pmIeWW2y+2ZKlS55l87FV K5lQJk2eiG20xMIFCxjfNtxwAxz0yJxHx44dvcZaa7IeZNZn8x36ASM/a4ctttqCC0rshmgUMhSN Gfvcc/MGBwfYZY9RnSs8nAssWgSzRQwSm22+KcuuBx+cTf/GszNnbsIC/v77/8VrEFDRaJtvucWk CZPuvudulgB2ojQh22XRp9nJlOUnFzxmz57D/LXOlHXQn0hi75pZm7IJ1iNs/PWlL57/4EMPX3DB FzgpiNM8oWM2ZBPO6TOms+BnGGNdwlkAHpw/n3d2gOtIajiNQismdc62mEm5njRh4tjNN98CtriF TrVg4YLB/tFbbb0FSt11170QrrP22kuWcp63ZOxoNgRc46mnnl2xcvm0qVMZM4hgBhhkcZ6/+eab IuK+++5jsCQ6iABmPWRxcs7wQ7RhztrrrIMHJk1gYlo4efJkQLzyxhBCoOM0ZBE9nO5xirvJzJls b/evfz2AVk4uDH16CVzHBPptZsXMNVl9Llu2uG/ipLXHjmWihY+RhGNd9WVC8tpfrm7DgKGTWBEJ duyVSydbzaNHbNrNPkFOY3RZXOaqvq8fzQARByjByTkZemwWiaULVzVQRVb0LezkcsWypSyn2WqX KzGMMWwI7Im10ypkXthevXJoFXuNgaxJCEKU462XBZnjuEhA0CAcidgJawxWWa8xc2VlBYbgIKBU 4w5EE0Naki3UPvnJ0zmHes97P6Dj0K0odZ12cZ4sU0X7BBMcKhqA41RGlFjtpRrDUlr3Z+MKB0XW f6qiLO7scJebrc9G4xRmbaREVZDdAsqFCreBQHCroHAZ5WUScsiOe62M8mz7NgZB2KwbGfIBrx4a xA/LljvPKFRXoy358gmEKAUAXPRHw4oJ6dlBjsmRNkUVR3H+4Nu3dNmiNn7I0UQc6UH8DxvMjvgo G4TO5xYKARKm0uiBM/0jcfmSRQ5nEWjAutUzBvfISkxCGRyK6A0EnrzqsnixDwj2Bq4gBbX0Uj+L 6IMlfNFYWEUGdxCCRKMwWTeq4KtMVQZaIMSA1VRFDRJTJBsrMiISQhJEw7DyeWyUt8I5V204RnMa e2TCdYRuz0YuAPLCywiNOt+Jk8sO9hkK/b7i2gjhrTn9TD4ogaUQJSAUpAnFkIgh0HNdKjVQq1Vs DBrYagpNCPSFQoMlGpwTH3Qnur2ne9SwKmfOYnkLq1J22TKuBUeorOIUmlUPtH+49lwlXkeYnDog HhRDX5oUi3UFAWzZTZu2VFehqlkZ5KUvWs6rtjInbzOkAQs1xeJsVnlB6/QSv/xiTsQoPFzZs6+B wmFYDbn1jZozZw4XN3FWsSgNo4a7vykrXEs64kzp/bi1mQNLKx2o4ZghrKOSVtNK80KoI3U6D4JY RkktFWfDitPONotBxzCDIhd6ZRoKvitZU7LgGpCcZUYxMAUllZzccqTM0MiMxopNGZrSsBz/AjVU o6cqjXBv+IW/kkiGuKMu+pU74BXSGtXFcP7LI0KQOLSEDioZiOqxS6C4g6BSe5WF2RBDA7YaI6kh yTYldEgPEzysK1kRjdpKI0A9viEp4513oj/AIg1hssWiGHjEeSz6bMKWOgqx/cS72tl4+SVyNHGQ IVMjbtMNeJQHMcNuGl4/F65MZVb0IQfPcgD5NksGkwzr5EsBoXwKVDjIcB0qog3NKJwG5TqC8aFX kkKmU5jhnSiLXwY0m9zwqzaTUYAcSztIW4ypoQOmSpQeMKxpyZq+Pk72WByQIUQbFuj+SVgMuSBL lkVGrIBBxbqZYabSNAlRr4HqS1YdKjXlvKopNapDSJ845RyEiyscjXL9oyrFAFYsbriKj1Hlqw6k ySpOfRShRDMzhJA0pq3AdEaxG6GGBOKoDVljKMUUqJNWlAKpjiXltdRqCj8OT03g0qbJO2TJej7s ua1jPmyX+KpBY/SzDeR4742X0eIigOtj7oXo+6stpiCOyziAwz/BXP5OyQUrHhZZFnL3i0QUka1+ EruIOL7BRISionEjkkAbpMiCVIusE29EotY+hNL6M4AmMZRxsjoMg1sDlrKSScxf4cMOVwz0c1eC qy9AZ8+ew/kLN7rAkT+yhlazHGGX/m9849vlk9jVGMZuEaM9mfRxK9STy2HRkdETOVErtss4JQld 9Bc1dWGFT3VPRETTwq8FlgTEX/jWMbYkHH0ir1QJOAdbIPxSigTFwRyIw0FLGOyP0SSys73xU08+ zXJYnGqF+G5gzFjWB2ygSUJteWfoiVQUSVxjBQCTweOtTtFdZDHROvCEViUaEjnsTK/q1NEokjz8 0r8OWvDPzz/Ar0AFD0oTKn687NVfV+NKdEGvx9siXHUiUkIktDArv3RetRLXDXGJ7AeXfIszzG22 3uptb3szG/vfffc9TBlcOGI8wDquZHDvhtsC3IrjwbK6nM+av5iX95K34+IBzouQrkeihk2cNaBG iadKqJ1oM+Oaw3W9pwKk9EdVzSgev4VKmBhhYoHUs0U/2GKFooiA8lUaUu7WQSGNqjrNGI8vPEgY 1Vdzh5kB1VBMPdZwNuP1MQZ28LHFZoYgQvUkfYOiTRk9Yz7sGJODDRt1ilOiQTUjZBDnJFEHyVko B5kXIkfUokLbW10pWsgRKgJzsE4IBxCgw8sspKCCeRbhZkIVsPyVk084W42YCM/IR4tykfeEE07l KgtXEj/0oeOvuOKqfUkveRG/7MH2+IQFO5EjjluD0L1wj93Yc+xXv7qSFqVYYuJnVCNxWutpNpe5 oiFwZZmPjQ4sCQJV6+4MdObT4Zr9UEk55HbQMOVJFxloTKwILTW0kJWmCCnLqZNWp/Q0hAJM4jvf KpTIyMBWGopRj72RMzCIhVDFV/Gh2IwyBEb0E6XYSVqJCguEfymFdnKpRouiFpOKnN7tVujUBEcu 5tOZWiEyPHsn1BSUcou3jlXVhSBGqxkJNdhVHicSJaWDKEqQU+lf/LxT3U2Nz/eyUwz3B9Zee03u IXM/ggnlla946W+vv4Gd7d//vvdOXmMSt6Bh9tGPfpDg4DdfPvLh97MdOwuWNISiYKi+SuRiq+fY nQpKxV2CCzF69RakrWFjjR6Vk3hgYRpUXKDjZ3c4PdYKyrpO74lR5cawnWCXnDRkHG7XkAgsx1iI yFmGB+1cbSfbSkEJRkhSKbSoyqqwbLJV2AFK72aqNB8hkQJWT1e4xCTZpdIIxUSmDXd0tjZ/5khq rI5hGI66JpqWQsoJWsO3qF80sqrq6PWu/gmMUAAc8jKLeqnIkRN8Vz5gZjqKoeFrjb5y1OHW6AUX nsvtOpbG7z3uQ088/uR/f+viLbbYnMFp001nIY65Bju45nvxxZf849Zb9n4Rv5GwJVfuDXuZaIkz teHNAMIvlCmYeypc62NJDsjZpFMeuQ4l4KoZGV0gEN3zCJkwShgz1M+14JgrAfhSFmqjKTbiF4go 0KlNq56rFCVb6qOlABU35TstwQitBmntgpV67YgrFY8t6ceNQcjDzUuoMUimmW2ihpzUHkRGH+td +KQoLROQXU0UdFR1tQ+lppbdUJb6giJYbpLLNP985VquITWcMo/yoAl/0AFSe12BIdLKo/BzDMuS VTDX49yS+NjHPn7ueRfwlAk3dHh64cwzTwOdgEA/NIYTUxtWoDCPYLI6Uc38IwOvRZJWMzBwl5Hb cuTBiDfMRKcoDm7+OydIK64fz2HVmlLKOIzL5ESYAZcUexo6LaUKTY04NmTFoLFp7C3ZW8Pdwv9O 4AEzJIUUmlpoVC/1hkEbEvEqSp2ERnOHF9fTCw0n+HamUPLfelOHbk2HZnW17/MaWbk90xCrcNGK RdffpZWx8nrYKWhWB6pcj6Hw58mioqGWVrQlV1x4LuTqq6978MGHP/D+96673lTWHPy4B7d/+ZEo lKufFWB0yXKY3fvHcHleEVqmF/MdUUNsocHKMmv2IW6/LQYcTw7rjLaZcUJLtamxMZ7k2+s2ArLq F8nGc5gUOUnRyreJDKAOp3mjwwl2gK0mX/92sFlHUorQJDV5A2zkxPkLJU4JKj5QzmFDH8St7TxF AhTDdy3iKMPbzuYAUmI6OwxthSWRT7HH0CHHICwacSLIYqMSv+MALlaEQ/ErpsN5URNvpW7PucWg KmXMfRN+85Z7Wvy+Tl8f95xZ4N55591bbb3Vj3700+nTN+QREH7sjCfz7r3nXgzlx1+4z37bbfx4 29IJ4yfMmT2Hh69gnotFKo9KpXIu8K9g/e8CtqWR5qufvkMFekAaFazKoHmvH3Y2cimz3bKQBF3z BQFUFFCh8dFhcuyEyrVwrNEvkRoqa/49OVykAcMksRqjgsn5S98aa0zhEWX8z5LNWQb+YNmjZW30 5gclqXOhjU0EUZ7dGqkVenTWMieboppZBMUk27gcQRX20i9dn/IsrpsQgdUwQ9GioUdOhobhSPp3 GxWgsvCRkcrIr2s/pTUqbfSagXcWaXuYcW8FKmYcggAAqNweY6jgfilLbJ7T4Yc+4Mzdc4KAe+Lc qtAcp49uBMNhnKjDamg1w0gpqULN+tzjoFTmu6JTyeHUa2DEoDn3EQcGePJt/nOcQKm3t21RFP97 /VDzDA8e2+PSnFLwfGMIA1sr+pQrSkrQbSD5jExqJQsPGanAbAz5HmIRtiizJnkiwtkkDBAXXa2O czWbfNQowXF+5wDJmmD4t2yvKsxZEvJADAwy1IBTA2cZpi6lNraHWZpWpXrWaGNX8bxOE5NkgNsK u0nW0p42jU9z8Sh+0sWH3CDjnsvYsXZWrh4WITfkMGHcWFua8wj4YzLzS80gmkryqs8wfyostekg SkfbsouA4EJHuaUFx7BiIzXURmzGCewlwI94RkDWuXVbvYwoYRE3QoXI15H5wD8NhwfIBa0UKIeK k2qRAs0ckVleEK3fIFxCy5oCpGqz4AvOIOZIQp4BGW9WV0sTdtoVdqPRvI7vSEApoyS0cXj2akGh gl4aNnyuGGV2MALCSqi4QQRmDynhIwgB430Dt1WGKoUe7fMVKqc3HwHqGljClpdVZJmpeiRUQHc4 HVNIGlXVlNRhKPfZ61a7rieN8FLXTs1awQQrvySnzUly1mqKrYZq3FjQ3jHlIvJopIVDPOdA0/Er kHSSpJbeigeZN1vjdvV8OzA+P5ioNIQzlZbVnJGPp1azOiEjtOuy1abi9VIHSkXudHDtlccM6qG1 qExU6vTmJoRiuSd9IVFaPsBbtltd91hbH2R07Sobt54eoe6VhjNlDu1RmRqvMgnCDCLCMSYrAwem Umrz8VInsGNpdfTBqq5O48CPiM592juSNgK6ClzC7NaRp1Yn+WhoVaJUMpTLeynZ0x1iK9kaJYOv ZodUqpFPoZmNehSZVtM5C5JqSZ02imvHm1p+Qjs/FKcmfX08fOWkR0GUoCmrUkeVGnxtrbqRBMUv FioOGL2Zx8MLdgCHGYHDMA4CVQxX8Yhgp2xPYoG3CJDMJFtkRINODeuSckmbyTur6X+DNhzZl6BG 5RyhdFuUKp7/y2108xEXNLkBT5Sk4v916BQUVrrKNFwFdY0d0hY9FamBdhwjlLCL94QIqOGgC5NC rWZHKVAYrlTdmI5/IK54CWromjGaYNZrBmPGsvJiVm1dkGr+XZNSNWy91PxIGy+3LYW4zlt5gCpM 7VGiNubmSaW07DpAeASpDtQHxLDEYxY8/weVUasNYdEduCTKABOeVhVDRz+bTVukC6+eLKsBKCLd tMjIr64Xbr1h3ZQPiIPf/LVjMrAbVkV+AnMgfMx0JJUPMBYUWquNFtrauGVC7CiqtgRjhiIgRkoE dRxi3MhCsVI5cgWg2avNQttq+RKsR/3mGErHZ6uhaHY0QCrlpEfzO5vLlizN6puibq5IpsFLyXIx IVdKqH8UIs7z2moeO7PGGMmgVI5v6slTFUovB7QkgziJUkDwZR1jvqFUxDXsWgYqJGw9NEYqnD6U GllSE9qQioXm4ofIrhN/UOq4xUIR8i9Zwj28EluRVUxQMw0YL8hTrsO0DamqIzRQD0Fq31x3p5hC iQ2BuhmzGbiLoAAAQABJREFUpujCtzFuZTs36cQ1KhFKiWE1LBfzHi9HCRGlkrcuiqbhXwGiBiKE to1h4hA/POZXo5SrEWaVOMCWTGuWvlWHBVaqcRNUUE7V6gFLi+EKTieMqlIvRrahJkKiTaBROlbl IgqjbTVxghLzeDZzdC5ENnnyrGxM9pBy6jpALJZzBYj6lJ95oJq3lVKMP+IrqIqQ7zSTDAOJTRVl GdfSZAYZwzmpwH4Nq0DBohw4KF+4R769T+QpQdHWrNAQQiXmiBRlxG2y8tXyQSveRUFzihdtSnua FgdS5eSjeGGYmBgwX9itvkAWuuaXW6EVnUds03a++TR4rlwBqGnHYcYgSaCwKOEaoic2YhcVIC4e EDYVSlSySGo4FIpts1kJKuSfDLClMQ4ayEyBJEqF0ZtHI63VgsZpqqBh16t8KYBolGERIxNbLM3f U1jl1ZzElx41Z6qaZEJVVYGhZNdVeo3d07G4FXnzJmwliW0dQyVC48K7/iNWk3r6hJOPIhcz0CNN d4fEQ+mZijQK6outxgaMMoJM6MdFCngeFaMIrlPDEBZPjvR8/FYs4NPcEoXFCePwbmIypgjgr4fs pR5Rh23SgggUx6SO1PXOvxyEmo6uMWlZNJMKPLxoMR0fUhbPTz7Jr68/Bz4PKFKDzcVXdP6iJjWB peUV2SUimWEvP1fLMGStkkvfFr6IIEV6GEZXijZ/SZKsm2NLXhglPjSNv9Lf6ip3Qip2EgLyLXDD 8mYK1jeUJlvy4SmyMNWNEMl5PoM8rRGJAtmfi2VHXKtIXOkU2uRAFga5CZw1R+swqmK7A8autPyw rY05pqdlmnoUO3YhVQYV1vHn0NVJVWQCpqCjWLQ6ruDNJJvetoSi1VAWLpK81KeHnS5uyYbsWDRG ftFyvB/La2ROOj14WIdKVnJMUl5A1MhNkACY8Bw2D81H8aBmnBDdLWLsJuZL4WitktQ0xiGh0MOg PtYXf42qHiNi2lcHmTqSoFSlggqvocRVsa1RxahyN2wTRMQR7+Mzz4rn/Bb+6g+YTydHB4d7yZBc 5dRKkgbStK7JqLO+A/ENhcEET5nk3YVAZSWDdoJi1oeZbE7ZqZF18jLDJ2Xf9QBsBJlKmCoXSsoO EhnCigSQHcfT9+JpQ6JwmyAaY7mBX307eOEVuRxwDHAdVCHZiQ7ZiEOUZJzMW7UphFcGLRkQHEyR 8UZMCEq1WRCbyuSbzwg+dVd6qe9RqkbeZFCXHF+aIEbnIrWTyGbtIlVkXW2S1zAX3GJylnXTDcA1 TcjC/iVrXadKRSX7CLAYBGV1KarYWTvRHUCqXkIBS3zCyu/UIHIQ+WjZxiBqYUU74SB6MSAxZa9C EUsHXcVABQZf9XBqr+9FgCcxwdSgsj/9HkaZS9RKBymnS9EI4VgimlRhETi5aNshSzcCmizNYgj6 c/OreOOSPcq4cS//SKJtCAsuvdVrIzQ5upV8Mml+XVTt5KDe6JqGlLtWd13mQ83etaFaTD7cqWHZ BhEZjV69Ijx0nr6FSEeKUnIRnkZUQeijo8fyGzDuLUeH3M1BeviAWOLqq6hEU9u4mirDsNkR7sBF QMkqFmbl1V7x+F0apUOcJgtAqsFiRq2BklCAGGRDJJzDJZQoGikgkFnJ7RQbXBpw4A4VIGVJHLtL mGAp+VcP1TK1atolpkMsvbGozELrIQtIEkeK5gXQsZml1fJVPOG3bPy48bzXuftuu2688UbT1luP Vzt57HbOI3PYN4Ebs/PmzuPOS4kJn3IHzpWpPV92PmPRhDWV8zVqiBMiwmyzTWfx8vA222zNlkks FebOnXf/fff//aZbbr/9ThiMHj12GVc/y5Vlsrxkzt0DxlYKkePR1rJZUtfJpNp+0kPTT2KiZTDj tyBzsCrVRc1g10GCVgRRo7Iw77UyNfGjdVKxHVc83xH53Tdp0jpjx03qhCQOGVUYJNCmGqqcEyK5 BIXu6FIz3b0XcYQF8qiko1JJnzPkSn27YHd/uEwJw95B+1tX7tWNzBSNngCNY09oalywMGG/4mUv e+c737bttluzywH7izw791n2vlpnylq8FTxlyjqPPPLY97//P9/73g8eeexxHu8oJYsVPGHonVJu f6xsL+yMFOSAnn1NeFhkjz125zVo9g9i4xBGEp5znjFjOjtW8CLxT37yix/+3x+zkQ4XcoY1NJYZ WpjaBnhN0JcwB/t4f4K2RG+HtFhU/rFr2bOajT0mDD7go60JLUf6kFW51z1N/xsUdJgZWqFqrZB6 DrJx6CU+As5XsMVYtnRR4mO88WEccwPMmOhjLG7xEUUlaEIkI2EqiLgsJaRAPJwocJaGKp6EiiOU ZUFeiEyoFi7VI+0cZmAUwMH3GlXLoketNM74ClvrgK1YsYx31T/1qU9sv/22v7z81z/60Y/ZBo19 BpbzUmeClde7t9xqy1e98mVvecubWGKfetqZl/7459wjDbWRQWBjC7cU8FS7hojTu0d+uBsydeo6 n/nMJ48++sjf//4P3/jGt/72t5sJjlxWdubigXg2j3jD648+4ohX8dT7KaeceeONN44dy+/nyRwN +bDjAbcW6sVoVhjs8zFr1izeZ2QPgWXLeK9zTJysRiATqTERaskdaAa6+/ui/P+ZhtvOMazNE/Eo GhKRtnlGLKYNWgRX2OH6Ri1bstj4GDdhssqBQRi6zKBFq0GiB0Y6YYuS8chKGylJTEHOKaD1FAeB oGbedc0NS84dBgYSH10n6KH+vzJSDw4sX8YuPD0wOflnqRSugeDcI444/MILzuGxntNP/+Tfb7qJ p1Gxk3DU+DxtjxI8IMhTqzM32ugTnzjljW983ec+/4XPnH1eLUqA4hTUZEno25R6xnZlMYs89lvZ ZJOZ3/vef2+4wXofPeHUX/zicgYPJik0hHn0cQelXBQeesFOO3/mM2cygH3wQx/72c9+Pn48P2yu zti8xsRJ7Iz1xBNPo91hBx/E5k8bbTQdsptu+sfHTj79jjvuRBl7i67qG8MzBq5D0SIm09naXZXY 7KF5439le+CW6XxWalCJ2l2vTsv5WFgfiylbH6Zug8lKI5NUH5uvLGQ7Yt6aSk9qXdOYHxZjeEGI Ov7FWIHo3Wu5AGyJRFAj1XtZJbSysolTSatGbeT4/0jUgzRihPhfOLqwEk114EEHfP1rX/rVr67i MeMHHnhgcPTYLBLVWp2iJYU6I2BfiV9c9itWf2d84lTuBP3hhj+OPN3NgNHN30yyDHgrVk2dNvUn l17CYHPkUW+87rrr2QoRVhUcdSkCS1GGKy6E15w5c355+ZWbzpr10Y+8//bb7rzn3nsZM2Ip7yFP YHey+fPnbbftthd/5+t//BMb13wEZV784r2PPvrwn/3slzygVNqiOEtp+nQ8mmbLwq9iRbfxiV3N C8/Lt7r/X18dE+Fh0trXBq26alygxA17QxIfbLxBydaNVzvvRw89YWxFB2q6lvk3FcEbhnUNj1TS CF2TL17GTw8Cfwq9shHCp1O4oIXcw/E5ifXWm/a9737z1lv/+eGPnMTuNHVnWIkloimv9mSh50hA 3HDDH2nM00//2O9+/wc2vTFEGn4xd/BIv/Dyxte++iW2OTn88Nfdffe97TmHqMWBJ8o4wpy4R1sk MOjxyNm1v/0d7+e9/e3HXP2b65556hkGwpjGKy0rCMpjj30Le/C94Q1vZSMkNnf8+003v+tdx7L/ 02233eYQEo4cMGK4H1hbKX6CXZYpz6vqMPzWYT3vWRwJ7OXtwyj/PGattWIOEzc7WoVf2sL9o51e bJnGEU85OSUslDJSUCu3qnzVQd0gjKhhAssjODcDomynfy+S8Ayo0nafnlE9HE5lVx5/3LuZyM/8 5Fk8FexjJZ1+nVSVjyCbvChpeB4ZPO/z/0lUffLM07hSEr3CPxilDFQ8RP6G17/2ZS895AMfPPGO O+/yxKfxbwYafqWk9jJsqzRXWJYuXnzKqWcQCmeecSoNiWSwOPdZkHeu1l13Cs+xsu8N0QbPp556 hhdweN8ifrZlUQVepUbUouP11K+WIDo6E3uOGZF5HrQ4joB2VlAFE8HBl2FjquwM37ke7esIziki e+XDsQSKJkTNKkVEcfAoQv5Tn6sGrQkis9goSdwOVaatygx9ukphJ2Ir8q0mHcK/28g1Irabev3r j/rOxZfcc8+93ALqaMGNODinC1pOI9klkxi92abynHPP50xkF956Wll7DbJw49wr8eQcu3q99dZl Q6b/+eGll1/+ay6oSJohMuzlyuzm+90Vgsok6TxGESaaz5z9+QMP2J9NsFgRSxoEMrfc8s+ddtp+ t13Z1mwhMXTA/vvydtat/2Dw8MJu8cjo1XNNhXgHA4ne07nNUgkWfdh7qlIyg9E7mEmM8aW1rs1F 5Mh6Ue3DBQEZvYbS55rfYOm6r3GGDfWCMlzrspBQUTUFTTMmvjsu0auU8/KsEzo8M39Zm9Vy8zQQ QHhOyxSDBMXLSqtzgWXEPBS8yGdq3GuvvdgZkdceqaWdorYaMl+wzuJVUvkoWaooJ0cxhvo4ufjD DX9iF+WXv+xQMsrCPO2P6OyB9qY3vo4NC88//wuZgPRh61Mq57+oXg10TecfAy0CYNU/inPZK6+4 6uabb3n/+97N1ryAQFaT1f2//OWvjjziVT/60ffYdW3ihIkvfenBP/jBj/7yl79x5xp+pnIYRyWo vHqTUz3/rapycEW3aB2mma3WRSfNSj1gM42hVfAJL1fBdESWaIOjWcXTRzpRMiNkFCh7lZCLVHZf R5ESLVs8x7EEhEHQiybkHKwPjSKk7p2x20aJTWtFAeSQnEKERkZoIiRIYQOKspuPOmpAe7JH8UOz 2aWPNYVqZ3iXM8kfsVMZjzmxoq7jq2bMDM/Onctulmw0m7d5VSl6SQUyG5VyMvzzn1121133cDED WtWPx4MZ9hKBLyFHvtDCrDV9ixYv/ta3vstbmS/YeSd2kxA1np03dz57qn7jm99iy3Z2g/3EGf9x +sc/JU2TLx6lKCwRrAQmmxy+wHOKquoOE9GkOtZ39V0rw6H5ENYhbJhq7LAwxOk652FhMOztehRU SaUE2MjLK+n9q93LO0LDTwS0yjFKE0Beuyz+rVr2jhDFTY9pKu3BQ+FcoTXoGFCs7yRS5Vv4ZVGr tGTPHHZT+ai0USXOljfbbNMnn3pyiaM3HNELKj/e2aFDcN6m4RDy3UBSBge1MHPOnEfYAI59UXg0 poQFzLpsxd5777HZZrM+esLJbZGRFajGw0mW4al3KMNJ/mQE6z1z+PCGP/yJ3VRf/eqX//nGGz17 1R7OdLjk+txZZ517zjkXQM8a0E1jE+Ig6HGGwEHVizJKkFCx8ZrfCu3VixlYIUEGEyk8kW16wkEs 3VQ2yCKW2DqxwnL4UK7zlGib6iBQr1xZoS6niXrNMdOgsBfqB+UqQfYexFZXxevzgqh+TW/FngdH BlayIRu4ERI2agYL/iUthuSjLwekyNHL5/aDoAVLeT6p+t/f+g5bGxINnpoYEiZYRkpJCFuw5Ul9 MAIP81Hco4kILz1x+gESxVwpWXnooQdxBZbrYJ7cWe0n4uUWoWnLwKxHc/eCi+UONTTNEFtTXv+7 G9h8fI0111i6hBd6SwN2XGUVyxvYrrF45rPrhfIyxScEedMUMhm2e2HwCBu9RiY+LLbqV96j7PVW fVm+o70TMeGoBANRZc0pUn9ovh/9HZAYTiJS4fQMWaCQ5dSR/cutCTREoSNHCmGupKuC/ZTKSEim RPbCVxU4c7MBQiOOelHtn79VkGQZdfy0gBCl2eUIVPih9HD55Vdxggo3sBSf5o0almMRIC/2FwZw HabJUsBt6rpTOadgmSk7a8JmaIgnBHgjl9NgzizwjWcTLnHc2C9NBWLUitoKIlWAUsCRDmDUOo7+ 7vo/zNxkY66IeAEN9sog9SbA6NbZWGqA5YoHJ2twDIIC+2BnJa3XADqvMRTDapPn8HRvdagahfDx dEtG1f4ShoLvLpUTI6gsMjBJNZ85CVGAAa+Q07ccpgT6iaDoUDL0ifW15ieXFJlSMIxREVTr3BaS FBudS/IfnUEOIyfUktKCFxySxzhfF/KPlc1mnwPiB0nZuMzrvYAUKoV5jjDkZpg1wrrmDBNq4Dl2 3FhWAPwqA786UvRqLOHq9debxk24P/7pz6VdNJRzRIe/XOM6OZkcy9EAnEQLGVukr/+uu+9iNwp+ L4Y7NWpikgY5EMUnqYO0gHZ9Rsdu0IqqDGkRwsGrLLRv/NAIZOSkhrT2jAa9EevUNi0Lnuo24dG/ hKGIID5oLQ6q0NJUclqGHRQrPgIqsJjh11kTVlJS0eq41huXWPRyPZwkEjMo+s68dcAosWuiIq1z uDElmjGY+2GNHG1qts/wEfVkWEykNRYy42lYXCR/K1UEMSNShMsQx+jcgIwlC255vvnmm227zdbs rK3+pPJHnhDggjoXJ3jztl2wUnLTuvjArFY5iUmtCoIyMLfJ0pyBxx9/krTd9tsGCTh6ERaJaLLo k0FaqnTG8OnnYisZ7cpf0558iwu+tAqX5nQDPkHUpZxMuQE1F4SMIv2jbZFLP8JKHdqzokClvB4T 6Kcs5hsWQisJTK6raIxAaD5UXniAFvEud56fyggEY1/TTTadEIbrBHXexguCprWUe2M1gCSEtZsk bQaq6KNNOZlMWBXfdKtihO9A1zUYRtB4hbsTLigOYwV6zJtez2+GcMm8zl96LsPnm246i7MPNkx2 2Sgj6UrJzB3WMTxJUgDVNGYx2Zzwct0QL3PMnj1n01mbeLFVAjBkJ07WinwXlRmTc4YvHDmvURdu xZHjat2ClxyuTJ3WIhtrYcC3Pw0QGeoNpGYLl/xGmK0Z8qZqjAtAHYSUQDL6MfQj6oQ2hB4yXkW2 TZcFsN/hFc/Ic/ifKA6oRAHL3NxZgk26tvtrEaBOpFT7mGXJ0lvwqmSmmESHyLSOkiKiSLAzQEkD NmcxvuhVKlknBcGx1VZb8iTARV/9OpcyvV5SABHs0IwfPCnCgx0OPwGpCZnuCGfvwlhuntctDVUm HUNPhWbPeYRHUsaN8/KG0aFNOcqylZOj8WCJzFGTJ00GI4g2fBDF7IY/vEf1sEtBoGRdqqVNUylJ 1go2fDmxKh2qMsLDxrN3A6TohEInafqZ5RHCRCto1Y4ECQmncGs8ZSsPBUQmWYn8FB5kFDTZ1H01 IYJEJfkzuZhJPzBESGjf/uIP9fJOJrbyL1U4imZNWEBlLR7yocl+Om75CiCQYnP2Zz7Jr4B9/evf zlXz0IWTbPr7pk2byi7mrlsDgSEqFVKrYDxzTVClHGnEKmpl0cHLOk5xJ02aND5XYAE44fGVjtzz FiysCy3kbKFfTGJJ4xgEEckUfh2riO9QklWOg0SYy7Ea3xlG5eRGCI14awEpzYqEHkWSmBzUht+v zBclmfQSEKPWa5+9xKDGVYfGwIsWyHQbKXGDZIYBcJQ7i8O2S+Zsb1scTA6ldgd/Pq5Q8fn2SYXi zRetrYaaSC5gUTWvlX1S2jLeIVrVzivdPnBqqLibl3yXLlnKLz0cdtjBrzni9VwiGz9uXPSIwHiR q+888sPP+bBG4YZfiBIfnhP61KV6qIqh38yRhXpEcRUlY00QmcW81TJm9IIGR0c4FX5ZCr4wlquw 5HDbbbe3qdZ6RRpX2ipfSWONwC5FeAo2qKOaDVgVZlzepBPHSD3UFKwerK54L81b4QURnOxkSd23 iqgEVraDpUrqF5hPHDkQW52mirhCtFpIozJejbP2F95QFYH0LTWLo5tjbE8x4fCKbHXCEuxnGCgB 5MyH3JrS28eLFEFAEyHQBHmIe+j777fP2Z/5JD+3w+ZBCQ40KtnFjxKPN48jjMJW6TFRDolS8a3j X081YjUzNYdGi1Tw045LlzIZMYuhBRS0g5NALAE/9BywOKYIGmL3RBBAKR0USPcCOVIU/79SWZCm i06uUoeTLFuPgZH17TFEVdGzatVBkFIzjUJ7JvbYqYG6wDJq2R5NEt/N0RGhGFXuhYo8io/HUBnJ 1OWPyvKG3x1POQ1XFxWIrPxxTbj0+BgH+XS2lFNyLHZ1ZJCFPw6n6NMvA/wKgvcYuH685RabfeMb X/nNNb8959wLes+4q2wUbm3V734WrBt0gSw6pcnSh0eUKtuLCC0JunTlO9lyNsFva6BHF/FNbRiD 7QWCUMG86zNZouoy5dtapQRZi7LMwYwQ/ilHU7JOXhk9Qt3hxBIXJ1271O8sy6kxzFe5OEzBFESo xEzBDVOeDWq2cTDLkJET27rPGRjkOtFPBhS/K4VbRCHAMFW5pCaLr/COydpoBgNVyd4U2hFvYARP BmYQiLkphWdqZGxGbwClQRg8PHHI78Ctu+7Ui7/zf/hNluOP/xD9prVHZBZVs9Q1UP0MdJQKrBBg rbOqIcE2XJAHsJLy0xJR0YL1jhw6LouDXDFSUIY/qav/+TgS90pDUAxlBv/WJTrjo2NAQOMKNSpo yvbtUqIjUYcuSYkQA6jJkqhTorB82tIHyVADrcjHnZRKL5fBIDaZKtFLlUeDGCdf0PKRtJH3sKM9 CFaU14oz4rmvO+TlIsNKBUnU5kYiRbjX/CKtZemTkxWV+tSaFOmDwvjr1XkyzATF8oUj6w8uOPCb j//9zYumTp3y0pcdwSa4zCCwLUIk11jl8Ozj5fy64HIuvXm/W8leTS49yOuWiG5qM3wKbJX0EXFV uij85hl6H0DkRzziDLVs+MNkjC+slLmXRFUlv8sqVbBBlVjdOQqU/eqj6YEWLTv5oKcTNOVgDfuK spVeEJa/RxnYJCRKAWV3UjFplkgXOdgQhDKM40CIIiN6WIBNGz5tGPHlk0zxaBwCFIEkDv+lAjl4 GFjWZfR08G2ja4233jKtqAm9iKWGmdDVIVoBxRuw6EBmoEYcixMSt86/9tUvvmCnHd/wprfzY0pc W9SI+Cqah7XiJCRWeDKDR44JrGZgyZK7CLQ1GZh7ZS99pQSP1FBfa6RqcLLKQ7LMMlRlYYau8jLF dZS4rQ5OAwQqg8Abnl7PrGWmEcZFWV86pGGqA3zhy6MnpsvYrQPocAqAjq44TFQo2LbRe2xxxllJ Ca6BqSHxVVpI9zyuUMJFYHlVHa3qBEQGFSnDueVKcIAayFK5qMRsslKjWjQ0K8cMAOom74asrMiz HPlNvFFVojoIUuDAPtqPPPooP9rIj/i9+a3vvPHPf+MFmdKtU9S7JNCGzjokPvP0M/zqJYvKEoGo gnKXkcpuopSQ4BuhEViNTSOEbX/flClTCDiec+6g5RUtSM+VhpZYysPYFeJlCMc0gRyLK5JyFkq5 nA4kuLS7f7oVkHwRoW4dpVVFVZxClywnvASW54lFBxpS5Vrjj4ETp3t95PnJUCpp1ENt3gg0XyaS wUWyzigAJOwKFUTFoDI44V1ImFbRqpHwRJ2sZyrwoZA5P4rIEjVS3N7c4SQQtaWXITgf6lQoLxS1 QbaqXEPooqWLl3789JP5pcR3vPN4lqU81SE6qcY+h4EM3BhWqggb4gUWtt6ePHlSm3esNDHjsJio fHeUTota0uSWCtDXv8EG68+d9+ySpf5Aloo379nHUNHbk9rgCBg4+dgULrjORrAinb+WPtVo0ZhF Ta06O94phTbea8TyrGUvVHDzA+NIwkifuTAF5DoSM3hcCGu9ohb8UgKKip6g9w5iUBjZ+hKSIgQT S2Ul6KqEkdKiB4hFHfzEVsVZBrPGRb1LDCz6J06a5AsKwkhYWjzCJhLM8Wln2VGlWRdZhh03WVac fPIJ73zHW487/kM///llXrRuQL7COwpkVA8/2igW8LQwv7LLrw5mcVHaa9myJW5+pJ7iRbWoESur XCD1KRQWOjNmTOdnFfmV5ArtzsqQ4z7jQioPBetx1vJhr0NgSMHZD0gCSw1LSRFPLj2w1YZrISoq 1EHGRUSf/DyaqS+ONCIvAnjaRRrkXjC8REJ+kCjyHaWLLqWygWOtFmqOCNcaQaCosUEdKs5kKEcB ldLYjuIOgOke1ptXTf/xGL/c7rJfUq96+Yhod0ITG2XIhz+pEtPpR5ZiB2vMpR94//Ef+cj7PvyR j/Gz8DzJB2F0LVoZWBORaoDjGJBZsQ8O8lg5oM0246Z8m87hCS6+iZLDRNKVf8tkGYEV3QSN4glF 3nO55577IFSYEv1PvjpX0yrqlEZBiSvCH2zRtZNVPTny3JvTzpbaoFEwNVFGLykg5XQ447EHMqP3 aIe4rQNQ5LINrww5y3BmBZH6hDR+aIhhbS3KMVHBipqsBkGgxRVVLiNDwfWRQ7Wl0kkFBHFo2UCs s2X5Vq5jWpsuZd8/aeIkQlfOal+UbVTV0UkIVi1Zq5QGqp6VPBL8zncce/rpJ5173oXf/OZ3eJ7D E6KiSvtJhAE5IhgqPJS77XqD58qeevppfjKcZU28IVzqUsQv88qKfEXa+oURcLxALb8kz1L35lv+ 4UuVUVRFYCBDx2AMD6UsyjS+i7ES6rZIyQq52VrnJldk6V3RqoTb/cQrjQEkMqzAn/ixNKC+ZCkw rZAaZFriChAOYX26it+wzXOpVMoBxeVdzGNNlaM01XF0MNLlc5cZR9o/0sflQmqawga+Td9SE3YC I0GdS5hCLAXCaNz6hGjqGzZmyolyKsKcwQpIApGXb9/0ptedddaZ//VfX/vil/6r9rjFJRCqZIW3 tE0PeRqs5VEWGf4w+8033fqSfffxTEc0ZZFCopiqCoH6tFEQeAGx17iW6oUv3JUf2r3nnnu4zo/k sHEFg7OISyTz2JHDljI8dVKK/zKytluQqoA1AXWHUikkggojlKIyELJuyxAdXsVf1TouVQ3f+o9U YGVX6WAwA9VFCjdR0fC7Gr+FRXvt8j5yLZWCL7EI0dDuT76bThRnkn9hpWznCVaTVRI4Qs2jazfc 8Cd+xUCCjqqsty1yCtdFDy9FDrZfNA7usmVLXvOaV53/+c9+59vfPfdzF/pka4aWIi9drGoWpRkR 0yQlhugxK1ddceXVO+24/axNZrbHxsToiDSgjFA/AysMykfglU9xAru277/fvjfdfPMTj/PD7Boc 5e2AIxg015RSbXQZZtgJCokxXGMKvKjpEln+kdiZJSBxm7MHce1kNJyzEhlkNgZy6Tg5kpl6IGWl qMZJ+qAyaWDs8VJb8Fh0wNwYj86EVKGW0lHbChQZETzygqddxAEmSd1gkdJIg4KpAkx+PNNVNrRg Dp8iz9sMGApDKsCvN0fIM3IccsjB/GT6j3/8809/+rNcqLBVIslW1DRJEmS4iAklz/xRRYoTg+Er 19dcez3353j7gV/arqWTrmj9uwjiBcxuHitlwsnHuFgdr95ii0132nmHy395BbSg0T4lqOjriFgZ 1L/mPA9FRjg6Z9G0lX5DTofvd/Ctqj9hSVq3asVyn7suF0gHNUtu1IjuHpp7bRoZJPEVkHWJgqpO rSg9SQKjVK0j6dphAXFkFC74nZIVnbmiTBV/0a3aEU7xZOGGRKUSNChZpFSTsd2DJlwhpp5VDNKW cVUEEEk8qAE6a459Xvyir170hSuvuua00z/Jz1Pyaw1iJpBlKl8JcVxkNINTK6Q05ou5gB+FufLK 37z1rcfw8+l4FFT0akj56hVad6me5gzC3gVuDYWzjj7qCJ4jueba33KBTuoYxaWOlu9Mw2qACpBp +TiuMxyaH7U1cj2QBSAydVDZhY0/TQyPUBUcDOKBBpSq+xMUYhn4qS4PimWglkXOikHFvGCV9pJQ DFuu5hOUCQLPWXlXdISesmhFmelBONnC1HuOI1CJZuoCi7KUHTImVw1tOonZ1655qILVgYVB0zoW FkurW2K8Wbrrrrt84+v/9de//f2kk05jW8u6UCH32MmXOZNi+NLGZPxOCoIgPmh/0Ve/sdlmsw4/ /JW8GlmVqlN/RSATumk4FT9ouW7jL2EMbbnlFke99vDvfe9/Hnn0sTyH5rTy/zH23oG6VdW59+m9 d06l915FkF5ERCyAooCAxkKu5dpN9CaamGgSTNQkaoy9XKPRJBpjF7DRpNcDHNrhcHrv+7Tv93vG XO/eeP3jW/vd651ljGeUOeZcc60137UQUQ0YwNY541KdxubF2dJMbXS96oYzzSxN9HTOM1Bw6VUo YQmh5AEuNxeQhW7FXmmNVr0OM7Ihec74ER65gKQZi0MKnbbH+BDBrb6SLiok1+YidX7T0QaY1teB 4jqQTE1Zgui56hWsfSv4EQFg++6VwZSuoEbFQhW/UuTxG1/84mf5CfXb3v5ubo5z4l4szV5bJc9K VPOCDXsH0ZV15uVJm7xN7L/+678/8KfvmTVrBvP3Mjodrek4UIcSR/NwyYBVI9zPf+tbrtu0cfOX v/I1FhtLqdjI64RpXQrC67CBthlHLZW6iyU40i9tFqoMjdKGbNFmGptxpAqs57+kmug83wWVJf3C o1l524oITyKjoqkyubMh8h3qeqMFGnKRmAM2VZHRb2yAGkdnc33bOk0JGwialJcx/voDpHZUtk4b xGlkzUJttCgVfDvUVTrFPFNq3333/dIX/2Xp0qXX/fHbVq1cw5oP6gsoX9LZsQIepgCoW3IdODGd U1yZCWiulv7FX36Uc+O/+sife4Clw7Q7eY2r4ytZrZChgnX1l1zysosuetFff+zveGhRbsxK09pG U0NchsUW/ExRs9TIsBR9TeJFt9THEDsXNRaWquVlw0Y+xynZ3KfAQlN1tc9UqhTBpjpWUg2kF1LN sOULY8ayGp5MFdX5NoLT29NZi989/2nSHGWDYARph+2ctFqZLZxqFcr4i8yY2YTF9CZWa3qxCDvE XD7FXuCY9oBDB7JUFeBvF8u46TVn7uyvffXzjFjXvu66pc8uG8pq06jqnn9l1WGy0gq1CCxrg+gx QXALaovCtDRXQZ5++un3v//dzFhvuPGXHLNCKRf/pTBcMgaXRtzZt/Oil1z4kb/8s29/+7vXf/yT PCuAanWONnBJqBc9kU4Lw52fLUS0ahgsMNRwILoU5pVbabwuTdtCngoLHGzcIYOjpED4K3voHKak ccfGdwrBb0a16gj1+R+8X8yHG4U4ZuSIgzpmnNpgjO0RkVChZIIdHF2khKa3ESBXDkxoYlq54gxQ LJJTyCHHasncvOHCV0PhN0JcpxGB+OCOtZZma0Mth2oe3jJt6pe++Fl+pX31NW/kTXKs9VCZ0gFc OewFOsxNRUmRxdcSUhRUr8UpuLawhZl7EDwGghcGfvAD7+MJY7fcfCtn3SimDhqr28MjEscgVL30 0pd/5C//zw03/vqd73ofZzzcsYnBhPtQTgVxCh9YEa9d5bpgkY7icW+kW6nrkikxEUcZ8tnrRXij CB2ywJKPMxkMek7zRERada4m0fraCkVhpCxWosRctuZd0WO4jFKECo36UUw6rddztmMDgyQ/pnVO j8dRSiIBk8m8InIodmKdTUCV5V1+9BqKYhrNplPKaJak2IoCgqh6fGxD/hg/jDuZ/FPQnj1Tpkz6 9Kc/wdLw1179hocefqSG8RIHrYkgQ4lNObcMYDSp44W6RkJrqjJR5/CHtjYDo8htt9zGTeB3/O+3 vPCC85ctW8aPwnk8BGe/MHOlhATrRbhLcfTRh3/4wx9861ve9PVvfOt97/sANInX2NHUig9yjoaA mBrHmNZEVFWyZmenFdFJbexLVYPLCGiqKKEGUnVlwIAe8vpIHd/GFcZThmGlplsjTVL9HFjl+E8J XzgE+p07+nj/3LSRPJ8OmoihBjWdQ9u0KS0265VHDl29GBDl1ElM9XPmmKy0MiupfVNOZs9g3v2L K3iVH+09ZMhwHgeHIk5mWSvqL0S41eLP7OSDuyD4bspE98QH047r/+6jV111OW8qferpxfKywReR pgNASZWpl7r3k0SGJYD+8Ec/4Uo8a4LChQN0A2nchG7YyG/sjjjikA9+4P1nnXU6d+9+8Yub+O0/ S9EYMyZNmsircU8/4wXHHHPUE48/Ac73v/8/ODfx2hNS0hGFErmfbuxGOWqUxdGkXKTm2VSgp28O DK1jAJKA5o7HLoYN3C5pAwtTsG0SJ0z4zpsGXCViIm8IunGeyA1uPYJ3TbjpIzY0ZJLNfvOmDbpV 7VKPJwhC8aoE2n6p4AYgIOIWaEiF76EUndGTjaybaohqCFlFbs/unaYCRJbLll1IWR8uvvgrhCpI 2PiQj2F33HEHU2ZWZ2F6qVmwGadKYOtAKiuK/i2vka32oJC/p59enHFTQToIuviRZmAyiFv4QdsD Dzz8qsuvOvHE41/ykgtPO+2UV172ivptBHeJWWVy5913f/qfP8evsXl+PA8XeY6uLaNww67cqDba jhxb0VOSntUD7G1lpY66Yoa+yhQ1YLoyzhLZOrbymE5pwzn9uW9HXUuVICYqpXiSgJiA0vzgeyNQ zcZPmDp69HgIuz7acfGtzv6bQGY42TPk8iOuFIqPek5DfPwcodXRl64Jjqa2+kBXFM0QSwpeCWqo lJy/9ZNaVZzoYDvSYOAwCLmKuNsCL4YjoF2fX27uptNwSjIAwKO+I633i+ougcMyL6Z0NVA2hm76 HA0GJadC3Fny6ic3k2HwZ+t9APKO3IkTJ44dNxavMJKtXrOGh1Gh+IjhPNcwV0/1WHyN6mUXX/x+ gBNvYXhCQn4DQCZPdnQ8bjbGUpiTLXeJ1bqOBaFMwJf3Igt3pbGxS8nNe3IWoHDOUXAeJcWSqiAW jXu8o8IQDGHlPc+3nMAbgccjvbWKeB112ssDlcN7Z62V1RHVAUAeOOz0td4oLmG2GGFjdx230lUH V6yMoNI3kUSePpHOlCqoqUVMEiKU9R4DY0OmaCmTriMwjMqPBl/zbEVVHCeaUqHnlIQJBKmeIGMC Dbxg2LlR2lIjQpMzgoDZzRv1PJ0GqiiSDiNy1bOGY9yTWVQcQrXkMCRSCZrEK6Wx15ridcwzHiSO IyOoKVFahdidfVSNm4s6XzXMiItaqtpPY5HatEG8KaYeCN2+dXMNUdk742nSkFSOpKArIxEndBpA qpiMSS58ZPCIgQ2Crw5Ce3oossXk8lDIJA2JUm1aN0V3NAO5W1WjcUDpkvm2WgwDQN9WYene9EcW NFanzcwo2Dyb2oZL3sYe8kIKFywc4BhzvBLGM9cZkzpVpaq0gEAVKu2XfCkUxcD2dJl12fUL9Y6w JxUGPAwZCXpUyW9NW8r2s0StnhKKamq0pCDZcgQxFdBoWAJLTuNSKiNRW/inzM4SYbRJG+UOc2En xgJtceqoKIvzLVlIrQcgKkhZgP1VlLFVJPSYLLEwFqW0388F2ygC3eoipcrViCiLrH41qBM3rqM2 4BFEoQ4grO3ksoYo71XBJlXhU+VWidNr7GZZ3Ns5QAI2h+iiVhtLvCJQZa2gyChn5sRRzGxJg16h coUzFbZoEl0p2SpQfJdKZVNLagSm1npTbQPMY1whiJtRASv9iNYDJ0Ve5RIo5VaNEU8qMeCRrW0y 1J/Ibjg2MyDTpUm+Uysb/3ykFrC+iza5yOg4o6K6wCJDiRLYoT5gOc5R2z/GUJW66B3GCMLpTWZP ckE2LVVKZGFD4ZcuRV+iuZWnyqIGxpdVfBI2sY37L54+cH5QRBJ3/NoSei+CaBcZMdizoUMeCtJl uvIiaqVFXYgtnRpE2HT+l7S4La7r3BVFe/XKz0aoMrqaTBOEKkoiP8FSRqoNHwW0ZEslq7T4QKr4 xGmB5x5SwVD6VZUkfnqbSf+JHVu07IpDkqaqc2IoCbu2UewVbko9RpYVQVJAkELY1ahObz5mvXxy dwe7AKU80rtgstWeo3HDllwIUSIvelahe8m6nT3DscdSxoCxo8f01G1OanLl4zSYOY2aaXhBmGDx AOXmhdYNESEn0xvyjTYOalVRvsyMrRLXhj5xeNpUlhaPXX2h7858S3BMKE82ZL7idt2awIOxG82j AfkSSSCU3/uhO80FKUFKCIcLiW1ONhh7g0zjTW+ktNdmuindSQIz+TZdScocjel8aYCuotOQapdc IS8gjaZApRWlK2yYGEP7kIm+KUTjftG87DcnL1T3pHSpsqtphsgo2b4UJgOHiSnTJpMqCwjx53J1 3NYruCMk6dlUV63J1hYK+0JkdTmeIFOMqS01OxOKQRi5cV5e29t06FUmwYGUQcvIoWtlii1qRKIH oa7XwxlFUE6Fy9cILbmdwuELbJR2l4OhrNGtviNBHOmLPPtit7QoAiuFf7mfaodOxqrGE6cYIJUn whMpVS1YSBuxzLWlWC63soOiyLLArQ2B5uqjz0kP5nkb40h42pI+V1zFIkX15hx3qBooMzNhb8qz iDBSQh1ZspWgJt8vPh7FoIpop6d0rpA1ar563T6EVscnHbQO4XxYroYcBvnLnIiBOgw2d6+qlDfS hGZXW5fMQdmKYqWaS88FWtgR2avs2DuUgIbBGLXUQEtnV1OrLbbt1bjHXi4ISmTTaToZDlMtzq2X Jcpl1pZcIQa1ECJDOsVVkRNAUrq8tLDaquSSqLxJt+6IFiJkDfBgeGQ3yBp+sqTVtadtZJUAbmuv XrXGmEYPvS9jPvUtfNT1ppJDRpSwTI6qSUqhIS7JereDEcK/4q29w6Rm+0m9ewEzwwhNEQaux9wb sIQs1C4V+CLUFpWyqTPpb4o53sEW5zTKysfykt1Gphg4QIOoFm74I1qFPTsoAyrdLc6Q0ZVNJUrK QIXUZmjA5RLR0Ma/KrdAHvKt+8TR5d8Q5QjVkxzakAuiRwGKycTH+vXrSJbJwCQMzEWXcJYsk5aX Dipkyu8BjV6olkveWtwMruZkuI3fVRlZkgUysN1BUDE6LLq6S2z2NELJeLaYs69kIjjKR0RPDRNR V2FC57sSZUX/MKQJrppLx3N+JW1p3NjkaygFW2pLGbpOT7TJz1Dl75wlRJjlxIwB5zga6Q+zHFg7 /JA32MBQQEg16YXV7cOmAlHC7wh1Ngc0mFwXJXgFLzV1KltOfARxowbqIiPLBa6SRblw7ZjbE5HS 1kpyh73yIU9Sf2QIEIS0SPlqiVAO5kkTPrG9qqgmnfm4nAFWkUKAhoS61/HGNBz8p6JJUURvq/aV I7XiRFIUycxA0PT/LJYuxozgnoI5R6x3Z0HmNBKc3LYvuFAH25T2+HQm01I678jNHjLmrdYA4izZ VFvm1r7rKOKeglaFTH40kMNHvxnF1RkveHHIlWRAA1tyCTuKijDM6tA2vdRpZ7pXYXkjzlcdl302 K7cJy7cR2w5+HZ5c4PVsCyA+wIcgpLhg05gxCvMcSnUerZW2F42QzDS51KsS6IVu+DGXiiqKZMlM tH9pe42UqtoFAz5zwqW0gzOfqWNKUZrbDlCoWGArpEjHCxEeiZTwZNLMjuWUuka/git2XaG8SKXT ZXJeCsT1kRH7JMq9D50SrhQL7VbD9R5W/Y/KNWmFlNCqjRRLmnWdG+roVCMHHM0Yv3RuIRQW2gUq 3bFAre6JMVF8VVQ68nxtaNKwCs+UCLLGr4D8p6DkFbdQ9H6KSg+y9sV6dJ3xEdUUH4MG84Rdzmu8 SdYsDEGBs0+ppyoV6/KhbQlMw9F4JVjifutED4hFKps6KMJv4Hdx4AX+6FQ9OrQDlEd3tM5AVhDa RYy39td14Ra4F22Rna6Q81QVsL7ZoC6yU8zhCmc5aAv7nE08m1dG6PlJqre7GobEVRXLzHL6iq4q o3RnA5WQoxULJJrNWkHfMkJFeQ9r0SRCS6d426QoMjg/Hzx58qTSzJLc/NOobPXVEVtqKwYxhe6U 2DEknfuUxVO1YeiRaUR0lkvT0GIPa53sqLZmTGbviK2G8TfFTRCl8ifLriWaUl5fsIe3oVHKag7q G3ganBv92hcg1TDTKJUqvkccPjmAlOiSUcMiaciUJi1/6lFxKLFHFUvSNKmkKLQpl0DqbGYUFTYD hZeob+fH7JZGMSRJ4KZybiW1F7itOiK4rSpla+rMNkBhfUM37ZVZqKIIa/JNvqrUP18k8r7tqosh KhFtamcN7nay1ikXvp5BwaYuYGqm3xzGakoke3xnhWTxvvXh0LNxgt9uVR4lIAhP/b6/uFOt8fmX IjiRiiQ//lX8lcj0TQIv4Dm7VuUEmY2l9KhCKk5LxlI3j5GUVzubL5V0Saqdwjo2uKycyYt2pUIG Eo4KhnDIOymKMzosb/IbmeWDB2/atJGxprqKErNpJ1QBJwEgSambiFYgrWAhlVU+Ns4b+YNdvUto V1UE0LSAKYEBUdqeQax3R4woVkXloillip+SfAzIqCY9tpOWOGpEL/lVAPOtAoORATKPRCGF2vmy xAwRei5ySmRAU9Uw5MlI0s8bz1GOCZkBIAYvsZMEiXVCMIhl9Hm5j+Lqemjky+amcjaRQH5SVLpQ 2tMGv1SrNC4p46wECM/tMC+ziGEXtDWkJ3VWogAqFGGrIoIpq9a1vjsfkVxramtMWqhh0bmBG4HB VkRZIA3CbCAZ00ncU8uz51iZYQoepNVF+mB0DokfxBS1t+fK6pJnltDqJcsw7FoMID9WNHolillb aRsqynL4TZzJBUoBSmqtWCFNlh0bbhDQbUAVpBZKwtoJsUqhEixqU95x1PaJING1VKq4YYjP2DG0 rMmeYuyMMCIjXBJbrXIpwLsOBUq3vB1f5JHEwnz7FaRWTlVFbeOSkqQKJVm29pit9ZPwoBS1c0CS SRGxXs5k/TJNw4dJYVUGoY52ixxlZRMgm/kuzXfo+Eb3pK0qGUXe7QWsP0q8H9FtHhQCKCdbAKsk OAVIRdMQCmT1qrTMoTtbANwFKzRliAUo7klc7GlGdfTqFteZoJvVpFvS6u+NjrUBuUqgjoZQVNLT 2eDyaWblhyY2FVBWDy+6fgU6RhAqqfiMUIZhaaq1FWFiSJg4S2W0jmOr/yNHCzWTRc4+LkxirVBy 5qq9ZgQrpY7i/rvVIKI/S4+GL04gUoMHzbNHlTSe0RX95Qpo+zJTFWHpVXlSQ3nycPpHOkKLxvFI /wbHoiSE0tsFpsm9qtKwX1arosD7saFTx0C6z6bAQiggr6iVfCyKLHJJoI4TfUolCEpUjs76QRH6 3q2wa2k3qmYUU3H+64im/l6YiNsSu/1tGvmF0KzudIzV1tgAguUo1xkTyPApiU+/kTBWEdW+ahpb OFnlR0TPoROR+vaTNZHIWhAHJA1mvitjOLIF3RL++VSwlq6ZIUqh44qavZqqXqklhIUB6KpKaBVR VWjZmzHoolXhiBBAE22LiC7DdzdmpwjiJi7f1aYmLW3KJNlJrDrHGMctDenXvfFZiF5aL07AqkxM tmjAs6GJMMu7cUUgZbVBBAC5hwzl2bxgUaHnythw9RvWHfAV1WtfoJm3wFBcSipLCMrIESTyg2Z1 pHd9qeat/ppyx7r1G5BslwhG9FR6a3b5SzA86Rjkmk7KhyvuqENJccuualpF/9a8Jl/ciOlhOhip WpW3tPlsqTHV42uhGfCUy9htJvmvEliSaK0VBEe+jsAmBKY5Xc3ZgtRk9DtQB2B02jZ3ChkkwJE8 HMXoPh/Kun7Q6ssX0kbEDmZcO3llkcOB1z07J9ScJMQuP8gBuhu3w1xwGXnMD2xtDRNcbsn80ZvW tc3SJj3KQdaIBYIQb+j96NdVSVnhiaZswbZSMoDDaWkcgDGWJWtNAYeGDDhsFPoHjd1RcQ2lVFVg gVpbAHi+yjoWA66RBQyGrjsGuxDDA4IyooyAql0ZpbRxixL5pM3eFGT81aeT5cCfYnlDLhkb+hAd bUIZtEAUiZC9sI6MuBHssk+dmrhCpYYfL3EEUV3JFOGVe9Jimc02ePfO3du2MxHhxxAgQBltqi5c iuiVlZzWQhQ78yjaGJOkfbVuWDR+qgTomR1H93NhXC1iCLg7zYGlEyMnBamWDX0Y13POrApKgdS7 EkZHGyoKRMOFkS4Sa9dB8a1mz6kq8aGj3Kqe9WarGXClFLZLiCQTS2DTbB1XZbOPWJ/4Y45Mowy5 aRXt6Z/SriqnDp6B4xephGf2wArWHk75B5hIkSKEEkdOE1cibIuUM/j2Drjl0p5SYaA+4ioDTzZp Gmjkke7I8M8AhF6kNRC4MKCcJ1Jg+xkowYcQlI09H1pMowc7wWEcY19QmwcKJYAi15bC6OPY41DH n4weeklms9lMsiv2ngEM0aQpNLxCy94WqkyJL5Cwk2yqpyqwERToWNEdAnpc/Qk17OJUASWk1RdM Fx9V1Qg6WbXSHVXDqcFEDD5qxP1GegVW36WidtWRG2C/StB4dM4hz/iGqQy08Peok8dXFEOW1olm rZmkxu39giNlwPhhXvbfg02+lWFb/YS/ye5IGegw06NMnv+HjgFvu/4wSUHHZIYqVUJwJPeq1JlM d7QqW3u1PR3LGtjTa60nDW9CrZgiEqz4jqrWv0uilXKV12I72D05lqtZNjXM4GMhW3XhqmNfhEXb qxKrhxefuAtRlq1v3b4NdT0u5OhQyuuU3pZkVGhcvRoS+qgIyCiqKrHS4KMoXrTcmgEo4dVR7XBf V6eESrSFsrCMjwabVOZe/QVtOE7BAFPlbWUlunLRNdNyRm/re0DUMIey3hOm51SJZQVt2iwsLsXl o9KlcWOUsiE3DhzlvK9yVPUSgptNtFWm9qWCx258WLdYK4ZiwwBKREtbGvarEb6BZKQljV7dboBG VA/hITaec6Y25L2kQBUVRnx1DctKdaLfuE5XlrkD0Dv5t5UGmJx0FYSUqo4w9Obc/FJWWLuyfsrQ tPHDUv/i+ZxZFH0Bp7ZRFG6rjTi4msSwx3NNaFOiqDsfR647i1tVlSV4UwNgfXKJtlmvnNC3r46b Mok7tGrhAq59alqSr0rREowlBZjxXD6KnPSpg1sHawGuiWn8NtVALsZQFaCuK/oB7K2IEqpq5C+W 7APTUXeypCwdq6b2NSQFTlYK/fhTRluwYqrng6rNSjVVyiZrDQYoWkUVkaQbUYpbT+q6SdAZiKSS qytPYJUSshdihwtpjfwUGBMyuhn5MTPlFvgZwCUREhtcryok2thquv4OWNMnHABVttNHuNoitg22 ANWRrqsUVux8GoK5NLdEdce180zPbakKY4uHOja5eMJW0S7/s3WqKqRnF4VxhxTVeI5VnfkWWV0Y FXwNqx83BaWzID1fp4jo6OKjJ6HkQGqiTGlKNCdEp4FyWguqBuqVjU0pbnwGuJpGvJqegN35kZ9O xigtzH9Z31SOfQj2fCdFHTDDfY4xhQOrY4MUPcrCk5di9qoGBWQxkRwZSsPjlDM1ESI9xdKmmq8E hUUBbAjSFGBSDbggAI/DqqZJ6gckFVaR9WiY8A4CfagoAZg7utFPWlqOEimDoR38kWnnDxIM3hV7 JEiFDSNwtK22TB0FlSsNYjk7HdWb2EFiWLMmAAT9r7vjScozqSNvAYRUI0l2mSzJFmUExyybvqvx u5GmNzdyv/IMiS7CbVEnj6yGrxOaBK8DjpSKATtjLXmJKfAZwU2BGG6hVSWbvc0e4ZYXTz+91G4p x/VQpgFiKMUoECzmyAXYI080pSHTQKEUJUh8SV67sLTiVKNNv4Y9wCTSygEkm46l6i0hBoz9Esxn hk7CjVbK1hqmilLOA6j47b+c6NR5Q4ZokkSqWqpRUNQaQihyWXOTm0dAlRRdWpDkdbQffKj1kWd7 JrIpL+Wttn0jhSJ+SS2t1GzV3AVbxcFRChxGt9y2Esr5ZUkkya3UIFQp5WBTkEBvoKGziKqwpIBk UCyDWVPqIgqCVC5/sZSUxPkyxablpuorZdE9w58AqlMk3bd4VBS/GAL6baK2UkOy5E3I4PlF+nuH wE/1ubHQOVEuUYpLDtnrX89b6ZbWqnLVI5vhI926RAWk4GQKY1NbAIjKpAY9uKcAAEAASURBVFBb QKXC+GSLN5rVlqVKGmuhTJAUSKtSRsQ0vfLFgFRlqar4sCDTNc2JXLsqvol8W9ym0iYSJU+hoBs8 KlZuIVfDw0DPQC+q5NGrg7Awd5gi0ItjXCRGgoKjW3QJn/k8t1RBqS+BDrohjVbRw1qURY1qGsFq M1XsMSZ01MgVeRZQU4BhSbyV1k1egzI4hGveKt0K0GI3qqojFqDeAz6eGsTTZliQYFGER/lYmD6N VNkbToNKNkVRXtdFXr/yKmSuNAtbg6AEWbRvzV4sVctSvjOvCmnqDPHUFnMeu1O6SF+cScDg8OK7 prjDwlNQItlLOlndKinR0Mcjqpyu+Z4yJG7Zuo0YGc6r1NRAPP3U26JpchZDwnM3tlWENX060h6n x05uEsWXppUjsDZrhTmhzMb9yVWZyeiAx22ZYk7HNdv6boBk6HdZ5STwKB7gKjLNn52AT3JaGLoa /yBAp2r3nq4SeuzORTzrAp35FmiNsQAh1RKdqaxBOJ8fCPTxHr0RvGyV25O7dvfxPNbBg0aNHMES oIH3pssVsLkpwu/qsSznVCkeGcXjmeKGOCaEEUh97wpBjhOKBoVb82OHjxgpIRugEQJCjQr0b+5Z H3booaefduoJxx9/7LFHso5vxarV1BKPvEHnw3/+p2vWrFu5aiVLORmJzzjjBS88/9wHH164c0fe gquFyNHcFvC2bESj0NChE8aN5zEv1Y2kzcds844q4T7zKXO8gT96SgZDWJgG2ZSpCQuxW6Nd7HLc K3R5WJCAW5uNFZdiRnoBhim7VtpfQIoytmjYUMPsVEwzfZKMmvEYLh6U64VDyVOrV72LKaFhWlVp MFoz5kAqfRROvB977FEvf+nFM2dMf+LJpxkFeFvZxS+98PTTX8CDo5etWN4DkQtcUETWB0yh8dNe e83k+X2bNm8GdPSYMQcfeMDe+yxg+Nq0eUviBM3yc37NESHPkFEXQGjEOr6ocG2BVpT1WrGHBzZe cunF733vO84//6zzzj1rv/33wyyuEtBsBPaNN/1q+fLl3Emk89Le++694NRTn8cAs71vB4/zQj8O 1SDRWrguqoNMe7sx0mxWb1sv+ZRakfpOJxXpCjLho3HTYatpreofAqpnK66VNhREpAE0zAZy8ghK J1GDo4j7/kJTnRqW/4Gq6uih6nynjOictVikA5GYJoXsVDaj60sawEOoP2g1CnYPPu7YY/7XH79h 1apVZ515xmsuv5QnGr3+9a898sjD16xZy4PweO4ZDVEtFVQZ8+9zb/gt1nHHHX3O2WceesjBzEl5 RtIJxx0zbeY0hp+TTjp++vSp9Wh96GUp41ivkcExeVXL8YX6WK6B+NFsG7ec7Hrc4nn1N7z/fR/Y snU7ne/tb7/u4IMPmj9v3he/9LUXnPq8Jc88O3HChPe87x0cVlgYzW/SWdn2Z//nfSeceBwP9/vr j338yCMOmz59+ic+8c884e+yy17xt3/3yRXLl+unvKjFuxL4wrZCspPb1uOiNIrZ5L0tSZWrwmiu Jysg4mViSJPLqA6sGok9nJjAqjEldoYHvmGVK3pVskCJXOrZokA/XxVajvIVpnVIUkUvtTGKMKrz hCofZeZd+DbOgRdttWQ3T13O4yEU0HSnln60adOmT33qMzfffNuyFSsuuvACnPHTn/78gQce4uH/ hx9+yNw5sx968GFW3xZfT0PmADzAGeEbNm669dbbZ+01C1G8TIKBhPdSsBQToQcfdMCKFSsHDctT Bcu4tELWGIuHoRhe40eUMm9jcEKrt4GUyP2OnX0cXD76sY98/ON/c9RRR+y/376HHnoIjyd/4MGH jz76qGnTp77r3W/fuH7jx//+k2PGjmaA5eVci59Z8oEPfPiJJ596zatftXTZ8rPPOo1nlZ5//jl0 qS2MGeVlPcSf41z8nEbtkshVeAudVHUlfqeqo2kPtGhZMU3KTKKTRd6Q4K6YT9/uqoJDph+wV9UB FJJ74bKHuoecIqroSLZ1IrWVeVjxcduo4KWKFjkRFvZSDQ2NJDD7VSU43B588OHbb7+TZ3heeMEL eaUESz7uv//Bs88+47Of/eT4CeN/85tbGBX6nacNbkwJmLUwTixc+AgTxBzPBrNeBPgF8+dPnjSF iOENTM57ZIncQumM0jrBMtRHq+xqaIsf2UmQjQQPKF6zet2aNavz5o3BPKjvhhtu4j2PjBe8141X 8H3/v//nppt+xTsPdvHUzL6dRMMb3/C6ww49mMc/3nnHXSwg4sl/Rxx+2M9+fgNz2AbbBFQQ6nHb KXo1wShVelXPbMqErfOFNlTaSOLTswYk8g0pRLyqzKElI1Z/VadMF2Q9rianzRIgK2dS3K+kMM0M cZy6NjwqSDIwcLUDtYgAA6RhipF4Ya5gEbRqFQRKyNp3EyOTJk164xuvffzxJ378k5+xHgAUHtn7 la98nYe7v/CF5/r6kXABWHFAszEgMXVA3VgakYMGbdm+9Y477jzowANPPvkEuDZvcUYCV+fI5jk1 LBPcowO4IexXPdaHrfmBIL3/gQf+9uOf+Ku//ruFjzwKKA9x4yXkBDgnL0wwN23ceOyxR8+bN58p LCPQxS+54IzTX/Cpf/r0XXfxXq1B69dv5H0/r3n1ZZz63HvffTzHMjKxR9frODud4YiylJY67i1q Ob8rnX3MamWmq6osa+mUkU5WZE3S4HpAu+XNN7KntslKVSdXfQLRVUrcpm0itLoglAweTWahJb5K ZvTo0fq+n5KUQybKCl2kLpP21p3YQXdiMWg3j0h87WtfvWnTlk9/9vNEy7hxY6695koWoNx4468e W7TooAMP4LwSh5cOYpKiXcVt6ho0KefozzTgpl/+6qc/+wVNxktRoLT5o0FCouIiKhUX4x8N0x/y IbXV3CJAGwbz0sZt2/rGjB49dsw4nsm2Zctm58Oi7V7PI0g3b/7MZz9/9llnfOUrn5s2dRp1d955 Fx750J//6b777bNx42YM++H//PjAg/a/955716xemwOwzE1GT4Mc6ePKZlv/V8jL6OgV9UtD9PuD TShzR5FxPja1gcgKMflXC4QSpkXeVcmfrXnCdLwRFkWK3ztmRJgihtp5Agr94OEjho8bP8bwMBcm jzXO2S2SLripF7+Zo0ocI05+3olXvOaVhxxy0Kc+8bdv+qNrGLwp/5uP/uXHPvYXJ51w3Le/8x+c 9zIQidVOAoTrbYBzDsHlCeZQ9EFetMUh/vzzzh09euQjjywaMmxAS+uN39vinAkTp48eM6G0rMGO iKOGHuLPerKNGzeO721btniDwYfFjkVcPYyXgwunKkyjpk6Zwg+v169bx2CzdfOWcRPGjxo5csOG DcyieQ3iBRe+8H3vecdb3/bOW269Q5/GLXSj/uBMEzKQRMIfUBYHEEhYwKBFRLNi2yO6Ph/MA3Jx wR/gif/RHD4ecMvCA3R2zGPCaO90gx1kp7RxgSWJmlSGoJNbxCk3AupXEUDrLmXYRDX42VZOTjmW 7ZkwcdKUyZMWPf6Eg1agNdA5Mr98ds7BaFGr3tXSRWW+N46XGyGIZ4Xw8jzmlZwPAr+tb/va1asJ IaalEydNfOKJpzZs2Eh3jeJeRclZYrRPkQpD7ftGhnqCaRjt4X2aHKS4JOGFK6QRIokhdRuwlaZb t2wcPJH4GDvBKtTL+QMOpPkx0pOdGlzwIXNvRKVdObHWvjiOsLT/woB8292uwoyMWQj6wMDod8B+ +73jnW/9zW9++61v/+fOvj4taVslWsvSbLS47kunjIpFh9TWAGjJIS1nKPYwq5HC80PpHckO4GoN lmMX7TSBadGWrVtpD9lUU26yoLflhhZY0j+TTElvRxXpqJc2Lmvrvj+a4xOwMhrhHM5ZGiPyuotg KAmVqobMitgBp30DBlCiD0BYSsGOPn4raxTTOrQojeAj3zlf9TGEFGcjgTL4wFx2gU5Gf6Za26jk Dkw5ocQBUf4MUBQq3sGDKz5mjBk3Hv1r9sTZLUb6poGYYfM3gaqCGAAU5s8rfBy2caLHeJsLg0E8 D1lrOi8QsbG4rI+FUhz4ObEcGByCxT1RDcr4CNdbihglI6sZ7RccAqpVSmMJRQhUeI8rgLAyQUtH H8zbF/jR76bNm5yy6SPtYqMzQObBJYAa1x4ETaVt2NQoYg+95U2rGIhqJMN8mgZbQ20zdXLD5k6v YlBVMfKhQILJNoKbM9Ic4GJymKCuk170R6sYVzpLwz+KJh5IC6Jj7Qr9CJQVY2eavsOg6n4C6F61 SCfvGk2sqjI+eFOa0ZOTcxZY09i7fbMomuDGuDwXG5oK3uunSkt55QZX3n0xNxrBYCqDDaaYzPUA xoNdnDQM2k1XyLDEKFcNa+t6qY6nLlMfAweEf4Yy7ljrb6/HRIQsJvVDXsIVLvJeO/VQE++gOoRV lfioKqKKxkVWjgEYraNCJxR/4Vba0D2+HSyyIAK+H9C4EtrmMXISSXZ9rIXHq9e0pUrDTpn+CzGC 6HDy6D8iQQ6fjqvrwurwAYDFMuWwtWPPDvVEJcY8GGknkR1m2jDbjLUREvCq2wAQac+CuwxQ8fxc UxzJXBBAUHnIsPl4Yj+Gkuiqgrln2PTp06bNnE0nIqZtd2SjaXQ0x792ZmaCP2wEj7ix0wuiHNxE tUNHG/jVS23J14CmxnrT2YZJhbCBKVKuQFsa1GpZPVmbNtZFs+Z2H/fj7IFi/aSClKRDltPCmapg SYfSvCOM3xuuX7ueu0dIIsKaUYrBFS26SDGg0H4CBKmkdPto3xma8WM3gLZtHrTNmUUzzwOKPRIQ NGSr0dGEBwiGKwRBIg3spBIfYYEoExEVoBqd4hpld81NCfzMcdQ8nuAr0WFTVZFiizFAsnhsRV5I olgKFVo+TP8pw0VdtWrZsDVr123fuWfYkGFENcztD2gtcDxNtBDaiALIeE9PIG08pQ9w/NZMWLTY n7ipRTjUVfVs//Q+HY+DJQ4vxzKXzWiK4wBa6x3/ksKtQANBvtIoRWs0StmMMiNagysRECCzqfag PfxInzmsz5WAPweyQEphTNTFTfjFcDoCFQSlhv5LGxdgbw8pBB4FGCZj/u9jomW6lrj0XlypFY4V 5Dmm2N4OanqDjRIAa9P3zROYk4N4Tke1lI2jT46z4muBusQnKiuBdsWIxmABooGMFmbJ4A2FDBrM JW8mxVwXgY1sCgdt2bzBsGBURC2umoodl9iktj0HjTxvGtVzvgArG503LaDeHHE0Ozoph9ZylHF5 FW92UYN0kehguSOKXiocwj+F5LCGgT1zfjKNgrgexrjnXyGoPLqrv9JI624D1w1rO+MlE1odJfN0 P+HLa0/o8SrdVnXo34xJHuYJFKBpMJpKsU1KWabT+LM9Kony2GJ4QJDmoSJVWD10kE/dB6RamktW snGdQ0sg4tqIcPLKLjLvOYAGILsJq80QVDb4/iz9yMSyhFGcC672B72MsXQb46zUU2EaiiaMS82k yJ3CkqOw7AUkq8fTlNJKgOzcZcMp6WEWG6fRythTpJShRz0TFrai5NCWEKK8K8WjOdZQUoqk0to0 loeKwilY9RWzsVdCKaFKRavkKygipbaxVKcpNKwuxtqLLVMoM8yY5WOzd24NDW6KTGvi8YHU8Ivg Ziq5fNVgSTFMQW6adXKrSRppsQdJJfhTUuYZPeQ0sGKQl9BswtKqNqvT41SrvaWS1k6eFPgVMnbp oZXpiiBrGJLpB/OekagO6eSLCApP9gwfh6noxaQxAnj3CQ/mQgm4VEL5AofI7xQnTw9NTdUT+70B E2aO81aGmx1HIg2rvAYHMBSlWJo49e7sytEaOjdZ81UoZnWyRpLGDgpK00ZptslvVeqQ0cg8/xI4 PmmQWWU05uaq38vH7ZDapdmHl5TM3V5Mj9dpZArzERsi6UqA3FEvRcWcca2V0ijY1mNGKQNIGThG HqTwVWrUl9gN3W+Ug3bgZmtaVhYmJOAkW1YL7UZJCtK0DsBmQ6VuUjAuMaFrjrM+ASSn1SoNeTJi lDu40OMQ5Y4kZLwszOgTM6DFNcDmIDRtbeQAKj5Ssm+KsUQJy9hjipeiI6jubneTzSjU8UaeNiah +YK6RUr2KbOwLq9xHS9WeS2VEmB7agDyHF7VCxY6MVmJB4NfkM2fEqUANIpU2964i5tWHIDjNo+P RdNxFrScNlLapWA6Mis8DLbNCw1M2FGDKy7QozyULOgi5h3dIePfr+aNuMK8pXbgzH6qoGI+VdUW Q0eNHMtSAUqYJyJBdZ3lsiX6xKDEIzMluoQJYx1BKI9YBuddO3buv/++V17xqtNOP2Xl8lX8LOxV l13y4oteOG7c+KcXL0Zjj8GlgV9ElHKa8SrpINHakISUhc13qTz4kldc/LKLXzJ37qwHH3zk8MMP fu1rX8NCk6XLVqxbu9ZZQ+FH7zqmAhEglae4IDOryLlD6KuQWD7v3LO5jM1dxvvuf2DKlClvftPr zzrjtCVLnl21anXQgEINVLZZ4iGVp0oThgweMXxEQjaH8+Y7xcckDNnzglOff+WVl3Pv9KGHHubF U9deexVVTy9ewikMp/0OkeFC1eLCnBSZRxx7zXBLE5hp3sN1KHz11VecdvqpG9atX71u3cUXXfiy l7947pw5jzzyGCFuw/XsLzc0KcELrG2RHGIIdWMSmj3cEurj/HTYKc9//qy9Zh55xOEHHrC/b4qP stJAFP7QoxKfxK3lfvAO+lX0Hn/8cb/85W/uvPOec849k/u0vHXry1/5ximnnDRjxnStDbc6wGWD MaQkYkqvWO/pt+XxapFGac4GucHNepZ/+ufPHnrYoQceuO8hhxz879/53p133v3Siy+sQ2RpyL7w Sr1SPmMooNn8ThqJOoUp2J558+aef/7Z//iPnznwwP0PP+xQAvHxx5/40U9+RgiqV88DnQlNhDfl PU5B44EYVD8QRYckKj1t2rQXvei8r371mzwokRfXnXbaqQcdfMCCBQsYrogMTokH6Fy6NR0FVF8D stToSowabMU0FnqcecbpLLP64Q9//NKXXTR37mwuWHzpy/8Xjx1zzJGM39XYQehg4SzkgjfdJEXh ro5vgn/K1Mlvf8cfn3fOWZe/6tL9D9iPnujwQEVUC0LDQwZ6Mhg8B15I3/L6ne/8x8233DZ54qTl K1bcc8/9X/v6v3HnZcP69Zs3baHVifaa8upQ8kZCG9Y6j1reKarTkeXGO9uGDuWtop/57Bc8Uu3e tW7d+m/+23emT5181tlnsRiCMwBHNgAF0o0c4TrsIFjcmsAjSNe8sjBq7nLkW7Toiccee+KOO+4+ /PBDZ82a+dubb7vzrnv4CYKPvmwM0UatvbECbxQUgTAfNWq0ijKPsUbn26Aqz2fP7Nmzli9fybvf 77zzzn333ec73/3Pn//8xsBFMwePplOzmUtXibySTHNAUaNIHOloyxYhg7j3NHfuXr/97a2PPPL4 tm3bOFp89nNf5Iec3GRZunS5NwrhiTo9P6OXrlYDa0u48YY8kJHWqqQZctBBByx+ajH7sWPHPPXU 0328eRSuWNvUhVG3OHNikzdbS/AV+dzjPe/8s2fOmvHTn/yC+7s45bJLX/a97/1g3Yb1qICNjlw9 5jik5YNgVfLZeRfefO1YpLiDNWljrnvT63/wgx+z2ojFUStWrrrrzrtZOccK5zaq2ZWjWXbgmO0w KtGrxhAdgUckUBt0dJjFWx4xMrZIbatDU1Tly6TDGHnMdlevWU1EykVd1EhKQjgZogDw0qr4g7hH mCcLWhnc7KNuuMiWvEbQhMYjPZb0XnLGIgQeBJVLgO4aO27M5a+89Lc337ro8cd9TWm0p9v7uKEO JIoHrBW19ujw+9UfcuYZL3jwoYcX7D2PmKVrOuRBVYOk5NE+09VStLTHAj0Ud0DCtJEVsy9/2cV3 33MvN3tZTfied7+DF1pzG2nUCH4IZLwOZBe1ji+UO5tpW2cAHD0VlcHPid7/vnds3LRx9ep13DG+ 9pqrJowf//gTT06fMY2hK61iBDddRRewekaS2ZWQXtIEg9Owhx9+dL9992FdHCuY7r7nvqcXP3Pm maedcsrJW7ZsXbt2vTMbCT3HUUTYSTVzgsmyLkmcU1mNZ0p0WfHMkmdZLcVS0JNOOuHhhxdyI5db a93TWpsP81XYARAunzQciIqrEqvY1Ioibsw++fRi37579OH8sA+dr3vTG0aMHM5LnKdMnULQRyPp mTkwEhd3sIJvPoaVoFhHGVuNg0NHjxnP4YAB8K677+WWMYdDdR2ob+NUOzaUUq9yRQeKu4444lCM ZrU0y5K5Ese0Y9SY0QsWzH3qqWdYUChTC7wWeoRzC4wOBPxqDLyBfPcxDk0nTfYdxBxLDzpwvyef emrZ0hVnn3PWgvnzeMf9qtWrML65D70LTaxufiNIStlVsryAFdnWrluLWy968YvuuvueX//6t48/ /uQJJxy7997zv/b1b27Y5P28hELxNCRxdEduqZhQAEM9XvHaPN10gCxGVuLsgheeC/JPf/ZzbkUR 0ytXrl65chXzU4HUVkRdpLadrNRUrr+K4c3NoQ4HccB99tll+++333777/u97/03a/OOPPIwZoT7 7LNg5Qqm16uRBTCGQu7coBkdQzCgfyIcXze1Kdf/O/u280LryWPHTWCQxJ28D7yapBcgcY2aa4MO aRcoQ9Z/rIKAIcTzTJba+s69wX2cwmU8Y26PF+xPOWaDAg26cBHT2xBkW19TcYyxm+ZOEOW4AeKw 7gYQv3LaPGI49xRViHM6vMoCCFRLge5sW5xIYYHjbw34fza9EArGztrogh4MUcJbEjYl9dVZgvAH YYK7B008DeQataEZdwGU1vXx2TF8UHk4Arxx0/RS2zbEItFpb6dv9ZNSvMIRfTzrSSBS7lSRXyHt 2MmAhN/xDL+8UvrgwSM98hpqpKvtcLgtr9W4pobtnm96CRn83dOeXd6/xSPDHPDakCNc9weQ5xQt qCNHWdVgeKqcpQZsTIhYqYPl3uDKakrp1CsqghNCDZOxcT3HfhEd6yLJlrMWv3FjE2tHshCXa9ku hyFukLiLX7HAInkBslegsVKXoanrFAhdV1tk1IqjiTghyxUAcMXo2LFjeR+Ul/ZFDzWyE6nRHRVS jnHRuWi4yKGx+a8S5IXQ175Iak67uHFBI5PrgDSADVaWzuzezQ+COmAshy5q0BlicKyAIcEt6pAh jNk1FBHovP6Apsdvhlp6ICTozgFSGZFCAxmEMmuD8AHMlztuMluX2XfoQkreb2zMzrYxS64aVwN0 QJUVNdicodH/CCSGVm5W1Z0BPMHRLiMK/ckgozNhogCia3MSishGgWQOhtRA4ahrZ3ZUdAYUcPko ZAU/lNUJgJETFzhaujkAZ8SmJKNYSrOLeL2hDITwu0AQgd+9izfaOl7v3rN16xYO15y4Y1f12qa8 hiPNwJU/MAOh45vQqJM6Z7Et2tFxXWhi5+KyG8Gh7ukKmuHVLdXPPcsKCdmjYSmsqDifQhzAR/Hc LpaR1G5u7u3GFjbCnjEVbyPCmOIyWZuFqHKnopSVz77bld46RJV27eQi+rhh+f1c2Zy2yeEgTegg lCiJX2hx+K0IeiQMHTrz1AsmHHjU1mcfn3nqi6adcBYq7diwZuZpL5ly/Bm7t20ePWMu5Ts3rhk9 a+9Rk6ft2LCWlkib2dE9/nVoKBBc7wkjzkF4z+5R02cvuPia7WuWj5gwZc65l43b99DNTz08bt4B s8562dh5B25btnjWGRePW7Df9mXPTDvh7G2rn+Xdhc0D1VOZE3E3zk0P2NgaEGui/oxTLph6zKkb F94988yXznjeuZi2ZelTM8++dPqJZ+3csmnExClzzrusb93KUdP2Gj1r/tZliw36IOBAPVbhUi3X DWwCJ2BRfv5Lru5bt4YRae4Lrxi378Fbnlk0ata8OeddPnb+ftuWovxF4xYcvGXpE9NPOmf7qmW7 d7hUDOZ0E9XFFezjIZYLedGMDacZBCNGTjvu9ClHP3/zUwtnnnLBlOPPpFvsWLNy1pkXTz36BVAO HzN+5ukX7enbNmzchLFz99+2fLF2q7ANaJiZ1wb1JeOEzUZJeujo2XuPmref81NmtmG0edLh2ooS zn4bhj25ww1agOx0w8dPHjN7wYhxk+kiIyZPX3nLT6YccfLw0WP5Ze2aO26adNhJwyZMHDlxypDR 40ZNmbH2wdv37HCFLXB0cAIgitXeTp+sJ4oU+WG0nLP32Dn7b1+1BEcAPnzcxGFjJ0w89PhlN/zn yBmzR06aOnrm/GG8MWTm3G0rlmx59qkaZuXln/d5MSaM5OImF5txiYMJ+5ICxbAxE8bO2XvU1Fk7 1q8et99hz3z/S3ud+dKd27eOnjXv2R99E+eiE7VDRo6mZNXvboQFJXWumzB84VDDLllN8HiYk/k9 u0fP3peo2rlhzYQDjlp73y0oNXbWgrELDlp1+8+HjRk3Zta80TPmDB01esSUGfSozU896nt7iD8w 28RFn+jqtCfSkEjaWRHG8WvJ2fuMnDy9D+UXHLT0hu/SORkO6ZBLb/rPaSedzRP6R02bNXT02FFT Zq677xYaCK5CAKbQUNxVWhUTtLdXc3Td0BEjRk6esXXNisiXC9lls5xpqHQ14yIczbERkZ3KDhmK Z5G9c+um4eMn7Vi/asfa1bt39Y3E4HWrt69ZicHr7r1l7T03j5gwadfWzSOnz0lIyOq/ataRK2BE TYp1ehxE91l3/+82L32CH0YMGjq8b/2q7auXjZg6A2o6Zd/qFZCt+PUPtq54dtjo8UNGjhk+bkIC 2UaDhmVXzDA5rYh/c9jSRP6r8wzZuWn96jtuotcOnzB5++rl29as2rF1y5iZ87avWooshop199+2 5q5fjmTY27h+7Jx90bc0LNWRUVDxURlkTbJ+rX/4rs2LHxs8dDh9vW/1MkQMmziVhRv08r5VKyBY etP3GJNoCVw5YpKno7KXE9x3t++jMuNu9aiStGPDutV3/4ZfQQ0bM57w2rF+7e7t2xjntq1d0bdh 3Z5tWzc8du/a+24eOnL07h199J/yjPo1EfG8z5WxORWWP9OsKOvbvuGxBzY/8zgdGTdikaYq2PDn Bk+NFw43FscRRZBhPwEiotXEKUdronjk1FmjZs4bPGTYluXPjJwyc/Re82DZsXbl0HETtq18dtRe 8xlFh49nLXQObVmjVaYiVq2I1SHMukcwMTRCKwo5i6jVzju2jZg2e/Re8/tWLiWqRs2cM3rmvL71 a3ZtWj909PgdWzdNPvyEyUecOFBh5nr8VmvTps1OjFBWITECfrq4WSZJw4cMH+kRZMZsnDh05KjN S54AmVDGM4z5w8ZO3Lr8mbFz9pnx/BfSEp3C5YGglrMA9pSKBnY4cbSizRnNhvHjKE4wto2evQBY joA88mDUrPkjZ81F+Z0b1w6fMKVvw9opR5w0+eiTd3NXzZtt7X0BiWIvWKdhVJ8NkVk+x5kRug/H 2zs3bxwxZfro6bNRftvKJaOmzh49bS8icsfaVfTPHZs20CiTjzt9GGN8btd1JvgtciZ9OBxkfpzh Xt+TzvnbmLEThmkDrUyvtVEkcVixsxAm8BC2FOJTa40Zx73mIWgYEocN2/jo/QzFkw49lj634dH7 aMgJBx6x5s7f7Nq1fdi4Kevuu3XkpGl9a1duWvwY81lgGnuZLCxHpJEEJ0mmDF4IryrW34wZu33t yi1Lnphx4tnMGVffcWPf2tUzTj5355aNa+769fj9Dtv45EM7Vi8fOXXG+ofv3rV5PViYTNNwW4Qf AnlK5YCSja8yn1zcwP2nwcNH0tFHTOIa1mkMJxseuZeDwpSjTl558092bd86ZvbeK377U6Jnx8a1 Gxc9gGMyk8QNepF/XGlAO2lI74dCZ5WAQUNGjab5tz6zaOpxp+O2Vbf9jLCY/ryzeajx6jtvdPLx zKJty59hprJh4b1U0UOiqOqBATp7AMvtDVSKFNMMw4ZvfGLhiPETJx1+Ep7f+MTDo6fOnHDwMevu vXnHpvUca9bc/ZsRXL/YsmnjEw8K59bvfIHFbyLI2soJbhTgsvXgWXvNHzFiDCFJ1DORdlxP6KAA 94uZH3G+xy9cDI9SNDNHjpM1kKAh457HNg4GrEDLKiac7lyaJVS4jLn6buaMuFB0OqU4UTOAWlpa Txg/jguR/PGLj81bNnU9nElObkKimT7zFAk9SdMtOe6wpxjAil6n7jkzoJl4USZoOYI1x9h0tZQw boKSAlTlcLtrR1+hMXdg3g4ZDU4f4gQEnT3ycWauTjoXt+QSCSgagTcwwjOfLLST0hsoAa/5cpRz TKafciGf1eo7d9C5UdtHp9tIzGyG1phmBlDPPFLQ9UYcblvGdbWDTN/as3EIZ+OmLfEX27QI5ZTg /wrc9nuIBEA/CtpiE9ffUVg8zwRTO3jQNq5/cBcKvzCw2QxRFA3kSJBRgN6DB+PlQtRBpGKmdDau RHVZghdBGl/Q0ooJnZiD0oLSycLb2d8wKRN8j7+k2rV76K4hI0eN8OEUVaqsXEH3UlWZgMmEheu/ 1QkxWqhlis5QJ+TuPTylx6B3wC8RKkyyNgphUFUnKCqM+bQSOOIDjHvhZeqj7k48HWALChwdFG/U PUvKm5SeBLQl2Dzf6UmFheEWlXftERaFCUF1QJxXxnIo6ZRsaufKS5mon7pNLtjsLfAOdxnHLpRE ospzJUX/ESLQM8Cb5mjgt1u+rOKwYtqWh5WphXTpUlKBzA+0uLSVUmsUyT6Xb6XY5XPgOz+IaxRr gArbYPaZMDJnpAsOGTJ+/Hik+RNCi2nCIEIluuBsfuPu7NVV5bCC6bsnNvxgtTfK9lgQxGnIWH6Q OnYMVBokhvVJxkwL7LUCWtX5A1nRhgbLwiXLU1DlAnD9F/n8GJrWIy26FFbxqcGylSkxh2vybhE9 ABBbopp0MpNhcNm5k5/CjR0zlkNnCDS5855kUQy97N4xrySXCZaI2hmUpAhuLtTYgd/4RT+nNt4I THEnnIy82uJM007VqkKnuwghxg8FahjfAVarYTwTYnvfriGbiB2PDk2kvVBGo8HTouCHy1RbQVjD YXRxarbzqCOPvPLKVy6Yv2DJs0u+8pVvPPjQQrtzRKld5GN/tGpcfHXQXpg3QLYP8W0ynZJFDAyX OK95zWXcOWPWxNMDvvq1b3LThKFDm2KhlGKRMVn/rdAsWuP5KJFxx2botKAPcGf/zW963ZzZs5cs WfIvn/si96T4uaiQxRNgEAoo4dKYcblGIoAth7ZIVxyqUINSo0aPetUrLz3nnDOJiBtu+NXX/++3 kUhXUJuyX0HJlYYxIsez8OuOMkihHUfo6a1DBh1x6OGvvfoK1gQtXvw0nuFn8V71KSeEA2Z8xcjl 3LaTpU1k9Jgn5KS5tm1ZOK0ibsaOnQALv8aklBjUopzlM8yywesIpPEhhz3f0TpJFfe28syZM//k /e9ifc3YsaPnzp17+BGH3XP3vbyq0oOfh28GNy+FdTABagAiAjhxwkSCjCP3nDkumIC4J5IHRlxy ycWvf91V3BzmoVbHHHMUvZD1QewJKXRM0zRyBmqaiQyFKW+Np4GNxC+bJzQ09sSJE/7qI392yKEH c4ybM2cv1jqxlmXNmjXya19855UPHOIYHn2D5fE3oaDz6kICpui3iKDKjZt/17359WPGjEb/o48+ EpZbbv0dltLdC136kEZDrnA4i0oBSkd6GiZgsSL4Zc+smTPe9953HHXU4aNGjWRZ0GGHHXr3ffcv W7qcQ6VXgwrRA5FPFPJWsya5AeyG/wiPurNmkDpFBR6f9u3YPnT+gn24esRyL7Qpl9GGXqXxgJ7A 8FgjdSC7doWakpIzaDArVbk5ft55ZxO2W7duIztp4oRjjj6Sm67LV65cv9a320Or56IWuFG8HxM9 4eP2IwluYvnCIS3wU2dPr7v2ylkzZzKQQsPk7uCDDjru2KMZUXkEDauk4JK+uRQhbgmbstYQsjSA 6pH+RBZfoPAxRx91ySUv5QYKd563bN3CIfLEE47nGTgssVm5ilugNLwezOGgokxxZYthkYBQROxT drZUMSoPvebqV8+ePZuVHy7p3bX7oIP2P/bYY3jawmOLHqdr4UncC28AUZLN+W8Ho22R6q4shYFa GAjuQw875OUvfwnHL37dz2fChPE8ZePAA/dbtWotN7fRAUr4uJHJT+fRoZpNWQGJGf7M35lpPCK1 tUP46e/Qt771LTNnznrqyad47FBnsreq0c5TgyirdmJFT4HVvCsBmiPLEazGo+fxvJsHHnxo8eJn H1+06IgjjuBe8/z582677U7uccsDjrw4o1MukDHaBd8QMIDwW5XmhzQk0yOegcESThz445/csHbt 2ttvv2Pq1KmHHXbIySef+OyzS3lUASOn8DgsupWK+jmHFRMkqe0pT3zIwlN1dtDhrrvuj1iQ8NDD Cx944EGGLh7A8vyTTzr4kANZNsVjcJi8BxDm52xli1czM9ZSV67vfSOUq7c8+OSMM05jWvCTn97A 4y3uueeesePGHXvMUccfd+yqVSvuf2Bh/QYf5QoQdsY/eI2XfpmVaiT0ZLoNTX/IoYcwrE6fNpX1 b7ff/rtVq9eyxOSE4489+OCD99tvwW9vuW1b/STdG93D+RGUPbAUdYSgUeMvvhOeqep5kGXb27my NWzvBfM51kJQrcIe39FpVJQg8bRNbl0c6NpLbAz503gW9B526CGUP7NkyeWXX3b0UYfziCk8whSB VRqTp072INV4C0VX9qdSRUlKHatAdiTnVs6OnWeffTorn7mnSijMmT3rdddeNYanNYwZxXI6aHgS Gj3bLezqZvv4j850LwXpcb2dirZP7S6ukbzznW/hsEg/fvTRRa++/NLjjjsGP0b5LfPnzZ0xfQYg glYDBWWALGFKuDSmlKcMTi537Tz1lOdfc80VXPRjLcbUqZOvvfaKkaNGMefjSQKQEZpyDYgCdbVE gwqmMpbV1qqVwFLnN77hGqZ9jHw8JfAVr3jZ808+kQZlJGAo5Ii/18yZuaYAlHcGmMMNlJW0h5YK kwA36YjKcOL5xZ5ly5dxWLI9yGA/Izxnp65dBFY9Sv/ycNOyH2cQi7s4rDLKbtiwieMLzt26dSuP JmMsQVciehNLDHVaPo4d2cj1NiX9nnpSsyHUc4qc27AQixWyGzdu5KLM977/Q5yCaU8//YxNxGKQ Gh4KM4BiAqLgGNITlwStThdkyMXLpAhlXMlaYh4NuOiJJxmiiEjSbOUZQQpQD3XaOsKXQVViHfBV j0b0E3xCGzy7dCnPbcvTuQb94Ac/4tITRqE8xOrfHU3CLDsixNX/sSJCSbYwV0ApP4GTUppvW98O F7quWLlkybJbb7mdW1I8fGX12rX29IzXDPObHcVLT/doXkcJ4r838JaJzXGe1wweft/9Czes36BE 9fH2IP2TSfl27xdTYDk+sgG6Tf1z3KWFeGAQnW/+gvlPP72YUpZ4HXDAAQ89tJAlTDwh7/Nf/Ooj jzwWezU4R/HYDLR4Wt++lVQRqf8dQvc4g1u+fAUH7/HjxrF++Pjjjpk7dw7HWR7mMXXaVNa6/vu/ /8d2fl1SypUNYIoabOfazKVatfj14TvHOCYf27ZtPfCgA55+ajFD8dFHH8Ei/jt+dxcH9RXLV3z6 M59/9NHHmNlBXfZ6EEA3bY8v1FPjSkRk4oMWjpCuXLmSn00QJcymjzn2KOaP8LKOc+bMGb/61c3f +Oa3iXJ1FSEqpZeiG47ytIhNTytOwVAmJe2eQUwJtm3bvvfe81auWLNxwwbmNIQICi9YMJ9Vul/+ 6jcWPrSQa5XOn1woT4S0+5TCsinTf+IzWdVoZSY4+G4fPHbc1HHjJ3KrgkMF1D6LYfBQjmfM1Fgj w49uCqLbVxPqLMKSGTgJOh+imRZhws6+He9579v5tfcn/vEzjOk8Vwj/091ZU+ZBOsHnNdq2tfkv gYw+0VL12NAOp4jvtchdHDvHjxu7dcu2eQvm/tM/Xv/u93yAxa3IRUOaJycs1VywRsOafua6hfMD oCPUlghF2ynKbjR5MqdOu4mUd7/r7Tyd521vfw8z361btvDsLJ8uFxpwMFPV0mABBDh326M1Blbz 0R4OztEI1zDdZsLLT8PnzZvzD3//Nx/8s7+gw0CzfgNzcNujdUF1KfPF1HB1BsWhHPU8DDBccTir HkWGTrtr19jx4zgSE8RXXXn5AQfs/553/yn3hnlkGY8BqzvzjOI5PjCtHM5DiMoJIgtUDrEhom8K tdH22rx5vdGVqQbE/EpFVeGgPXCp/QBldLhbOmHsAaxK/EZJeuhQHqcHM23FUMTgnychObBxqBIA dZjQcNEs5y3w6Y0eMmoCTzAgkeJsBo1phxC8TChwmX/ihPHf+vZ/3HP3fdDTHExLowtk4klfuygo Pjr1ux/ajgy7pDWPBwCHjO5Fq1//8U8RKHQP/IJn5ZGqpl9hUD10JbBEK5DANUPjKwqspm2ZwDFg wMINpv/54Y9uufn2UaOZ7amiY6QoClBE9DWV/2QFw49etYCuWgRWVDDnqeaWTZvJjfRm0zau3Gzy LHAbjUKn1HvcIPGKLTdLuHmVxcWqDIAygOiObBGgJsaKfySBnzhnXw7uXsBPOVyATZ48mfgnAuvs C1aDt5jls3MLn4RB1VzNL0FGLV+2nCXENZ3VOMmrIXPCjGYWYHNx6SNCNUNo/VAxmhl1TSIJNrSC kWea3X33fTjCPhVoGInwNjyom/Ba5wktetGuAulPNzJlOhqHMD4yVPgZ3IgRrBl+eOFCZwyO84GK vSSFkiNiPeFvB1wSZWPRs0f1nPopz80nJnrVhOeYc2bE5IwzMqBBam5UTgpKlizoWz7REdzOzlRB MPm0wH6rZ0xCohuIcn6fRzRQ5gkdkNqFMrX6NZ0wLQUL+GGOc/qvcFndzNzNBfHtQ0cMGzE8xycG D7fEB4+85RoDj+gm6GBAp7JEeTawS1SI+2KwJTz3UXOOBWtWr+mExICIoyTgBLSFaXEDhQSGMcMS AIOdFOsD9MioZqG4BqLLnumILnOx+wpILRfF2Yjj0iGtB3kq0zOVFukBNlqs9lhQovg2FMhhLGcB RFsEKpePakurSjZG2P32tLa6voO+RG0rb5CNQFm1kTxTBLocCqNSDlWI1bjwSiy2SoXXMLMTspFn pwR0aPGI9yCQK7YwmO1avXqNlSWR26H6tADVmhz0EagYa7OpZ2I/6vakI401530uWiwBUUJSuHgq IxuJNLvaRXM6SjR2aMXBjrE0uMloXmTYH0lyZQPGUTQ9oBSuvQ0HJ89fZK/1GUg1RR+x5VsRbpYB NGQo10/50qpQ4UQXapuhJPbLWgCmaLsSrYCYF8rKSAA4xehHD/HCZZMeBHfBKl1wQMmJwvEY9U2T HgOJyEpVABJWhpTtR2/wPpyuTlx5GPoDmwFgMYQ6r4ThHLuXMNiqV+N9/TOEW9f09OY0faGuxo2t LwMCA1jXJjFcK+j/Bkqr0dqUV0GGeaoaVqNykQ7hkUWH4WNXaiReQcWnVQGHDShjQ6R9lVHVtEw1 bfL9VDaFj6NpbQ9gAWgJk7Po6/0qkRuUkzWqeaT/li2KLJc5YnGVhcOtfqyPHB2gakQfyqwlXLxO 6BRPo61Gwcx0TFqQQitaIl8dfa2KVRGv5lmlJcGWhY0yi2Wg0hJ81d0XbdWwF4U0jdyUB60UpTS/ sqzq5CVAQ9UNADnd2ygqYSAm4rkcGp3D5EMUOO1ojWh9urR1zSvxHAwdTxlFdY1gyiur5BjkD9Kd mpX62TfE3IsKWKCtCicJfaGDdbt/bSNnbKWkChP0NCst3uzrEduxRKqIhqcfSMfgAxYlbN1acFQq Et/v3lkDXbU4e0LMunAbOcFpHrQiykZz6BQTI1LjLsxSmUiVAJJmWO4RpPlDbarjSkqPOuZVIRGp SmgAmkC1t4M0XUxAzF+1CLnkY7YcMrJnOPBskdOZ6rFihTXXMZ11k4eSvyClID+PD3pA+3f2RTkY uUVJpisJSFYgU17mSCoVd0C4wl6/lQq/pR4dE9750koLctBkL1lpFb06rqDpF7U2E8qqTYxSEQNT hDMG8TYcHjNRyoqf5iHbMBTO0QqwwEEQTNwVZYQxkYyyKm2vjISmRlTFZvXqVyOllvCfratShFuJ KPzKkg6IdYKltEOI0GLNuI/3YhdMbFFNyDpkk49DldXJiyaBbQpYIGGXfY7yrqnYYeCkdwWnDS/4 kMNwjbEUFYG6etBpoxG1KtKorIyCA8azlLFDIU6EiNFqEvaqkyM09tk3tY3/ziGdP6Czj8sga8+I 8OibcClmQFWXjYwguisRji/RhxJh255O5KyZrSIUVj+ZHSucjQK/Cibf9qpskVGoz1EDWqoEkqJX FQgXloKs3HCWLvjc+cqATW4F82+pOqMPifgy+nZ6dUIkllSxNeMvvKaLlYIFM5085NDI1e1NCVib ZjquZti2yMm+/aqq9RCp4vfbP4hxq8mSZthajnkWVF9CRXC49Hv//Q9xsY31PsWcvq/Aeryt9JqC syBHHILjCM9UWWObHytrL7KqWencnp2qNqVQR6RKllWlAsKsrZMtAxeJZVLbx2e2jX53bKSF+nb2 wcA5bo8yOjstiKUW67CoQhdV0eBQTFXpFxpRuVHim+HgjU0h0EgNzJZ0FMiyQqCdJ6FmO8LJ2M3H mqZlJK3vAEEmPa1JVEApojL0SUV1W4m0gFJA2WEGHP7zl9IQ96cKD2P1fCyVnQ6fWaq8YZbXhOtC s2FBUyS9WdEp9yReHMMneCjBuyA2b+YaS8yWL85WkR5b5opV4KU9LhLDjkyGHQzhTWkcJsB1Mpgm UEY0yk7h/qFh/xbBVOhD/qJuKLhFxxFXNC75b+/jyIefiUJDnKeVD2lPSNa8MBpVggcwnR7+GKkp VGmF32rGggGukKJd2mYwl+AYYTm64lAokMsFRIbsUtPgKGT33mr2DNAuUq7hS6em55hkOoXrmMyV fzRhzy4WdGYC4ZCCSYQ4sgQWu8xWw6ThMAyoSldMNRnlqTxO5tfIVKM8JVze4wxpxPCheIwsagOO CBzCLWik6BkRCyAgIrO1r1Q0iczqaNmh8+fv/aY3v+HFL34ht6JWr1pLb+DCQ1SlV2o5rHLzH7VU r9o8KiOdi8e8A2vv/fZ+4L4HeQTP29765osvvnD+3LkPPvTQzOnTr7rqNaecfOLTzyzhvprXuKJJ gSQJsvbHBzaaB8CUYRilmMWt9v/9tj/mtjUXpK9+7auvuurVPM1mGTcVly9/yUUXvvxlF40fP3bR 409qebU6l2e4hpF5qTonsMoCQ6q6UDXG4EHcDb7qylfz2rxHH1u0YsUKXsr0wQ++98UXXrBx06aF Dz/Cu/SuuOJV06ZOefCBh3IIlw0NM7BR4GCQ+NDp8ZKFNIiFu3cffPAB737n2y644Dzuttx77/08 4/utb7vu4pe8+Pjjj3n4oYWwXH3V5WeffSY30p5duoy2RElQwMEh+Sq3FLCC6MIKtQV4H9So17z6 UpaNPf95JyxZuoxbieeec/pb/tebeLMKEfnoY49xO+aqK1/FzflHHn2MiCzUkmALAzFACL5DDNGM fQyynCofedThJ5147JBXvPzi9evXPfjgwhOPP3bCpPFOV7CeC1Bhr31MNx+/eBiOymR9L8Ib3nDN gQcecOB++/LyqDf+0et4odWHP/TRufPnnnrq88846/R77rr76cXP8Iox2syOmJmDugJRH7/Jtryp OuP3+syO00875aUvvYiw400GZ55xKmsm/vpj13/nu//1R6+/et7cOSy0+ey/fAFH8BYiQdTRjVk+ 9mtz25oFxhx+iWv4zTvLgniX25984EO33fY7PMv103e9823f/Oa/X//xT77pDdfus+/ePA7qH/7h n1hoMnPm9ExBcF/0Cx6BoqoeBHuiOe9tzmHgeeWlr2Ap5Ef+6m+f97wTec3gsccdvWnjpve//4M8 7uGKK1+5L8sqRo761re+ez6v1VKxqFXqmQRTAWkP1aZlbDzVZ83XkEMOOfCQgw/62Ec/fvvv7rj2 6it4S8Tzn/+8L3zhK5/71y+9+MXnc5eRBv3v//4RZ6K8HoRupnP0Maj+kMDO1LxCSerqOwPOlCmT XnDqKXTIIQ8//Mg+C/Y+4YRjeJBy37Y+SO0CbcxsKkdxKoTXufnmCxlsX/ziV//tW9/hrcHcEOfO wm233fHIosceuP/B55104uOLHj/hpBNYGsLdUeVqonHaQQhUblBk+o+Kp2nZcxHm0cce/9CH/pJ1 VgyP++6zN4uPFi164pe/+g09koc/cX/4mtdewROttmzeEvUCbBwro1o0+v6eTGtpP2A/9OGPrnCN 2Bruhe6z9wJmXTfe9Guugj/51NMH7L8/N9Le+MZrWa+EcxwY8ktqJxzZbNQ4QXRNqWJla8KgPcTu j370E1Z+cE2dkht+cdO//utXWE7A4xKeXbLsmWeXjp8wgXWTPCVLTh2RJuqHKmeLSxQqTjcph2tH jzy66GN/+w+A8LIODmQM/9df/6nFi5/h1R+rKVq/4enFiy+66EXcaOS+ei4KK0NBbKpXmQLstbhz ZCSsXrP2q1/7xi9+cdOwG268ad2GTfzkhFVYvHPKUTQnkNVM4oGAcR0yPooE8o6ivCkT97EgFC6G OB6B8sY3vo6FWOeec+badRvuvvte1lLgrVUrVjkyaptgTEycZ6hJQ1NNKvGC9/Dq2KDkpUuXUYR5 I0cMu+lXv/3T97/r2quv5PYQTw5iudyXv/y1uXPnLlmylE4WhKjW9DPg8GnQ9EjnnZII+BAGdoYo BifufH74Lz7KK2w4rIDDWcm6detYzvOlL32dhXqsS+KI7pisX71EpjdcpF1r9LWq4ZejtAVLBi1d thQpr7v2Cm7r/O6OO9Dl4IPnX/fmP5o1a9bH/ub6VavW/POnP8etfxqVy03qpwM6NTOeMEQ5+UsN ouMgsrzWYAgvZkITxgki7Etf/Lo/HBq249LLXnbOWWfc98BD3OX40Y9+dtc9921cv2Hjho3cpAs+ AHY/m6G8pKotbUHK8QBuWbViNXd96bNDHnhg4R133GVw6GMO+Tz6s83IAlKMxm6ywtMeaKmmPjcn t8o8fx78+S985c677qLm1lt/t/TZJQQT0wSelcPtNZkJM75Q0u8aMByEiAn2XagUsKISGcYraa7H PPbY4393/SfHjOHdR4+wvoSH3zGo8My0KFw9IugKyu8YUA5pSvJ/gBssZ2M8mzFjxvvf/046+n33 PcBqBB5b5Tix24dGrl+/HiBmNgwt3ZwsupUbAKzBAztq6KvgKGiF0Z5DOXzzKKLrr/8k9hFwTz75 1Nvf/t6P//2n3viG148eNZJ73SyX916aXomujT1f2JTGVFTqbYKeUUOGsNqeBWnf/Y/v33bHXaxJ 4/cTX/j8l9983f8eOXI4b6LlDONZpn08AskH0aCOELqi84VJD1uY62RcIfbXXCPetWfEqJHchlMi k5HhI3k4lee60vTvxQpwuKtSEabQk2/bFQdxF58HcgweTEfkWTk8/4+ZwR133stwzX01GcIScPk7 ISQaVFWV5HigkqW1d1Y5ZPJuvcsufemPf/ILfrnOiL34mWdoGK5BBDDW91CimODCNylkzLVSvcAK 4X/4+489vuiJVStXs5qaYwqizz3nrBNPPG7evLncKObgTVy2EahjTgtVJmgNN7JUvVWhENNnpres Ftv/gH2ZnF78kguve/Mbpk6dsmDefG7Uca7HaTnLDdvgrxkBaQimOQFURpUI3MkdPJhl63/yJ+9Y t24Di6h5DySPXfzgn7z76GOOmjFz+qT0qYoyAABAAElEQVQJEzdsYpUdvnH5RuzmuG4gA4CY8nBi r5I5tHfoTD9HjR196SUXc1rAz7vH+xO6TOwrWvsVgqG51IS4CjFtwv4hLmqwcn/b1u0PP/ro2jVr eanieeececutt//8FzfmzE2T6JSwVKhFSgPJOEQxTZCfKPYu7eFdQlcO2ZlqLFz42FNPPTlr1l6X XfYyVqH+0z9/nrcG23Ju0JR6yXUlvYwo2aok1MxOdvFkyyOOOBx9OKFgzL/llttYE3n55Zfw/DEm evx+x2VTDS0CKq1a3aY3PBo21/WquJs/fNiZZ5yGaKZNSOHOMN3mpBOP43SG9cmf+cy/cjue2+AA 4ASaiibgr5zTtZSCbGZ8TZxEbNpTY+bPm8NPJSg9+qgjWM8FOH3mkle8lAft8eOMn/3sBvnY4hq4 SNUv8U2DWwd396qQMpzeYmfixPHMGfgd0+BJk2eNHTeR8ZP+VFPxznS/jTgvwwkob40WntljEfcU vNzE+hNOrV1QOYJn7jh3QzPGZNZNJexkJIozZ84ZuXELFLumld/NxSasVGZLkGP6DRqlBByvScwi KKR4TP3/uZWzQMDKBGsJGcRSIKoAoakY57mQQJejyRlyK/qpUo+EOA76f8R5y7dgn1tl5+HA5+lM nMd0GAIuKYwZNZqfUFDrkzldTeHiBLTynGSQr8bS+P6NLmAjwIgipKkvfZj94PO0kN2PcZrLMShD ULD6cmSe+RMYO5ERyMVQH3cZAR65BoxM0iFURWuDfseuHb7fo+VRSq0aBSaZy8m9gZsgIVBoM4co hnQfiSQN7YgPKKP9ZPZA7Y1HJ1xxjPiFJahFsFhIzJriy1NeSzrxkkOmQnwgqed3+aSKkSNdnM2g TymuDGGjaumwdkj9VZ2EiIwWwNNm/kiOMjckDmK5sjx7fJiAF4JLldK3SKIRQoq+hKIqweVFqiCn SmoaydZmyzSZEo5W6I9zkIm4VNHG2ogbuBCL9+x6DTdSYkQEislH63yI2dChI9tymahMlPiINpzf BUfpihAv2oAPUrkcjDacd4IKt3IKGDJoxJDhO4YPp+uAQrjQNQAwNrOpRrRBI1u1lSMov2NOl3Ng VKJWapJkXlRz/XvH4LcCiBwhTShFQLMpY+ggEUJKu6rQSsOGjBAgyqGYKA1OV+nwGCoATQS1Sroq WaJmyYqnFQo9u/Q/+3cZQwlHH03L1iMTvV9AUjYzZK71oirdCh9SpcJMy/AG4B2XLAwSlCkrjJ1E CpoyhatkUqiblqxCOXSwpJQgVG+3jcLk0zaaUlIDFHaHKRWjRMsGEOgli9hUIt9JqigFJc6EQqTK HyEDYmvNKMXw5LPUPOREUKGhIHk+5SPbWz+IawX+wRdJFz0FqXLfn0iZvisiaLKV3uWDsgsFHJA7 kyJZ0sZR7OEdWKUZ3WbfZQMmXOrGAGARzeEvjoGvKkCjecZlarWitrQuSfIkOSE0bW0zSZP52FoW skFmdIsCbbOrqqzuZ1WAJO5D2rzX+FKlFKsd0Bt1FYSvK2pSYkIFBiOBg0FJh6xfDRVViUgRxSpb 0V3VkI5wC6MxJAYw2cLx2zGDzbGin15NQyxCQoyCgEllJ3MqbVLuTkryYFKY2zfRAhiBG1Gncgbq yIyjIWgg0rq17+qalemqqM1Rt4lmbCgXdUco1+hmwhFhcHXGmgcw2fSKJgYLUhYLy8zSQP/CJFfM JIlzOzhowuhgDUlzUBIOFAMwoXRk4KtYmgwd1cWrgrzJ0t3iSqAoKVydUgXR+Zyc/g9sR1cZ96VP M63hsLicWV86o0HKye8QBlb+Xd2VIYIhnZ9NRHmHSvoZnsoNobSzNcxTjDPmR6BmhY/HAccNFdNR KMPYpxhLaOu8NcwLkVpM3t5qX/CekzbhQAOOirjJBVjApKNze8Ak/xBm9ie+xHL5NJTWPcQRScMx zjRVelV261qaF3E5sUZDiqDpcVX/UT3+0x/wT+xRVuTTQiRlQTvekCatPajdoICOH5FD6SUGb+06 0xQOaInh0u94tDRi8FIWDoqZWWNHyjEVXFSAzJd+umoQ1lJGHM8w0D2/Ue28EQ+paaJFAXWqpcYq z96dXnWfcQLx5RVdwSP8ZkyfNn3GXkXIPq0hkt7IzFl3B8aBP+MwbFzYiAgF09x61oStrD580VI+ NtlL/WRBYjKIazKke7JAFZ1YRBpZgSoMDiSk5dediobEbwgh81SIST5CZJGHTaIkglDeb/lQUZu2 94BiN1PFqDmQ3SDXQmcetcUB8KJqFFAIBOUPSch3+GbRjgBXVcmQwxVeiPkpV1eS1pVSi5HmF4ms bkcIbMUOiQorVgEu6c25mxL9QUZ7g6cyACuQNEG5l8JOk3hN/2gGhahm/EoR5QNIm0VDp4i0UM+o lSuWDmPR87btMKgHzNkpMI8cApAX3HlxM3Axurj/P7reA9CP6rzT1pVQ76iARBHqdEwxvXeMwZjm GtsY44YT50tiO1knX/qmbLypGztex4n3s5O4l9gYDKYYUyw6kqgCBBIgJKHehaR9nt975n+vvPvN /96ZU95+3lPmzJkz6WZiB5RkP1NJl25NZ3Y8HjmCJSQsP9ZBM1XDZ4R0Xety5OoktG6biJPFHspC lXFGhD9SwSoPb7j6u2nq6dHDBZhdlVM/Kqf0Qrh4IZfmKDqeYkFQZSFo6QBFwCwCArvlaIYpROJA XZEV06oMopVCTIbLO1+s5S7PXizeBAQsCqiKE50AoPaQjG0wGpSpk/mOsMXOjHPqlupzpwIH7pal ULZTQDVAeCVTgQpHMKI+ZKYpj4KgBI4LxQo8OGJ5hCD2I4PJmD1sfudAKkff5k3r3ahJDwg7WUIZ Ga3ZUuKJUHwY8nqfa1xCFsBUacCo8eSxz5Xioq0tH9mDBw0fOoz9DFiUoLSxVKygJcj3sFQSThzy 6GNPYuH5jLLdQ9uouKUuwM0WVmLJWrTRHFxFpLlKAYk+gH4gBQiQWZacVg1SnKbVqiDGGkrDn+1f VIYeh2BGFaUEIBpeJIKiYGRZqp22osFC/xCVC2fA9nE/J4zPfEwcFMqgJyptc9K9ZDkBWEbBjhVg LdGEDdCu2wFFJU1KWWMz2vXqtoq+GvdSkCGKWCn9gk6eqyNPa78laYfgUxPpe+KAb0rJANwVFxMq DI5gkkQtSJN6WCYnjVSvyWKHxaHBDN0mTFiYEIKIlqNL6Bs2YqizRGbCz5tDw/yENJQsr+QbKcam NlaUuLiB49LAKmFAjvmiW7YF1pCSEXRC5kdfSQLWFCdbiCKXkLGkScswkuMBHIVoWiqDebFkEdDE hBA+6WFSoQBGOwhWNjYwlSNEg1hBMjpUMgHQXBqPs2OqOCdEZFVnrxVtNEm2ey3ocDBfwyNEDiU1 niOUioRGEiZw8RBkKWYk9Ty42iHqJV4XnntWr1rDshQFacitMGBsqPh7KT6eWZtsZ6ywsYGoHiC0 o1HTYkAk0TMy4vuhlMRkQcZIKBEq6CSgZT9YQYTUAEUbQtO68Qo9IaXZEYxNJJgSMS8e3ghioEZD 4mSBVwmKHMkxGG2DPVfXGWmfAKGT9dMxil0MTCUS85UsOSsKXINRbFu59FQWN0Dggz1QQttDJ/ac CO6qJFEVBCPyJgTrYlZnpeWnPNJESYYSlkMOaoZZZrQuR5Y2iqWaXWfmH1UHAlG84EmJK0YlcaIE Z3oWhr3Oo+vwdMpardJT/DVI0kLhImJw1Tf6e+JBYZSXbh0lsIIbjzLe9YSreRW0GL3vzZPM2DLm tE8VxqLPgpJc9c4QTJ4kCJT1TCHoKI9LIpJ2q3B1SZqMCGPDiqdZQq1YWTvw8w48EqgsRnVVZdhw AjIH5Do98LVu+8nYG4NDnO67mKTuaC5JkdZEjnyQ4DaIPO4naLwl3toeWGFLS01OIWdMzY2boUwO 6Snf3aNHjcSdKcISTuJkMkBBeT87GiKcmvglulBFJR7FZh7jeFpMijbzrhYjanyiANCnjBoxAglw Dz470pGStMwQJadQVDIFVMQ6vA4dto8TlIIGG4yCiHxVPIXecMx3fMOVpXg8MY9gjW4hW9jSrqFr QmRg1lhKG6iyGnkx36IOCa1RCZwDEKCACFCZ4kBOSv5E599EWDA6xCbO3zM0sduyTWGrMYcnBG3x gabgi3LQTYp9aRocXNpgUPqAAMSqKzmI27iFPS2UHmLb55FMZsJb2DaMgT9j02JT+YaxDjtYfPC6 X5m2/1Qej/HhwUVPPMn+3DosBPv6eGDG8sLFTz654w0+P1CjcdzJx2A2M9z9+lat0wBs1PzRj1z/ zW9+d8kLS3fxhnzu3LhXhrV3K0jcx1Z/fOvPWZZhw0bs6dtcRtVWzeSR37LJ06C4iCqouEAsetDd DMpdozgYtJRinQwIxOrUzEBh7Jix7B93yikncQd+66238xY8C6FZVBA3gJkMIEkZpD4SJlbuAeUy qRLRwMrZI1cLvjHq8SsQKAPUE6OpaZF1zMKAbdze+953zZs7ixVh//KVr7J85KADDvjIR6+fOGHi S8uX/fOXvsJCL3hFREk2J4k1IDZm1Cie8fJdNtYq0EGxDd/xxx/D1xQ3rt/04MMPs4FFqrfiIjyP f8GjZjZDURo0KiNHjBk6YgRy6f+ljpL770HjsfONGz92A4vk/vYfPg9FNm5jBy3WJB9z7NF8W45F NCee+OaP3/ghPnjGXiXsTsruAqNHjZg4cV/8g1U2PEOHDM7OWs+Ro0aw2JiVuqxoOuLwww8++MB1 a9dNmDhxxLBhCEd5sEMG6xRZLMi2T+xzyp4R0VQ5FKWTqhki8sbOBUB2FNDCzVhWuM5mVVT20x7t oSCDMh7h/sqvvPPaa65khpdFv2wEiCIrVq5k35uOEdbTaOFVkkSucENNMyNhlYvhFHP6+XIMbU3p hbs9vuNGjS5u1Y0igOilcmWxcHXu3Nl/8Rd/wwLbs848/b77FnzoQ+977vmX/v7vP091ZWelp59+ xifD8k+9QCQIxc/YRvbNxx/LomD63OeXLuWlAopg3dr1bJ3IWiIsvHpNvc8dcd0Ni6agmSVCu/8Y 3/cYM2w4VbYORY56KQ09yNuq444/li1pVry6YsEDD99z7/1sOMYi9f2mTL74LReyRG/WrEPYEJJF jgceOJ2VE488/Bg7/11+2SXsiPJ7v/fbBx14IAvNWRR4+OGHHnHYoYceNv/W226/6MLzTz/9JNb9 sjyOtSMsdmJJKfpfcP557AeHyehueRDId3oilkpzpHi0hGJVtDOx0aRHMacbabhIo2A5VZYk+g+M mJq/xz0jPnzDddQtlqOy5ohdC/jWIiLhxCzOrYKUfP3JHwEz10Tp0nfrcNDVf8otTAmjuA4hpTXc mhwBvVkIQUgFdsApRRAl+1gZe9+9v9iwcePsWTPHTxj35BNPsebohReWnn326UuXLmdtqDe2wMce kOQqOeSiVePjFqtX83kCfOvFF5ePGTNq3pw5a9etmzVzxtp169n3se5WBO9+IRMKVgf2J9rWdTeK Z+6AI9E8kmaxDEv6PvLh67/4xb+/4LyzN2/Zytd+//OHP2ZtHDus/ezuex9+6NFvf/cH7J3oYogI x4NsnpUvW7bsd3//T2TYt+eP/+Qv/ubv/pHPXVNNUezrX/8Oy195n4DVuSx2nzhhwsknn7RgwQOa vm8w27f54UFFirUUS4kjpG5bwhVAL7NrKpLfQILV4GMGoXP4estudq5lfSFL1VnkzPrZWTMPWb78 ZbKR593vupa9Auyb9LzOOpZyE6rjXnYj1klYCR1GYxddunB8uXVM8ZpIKx6+46GqYOCj7AR0/HHH 8AbGf/z7t9gqCFEPOGA6qyEvuui8y956qZOzAY2EyFCq4ik8qdhNE8hkK3TIZZUgn3lkuSvrsWmT 5s+b6/1TuCl3ualiRBR9XbreLFjJcpAimAWcqkEdc8zYx67QX/zSV778L//f2Wee8a53X0MxnHvu WfSF+02dum7tBuu61cEbMPi8sYPxhAThQ6/J+IrVX5iewmADO5ZZIyibCdO+btm8lf1kVq5aufSF l8459yzWLD1CN+lWN7TAYEctwrkpl3RJmSybiGigFt1/5ZuB6W0/kmc0uqIbgTJEkFh2hJnYk5nH SSxyPvmkN8+YcRBfjn15+cszDjnY6iiiFuGv419siyc3G952yUbCvazCyrgnQgDd8hIl7Mq6kAY1 ozgWE9WXr0pLOaemDJ43Z9a73nktXz2meZs9e9aqlau++a3vPPfcUqamaeS+9a3vFodm8aiIyLZQ tKHpdIhhDJYz8pntxYuf5HUWluzMmX0IS/I6paJBFIVxSJUYGep3cqqlcql7qQMQw8ddH7z+fb96 4w2zZs3iY9ssjJ458xAK+/Y77uI1O5oJXJjV5PPnz2bB+qHz5jAgwuLjxrGjod/N426FhXrz5s1j 68W3XHLB/Pnz8OHDD5v3s7vv4wO+5DJ6pU/5wPvezfdsGY54HxhBIkKzqkL1DtISpQMn4H+rc0KU /LScrfkOViOY3KDqYoAyCmZPxJdeXE6A1X68UIO/svIUdBas/+A/b6L6QilkAQ/9EOREJamxagzJ KdmC8u/YoncYZATe/LUkNFMcihFfHsxXEvjEiqXaOxzZ7949a9bM3/3sZ15YupQqSHdM67tw4ROs Yz36qCPPPecsXoKyySysdn9u3xd7mAp9yA/laVffHnZvW7lyNa9sse8lWwfyXKVzjmjQoJse2j1k HX8MHTqiKklLKxlhY8B689yS51mNeM65Z+47cV/uXxY88CC3gizoff6FF599dglvMzC0ZIDy85/f w86kJ590wrLlL/M58ReXLuNu4sUXlrL6d9369TgNJmWt/IIHHmB3vXPPOX3HjjeeXfIsfeorK15j nffXvvZ1vopNAdeRVi02TDwjiZIMYRWOAYrum+d5gFSefsHstoPwqG+6WQ5Iu0GAdosBuPBW34MP 8eHzx+69735KhP7lj/7ozxcueoJF4azibNayNYuXQKJjVOy6s/W0zJUUR6C9o0lGPKFI2DKrEWS8 gpu4Cy9ljWA9hD17qJMHHXwAKOyDy5jysYWLnnnuuROOO+6MM07F8t/61vdRcy9nrGGqjWfUzxo5 3nxgX170X7tmzbRp0w6acdCa11+nIVHI2DaCxSbOvoioeQYPcv/CiZOmjR41PsQiNDne6w7Qz3kh RrZ83oCPgPrWKwMIVj4CwaMW+hYaia3s2syXMIaajnaYExJUT6oAd9vUQDZ8K/uMHM0HDGhx2EVv MG0zhhkzdswHr3vPpEmT/+zP/wpGiIw5yN3l3WJPpH6BFDAxVtHxMMnJCfnJFtV8zM33SocP58tR VEGSSeQwrwooKSLkzpZEmKIf36y/8eMfZpU5r7vVnS2DD+5yuxtaGyl4BMv6CTkTpFZSplz/D9PJ FGMUdwMlITJaCEgLXRbvEtHD7FGg3U+TSQRW8pJCPk0I6+l5nkUpMLzbuXPXyBHDBqgoFMycS8A/ MgmWJMPdWl2n5qg83KfQbOOX/GCq1JkyBDdrPVSMUti4aR2zSQpEXKPb3DWDhnROGaLmOyO7+Vqu 6lL0w52u6RuKhjrMyOHDI88e1nNSU2OR2NCZD4lTYMgMy3F8WnbTxmGDRiiRt3nKwapxRh69xe7A o+Vgvt1ZQgzw1lgvhZPGIItNIn8zrrwgiAc6ciLmMcBL1LSl9q7cH7LWHCwWxP/opltGjRpFd4PR SOfLQZRGjFIe0XiFqmSRFMhw4aRpKkZOpZKEGGjgJUFOXV5SOHkN5UaoR5D1qozuWHAjAWY3oU6x su4UpsNHKLN3pNEkOFJBfwY+SVNTPS8LubUG812uFNgDVWWwuHme2QiIDEUMl6ySZcioMWPZV69J DIDel0NWpYBsogLeZnnrbuYJRjnaTsRIeIp6plzUONJyorSriMnmjULmGxAh7bX3gazM4yVKziqW I35dsxSdDBEmPCULNxJ4/mcnnaZUXpGyhgvUmNxFRS1z+ksRGSVapkhhSjEHt3zcDZZzAMAUAYxc 3aP2kQzlepoTwJpdYyaPHLFEYqLlVwGs4LikZNfGWCMlR5IPZjnkkXzDiSUNACUgQTSOQBNJSVaS iQLRICtVK2TJkF5ZLQAYnKNICgxTYncog8dR8onmy5FMNqJmx0IOGVsVqSIjcZIVzdYPeL0TlSIs 1KlhCJqsiBKEwMsF3TKvWKr5FYF6QgtJiYrm60+KWiDKyljL6u9ho2YhCC60lwru3Ilv8MkkEyyV ENNh9J5QJ2jMQ1ICJsNrl2g4dF1gYdur1jlwFFpjeMs1yEpYlAKi7QhksksJe2AAY1OiEV5iwBBN b4JujQEyIK6T9ymoRqBM3eSkAnTClypSVaJIyNmAunaCYQZxkiJMADuZsVWEDEZC9M7Zu0YI/qsz BSpkLGZ9Zi8PCcEiK19dK5SI4EjkNg5mEisVzTTDc/8vWjR6uZCgK9AnKXoTvl0LIOQJ2hJJPtwM Fumi3cJ0ItzsCKIYOhVwXspZTQ4J9DZrr0NwcQNQ6OEV0sGkaUyFKvqm56iADb63MGQqKGOsSgeo uJbEJCoTh5arnPAMMYRq3ixEMQhMRQtBpi0vgWBalL98hE+xLwSxglnkxC6c8EgwrqjF0ARgLaeh RDBffEZzdm6JmZbhnoHoJAvDxgw4kmuLiarRkZqw/KfGFGHtJqY0+l05K2Z4H5D2ptOv1RWNGPBQ SlgRCPQf1bB1adHFiHw6ahSYw/awLkCp5uiHwQSkhF0/8Uo0PQoUwQ0bNtaqdFOTHoC9sXwqqzCg 2hggQNiXDEWnhKRS83i6qnZPLAnSmxbdrtYY8y94BnMULdJN6KTBs4nFBxugOfVXaDkXTpcOimKE BTmNgc28iqahS2oyWDNc7iGhBir/tJ0dtmh6lj8ph3oHXRx8zEHrVDmpkErQI1lA2O/111/PONQs gYtlYFsZIGg8WqOTlLuMXFt1RlxbCQgEoJg0MghpCHAcE/RGA1DBGjsuZCVf2MoJgJhpY8Hdwz2X 30Y1G+lDN0CRxVQoZK1b9slX6uIS9hIqnIqGBvAcQS15KxUp8a3U09CUcj+2zIPS8IhGgYGpcqsD CyM6cgEjZOJkppkrAwBb5gOjQ6sk7S0WGWU8LtUMMDjpoMMKICiqTOkDvgur/UlKS+QWn0gAIIlg Ogi9aZk0ZszIJM14yIJZgyAoFBkIlEByLBGqhIQgqVMgiHLgJghZbdQ9KqXXOFSiBK2LytnwcwEn vJoGLUsm5vCEP71GA8G2xYOzXFW8/5A0RwgGvcUbLWhS5LGMgvjXoCQS+xE3KAz/zuIwSiNqahNb CP4wtbk1bWgCcXcP1LYStuwyDiAnpKtEkE3YdmCi9MU6cR3S9YW9DkJU8SNpz4EGMT82djhP0itb r4iBAieCMrCPz+4J+46bO3s291ZsguCgRfi0MpKVqGoip8aPzLnTYZ4fRdiaggwsFoFlUPyFE0ks KKAmDlBEoKmxpCswDJl00T10FO7z0kIGXeRIUHTibyD6OrFhyHlblMJurtisIAtxYcoMxKCjD91G EWzZtk+32MONN5qEUuHPWDsUGEyZ+4MS4XhuSQtXBFBN0tFEAioSgqV+lIu6yiAcB4HUdaoR4dQH Prg3d85Mkt2pYYgfb2RvHJ7csvEL0zN4CYh11xbZpMQ/nLgPwIWGDtln6Iih+BP8eE4yZswYblfz 6i8z47UESc6yi1yQUl6tz62lz2/1D3VUurypUGVTCBnVv+m4o37jk5+Yf9jcyy69hFEb07o7d7yR /dB9+RZcprx4b4UZQG+vXPflq8NEP/nJj696bRV7hTkllk8QhXP67N1ulMgbiEiGYN43eAfjnR6S qB9qk9Ql+uYqFkfCOKdmQGD/lTwh1CIBzJRCFRqlZkOoK5TrCl7/0NkzaP/Juybvu/vVVUMuOWvj 2g37vL5un8Nnb123kQXlwovFNQTBSjF3zDqCujW8fJCruLQ1gsuxFbniSUq2JQZhrASwdThHywoU /hyultGBBxzwmU//Ol9qO/+8M9nDiAdD11575Yeufz8Pw4868jA+eMXnixxHu/YH2h0teTHVsc/0 /aaeedbpLCJ5adly7hz51hZbUk2fvt/8+fMYU7/y8itxrKAhc7BARDwVcuphuy86R5ciHaAYpiWi wZ5db3/bZXfedfe//fs35s+de9IpJ7LIat+JE9kDk4css+bMXvrCUh7xT+E9msmT2dOBDVsAOP+C c19ftZrlFDRrEyeM5/Ejj13uuOtujMgcPJ8ZGD56+FFHn/D4YwupBGVKLZu2Uivyn0O1LQmrw6B8 ScdKpXMjqllCRWqvsREnFr6rb6DS9u5SaakUUQtABf2o+563nb9xxaoJi58dwafZ5s3YdOJRGxY9 M9k3wCVYxDlrlGowkmRlk4o8pWNbA0ZScGMzYsbwM19ILgb92Sc4MO217/F6s1oGNkD8GQcfyMdK //V/fe2iC85966UXP/zQI8zq/sM/fpGH/sg/bOjwWo5pO5+a05FTJG4VDz7kYJ5Ls4ABwjz/Yzun Rx97DL857eST2YwPDy2J+uWyYU5PSo4ewvqgUWNZqaVcOao8DArhmbuNKVMmvfUtF0+ZMmXZy6/c 9tM7+FrbJRdfcN8vHmQfjne+86rly1/5zKd+/aWXlk+ePOm0U0968qlnP/Vbn2TdEKuBzjjjNDbd 4tkNj5V5ZP+Wt1zEOqMr3n7pz+9d4DPrs05f8MBDPrf0gxD1qriKRRitaQ2L4VMz3S6hYq6XDGCB KmiTHzskpKGrPCw3lTK5ARGw/QZgT9+qNcMWPTPi9z7x2h99euXZx6+/f+ER63aczioFxtH1RDpG TJvfFXAcQTHlAfGciSFRa/+abIFpTMt9upSsGmEe1OFa72gSimwwVXvZ8mWPPrZo5IiR7Eq4Zt26 hYsWXXH5pWyqxzf5Zs2cufjJp+k4nMKOu2uuOCsEMANdD0VDez5x3wl8TqkSgTnggANY7PL4wieZ 3C5WkV2edUhObVwflE3WS7JGWph4NvZVVjYjYPs5nuafd85Zf/onv/eTW+544YXnWRyISFQUOhXk e37pS9/+9veYRP/0p36dgqen/Jd//Sqf7jr8sMNgdc+9v2D/wqn7TWVLExo6FgDwpPSEE47jSfp2 vmQTuw8dirEGM9KBZVpdZVQS/vURvsCabWsZvfpTetIpvHLoELHKkR7t0g2pgasMS3+VViFIWlrM ix41b+txR2x7aPGI912xdscbg+567JJf+43f32/qvjy0+5u//cebfnzrCD5UMIRPJYETWkqkB8bh ymp1jqXIi1wyEFDuUSBCFY1wT26ICFZHMA1iVt73BJOpP98tYpruoovPO2TmjD/788/t0zfkoYcf W7du7ZIlz3/wg+9/66UXfv0b32GTCg1hU1SqS0UW0Zbeh8aFkoo3MFUzjMb+qSeeIlulwhZ0NWrh EjlZrv9oVi3wBlOeIR957jnxhONZxXPHHT9jN8jf/jR7Gq3loQC3f4AhPZVxx7btvAPIUhTYcMSh SbYRZSONT/7aR9k/k13etm/fycfeHnn0sfN4FLzvvjx2cZo0fsgauN1+a+SNck0URTC6NnqHmJte JfpHpGoNNHi0RGiD6NhrGkGKhRA/GHUNeOclQwbvXrF66P2PDlq/ccj6jYOfeaFv1OQP7L/fJFY5 sRHjxz72oUMPnffjm29d+uIynimUXkXKQtBJ5KChKqSlzNfopsi+x9xwRsl5wc5cX/3KzbOELCdd NmfJppytB9iQFZknn3j8n/3FX/PtGzr0Z599lp592/btDz3yyMwZB9uvQK+ewmBwhquq7ticmVEa QplFGMgzTJk+bX9uh3hgzssMyiffyBxFqtsj2NOK9UH4VvOHKKZwZLckx6e7Tzv9ZIZF99xz31FH HcEKvCezcey7330Nz/QZiOAXrBoHi6aMddWU+rnnnn399e9nSMqOYQy52eWTrAMOnI567HR29933 /8M//NU99/yCuTKK1LabRaDbt+sB6qbEXDgQI/20vWucwVwz+o8GGqO0VGuDtpdSBxi6iVcxkA7K 62uHrF4z+PC52z7+B9OPOfbicy+cWw9L6fImjB//rndeQ334rU/9LktivQfqDuj3xg2avicT9o+4 abHk0GHkijIWhSsfY30TdYUCM690k3xZn4Kha/6D3//t2++4+62XXsQmnPfft4Dt0S6//LKHH330 3LPP+urX/oNlmKjViSDhuCcpHI12eioqW9/o4cNnz5m18PGFSsCRhllDlChexMnorXAz/hg6jPXJ /YfdmA7YUqiYLCkFb/bsWaym+ea3vrds2XK2cmM8+jArJx55nE6OwcerK1ZyJ8uZ/UlpIchdsWLF LT+57elnljz08CMHTJ/Gur277rpn6UsvsWTuzDNOvemmm19+ZQV8tUfqk36aA9H4U3hzS9B+8QaG 0LxMM6Dr9Q4KU3MMhKww1ETpspjzOGzO9pPftH7RCyfd+Gu/O2okr1O3ER4weAn99O13/Ix7hDKx wkja00CLNUaduD36LT0X5ERIMYNeWdAjUWXNtfUtfUtnomzW+OqrKxVgyGCW2z2zZAkrC8eNH7v/ 1Kn/edOPH3zgEZ74F3nI0o0Q7reXxPvweJY+8fVWfBfLMD3BcmDUgZF84ahYzSYKk2asxNu5c1vW f4wenzj6WU07ZywYz9RfPkWG6RhqsN8eRJnSYB0CxEYMH8E4lDW93FMz2uJmhIkKfItWmlyKl36H hgFb08wwpzNq1JhPfPwG7u6+8IUvb9m2VQj9w5YD1WSdYjUxZexNPI+gU2o90SFcRYw+vJJBLg0p TCox7zRQ0D3/UK9SRmZ5m1dmEW+fwbu3bHMj5f/+uT9N/6iBC5yuc/GTT33qU59FO3XJkDFkU4qR r8j2iKNOFVJLGWBMCLBwxtekUooN0T3jXJdJT+oGYrvfsLC6kiYdu2k63hljK/R9WAhGCoM0enY2 nh/MrpMULQTVpZMnYQyUzXQzLUbx1Ytx8nYgopvqCXkAVP7hc5UkFkGKmCjfrxzoH5qGts32rztk i5KazESusO8B0DvwIWs2ytywfiMBPhtYs3p02O3V6o4O1ypCagmLEVe//jozKPZjKSZoQxbWzueF uXyjs+x8LcdkQKphI7EUKJHI4TfAt8hPOYXUABESVBcDAmW6gii+yx3B7NmzCIubzelYrfnT2+9i 5+d6aYh0xno1axmT9MtQLFIn2Xkh+5cUq9KwZAU/iT3JC0vRIzyOwohBR0yxVS5n7MJ+6jyUYKbR MrUgNEYHALotE+nJMhlWQGTgBjwdixgmVvtkYcYEQiYntpOoDmCTXAD4R9ufrpgpqeK2Slys5Bee RbWRDktyuEljvTFZuKbOCaSdhWOIJoJUJCFIbq9foVvBF0KUnE5UFZJz0DiZz1GMJJcm3Stp9j5l pcDb7A2UG1sMVKIotXMTCwktC7vlGO5HP7oF56bNoIFpj+UGuRoB12n1AeAwkZHMG6FGFo2wBj7S u2MlnrwqngGFktTSy2CzqM2gLQfyqGGPfMhISeYt2Wh3KEay4NyEgiLKxXbmieVEQUhCpAuCqDFl J0xxFFFBIgP3Lx0bYSQ5oJBkLDX+MwYCoL/pKDzfqGZiFDgHcREzWHUaoGfXZkKDkbOuotRFxHN0 DztYNSco3fQlQhmOxHIEOUrbjgLowCFda7xVt/8ogv1xQ4Eo5/K8h9mkajbQgmIuYBlxaEfNQCKw WqixLyjPSpb3BXtJIpZ4gdaKA7GAV6wIwjkTPSHfI5BAuEomVS8oRbTlWo7KpYxJCtmMPCoaFclW HGBaYAAN85SMo0chwcRiCBl4SMJff2JRRXP7xUDkHJmAG9xHn8JnO4twI98IDZRZJOh6ijaG+6Fb ltlh3w8KtPWgA6hSwz2q/ErsRtamDD2BpSx9fhldxPVQq45sS2CEkkdWRuk1HJlSoKB2Q1QRwAr9 hM0VOk1FUTRaMOUMAJSCZuSzTWEdA8YbpBmKwSI9FlduSEvdzEpMOAwHDKb6ceWQA5YRrMMyMd5c rXSHUYLJ3P+Bh1WrGHOxHwjTUjzNUMWtA9W/w7GEFQvPoBOx3SVSlAs+Z5J6pYWU6UMKStCAN6ze RTrhoIwlq4wbbn+W5Hxwmkxwyr62Lv6BWwLkDD2cNQQ9taPkTESM+vVj/bKEjWCHzbVM30oU28V1 wjwKJCQWVuoGDZ0XyC0M1dAwY8vuiKBJNAOMNOltkG46gNboiEqnnd28akVmSHZZjQ5mSqUAASwS aewoZovadZay9wi1Im60PyReyxYsFu7gq0oGXirZmAAePeSUGzsPZleg4hOVSgeClIr+1xB6kvQI dI1sY5FKG0lh1hle6eIMNYAxh7aaIThx/9Q00jW5SGtahx+8MpMmz+JrfW2R4MmceP17Fh1Q/g2U PBYDB7QbkX5wIVMKEg2WZ8FCIdVPooyvOwA5QreRRr/2HobpdaRq9lCLkjnRSbFaoIHbw2C9ipGV fE9ywUBV70NUaxqnFTWVo5p/ZNNyrX1oshENrpJGeCzX4+wdgaxyqotAJGkkeIM8aM92NrTeuaPo kkjxZNWuXpcWsgY0EmmmJVTcY3vGKDpyeAyEMCG/4pUY4kSMjkDGGpEnvEjmiJkioTF7T+hwyx23 Ufp+GlX2mLGUMy8AgiSCoODbu/fNmTeHCTFekeILmubnhgRjFlnVjyDoIpUc4UUoxvJiWJNSCiDQ +FmxPExIVqksc23X9VlkoURA+20Yckwk0InzNDxEZEGJMIKmFAhb1sWgiRBmniQoANKjHSELzi/B sS+L5RH0SNz4BikngDlyrudzwxNVco7ytehjmL551qwZE8ePZ5oFdvW4bu68ObwpqWlrKBCXjDhS UG3pS+6NHbvYlJ6nu0z/2RjEPGQIYDXv6iXISeUEzZhX9FauuFV6U+hqFVJ7LHoEmwxpOMz1J1xu jIoURPB4E8Eyx2Rk4S6F/R34ShrPHfkWArsh8P0XEhmoWvuof/auwqc8pJssr+QWrWhE0Nm5EhH1 KB0YKYpJxa/xlSbq65otS2EqU0DFJ4XvRPHJgwnjJyx/+WVKEhPyPYVjjzuGKspWBwEs04kJL4sv IjmWGDSYj4rw6Q+2R2CUMH3afry7y3NWnthh961b2Y8jZghTQonAA9aq8AbrP0aNGscjEsBKh+KB JqqdZRlMwLFpx1VXvY0PK/ESES9j8R7RlVe+7Y7b71y/cRNwtMkAMz7xi8d5wYmJVOYM8CTi23ds v/QtF/JFHz5Hxwtz1MksE+fGxydGHKAzoxU9yyBtAhT7kIuYNsHpBhVJfbSzWXQ6ulsSMWWaaqtk 9mvvmmIdAQioUR5kUXHEcXBdRTuIqf3zzj3rYx+5PjIM4hXcafvvt2r1auoDlS30PFVuioxT/aAN EcVoXiK3IkuTzpHciKvbKnYjAzz2tdMRJcmC+SM9eln1jz76iE/c+JFXX331tNNPYcr/8ccXHnjA 9E/+2sff+5538ME83sJlYAhy94tdMoGBvrw7g6+fcvKJfBeGSW0geUTKwiLequLZLwXEbLgmqXEb qIRLFi2qzXx+G3k1NqWhAiVfOIabKEzKMkHOZ8z4Asb+U6bwBQk2AuER7iknv/mSiy/k0ev3f/Dj RQsXXXP1lWPGjWEzkwcffOS73/vPgw+c/p73voPVYxP2nchM8OTJk6+9+u08H1r8xNM/u/ue0087 5Uc/+jGbhVx/3ftu+vEtvBoqJ+tMngsjS8qeRIVC2ioBrd5MHOgUtZiOVwJKpO7+e9OyqQtFIBpG /aLiVNiY0aPOPP3UNLl2HDx2PumkN5944gnsS/BXn/tbetaqkIrBv8ie8H3cGvtSxKYpfGUGzqhS 5WqGxZB6aSK64M3KC6pwnvvdXXJJhsnuf/3KV3kyev55Z1/ylou++a3v8vmwBx98ePPmTb7j1H/0 03FEIG3XB9Has+Zj8pRJ8Gd+jVcyWcfF5xxZR8an36yWaW1DRnPT9sQ3bXnMstKVCpwDhfQGMyA3 JenU+Hvvve+UU06kdE4749QlfOpx1arp06f9ynveccstt91yy0/f+55rp07d78KLz+UF66/8r3/j VdtZMw/58EeuW/Lsku98/4e85s+959TJk596+pnP/9M/H3PMkdOn73/M0UccdNCBh8w46KgjD+et JBghWVmqzZXgs6SW9bhGMi1rKxLBWnaLOi9tk6qfMDnLTWupKmpKMKhagRSypANwXx/V8YzTT6kn c1LOMn1yzzn7jEPnz2feUgIeIlTQuPXJXkapiRG3ZS/YJHRYppHgPyS0rxGwDAiUvzqpsiaXtL/H Fy76+c/vw4C8/MyaIPr6J5566pZbbpWff7aFkgXLay9Rj6SxX/zUM7yN1poId2H2oyJzZs/CvVa/ vg4GjVeYQ0Xrxcs7evgHVm1Gi1x6TbM4/HA6OjxmSNkZZt8JE+bOnX3csW/iC5Xs/UJ4+cuvPvLo o7zIv3Hj5v2nTV2zeg2vbtN5s5PMgQceyOIxHm49+vBjd999D0NUlscdOH361Vf5vS3q3QMPPjxv /tw3n3D8Aw8+wseUEDR/KslR2kblSmjnqJCq7n1vHTFQG0OagpK0Clpaj1O/FEEuRVcb6CAgjRsz 5sQ3H58mQICBhx6UukhiSZLCSDA8tVcsDEA8o6Muldx/DZhrt+GzPKAZch0ZxcNreo28uB7FC//j k2fve9+7+PDSTTffyofDGLOwhoPsEMKNlC3ERDHQL0V1qYrm4RN/n4dMm7Yfn26tpzBax9vD5q1q zLBAh9BwJCtykY8dTdXwxbxciZ57iF/D45nyxz56PWX54tKXeBTBcgQe7rOZFR9kZC8oNoXCk3jI wlMu7vUB43HU5EmTWDQ04+CDoHjdB97LyPnf/v1by15aTl/I2/GHHzafj6yy4i3LFKogy+Kp8E1r S7HyImEzQjRuJ5LyhAZVKAROKtAsnBBwpnvJqVOZRJYy/fye+9h9PaUHkKbhDw+79bY7WMlgYUgk zMXmCCNabD4MXXsaAy9qvCnmE0qciGGkWOOUCGd1lAgVUSy7nfJDSik5rVUHgMefV1/9dqb5/8c/ finFhR/lF3+qkD5SHKBWjAoIQ2gJmeSw/aBysnnQ62vWe2PR0pWSo2JiJFon1weVFmSrTxoYaCa7 Lr7ujCPfffe9V7398n//+re3sjJoNzs1PHXcscd85tP/D87B8p8XX2I3h601GmdYt279ujvvuIs7 Ar78e/CMg9hAgZ2y6NcZPPOOPO639IUXcTu48MlLLIaf2jH4Q47mzpGhJDHYHzJckEnHkGaiSe8c 1JwGYtUkRAdmESHJF77wpbsfXty3ZcMb27cNHb8vFYi94hmFPP34YzwSoxfH74t5wTfS0qW2NWPK 2IPEDDnjGoUVOJZwM3WBnmlpTEpjHslB81WDDjogmoGi4Nbvhhvezydj//gPP8tuGtQuNnqB9o5t blwQBwtnkH/JPKZ4AEwnUGE+VkxXteDBh7kzU3xwVKlhxvJJDK1K5qOK00ePmRC3Fk63UtwqKrWk yNn5CvU2b90yfuwYKhwrDsdPmMBKUtrxbD+3h4E0FW7ffSdt2rBhx643+OA07Q0mZqxKK8ISWTZi 37Jt2+yZh/AMjE+zshYVD/udz/zGfb9YcMvNt7N4zBm/3C4hMqQs6/+fI57h8yanBlPjaMycZtgb RbP536jofx3EXsW8e9eIaTMmn3n56/fdQl865eQLVt1z09QzL3vtju/teG2ZHxWot3BDphC1qdTs lBSmeDBisx6Xj9gqtPRf0iIjPtpXWqyqC7i5hOqIm3OH7ON+DMFun6NHTpm0L0smXLqxecsry1/B r8hgSTp3kuzkB1OQEIYqgqkbWeWzWUI+bMsfMyg4As9SecxUWOlTaFFcjJFhxy8JapT91/smTY5/ RB04+dpKSPdMAByT3DBBYYYRGMEZpJ32UnmPgWeeWgbxaG8ziazEOpxuyH7vPMfXXpyyFzsBbzLf 865r9p++3798+WtsviaAh49QOP+fhV25VRZFnEpWFgCefUf8BEln5ACn5PSPvVOLUJqNAkOlCYef wIPaScefs+6JB4aMHMPaFjY12L761W2rXtmy/Lmhw1G2bVlP5aH8oUprirJ6oKSgpHrpqnUQE3ud YrHhHCOgQkzls0Tk1+ApXbJDxJ4F73GTWT2J6ZNdOzMzFgK6a6NXVoBvHf1uxwwTZB01ax8Oykmm mVIiCmI/UxZduCiJMSbs+4+OuP4xcdL0MWMmRDw0V0vDUPb2sGqDiPhvdZJIpM+qTvLbwidasNSk CMyddx6cOHDBEKTp4GmSehphYlYYgdM5h2TTbqlPD6wndCezYKpMUdHuW1p9fBcRK4rTmQusgvf8 yy6SkujoWpZv7By+/8Ejpkxft/AXkB1/+Akbn1s8dOyEnZvW7d62NavMY2hoxo85Y9Zu5BGtEDhG D0CE+KVKiRz8lBvvsYUGEpvEjjpB6pPVHf+gGfBTDRYyDVLd7e+lWsuyyU3HEeKcetYTcaAA5JXx Ia6bwojXt3xjimKlIGnUO3vUVYpQ2ML+MAT446jWGGtScoYrvTOv5Mp7UB/18LuUbqAsgZCUjJiC kKiTYF/0IEUhu1xiNCHWJOtPl5ygKf1goRUexUDBUEvaMuUwlHfIGuOGYXpKDbymWuVoH9IadvgP G7Z95fJtKxh0O6OwfvECzLd92xbKh2zk7EjmKnMbTiIRFGkURy0qhXgpUAbtkEm08JtlpWyZRRRB Gk5TrhKkFOJcSOnMZKiaeBH/70ePnBx7lnG4F/kjsQQ5JD3wgJmcSDcHGyiTonAoTwI6+N5IyfVE Ok6IiByq1+C4GCKbxWN0JGGBf/LXgGS119HjZmqQDVTJNXImFE1VQeaIjfQWW6wrRgaQAR1wCrfU G2Xqz/jlSHSnXuEcYTqY5U5gULE6q4hb1MzQqPi9aTYFsYYQsYr5CqQZ+8vFtKCaq0G0ni0uh2VB oBnHRoWXDwVLbnGoSMkgqRyihFuXAN/+IL5YUMKkvIman47Pzi1HeogOTZkHkISCQ2XwuVRdjnoM 9VrXGH8LhiRK945uDEQEXymiXoVVHv4T4OwD+nKksGpAEVXzCBgOYNFfNe/o8YyRAlNJBd8Sigvn yBA6jWLRVYwyU0EGDWFztIiCOEnWDJPcsAoKmV4T5qx4Pfe1bngUOcJUKTXVcYueOQB1tKVjippq z1TNoIeMuS3QSOuIbk1WQxYzg11gngPfzrYpnUdqScYhjWDDCnphFBvPmseK0A9TCpmXo+wHj1QX DQ0JRGJjKwo2ija9mjzNQO0C3aKdFltcU5oUXFUx8y0YRJvEigVS9ISNWvEpaYlOSohIwSRFMCW/ ABDTyP6JYQZHThJMFo2HKsi0lxfgfoIiIaPo2lMKVlkJ5gg2WWEU72g2IV9QgLBZ/mkXNKYa26LZ uxcNIKXPibw6RDbZgULBRcIElUREFbSgGxFV6rKkBTLtUJMhMGAVxzqHBBTla36yFXUva0T6ygwa 0DlUmaPqV1iTYYI/4a0FXAKuv0Qk4pVfRMI9GWm3cNoCU/4SNnGDskt3lIa0CVz4Id7IN7SwlUhN LALuX9mtWJtCPjDxcLLhwZFUT4ZlG3WCk1Q1jHQgaPIYQS4Iz0LJHdt38LxQKTjEDhsZmVKp4WWK +B7hiQUyUgHIZNI4tL5ECrXgTTdNksnE1DpUwZmVkDjBBCi9QJJVtkYUrUSEKYSiqnk7uZJlmfY4 hWTBd1YAqNQgr7Jj0tKOlduVWyQ1FqXQM0DoAo7dkJYsOfqBiDKU2SamM4s6jQdCcncvO4VLRaCe cQeUcXKjIqKVsROLq8WbGk9yblIEFcJC7eyOKSNgfzFEhkhWtCQjDpgaLWJDJOrTLjK4tp2UqIT4 Zx+EXcwo8MiQ7Q8WLHhwyXMvsAcC2fLOoW9GoaJSxPD4GCAsYFoj2QILa7RgSXrk133AgplGkK+M +yUPVoRSsE44pNuzfcdORnHo7B6Lg/j8Njc3ThkwgVJfjFUYBQ2fCFp6hSTcnK9j/gQT8hzNWgpj dGaWO69WKIMULMYIJTFp5dIGZaAFBkg5cJanSLwgOfQ977n2gGn7izSojw35/+Pr3+EVSwjQxjAh gKIE4EtrSRB/gmXksPkEi9vrUSNHf+D97/zGN7/PDsD16gN5tjdO9oAMH+nAkBCH91BOTvJWiE1Z S5V/bCrIgBJTE8CjQWkbSKE4zBS6hQlKpEXJRtRJkyd99nd+85ijj0Llt7/9rX/8J3/Je1+8e6sY EohgEoJtoyThEIrkpPaINj7ARlNyqPHeBylCoJRXKNXuqWbQFraoygho3h259NKLjj/+ON5b5rso GzdvZPOPa6+5gs9j8Fbz7XfcCaVgNMqhVtTlwCYOc9mC5Y1dS5Y8z2N2PofAEw8qA8bidTVe3RjS x+eUNA/AJRPRhHRr/mr/Dz+5Ykwlc/aUcFCZXdi0ZcvFF11w98/veeqpZ1evXbvTTRmYKGPbUzz0 jbFjec41hkeF2Jpj0qRJI0cMZ9Ncwox92fhh2NB93nrpJQ888ND6DRvMHclmCttH8qqV1c67ZeAd qLSCY79UZlCI9HttJ7+K5EArRfasE4nqYaKx3oEiVsgcCQsYVDT0YP0HX5t422VvYcKXCfWxY8aw koE1NTxg4mijClxWi3D0l4hZUII77hFP0oD5J1FhXA6VGxaNWe4vDf6bBEQkUlkmdhkaHwPUCor/ +Po3+dDF0Uce8dBDj33wuvcyY8Z2GzyXYS92tqpmdlWi4RjaTVumSvmcxsxDDsZLXuBpRpbXb9qy mfXk06dP53n1q6+tRIU01VoPGqBziX0UhO6229+BlsDOUvnUJe7BCYemGr+8HFKrjzv26G9++3sv vbTsozd88Oklz/EI91dv/PCyZS8ffeSR77/u3eeefSZrRJ5Y/BRLsK65+ooLLjqP4l+2bPmNn7jh 0ksuOuaoo6ZNm3LrbXdd8bZL2Ur7gvPPoVE55ugjZ8+a+ehjiy8478zTTj35sUWL9AcF0/ExLu5l LI5ampPVO5S2UsVolYDElGNlCmAb0JQ33AwBUECYGjrkkBnvefc7+GCD7Lg5372blTh8eOXIIw// +T33s/KqYEUITjkINKFmY23bgZGlnKyIDNN0KCWPuBG1J5YDCS0OnuIlvSRSZuElxjfddv7i/gWL n3iKr6DwMvNdP7ubl5bvvPPuV155hS3Y+VgHW58zgR7q0EnPK5n6H7Jt+9ZVK1ePGzuGp2M0YjzW X7t2HQ67/377PfrYQgwcoRp3GTfWMaj+4f6nLRkpG3yN+VBc91fMoXyqlKndvArFXhRT95/KLqZI P2kST3AnXHX15bf95A42LTnpxOPmz59/4QXn8Oz+c5/7+0cffezU005mP5Pf/4M//d4Pfshb3Myr Pvb4or/+2//xne/94MwzTlv64ots5j98+JBTTz35qWeW1OgkIrJ2YUcWXiBvHKQ0LlH/L2f8OTZt WXZrex2lZJUioB01SFPJfvM3PsE6qwxLmzFwEdxizuyZPF3K3GIPX2RsXyRS6i0rrqwY7dA5ehGr pMD114Ekm2TL0mbaZs60/FsGJLy8/JUXly2fPXvWpZde/IMf3kRP8cSTT7Ey6/xzzxk9ZvS99/zC Vy9pwy3QVqigQ4YIqwNXrFhprOwBSdZ/DB8+Z+7slStf4yMtKWcA1UemAW0hL6YxY+jFUkg/BGlH BvSEhSFT8+WhKl6dwWGZN0+3d/I+7Uj6i7POOnXL5m3sI8UXZT7/xX+56orL2H7/+/95C0sNljz7 PK9OsXKJXKZSTzj+WBYWjRs7euy48c888/x5524/6cQT2KmYj0phRD1U5eDaGBf7dm5ZyjMAgFQP RAM/qy2AswAAL8JJREFUgcTjM3HyTgdVrM+/gxKTsJZzxHC+ZwCi87zBK9I8GeDjAqxCtckp08Mg Ia/8M/DTCWInMmz5+mVoEuRierHrhCZqs5OVjjUqQYDI1K+2ECAO7ttv6v43fOj9P/3pnQ889PDI YcPpyaiHbM/0uc/93YZNm/jwA9VYat0ceUjFubqBuMwVXX+YMG4cT0/vuuvnPMJVnAw3OlsDxB8H CXFo/UPX6DSIUPb7aTYEhHCVFos6eRCH1bZuY78ivkg3evRIlmpu3riZ9/RvvuX2Z55+5pg3HfX6 mnV84uPz//Slww879Oprrrj9trtOPPmEqVOnUBHZ3+Hggw7kEf9//bO/nDtn7tuvvIylqQ8//OgN N3zgzrvu3bhxw5DBfnpSafxvjCOwRU2Co1/z1BWIdm0atRqqpQja2eaZQgAFRk9tSGIcB2J2EHy/ YdM3vvGdKy67hK3ly8p50sT76Dt+eNOtLNvk+X68LjKAbLE22+VGqmjjeroIuZ1k8RV4GUd0pWxt jAnBMrPK1eKLD2ltPc4SgOOeyZMm3/ixDy1ftpzPdk2aOGnr9q3HHX3k+9/3ni99+SsbN22mbeaG PLRkYiDY0tdfkyJzOzLysPCcebPZxIzn53QHgZCNiOY35saKGo9/SwG1SO9lnjo2jy925DEI5Ssk SMNawNt+eucH3v9u3IIOgm+Yfe1r37j66itGXXvls27l8Oj+0/a/9K2XcNdx849vu/3On9EZfebT n1zx6iqWnfLBl0VPPHHjxz/Cx0deYNnH7kHsL/Xrn/zYggULeCoVGUvOjn8k1vSWiBpQLxzjl1Or WvTgnLC3QGVY1BCqtIxOplBCVXzcTYBgQVD8P/zhjx9Yvm7L0id3bds6asa8PVs3Dx0zbuuGdaue f5qt/mxyJBp8TxZgs56lWVVKk8ExpoMxgsXTU9g6pmmCVOlHU4VvZC2gRrKDBNhpj8MPnc8+dHw5 6Q//8LNPPfH01/7jm2edeQb7O7zz2qu4DfnhD2++6+77uMsNQXhUfY7eTZZBVEKekOMi8OC2gBvd 555nrbIoKWNV057VTERCqSmOMvRNmnIA6z9ADnE6D3ioSbCtZBKQRIELxhTS2FGjOOM0PDpm50Ja OfZ32Lh5C20Mn8nl83foxvvvDFlYpz5+/JgtW3k71y0YmJSl4eFbNbTbDEIvueRCFqL+6X/9K9aw WMksaadAfPALW12W0sgNAs9HiFIHEQbIEkwErRvrK6Oie4iVq0oar5wETWnJrjXd98gTRh/25o1L FkFswtEnr7z9u9MuvPaVm766ffVrPF2nOek9jZNO/uFJANfRzfY+4KAcciezxyYs02iBGYX2Qozm pLNsIC1cZIYwVBh+0gnylUjszNkBLe2A+1mw2sLmp5gAic5lAJ85p7uBbFWlaJGOIabQzIiRMu7Z rAlkWdMTGdu0YR0rUNjfsr5P6P4FBaQZOdolwXIaWmSep7N5F+xtW/yBRblx0+VeNnjB4L4d0YXe CAlw1bxbZXljFw4/hKNsgydOHM8927e+/T3eJNAJIGZnD2CVbhpa08C1y1AeTA4YoJ1wEkLbtCot UR1I1lqKHrQB10gd1QwBM3TYzrWrJp1wzqYli7a9+uLYOUdsem7x8H2n4o4716/B1uEpreZWQVMC /DbDDjJCT2IGFK/YhhfqmJSHXQCI2cDbxWWeLbHnUpVlFOA9g7Zu31aVxR42tcQFBtXTAQpUbJtC wa20mBS7dpWiVXqNV0aOYKl62rRJGDolCcC7eb9hm+2H6z/M6pRUuYpYm/m1rGiV1jKsZbcXVuxV sJy7rEhvXJL54fV0bEP3YR6w9pPRsRQLvbLKRAC16WpoSFht2KGM51WpuZwBk6rCREaDLSUCgkY6 JWigy6pwEpr9dr+xY8Sk/ZiK2vrKi3Acud+BO9as7GMJCwWQ4grxyBAqlnaHX/l70YSRrqkkVR4d bGpYiYw7VE9XeZG2wXd8uhx7QL7CVrfZkUSx8Voa79IWRJDiH7wGm1FXUhCjBACeAzQap9RCySSr NEkpRuBOERjoH5tY/4EcjUFPIgIhZ5OlPv0iy6YQzDLdeJODoCmc+AVRWBN7cQIAa6g2jKDl7PGQ kGRL6x5mkiDhwLDK2gIKJ2AgVQC5egI0qdAhlGhJ2MuqZPNDhgf6b2xcR2vNKjKytq18hbZqD1+4 irLaseAauboUC8ORQEaxlLRVuCXkqmJJSaamiY5dUggAEIM2bM3uASL3SW/s5nNbxvxFngykjDY7 28p0laR4JaXlaiGDIRIahGRBYhMtwsujAkIHHB+AXiGa7REUG3pJ1SXhrt6aBnq/ZYThoAE0GXQp lJimJ2qgP2hr2xJM7WiphXpYGQqazNAsDQkaC0UJJGLUv9ApiXOmELp8cdpRAKVZJ1jJy/1tiKSP a8S0aSnS8JIOqUqUpjg5FMgIJjfQEa9Mo+kgy3LNyQIfHERN+aV+N5Je0oJTMwhGrrJG49BIC6Yt euY3XQGaiTSDluisoWRhCs0CbecwFM5CCDzPTHqKFxAwQTY/Qje64rZGLLyjmmnCJzPBxNpYIZhN mAgLHPyiIsr43Mho0eDcWohGIsmmFoDGBVbwSlCDClXAsAD5ER5wFBMxB3Ajv8wQqj1KHZoJrdDi roXZmTngnvYmGAEaqSLeyIEH70yYKkPDivxU+34gBwcRshFBa48Aeg9SIQXvHpVDOOh180w4JVpp mq6HI27HSc1EFCygCtT9m5JE6Tre9MqZSptAeR3l11EreMWEbI/KAModueAjX1TsUYZH3BR7h1NE g1r4RNAkF5dIEnrE6U1jZXj6U3MPBu3kuKwkMgRRrzO3jBnApFeSw+oKKVyIGY+KYHCEdgiUXiS1 QACtnAZM9ufJc6J1ERkqiJGBpNA5Ogzldkq+S++/hmARUVBFkZj/pjYCULZlis4mRv0GVLRKwgrT lmQsApF0IZKkZ7cE6bBokIqH+BDtjrDuRc3TveovFjLc/ZpRwbWQxHLRkJf8p+QI9dooxStcAsnV f5sDqKTScU9ssIigYm5XC6/oohepPmOUdgEW9+S3xFjJBLMsfK9aTMs1hYERTBL8B7vyjPWOZOeu WXDuH4OVqkYRiCtEDCBeEU8xDSRrTv0HvLIqoSOCRbpJ6Y6I1GIMeFZx04k4mwVmiaE1cAVRNUqP AlE7nW5AJr+qcA58deaQ4BTuIVdMYZM/6RcbM/UcNehKpmKqhFdIWsWBwLkhzr+JEApOlmuTEyDv +CMtGyxy+1pFI2AO6XOXzns4Y8ePkZxEO3kkmVhIxx6WahgXBR2IyZ/xY8eJF44iCC9A7vRDsnRN FvhKxBGc5BhSlI56t1wU2KYv4OSGdRGUHaPSM07YVN181DSxk0xioRc25nhUoUgpPC0bUz2RWJdg YQphCqBoAkGjFDuYqfzWeeY1upvmAti9e/zYsd7uMS+wZxB7qRAeN25sk7DTs/GSayXJHX8SLHmE uAV0wz0OHiYEkLaF9OYqJFGeJXVQCDP/MZ79HcyqB4mRVx/u4Jif+ciHr+MBLpOe11z99je/+Vj2 d+ajtTdc977nXniB16XYqiTa6Q3cdLGNK5v9HjZ//pNPPeWUjt9rdVtPflRTUnD8NLPebjGZhiTk BXcXrwBdfdXl8+bP471kDKVFogfNiTDOZjHv0qmBhCqppJFWibkJJqmMHlVNbOUhnJAaLFWAK3oS 5WkxOzkwA/eBK9f8/KExb7zRN9ytcoMgLYdpHJi6WSmkQw5SvHfEy0FcuTOrFqxNI8FajpywLeQi bbFWLDO8NpiEIcJRiZCcMHECG0/wwWx22eYZLBvlnnTSicw4n37ayXPnzuFb2rVWyCZU+dSn01Cy 7O/Lg2j2bmHPSF7SPPqYo44+8vCZh8xg+xYc5bXXViHYAAGwsTOiLYWZqh3bfQ8iSerhjyN6SD7a btu6bcKEcXNmzcTtTjvt5PPOPXvUyFGzZ89kG9Otm7ew/OScc85g+xfvWvcM4ln/aaedxBuU+Dg7 rPNC9qmnnnj88cey/gM+fJ3mjNNOOeaYo9nCkJeODjzwADbemDVzBph4Mc9yzzz95HFjx7Muh9HF vLlzL7rwXB7ZMDnLp4lod+mL0G3chLHVDikhh/oQKMmJ9n6lChldVopQcO/qwCgsFmINuvqiNezV z5a+37p54rZtg4+ct+2aS9bREzbCckjDAypNejWvxdsWXuemXMIHophPjs1XlKjcWoSYNAYmNRIk NadgJTGSRZGjjjqMYvjs//vHjzzy6LvecTVFcMwxR/zbv3/zD//wz6cfMO3kk45nKhK+8pOg9NMe WEV4d5cVFMy+sziH0qFlemLxE3fedQ+fRWBqm8U6QCOkuByw4dcawBbnMmT06PHDhzN/Cl3BZEWH EnVBgDUeSnlPm77/hnXrZs06hIfLTz/z7LFvetPy5X7Q47K3voW27sILz1u0+Inzzz/niiveSpTt NJY89zwP/2/40Af2GbbPZZdeTGPw2oqVN954Aw8PTznlJNbgwPHDN1zHOoELLzx/8cLFl7zlgrdf fikPcs8950ye1NBO8FFtzH7VlZez2u/jH72ehQF8dOh3PvObbGjB9xVikgisvFoogsdQukB/lmpH Lc727pkUb8CpAoC//NqIMaPf+J2Prrj+HauPPWzLo0+OemjRqK3bBZeQxW/X26tbaf+ka3baleKJ ILThwGLnwswZVH2h/KbEkBTxCBAOylaJ6lLQewbzauovFjzETg2Hzp/H0xO2JFm0+ElehZ9/6NxZ s2bee8+CNWvXMG1ovY8wTXMpME7YvXLFKl6KZmnLSy+9RBKtOQdLMvabMvmRxxf1+AhdisRWhlVr EE/jh4wcPW7Y8JHmY0isZ4aVxWoiS388aeG5PK9Vsrpk5Wurx40fw1qVXyx44MorLnvq6Wd5Bstr xICfcfop//RPX/7GN78zY+YMHvOSQu/y3//6H1mwhD4jRo5409FHsePDpo2bzj7njFdfXcE+Mzjz zTffun7jxo/ccN1/+9zffec7PwCSB+v33LNg2fJlr65YccKbj2MJDK0R79GzposFAzf/5KdQbnbv JGzRSK5yyUd0ddBy6NVhGBWAgzIaMXzPfpPfYKP+D12z+lfeu2bfMbsOP3rb1g2Db7133AHTWOk5 mLcby3qhJBYE87EzrnECU+QjSR4D+IFqXQkmAicDjmleidJ0UaCODMgvPFHjQjmJYjlIjBJyvfQJ Jxx78cXnf/F//qsbSu0ZdOqpJ73jmrfjijQGmzZvwjuKTYQofioNCzpwNgziYL98bANNGuOjjjzi xZeWr1nzetWWslIoaKQi5bm+j5yAJ+KZ5ZaB5In7xyuag19avpwulp2Kljy3lIaO5ZDsQbPi1ZUs NmFZ79w5s/kYAw0GLRhPdym713l1O3c669etp59jXTiduTtxDx16yMEH8WGyW26+7d777v/C//zy YYce+l9++7cOO3QewxRWtsJ01arVfPjh3HPPeOc7r+ZzVawlYG0SW1vxGJOPD9177wKHbz27R6HS PGJz5+vwROlRIgqoRvRRLVrJDCvM9nFu37QpO991+Zr5s7bPOWT7IJ4L8bdz0OwZ2+fP3P7uy9dO 34/X5APaDCJWSPfKglgA9AV+aa103yR6bhmRWaxANCq5iAhGOgYl1NtAIjlXFjteeeUVX/j8l1m5 RxVl/elPfvLTG3/1UywAe9c7r+RjOhC1W5CpR50ThIx9X7QPtUF9jAR4lPriSy/xhK+ElFGDDtu9 CLR+E18ExG5ZX3R+wZtMeHKBytZNW1iKMnPWDJa1PbPk+UNmHEzvxQ5dCxcu4iswCxctZiHqqtWv r3xt1dve9pazzjztwgvOozFklOzmGb6ZNmTk8JHspbF5y+anlzy/9vV10J8/f94xRx35o5tu3r5j B+sYVry24tqrrzrjjJMvuvB8Wku2BsH/HntsIRPwLPFigR1r1Y444vDHHl+IjDFx7IfUNv4qVpbx 0txDpZtxmr0B8teVLeu/9yx9efhffmH/BxeOuunO8XtwDnra3YNuumv8Q4tH/bcvTnth+YihQ7SA pMKhwk4hdP2x6Tmq8fUGxMmrhhHUEi28SdZFmwgNNyqIEDpc7c4skz3Uvc/+l08te2nZ+InjGLeN GjXiwzd8gJWnh85nSHbIK6++WpoHFZqaIaS5lqT2d+kldR9MyeZBS5a84LObAIAAK5gFy5MpEaPw 7V+GDx9lmtsrcKlcQeO+Qe7bs2XTFj5Pz54f7BTAsyKWd6949bUnn3x69uyZbNXFTmeLFj75yMLH Wa8wa87MBb94iM96sAEEf3wWCG1pGB97bBGbjJ11xmlT959y//0P0MTNnTf7tFNOZgein/70bmrD m44+YuasQ9it5dklz7Pw89g3HTVt+rRHH2HjkCWstObTM6xtpntC7ogejXQGW2mU6jQsVYipqGVm 0ABg6CRkqpo1oWAH9Z1x/MaVa4bece/4l18d+k9fnbLs1eFzD9nx6soRrKGxmsQqjg9SrnKPkVrA 3gJKjklaLaYREInORsxik2sMb06qYlEhDZmUs2QWnDEM93lIyxZckydNJMT9AZ/yeHzhYhb80o6y i9PiJ5/83vdvQi9LWCUhFzpFtopRuoN4fr5u7XrcYDjePmTI80tfLFc2T7CuwklAT2EgShaltn3H 1r5JUw8cP24SUHp9IMoKpMSa+Ay36XQXDG52M5yEI/0FIg3dh5Vtu7b7LgZm4bsfLEDflSxVpfGg GyWjPtvA/Qi4jGO4XYIuLQovX2yne0/byOoRWLBkqxyZTASEnxJEBbYCe9e7r/nrv/77JUuWYg45 RjNOFAv1kTqS5s5TaYEMKTOfb6EtxQdYClJxOeACFfTipvXckzcsenbkilUjzj9t3U9+Pm76lO1H Hbr9rgUT0IRb6xjNO1uAY3Y5lAdAlxsEhn2IikHtvpDMwlJCuuZuoCp8s3CyMKNOZFjZRND5dDRT OCujA7gdO9iFMjV38JDhQ4ciD+yGDRnCp02HszLZRRQSH3BYB0oMbOGaqDZvK0deGfFpudbLkomg qSDsJcJ/qchYdMjGDWv6Jk85cPwE97erkrOESvIOWGNw5CKNHhWLyaMAMXd6JeN6tG1s6ra3RVE7 OYTLBpSyTbT4qAMLtEz1FF1+ql3W3bX78CMP27Z1x3PPP6dzKE+pIWpVa1ZTMizJoCf0wqZklrIE IymZ8jVCuRLQaRyAy45nyZ/60Iq/+uf9eU/Dwh2i6IDCRPMZNkFqQLfixNVxMuhZKsrcOAlcUdhz yLPpZ0ZqXRkzhU+JOi0WXmGDt+FPWgfE8Azr1IxOJCURIwU2EMp2Sx3NjxRm1mGOqfzT9XAGn4h9 XpghbYkF4MaNa/smTz1wzNiJSsOrTQDHP0Br7PTDkEOheJnUc6S6ABXOStHokmm4TSVRxlq5LFVZ nPfK1X7mkNgMEWpUGRzOLDZWY/ia5ZOJRiQwugN21i/BKIHoUEYFAFII6peC9UUSqk5jjbRCEV8B 9ABYTRy/a/1G6ijNHu0N8ALAVEeNUsVT+OiFcUgHsQAMdu1ESCsOMOEVm8ZaQFmoln7vaBKTHqZw cL7HsOpqHAUIOZLQV8/OEaZVEOBGZdoU3l7DepqlTFuw3VmqMaOyCU2zbscisERKmk0b1uo7xk1M K+cLcElIEoB1cE3xlcBKbIKIDUJzEMeaXaIBY14CB6hR6ZR8gU5SUdHfu6xOzqAwh8t3JM0deDQi JuE/ekA5hwny6mQDD8olWVftMTgpoRBI2QCxeo2dTjGKTIqsnsGWsLldTnAqAV5STIlStkVOk4aW BHTdhg8BaSphUsxOntxMryzDlVyqmKujtNSgCtkFclXQ+vUHCPWOwgaJNMO4Bs1uhGu8OvWCX/4h Pv+5KHrCxtpBMI2V0SRLP40YV4FLSENCNE/Ssnq9SSKIbTOUuPVPgSSA5Uq2ZIWIiRUTUYLghUbj FdQGkjBQlQVi+DamJJoSUE5dK19imAoAR6Dd9cNxpg8KavbU6q/IXDJKKDIN3Au/jkiYwKiaALMq j3xSi0hSil8AKh76BqM1uhLWnaqwjZpGIv/5VeMhHbOSHikklFpmWn4ENJ7IxPNvRg4CLQQNefmX oggfodWlwRhtpWKaoF2m6vWyGu2wrNOAxw0hFv/oWDRJIBBflFmcJAQFUsYCJpiEeFjVRdtts3Mo VQRLCidFLnGafl2kIBOTfHeEmzwaXldsLT+QEV5y0IhfgqTkJbSpgO1NlDgNPu4JmPIKIMlGqlBS 1lUIKqMTgmAwJVwMRYlbBL+oyLn4eTEjaHWVTTsqV4hqq9CgcyPZCFVFIH4PqQIo2JKad8nJlK5o 7aQLrQglN7wiTvQwh/9czKKmaZfGu2PQu9rgN6eyNw07T0HoT6j0YGnaQMAoPm8ENck0vRCbDEqR o0vvErzyX/BcWyGFjKcmH8HwIuoicPvy1Jz+kZoDxq5SAZwRRnAyqgW5V9MiZufHHV1ZhVeEiewV Lz3M1CymNZFbNhca1zagIU/TVT8ln2CHJBkkm2Zy5UisYv1pJKRsI0KsJZRY/JrUXdwrR+C5MopH ScbJfNACocApK9RunFgW2rGvpqCsK1fZGd/v4Q7dXQYkWJXdMg0SjXg1czKyiN3NESDVhpB3zAwU LRCj3Ow4EiXqHXa1q94LJtdbMnWm4VeSLtFqmtoBNlYyK5zVKWLs5pakDRsdpSt5suw+miIhh6Te yMgrr1jSxbQX6cLeO0wVzHMo5KBAAQYcqGiJqQQsKwjntvachAE2qIRdBG9Ys6g9b3rEWDpZGU9p qcZEM1IG1B6N7N27doLs6ErzSDS0LCq6Q9Fd7oFhoC01NRW76PiGPKPypJMYu7o1KEwtXEU0LOMi zYUbgyRw2ofdbXmJFhJEAhM4whWFQl8fWzwwFRqaCorckyZO5Ik/Axugu7G0Ril3jjLyyaGO0ajx gNrU/fdbvWoVn9NGL6TM0JLcPd4sRjGK3ofmDsKdWoA0j6fLyYDDVsVUW4Dvf/NdePUfiWhl+Zde uanD5vV2nRbyXRuaCh4P8Y48zzuWLHmeNzBCskzQ9IIAiUbCgBscpnOI4TMSDy8gyOxgiiP6MIPM vZX+UmBwrBYr0FTMZIWUkpYCdQOYuSI2N8BWO7ZvRxeeV2BAoChDng85LBcDMZDI0bfuwuIcbvi9 7baRNyPwTEqREq/wDRWMoMODIlctaVApIyfR3duZtmBXTV8AT31VgxIvUERiEQ3qfU0JT3O8xo0P +HbrPtVO1J00iCkrnbQjIhmquCI3ZCgO2bBuPanD9hnKTTXWYepMruxWk28SoKFVAs4WX/DUkxsY 1eCg6YHK4Kpu8iRWVgYhT2eicykjnUSbSClCPpsrikmeaKlh+eKLL0Eci1EG0IylmjUAgIYoAGgH MTMHKC5ZHFLaGwu5KlUrM4HQGZAr5axUVSrRntxqbdPUySK9D0bu42PDMMY4hHERHSI/6FP81Uc5 sOZTm+ThONlWhYZVDn79lOaXXSTtLgNMefCQkIqhiTm8sS034dpkVhV9Y8OGTbv3rFKW1PqyGVil S09f8JQEhUr8WELiliSw2ssDsNocuKwLN4EEAJM0bUhc7aWdDM/EuaR+UFS0qU4vEzUn7ib34OGq 9AhyrJpCqo9EXfto2SIPgCmvTsa0H3ioDMqBrPElVmOsHJGiYABMSolIRCeIzLiR5IVVbw+7nMSD VUxDrlEhE5SUK/vhNMXLaE0MSYtHu0Igs3zSVuGiHRs3yqloER4Q3aR3sHEqhvEVxXTUZQxoIyDc BSwjWNSWBwnOfUhQs8T9Pac2S5Un7bztBh3ms5G7RgQERSll6xweab9Y3dqHgbRz+hk2aPVpdaQM Pz47wiuW0AYn3oompT1IoSZYlQ7pnZ5KUywFJh1T6ZHl9HIkDha8nPRBRLMstLiN4jpuQKoS01ZH d4QsjsXZDfybLW18urAAEYNrO0qMivSyII4B4cVoRCHimyL7z7kuoBrJOWHStQMYiuXaN7IVJ1ax VZamlrKQqK/I5o6F4klITc2l2JvwRVtbBiC8EvJkoqVMSwJc9I4fWH8y0+9eECHqa2iyASbiwQTr kauHxVZhr+1S2MZycIFNiq1fz06KpFc5W0jSB4nciFLwLbHSPQMXmsgeiI58i5LZjsK3hcT9O2Jl FspfG6q+RAAhXIILyV/SUdX0YlnCRhfKoHiYIx2OpEimQpXYyzC9lwVW7mXK1g1e/CZlmDYCcmjJ pIRXj2VMpr8GwBPQkSMUgtgSIl8g+kXqsoBLYiTsZUuC8k0LkXxzejpYWyKMSXqERASr2mtQEDjK pf4zX5r9P4peSkCaASDGpGvYQVgIePtpYzcFywjXaTecjRaJZDr0FI5LwHktUTJBkqVSUA8kW6mQ JlJk06o10S3+TDmWKboZ7hJPihzCi66UxprfmGCzKVE1NJOEQIJikSBBuIZCrBQKRhVHC0k/TCTf HeSn7+WsMym3Jg6XunKO6GCQyhFASNVV1hYdQiSbuJW36JuU7oAERpSSqIycmx62ImA3tpEzcE2e yCx86CMarQJ9dAqvEVOGms0VuMgSor+THTL46c09PhfVdxydFbl9DPAnWHQENYZgADx2LF8OyN5F nQBEnamnuYgqWp1eavMWh9YxPwLrh6Wj/Kl5yCtNI5ESlIGH2gIgcy9S7KTDHpHNpH6jKGtyuIQg qOnkpKoa4RsECBq1OHJ4UZjwKooKZprqt0MxEjSrHQT9EyxaCBGnIw1hiJkFMLlV+IkUdsgVgsF+ NxYrAhTl0Akl8aSrhsU31jEsl8ZL3oH0pGCKlptg+ildzUO++IqhMoMSUFjmlJ/aCYRoqJfLiykb O6r4G7I4j1CQOMGYsWPPOeuMSZP3FZBkDkXFucoRmuwsBrv7Z/c98cRTCCAfD9kUNJcw5kpmeaU6 V1UQKsAiqFrizV7eUBBvigCRXAsiR6CgCS0ISsUc/h0xuz7eapA2DyPUDEYhAlHFIMOiJi3TIlZB iZsjFO1GBQ1ToIimojP+8WMJPWDz4buHr1xIvZfeiSdFEqXZUeNesHOCvXON5YBSyCpeb+RYFMiX ZY4YCjMzLkOV9CZhYpmWmjDuaq6atvTCNwEoHMhJBYmmycQ/4K5XlAG8kidoR7OFjPpfdUP2xCTj qR2iDcAzo/7bDAf5FRdV2ACX/kUGCCqlI5DQUs4q/Z4HiMURbXQ48Wh7bUhUPgiybfSjago/aGWq 0BZGlwxEhAmpRiN0ymYCRTEuiuHwAe+QtUekGaB2WnVrWgQL12KdF9cAxO1lLKlWRIRK3wCGovQj XW6bcmuhv5EnxxKocc4lBBWOHkNioa7ZcZVd9P9+FyZaBJvWPwaUP/cT1CTam3aAm6rVmLn9ZQ33 ZB47RUOUKMamasWyEfKFTzKVk7yI3JHviBA3J38dHGKlRHVI4Trz4PXQxxI2GORAM02hY/vMupgc 0ZJfAIlrrFRu6zQEnK5THDYepQGhanpLFl72/3lqXxKBx6HFtYPGgqp2kYJJpbNctXCs0bQlp3+d LpBON6hNCIIXJSoaJv0nwECOgF75a2L0g+wdUjtkA5AiYlJTXfEbBFHmmE/Wtlm0GLZkIasM6uU+ hZPY35K93aYfMJ37SkDjtuonc3v/XWvXrFvDbrZNBQ0/hPssvlVnO9LHeAJ2MibeocuSg+/nPv30 s4jH+w28aQMYM3fqBXEhDCpxQZfqkmg6CQSkAMpTxtFGqKFNY1YZMfTCQSwkrZBHIaIUWU0qUnga KsiQrihwIeVJMABIwLfwjwz4nGMcMWx4Pr22jjWO9D6CAZymuOpLMaxUPAlabFackkBg+lulQ0pE zVtbOs22bZvhwnxmzQ+UhGrNAXQFZFTM4GdqRVu2ivdXz3APgsjKiBR4YNEAG3YQgQapHUTZ16ht u8OPxgQspoPZxBX1N7HFVK00E03KXKEObyZmyfJDAJFYy5MBH3yHz6s16Sxo22u4h4HKDBu2z+Yt +g+f4iXKGJBXmFhQHtnk0vmGJKOPlJEujFqSwOGoZSRePq7eupLSYqHd2eu5IZOqEC7+Q7okFppp qhVfCiOICtlH+8mUiYxMybyhQojL5xOpQzNmHIxxf3zzbTZVyYA0GxgdecThvGPy7LPP6Q/IsnsP b2TNnDkDlV97jc0hPeB3+GFzed1r4cLFGzbyPoFDnLHjxv76r32M1bhf+MKXu+9Yyy9aBq3YK6a1 L3onvbzYoOA2nhRTMFtOzNeVlgqakESgYhEN2pIxkLiqFc8hq7Fi+nzN62tXrlzJKnG+NBr/VpAa HDh2UmV8jg1QvI2VoERCh4wcjk+VUxUyqEESokrnHBWvTsB59MiRfHyOFfFDeZCAmc0PcCsp2naH yE1qUSNtCKcuooPNQ/HqNBCcFLXSSSu7uBMptdVVoAbJlagNa5cBlpA06rx3IjV56+X4Punss8j2 t7yONXbsWNa+82YRk9DKj6F37T7iiMPmzZtz0EEHvPIK+4Fuhg1T5mwDzHbbLKnnu758NhD5J0wc zyuAfNWcluO++x+gx+Yz4ldfdS5bGbOO/8knn/0+u7uyKX3IRgrpR+RKSkTpCAhlsIozc9h2HBnR KnqZPhoCydu2VEIUopZaHVOLUZ5CYdSFEs53aaMiqd2kjnUUYdDU/aYceND0p556ZuqkyShed3lo pBDc9LGJ+57dLF3esH4jTaCmU9LwUkJljX+E9YCGCW5Ksm3rdloL2h+2Yj3owAOQh7ct1qxaRTpf cgeZGUsVwBORsQ0eYJppQkXoChFqKdVYRcmUhaZSU7VRyAAKSqY3BcX2Iy6iTuLr71iFQKWUtnJL PEoJKYG+PbyF9fLLK3gtgB2bebzCNKh55IQJewujF4vst/NqJRoP5m2oN1a8thJ9aTzwBuXWDlt5 K4dOlrMpPCfaZwgvhgHJ1q7Pv/ACa7C1ZZMhEHIwofGKTxNvyVQu1DJOStqP5Fn6GUKJRkoRxLZA YS2HGFoZIvw0YoHRQWcTPTUuJM2LBQKD81WgEKSpbblQTjysiZCi9Y6Oigl9U/Y7eNx41p/S0bid PMRgy2iO5vTEE47jDbZVr6/hE73sg8vbE/mq7RDeyOWFF0zJDtoHHXQQu1Y+9eQzO3f5MJY96aBS Hog8pSRsWDONq6IRvFtB7iVXTTNXVhmntR8lkqWCBzLA5KHgPrzJTpecigLFgBeO0jemxZlkafLi 3dy5s/lwM06AcPp+VbO+vlEjR+arHjtruTLJ1LJRo0bxDgcvllYpkchWi7zOysvoyg+b9H3s60on zbdkQakHwski0xKwmZVNRKcOkUYkjW98Gp2E5OEo69GxGN5Jrl8mHHCAge+hFfUwXmLTmHwvcsgp zXeLyMbnKm53QBuJlw8fMWzndsju9tNYjqUsiLT/CEcnQa2h2hTBEj5E97A57JpqP1JDdQ75CWIF Zm/hERMnTuSTmCOHD0c6GlV6Mr6KTaezbeuWobuGjh47Zty40ejmYFdkxti06qgTWZsGVbiS1rRh gCwFYzwHBKI5nOOh+qkgoatErdZEMFghcauEISxOBXKJlxBveeyt+PzzL3Ql5lVon90MTpGTovPB L0952Jdtk59s1hIeFBwUdu3aXCWqsXwgOmTlylWE2HzcR6YK2CF0jKWQDLuB5AfEVgKyUCeVDkw2 AmJH8uuViDJPUSRfQopiQhmmeJkonZR20bHwSFEbPl677/77TWFz/nzi3sd3uqa/CMzdwKBd7HBc RkgJhocQcYle/4JTlUQK4SEPXIs3sBmIsSHHiFFsJJdRkHkYFpn28CVm9SHknatPoglia5+bxSBF C1ERh+fJVJNWOKqinsBGXeMesjUtkwQmVgbeI9mgWNUyuOL+JDg5idh/dKqaQti3WLOeFF5hQAmh rr6oJt0hCcve5jpSaeJkyrva8AC0tFQ7xzGlSUdG+8hI1LRn9KR7TyJHkyrC3DwD18mPL+YuvfhK ElvwfK2IkxqbaYiQjzPFMmaETiQXnCh1m4EXktNj0oQDKCzDNUVWVdoXPrUszaZpx8e4HtHajyQb B794Yzi+bsEbs1SOJ15+ddK+E7b4yrUmow3kbSheheKYM2em7phBODRVMyIkUbYiFG+zDZkCF5hp xFiwc5RQMKvyI1U7AQkuenHm6FmhZfcuyZZoLyUBWwjSOiNKIAteBkJFNhcTCOtRrBS7Iv20VURb mJ5QgapOvD6ZkVgqZhYR6hKdUcMJekiQIAzy4VuZhGmWMj2mkrI6qYA/bSSZGCvk4YuS3pJUtYHg HkZRvObIM5IlS17gdtWRTIZ9mq+Jr9/nliOC9LQy5tHuXwYatGnTxxtyQxlkQGf0qJEM4ti0e/To 0VQXlnJxm0fPhpf0bFTiltgpBcs8LASxNBx9cWBBB+tRzSz1UOPkqXO1KInvddKbIARkmuu98nqR UApQSZYMgmnQiJhlg0crlDFED9FAJ3DPdkrViUQL1EAkZwHVoSq9WIKWcDjCI5oGsF+vXy6EGCM0 ymaqKVuTAuvAtDHRemk+MwVWMCWKnHSiTiyw9TVadXxiKHcNySe3V8c60N412P2uADL+IWN9vkFF uCT18W7+6LGjaT8YnekoTEcOY9VlDb34WNUbOB4vhdpEwztdqUSIIaX6AUpVjKYxVOQVhCTH1DlU yhEtCntv4pxHzN0JIjQJNW8mphmdGZJVdDpq/Zm9dKGCEbkwEE1JBTs6TRIuFkBY9if11zUyBjAv +j1KZHV6IWNFEBz7pTWK04KidzbaKQpN37unJANhlVdGxPgHgJ6h55FAU+xuNWXrK250oxUAhh48 tEOiQhCg/w8xoNWgbDEQTobEJdgRaILUKjfzCh7DlQX4lsw99/2Cm35vq/hFXxowiEuka4ChuHr1 arSmcJXYSpl6piVF2u1HsYnQhnHv0Kq+cpgK25zDWw6lLdfgmh2+ZQsMYQ7IvULqpA7BBh5Nu4yi DBHFqUGXJCvbQAnSCIa0YhRaYVVEOf0lTeFL/AGNGQmFiQcUHEDoV+XXIUKtBAjBsC/ZbNGYkPD+ JaTDS2B7BUFi9GAJkX+EhxORSMalNZPRQ3MpkBqSH4mxe0B75kmgctPLBKzTmGvaj+JRGiiR1mJ0 wcwBI61MLZOq9HhueR8x9Y4cUHduHyytXdPFEdjceg8xXQutDcSimm4uiSZtT8nyrRJPgkofcSop pUjzCCLpPayAtViwyojCCOuh4eTpS6eYIEcuZZpGkOQOAXL8OCBRVFpUiI6A5k+YE0EjRoFPdZBR /s3KITfEKM2KuBEP+fGHmCTwQ04aGv40Ig0G5VpzI8zZ2d0MKEiwYeyRWisdOHfNeKjXCWpQ4le1 Qo4cnfCJVJKSVJYTO/x1xuaqLNhAEZnN4OXjmAgQ5GxIwRCGg+FqfQVeOlIFnZM5dnVZNmRQ7Sgg krFexuQNPiXyv5s2w/UIYRAI/un7P3NnZoltzlNCYFkwRut9jXNUMYxPRYwGY1CAV5ZWQmyCWAbL llhNfFPtzFv0aJiMNppaFpXsVAjMCfGQao816oqQqckrSCrPJnbmKGwOa7C9zonq/ndSQuIFG8l3 lmWgY306Zul31snBGYce8wCH7koeL3rm8kFxG8eQpHcRkFxDVo2MR5WlnbRd+Rw+Jj7u4idebdHq Bc3/tUJn9cur4Ji36s2HvSVZvQUYGVTLdhG8SYmgr+YILEY0Jbc65z7Z8dktjZwf/IYaz11EYCry aTNBFyVjJ6gIyVMfk3qPQijHUNl5pZ9O+z7AVHEXT2EGHXge5Impq18UmpN8xznGpxHvR18Mgfor Y1MkR8+BNTaO36bNkZm9nZXLcZpLzj6SsuXVmBoHvW42dGqQNxXEwIANGEVjTuchL/doPe3T2ceO 5XEndvpgzMXNFfxalLS/71MX8DpBS7Y24TqnGU3iOamnG13lz5TR6vcFH3DOii/CASwQxuaXKX8R NDZQcXW51ajedAOyiHj+RRsIg42fKW6zMJwfSKq4NDX9TjtTx4fWz14k5pMmp01zcQxjEFsRE/4X 1tEsrNxMBdDuWhZd+AaNWSp3rhnFo8NP2DTTzX1o7EtlfL0rKPXvNE3T7ikucgIzJCj+yN5Q7Fwt ylhoroAff09CwaeKWYE5/tHLNTysgqZzD/x76ncqSCZfXlMUrgUx36SD7VA8c2sVtKerjckscTYJ lviGZVl5HOxTlU0OkLlbIN83yCQ+RQ+uWCKFfEmUeGF18SZIDf3tA3fDgOFdw8r0C0DOTpAvX1+Y 6xsypayYc8aOoLq0oyTvSvX5pYKpMKte82c4c3VYjwaqB8MaMLRf1UWq2PajoUIAAAAASUVORK5C YII= --Apple-Mail-95E9B4E8-7BB0-4C87-9CD9-C6EE72DA9445 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit > Steve > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans --Apple-Mail-95E9B4E8-7BB0-4C87-9CD9-C6EE72DA9445-- From nobody Sun Apr 3 04:44:30 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5244912D5DB for ; Sun, 3 Apr 2016 04:44:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.91 X-Spam-Level: X-Spam-Status: No, score=-6.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fBi-OuN91UQG for ; Sun, 3 Apr 2016 04:44:26 -0700 (PDT) Received: from zinfandel.tools.ietf.org (zinfandel.tools.ietf.org [IPv6:2001:1890:123a::1:2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB03712D5DA for ; Sun, 3 Apr 2016 04:44:26 -0700 (PDT) Received: from localhost ([::1]:36504 helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1amgS7-0003XV-Sy; Sun, 03 Apr 2016 04:44:23 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "trans issue tracker" X-Trac-Version: 0.12.5 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.5, by Edgewall Software To: melinda.shore@gmail.com, linus@nordu.net X-Trac-Project: trans Date: Sun, 03 Apr 2016 11:44:23 -0000 X-URL: https://tools.ietf.org/trans/ X-Trac-Ticket-URL: https://trac.tools.ietf.org/wg/trans/trac/ticket/101#comment:2 Message-ID: <069.f86ac40b1f1dc9bd15e414fd5186af98@tools.ietf.org> References: <054.594fc339510384b88e41096bcfecccc3@tools.ietf.org> X-Trac-Ticket-ID: 101 In-Reply-To: <054.594fc339510384b88e41096bcfecccc3@tools.ietf.org> X-SA-Exim-Connect-IP: ::1 X-SA-Exim-Rcpt-To: melinda.shore@gmail.com, linus@nordu.net, trans@ietf.org X-SA-Exim-Mail-From: trac+trans@tools.ietf.org X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false Archived-At: Cc: trans@ietf.org Subject: Re: [Trans] [trans] #101 (gossip): Handle Shutdown Log Case X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 03 Apr 2016 11:44:28 -0000 #101: Handle Shutdown Log Case Changes (by linus@nordu.net): * owner: draft-ietf-trans-threat-analysis@tools.ietf.org => melinda.shore@gmail.com -- ---------------------------+-------------------------------------- Reporter: tom@ritter.vg | Owner: melinda.shore@gmail.com Type: defect | Status: new Priority: major | Milestone: Component: gossip | Version: Severity: - | Resolution: Keywords: | ---------------------------+-------------------------------------- Ticket URL: trans From nobody Sun Apr 3 05:32:51 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 46D3412D1BB for ; Sun, 3 Apr 2016 05:32:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.91 X-Spam-Level: X-Spam-Status: No, score=-6.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4cWnYUBaloCq for ; Sun, 3 Apr 2016 05:32:48 -0700 (PDT) Received: from zinfandel.tools.ietf.org (zinfandel.tools.ietf.org [IPv6:2001:1890:123a::1:2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2794B12D1C1 for ; Sun, 3 Apr 2016 05:32:47 -0700 (PDT) Received: from localhost ([::1]:38593 helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1amhCw-0005fm-SJ; Sun, 03 Apr 2016 05:32:46 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "trans issue tracker" X-Trac-Version: 0.12.5 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.5, by Edgewall Software To: linus@nordu.net X-Trac-Project: trans Date: Sun, 03 Apr 2016 12:32:46 -0000 X-URL: https://tools.ietf.org/trans/ X-Trac-Ticket-URL: https://trac.tools.ietf.org/wg/trans/trac/ticket/103#comment:2 Message-ID: <069.955bbae72567771abbe675ba3cde2dcc@tools.ietf.org> References: <054.7ef09aa7ae3f095e1a81a92258dd356d@tools.ietf.org> X-Trac-Ticket-ID: 103 In-Reply-To: <054.7ef09aa7ae3f095e1a81a92258dd356d@tools.ietf.org> X-SA-Exim-Connect-IP: ::1 X-SA-Exim-Rcpt-To: linus@nordu.net, trans@ietf.org X-SA-Exim-Mail-From: trac+trans@tools.ietf.org X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false Archived-At: Cc: trans@ietf.org Subject: Re: [Trans] [trans] #103 (gossip): Evaluate if we need tighter requirements around STHs when we take into account multiple logs. X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 03 Apr 2016 12:32:50 -0000 #103: Evaluate if we need tighter requirements around STHs when we take into account multiple logs. Changes (by linus@nordu.net): * owner: draft-ietf-trans-threat-analysis@tools.ietf.org => linus@nordu.net * status: new => assigned -- ---------------------------+------------------------------ Reporter: tom@ritter.vg | Owner: linus@nordu.net Type: defect | Status: assigned Priority: major | Milestone: Component: gossip | Version: Severity: - | Resolution: Keywords: | ---------------------------+------------------------------ Ticket URL: trans From nobody Sun Apr 3 10:36:07 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FB6812D62D for ; Sun, 3 Apr 2016 10:36:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.91 X-Spam-Level: X-Spam-Status: No, score=-6.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dl1hxY55I3sf for ; Sun, 3 Apr 2016 10:36:05 -0700 (PDT) Received: from zinfandel.tools.ietf.org (zinfandel.tools.ietf.org [IPv6:2001:1890:123a::1:2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8F8F312D623 for ; Sun, 3 Apr 2016 10:36:04 -0700 (PDT) Received: from localhost ([::1]:36146 helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1amlwQ-0005jm-LT; Sun, 03 Apr 2016 10:36:02 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "trans issue tracker" X-Trac-Version: 0.12.5 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.5, by Edgewall Software To: melinda.shore@gmail.com, linus@nordu.net X-Trac-Project: trans Date: Sun, 03 Apr 2016 17:36:02 -0000 X-URL: https://tools.ietf.org/trans/ X-Trac-Ticket-URL: https://trac.tools.ietf.org/wg/trans/trac/ticket/101#comment:3 Message-ID: <069.54bee2f754c9e758683c2da1e6224f6a@tools.ietf.org> References: <054.594fc339510384b88e41096bcfecccc3@tools.ietf.org> X-Trac-Ticket-ID: 101 In-Reply-To: <054.594fc339510384b88e41096bcfecccc3@tools.ietf.org> X-SA-Exim-Connect-IP: ::1 X-SA-Exim-Rcpt-To: melinda.shore@gmail.com, linus@nordu.net, trans@ietf.org X-SA-Exim-Mail-From: trac+trans@tools.ietf.org X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false Archived-At: Cc: trans@ietf.org Subject: Re: [Trans] [trans] #101 (gossip): Handle Shutdown Log Case X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 03 Apr 2016 17:36:06 -0000 #101: Handle Shutdown Log Case Changes (by melinda.shore@gmail.com): * status: new => closed * resolution: => fixed -- ---------------------------+-------------------------------------- Reporter: tom@ritter.vg | Owner: melinda.shore@gmail.com Type: defect | Status: closed Priority: major | Milestone: Component: gossip | Version: Severity: - | Resolution: fixed Keywords: | ---------------------------+-------------------------------------- Ticket URL: trans From nobody Thu Apr 7 16:32:43 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 06A4C12D65E for ; Thu, 7 Apr 2016 16:32:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.93 X-Spam-Level: X-Spam-Status: No, score=-6.93 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5EINgKLeZ4Oj for ; Thu, 7 Apr 2016 16:32:39 -0700 (PDT) Received: from tus1smtoutpex02.symantec.com (tus1smtoutpex02.symantec.com [216.10.195.242]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 60BF312D613 for ; Thu, 7 Apr 2016 16:32:39 -0700 (PDT) X-AuditID: d80ac3f2-f79216d000007157-7b-5706ee16c8f1 Received: from tus1opsmtapin02.ges.symantec.com (ausy-zone.relay.symantec.com [192.168.214.44]) by tus1smtoutpex02.symantec.com (Symantec Brightmail Gateway out) with SMTP id C1.55.29015.61EE6075; Fri, 8 Apr 2016 00:32:38 +0100 (BST) Received: from [155.64.220.193] (helo=TUS1XCHEPFPIN41.SYMC.SYMANTEC.COM) by tus1opsmtapin02.ges.symantec.com with esmtp (Exim 4.76) (envelope-from ) id 1aoJPi-0006d5-Ji for trans@ietf.org; Thu, 07 Apr 2016 23:32:38 +0000 Received: from TUS1XCHEVSPIN42.SYMC.SYMANTEC.COM ([155.64.221.74]) by TUS1XCHEPFPIN41.SYMC.SYMANTEC.COM ([155.64.220.193]) with mapi; Thu, 7 Apr 2016 16:32:38 -0700 From: Rick Andrews To: "trans@ietf.org" Date: Thu, 7 Apr 2016 16:32:36 -0700 Thread-Topic: Issue with redaction and CN-IDs Thread-Index: AdGRJaeQF6g1W+VjR2ODBtAWi3yQcA== Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_0615_01D190EB.17B90210" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprHIsWRmVeSWpSXmKPExsVyYMU1HV2xd2zhBqcOalqsfXyRxYHRY8mS n0wBjFFcNimpOZllqUX6dglcGW9/HmYtOOJe0XhLo4FxuksXIyeHhICJxKnPTSwQtpjEhXvr 2boYuTiEBN4wSmxcdBzK+c8o8eHNb3YIZwWjxKzHrawgLWwCehJbHl9hB7FFBFQlPt9vYQKx WQRUJF40PwOzhQU0JL7+nAZkcwDV6EosXqgAUa4nsez+bbAxvAJREmebOtlAbEagK76fWgPW yiwgLnHryXwmiOtEJB5ePM0GYYtKvHz8jxWiXlTiTvt6RpDbmAV6GSUOtS1kgxgqKHFy5hOW CYzCs5DMmoWsbhaSullA9zEDHdW2kRGiXl5i+9s5zBC2tcSMXwfZIGxFiSndD9khbFOJ10c/ Mi5g5FjFKFNSWmxYnFuSX1pSkFphYKRXXJmbCIynZL3k/NxNjMCYusF1+NMOxpl7HQ8xCnAw KvHwcj1gCxdiTSwDqjzEqAI07tGG1RcYpVjy8vNSlUR4W14ApXlTEiurUovy44tKc1KLDzFK c7AoifPqVASHCQmkJ5akZqemFqQWwWSZODilGhg3vHROeuv9M3+ijWVgx6XwKfOuKDy3VPPd VzrthpTCjaA/TUn6zK98ZwVY90Wmt2dH+OonWq7KuaN4YJ+l9HFmEcddSttupIkz/f7PnD6h o/5xN9vuHLsyjmkBqulTHzp2HYtw4fr/+oeCe0M77/3XKuHRUz1vsBWt9P1+5PpL8W16GwNP FCqxFGckGmoxFxUnAgB/SGWcsQIAAA== Archived-At: Subject: [Trans] Issue with redaction and CN-IDs X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Apr 2016 23:32:41 -0000 ------=_NextPart_000_0615_01D190EB.17B90210 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Section 4.2 in 6962-bis says: When a precertificate contains that extension and contains a CN-ID [RFC6125], the CN-ID MUST match the first DNS-ID and have the same labels redacted. TLS clients will use the first entry in the SEQUENCE OF INTEGERs to reconstruct both the first DNS-ID and the CN- ID. I'm aware of a problem (confirmed by Peter Bowen at Amazon) with Java7 and Java8 where getting a new certificate with a different SAN ordering from the previous one will prevent those Java clients from successfully validating the new certificate, at least until the cache in the client expires the old cert information. In most cases, we put the CN-ID in the first SAN field, but there are exceptions made in cases like this. I think the spec used to say that the first item in the SEQUENCE represented the CN-ID, and I missed the discussion where that changed. -Rick ------=_NextPart_000_0615_01D190EB.17B90210 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIRhzCCBBkw ggMBAhBhcMtJjF+YRSnnsKbZUFt6MA0GCSqGSIb3DQEBBQUAMIHKMQswCQYDVQQGEwJVUzEXMBUG A1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4 BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkx RTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBB dXRob3JpdHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYDVQQG EwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5l dHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQg dXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkgLSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK8K DcLVLNtnuS3llCfdpb7gsE2Ps2FWPNZ8w/TNPobLooji4dikacW14r/BpkdQXkY5i9WWurVvFL8Q zicTngVHmzF6E9gf2dMCN4utLEfwjoEGpw0wDOv3PA8gHdxyRu6lAshbw8lWaUzFGMGRewvVEwCb vO/DSD5GYCCFKtWQts2LoMwy3bf9QFWyUBxWrsyNd03HIE2nMXbvaJKKkB4IgVayrWmjUtDLHMQj PR+Z/kzoFmOOxgiO9jH20vrldt21HJKjSc3NAc1ozalpuqPrHQ2cpCCmwaDF0UZMF23SrGY/lozg hNQ2/yJZxfkRYKhfBH3yGvYlQmEPxEq4PokCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEANCYVPMCN TUNJHb3pIZLXZpy33sW40ORdX3YiwCb5hDo6+Yy1++xg8ejOBLDI3acDjzDzmN+k5qQx39McC0bc ciA/ru4FPKQzPws5rHB4c0uZK98wwlSwqDtVof4WKM1CvXRugNsnRKfORF3UG5CYDR5ClLEALATQ dKMCBSJjY82DtfvBbWJraXX9XXBBufW/fN++wTJzIiGLWIF7FZF6uuNkSLB/+zYl2pXQ8SQUF90Y gGtGIzlU9Y5iCQQdlJCmm+Yl4kJFqriQrb4Ij6kLQhiUz3I54bFD4CjPt+dabBNrSbP/4xh8iYsz Xawz16f52jpVyVgQ+arvWrbPS0vfKjCCBkwwggU0oAMCAQICEBw3Lcu5cD5rtz7z+tELQgYwDQYJ KoZIhvcNAQELBQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0G A1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24s IEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3Mg MiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEczMB4XDTE1MDEwNjAw MDAwMFoXDTI1MDEwNTIzNTk1OVowgbAxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBD b3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazE1MDMGA1UECxMsQ2xh c3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0ExKjAoBgNVBAMTIVN5bWFu dGVjIENsYXNzIDIgRW1wbG95ZWUgQ0EgLSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC ggEBALbX9Fd7nt9wUT7ISGRoQMGJbj8EkkrtHHQnINo4z1KTPLnRWscXLT5oTmFpC7JuaHn0AnYK +NJutht+e0vGtU/avfhJDgLP7K1qZ+vOBHm9hMzzmiME1s9CP0nOlifrJK5h2TS5Znq8g4kfGJTA asB5zmfjNVCJomx17jhf8fuZrvMXSBsWDxl6NGohZloUgxFAwrCe0NuDzt8E8jJCgw5lewsqjlll eBvJbCxOXhcuMvjK6/ilNC1WjkaIlTWXyaraGQAMPm2nsZED4+aBNRMX855Amtk5zAoKh1oeIiN7 2YaPVmiIIOeGKqY0B3RYTY7cmxgU4RA5xgKA3LeMIP0CAwEAAaOCAkQwggJAMBIGA1UdEwEB/wQI MAYBAf8CAQAwbAYDVR0gBGUwYzBhBgtghkgBhvhFAQcXAjBSMCYGCCsGAQUFBwIBFhpodHRwOi8v d3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29t L3JwYTAOBgNVHQ8BAf8EBAMCAQYwNwYIKwYBBQUHAQEEKzApMCcGCCsGAQUFBzABhhtodHRwOi8v cGtpLW9jc3Auc3ltYXV0aC5jb20wNwYDVR0fBDAwLjAsoCqgKIYmaHR0cDovL2NybC53cy5zeW1h bnRlYy5jb20vcGNhMi1nMy5jcmwwKAYDVR0RBCEwH6QdMBsxGTAXBgNVBAMTEFN5bWFudGVjUEtJ LTItMjMwHQYDVR0OBBYEFKQzr7DDRoer5XhJsrTiRp/qCfwVMIHwBgNVHSMEgegwgeWhgdCkgc0w gcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNp Z24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24sIEluYy4gLSBGb3Ig YXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMiBQdWJsaWMgUHJp bWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEczghBhcMtJjF+YRSnnsKbZUFt6MA0GCSqG SIb3DQEBCwUAA4IBAQChthp96rPOdkvEEfo4yk4Q8auHf5LqUJUlwDdoAvuCrYDLM9TMQzCwRWf7 IpiGPMAVnddFj2ohiX3bYd0tkaqyjfDJDtZQK9YgN5GD0RTO2gHS0PHOOyJBSDJ5G0um4NLofhkB h9RqEE3mBF68RGe4Te7Z5ST+pvgqGzC8v/2xDEZcClXhch8gNU7muFl18YdX9gWV54BcTj0lo9E9 9/2HVCPB5QAzFhHqgHjDnETpw5S3JlpKTEMXyqaWd/5+Vo+ID+jd51HS+BS1u2Dguv+FvgINTVrr IO1ymEh5L3XM4gQrCgD7yajPRf/BIjyF/xzL/ONUoxd8e1gR/E1N98oyMIIHFjCCBf6gAwIBAgIQ OVrt7EotOiYavftZTf7D7jANBgkqhkiG9w0BAQsFADCBsDELMAkGA1UEBhMCVVMxHTAbBgNVBAoT FFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUw MwYDVQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTEqMCgG A1UEAxMhU3ltYW50ZWMgQ2xhc3MgMiBFbXBsb3llZSBDQSAtIEczMB4XDTE1MDYwNTAwMDAwMFoX DTE2MDYwNDIzNTk1OVowWDEdMBsGA1UECgwUU3ltYW50ZWMgQ29ycG9yYXRpb24xIDAeBgNVBAsM F1N5bWFudGVjIEVtcGxveWVlIEVtYWlsMRUwEwYDVQQDDAxSaWNrIEFuZHJld3MwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDMkzz3/cxC5IPK1PgEVnb2v6HNo5VaRHC5nKGTtKfmdl58 yBdBK4SJwGSIHiQsIgItAQc4mmd7MUIQOxt5RN7dCFMDFzxbSF0nIl1GR52WzN8mgVE9+6oMxDKN 5LOckMEKNH13NF7Ebjz/p0v0JaRHEuzG4w12ah3B8GkBKJn0XDRJjZNq1R/fJJxklUWsQcimw7S5 bb9bGQwCipDGDn1WLaXP1UWDqyP/ja6OYyKY3QFlk1olDk5iZ5XipSiX57euk9FigV4Ddu6gsVaE hQR/mZNcNag1rH/RjcVoox7iTgvKxyBh3VVT2dEX4vebLdt2/rwIgz626XDSTeUmJQ+ZAgMBAAGj ggOBMIIDfTAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIFoDAWBgNVHSUBAf8EDDAKBggrBgEF BQcDBDAdBgNVHQ4EFgQUVoVKaC1xEPB9EWKq3dWrwskIufkwJAYDVR0RBB0wG4EZUmlja19BbmRy ZXdzQHN5bWFudGVjLmNvbTAfBgNVHSMEGDAWgBSkM6+ww0aHq+V4SbK04kaf6gn8FTCCAWQGCCsG AQUFBwEBBIIBVjCCAVIwJwYIKwYBBQUHMAGGG2h0dHA6Ly9wa2ktb2NzcC5zeW1hdXRoLmNvbTCC ASUGCCsGAQUFBzAChoIBF2xkYXA6Ly9kaXJlY3RvcnkudmVyaXNpZ24uY29tL0NOJTIwJTNEJTIw U3ltYW50ZWMlMjBDbGFzcyUyMDIlMjBFbXBsb3llZSUyMENBJTIwLSUyMEczJTJDJTIwT1UlMjAl M0QlMjBDbGFzcyUyMDIlMjBNYW5hZ2VkJTIwUEtJJTIwSW5kaXZpZHVhbCUyMFN1YnNjcmliZXIl MjBDQSUyQyUyME9VJTIwJTNEJTIwU3ltYW50ZWMlMjBUcnVzdCUyME5ldHdvcmslMkMlMjBPJTIw JTNEJTIwU3ltYW50ZWMlMjBDb3Jwb3JhdGlvbiUyQyUyMEMlMjAlM0QlMjBVUz9jQUNlcnRpZmlj YXRlO2JpbmFyeTBdBgNVHR8EVjBUMFKgUKBOhkxodHRwOi8vcGtpLWNybC5zeW1hdXRoLmNvbS9j YV8yYzc5ZDVmMGM0NTZlMGUzZTJmYjNlMjM2OTAzZGExNS9MYXRlc3RDUkwuY3JsMGwGA1UdIARl MGMwYQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9j cHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwQgYJKoZIhvcNAQkP BDUwMzAKBggqhkiG9w0DBzALBglghkgBZQMEAQIwCwYJYIZIAWUDBAEWMAsGCWCGSAFlAwQBKjAr BgpghkgBhvhFARADBB0wGwYSYIZIAYb4RQEQAQICAQGdpPp0FgUxNjc0ODA5BgpghkgBhvhFARAF BCswKQIBABYkYUhSMGNITTZMeTl3YTJrdGNtRXVjM2x0WVhWMGFDNWpiMjA9MA0GCSqGSIb3DQEB CwUAA4IBAQAXM1lZbwfKyY8FFxOxBuM1zaVaoRHcKD6EjwhcTlIeFQSGl/n24G+1xpy6NIe7Mwzp EAwVUwzb3wKFyKnDMdDvPIedes3QyC1yIjA3ZViOLNpIhWmalth1ohXYFGjjLx7eAq6GJ7oorcJH ZCWOMNr4Nm82UlZ4WoOw1W9mU2ll9R4rfDxsWOImko7O0E9fvozhf4B224DA6cin71gk5rFzzzKC Knjv2lUSpjNuOmlcY2LFOIKPyFzpGKRikO/LwfWVsefhppBSRGKaxfbKS9QP8ex1IcZgGbdCTBzW t9u/tgGv8+qMCn347fdIwO3qFAFgGfJULuFLOvdwqtkJZ8CxMYIEsDCCBKwCAQEwgcUwgbAxCzAJ BgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50 ZWMgVHJ1c3QgTmV0d29yazE1MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFs IFN1YnNjcmliZXIgQ0ExKjAoBgNVBAMTIVN5bWFudGVjIENsYXNzIDIgRW1wbG95ZWUgQ0EgLSBH MwIQOVrt7EotOiYavftZTf7D7jAJBgUrDgMCGgUAoIICvzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcN AQcBMBwGCSqGSIb3DQEJBTEPFw0xNjA0MDcyMzMyMzZaMCMGCSqGSIb3DQEJBDEWBBSPCzP9TngH 0Q2CM666IfwLWm/upzCBqwYJKoZIhvcNAQkPMYGdMIGaMAsGCWCGSAFlAwQBKjALBglghkgBZQME ARYwCgYIKoZIhvcNAwcwCwYJYIZIAWUDBAECMA4GCCqGSIb3DQMCAgIAgDAHBgUrDgMCBzANBggq hkiG9w0DAgIBQDANBggqhkiG9w0DAgIBKDAHBgUrDgMCGjALBglghkgBZQMEAgMwCwYJYIZIAWUD BAICMAsGCWCGSAFlAwQCATCB1gYJKwYBBAGCNxAEMYHIMIHFMIGwMQswCQYDVQQGEwJVUzEdMBsG A1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdv cmsxNTAzBgNVBAsTLENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENB MSowKAYDVQQDEyFTeW1hbnRlYyBDbGFzcyAyIEVtcGxveWVlIENBIC0gRzMCEDla7exKLTomGr37 WU3+w+4wgdgGCyqGSIb3DQEJEAILMYHIoIHFMIGwMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3lt YW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxNTAzBgNV BAsTLENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBMSowKAYDVQQD EyFTeW1hbnRlYyBDbGFzcyAyIEVtcGxveWVlIENBIC0gRzMCEDla7exKLTomGr37WU3+w+4wDQYJ KoZIhvcNAQEBBQAEggEACJRIQJ/N3kqL7YWalhTNNO4/wf+H/PUzqpnxAVDP/bmt+4b8+kl2gg8P AT2I6zRMx4ENeyCYZXzumKrnHMb8ZXG8IXx10UBRRLtUxP8Nc5rpuWInDFOPXAySlXqzCl+L1Ms+ 5kMrP4R/s24DZZ2WIkJTnNZ44LtQD23AzDDdXy4FtybN3N4WOMunUu0FGketxRF5t1J0UQRBD6ab 1QqY0/AFCa0fbpTM86ROVNAOjSP+eCpQDEmJ/kpL8NHwRjG6PcEUVIbelMKWa6p8vJ/QHwXLZEV3 LOT06lOYDJwdkkrhHhmXAjCjB+6vRB5KYdEgpk9PZ8TJ8/RybiIkWrSkdwAAAAAAAA== ------=_NextPart_000_0615_01D190EB.17B90210-- From nobody Thu Apr 7 17:33:47 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B38512D0B7 for ; Thu, 7 Apr 2016 17:33:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2E_vYMP8RE_0 for ; Thu, 7 Apr 2016 17:33:44 -0700 (PDT) Received: from mail-pf0-x233.google.com (mail-pf0-x233.google.com [IPv6:2607:f8b0:400e:c00::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 37C0112D0E9 for ; Thu, 7 Apr 2016 17:33:44 -0700 (PDT) Received: by mail-pf0-x233.google.com with SMTP id n1so65327137pfn.2 for ; Thu, 07 Apr 2016 17:33:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=XrKmIuw8GSsBUoygGRbxkmfiEx3tWa0iWj+0TAJRQLU=; b=Kx7af2CR5cdmVACGnxHbNdhSl/5v7nxXcXwvO0dQZcS6+elqvo6GAgqbDtA6YX5/nw 4q9+wBMvd9rad+PlGwfwKN7nHqaLq3aDGgWzju3Itu7GDVcU8HH8gW9XSRko40D4Llet sm7YpPCfy2BxVM+F6Yxf1JCdJVjXJjxL+ZJ7RXv4xD1zSsY7HEeoNU6o/W8eIRRF204J iP1wWLwpfL+0OxN9LWf5mFGqpYxeosr/7yIkhDghsJjZW4L1aG27hhqbAvWSv1cusi+A nKZoq626e4dg36i6B0wTU/B6K/wjDqVN0yfYYd8Paa33kBDgBYTJ2T4qsUboyXBQZUBo dXWw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=XrKmIuw8GSsBUoygGRbxkmfiEx3tWa0iWj+0TAJRQLU=; b=TzSnGyr0ayuAPomOnvdSeCDgugMhXjKmkdeV/rR01KECDHfegfvBjWNqx5zPRSfGEu DmeBkwN2fBoZFJEYjGFODV3BIe08pMae6fmsyu4M2tgI+w7upljhh/d9zwjQB9/6wx4/ mzfqzKkiQ3LdjEWoAdQ+cIoNFyR9mXK+qg45PVZYCfg44k46FJyxMQRuVuPxYxw7BpkQ yq04139KQEm+sgcSsYWxejKIaN6K8LKkLfyQeJE35T5dB6v+fDngTHrEpogrwMH0EozN /B6R4153xMTkK1GLCHZ+BKNaLf/D1BjjsUksZpTbL6k75ctJ30hYuUSdnWzO+Kfpi/lz Geyg== X-Gm-Message-State: AD7BkJKY8PKdh/2EW39dLzJSSCQdB6lP3dWcE1AveW0A6LI52DobsFHMwnE0OCuPQ+2vCUVsOP0G17qcNgMY8Q== MIME-Version: 1.0 X-Received: by 10.98.80.150 with SMTP id g22mr8589018pfj.132.1460075623720; Thu, 07 Apr 2016 17:33:43 -0700 (PDT) Received: by 10.66.74.39 with HTTP; Thu, 7 Apr 2016 17:33:43 -0700 (PDT) In-Reply-To: References: Date: Thu, 7 Apr 2016 17:33:43 -0700 Message-ID: From: Peter Bowen To: Rick Andrews Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] Issue with redaction and CN-IDs X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Apr 2016 00:33:46 -0000 On Thu, Apr 7, 2016 at 4:32 PM, Rick Andrews wrote: > Section 4.2 in 6962-bis says: > When a precertificate contains that extension and contains a CN-ID > [RFC6125], the CN-ID MUST match the first DNS-ID and have the same > labels redacted. TLS clients will use the first entry in the > SEQUENCE OF INTEGERs to reconstruct both the first DNS-ID and the CN- > ID. > > I'm aware of a problem (confirmed by Peter Bowen at Amazon) with Java7 and > Java8 where getting a new certificate with a different SAN ordering from the > previous one will prevent those Java clients from successfully validating > the new certificate, at least until the cache in the client expires the old > cert information. In most cases, we put the CN-ID in the first SAN field, > but there are exceptions made in cases like this. > > I think the spec used to say that the first item in the SEQUENCE represented > the CN-ID, and I missed the discussion where that changed. More than just working around bugs in Java, there are names that can be placed in a dNSName entry that cannot be commonName value due to length. According to RFC5280, commonName has an upper bound of 64 total characters while dNSNames have a bound of 63 characters per label and a total length limit in excess of 200 characters. Therefore a CA may not be able to place the first DNS-ID in the CN-ID field. I also wonder how to handle multiple CN-IDs in a single certificate. There is not, to my knowledge, a requirement that the Subject only contain one attribute of type commonName. Thanks, Peter From nobody Thu Apr 7 17:46:26 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FE1512D0BF for ; Thu, 7 Apr 2016 17:46:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.93 X-Spam-Level: X-Spam-Status: No, score=-6.93 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gFoU1N4O47yS for ; Thu, 7 Apr 2016 17:46:22 -0700 (PDT) Received: from tus1smtoutpex01.symantec.com (tus1smtoutpex01.symantec.com [216.10.195.241]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 796B912D0BA for ; Thu, 7 Apr 2016 17:46:22 -0700 (PDT) X-AuditID: d80ac3f1-f79e86d000003115-25-5706ff5dd591 Received: from tus1opsmtapin02.ges.symantec.com (usrv-zone.relay.symantec.com [192.168.214.44]) by tus1smtoutpex01.symantec.com (Symantec Brightmail Gateway out) with SMTP id C5.07.12565.D5FF6075; Fri, 8 Apr 2016 01:46:21 +0100 (BST) Received: from [155.64.220.192] (helo=TUS1XCHEPFPIN40.SYMC.SYMANTEC.COM) by tus1opsmtapin02.ges.symantec.com with esmtp (Exim 4.76) (envelope-from ) id 1aoKZ3-00068S-P8; Fri, 08 Apr 2016 00:46:21 +0000 Received: from TUS1XCHEVSPIN42.SYMC.SYMANTEC.COM ([155.64.221.74]) by TUS1XCHEPFPIN40.SYMC.SYMANTEC.COM ([155.64.220.192]) with mapi; Thu, 7 Apr 2016 17:46:21 -0700 From: Rick Andrews To: Peter Bowen Date: Thu, 7 Apr 2016 17:46:19 -0700 Thread-Topic: [Trans] Issue with redaction and CN-IDs Thread-Index: AdGRLlBDv90LJKX8R+KgQSGr0VhxIgAAXSyg Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_06D4_01D190F5.63A41520" MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrLIsWRmVeSWpSXmKPExsVyYMU1Hd3Y/2zhBuv+Glv8f/CSxWLt44ss DkweO2fdZfdYsuQnUwBTFJdNSmpOZllqkb5dAlfGtp55zAV7XCvuTXnO1MD4yKmLkYNDQsBE 4vlq1S5GTiBTTOLCvfVsXYxcHEICbxglvr84xASSEBJ4xSixeacLRGIFo8SZaT/BEmwCehJb Hl9hB7FFBJQlfjYsBLOZBVQlth19CmazCKhILGv/yApiCwMt6z53iRWi3lRi6qI1TBC2kcTb 59sZQQ7iFYiS6H7hDLFrIaPEnFu/GUFqOAUCJfZNns0GYjMCXfr9FEQvs4C4xK0n85kgPhCR eHjxNBuELSrx8vE/Voh6UYk77esZQYYyC/QyStz684YZJMErIChxcuYTlgmMYrOQzJqFrG4W kjqIIm2JpzefQtnyEtvfzmGGsK0lZvw6yAZhK0pM6X7IDmGbSrw++pFxASPHKkaZktJiw+Lc kvzSkoLUCgNDveLK3ERgtCbrJefnbmIERuwNrsMfdzAe3et4iFGAg1GJh3faV7ZwIdbEMqDK Q4wqQOMebVh9gVGKJS8/L1VJhLflN1CaNyWxsiq1KD++qDQntfgQozQHi5I4r05FcJiQQHpi SWp2ampBahFMlomDU6qBcUn/5OvqpzU0bp1cwfSe6c1OUa+2ro4zTC+bRbsb+Y1u+cacil1S v2q7yY/1c+bwbpwtZVjCbV9t+7B4T/2740IXds+IsL92SFmuee7Z5ECXkM3usvPjdlR6fXx3 eftbxkm6KquOvtk3/U2BLf887ZxLvy36N5ZW7XO/kDuZ+x7L24sT4m8q71JiKc5INNRiLipO BAC5JIRg4AIAAA== Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] Issue with redaction and CN-IDs X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Apr 2016 00:46:24 -0000 ------=_NextPart_000_06D4_01D190F5.63A41520 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit -----Original Message----- From: Peter Bowen [mailto:pzbowen@gmail.com] Sent: Thursday, April 07, 2016 5:34 PM To: Rick Andrews Cc: trans@ietf.org Subject: Re: [Trans] Issue with redaction and CN-IDs I also wonder how to handle multiple CN-IDs in a single certificate. There is not, to my knowledge, a requirement that the Subject only contain one attribute of type commonName. Dan Kaminsky's PKI Layer Cake paper (https://www.cosic.esat.kuleuven.be/publications/article-1432.pdf) exposed vulnerabilities around multiple CN-IDs, but we neglected to outlaw them in the CABF BRs. -Rick ------=_NextPart_000_06D4_01D190F5.63A41520 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIRhzCCBBkw ggMBAhBhcMtJjF+YRSnnsKbZUFt6MA0GCSqGSIb3DQEBBQUAMIHKMQswCQYDVQQGEwJVUzEXMBUG A1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4 BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkx RTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBB dXRob3JpdHkgLSBHMzAeFw05OTEwMDEwMDAwMDBaFw0zNjA3MTYyMzU5NTlaMIHKMQswCQYDVQQG EwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5l dHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQg dXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkgLSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK8K DcLVLNtnuS3llCfdpb7gsE2Ps2FWPNZ8w/TNPobLooji4dikacW14r/BpkdQXkY5i9WWurVvFL8Q zicTngVHmzF6E9gf2dMCN4utLEfwjoEGpw0wDOv3PA8gHdxyRu6lAshbw8lWaUzFGMGRewvVEwCb vO/DSD5GYCCFKtWQts2LoMwy3bf9QFWyUBxWrsyNd03HIE2nMXbvaJKKkB4IgVayrWmjUtDLHMQj PR+Z/kzoFmOOxgiO9jH20vrldt21HJKjSc3NAc1ozalpuqPrHQ2cpCCmwaDF0UZMF23SrGY/lozg hNQ2/yJZxfkRYKhfBH3yGvYlQmEPxEq4PokCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEANCYVPMCN TUNJHb3pIZLXZpy33sW40ORdX3YiwCb5hDo6+Yy1++xg8ejOBLDI3acDjzDzmN+k5qQx39McC0bc ciA/ru4FPKQzPws5rHB4c0uZK98wwlSwqDtVof4WKM1CvXRugNsnRKfORF3UG5CYDR5ClLEALATQ dKMCBSJjY82DtfvBbWJraXX9XXBBufW/fN++wTJzIiGLWIF7FZF6uuNkSLB/+zYl2pXQ8SQUF90Y gGtGIzlU9Y5iCQQdlJCmm+Yl4kJFqriQrb4Ij6kLQhiUz3I54bFD4CjPt+dabBNrSbP/4xh8iYsz Xawz16f52jpVyVgQ+arvWrbPS0vfKjCCBkwwggU0oAMCAQICEBw3Lcu5cD5rtz7z+tELQgYwDQYJ KoZIhvcNAQELBQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0G A1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24s IEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3Mg MiBQdWJsaWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEczMB4XDTE1MDEwNjAw MDAwMFoXDTI1MDEwNTIzNTk1OVowgbAxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBD b3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazE1MDMGA1UECxMsQ2xh c3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0ExKjAoBgNVBAMTIVN5bWFu dGVjIENsYXNzIDIgRW1wbG95ZWUgQ0EgLSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC ggEBALbX9Fd7nt9wUT7ISGRoQMGJbj8EkkrtHHQnINo4z1KTPLnRWscXLT5oTmFpC7JuaHn0AnYK +NJutht+e0vGtU/avfhJDgLP7K1qZ+vOBHm9hMzzmiME1s9CP0nOlifrJK5h2TS5Znq8g4kfGJTA asB5zmfjNVCJomx17jhf8fuZrvMXSBsWDxl6NGohZloUgxFAwrCe0NuDzt8E8jJCgw5lewsqjlll eBvJbCxOXhcuMvjK6/ilNC1WjkaIlTWXyaraGQAMPm2nsZED4+aBNRMX855Amtk5zAoKh1oeIiN7 2YaPVmiIIOeGKqY0B3RYTY7cmxgU4RA5xgKA3LeMIP0CAwEAAaOCAkQwggJAMBIGA1UdEwEB/wQI MAYBAf8CAQAwbAYDVR0gBGUwYzBhBgtghkgBhvhFAQcXAjBSMCYGCCsGAQUFBwIBFhpodHRwOi8v d3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29t L3JwYTAOBgNVHQ8BAf8EBAMCAQYwNwYIKwYBBQUHAQEEKzApMCcGCCsGAQUFBzABhhtodHRwOi8v cGtpLW9jc3Auc3ltYXV0aC5jb20wNwYDVR0fBDAwLjAsoCqgKIYmaHR0cDovL2NybC53cy5zeW1h bnRlYy5jb20vcGNhMi1nMy5jcmwwKAYDVR0RBCEwH6QdMBsxGTAXBgNVBAMTEFN5bWFudGVjUEtJ LTItMjMwHQYDVR0OBBYEFKQzr7DDRoer5XhJsrTiRp/qCfwVMIHwBgNVHSMEgegwgeWhgdCkgc0w gcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNp Z24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24sIEluYy4gLSBGb3Ig YXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMiBQdWJsaWMgUHJp bWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEczghBhcMtJjF+YRSnnsKbZUFt6MA0GCSqG SIb3DQEBCwUAA4IBAQChthp96rPOdkvEEfo4yk4Q8auHf5LqUJUlwDdoAvuCrYDLM9TMQzCwRWf7 IpiGPMAVnddFj2ohiX3bYd0tkaqyjfDJDtZQK9YgN5GD0RTO2gHS0PHOOyJBSDJ5G0um4NLofhkB h9RqEE3mBF68RGe4Te7Z5ST+pvgqGzC8v/2xDEZcClXhch8gNU7muFl18YdX9gWV54BcTj0lo9E9 9/2HVCPB5QAzFhHqgHjDnETpw5S3JlpKTEMXyqaWd/5+Vo+ID+jd51HS+BS1u2Dguv+FvgINTVrr IO1ymEh5L3XM4gQrCgD7yajPRf/BIjyF/xzL/ONUoxd8e1gR/E1N98oyMIIHFjCCBf6gAwIBAgIQ OVrt7EotOiYavftZTf7D7jANBgkqhkiG9w0BAQsFADCBsDELMAkGA1UEBhMCVVMxHTAbBgNVBAoT FFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUw MwYDVQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTEqMCgG A1UEAxMhU3ltYW50ZWMgQ2xhc3MgMiBFbXBsb3llZSBDQSAtIEczMB4XDTE1MDYwNTAwMDAwMFoX DTE2MDYwNDIzNTk1OVowWDEdMBsGA1UECgwUU3ltYW50ZWMgQ29ycG9yYXRpb24xIDAeBgNVBAsM F1N5bWFudGVjIEVtcGxveWVlIEVtYWlsMRUwEwYDVQQDDAxSaWNrIEFuZHJld3MwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDMkzz3/cxC5IPK1PgEVnb2v6HNo5VaRHC5nKGTtKfmdl58 yBdBK4SJwGSIHiQsIgItAQc4mmd7MUIQOxt5RN7dCFMDFzxbSF0nIl1GR52WzN8mgVE9+6oMxDKN 5LOckMEKNH13NF7Ebjz/p0v0JaRHEuzG4w12ah3B8GkBKJn0XDRJjZNq1R/fJJxklUWsQcimw7S5 bb9bGQwCipDGDn1WLaXP1UWDqyP/ja6OYyKY3QFlk1olDk5iZ5XipSiX57euk9FigV4Ddu6gsVaE hQR/mZNcNag1rH/RjcVoox7iTgvKxyBh3VVT2dEX4vebLdt2/rwIgz626XDSTeUmJQ+ZAgMBAAGj ggOBMIIDfTAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIFoDAWBgNVHSUBAf8EDDAKBggrBgEF BQcDBDAdBgNVHQ4EFgQUVoVKaC1xEPB9EWKq3dWrwskIufkwJAYDVR0RBB0wG4EZUmlja19BbmRy ZXdzQHN5bWFudGVjLmNvbTAfBgNVHSMEGDAWgBSkM6+ww0aHq+V4SbK04kaf6gn8FTCCAWQGCCsG AQUFBwEBBIIBVjCCAVIwJwYIKwYBBQUHMAGGG2h0dHA6Ly9wa2ktb2NzcC5zeW1hdXRoLmNvbTCC ASUGCCsGAQUFBzAChoIBF2xkYXA6Ly9kaXJlY3RvcnkudmVyaXNpZ24uY29tL0NOJTIwJTNEJTIw U3ltYW50ZWMlMjBDbGFzcyUyMDIlMjBFbXBsb3llZSUyMENBJTIwLSUyMEczJTJDJTIwT1UlMjAl M0QlMjBDbGFzcyUyMDIlMjBNYW5hZ2VkJTIwUEtJJTIwSW5kaXZpZHVhbCUyMFN1YnNjcmliZXIl MjBDQSUyQyUyME9VJTIwJTNEJTIwU3ltYW50ZWMlMjBUcnVzdCUyME5ldHdvcmslMkMlMjBPJTIw JTNEJTIwU3ltYW50ZWMlMjBDb3Jwb3JhdGlvbiUyQyUyMEMlMjAlM0QlMjBVUz9jQUNlcnRpZmlj YXRlO2JpbmFyeTBdBgNVHR8EVjBUMFKgUKBOhkxodHRwOi8vcGtpLWNybC5zeW1hdXRoLmNvbS9j YV8yYzc5ZDVmMGM0NTZlMGUzZTJmYjNlMjM2OTAzZGExNS9MYXRlc3RDUkwuY3JsMGwGA1UdIARl MGMwYQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9j cHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwQgYJKoZIhvcNAQkP BDUwMzAKBggqhkiG9w0DBzALBglghkgBZQMEAQIwCwYJYIZIAWUDBAEWMAsGCWCGSAFlAwQBKjAr BgpghkgBhvhFARADBB0wGwYSYIZIAYb4RQEQAQICAQGdpPp0FgUxNjc0ODA5BgpghkgBhvhFARAF BCswKQIBABYkYUhSMGNITTZMeTl3YTJrdGNtRXVjM2x0WVhWMGFDNWpiMjA9MA0GCSqGSIb3DQEB CwUAA4IBAQAXM1lZbwfKyY8FFxOxBuM1zaVaoRHcKD6EjwhcTlIeFQSGl/n24G+1xpy6NIe7Mwzp EAwVUwzb3wKFyKnDMdDvPIedes3QyC1yIjA3ZViOLNpIhWmalth1ohXYFGjjLx7eAq6GJ7oorcJH ZCWOMNr4Nm82UlZ4WoOw1W9mU2ll9R4rfDxsWOImko7O0E9fvozhf4B224DA6cin71gk5rFzzzKC Knjv2lUSpjNuOmlcY2LFOIKPyFzpGKRikO/LwfWVsefhppBSRGKaxfbKS9QP8ex1IcZgGbdCTBzW t9u/tgGv8+qMCn347fdIwO3qFAFgGfJULuFLOvdwqtkJZ8CxMYIEsDCCBKwCAQEwgcUwgbAxCzAJ BgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50 ZWMgVHJ1c3QgTmV0d29yazE1MDMGA1UECxMsQ2xhc3MgMiBNYW5hZ2VkIFBLSSBJbmRpdmlkdWFs IFN1YnNjcmliZXIgQ0ExKjAoBgNVBAMTIVN5bWFudGVjIENsYXNzIDIgRW1wbG95ZWUgQ0EgLSBH MwIQOVrt7EotOiYavftZTf7D7jAJBgUrDgMCGgUAoIICvzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcN AQcBMBwGCSqGSIb3DQEJBTEPFw0xNjA0MDgwMDQ2MThaMCMGCSqGSIb3DQEJBDEWBBShzGv6Mr8Y OxfUhBuLO8MppG2twTCBqwYJKoZIhvcNAQkPMYGdMIGaMAsGCWCGSAFlAwQBKjALBglghkgBZQME ARYwCgYIKoZIhvcNAwcwCwYJYIZIAWUDBAECMA4GCCqGSIb3DQMCAgIAgDAHBgUrDgMCBzANBggq hkiG9w0DAgIBQDANBggqhkiG9w0DAgIBKDAHBgUrDgMCGjALBglghkgBZQMEAgMwCwYJYIZIAWUD BAICMAsGCWCGSAFlAwQCATCB1gYJKwYBBAGCNxAEMYHIMIHFMIGwMQswCQYDVQQGEwJVUzEdMBsG A1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdv cmsxNTAzBgNVBAsTLENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENB MSowKAYDVQQDEyFTeW1hbnRlYyBDbGFzcyAyIEVtcGxveWVlIENBIC0gRzMCEDla7exKLTomGr37 WU3+w+4wgdgGCyqGSIb3DQEJEAILMYHIoIHFMIGwMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3lt YW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxNTAzBgNV BAsTLENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBMSowKAYDVQQD EyFTeW1hbnRlYyBDbGFzcyAyIEVtcGxveWVlIENBIC0gRzMCEDla7exKLTomGr37WU3+w+4wDQYJ KoZIhvcNAQEBBQAEggEAciv1WjeRhNjjeE0JNg1ky7FQNLpPif2N0OiKy1xat+ERDn65I8Tcmc3z NxbBU7wzw44KihpZtkUVQTw6EVPK/WvD5hmAR/VW1rUdR4m7OoPbBgJaL5juHKlM1fWWOVZYvcn2 K2Yown34HXBwLMUSqX6H3J86nd/KyVQDbXyTs0EAr2uhvgIK2RHEULfDRDwvR4ZtJ7YhQdoh74/w UAm+BFJIyul13r+mTBcO/2A2xsLqahP35aI4WLQKp/YEDI3323dc72CtYm3J6XANHHVejloUG/1U /Vranx1hu91HjrxoDCOAjELf3sSYLEYZ1A+d5b54i/lYRMRW2i1Yfin89QAAAAAAAA== ------=_NextPart_000_06D4_01D190F5.63A41520-- From nobody Thu Apr 7 17:47:43 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE5AE12D0E9 for ; Thu, 7 Apr 2016 17:47:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t1VyZmaWy9sY for ; Thu, 7 Apr 2016 17:47:40 -0700 (PDT) Received: from mail-pa0-x234.google.com (mail-pa0-x234.google.com [IPv6:2607:f8b0:400e:c03::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C13A112D0BA for ; Thu, 7 Apr 2016 17:47:40 -0700 (PDT) Received: by mail-pa0-x234.google.com with SMTP id zm5so64464182pac.0 for ; Thu, 07 Apr 2016 17:47:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=VmQMJxJ7konMJzgfxWsARO3Kiqau1LFUP0tHwiutFQ0=; b=y7XX9EHv0/3wduAx4pGdDu2j4HsjCxdSlfMGauvNiy2YEjzNeOXjgbSTavb3talHlC qGYoc4OaCEyHn5vhKEiy40F89VIQiPTFf3k7vG4iztXoPsZiU6cg4jQleG8l9lVGXypg sVPTt0SBPJZJrgPvTWe1sctE5tyoSIK4kCeM/kSE3vPDU1CYDPrAlMa0GqUqy6IId7qw 0s97Djn1RXXUMyGx4Eo6maN37B6lHI08Tot1tNhwC6gan5f0Zo9xF2UxSoOZQBLyPZlr dMTVzNeCeIeIVF4OlTnuQTR1vkhySXoDKYI/LzKQQy0W8KBv/4YwtJQS4/mEovasejqn RRww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=VmQMJxJ7konMJzgfxWsARO3Kiqau1LFUP0tHwiutFQ0=; b=CLtjLHOCNFJXMLM5zWjjTmU4BQZbAxzdMg7pGgCgdknVOS62ON3PF4lXYC+PZK6mbH Z8iG4F6XfUlo51SuFmU5Q/bWFrNscyfb1iVAy2KRCQy0MqKme4wJxCSrFh4sI6UDXv+J a9aw8pFijQNiQBcJkSQg4qaP8ogk9NfKKq7GIvy/ZNpUOZn7vAdjHxsMybD375yo/DD6 +1MJC1QC1h3OpXwmm2d3Cnc/AMMyxV5js8m+BZMSrOgQWlHFPWfvPhp0T0qGPBgZKyfR +UdBKja46EUyJjt6LtjzbMD4TPrVdugitlWMU/eAgOglTo1aGwZzvTF/GLF/16DH9fqE UBlQ== X-Gm-Message-State: AD7BkJJ0uTFplg9s1uoBkph8Zprpcy1qGS/u37/E0J5ufYcWUJXmAqWaojT3RlbQkcYP+g05I5gcGOPE6yTa4A== MIME-Version: 1.0 X-Received: by 10.66.160.201 with SMTP id xm9mr8615089pab.68.1460076460344; Thu, 07 Apr 2016 17:47:40 -0700 (PDT) Received: by 10.66.74.39 with HTTP; Thu, 7 Apr 2016 17:47:40 -0700 (PDT) In-Reply-To: References: Date: Thu, 7 Apr 2016 17:47:40 -0700 Message-ID: From: Peter Bowen To: Rick Andrews Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] Issue with redaction and CN-IDs X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Apr 2016 00:47:43 -0000 On Thu, Apr 7, 2016 at 5:46 PM, Rick Andrews wrote: > -----Original Message----- > From: Peter Bowen [mailto:pzbowen@gmail.com] > Sent: Thursday, April 07, 2016 5:34 PM > To: Rick Andrews > Cc: trans@ietf.org > Subject: Re: [Trans] Issue with redaction and CN-IDs > > > > I also wonder how to handle multiple CN-IDs in a single certificate. > There is not, to my knowledge, a requirement that the Subject only contain > one attribute of type commonName. > > Dan Kaminsky's PKI Layer Cake paper > (https://www.cosic.esat.kuleuven.be/publications/article-1432.pdf) exposed > vulnerabilities around multiple CN-IDs, but we neglected to outlaw them in the > CABF BRs. Ah, then ignore that question in the trans context. We can fix in the CABF context. From nobody Fri Apr 8 02:59:05 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A78E12D816 for ; Fri, 8 Apr 2016 02:59:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NLSQ0gTTqvnZ for ; Fri, 8 Apr 2016 02:59:01 -0700 (PDT) Received: from mmextmx2.mcr.colo.comodoca.net (mmextmx2.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0939312D814 for ; Fri, 8 Apr 2016 02:58:58 -0700 (PDT) Received: (qmail 32757 invoked by uid 1004); 8 Apr 2016 09:58:56 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx2.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Fri, 08 Apr 2016 10:58:56 +0100 Received: (qmail 9568 invoked by uid 1000); 8 Apr 2016 09:58:56 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Fri, 08 Apr 2016 10:58:56 +0100 To: Peter Bowen , Rick Andrews References: From: Rob Stradling Message-ID: <570780DE.4040200@comodo.com> Date: Fri, 8 Apr 2016 10:58:54 +0100 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:38.0) Gecko/20100101 Thunderbird/38.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] Issue with redaction and CN-IDs X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Apr 2016 09:59:04 -0000 The CABForum BRs say this: "7.1.4.2.2. Subject Distinguished Name Fields a. Certificate Field: subject:commonName (OID 2.5.4.3) Required/Optional: Deprecated (Discouraged, but not prohibited) Contents: If present, this field MUST contain a single IP address or Fully‐Qualified Domain Name that is one of the values contained in the Certificate's subjectAltName extension (see section 7.1.4.2.1)." I believe the intent of "...MUST contain a single...that is one of the values..." was to outlaw multiple CN-IDs. Clarification would help though. On 08/04/16 01:47, Peter Bowen wrote: > On Thu, Apr 7, 2016 at 5:46 PM, Rick Andrews wrote: >> -----Original Message----- >> From: Peter Bowen [mailto:pzbowen@gmail.com] >> Sent: Thursday, April 07, 2016 5:34 PM >> To: Rick Andrews >> Cc: trans@ietf.org >> Subject: Re: [Trans] Issue with redaction and CN-IDs >> >> >> >> I also wonder how to handle multiple CN-IDs in a single certificate. >> There is not, to my knowledge, a requirement that the Subject only contain >> one attribute of type commonName. >> >> Dan Kaminsky's PKI Layer Cake paper >> (https://www.cosic.esat.kuleuven.be/publications/article-1432.pdf) exposed >> vulnerabilities around multiple CN-IDs, but we neglected to outlaw them in the >> CABF BRs. > > Ah, then ignore that question in the trans context. We can fix in the > CABF context. -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From nobody Fri Apr 8 03:32:10 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A8FF12D0E3 for ; Fri, 8 Apr 2016 03:32:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F3BfVly8A15b for ; Fri, 8 Apr 2016 03:32:06 -0700 (PDT) Received: from mmextmx2.mcr.colo.comodoca.net (mmextmx2.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A878A12D125 for ; Fri, 8 Apr 2016 03:32:05 -0700 (PDT) Received: (qmail 1958 invoked by uid 1004); 8 Apr 2016 10:32:03 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx2.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Fri, 08 Apr 2016 11:32:03 +0100 Received: (qmail 11021 invoked by uid 1000); 8 Apr 2016 10:32:03 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Fri, 08 Apr 2016 11:32:03 +0100 To: Peter Bowen , Rick Andrews References: From: Rob Stradling Message-ID: <570788A2.6090108@comodo.com> Date: Fri, 8 Apr 2016 11:32:02 +0100 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:38.0) Gecko/20100101 Thunderbird/38.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] Issue with redaction and CN-IDs X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Apr 2016 10:32:09 -0000 On 08/04/16 01:33, Peter Bowen wrote: > On Thu, Apr 7, 2016 at 4:32 PM, Rick Andrews wrote: >> Section 4.2 in 6962-bis says: >> When a precertificate contains that extension and contains a CN-ID >> [RFC6125], the CN-ID MUST match the first DNS-ID and have the same >> labels redacted. TLS clients will use the first entry in the >> SEQUENCE OF INTEGERs to reconstruct both the first DNS-ID and the CN- >> ID. >> >> I'm aware of a problem (confirmed by Peter Bowen at Amazon) with Java7 and >> Java8 where getting a new certificate with a different SAN ordering from the >> previous one will prevent those Java clients from successfully validating >> the new certificate, at least until the cache in the client expires the old >> cert information. In most cases, we put the CN-ID in the first SAN field, >> but there are exceptions made in cases like this. >> >> I think the spec used to say that the first item in the SEQUENCE represented >> the CN-ID, and I missed the discussion where that changed. That idea may have been discussed, but FWIW I don't see it in any previous version of the draft. We did change CN-ID redaction from disallowed to allowed: https://trac.tools.ietf.org/wg/trans/trac/ticket/17 https://github.com/google/certificate-transparency-rfcs/commit/49de5eb87e1e6d29e50c418c00654a79a950522d > More than just working around bugs in Java, there are names that can > be placed in a dNSName entry that cannot be commonName value due to > length. According to RFC5280, commonName has an upper bound of 64 > total characters while dNSNames have a bound of 63 characters per > label and a total length limit in excess of 200 characters. Therefore > a CA may not be able to place the first DNS-ID in the CN-ID field. I notice that "the CN-ID MUST match the first DNS-ID and have the same labels redacted" is also problematic for IDNs, where some CAs put the A-label in the SAN dNSName field and the corresponding U-label in the Subject CN field. e.g. https://crt.sh/?id=16244739&opt=cablint I think we should update the draft to say that the first INTEGER in the SEQUENCE corresponds to the (zero or more) Subject CN(s), the second INTEGER corresponds to the first SAN dNSName, etc, etc. > I also wonder how to handle multiple CN-IDs in a single certificate. > There is not, to my knowledge, a requirement that the Subject only > contain one attribute of type commonName. > > Thanks, > Peter -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From nobody Fri Apr 8 06:34:08 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5848412D7C7 for ; Fri, 8 Apr 2016 06:34:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.211 X-Spam-Level: X-Spam-Status: No, score=-4.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l_uVy7I3xzeM for ; Fri, 8 Apr 2016 06:34:06 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B46ED12D0FF for ; Fri, 8 Apr 2016 06:25:24 -0700 (PDT) Received: from ssh.bbn.com ([192.1.122.15]:42771 helo=COMSEC.fios-router.home) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1aoWPb-000NZq-Jt for trans@ietf.org; Fri, 08 Apr 2016 09:25:23 -0400 From: Stephen Kent To: trans@ietf.org References: Message-ID: <5707B143.9050300@bbn.com> Date: Fri, 8 Apr 2016 09:25:23 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.7.2 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Trans] Issue with redaction and CN-IDs X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Apr 2016 13:34:07 -0000 Peter, It's good that this potential problem has been identified, but it ought to be addressed in 6962-bis, not via an action in the CABF context. I say this for a few reasons: - CABF cert policies do not apply to all cert that one might encounter in a browser - Eran has argued that CT applies to all TLS-based communications, not just browser/web server interactions (I still disagree about this) - 6962-bis wants to become an IETF standard and thus relying on an external spec to address a potential security concern is not appropriate. If Rob can adjust text in 6962-bis to address this problem, that's the preferred approach. Steve > Ah, then ignore that question in the trans context. We can fix in the > CABF context. > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > From nobody Fri Apr 8 06:39:07 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EED8112D7D1 for ; Fri, 8 Apr 2016 06:39:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.731 X-Spam-Level: X-Spam-Status: No, score=-2.731 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id twpI80OM1jne for ; Fri, 8 Apr 2016 06:39:03 -0700 (PDT) Received: from prod-mail-xrelay07.akamai.com (prod-mail-xrelay07.akamai.com [23.79.238.175]) by ietfa.amsl.com (Postfix) with ESMTP id 9941A12D8D5 for ; Fri, 8 Apr 2016 06:38:53 -0700 (PDT) Received: from prod-mail-xrelay07.akamai.com (localhost.localdomain [127.0.0.1]) by postfix.imss70 (Postfix) with ESMTP id 8A5E5433417; Fri, 8 Apr 2016 13:38:52 +0000 (GMT) Received: from prod-mail-relay11.akamai.com (prod-mail-relay11.akamai.com [172.27.118.250]) by prod-mail-xrelay07.akamai.com (Postfix) with ESMTP id 744CF433401; Fri, 8 Apr 2016 13:38:52 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; s=a1; t=1460122732; bh=521E5ETNXk64UnvD+5pmDy3h62AM3X7IGpiZucpZ68I=; l=266; h=From:To:Date:References:In-Reply-To:From; b=oUWI1Lq4N7psMRqwskBieeSgRAb7Om3q79cNnUTe8SjwEbL/bWdJUDBVdRXovcEmy n1p4IGIJ4ra1l8FR/XqXA3xd18Y9t5ksMiuewXkPDJ2uijqDVX0N0n4jnEtjOK/JIH YkjoyQEu0APDUCEfgsb5m7J5GVL+G4TjtBkXLWQc= Received: from email.msg.corp.akamai.com (usma1ex-casadmn.msg.corp.akamai.com [172.27.123.33]) by prod-mail-relay11.akamai.com (Postfix) with ESMTP id 71A561FC90; Fri, 8 Apr 2016 13:38:52 +0000 (GMT) Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb6.msg.corp.akamai.com (172.27.123.65) with Microsoft SMTP Server (TLS) id 15.0.1130.7; Fri, 8 Apr 2016 06:38:51 -0700 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1130.005; Fri, 8 Apr 2016 09:38:52 -0400 From: "Salz, Rich" To: Stephen Kent , "trans@ietf.org" Thread-Topic: [Trans] Issue with redaction and CN-IDs Thread-Index: AdGRJaeQF6g1W+VjR2ODBtAWi3yQcAAKi1KAAABwp4AAAAwSAAAadoSAAAfsiRA= Date: Fri, 8 Apr 2016 13:38:51 +0000 Message-ID: <2c8a2e42eb9d48b9810e87edf73f4e0f@usma1ex-dag1mb1.msg.corp.akamai.com> References: <5707B143.9050300@bbn.com> In-Reply-To: <5707B143.9050300@bbn.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.48.144] Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Trans] Issue with redaction and CN-IDs X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Apr 2016 13:39:06 -0000 > - 6962-bis wants to become an IETF standard and thus relying on an > external > spec to address a potential security concern is not appropriate. >=20 > If Rob can adjust text in 6962-bis to address this problem, that's the > preferred approach. Plus-one! From nobody Fri Apr 8 07:16:17 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2AA3112D726 for ; Fri, 8 Apr 2016 07:16:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WK9MRzKGoZvY for ; Fri, 8 Apr 2016 07:16:14 -0700 (PDT) Received: from mail-pa0-x229.google.com (mail-pa0-x229.google.com [IPv6:2607:f8b0:400e:c03::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5021612D912 for ; Fri, 8 Apr 2016 07:15:59 -0700 (PDT) Received: by mail-pa0-x229.google.com with SMTP id zm5so75712017pac.0 for ; Fri, 08 Apr 2016 07:15:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=2dW0HxEPkTXTRghAZ+1i5go6JG0JyPgt99Re7R0NZPc=; b=i4C9RcmBDrymvo4reXKO/LZVF3p7Y/VV+ju5Kh1IP9Z4XWN2aaGBNR9qLNJn/VlwEj i5dUTWXDt1ilMMMl47jZ4yJSLKREdJBRDS865ZrinbvhIb2/5C+W9C6ZF9iwMWSQN/ir R/8ez2jqPRWKjJTWqE219ZrUwcxBeYEAJN/Ugk6FRQDxXO5gwKgSkiylfOHb+VvHDblP I/a/SeZst01xiVKGejVgV+qR6hAfxzWs9RxeMTt5U4Fqik/GayMNcci/vyJQkzVsHDZL DloaKWIafKgGaqjRmpHUlqjUm680n0yzyEP1MpDwedbS3Pbnulg+3gklT34B4w8PwG3h cXBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=2dW0HxEPkTXTRghAZ+1i5go6JG0JyPgt99Re7R0NZPc=; b=IsJHx95dbmf1CvNZr1QQcVrg74P3yEm/klrBDplWdYBuMh1iGpEpm8MZJZ/0KXJAfS SozfsjZhQRwyDLKlNHMOp1QzltKw3KPSLtE4aWkPB/ywXA7Jfe4A4ifv9PE6ns8uWA2l 4QrNL4C6gl1w1etvx3z4TQF/ewnHdTV9zXCghV8fONC4P5yAC/MQXFp9d3M1ujq+9ccJ L0VJp4Hfs743D2ejjlrk02m96zoTjOIhHIvrCAsdnAYZDAPccgbC/ir8aSDtyCobvmEE ijdLn+C5WLAf61IkXE2Ep9DjCXJVzqIy15GBQ3BE7Olh2a7g3rMYGh/EKXd0d6j9crdr DAYA== X-Gm-Message-State: AD7BkJLvJxA1dpNCnPenODEtBECw2UCxqVJxtXz9DGLe12BLLLclNpJmXWPNQQWTJe1VMuWZ5GN9nxm68tnOvw== MIME-Version: 1.0 X-Received: by 10.66.101.35 with SMTP id fd3mr12948213pab.7.1460124958890; Fri, 08 Apr 2016 07:15:58 -0700 (PDT) Received: by 10.66.74.39 with HTTP; Fri, 8 Apr 2016 07:15:58 -0700 (PDT) In-Reply-To: <5707B143.9050300@bbn.com> References: <5707B143.9050300@bbn.com> Date: Fri, 8 Apr 2016 07:15:58 -0700 Message-ID: From: Peter Bowen To: Stephen Kent Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] Issue with redaction and CN-IDs X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Apr 2016 14:16:16 -0000 On Fri, Apr 8, 2016 at 6:25 AM, Stephen Kent wrote: > It's good that this potential problem has been identified, but it > ought to be addressed in 6962-bis, not via an action in the CABF context. > I say this for a few reasons: > > - CABF cert policies do not apply to all cert that one might encounter > in a browser > - 6962-bis wants to become an IETF standard and thus relying on an > external > spec to address a potential security concern is not appropriate. > > If Rob can adjust text in 6962-bis to address this problem, that's the > preferred approach. Stephen, This is obviously the correct answer. The real challenge will be determining how to map redaction info to the DN, given that DN is a SEQUENCE OF(SET OF(Attribute)) and that SET is unordered. I'm thinking the right answer is to borrow ASN.1 Distinguished Encoding Rules to set the order of SET when a SET has more than one commonName attribute, as I think the most common state. Thanks, Peter From nobody Fri Apr 8 14:40:11 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 59D7512D1AD for ; Fri, 8 Apr 2016 14:40:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 84eRmCYjTJUA for ; Fri, 8 Apr 2016 14:40:07 -0700 (PDT) Received: from mmextmx2.mcr.colo.comodoca.net (mmextmx2.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B065012D0E2 for ; Fri, 8 Apr 2016 14:40:06 -0700 (PDT) Received: (qmail 12098 invoked by uid 1004); 8 Apr 2016 21:40:04 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx2.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Fri, 08 Apr 2016 22:40:04 +0100 Received: (qmail 30287 invoked by uid 1000); 8 Apr 2016 21:40:04 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Fri, 08 Apr 2016 22:40:04 +0100 To: Peter Bowen , Stephen Kent References: <5707B143.9050300@bbn.com> From: Rob Stradling Message-ID: <57082532.9000000@comodo.com> Date: Fri, 8 Apr 2016 22:40:02 +0100 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:38.0) Gecko/20100101 Thunderbird/38.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] Issue with redaction and CN-IDs X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Apr 2016 21:40:09 -0000 On 08/04/16 15:15, Peter Bowen wrote: > On Fri, Apr 8, 2016 at 6:25 AM, Stephen Kent wrote: >> It's good that this potential problem has been identified, but it >> ought to be addressed in 6962-bis, not via an action in the CABF context. >> I say this for a few reasons: >> >> - CABF cert policies do not apply to all cert that one might encounter >> in a browser >> - 6962-bis wants to become an IETF standard and thus relying on an >> external >> spec to address a potential security concern is not appropriate. >> >> If Rob can adjust text in 6962-bis to address this problem, that's the >> preferred approach. > > Stephen, > > This is obviously the correct answer. > > The real challenge will be determining how to map redaction info to > the DN, given that DN is a SEQUENCE OF(SET OF(Attribute)) and that SET > is unordered. We originally said that CNs could not be redacted at all because we were trying to avoid this complexity. > I'm thinking the right answer is to borrow ASN.1 > Distinguished Encoding Rules to set the order of SET when a SET has > more than one commonName attribute, as I think the most common state. Does anyone actually need the ability to redact different numbers of labels in multiple CNs? I'm guessing not, in which case let's not make this more complex than it needs to be. > Thanks, > Peter -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From nobody Fri Apr 8 15:08:49 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6FCE12D5D0 for ; Fri, 8 Apr 2016 15:08:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bwypBO6FCmSo for ; Fri, 8 Apr 2016 15:08:39 -0700 (PDT) Received: from mail-pa0-x234.google.com (mail-pa0-x234.google.com [IPv6:2607:f8b0:400e:c03::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0FEBB12D6C3 for ; Fri, 8 Apr 2016 15:08:39 -0700 (PDT) Received: by mail-pa0-x234.google.com with SMTP id fe3so81895009pab.1 for ; Fri, 08 Apr 2016 15:08:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=+M/GycIp2V2/J2jAjuwnARyQtFyH3D3ItA0rg3AyJU4=; b=YG9yqF8Wk9VzmCTR2qsp5/vweGelyMIMJ7HvDhyomFeZq9tBvhzuCcFg/uMO+ksyC6 7nCmECPxr1dEk6O/g2uSVKeE0HNxCsfP+L+0JiCaL57V/5dNb45Xx1WDoU9eJl9WzxEd 50BoXvlmSsQMjUM1Kr+OLQGqWuuHj9BK5APo/OsSsk+NylL3rMBfjU0fG+alZogyeMiE vJ3/UByycFRhmDZhIm5O5oES5JhZixD1Gx1rJJYMezkF2dN8Tjidx1h+lM2BYY6ujN6k isx7bjcT72VgKz3IvYFiyr+lI0XkJdo/375zfENwlFz4mJpx73L6sAWC7Q+556V92vVx 4KOQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=+M/GycIp2V2/J2jAjuwnARyQtFyH3D3ItA0rg3AyJU4=; b=SRle5EBYNXoVCM/zSBWkLQjsTWSQOtQwZsjPN25FWhMgpOC/g+oD+4k0fSbd7rvTdX e1ZG4IbjkCddd7+9n6NSpc2bHnqwkGWVilKA7CJUSXEsPvgDUuApDXf2F0aP4TzyhvvH mWGAWyNka+DD+lthiF6YS+oCRQ7M2REzQMpETrIkfcmAjBR4ALm9cj68ftp8GARO87Dn /GIqqB2kuEs/7TLWJvwuVs4uo3zKsfMDPqlYFwMtXDJBOjqt9Zho7HA8e6uppn59pBdM OcPMYgUrGnDlKZGS7izYxLlh1BGnfxysijk7bgomC4oReNC984a5EEIaI4bfI6JwOcDA ULNQ== X-Gm-Message-State: AD7BkJI0mnv0cvFrBD5T/HsaJE7nygpTZywx91MFN0G7E9z9SXt6bWWpVNY8u9WOIueJo5ddbDx+ZZjBKT2pOg== MIME-Version: 1.0 X-Received: by 10.67.14.98 with SMTP id ff2mr15741385pad.105.1460153318512; Fri, 08 Apr 2016 15:08:38 -0700 (PDT) Received: by 10.66.74.39 with HTTP; Fri, 8 Apr 2016 15:08:38 -0700 (PDT) In-Reply-To: <57082532.9000000@comodo.com> References: <5707B143.9050300@bbn.com> <57082532.9000000@comodo.com> Date: Fri, 8 Apr 2016 15:08:38 -0700 Message-ID: From: Peter Bowen To: Rob Stradling Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "trans@ietf.org" , Stephen Kent Subject: Re: [Trans] Issue with redaction and CN-IDs X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Apr 2016 22:08:48 -0000 On Fri, Apr 8, 2016 at 2:40 PM, Rob Stradling wrote: > On 08/04/16 15:15, Peter Bowen wrote: >> >> On Fri, Apr 8, 2016 at 6:25 AM, Stephen Kent wrote: >>> >>> It's good that this potential problem has been identified, but it >>> ought to be addressed in 6962-bis, not via an action in the CABF context. >>> I say this for a few reasons: >>> >>> - CABF cert policies do not apply to all cert that one might >>> encounter >>> in a browser >>> - 6962-bis wants to become an IETF standard and thus relying on an >>> external >>> spec to address a potential security concern is not appropriate. >>> >>> If Rob can adjust text in 6962-bis to address this problem, that's the >>> preferred approach. >> >> >> Stephen, >> >> This is obviously the correct answer. >> >> The real challenge will be determining how to map redaction info to >> the DN, given that DN is a SEQUENCE OF(SET OF(Attribute)) and that SET >> is unordered. > > > We originally said that CNs could not be redacted at all because we were > trying to avoid this complexity. > >> I'm thinking the right answer is to borrow ASN.1 >> Distinguished Encoding Rules to set the order of SET when a SET has >> more than one commonName attribute, as I think the most common state. > > > Does anyone actually need the ability to redact different numbers of labels > in multiple CNs? > > I'm guessing not, in which case let's not make this more complex than it > needs to be. So I think the easiest method would be to append one more element to the sequence for CN redaction level. I think it should go at the end, rather than the beginning, as it should be more likely to not have a common name than not having a SAN. From nobody Mon Apr 11 04:04:48 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 04C8E12EBCF for ; Mon, 11 Apr 2016 04:04:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.896 X-Spam-Level: X-Spam-Status: No, score=-7.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.996] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bin_JpvzhBmQ for ; Mon, 11 Apr 2016 04:04:46 -0700 (PDT) Received: from zinfandel.tools.ietf.org (zinfandel.tools.ietf.org [IPv6:2001:1890:123a::1:2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C823B12EBD0 for ; Mon, 11 Apr 2016 04:04:46 -0700 (PDT) Received: from localhost ([::1]:59268 helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1apZe8-0006Ux-IU; Mon, 11 Apr 2016 04:04:44 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "trans issue tracker" X-Trac-Version: 0.12.5 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.5, by Edgewall Software To: rob.stradling@comodo.com, benl@google.com, eranm@google.com X-Trac-Project: trans Date: Mon, 11 Apr 2016 11:04:44 -0000 X-URL: https://tools.ietf.org/trans/ X-Trac-Ticket-URL: https://trac.tools.ietf.org/wg/trans/trac/ticket/17#comment:9 Message-ID: <071.0e0632fe35d9e3994b0195ea8507da7c@tools.ietf.org> References: <056.85fdae525760c3becdf667e2fc76585f@tools.ietf.org> X-Trac-Ticket-ID: 17 In-Reply-To: <056.85fdae525760c3becdf667e2fc76585f@tools.ietf.org> X-SA-Exim-Connect-IP: ::1 X-SA-Exim-Rcpt-To: rob.stradling@comodo.com, benl@google.com, eranm@google.com, trans@ietf.org X-SA-Exim-Mail-From: trac+trans@tools.ietf.org X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false Archived-At: Cc: trans@ietf.org Subject: Re: [Trans] [trans] #17 (rfc6962-bis): Add advice on CNs X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Apr 2016 11:04:48 -0000 #17: Add advice on CNs Changes (by rob.stradling@comodo.com): * status: closed => reopened * resolution: fixed => Comment: It's problematic to require the Subject CN, if present, to match the first SAN dNSName. See this thread for discussion: https://mailarchive.ietf.org/arch/msg/trans/q3mT1tSeKJkh2TDftElF8WBlLp8 Let's adopt Peter Bowen's suggestion to "...append one more element to the sequence for CN redaction level. I think it should go at the end, rather than the beginning, as it should be more likely to not have a common name than not having a SAN." -- -----------------------------+--------------------------------------- Reporter: benl@google.com | Owner: rob.stradling@comodo.com Type: defect | Status: reopened Priority: major | Milestone: Component: rfc6962-bis | Version: Severity: - | Resolution: Keywords: | -----------------------------+--------------------------------------- Ticket URL: trans From nobody Mon Apr 11 06:14:45 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3B51C12EE45 for ; Mon, 11 Apr 2016 06:14:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.896 X-Spam-Level: X-Spam-Status: No, score=-7.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.996] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GOPqhGH5BWBN for ; Mon, 11 Apr 2016 06:14:43 -0700 (PDT) Received: from zinfandel.tools.ietf.org (zinfandel.tools.ietf.org [IPv6:2001:1890:123a::1:2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1090C12EE47 for ; Mon, 11 Apr 2016 06:14:43 -0700 (PDT) Received: from localhost ([::1]:36161 helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1apbft-0007xz-BR; Mon, 11 Apr 2016 06:14:41 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "trans issue tracker" X-Trac-Version: 0.12.5 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.5, by Edgewall Software To: rob.stradling@comodo.com, benl@google.com, eranm@google.com X-Trac-Project: trans Date: Mon, 11 Apr 2016 13:14:41 -0000 X-URL: https://tools.ietf.org/trans/ X-Trac-Ticket-URL: https://trac.tools.ietf.org/wg/trans/trac/ticket/17#comment:10 Message-ID: <071.217d6d40b62761ecb4be3bf60e896329@tools.ietf.org> References: <056.85fdae525760c3becdf667e2fc76585f@tools.ietf.org> X-Trac-Ticket-ID: 17 In-Reply-To: <056.85fdae525760c3becdf667e2fc76585f@tools.ietf.org> X-SA-Exim-Connect-IP: ::1 X-SA-Exim-Rcpt-To: rob.stradling@comodo.com, benl@google.com, eranm@google.com, trans@ietf.org X-SA-Exim-Mail-From: trac+trans@tools.ietf.org X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false Archived-At: Cc: trans@ietf.org Subject: Re: [Trans] [trans] #17 (rfc6962-bis): Add advice on CNs X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Apr 2016 13:14:44 -0000 #17: Add advice on CNs Changes (by rob.stradling@comodo.com): * milestone: => review Comment: Fixed by https://github.com/google/certificate-transparency- rfcs/commit/11b145a7c9865dd8e6f04c6edb19e6fdc4b1a174 -- -----------------------------+--------------------------------------- Reporter: benl@google.com | Owner: rob.stradling@comodo.com Type: defect | Status: reopened Priority: major | Milestone: review Component: rfc6962-bis | Version: Severity: - | Resolution: Keywords: | -----------------------------+--------------------------------------- Ticket URL: trans From nobody Mon Apr 11 07:44:42 2016 Return-Path: X-Original-To: trans@ietf.org Delivered-To: trans@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B8CD12EFED; Mon, 11 Apr 2016 07:44:41 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.19.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160411144441.13115.21653.idtracker@ietfa.amsl.com> Date: Mon, 11 Apr 2016 07:44:41 -0700 Archived-At: Cc: trans@ietf.org Subject: [Trans] I-D Action: draft-ietf-trans-rfc6962-bis-14.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Apr 2016 14:44:41 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Public Notary Transparency of the IETF. Title : Certificate Transparency Authors : Ben Laurie Adam Langley Emilia Kasper Eran Messeri Rob Stradling Filename : draft-ietf-trans-rfc6962-bis-14.txt Pages : 52 Date : 2016-04-11 Abstract: This document describes a protocol for publicly logging the existence of Transport Layer Security (TLS) certificates as they are issued or observed, in a manner that allows anyone to audit certification authority (CA) activity and notice the issuance of suspect certificates as well as to audit the certificate logs themselves. The intent is that eventually clients would refuse to honor certificates that do not appear in a log, effectively forcing CAs to add all issued certificates to the logs. Logs are network services that implement the protocol operations for submissions and queries that are defined in this document. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-trans-rfc6962-bis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-14 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-trans-rfc6962-bis-14 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Apr 11 10:53:49 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 272DD12E6EB for ; Mon, 11 Apr 2016 10:53:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.896 X-Spam-Level: X-Spam-Status: No, score=-7.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.996] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9bw1pcb2Mw3e for ; Mon, 11 Apr 2016 10:53:46 -0700 (PDT) Received: from zinfandel.tools.ietf.org (zinfandel.tools.ietf.org [IPv6:2001:1890:123a::1:2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2B3D512E870 for ; Mon, 11 Apr 2016 10:53:46 -0700 (PDT) Received: from localhost ([::1]:59065 helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1apg1v-0001oV-6Q; Mon, 11 Apr 2016 10:53:43 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "trans issue tracker" X-Trac-Version: 0.12.5 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.5, by Edgewall Software To: rob.stradling@comodo.com, benl@google.com, eranm@google.com, melinda.shore@gmail.com X-Trac-Project: trans Date: Mon, 11 Apr 2016 17:53:43 -0000 X-URL: https://tools.ietf.org/trans/ X-Trac-Ticket-URL: https://trac.tools.ietf.org/wg/trans/trac/ticket/17#comment:11 Message-ID: <071.9ee48da1935cc99fa485f308c51af1b4@tools.ietf.org> References: <056.85fdae525760c3becdf667e2fc76585f@tools.ietf.org> X-Trac-Ticket-ID: 17 In-Reply-To: <056.85fdae525760c3becdf667e2fc76585f@tools.ietf.org> X-SA-Exim-Connect-IP: ::1 X-SA-Exim-Rcpt-To: rob.stradling@comodo.com, benl@google.com, eranm@google.com, melinda.shore@gmail.com, trans@ietf.org X-SA-Exim-Mail-From: trac+trans@tools.ietf.org X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false Archived-At: Cc: trans@ietf.org Subject: Re: [Trans] [trans] #17 (rfc6962-bis): Add advice on CNs X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Apr 2016 17:53:48 -0000 #17: Add advice on CNs Changes (by melinda.shore@gmail.com): * status: reopened => closed * resolution: => fixed -- -----------------------------+--------------------------------------- Reporter: benl@google.com | Owner: rob.stradling@comodo.com Type: defect | Status: closed Priority: major | Milestone: review Component: rfc6962-bis | Version: Severity: - | Resolution: fixed Keywords: | -----------------------------+--------------------------------------- Ticket URL: trans From nobody Mon Apr 11 13:17:48 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C6DA12F3B2 for ; Mon, 11 Apr 2016 13:17:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.696 X-Spam-Level: X-Spam-Status: No, score=-3.696 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.996, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id POBp5V2c98lu for ; Mon, 11 Apr 2016 13:17:45 -0700 (PDT) Received: from mail-yw0-x236.google.com (mail-yw0-x236.google.com [IPv6:2607:f8b0:4002:c05::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A60312E0C9 for ; Mon, 11 Apr 2016 13:17:45 -0700 (PDT) Received: by mail-yw0-x236.google.com with SMTP id i84so219156746ywc.2 for ; Mon, 11 Apr 2016 13:17:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:date:message-id:subject:from:to:cc; bh=iZI/i0395O9JwuFxGfRlPzbDdQpKXPllAQTnXcVsD2I=; b=edaAE0AXOLQsv2MNRkw2B5vEKNG8A9ru/ezp0A+twEhnhAt2o+bHzz42vrOHVZGVsh G95yeIH2S+MWWDqfRA50one1nfkCO/OtjNmkpcnKMaEONiv+Qk6LxxG3D/VrI/Fu2/zP kNsHBdQLWnbqVWE9sx/YCw3Ty608HWIbYrcTnR1eWXbPrd/5X+0K6Z30J2wy21Qr7MA5 AGDLvVMskz5t15gSGlxD23MWOy3N6luqblN2TeIjMs0pYa+a93SmvjgeeYx80O7fT6Q8 H0lRrTVMZBGJta1XKXnWscGIWBPbAYua4xLj40Af81KUwN4OQ7etcWCY6wumQbRVPv+t gi+Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to:cc; bh=iZI/i0395O9JwuFxGfRlPzbDdQpKXPllAQTnXcVsD2I=; b=O+IioswUBHtVDKjhotcu1stK4Z26d88ONoOlGH2xjkEXRI4T8XjJjeKxGNy3Kmi4jr s1OYz0MvzmXBfsJamye0PHAc1gM9hH2ZEmC943+duSC9OZdlMtVEb6oNeKbOLT8UCb6O lAXnbVrtr46bJ2ySCvc2AnuUNOAnSjb6X5mibnpwhLdfKLVtezny3T7SkbPgqoHy6d/c N5CWkSX9NYCrWCp/5KGObCqg5Xef8Q4zM5aJH/XNN52iaJ4MxMPoceLH1uvVEEwEWeRI u7zfksBg/vGsiiYLOxDe/mNiN01AHR0TJUBZ4ZIY02V3wk7H8malmYs7Fs+EMwL797OY HBCg== X-Gm-Message-State: AOPr4FWL0W462PcjtmiovqlemaDEMMnD4WS7salNZ7ws/1ytEZ+cs3jdPEbnTkiuohnWr8f/8/pAbM7eG06950bX MIME-Version: 1.0 X-Received: by 10.37.204.135 with SMTP id l129mr270497ybf.78.1460405864669; Mon, 11 Apr 2016 13:17:44 -0700 (PDT) Received: by 10.37.48.6 with HTTP; Mon, 11 Apr 2016 13:17:44 -0700 (PDT) Date: Mon, 11 Apr 2016 21:17:44 +0100 Message-ID: From: Eran Messeri To: "trans@ietf.org" Content-Type: multipart/alternative; boundary=94eb2c084190cb321e05303b3c5f Archived-At: Cc: Rob Stradling , Ben Laurie Subject: [Trans] Proposal: Allow redaction of exactly one DNS-ID X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Apr 2016 20:17:47 -0000 --94eb2c084190cb321e05303b3c5f Content-Type: text/plain; charset=UTF-8 I'm looking for feedback on limiting the name redaction mechanism specified in section 4.2 of RFC6962-bis . My proposal is to allow redaction exactly only of the first DNS-ID in the subjectAltName extension. Right now 6962-bis allows redaction of multiple DNS-IDs by requiring an extension with repeating integer values, each indicating the number of redacted labels in the corresponding DNS-ID entry. I am proposing this to simplify implementing clients - not having loop over one extension, match it with fields in another extension and dealing with the edge cases where there's a mismatch is one less source of bugs. However it may enforce certain limitations on CAs / domain owners that are fundamental to this feature (each redacted domain name will need to be in a separate certificate, for a start, or not being able to redact a CN-ID). Hence feedback is appreciated. Eran --94eb2c084190cb321e05303b3c5f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I'm looking for feedback on limiting the name redactio= n mechanism specified in section 4.2 of RFC6962-bis.

<= /div>
My proposal is to allow redaction exactly only of the first DNS-I= D in the subjectAltName extension.
Right now 6962-bis allows reda= ction of multiple DNS-IDs by requiring an extension with repeating integer = values, each indicating the number of redacted labels in the corresponding = DNS-ID entry.

I am proposing this to simplify impl= ementing clients - not having loop over one extension, match it with fields= in another extension and dealing with the edge cases where there's a m= ismatch is one less source of bugs.

However it may= enforce certain limitations on CAs / domain owners that are fundamental to= this feature (each redacted domain name will need to be in a separate cert= ificate, for a start, or not being able to redact a CN-ID). Hence feedback = is appreciated.

Eran
--94eb2c084190cb321e05303b3c5f-- From nobody Wed Apr 13 10:04:22 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95E2912D6DE for ; Wed, 13 Apr 2016 10:04:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=andrewayer.name Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eSHLVItSxRfC for ; Wed, 13 Apr 2016 10:04:19 -0700 (PDT) Received: from alcazar.beanwood.com (alcazar.beanwood.com [70.85.129.230]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1830512D6D6 for ; Wed, 13 Apr 2016 10:04:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=andrewayer.name; s=alcazar2; t=1460567058; bh=wVTQAiOS/C2PjUwpqbRyiKDCjmyVoo8HlpH9eMoSCXA=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=KIhTvkIe4fazHHrCqzA5NdkXdzsKQ2PmcbZw8/gC5dGlQrf0bpfV6vcOeCb94rudZ OUaGv7KySIPrXi94CZObjRFYo0Dr9a6/83E9BnEDyry/fQDCOyUkNo0Y9l0EQ42DpM 28EeZfs4848BCGmY3PABbuq/Ynyk1vHANJG+uPjleaxwVXLlfQ1pIJxfON63y4hVCh 4CFwY29riABPWZO9HmBlWuk0yqbxTWXf5XrSB+1qyfSdtDMQCz3eIn/QKnOij0CnDh 18b6UhCm3jHL2rOKZoSx9SdLxe7bqm2odqPSGHY0fxgy2rGK+gLu92ZdDBCsTpt9oF R/HytfIpfyqZg== Date: Wed, 13 Apr 2016 10:04:17 -0700 From: Andrew Ayer To: Eran Messeri Message-Id: <20160413100417.93b393ccb311b384e3cf793d@andrewayer.name> In-Reply-To: References: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Archived-At: Cc: Ben Laurie , Rob Stradling , "trans@ietf.org" Subject: Re: [Trans] Proposal: Allow redaction of exactly one DNS-ID X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Apr 2016 17:04:20 -0000 On Mon, 11 Apr 2016 21:17:44 +0100 Eran Messeri wrote: > I'm looking for feedback on limiting the name redaction mechanism > specified in section 4.2 of RFC6962-bis > . > > My proposal is to allow redaction exactly only of the first DNS-ID in > the subjectAltName extension. > Right now 6962-bis allows redaction of multiple DNS-IDs by requiring > an extension with repeating integer values, each indicating the > number of redacted labels in the corresponding DNS-ID entry. > > I am proposing this to simplify implementing clients - not having > loop over one extension, match it with fields in another extension > and dealing with the edge cases where there's a mismatch is one less > source of bugs. > > However it may enforce certain limitations on CAs / domain owners > that are fundamental to this feature (each redacted domain name will > need to be in a separate certificate, for a start, or not being able > to redact a CN-ID). Hence feedback is appreciated. From an implementer's perspective, I like the idea of changing the redaction extension to contain a single integer. Why not have it apply to all DNS-IDs in the certificate (including CN-ID) instead of just the first? I think this would make client implementations slightly simpler (since clients could apply the redaction uniformly to all DNS-IDs), and satisfy more use cases (since all names could be redacted). However, this would not work if a domain owner wanted to redact both secret.example.com and subservice.secret.example.com to ?.example.com and ?.?.example.com. Another possibility is for the extension to instead specify the number of *un*redacted labels at the end of the DNS-ID, which I suspect would satisfy almost all use cases. If a domain owner wants to redact, they probably want to redact all hostnames under a particular domain, and counting the number of unredacted labels would make this possible. The downside is that it's messy to think in terms of unredacted labels, and a naive implementation might perform the calculation number_of_labels - number_of_unredacted_labels, which could cause trouble if the cert is malformed and number_of_unredacted_labels > number_of_labels. Regards, Andrew From nobody Wed Apr 13 13:25:45 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70FEE12DD0E for ; Wed, 13 Apr 2016 13:25:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.096 X-Spam-Level: X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_ADSP_ALL=0.8, RP_MATCHES_RCVD=-0.996] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VkJ3BO6u7tkD for ; Wed, 13 Apr 2016 13:25:43 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 23E4A12DB9F for ; Wed, 13 Apr 2016 13:25:43 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 3qlb0N72ZRzwS; Wed, 13 Apr 2016 22:25:40 +0200 (CEST) X-OPENPGPKEY: Message passed unmodified X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id MCdMVgi8pZrn; Wed, 13 Apr 2016 22:25:40 +0200 (CEST) Received: from bofh.nohats.ca (206-248-139-105.dsl.teksavvy.com [206.248.139.105]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Wed, 13 Apr 2016 22:25:39 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id A3023614AFE7; Wed, 13 Apr 2016 16:25:37 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.10.3 bofh.nohats.ca A3023614AFE7 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 9EE72D5100; Wed, 13 Apr 2016 16:25:37 -0400 (EDT) Date: Wed, 13 Apr 2016 16:25:37 -0400 (EDT) From: Paul Wouters To: Andrew Ayer In-Reply-To: <20160413100417.93b393ccb311b384e3cf793d@andrewayer.name> Message-ID: References: <20160413100417.93b393ccb311b384e3cf793d@andrewayer.name> User-Agent: Alpine 2.20 (LFD 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] Proposal: Allow redaction of exactly one DNS-ID X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Apr 2016 20:25:44 -0000 On Wed, 13 Apr 2016, Andrew Ayer wrote: > Another possibility is for the extension to instead specify the number > of *un*redacted labels at the end of the DNS-ID, which I suspect would > satisfy almost all use cases. If a domain owner wants to redact, > they probably want to redact all hostnames under a particular domain, (no hats on) I don't think that is true. A big use case I think is to have certificates within and outside the split DNS view for the corporate versus public DNS. Eg *.nohats.ca and intranet.nohats.ca. Although I agree that an organisation should probably get two certificates in such a case. Is the implementation of the current text really that much harder? I think it would be better if the specification would not be limited, unless it is a significant continious cost (eg extra load on servers). The one-time programming cost seems less important[*] Paul [*] I am an implementor of RFCs too :) From nobody Thu Apr 14 05:48:31 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6389012E07B for ; Thu, 14 Apr 2016 05:48:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.197 X-Spam-Level: X-Spam-Status: No, score=-5.197 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.996, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z7wjvYHMFVfO for ; Thu, 14 Apr 2016 05:48:23 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C1F6812DAE4 for ; Thu, 14 Apr 2016 05:48:22 -0700 (PDT) Received: from ssh.bbn.com ([192.1.122.15]:53314 helo=COMSEC.fios-router.home) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1aqgh3-000KNi-IH for trans@ietf.org; Thu, 14 Apr 2016 08:48:21 -0400 From: Stephen Kent To: "trans@ietf.org" Message-ID: <570F9195.4050301@bbn.com> Date: Thu, 14 Apr 2016 08:48:21 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.7.2 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [Trans] revised threat analysis doc X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Apr 2016 12:48:30 -0000 We've just posted a revised version of this doc. Here is a quick summary of the changes. 1. Revised the introduction to discuss the AIA extension and its status relative to 5280 and to CABF cert policies. 2. Added a paragraph to 3.2.1.1.1 to note an attack in which a malicious CA revokes a bogus cert but sends a "god" OCSP response to a targeted user (browser). Also added a few words to the paragraph in 3.2.1.1.2 noting the same sort of attack. 3. Revised section 3.3 to note that 5280 warns about the dangers of having duplicate names, in the Security Considerations section. Divided the text into subsections to address different forms of the colluding CA attack, in an effort to make this section easier to read. 4. Revised the 3.3 text to better distinguish among attacks based on revocation of the doppelganger EE cert vs. revocation of the cert of the CA that issued and logged this bogus cert. The discussion notes why these revocation actions might or might not be effective, depending on implementation details that are not specified in 5280 or other RFCs. 5. Added text to note that, in this context, a CA and bogus web server could cause a targeted user (browser) to get a "good" OCSP response as part of the colluding CA attack, if the browser asks the web server for the OCSP response. (This is relevant to the discussion of whether an AIA extension is included in the bogus EE cert.) 6. Revised Section 3.4 to address comments received from Bryan (offlist), including his suggestion to create subsections of 3.4 (which motivated creating such subsections in 3.3). Steve From nobody Thu Apr 14 06:55:34 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 20A9012D7F6 for ; Thu, 14 Apr 2016 06:55:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.196 X-Spam-Level: X-Spam-Status: No, score=-5.196 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.996, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0AZDutd2ZqXk for ; Thu, 14 Apr 2016 06:55:29 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D3D0F12D641 for ; Thu, 14 Apr 2016 06:55:28 -0700 (PDT) Received: from ssh.bbn.com ([192.1.122.15]:45274 helo=COMSEC.fios-router.home) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1aqhjz-000Nyj-3w for trans@ietf.org; Thu, 14 Apr 2016 09:55:27 -0400 To: "trans@ietf.org" From: Stephen Kent Message-ID: <570FA14E.4010109@bbn.com> Date: Thu, 14 Apr 2016 09:55:26 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.7.2 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="------------030807060802070902070007" Archived-At: Subject: [Trans] slight timing whoops X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Apr 2016 13:55:33 -0000 This is a multi-part message in MIME format. --------------030807060802070902070007 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit We've been having trouble getting the -05 version of the threat analysis posted, so my message about the changes that have been incorporated is a bit premature. Here is the modified text: *Introduction, page 4:* Certificate Revocations Lists (CRLs) [RFC5280] are the primary meansof certificate revocation established by IETF standards.Unfortunately, most browsers do not make use of CRLs to check therevocation status of certificates presented by a TLS Server(Subject). Some browsers make use of Online Certificate StatusProtocol (OCSP) data [RFC6960] as a standards-based alternative toCRLs. If a certificate contains an Authority Information Access (AIA ) extension [RFC5280], it directs a replying party to an OCSP server to which a request can be directed. This extension also may be used by a browser to request OCSP responses from a TLS server with which it is communicating [RFC6066, RFC6961]. RFC 5280 does not require inclusion of an AIA extension in certificates, so a browser cannot assume that this extension will be present. The Certification Authority and Browser Forum (CABF) baseline requirements and extended validation guidelines do mandate inclusion of this extension in EE certificates (in conjunction with their certificate policies). (See https://cabforum.org for the most recent versions of these policies.) In addition to the revocation status data dissemination mechanisms specified by IETF standards, most browser vendors employ proprietary means of conveying certificate revocation status information to their products, e.g., via a blacklist that enumerates revoked certificates (EE or CA).Such capabilities enable a browser vendor to cause browsers toreject any certificates on the blacklist. This approach also can be employed to remedy mis-issuance.Throughout the remainder of this document references to certificaterevocation as a remedy encompass this and analogous forms of browser behavior, if available. Note: there are no IETF standards that define browser blacklist mechanisms. 3.2.1.1.1. Self-monitoring Subject < add a second paragraph> A malicious CA might revoke a bogus certificate to avoid having browser vendors take punitive action against the CA and/or to persuade them to not enter the bogus certificate on a vendor-maintained blacklist. However, the CA might provide a “good” OCSP response (from a server it operates) to a targeted user (browser instance) as a way to circumvent the remediation nominally offered by revocation. No component of CT is tasked with detecting this sort of misbehavior by a CA. (The misbehavior is analogous to a log offering split views to different clients. The Audit element of CT is tasked with detecting this sort of attack.) 3.2.1.1.2. Benign third party Monitor If a benign third party monitor is checking the logs to which acertificate was submitted and is protecting the targeted Subject, itwill detect the bogus certificate and will alert the Subject. TheSubject will then ask the CA to revoke the bogus certificate. As in3.2.1.1.1, the CA may or may not revoke the certificate and it might revoke the certificate but provide “good” OCSP responses to a targeted user (browser instance). -------- 3.3 Malicious, Colluding CAs Section 3.2 examined attacks in which a single CA might issue a bogus certificate. There is also the potential that two or more CAs might collude to issue a bogus certificate in a fashion designed to foil the remediation (but not detection) safeguards envisioned by CT. Their goal would be trick a CT-aware browser into accepting a bogus certificate because it was accompanied by a valid SCT, while evading certificate revocation status indications. This section explores such scenarios. In this attack two CAs that do not share a common path to a trust anchor, collude to create a “doppelganger” (bogus) EE certificate. The attack need not be initiated by trust anchors; any subordinate pair of (not name-constrained) CAs can effect this attack without the knowledge of superiors CAs (which are presumed to be benign). The two CAs must have the same Subject name and the same public key for the attack. (RFC 5280 doe not explicitly preclude the creation of two CAs with the same name, so long as the parent CAs are distinct. Requirements for Subject name uniqueness apply individually to each CA but not across CA boundaries, as per Section 4.2.1.6. However, the Security Considerations section of RFC 5280 warns that name collisions could cause security problems.) Because the two CAs have the same name and make use of the same key, each can issue the (bogus) doppelganger certificates. One of the CAs would log the certificate and acquire an SCT for it, while the other would not. Because the bogus certificate is logged, it is subject to detection as such by a Monitor. Once the bogus certificate is detected it is anticipated that action will be taken to render it invalid. The bogus certificate itself might be revoked by the CA that issued and logged it, an action that masks the malicious intent of that CA. A browser vendor might add the bogus certificate to a blacklist maintained by the vendor, e.g., because the CA failed to revoke the bogus certificate. If the CA that logged the bogus certificate is suspected of being malicious, e.g., because it has a history of using bogus certificates, the certificate of that CA might itself be revoked. This revocation might be effected by the parent of that CA (which is not complicit), or by a browser vendor using a blacklist. Whether the proposed attack can achieve its goal depends on which revocation mechanism is employed, and which certificate or certificates are revoked. 3.3.1 Revocation of the Bogus Certificate If the bogus (EE) certificate is revoked by the CA that issued and logged it, browsers should treat that certificate as invalid. However, a browser checking a CRL or OCSP response might not match this revocation status data against the doppelganger issued by the second CA. This is because revocation status checking is performed in the context of a certification path (during path validation). The doppelgangers have different certification paths and thus the revocation status data for each might be acquired and managed independently. (RFC 5280 does not provide implementation guidance for management of revocation data. It is known that some relying party implementations maintain such information on a per-certificate path basis, but others might not.) Even if the bogus certificates contain an AIA extension pointing to an OCSP server the attack might still succeed. (As noted in the Section 1, RFC 5280 does not mandate inclusion this extension, but its presence is required by CABF requirements.) As noted in Section 3.2.1.1.1, a malicious CA could send a “good” OCSP response to a targeted browser instance, even if other parties are provided with a “revoked” response. Also note that a TLS server can supply an OCSP response to a browser as part of the TLS handshake [RFC6961], if requested by the browser. A TLS server posing as the entity named in the bogus certificate could acquire a “good” OCSP response from the colluding CAs to effect the attack. Only if the browser relies upon a trusted, third-party OCSP responder, one not part of the collusion, would the attack fail. The analysis above also applies to the use of CRLs to disseminate certificate revocation status data. The doppelganger certificate could contain a CRL distribution point extension instead of an AIA extension. In that case a site supplying CRLs for the colluding CAs could supply different CRLs to different requestors, in an attempt to hide the revocation status of the doppelganger from targeted browsers instances. This is analogous to a split-view attack effected by a CT log. However, as noted in Section 3.2.1.1 and 3.2.1.1.1, no element of CT is responsible for detecting inconsistent reporting of certificate revocation status data. (Monitoring in the CT context tracks log entries made by CAs or Subjects. Auditing is designed to detect misbehavior by logs, not by CAs per se.) If the CA that logged the certificate does not revoke it, a browser vendor might enter the bogus certificate into a “blacklist”. Unfortunately, there are no IETF standards for such blacklists. Thus it is conceivable that the revocation status data also might be managed in a path-specific fashion. If that were true, then the attack could succeed. However, if a vendor maintains revocation status data in a path-independent fashion, then the attack will fail. For example, if revoked certificates are identified by CA name and serial number, or a hash of the certificate, this attack would fail. 3.2.2 Revocation of the Colluding CA Certificate If the CA that logged the bogus certificate is viewed as acting maliciously, its parent might revoke that CA’s certificate. Even though the two colluding CAs have the same name and use the same public key, their certificates are distinct, e.g., they were issued by different parents and almost certainly have different certificate serial numbers. Thus revocation of the certificate of the CA that logged the bogus certificate does not affect the certificate of its colluding partner. In this case, the bogus EE certificate would be treated as valid when it appears in a certification path involving the second colluding CA. Thus revocation the certificate for the CA that was detected as malicious does not prevent this attack from succeeding. A vendor also might choose to add the certificate of the CA that issued the bogus certificate to its blacklist, e.g., if that CA refuses to revoke the bogus certificate. This also may not prevent the bogus certificate from being accepted by a browser. For example, if the CA certificate blacklist entry is analogous to a CRL entry (Subject name of the parent of the malicious CA and the serial number of the malicious CA’s certificate), the colluding CA’s certificate would still be valid in this case. ------- 3.4 Undetected Compromise of CAs or Logs Sections 3.1 and 3.2 examined attacks in the context of non-malicious and malicious CAs, and benign and misbehaving logs. Another class of attacks might occur in the context of a non-malicious CA and/or a benign log. Specifically these CT elements might be compromised and the compromise might go undetected. Compromise of CAs and logs was noted in Section 2, as was coercion of a CA. As noted there, a compromised CA is essentially a malicious CA, and thus the discussions in Section 3.2 are applicable. The case of an undetected compromise warrants some additional discussion, since some relying parties may see signed objects issued by the legitimate (non-malicious) CA, others may see signed objects from its compromised counterpart, and some may see objects from both. In the case of a compromised CA or log the adversary is presumed to have access to the private key used by a CA to sign certificates, or used by a log to sign SCTs and STHs. Because the compromise is undetected, there will be no effort by a CA to have its certificate revoked or by a log to shut down the log. 3.4.1 Compromised CA, Benign Log In the case of a compromised (non-malicious) CA, an attacker uses the purloined private key to generate a bogus certificate (that the compromised CA would not issue). If this certificate is submitted to a (benign) log, then it subject to detection by a Monitor, as discussed in 3.1.1.1. If the bogus certificate is submitted to a misbehaving log, then an SCT can be generated, but there will be no entry for it, as discussed in 3.1.1.2. If the bogus certificate is not logged, then there will be no SCT, and the implications are as described in 3.1.2. This sort of attack may be most effective if the CA that is the victim of the attack has issueda certificate for the targeted Subject. In this case the bogus certificate will then have the same certification path as the legitimate certificate, which may help hide the bogus certificate. However, means of remedying the attack are independent of this aspect, i.e., revocation canbe effected irrespective of whether the targeted Subject received its certificate from the compromised CA. A compromised (non-malicious) CA may be able to revoke the bogus certificate if it is detected by a Monitor, and the targeted Subject has been notified. It can do so only when the serial number of the bogus certificate is made known to this CA. Also, the bogus certificatecannot have been issued with an Authority Information Access (AIA) or CRL Distribution Point (CRL DP) extension that enables only the malicious twin to revoke the certificate. (The AIA extension in the bogus certificate could be used to direct relying parties to an OCSP server controlled by the malicious twin. The CRL DP extension could be used to direct relying parties to a CRL controlled by the malicious twin.) If the bogus certificate contains either extension, the compromised CA cannot effectively revoke it, but it will also be apparent that the bogus certificate was issued by the malicious twin. (The AIA or CRL DP extension would provide a strong indication that the bogus certificate was not generated by the compromised CA itself.) If the serial number of the bogus certificate is the same as for a valid, not-expired certificate issued by the CA (to the target or to another Subject), then revocationposes a problem. This is because revocation of the bogus certificate will also invalidate a legitimate certificate. This problem may cause the compromised CA to delay revocation, thus allowing the bogus certificate to remain a danger for a longer time. The compromised CA may not realize that the bogus certificate was issued by a malicious twin; one occurrence of this sort might be regarded as an error, and not cause the CA to transition to a new key pair. (This assumes that the bogus certificate does not contain an AIA or CRL DP extension that wrests control of revocation from the compromised CA.) If the compromised CA does determine that its private key has been stolen, it may take some time to transition to a new key pair, and reissue certificates to all of its legitimate Subjects. Thus an attack of this sort may take a while to be remedied. Also note that the malicious twin of the compromised CA may be capable of issuing its own CRL or OCSP responses, without changing any AIA/CRL DP data present in the targeted certificate. The revocation status data from the evil twin will appear as valid as those of the compromised CA. If the attacker has the ability to control the sources of revocation status data available to a targeted user (browser instance), then the user may not become aware of the attack. A bogus certificate issued by the malicious CA will not match the SCT for the legitimate certificate, since they are not identical, e.g., at a minimum the private keys do not match. Thus a CT-aware browser that rejects certificates without SCTs (see 3.1.2.2) will reject a bogus certificate created under these circumstances if it is not logged. If the bogus certificate is detected and logged, browsers that require an SCT will reject the bogus certificate. 3.4.2 Benign CA, Compromised Log A benign CA does not issue bogus certificates, except as a result of an accident or attack. So, in normal operation, it is not clear what behavior by a compromised log would yield an attack. If a bogus certificate is issued by a benign CA (under these circumstances) is submitted to a compromised (non-malicious) log, then both an SCT and a log entry will be created. Again, it is not clear what additional adverse actions the compromised log would perform to further an attack on CT. 3.4.3 Compromised CA, Compromised Log As noted in 3.4.1, an evil twin CA may issue a bogus certificate that contains the same Subject name as a legitimate certificate issued by the compromised CA. Alternatively, the bogus certificate may contain a different name but reuse a serial number from a valid, not revoked certificate issued by that CA. The evil twin CA might submit a bogus certificate to the evil twin of a compromised log. The operator of the evil twin log can use the purloined private key to generate SCTs for certificates that have not been logged by its legitimate counterpart. These SCTs will appear valid relative to the public key associated with the legitimate log. However, an STH issued by the legitimate log will not correspond to a tree containing these SCTs. Thus thorough checking of the SCTs issued by the evil twin log will identify this discrepancy. An Auditor checking for log consistency might conclude that the compromised log is acting maliciously, and is presenting a split view to its clients. In this fashion the compromised log may be shunned and forced to shut down. However, if an attacker targets a set of TLS clients that do not have access to the legitimate log, they may not be able to detect this inconsistency. In this case CT would need to rely on a distributed gossiping audit mechanism to detect the compromise (see Section 5.6). In general, this sort of attack is analogous to a malicious CA creating a bogus certificate and receiving an SCT (with no log entry) from a misbehaving log (Section 4.2.1.2). The lack of a log entry prevents detection of the bogus certificate by Monitors, and the presence of the SCT prevents rejection by a CT-aware browser that accepts SCTs from the compromised log. --------------030807060802070902070007 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit We've been having trouble getting the -05 version of the threat analysis posted, so
my message about the changes that have been incorporated is a bit premature.

Here is the modified text:

Introduction, page 4:

 

   Certificate Revocations Lists (CRLs) [RFC5280] are the primary means of
   certificate revocation established by IETF standards. Unfortunately, most
   browsers do not make use of CRLs to check the revocation status of certificates
   presented by a TLS Server (Subject). Some browsers make use of Online
   Certificate  Status Protocol (OCSP) data [RFC6960] as a standards-based alternative
   to CRLs. If a certificate contains an Authority Information Access (AIA )
   extension [RFC5280], it directs a replying party to an OCSP server to
   which a request can be directed. This extension also may be used by a
   browser to request OCSP responses from a TLS server with which it is
   communicating [RFC6066, RFC6961].

   RFC 5280 does not require inclusion of an AIA extension in certificates,
   so a browser cannot assume that this extension will be present. The
   Certification Authority and Browser Forum (CABF) baseline requirements and
   extended validation guidelines do mandate inclusion of this extension in EE
   certificates (in conjunction with their certificate policies). (See
   https://cabforum.org for the most recent versions of these policies.)

   In addition to the revocation status data dissemination mechanisms specified
   by IETF standards, most browser vendors employ proprietary means of

   conveying certificate revocation status information to their products, e.g.,
   via a blacklist that enumerates revoked certificates (EE or CA).  Such
   capabilities enable a browser vendor to cause browsers to reject any
   certificates on the blacklist. This approach also can be employed to
   remedy mis-issuance.  Throughout the remainder of this document references to
   certificate revocation as a remedy encompass this and analogous forms of
   browser behavior, if available. Note: there are no IETF standards that define
   browser blacklist mechanisms.

 

3.2.1.1.1. Self-monitoring Subject

 

< add a second paragraph>

 

   A malicious CA might revoke a bogus certificate to avoid having browser
   vendors take punitive action against the CA and/or to persuade them to not
   enter the bogus certificate on a vendor-maintained blacklist. However, the CA
   might provide a “good” OCSP response (from a server it operates) to a targeted
   user (browser instance) as a way to circumvent the remediation nominally offered
   by revocation. No component of CT is tasked with detecting this sort of misbehavior
   by a CA. (The misbehavior is analogous to a log offering split views to different
   clients. The Audit element of CT is tasked with detecting this sort of attack.)

 

3.2.1.1.2. Benign third party Monitor

 

   If a benign third party monitor is checking the logs to which a certificate was
   submitted and is protecting the targeted Subject, it will detect the bogus certificate
   and will alert the Subject. The Subject will then ask the CA to revoke the bogus
   certificate. As in 3.2.1.1.1, the CA may or may not revoke the certificate and it
   might revoke the  certificate but provide “good” OCSP responses to a targeted user
   (browser instance).


--------

3.3 Malicious, Colluding CAs


Section 3.2 examined attacks in which a single CA might issue a bogus certificate. There is also the potential that two or more CAs might collude to issue a bogus certificate in a fashion designed to foil the remediation (but not detection) safeguards envisioned by CT. Their goal would be trick a CT-aware browser into accepting a bogus certificate because it was accompanied by a valid SCT, while evading certificate revocation status indications. This section explores such scenarios.


In this attack two CAs that do not share a common path to a trust anchor, collude to create a “doppelganger” (bogus) EE certificate. The attack need not be initiated by trust anchors; any subordinate pair of (not name-constrained) CAs can effect this attack without the knowledge of superiors CAs (which are presumed to be benign). The two CAs must have the same Subject name and the same public key for the attack. (RFC 5280 doe not explicitly preclude the creation of two CAs with the same name, so long as the parent CAs are distinct. Requirements for Subject name uniqueness apply individually to each CA but not across CA boundaries, as per Section 4.2.1.6. However, the Security Considerations section of RFC 5280 warns that name collisions could cause security problems.)


Because the two CAs have the same name and make use of the same key, each can issue the (bogus) doppelganger certificates. One of the CAs would log the certificate and acquire an SCT for it, while the other would not.


Because the bogus certificate is logged, it is subject to detection as such by a Monitor. Once the bogus certificate is detected it is anticipated that action will be taken to render it invalid. The bogus certificate itself might be revoked by the CA that issued and logged it, an action that masks the malicious intent of that CA. A browser vendor might add the bogus certificate to a blacklist maintained by the vendor, e.g., because the CA failed to revoke the bogus certificate.


If the CA that logged the bogus certificate is suspected of being malicious, e.g., because it has a history of using bogus certificates, the certificate of that CA might itself be revoked. This revocation might be effected by the parent of that CA (which is not complicit), or by a browser vendor using a blacklist. Whether the proposed attack can achieve its goal depends on which revocation mechanism is employed, and which certificate or certificates are revoked.


3.3.1 Revocation of the Bogus Certificate


If the bogus (EE) certificate is revoked by the CA that issued and logged it, browsers should treat that certificate as invalid. However, a browser checking a CRL or OCSP response might not match this revocation status data against the doppelganger issued by the second CA. This is because revocation status checking is performed in the context of a certification path (during path validation). The doppelgangers have different certification paths and thus the revocation status data for each might be acquired and managed independently. (RFC 5280 does not provide implementation guidance for management of revocation data. It is known that some relying party implementations maintain such information on a per-certificate path basis, but others might not.)


Even if the bogus certificates contain an AIA extension pointing to an OCSP server the attack might still succeed. (As noted in the Section 1, RFC 5280 does not mandate inclusion this extension, but its presence is required by CABF requirements.)  As noted in Section 3.2.1.1.1, a malicious CA could send a “good” OCSP response to a targeted browser instance, even if other parties are provided with a “revoked” response. Also note that a TLS server can supply an OCSP response to a browser as part of the TLS handshake [RFC6961], if requested by the browser. A TLS server posing as the entity named in the bogus certificate could acquire a “good” OCSP response from the colluding CAs to effect the attack. Only if the browser relies upon a trusted, third-party OCSP responder, one not part of the collusion, would the attack fail.


The analysis above also applies to the use of CRLs to disseminate certificate revocation status data. The doppelganger certificate could contain a CRL distribution point extension instead of an AIA extension. In that case a site supplying CRLs for the colluding CAs could supply different CRLs to different requestors, in an attempt to hide the revocation status of the doppelganger from targeted browsers instances. This is analogous to a split-view attack effected by a CT log. However, as noted in Section 3.2.1.1 and 3.2.1.1.1, no element of CT is responsible for detecting inconsistent reporting of certificate revocation status data. (Monitoring in the CT context tracks log entries made by CAs or Subjects. Auditing is designed to detect misbehavior by logs, not by CAs per se.)

If the CA that logged the certificate does not revoke it, a browser vendor might enter the bogus certificate into a “blacklist”. Unfortunately, there are no IETF standards for such blacklists. Thus it is conceivable that the revocation status data also might be managed in a path-specific fashion. If that were true, then the attack could succeed. However, if a vendor maintains revocation status data in a path-independent fashion, then the attack will fail. For example, if revoked certificates are identified by CA name and serial number, or a hash of the certificate, this attack would fail.


3.2.2 Revocation of the Colluding CA Certificate


If the CA that logged the bogus certificate is viewed as acting maliciously, its parent might revoke that CA’s certificate. Even though the two colluding CAs have the same name and use the same public key, their certificates are distinct, e.g., they were issued by different parents and almost certainly have different certificate serial numbers. Thus revocation of the certificate of the CA that logged the bogus certificate does not affect the certificate of its colluding partner. In this case, the bogus EE certificate would be treated as valid when it appears in a certification path involving the second colluding CA. Thus revocation the certificate for the CA that was detected as malicious does not prevent this attack from succeeding.


A vendor also might choose to add the certificate of the CA that issued the bogus certificate to its blacklist, e.g., if that CA refuses to revoke the bogus certificate. This also may not prevent the bogus certificate from being accepted by a browser. For example, if the CA certificate blacklist entry is analogous to a CRL entry (Subject name of the parent of the malicious CA and the serial number of the malicious CA’s certificate), the colluding CA’s certificate would still be valid in this case.


-------

3.4 Undetected Compromise of CAs or Logs

 

Sections 3.1 and 3.2 examined attacks in the context of non-malicious and malicious CAs, and benign and misbehaving logs. Another class of attacks might occur in the context of a non-malicious CA and/or a benign log. Specifically these CT elements might be compromised and the compromise might go undetected. Compromise of CAs and logs was noted in Section 2, as was coercion of a CA. As noted there, a compromised CA is essentially a malicious CA, and thus the discussions in Section 3.2 are applicable. The case of an undetected compromise warrants some additional discussion, since some relying parties may see signed objects issued by the legitimate (non-malicious) CA, others may see signed objects from its compromised counterpart, and some may see objects from both. In the case of a compromised CA or log the adversary is presumed to have access to the private key used by a CA to sign certificates, or used by a log to sign SCTs and STHs. Because the compromise is undetected, there will be no effort by a CA to have its certificate revoked or by a log to shut down the log.

 

 

3.4.1 Compromised CA, Benign Log

 

In the case of a compromised (non-malicious) CA, an attacker uses the purloined private key to generate a bogus certificate (that the compromised CA would not issue). If this certificate is submitted to a (benign) log, then it subject to detection by a Monitor, as discussed in 3.1.1.1. If the bogus certificate is submitted to a misbehaving log, then an SCT can be generated, but there will be no entry for it, as discussed in 3.1.1.2. If the bogus certificate is not logged, then there will be no SCT, and the implications are as described in 3.1.2. 

 

This sort of attack may be most effective if the CA that is the victim of the attack has issued  a certificate for the targeted Subject. In this case the bogus certificate will then have the same certification path as the legitimate certificate, which may help hide the bogus certificate. However, means of remedying the attack are independent of this aspect, i.e., revocation can  be effected irrespective of whether the targeted Subject received its certificate from the compromised CA.

 

A compromised (non-malicious) CA may be able to revoke the bogus certificate if it is detected by a Monitor, and the targeted Subject has been notified. It can do so only when the serial number of the bogus certificate is made known to this CA. Also, the bogus certificate  cannot have been issued with an Authority Information Access (AIA) or CRL Distribution Point (CRL DP) extension that enables only the malicious twin to revoke the certificate. (The AIA extension in the bogus certificate could be used to direct relying parties to an OCSP server controlled by the malicious twin. The CRL DP extension could be used to direct relying parties to a CRL controlled by the malicious twin.)  If the bogus certificate contains either extension, the compromised CA cannot effectively revoke it, but it will also be apparent that the bogus certificate was issued by the malicious twin. (The AIA or CRL DP extension would provide a strong indication that the bogus certificate was not generated by the compromised CA itself.)

 

If the serial number of the bogus certificate is the same as for a valid, not-expired certificate issued by the CA (to the target or to another Subject), then revocation  poses a problem. This is because revocation of the bogus certificate will also invalidate a legitimate certificate. This problem may cause the compromised CA to delay revocation, thus allowing the bogus certificate to remain a danger for a longer time.

 

The compromised CA may not realize that the bogus certificate was issued by a malicious twin; one occurrence of this sort might be regarded as an error, and not cause the CA to transition to a new key pair. (This assumes that the bogus certificate does not contain an AIA or CRL DP extension that wrests control of revocation from the compromised CA.)  If the compromised CA does determine that its private key has been stolen, it may take some time to transition to a new key pair, and reissue certificates to all of its legitimate Subjects. Thus an attack of this sort may take a while to be remedied.

 

Also note that the malicious twin of the compromised CA may be capable of issuing its own CRL or OCSP responses, without changing any AIA/CRL DP data present in the targeted certificate. The revocation status data from the evil twin will appear as valid as those of the compromised CA. If the attacker has the ability to control the sources of revocation status data available to a targeted user (browser instance), then the user may not become aware of the attack.

 

A bogus certificate issued by the malicious CA will not match the SCT for the legitimate certificate, since they are not identical, e.g., at a minimum the private keys do not match.  Thus a CT-aware browser that rejects certificates without SCTs (see 3.1.2.2) will reject a bogus certificate created under these circumstances if it is not logged. If the bogus certificate is detected and logged, browsers that require an SCT will reject the bogus certificate.

 

3.4.2 Benign CA, Compromised Log

 

A benign CA does not issue bogus certificates, except as a result of an accident or attack. So, in normal operation, it is not clear what behavior by a compromised log would yield an attack. If a bogus certificate is issued by a benign CA (under these circumstances) is submitted to a compromised (non-malicious) log, then both an SCT and a log entry will be created. Again, it is not clear what additional adverse actions the compromised log would perform to further an attack on CT.

 

3.4.3 Compromised CA, Compromised Log

 

As noted in 3.4.1, an evil twin CA may issue a bogus certificate that contains the same Subject name as a legitimate certificate issued by the compromised CA. Alternatively, the bogus certificate may contain a different name but reuse a serial number from a valid, not revoked certificate issued by that CA.

 

The evil twin CA might submit a bogus certificate to the evil twin of a compromised log. The operator of the evil twin log can use the purloined private key to generate SCTs for certificates that have not been logged by its legitimate counterpart. These SCTs will appear valid relative to the public key associated with the legitimate log. However, an STH issued by the legitimate log will not correspond to a tree containing these SCTs. Thus thorough checking of the SCTs issued by the evil twin log will identify this discrepancy.

 

An Auditor checking for log consistency might conclude that the compromised log is acting maliciously, and is presenting a split view to its clients. In this fashion the compromised log may be shunned and forced to shut down. However, if an attacker targets a set of TLS clients that do not have access to the legitimate log, they may not be able to detect this inconsistency. In this case CT would need to rely on a distributed gossiping audit mechanism to detect the compromise (see Section 5.6).

 

In general, this sort of attack is analogous to a malicious CA creating a bogus certificate and receiving an SCT (with no log entry) from a misbehaving log (Section 4.2.1.2). The lack of a log entry prevents detection of the bogus certificate by Monitors, and the presence of the SCT prevents rejection by a CT-aware browser that accepts SCTs from the compromised log.

 

 

 

 

 

 

 




--------------030807060802070902070007-- From nobody Thu Apr 14 10:35:40 2016 Return-Path: X-Original-To: trans@ietf.org Delivered-To: trans@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B393112DBA9; Thu, 14 Apr 2016 10:35:39 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.19.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160414173539.6872.46290.idtracker@ietfa.amsl.com> Date: Thu, 14 Apr 2016 10:35:39 -0700 Archived-At: Cc: trans@ietf.org Subject: [Trans] I-D Action: draft-ietf-trans-threat-analysis-05.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Apr 2016 17:35:39 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Public Notary Transparency of the IETF. Title : Attack Model and Threat for Certificate Transparency Author : Stephen Kent Filename : draft-ietf-trans-threat-analysis-05.txt Pages : 31 Date : 2016-04-07 Abstract: This document describes an attack model and discusses threats for the Web PKI context in which security mechanisms to detect mis- issuance of web site certificates are being developed. The model provides an analysis of detection and remediation mechanisms for both syntactic and semantic mis-issuance. The model introduces an outline of attacks to organize the discussion. The model also describes the roles played by the elements of the Certificate Transparency (CT) system, to establish a context for the model. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-trans-threat-analysis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-trans-threat-analysis-05 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-trans-threat-analysis-05 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Apr 19 05:57:18 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD4C212DCF6 for ; Tue, 19 Apr 2016 05:57:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.696 X-Spam-Level: X-Spam-Status: No, score=-3.696 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.996, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tmk1TT6g3aXQ for ; Tue, 19 Apr 2016 05:57:13 -0700 (PDT) Received: from mail-ig0-x236.google.com (mail-ig0-x236.google.com [IPv6:2607:f8b0:4001:c05::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D32212E258 for ; Tue, 19 Apr 2016 05:57:13 -0700 (PDT) Received: by mail-ig0-x236.google.com with SMTP id gy3so98445697igb.0 for ; Tue, 19 Apr 2016 05:57:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:date:message-id:subject:from:to; bh=N04UWQlBCvVlvJpZi/UnewfwgUWzi4EEJWxd/R4+ZFA=; b=VHAJT//NsLIRHhb1kvyJ3RA89Z0wWV2LxUbcM8kl8QtguxkNqQrqBh0BAIbDC7SVqA Xy1gu2KyCE6is1TVM50vnTE2d23PLsHznix2VIObJoMD9Gr3hLcvwRYgYPXPBu0KYC6t 7lyZvu/36A+IdQP20y+184ZblrCEtBHJu23XelnGD80VNVxlzxsG6VoIClftpst1lc+F l2IabxuLsMTJU91wn2mdt9JxigLxIB/2yFQ5zct/WaLiep6rrrBS+C3SxatotZIopQ4Y K45H3XlWJBdkIPKdz34kETZrvzJPhTjOM0vmsomjnAEiJv70ejRddoFh5OcNx/V6Ip+y +xsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to; bh=N04UWQlBCvVlvJpZi/UnewfwgUWzi4EEJWxd/R4+ZFA=; b=KOnZwF4xMY/+ACwapXofYZMWZEy92MdgqJzUKkBJFM4uqpmnWaHuuGeYOR6lXdJB2e 6JuS6YZVeHkcN4EGeEjTDcwG2yEibTI5hZYwHdmZ8TBRkuOEVSy8O8C4fS78qe/E/AoB B+38tlVDAP71ZLZafIaw+lUrs6LLDXKGiZmfkhAb0ibqswX/SYgiFPN2IJ4TTZuf4Ur9 Y4AYs3ZgA7bzyUWcrKpO8xPoA/xz3YAaKQ4RrfaBgguqKtlQMc74DOGQ13YYtxe3/R51 E1WpaVtjPmcmdgb3cIb7WNSDWfJYETt78yE5FusSwdqNesoWRNAnBNcYylQDmmZGIKfn kmvA== X-Gm-Message-State: AOPr4FVGGRoPpRjsoeoLCG6t/y509NRHOPZgPvMGUhJfhCLQ1PwIy1rYvQ12OHUCJhuZNb3+RmRkzinOSUtjg2iM MIME-Version: 1.0 X-Received: by 10.50.29.73 with SMTP id i9mr3766061igh.32.1461070632063; Tue, 19 Apr 2016 05:57:12 -0700 (PDT) Received: by 10.64.245.105 with HTTP; Tue, 19 Apr 2016 05:57:11 -0700 (PDT) Date: Tue, 19 Apr 2016 13:57:11 +0100 Message-ID: From: Ben Laurie To: "trans@ietf.org" Content-Type: multipart/alternative; boundary=047d7bd76d7a0486a80530d604ae Archived-At: Subject: [Trans] Comments on draft-ietf-trans-threat-analysis-05 X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Apr 2016 12:57:16 -0000 --047d7bd76d7a0486a80530d604ae Content-Type: text/plain; charset=UTF-8 (looking at the TXT version) Page 3 First para ends with a spurious ")". There are two classes of beneficiaries of CT: certificate Subjects and relying parties (RPs). In the initial focus context of CT, the Web PKI, Subjects are web sites and RPs are browsers employing HTTPS to access these web sites. CAs are also beneficiaries - they get to find out about key loss or abuse of their platform, for example. it directs a replying party to an OCSP server Should be "relying". Page 4 Finally, if an RP were to check logs for individual certificates, that would disclose to logs the identity of web sites being visited by the RP, a privacy violation. Thus this attack model assumes that RPs will not check log entries. It is not clear that: a) All RPs care about privacy in this respect, b) That checking logs is necessarily privacy violating (for example, we've announced an experimental DNS-based protocol for log checking, which we are implementing in Chrome), therefore it seems unwarranted to assume that RPs will not check log entries. Page 5 There is no agreed-upon Audit function design for CT at the time of this writing. As a result, the model merely notes where Auditing is needed to detect certain classes of attacks. Section 9.4 of 6962-bis-14 has a comprehensive design for auditing. Page 6 [ 4] SCT (embedded in pre-cert, if applicable) SCTs are not embedded in pre-certs. Page 8 Spoofing enables an adversary to acquire information that a TLS-enabled client would not communicate if the client were aware of the spoofing. There are surely many other issues with spoofing - e.g. serving malware. An adversary may achieve this in various ways, e.g., by causing a user to click on a link to the website, or by manipulation of the DNS response sent to a TLS client. If a link alone works, then the site is not spoofed with a mis-issued certificate, surely? Also, MitM is probably the most common attack vector. The elements of CT may themselves be targets of attacks, as described below. A criminal organization might compromise a CA and cause it to issue bogus certificates, or it may exert influence over a CA (or CA staff) to do so, e.g., through extortion or physical threat. (Even though the CA is not intentionally malicious in this case, the action is equivalent to a malicious CA, hence the use of the term "bogus" here.) A nation state may operate or influence a CA that is part of the large set of "root CAs" in browsers. A CA, acting in this fashion, is termed a "malicious" CA. A nation state also might compromise a CA in another country, to effect issuance of bogus certificates. In this case the (non-malicious) CA, upon detecting the compromise (perhaps because of CT) is expected to work with Subjects to remedy the mis-issuance. There's also social engineering, which is mentioned elsewhere, but I suspect should be here, too. It seems unlikely that a compromised, non-malicious, log would... This seems odd - a compromised non-malicious log is effectively uncompromised, isn't it? Page 9. CT is not designed to detect and counter this type of locally-authorized interception. Actually CT is designed to detect it but it seems likely that browsers will explicitly ignore it. Page 10. (and elsewhere) is there really any difference between a benign third-part monitor and self-monitoring? Couldn't the doc be simplified by treating them as the same? (A misbehaving log also could create and report entries for bogus certificates that have not been issued by the indicated CA (hereafter called "fake") This is slightly confusing, as on the face of it, the log could not create such a cert, since it doesn't have the CA key. Later wording makes it clear that the idea is that the cert would not, in fact, be signed by a trusted CA. 3.1.1.2.1/3.1.1.2.2 Since I think that benign third party and self monitors are essentially the same, it is odd that these two sections differ so much. Page 11. Note that independent of any mis-issuance on the part of the CA, a misbehaving Monitor could issue false warnings to a Subject that it protects. These could cause the Subject to report non-existent semantic problems to the issuing CA and cause the CA to do needless investigative work or perhaps incorrectly revoke and re-issue the Subject's certificate. This para is general, rather than to do with the section it is in, and hence should probably be somewhere else. However, the CT architecture does not describe how such behavior by browsers can be deployed incrementally throughout the Internet. As a result, this attack model does not assume that browsers will reject a certificate that is not accompanied by an SCT. Given that incremental deployment is already under way, this seems unnecessarily dogmatic. Page 13. For example, the CA could make excuses about inadequate proof that the certificate is bogus, or argue that it cannot quickly revoke the certificate because of legal concerns, etc. In this case, the CT mechanisms will have detected mis-issuance, but the information logged by CT does not help remedy the problem. (See Sections 4 and 6.) The logged information clearly _helps_, it just may not be all that is needed. Page 14. 3.2.2.1 is essentially the same as 3.1.1.2, just refer to the previous text? Page 15. Their goal would be trick a CT-aware browser into accepting a bogus certificate because it was accompanied by a valid SCT, while evading certificate revocation status indications. This section explores such scenarios. The attack as described only requires colluding CAs in the case where EE certs do not contain links to revocation information. When EE certs do contain such links, the attack described is simply an attack on certificate revocation, regardless of whether one or more CAs might have issued the doppelgangers. In either case, the attack is nothing to do with CT, which does not claim to do anything to help with integrity or correctness of revocation information. Even if the bogus certificates contain an AIA extension pointing to an OCSP server the attack might still succeed. (As noted in the Section 1, RFC 5280 does not mandate inclusion this extension, but its presence is required by CABF requirements.) As noted in Section 3.2.1.1.1, a malicious CA could send a "good" OCSP response to a targeted browser instance, even if other parties are provided with a "revoked" response. Also note that a TLS server can supply an OCSP response to a browser as part of the TLS handshake [RFC6961], if requested by the browser. A TLS server posing as the entity named in the bogus certificate could acquire a "good" OCSP response from the colluding CAs to effect the attack. Only if the browser relies upon a trusted, third-party OCSP responder, one not part of the collusion, would the attack fail. All this is independent of the attack and of CT, and applies generally to revocation. The analysis above also applies to the use of CRLs to disseminate certificate revocation status data. The doppelganger certificate could contain a CRL distribution point extension instead of an AIA extension. In that case a site supplying CRLs for the colluding CAs could supply different CRLs to different requestors, in an attempt to hide the revocation status of the doppelganger from targeted browsers instances. This is analogous to a split-view attack effected by a CT log. However, as noted in Section 3.2.1.1 and 3.2.1.1.1, no element of CT is responsible for detecting inconsistent reporting of certificate revocation status data. (Monitoring in the CT context tracks log entries made by CAs or Subjects. Auditing is designed to detect misbehavior by logs, not by CAs per se.) Likewise. Page 20. This will happen only if the log performs syntactic checks in general, and if the log is capable of performing the checks applicable to the submitted (pre-)certificate. Anyone can detect syntactic mis-issuance, the log does not need to do it. For example: https://crt.sh/?cablint=1+week . Page 21. If the (pre-)certificate is submitted by the non-malicious issuing CA, and if the CA has a record of the certificate content Clearly there is a record in the log! This analysis suggests that syntactic mis-issuance of a certificate can be avoided by a CA if it makes use of logs that are capable of performing these checks for the types of certificates that are submitted, The CA can obviously perform these checks itself, logs are not special in this regard. Throughout this section there is talk about syntactic checking by logs, which is not a defined function of logs. Unfortunately, experience suggests that many browsers do not perform thorough syntactic checks on certificates, and so it seems unlikely that browsers will be a reliable way to detect erroneous certificates. What is unfortunate is that a very large number of extant certs have syntax errors and so browsers can't usefully perform checks. Moreover, a protocol used by a browser to notify a Subject and/or CA of an erroneous certificate represents a DoS potential, and thus may not be appropriate. Subjects are already subject to DoS by virtue of serving web pages. This doesn't seem like a valid concern. Such browsers would benefit from having such checks performed by a log and reported in the SCT. Browsers don't need help to perform syntax checks, it just isn't viable to do so. Page 26. Thus, for now, CT does not seem to provide a way to remedy this form of attack, even though it provides a basis for detecting such attacks. CT doesn't claim to provide remedies for attacks, just information that reveals them. Once more, you are describing a flaw with the whole system, not a flaw in CT. Absent a well-defined mechanism that enables Monitors to verify that data from logs are reported in a consistent fashion, CT cannot claim to provide protection against logs that are malicious or may conspire with, or are victims of, attackers effecting certificate mis-issuance. The mechanism needs to protect the privacy of users with respect to which web sites they visit. It needs to scale to accommodate a potentially large number of self-monitoring Subjects and a vast number of browsers, if browsers are part of the mechanism. Even when an Audit mechanism is defined, it will be necessary to describe how the CT system will deal with a misbehaving or compromised log. For example, will there be a mechanism to alert all browsers to reject SCTs issued by such a log? Absent a description of a remediation strategy to deal with misbehaving or compromised logs, CT cannot ensure detection of mis-issuance in a wide range of scenarios. The absence of a standard to do a thing does not make the thing impossible. In practice, none of this actually seems to be a problem, nor in need of standardisation at this time. --047d7bd76d7a0486a80530d604ae Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
(looking at the TXT version)

Page 3

First para ends with a spurious ")".<= div>
There are two classes of beneficiaries of CT: certificate Sub= jects
=C2=A0=C2=A0and relying parties (RPs). In the initial focus context of CT= , the
 =C2=A0=C2=A0Web PKI, = Subjects are web sites and RPs are browsers employing HTTPS
 =C2=A0=C2=A0to access these web sites.

CAs are also beneficiaries - they get to find= out about key loss or abuse of their platform, for example.

=
=C2=A0 =C2=A0 =C2=A0=C2=A0it directs a replying party to an OCSP<= /div> =C2=A0=C2=A0serve= r

Should be = "relying".

Page 4

Finally, if an RP were = to check logs for
 =C2=A0=C2=A0individua= l certificates, that would disclose to logs the identity of
=C2=A0=C2=A0web sites being visited by the RP, a priva= cy violation. Thus this
 =C2=A0=C2=A0att= ack model assumes that RPs will not check log entries.
<= /span>

It is not clear that:

<= div>a) All RPs care about privacy in this respect,

b) That checking logs is necessarily privacy violating (for example, we= 9;ve announced an experimental DNS-based protocol for log checking, which w= e are implementing in Chrome),

therefore it seems = unwarranted to assume that RPs will not check log entries.

Page 5

There is no
 =C2=A0=C2=A0agreed-upon = Audit function design for CT at the time of this
 =C2=A0=C2=A0writing. As a result, the model merely notes where Auditi= ng is
 =C2=A0=C2=A0needed to detect certain cl= asses of attacks.

Section 9.4 of 6962-bis-14 = has a comprehensive design for auditing.

Page 6

[ 4] SCT (embedded i= n pre-cert, if applicable)

SCTs are not embedded= in pre-certs.

Page 8

Spoofing
 =C2=A0=C2=A0enables an ad= versary to acquire information that a TLS-enabled =C2=A0= =C2=A0client would not communicate if the client were aware of the
 =C2=A0=C2=A0spoofing.

There are surely= many other issues with spoofing - e.g. serving malware.

An adversary
 =C2=A0=C2=A0may achieve = this in various ways, e.g., by causing a user to click
 =C2=A0= =C2=A0on a link to the website, or by manipulation of the DNS response
 =C2=A0=C2=A0sent to a TLS client.

If a l= ink alone works, then the site is not spoofed with a mis-issued certificate= , surely?

Also, MitM is probably the most common attack = vector.

The elements of CT may = themselves be targets of attacks, as
 =C2=A0=C2=A0described below. A c= riminal organization might compromise a CA and
 =C2=A0=C2=A0cause it t= o issue bogus certificates, or it may exert influence over
 =C2=A0=C2= =A0a CA (or CA staff) to do so, e.g., through extortion or physical<= span style=3D"font-size:13.3333px;font-family:'courier new';color:r= gb(0,0,0);vertical-align:baseline;white-space:pre-wrap;background-color:rgb= (255,253,245)">
 = =C2=A0=C2=A0threat. (Even though the CA is not intentionally malicious in t= his
 =C2=A0=C2=A0case, the action is equivalent to a malicious CA, hen= ce the use of
=C2=A0=C2=A0the term "bogus" here.) A nation = state may operate or influence a CA
 =C2=A0=C2=A0that is part of the l= arge set of "root CAs" in browsers. A CA,<= br class=3D"gmail-gmail-gmail-gmail-gmail-gmail-gmail-gmail-gmail-gmail-gma= il-gmail-gmail-gmail-gmail-gmail-gmail-gmail-gmail-gmail-gmail-gmail-gmail-= gmail-gmail-gmail-kix-line-break"> =C2=A0=C2=A0actin= g in this fashion, is termed a "malicious" CA. A nation state
 =C2=A0=C2=A0also might compromise a CA in another country, to effect iss= uance of
 =C2=A0=C2=A0bogus certificates. In this case the (non-malici= ous) CA, upon
=C2=A0=C2=A0detecting the compromise (perhaps because o= f CT) is expected to work
 =C2=A0=C2=A0with Subjects to remedy the mis= -issuance.
=

There's also social engineering, which= is mentioned elsewhere, but I suspect should be here, too.

<= /div>
It seems unlikely that a
 =C2=A0=C2=A0compromised, no= n-malicious, log would...

This seems odd - a com= promised non-malicious log is effectively uncompromised, isn't it?
=
Page 9.

CT is not designed t= o
 =C2= =A0=C2=A0detect and counter this type of locally-authorized interception.
=
Actually CT is designed to detect i= t but it seems likely that browsers will explicitly ignore it.

Page 10.

(and elsewhere) is there really an= y difference between a benign third-part monitor and self-monitoring? Could= n't the doc be simplified by treating them as the same?

<= /div>
(A misbehaving log also could create and report entries
 =C2=A0=C2=A0for bogu= s certificates that have not been issued by the indicated CA
 =C2=A0=C2=A0(hereafter cal= led "fake")

This is slightly conf= using, as on the face of it, the log could not create such a cert, since it= doesn't have the CA key. Later wording makes it clear that the idea is= that the cert would not, in fact, be signed by a trusted CA.
3.1.1.2.1/3.1.1.2.2
<= /span>

Since I think that benign third party and self monito= rs are essentially the same, it is odd that these two sections differ so mu= ch.

Page 11.

Note that independent of any mis-is= suance on the part of the CA, a
 =C2=A0=C2=A0misbehaving Monitor could issue false warnings to a Subject t= hat it
 =C2=A0=C2=A0protects. T= hese could cause the Subject to report non-existent<= br class=3D"gmail-gmail-gmail-gmail-gmail-gmail-gmail-gmail-gmail-gmail-gma= il-gmail-gmail-gmail-gmail-gmail-gmail-gmail-gmail-gmail-kix-line-break"> =C2=A0=C2=A0semantic problems to the issuing CA and c= ause the CA to do needless
 =C2= =A0=C2=A0investigative work or perhaps incorrectly revoke and re-issue the<= /span>
 =C2=A0=C2=A0Subject's cert= ificate.

This para is general, rather than to do= with the section it is in, and hence should probably be somewhere else.
Howeve= r, the CT architecture does not describe how
 =C2=A0=C2=A0such behavior by browsers can be deployed incrementall= y throughout
 =C2=A0=C2=A0the Interne= t. As a result, this attack model does not assume that
=C2=A0=C2=A0browsers will reject a certificate that is n= ot accompanied by an
 =C2=A0=C2=A0SCT= .

Given that incremental deployment is already u= nder way, this seems unnecessarily dogmatic.

Page 13.

For ex= ample, the CA could make excuses about inadequate =C2=A0=C2=A0proof that the certificate is bogus, or argue that it c= annot quickly
 =C2=A0=C2=A0revoke the certi= ficate because of legal concerns, etc. In this case,=
=C2=A0=C2=A0the CT mechanisms will have detected mis-issuance, b= ut the
 =C2=A0=C2=A0information logged by C= T does not help remedy the problem. (See
 = =C2=A0=C2=A0Sections 4 and 6.)

The logged = information clearly _helps_, it just may not be all that is needed.
Page 14.

3.2.2.1 is essentially the sa= me as 3.1.1.2, just refer to the previous text?

Pa= ge 15.

The= ir goal would be trick a CT-aware browser into accepting a
 =C2=A0=C2=A0bogus certificate because it was accompanied by a va= lid SCT, while
 =C2=A0=C2=A0evading certificate r= evocation status indications. This section
 =C2= =A0=C2=A0explores such scenarios.

The attack as = described only requires colluding CAs in the case where EE certs do not con= tain links to revocation information.

When EE certs do contain such = links, the attack described is simply an attack on certificate revocation, = regardless of whether one or more CAs might have issued the doppelgangers.<= br>
In either case, the attack is nothing to do with CT, which does not = claim to do anything to help with integrity or correctness of revocation in= formation.

Even if the bogus= certificates contain an AIA extension pointing to =C2=A0=C2= =A0an OCSP server the attack might still succeed. (As noted in the
 =C2=A0=C2=A0Section 1, RFC 5280 does not mandate inclusion this exte= nsion, but
=C2=A0=C2=A0its presence is required by CABF requ= irements.) =C2=A0As noted in Section
 =C2=A0=C2=A03.2.1.1.1, = a malicious CA could send a "good" OCSP response to a
=C2=A0=C2=A0targeted browser instance, even if other parties are prov= ided with a
 =C2=A0=C2=A0"revoked" response. Also n= ote that a TLS server can supply an OCSP
 =C2=A0=C2=A0respons= e to a browser as part of the TLS handshake [RFC6961], if
 = =C2=A0=C2=A0requested by the browser. A TLS server posing as the entity nam= ed in
=C2=A0=C2=A0the bogus certificate could acquire a &quo= t;good" OCSP response from the
 =C2=A0=C2=A0colluding CA= s to effect the attack. Only if the browser relies upon
 = =C2=A0=C2=A0a trusted, third-party OCSP responder, one not part of the
 =C2=A0=C2=A0collusion, would the attack fail.
<= span>
All this is independent of the= attack and of CT, and applies generally to revocation.

=
=C2=A0= =C2=A0The analysis above also applies to the use of CRLs to disseminate
 = =C2=A0=C2=A0certificate revocation status data. The doppelganger certificat= e
 =C2=A0=C2=A0could contain a CRL distribution point extension instead = of an AIA
 =C2=A0=C2=A0extension. In that case a site supplying CRLs for = the colluding CAs
=C2=A0=C2=A0could supply different CRLs to different r= equestors, in an attempt
 =C2=A0=C2=A0to hide the revocation status of th= e doppelganger from targeted
 =C2=A0=C2=A0browsers instances. This is ana= logous to a split-view attack
 =C2=A0=C2=A0effected by a CT log. However,= as noted in Section 3.2.1.1 and
 =C2=A0=C2=A03.2.1.1.1, no element of CT= is responsible for detecting
 =C2=A0=C2=A0inconsistent reporting of cert= ificate revocation status data.
 =C2=A0=C2=A0(Monitoring in the CT contex= t tracks log entries made by CAs or
 =C2=A0=C2=A0Subjects. Auditing is de= signed to detect misbehavior by logs, not by
 =C2=A0=C2=A0CAs per se.)
Likewise.

Page 20.

T= his will happen
 =C2=A0=C2=A0only if the log performs syntactic checks in gener= al, and if the log
<= span style=3D"font-size:13.3333px;font-family:'courier new';color:r= gb(0,0,0);vertical-align:baseline;white-space:pre-wrap;background-color:rgb= (255,253,245)"> =C2=A0=C2=A0is capable of performing the checks applicable = to the submitted
 =C2=A0=C2=A0(pre-)certificate.

An= yone can detect syntactic mis-issuance, the log does not need to do it.

Page 21.

If the (pre-)certificate is submitted by the non-malicious iss= uing
 =C2=A0=C2=A0CA, = and if the CA has a record of the certificate content

Clearly there is a rec= ord in the log!

This analysis suggests that syntactic mis-issuance of = a certificate
 =C2=A0=C2=A0c= an be avoided by a CA if it makes use of logs that are capable of
=C2=A0=C2=A0performing these checks = for the types of certificates that are
 =C2=A0=C2=A0submitted,

The CA can o= bviously perform these checks itself, logs are not special in this regard.<= div>
Throughout this section there is talk about syntactic ch= ecking by logs, which is not a defined function of logs.

Unfortunately= , experience suggests that
 =C2=A0= =C2=A0many browsers do not perform thorough syntactic checks on
 =C2=A0=C2=A0certificates, and so it seems un= likely that browsers will be a
 = =C2=A0=C2=A0reliable way to detect erroneous certificates.

What is unfortunate is that a very large number of extant certs= have syntax errors and so browsers can't usefully perform checks.
=
Moreover, a proto= col
 =C2=A0=C2=A0used by a browser to notify a= Subject and/or CA of an erroneous
 =C2=A0=C2= =A0certificate represents a DoS potential, and thus may not be
=C2=A0=C2=A0appropriate.

Subje= cts are already subject to DoS by virtue of serving web pages. This doesn&#= 39;t seem like a valid concern.

Such browsers would benefit from
 =C2=A0=C2=A0havi= ng such checks performed by a log and reported in the SCT.
Browsers don't need help to perform syntax checks, it just isn't = viable to do so.

Page 26.

<= span style=3D"font-size:13.3333px;font-family:'courier new';color:r= gb(0,0,0);vertical-align:baseline;white-space:pre-wrap;background-color:rgb= (255,253,245)"> Thus, for now, CT does not seem to provide a
 = =C2=A0=C2=A0way to remedy this form of attack, even though it provides a ba= sis
<= span style=3D"font-size:13.3333px;font-family:'courier new';color:r= gb(0,0,0);vertical-align:baseline;white-space:pre-wrap;background-color:rgb= (255,253,245)"> =C2=A0=C2=A0for detecting such attacks.

CT do= esn't claim to provide remedies for attacks, just information that reve= als them. Once more, you are describing =C2=A0a flaw with the whole system,= not a flaw in CT.

=C2=A0Absent a well= -defined mechanism that enables Monitors to verify that
 =C2=A0=C2= =A0data from logs are reported in a consistent fashion, CT cannot claim
 =C2=A0=C2=A0to provide protection against logs that are malicious or may=
=C2=A0=C2=A0conspire with, or are victims of, attackers effecting ce= rtificate
<= span style=3D"font-size:13.3333px;font-family:'courier new';color:r= gb(0,0,0);vertical-align:baseline;white-space:pre-wrap;background-color:rgb= (255,253,245)"> =C2=A0=C2=A0mis-issuance. The mechanism needs to protect th= e privacy of users
 =C2=A0=C2=A0with respect to which web sites they v= isit. It needs to scale to
 =C2=A0=C2=A0accommodate a potentially larg= e number of self-monitoring Subjects
 =C2=A0=C2=A0and a vast number of= browsers, if browsers are part of the
 =C2=A0=C2=A0mechanism. Even wh= en an Audit mechanism is defined, it will be
 =C2=A0=C2=A0necessary to= describe how the CT system will deal with a misbehaving
 =C2=A0=C2= =A0or compromised log. For example, will there be a mechanism to alert
 =C2=A0=C2=A0all browsers to reject SCTs issued by such a log? Absent a
 =C2=A0=C2=A0description of a remediation strategy to deal with misbeh= aving or
 =C2=A0=C2=A0compromised logs, CT cannot ensure detection of = mis-issuance in a
= =C2=A0=C2=A0wide range of scenarios.

The absence of a standard to do a thing does not make the thing impossib= le. In practice, none of this actually seems to be a problem, nor in need o= f standardisation at this time.

--047d7bd76d7a0486a80530d604ae-- From nobody Tue Apr 26 12:07:59 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E19512B069 for ; Tue, 26 Apr 2016 12:07:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ojQaTlTSv9eq for ; Tue, 26 Apr 2016 12:07:56 -0700 (PDT) Received: from mail-pf0-x234.google.com (mail-pf0-x234.google.com [IPv6:2607:f8b0:400e:c00::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8BCF312D56C for ; Tue, 26 Apr 2016 12:07:56 -0700 (PDT) Received: by mail-pf0-x234.google.com with SMTP id y69so10403603pfb.1 for ; Tue, 26 Apr 2016 12:07:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=to:from:subject:message-id:date:user-agent:mime-version :content-transfer-encoding; bh=bCg0LCtt35ARWEnpGtowb7fFDwtSQQS5Y1W7LalbLKw=; b=I3HQAGDxfaVW9pbXzsg1Wy5q3+ICJ55YRmOtixhyc5IqSy7DpbPut3etpqafbmKZd/ fkT70uiwenZZUn/+CRlKjt57Wp+XlmM0VXFHU6cS5vGbrYX3Qfoz4W5bJzS+RdJiGGhd NRNUgdFtfm/NWPzgJ/ZZcCf2OgoEop0VoH6suZ4qkPee9Dok/PyrADIFSEc84vqHIxkN X4D7wbfHUc3Bq1GRTZrQtARW+1AgWWepHK1Gtm30T1xNxbJxQr4C5ZwNSczfSvBiOZg2 6DqSsVm7eo6BPKEmXN8CoirHRSzg8YiXyvpFrXJG+49hVlxi9qCDaksljAbK9bEfcKSY ak3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version:content-transfer-encoding; bh=bCg0LCtt35ARWEnpGtowb7fFDwtSQQS5Y1W7LalbLKw=; b=MqBM5xgs64lqMwAnOJ1yBwaPdBo8LniC7Q10SZ5O4hFPexpBycKhh/4cUBRPS3xsy+ 0bbccovsGmZULCNXm2FpnjOppLgFmBq1s4iVFbJfZDBH/KF3ZSbXDOgGfaHG1Ik/lKOT Yls7wpUCpb0FSbzc+ukaRxeI9DoGBXUwiEjCBbrfB2PLDruLUrpqY4vZ0OztfvIOyd/E S4UaaDjWWZ692Rwa0qTdpgqv++USteaNZihSYJqxMHfMB3/E5mUrNBjl5GPFU2v/0/Fx 2KEGxo47+LkQfvmeWh3qxTJji4FLPczBH/cYMF/4YU4KVn+jbQoAsFHRVRXwNH7zyQhp q4RA== X-Gm-Message-State: AOPr4FWDPx68ztez8FDANPFzjBtlccvRKvvNMlEhG0e35n3iE6uhB6GmH9Ib7F3wjxUAqg== X-Received: by 10.98.69.132 with SMTP id n4mr5918503pfi.53.1461697676044; Tue, 26 Apr 2016 12:07:56 -0700 (PDT) Received: from Melindas-MacBook-Pro.local (216-67-79-5-radius.dynamic.acsalaska.net. [216.67.79.5]) by smtp.googlemail.com with ESMTPSA id y2sm135518pfi.39.2016.04.26.12.07.54 for (version=TLSv1/SSLv3 cipher=OTHER); Tue, 26 Apr 2016 12:07:55 -0700 (PDT) To: "trans@ietf.org" From: Melinda Shore Message-ID: <571FBC96.5080202@gmail.com> Date: Tue, 26 Apr 2016 11:08:06 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0) Gecko/20100101 Thunderbird/38.7.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [Trans] IETF 96 planning X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Apr 2016 19:07:57 -0000 Hi, all: At the moment it doesn't look like there's much on the table[*], although we've got some pending work on gossip and on logging other types of data (DNSSEC, blobs). I'm hopeful that we'll be making progress on both types of documents and it's possible there will be issues that will benefit from face-to-face discussion, so I'd like to go ahead and request a 1-hour session, with the possibility of cancelling it if we don't need it. If you are planning on asking for time on the agenda, please make sure that there's been enough mailing list discussion of your draft to identify what issues would benefit from in-person conversation. Melinda [* the -bis document will be starting working group last call shortly, and the threat document will restart working group last call once Steve addresses Ben's comments.] From nobody Tue Apr 26 12:13:49 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 040B712D56A for ; Tue, 26 Apr 2016 12:13:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a2WOkPCFA_QC for ; Tue, 26 Apr 2016 12:13:47 -0700 (PDT) Received: from che.mayfirst.org (che.mayfirst.org [162.247.75.118]) by ietfa.amsl.com (Postfix) with ESMTP id EC36612D1D1 for ; Tue, 26 Apr 2016 12:13:46 -0700 (PDT) Received: from fifthhorseman.net (unknown [38.109.115.130]) by che.mayfirst.org (Postfix) with ESMTPSA id 84B56F991 for ; Tue, 26 Apr 2016 15:13:46 -0400 (EDT) Received: by fifthhorseman.net (Postfix, from userid 1000) id ADA401FFE1; Tue, 26 Apr 2016 15:13:40 -0400 (EDT) From: Daniel Kahn Gillmor To: "trans\@ietf.org" User-Agent: Notmuch/0.21+128~g620f892 (http://notmuchmail.org) Emacs/24.5.1 (x86_64-pc-linux-gnu) Date: Tue, 26 Apr 2016 15:13:40 -0400 Message-ID: <87lh40uqsb.fsf@alice.fifthhorseman.net> MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: [Trans] STHExtension expression X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Apr 2016 19:13:49 -0000 in rfc6962-bis-14, both the TreeHeadDataV2 (section 5.7) and SignedTreeHeadDataV2 (section 5.8) structures have an SthExtensions member. The SignedTreeHeadDataV2 structure itself contains a digitally-signed struct "signature" that contains a TransItem merkle_tree_head which is constrained to be a TreeHeadDataV2. https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-14 I'm assuming that the the implication here is that SignedTreeHeadDataV2.signature.merkel_tree_head is not expected to be literally included in the bytestream, or else we'd have two copies of the sth_extensions field in the SignedTreeHeadDataV2, which i don't think we want. But the specification of whether SthExtensions are present is unclear. in the STHv2 description, it says: enum { reserved(65535) } SthExtensionType; struct { SthExtensionType sth_extension_type; opaque sth_extension_data<0..2^16-1>; } SthExtension; struct { LogID log_id; uint64 timestamp; uint64 tree_size; NodeHash root_hash; SthExtension sth_extensions<0..2^16-1>; digitally-signed struct { TransItem merkle_tree_head; } signature; } SignedTreeHeadDataV2; [...] "sth_extensions" is a vector of 0 or more STH extensions. This vector MUST NOT include more than one extension with the same "sth_extension_type". The extensions in the vector MUST be ordered by the value of the "sth_extension_type" field, smallest value first. If an implementation sees an extension that it does not understand, it SHOULD ignore that extension. Furthermore, an implementation MAY choose to ignore any extension(s) that it does understand. This is not an "opaque" data type, so there is no indicator of the number of extensions available in the bytestream. Consider the case of zero extensions: log_id timestamp tree_size root_hash signature and the case of one extension: log_id timestamp tree_size root_hash extension_0 signature if the start of the signature was mistakable for the start of an SthExtension, then there is a potential for ambiguity. This concatenated array representation is used in TreeHeadDataV2, as well as in TLS 1.2 for client and server Extensions (a list of TLV extensions at the tail of the Hello handshake message), and for Certificate messages (a distinct and independent Certificate handshake message). But those uses have the advantage of an external frame indicating the overall length of the repeated datatype. I see four possible resolutions, none of which are that great; i'd be happy with a better proposal: (a) explicitly indicate the number of extensions to expect: index ef69039..0b09171 100644 --- a/rfc6962-bis.xml +++ b/rfc6962-bis.xml @@ -654,6 +654,7 @@ d0 d1 d2 d3 d0 d1 d2 d3 d4 d5 uint64 timestamp; uint64 tree_size; NodeHash root_hash; + uint8 extension_count; SthExtension sth_extensions<0..2^16-1>; digitally-signed struct { TransItem merkle_tree_head; (b) If the size of the signature is guaranteed to be known or computable in advance, move the extensions to follow the signature, so that they're delimited by the size and framing of the STHv2 itself: --- a/rfc6962-bis.xml +++ b/rfc6962-bis.xml @@ -654,10 +654,10 @@ d0 d1 d2 d3 d0 d1 d2 d3 d4 d5 uint64 timestamp; uint64 tree_size; NodeHash root_hash; - SthExtension sth_extensions<0..2^16-1>; digitally-signed struct { TransItem merkle_tree_head; } signature; + SthExtension sth_extensions<0..2^16-1>; } SignedTreeHeadDataV2; (c) If the size of the signature is guaranteed to be known or computable in advance, provide guidance on determining the signatures in a reverse scan: --- a/rfc6962-bis.xml +++ b/rfc6962-bis.xml @@ -682,6 +682,12 @@ d0 d1 d2 d3 d0 d1 d2 d3 d4 d5 sth_extensions is a vector of 0 or more STH extensions. This vector MUST NOT include more than one extension with the same sth_extension_type. The extensions in the vector MUST be ordered by the value of the sth_extension_type field, smallest value first. If an implementation sees an extension that it does not understand, it SHOULD ignore that extension. Furthermore, an implementation MAY choose to ignore any extension(s) that it does understand. + To determine the size of the sth_extensions field, subtract the + expected size of the signature + field from the size of the SignedTreeHeadDataV2 object. + + merkle_tree_head is a TransItem structure that MUST be of type tree_head_v2 (see ). (d) treat the signature as a very special-cased extension: --- a/rfc6962-bis.xml +++ b/rfc6962-bis.xml @@ -628,7 +628,7 @@ d0 d1 d2 d3 d0 d1 d2 d3 d4 d5 root_hash is the root of the Merkle Hash Tree. - sth_extensions matches the STH extensions of the corresponding STH. + sth_extensions matches the STH extensions of the corresponding STH, with the "signature" extension removed.
@@ -641,7 +641,7 @@ d0 d1 d2 d3 d0 d1 d2 d3 d4 d5 enum { - reserved(65535) + signature(65535) } SthExtensionType; struct { @@ -655,9 +655,6 @@ d0 d1 d2 d3 d0 d1 d2 d3 d4 d5 uint64 tree_size; NodeHash root_hash; SthExtension sth_extensions<0..2^16-1>; - digitally-signed struct { - TransItem merkle_tree_head; - } signature; } SignedTreeHeadDataV2; @@ -682,6 +679,15 @@ d0 d1 d2 d3 d0 d1 d2 d3 d4 d5 sth_extensions is a vector of 0 or more STH extensions. This vector MUST NOT include more than one extension with the same sth_extension_type. The extensions in the vector MUST be ordered by the value of the sth_extension_type field, smallest value first. If an implementation sees an extension that it does not understand, it SHOULD ignore that extension. Furthermore, an implementation MAY choose to ignore any extension(s) that it does understand. + The extension of type "signature" is special, in that it + contains a signature made by the log as defined in , and it is omitted from the + data being signed. The sth_extensions field of a + SignedTreeHeadDataV2 MUST contain a "signature" extension as + the last extension. + + merkle_tree_head is a TransItem structure that MUST be of type tree_head_v2 (see ).
Any suggestions on how to resolve this? --dkg From nobody Tue Apr 26 13:01:08 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D091712B04B for ; Tue, 26 Apr 2016 13:01:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T67e_yJLp_Xw for ; Tue, 26 Apr 2016 13:01:04 -0700 (PDT) Received: from mmextmx2.mcr.colo.comodoca.net (mmextmx2.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 967BB12B038 for ; Tue, 26 Apr 2016 13:01:03 -0700 (PDT) Received: (qmail 20242 invoked by uid 1004); 26 Apr 2016 20:01:01 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx2.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Tue, 26 Apr 2016 21:01:01 +0100 Received: (qmail 32224 invoked by uid 1000); 26 Apr 2016 20:01:01 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Tue, 26 Apr 2016 21:01:01 +0100 To: Daniel Kahn Gillmor , "trans@ietf.org" References: <87lh40uqsb.fsf@alice.fifthhorseman.net> From: Rob Stradling Message-ID: Date: Tue, 26 Apr 2016 21:01:00 +0100 User-Agent: Mozilla/5.0 (X11; Linux i686; rv:45.0) Gecko/20100101 Thunderbird/45.0 MIME-Version: 1.0 In-Reply-To: <87lh40uqsb.fsf@alice.fifthhorseman.net> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Trans] STHExtension expression X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Apr 2016 20:01:08 -0000 sth_extensions is a variable-length vector (see https://tools.ietf.org/html/rfc5246#section-4.3). "<0..2^16-1>" means that the first two bytes of the encoding of this field are the length of its value. In the case of zero extensions, these two bytes will be: 0x00 0x00. There's no ambiguity AFAICT. Does this resolve your concern? On 26/04/16 20:13, Daniel Kahn Gillmor wrote: > in rfc6962-bis-14, both the TreeHeadDataV2 (section 5.7) and > SignedTreeHeadDataV2 (section 5.8) structures have an SthExtensions > member. The SignedTreeHeadDataV2 structure itself contains a > digitally-signed struct "signature" that contains a TransItem > merkle_tree_head which is constrained to be a TreeHeadDataV2. > > https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-14 > > I'm assuming that the the implication here is that > SignedTreeHeadDataV2.signature.merkel_tree_head is not expected to be > literally included in the bytestream, or else we'd have two copies of > the sth_extensions field in the SignedTreeHeadDataV2, which i don't > think we want. > > But the specification of whether SthExtensions are present is unclear. > in the STHv2 description, it says: > > enum { > reserved(65535) > } SthExtensionType; > > struct { > SthExtensionType sth_extension_type; > opaque sth_extension_data<0..2^16-1>; > } SthExtension; > > struct { > LogID log_id; > uint64 timestamp; > uint64 tree_size; > NodeHash root_hash; > SthExtension sth_extensions<0..2^16-1>; > digitally-signed struct { > TransItem merkle_tree_head; > } signature; > } SignedTreeHeadDataV2; > > [...] > > "sth_extensions" is a vector of 0 or more STH extensions. This > vector MUST NOT include more than one extension with the same > "sth_extension_type". The extensions in the vector MUST be ordered > by the value of the "sth_extension_type" field, smallest value first. > If an implementation sees an extension that it does not understand, > it SHOULD ignore that extension. Furthermore, an implementation MAY > choose to ignore any extension(s) that it does understand. > > This is not an "opaque" data type, so there is no indicator of the > number of extensions available in the bytestream. > > Consider the case of zero extensions: > > log_id > timestamp > tree_size > root_hash > signature > > and the case of one extension: > > log_id > timestamp > tree_size > root_hash > extension_0 > signature > > if the start of the signature was mistakable for the start of an > SthExtension, then there is a potential for ambiguity. > > This concatenated array representation is used in TreeHeadDataV2, as > well as in TLS 1.2 for client and server Extensions (a list of TLV > extensions at the tail of the Hello handshake message), and for > Certificate messages (a distinct and independent Certificate handshake > message). But those uses have the advantage of an external frame > indicating the overall length of the repeated datatype. > > I see four possible resolutions, none of which are that great; i'd be > happy with a better proposal: > > (a) explicitly indicate the number of extensions to expect: > > index ef69039..0b09171 100644 > --- a/rfc6962-bis.xml > +++ b/rfc6962-bis.xml > @@ -654,6 +654,7 @@ d0 d1 d2 d3 d0 d1 d2 d3 d4 d5 > uint64 timestamp; > uint64 tree_size; > NodeHash root_hash; > + uint8 extension_count; > SthExtension sth_extensions<0..2^16-1>; > digitally-signed struct { > TransItem merkle_tree_head; > > (b) If the size of the signature is guaranteed to be known or computable > in advance, move the extensions to follow the signature, so that > they're delimited by the size and framing of the STHv2 itself: > > --- a/rfc6962-bis.xml > +++ b/rfc6962-bis.xml > @@ -654,10 +654,10 @@ d0 d1 d2 d3 d0 d1 d2 d3 d4 d5 > uint64 timestamp; > uint64 tree_size; > NodeHash root_hash; > - SthExtension sth_extensions<0..2^16-1>; > digitally-signed struct { > TransItem merkle_tree_head; > } signature; > + SthExtension sth_extensions<0..2^16-1>; > } SignedTreeHeadDataV2; > > > > (c) If the size of the signature is guaranteed to be known or computable > in advance, provide guidance on determining the signatures in a > reverse scan: > > --- a/rfc6962-bis.xml > +++ b/rfc6962-bis.xml > @@ -682,6 +682,12 @@ d0 d1 d2 d3 d0 d1 d2 d3 d4 d5 > sth_extensions is a vector of 0 or more STH extensions. This vector MUST NOT include more than one extension with the same sth_extension_type. The extensions in the vector MUST be ordered by the value of the sth_extension_type field, smallest value first. If an implementation sees an extension that it does not understand, it SHOULD ignore that extension. Furthermore, an implementation MAY choose to ignore any extension(s) that it does understand. > > > + To determine the size of the + style="verb">sth_extensions field, subtract the > + expected size of the signature > + field from the size of the SignedTreeHeadDataV2 object. > + > + > merkle_tree_head is a TransItem structure that MUST be of type tree_head_v2 (see ). > > > > > (d) treat the signature as a very special-cased extension: > > --- a/rfc6962-bis.xml > +++ b/rfc6962-bis.xml > @@ -628,7 +628,7 @@ d0 d1 d2 d3 d0 d1 d2 d3 d4 d5 > root_hash is the root of the Merkle Hash Tree. > > > - sth_extensions matches the STH extensions of the corresponding STH. > + sth_extensions matches the STH extensions of the corresponding STH, with the "signature" extension removed. > > >
> @@ -641,7 +641,7 @@ d0 d1 d2 d3 d0 d1 d2 d3 d4 d5 > > > enum { > - reserved(65535) > + signature(65535) > } SthExtensionType; > > struct { > @@ -655,9 +655,6 @@ d0 d1 d2 d3 d0 d1 d2 d3 d4 d5 > uint64 tree_size; > NodeHash root_hash; > SthExtension sth_extensions<0..2^16-1>; > - digitally-signed struct { > - TransItem merkle_tree_head; > - } signature; > } SignedTreeHeadDataV2; > > > @@ -682,6 +679,15 @@ d0 d1 d2 d3 d0 d1 d2 d3 d4 d5 > sth_extensions is a vector of 0 or more STH extensions. This vector MUST NOT include more than one extension with the same sth_extension_type. The extensions in the vector MUST be ordered by the value of the sth_extension_type field, smallest value first. If an implementation sees an extension that it does not understand, it SHOULD ignore that extension. Furthermore, an implementation MAY choose to ignore any extension(s) that it does understand. > > > + The extension of type "signature" is special, in that it > + contains a signature made by the log as defined in + target="signature_algorithms"/>, and it is omitted from the > + data being signed. The + style=verb">sth_extensions field of a > + SignedTreeHeadDataV2 MUST contain a "signature" extension as > + the last extension. > + > + > merkle_tree_head is a TransItem structure that MUST be of type tree_head_v2 (see ). > >
> > > > Any suggestions on how to resolve this? > > --dkg > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From nobody Tue Apr 26 13:05:21 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB8D912B038 for ; Tue, 26 Apr 2016 13:05:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.473 X-Spam-Level: X-Spam-Status: No, score=-4.473 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.723, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.996, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ARKdmjx9EJMg for ; Tue, 26 Apr 2016 13:05:16 -0700 (PDT) Received: from wsget2.nist.gov (wsget2.nist.gov [129.6.13.151]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F17A12B015 for ; Tue, 26 Apr 2016 13:05:16 -0700 (PDT) Received: from WSXGHUB1.xchange.nist.gov (129.6.18.96) by wsget2.nist.gov (129.6.13.151) with Microsoft SMTP Server (TLS) id 14.3.248.2; Tue, 26 Apr 2016 16:05:12 -0400 Received: from postmark.nist.gov (129.6.16.94) by WSXGHUB1.xchange.nist.gov (129.6.18.96) with Microsoft SMTP Server (TLS) id 8.3.444.0; Tue, 26 Apr 2016 16:05:14 -0400 Received: from [129.6.54.72] (st26.ncsl.nist.gov [129.6.54.72]) by postmark.nist.gov (8.13.8/8.13.1) with ESMTP id u3QK537f008580 for ; Tue, 26 Apr 2016 16:05:04 -0400 To: "trans@ietf.org" References: <570FA14E.4010109@bbn.com> From: "David A. Cooper" Message-ID: <571FC9EF.9020002@nist.gov> Date: Tue, 26 Apr 2016 16:05:03 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 In-Reply-To: <570FA14E.4010109@bbn.com> Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: 8bit X-NIST-MailScanner-Information: Archived-At: Subject: Re: [Trans] revised threat analysis doc X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Apr 2016 20:05:19 -0000
Is it necessary for me to point out that this draft has not fixed the problems from the previous drafts? Isn't this supposed to be a working group document? Why does the document still talk about two different CAs that have the same name and same key, and that are "both" controlled by the same entity (the attacker)?

This insistence on referring to this CA as "two CAs" is not only factually wrong (as are the statements about RFC 5280), they lead to confusion. The text suggests that the two or more CAs that might collude to issue a bogus certificate are the "two CAs" that "have the same Subject name and the same public key," but it is not. The two colluding CAs are the two CAs that each issue a cross-certificate to the one (bogus) CA that issues the (bogus) EE certificate.

Granted, "colluding" may not be the appropriate term. They may be two CAs that have been unknowingly compromised by the attacker into issuing the cross-certificates to the (bogus) CA controlled by the attacker. But what makes this attack different is the two cross-certificates; so if there is any collusion, it is between the issuers of the cross-certificates.

On 04/14/2016 09:55 AM, Stephen Kent wrote:
We've been having trouble getting the -05 version of the threat analysis posted, so
my message about the changes that have been incorporated is a bit premature.

Here is the modified text:

3.3 Malicious, Colluding CAs


Section 3.2 examined attacks in which a single CA might issue a bogus certificate. There is also the potential that two or more CAs might collude to issue a bogus certificate in a fashion designed to foil the remediation (but not detection) safeguards envisioned by CT. Their goal would be trick a CT-aware browser into accepting a bogus certificate because it was accompanied by a valid SCT, while evading certificate revocation status indications. This section explores such scenarios.


In this attack two CAs that do not share a common path to a trust anchor, collude to create a “doppelganger” (bogus) EE certificate. The attack need not be initiated by trust anchors; any subordinate pair of (not name-constrained) CAs can effect this attack without the knowledge of superiors CAs (which are presumed to be benign). The two CAs must have the same Subject name and the same public key for the attack. (RFC 5280 doe not explicitly preclude the creation of two CAs with the same name, so long as the parent CAs are distinct. Requirements for Subject name uniqueness apply individually to each CA but not across CA boundaries, as per Section 4.2.1.6. However, the Security Considerations section of RFC 5280 warns that name collisions could cause security problems.)


Because the two CAs have the same name and make use of the same key, each can issue the (bogus) doppelganger certificates. One of the CAs would log the certificate and acquire an SCT for it, while the other would not.


Because the bogus certificate is logged, it is subject to detection as such by a Monitor. Once the bogus certificate is detected it is anticipated that action will be taken to render it invalid. The bogus certificate itself might be revoked by the CA that issued and logged it, an action that masks the malicious intent of that CA. A browser vendor might add the bogus certificate to a blacklist maintained by the vendor, e.g., because the CA failed to revoke the bogus certificate.


If the CA that logged the bogus certificate is suspected of being malicious, e.g., because it has a history of using bogus certificates, the certificate of that CA might itself be revoked. This revocation might be effected by the parent of that CA (which is not complicit), or by a browser vendor using a blacklist. Whether the proposed attack can achieve its goal depends on which revocation mechanism is employed, and which certificate or certificates are revoked.


3.3.1 Revocation of the Bogus Certificate


If the bogus (EE) certificate is revoked by the CA that issued and logged it, browsers should treat that certificate as invalid. However, a browser checking a CRL or OCSP response might not match this revocation status data against the doppelganger issued by the second CA. This is because revocation status checking is performed in the context of a certification path (during path validation). The doppelgangers have different certification paths and thus the revocation status data for each might be acquired and managed independently. (RFC 5280 does not provide implementation guidance for management of revocation data. It is known that some relying party implementations maintain such information on a per-certificate path basis, but others might not.)


Even if the bogus certificates contain an AIA extension pointing to an OCSP server the attack might still succeed. (As noted in the Section 1, RFC 5280 does not mandate inclusion this extension, but its presence is required by CABF requirements.)  As noted in Section 3.2.1.1.1, a malicious CA could send a “good” OCSP response to a targeted browser instance, even if other parties are provided with a “revoked” response. Also note that a TLS server can supply an OCSP response to a browser as part of the TLS handshake [RFC6961], if requested by the browser. A TLS server posing as the entity named in the bogus certificate could acquire a “good” OCSP response from the colluding CAs to effect the attack. Only if the browser relies upon a trusted, third-party OCSP responder, one not part of the collusion, would the attack fail.


The analysis above also applies to the use of CRLs to disseminate certificate revocation status data. The doppelganger certificate could contain a CRL distribution point extension instead of an AIA extension. In that case a site supplying CRLs for the colluding CAs could supply different CRLs to different requestors, in an attempt to hide the revocation status of the doppelganger from targeted browsers instances. This is analogous to a split-view attack effected by a CT log. However, as noted in Section 3.2.1.1 and 3.2.1.1.1, no element of CT is responsible for detecting inconsistent reporting of certificate revocation status data. (Monitoring in the CT context tracks log entries made by CAs or Subjects. Auditing is designed to detect misbehavior by logs, not by CAs per se.)

If the CA that logged the certificate does not revoke it, a browser vendor might enter the bogus certificate into a “blacklist”. Unfortunately, there are no IETF standards for such blacklists. Thus it is conceivable that the revocation status data also might be managed in a path-specific fashion. If that were true, then the attack could succeed. However, if a vendor maintains revocation status data in a path-independent fashion, then the attack will fail. For example, if revoked certificates are identified by CA name and serial number, or a hash of the certificate, this attack would fail.


3.2.2 Revocation of the Colluding CA Certificate


If the CA that logged the bogus certificate is viewed as acting maliciously, its parent might revoke that CA’s certificate. Even though the two colluding CAs have the same name and use the same public key, their certificates are distinct, e.g., they were issued by different parents and almost certainly have different certificate serial numbers. Thus revocation of the certificate of the CA that logged the bogus certificate does not affect the certificate of its colluding partner. In this case, the bogus EE certificate would be treated as valid when it appears in a certification path involving the second colluding CA. Thus revocation the certificate for the CA that was detected as malicious does not prevent this attack from succeeding.


A vendor also might choose to add the certificate of the CA that issued the bogus certificate to its blacklist, e.g., if that CA refuses to revoke the bogus certificate. This also may not prevent the bogus certificate from being accepted by a browser. For example, if the CA certificate blacklist entry is analogous to a CRL entry (Subject name of the parent of the malicious CA and the serial number of the malicious CA’s certificate), the colluding CA’s certificate would still be valid in this case.


From nobody Thu Apr 28 21:38:41 2016 Return-Path: X-Original-To: trans@ietf.org Delivered-To: trans@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id A2B4712B020; Thu, 28 Apr 2016 21:38:39 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Meeting Session Request Tool\"" To: X-Test-IDTracker: no X-IETF-IDTracker: 6.19.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160429043839.23481.36846.idtracker@ietfa.amsl.com> Date: Thu, 28 Apr 2016 21:38:39 -0700 Archived-At: Cc: trans-chairs@ietf.org, trans@ietf.org, melinda.shore@nomountain.net, stephen.farrell@cs.tcd.ie Subject: [Trans] trans - New Meeting Session Request for IETF 96 X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Apr 2016 04:38:39 -0000 A new meeting session request has just been submitted by Melinda Shore, a Chair of the trans working group. --------------------------------------------------------- Working Group Name: Public Notary Transparency Area Name: Security Area Session Requester: Melinda Shore Number of Sessions: 1 Length of Session(s): 1 Hour Number of Attendees: 50 Conflicts to Avoid: First Priority: dane curdle dnsop tls Second Priority: ipsecme saag Special Requests: ---------------------------------------------------------