From nobody Fri Jul 8 13:04:18 2016 Return-Path: X-Original-To: trans@ietf.org Delivered-To: trans@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7302412D106; Fri, 8 Jul 2016 13:04:17 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.25.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160708200417.32103.70086.idtracker@ietfa.amsl.com> Date: Fri, 08 Jul 2016 13:04:17 -0700 Archived-At: Cc: trans@ietf.org Subject: [Trans] I-D Action: draft-ietf-trans-gossip-03.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Jul 2016 20:04:17 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Public Notary Transparency of the IETF. Title : Gossiping in CT Authors : Linus Nordberg Daniel Kahn Gillmor Tom Ritter Filename : draft-ietf-trans-gossip-03.txt Pages : 56 Date : 2016-07-08 Abstract: The logs in Certificate Transparency are untrusted in the sense that the users of the system don't have to trust that they behave correctly since the behavior of a log can be verified to be correct. This document tries to solve the problem with logs presenting a "split view" of their operations. It describes three gossiping mechanisms for Certificate Transparency: SCT Feedback, STH Pollination and Trusted Auditor Relationship. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-trans-gossip/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-trans-gossip-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-trans-gossip-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Tue Jul 12 04:06:15 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7872812D105 for ; Tue, 12 Jul 2016 04:06:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nordu.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MDwmgtqP4AN1 for ; Tue, 12 Jul 2016 04:06:11 -0700 (PDT) Received: from e-mailfilter02.sunet.se (e-mailfilter02.sunet.se [IPv6:2001:6b0:8:2::202]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ED54112D09B for ; Tue, 12 Jul 2016 04:06:10 -0700 (PDT) Received: from smtp1.nordu.net (smtp1.nordu.net [IPv6:2001:948:4:6::32]) by e-mailfilter02.sunet.se (8.14.4/8.14.4/Debian-4) with ESMTP id u6CB68Mo016456 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Tue, 12 Jul 2016 13:06:08 +0200 Received: from kerio.nordu.net (kerio.nordu.net [109.105.113.41]) by smtp1.nordu.net (8.14.7/8.14.7) with ESMTP id u6CB65Js014253 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 12 Jul 2016 11:06:07 GMT VBR-Info: md=nordu.net; mc=all; mv=swamid.se DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nordu.net; s=default; t=1468321567; bh=nPF/6ICz7jUrYSRE8zK5J8U0x640caKXT/jLT8wXLa8=; h=From:To:Subject:References:Date:In-Reply-To; b=Fcyw0qydiGqVNVLwFq8ocf9WNBgfJnJ0ooqP0P0iEL52RmZYY8DegrlAXIHykV6QM 5KH0o49gflJHJzlO1wk4+tQgJ3TXV5TCq5uovgX1jPORNfWAZirCzmWF2AT1AYROEd ZMEzqtX2VnUVSfR4rkhMH1APbRj2GohrHVqOoClk= X-Footer: bm9yZHUubmV0 Received: from flogsta ([193.10.5.129]) (authenticated user linus@nordu.net) by kerio.nordu.net with ESMTPSA (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256 bits)) for trans@ietf.org; Tue, 12 Jul 2016 13:06:04 +0200 From: Linus Nordberg To: trans@ietf.org Organization: NORDUnet A/S References: <20160708200417.32103.70086.idtracker@ietfa.amsl.com> Date: Tue, 12 Jul 2016 13:06:02 +0200 In-Reply-To: <20160708200417.32103.70086.idtracker@ietfa.amsl.com> (internet-drafts@ietf.org's message of "Fri, 08 Jul 2016 13:04:17 -0700") Message-ID: <878tx75d5x.fsf@nordberg.se> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: text/plain X-Scanned-By: CanIt (www . roaringpenguin . com) X-Scanned-By: MIMEDefang 2.74 on 109.105.111.32 X-p0f-Info: os=unknown unknown, link=Ethernet or modem X-CanIt-Geo: ip=109.105.113.41; country=SE; latitude=59.3294; longitude=18.0686; http://maps.google.com/maps?q=59.3294,18.0686&z=6 X-CanItPRO-Stream: outbound-nordu-net:outbound (inherits from outbound-nordu-net:default, nordu-net:default, base:default) X-Canit-Stats-ID: 0aRhL68T0 - a14d7b43a83f - 20160712 X-CanIt-Archive-Cluster: PfMRe/vJWMiXwM2YIH5BVExnUnw Received-SPF: neutral (e-mailfilter02.sunet.se: 109.105.113.41 is neither permitted nor denied by domain linus@nordu.net) receiver=e-mailfilter02.sunet.se; client-ip=109.105.113.41; envelope-from=; helo=smtp1.nordu.net; identity=mailfrom Archived-At: Subject: Re: [Trans] I-D Action: draft-ietf-trans-gossip-03.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jul 2016 11:06:14 -0000 internet-drafts@ietf.org wrote Fri, 08 Jul 2016 13:04:17 -0700: > Title : Gossiping in CT > Authors : Linus Nordberg > Daniel Kahn Gillmor > Tom Ritter > Filename : draft-ietf-trans-gossip-03.txt > Pages : 56 > Date : 2016-07-08 > > Abstract: > The logs in Certificate Transparency are untrusted in the sense that > the users of the system don't have to trust that they behave > correctly since the behavior of a log can be verified to be correct. > > This document tries to solve the problem with logs presenting a > "split view" of their operations. It describes three gossiping > mechanisms for Certificate Transparency: SCT Feedback, STH > Pollination and Trusted Auditor Relationship. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-trans-gossip/ > > There's also a htmlized version available at: > https://tools.ietf.org/html/draft-ietf-trans-gossip-03 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=draft-ietf-trans-gossip-03 Hi group, The authors of trans-gossip think that this draft is now in a state where the group should read it and comment on it. While it needs wordsmithing, we hope algorithmically we're done. Our goal is to get it to last call in time for the Seoul meeting later this year. Those of you who care about CT gossip and are in Berlin for the IETF should join us in an informal meeting sometime during the week for discussions about what needs to be done. Please indicate availability in the following dudle: https://dudle.inf.tu-dresden.de/ietf96-ct-gossip/ If you're note in Berlin but still would like to join, let us know and we'll try to figure something out. Thanks, Linus From nobody Sat Jul 16 12:09:57 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF96A12B018 for ; Sat, 16 Jul 2016 12:09:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nordu.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UppQHlVLCrHo for ; Sat, 16 Jul 2016 12:09:53 -0700 (PDT) Received: from e-mailfilter02.sunet.se (e-mailfilter02.sunet.se [IPv6:2001:6b0:8:2::202]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 30C4812B006 for ; Sat, 16 Jul 2016 12:09:52 -0700 (PDT) Received: from smtp1.nordu.net (smtp1.nordu.net [IPv6:2001:948:4:6::32]) by e-mailfilter02.sunet.se (8.14.4/8.14.4/Debian-4) with ESMTP id u6GJ9owO006837 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Sat, 16 Jul 2016 21:09:50 +0200 Received: from kerio.nordu.net (kerio.nordu.net [109.105.113.41]) by smtp1.nordu.net (8.14.7/8.14.7) with ESMTP id u6GJ9kIU029213 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 16 Jul 2016 19:09:49 GMT VBR-Info: md=nordu.net; mc=all; mv=swamid.se DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nordu.net; s=default; t=1468696189; bh=Utpe/GBSpfEM4Dyz78cpbHZKcZaK4q3U2NySoV9GOCY=; h=From:To:Subject:References:Date:In-Reply-To; b=ProunWVjW/hMedRv6IRf6jDsBuO39QNkn07ujc3pGqJsC1f8rl0DKI8hL+Wzjbvte CrhNkPImXp8ugbrDEzUV4RV7Tr/LuOVm4ODR1IMpgqshBDlRuAIvjMSSWcSIsDVLFA 2xQBHiOfzxkKXsDwITb+jCMiRvqIBp5XPW9uChCc= X-Footer: bm9yZHUubmV0 Received: from flogsta ([193.10.5.129]) (authenticated user linus@nordu.net) by kerio.nordu.net with ESMTPSA (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256 bits)) for trans@ietf.org; Sat, 16 Jul 2016 21:09:44 +0200 From: Linus Nordberg To: trans@ietf.org Organization: NORDUnet A/S References: <20160708200417.32103.70086.idtracker@ietfa.amsl.com> <878tx75d5x.fsf@nordberg.se> Date: Sat, 16 Jul 2016 21:09:40 +0200 In-Reply-To: <878tx75d5x.fsf@nordberg.se> (Linus Nordberg's message of "Tue, 12 Jul 2016 13:06:02 +0200") Message-ID: <87lh11tn63.fsf@nordberg.se> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: text/plain X-Scanned-By: CanIt (www . roaringpenguin . com) X-Scanned-By: MIMEDefang 2.74 on 109.105.111.32 X-p0f-Info: os=unknown unknown, link=Ethernet or modem X-CanIt-Geo: ip=109.105.113.41; country=SE; latitude=59.3294; longitude=18.0686; http://maps.google.com/maps?q=59.3294,18.0686&z=6 X-CanItPRO-Stream: outbound-nordu-net:outbound (inherits from outbound-nordu-net:default, nordu-net:default, base:default) X-Canit-Stats-ID: 0aRjv9OSD - 334c3af70e7a - 20160716 X-CanIt-Archive-Cluster: PfMRe/vJWMiXwM2YIH5BVExnUnw Received-SPF: neutral (e-mailfilter02.sunet.se: 109.105.113.41 is neither permitted nor denied by domain linus@nordu.net) receiver=e-mailfilter02.sunet.se; client-ip=109.105.113.41; envelope-from=; helo=smtp1.nordu.net; identity=mailfrom Archived-At: Subject: Re: [Trans] I-D Action: draft-ietf-trans-gossip-03.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Jul 2016 19:09:57 -0000 Linus Nordberg wrote Tue, 12 Jul 2016 13:06:02 +0200: > Those of you who care about CT gossip and are in Berlin for the IETF > should join us in an informal meeting sometime during the week for > discussions about what needs to be done. Please indicate availability in > the following dudle: > > https://dudle.inf.tu-dresden.de/ietf96-ct-gossip/ Thanks! Monday Jul 18 at 20:00 CEST has been chosen. Place to be announced here as soon as I've got an idea about it. > If you're note in Berlin but still would like to join, let us know and > we'll try to figure something out. This is still true. From nobody Sat Jul 16 13:24:24 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F21E612D10B for ; Sat, 16 Jul 2016 13:24:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.988 X-Spam-Level: X-Spam-Status: No, score=-3.988 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.287, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jP3aSPwCXsp3 for ; Sat, 16 Jul 2016 13:24:20 -0700 (PDT) Received: from mail-vk0-x22c.google.com (mail-vk0-x22c.google.com [IPv6:2607:f8b0:400c:c05::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B1D0112D096 for ; Sat, 16 Jul 2016 13:24:20 -0700 (PDT) Received: by mail-vk0-x22c.google.com with SMTP id w127so137731252vkh.2 for ; Sat, 16 Jul 2016 13:24:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=5I2lILQhrvTqJPfAE5seJlRYApHr9ChJZkyNqh0i/Zs=; b=DRoh2wMvfIisEKyPlPVXX4MrWFw874RXJ+cOlszmI2CyCE2B99Fd+hy3iPkmyEviHJ MCESVc8/Z62dnyhXtm8HaTsXGhl0HA5obeQ5dik3j6FBn2jHqvEu3T+sNsJAdqmDe50F OOWpdFM++hDD05ZMwo8aE+V5/bOm6ltrfx0LYTa72+35SyTFjM6M+9zepNV0PZ+ccq7p RAp9a2bAHShmQimv2OfX+0dEzgfONHhncmrqP5AjxJosVyfvsR3GlT/xGInAEzmC+ol8 dU4NAV7r0Grx6io4vhJKBOWk5ObQhU2nPgyIjK/WpbbrbIdu93PneDyySkJ7QRVR5/z9 +cag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=5I2lILQhrvTqJPfAE5seJlRYApHr9ChJZkyNqh0i/Zs=; b=hR2t6CPYjF9NTEmk0yvxc0x7+wiSCUYiiOGHidGmoZhLEH/X7xhGppLQDdyQTq0pIc EJXNHCRANTiSsQmhwWtw09UEpw9+OWGD6hFXFnJk8J862oHrpIHN54LVGJdoHOtaw0jF ylEf9evj+yYyQAnw24iUx0LxJ9EBoBHuxibYxm+0z+NDm648mh/Ve6azMoX7gbiPNtv7 h/hc9wfxJAd9H7RU1LKqjjYSKPs4+4HxQ7D3e0GTqMp7RBXN0+YzvZWHRRMKmWLv0h1v My+T4cELAJVePtQ0sUi506Yd1CdqZzOOSAz8xGG6wj0P13ArLbMrtoLcXLCg1DLE4MzT cO8g== X-Gm-Message-State: ALyK8tI0386DVF8NFJfAzLH9rWS5/g9yz/20NLdk/5drRgDVAJZ5Wn11BAj951AlW0inKGT9dcLQxUQEoA2I1QHY X-Received: by 10.159.39.39 with SMTP id a36mr14043957uaa.86.1468700659660; Sat, 16 Jul 2016 13:24:19 -0700 (PDT) MIME-Version: 1.0 Received: by 10.31.148.12 with HTTP; Sat, 16 Jul 2016 13:24:19 -0700 (PDT) In-Reply-To: <87lh11tn63.fsf@nordberg.se> References: <20160708200417.32103.70086.idtracker@ietfa.amsl.com> <878tx75d5x.fsf@nordberg.se> <87lh11tn63.fsf@nordberg.se> From: Ben Laurie Date: Sat, 16 Jul 2016 21:24:19 +0100 Message-ID: To: Linus Nordberg Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] I-D Action: draft-ietf-trans-gossip-03.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Jul 2016 20:24:23 -0000 On 16 July 2016 at 20:09, Linus Nordberg wrote: > Linus Nordberg wrote > Tue, 12 Jul 2016 13:06:02 +0200: > >> Those of you who care about CT gossip and are in Berlin for the IETF >> should join us in an informal meeting sometime during the week for >> discussions about what needs to be done. Please indicate availability in >> the following dudle: >> >> https://dudle.inf.tu-dresden.de/ietf96-ct-gossip/ > > Thanks! > > Monday Jul 18 at 20:00 CEST has been chosen. > > Place to be announced here as soon as I've got an idea about it. > > >> If you're note in Berlin but still would like to join, let us know and >> we'll try to figure something out. > > This is still true. I would like to discuss this, but that time is quite awkward! That said, other times are not so great for me either - I'm travelling from Tuesday. Perhaps I could organise something online in a few weeks time when I'm back? > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans From nobody Sat Jul 16 14:14:23 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E8F4212D0D8 for ; Sat, 16 Jul 2016 14:14:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5v24SjnCoaNt for ; Sat, 16 Jul 2016 14:14:20 -0700 (PDT) Received: from mail-qk0-x22d.google.com (mail-qk0-x22d.google.com [IPv6:2607:f8b0:400d:c09::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1907312D0B4 for ; Sat, 16 Jul 2016 14:14:20 -0700 (PDT) Received: by mail-qk0-x22d.google.com with SMTP id x1so44633521qkb.3 for ; Sat, 16 Jul 2016 14:14:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to:content-transfer-encoding; bh=Mcnksqf6MsLxsfDQ1QyiJ1VmhHGsM2k0wc4lyr+4nCA=; b=PyxZevBeBEpucI2yOA38vx6tz6QXUJiaIB0TRrL+2P5upYQM6rrEb1+sddK29gAOWr WcUsJVeWeE87UNdY5j0l6oAAPamH0WV9+IcNn6QLTSVZCcAdGwF+0c9mYQffpAwcESUb JPrpmO3eFjFpQ2t3IahGTJW7W33wsRqQVivnalx85CcSsltS3hsEWR/J6mQgmCPw86Tu QJxBWynncfiy8xVrnCUb/AwrWcXVMFiR71B+oZ5K/1P5bMtRrVAacQgjGUBMqjHJZe6z sToKm3CGEPOMnoRUZZ7Jm0z+sX28JxKuJjjSYZFg2t1Y4NyuPl4iSNCM4a4EOMFbeODZ Jb3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=Mcnksqf6MsLxsfDQ1QyiJ1VmhHGsM2k0wc4lyr+4nCA=; b=B3Hwq0IAAH0efnZGmQ3DaGkUsSzZS5XlZBjezmfd4WFgGwK9Z5XQKgaO2N6QPhr8GN AWX1zoI8qcCPhjojIYK72mHaeUOeLaxWOChzuwCSm0C79RMkSt8bVep82UZm/v0JOCjJ ltwAOt/G2FKEq2MyC0WfoJ2o2jB5W/5BNYWx8Sxtp82mIU24PmnTc5Y9XDRKKhr7aWfs 89m592eUZTqPjbHP2ler0FsEeCfpMHS3k8yWQe6f4XbnEJ1sthfvbodirX4Zvczu4P1y JCdlwFK0JQdh1fkz9rGyMUu6VzThM+7ZS9I8laOq01fcgS6KgE1jzDT0Ud3ZFtGNssBG kzlg== X-Gm-Message-State: ALyK8tKF9OyuYOjxv7lpMdjaWJyKSe+uHx8M0PU3/vjv5pSpX+2h3Loyt8HSNZLK2ZoZQg== X-Received: by 10.55.161.73 with SMTP id k70mr33634509qke.189.1468703659239; Sat, 16 Jul 2016 14:14:19 -0700 (PDT) Received: from dhcp-8c0c.meeting.ietf.org (dhcp-8c0c.meeting.ietf.org. [31.133.140.12]) by smtp.googlemail.com with ESMTPSA id i13sm1614863qte.42.2016.07.16.14.14.16 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 16 Jul 2016 14:14:18 -0700 (PDT) To: Ben Laurie , Linus Nordberg References: <20160708200417.32103.70086.idtracker@ietfa.amsl.com> <878tx75d5x.fsf@nordberg.se> <87lh11tn63.fsf@nordberg.se> From: Melinda Shore Message-ID: <55f29f26-14cb-9132-f271-7ba72e613db6@gmail.com> Date: Sat, 16 Jul 2016 13:14:14 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] I-D Action: draft-ietf-trans-gossip-03.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Jul 2016 21:14:22 -0000 On 7/16/16 12:24 PM, Ben Laurie wrote: > I would like to discuss this, but that time is quite awkward! That > said, other times are not so great for me either - I'm travelling from > Tuesday. Perhaps I could organise something online in a few weeks time > when I'm back? I think it would be helpful - I've been a little concerned about the lack of comment on this draft, plus there's the question of how it fits in with what's being done (and will be done) by log operators. Melinda From nobody Sun Jul 17 04:40:40 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0402112B050 for ; Sun, 17 Jul 2016 04:40:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5omgocbylE0V for ; Sun, 17 Jul 2016 04:40:37 -0700 (PDT) Received: from mail-qk0-x22d.google.com (mail-qk0-x22d.google.com [IPv6:2607:f8b0:400d:c09::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E66D12B031 for ; Sun, 17 Jul 2016 04:40:37 -0700 (PDT) Received: by mail-qk0-x22d.google.com with SMTP id x1so51899621qkb.3 for ; Sun, 17 Jul 2016 04:40:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding; bh=oWeTo6UNSLTQksXJEKJWc7kvYVugPyh6GTXfD0Lt2ZI=; b=KCOMC3s42QiZo8NYm5GNbnWYJtuQizdQR8dZ2d+UiUFtceHZ0utLdFbS8YfQh4j1RH 99IKqa7skos41vXGyU4d/ysX+rD5jhDMuy1GDrWEVyUUHw1T6o1Bj7fRSVS6XZFY7Nm1 1msTU51XNzWAH64MSMQpZ/gm7XTm5fkNFduMVHtE8DJU2S4wXfV9mHUZQv3gCqdXNHNz dyn2vaOR9piFzRLjcj94R3ZXk9mRW3UBdR/GYcYiMeU0SNxii1dEV5NmZmBMfh7GBDVc LaoaVkH4RGW4jEkeaw6RS9DLEjNrQW7R70LYm9g0RrLUpRrG9TRjRVmXH+xtZOeEm+ex ENDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=oWeTo6UNSLTQksXJEKJWc7kvYVugPyh6GTXfD0Lt2ZI=; b=WFmBqEx8zKW/QyfkMtoUU+HZCT+4fUMoqUZKSVmK9rm3vJu0uFgjrZrpegbQV9npwr TYi9uhYO2CfP5itObDgn/4qIJVSLugVh+bHyqnLPKFKEFZ0Tf4AmY5Sk+BUwduMKkvjT hjg8rYsnBiE6R9C9Ate1T4zQqZPTSQqJEBpHR0J9hTOcD7jVO2dJ0kt2YSyrgdOMrDvV Rib0lMQ7nWX3JZWBzI8S9rpF50pDPqH9ImIgG/RADUnsmmv5oxw68gUnQgrV/1U76yeb xC70nQCjGCescN0Qs+KmdBds72ypxGRVYtT3fwx79XaL7SgPK6P9O9T/1WsRTnDXwmnv KpNw== X-Gm-Message-State: ALyK8tJWFFWguuu++BmUSSSNaFcNCFSMJaXTxG3PZwLsckKdpBtjiFwsJYPqIJ9t1nFQyg== X-Received: by 10.55.145.70 with SMTP id t67mr11170058qkd.19.1468755636378; Sun, 17 Jul 2016 04:40:36 -0700 (PDT) Received: from dhcp-a042.meeting.ietf.org (dhcp-a042.meeting.ietf.org. [31.133.160.66]) by smtp.googlemail.com with ESMTPSA id y36sm407701qtc.46.2016.07.17.04.40.33 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 17 Jul 2016 04:40:35 -0700 (PDT) To: Linus Nordberg , trans@ietf.org References: <20160708200417.32103.70086.idtracker@ietfa.amsl.com> <878tx75d5x.fsf@nordberg.se> From: Melinda Shore Message-ID: Date: Sun, 17 Jul 2016 03:40:31 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <878tx75d5x.fsf@nordberg.se> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Trans] I-D Action: draft-ietf-trans-gossip-03.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Jul 2016 11:40:39 -0000 On 7/12/16 3:06 AM, Linus Nordberg wrote: > Those of you who care about CT gossip and are in Berlin for the IETF > should join us in an informal meeting sometime during the week for > discussions about what needs to be done. We have a room for this. Monday night at 8pm, in the Köpenick III room. Melinda From nobody Mon Jul 18 09:21:40 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 773A312DA7A for ; Mon, 18 Jul 2016 09:21:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a5kbmwbGDxiE for ; Mon, 18 Jul 2016 09:21:38 -0700 (PDT) Received: from mail-wm0-x236.google.com (mail-wm0-x236.google.com [IPv6:2a00:1450:400c:c09::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA5DE12D59D for ; Mon, 18 Jul 2016 09:21:37 -0700 (PDT) Received: by mail-wm0-x236.google.com with SMTP id o80so124561156wme.1 for ; Mon, 18 Jul 2016 09:21:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=to:from:subject:message-id:date:user-agent:mime-version :content-transfer-encoding; bh=Xb5X+x8DWRmTp366ZkHDpLn7Wt30UhY3Dgknm6PPkR0=; b=TZTu9zoDK2G6X0iaNJL4pSDdju6tiwGCIM0tJdCUZ9GuUAQ2sWLu/yGU4nH/hbg1Bc OGuFPld9Rd29tE5qyc31eNp2p4mmKQEnXJT3W8Ukt1H1ZJkcD0Mz7XBQEcHqY4Rxl8EX Xchy793mWmKQnZ9FQLd2KkdPndY5CMKdpoKuiWubIulNiWWRYV7aSzaOfFZak0I1+4Vg 94fTETbcHPaAi7w6ib/GIl5lOH3JduUUvXXwp1D/PXoOHSuj2AbX+5XasBx5z4/7hlT5 Ez+BBT+w5xzK56VxPWGr+7ecxjPH/rMJhrfs/8Jk45Jdr8YZO6DZGI/c3g/ZvtQEXVmY ZZcA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version:content-transfer-encoding; bh=Xb5X+x8DWRmTp366ZkHDpLn7Wt30UhY3Dgknm6PPkR0=; b=cWZ69SRC8ypLa9hQoHf1MK9s5cFL+pPAGSM/6tOAA2a2ESL0N8dBHOaqEs+WQgo/YJ 6y+82Fk14SNDW3g0jyJbZbi/dBu9urfXYERDFfQXyzEhZcSQoUCaGnHNU6gVuuz/KsLs R7R050a4ANHuNJXQa7gDDQ2CSxFT7jI/7cfcBXlgvJRXJtP63ps8JEKJE9sQq/86o8Zx 5rSBjYFg6V23IdXtu5si9hVTMYdlvItw49rRKhL5D/Q6UZrwuurAFMgohrvP+DmyvcLq 8VlecwvHHHUGYzw+RTlq74PfX0odvykh5YajQdjPVkJrOxMSkHZtZmWzZAxrJhabjgaq cgPw== X-Gm-Message-State: ALyK8tJT1BaoO5mamFjDJzIL/ONHW/S4S+6GVRuy2WtDrGL5+pG60TM/Ft1M+oYk96ovYQ== X-Received: by 10.194.111.41 with SMTP id if9mr2283363wjb.152.1468858896338; Mon, 18 Jul 2016 09:21:36 -0700 (PDT) Received: from dhcp-888c.meeting.ietf.org ([2001:67c:370:136:58eb:383d:51f5:9d8a]) by smtp.googlemail.com with ESMTPSA id p23sm14632436wme.8.2016.07.18.09.21.35 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 18 Jul 2016 09:21:35 -0700 (PDT) To: "trans@ietf.org" From: Melinda Shore Message-ID: Date: Mon, 18 Jul 2016 18:21:33 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: [Trans] Reminder, tonight X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jul 2016 16:21:39 -0000 This is just a reminder that we will be meeting tonight for an informal discussion of the gossip draft. We have reserved Köpenick III at 8pm. Melinda From nobody Tue Jul 19 08:42:37 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0601612DB6D for ; Tue, 19 Jul 2016 08:42:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.187 X-Spam-Level: X-Spam-Status: No, score=-8.187 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-1.287] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zLQDUu4tCfYI for ; Tue, 19 Jul 2016 08:42:33 -0700 (PDT) Received: from zinfandel.tools.ietf.org (zinfandel.tools.ietf.org [IPv6:2001:1890:123a::1:2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6782912B051 for ; Tue, 19 Jul 2016 08:27:46 -0700 (PDT) Received: from localhost ([::1]:34417 helo=zinfandel.tools.ietf.org) by zinfandel.tools.ietf.org with esmtp (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1bPWvv-0001ri-N0; Tue, 19 Jul 2016 08:27:43 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "trans issue tracker" X-Trac-Version: 0.12.5 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.5, by Edgewall Software To: rob.stradling@comodo.com, benl@google.com, eranm@google.com, melinda.shore@gmail.com X-Trac-Project: trans Date: Tue, 19 Jul 2016 15:27:43 -0000 X-URL: https://tools.ietf.org/trans/ X-Trac-Ticket-URL: https://trac.tools.ietf.org/wg/trans/trac/ticket/111#comment:5 Message-ID: <080.20bffa4121c490fa51c37dc646e6d6e4@tools.ietf.org> References: <065.0226a5b84d88bdfc7c9b20fa02c5a3aa@tools.ietf.org> X-Trac-Ticket-ID: 111 In-Reply-To: <065.0226a5b84d88bdfc7c9b20fa02c5a3aa@tools.ietf.org> X-SA-Exim-Connect-IP: ::1 X-SA-Exim-Rcpt-To: rob.stradling@comodo.com, benl@google.com, eranm@google.com, melinda.shore@gmail.com, trans@ietf.org X-SA-Exim-Mail-From: trac+trans@tools.ietf.org X-SA-Exim-Scanned: No (on zinfandel.tools.ietf.org); SAEximRunCond expanded to false Archived-At: Cc: trans@ietf.org Subject: Re: [Trans] [trans] #111 (to-be-decided): Consider using the cached-info TLS extension X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Jul 2016 15:42:35 -0000 #111: Consider using the cached-info TLS extension Comment (by rob.stradling@comodo.com): cached-info is now an RFC... https://www.rfc-editor.org/info/rfc7924 -- -------------------------------------+------------------------------------- Reporter: | Owner: rob.stradling@comodo.com | rob.stradling@comodo.com Type: enhancement | Status: new Priority: minor | Milestone: Component: to-be-decided | Version: Severity: - | Resolution: Keywords: | -------------------------------------+------------------------------------- Ticket URL: trans From nobody Thu Jul 21 03:06:19 2016 Return-Path: X-Original-To: trans@ietf.org Delivered-To: trans@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id F28AA12DC8A; Thu, 21 Jul 2016 03:06:17 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.29.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160721100617.4459.89667.idtracker@ietfa.amsl.com> Date: Thu, 21 Jul 2016 03:06:17 -0700 Archived-At: Cc: trans@ietf.org Subject: [Trans] I-D Action: draft-ietf-trans-rfc6962-bis-17.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Jul 2016 10:06:18 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Public Notary Transparency of the IETF. Title : Certificate Transparency Authors : Ben Laurie Adam Langley Emilia Kasper Eran Messeri Rob Stradling Filename : draft-ietf-trans-rfc6962-bis-17.txt Pages : 55 Date : 2016-07-21 Abstract: This document describes a protocol for publicly logging the existence of Transport Layer Security (TLS) certificates as they are issued or observed, in a manner that allows anyone to audit certification authority (CA) activity and notice the issuance of suspect certificates as well as to audit the certificate logs themselves. The intent is that eventually clients would refuse to honor certificates that do not appear in a log, effectively forcing CAs to add all issued certificates to the logs. Logs are network services that implement the protocol operations for submissions and queries that are defined in this document. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-trans-rfc6962-bis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-17 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-trans-rfc6962-bis-17 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Jul 21 03:35:14 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95A1512DD3C for ; Thu, 21 Jul 2016 03:35:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.987 X-Spam-Level: X-Spam-Status: No, score=-3.987 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.287, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UAcJ2SxvjnyP for ; Thu, 21 Jul 2016 03:35:11 -0700 (PDT) Received: from mail-wm0-x22b.google.com (mail-wm0-x22b.google.com [IPv6:2a00:1450:400c:c09::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 18C1812DD3B for ; Thu, 21 Jul 2016 03:33:25 -0700 (PDT) Received: by mail-wm0-x22b.google.com with SMTP id o80so19601060wme.1 for ; Thu, 21 Jul 2016 03:33:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=7gsG0qB/1PRSjAssQQA+HHx6/LRDTy/e1BvicVQg1Z4=; b=ZeXUQT6yJtA8CqlGYX3vrvV7PoYvfATvRRnSy7Q0rYIfJMys9HQIJfx4T+ANI1iSWe ERCZe8tiuWUS0FMoL34eiww1/JhNNj4YEBQGqWi67G7Y6X057iCPHw09nqYFktHMNWp+ tzFdVnm80t9z8q7VkxmpLrVzWONWYN36gwhOiTeGn0RiMaDQVKpnvcI0wc/QyqQgdV6J TwZkS1e9wB3btvAfKtmk21XauQzPNQIsKqVtCbcbJ78B9L7cS1PPLnJij9/nj3v5ZtNE wJDBGzyDAPPlvpRT5OzJchGTdpKE5KaPWlBZAytnX4SrYNjfpQ7OZxa9slWV520sEjpP Ehsg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=7gsG0qB/1PRSjAssQQA+HHx6/LRDTy/e1BvicVQg1Z4=; b=ZlYGGsJP3Eu5ay1av5KHVZP+3jCRDR3yNgxXWlUtoFM+vcmSANaVvvYtDrQJ24OslX gU5Pb68SdwiLFIQnHVnqbNw+Uo7drpmQgoFCn4J0n8ocVQ/YPGGKRdThQW/dc5VN/0gG f1HJlASY5RM4LHJFW4GvICk/2Bc8VFve0eoiY80OJ2oSE7csUyvXelJTUxLvtM3+EOGX gug/v64iu852M6Xgvy1puBkJ8abo9ZWpKVIkUsW05sXieFJ8gkTXHWhcGZIWGKhF8941 9Jza2rT5ErVje4SJj6vVL06bAXs9Reg9EAYz/0nQ81Yyn5jMSgcdkVOii0bkNK+3t2Xq zLqQ== X-Gm-Message-State: ALyK8tITROG24f4/5ObnYPR3RH3pQibJZdkoHmY8sC0PZHPzNucSI+EhSuMZHnxQ61oQ91fRgFFWbgXIMDn0INvK X-Received: by 10.28.165.207 with SMTP id o198mr17139634wme.87.1469097203114; Thu, 21 Jul 2016 03:33:23 -0700 (PDT) MIME-Version: 1.0 Received: by 10.28.168.216 with HTTP; Thu, 21 Jul 2016 03:33:22 -0700 (PDT) In-Reply-To: <20160721100617.4459.89667.idtracker@ietfa.amsl.com> References: <20160721100617.4459.89667.idtracker@ietfa.amsl.com> From: Eran Messeri Date: Thu, 21 Jul 2016 11:33:22 +0100 Message-ID: To: "trans@ietf.org" Content-Type: multipart/alternative; boundary=001a114b41d2ef319b053822d8e2 Archived-At: Subject: Re: [Trans] I-D Action: draft-ietf-trans-rfc6962-bis-17.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Jul 2016 10:35:13 -0000 --001a114b41d2ef319b053822d8e2 Content-Type: text/plain; charset=UTF-8 The changes in this draft are mostly specification of the "simplified redaction" mechanism, affecting sections 4 and 10.2. As a reminder, a document listing the changes from RFC6962 is also available: https://sites.google.com/site/certificatetransparency/ct-v2-rfc6962-bis On Thu, Jul 21, 2016 at 11:06 AM, wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Public Notary Transparency of the IETF. > > Title : Certificate Transparency > Authors : Ben Laurie > Adam Langley > Emilia Kasper > Eran Messeri > Rob Stradling > Filename : draft-ietf-trans-rfc6962-bis-17.txt > Pages : 55 > Date : 2016-07-21 > > Abstract: > This document describes a protocol for publicly logging the existence > of Transport Layer Security (TLS) certificates as they are issued or > observed, in a manner that allows anyone to audit certification > authority (CA) activity and notice the issuance of suspect > certificates as well as to audit the certificate logs themselves. > The intent is that eventually clients would refuse to honor > certificates that do not appear in a log, effectively forcing CAs to > add all issued certificates to the logs. > > Logs are network services that implement the protocol operations for > submissions and queries that are defined in this document. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-trans-rfc6962-bis/ > > There's also a htmlized version available at: > https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-17 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=draft-ietf-trans-rfc6962-bis-17 > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > --001a114b41d2ef319b053822d8e2 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
The changes in this draft are mostly specification of the = "simplified redaction" mechanism, affecting sections 4 and 10.2.<= div>
As a reminder, a document listing the changes from RFC69= 62 is also available:

On Thu, Jul 21, 2016 at 11:06 AM, <internet-drafts@ietf.org> wrote:

A New Internet-Draft is available from the on-line Internet-Drafts director= ies.
This draft is a work item of the Public Notary Transparency=C2=A0 of the IE= TF.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Title=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= Certificate Transparency
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Authors=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0: Ben = Laurie
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Adam Langley
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Emilia Kasper
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Eran Messeri
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Rob Stradling
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Filename=C2=A0 =C2=A0 =C2=A0 =C2=A0 : draft-iet= f-trans-rfc6962-bis-17.txt
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Pages=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= 55
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Date=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 := 2016-07-21

Abstract:
=C2=A0 =C2=A0This document describes a protocol for publicly logging the ex= istence
=C2=A0 =C2=A0of Transport Layer Security (TLS) certificates as they are iss= ued or
=C2=A0 =C2=A0observed, in a manner that allows anyone to audit certificatio= n
=C2=A0 =C2=A0authority (CA) activity and notice the issuance of suspect
=C2=A0 =C2=A0certificates as well as to audit the certificate logs themselv= es.
=C2=A0 =C2=A0The intent is that eventually clients would refuse to honor =C2=A0 =C2=A0certificates that do not appear in a log, effectively forcing = CAs to
=C2=A0 =C2=A0add all issued certificates to the logs.

=C2=A0 =C2=A0Logs are network services that implement the protocol operatio= ns for
=C2=A0 =C2=A0submissions and queries that are defined in this document.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft= -ietf-trans-rfc6962-bis/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-tr= ans-rfc6962-bis-17

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2= =3Ddraft-ietf-trans-rfc6962-bis-17


Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
Trans mailing list
Trans@ietf.org
https://www.ietf.org/mailman/listinfo/trans

--001a114b41d2ef319b053822d8e2-- From nobody Tue Jul 26 10:45:17 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 965D8126D74 for ; Tue, 26 Jul 2016 10:45:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.488 X-Spam-Level: X-Spam-Status: No, score=-5.488 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-1.287, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id In-bS2SunNfg for ; Tue, 26 Jul 2016 10:45:14 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 782E812D10F for ; Tue, 26 Jul 2016 10:45:12 -0700 (PDT) Received: from ssh.bbn.com ([192.1.122.15]:49831 helo=COMSEC.fios-router.home) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1bS6Pm-00057y-4a for trans@ietf.org; Tue, 26 Jul 2016 13:45:10 -0400 To: trans@ietf.org References: <87poroap4u.fsf@alice.fifthhorseman.net> From: Stephen Kent Message-ID: <4826e966-de00-3d8d-1079-d9d21bdc16c8@bbn.com> Date: Tue, 26 Jul 2016 13:45:09 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <87poroap4u.fsf@alice.fifthhorseman.net> Content-Type: multipart/mixed; boundary="------------553674C3541578A274FF98EF" Archived-At: Subject: Re: [Trans] threat analysis v06 review X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Jul 2016 17:45:16 -0000 This is a multi-part message in MIME format. --------------553674C3541578A274FF98EF Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit DKG, Thanks for the review and detailed comments. In response to your comments I made the fallowing changes: - added reference to the gossip doc in the introduction - removed all use of the term "doppelganger" - adopted the terminology you used in your example: CA-A and CA-B (same name, same key pair) and bogus cert X. - revised text to note that the two CA instances that appear as issuer of the bogus EE cert need not have different trust anchor ancestors. - revised text to include a scenario in which one CA is compromised and caused to issue the bogus cert (which is logged and, maybe revoked) while the second instance of the CA is malicious and has a parent that may be malicious or may have been tricked or attacked, etc. - revised the title of 3.3 to reflect the broader range of scenarios as per your example I did not explore the potential for logs to discriminate wrt the certs they log. I also did not discuss possible enhancements to the Monitor function to detect AIA manipulation and the like. I did not discuss in greater detail the non-standard mechanisms that may be used by browsers to deal with revocation. I think it suffices to note that such mechanisms may use cert hashes or keys to identify revoked certs, and that such approaches are not path-specific. I retained the discussion of how OCSP or CRLs and AIA extensions might be used to prevent a browser from learning about the true revocation status of a bogus cert. Yes, these are not vulnerabilities of CT per se, but they are part of the standards-based ecosystem in which CT operates. I have attached a PDF showing the revised text in 3.3, where most of the changes were made. Steve --------------553674C3541578A274FF98EF Content-Type: application/pdf; name="threat analysis 3.3 revisions.pdf" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="threat analysis 3.3 revisions.pdf" JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVy IC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGtXE1z40YOvetX9HGmymH4Lar2NOPard3DHpJ4 a3PwhZZoixlJVETKjvfX7wP6mxIpcjyVqoxhyc1u4AF4QEP6U/wi/hSrIMlFkgRFGoaJyFZJ EBdimRZBIU6V+K84iJ/v20isWxHyf+0afxQGcSpl+iHJgzhZFfizKAyifLHei68PIpPvV/88 7MXPDw+RiMTDs/gkPouHP8TfH3gH/mJpEqRpFOY/ZDGzs9UyWMU44Mf2ZpYrsh+63DL5ocvl 0Y9dblVYq4ZBGIYw4nrUvkmQDFs4WwJsSSpyd91raIlvo2UZK+h5i03b5L/LXb2um3N7J+6b 3e68qQ8vFpiLPsrjGMjM00ztW9xG+b3SwYL8zEd5nIRBnmfL6Yt9ocUWV10mTqDRPC+mL9Z+ Xmj/C4NVmBUF+XOQxKs0igrnpyveHqdZELoPW3y/s8cZ7JevYh8L08xXHjY/Nyfxn8Om6tZd tRH3X2DH/fHU7Ou2ck84FLfSZRZkYTbFoouLuHVTb6wnQnmKULoX9LBUiYudK2a52Ann3Sxv xbMNuPEyiGKxDJfBMsdSEItUiVhKinmR0Kss4s1GpIX66CMPTFYrAGaZwrUllBfT1P5bte7q 5iCQJ0T1V7mvD1B92XXl+lsr6oN429brrShFC2/aVWSUff2y7UTdtucKv7fIG95VHptdAYuj AUcZ5ql5ObdiXZ26+rlel10ViIdthQRWt6LctY3otpU4Nl116OpyB6nsRPfWCABo3+Bt91/a STvLKMEp15+2M3n6NQeYSnSNUcTFlkl7pXgu2y3pd1O19QvpFn8yRWcJBelZO3tuatJEhTy/ rzZ1SWYdjtpxGCHIUNh2nrS4FrYnJPk4XCGGpLldjILIDYWqbPD46enciUPTQUWdBOPjZ9GW z9XLuTxtWlEdXusWZ4Hunt4n6S7O5+ru/iGwqQIbnxlDizzI0zRH+OdHK1Yy7fwc8HBuHG9t wp1ongVO7OGZcb9uzjvooRLnto8l3gR2EHN8ysABQ1iXxZ1wRI5H9s02PC2I4SFDyPCUJ5kb npRowhOypxuetMhxTqsPIWhSCrLxK7Lxawg+C596Vs/PUJ6o/jzXr+UO8UAHL9eg/dDEeWoJ /8r5gbPshTgkXhoEnWHfSqJlEBYxovb85WH49kwRV4fgFhHDPIpNxEbqHynNiyDhPO7qcNif F6OknTPpcqUOMB6GegbpTvX6GyUGUxLcdCdmkHhWGBQLZFacBPSFReQ/R2So2jdb5GpGoJDL YMRKKpNqbCoxijzkanE8sYaUwmbh5P7BaqBvLKK5aZwAIO66w8YSn34aWWwFIpKA9bhrTYs9 5VuJZPl0at7a6oR8hdxUrtfVsSPqXIrLlPZUrUtEHlF34q2clGKz1ewUiy0gEJaHuho+dBSv giKLlqhwr60/msg4j5QC4aLeiN/uH+6I5IDbVK8l1wwO7UAufW3APyiDT8ja2XJ21m67sgPV qQ8b4jl4TktUBzSnVcSs+uu4A6XBLygstOvqUJ7qpg0c3SDOuvW7CQXedsbQZZ0VS83MfSZ4 Z9lF8F7cqCsRS51jIOK7x1gqXMt1Z/leO7IsOiJFmoFwe+tO084F847AosIUKOSzz9qjDPDD x4/SNIiz3januXUr9uW76Mpv4Mi7cl2Jt7rbNmBZxA6/HZq3XbV5YXJRtm0NBB7wnuZ5BOAp MnlUZOqcKh+M68xUpDJgZ6DaVDdlWApWliJ4iRWd6E6v2uju85IsZ+aho7sSNS/JMi+6G/Fj vCRLb1cwF2nw3IKLHNbb5tT+DT+8i2NZn4jYDdvc8BL5wFl4QvSuTpL4O+jXTb6L9kcC2p8X 6Fh4Zxs3qczoV9ofCXoIRYEmgrfYTbAuqHdIpdq6PAhF5DqKfdI3HEXdikoLBTIcikDGhwPI WNy5ogsyvGpB5lGIhcKNAZmDKoocycqlEEYcpRAZWkQzKYR222HARBF1IVa0pdmr94IB8c5j hdRy4ur58ZOq/EEQjkg/Z0CLaleUHiNxQjcismh2InyqDiiQHz+P8fYI1UyOFo+4vv5o1n/8 RMz9GYV780b0pqv+6pDen6sTMWwKjeA14DTURgAm73BSyXWmHDecXXHiee+qlQKVnirSMaoX WeRSW6OrkfO5sUEcrTm9gBD9jxlCuduhDh5sH5qEDFzMrYM3yAb1Yd3dCUBhWx5b7Aw06X9y W5saxdaJaqzj9r0FX9kxNCqkD7CWfzZv1Wt1upuCj7S4HVCFKvR0S8iJaoN8esq6vUAtjczm aLekavyI9sO+Egf6H9qS4htMRcH7jmtyrsNlG+i1rt4mHXd5jaReb7mr42IXe4aj3g06bxIN x2NVArPoLhFUbWy4EiOdAvxK59dE7XTC9vpas605Zwc6iPbtk8boMa9WS7RJnTA1JdlcvVGK UemGK3+xm8mGL6qOZbdt7YYv9qmLaG+f05YO0LUaWblYBasIN3LfsfIDIDDT1GzaFLVzLpvV pH8toqS2IidA590kL5gsaVvKmjoFG3ea1UrUrAutLzchGnG7GGlWg4RPDk8iMlxhT7xqW746 jvrb+ekPagIZhzUufDw/4VKIHfgZiY1+PyGco5U3eWfKXSVjCcTjp1//cS+yuAjFphmJWKZj 6j5rNH+NwDaOcGObZ4Uwi33kDgftEuAG7sVamMVBqYtL9Sru4TrkKOS0Ne7hpKXWyCTDuk8z 3JmGuFAxR6A75xuep0MlVefg1b6P9H3bpsXkWloc1T1xVCJjfm64E7iI2DXUKqFMDZ6E9IHk SO+mRKKTKRiNKYaGdwVqM7Ph/ys1PanZf+haEJuT8PzgfKj/PFeHqsVmjkdYg1oMr/XmzPQB jKcq0U+YsjOeAhjvAfZyNXKVbuqX61ODLdBvmvNhg95FBW4FhYFgCH35hEo3iIJ8HofAiMJc jZGR8Mzzqe7ecbl4aOtNdZJdF9NvAZCUCw9H8wTRPFwlKyH3MMtHQnTOTgdF7ThiOc/pdXIM ZhP066eiQ92r0BUV35ugvOJLA0l00FaSx8fF6tOu2rectwbxmSCyp3BM4e1gPHObxa4wEri0 vhK4wkjsefWV4fR7pAePDPX9zNzQJLzyLIvVB9kiaSnIlATlYYuZUCyfM81rlMUuI4zHPkd8 lYLmMkQ/ec5TVfR8/AQezxeHexzNOVmvHUedGu4Bec/wkNDjiE7PmgwLDCHjyx4QQKVF6gEZ 0ZbnC3rzQHkukiV3eXR5rkTNRpLMK8+liIt1rwfkAHEiJPVd8XRIfmH7jSnV1O8Jr65g6SlV h1YFEkepfYyb6thb7EYOVct+HWWvuhf5HQvL2IOwT7cGB0RZlIioG9/Kd5SMX5tuO5yBkgJX 1Kt4Cdw45dOYckZcxIZsd7EbylEuIos9lOl7O2JkHUVhGy7I2Aa3JqizCGxbMcuBQfvmQWxL 9BpsO2DmdSXTXkhansB1+Br2g9hGK2xmb4roHHUrQPfQuWjBL4iBHM+nY4NpHaZjtpMXiH+h WiV52NqGAVLzbmquUwbiWxFrkb5jpLr4mrJ0L4ihITa8cIbLwyxKCu4wmj17CO0t56aOfoBF z2wZZf5aAwDtrYr2qd2kghhYLuNRzgEkLAJ/VnRjLV4dxKOEmMGjRpy8TU3klACHXowpSfHj sVZPcEyPtbIAA6c8VBWGRsBvd3RxR83Lpj3SXRoqRoegm85aecbdyIlbXBacSod6lkJeUiR6 lsKKVoeCXrU69O8slJaMDh2lkU87F9SkQy16Pu20cibmK3cOYBqMoDTp1mgFPzUnXIaSArmc QReMNfZWgytQmWfx1ve2BENo+YqAPH/6QY4AcdocfoCNFPMfcKq4U3DNYdT4AbWWcxiFRIwf OKJrbLxqje23SqT9zPiBMadyGD1voAK4Fj1jXyMni1G+zHf/U9km91LgMNX+iDtBY3Qy9LDW LbN1ngVUjo7zGWY7si6PzhaRSObPL/Qrco8v4x7dOnQfpCmGqqMQJpRPnaY5lW1Mpe+qS0aM GDWpE3WlaKIuiRZECyOy7XsgkrgwEUPDRIIoXnkMV4ofjrqxHqWYEXXR5hg2rSm65Mqziq7+ nZOZJupbMsItR44xN/EdD9EdGsbNpuHAxq1FrsvXaBB0pxIXq6pat3BS1sYBHc4XswhrS85H orW2MCJb288Pyp7a2q55kR/iwuuuGtELGbPzQzxhVqVHM2CTV2pwPYG2i2cMZqsJ3Xe6T+un jMtq1u2DKQUiVbACZcyNWTQxl0RXgVq8pkCpIqNAR2OkQIyzOcOKRvygAtFcN5xvIA72FGjn 2WUrQQ1VK1qCSCynqqmRaaDpTCO59FkpEN0MV4EsWgVCdBWoxWsKlCoyCnQ0RgqUMxea5Rnx gwq8HBi6+CBKT4E+qIYjT4TmQZ4hjWOCxhhpYrLyuqh0/edcIrxxJ434D5qnNbyB+74XcQEl prRKRH2OmEWyihFdq+BVFq9ZxZ91MXpXWcCZSgBvjLX4QavMn3WhcVin5BsxS47iOIMrYvpR mmV6quF5WDUbh0JS385TS9cZ0kOHjuamdcvOqTeVw/BICI0hcc8pZhGmsaJrGrw6aBqpbeMw WvnKNP6ECD5Od6VMnx+yechjnKv0HIauRaChy0lOiWRz+U3t7wZYv3zjBbhRm7lJj0VoUCU9 iK4GtXgN3FIpRoNaR0qD+MeN2Vr8ILgnzKX0NGihNExBUPrxWEp8ufytEUgEfZ7/eG2+oZuC e5G3ardzhzt7XYIYTbFwmSdCPmtCx3CEoMUFRq2Xy8xfbCCX9RqRuqOjJ1L95jGw7c5ymgEA T0Neo6S3vO1zXoyupYkaAPAWm7LrxacvMsXK+zobqFRwQD3pZlMWbTaFaKG9iLXIiPTZeyzR aqCtwYt/KZtiaMuFNosfZ+96Bml6SL10durh/c5seNe8YMakczlbn3knMe7tigRQ1I+efmc7 1hQ3o4neulfBoioyC5aLCV0z5OItNgCWnut/xaUv2h24PsXEjRp+03PjF9hB9crYkc2hmETq 91rRYgcKc3tFPexIdBjsaHQo7ITe525iLXph8Vr7gD7Y0zcgoZ4/N0g11Mz+L5iqVUF/YT26 /R3rntHCU0mLh7Ac+juGRRPJ5CNVjryKGdWTuKAGEcpfsiBH2FRIEZSXAq4UHQvSqyxeS2zS KMaC2kbSgpGcpNFc2oieBWdTg2j+CNcX0Fh8ptJ8pABTuDvQOAoBIy3vGPcR6RLfKSCfOKum BzHD5ekjRn6HoWOCirf+mCHHnD8B48a0//ds9svojViCeZUQX5Hg7XIgqvQym/NxrguPNNft 3rpjpx/J7qYR6y02bZPgJMQbX2s0zvdcrDpXDGraOlLTZaqukSKlSy5zSHQdRouX6XKhfEA7 jHEJ5TD+cFmkRc9hbMhzXGc05E2YPuulAzWVzn1wmojeoS+EK02q2dEAGYZ0jO+DKJYZPkfL z5zlMpimHaSdNubNX5fqWqT4l9GNWzS6DxhD493wbi0apy42cnRzNfwdKr1eD6mN48MNkgtG aBxwPpcXZlIEuK3oghtvttlA5XN1RavwasCt4avAnXlcMNKiB24H0tPufiIe3ZtVKDLzQ4Yd RFsU0scyC3yJx+Xit4qcB4QSc0EH/R/UPRNG03ThqRODGR7qc4oUaTRd5b3nj4HxJ1u6XiyG +5t8tURavzzMRQ9Kx29FNmlUYqgPpbCD7gZjR9bEEYvAjhWdWQB69QI76jPYCg4GOxodCjv4 bh2qIzTQlPjBOZeIxyNnBSkzd2s7ZXcCw34gF2NfEBEjJeAbK4R84jhaezZwPonAM5c8ismB 2Xq3hbKyCronbBXZbI5IJIZuRdej8eqgVaSijVVYxErKKuAcTnUXadHzaJuunJ9G0xVaDDMZ usOcmdT9LqsZG+j6TiG/EQeTvzRIdKuzrQ2iJrPBF+TnaaXZ2RRw6dv9DDO6Jh86r5+hDAsL kmFpKbR88Y03EHcLR3QNi1cHDSttZQyrTEf+hbI9kt/XYoi7Fsmwv/wfi3wyTQplbmRzdHJl YW0KZW5kb2JqCjUgMCBvYmoKNDUwNAplbmRvYmoKMiAwIG9iago8PCAvVHlwZSAvUGFnZSAv UGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgNiAwIFIgL0NvbnRlbnRzIDQgMCBSIC9NZWRpYUJv eCBbMCAwIDYxMiA3OTJdCj4+CmVuZG9iago2IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAv VGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAg UgovVFQyIDkgMCBSID4+ID4+CmVuZG9iagoxMCAwIG9iago8PCAvTGVuZ3RoIDExIDAgUiAv TiAzIC9BbHRlcm5hdGUgL0RldmljZVJHQiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJl YW0KeAGdlndUU9kWh8+9N73QEiIgJfQaegkg0jtIFQRRiUmAUAKGhCZ2RAVGFBEpVmRUwAFH hyJjRRQLg4Ji1wnyEFDGwVFEReXdjGsJ7601896a/cdZ39nnt9fZZ+9917oAUPyCBMJ0WAGA NKFYFO7rwVwSE8vE9wIYEAEOWAHA4WZmBEf4RALU/L09mZmoSMaz9u4ugGS72yy/UCZz1v9/ kSI3QyQGAApF1TY8fiYX5QKUU7PFGTL/BMr0lSkyhjEyFqEJoqwi48SvbPan5iu7yZiXJuSh GlnOGbw0noy7UN6aJeGjjAShXJgl4GejfAdlvVRJmgDl9yjT0/icTAAwFJlfzOcmoWyJMkUU Ge6J8gIACJTEObxyDov5OWieAHimZ+SKBIlJYqYR15hp5ejIZvrxs1P5YjErlMNN4Yh4TM/0 tAyOMBeAr2+WRQElWW2ZaJHtrRzt7VnW5mj5v9nfHn5T/T3IevtV8Sbsz55BjJ5Z32zsrC+9 FgD2JFqbHbO+lVUAtG0GQOXhrE/vIADyBQC03pzzHoZsXpLE4gwnC4vs7GxzAZ9rLivoN/uf gm/Kv4Y595nL7vtWO6YXP4EjSRUzZUXlpqemS0TMzAwOl89k/fcQ/+PAOWnNycMsnJ/AF/GF 6FVR6JQJhIlou4U8gViQLmQKhH/V4X8YNicHGX6daxRodV8AfYU5ULhJB8hvPQBDIwMkbj96 An3rWxAxCsi+vGitka9zjzJ6/uf6Hwtcim7hTEEiU+b2DI9kciWiLBmj34RswQISkAd0oAo0 gS4wAixgDRyAM3AD3iAAhIBIEAOWAy5IAmlABLJBPtgACkEx2AF2g2pwANSBetAEToI2cAZc BFfADXALDIBHQAqGwUswAd6BaQiC8BAVokGqkBakD5lC1hAbWgh5Q0FQOBQDxUOJkBCSQPnQ JqgYKoOqoUNQPfQjdBq6CF2D+qAH0CA0Bv0BfYQRmALTYQ3YALaA2bA7HAhHwsvgRHgVnAcX wNvhSrgWPg63whfhG/AALIVfwpMIQMgIA9FGWAgb8URCkFgkAREha5EipAKpRZqQDqQbuY1I kXHkAwaHoWGYGBbGGeOHWYzhYlZh1mJKMNWYY5hWTBfmNmYQM4H5gqVi1bGmWCesP3YJNhGb jS3EVmCPYFuwl7ED2GHsOxwOx8AZ4hxwfrgYXDJuNa4Etw/XjLuA68MN4SbxeLwq3hTvgg/B c/BifCG+Cn8cfx7fjx/GvyeQCVoEa4IPIZYgJGwkVBAaCOcI/YQRwjRRgahPdCKGEHnEXGIp sY7YQbxJHCZOkxRJhiQXUiQpmbSBVElqIl0mPSa9IZPJOmRHchhZQF5PriSfIF8lD5I/UJQo JhRPShxFQtlOOUq5QHlAeUOlUg2obtRYqpi6nVpPvUR9Sn0vR5Mzl/OX48mtk6uRa5Xrl3sl T5TXl3eXXy6fJ18hf0r+pvy4AlHBQMFTgaOwVqFG4bTCPYVJRZqilWKIYppiiWKD4jXFUSW8 koGStxJPqUDpsNIlpSEaQtOledK4tE20Otpl2jAdRzek+9OT6cX0H+i99AllJWVb5SjlHOUa 5bPKUgbCMGD4M1IZpYyTjLuMj/M05rnP48/bNq9pXv+8KZX5Km4qfJUilWaVAZWPqkxVb9UU 1Z2qbapP1DBqJmphatlq+9Uuq43Pp893ns+dXzT/5PyH6rC6iXq4+mr1w+o96pMamhq+Ghka VRqXNMY1GZpumsma5ZrnNMe0aFoLtQRa5VrntV4wlZnuzFRmJbOLOaGtru2nLdE+pN2rPa1j qLNYZ6NOs84TXZIuWzdBt1y3U3dCT0svWC9fr1HvoT5Rn62fpL9Hv1t/ysDQINpgi0Gbwaih iqG/YZ5ho+FjI6qRq9Eqo1qjO8Y4Y7ZxivE+41smsImdSZJJjclNU9jU3lRgus+0zwxr5mgm NKs1u8eisNxZWaxG1qA5wzzIfKN5m/krCz2LWIudFt0WXyztLFMt6ywfWSlZBVhttOqw+sPa xJprXWN9x4Zq42Ozzqbd5rWtqS3fdr/tfTuaXbDdFrtOu8/2DvYi+yb7MQc9h3iHvQ732HR2 KLuEfdUR6+jhuM7xjOMHJ3snsdNJp9+dWc4pzg3OowsMF/AX1C0YctFx4bgccpEuZC6MX3hw odRV25XjWuv6zE3Xjed2xG3E3dg92f24+ysPSw+RR4vHlKeT5xrPC16Il69XkVevt5L3Yu9q 76c+Oj6JPo0+E752vqt9L/hh/QL9dvrd89fw5/rX+08EOASsCegKpARGBFYHPgsyCRIFdQTD wQHBu4IfL9JfJFzUFgJC/EN2hTwJNQxdFfpzGC4sNKwm7Hm4VXh+eHcELWJFREPEu0iPyNLI R4uNFksWd0bJR8VF1UdNRXtFl0VLl1gsWbPkRoxajCCmPRYfGxV7JHZyqffS3UuH4+ziCuPu LjNclrPs2nK15anLz66QX8FZcSoeGx8d3xD/iRPCqeVMrvRfuXflBNeTu4f7kufGK+eN8V34 ZfyRBJeEsoTRRJfEXYljSa5JFUnjAk9BteB1sl/ygeSplJCUoykzqdGpzWmEtPi000IlYYqw K10zPSe9L8M0ozBDuspp1e5VE6JA0ZFMKHNZZruYjv5M9UiMJJslg1kLs2qy3mdHZZ/KUcwR 5vTkmuRuyx3J88n7fjVmNXd1Z752/ob8wTXuaw6thdauXNu5Tnddwbrh9b7rj20gbUjZ8MtG y41lG99uit7UUaBRsL5gaLPv5sZCuUJR4b0tzlsObMVsFWzt3WazrWrblyJe0fViy+KK4k8l 3JLr31l9V/ndzPaE7b2l9qX7d+B2CHfc3em681iZYlle2dCu4F2t5czyovK3u1fsvlZhW3Fg D2mPZI+0MqiyvUqvakfVp+qk6oEaj5rmvep7t+2d2sfb17/fbX/TAY0DxQc+HhQcvH/I91Br rUFtxWHc4azDz+ui6rq/Z39ff0TtSPGRz0eFR6XHwo911TvU1zeoN5Q2wo2SxrHjccdv/eD1 Q3sTq+lQM6O5+AQ4ITnx4sf4H++eDDzZeYp9qukn/Z/2ttBailqh1tzWibakNml7THvf6YDT nR3OHS0/m/989Iz2mZqzymdLz5HOFZybOZ93fvJCxoXxi4kXhzpXdD66tOTSna6wrt7LgZev XvG5cqnbvfv8VZerZ645XTt9nX297Yb9jdYeu56WX+x+aem172296XCz/ZbjrY6+BX3n+l37 L972un3ljv+dGwOLBvruLr57/17cPel93v3RB6kPXj/Mejj9aP1j7OOiJwpPKp6qP6391fjX Zqm99Oyg12DPs4hnj4a4Qy//lfmvT8MFz6nPK0a0RupHrUfPjPmM3Xqx9MXwy4yX0+OFvyn+ tveV0auffnf7vWdiycTwa9HrmT9K3qi+OfrW9m3nZOjk03dp76anit6rvj/2gf2h+2P0x5Hp 7E/4T5WfjT93fAn88ngmbWbm3/eE8/sKZW5kc3RyZWFtCmVuZG9iagoxMSAwIG9iagoyNjEy CmVuZG9iago3IDAgb2JqClsgL0lDQ0Jhc2VkIDEwIDAgUiBdCmVuZG9iagoxMyAwIG9iago8 PCAvTGVuZ3RoIDE0IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGdXNtu 5DYSfddXEHnyAF5F95YePcYEGyCLbDIGssB6H+Ru2VamL06rbcd/v6d4J1tiS4Ngs6FbXaSK VadOFYv9F/uN/cWaOK9Ynsd1kSQ5K5s8zmq2Kuq4ZseO/cH27MfbIWXrgSX8n2GNLyVxVogx /Ue5iuu8afC1NInTKlrv2Oc7Vorn5f/d7diPd3cpS9ndI7tin9jdn+zLHVaQxE1S1jXJi/Os KdK0Nv8VjcyWV3GWN3XN6jJuMlr0nPkiPZ96i2wVpxlryrjkQnYMf6gL84et/EOdyyf4H9Is sv7wzB4D2sgvry8608ekcqu6gnLlyyZxkiT47tpVc+Sq+XO3bl+Hjp2eu7kaZyMaT4sizsqC iRXI7Z1YAXNXcHtjdtp/s7Ss46qsPLkhs/lHQFhVxnW5qr5nkTes3W9YaKlZlsdFVTWu9O9c apYncVXV6Xxhn817TzphlsN8qyafL9UyCX9rsqKMk1Xibc28LX9u34TFDe2uY3v6F6l3137r GBnj4VHYo/HIEAKQPXL7o7VkACX4Kb2pGsIp+TCiT8uKbe2n+Zh8VGtNOH0Fr4epKJeXQ+nw kJTTp9LdMa0cBp29WhUj3hmFTITr51v3cW1txGI0TLMGdp+u2PgCXHgwzhkRCrfs4fD0OrB1 dzz1j/26PXWsH4bXbsNe95vuyLoeyHGEZ1wbA/RNpcibuEwyWDPXwDLwPxNWVPEqyTNX2Dy7 O7XHp+7U759YaymU6wfGskriOtqxMgNMyCF22BoK2yFtio8nbYebA0SJcKGtQw5XqWM7asiN MGTnY5FOx9WqykaMK7i3X18f/uzWJ3Z/9Z/7T9O7l8J5kjIDsNlTOFbrxRRLt/7u6Thhy5rY PE9qP7C3dttv2Ptzt2cvx8O6G4Zuet15ksXVCpRDrHtRTFLW3TqGv35u+z37pFGJlA9LQIwi zCka6EkNt/aQ24l52JhNRKAD9JKQIyxBm40yDGk2ZeOYjRo6ZhONEKSxcG3MpiQ6togx9Pu3 w/aNnEj7/vQmpE2BQJbBW/lEM1w/EMCzJEX8yknHFomcsB4DZJxO3rADodT0SrMyi7MVdOEI d8zcExlaKXanWIElzxZmxW/fZ7KqgiF7bx1aWGzeUke1M6Er8PlVCUy2dRmSGvDqrE7BBSoQ C1vYvI35da/j/e3NYE2i49xco87rJk6aHEDFV7HIqO+vhhZRNmQghQ48tnhHYx5iBQykKMH8 k0Jt6qK13oTQuqjqOE8qZXm+4CDbOLxuNzNMh4AuTdPS3W1HEZ6nWLvq22GZFHGeZiAny01n e3iyJGt7sXJDA4dAWYnA2EZOEckBoH8+JCKnhzZc41MB19Ej4/alvmHwXgpQ8K++YT1tAJ9Y JoVxCfgCwzXgK0iXgF+sHMBXwzDHzGvg+aJYR5mfTe+Iibfrv1575Pbtnn29vWOPwM7+dI3I 228FcT9w1vdOFmMFxLPNRYDkWX+VXU5Mlc3IfHd/ONk4FiJGYxEOmXAFj4Vd8alnBB7blFQB wH8hlD7qoiSz+Q6pctNzN7EQw20kNz11yaEahjcdTMcL4pGf9ivtyuqKnfaPMXwG33rqNtfY dvB9NkiqeDqwTXcCaewPNhHy1aTpRdlcphdqZXLfW5pt/cwePkDS/3XY96fDMbb2xp8rS1Hs AQdDXcrMhZAxWvxQc0kt/LpfC3MeVYF4U2Q6QgeG9/lLMK+7Iu/zMXechKvX3Z/6df+CvGqD nLc9wfW4ct/77ZY9YHXIifcMej92PN+itew5D47ZnazZRLxKNr0q8IeFqxrRx2noto9s1z89 n2hdx+7t8A1rxjaZkOEvIQcvqBuAe8mXsAiW7FB8EdrPJm5gFE0p55UbMhGheJ4bCtUJCjtN lc0QJvfUYpmT/KtAHbRqwOqEasaW6LGJgJ6LFEDb1JUrbMIHPLHc6GRKT9BvdnNE6ya0Eubm pOUiKpHL8QSIXoleiIZIgMyQB0DxNP/YDYg6A4rKlYONciiLLvimU3TRwyA2liUVXRZZnoA+ eH1QFRYrhSp8A0wzJJ9lAgvk84chwdsRcux+sCafikapKmjqSaL5RfWzFYMAocoOX12uMYlZ Zsm+cF0c/Q7hu3b4NvB64A7p/7o/oBzV70/d/kR1wmlU1lUnrR06cphwChUYpAdfAB/XDfyX 1dzeedkJ9OHJaQh9qjROEziMI+zCW8jwdsP6RxW89GEKt0x4Keg2Vbu4DckhVUbJpMSQO6n1 tHZaej/5DLl9iZOhBChAAqlexodcPv+G9bSWoFFRUCLpyZIHA0+Mn/N5HEpUlnLoFD6sHbE5 f+TvjQnVxRlnOjsqUUbB1RldafObtnPj9rZ4f+sj65jL4rj+WnXdtpwU5iGHBd5nwlQVzxE2 YUee2J/hZtp+zgSrI5pxwcGE03azM7kaj9TbXwK3gBelNY4jy6ZhYpGLwsENewcnpSzprQc3 2xHqIC9qT6d2/Y0I8qA4G4iygSORbZbIx6zioBjq4iANuVOYh42PuMVBafYqV9ReINKGEhV2 6zxCDx0fsSKW7SNnscv4CE6hLhFHz1S6v1+QHXRzygioIMRF0QBs1DSXNjhkhTrecmELN/jh eHgfcIrxBo6NVFeQ3HZDjLwbOQABG8f5gS4DX+RJcneRMpIpiPfGuQINgbhcDRENbVNQQ76D igBIuBSbrU3B2nuCSzy0qiJ1NCWGmCfMktLLiYu30w9bmP+2H044tkM4xv9ENsAdhevxmnXx Uzx6dDXXFPMKfosMgpXLF9g/GtDSAcdHmRwnUlWDWpYzgQPY3nsHjNCkO8tXa0PhRYM6ewuV 7vB5pfE7L+GEMnYVgMpCpztzhS1Ld+ZKDejZpDu2sIlY5r35Y4sSFhybEmrKYK1ptNqnrJNb IzwsLbgjc9tRwy2zhtyRxdMRPa1BXeVAUoJKkfjQZEzqG9bTJCEawwLu7fqYWnu7DAvAFjss qOEzqpn6bSeoUyAsJGf1hEvlJlQtCFfbD1QOEExbHN9R3wlVOtrjB9t17fB65Gd5opYx7a95 GhcowaGmYi1i1NQllQ8QrBzht0JHyHxhY9YypT+J+qjNEerntHAYCw0BztbQRn18qm1F60Ci vtg8jfp8KGAeqF80DknWQ4cATK3UhxNNAAo0TCxMnoNccYVTsSIv2XfItfHRX6+uyjpyR41C ZkYB/EtxyJgUK3eNIVlz4C9NalRK6my+VMvS/NfVxMl53Xnwx2u5g+BoRGQfOjrIVZmN4TT+ nNxeye/EnOF6hoJc6YGDIgIPstcMaPDMUcAK0Bfq+ygNUc5ZoMDKORTXpxyCQ5mh5U308IQ3 RdJBlDdpfxG4WcBQLdzUwyCHKtA/stBZUOZBdfuDNuJ1oI04q7tCd0So7PMZPMxrdrc3Fgf1 98u4MNKzSxze2y9Bf5HXUMHXlHpFWYqHTbQB0QGALgZ3j4+c9VM1mJY7bUdmXTgnW7iulxY1 cF70Ue9/f4UTKZwVUOKlE9RgYBvroUFiKA7r6YR37ppYKvqjhuF1J/iEtQLF1/1d0QFnZKZL IRTnYdYMIXcZe0dNpJ2ZQ7DGNTp+spBXK1TE0eviCLsAQBIMHqyOHR3hzvSkzg2cCZzVLmHl si3AETaxWk/s+rB7oZrj6f7TNTEYfii1YBu4aZGeFAkA4VBDIgF6yHHKelrjlmSRWgJpxpJg hvwbkqHS01qC1jLnEVFROjV2OVQ1doRnB/nUMIx8+eIau5dxC/RDs6FKKnHip/PrM+sAS+KN XQWfd1Es+uO5A0AdOUqhhezlMMB5RSmHrVHVMXvrz2qQC6WGhTjfrp/7Di2vVCt6OrRbHKK+ IEUeGEBUIBglIwpVO/SZ7fthR7DWwf4OH3QQO60PszLeW79IH3TiI1bghJijHXHA19EKIA/8 AnRap2WU1mgNOV6rIo2kYQF16xb+nPe0Lyro5HEep9M7uUKjV1Hi6M0RPbbO7PI6idLiqkHu CptAF+/1fzebzoN6xz7zZttb02w7veuCkSW1nFju+thbmBsVky6lTSif0Zep3kIiOhg/xXxB Xe6vvny5/2RbD1mxtB33sHgkTluJ98iZmq7VzFmkB+Sh9EH3jTlyHU160gLpA8/ZcfI8W9ac 9EHXZBypwsgu8YZrJrEWfRXPol8nRJXcLZA1jVy1uFJtCH7Dh6hXmKGIPlRMEx/TeKxekbs9 rnKook9udUDh4o0eUr1iEo9zux3vouNx1nYStQZxu8gXrJLUOXI9u0D7BqemNpYi0dENG/88 vCMMHK9RAFEBcP3crb+JjvTb33+Zg/LEGuayVOmiYC6/3n79N/xweDnsccFCMHdQSqR+JxDo EzIRm9kPp/aEY9ZNe2pZ+4TaLsq801Bk0ANV64VL4+lCyCCtosUIJug2r5xPvShMnCVborNc dPu89d07UYPBvLYmUr7FaHItFhGCYrkhwcAnybUjbMKuPfuTbRzBnhx9LD4i/xKW2Cg6At/O Vp0dvepjcWdiB2ZVZPGqNBFdQnTvExbqWHy2MN5gfaG6qJtnHanzdC/T4/mpKLW9cPNlORgl ncVL9s6HOLGxhhxezcOa28vDdfENtKSi+RcNOUqAGHLx/BvW01qCNmpRZcyd7sRIDjU+446b VRfJ1TCYHeQoZ2s2OKFLb+NVochixRKRNFxCzy/dEY2plH3jVgZwxHjqmbUgsed3hsRaQg6q Gd8kVzJ2zF9sEd1eH9C48jevYdg3kPz1GkBFquMB6iUfNbGHSjRoLHzGBZ/N65FiDB/x5kFe wLn/JHsI9btecupzP6QmL2pjo9s2fKV0iDtzl89ulhnOLk5GoqwR9T7ZVCKGuseEhsKwRauZ HvOqtyrCiLQ3F520quAnh8qws8Yp+OkhF3Rea3FJ0uTuZVZH6pROPATnd7EC0UHHuxHZlyyD aq6n94NRsvZ9/w30lS8xy4wDxcCS1ZUvR9Y8C9n0KCzyot+5VSMrRe56egZNIQ5hQYXBgYvm TI5WsAxa5VVl6pFRQ1SV+TCiT7mVmYen0FPajTIybUaiqpzVzsm8GF46mc9mtBR7NmSTN+rc 71B+MLVa2doPagP17dp9izZvAKioSKC+uv0I1V40MtGlJA+ZJvunJOm5v/r9p1v0J9QJ2xy6 gRH9RA3mrd+gMoI6R7fD9KKy/PTab1pqzqb1i0XSh+GGP7O2GT2XKuLItVnmQ6Q3Zj/zvvdv +8M7xRYQ++GAW8rHbvshgPR4+nAXbazO9yYCrzRd5QwX5JfqbG9Xts8Eq+sVmWqRCnQ4ekai mjZEs32/p0gqdI+ogfPZ7mhwwp9X36wU886Ah1DCnOA+LW66O7LmwYMBhU6Etod26HFi8vA6 K1uhS/YLTZhfexlM+hSHrmKl8HfwVLyaPZFDeL1NCaCoMW774HtCT57YL+hrolZQU6Yxe3sJ Is9ovHmrGQtRXsZZVXRlbxhRISSWZiVnVpbhJyXqHG5jTxRS35yeaX2QOVtqYFP0eY4jbN6m oNh88/MNAxvs9gOnage0URG4oDfFaCW4P3TSw/cDQQv8y+ozEEPdZ0BDHrSsp90gZm6lZW6j gRxqpoSaj5UCZGoYTAHoFvDCFADq4SULtOWhYsJNV5bpRe1iONEFGdwUWnfdJgbFveEBRScD c8oVKW9vWETgv8q7T+k1Ow9mCFQIHghmIatWPSdi8kUFi/UW5ySAZ16t0YYzG+9SfkC96HXp wAKtOkNHsZiXiPi9QH7t5/bm808IiPwPFJwHgCFj9jYoZQVCo4pg9EMvC7EYv0IUozc+xla0 uoNhwBVetuZlTiwaJIf98HQ4bH7w6l+igxNlp/EDTg226YITYckkxG9MwA5VhY+KZ8Rl0AUh cVhcnsRx9qkHDaLDFUmDcBaDn9PAoudobPnh1w+yDv8Dtk0UAmN2sx1suPFBWP9kTKqmm5/f gd/R7Tq608bufvnKpCvTMdvw+vKyxQU/6eRzXpefui0yXvWSBKim4IokiDRPVJLiIS0Mx22b 4Zl+fOa/cOqqqdL/oa9bNL1fMpDlR27kMt1A9/1kt4Q0FOyFrSYcTfKysEhv4F89GCf9VA4v d8zQGJLjtDK/fTURlRCh7esIhiK4sZru+epLweM+9Xg87LhKzdp++z/TYEMQCmVuZHN0cmVh bQplbmRvYmoKMTQgMCBvYmoKNDU4NwplbmRvYmoKMTIgMCBvYmoKPDwgL1R5cGUgL1BhZ2Ug L1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDE1IDAgUiAvQ29udGVudHMgMTMgMCBSIC9NZWRp YUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iagoxNSAwIG9iago8PCAvUHJvY1NldCBbIC9Q REYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9UVDEg OCAwIFIKL1RUMiA5IDAgUiA+PiA+PgplbmRvYmoKMTcgMCBvYmoKPDwgL0xlbmd0aCAxOCAw IFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBrVzbbuNGEn3nVzTyNANMGN5F PXqMCTbALrJJvNiXeaEl2mYiiY4o2fGH7v/sqeorKZJqeoJFsG5Nq7q7ui6nLq0/xS/iT7EO 00KkaVhmUZSKfJ2GSSlWWRmW4liL/4qD+OG2i8WmExH/r9vgS1GYZHJMf+SrsEzXa3wtjsK4 CDZ78flO5HK++r+7vfjh7i4Wsbh7EB/ER3H3u/hyhx1E4TrKy5LohWmyzuK4tH8FI6ulRZik 67IUZR6uE9q0z3qBWU+fIlmFcSLWeZgzkb3AB2VmP9ipD8pUzeAP4iRwPngSDzPcSK/vL1jG DzHCD8P9oiws96MwiiIQ38zeQyX21a7ZNO25c65keL9xloVJnol3LHB7Y2/6gmxehkVeDOh6 is0FsSIPy3xVvGeTXz/U4WP4ScxtNkmjsCjKuE9/brPfT588SSFqxTrtE/O7ss9fP1rCkyqZ 5EmYrOIBO+a2O3P/Sb4OsxXMwjsE4NSK+uGh3pzE6akW1elUbf4Ixc+H3ZtoHvizj1Y150wB iT6JOolLAuMEfaUz6iGUk4cB/WteiJ0zmYekqoZdUvcLKD8kRmu+Gmq9L6DnqyJQWo9VaQi6 szpfrDLooLJIExca9G3h/bF97eojrO2uqTtxfm4PohKn47k71dtPYFFz3NobH8p9Gq/CqEwS IVf2sL0zcpkmUPQyhVzyMRSxiWOI/jGeq+PpTfx8+9u/cZIOh9jWx0+iPdTi0J6EveThAaz5 KpKrrNNrKrNJa4pWitGm3e3OXdMePonX9rzbOvImHqpmF87wsIzDcp2sRMFb8ODhjLLY86Tl UnN8RypyqHZvXdOJ6r59wXDXtaJ6fmbZgDKRFp27mk59++s/O4GPtk3X1fvmUJ1qLz4n5Cbm RXTA5019PDUPzYZWONYvLf4Ao0V3qk7TXLUmiBdcJExwR9vqVIWCOGKXMFghGMEKY74xzeAV ygKWy+PQQ71sH8+ds7bGDUMBTo30OGsE7zS1abkOo3W6thsOAKX8NNC9pQ2rgLN7bVqnOMec gjFNpG3lQ+nhTjhDNqZydkCzJ41r2jeucmiMa6KsqbLEPIStnTeu8XXjOpTc9nCqGjKo0BbS lNOxuT+z9D63zeEk6r9O9YHMhmgOMLjVljSrOoibn2604AUEkycQbxH5Gy0RB4R9zYqh+OkA fa5OYlNBoyvRNdCv7gxlf2sOj1K/H9qj3ocLlqeucbjRDO6hXJfAAR4bHSjAHBzK0iRMowhy 6tLtCf2A2ozbydJ1mEcJsJUvsc+OZE/pZZYV4SpK4Rl9qTqMvuBjDjAfZdAIl9iEXg5OLnVR 3quzhDFmNtxx/gLa4bvLgnxNsdhe0HkAluVw5w5ZBeVs/ucJlQyKOO7hHTnUKpmv1xLgSJU0 w1mVzNdOxDfBDq2SKvbbNsCDxxq6Zx2Y/uRY/3muu1N77D5BH0kPgRjr/TPQYyuemm3N/s8D TOQrcr6LnNzAscEFSWRhRW0oFCYmMKuRse4pweDsC64/uFxNBQ1mNYqyfXgefLgnXyYcB2EP ZTDxcL20gM0DLAKQtrx8t18rVmEGBbLE/P3aw7Hdi1N1fKwBiMc46G0MixJGC2jAPdEUBwdK rFC6B9/yuAxXcW4X+TuFgiNH4mLGNoHvSA/hpunK5JBtgDPb2IQMTFBzymAvaLdkVZgggiY7 lFbFzjYUjMQoQ1GuKE7SUVTOQ8RJ+FcEa/mKYYCOosxw3qoUizMZ5L2rw6buCDMCPROABpJu Hym1AeMB7woMfZo2HSngeoEMgsh5cY+k0vczxDTu7BG7oqsqqHlp6lcVKKvQGVJ//0YQ5s6R /qG6mrgjzwklLYLbYFMo/tG+1i8Us1UdhWxYFBb4N0TuBI6QFQzjMAZPt/rvMP6EeaLe1Xsy 5tPMsDvL/MGSYgaFOXd0mTKm7Jr7XS0IE21hDLA1wKTmsGmB4ADesItj/dwiVsHH+KZS1jn8 liOt4+snFH5zrKgMhqxNGN5JXEIf4UjFyDLBtdScCbFMMPT1w7/aQwPvKI/NvhDcwfFPAJVe NwD19j2uuoHTERmbTkBEBBh8pBTFvoIjhkTe3sBHHsVv5/vfcRfQvJvztpF3gvit7prHA6QI yucjG9HiqFSKgNg33X39VL002Ao2hY0CPFDOQe3wGbmVrg6/ftTywGnvPp7PohTuqYCv4238 TRmADKmohZr4k5HakV2ukIbL0ly8g66L5UeAp+NBRzLMqAmUWQ5jLheeN40c48yA/TiKwyhb 9WlNWMaBD74RXz+8PrVW34wnulA8lbE2G17ggy9o5XGY5XnyHrZDGB9JBZDFcMyGtUsjV9GP AYabSaM1Ehpxn3s9xDngmVe22CQRDb8uCjgDsjO6ZJKIPWJ+N7xtYV5IdwmM/1GL5gR3JHSG 1Ll4nc6w3OqLMIusyIBcKXTiAgbEl4c7d8igxk6WGCd4EMxn/Y29YAbpIXAWJV3lkL/hzO6j JKpfSZSUrXuxlxpqlJRBtTm5rCbr4SxKylaLY6+X+rCFmdw3j09IfcBtHGVAJatxI44yQWIm K4o1eLfYUV4EHXDVjMS+u9/Bp+zgsr8LZwTJ4AbYnqV29D8HgITTmXKiuzdKoiPiFBX+A2L5 6cvdj5S7PGyr47ZjNNGdN0/C7IoxJLyuh9uioHyhQ21OhGfgtDd181IRnuEcENmIyxCUsqAy Byzv7F6mQwMunQ6Ng2VYujhRtgdaJlPFubLn6vRklW24jEE1mbvMnBGacwcIFzIkJkSPmJ+1 6J7rDaWlkd/vnoBSkVCjWgASaq903Sih1Hz1lGVz08jDA1m+IZ+50GHLihauk0oOEKNNXW9t qeEyiIf9joqsEBkvNe9Ke6XyMeWMUQov8rJPbIJ3NhPBHtqgfVThKqHtAlKllC4luG2y/NOC YPnm1v2vrs/HotqBArYjMjfDN17Kg29a5mb55hK7um/mW4O61jOsKAUbSuwcGVPS8Nrsdj6G DW0MS+WNS1niRxjx+q9q/7yDhOMGpbvcuiAD8S90ACmzA5VuoNkMh8Wh2ntViVJuJlB8vsIa FSlQbIhCZlPtxOG8v+fy3xHC9QTtVLk0d4Nc2sQuuSSsanYeFjf1qLBqWVcbu1L+M/C2R7pn z0AwGG9fGdoS052S5tcd5gBUpSHC7Gl1W1G5G4ka0SPd26cimFy22Qz3SbEExC/tE5u46ME+ f5XGYXqncQKUmpVjtK+FvZRssKG7W/KwUM/+NdYfJN0TYrlpNmn5UGyq6CTSpU5HFOSn5pmv qSqpmzEA8TpD5wuqMr0t+jH/9kbcOuXY6UtIUakoVkVsF1kQBF0LTALmMkQR+IcRNrFHD4Gw 7ZABsTO7D5BRtA0k5k3RZOI0Y6ihBsipUz5E15YZzgLkdHnh2Sv+fgfdvyf+lgvPOz/f+Ps6 LSXHTgfXtHZElFQucTFODbxfCRnYkDntiHPI0hrS5BLz0w4ga8qfwt0hi1nJBKFpcaNIoDl1 Am0j5L4lopauk7ejTMBlbGkNDjUZyHAxVZXymI+OvVLhHJLPw4CGLOl28oXgq8hQybLOnxvR lvnzVFfGlZbouvm84HsUygf3wbD59uZ/vSpRKL4AGQI9t+fHJ+fGRqxDP/weehudtkiXb8zV nAuyul+pR3fMI+rGU40KR7JraYo8D/JciO6vR08D7n0mkGNN8aSepLoM5q7x7poakFCxRqXJ EPOvqVFA1BEUZDxIyM3ZvVYA505tv81IfjCPsjCN0T9lNjJTmRxwDr1MduXh/eYJWnxjcmHu lczdr88l5Oh2juMVoI8v1THmODahxxyVC0oRWpBj5BvPAjmkCp30k/hXtgfObGMfiJ2o0GkK tF0kmxSFwBnyN5zZhoKRv57RMBZG2RByvEjqpk4bALlWPZy3MJdtENeQnRG55/M9eo7FHzXM sb37xTYl0aE0AZ1rOZiB1MELOCtPdZCY+r67wnu11fT8GmL+2urkjt0+bcMyX0W1Ju4dLPPh mOm3M4f8lkQyem4i9Pn3aPnBAGr0Ql3Q6U40vJrS26HtyaCixZqiLebVt5WETBtWj9jEWXQc oaIT2f5AWS0qhjpobLhjay19dzzjDa2R9CXm7MzYn4stZrCVcQmX5VL148MiY8HGIROJ6p1i TdZDxBTUzC+HbDOd2TQOyPSxruivwI5TRV8PYcftkCk4s40VZgnKAr2HHGeHWZdDdFrYIX9D zuZ/NhQMH9mOw4n0agjGUks7nvT7t8xw1o4ny/u35FsJx3xquGA1y7FHI3BBVwDl2vMppgu7 LV69gJZ+suKu8V7LHesCoCHmb7nRmn2WubdvYJgpwpgN+OOrynWx045OtZaNLHDNrXM7nz3c UOOTFYrHqzyGYC+uVnGUZkmPmPB5QdNRx8ipLh5GDQRNhojO2lOsS5WTctd4r6CZjjtDzF/Q CMJXu33boZsY6SEk8fHCxtm/VlKHYz3YOry3HLYmj9NS3dsiLUUsJDinpl74TfEuz1ZYY73q reHLvBFpsAaIwnRpZoIEiWynBiyHpgZMQza3crYwY7KarHew2JJCoLrpNAVnyBSc2caAK3iv KCATx1Ceh2h2d4b8DWe2oUD3gMSapkAsM0NyIjTkM/I3nNmGQt+JgNe9PJtxE+xEQIma+WT3 HoIBM5x3Ik6DKO5APTycvUjbBOxgW109+AaxTdC8h8dLSK1cb3QaqLysWThrT4mtMSvOGlAr n/eW1JyIqpdTXQOm6xcnjVxPaSofkU6oWkCpI0QPIVN2yBIgZyPUyyZfaqhL1uGhuXMFK/oN nAkPr73UoFWvhWQa5qo0oysH/gWAsUc/sX4KKnexqBNyDl+bunePbi8boc+koPsMvuYMOdW9 vYn54GsuLOBVjj9Vx0cMXUCCTq2ySCFby9txTSNPZR9/Dm/Y/93ncGeZfo0hdwbn5O8o526Y eqO5Qbx34nfecAZNyaPVus++OWJer1rQU7iK1gO58bU+/OAIOXLHyl0DBqxNJAPyYRhLmB7C jVIlSw7Z3MjZAc02DohuiyyUokBtYeorlDB3hvwNZzaNORYbujBpkozBciwUr9N7WpYU+t0u 2rqGgmQ6GPC83dtg6T5gPNri0r+QjU5fvrjVbVXQRr/O6VijC4kLEi94bL8Vr0/IqaMLiC7h SiNPsrxjGm9F6+qIBnh69GZVzt74kAc2utCL+SsTVWupWQirvbS7F+pLnl7Iwlte6N122XhI i/ccXzkScFJdnxPlPXZOaOK1+pl57nmdmPJsPmpt3n32qBq1nsVSl6BiAlFM8Yv5AwXFCwhO WdMbVD0EorBDVlBn9qSCImJ2armJHOpaLn69o4cx9fBpVkG/rVF/4hml5Yjz14gEoVoQ4ldK EKnwNt4tukPdsyjApTshmdw3NQcpyBaz83eJGRnql2MHSMU8dqWOiyngazLuPS7M7XbGGiS6 ea1HzG+3Bl08A0lTKRc/kmA6iThfqjrxYJDQYWqAxpD9NgB1pWv+QIbYiBnqCxELDfQIVWxS K51k5CF0gcoXCN0wZLVyZvOYIi5zE5z/g/D1QzetOCp0Q9ncDd30cD50G312MWtubnS3IP80 gSyib57aFk+Yqbt3e9Huzv08hm3DOzCPf5PRrYxLrbKsLpa7eh0XCxsQ6fvmY0b30MIaxhEu Tp7Co1rgA+ctHvXd4ozCWTzqEvNTOFwsNU5Y3z7C7b4P1jAOeX4SfvXqMOEhQJ98VkhDFnZn No1HQZ+UZwP6tHirKBUPeFzh18NZn0Lg1TdKVaDP9Ih/EjIPjuZL1TqBqP4B1Wx+baiaSsgP X3TBzxok5GH5l7Rifjo0n3XTJlwpAz97hE7aSxpKfAyecWOND/VBdqTFq683fpphbe7I4QRb 3/uakGCFZuhnfrI7qfwGf8cLnheo86Kf1TwNCS86Yon1aJWzABib1a8O+CEbfn/Iq8M/5scH i25i8PCUfnkCTur4hudL6q2cbLtQuR/VjtTPBI20LVtmLXh0oOTW9EARUyhXTPzpNevqDl13 JrqBpqXJboefASzCRM61TC8Q41eyojxZi3j5Al8/ytCMfxVoS9I47G1SARrqxOjVRpgmYzNE TTNwwWin27x/xYIqaWWEQr/zYR8HXESj3DabxysRu/R7cGSglT7Xwz3mEz+TN03ul/8DRhL3 egplbmRzdHJlYW0KZW5kb2JqCjE4IDAgb2JqCjQ2MTEKZW5kb2JqCjE2IDAgb2JqCjw8IC9U eXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyAxOSAwIFIgL0NvbnRlbnRzIDE3 IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKMTkgMCBvYmoKPDwgL1By b2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9u dCA8PCAvVFQxIDggMCBSCi9UVDIgOSAwIFIgPj4gPj4KZW5kb2JqCjMgMCBvYmoKPDwgL1R5 cGUgL1BhZ2VzIC9NZWRpYUJveCBbMCAwIDYxMiA3OTJdIC9Db3VudCAzIC9LaWRzIFsgMiAw IFIgMTIgMCBSIDE2IDAgUgpdID4+CmVuZG9iagoyMCAwIG9iago8PCAvVHlwZSAvQ2F0YWxv ZyAvUGFnZXMgMyAwIFIgPj4KZW5kb2JqCjggMCBvYmoKPDwgL1R5cGUgL0ZvbnQgL1N1YnR5 cGUgL1RydWVUeXBlIC9CYXNlRm9udCAvV0lGRExEK0NvdXJpZXJOZXdQU01UIC9Gb250RGVz Y3JpcHRvcgoyMSAwIFIgL0VuY29kaW5nIC9NYWNSb21hbkVuY29kaW5nIC9GaXJzdENoYXIg MzIgL0xhc3RDaGFyIDIxMyAvV2lkdGhzIFsgNjAwCjAgNjAwIDAgMCAwIDAgMCA2MDAgNjAw IDAgMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDAKNjAw IDYwMCAwIDYwMCAwIDAgMCAwIDAgNjAwIDYwMCA2MDAgMCA2MDAgNjAwIDAgNjAwIDYwMCAw IDAgNjAwIDYwMCAwIDYwMAo2MDAgMCA2MDAgNjAwIDYwMCA2MDAgMCA2MDAgNjAwIDAgMCA2 MDAgMCA2MDAgMCAwIDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAKNjAwIDYwMCA2MDAgNjAw IDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2 MDAgNjAwCjYwMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAKMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMAowIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCA2MDAgXSA+PgplbmRvYmoKMjEgMCBvYmoK PDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9Gb250TmFtZSAvV0lGRExEK0NvdXJpZXJOZXdQ U01UIC9GbGFncyAzMyAvRm9udEJCb3gKWy0xMjIgLTY4MCA2MjIgMTAyMV0gL0l0YWxpY0Fu Z2xlIDAgL0FzY2VudCA4MzMgL0Rlc2NlbnQgLTMwMCAvQ2FwSGVpZ2h0IDU3MQovU3RlbVYg MCAvWEhlaWdodCA0MjMgL0F2Z1dpZHRoIDYwMCAvTWF4V2lkdGggNjAwIC9Gb250RmlsZTIg MjIgMCBSID4+CmVuZG9iagoyMiAwIG9iago8PCAvTGVuZ3RoIDIzIDAgUiAvTGVuZ3RoMSAz MzYxNiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHUvXlgVEW2B1xV9/benb69 73u6k05n3wiQkAshQUEEFIQAgQDiCkIEd0fiioIKijoqKswoboiGBDAEFZzRcR9ccBl1HujD XdweMs5Iur9f3e5mm/G97/vzS1N73XvrVp069TunTl2WXnjRfGIk3UQg8ryFcxYT5c+rJYRe N+/ipeFs2mgkRHPzWYvPXphN2+4mRLXg7AWXnZVN+yVCzrrwnPlzzsymyWGE9ecgI5umtQgL z1m49NJs2iPi/uKCRfNy5b6bkX/dwjmX5p5PPkY6fMGchfOz9a8tRli8eNGSpdn0NdchfGjx hfNz9ek0QvSbl1y0aCFFwZIzF86jpACPQGIkjZKTybVERRiRSAWZQoiwTjWViEjzchUhJbuf v3W2ufFnrQ6vjb8H45OUdr1oeOuBjOZfq8VftSlk65T6vAKuUz82eA8h4hsZTeZt8dcjJbyU /40cIJMzu4RdvVNq5H4Ew5Sgr6CwuhvJPoNJCXt1Nc0jK4RdZDHcU3C74UQyG/6yXI5AQog1 w/HcVXAiWS/sID1wu+DehOM5A8gZQM4AcgaQ0yz0Eyo8LWzrLQyhBVv6PIXV34/0Cn0kA8eE 24SVJIJ7z8qFs3PhKoQlyF+dC28RVvYOD5lH6pCm5Hv4GTiGd7uvd8yE6u1KZEijElmbz1nb h5zQSI9wH1p1H1p1H1p1H1r1PXyKu69F/lrkr0X+WiV/LaHKrSLJ3K1ykft6zc5cDiIj9UK7 cAapxi2m5cKpwhm91aGdIzuFKbj1U4q/XpiM+CrFn634ExR/mVK6TIkvUuKLlHizEm/Oxfm1 FUo864eUuJn7wmnC6SSJp08SxirhRKGVxJGegDQPTxVOVsLxwhglPAX5buSPE1qJFeFYoU1J n4z0aKRPQpqHY4S23tGhypGLkZ6NMkbMAs8fjZaMxmCORifxnFVw6+H2Kjmz4S+D2w0nKDWp MBq/FvxGCiNxhYx7yCiRiSDI+DXjN0IYgZImvE0TfFloxPuG4FfANcNNgJsNtwvuTTiN0Ag/ LNSRSjgZbiJcJ5wK9ynFdaVoVymeUCqUkULcK8JuJnaE4VwYYitJEOkgW9kbDMkjdWwLmQjX CbcYrptt6VVZzSPtqMfrVsBNgJsNtwxuHdxTcFrSDB8lsoE1s2ZhApsgiKDuZF9jY7US1tRn Q38gGxq91eaRFwpJdFOSrIMT0OQkmpzEq+ZTIcQYSKeI7ITbDbcXjnd4ETqjCJ1RhBcswvVF Si21Uu97pDJwAlkEfxncsXV41xThlYvwrKN34bnFyCnGPYtxTTHuV4xu3AufKlfw8olwq+B2 wvGyKMpWKX4z/AlwDPeI4g14zAw/JER7mc7cj/6lw8wjh6DfJ8ChkN2C3rwF/XYLpxD0Hmgb Jc25GqsQPgWnErbjl8SvCL9i/KL4RfAL4xfCL4jRW43fKvxuxe8W/G7GbyVGw/5UameKza5b VLesblXdurqn6nbWaXawOfh1sk5ZT5xO8ESrResdKTGRzCQm+i/F36T4Fyq+rPgu2TvTtH+m 6eWZpntmmu6caZo203TqTFPbTFPFTFM/nSu7UqaPUqbVKdMZKVN9ylSXMtWkTMmUaaSFttOp xESeU/xRil+t+FHFD9CpvSaie4bOIBEtKJ4WbYlcHfos0i/S3tC1kX4tgmuyqRnZYDjP3Baq jJwdKs3mJLJBYeRZEXcgU+gTRENTcqnmFc1sjawZqinXlGmKNUWamCaksWutWklboDVq9Vqt Vq0VtUxLtPb+zD4ZywkldjVWTUrUfC0kohKXGI/Dg08Y1TIylvTYhHFs3Omj6LieXfPIuLnh nkOnx/qpftL0HlVsFO2xjiPjJo9y9wxJjevXZE7raUiN69FNnDFtM6W3tiPVw27sp2TytH6a 4VnX+3qsLdO2E0pLr7/Flwvb2/k10zaL9JZb2onz4mZ3s3WEZWjb6P/gdSqZnaNTR//cR6Op FG9JoOeucadP63k80N5TzSOZQPs49PPp4ZnTtrMGVt86ejsbwoP2adv13ayh9TSer+8ejYbk 65Ew8kdvJxEeKPVImNcj4RPqBdkQXi/Og2y9oFIveFy9zU2R1tGbI/CydZqUOk3H1zn7+Dpn K3XOztURlPYrt8jfR7OPRJQ6Ec0+pe3H1glmn/W/1on/xzrHdOf8Ucck/i1Kt5Ox9L3NLZe3 zo+1dsZa58N19qy8+Bx3T/fccHg7aaHv8aJwj5DonDvvHB7Omd9P34vNH93TEhsd3jxWufT4 8p7LefHY2OjN5PLWydM2Xy7PH907Vh7bGpszur1vzJySTcc97qb84zaXzPn3h/XM4Tcr4c8a o1x3wrM28eIx/Fmb+LM28WeNkccoz1KoHmSpJaPaW2Zmwz5m0IOAO32R9lFOafEIhZqHR9xX +QZEQh8lhlR7jzE2qscExwm9bGTZSF6EWcaLCpBtzhW5rxoe8Q3QR3NFErItsVHE3XruaPxb siQXySb/T3/JkiVLZy2ZhWDJUuXfkqUXIeRjRpYQIFe8wUijsr6FwI05b14Jd7PCo4UlS9qX EmV8l1xE+NOXcu/IQ4/GLsLN6ZJjKYHwRx73h1KaIlmH2y25iKINvBkXZa+jSygKcRtcujSX B54jfgF3O/EhDApzsWKTzN6c+zR9VbY8PZjJsPdReXLOIVBik8mdyMOPjs+G5Eyyhywkt5Hf I6+G/pU8RmRiRtkeIlACxN5I1pBLyLtkSuZH5EbIg+R7UkqGknMyaWIhy0ia/o48SBnvKdJA 3iHzyWrWKKTEb8AcS2ilsJFeQ8pwl8nkLuIiu3HHkowe6T4WYI24ajJ5TZitLc1UZn6iu8RX MnPJH2kje098krxODtCoSNLXZlZm1mbug6hwUAgM/jlTlVmIq6aQTnIRuRIt6CYPkDdoO2ti OzM3oU3T0IZl5GnyGk2BoDqB6E5D7evI3WQ7eY7sJh+QzyilZlpMu+k7dI+KDL6QfiFzcmZu ZhFpJaeSiaQbpQEapyPZdGG6sEl4f/C/0/syQdx7MrmYXEquIKvIarKRvE/+Rj6iAtOzyWyK sIn4SBOZTuaiN9egTY+RV8heqqW1dBiV6Q30CXaxKAy+gBVeJA704Em425mouxZ9uoE8RV4g b5K3cM8f0acC9WDwp9CZ9Hf0enorvYNuoE/QJ+k3TMU+EAThavEv4jfp9zL6zL2Zx/BcH/GT MLBuKcbgFIznG+RrvF8JLaXN9G2WYqUCFY2D6XRNZkxmWebFzPskRopQtwm4tpWMJ1PR6ssg f+0gf8G1b5C/ks/JP9BLAtVTK/oiTGP0NHo6vQit2ES/p4PMifFrYAtYL9sjpIQ3xKnik4Nb 0o50b/r7dCazMdOT+XPmdWV86/GcFoxAB1mMKcZHbCue8yLZT74iP+MZahpCW0+i4/C+d+P+ e+lhkJOWXcWeYBmg39XCK6JHvDt9anph+u50X6Y2Mx60JQB0eUgtfsNATVNIO+59DXrzQfI4 RqYP1PMe+Y66aZBW0pPpGXQa7aTn0EV0Me2iV9Ar0auP0S10B32PfkS/YyJTMwf6KcXmsWvY GraFvcDeY/sFIpwOGaZLuEJYI2wR3hS+FCWxVKwUx4ud4mXi5SpAMrVT+/ph1+GFg3MH7x38 c7o8PTp9fnpl+vn0e+lPM4bMzsxnRE0q0cZ2cjba+Du8/w3kVrIO9PE42vgJ+YJ8gzH/CX0h UB31osUhZdxa0O7xaPlUQKaz8DuHnof+76YbaS99hu6iz9NX6Gv0bfox/Z5RtL4cv+GYBVPY WXiHe9lG1sP+ht/P7J9CAqi/WqiBVNGJt1ku3Ij3+b3wsfCZyESHWCWeLi4TX1IJqjNVd6nW ql5Qvaz6Wi2pZ4BCs78s/1B84XX2vDhCWEDWQzoQhK/Z26yR/o79Sh9hAfo8nhYQJgoTWQsb Dmy0A1S+kNg1a9URdYTZiaTp5Ddh97AyYaqYEIxkKeYbYdPZDayTPEyfIb+yk0BpFwtvsPVs trBWvF0cQd+HfPE8VAEmeoiMhK5gBMbuHdKFESoTnhL/yu+o0gqHVQuZKbNc/ELFhLfBB5so E16l0+kBOpE50VvD2a0khrREDyA8GTPwb6D87YCdDeI+4WY2ln2EvAVkDX0e77iDLGA76B8x Lg2YjxfSifQ+oYpcRbvQI0PJeewOEmWLWRT0PIX8D72GOjBzf8XYFLKziCiY2Dyyh7Vj1N+k VlZOrwKdLiQr6QpSSgfpLvI6u43U0/nCc4c9g8WMHj5ANwsnkc30V/EV8RWA71/RkwFQrpbK oJAHwSOmYGZGhASopoGoGOQ4zKdOzHUL+5leyRaQc+ndwld0AxtJJpD5whLWRu9K/yyOFGrQ YwPgJi3qoVqialQFxFqM+BdkBKjxbGhIzhH3qq7hceEd4WCmPRNJz1YVpD8ml6N3TgJ3W4m5 dBL5kDrpLDpJzLBxYiZzBtnInhI/zriokUbIWxnMsPRW2kgLM2HalTHQSaDwWVz3Iq4Urxcv Eq/E+vQruOYN5HZyL/kTVpOHsG4VoR9PQW/OBO85F2tEJTQGdXi7EWQUuNLJKJtIzgA/7QSX PItcQLrAee8nT5DNWKHGoT9m4bqzyHnIX4IV6gpyFeb/cnIzeMBd5GHyFnucrYOMeyN7kV3M ziUfkg+FlwSZnkH2iDeJy8jpkIEnURuePASjFMJ1N2fewdOSxAfuX4tZCsrPfJN5L/Po4G7c 72G0/Xb1KPKNuoUUkwn0kOilKnnkZLl5RFPj8GFDG4bU1dZUV1VWlJeVpkqSxUWJeGEsGgmH ggG/z+txu5wOu81qkcwFJqNBr9Nq1CpRYJSUtsbaOsM9ic4eMRE76aQyno7NQcacYzI6e8LI aju+Tk+YXzcHRcfVlFHzrBNqytma8pGaVAo3ksay0nBrLNzzxuhYuJ9OnzQN8VtGx9rDPQeU +HglvlqJmxCPRHBBuNV9zuhwD+0Mt/a0XXzOitbO0WWldLNB3xJrma8vKyWb9QZEDYj1uGKL N1PXCKpEmKt12GZGtCa8Yo83Nrq1xxPDpbiNEG+dc2bPxEnTWkf7IpH2stIe2jIvNreHcBSY UqqQFuUxPeqWHo3ymPC5PXgbsjK8uXTXipv7JTK3M2U8M3bmnJnTeoQ5uEdrjyWF547ucV2+ 3300iZsDby4/ttQnrGh1nxvmlVesWB7uWT9p2jHX+iL8Du3tuAeuZfG2zhVtePTNGKlxXFLq Yde3T+uh1+ORwMxx5a2y75dF9PHO88I9utio2DkrzuvE0HhX9JDTLov0er3y9sw+4m0Nr5g8 LRbpafbF2ueM9m+2kxWnXdbnkcOe40vKSjdLlmzHbi4w5yJG07GR+ej0bJkSU6rz2LjTjvQs 5W2Mndwjg6LmhdGSaTG8UwP35jeQFfMaMAD4a6e4qudMjMi5PbqWzhXSMJ6PV6Q9qrgUC6/4 mYACYge+PT5nTi5HHZd+JryQ08kRUuuhc/LxnlSqp6SEk4imBWOKNo5Q0nVlpRf3s3Nji6Uw AghEZCL6dk77sAp0fyTCB3hlv0zmItHTPWlaNh0mc329RK6A3MA6ecmufIljCi/pzpccubwz BkreAhBBiKNHmzjyzyw5ba3nDOuhzv+leH62fNzpsXGTpk8Lt67ozFHtuMnHpbLlvEPRbyjL xXpsLdMEH0MejzGfoJSCKGdOP1IFiWnGHjGOf2qFqM/s12hBlUoODbf1SJ0nZf12fSSSmzP/ 10X9mR/4VUpw9LLca/QMS+Uamm12z/Dj0sc1z7hCGDcZLIeNmzx9xQr9cWVtYGYrVrTFwm0r OlfM6c90z42FpdiK7QAgiRWLW8GGsiPanxlY6etpu7kdr3IOHQa6ZWTU5hi9cdJmmd54+vRp 26FpCd84eVovoE1L56j29jLxDXI2HLT5VC++wToQIg8Y/w0ygPANhJ/DfQa3H24j3J/h3oN7 AeVWhF8gtME1IG6Bmwq3DG4a3Dq48+H49d1wbrhz4PrgePl2uFVwp8PF4SaiDU24VyPiq+F4 +/gzr4Lj178P9zu4KXDPwm2B2wm3A84BtwDuNjh+Ha/Pr90NdzvcDLjhcLyd8+HuhDuAZ8VB sBDK4BPsBqnpxQjDZJuSw9VR+T8uYfA/FZCnBvpYHdETA64wQYYyI1+CJANNH6+S+7NBE+xA 3AkZjUD37VHyvZArCCSLAHxohvGsCGJRyA78rxCOt4j/JbCaF2PtLCEpyCBlpBx7OJWkCit6 DZBPHanHKtuA9X4YGY7VtglrfHP2wv+f+bLS3iF4m5XkUzqUnkuvBRbNQPu6QbxYNR6o+R7N Vu3zuq16g6HMmDJ+Y3quoNs8IJ0hPWeN2CbYDY6U4x/OJa6T3IPeS7zbvYd8B/1/DlweLA6+ FLooPD4yOfJ8VI59Vdgc7038uei24kXJ9pJo6vLSYOm+shcr7q5qqT6vRl0zFHIVsJt4tgrb ZBjhts1qTT81bgGcUIk8IhC9WoXINkFgXp2G522jxKOdcIU7dap0sHH8YOOp0qHG8dIgNhMa Bxu5q6qssUQs8YglcrZIDoeFXYdlFfmVhMVdwPF69ojwvPg2aMlCOjcXqPrZDbKe6nV8t03/ vm6APUQM7DnZGLbstOy27LV8b1FZBqiTMPZcnxb4vZ89tLVSuwi61WfYPaC8H+lE4k5JhzoO HpAGD3UcOHgA7WiUGtG2qkoaEdTqWDRRdDSCZ7Wpwx5PWE3PVqJub1glvp32JkKhBP08GxLK OtKHIRF8AbqdKBcljSUSU7kKbHqrU61WSS6nzTHCphqv09nWF4B6JXSjx//qAFURN/Vcz3um Y/zgwUbpgLQfzWlutFiHDqXcQ5s6aK3VOqS+pho4TgNh0W7liA7NLEqwBOtofLzIWGD1aC6Y NesCjcdaYIw/KtOfllBGT4sZ3Ba98dV0/0Mb0v2vGPUWjyFKx6ah2y1LH2bLcq1N6pjO62Ee r8hbrLOqXU5JpUZr9Xo0Gu01YwIy4g08NEDH59t7iLd3PxqsNPe41toZ0/BOrKsdUm+tq2VF iKH1LqfVyZb9x9b+uCSdSW+KGj1o7Sv0pIc20JNeRWvdhmh6G29tKr2HvUXLwU1qZPefyNtk H/kBjGabSP+HPU/eNkOZzjTP0LvBbBbSQHZ49w/uJxUHlO6L0FxzILpa0u/7Ep6YQMsHP6iO efTYuKZkgGlEG1sGivbKRrIL76piHnHeRk6y+6XPScV4fiNHpE60HX6ELbv0UrTpjcynUFP9 CM7mBz32ag3iBwZPwcLtNIjnYzzHo2dwVVwZNnVM6Y96NqWwYeKkIdz7cULDsFO5w/M/z0wV vlYtBFkslIfpdE7q0QngWbo2erJuhu583cX0Ut1N2pt0d9F7dBvoY7ptZBt9ib6ie49+Tr/S HaK/6FwGHTX005e3CoYRZIaun/aiUTO0z1YIVHjf0k93bH4GRH+wYxD0nuuXro4OaECy40Tr s+Ql7BucafFZPHr2oMFeYPGoCv81Le4xGx2qR10FHrMBZPAZ3vtLFdeAVNBNfVamjw1kfiJC 5mBvmTY5Uod4ceYgKcr8gzjhHJl/bPMX6Aq0BWwg8wuRMj/1BgrK+BUlmZ/kWFLlLwgVRK0L tUG/lZTTIpUpGiuINFlLm1RWlcrkbcL8fX1bVWFTgafyDwNUDfIrVabL+APSIfRwM2bMAVAf poqFe5gvLZfJ01m5lHB7XB6nx+Gxe1Rqvy/gC/pCPlFdlChOJBMlCVFtMOqNOqPWqDGq1EIi aimUSdjmlWlKHZexNlbINGaOyNTngZcwlsqknMHjClJoS/FXgr/U1aQh90fzESUEjJIdlqDN 02wPWlzNFu45g0Frc7Q/86ssI1Jk91vg+SR4HjM8V0FzjHtFdqcJMXiCHfWEoNXQXKaH5+Sx gN0T4Tf5VnYhYra7QvyqUDPTS5YRLu5lW6c08YjHm91OHZIyL4sSCUzJOklhKS6n0+XU1CKn KBGLMofDjrTLWVNtrRO+vHr+vWOvLQ+0ml2IjbumPDhack5uKfEUDx1zy/qWlLt46Ek3r2cf vZn+8YErh9dFbm86Y8mbVOLx6O2NZyy75I2mmCeW3rdr+yV/bYp6CmlkF59t+7F0fCn+Ak65 udeq9fVnfpHNFjXR6nyyb6J1ok/UmQfYY8RI18o6yWg0S8/ptIznqJBjpSoVo89pc2Ktxuqz D0DfbGFnP01UOq3Rw+w72NVYK1zsr9hYPNtioWcTiUrPssWAE3+AmlmhIPD/A43S4AFJYf/N Bw6A2bqGEmmwyTq0wk2lnw++cFyiqpJ08IGllghnw+pYhPO3+pqIRZVndUPYahoOer3BwQXc p+H0d3ad2aPXesRffp3pslndbqvNJVaeofZYzCYtX782oifex1xK0fBmNWuZPO1pnyGlEu2E 9NMZW/VGe1NUBS7SPMgbV1WJ3Thn5r/kUl9h7UnmywtuKLqh+Ibkw8UPJ3cYt5ToTFa9s87Y UCImYyXBlL0oWBwz2g2cUkxfWw84/2UddIrF2nxPfvx0riNVz9L9YKwGagJTm7FFp9Mbvf30 n1uUZ++gMwDfGPK1n1ia4iNNbBEglgu5QdQ3sIVQKt2Wn5XSISyph8Bg+KJw4EAz+ne/dIDm +pTwPlVmpz9UaHU74+GEI+KWiS1mkakrZJeptRBebnZdfXW2v9HlpIt2pdqHRJRFxOkAFy4c MoLV1YJc1Rr8spw1y7/Uag3RDLLr3ejtw3so+alrcujJKy543KPWGSWL69ztc+7/NDHj4vQH A5MjfJAuuvLz7xadM6F4wcNXdbg1epdU+dCsD1cMm7NkafrjP3Ba/XPmUxEdRTDwfQsaKOkH 16qprq6zDCs8uXBsvKXhQqJeFrmh4U5xTd1dDRvqHm7YbhtwvWZ7zf6G6yPb313f2v7lylRY +HVb7VEMnKUfI+hHJKk1G1LFFqECDXETVcxPPMFwcaLUg6HvC4etpf30lr5EU00Bwq3WJnWs qb6fmmS9o0nw+4cK3mEVAxgCP7v6aYNnaI1Kbfp2gHZniRtskfIVaP/+U6XPQc/jJY5y+GgM 7kfyAPgkZ5cKyYOwLFmm6a+tK4zb7KIqXhuTqU3lkGlhXUKmdtEK7KmMy9X4wwg1dHQ1kIYu 6szCEM5Nsgt8TXU9xgUDo2S4lJQySvk5kl0MBdvSy3/uX/BludklSfa1m25/cc62jqDX4zmp a829V069vVSyGCzuqZfdu+71uWxj7da5v/9iZqVkldzmJU8vHrf6dD6X6IoZs1Y31tp1Lqm4 acrO6ybfhbXpPT6fgGoCkBbekk1Yz8MsGFEFQn4nuvXzbYHAc06zw9pPO2VrQcFzjnAkcjYT gFcEFglBETXjaUEQVZGgKYh4L0SWfob1KuDn08BJzMhzOoR+dq1spqqCswOBEDEHKaZCcIBd QCJ0hmzAHKKeqCg6jFit3sZwFF6fyg1H13jAza5GYM3BRqA8qRH4s1H6DhAK6JMD0MFGy1DV 8vLU76QX3IRPnJ/3NOZDc1VlF43U0RpLHk/kIzlGVGOxxKggDL5D33mqLeT1htoUP/0yj99f mp5KZ88Rig6/zvsu/XOeG9HZbO9gBHT+Aqdz9Fwp+S85avDp/FFd0jPMrSpLnpKcnbwgeXfy Fc9H7m/cWg8nYicnYhsivnBMa5fChc6Ql4YCEfIsOirO+Qh6Y7+sCzSJop4k4rZ++t+yztWk 9zZJGqoZYNeTJFuwFTXPjhf2078/LXnK4qI+T8JH+2z8QYgH0oHBjiz5clhccQBcm5OwAo85 HStMxe32q3R+FdZvtw6eTx2QqUfrOkq5mMKpVEcXteSgDkiSr3nHUW4smmUneSZPl429semB d3/YcskFp8oJt2Sx/b53za6Hu6+9NmwCmB3LWYh4e3p+KPRfW1/+pS4+JOK0eqy3vPLIrZta JbeTlXE+BPZpRe96wUVipJI+LhvLo/bC2mgwFYwEEwOZQ1BRfyoX1InDtS3iOO0UcbpWHUcH 96F/w7kQCz7SsdrC/sweWc+5B64u1Jr6ceUyURS1dtGuTYgJbYltmG2cbYbtPNtlthtt1xfu sG0t/NDwofUbk81AVVpNWJ3wmAvD8cj88LzIZZHLipdULK7si+4oec/4qf5zo3W6FqBHsljD NnvIEXQGXB7JbYqSQpMxbkjoaWUFKy/FKpLUpEpULnWBqbAKc2TD1rImQdD5+ul/yc5Qk11V 1KQzuT9RN5ESqSRcUlkiljzL3oBEXkgLiZE9/HS0qbKAFniqdtAGenWWZykSEF87BjsA3LHm HQCsqziwn48yX/2yKyCwnT9eGo6INslsMVvNgtpoMpiYulQskWnYFu2nT8gOktADy8ULi7XI TKnKZBoxh3iJgcZNRTJJauDlgJzUqCA5zte6lAWeQ6bc0pPKo2LOvTilYNnhYkxO9opFicMO +JRlepx06IJTN8y/4c3nHln4bH1Lc+X6d6+c3OB2WkzWZNOf0zs9iQcXLV63fv6c6Y3MtuSC vQ/d9c8bVm56+4Ebz103P2r2WF16e3rzF5G3tt331M3XPnH6EHCvL4C1v1CwdpxU0eXyaOsj 0VfJd+Q7o+gVA45U2dTUfKYyFIhuX4HdvcJ9B71Xe69hTdG61H1lj9EHi7aynfoB40DqDf2r KdtldEOEVdnLgAh6/bFgf+bvvZWx8oHM3wHSf9li0RYXg7r+3ltSHB3IfEvima97i6IRDh+s qWJZG2tKJtWBJpuqokltgnnR32QpmXRKiSbhE29Ts3OCkzn76QHZUBNukj4pbdJ5qk+A6xja g1za5lP4c2WA+fgqc7eyrMoXsjhEbdAalonfjvlbrgHWrlRh+QlZMJN9Dnhl2gqZVAGYHwXh fEH6dwROOmhHF+kCBt9OUpkv+4Ci8SJf9gFc81CuBLZWuZFSuRGjPEZ5TOW2G5sdblR38DwH z3PwvOMgdfuRdQ+8Y0iehYAqNOohCigBhAZN2I6JC7Zzz9+3fv2+88+bWTLs3bt+v2dY0vSH i5b+Yd3Fl6xzPdHd/cSmZcs2sZU1j3Te+eGHd85+pLZu6KS5K3bvXjF34rCvFqy977y5a9ak NYseeuiCCx99FPzEBn7iAl3ESQ2dKJdptGKJJkXKHy8cKFQnOHOJlcIrcMMzFQSra41ReNXO mtKiUgdHMOYZVZ9Z/xn7n5KD5aqdhFZx7sKv6ueD7sT4f02q0U9luEpt31r1QtU7VeIsramQ JAqMRYZiXQmkJsRMCWSYRHNhskmv4nxA1leAEegjTU5TYgBz3cQelvWFTWZvnfcTTVPps+xR Unt0yksHBwFQDo0/cPAz0IMy25uzOBw0cnTCFxWVR2Oiw1RgLGBqC2CATbJLoloVL9GBRooN oJGiRNSBdeQJ2UbLRS6kaZPILIAXkyLI30rK1CCbPN0cnfSkIwWEmeqiR+Y+4ooGKLswQBLi 46qgzGPWClJXCyEKyCY71EPqhZ0j+2ZNfbBz5/oLn6ltGZpYM/OqG6cP9botRldRzbu02l53 /7nn//GPZw1fUhNhf1my9Mznz7t38Nblmz7rvXjiXRXNUcltcRlstOaLkg9eW7Pllpv6ZJgA MtqQKYEdwFzoGNxkmmzZVfBmwQfSvoKvpB8K/ilpXFhWH++rNFNzP/XKOm0vMf+P9LxT7KdO 2WSoLXjb7KTODz1EnVNKkGaKKXiQ81jAjwOIYumEdimPKBTUJkBZkkNrbHK8YcLEIfAmzaTa 9GcOj8UdVgtzJw4Zfip3g6+nK6PWoMNowzY61+uKO2EdVAIxfpucqrcAY/pGlA4pG2M92XtK aVsZRDvnbO/s0ollv5SYU6SkpLScMlaml6Chk52mVaZ1JrbXRE1Ji8kkWQJ6izWW5EUFiURN SSKRLAnESkp1gF/IUqtrmFotsICOlXlsSpbTeYbV6bRZAx6rJernWSeFSKg7tDokvBmioaQv FIIWIOrzektLSoI+r93n81otliArA/4rK4zFsDNKaDBlLg/BnKFc5ykrTXhtCSjGvAMwHSql I2R7ScInm3XNxELNUCbs8/3gE7HolW6rZAlLWcI6QEcQS2ZXn0XfDJi/S5ZQ12yhxDIBWsmM RYQeprSvonWBG+H1XAXZBcbCxaVsdFCRRTkq5DyyQ1GOAhcuVymQcHm5O7X8d0CG2iNC6o8d XRWQU4/J+P+UVK7WAHtyl1WUCTlayINKmoPykTyR5AsEISYIVwx+0PUHjoHSf+H+SLrkFx7S R+i9I5Xslzj4XL/my9AndHn6jTzoFL522WyuX/+UT9PlbN7g/YDusAUiYjtoyA+dfjU9S372 qZKNqb/oXzS8r1etKlmRuj+8Nr4u9WRcfUXhsviS1EVlq/Sr7CsLV8W1U6T50jL9YmmxZbF1 sU0zFgrtkwvHpW4oUFWbh4eHRYbFm0uGp1rNYyStrsIT9kd8cV+JryJmLklpL5OeKXypQmgL nxy/OHxDeEXlneEN4a1hbakWYgMscQNOplWlKA1oK8MFQqy4oDpcFEgmnEUJbTAQrKqudmqZ UxuLm40hY4Wx2TjBONu4CGqlfnqtnCyLE4tkYWbLassuy5uWfZYfLGqLt7aoGIIDVwP/APDt qRl7WZYmOArqyunIOxSBgeu4QA0KDFZgrwJ8uarieAFBWUiDhaVWu95gS6TiJfayMhrXx8po qTUJq3tDooxmhbhUii+aXR20qwsqwI6OuCU/yIqCWRHqjug3bJHqIfVcqItBO1+txBClpIuP L5Puf3HDtZdP3DBn8GaefpEmZ09oGn3HJek++tikS0e0P7Ay/fbk7HBvvfze2RX3zZq8ci7X grD6mP+8IROuP+w86byh8qUj0AnLMnvFU8RN2KvZK19aZqcV2KeZQASV0+E8wzXffqbz3PLF 9iXOxe4tLv0Qf33lWOfY+hmuGXXnuc6pu95/T4W+psoc9kVhnqUtcLqGVIdjQTMkQKshtiVl jQ8xrBSD8dQQQWQpXUFC2xlJJLzDfAlzVaiqoqq5SqzyDF1+zCCMP8BXpsFB3v2KjpHrGbM4 VFEzZmVnrFJgoWRcj+H0cT2F2JPdTvxAVxY74RAqkPl2K7RrfreTa47w185hCSZ9XpPBdfjA D1zxxhUZGjW0bwTQ4YiuH+VF5UJdXa0V6g3hAz5tXDaLi6nOWHrHnDPkxKgiP5W2LNg40eKw OlOnvXHujFknzbqp+vovlr8phobzIfkq5HX7Jo9sT4XKTp3dNm3NM+lvZs12OC2uipkdMd9J G2+buvFKqhzdwQkpsQJzr45aZe/s0CL1MrVgMRSkrNaAIeoP1cViAb+gU4Ov9ZmDzTyUS82e ZvUZDFzY7nWlbLaAt7acdyirStXVBcqLyjj+ZyWpRCJQBgC+QG70MpowxAoT3jpIhbAfNXiZ QRtNmP30e3/Gz/wjYWakoxN163Vv6vbpftCpdHWJRDkpk8pYWT84sDMeLwST1p1mq7B+b/3B Klg99WMXKfr2jsbxBwa5dH2Qc06powsLXFdu9iCtSN1clqTQTkk/d+xpPBLJzSQlP5XKF+xR 6kIE56o/qP1yg2bJc8Ajs8aiDGNdHSZIvk4uh05hN/AxOzyHD0WXMmeEJTxn8GGqyIaYC25W lw4pfDO9hU+N7HRJ7+WXvJEeN5uH6e+4PxuzZB1GaSlGqZb8KM/qVFGzzpiSpIAu4gvWRaMB X02ZuTJUySpTtbWBMrCtes62rB5HymIJeBKlJCklWTIVjwdKo7GEpxZSUoIQD0ZF52E6bW28 LJ4gpVLpxFIB+qcRcmlhYYzQhBRNEF/Yxyb61vveVNY9le80S1iiROqWVks/SKLkqTu0nWqz Wx8KC0PnYyVTxoMrODCPkAQny43Fib2f52fHj84xgwCgkhfLjx8CzJbI/zIG92WVsmlffgzM hqBwP+/4wd8dPwj59UgZAZP+Pw8BxuB8jMEijEEL/ZNstP7B+WRFn3NnhZgFMgZTKodfvGEF l0gBGkhFAoFwJOAtrVaysHNSkaypqKiuCZQ2juJZkrkZKvzmVEtz86iWQGMW5RjUqRzIyUIc gzOZQzipuHIfczEtThUWF8cLA6nhdTyrBVqOhlRtQ0NdbWB4LBqEKgaSWKK0NBVOeOOJVCqL aBqHD9cD7tQEC2uDhS2yP1S7ruWpFraqZW8La+lnO2RfqzUYiViClUzGkR6co3qTMTObzRZB U/YMDBRH82MFfJ/tYAfGGTOFr1spaLQw4fhcww7mAQQc2sDncIbPySPK9Y7jtOvHp44rOi5x fL3/LcUVzaAXRQCsAKPSme3NThleBdjW0wU2JOBxUb+dRv5NkZZbDvOwGFvTJ+acgJKEawff USZ3+mNlntZy2PNPhd5Y2WIoNkP/5Dm12bmMOp7QYlafDh5HcODsNlf6FLoly+XBNZz5ctDc Z4BHX4HmQuR9uaxCLFfFjGFT2B52VPgrgiNUNcZKe6Wj2d8cPFXVYpTtsmOcf0JgQtDBz3w9 JBuM9cpGSkDnCSlpfz3x+0Mk4NEyJQ0+wbdVAlq3laeLHPUWh8NqCbhDCY814XEzltCaEzqd lkNkywTsp3jCN+/N811lK58PNh91zPrf2EM5bkPluIQyWifMbrDT3BZLdsOF3XbC7so+3sHs Du6LI452VpZ/8k7k+vtuzNVp6LcIWSA3YDmr48sZZ5aAdT4sZx/lVq86vnqxhMHHFySzjuq8 4HtBm9UT3XCZ8ppZUPZ5B/gYjBfwmop6VuFWR5hUnofhdUA0XCXudOTfoiZPRLn9I/ouK1d2 KTr5C7z8MvfpZ/mXoadyIknPOrogKC9EIQcScRfep4EVycM+DXweZG1kbMMu2O+/Qz/wvxU4 RA7RQwF9nBQFioKJhjH+qf5Hg9uDe8geuifwNf0yYJoWpEZlkG3rIDmaQ2ZmTtrMZqstYAwp bEUi0YlRFk0motF4IhCqUBiLoRonJ6vr6gMVBlhggKK0NaJWqxIDBp+Dp23r3NTsDrmZO2l3 ux32gK+8mOcXkNRE2LYni1Kp4qJAeX9mpewPUBL2BwJByuyU+8EG2PgEgnZkQYkQkA3BOGwr gkF/IEF5eqzf72sYwgRHwsfKK4rqExUVBoNRtCWM2kRRQ0MgGAwMqQ9Cp7ebhopmFy0qeqpo Z5GqCFYYtUWytc5ctKrozaJ9RT8gr599IjsCITqbslV0N0wkqOj3i4yJgX52mey0hQXRLgYn 2Hbb9tq+t4k2z9A/5dDFeL6IeT3SAbdlaEX2X0cXkh2pVJdb+tyraO95AV/qlDVOQRyNiPNF EAnOChWWyAU6SHLLtZDoVFD2p6DtPzJnTmBrXcdxwN9O/PtlIMILuzqweRajsd9kcTQv1/2H KuyBzvSz0lpOkulXuT+mjvt/hQ380L8q/Cy7w/AahOnQWivfSjhxFg6Wsj2ccI/N57qCc4D1 zwHWNxEPPSxnXjG/6GHWz52fu/8p/dN60HnQo37J+Tfpb9b3nO+7v5K+smq8ktfqcDrd4kvW f5kP2YT7dXcaH2KPqR7TPWR8Vf2qVnstu1l1i7bbeJPtJscdbK1KO0Q9RFujazQOk2qsNc5h bm0JSxkrpLg17qxwD4e1iHmn1GvttfU6epw73QMe7Sbzk9IG6x9tDzoecj7lftyjnWqb5Oxw r5PutK1x3ue+x6NttbU6Wp1j3ad4ppunS6dZtUn3MHO9bYhjqPtU81ip1ao1qPVan9qnTZqL bEUO4HkPFbU2s0kkGldc1FnieqEgzsW+MEzU1sNI7hJ7XOPp87ZcnjMZ4RsdXPetiBd8y5cL aTk5DWPZ0YElbatTD8sBa3/mUB9CCdvnfVZ3M7ZkfpEL7L5mp9sZaHZzT4eTpH2A6Cj6moeq /sx7R9IGK0//qQ8h6imhjYcmSzNUhPty4UG5wCg1O7DbMcIWhEe5GhVGDdh4UELGQ8nRbMyF bq5dNFlsI2gBPGOUx/gye/yfoofD2gtcbWeQcSAhQ+xxWjW1jJsgcBnIKp5z4/c3vZZ+jda9 dtN3N0357tnNv1LNhme/Y22Ppj9Zj3MpBbCVn7Y+/eljb9C29Csff51+n7Zy2uoDh5wBDhkj ZeQH2Q1FuU8DC0KbzxqK++p8rb7tKX2Jtag/850sXeS9zsuKtCXaNd47Q8r5aL5WpnJr5X9e G6uApbNrY6myMsZIMG41FzYXssJCNxbIZBzSjN9bUYaFUvKUHzoqVOblem4ZxJFwBz/xJ5sL ZYxBITAKPIOZo5J2RfVzLGD67YmfhTp8lxzGCdjdOt484YRVR9kuj+fkeIjxPSdiY6xBX276 aEz1uInDzkj/kxo7Hhz3+DXpd+m+9NI8GMmur6/fNOmaeIPXNvn0S0fMe4D3O5cfn0O/l5Eh 9A84lZt5QT41HBmRsrvcI2bUnVV1UZWgSQ2rGls13Tutaml4aemldbfUbSh5vGp34t3QO+G9 iXfLvk9YADKqWkNtkUtLrw+tKL0t9MfQxtKXw69EPk+ZgjtgQKTDacj/NEY1x+GX4UfHKBQu SUXU0bLSWKic1Cc8gDNuVkaCFeW82+GZm8vLte5kLFFSwvFNaIBdTsrYeuwe40WCUk3cTxI0 0U87ti7zr4KI2k+LURalE6Pro29Gf4iKUb5GmS2yRCsgCTHJ0zA2p+HLa3M6uvZ37O/gyAgr AbdaUhYCRcuHqcAHm0NooOQjup0jy8H/MfAN0D1Yc7qH3pAxPADTq0jm4JaUsc4ZAoforQ1D uf91Vv2APft27HJh1mEz/7eWhCz9aKC3yONfliiCEVtOCUSnrOWsP72eLwVZiZYevv/96++b 3n2LzPMW37dxUfrnzy7om/TYZenXmD499njCeel309fVjbjvJ55LXc/VTZ64oGHy3UBq27Em 2LEmjCYfySVNNaf4JtR01FzivMG53HuT7+ah94zSnxxuG8k4STw28tFR77o+d/3s0sB66FCv zV2PHQy5PSUnm4Z73WaVndAhBdWVMaG8luuALAZPorGx1hJvgRaofGVRbTzSAkVQkTaiqIKG xGcHFwVZ0Ntmj8tViVhCHrkouSy5Krku+VRSlfS03j9AQ8fsUu4/APgH9RAsILP6obyCaBDL f05J5MptT/ONS64iwghQzsBP1P1A9YNNhCDjNle5jUVlexH2WQp+PLK/yNVEuR0IYU1WRLC6 qOrB61Y+VH5K51kbR05t//zPH13LuxUOJTseeODpttbKu9+aOfOdTT3iCD8fnfdga+KbfMOq OdWn1YQs/kDRilmrX7upkhd9yTVFM3//wIJRZwcdXpwHuv665ziCXoV53ajw01vlEqgb6ri6 AQqheq4QgoahjmsYbB5nPZC1J2YFGIAiQQtzi0XbJMkCHQ9FVA5L/gp/p3+3XzT7m/0T/LP9 izGbnvLv9Wv9X8U5yOI6cBjAgutlLWAHcwqaI+j6eKzNMfYJYhgwd1bxcjTCVn/I323wH9z/ MP0o7x5hE+++40WG9N85VdNL0jcpIbA/OR30eCXeu5JGd0Cr9wsJZX7pDUl+bsbow1obvcS3 X/25/+vQP9nP6p99v4R+DesMTFRTnyF0vW+tWm11cwAsEYfkYI4aj8Ph9gSsJZVZVFxGy5Kk rKySBEosep5lMCV1JpNeF7AkYzw9JlET5VtMgWQlOFMskUy6E1Z9wmphASCJaCRI6SKMDTND STqbG65We7xBrXaCbrZukW6ZbhVUZ56qYecfVSsrJtecaqEoQy9zmMGlNTAeDkr/XzCcEyCm svAoe+Ygbprt+URdVsrhKpms1BazKJuh9bmCI/nC4LePLH7y8jFBb4ExSOv58Kx97prTbzpb wZvZDHHE4KjNP8x96VL2HEbMpOfDNjhq5Z9OeWCekqNIzBgpICrxIYxUMfsxa0Unux1u5nSp 1DBp0RZ77epE2Mh0hcyRVHAV+C8H5dzIWrGqk09f5F3kW+RfFLjReYNrl2qX/UunrlPqtHRa O23ibkYlp+SSnbJLdDOfK+gJBYLFSVc9q3dWudpYm3Okq53OcE5z3eh61PUKe9n5octuUvak LNJESMp1dkmy2QMmuyMC+eMhOVgYLlxcyEihVDixcFfhm4WqwtXFhYVFxYFIMTGqlSo6sy6k Y2bdTt1e3fe6DAZztUqnU6sCRpUY9vIq9sBsKJbqPIGA1xMIe2Bl4nSF+9P/kmsdohC2q0Qx 6LDboVDGl7GCbg+EMmj5mECDbhfiLuhxqBB0OFHDyRKufnaxHHQnoC6ClCWI2qJExMv/hcO2 hEmdMBlhcklLCc5ngIvhhAbtkKt3e2jIQz1ySZ1Hrq2v9XRXIBIrrPXIiaJaT0I2F4eKZxcv K15VvK54d/H3xdriHewyAAUXLZVdTlzmlCvgcKlT9taZnd8rJgTTtjA5UQetxGW9qrDjWTzO js8BlBKRlsmOkJ3uslN7QlLhuMEE1SrVbpUI+0WoNUkrnYzGnZndVjsAVvKdR9oPqSw12MXB p/tzjzTY5XUfUJBoV8d+lLql70AKuTmAIKuzaoR9EZfQtJDMELqPRnhGdhMO9zt2163jhG23 f9uW+/cMXAEONq4ngcW7BBsHT7Nu5nV5nV4sFHyZHtfjPbKlwLClwLQuHJ/a7JRy5co+QkdH ewTbcDEhp5/KzzmbrcZmOyFPeP+677667soQn2m0gXO5Fxb999VfLXxRyajnGSGh+TDOV2cX FwhtUaHi8FvCf+XTmGkTMdO6MdNaWI18p7WODos0xOpaZOME54TykQ2TjLOdHeWTGuYYL3Be UD6n4YHy1Q2PRPut/ZH+2v6Wl60vR16ufbnlA/Jt7ffNB1r+gZMYP0pRN25bTa0tFmtLTIpi ux5HWWmktrbFaoUKstYeidRWx7DpH8QmOqXVDFhMSpgTelvCmogkoNUclWhJ1CbqEsOrEtUJ qFwvlf3AcnqtVzuclbDva2ltoqWluaGhORYrLy9q4fDN2jxSJSUoVRmNqkDA6HQGsEYVyxaz qkLVDLqarVKpvK3VCZi5FG8tOiuAJ/Fy/QTMuUUBIeAZvYMmuLKbOrJHNzzjD7qhAvXA5xzW M36/G/g+qyXwIKYUKnkeJJCfzeTKJL67pACKAxxV5D1OgFw4CEqyp7pZkl1l8OzFzRL225ul ApMTntGet0tp59oEUCau2E6smT19uAby4Z4+XKaEuBLhl324WEnjeh72Hn8LM/64xMmFzO2k JvOjbCuA6brZ4m+2qBzcg6THJUDZhqyIG4Ut3JPc0Kwq90dYjfKnEVoKgPvzsp8i8LUfUTbk 9fcnZNTX0Px+cx57/lsGu4euCnOSTf/E/RvSG9KP3aCkDwa9kr2GrkjfqND4Z5yiZ9HRdNQs Hvuc1wmzqYODHAJwtRp9Lj0qGy9wqsEYv8jTebqDPpiP41xPU3pQuBOWkRbSJiegQfyJkGoD cM9PoEatQS9prYQW6iR9pX6iXtB7rPMfO1YtCqh/4j7tUdySF9bYba8rr7AvK46Jt/9rJ2+A 6mvFfBBMuTE9yO5Q2jBCDp/YBslg1ekLaTMmUv7ph7HG8yUeioRjjUirKlVHtJB5vSRrfo0/ G9bq+3j4lGok3xr5l6J7BrNeDRR0htCNE3b1dK486XHNQ6HHy4WEJh4aLi61XeK92Ndtv957 u/1O70bNevtD3icrtmqeKdhs3+LdHnyt4GCVQ48PAJRQ4V7LHV52RfmK8rXljxdsLH+x6t2q z6q0xZCdnpS98YpIPB6NRIutAZsrWR8h9Ukq1Bh1pbB43idPpzcWE31NRDDoInxvajH2ppLD jcZi+31SJKDhBSYSDkdkULU5QisizZEJkdmRdZGnIjsjeyPaiLfBtaoyoubli9Tr1DvVe9Wi 2jOkZMdRcERT4wc/51MXFhnZrssbIFZ0INbcqNitAS5wc0SIaZbjjwooe8CeHMPeSTSAiLWZ H0gdnCdzsM+qLddmRTCoPLpy28V2cP0dJIgqtswu7A1z4aAjUgd1SN70SDFxzxqk4iQVMBVX J+dmhsCxIRRMCroaIkx7+s3fP77v/WE3Tujunrs5rJNc+oJ5901c17uYE/+Lw687+emzT73k woU75l127z2LLt9mlm5sPWuo3m216M3ekvvnDUJNB3nsjxZpwvDTTjln6mwu0Zdh7KeC6vyk mBZu5pDmSdkgVShwJmryO3na5qlweDxOR9Qf1AjUEE4YO3AMad7WREQXjoCrzpNLBD/2LjQ6 QyBiRs8ztbckNpkYww47N6Ux2xfZ99oFuyc569Zjh4MPAjcO6+DKEqjc+XIN/ujZ797PRwDu NyGrMhjG3GDIk8/T0UpDZeGY4jOKzyx+LLqh8Gm63fBMcFvRC6rXtHvEj7X7VV9rLU6xilar mgwtdILh5OAZdIqqQ9NhOJOepVpguIhdob8ieFnopuBA6Nno1rgTPPCHXoNUDMl6c1DZ3FfM KdphW1xTDaNQgm17R24cj2hgsA4dMRijJXe/30/V6X9s/XiNsgDn9oYf+PD22z/kTvxi8J2/ pH/+0wvpH/6ygXMrcYSyWfDyur//fR0c5vpGjM44zMwS8sPWiB5qDKjtDsmliLzk+Dj+t6J9 oX2Rb+JfF2kKHUXO0eHx8fFFU8Id8elF55nP85wbv8ljhF7wJ3mJzd5uO8NxfvysokNelRoa bocXm8TWuHeFtFa6y32nd4NjA+rGIHqYPXafYl/h8buycjW50RJJagx9otr/R1ckZigYrm1f H6KrQ7tCLOQttUcAA3XN6xPUnAglVuMktif1wjHjjNmmGFrA1IXbPuHMCH4YYEVqPmpigdHG oHJZA4sTV17kDSgUS7XjLfGU+cEnDWz0oEcUXuTsjCpWE+qn7tjxp/cen/vaaQ6cBZn/4Muv pX+lhteeF0x+PkueC3ldvjHdX//+wT0nTbS7LKlR51PhpdcoTggychV6eyPmQhD9/cm2k0vO KcFngvgEKMCpJFWFon2KaoMQ+Z6UJV+Fy+dzu6JBvTNarOvQYxr0FUfQ35gO4WjEHiRGg10D NI1zL7pwN/8iFKXe0nikG+JCP725L1XSnZ0M0qEuBVHAFIhvIvCpwPcQcKxm/0E+D35jEkBU q6oc1+PMTYK+AnxpkLOYcT35ebEd5+++7Q3bi7g4m8h80RfTFnqO8KgjS1RM4UecIYGyXfnF 41jTVpFlWcztn1z41mWXvbXk47uU9OIP7rzrgw/uuvMD8YtfF3Le8sjLl+275NK9l79MP8xS 8vqPP17PKZmRbvRtBSjZA7X4m/K5euc9DlbNRrHT8EWkv7C/2F71fGj90POx77/dn4X+5TR5 /CX+WtYQHOs7JTTTNz20yLcgdJXvZt89/nuCT6vMFzkH/C8IL1hf8b8SVGtftHjDYayglkDE pREjFoNxsnf4ekIXYwb1089kVzQ8nA5fb6eL7Dvtu8GKRJyvK3niKCvqGg9chnUBpyY5cQLM 8Z1s2C0f05m9TjvsYX7Y4rOHgtCIf6v0I2f1sPehEafzBJOeLGUSDWfhao1YdvhR52ePzfrr SFuB5JYqf776g/Rean75r1Q/1fPumjV7vPT+B18aUWP2WCxS9VTqe+VpcI7/uXrlk0/cAgrC t3+IOB2UWUtek+OycaKqW3Wt8eqq9cZe45bUn1J7UnoXNjSNL0tSVFdbDjPyqn4mbsNZ+nKA mH4qy15Ko9rC4iiJdyQjOG9vDXvKy9xqnVYPc/qbZX09bB/D3t0Kad4pmyocsmOx402H6PDU XbSdvp4z+RivmN004rAsP77cyJWag4rx/gmWajC8ObpNCnP+gpKUDwNaGiIpXzIEEzUK87Tf tPWor6lR5v4RZZnCUx05wYdVUGUbfnARhzKvbeP+tiduvWR5Day4tbbfn3PBJfQmnimYBsfk cSDbzulx2Xn3ObVOq9UluBa0LsviLkZ+l75KvAqUWQQ766Bc1WpfbGcfR96JfxvZH/81crBQ fX5yYdm8ink1l5uuTHbV3Jzsrrk/eVvNxuT6moFgAdNybjBXYRA6lUqrizISTFW5w5IrjLEs CK6pioT1qQhZk9BAWFHjc2TFgTAN6/USDKB6dIJZx9U5T+l2Q/731pVHumOrY+tjPTFxZ2x3 bF/sh5gY89SWzDmOWBUQw3eowTA4AGzez1kqh6GKhvkYjqEwiWOoeAfUWgeJFwd5S7RA8b/0 BrU4tnawt1RbyYOksYZnljlhQ5FXKOcInSMXWpfH7Ba7poDlzjvX4AzYkPo6zkVwYs9aU30s 6xCuzq59he7FM8crFk4/jr2kyLn83U2//rrp3eWv3XLLq6/ecstr7OV7FY6xffKo0lnFAMZu esrJJSMPb6d061ZK0uPueP2NNXe88QbmAr7dLS7EXGigF8pl93h/DTOROuiZ6ovUq+kdbD19 iPXQPqbfoH5Ys0W1VfMXzQeavV6NV2uBAgR822wP2Zl9ptuOPYuoJVnBMw2lMytLSysqo0kJ ejrO72GiPFNR1UWlLH41xGfm8GsD7HuelGN1FVV1ddVV0QYaTvojYrK4GMPdQESNpNfqwp69 bop14kHZMIxEwlU7K3fDXqufftM3dExuKMFvOJNRZlSO5Ss7BpbfZPjHbRMcr6g7sSirIsN3 XWHIh4NEwDL7emGQChGtXbEhlbw+lUYd96k8IerV+LNTEnMSlJLfadhO1JmDW8PGkD2LfmDX yAFQ9mTVUYyaF/MsHPlg6ymPXY/k5yASPW3imhlzb5o5K+SBzcP3iuB27UUzR1YsONb4TZnZ wEW/Th3TumrC4D+OzF9hxuVl4UsGv81nZKES1pVnQQ1OlQXKUT9ZJpdEPdUe2XOaZ55nqec6 j8ZmkqbZ7VGT2qibplJFjU6/504HcKzwIuund2zzq01GPcFX+rhylUEMKRBFKKQmQP3kCUxa dlTGgy5VsX9pPoQZdpy4dZTPYXo4YnW2vLyXN2zJr6ds9ZXL6Fj+3oNuzp7o2J/5nrrK8re/ pScdVrZKOAYEpwKW4WhkS/oqoUF5swBZJ6ckfsCZScIMc7sf6M6/1NxNumk36xbuNBecql2l Xafd6B/wq/xaH98g8mM2qwzafrppmyhGDdkXlgsMau9kT9hqK3Cugd1YP50tW3AwUgiGjKZw IDABulRPcIBupW/lOL6iRgYIqTiitB/c33xoMNcJWCAB13BSVHnzI29sh5Vr/uy0CudD2d4r r06buLELGzNtWtPk9M9KB+jOv46//eBhZebPO391WUiZ+DefjVm+E+O6BrMcWsLtJAkyxjGd JLdLxUkdHsoTcE7+bNvDNvZCLS2xl8TLkyW1xXVD8WmTpmRz7Xn282KGs2w0Zqu3sZR9QvJv 8b/Vfhv/tvbX+K+12mHxYbXnFZ5Xt9G+MaYuhNUrvgep8AFVRY6H+7nQugXfhw5hh21XH/bH eShLQN6hmbFQKBqL+rH5XKNwi8rKttrKypraaFltncWg3KigQl9QYNBHLdxyBhJU1mzGfY9i NxP12W2lCZ4/JpmcGU8mE/FoabwwXlgYrqu1Y1Mohk+52cIkhjPiMWKrK7SrYjQ63O93DPep E8NLa4aXlZWWMsNwq4Voh1Omt3MRWrcIRiD3xgun1A3Q9SSOHNPi2u5aFq6trO2sFWo5NwoM wTEOK1afxbpuHZN0YV0lInwdUus89Tvo/bClUhSs+V1NxaqF29jiBANOdnFVak6DytcaZUtT gfDLRUWXtR1y7p6+YGMzzAz29PmHZENoqpQ0NFU87IWmSlEWwTBvuQparYKcjYz7WH3rCerW in9jeL99IgLSw79V1xTg/EOeLdpg++AtrOVf4e4zW2rRqH29CHmjwB+hlz2KoGNA0HZtnH/M ojZziK+F2e3VLtQqBPSeqBiEx2CfEffUhpVibv/NlWI0P/WPiIc1lrzuK6/FPUE7VgPt2DPH CIsv0vkpZa6YOOOYk+6n6+bwWPoHnjs8/Xt6cXrFMaLjv2gpZx98QqW/S7fnuSW+8UvxTVSC vdcvYF3WIdfOdSxxXOsA+DBO45gRKHEaR4hWt+NOiwX6WgBDQsMWSZog7ZQEyeM5lhty9Pe/ cMHf5IC3Hc//fuL8Ly86HH0JjnfxrShxJzBZGyuRG81DzA0FQ83DzI3mJrNsbjG36qwJY71x i6+3VCyi9ZRN8c/VzPUv1Sz1q+o11f5WTat/ikZVqR3SpMzPvcPosLYRw4Y1jYgOccBW8kk5 GLbSidY3rftgXi4Sq2SVYWXeVmC1mguijjjMJwEUSFSChVxbMBoNBaPxeuzp8cwaqYbVtFXU 1FRWROvbZJ45f28LbWlrbmmRm6NlFepgorysOOBXU03JEHk4aVOXRARvRKcTNDhkEY879KaC MLZGQnWVzm7shhxOBILhogRPJ7rxrZ/DI0hFuHkEV2SRETtH7MZ/1OAZU7IpuxZlFVeYidyg IBdgNLjRWRb9YXJyyZprsKxDyZENv+Mnz/+awq7KsV/FQN38rFFzLqyAiRNBRQ5VhIuTbnxs R1QZ4kmxKERVao/ehY/vqkpC1G3E1ismGE3xg3nKkc6ODsANX058Hakn+sx3RITTZD4E9vgQ 4OWdPPak2XOeGt4C7wjlfAJCwJpdvQiVeUs7bA6uPXMpUuxRgBJTkMlRYJJNH4NUTtThfHn+ gpFzIw1Lhs2oH4OtS+xZnlpTftbINiU6oaqstKlFyf6UZ2RrCHOnLGlta2sdfsr0wa180rHf y5Nb5w++o8Rva5kaSJ6ZTXAyzwojoPIFoPKpoPIGulwe8q76XS17Qf2Clj2o7VX3aoUuTbeG zdOcqT3TJ6z1bVCzK0J9dAsT/KHzQvhfa2DQGMR8VajS7Ahh+7lN2X6OWk/EtNklqYDgNHZb blXKYlqJxKU4OwHYmurassC2eniDmg7QfSQMjYYtEBE1wLhWKBN1+rB3LzYF+YIiKfB2deV6 wFsPx7bKV664Yi+PbLPEiWNvzQeOkOOJFPabppEnVsyT4m/hWrvPj/Pv+G8WmBqfCQhRnxZ2 oFzcLFGwbZ7YerHHCGOSzT47Z9iE297BBg/HpKgjSz3HkE9WU1tzAhX9G7ydOu3W9s4JDTMU 0viE8+i2axaefnnXsehWKRPmLmsfnQyuPHnw+zx7ZkL7FS3XD/54JK1IqxwD3gatSSMoxIAN 1ZPkBqtTdOI0uvAKfcXwLvtI9XfNuwb1+ZpzLWw+my+eqz1Xf55pgWW+7SyX1hERzBEd1Oka YwQSHs7zeJqVEHs5PJRNjroeQiXYKHYC/Paz5bLbCv05qqll1FkEFfpu9T71D2qVup9+2ucG C8qfaMTihq81dPFPJHHFLUcCiqokf0BqB75gc5DYYaIk2QvsroHMp4AFn/aZgpagMqGVTkeP Q6Dg+18Gp13yNdu5hxOVhwCWgs0GOzytHp6Ge8j/Vg4A8WnsMOgycM9pt7hG2Llns/OtqH7Y olkR0esB1rTcY4I51Ej5N++P+2unXHeb188co7D9fyq7Fugoyixdf/W7Ov2qqq5Odyfd1Y+k 8yJNQiMdKyQFyToqEhBlgXEyuhxQwHECLMy44ln1zDmIi49BBof42MMeUXYkG5TA8B4ZUMAZ V9wdjrvu7Cpy0HHOysjselx33TT73b+6Q5Jx5sz2OamqruoOoW79/3/vd7/7XXtn6RLA2N8w +bUTTFn4wY4dH9AP23O8dJmFXj0OWbHLP/3r995/7tnz78M2U4Ab0Oilqv0pZnebFOjI4Wf6 lJtREtTvW8ZgE+fdvnVsQ9PaVu9J53HpXde7nn/Jvdv2kfNDCAZBMnuD61HboG0IGt+oZUUY Gs3XRqM1tWnNWqW88pkJS9KsdL68GqGANh8wwjUG+ET+fMorNabYVrtLSBp1zvpUwM3csWkt gl9PBGrn8XymvTbaPh58pxFKGn0cer/UyQGEr8IPJgzASW+4zSue0t6GqqkUd0zhxDSfzsjq bVf+7ZVcZszm3OJ4aKxRRlQoAtF/b8Q4zjSsac7Q+vv/8c9Lo8c+eNTKo3H4pwypP/eL7YPn zg3+8Jxt6eBt31h3du3+0pUDJSeNJ8qx2Q3uEK3ccvbt7295+yxs9yBs9xJsl0GVzk2kH/D5 3kAHworPzWKgY1jYFR+usy0Qbo8tE74dW5WCqnzsO63fEx6LbWwdrH+25YetP6ofanmxNbQz w55p3K3vbrRZ8YOFE5dDCGtu9obPlKdlaxpeQNNwJTgQYrkp1YZMjrx/SqoG1TpAiHLAitKu LOThovqDEgtI56XLSDrG2ppSVOi8I/ly0n42eT55GQ15olMrIDJ32Cs4O9HYAQwBFSLaITns RDycCAuNm3Mn2BUL/kTDxqxCxzwc4Tq1hYQlGtRmiEi80jjJshZqP4YQlQ/GZkrAQxh02Unw 0NDrNFeu5nhyCWU0gPQ2XzhaGmW2n5zffG779nP0I74xSBb88vWKRdn/HAAw9OMrpTlbzp7d suXtt7Ga7sZq+nXbdzHbh031fj9r8cyTVsl/IT8iP+V8TnHxiM70Js+Uo7d4+LA4jGDHND3l oIwKrobNeQ19vNoq3ez1q1xK2+HyQchb9QelbJ0hNDul7iAWQ8RiFJLFpYDrMoQJY1MEVc8G MvMzFoB3OePMRFtGH7+6IEKmCVwAQu0ocIJVeAk42cXy2Dompht/n32u+mNfuQjCpQqVXar9 iurX5BpriQNtmK9tFv8QLEMCVV2TXPWxQEUUdz7/J3MeiiqSX8kUojOeeZWtIzuN3kNR/M/B 34ombUvP/WDh8pgClCUTW7y7VODGkVG5epSMBYucvfK+rYRR1st+a25Su2tmifJNaFOwsndI H5rxN8U3lTdmv6e8o73T9cvZ/65cLHw8+3+VzwpfzJa9ilNzdHlmJ5WwFu6Kz96c3lY4EvAu Ur5eXFlcZdxX/EvjkeIjxgvqXlV63NifFG92N4Pb22bO7CyAGep3has6hAKoofbWawL+KpsE dmjUmDkT1UY9yNNM32fTW1nrQfaUWVN/TSolGK6FHal5CSKI2kAQbbs1YzSGUyatkhrWQ3PJ QCMDQ7THZXPWSynvN8t5G0LtuAZX/9zPWDPodVYuk/iiZGPOBQYNhHN+LW0b7pbzvBe8cw7E FWfMlvWaOqUu0hVOCka8I8lm6NjIs/FW665OCmBYzLy2thO+TMzoLCavSQrqrBB3pcnrhzeN DUWbeHEfp2L9fYZakGqOXvmVEEGZci+GbZc6A6N3JK110jNhvXi1cpkMUsQa60HYYajYFGnF rQYXxFCx6aUltlfFotqrAgKpod+DO0MfOkCOhUob64+gLZH+rcooi+daKX8mKZ1xJFjVEqEo J/pwjZIopLqRrbfS47b7rWgWz5SzuODhx/qM66Zu3NP7Z7e/dfr0A+6wj9Ngo5HM4MDOHTcv KJ3edNO5rcO25lo8qd9PxLRoZ67Y0Ty9s6EmoFRn7r/+7l3L06o/lvg7PL7h1uTU7vt6+/J5 vbCi81sPUNT5JLwtA8ynFuENM/tlnPnisbi4U9ovnZB+IV2UHN/xb/Rv87/oP+V9x+uMuEnj ahictbVm2G23u9xpFlQ94VAAykqqI1rVeJA9b4YSRjbrMhg6fFWlol51E4Q7fmSqLS3AiOtT p4SaYI0OluyrwO0Oih+OTKFAD6vyRUwO8KB5OgqoPhUW0SRh6WFNmBn4U+SPxSEIHPMkBSle lYQECuVXeLq6n5WRBtBmJ6eoKkTOSr5FC8Pd5zVqpeL6NQtPzVB90IXS/2vN1mFO2HyGjGFb SoN79B9uWDpN95HGYWruX60X83SS1zfTfbwN93GJbamQw0xcJdn3a2KDxmJIUHEnpyrvrqry uNMBK5HqjfeVE6m5FF2HjAHLXqdnsyk9nWNaQNVThpCTItUGqsUCbo8RDDhV0EGQ8RMioCc8 b3oagyHdfRaaYwSwN0wG2HEjKe1M8y0NFkuN+I9eDivTLZRWTULS9QkwuqyQRo1iDyUF2ala d94ahkp5Ej4G4aVP4A9fAGfrAsYcZQw5AQQ876v4ENlmxtW35aXTtnHozAbzFg6Kv76i7+93 czN8ysOIDc/2LF4vJrgxHluw6qh1aOHIZAMDq+GTsEEGEG/bbrZbHlJsuqR7dSop9esBHZGb wYrytcqd4l2hlerKzB586CVFNpOMipyHzbBP8AV9eZ/N18eLndMQa7EWUfxvAYxehUGpkhlJ E6fzG7yUGXAStJzoVHd1gJcL9o3BniFU4+lySEUcqULmGwpkqqIA7YTMcxngjAcNyWZIHmfG AKy5yvQqopEPdYf2hGyQfF4lKMxj+qAQOlUekHcAwrHLx9gePDN1LGVBlwg813wErNJS/cRE zAcQ7J/PV4ryLILnBLhxMr1zEvw4+TK95zQ6oT8F2HVCEWsGja4mnRFffry060/Ju2EGbTez Qh1r5XoarJMyIgttPjIlN+fXLICAjsmSxStX7D+AJRtsLeYLDVoustH2kvYCklmHtH0RtyAG xQe0J7Q92k+097WS5t6BtjxnRRsaDYar7dXhBrHR3hDORYr2Yvh6+/XhRfZF6uLw4ujihjvZ 3fYV4bsid0Xvathgvze8XXsq8qK42/634R2R/eIR+8Hwy5ED0QMNb2inI7/UzkV+rV2MNHu1 uIZST6058nD04YYh7Yh2ynFK/VftY/Zx5AvxS+2LSMjiEPmDYyQiixM9bLaszjIBvGgza7tM RztAi7atzj6YFYkkjcqqQc6QTpcZ0sNm4+2c5A6UMokkqe1TD9vDydI4wTyeQU6WTpfJ0sNm qLY2z5nSaTClt3Gm9JUbzfYKUxpcpDJTWh/HlNbHMaX1MlP6VWAeEbYOT9N53P4wgPSMHd3L mO1Wu5QzUjFDVwyf06hK6brPV+UcQKbvZBS5lEfNemFr1JwKhnRDMxjSdWBIm7UJbKIxbAAw Rw3zDpTzH2G7EINE2GZQpBeKZltHQaTPifQ50QyGCkhO7TJ9Dv2OMAufVO1bVQNlfMf3Tp1O u5FiR4G/bbbe4p/hp/Eb+B7f53v8MtqbshYpOMzw9AdApRaJUS2CTX1BaBw3YlAvMLZ4XyLW dD+RqvEa5ZTq/gqluvkzMKwv9gvVFuRIXg73ZlHSAbYK0tH/X1L1pFGWBwSzhvDH8dg+zv3u yTKzuoI47G9wR9124k2XHRq2NuWyoYlpBdwrFyqMJ01XAhXbphWHDq4YbqRx+Sva3L1tZNnB J1YROv0ROb0NTKwBzWHcCL1TVEc/EXnGujJKl2O+XYVR2iM+aW5LhpKyKBdDi0JinDCWZPoO do88kBrI3NFzkp0MviW/lXoz82b7icKJngAoxsL2tO2rCNKcFK1bpGhOltYtsrQIOkvAwESp GLKRMnQj1ma0G1kjYzTNNnqM6UbBMMwKIToHRnT3EkfhIGvdp/c8jWJSPNFxIkanUhrI0QIE xECOfjrgGMCjAUo0ro9kns5BQRWfSz2dWxKozZdhBAdo0ZIUk5qchvOjw8yFMQKRq3GO8EWi R0eDEznS/USGxg8WXbCk8QTFLlUHL9JJOlHex4Tqq9Toq0eklVqmPP9sEuV5aMSiPH8+ImeI mnxhBLgV9u/tjXd2Wc/zONK0mQleQzTrljGatYSvBRPEbU7A4Q2mx77VTF8jorQFN+4PVfsC hWngPO/FHm4u5YioxM4CpadduWB6AE2FEkCl8KkL5o04CElapCuEJbOrZxa0BhltemaglpfR pmcGJMEZbXpIFxzp5kB3SqrVuwoBbNrVaLwL+ndhIlp/QqW3+F/xfQ9QrpGgSsj3a6YPB5lO bFK0KccAY+MYB5ZHTs44a7cKzyrB+KS0E5GyUYhEjnhlVEwiZTszYFY8VK8GkHv6DxoUm0uH Skf4Alb6NBELKPXsodJLWQXXP6T1bBmLs9plNIQ+pKtZ9nrpCZcGh50AcNZROm1hnT7NhcD0 eje/gvWu9CkLWetglQYVCmEbcJrtGFXt7CicCaFark43+1KR6Wx6aJ7PjHyp/Hfa64EW6o3p FWxF6F7l3vQmZVP6UOiYcjh9Kv1PaT8WULldDrUrlk+T8PnyY85MPJ14ELK+g+kEULV4OtMM 0tTwvtapPDaMmN721ta29nRzu+KxSIAOx6BFAfQwIaaSfxOKTI2wSB6CTaqSjintTVk6e08u l8/kcmjP1ZRJK+0QqUqroMqEZFkXgD3KisDacUGGaJw74ZDRPSVtxOOqEYthRIvk+mSNpjYD 4vN+ITE/Ia5OnE9cpsi0MN+BkpigQ3esdpx3XHY4HdFpTYcZ+T1cL/9i/xpgDGvGQIZK2Qvw hnLRKeQIuBoBFRJwBeLxE+3EeXeyxzNpqh67jBHMgr/tzwcnztqfveZyBzvdJDm3pj9V9of+ wONV0SgoP6Ep8Vul+6KJmC+scVb/GrQpXMAdYXD+g2rr6Cffo6m6xAsemQtzs+wLe7j7NE98 xXqE8HBdRYzIk7oEjvJv8DRFhF+bkp8gYub2S+IxqPP6wJCUBDus53XlbS6X3ZaWNO4G9yr5 gAIl2rTmZ6Is6j6/6vOhyZroZ5pPrGL+gC5EoFKoo9UA67cbAalbGiC8Lqr1D1Sxqmj1+jJe QBDd3DLfmcofrUiEaM6ECyC4w1RnydmIVnkHaIbHqbyD7zHXYf/PezFf0RinKQo33kqpcNn1 CW9w2ynAR5PPMBSlrVjcBWnpVKXw1PbO6GaxyPkWo4K4dvRzK7ibMzpzHd3YM3PEE2vp4DR4 lXXo8v1zZI49wrVmpAUtCUXBZf8x8/xUFPay/wyISVGEx/LtEYkJOw/x1hykQjlKzVcICiGo A6P8aoOOw2MNOkD1qTTowC/lr1IGnfHIWpNfs3CCunJSp6EA5BVCgixYfYWoqxD1FKIupQn0 DaoT6lHL0Mh7BVGfIOoSVOkRRB2CugRToL6k1wlfQ+/BG9Beew66Ac4V+lBmOV+4Gf1cb8Hf sBDdAReh4n0Juvbdhi6C/ej5Sn8XSkH4n+akLPWiG67rvam3uWdg/dqVy9f2Lf/u/Fvm3ir8 H9TRp3oKZW5kc3RyZWFtCmVuZG9iagoyMyAwIG9iagoyMzEzNQplbmRvYmoKOSAwIG9iago8 PCAvVHlwZSAvRm9udCAvU3VidHlwZSAvVHJ1ZVR5cGUgL0Jhc2VGb250IC9HUlJBUkorQXJp YWxNVCAvRm9udERlc2NyaXB0b3IKMjQgMCBSIC9FbmNvZGluZyAvTWFjUm9tYW5FbmNvZGlu ZyAvRmlyc3RDaGFyIDMyIC9MYXN0Q2hhciAzMiAvV2lkdGhzIFsgMjc4Cl0gPj4KZW5kb2Jq CjI0IDAgb2JqCjw8IC9UeXBlIC9Gb250RGVzY3JpcHRvciAvRm9udE5hbWUgL0dSUkFSSitB cmlhbE1UIC9GbGFncyAzMiAvRm9udEJCb3ggWy02NjUgLTMyNSAyMDAwIDEwMDZdCi9JdGFs aWNBbmdsZSAwIC9Bc2NlbnQgOTA1IC9EZXNjZW50IC0yMTIgL0NhcEhlaWdodCA3MTYgL1N0 ZW1WIDk1IC9MZWFkaW5nCjMzIC9YSGVpZ2h0IDUxOSAvU3RlbUggODQgL0F2Z1dpZHRoIDQ0 MSAvTWF4V2lkdGggMjAwMCAvRm9udEZpbGUyIDI1IDAgUiA+PgplbmRvYmoKMjUgMCBvYmoK PDwgL0xlbmd0aCAyNiAwIFIgL0xlbmd0aDEgNjc4MCAvRmlsdGVyIC9GbGF0ZURlY29kZSA+ PgpzdHJlYW0KeAGFWQl8VNXVP/feN0s2MgmQdZJ5w5BBMomRAA0QmkyWCWhEIASdoUEmJJEE wUTC4oIwVBEYNkstFVxwqYpa5WWCdAJYoqitKMKnVOsKov3U/oqgv59at7zvf98MCNZfv3fz P+fcc87dzjvvvvsmixctaaNkCpEgb8vC5i4yruyPwHJali5WY/WULCJz4zVd8xbG6oMXoH7d vAU3XhOr51jBC9vbmltjdfoe/BftUMTqbAz48PaFi2+I1bPfBbcu6GyJ23Ok2ryw+Yb4+CTt 6nXNC9ukAVNpAlG7OrsXG1XKkf1d1LWoLe7P/ERJf+5e0rmQwdDdurCF0SAiWeH0BU2ke8kC yUYldCWR8kclj0yoS7sptem3ex8dNyd14pfWXLkMogc/HFEo+Qt3z73q210/zLORNRnVBMNf GtDOUjFwBdXY6Ntd395ki40kLWcv3keN4qJed5bj6H4xkk4AXIyMePIcfWKEyIuUO7xR4epN H1qaWlUsVPRYYlAVtBPYBRwAFJoj8mG1ga4EQsAu4ABwFDATgUqrCnQCO4ATgFnkCXtEddiq RohstM3GelNFJp0GdECQA7QEmArMATYDOwCz4Sc1ncBK4ABwBjCTV2RGtozG3DMj6w3WO39B qVFtjlWbZhvV3qsCMT5leozXXhpzmxBzGzUmpr64OsZHFMV4ekFpCJ33JqaU9ldliAwsMgMT 7wJl/HlKZYwcdL8YShrABaZqaLwivXe4u3THAaEQE1wwaiWH3i9YJCWttCqR6/w0pZODf8ZP xSz8VO+gtNIdVZfxk7QLOAAIfhLlA/4BreQnZMxBK4EdwAHgCHAaMPMTKMdR3ufvUyp/j0qA SmAOsAM4AJwGLPw9UBt/V2aMQaVcCXD+LqiNv4NlvQOayt+G9DZ/W+/nr0fKxpf2GYKnJC44 CuJCZm5cSM8ojfLXIt+MREa5caeRUfvEMKqg0WJYpGCUIyqyIhM7HFH+Ya/qcdxfdQk/RhrA MZNjGPkYqcA0IAh0AWZIb0B6g0LAHcD9gAYgy0BtgMoPAa8Ab9AlgBeYBlj50QiGifIjEXe1 oyqDv8r/QpmI+GH+V4O/wl80+Mv8BYO/BJ4P+yH+YiTfQVVJsBPa2MBt4CWwm/izvcPTHXpV Gj+ACDpAS4BKYCowB9gMmPkBPizS6khHJ/voEJ5hB4/QpwZ/hB60kne+w+uuQQKqkrgn/BIS yA51h5t73Vu3oSqJe9MWSJK4b9sASRL3TasgSeJesBSSJO7W+ZAkcc+aA0kS99RGSCBRft+f ho9wlE29lqlVqXwZorQMUVqGKC0jhS+Thb5R5BzvjhQWImLbvZ6RhY7QXhbaz0INLPQgC7Wx 0AoWWsVCE1noahbysJCdhfJZyMtC+9g4hCLEvLsvqI73ZrHQIRZ6koW6WcjNQgUsNJyFVFbm jXJn5FI8dWA+g/VWyYeOO3t/WYHdJ5U7EVEnct6JPeEA6BFAN2peOKnDYs7Z+ZIP6y2sjNUv nlDaWTWZH0TDg7gNB+k4oOAGHUQaHUQnB9FdKmglMAfoB04DOmCG9zCsY7NBU0FLgEpgDrAS OA2YjemcxlQ4dYLKKe4yJlYCWglMlTV+EGUYipM7vXk2u81jmyw221lqPpuar+fzMsrIwL6c nmZNi7KUPV+n/PvrFEqoSuCb+GbKw424I843R77Jc0TZXRH3PkfVUPZ7yleQdWw8uVkB+Djq NupjyW6V+jFk50+Al0bsV6JZasRd5NjLBslWexzf2D9yfGqPcoif2Pc53lSjCos4/gbNE3sc x+zrHC+VRK3Q7HdHGdhe1XDts49zPHnIcF0Fw/aIY4Vkexy32Cc5rrUbhraY4epu1Lypjgb3 LMdk9Fdrn+vwdqPPPY5K+9WOiTGvsbLNHsclmIInJhZisiPtxqCufKPDmWVR1u4tsmy1+C1T Lb+wlFqKLE6Lw5JnybUMsaZbbdZB1mRrotVqNVsVK7eSdUhUP+H1yLfeELPx8jMjoRkphmzD DsPkNgNKnFk5XUbaYFHP62dUs3qtv4Xq56raVzNcUZY4fZZmclUzLb2e6hurtXGe+qhFb9DK PPWaZdqv/D2MbQpAq/G1UUaN/ijTpWp1rpZe4+8jxtJWb8yV/KLVGwMByspYWplVmV6RNr6u 9mdI0FAGaz0/Xlk/ip4sT562tX6GX3s8L6CVSkHPC9Rrv52hNvn72BfsjK+2j30uWcDfJyrY F74GqRcVtYFAfZRdafiRyj6HHzIGDH5WvJilH6nW/Jjf9phfAdrDb7hk8EtIoALDryAhwfBT mPTr6R7uq+0ZDgKfTJW6DZ/uTPV8n0MF8CkAgU9GiA4ZPocyQtJHqzC6sdvhkg8CF5ZDdsPF znIMF2PmPYZLSdxl3TmXdcZIIjYbw0cSdJNy4qxPygn4nBfI/y62VXs8rLc80NLka3P5gi5f GxDU1i9tz9JCc1W1pyUgDaom3MG5Le2SN7dpAVdbrdbiqlV7yo12PzE3SXO5q7aHmnyN/p4m b1ttpNxb7nM11wZ6J00bU3bBWOvOjTVm2s+MNU12NkaONclo95OxyqR5khyrTI5VJsea5J1k jEVGjk/z91ipOlCD+yd5L09KRL4Gc52B6gxbV4WRvOXOrBW5e3Fa2UlJnoCW7KrWUgCZ18VV xVXShGdKmgZBnRo3Za0od+buZTvjJhvUaa5q8ixe0r2EsnwdtbG/blxQLV4ib0WMeqTuZy+4 +DRvc608W9drhTPqtcrps/w9Fgu0wdoAdBPO6pKSfFG9P6a8GMoJ0lGIc45SN1HqEhLijv+Z C8acoEZ0+nDQ2NfLvPlsMXUHhJZf38ixFTTOQhiaZvn34iwlXxLdASywm3lY99ne5DoMmWIa wrK7z2LxkrgUj8XiODdcuz3k6T4bkrPdeWSwDGLEarEHW5tpL2UDOaZHKVtxE75/9I+BTyQf 6NA/kXbJ+T+x0UXjINpJT7IOepIO0HPsDFrtoj7aTfIIVEv30HK6k9bgtTYLmnXUgGKC/k6W re/Gl8kDeGE+QIfhexWtoL2UwbL0T2klrRavo9VqSqFhVEXTqJM2ssv1JdREx5VbqYwup+uo i4V0v75J36L/gR6mPvFX/QdKohxqQTmsf2b6u/4uFaPF72gbHWdbEp4mL0YJwfNeWkTbxWyF 6fP0bzEDJy3DHBSaQodZP/eg9zb6mGWx5aIGvTyka/rz8LLTbGqn7bSXjWWTuNPUpE/RD1MG xrgBvW6jCO1BidIz9DZLNp3R/6CfoWwqokuxnt30KusXAz+sGqhE3EyI0kgaD0sn/Zn+QkeZ iz3LO03JplKT13STfoyG0Ciaidk+ipb/y77mK1BWiheVOr0aH3mr6Tcy2vQCfcByWAmbyq7k I3knv08sIitGHIXSSh2I913o/X2k0R6ezI+Ih5QnlO/MeQMn9EG4I266m+6lZ1kKVqqybvZr 9gb7kNfwOfxuflLcqTymvGZpxqqvpoW0kZ6gr1k6G8ems1+xdracrWG/YdvYYXaUfcKreCO/ lp8W7eJ68YxSjTJD6VZuNd1uWm/+ZMA/8PzA/wx8rZfqt9N05MMqzP53dB9W1kdH6C2U43SS mVgSG4SiMiebyW5GWcE2sgfZTvYY241RjrKT7FO8kr5k33G8abmZ5+LwI49ALr4IJ8w7+T38 CMpR/i/+jcgUw4RHjBUTRUB0YlZrxB0oT4sPlBzliKIjzqWmraYdpp2mJ0zPmc6Yky2/xjv+ le8f+qHwh/cHaGDtwNaByMBu/QMainuItwc+wSZi9s0o83G/tyLjdtHrLBmxy2GFrIJdjsjM YfPZ9ewGRPI2tp09bMz9KbYfUXqTncacU7jdmPPFfCyv5lNRruZt/Hocxrbw3fwN/q2wiCSR KoaKQjFJzBZtYrG4UWwVmnhFvCdOiq/E9yi6kqg4lGGKW/Eok5Q5yhLlPuVj5WNTk+ll0z/M ieaF5tvNUfPnONVUWKZZpltmWzZb9liOWYPIzoP0NP0JGXjuYifEKuETT9MmPlrJxifMq8jn OdQqpnBkKt/J1vJb2G4+3HSDuZyXsyvojOJGrF/kO/hXvFxMYfVsBs3no2Idmocoj0OaqByk U8p+rO1V9HyDOZmt4KfNyRTBGWk8zkgviEsUj3iZ3hbHmUV5gN5RElkmO8UfFdOQBc8oFSY/ OcU99JS4nt1CT3MfUeJ31g3I4yvY49gXGlkp+7fQcQy+AllUJj6kW+la/nc6hed4Lf2etSrz aBONZsvpY3oET8VI03XmQvNQ9hLvUMJ8MNtNXHkMqxvPhjNhGkK3sdliu/k0f4uW0BElkd4X f8Tsj/CnxBTljKmBteMJuIVup+v1VXSjya+8xuaRYFdSgXICu9tyUao4wVdiV2nCnrYHT/de 7ANVYgo0Wcicy5EXM7FDbEe5C/uEggzqwDN+FXaxV2m3uZFHaZ5pEMOug19qXh5ooFn6I7RN n0fX6VuoGPvBGn05etxJ/6DNtJOtHriZuvAp+Rae7ctNdfyIqU4v5mH+Fp/Bt154fxHtApZF /0R5CnemwrSPwsqbNIMq9Q3635DdF2GH3UZzcWD9CKv8DCNMFv00euAK3qPXiS6s9zhN1x/V HSyR2vUFNJX208MWEzVbPLjHGnsN672Z2niDvli0DXQgDpsRBS+itQT7zzpvzczGKm9lxS8n lk8YP65s7JjRpaMuKbm4uMhTOPKiEe6C4a5hTtWRn2fPzcnOyswYOmRwepotdVBKclJigtVi NimCMyryueqCquYOaorbNXlysay7mqFoPk8R1FSo6i700VTZrhmmCzy98LzmJ57emKf3nCez qRNpYnGR6nOp2uFalxpls6b7IW+sdQVU7ZQhTzHkOww5BbLTiQaqL6u9VtVYUPVpdUvbw75g bXER60lKrHHVtCUWF1FPYhLEJEhapqurh2VWMEPgmb4JPZysKViiluOq9WnZLjRFN6LA19yq TZvu99XmOp2B4iKN1bS45mokT0oew4VqjGE0c41mMYZRO3DG0Wi92lPUH94QtdHcoCe51dXa 3OTXRDP68GlpHoxbq2Xe9FHWj1V0jjPZmvOtuSLsy+pQpXM4vEbV7p/uP69trlP2EAigD7Tl BXXBcB2G3oA7VS/P4hpfHfBrbDWGxMGywFhVbH2xU29BcL6qJbiqXe3h+UHcmpywRg03OiM5 Od4+/QTl+NRwo9/l1CpzXYHmWnvPEAo33Nib7VWzL7QUF/XY0mKB7RmUGheSU84X2hD0mM2Q DHcp1TeciyyTc3RdipOgpraomInfhTWNk6RtHIVbxuEG4AowtNJacUc6tISaYNg2QeqxRKaZ CmwuNfwlIQNcp/51oaY5rjEX2L4kaZR5ci7VNNZ8VtY8Hq2wUKaIpQb3FHOsMOpji4uWRrnL 1WXD97P8aKBpiG1zYEIJwu90yhu8Puqluahooen+WF2lubkR8pbgbM2D0tJ/1jJ0prSEzlrO NQ+6kMm75fcsDdWs7nN/qbaMwb72CRrL+C/mtpi9foarHkdj1RcOxrO2vvGCWswuA4q4wRaX tME1fpHLoZMSzxWGNXZCPuuC47I/WVMK8Gc2kro1arEiKw0NU+s0W3ByjAYSnc74M/P/NYrq Z2Qrg/3YLL4MbYInPtHYtLXyC+oXTC85LOobseVwnOzD4cQLbEi12CwvjTNkPD70nWqNRjPx ZBbgD58c4yQCuZoXIYOlEU+RoQ7kxqsXOObGGwVwyewsLqrDnhkO17nUunAw3BzVQ3Ndqs0V 7uPP8efCXT7sdrHEiep71+dqdRsCiFg7m4DHg1N1j4utnd7jZWtnzPL34ScOdW2jP8IZrwlW B3qGw+bvU4m8hpZLrVRKF1VWqJ5hkRFuNfxz+7xEIcOqGAqj3oJfNwxdzAk6Ri1RHtPZzvpx 6JSYzmvo5PrkHlPT6I/fFiMh5KOHHMI/VNCNPGPgYijySoZS/i9DPadBSqPIX2pATCg43VuI nGnOtAIQ/KpD36ui/3uvib4jVemHl/HjDpg+Ame/n7s4lMIwMEqPj2yW/5CZ1NBQ1XCZp2pR R/OCKY3/BxLU9TAKZW5kc3RyZWFtCmVuZG9iagoyNiAwIG9iago0NTM4CmVuZG9iagoyNyAw IG9iagooTWljcm9zb2Z0IFdvcmQgLSBUUkFOUykKZW5kb2JqCjI4IDAgb2JqCihNYWMgT1Mg WCAxMC4xMS42IFF1YXJ0eiBQREZDb250ZXh0KQplbmRvYmoKMjkgMCBvYmoKKFdvcmQpCmVu ZG9iagozMCAwIG9iagooRDoyMDE2MDcyNjE3MzAxNFowMCcwMCcpCmVuZG9iagozMSAwIG9i agooKQplbmRvYmoKMzIgMCBvYmoKWyBdCmVuZG9iagoxIDAgb2JqCjw8IC9UaXRsZSAyNyAw IFIgL1Byb2R1Y2VyIDI4IDAgUiAvQ3JlYXRvciAyOSAwIFIgL0NyZWF0aW9uRGF0ZSAzMCAw IFIgL01vZERhdGUKMzAgMCBSIC9LZXl3b3JkcyAzMSAwIFIgL0FBUEw6S2V5d29yZHMgMzIg MCBSID4+CmVuZG9iagp4cmVmCjAgMzMKMDAwMDAwMDAwMCA2NTUzNSBmIAowMDAwMDQ3MDEy IDAwMDAwIG4gCjAwMDAwMDQ2MjAgMDAwMDAgbiAKMDAwMDAxNzQyOCAwMDAwMCBuIAowMDAw MDAwMDIyIDAwMDAwIG4gCjAwMDAwMDQ2MDAgMDAwMDAgbiAKMDAwMDAwNDcyNCAwMDAwMCBu IAowMDAwMDA3NTY4IDAwMDAwIG4gCjAwMDAwMTc1NzUgMDAwMDAgbiAKMDAwMDA0MTczMyAw MDAwMCBuIAowMDAwMDA0ODMyIDAwMDAwIG4gCjAwMDAwMDc1NDcgMDAwMDAgbiAKMDAwMDAx MjI4OCAwMDAwMCBuIAowMDAwMDA3NjA0IDAwMDAwIG4gCjAwMDAwMTIyNjcgMDAwMDAgbiAK MDAwMDAxMjM5NSAwMDAwMCBuIAowMDAwMDE3MjEyIDAwMDAwIG4gCjAwMDAwMTI1MDQgMDAw MDAgbiAKMDAwMDAxNzE5MSAwMDAwMCBuIAowMDAwMDE3MzE5IDAwMDAwIG4gCjAwMDAwMTc1 MjUgMDAwMDAgbiAKMDAwMDAxODI0MyAwMDAwMCBuIAowMDAwMDE4NDg1IDAwMDAwIG4gCjAw MDAwNDE3MTEgMDAwMDAgbiAKMDAwMDA0MTkwNSAwMDAwMCBuIAowMDAwMDQyMTY1IDAwMDAw IG4gCjAwMDAwNDY3OTMgMDAwMDAgbiAKMDAwMDA0NjgxNCAwMDAwMCBuIAowMDAwMDQ2ODU1 IDAwMDAwIG4gCjAwMDAwNDY5MDggMDAwMDAgbiAKMDAwMDA0NjkzMSAwMDAwMCBuIAowMDAw MDQ2OTczIDAwMDAwIG4gCjAwMDAwNDY5OTIgMDAwMDAgbiAKdHJhaWxlcgo8PCAvU2l6ZSAz MyAvUm9vdCAyMCAwIFIgL0luZm8gMSAwIFIgL0lEIFsgPDIxMmUwM2M3NDg2NWNjOWJiOGYz MjE3NWM3Y2UxODRlPgo8MjEyZTAzYzc0ODY1Y2M5YmI4ZjMyMTc1YzdjZTE4NGU+IF0gPj4K c3RhcnR4cmVmCjQ3MTU2CiUlRU9GCg== --------------553674C3541578A274FF98EF-- From nobody Wed Jul 27 06:40:03 2016 Return-Path: X-Original-To: trans@ietf.org Delivered-To: trans@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E375B12D7D1; Wed, 27 Jul 2016 06:39:59 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.29.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160727133959.10509.23419.idtracker@ietfa.amsl.com> Date: Wed, 27 Jul 2016 06:39:59 -0700 Archived-At: Cc: trans@ietf.org Subject: [Trans] I-D Action: draft-ietf-trans-rfc6962-bis-18.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Jul 2016 13:40:00 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Public Notary Transparency of the IETF. Title : Certificate Transparency Authors : Ben Laurie Adam Langley Emilia Kasper Eran Messeri Rob Stradling Filename : draft-ietf-trans-rfc6962-bis-18.txt Pages : 55 Date : 2016-07-27 Abstract: This document describes a protocol for publicly logging the existence of Transport Layer Security (TLS) certificates as they are issued or observed, in a manner that allows anyone to audit certification authority (CA) activity and notice the issuance of suspect certificates as well as to audit the certificate logs themselves. The intent is that eventually clients would refuse to honor certificates that do not appear in a log, effectively forcing CAs to add all issued certificates to the logs. Logs are network services that implement the protocol operations for submissions and queries that are defined in this document. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-trans-rfc6962-bis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-18 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-trans-rfc6962-bis-18 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Jul 27 06:59:21 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 56F1212D803 for ; Wed, 27 Jul 2016 06:59:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.987 X-Spam-Level: X-Spam-Status: No, score=-3.987 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.287, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xIX20QQ6kSTL for ; Wed, 27 Jul 2016 06:59:18 -0700 (PDT) Received: from mail-wm0-x231.google.com (mail-wm0-x231.google.com [IPv6:2a00:1450:400c:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E32B012D801 for ; Wed, 27 Jul 2016 06:59:17 -0700 (PDT) Received: by mail-wm0-x231.google.com with SMTP id o80so63959385wme.1 for ; Wed, 27 Jul 2016 06:59:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=MNvRul9bwgg75u3Ulkh1o7YaKzvVm+rblj6CJdsg3Qs=; b=HH2Ukkt+URGgrNp+qb/YUQtUOgvvWGwh+kOv5IMNb/jaLZu6i6XNfDeQ5cpDFXFfnO iyK/KQTOhVcDt+y/rsHA+89BUiRYMmfKmXLiqg+Gixze07MaVWKIcbhNDXvK8KLZ4/G3 QB1/CUIhUUCmLtCoEUUDVgYuajQLTiHtD4riaG9tnvN+NClb8Ofzvve7aFRfgnCdqSCi WkAGbUYLobJMkxzpeiO6sutply4bw2jJUmZxSUyYMPqj50CwyWdmNz+0KTTjTrPFt17t /5dh1bC/84C+fcIWNNQTPOyglE37TEqeB2dx0PT7BfnHAmCE0oytkBCsJNtwQK9ETxN0 6yug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=MNvRul9bwgg75u3Ulkh1o7YaKzvVm+rblj6CJdsg3Qs=; b=IqjzGJIyMTLnxhO7hIVEaHjzCIw66q0Nbomy/MfgW5jQh+fKtSrZDdcK5YfDI5g54d 2c8ZvMoA4O0hrArYJblhAxH9DCDe9iARq8DFBXbnE3dZDaKK+kbyyxn4Jo/vpW48gUkE ivkmbH5EOnSZ36EsSlayZmwMAMsvSMoRacaPTO3qfq2036+JOBHVFkuiGvmx95QK/TtA T+RxerzyVA5HXepDxFvXKOCBTL2Bbp9/v9L4/pt+9gOwS9nIa8CTMlDgyZtZiemPx83R wvLiNMvUbmPcaNFXQJonjbcX4dnYiwE6A+Vc6eR57ZpKDlcdhVO8UuDUMRz6WvJwI6if jZrQ== X-Gm-Message-State: ALyK8tIuVERv/hS0C7o4KRl/k+5UaYF1M8UZPqD5vXZCsNuC7Zp2oEJEKy8cX+mJ+CD+MMgXlIcCKcZJmGnnCWGY X-Received: by 10.28.140.10 with SMTP id o10mr39197354wmd.36.1469627956140; Wed, 27 Jul 2016 06:59:16 -0700 (PDT) MIME-Version: 1.0 Received: by 10.28.168.216 with HTTP; Wed, 27 Jul 2016 06:59:15 -0700 (PDT) In-Reply-To: <20160727133959.10509.23419.idtracker@ietfa.amsl.com> References: <20160727133959.10509.23419.idtracker@ietfa.amsl.com> From: Eran Messeri Date: Wed, 27 Jul 2016 14:59:15 +0100 Message-ID: To: "trans@ietf.org" Content-Type: multipart/alternative; boundary=001a1146915247996a05389e6cee Archived-At: Cc: internet-drafts@ietf.org, i-d-announce@ietf.org Subject: Re: [Trans] I-D Action: draft-ietf-trans-rfc6962-bis-18.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Jul 2016 13:59:20 -0000 --001a1146915247996a05389e6cee Content-Type: text/plain; charset=UTF-8 Updates in the draft 18: - Fixing the specification of the REDACT function - it was incorrectly calling for the use of length-prefixed concatenation everywhere, but that is only necessary for the values that are concatenated for hashing. - Indicate that only DNS-ID labels can be redacted using the specified redaction mechanism (end of section 4.2.2. ) - Certificates with other types of fields of the subjectAltName extension that should not appear in public log should be logged under a name-constrained intermediate CA cert described in section 4.3 . On Wed, Jul 27, 2016 at 2:39 PM, wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Public Notary Transparency of the IETF. > > Title : Certificate Transparency > Authors : Ben Laurie > Adam Langley > Emilia Kasper > Eran Messeri > Rob Stradling > Filename : draft-ietf-trans-rfc6962-bis-18.txt > Pages : 55 > Date : 2016-07-27 > > Abstract: > This document describes a protocol for publicly logging the existence > of Transport Layer Security (TLS) certificates as they are issued or > observed, in a manner that allows anyone to audit certification > authority (CA) activity and notice the issuance of suspect > certificates as well as to audit the certificate logs themselves. > The intent is that eventually clients would refuse to honor > certificates that do not appear in a log, effectively forcing CAs to > add all issued certificates to the logs. > > Logs are network services that implement the protocol operations for > submissions and queries that are defined in this document. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-trans-rfc6962-bis/ > > There's also a htmlized version available at: > https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-18 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=draft-ietf-trans-rfc6962-bis-18 > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > --001a1146915247996a05389e6cee Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Updates in the draft 18:
- Fixing the specification of= the REDACT function - it was incorrectly calling for the use of length-pre= fixed concatenation everywhere, but that is only necessary for the values t= hat are concatenated for hashing.
- Indicate that only DNS-ID lab= els can be redacted using the specified redaction mechanism (end of section 4.2.2.)
- Certificates with other types of fields= of the subjectAltName extension that should not appear in public log shoul= d be logged under a name-constrained intermediate CA cert described in section 4.3.

On Wed, Jul 27, 2016 at 2:39 PM, <internet-drafts= @ietf.org> wrote:

A New Internet-Draft is available from the on-line Internet-Drafts director= ies.
This draft is a work item of the Public Notary Transparency=C2=A0 of the IE= TF.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Title=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= Certificate Transparency
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Authors=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0: Ben = Laurie
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Adam Langley
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Emilia Kasper
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Eran Messeri
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Rob Stradling
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Filename=C2=A0 =C2=A0 =C2=A0 =C2=A0 : draft-iet= f-trans-rfc6962-bis-18.txt
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Pages=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= 55
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Date=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 := 2016-07-27

Abstract:
=C2=A0 =C2=A0This document describes a protocol for publicly logging the ex= istence
=C2=A0 =C2=A0of Transport Layer Security (TLS) certificates as they are iss= ued or
=C2=A0 =C2=A0observed, in a manner that allows anyone to audit certificatio= n
=C2=A0 =C2=A0authority (CA) activity and notice the issuance of suspect
=C2=A0 =C2=A0certificates as well as to audit the certificate logs themselv= es.
=C2=A0 =C2=A0The intent is that eventually clients would refuse to honor =C2=A0 =C2=A0certificates that do not appear in a log, effectively forcing = CAs to
=C2=A0 =C2=A0add all issued certificates to the logs.

=C2=A0 =C2=A0Logs are network services that implement the protocol operatio= ns for
=C2=A0 =C2=A0submissions and queries that are defined in this document.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft= -ietf-trans-rfc6962-bis/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-tr= ans-rfc6962-bis-18

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2= =3Ddraft-ietf-trans-rfc6962-bis-18


Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
Trans mailing list
Trans@ietf.org
https://www.ietf.org/mailman/listinfo/trans

--001a1146915247996a05389e6cee-- From nobody Wed Jul 27 07:36:49 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1747C12DAFF for ; Wed, 27 Jul 2016 07:36:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.187 X-Spam-Level: X-Spam-Status: No, score=-3.187 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.287] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5x2hqfH_Di54 for ; Wed, 27 Jul 2016 07:36:46 -0700 (PDT) Received: from durif.tools.ietf.org (durif.tools.ietf.org [IPv6:2001:1900:3001:11::3d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C7A7012DAD2 for ; Wed, 27 Jul 2016 07:36:46 -0700 (PDT) Received: from localhost ([::1]:49521 helo=durif.tools.ietf.org) by durif.tools.ietf.org with esmtp (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1bSPwv-0003Re-C4; Wed, 27 Jul 2016 07:36:41 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "trans issue tracker" X-Trac-Version: 0.12.5 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.5, by Edgewall Software To: rob.stradling@comodo.com, benl@google.com, eranm@google.com, melinda.shore@gmail.com X-Trac-Project: trans Date: Wed, 27 Jul 2016 14:36:41 -0000 X-URL: https://tools.ietf.org/trans/ X-Trac-Ticket-URL: https://trac.tools.ietf.org/wg/trans/trac/ticket/111#comment:6 Message-ID: <080.2ef511a0bbb85fab222533101d4113fc@tools.ietf.org> References: <065.0226a5b84d88bdfc7c9b20fa02c5a3aa@tools.ietf.org> X-Trac-Ticket-ID: 111 In-Reply-To: <065.0226a5b84d88bdfc7c9b20fa02c5a3aa@tools.ietf.org> X-SA-Exim-Connect-IP: ::1 X-SA-Exim-Rcpt-To: rob.stradling@comodo.com, benl@google.com, eranm@google.com, melinda.shore@gmail.com, trans@ietf.org X-SA-Exim-Mail-From: trac+trans@tools.ietf.org X-SA-Exim-Scanned: No (on durif.tools.ietf.org); SAEximRunCond expanded to false Archived-At: Cc: trans@ietf.org Subject: Re: [Trans] [trans] #111 (to-be-decided): Consider using the cached-info TLS extension X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Jul 2016 14:36:48 -0000 #111: Consider using the cached-info TLS extension Comment (by rob.stradling@comodo.com): I'd like to tackle this in 6962-bis. The original idea in this ticket (i.e. a TLS client sends hashes of SCTs that it has previously seen and cached) seems sub-optimal, in terms of bytes on the wire. So here's what I think is a better approach: When a TLS client uses the cached-info extension to inform a TLS server of 1 or more certs it has cached, the TLS client may also indicate (via a boolean flag) whether or not it has already verified that each cert is "CT compliant" (according to the TLS client's own policies). One approach would be to have a list of boolean flags that corresponds to the list of 1 or more "cert" cached-info records. A simpler approach (which I think would be sufficient) would be to have a single boolean flag that is only set to "true" if all of the (1 or more) cached certs is already deemed by the TLS client to be "CT compliant". This boolean flag could be passed in the transparency_info extension, but I'm not sure it'd be wise to create that sort of interdependency between transparency_info and cached_info. So I suggest that we define a new CachedInformationType so that TLS clients can send this boolean flag via cached_info. Any comments on this proposal? -- -------------------------------------+------------------------------------- Reporter: | Owner: rob.stradling@comodo.com | rob.stradling@comodo.com Type: enhancement | Status: new Priority: minor | Milestone: Component: to-be-decided | Version: Severity: - | Resolution: Keywords: | -------------------------------------+------------------------------------- Ticket URL: trans From nobody Wed Jul 27 10:28:49 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DCBB912D196 for ; Wed, 27 Jul 2016 10:28:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0zEquVnsubHz for ; Wed, 27 Jul 2016 10:28:44 -0700 (PDT) Received: from mail-pf0-x22c.google.com (mail-pf0-x22c.google.com [IPv6:2607:f8b0:400e:c00::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 503C012D108 for ; Wed, 27 Jul 2016 10:28:41 -0700 (PDT) Received: by mail-pf0-x22c.google.com with SMTP id x72so12905964pfd.2 for ; Wed, 27 Jul 2016 10:28:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding; bh=JFFVL/79zS5cI7LAAmGoGbvaFZ/0YkcrfpZwCbIXvSU=; b=PN77Ww9AppINv3RHBlIY0bV53eObd9xDLLZFpPNeVBiIem/8cjnePRip1P8/E9redr JKGk12kim7j6AbZWT/NwIbYRLyG75fvMVgSeiBLWMlLCDRUgYVx+H+WKcNlJ3ZeCIXFC +fmg/1rl5D1HETPMkjhDsUK1UjW1/vGSBgTPlNd7d8DIPINvPff2eKN0rZ/dRZIINibq 2n8AtIwBiC6NR5NTX+mdPTybplgjGMtXTpvtMArOJ+ya+84AshRoxt1dbmo6FBVBbIHe vX32IuJEEhw+OZ7z+RtJkm8rKzRJR/296jWIxFBuRwSwkEb4KxcVfT677ASJuYye1REo ygOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=JFFVL/79zS5cI7LAAmGoGbvaFZ/0YkcrfpZwCbIXvSU=; b=T1ln8wD34JwuTpIQOURG6cHyt3JU50+Eq9AWrM8fEk01L+Pts/KDdhAENQ5a4wPO5P BIubWaQ5hkmmPDKc6RospwMC5X2dH+7BgEwaGAk021DH5zZaYs7IPGlpHejdKrsU764j AkjOMAlSca1SIEbZCbL75A/9ANyR2bbE1/Fo9A269wErKkuhoK9aPUQwJiedeNjNJ7/7 GlitryWkAMGcYUVfwNODHK2hvKw26B7tmfpUl5rmYqSkiu8wRv9MKX1kIYj7ViU64+bo sIyEcAH3C5FHMPRkjA6OYHdKqQhVSzxcKh7krmBR4xd/mHHekHDiZVZnLOt5xehsSiSd AuqQ== X-Gm-Message-State: AEkooutR9QwgsrWCIX/3c2BD0z5gxKX729tLap7MNohCbXTYveHgIxEq3GFnVgNCFKzATg== X-Received: by 10.98.64.93 with SMTP id n90mr52041829pfa.29.1469640520637; Wed, 27 Jul 2016 10:28:40 -0700 (PDT) Received: from Melindas-MacBook-Pro.local (63-140-103-60-radius.dynamic.acsalaska.net. [63.140.103.60]) by smtp.googlemail.com with ESMTPSA id ty6sm10720104pac.18.2016.07.27.10.28.39 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 27 Jul 2016 10:28:40 -0700 (PDT) To: trans@ietf.org References: <20160727133959.10509.23419.idtracker@ietfa.amsl.com> From: Melinda Shore Message-ID: Date: Wed, 27 Jul 2016 09:28:32 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Trans] I-D Action: draft-ietf-trans-rfc6962-bis-18.txt X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Jul 2016 17:28:46 -0000 Hi, all: Please take a look at the draft and let us know if your concerns have been addressed, as we'll be restarting working group last call soon. Thanks, Melinda On 7/27/16 5:59 AM, Eran Messeri wrote: > Updates in the draft 18: > - Fixing the specification of the REDACT function - it was incorrectly > calling for the use of length-prefixed concatenation everywhere, but > that is only necessary for the values that are concatenated for hashing. > - Indicate that only DNS-ID labels can be redacted using the specified > redaction mechanism (end of section 4.2.2. > ) > - Certificates with other types of fields of the subjectAltName > extension that should not appear in public log should be logged under a > name-constrained intermediate CA cert described in section 4.3 > . > > On Wed, Jul 27, 2016 at 2:39 PM, > wrote: > > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Public Notary Transparency of the > IETF. > > Title : Certificate Transparency > Authors : Ben Laurie > Adam Langley > Emilia Kasper > Eran Messeri > Rob Stradling > Filename : draft-ietf-trans-rfc6962-bis-18.txt > Pages : 55 > Date : 2016-07-27 > > Abstract: > This document describes a protocol for publicly logging the existence > of Transport Layer Security (TLS) certificates as they are issued or > observed, in a manner that allows anyone to audit certification > authority (CA) activity and notice the issuance of suspect > certificates as well as to audit the certificate logs themselves. > The intent is that eventually clients would refuse to honor > certificates that do not appear in a log, effectively forcing CAs to > add all issued certificates to the logs. > > Logs are network services that implement the protocol operations for > submissions and queries that are defined in this document. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-trans-rfc6962-bis/ > > There's also a htmlized version available at: > https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-18 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=draft-ietf-trans-rfc6962-bis-18 > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org > . > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > > > > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > From nobody Wed Jul 27 10:30:15 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38FAC12D518 for ; Wed, 27 Jul 2016 10:29:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X1oxc1Vkxllr for ; Wed, 27 Jul 2016 10:29:45 -0700 (PDT) Received: from mail-pf0-x230.google.com (mail-pf0-x230.google.com [IPv6:2607:f8b0:400e:c00::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7486E12D672 for ; Wed, 27 Jul 2016 10:29:45 -0700 (PDT) Received: by mail-pf0-x230.google.com with SMTP id p64so12900527pfb.1 for ; Wed, 27 Jul 2016 10:29:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding; bh=/LyspATOLhTkZHSk8/Ycs8NfG7LbKkS+vXUyNsTK5t4=; b=pARLCnWP5Kt2PPJH0DBWL+2HsDHq4WrT4P3PxCwWwYw2IFpF9OI3fKtGwYOhG6mhwx K7v3ylmWSKvzVc2i3S9tbm2iVt0+YwBtZ5FccXQVKtCfHV20qvutBDOdWH4EUIEqLf79 UPUs8VOID69XgRWX08N73gK/9LEtjbmNepZ5bA1ITuxi8lJlcsPqG6qlObLe8OdNpL27 jSyX/nEsVVR9ejjlWg2XMpAEvBWCpydwWas0WwKSjmGQHgSmYl1pYLZiGzlzoaqmFLbx v6q0g9Tf+xJMfUtTrN5eFA5WeOsbHbL1IITAm1rDWMBNeuxthKZ5AvTYApR4Ypr64DEy sAIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=/LyspATOLhTkZHSk8/Ycs8NfG7LbKkS+vXUyNsTK5t4=; b=SFbuBZAHDpukD11BM8nSaXQblHxhf/l1GqN9Fbq+rP0pWJC8RvEc3le7YNZkpYwwzX s3O3ZhS4tQap5ly1YCrp1APfjBnk+GvOkVKx7hHi4OBfLdEARq2xc3oh4MexZxeTW+6F Ch8Eht7vxP8zCd8itFVSPBy0Z6A7gqZW7YQ5cJSWqj7VjsRz3bB3R/DTePvhwAjJKeFW 5Na42eTHln3OMxK0gIyBNLBu+pMO6pqjmty+n3KC2Lvgb5Lx+2yu9NyV+OFPaeSf+r7H 8iQwcvCkY1QTpyLJOBaZQ0MdWQA3EH+UtjSlF77jy8gDUnHpUnoTILudcIMDglMXolwz rrEg== X-Gm-Message-State: AEkoouvzjXnScz+0IPzSnbqpvZY9itrt5ee+RD0C+sxjt8oQ02m6RkBh00ulYO9JboY1Pw== X-Received: by 10.98.93.204 with SMTP id n73mr51357564pfj.87.1469640584838; Wed, 27 Jul 2016 10:29:44 -0700 (PDT) Received: from Melindas-MacBook-Pro.local (63-140-103-60-radius.dynamic.acsalaska.net. [63.140.103.60]) by smtp.googlemail.com with ESMTPSA id i7sm10762389paf.9.2016.07.27.10.29.43 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 27 Jul 2016 10:29:43 -0700 (PDT) To: trans@ietf.org References: <87poroap4u.fsf@alice.fifthhorseman.net> <4826e966-de00-3d8d-1079-d9d21bdc16c8@bbn.com> From: Melinda Shore Message-ID: <6c1e8d74-3aa9-8990-25e8-37da4bc6c648@gmail.com> Date: Wed, 27 Jul 2016 09:29:42 -0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <4826e966-de00-3d8d-1079-d9d21bdc16c8@bbn.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Trans] threat analysis v06 review X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Jul 2016 17:29:47 -0000 Hi, all: Please take a look at the revised document and let us know if your concerns have or have not been addressed, and we'll be restarting working group last call shortly. Thanks, Melinda On 7/26/16 9:45 AM, Stephen Kent wrote: > DKG, > > Thanks for the review and detailed comments. > > In response to your comments I made the fallowing changes: > > - added reference to the gossip doc in the introduction > > - removed all use of the term "doppelganger" > > - adopted the terminology you used in your example: CA-A and CA-B (same > name, same key pair) and bogus cert X. > > - revised text to note that the two CA instances that appear as issuer > of the bogus EE cert need not have different trust anchor ancestors. > > - revised text to include a scenario in which one CA is compromised and > caused to issue the bogus cert (which is logged and, maybe revoked) > while the second instance of the CA is malicious and has a parent that > may be malicious or may have been tricked or attacked, etc. > > - revised the title of 3.3 to reflect the broader range of scenarios as > per your example > > I did not explore the potential for logs to discriminate wrt the certs > they log. I also did not discuss possible enhancements to the Monitor > function to detect AIA manipulation and the like. > > I did not discuss in greater detail the non-standard mechanisms that may > be used by browsers to deal with revocation. I think it suffices to note > that such mechanisms may use cert hashes or keys to identify revoked > certs, and that such approaches are not path-specific. > > I retained the discussion of how OCSP or CRLs and AIA extensions might > be used to prevent a browser from learning about the true revocation > status of a bogus cert. Yes, these are not vulnerabilities of CT per se, > but they are part of the standards-based ecosystem in which CT operates. > > I have attached a PDF showing the revised text in 3.3, where most of the > changes were made. > > Steve > > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > From nobody Wed Jul 27 12:19:26 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 234E012D0A5 for ; Wed, 27 Jul 2016 12:19:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.764 X-Spam-Level: X-Spam-Status: No, score=-4.764 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.723, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-1.287, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v0v7CLqRbkPf for ; Wed, 27 Jul 2016 12:19:23 -0700 (PDT) Received: from wsget2.nist.gov (wsget2.nist.gov [IPv6:2610:20:6005:13::151]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E863712B053 for ; Wed, 27 Jul 2016 12:19:22 -0700 (PDT) Received: from WSXGHUB1.xchange.nist.gov (129.6.18.96) by wsget2.nist.gov (129.6.13.151) with Microsoft SMTP Server (TLS) id 14.3.301.0; Wed, 27 Jul 2016 15:19:05 -0400 Received: from postmark.nist.gov (129.6.16.94) by WSXGHUB1.xchange.nist.gov (129.6.18.96) with Microsoft SMTP Server (TLS) id 8.3.465.0; Wed, 27 Jul 2016 15:19:20 -0400 Received: from [129.6.54.72] (st26.ncsl.nist.gov [129.6.54.72]) by postmark.nist.gov (8.13.8/8.13.1) with ESMTP id u6RJJDZc006620; Wed, 27 Jul 2016 15:19:13 -0400 To: Melinda Shore References: <87poroap4u.fsf@alice.fifthhorseman.net> <4826e966-de00-3d8d-1079-d9d21bdc16c8@bbn.com> <6c1e8d74-3aa9-8990-25e8-37da4bc6c648@gmail.com> From: "David A. Cooper" Message-ID: Date: Wed, 27 Jul 2016 15:19:13 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <6c1e8d74-3aa9-8990-25e8-37da4bc6c648@gmail.com> Content-Type: text/html; charset="windows-1252" Content-Transfer-Encoding: 8bit X-NIST-MailScanner-Information: Archived-At: Cc: trans@ietf.org Subject: Re: [Trans] threat analysis v06 review X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Jul 2016 19:19:25 -0000
Unfortunately, I must yet again point out that there has still been no attempt to address the issues that I and a few others have pointed out with this document.

I have explained on multiple occasions that it is both technically incorrect and confusing to refer to the attack as involving two CAs with the same name and key.

On May 19, Bryan Ford sent a message saying:
I agree with David Cooper that describing this as “two CAs” is rather strange given the assumption that they have “the same Subject name and public key”.  I would call that “One Malicious CA with Two Certificate Chains” or something like that.

On June 10, DKG wrote that:
This paragraph seems wrong to me.  The compromised CAs in question are
*not* the same CA, though they do need to create at least one "doubled"
intermediate CA that shares at least the same key (and likely, the same
Subject).

Perhaps it would be better to think about "compromised CA keys" instead
of "compromised CAs", and leave the mechanism of compromise out of the
technical discussion?

While it is clear that Steve Kent very much wants the text to remain as it is, technical correctness and the WG consensus needs to take priority over the personal preferences of the editor.

On 07/27/2016 01:29 PM, Melinda Shore wrote:
Hi, all:

Please take a look at the revised document and let us
know if your concerns have or have not been addressed,
and we'll be restarting working group last call shortly.

Thanks,

Melinda


On 7/26/16 9:45 AM, Stephen Kent wrote:
DKG,

Thanks for the review and detailed comments.

In response to your comments I made the fallowing changes:

- added reference to the gossip doc in the introduction

- removed all use of the term "doppelganger"

- adopted the terminology you used in your example: CA-A and CA-B (same
name, same key pair) and bogus cert X.

- revised text to note that the two CA instances that appear as issuer
of the bogus EE cert need not have different trust anchor ancestors.

- revised text to include a scenario in which one CA is compromised and
caused to issue the bogus cert (which is logged and, maybe revoked)
while the second instance of the CA is malicious and has a parent that
may be malicious or may have been tricked or attacked, etc.

- revised the title of 3.3 to reflect the broader range of scenarios as
per your example

I did not explore the potential for logs to discriminate wrt the certs
they log. I also did not discuss possible enhancements to the Monitor
function to detect AIA manipulation and the like.

I did not discuss in greater detail the non-standard mechanisms that may
be used by browsers to deal with revocation. I think it suffices to note
that such mechanisms may use cert hashes or keys to identify revoked
certs, and that such approaches are not path-specific.

I retained the discussion of how OCSP or CRLs and AIA extensions might
be used to prevent a browser from learning about the true revocation
status of a bogus cert. Yes, these are not vulnerabilities of CT per se,
but they are part of the standards-based ecosystem in which CT operates.

I have attached a PDF showing the revised text in 3.3, where most of the
changes were made.

Steve


_______________________________________________
Trans mailing list
Trans@ietf.org
https://www.ietf.org/mailman/listinfo/trans


_______________________________________________
Trans mailing list
Trans@ietf.org
https://www.ietf.org/mailman/listinfo/trans


From nobody Thu Jul 28 00:22:00 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E37F212D15F for ; Thu, 28 Jul 2016 00:21:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.619 X-Spam-Level: X-Spam-Status: No, score=-2.619 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c1VdTb_PmN4e for ; Thu, 28 Jul 2016 00:21:56 -0700 (PDT) Received: from ipxbno.tcif.telstra.com.au (ipxbno.tcif.telstra.com.au [203.35.82.204]) by ietfa.amsl.com (Postfix) with ESMTP id 8915112D08D for ; Thu, 28 Jul 2016 00:21:54 -0700 (PDT) X-IronPort-AV: E=Sophos; i="5.28,433,1464616800"; d="scan'208,217"; a="92021826" Received: from unknown (HELO ipcbni.tcif.telstra.com.au) ([10.97.216.204]) by ipobni.tcif.telstra.com.au with ESMTP; 28 Jul 2016 16:35:36 +1000 X-IronPort-AV: E=McAfee;i="5700,7163,8239"; a="158132429" Received: from wsmsg3703.srv.dir.telstra.com ([172.49.40.171]) by ipcbni.tcif.telstra.com.au with ESMTP; 28 Jul 2016 16:35:36 +1000 Received: from WSMSG3153V.srv.dir.telstra.com ([172.49.40.160]) by wsmsg3703.srv.dir.telstra.com ([fe80::9c60:bf5:3f86:2ec%11]) with mapi; Thu, 28 Jul 2016 16:35:36 +1000 From: "Manger, James" To: "trans@ietf.org" Date: Thu, 28 Jul 2016 16:35:35 +1000 Thread-Topic: [Trans] draft-ietf-trans-rfc6962-bis-18.txt - Redaction limitation Thread-Index: AdHomiIUGZB7KrnsRm2k/+YpR9d/Cg== Message-ID: <255B9BB34FB7D647A506DC292726F6E13BFC28CB2C@WSMSG3153V.srv.dir.telstra.com> Accept-Language: en-US, en-AU Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US, en-AU Content-Type: multipart/alternative; boundary="_000_255B9BB34FB7D647A506DC292726F6E13BFC28CB2CWSMSG3153Vsrv_" MIME-Version: 1.0 Archived-At: Subject: [Trans] draft-ietf-trans-rfc6962-bis-18.txt - Redaction limitation X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jul 2016 07:21:59 -0000 --_000_255B9BB34FB7D647A506DC292726F6E13BFC28CB2CWSMSG3153Vsrv_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhlIHJlZGFjdGlvbiBtZWNoYW5pc20gaW4gZHJhZnQtaWV0Zi10cmFucy1yZmM2OTYyLWJpcy0x OCBoaWRlcyBhIEROUyBsYWJlbCBieSByZXBsYWNpbmcgaXQgd2l0aCBIQVNIKCBrZXktaWQgKyBs YWJlbCkgaW4gYSBsb2dnZWQgcHJlLWNlcnRpZmljYXRlLiBUaGUga2V5LWlkIGFwcGVhcnMgaW4g dGhlIHByZS1jZXJ0aWZpY2F0ZSBzbyBhbnlvbmUgY2FuIGRvIGEgZGljdGlvbmFyeSBhdHRhY2s6 IHNlZSBhIHByZWNlcnRpZmljYXRlIGluIGEgbG9nLCB0aGVuIHRyeSBwb3NzaWJsZSBsYWJlbHMg dW50aWwgdGhlIGhhc2ggbWF0Y2hlcy4gSWYgeW91IHdhbnRlZCB0byByZWRhY3QsIHNheSwgOC1k aWdpdCBjdXN0b21lciBpZHMgdXNlZCBhcyBETlMgbGFiZWxzIGl0IHdvdWxkIG9ubHkgdGFrZSBz ZWNvbmRzIGZvciBhbnlvbmUgdG8gdW5kbyBhIHJlZGFjdGlvbiBieSBjYWxjdWxhdGluZyBhIDEw MCBtaWxsaW9uIGhhc2hlcy4NCg0KSXMgdGhpcyB0aGUgYmVzdCB3ZSBjYW4gZG8/DQpJcyB0aGlz IHRoZSBiZXN0IHdlIHdhbnQgdG8gZG8gKGVnIHNvIGEgZG9tYWluIG93bmVyIGNhbiBkbyB0aGUg ZGljdGlvbmFyeSBhdHRhY2sgd2l0aCBhbGwgdGhlIGxhYmVscyB0aGUgZG9tYWluIHVzZXMgaWYg dGhleSBzZWUgYW4gdW5leHBlY3RlZCBwcmUtY2VydGlmaWNhdGUpPw0KDQpJZiB0aGlzIGlzIHNv LCBJIHRoaW5rIHRoaXMgbGltaXRhdGlvbiBuZWVkcyB0byBiZSBzdGF0ZWQgY2xlYXJseSBpbiDC pzQg4oCcUHJpdmF0ZSBEb21haW4gTmFtZSBMYWJlbHPigJ0sIGFuZCDCpzEzIOKAnFNlY3VyaXR5 IENvbnNpZGVyYXRpb25z4oCdLiBQZXJoYXBzOiDigJxSZWRhY3Rpb24gY2FuIG9iZnVzY2F0ZSBh IGRvbWFpbiBuYW1lIGxhYmVsLCBidXQgaWYgaXQgaXMgZmVhc2libGUgdG8gZW51bWVyYXRlIGFs bCBwb3NzaWJsZSBsYWJlbHMgKGJlY2F1c2UgdGhleSBkb27igJl0IGhhdmUgc3VmZmljaWVudCBl bnRyb3B5KSB0aGVuIHRoZSByZWRhY3RlZCBsYWJlbCBjYW4gYmUgcmVjb3ZlcmVk4oCdLg0KDQpJ ZiB0aGlzIGlzIG5vdCBzbywgdXNpbmcgSEFTSChzYWx0ICsgbGFiZWwpIGZvciByZWRhY3Rpb24g c2hvdWxkIHdvcms7IHdoZXJlIHRoZSBzYWx0IGlzIGNvbnZleWVkIGluIGEgY2VydGlmaWNhdGUg ZXh0ZW5zaW9uIHRoYXQgaXMgcmVtb3ZlZCB3aGVuIGNvbnN0cnVjdGluZyB0aGUgcHJlLWNlcnRp ZmljYXRlIFthcyBzb21lb25lIGVsc2Ugc3VnZ2VzdGVkXS4NCg0KLS0NCkphbWVzIE1hbmdlcg0K DQoNCg0KRnJvbTogVHJhbnMgW21haWx0bzp0cmFucy1ib3VuY2VzQGlldGYub3JnXSBPbiBCZWhh bGYgT2YgRXJhbiBNZXNzZXJpDQpTZW50OiBXZWRuZXNkYXksIDI3IEp1bHkgMjAxNiAxMTo1OSBQ TQ0KVG86IHRyYW5zQGlldGYub3JnDQpDYzogaW50ZXJuZXQtZHJhZnRzQGlldGYub3JnOyBpLWQt YW5ub3VuY2VAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbVHJhbnNdIEktRCBBY3Rpb246IGRyYWZ0 LWlldGYtdHJhbnMtcmZjNjk2Mi1iaXMtMTgudHh0DQoNClVwZGF0ZXMgaW4gdGhlIGRyYWZ0IDE4 Og0KLSBGaXhpbmcgdGhlIHNwZWNpZmljYXRpb24gb2YgdGhlIFJFREFDVCBmdW5jdGlvbiAtIGl0 IHdhcyBpbmNvcnJlY3RseSBjYWxsaW5nIGZvciB0aGUgdXNlIG9mIGxlbmd0aC1wcmVmaXhlZCBj b25jYXRlbmF0aW9uIGV2ZXJ5d2hlcmUsIGJ1dCB0aGF0IGlzIG9ubHkgbmVjZXNzYXJ5IGZvciB0 aGUgdmFsdWVzIHRoYXQgYXJlIGNvbmNhdGVuYXRlZCBmb3IgaGFzaGluZy4NCi0gSW5kaWNhdGUg dGhhdCBvbmx5IEROUy1JRCBsYWJlbHMgY2FuIGJlIHJlZGFjdGVkIHVzaW5nIHRoZSBzcGVjaWZp ZWQgcmVkYWN0aW9uIG1lY2hhbmlzbSAoZW5kIG9mIHNlY3Rpb24gNC4yLjIuPGh0dHBzOi8vdG9v bHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRyYW5zLXJmYzY5NjItYmlzLTE4I3NlY3Rpb24t NC4yLjI+KQ0KLSBDZXJ0aWZpY2F0ZXMgd2l0aCBvdGhlciB0eXBlcyBvZiBmaWVsZHMgb2YgdGhl IHN1YmplY3RBbHROYW1lIGV4dGVuc2lvbiB0aGF0IHNob3VsZCBub3QgYXBwZWFyIGluIHB1Ymxp YyBsb2cgc2hvdWxkIGJlIGxvZ2dlZCB1bmRlciBhIG5hbWUtY29uc3RyYWluZWQgaW50ZXJtZWRp YXRlIENBIGNlcnQgZGVzY3JpYmVkIGluIHNlY3Rpb24gNC4zPGh0dHBzOi8vdG9vbHMuaWV0Zi5v cmcvaHRtbC9kcmFmdC1pZXRmLXRyYW5zLXJmYzY5NjItYmlzLTE4I3NlY3Rpb24tNC4zPi4NCg0K T24gV2VkLCBKdWwgMjcsIDIwMTYgYXQgMjozOSBQTSwgPGludGVybmV0LWRyYWZ0c0BpZXRmLm9y ZzxtYWlsdG86aW50ZXJuZXQtZHJhZnRzQGlldGYub3JnPj4gd3JvdGU6DQoNCkEgTmV3IEludGVy bmV0LURyYWZ0IGlzIGF2YWlsYWJsZSBmcm9tIHRoZSBvbi1saW5lIEludGVybmV0LURyYWZ0cyBk aXJlY3Rvcmllcy4NClRoaXMgZHJhZnQgaXMgYSB3b3JrIGl0ZW0gb2YgdGhlIFB1YmxpYyBOb3Rh cnkgVHJhbnNwYXJlbmN5ICBvZiB0aGUgSUVURi4NCg0KICAgICAgICBUaXRsZSAgICAgICAgICAg OiBDZXJ0aWZpY2F0ZSBUcmFuc3BhcmVuY3kNCiAgICAgICAgQXV0aG9ycyAgICAgICAgIDogQmVu IExhdXJpZQ0KICAgICAgICAgICAgICAgICAgICAgICAgICBBZGFtIExhbmdsZXkNCiAgICAgICAg ICAgICAgICAgICAgICAgICAgRW1pbGlhIEthc3Blcg0KICAgICAgICAgICAgICAgICAgICAgICAg ICBFcmFuIE1lc3NlcmkNCiAgICAgICAgICAgICAgICAgICAgICAgICAgUm9iIFN0cmFkbGluZw0K ICAgICAgICBGaWxlbmFtZSAgICAgICAgOiBkcmFmdC1pZXRmLXRyYW5zLXJmYzY5NjItYmlzLTE4 LnR4dA0KICAgICAgICBQYWdlcyAgICAgICAgICAgOiA1NQ0KICAgICAgICBEYXRlICAgICAgICAg ICAgOiAyMDE2LTA3LTI3DQoNCkFic3RyYWN0Og0KICAgVGhpcyBkb2N1bWVudCBkZXNjcmliZXMg YSBwcm90b2NvbCBmb3IgcHVibGljbHkgbG9nZ2luZyB0aGUgZXhpc3RlbmNlDQogICBvZiBUcmFu c3BvcnQgTGF5ZXIgU2VjdXJpdHkgKFRMUykgY2VydGlmaWNhdGVzIGFzIHRoZXkgYXJlIGlzc3Vl ZCBvcg0KICAgb2JzZXJ2ZWQsIGluIGEgbWFubmVyIHRoYXQgYWxsb3dzIGFueW9uZSB0byBhdWRp dCBjZXJ0aWZpY2F0aW9uDQogICBhdXRob3JpdHkgKENBKSBhY3Rpdml0eSBhbmQgbm90aWNlIHRo ZSBpc3N1YW5jZSBvZiBzdXNwZWN0DQogICBjZXJ0aWZpY2F0ZXMgYXMgd2VsbCBhcyB0byBhdWRp dCB0aGUgY2VydGlmaWNhdGUgbG9ncyB0aGVtc2VsdmVzLg0KICAgVGhlIGludGVudCBpcyB0aGF0 IGV2ZW50dWFsbHkgY2xpZW50cyB3b3VsZCByZWZ1c2UgdG8gaG9ub3INCiAgIGNlcnRpZmljYXRl cyB0aGF0IGRvIG5vdCBhcHBlYXIgaW4gYSBsb2csIGVmZmVjdGl2ZWx5IGZvcmNpbmcgQ0FzIHRv DQogICBhZGQgYWxsIGlzc3VlZCBjZXJ0aWZpY2F0ZXMgdG8gdGhlIGxvZ3MuDQoNCiAgIExvZ3Mg YXJlIG5ldHdvcmsgc2VydmljZXMgdGhhdCBpbXBsZW1lbnQgdGhlIHByb3RvY29sIG9wZXJhdGlv bnMgZm9yDQogICBzdWJtaXNzaW9ucyBhbmQgcXVlcmllcyB0aGF0IGFyZSBkZWZpbmVkIGluIHRo aXMgZG9jdW1lbnQuDQoNCg0KVGhlIElFVEYgZGF0YXRyYWNrZXIgc3RhdHVzIHBhZ2UgZm9yIHRo aXMgZHJhZnQgaXM6DQpodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1pZXRm LXRyYW5zLXJmYzY5NjItYmlzLw0KDQpUaGVyZSdzIGFsc28gYSBodG1saXplZCB2ZXJzaW9uIGF2 YWlsYWJsZSBhdDoNCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRyYW5z LXJmYzY5NjItYmlzLTE4DQoNCkEgZGlmZiBmcm9tIHRoZSBwcmV2aW91cyB2ZXJzaW9uIGlzIGF2 YWlsYWJsZSBhdDoNCmh0dHBzOi8vd3d3LmlldGYub3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1pZXRm LXRyYW5zLXJmYzY5NjItYmlzLTE4DQoNCg0KUGxlYXNlIG5vdGUgdGhhdCBpdCBtYXkgdGFrZSBh IGNvdXBsZSBvZiBtaW51dGVzIGZyb20gdGhlIHRpbWUgb2Ygc3VibWlzc2lvbg0KdW50aWwgdGhl IGh0bWxpemVkIHZlcnNpb24gYW5kIGRpZmYgYXJlIGF2YWlsYWJsZSBhdCB0b29scy5pZXRmLm9y ZzxodHRwOi8vdG9vbHMuaWV0Zi5vcmc+Lg0KDQpJbnRlcm5ldC1EcmFmdHMgYXJlIGFsc28gYXZh aWxhYmxlIGJ5IGFub255bW91cyBGVFAgYXQ6DQpmdHA6Ly9mdHAuaWV0Zi5vcmcvaW50ZXJuZXQt ZHJhZnRzLw0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xw0KVHJhbnMgbWFpbGluZyBsaXN0DQpUcmFuc0BpZXRmLm9yZzxtYWlsdG86VHJhbnNAaWV0Zi5v cmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3RyYW5zDQoNCg== --_000_255B9BB34FB7D647A506DC292726F6E13BFC28CB2CWSMSG3153Vsrv_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj1Db250ZW50LVR5cGUgY29udGVu dD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij48bWV0YSBuYW1lPUdlbmVyYXRvciBjb250ZW50 PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQgbWVkaXVtKSI+PHN0eWxlPjwhLS0NCi8qIEZv bnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0 aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5 bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3Jt YWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEy LjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQphOmxpbmssIHNw YW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0K CXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlu a0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4 dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpzcGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUt dHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsN Cgljb2xvcjojMUY0OTdEO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9y dC1vbmx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCW1zby1mYXJlYXN0 LWxhbmd1YWdlOkVOLVVTO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzky LjBwdDsNCgltYXJnaW46NzIuMHB0IDcyLjBwdCA3Mi4wcHQgNzIuMHB0O30NCmRpdi5Xb3JkU2Vj dGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28g OV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+ DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5 b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9v OnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPjwvaGVhZD48Ym9keSBsYW5nPUVOLUFVIGxp bms9Ymx1ZSB2bGluaz1wdXJwbGU+PGRpdiBjbGFzcz1Xb3JkU2VjdGlvbjE+PHAgY2xhc3M9TXNv Tm9ybWFsPjxzcGFuIHN0eWxlPSdmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMnPlRo ZSByZWRhY3Rpb24gbWVjaGFuaXNtIGluIGRyYWZ0LWlldGYtdHJhbnMtcmZjNjk2Mi1iaXMtMTgg aGlkZXMgYSBETlMgbGFiZWwgYnkgcmVwbGFjaW5nIGl0IHdpdGggSEFTSCgga2V5LWlkICsgbGFi ZWwpIGluIGEgbG9nZ2VkIHByZS1jZXJ0aWZpY2F0ZS4gVGhlIGtleS1pZCBhcHBlYXJzIGluIHRo ZSBwcmUtY2VydGlmaWNhdGUgc28gYW55b25lIGNhbiBkbyBhIGRpY3Rpb25hcnkgYXR0YWNrOiBz ZWUgYSBwcmVjZXJ0aWZpY2F0ZSBpbiBhIGxvZywgdGhlbiB0cnkgcG9zc2libGUgbGFiZWxzIHVu dGlsIHRoZSBoYXNoIG1hdGNoZXMuIElmIHlvdSB3YW50ZWQgdG8gcmVkYWN0LCBzYXksIDgtZGln aXQgY3VzdG9tZXIgaWRzIHVzZWQgYXMgRE5TIGxhYmVscyBpdCB3b3VsZCBvbmx5IHRha2Ugc2Vj b25kcyBmb3IgYW55b25lIHRvIHVuZG8gYSByZWRhY3Rpb24gYnkgY2FsY3VsYXRpbmcgYSAxMDAg bWlsbGlvbiBoYXNoZXMuPG86cD48L286cD48L3NwYW4+PC9wPjxwIGNsYXNzPU1zb05vcm1hbD48 c3BhbiBzdHlsZT0nZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1z ZXJpZjtjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTJz48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxzcGFuIHN0eWxlPSdmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7 bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMnPklzIHRoaXMgdGhlIGJlc3Qgd2UgY2FuIGRvPzxv OnA+PC9vOnA+PC9zcGFuPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+PHNwYW4gc3R5bGU9J2ZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyc+SXMgdGhpcyB0aGUgYmVzdCB3ZSB3YW50IHRv IGRvIChlZyBzbyBhIGRvbWFpbiBvd25lciBjYW4gZG8gdGhlIGRpY3Rpb25hcnkgYXR0YWNrIHdp dGggYWxsIHRoZSBsYWJlbHMgdGhlIGRvbWFpbiB1c2VzIGlmIHRoZXkgc2VlIGFuIHVuZXhwZWN0 ZWQgcHJlLWNlcnRpZmljYXRlKT88bzpwPjwvbzpwPjwvc3Bhbj48L3A+PHAgY2xhc3M9TXNvTm9y bWFsPjxzcGFuIHN0eWxlPSdmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMnPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+PHNwYW4gc3R5bGU9J2Zv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyc+SWYgdGhpcyBpcyBzbywgSSB0aGluayB0 aGlzIGxpbWl0YXRpb24gbmVlZHMgdG8gYmUgc3RhdGVkIGNsZWFybHkgaW4gwqc0IOKAnFByaXZh dGUgRG9tYWluIE5hbWUgTGFiZWxz4oCdLCBhbmQgwqcxMyDigJxTZWN1cml0eSBDb25zaWRlcmF0 aW9uc+KAnS4gUGVyaGFwczog4oCcUmVkYWN0aW9uIGNhbiBvYmZ1c2NhdGUgYSBkb21haW4gbmFt ZSBsYWJlbCwgYnV0IGlmIGl0IGlzIGZlYXNpYmxlIHRvIGVudW1lcmF0ZSBhbGwgcG9zc2libGUg bGFiZWxzIChiZWNhdXNlIHRoZXkgZG9u4oCZdCBoYXZlIHN1ZmZpY2llbnQgZW50cm9weSkgdGhl biB0aGUgcmVkYWN0ZWQgbGFiZWwgY2FuIGJlIHJlY292ZXJlZOKAnS48bzpwPjwvbzpwPjwvc3Bh bj48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxzcGFuIHN0eWxlPSdmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3Qt bGFuZ3VhZ2U6RU4tVVMnPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD48cCBjbGFzcz1Nc29O b3JtYWw+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyc+SWYg dGhpcyBpcyBub3Qgc28sIHVzaW5nIEhBU0goc2FsdCArIGxhYmVsKSBmb3IgcmVkYWN0aW9uIHNo b3VsZCB3b3JrOyB3aGVyZSB0aGUgc2FsdCBpcyBjb252ZXllZCBpbiBhIGNlcnRpZmljYXRlIGV4 dGVuc2lvbiB0aGF0IGlzIHJlbW92ZWQgd2hlbiBjb25zdHJ1Y3RpbmcgdGhlIHByZS1jZXJ0aWZp Y2F0ZSBbYXMgc29tZW9uZSBlbHNlIHN1Z2dlc3RlZF0uPG86cD48L286cD48L3NwYW4+PC9wPjxw IGNsYXNzPU1zb05vcm1hbD48c3BhbiBzdHlsZT0nZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eToiQ2FsaWJyaSIsc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdl OkVOLVVTJz48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxz cGFuIHN0eWxlPSdmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMnPi0tPG86cD48L286 cD48L3NwYW4+PC9wPjxwIGNsYXNzPU1zb05vcm1hbD48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEO21zby1m YXJlYXN0LWxhbmd1YWdlOkVOLVVTJz5KYW1lcyBNYW5nZXI8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ PHAgY2xhc3M9TXNvTm9ybWFsPjxzcGFuIHN0eWxlPSdmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3Vh Z2U6RU4tVVMnPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+ PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMt c2VyaWY7Y29sb3I6IzFGNDk3RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyc+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPjxwIGNsYXNzPU1zb05vcm1hbD48c3BhbiBzdHlsZT0nZm9udC1z aXplOjExLjBwdDtmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE O21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTJz48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ PHAgY2xhc3M9TXNvTm9ybWFsPjxiPjxzcGFuIGxhbmc9RU4tVVMgc3R5bGU9J2ZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWYnPkZyb206PC9zcGFuPjwvYj48 c3BhbiBsYW5nPUVOLVVTIHN0eWxlPSdmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiJDYWxp YnJpIixzYW5zLXNlcmlmJz4gVHJhbnMgW21haWx0bzp0cmFucy1ib3VuY2VzQGlldGYub3JnXSA8 Yj5PbiBCZWhhbGYgT2YgPC9iPkVyYW4gTWVzc2VyaTxicj48Yj5TZW50OjwvYj4gV2VkbmVzZGF5 LCAyNyBKdWx5IDIwMTYgMTE6NTkgUE08YnI+PGI+VG86PC9iPiB0cmFuc0BpZXRmLm9yZzxicj48 Yj5DYzo8L2I+IGludGVybmV0LWRyYWZ0c0BpZXRmLm9yZzsgaS1kLWFubm91bmNlQGlldGYub3Jn PGJyPjxiPlN1YmplY3Q6PC9iPiBSZTogW1RyYW5zXSBJLUQgQWN0aW9uOiBkcmFmdC1pZXRmLXRy YW5zLXJmYzY5NjItYmlzLTE4LnR4dDxvOnA+PC9vOnA+PC9zcGFuPjwvcD48cCBjbGFzcz1Nc29O b3JtYWw+PG86cD4mbmJzcDs8L286cD48L3A+PGRpdj48cCBjbGFzcz1Nc29Ob3JtYWw+VXBkYXRl cyBpbiB0aGUgZHJhZnQgMTg6PG86cD48L286cD48L3A+PGRpdj48cCBjbGFzcz1Nc29Ob3JtYWw+ LSBGaXhpbmcgdGhlIHNwZWNpZmljYXRpb24gb2YgdGhlIFJFREFDVCBmdW5jdGlvbiAtIGl0IHdh cyBpbmNvcnJlY3RseSBjYWxsaW5nIGZvciB0aGUgdXNlIG9mIGxlbmd0aC1wcmVmaXhlZCBjb25j YXRlbmF0aW9uIGV2ZXJ5d2hlcmUsIGJ1dCB0aGF0IGlzIG9ubHkgbmVjZXNzYXJ5IGZvciB0aGUg dmFsdWVzIHRoYXQgYXJlIGNvbmNhdGVuYXRlZCBmb3IgaGFzaGluZy48bzpwPjwvbzpwPjwvcD48 L2Rpdj48ZGl2PjxwIGNsYXNzPU1zb05vcm1hbD4tIEluZGljYXRlIHRoYXQgb25seSBETlMtSUQg bGFiZWxzIGNhbiBiZSByZWRhY3RlZCB1c2luZyB0aGUgc3BlY2lmaWVkIHJlZGFjdGlvbiBtZWNo YW5pc20gKGVuZCBvZiA8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQt aWV0Zi10cmFucy1yZmM2OTYyLWJpcy0xOCNzZWN0aW9uLTQuMi4yIj5zZWN0aW9uIDQuMi4yLjwv YT4pPG86cD48L286cD48L3A+PC9kaXY+PGRpdj48cCBjbGFzcz1Nc29Ob3JtYWw+LSBDZXJ0aWZp Y2F0ZXMgd2l0aCBvdGhlciB0eXBlcyBvZiBmaWVsZHMgb2YgdGhlIHN1YmplY3RBbHROYW1lIGV4 dGVuc2lvbiB0aGF0IHNob3VsZCBub3QgYXBwZWFyIGluIHB1YmxpYyBsb2cgc2hvdWxkIGJlIGxv Z2dlZCB1bmRlciBhIG5hbWUtY29uc3RyYWluZWQgaW50ZXJtZWRpYXRlIENBIGNlcnQgZGVzY3Jp YmVkIGluIDxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRy YW5zLXJmYzY5NjItYmlzLTE4I3NlY3Rpb24tNC4zIj5zZWN0aW9uIDQuMzwvYT4uPG86cD48L286 cD48L3A+PC9kaXY+PC9kaXY+PGRpdj48cCBjbGFzcz1Nc29Ob3JtYWw+PG86cD4mbmJzcDs8L286 cD48L3A+PGRpdj48cCBjbGFzcz1Nc29Ob3JtYWw+T24gV2VkLCBKdWwgMjcsIDIwMTYgYXQgMjoz OSBQTSwgJmx0OzxhIGhyZWY9Im1haWx0bzppbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmciIHRhcmdl dD0iX2JsYW5rIj5pbnRlcm5ldC1kcmFmdHNAaWV0Zi5vcmc8L2E+Jmd0OyB3cm90ZTo8bzpwPjwv bzpwPjwvcD48YmxvY2txdW90ZSBzdHlsZT0nYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQg I0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBjbSAwY20gMGNtIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0 O21hcmdpbi1yaWdodDowY20nPjxwIGNsYXNzPU1zb05vcm1hbD48YnI+QSBOZXcgSW50ZXJuZXQt RHJhZnQgaXMgYXZhaWxhYmxlIGZyb20gdGhlIG9uLWxpbmUgSW50ZXJuZXQtRHJhZnRzIGRpcmVj dG9yaWVzLjxicj5UaGlzIGRyYWZ0IGlzIGEgd29yayBpdGVtIG9mIHRoZSBQdWJsaWMgTm90YXJ5 IFRyYW5zcGFyZW5jeSZuYnNwOyBvZiB0aGUgSUVURi48YnI+PGJyPiZuYnNwOyAmbmJzcDsgJm5i c3A7ICZuYnNwOyBUaXRsZSZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 OiBDZXJ0aWZpY2F0ZSBUcmFuc3BhcmVuY3k8YnI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 IEF1dGhvcnMmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7OiBCZW4gTGF1cmllPGJy PiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyBBZGFtIExhbmdsZXk8YnI+Jm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IEVtaWxpYSBLYXNwZXI8YnI+Jm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7IEVyYW4gTWVzc2VyaTxicj4mbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgUm9iIFN0cmFkbGluZzxicj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgRmlsZW5hbWUmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgOiBkcmFmdC1pZXRmLXRyYW5z LXJmYzY5NjItYmlzLTE4LnR4dDxicj4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgUGFnZXMm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOzogNTU8YnI+Jm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7IERhdGUmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyA6IDIwMTYtMDctMjc8YnI+PGJyPkFic3RyYWN0Ojxicj4mbmJzcDsgJm5ic3A7VGhp cyBkb2N1bWVudCBkZXNjcmliZXMgYSBwcm90b2NvbCBmb3IgcHVibGljbHkgbG9nZ2luZyB0aGUg ZXhpc3RlbmNlPGJyPiZuYnNwOyAmbmJzcDtvZiBUcmFuc3BvcnQgTGF5ZXIgU2VjdXJpdHkgKFRM UykgY2VydGlmaWNhdGVzIGFzIHRoZXkgYXJlIGlzc3VlZCBvcjxicj4mbmJzcDsgJm5ic3A7b2Jz ZXJ2ZWQsIGluIGEgbWFubmVyIHRoYXQgYWxsb3dzIGFueW9uZSB0byBhdWRpdCBjZXJ0aWZpY2F0 aW9uPGJyPiZuYnNwOyAmbmJzcDthdXRob3JpdHkgKENBKSBhY3Rpdml0eSBhbmQgbm90aWNlIHRo ZSBpc3N1YW5jZSBvZiBzdXNwZWN0PGJyPiZuYnNwOyAmbmJzcDtjZXJ0aWZpY2F0ZXMgYXMgd2Vs bCBhcyB0byBhdWRpdCB0aGUgY2VydGlmaWNhdGUgbG9ncyB0aGVtc2VsdmVzLjxicj4mbmJzcDsg Jm5ic3A7VGhlIGludGVudCBpcyB0aGF0IGV2ZW50dWFsbHkgY2xpZW50cyB3b3VsZCByZWZ1c2Ug dG8gaG9ub3I8YnI+Jm5ic3A7ICZuYnNwO2NlcnRpZmljYXRlcyB0aGF0IGRvIG5vdCBhcHBlYXIg aW4gYSBsb2csIGVmZmVjdGl2ZWx5IGZvcmNpbmcgQ0FzIHRvPGJyPiZuYnNwOyAmbmJzcDthZGQg YWxsIGlzc3VlZCBjZXJ0aWZpY2F0ZXMgdG8gdGhlIGxvZ3MuPGJyPjxicj4mbmJzcDsgJm5ic3A7 TG9ncyBhcmUgbmV0d29yayBzZXJ2aWNlcyB0aGF0IGltcGxlbWVudCB0aGUgcHJvdG9jb2wgb3Bl cmF0aW9ucyBmb3I8YnI+Jm5ic3A7ICZuYnNwO3N1Ym1pc3Npb25zIGFuZCBxdWVyaWVzIHRoYXQg YXJlIGRlZmluZWQgaW4gdGhpcyBkb2N1bWVudC48YnI+PGJyPjxicj5UaGUgSUVURiBkYXRhdHJh Y2tlciBzdGF0dXMgcGFnZSBmb3IgdGhpcyBkcmFmdCBpczo8YnI+PGEgaHJlZj0iaHR0cHM6Ly9k YXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi10cmFucy1yZmM2OTYyLWJpcy8iIHRh cmdldD0iX2JsYW5rIj5odHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1pZXRm LXRyYW5zLXJmYzY5NjItYmlzLzwvYT48YnI+PGJyPlRoZXJlJ3MgYWxzbyBhIGh0bWxpemVkIHZl cnNpb24gYXZhaWxhYmxlIGF0Ojxicj48YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0 bWwvZHJhZnQtaWV0Zi10cmFucy1yZmM2OTYyLWJpcy0xOCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBz Oi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRyYW5zLXJmYzY5NjItYmlzLTE4PC9h Pjxicj48YnI+QSBkaWZmIGZyb20gdGhlIHByZXZpb3VzIHZlcnNpb24gaXMgYXZhaWxhYmxlIGF0 Ojxicj48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9yZmNkaWZmP3VybDI9ZHJhZnQtaWV0 Zi10cmFucy1yZmM2OTYyLWJpcy0xOCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYu b3JnL3JmY2RpZmY/dXJsMj1kcmFmdC1pZXRmLXRyYW5zLXJmYzY5NjItYmlzLTE4PC9hPjxicj48 YnI+PGJyPlBsZWFzZSBub3RlIHRoYXQgaXQgbWF5IHRha2UgYSBjb3VwbGUgb2YgbWludXRlcyBm cm9tIHRoZSB0aW1lIG9mIHN1Ym1pc3Npb248YnI+dW50aWwgdGhlIGh0bWxpemVkIHZlcnNpb24g YW5kIGRpZmYgYXJlIGF2YWlsYWJsZSBhdCA8YSBocmVmPSJodHRwOi8vdG9vbHMuaWV0Zi5vcmci IHRhcmdldD0iX2JsYW5rIj50b29scy5pZXRmLm9yZzwvYT4uPGJyPjxicj5JbnRlcm5ldC1EcmFm dHMgYXJlIGFsc28gYXZhaWxhYmxlIGJ5IGFub255bW91cyBGVFAgYXQ6PGJyPjxhIGhyZWY9ImZ0 cDovL2Z0cC5pZXRmLm9yZy9pbnRlcm5ldC1kcmFmdHMvIiB0YXJnZXQ9Il9ibGFuayI+ZnRwOi8v ZnRwLmlldGYub3JnL2ludGVybmV0LWRyYWZ0cy88L2E+PGJyPjxicj5fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj5UcmFucyBtYWlsaW5nIGxpc3Q8YnI+ PGEgaHJlZj0ibWFpbHRvOlRyYW5zQGlldGYub3JnIj5UcmFuc0BpZXRmLm9yZzwvYT48YnI+PGEg aHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby90cmFucyIgdGFyZ2V0 PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdHJhbnM8L2E+ PG86cD48L286cD48L3A+PC9ibG9ja3F1b3RlPjwvZGl2PjxwIGNsYXNzPU1zb05vcm1hbD48bzpw PiZuYnNwOzwvbzpwPjwvcD48L2Rpdj48L2Rpdj48L2JvZHk+PC9odG1sPg== --_000_255B9BB34FB7D647A506DC292726F6E13BFC28CB2CWSMSG3153Vsrv_-- From nobody Thu Jul 28 07:00:09 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5609312B01B for ; Thu, 28 Jul 2016 07:00:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.488 X-Spam-Level: X-Spam-Status: No, score=-5.488 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-1.287, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TNWnl-FCWv8o for ; Thu, 28 Jul 2016 07:00:06 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6CF7612B00D for ; Thu, 28 Jul 2016 07:00:06 -0700 (PDT) Received: from ssh.bbn.com ([192.1.122.15]:52355 helo=COMSEC.fios-router.home) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1bSlqz-000GGA-TS for trans@ietf.org; Thu, 28 Jul 2016 10:00:02 -0400 From: Stephen Kent To: trans@ietf.org References: <87poroap4u.fsf@alice.fifthhorseman.net> <4826e966-de00-3d8d-1079-d9d21bdc16c8@bbn.com> <6c1e8d74-3aa9-8990-25e8-37da4bc6c648@gmail.com> Message-ID: <15088a12-8846-ff72-49fd-684ab2ea225f@bbn.com> Date: Thu, 28 Jul 2016 10:00:01 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Trans] threat analysis v06 review X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jul 2016 14:00:08 -0000 David, > Unfortunately, I must yet again point out that there has still been no > attempt to address the issues that I and a few others have pointed out > with this document. > > I have explained on multiple occasions that it is both technically > incorrect and confusing to refer to the attack as involving two CAs > with the same name and key. You have made this statement several times, but I do not recall you citing specific text from 5280 that supports your contention. Although analogies are always imperfect, I'll propose two as a basis for rejecting your assertion. 1. When a person is the victim of identity theft, this is analogous to an attacker compromising the key of an extant CA and using it to create a CA instance with the same name and key as the targeted CA. We do not say that the identity thief is the same person as the victim, even though that is the goal of the identity thief. We recognize that, in the physical world, they are two different entities, even if the identity thief appears to be identical to the victim in the eyes of banks, government agencies, etc. 2. If an animal is cloned, the resulting offspring may be identical in appearance and genetics. Yet the clones are distinct animals, not one animal. Again, there is one animal only if one chooses to view the animal as beign defined by its appearance and genes, rather that physical world presence. This is analogous to an attacker providing different contact info (postal and e-mail addresses, etc.), while using the same CA name and the same key. These appear as two CAs as far as the CAs that issue certs to these entities are concerned. Steve From nobody Thu Jul 28 07:05:45 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FF5512D17A for ; Thu, 28 Jul 2016 07:05:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jjjjgNRsnCPt for ; Thu, 28 Jul 2016 07:05:41 -0700 (PDT) Received: from mmextmx2.mcr.colo.comodoca.net (mmextmx2.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ED40412D0AD for ; Thu, 28 Jul 2016 07:05:40 -0700 (PDT) Received: (qmail 30110 invoked by uid 1004); 28 Jul 2016 14:05:39 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx2.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Thu, 28 Jul 2016 15:05:39 +0100 Received: (qmail 6817 invoked by uid 1000); 28 Jul 2016 14:05:39 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Thu, 28 Jul 2016 15:05:38 +0100 To: "Manger, James" , "trans@ietf.org" References: <255B9BB34FB7D647A506DC292726F6E13BFC28CB2C@WSMSG3153V.srv.dir.telstra.com> From: Rob Stradling Message-ID: Date: Thu, 28 Jul 2016 15:05:38 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <255B9BB34FB7D647A506DC292726F6E13BFC28CB2C@WSMSG3153V.srv.dir.telstra.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Trans] draft-ietf-trans-rfc6962-bis-18.txt - Redaction limitation X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jul 2016 14:05:44 -0000 On 28/07/16 07:35, Manger, James wrote: > The redaction mechanism in draft-ietf-trans-rfc6962-bis-18 hides a DNS > label by replacing it with HASH( key-id + label) in a logged > pre-certificate. The key-id appears in the pre-certificate so anyone can > do a dictionary attack: see a precertificate in a log, then try possible > labels until the hash matches. If you wanted to redact, say, 8-digit > customer ids used as DNS labels it would only take seconds for anyone to > undo a redaction by calculating a 100 million hashes. > > Is this the best we can do? > > Is this the best we want to do (eg so a domain owner can do the > dictionary attack with all the labels the domain uses if they see an > unexpected pre-certificate)? I think it's the best we want to do. There was a discussion about redaction on the Chrome ct-policy list a few months ago. The Chrome team decided that they would not support the redaction mechanism specified in 6962-bis-14, but indicated that they'd be willing to reconsider this if/when the various concerns expressed in [2] have been addressed. Since then, as you noted, we've changed the redaction mechanism to allow the domain owner to do a dictionary attack if they see an unexpected precertificate. This was in response to this concern... "As I indicated, we haven't really found a viable policy here that might allow for the 'un'redaction of certificates, short of observing them in the wild. This definitely leaves significant risks in the ecosystem, both for current and future domain holders, and makes it challenging to support redaction." [2] > If this is so, I think this limitation needs to be stated clearly in §4 > “Private Domain Name Labels”, and §13 “Security Considerations”. > Perhaps: “Redaction can obfuscate a domain name label, but if it is > feasible to enumerate all possible labels (because they don’t have > sufficient entropy) then the redacted label can be recovered”. Good idea. I think §14.1 (Privacy Considerations -> Ensuring Effective Redaction) would be the appropriate place to add this detail. > If this is not so, using HASH(salt + label) for redaction should work; > where the salt is conveyed in a certificate extension that is removed > when constructing the pre-certificate [as someone else suggested]. There seems little point in defining a redaction mechanism in 6962-bis that the Chrome team are unlikely to ever accept. ISTM that they'd never accept HASH(salt + label), because it doesn't address the 'un'redaction concern. That said, if anyone has any alternative proposals for 'un'redaction, I'd love to hear them. [1] https://groups.google.com/a/chromium.org/d/msg/ct-policy/fCt4Bm03GsI/jBbqE_QWBQAJ [2] https://groups.google.com/a/chromium.org/d/msg/ct-policy/vsTzv8oNcws/imuC3iloBwAJ -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From nobody Thu Jul 28 08:19:49 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6927312D842 for ; Thu, 28 Jul 2016 08:19:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.764 X-Spam-Level: X-Spam-Status: No, score=-4.764 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.723, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-1.287, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NqMRRC7jhhEy for ; Thu, 28 Jul 2016 08:19:46 -0700 (PDT) Received: from wsget2.nist.gov (wsget2.nist.gov [IPv6:2610:20:6005:13::151]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A0B0C12D105 for ; Thu, 28 Jul 2016 08:19:46 -0700 (PDT) Received: from WSXGHUB1.xchange.nist.gov (129.6.18.96) by wsget2.nist.gov (129.6.13.151) with Microsoft SMTP Server (TLS) id 14.3.301.0; Thu, 28 Jul 2016 11:19:28 -0400 Received: from postmark.nist.gov (129.6.16.94) by WSXGHUB1.xchange.nist.gov (129.6.18.96) with Microsoft SMTP Server (TLS) id 8.3.465.0; Thu, 28 Jul 2016 11:19:44 -0400 Received: from [129.6.54.72] (st26.ncsl.nist.gov [129.6.54.72]) by postmark.nist.gov (8.13.8/8.13.1) with ESMTP id u6SFJWTP027523; Thu, 28 Jul 2016 11:19:32 -0400 References: <87poroap4u.fsf@alice.fifthhorseman.net> <4826e966-de00-3d8d-1079-d9d21bdc16c8@bbn.com> <6c1e8d74-3aa9-8990-25e8-37da4bc6c648@gmail.com> <15088a12-8846-ff72-49fd-684ab2ea225f@bbn.com> To: Melinda Shore From: "David A. Cooper" Message-ID: <594a99fb-fc64-905d-92f0-aa10457645f8@nist.gov> Date: Thu, 28 Jul 2016 11:19:32 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <15088a12-8846-ff72-49fd-684ab2ea225f@bbn.com> Content-Type: text/html; charset="windows-1252" Content-Transfer-Encoding: 7bit X-NIST-MailScanner-Information: Archived-At: Cc: trans@ietf.org Subject: Re: [Trans] threat analysis v06 review X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jul 2016 15:19:48 -0000
The editor of this document is again making it clear that he intends to ignore input from the working group if what the working group wants for the document is different from what he wants.

The so-called analogies below have nothing at all to do with the attack scenario that is supposed to be described in the text. The only thing that comes even close is:
This is analogous to an attacker providing different contact info (postal and e-mail addresses, etc.), while using the same CA name and the same key.

There is nothing in the attack scenario that involves the attacker providing different contact info to the two CAs from which it is trying to get CA certificates, but providing different contact info doesn't make the CA that the attacker is operating into two CAs.

I could provide text describing the attack scenario that would be both technically correct and much easier to understand than what is currently in the document. However, there would be no point in my spending time writing something like that at the moment, as the current document editor has made it very clear that any such input would be ignored.

On 07/28/2016 10:00 AM, Stephen Kent wrote:
David,

Unfortunately, I must yet again point out that there has still been no attempt to address the issues that I and a few others have pointed out with this document.

I have explained on multiple occasions that it is both technically incorrect and confusing to refer to the attack as involving two CAs with the same name and key.
You have made this statement several times, but I do not recall you citing specific text from 5280 that supports your contention.

Although analogies are always imperfect, I'll propose two as a basis for rejecting your assertion.

1. When a person is the victim of identity theft, this is analogous to an attacker compromising the key of an extant CA and using it to create a CA instance with the same name and key as the targeted CA. We do not say that the identity thief is the same person as the victim, even though that is the goal of the identity thief. We recognize that, in the physical world, they are two different entities, even if the identity thief appears to be identical to the victim in the eyes of banks, government agencies, etc.

2. If an animal is cloned, the resulting offspring may be identical in appearance and genetics. Yet the clones are distinct animals, not one animal. Again, there is one animal only if one chooses to view the animal as beign defined by its appearance and genes, rather that physical world presence. This is analogous to an attacker providing different contact info (postal and e-mail addresses, etc.), while using the same CA name and the same key. These appear as two CAs as far as the CAs that issue certs to these entities are concerned.

Steve

From nobody Thu Jul 28 09:09:26 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 695F312D7E9 for ; Thu, 28 Jul 2016 09:09:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KiWmefbjcRzX for ; Thu, 28 Jul 2016 09:09:04 -0700 (PDT) Received: from mail-ua0-x236.google.com (mail-ua0-x236.google.com [IPv6:2607:f8b0:400c:c08::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F082212D8F8 for ; Thu, 28 Jul 2016 09:08:59 -0700 (PDT) Received: by mail-ua0-x236.google.com with SMTP id j59so43116412uaj.3 for ; Thu, 28 Jul 2016 09:08:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=sCYCUVGSaC+/2lPPaVeeh7kzWWp5od9HyPFp0tyMnyo=; b=KAicAYXVlTo6sLCDDkpzlWgK3QMCX2/IuZRsga8fGJtRKEUaRS7FmFKkRfvf+M2F/1 OAMfZU3SBDsjRiuitXJtqwQQkfI7C15pNAcMgAnro6twrVw09qGNFoTEg1PxUHbAlIXB jnWGdT9pWtXCIEy4H6N1GR8RGvJz9CcckMqu2QOhU6FJTESU+p7A4/Yz4eKILpf27RkE w+HfrNVJPOwNQ1EHUUzT/WvO7WrtAAe7a2eykL2Q0uoC756rs+C6fhpZ/VOI/yGgiYly EDcxeYMoKdJoglPILSFLxrz7UaQ+lL40IGud8C3m3peRy78BpNeY+imU1LOlAC82xiJ1 4MYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=sCYCUVGSaC+/2lPPaVeeh7kzWWp5od9HyPFp0tyMnyo=; b=fLAJ0pZs0ADh9mKnuLncuWXCusWQmw4vF+BXqIkLEIHkJQyMD/w1dHp5ywivcg9BxV v7CoCfoRTo3oP/1MILCs6JocuY7MxHdZnUAssV3KAiZzabCR6z6x0BZsXe0eKPm+QfHz U/kVNKvREl1YmfOg6rgXdUcJqky2F28BrZvZ7lz4PCoT2gM55zduwf2wVJvL31P7aBx0 /+UUmCorjGgzw7HKwc697SPXkc+aIjDmLsDMYmE0AARbrSYjE7me0rTSeQfuyoxcSTSK E31VfQ66lYjWOImP4nZLXqgVKmKYzxKKMYxR/t9fzqx9c1sRPLh2PZuds6KifhoU+tup 6mvg== X-Gm-Message-State: AEkoouvYOLeh+MI1T6Og//NYu7gNVcp6WqT5fnahfTvI+P1aO2SH2rO2PJngrPWLWkDC/Alsyso9msoLnHLKBw== MIME-Version: 1.0 X-Received: by 10.176.4.101 with SMTP id 92mr13560872uav.56.1469722138887; Thu, 28 Jul 2016 09:08:58 -0700 (PDT) Received: by 10.159.39.194 with HTTP; Thu, 28 Jul 2016 09:08:58 -0700 (PDT) Received: by 10.159.39.194 with HTTP; Thu, 28 Jul 2016 09:08:58 -0700 (PDT) In-Reply-To: <594a99fb-fc64-905d-92f0-aa10457645f8@nist.gov> References: <87poroap4u.fsf@alice.fifthhorseman.net> <4826e966-de00-3d8d-1079-d9d21bdc16c8@bbn.com> <6c1e8d74-3aa9-8990-25e8-37da4bc6c648@gmail.com> <15088a12-8846-ff72-49fd-684ab2ea225f@bbn.com> <594a99fb-fc64-905d-92f0-aa10457645f8@nist.gov> Date: Thu, 28 Jul 2016 09:08:58 -0700 Message-ID: From: Watson Ladd To: "David A. Cooper" Content-Type: multipart/alternative; boundary=001a114809fa01cdcd0538b45ad6 Archived-At: Cc: Melinda Shore , trans@ietf.org Subject: Re: [Trans] threat analysis v06 review X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jul 2016 16:09:09 -0000 --001a114809fa01cdcd0538b45ad6 Content-Type: text/plain; charset=UTF-8 On Jul 28, 2016 8:19 AM, "David A. Cooper" wrote: > > The editor of this document is again making it clear that he intends to ignore input from the working group if what the working group wants for the document is different from what he wants. > > The so-called analogies below have nothing at all to do with the attack scenario that is supposed to be described in the text. The only thing that comes even close is: > >> This is analogous to an attacker providing different contact info (postal and e-mail addresses, etc.), while using the same CA name and the same key. > > > There is nothing in the attack scenario that involves the attacker providing different contact info to the two CAs from which it is trying to get CA certificates, but providing different contact info doesn't make the CA that the attacker is operating into two CAs. > I care about semantical clarity as much as the next person, but I despite trying I've failed to understand what meaning CA has here. The two N certificates are different certificates. In what way does CA mean anything? > I could provide text describing the attack scenario that would be both technically correct and much easier to understand than what is currently in the document. However, there would be no point in my spending time writing something like that at the moment, as the current document editor has made it very clear that any such input would be ignored. > > > On 07/28/2016 10:00 AM, Stephen Kent wrote: >> >> David, >> >>> Unfortunately, I must yet again point out that there has still been no attempt to address the issues that I and a few others have pointed out with this document. >>> >>> I have explained on multiple occasions that it is both technically incorrect and confusing to refer to the attack as involving two CAs with the same name and key. >> >> You have made this statement several times, but I do not recall you citing specific text from 5280 that supports your contention. >> >> Although analogies are always imperfect, I'll propose two as a basis for rejecting your assertion. >> >> 1. When a person is the victim of identity theft, this is analogous to an attacker compromising the key of an extant CA and using it to create a CA instance with the same name and key as the targeted CA. We do not say that the identity thief is the same person as the victim, even though that is the goal of the identity thief. We recognize that, in the physical world, they are two different entities, even if the identity thief appears to be identical to the victim in the eyes of banks, government agencies, etc. >> >> 2. If an animal is cloned, the resulting offspring may be identical in appearance and genetics. Yet the clones are distinct animals, not one animal. Again, there is one animal only if one chooses to view the animal as beign defined by its appearance and genes, rather that physical world presence. This is analogous to an attacker providing different contact info (postal and e-mail addresses, etc.), while using the same CA name and the same key. These appear as two CAs as far as the CAs that issue certs to these entities are concerned. >> >> Steve > > > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > --001a114809fa01cdcd0538b45ad6 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Jul 28, 2016 8:19 AM, "David A. Cooper" <david.cooper@nist.gov> wrote:
>
> The editor of this document is again making it clear that he intends t= o ignore input from the working group if what the working group wants for t= he document is different from what he wants.
>
> The so-called analogies below have nothing at all to do with the attac= k scenario that is supposed to be described in the text. The only thing tha= t comes even close is:
>
>> This is analogous to an attacker providing different contact info = (postal and e-mail addresses, etc.), while using the same CA name and the s= ame key.
>
>
> There is nothing in the attack scenario that involves the attacker pro= viding different contact info to the two CAs from which it is trying to get= CA certificates, but providing different contact info doesn't make the= CA that the attacker is operating into two CAs.
>

I care about semantical clarity as much as the next person, = but I despite trying I've failed to understand what meaning CA has here= . The two N certificates are different certificates. In what way does CA me= an anything?

> I could provide text describing the attack scenario tha= t would be both technically correct and much easier to understand than what= is currently in the document. However, there would be no point in my spend= ing time writing something like that at the moment, as the current document= editor has made it very clear that any such input would be ignored.
>
>
> On 07/28/2016 10:00 AM, Stephen Kent wrote:
>>
>> David,
>>
>>> Unfortunately, I must yet again point out that there has still= been no attempt to address the issues that I and a few others have pointed= out with this document.
>>>
>>> I have explained on multiple occasions that it is both technic= ally incorrect and confusing to refer to the attack as involving two CAs wi= th the same name and key.
>>
>> You have made this statement several times, but I do not recall yo= u citing specific text from 5280 that supports your contention.
>>
>> Although analogies are always imperfect, I'll propose two as a= basis for rejecting your assertion.
>>
>> 1. When a person is the victim of identity theft, this is analogou= s to an attacker compromising the key of an extant CA and using it to creat= e a CA instance with the same name and key as the targeted CA. We do not sa= y that the identity thief is the same person as the victim, even though tha= t is the goal of the identity thief. We recognize that, in the physical wor= ld, they are two different entities, even if the identity thief appears to = be identical to the victim in the eyes of banks, government agencies, etc. =
>>
>> 2. If an animal is cloned, the resulting offspring may be identica= l in appearance and genetics. Yet the clones are distinct animals, not one = animal. Again, there is one animal only if one chooses to view the animal a= s beign defined by its appearance and genes, rather that physical world pre= sence. This is analogous to an attacker providing different contact info (p= ostal and e-mail addresses, etc.), while using the same CA name and the sam= e key. These appear as two CAs as far as the CAs that issue certs to these = entities are concerned.
>>
>> Steve
>
>
>
> _______________________________________________
> Trans mailing list
> Trans@ietf.org
> https://www.ie= tf.org/mailman/listinfo/trans
>

--001a114809fa01cdcd0538b45ad6-- From nobody Thu Jul 28 16:32:04 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B152E12D98E for ; Thu, 28 Jul 2016 16:31:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6ye5Hx_4ZMaj for ; Thu, 28 Jul 2016 16:31:53 -0700 (PDT) Received: from homiemail-a35.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6953B12D7B7 for ; Thu, 28 Jul 2016 16:31:53 -0700 (PDT) Received: from homiemail-a35.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a35.g.dreamhost.com (Postfix) with ESMTP id D8075E00013C; Thu, 28 Jul 2016 16:33:16 -0700 (PDT) Received: from webmail.dreamhost.com (caiajhbihbdd.dreamhost.com [208.97.187.133]) (Authenticated sender: ryan@sleevi.com) by homiemail-a35.g.dreamhost.com (Postfix) with ESMTPA id C85DFE00053E; Thu, 28 Jul 2016 16:33:16 -0700 (PDT) Received: from 104.132.1.83 (SquirrelMail authenticated user ryan@sleevi.com) by webmail.dreamhost.com with HTTP; Thu, 28 Jul 2016 16:31:51 -0700 Message-ID: Date: Thu, 28 Jul 2016 16:31:51 -0700 From: "Ryan Sleevi" To: "Rob Stradling" User-Agent: SquirrelMail/1.4.21 MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Archived-At: Cc: "trans@ietf.org" , "Manger, James" Subject: Re: [Trans] draft-ietf-trans-rfc6962-bis-18.txt - Redaction limitation X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: ryan-ietf@sleevi.com List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jul 2016 23:31:56 -0000 On Thu, July 28, 2016 7:05 am, Rob Stradling wrote: > > Is this the best we can do? > > Is this the best we want to do (eg so a domain owner can do the dictionary attack with all the labels the domain uses if they see an unexpected pre-certificate)? > I think it's the best we want to do. > There was a discussion about redaction on the Chrome ct-policy list a few months ago. The Chrome team decided that they would not support the > redaction mechanism specified in 6962-bis-14, but indicated that they'= d be willing to reconsider this if/when the various concerns expressed in [2] have been addressed. > Since then, as you noted, we've changed the redaction mechanism to allow > the domain owner to do a dictionary attack if they see an unexpected precertificate. This was in response to this concern... > "As I indicated, we haven't really found a viable policy here that > might allow for the 'un'redaction of certificates, short of observing them in the wild. This definitely leaves significant risks > in the ecosystem, both for current and future domain holders, and makes it challenging to support redaction." [2] Well, to be fair, Andrew Ayer also pointed out the issues with monitoring that the previous redaction proposal had. > > If this is not so, using HASH(salt + label) for redaction should work= ; where the salt is conveyed in a certificate extension that is removed when constructing the pre-certificate [as someone else suggested]. > There seems little point in defining a redaction mechanism in 6962-bis that the Chrome team are unlikely to ever accept. ISTM that they'd never accept HASH(salt + label), because it doesn't address the 'un'redaction concern. > That said, if anyone has any alternative proposals for 'un'redaction, I'd love to hear them. Unfortunately, we're in the swirling nexus that is policy, practice, and technology. While I've largely remained quiet on this list, and instead channeled concerns through colleagues, I don't think it's a good idea for redaction to remain in 6962-bis. I think separating it out into its own specification, with its own enumeration of concerns, is useful. My operating assumption is first and foremost that certificate revocation does not work or scale at present. I can expand on that topic separately, but I think most people on the list are familiar with the issues the WebPKI faces there. Second, I assume that CAs will screw up and do things out of stupidity or malice (if we can even distinguish the two) with ever= y knob and control given. I know, it's an uncharitable assumption for a number of individuals, but history and evidence show that, collectively, it's a historic trend that's getting worse, rather than better. As such, these two combine to make it unlikely that Chrome will support redaction as specified in 6962-bis. While there are technical reasons for this (I'll expand on), I want to note the major objection is policy reasons. Solving the policy problems is hard, and involves multiple stakeholders: We need the CA/Browser Forum (and in particular, the browsers) to mandate any adoption of policy controls (technical or otherwise), we need CAs and site operators to elaborate on their threat models and assumptions, and we'll likely need the IETF's support in developing appropriate technical controls (such as the CAA policies I mentioned on the thread Rob linked) To me, specifying the technical means of redaction is the wrong ordering; we should be specifying it last, rather than first. We need to discuss th= e policy issues - what do we do when a CA screws up and what are the possible consequences and implications of that screw up? Then we need to discuss possible mitigations - e.g. CAA policies on redaction or requirements on how the CA authenticates the request for redaction or requirements for auditors to examine - and then we should visit the technical. It's a fluid, multi-stakeholder conversation because I don't think we're going to solve everything here, in TRANS, without understanding how possible policies and mitigations could work, and what they can or can't solve. James' question I think is illustrative of this; the redaction-as-propose= d is trying to address, in part, the concerns I raised for 'un'redacting a cert, and this makes trade-offs (such as to privacy) that seem difficult to justify without understanding the policy or practice components. I think most of 6962-bis is ready to go, but I've expressed particular concern to my colleagues that it's not at all a given that redaction as specified will meet our needs, because the other conversations haven't been happening. I had hoped that my position on redaction would have sparked the broader conversation, but it seems the focus of the redaction proponents has been on the tech and politics of it, without addressing th= e policy concerns. To the more technical concern, I'm uneasy with how 'fixed' this redaction method is. That is, it's coupled very closely to the use of dNSNames, under the assumption that is the only thing that could or should be redacted. However, as the CA/Browser Forum explores support for SRVNames, which could be a significant boon to server security (by further scoping certificates' capability), it's natural to question: Should SRVNames be a= s redactable as dNSNames? Why or why not? Are there any special considerations we'd have to consider? Is the service name of an SRVName considered public or private? Why? I think it's also useful to compare the logging of redacted certificates (which at least one CA is doing with their own non-conforming log) agains= t those publicly logged certificates. If you do, you'll see the same thing = I am: redaction is hard for users to get right, and often results in 'obviously wrong' things. We could blame the CA for making it too easy, but I also thinks it's reasonable to suggest that perhaps it's not as important as some have claimed. For a quick sample, consider: - https://crt.sh/?serial=3D7f90c4250ef1f03f96fbe59fcb807857 : Redacted "w= ww" - https://crt.sh/?serial=3D7fe0023277563c51af6c299e9baed126 : Redacted "w= ww" - https://crt.sh/?serial=3D132c3fd48f0bb6391200e9f56d43272d : Redacted "w= ww" - https://crt.sh/?serial=3D2c1fa499a25405936098e31404c2dc8e : Redacted "mystatus", despite it being a well-known URL Is the ecosystem harmed by those mistakes? I would argue yes, but I know others would argue no. Regardless, I think this is something that spans beyond just the tech, involves questions that we (in the TRANS group) are not well suited to answer, and feels very much like something better removed into a separate spec and the full discussions about the tradeoffs can happen there. It's very clear that the people actively participating are passionate about the tech, but I think the issues go beyond the tech, and I'd hate to see us settle on an incomplete or unsuitable solution. From nobody Fri Jul 29 02:53:05 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 154FD12DA3F for ; Fri, 29 Jul 2016 02:53:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lJrQSipRNVpe for ; Fri, 29 Jul 2016 02:53:01 -0700 (PDT) Received: from mmextmx2.mcr.colo.comodoca.net (mmextmx2.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2195D12DA36 for ; Fri, 29 Jul 2016 02:53:00 -0700 (PDT) Received: (qmail 10017 invoked by uid 1004); 29 Jul 2016 09:52:58 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx2.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Fri, 29 Jul 2016 10:52:58 +0100 Received: (qmail 5282 invoked by uid 1000); 29 Jul 2016 09:52:58 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Fri, 29 Jul 2016 10:52:58 +0100 To: ryan-ietf@sleevi.com, "trans@ietf.org" References: From: Rob Stradling Message-ID: Date: Fri, 29 Jul 2016 10:52:58 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Trans] draft-ietf-trans-rfc6962-bis-18.txt - Redaction limitation X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jul 2016 09:53:04 -0000 On 29/07/16 00:31, Ryan Sleevi wrote: > I think it's also useful to compare the logging of redacted certificates > (which at least one CA is doing with their own non-conforming log) against > those publicly logged certificates. If you do, you'll see the same thing I > am: redaction is hard for users to get right, and often results in > 'obviously wrong' things. We could blame the CA for making it too easy, > but I also thinks it's reasonable to suggest that perhaps it's not as > important as some have claimed. > > For a quick sample, consider: > - https://crt.sh/?serial=7f90c4250ef1f03f96fbe59fcb807857 : Redacted "www" > - https://crt.sh/?serial=7fe0023277563c51af6c299e9baed126 : Redacted "www" > - https://crt.sh/?serial=132c3fd48f0bb6391200e9f56d43272d : Redacted "www" > - https://crt.sh/?serial=2c1fa499a25405936098e31404c2dc8e : Redacted > "mystatus", despite it being a well-known URL Hi Ryan. FYI, here's a snapshot I just generated of all the "redacted precertificates" and (where known to CT) the corresponding certificates: https://crt.sh/reports/20160729_redacted-precertificates.html (See also https://crt.sh/redacted-precertificates - generated in realtime using the latest data; very slow to load; sometimes falls victim to crt.sh's automated long-running-query killer) > Is the ecosystem harmed by those mistakes? I would argue yes, but I know > others would argue no. Regardless, I think this is something that spans > beyond just the tech, involves questions that we (in the TRANS group) are > not well suited to answer, and feels very much like something better > removed into a separate spec and the full discussions about the tradeoffs > can happen there. Were going round in circles again. :-( Please review the "Name redaction - stay or go?" thread from 6 weeks ago [1]. FWIW, I too proposed moving redaction to a separate doc [2], but the chairs did not direct us to take this course of action. There are plenty of folks with a strong preference to leave redaction in 6962-bis, and there are plenty of folks with a strong preference to remove redaction from 6962-bis. How on earth are we going to get this document through Last Call? > It's very clear that the people actively participating > are passionate about the tech, but I think the issues go beyond the tech, > and I'd hate to see us settle on an incomplete or unsuitable solution. +1 [1] https://mailarchive.ietf.org/arch/msg/trans/DCIS3dwb-QbYY4ttZwlCd_zmmXY [2] https://mailarchive.ietf.org/arch/msg/trans/046Cv3IQTNzNRq8LUQJsPMNeCTo -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From nobody Fri Jul 29 04:23:38 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B84C812DD5E for ; Fri, 29 Jul 2016 04:23:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.987 X-Spam-Level: X-Spam-Status: No, score=-3.987 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.287, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1q1T5CxJksTo for ; Fri, 29 Jul 2016 04:23:33 -0700 (PDT) Received: from mail-wm0-x231.google.com (mail-wm0-x231.google.com [IPv6:2a00:1450:400c:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F150612DD5A for ; Fri, 29 Jul 2016 04:23:31 -0700 (PDT) Received: by mail-wm0-x231.google.com with SMTP id f65so286230030wmi.0 for ; Fri, 29 Jul 2016 04:23:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=KjAqLT3ww2gf/XNd/BVvT6w/8VhHY5mRp+7ZsmL6Vzo=; b=HQ/2SkwnWvjGrj+XNm+2KdpLuB/mVKPcZvAOAGBZgZZ7Q5ZAtsUoEZ1651ibY79BUj pftq9lspxef88jhaB7HthwlF0VPJajntGNEFUJIc7SAFkTjKO7/2PNZo2ZqCBG49+5hq 22Ht6hQhwfO8Ekv4QVLSKqqNMqwW+LoELHrYsmD5Kv7Iu6vu0Gk9cHHOEhoXcZEayEFV n464L1G+ZrMQmvWMjVe07t6Hhs9f+aM8d6kIwAn3aUQF31Zd1M9vkeS5/sqrzskOf+K3 iNeUGVFLSStRP8fcyG/BLK9vtDy+4G+xy4l6I60kBxX0e8m9AXRIo52+V6wV2zBKzcR4 I16A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=KjAqLT3ww2gf/XNd/BVvT6w/8VhHY5mRp+7ZsmL6Vzo=; b=YX+uO1bJzSB0VXUsoMr0q/fPToUOOqQyC5+93W377rjCiXlSRrbc9xW1t+szj0nJPG Zez5CACSFsgsS3BSnsDQRUN4vMcq1Aba5pK+bqid+WbVg6xKUgAW9WlpnxlOJ/+K+2sY REAv1x+cdg5FjV+E0sDwxgXWhExuzsZWS45NntX0vz2uX8CtL58i6Ho1C3EFZ79p39yx kYQxWfkh0LAFPae4mj3m/E4uDc5uiCSXq0tMqiuOgJHkg9gbEdbSG4+KBSY7W5C/DWZ6 j1xq03xhBO0vYvC/rZC1o5mzqNiDaaNfSXSMF2UcqlSVHn/L2zaOadBIwy0g9aILiSAJ GMNw== X-Gm-Message-State: AEkoouufyfDEMcf8oe9pvFoyThIZtDC5rJ3bh0n8u6UKIhHZU9o4XpbMgq/lX0ZJu6ryM0dXAD2DuntRHLZ6CoEU X-Received: by 10.194.107.130 with SMTP id hc2mr37332630wjb.7.1469791410147; Fri, 29 Jul 2016 04:23:30 -0700 (PDT) MIME-Version: 1.0 Received: by 10.28.168.216 with HTTP; Fri, 29 Jul 2016 04:23:29 -0700 (PDT) In-Reply-To: References: From: Eran Messeri Date: Fri, 29 Jul 2016 12:23:29 +0100 Message-ID: To: Rob Stradling Content-Type: multipart/alternative; boundary=e89a8f83a393e5cac70538c47ab5 Archived-At: Cc: ryan-ietf@sleevi.com, "trans@ietf.org" Subject: Re: [Trans] draft-ietf-trans-rfc6962-bis-18.txt - Redaction limitation X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jul 2016 11:23:36 -0000 --e89a8f83a393e5cac70538c47ab5 Content-Type: text/plain; charset=UTF-8 It seems to me that: - James is hinting the redaction mechanism as specified does not redact "enough" (this problem is exacerbated by the lack of a proper threat model - i.e. the attacks it should defend against and attackers' capabilities) . - Ryan is saying that it's hard to evaluate the technical suitability of the specified redaction mechanism since discussions around policy and redaction of other fields did not take place. - There's otherwise no endorsement of this mechanism from any party with an interest in redaction. All of this suggests that name redaction, as currently specified, is a compromise that pleases no-one and there's not enough feedback to significantly improve it. Did I get this right? Eran On Fri, Jul 29, 2016 at 10:52 AM, Rob Stradling wrote: > On 29/07/16 00:31, Ryan Sleevi wrote: > > >> I think it's also useful to compare the logging of redacted certificates >> (which at least one CA is doing with their own non-conforming log) against >> those publicly logged certificates. If you do, you'll see the same thing I >> am: redaction is hard for users to get right, and often results in >> 'obviously wrong' things. We could blame the CA for making it too easy, >> but I also thinks it's reasonable to suggest that perhaps it's not as >> important as some have claimed. >> >> For a quick sample, consider: >> - https://crt.sh/?serial=7f90c4250ef1f03f96fbe59fcb807857 : Redacted >> "www" >> - https://crt.sh/?serial=7fe0023277563c51af6c299e9baed126 : Redacted >> "www" >> - https://crt.sh/?serial=132c3fd48f0bb6391200e9f56d43272d : Redacted >> "www" >> - https://crt.sh/?serial=2c1fa499a25405936098e31404c2dc8e : Redacted >> "mystatus", despite it being a well-known URL >> > > Hi Ryan. > > FYI, here's a snapshot I just generated of all the "redacted > precertificates" and (where known to CT) the corresponding certificates: > https://crt.sh/reports/20160729_redacted-precertificates.html > > (See also https://crt.sh/redacted-precertificates - generated in realtime > using the latest data; very slow to load; sometimes falls victim to > crt.sh's automated long-running-query killer) > > Is the ecosystem harmed by those mistakes? I would argue yes, but I know >> others would argue no. Regardless, I think this is something that spans >> beyond just the tech, involves questions that we (in the TRANS group) are >> not well suited to answer, and feels very much like something better >> removed into a separate spec and the full discussions about the tradeoffs >> can happen there. >> > > Were going round in circles again. :-( > > Please review the "Name redaction - stay or go?" thread from 6 weeks ago > [1]. FWIW, I too proposed moving redaction to a separate doc [2], but the > chairs did not direct us to take this course of action. > > There are plenty of folks with a strong preference to leave redaction in > 6962-bis, and there are plenty of folks with a strong preference to remove > redaction from 6962-bis. > > How on earth are we going to get this document through Last Call? > > It's very clear that the people actively participating >> are passionate about the tech, but I think the issues go beyond the tech, >> and I'd hate to see us settle on an incomplete or unsuitable solution. >> > > +1 > > > [1] > https://mailarchive.ietf.org/arch/msg/trans/DCIS3dwb-QbYY4ttZwlCd_zmmXY > > [2] > https://mailarchive.ietf.org/arch/msg/trans/046Cv3IQTNzNRq8LUQJsPMNeCTo > > -- > Rob Stradling > Senior Research & Development Scientist > COMODO - Creating Trust Online > > _______________________________________________ > Trans mailing list > Trans@ietf.org > https://www.ietf.org/mailman/listinfo/trans > --e89a8f83a393e5cac70538c47ab5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
It seems to me that:
- James is hinting the redaction = mechanism as specified does not redact "enough" (this problem is = exacerbated by the lack of a proper threat model - i.e. the attacks it shou= ld defend against and attackers' capabilities)=C2=A0.
- Ryan = is saying that it's hard to evaluate the technical suitability of the s= pecified redaction mechanism since discussions around policy and redaction = of other fields did not take place.
- There's otherwise no en= dorsement of this mechanism from any party with an interest in redaction.

All of this suggests that name redaction, as curren= tly specified, is a compromise that pleases no-one and there's not enou= gh feedback to significantly improve it.
Did I get this right?

Eran


On Fri, Jul 29, 2016 at 10:52 AM, Rob = Stradling <rob.stradling@comodo.com> wrote:
On 29/07/16 00:31, Ryan Sleevi wrote:
<snip>
I think it's also useful to compare the logging of redacted certificate= s
(which at least one CA is doing with their own non-conforming log) against<= br> those publicly logged certificates. If you do, you'll see the same thin= g I
am: redaction is hard for users to get right, and often results in
'obviously wrong' things. We could blame the CA for making it too e= asy,
but I also thinks it's reasonable to suggest that perhaps it's not = as
important as some have claimed.

For a quick sample, consider:
- https://crt.sh/?serial=3D7f90c4250ef1f03f= 96fbe59fcb807857 : Redacted "www"
- https://crt.sh/?serial=3D7fe0023277563c51= af6c299e9baed126 : Redacted "www"
- https://crt.sh/?serial=3D132c3fd48f0bb639= 1200e9f56d43272d : Redacted "www"
- https://crt.sh/?serial=3D2c1fa499a2540593= 6098e31404c2dc8e : Redacted
"mystatus", despite it being a well-known URL

 Hi Ryan.

FYI, here's a snapshot I just generated of all the "redacted prece= rtificates" and (where known to CT) the corresponding certificates: https://crt.sh/reports/20160729_redacte= d-precertificates.html

(See also https://crt.sh/redacted-precertificates - gener= ated in realtime using the latest data; very slow to load; sometimes falls = victim to crt.sh's automated long-running-query killer)

Is the ecosystem harmed by those mistakes? I would argue yes, but I know others would argue no. Regardless, I think this is something that spans
beyond just the tech, involves questions that we (in the TRANS group) are not well suited to answer, and feels very much like something better
removed into a separate spec and the full discussions about the tradeoffs can happen there.

 Were going round in circles again.=C2=A0 :-(

Please review the "Name redaction - stay or go?" thread from 6 we= eks ago [1].=C2=A0 FWIW, I too proposed moving redaction to a separate doc = [2], but the chairs did not direct us to take this course of action.

There are plenty of folks with a strong preference to leave redaction in 69= 62-bis, and there are plenty of folks with a strong preference to remove re= daction from 6962-bis.

How on earth are we going to get this document through Last Call?

It's very clear that the people actively participating
are passionate about the tech, but I think the issues go beyond the tech, and I'd hate to see us settle on an incomplete or unsuitable solution.<= br>

+1


[1] https://mailarchive.ietf.= org/arch/msg/trans/DCIS3dwb-QbYY4ttZwlCd_zmmXY

[2] https://mailarchive.ietf.= org/arch/msg/trans/046Cv3IQTNzNRq8LUQJsPMNeCTo

--
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online

_______________________________________________
Trans mailing list
Trans@ietf.org
https://www.ietf.org/mailman/listinfo/trans

--e89a8f83a393e5cac70538c47ab5-- From nobody Fri Jul 29 04:35:40 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD24112DDC2 for ; Fri, 29 Jul 2016 04:35:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aw8jZqeaNJUW for ; Fri, 29 Jul 2016 04:35:35 -0700 (PDT) Received: from mmextmx1.mcr.colo.comodoca.net (mmextmx1.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 41BA312DDCD for ; Fri, 29 Jul 2016 04:35:35 -0700 (PDT) Received: (qmail 20336 invoked by uid 1004); 29 Jul 2016 11:35:33 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx1.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Fri, 29 Jul 2016 12:35:33 +0100 Received: (qmail 10774 invoked by uid 1000); 29 Jul 2016 11:35:33 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Fri, 29 Jul 2016 12:35:33 +0100 To: Eran Messeri References: From: Rob Stradling Message-ID: <19b632b6-6955-364d-e927-e6e375b86106@comodo.com> Date: Fri, 29 Jul 2016 12:35:33 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: ryan-ietf@sleevi.com, "trans@ietf.org" Subject: Re: [Trans] draft-ietf-trans-rfc6962-bis-18.txt - Redaction limitation X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jul 2016 11:35:38 -0000 On 29/07/16 12:23, Eran Messeri wrote: > It seems to me that: > - James is hinting the redaction mechanism as specified does not redact > "enough" (this problem is exacerbated by the lack of a proper threat > model - i.e. the attacks it should defend against and attackers' > capabilities) . > - Ryan is saying that it's hard to evaluate the technical suitability of > the specified redaction mechanism since discussions around policy and > redaction of other fields did not take place. > - There's otherwise no endorsement of this mechanism from any party with > an interest in redaction. > > All of this suggests that name redaction, as currently specified, is a > compromise that pleases no-one and there's not enough feedback to > significantly improve it. > Did I get this right? Yes. Good summary. -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From nobody Fri Jul 29 05:03:48 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D682A12D094 for ; Fri, 29 Jul 2016 05:03:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.187 X-Spam-Level: X-Spam-Status: No, score=-3.187 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.287] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a5IY1jP3JVfR for ; Fri, 29 Jul 2016 05:03:45 -0700 (PDT) Received: from durif.tools.ietf.org (durif.tools.ietf.org [IPv6:2001:1900:3001:11::3d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5790C12B044 for ; Fri, 29 Jul 2016 05:03:45 -0700 (PDT) Received: from localhost ([::1]:58580 helo=durif.tools.ietf.org) by durif.tools.ietf.org with esmtp (Exim 4.82_1-5b7a7c0-XX) (envelope-from ) id 1bT6Vw-0006j0-FA; Fri, 29 Jul 2016 05:03:40 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "trans issue tracker" X-Trac-Version: 0.12.5 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.5, by Edgewall Software To: rob.stradling@comodo.com, benl@google.com, eranm@google.com, melinda.shore@gmail.com X-Trac-Project: trans Date: Fri, 29 Jul 2016 12:03:40 -0000 X-URL: https://tools.ietf.org/trans/ X-Trac-Ticket-URL: https://trac.tools.ietf.org/wg/trans/trac/ticket/111#comment:7 Message-ID: <080.dc39dc7a5b8f88fce86922979146124b@tools.ietf.org> References: <065.0226a5b84d88bdfc7c9b20fa02c5a3aa@tools.ietf.org> X-Trac-Ticket-ID: 111 In-Reply-To: <065.0226a5b84d88bdfc7c9b20fa02c5a3aa@tools.ietf.org> X-SA-Exim-Connect-IP: ::1 X-SA-Exim-Rcpt-To: rob.stradling@comodo.com, benl@google.com, eranm@google.com, melinda.shore@gmail.com, trans@ietf.org X-SA-Exim-Mail-From: trac+trans@tools.ietf.org X-SA-Exim-Scanned: No (on durif.tools.ietf.org); SAEximRunCond expanded to false Archived-At: Cc: trans@ietf.org Subject: Re: [Trans] [trans] #111 (to-be-decided): Consider using the cached-info TLS extension X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jul 2016 12:03:47 -0000 #111: Consider using the cached-info TLS extension Comment (by rob.stradling@comodo.com): Proposed text out for review: https://github.com/google/certificate-transparency-rfcs/pull/186/files -- -------------------------------------+------------------------------------- Reporter: | Owner: rob.stradling@comodo.com | rob.stradling@comodo.com Type: enhancement | Status: new Priority: minor | Milestone: Component: to-be-decided | Version: Severity: - | Resolution: Keywords: | -------------------------------------+------------------------------------- Ticket URL: trans From nobody Sat Jul 30 15:35:41 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2696A12B058 for ; Sat, 30 Jul 2016 15:35:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.388 X-Spam-Level: X-Spam-Status: No, score=-1.388 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-1.287] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JLs8kOPkpQtZ for ; Sat, 30 Jul 2016 15:35:39 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 40B6A12B00F for ; Sat, 30 Jul 2016 15:35:39 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 3s20mR34wfz3Bd; Sun, 31 Jul 2016 00:35:35 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1469918135; bh=i4+2leI24pdp7EQKcTDCPwQh6qawtNlYv0BYaIHMq8k=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=Bc9B8CsmQ/QQEsTANUwDltHLDzQywgsWlu+vnQSuep2dmglDYtz0hNVj3nsDrSejo g6JcrRkedwO7z5+oynxhmBWdlpgIXWrTliMkq8W8zLazkf3CJk/sFMrJ91E15ZCLfj SF4ko3AZwh44ewfbtszeet6DSv9qh6HeXXpFz6SE= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id BIRgZooTcNse; Sun, 31 Jul 2016 00:35:34 +0200 (CEST) Received: from bofh.nohats.ca (206-248-139-105.dsl.teksavvy.com [206.248.139.105]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Sun, 31 Jul 2016 00:35:34 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 90EB4393BF9; Sat, 30 Jul 2016 18:35:33 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.10.3 bofh.nohats.ca 90EB4393BF9 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 7F2F6406A91F; Sat, 30 Jul 2016 18:35:33 -0400 (EDT) Date: Sat, 30 Jul 2016 18:35:33 -0400 (EDT) From: Paul Wouters To: Eran Messeri In-Reply-To: Message-ID: References: User-Agent: Alpine 2.20 (LRH 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] draft-ietf-trans-rfc6962-bis-18.txt - Redaction limitation X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 30 Jul 2016 22:35:40 -0000 On Fri, 29 Jul 2016, Eran Messeri wrote: > - There's otherwise no endorsement of this mechanism from any party with an interest in redaction. You mean from browsers? Because we have already seen redacted precertificates. Unless you think those were just tests? Paul From nobody Sat Jul 30 15:40:47 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13DF212D18C for ; Sat, 30 Jul 2016 15:40:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.287 X-Spam-Level: X-Spam-Status: No, score=-3.287 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-1.287] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g5nE2HVyZbB5 for ; Sat, 30 Jul 2016 15:40:44 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2FE7412B058 for ; Sat, 30 Jul 2016 15:40:44 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 3s20tL3wHLz3Bd; Sun, 31 Jul 2016 00:40:42 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1469918442; bh=e+Vlst8LQ273zu67+m6E8pUH5bZKEeI2UlKc1zo+A9I=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=Nx9FAIG7ac4ra3YfDLmbDwTg935SMhkW/jkX/L8f1SNnbpv9p35uMCHoZRZIgaEFn +aTCqb/R+bcDEfMaBQGNTXmE8kCsKBMHx2bQUdTmaa++zSagxjLzL6pbG8tDLmccOl bWSCsSXUuhhs+HL6l6QZinQ4r3VInsVzWIDVD6kY= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id I1yJpEL1OBkQ; Sun, 31 Jul 2016 00:40:41 +0200 (CEST) Received: from bofh.nohats.ca (206-248-139-105.dsl.teksavvy.com [206.248.139.105]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Sun, 31 Jul 2016 00:40:41 +0200 (CEST) Received: by bofh.nohats.ca (Postfix, from userid 1000) id A7106393BF9; Sat, 30 Jul 2016 18:40:40 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.10.3 bofh.nohats.ca A7106393BF9 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 8A11B406A920; Sat, 30 Jul 2016 18:40:40 -0400 (EDT) Date: Sat, 30 Jul 2016 18:40:40 -0400 (EDT) From: Paul Wouters To: Eran Messeri In-Reply-To: Message-ID: References: User-Agent: Alpine 2.20 (LRH 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Cc: ryan-ietf@sleevi.com, Rob Stradling , "trans@ietf.org" Subject: Re: [Trans] draft-ietf-trans-rfc6962-bis-18.txt - Redaction limitation X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 30 Jul 2016 22:40:45 -0000 On Fri, 29 Jul 2016, Eran Messeri wrote: > All of this suggests that name redaction, as currently specified, is a compromise that pleases no-one and there's not enough feedback to > significantly improve it. > Did I get this right? I believe so. If anyone thinks redaction as currently specified or with minor changes should remain in the document, please speak up soon. Otherwise I think the consensus is to remove the redaction from the current document. Paul From nobody Sat Jul 30 19:07:08 2016 Return-Path: X-Original-To: trans@ietfa.amsl.com Delivered-To: trans@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 383E812B007 for ; Sat, 30 Jul 2016 19:07:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.987 X-Spam-Level: X-Spam-Status: No, score=-3.987 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.287, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tKqewSz-Nvno for ; Sat, 30 Jul 2016 19:07:06 -0700 (PDT) Received: from mail-wm0-x236.google.com (mail-wm0-x236.google.com [IPv6:2a00:1450:400c:c09::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DCA71127071 for ; Sat, 30 Jul 2016 19:07:05 -0700 (PDT) Received: by mail-wm0-x236.google.com with SMTP id f65so330649507wmi.0 for ; Sat, 30 Jul 2016 19:07:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=kar/4Bvaq7VSnSXknlKp8eZIo99cusrnzvby6WPoEIE=; b=iQ/kHO2MnDF+lm8xrBfb9B3dJ4q8sjW2W0o4ddf4UJgSZ5NsN6TQzH+RD1CXw4aR+l yOnCHydmAgTOI7QPl20V/IDvNlv3nXGatUJc5m62P2KLGcvoE/gD8iujO5g1petHJYXP qUi9JY/tKTEHX5OyS9vo6gGqOgal8Y+VCsPL3jUDiPPhnpEHu8ckAWIuIs1wh5pQyUAK W2//FIkt+jb93NjKhujCCA7+VSuvCiV/iR8XVEU2Fm0FM6oD79r4+JBaK5grUJ0yt9N3 08npFnhG8/K44sWJ5+k8pY/IW6NczpMv+CUipK03DULH+fAssjMtDy285ACU491heKae PSRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=kar/4Bvaq7VSnSXknlKp8eZIo99cusrnzvby6WPoEIE=; b=eMyNsTfTrKHMmGKlF2fWdsDYKBlndlxHaOK0RFAMum6O+aZoaS/p9oJlCFqrenXEMB BYXfI0gZ0qDLCViPch5sLA1z3I5wJD3UbQ0EMJLttWF2OYnQQHljdiiMxLOLYpfjrgx2 Nm4AUR2rDf7qTh3hYVzC0Nwq5a1QoGePL4l+4W1ykxYdOUgkiZGy19LZ9PNBoYqhmasC d+KmysQ85mt0SKh/+8ZFvdak1aTAy9qpPuRXIaY3Mh443VfTrzwUEoVV0qubfAoKCMws y/+Uwt9AXdv0zbTNS0jvNVzDb8iNrzxMnr0bF88VnXo1rcWRHWmZLu7HZb4d/Qd7qTP7 gNUQ== X-Gm-Message-State: AEkoouvWZEmViQbCcuc+YLP9nLEu5qB977fVZ4/lSWm9Tllr3qTlffp/xSSFca/U4rYBTmrJ+A0dVhu3PjQUyKwn X-Received: by 10.28.140.10 with SMTP id o10mr7832689wmd.36.1469930824115; Sat, 30 Jul 2016 19:07:04 -0700 (PDT) MIME-Version: 1.0 Received: by 10.28.168.216 with HTTP; Sat, 30 Jul 2016 19:07:03 -0700 (PDT) In-Reply-To: References: From: Eran Messeri Date: Sun, 31 Jul 2016 03:07:03 +0100 Message-ID: To: Paul Wouters Content-Type: multipart/alternative; boundary=001a114691529de8900538e4f012 Archived-At: Cc: "trans@ietf.org" Subject: Re: [Trans] draft-ietf-trans-rfc6962-bis-18.txt - Redaction limitation X-BeenThere: trans@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Public Notary Transparency working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 Jul 2016 02:07:07 -0000 --001a114691529de8900538e4f012 Content-Type: text/plain; charset=UTF-8 On Sat, Jul 30, 2016 at 11:35 PM, Paul Wouters wrote: > On Fri, 29 Jul 2016, Eran Messeri wrote: > > - There's otherwise no endorsement of this mechanism from any party with >> an interest in redaction. >> > > You mean from browsers? Because we have already seen redacted > precertificates. Unless you think those were just tests? I mean CAs / domain owners who care about keeping some of their dns names private. We have seen redacted precertificates that were redacted using a mechanism specified in one of the earlier drafts but grafted onto 6962 log (*not* a 6962-bis log). As Ryan Sleevi pointed out in his post, some of these redactions did not make any sense. Either way the SCTs for these redacted precerts would not be accepted by any TLS client that supports CT, not now (with 6962 client) and not in the future (6962-bis clients). Eran > > > Paul > --001a114691529de8900538e4f012 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Sat, Jul 30, 2016 at 11:35 PM, Paul Wouters <paul@nohats.ca> wrote:
On Fri, 29 J= ul 2016, Eran Messeri wrote:

- There's otherwise no endorsement of this mechanism from any party wit= h an interest in redaction.

 You mean from browsers? Because we have already seen redacted
precertificates. Unless you think those were just tests?
I= mean CAs / domain owners who care about keeping some of their dns names pr= ivate.
We have seen redacted precertificates that were redacted u= sing a mechanism specified in one of the earlier drafts but grafted onto 69= 62 log (*not* a 6962-bis log). As Ryan Sleevi pointed out in his post, some= of these redactions did not make any sense. Either way the SCTs for these = redacted precerts would not be accepted by any TLS client that supports CT,= not now (with 6962 client) and not in the future (6962-bis clients).
=

Eran=C2=A0


Paul

--001a114691529de8900538e4f012--