From nobody Sat Apr 18 06:33:26 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 377D91A0387 for ; Sat, 18 Apr 2015 06:33:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.661 X-Spam-Level: X-Spam-Status: No, score=-1.661 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_EQ_SE=0.35, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v_u8vmzlXphM for ; Sat, 18 Apr 2015 06:33:23 -0700 (PDT) Received: from e-mailfilter01.sunet.se (e-mailfilter01.sunet.se [IPv6:2001:6b0:8:2::201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC17A1A0302 for ; Sat, 18 Apr 2015 06:33:22 -0700 (PDT) Received: from smtp1.sunet.se (smtp1.sunet.se [192.36.171.214]) by e-mailfilter01.sunet.se (8.14.4/8.14.4/Debian-4) with ESMTP id t3IDXKV0019872 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Sat, 18 Apr 2015 15:33:20 +0200 Received: from kerio.sunet.se (kerio.sunet.se [192.36.171.210]) by smtp1.sunet.se (8.14.9/8.14.7) with ESMTP id t3IDXHcP029795 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sat, 18 Apr 2015 15:33:19 +0200 (CEST) VBR-Info: md=sunet.se; mc=all; mv=swamid.se DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sunet.se; s=default; t=1429363999; bh=XdP627v4BUATEOIfpMoKb4lWm6f7+hPbQiUoO+7CfqY=; h=Date:From:To:Subject; b=fGfJlxNZwe0zl1/LG4qUaVMUw/a9PtyhPiGMZstiOmyyuUex5NkSlfZkcPMG2kqcP vWhOqLVy/a5qXK+2LM83ERl+ZaD3n2JAT4HYB3wK4PVD1jjEFfRYosV30hHe5BtWgE PxVUPeBAcRFoGkODKVZAVMcBgRI1UUF2Y8Y0W7uM= X-Footer: c3VuZXQuc2U= Received: from [10.0.0.107] ([62.102.145.131]) (authenticated user leifj@sunet.se) by kerio.sunet.se (Kerio Connect 8.3.4 patch 1) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256 bits)) for unbearable@ietf.org; Sat, 18 Apr 2015 15:33:16 +0200 Message-ID: <55325D1C.1080807@sunet.se> Date: Sat, 18 Apr 2015 15:33:16 +0200 From: Leif Johansson User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.6.0 MIME-Version: 1.0 To: "unbearable@ietf.org" Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Bayes-Prob: 0.0001 (Score 0, tokens from: outbound, outbound-sunet-se:default, sunet-se:default, base:default, @@RPTN) X-CanIt-Geo: ip=192.36.171.210; country=SE; latitude=59.3294; longitude=18.0686; http://maps.google.com/maps?q=59.3294,18.0686&z=6 X-CanItPRO-Stream: outbound-sunet-se:outbound (inherits from outbound-sunet-se:default, sunet-se:default, base:default) X-Canit-Stats-ID: 09Ohpxk1T - 8263b1ee1017 - 20150418 X-CanIt-Archive-Cluster: PfMRe/vJWMiXwM2YIH5BVExnUnw Received-SPF: neutral (e-mailfilter01.sunet.se: 192.36.171.210 is neither permitted nor denied by domain leifj@sunet.se) receiver=e-mailfilter01.sunet.se; client-ip=192.36.171.210; envelope-from=; helo=smtp1.sunet.se; identity=mailfrom X-Scanned-By: CanIt (www . roaringpenguin . com) on 192.36.171.201 Archived-At: Subject: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Apr 2015 13:33:25 -0000 Folks, The core drafts have been out and published as WG documents for a couple of weeks now. Please review! Cheers Leif From nobody Sat Apr 18 08:16:20 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84B5A1A884F for ; Sat, 18 Apr 2015 08:16:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.536 X-Spam-Level: ** X-Spam-Status: No, score=2.536 tagged_above=-999 required=5 tests=[BAYES_50=0.8, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MALFORMED_FREEMAIL=0.001, MIME_HTML_ONLY=0.723, MISSING_HEADERS=1.021, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id riMh9k13xMDp for ; Sat, 18 Apr 2015 08:16:17 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.17.22]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 301E71A87A8 for ; Sat, 18 Apr 2015 08:16:17 -0700 (PDT) Received: from [93.214.253.103] by 3capp-gmx-bs65.server.lan (via HTTP); Sat, 18 Apr 2015 17:16:15 +0200 MIME-Version: 1.0 Message-ID: From: D.Rogers@gmx.net Cc: "unbearable@ietf.org" Content-Type: text/html; charset=UTF-8 Date: Sat, 18 Apr 2015 17:16:15 +0200 Importance: normal Sensitivity: Normal In-Reply-To: <55325D1C.1080807@sunet.se> References: <55325D1C.1080807@sunet.se> X-UI-Message-Type: mail X-Priority: 3 X-Provags-ID: V03:K0:qe9Yc1A6RrPPnG+XYYZTeQk3j0U3Nxu2TICC4wce+2J xA25nmXYSNRa8Kt8DfXK+FAlcQDfiBHGM0pVOLwKQ5eup0Y5Yg mauH3jJ5vL3g6wX/lp+Qzfe5cZa85lr01gY0N5DOiXEwukB0DZ hyY6nt62PRz710K4hu17kHiG1lNrS3SiB3mTE7q0vXuO1BLNt9 ZSTgyCOyt/G09QGCOIX+Y6XU4nuXCMWksnOkj40y07w1/Ovx/j TmGEx7BAGdlG4Auor0R+e653Mt5f036SZu/l0l4wTnF/7nk2UF 59anPY= X-UI-Out-Filterresults: notjunk:1; Archived-At: Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Apr 2015 15:16:18 -0000
Sorry,
 
but like a lot of people we are all busy,
 
can you repeat the links,
without wishing to sound like Dr Who, you catch me at a time when I have time,
possibly its the same for others, quick links without having to mine them would be most useful brigadier :-)
 
best
Dean
Gesendet: Samstag, 18. April 2015 um 15:33 Uhr
Von: "Leif Johansson" <leifj@sunet.se>
An: "unbearable@ietf.org" <unbearable@ietf.org>
Betreff: [Unbearable] reviewing our 00's

Folks,

The core drafts have been out and published as WG documents for a couple
of weeks now. Please review!

Cheers Leif

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable
From nobody Sat Apr 18 08:22:19 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1BD981A891B for ; Sat, 18 Apr 2015 08:22:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.578 X-Spam-Level: X-Spam-Status: No, score=-3.578 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W49Wlc6tBMGp for ; Sat, 18 Apr 2015 08:22:15 -0700 (PDT) Received: from mail-ig0-f175.google.com (na3sys009aog121.obsmtp.com [74.125.149.145]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 59EFF1A8911 for ; Sat, 18 Apr 2015 08:22:15 -0700 (PDT) Received: from mail-ig0-f175.google.com ([209.85.213.175]) (using TLSv1) by na3sys009aob121.postini.com ([74.125.148.12]) with SMTP ID DSNKVTJ2pqHrK6WWpfUpm68YdmR5Qq5eIS3l@postini.com; Sat, 18 Apr 2015 08:22:15 PDT Received: by igbpi8 with SMTP id pi8so41719508igb.0 for ; Sat, 18 Apr 2015 08:22:14 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=0IqGpwSVccca7sd1O28SIOV1upa1mZOHWR4lbBkG3EY=; b=ZsQFyiy0PyZ1RXmyFjNuSmlrBnnWuW1InU2dEwuVxD6bSVRElUbI/ehzYs+wGK/2bs QyJe11spFjVV/8rqtLWXkTAHALxjYrcS4uK5dooGUtpek/Fc3NhBfCeV8d4BIaKCL/tR 1tAnVnYh6sSDLxZ0j3QXj/JuDhAlK7ifnP9bNuwNWlmjZvPWTwP0BOZ2Uad6oslTuoIO c86VfDCLGc8rLnPl0TjbwzPN8WMuaOJX4dFrxblp8fwvhsrNxd2VNja4PE40tM3Slqv0 99j9rrN42B/9zzvp83aTGyxfFB09CqCZ2zuOqRCrrnG91el//nhtWUHASGReZAyXTvf4 AEuQ== X-Gm-Message-State: ALoCoQmsNYoqG8rmJVq18KRTyxJBOtLwNU74Q/BSvC3exsIOOcxAvx3bIp4tMMpi3njK2AjOzSf1HsAcN/NLIezTOTH7EdC4VBagB3eXyV/YKZBnnOgqd3qHxihM5xJjAWvfmQL8hPwqfdW8iebTjG1p2H9NpHjK2A== X-Received: by 10.107.138.96 with SMTP id m93mr11230021iod.14.1429370534604; Sat, 18 Apr 2015 08:22:14 -0700 (PDT) X-Received: by 10.107.138.96 with SMTP id m93mr11230006iod.14.1429370534462; Sat, 18 Apr 2015 08:22:14 -0700 (PDT) MIME-Version: 1.0 Received: by 10.64.240.15 with HTTP; Sat, 18 Apr 2015 08:21:44 -0700 (PDT) In-Reply-To: References: <55325D1C.1080807@sunet.se> From: Brian Campbell Date: Sat, 18 Apr 2015 09:21:44 -0600 Message-ID: To: D.Rogers@gmx.net Content-Type: multipart/alternative; boundary=001a113f19e2f5c4b8051401422b Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Apr 2015 15:22:17 -0000 --001a113f19e2f5c4b8051401422b Content-Type: text/plain; charset=UTF-8 Some links: http://tools.ietf.org/html/draft-ietf-tokbind-protocol-00 http://tools.ietf.org/html/draft-ietf-tokbind-https-00 https://github.com/TokenBinding/ On Sat, Apr 18, 2015 at 9:16 AM, wrote: > Sorry, > > but like a lot of people we are all busy, > > can you repeat the links, > without wishing to sound like Dr Who, you catch me at a time when I have > time, > possibly its the same for others, quick links without having to mine them > would be most useful brigadier :-) > > best > Dean > *Gesendet:* Samstag, 18. April 2015 um 15:33 Uhr > *Von:* "Leif Johansson" > *An:* "unbearable@ietf.org" > *Betreff:* [Unbearable] reviewing our 00's > > Folks, > > The core drafts have been out and published as WG documents for a couple > of weeks now. Please review! > > Cheers Leif > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > > --001a113f19e2f5c4b8051401422b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

On Sat, Apr 18, 2015 at 9:16 AM, &l= t;D.Rogers@gmx.net> wrote:

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable


--001a113f19e2f5c4b8051401422b-- From nobody Sat Apr 18 09:57:57 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DDDE91A8BB4 for ; Sat, 18 Apr 2015 09:57:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DYNDA5_FAP5c for ; Sat, 18 Apr 2015 09:57:54 -0700 (PDT) Received: from emh07.mail.saunalahti.fi (emh07.mail.saunalahti.fi [62.142.5.117]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 275A71A8BBD for ; Sat, 18 Apr 2015 09:57:53 -0700 (PDT) Received: from LK-Perkele-VII (a88-112-44-140.elisa-laajakaista.fi [88.112.44.140]) by emh07.mail.saunalahti.fi (Postfix) with ESMTP id 8E98A4024; Sat, 18 Apr 2015 19:57:51 +0300 (EEST) Date: Sat, 18 Apr 2015 19:57:51 +0300 From: Ilari Liusvaara To: Leif Johansson Message-ID: <20150418165751.GA14171@LK-Perkele-VII> References: <55325D1C.1080807@sunet.se> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <55325D1C.1080807@sunet.se> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: Ilari Liusvaara Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Apr 2015 16:57:57 -0000 On Sat, Apr 18, 2015 at 03:33:16PM +0200, Leif Johansson wrote: > > Folks, > > The core drafts have been out and published as WG documents for a couple > of weeks now. Please review! Some points: 1) ALPN does not scale. Sadly, HTTP/2 has no way to perform server 0RTT capability advertisment without TLS 1.3 (and even there, it might not work with client certs) otherwise. 2) Following CFRG on signatures would be useful. They have completed ECDH work and moved to signatures (which shouldn't take too long to complete). 3) I expect somebody to complain about inventing a new key/ signature format instead of using existing ones (e.g. JOSE or whatever TLS RPK uses). :-) 4) TLS-unique can't be synchronized without resumption (or insecure renegotiation), even without EMS. 5) If one does not have HSM available, one should handle the keys in dedicated process. Makes grabbing those keys more annoying, to the point when the attacker can grab those, you are likely toast anyway. 6) Why is referred binding restricted to 301 and 302? I can't come up with a sensible category that only has 301 and 302. -Ilari From nobody Sat Apr 18 11:23:21 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A05911A882D for ; Sat, 18 Apr 2015 11:23:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.164 X-Spam-Level: X-Spam-Status: No, score=-0.164 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MALFORMED_FREEMAIL=0.001, MIME_HTML_ONLY=0.723, MISSING_HEADERS=1.021, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3hQk0Te8aynU for ; Sat, 18 Apr 2015 11:23:18 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.17.21]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EF4071A882A for ; Sat, 18 Apr 2015 11:23:17 -0700 (PDT) Received: from [93.214.253.103] by 3capp-gmx-bs64.server.lan (via HTTP); Sat, 18 Apr 2015 20:23:16 +0200 MIME-Version: 1.0 Message-ID: From: D.Rogers@gmx.net Cc: "unbearable@ietf.org" Content-Type: text/html; charset=UTF-8 Date: Sat, 18 Apr 2015 20:23:15 +0200 Importance: normal Sensitivity: Normal In-Reply-To: References: <55325D1C.1080807@sunet.se> , X-UI-Message-Type: mail X-Priority: 3 X-Provags-ID: V03:K0:uxXWe81gbGiJQgOmJsOaHK3gsIY+O7t+Qdrbn7h/aIc Ieod3WkJ/etfDhA4LR0zHJAbbwVL1unqXWSl+d8tsaVyQMSE1u m2pdZZHbye3l1qxv7hB0/LboU267LGsk/nXr4PC1YHQCZFs7nc WFsXHWfvH1aamHnU2yc3LNvQdu+2PKc6B1KAJBq+XaxPRH3DJS Fe/5vqjFptw3n5QUzI3wFdlsZIcCDkguCLx32iLo7SVQL88AKZ DbJl7oVW52ya5bFSH1c58dCP7q/hB4GwYftbXJz9skQzNk3m5E CqbKrI= X-UI-Out-Filterresults: notjunk:1; Archived-At: Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Apr 2015 18:23:19 -0000
Dear all,
 
 
nit:
"The Token Binding protocol allows client/server applications to create long-lived,"
 
just a semantic point but this is not yet proven so
"The Token Binding protocol aims to allow client/server applications to create long-lived" is better.
 
purly semantic
"The idea of Token Binding is to prevent such attacks by cryptographically binding security tokens to the TLS layer."
 
shoud be
"The idea of Token Binding is to prevent such attacks by cryptographically binding security tokens at the TLS layer."
 
Introduction:
"Token Binding identifiers are never transmitted in clear text and can be reset by the user at any time, e.g. when clearing browser cookies."
 
This sounds alarmist to most readers, meaning this should not be stated without further explanation, but the introduction is not the right place, so defer this until later.
 
2. Token Binding Protocol Overview
"This message is only sent if the client and server agree on the use of the Token Binding protocol."
Be specific on what happens when they do not agree. This is detailed later, but a re-wright for clarity would be benificial.
 
"If the bound token came from a TLS connection without a Token Binding, or if the IDs don't match, the token is discarded."

should be appended ".. and the connection dropped." This is stated later, but to avoid confusion it should also be mentioned briefly at this point.
 
Dean
 
Gesendet: Samstag, 18. April 2015 um 17:21 Uhr
Von: "Brian Campbell" <bcampbell@pingidentity.com>
An: D.Rogers@gmx.net
Cc: "unbearable@ietf.org" <unbearable@ietf.org>
Betreff: Re: [Unbearable] reviewing our 00's
 
On Sat, Apr 18, 2015 at 9:16 AM, <D.Rogers@gmx.net> wrote:
Sorry,
 
but like a lot of people we are all busy,
 
can you repeat the links,
without wishing to sound like Dr Who, you catch me at a time when I have time,
possibly its the same for others, quick links without having to mine them would be most useful brigadier :-)
 
best
Dean
Gesendet: Samstag, 18. April 2015 um 15:33 Uhr
Von: "Leif Johansson" <leifj@sunet.se>
An: "unbearable@ietf.org" <unbearable@ietf.org>
Betreff: [Unbearable] reviewing our 00's

Folks,

The core drafts have been out and published as WG documents for a couple
of weeks now. Please review!

Cheers Leif

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable
 
_______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable
From nobody Sat Apr 18 13:11:18 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72A601A8747 for ; Sat, 18 Apr 2015 13:11:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.164 X-Spam-Level: X-Spam-Status: No, score=-0.164 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MALFORMED_FREEMAIL=0.001, MIME_HTML_ONLY=0.723, MISSING_HEADERS=1.021, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dC7FCpSsNSBL for ; Sat, 18 Apr 2015 13:11:16 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.15.19]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AA1CA1A1BD1 for ; Sat, 18 Apr 2015 13:11:15 -0700 (PDT) Received: from [93.214.253.103] by 3capp-gmx-bs64.server.lan (via HTTP); Sat, 18 Apr 2015 22:11:13 +0200 MIME-Version: 1.0 Message-ID: From: D.Rogers@gmx.net Cc: "unbearable@ietf.org" Content-Type: text/html; charset=UTF-8 Date: Sat, 18 Apr 2015 22:11:13 +0200 Importance: normal Sensitivity: Normal In-Reply-To: References: <55325D1C.1080807@sunet.se> , X-UI-Message-Type: mail X-Priority: 3 X-Provags-ID: V03:K0:18A1UlbOpUOzwaC1EJpVN2E3whgsJa/drfCqPhJza8n bkUTNYWaCTGnM9q+Qm5PiAUrljQROJDAsD6GZbqcr29YEFl7wb ClMAY18tTxRWURM57Co/MF5c9ko6m7L4agP8l/M26yL9IwACQB CCICEbYD7EAUCweB/clbucYfDjnjXfGwzZIIduhcEN0Ha0XKpK HE1mG9cafDeJ5oMG7lRKGqmwrPF/zA8R2/eA7aXu1jRIx3MNxT Ju9nCc4b+57w8uN4JxaJElUhs4sPe25UhW5ZAVYPloFmYaKZBr dpclyw= X-UI-Out-Filterresults: notjunk:1; Archived-At: Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Apr 2015 20:11:17 -0000
Dear All,
 
 
perhaps its a bit late to be raising this point but:
Abstract:
"an HTTP server issues a security token (such as a cookie) to a client, and expects the client to send the security token back to the server at a later time in order to authenticate."
 
What happens if exactly at that moment the the client clears thier cache after the token/cookie is received?
Something in the challenge-response mechanism is missing here. Why does the HTTP Server issue the token, at this point there is no mention of a challenge prompting this response. What should the challenge look like? Basically this does not belong in the abstract.
 
"Binding the token to the TLS connection between client and server protects the security token from theft, and ensures that the security token can only be used by the client that it was issued to."
This binding is not yet established, so ... "and would ensure that the security token..."
 
Please, I may have misunderstood something, but are we saying that a token issued by server A to client X may possibly be accepted by server B, surely this can only be the case on implicit trust between servers A and B?
Further, "the client proves possession of (private key) to the server, and is long-lived (i.e., subsequent TLS connections between the same client and server have the same Token Binding ID."
I still have the same conceptual problem with cache flushing, if the cookie is gone the whole process has to start from the beginning and the client has to prove they are still the same client. In other words re-establish the 3rd leg of a challenge response protocol. Where this is still the same client only time is lost. but I am afraid that should an attacker be able to generate such a failure they may be able to hijack the session.
 
Section 3.1 suggests that each client operate a large scale Key-management system, "clients use different private keys to establish Provided Token Binding IDs with different servers".
Clients are clients and this should not be thier business.
It was with this, to my mind, major architectural conceptual misdiection that stoped my reading further.
 
Salutem
Dean
 
Gesendet: Samstag, 18. April 2015 um 17:21 Uhr
Von: "Brian Campbell" <bcampbell@pingidentity.com>
An: D.Rogers@gmx.net
Cc: "unbearable@ietf.org" <unbearable@ietf.org>
Betreff: Re: [Unbearable] reviewing our 00's
 
On Sat, Apr 18, 2015 at 9:16 AM, <D.Rogers@gmx.net> wrote:
Sorry,
 
but like a lot of people we are all busy,
 
can you repeat the links,
without wishing to sound like Dr Who, you catch me at a time when I have time,
possibly its the same for others, quick links without having to mine them would be most useful brigadier :-)
 
best
Dean
Gesendet: Samstag, 18. April 2015 um 15:33 Uhr
Von: "Leif Johansson" <leifj@sunet.se>
An: "unbearable@ietf.org" <unbearable@ietf.org>
Betreff: [Unbearable] reviewing our 00's

Folks,

The core drafts have been out and published as WG documents for a couple
of weeks now. Please review!

Cheers Leif

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable
 
_______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable
From nobody Mon Apr 20 10:19:41 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6279D1B2C4C for ; Mon, 20 Apr 2015 10:19:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.578 X-Spam-Level: X-Spam-Status: No, score=-3.578 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s2-7KAW3P7Tv for ; Mon, 20 Apr 2015 10:19:39 -0700 (PDT) Received: from mail-ig0-f179.google.com (na3sys009aog138.obsmtp.com [74.125.149.19]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CF9FB1B2C4D for ; Mon, 20 Apr 2015 10:19:38 -0700 (PDT) Received: from mail-ig0-f179.google.com ([209.85.213.179]) (using TLSv1) by na3sys009aob138.postini.com ([74.125.148.12]) with SMTP ID DSNKVTU1KbfCcQeAlT+HyWtbXbDZGS/G/Zc8@postini.com; Mon, 20 Apr 2015 10:19:38 PDT Received: by iget9 with SMTP id t9so70159004ige.1 for ; Mon, 20 Apr 2015 10:19:37 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=aTYBoU1OecYkjM2iwvX04WeRXfef5WqCQ8Jl/nOqXYc=; b=l3x+rGYWgVFklBCX4gs8j6phAsb8BjJtHx/wJzC3H+TEX3OceOnL+ssTRsEaKCuw7K vyYG5FZSZDcC9igAToJp6VXnPWIxeioq7EO/z3e68nhPkDQWj67hcwa7QRO3iPCiO4JC lLxYaf6F8Ur3nMLetKiqPa1r4Riz7KAwy5rN0Ad8enMuFwrlmLHvcCUka0tKLY9Z9AS3 v/V9N1AgzUIqBg1OlR3RJamuHRq0fGSVFRgCa+lII49qvr4dMo9p6KxyViqQW4qjcAoI Q56dDPzx5dwweggOpV+CQMNpz8E6NyBB7kjVUuyxrZIHDUEy+jPqTRExpRrXRkEiqlPl T32Q== X-Gm-Message-State: ALoCoQlCJNExAuR9IFTNYnBaC/xY/mFRS+tBlpWJYDUwEJwok/7SN79F5HkSlPlSSW5ucNxXeBIOj7Ud5mMskB1NlE9h46x7yoYyPG2HO9gAtDguLkWWIqXYLFppvhuMIwwEl1nLpIb79PhalZOK6lDRm0mKNFJriQ== X-Received: by 10.50.90.179 with SMTP id bx19mr22463131igb.43.1429550377293; Mon, 20 Apr 2015 10:19:37 -0700 (PDT) X-Received: by 10.50.90.179 with SMTP id bx19mr22463125igb.43.1429550377210; Mon, 20 Apr 2015 10:19:37 -0700 (PDT) MIME-Version: 1.0 Received: by 10.64.240.15 with HTTP; Mon, 20 Apr 2015 10:19:06 -0700 (PDT) In-Reply-To: <55325D1C.1080807@sunet.se> References: <55325D1C.1080807@sunet.se> From: Brian Campbell Date: Mon, 20 Apr 2015 11:19:06 -0600 Message-ID: To: Leif Johansson Content-Type: multipart/alternative; boundary=047d7bea42946c294d05142b226f Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Apr 2015 17:19:40 -0000 --047d7bea42946c294d05142b226f Content-Type: text/plain; charset=UTF-8 Not sure if this list or the github issue tracker is the right place for review feedback so I'm gonna go with a bit of a hybrid model by sending this link https://github.com/TokenBinding/Internet-Drafts/issues/10 to this list. On Sat, Apr 18, 2015 at 7:33 AM, Leif Johansson wrote: > > Folks, > > The core drafts have been out and published as WG documents for a couple > of weeks now. Please review! > > Cheers Leif > > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable > --047d7bea42946c294d05142b226f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Not sure if this list or the github issue tracker is the r= ight place for review feedback so I'm gonna go with a bit of a hybrid m= odel by sending this link https://github.com/TokenBinding/Internet-Drafts/issues= /10 to this list.



On Sat, Apr 18, 2015 at 7:33 AM, Leif Johansson <leifj= @sunet.se> wrote:

Folks,

The core drafts have been out and published as WG documents for a couple of weeks now. Please review!

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Cheers Leif

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable

--047d7bea42946c294d05142b226f-- From nobody Mon Apr 20 10:21:52 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 300411B2C5D for ; Mon, 20 Apr 2015 10:21:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nVbbQrkyCDhe for ; Mon, 20 Apr 2015 10:21:49 -0700 (PDT) Received: from mail-la0-f45.google.com (mail-la0-f45.google.com [209.85.215.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 93B4B1B2C5E for ; Mon, 20 Apr 2015 10:21:48 -0700 (PDT) Received: by labbd9 with SMTP id bd9so132300010lab.2 for ; Mon, 20 Apr 2015 10:21:47 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:content-transfer-encoding:message-id:references :to; bh=HJ9V9FhPPU6NYv76X/u8RLap0UuCzuDLzwr4i2aiAwo=; b=cvn0sCfjHD3szxt1l8/AN+c+tS/Kt2+q3dQng6Ff2SRMrpVjhMmtYKttFw+mBBj1vh TqpIzaAAJb6IEPiyqoocQZkVI8gwsJ4SrIr/RaVbGxc0vFvwCFl5yXVSmycwdqFaOk/I NhG6Xqir3quPlWRoqlAMZi7cVNvVm02SdlgM8QdxXgHqYq1A/PoquQ4p9ez/D9xjNGUk l3ahyLa+NuwWmJA8ENiUe+M5Kvhh0ldXYZN80PC9cV5WQ++gN3ufB6qVHloIodf9Sf0n CdxGzWGPXF49SVZ1N0dolYujoazJ/WEDYuJ3KQC/URdbsjZqnhB5d+H7PNRCzA/e/lpY K3oQ== X-Gm-Message-State: ALoCoQk7aHb8dy4q5sj6MeTAqlImcpF66ya3TxM7j/qiKng6I3MWuwHrw1+YK78j8FT12pXVq+xi X-Received: by 10.112.139.36 with SMTP id qv4mr16421724lbb.24.1429550506979; Mon, 20 Apr 2015 10:21:46 -0700 (PDT) Received: from [2.64.163.63] (2.64.163.63.mobile.tre.se. [2.64.163.63]) by mx.google.com with ESMTPSA id p3sm4437018lag.13.2015.04.20.10.21.46 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 20 Apr 2015 10:21:46 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-58F7CA0C-AA74-4AEB-A873-B166FD0E9EA7 Mime-Version: 1.0 (1.0) From: Leif Johansson X-Mailer: iPhone Mail (12F70) In-Reply-To: Date: Mon, 20 Apr 2015 19:21:45 +0200 Content-Transfer-Encoding: 7bit Message-Id: References: <55325D1C.1080807@sunet.se> To: Brian Campbell Archived-At: Cc: "unbearable@ietf.org" , Leif Johansson Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Apr 2015 17:21:51 -0000 --Apple-Mail-58F7CA0C-AA74-4AEB-A873-B166FD0E9EA7 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable issues on github, discussions of those issues here! > 20 apr 2015 kl. 19:19 skrev Brian Campbell : >=20 > Not sure if this list or the github issue tracker is the right place for r= eview feedback so I'm gonna go with a bit of a hybrid model by sending this l= ink https://github.com/TokenBinding/Internet-Drafts/issues/10 to this list.=20= >=20 >=20 >=20 >> On Sat, Apr 18, 2015 at 7:33 AM, Leif Johansson wrote: >>=20 >> Folks, >>=20 >> The core drafts have been out and published as WG documents for a couple >> of weeks now. Please review! >>=20 >> Cheers Leif >>=20 >> _______________________________________________ >> Unbearable mailing list >> Unbearable@ietf.org >> https://www.ietf.org/mailman/listinfo/unbearable >=20 > _______________________________________________ > Unbearable mailing list > Unbearable@ietf.org > https://www.ietf.org/mailman/listinfo/unbearable --Apple-Mail-58F7CA0C-AA74-4AEB-A873-B166FD0E9EA7 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
issues on github, discussio= ns of those issues here!

20 apr 2015 kl. 19:19 skrev Brian Cam= pbell <bcampbell@pingidenti= ty.com>:

Not sure if this list or the github issue tracker is the right place for re= view feedback so I'm gonna go with a bit of a hybrid model by sending this l= ink ht= tps://github.com/TokenBinding/Internet-Drafts/issues/10 to this list.


On= Sat, Apr 18, 2015 at 7:33 AM, Leif Johansson <leifj@sunet.se> wrot= e:

Folks,

The core drafts have been out and published as WG documents for a couple
= of weeks now. Please review!

        Cheers Leif

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable

____________________= ___________________________
Unbearable mailing listUnbearable@ietf.org
http= s://www.ietf.org/mailman/listinfo/unbearable
= --Apple-Mail-58F7CA0C-AA74-4AEB-A873-B166FD0E9EA7-- From nobody Mon Apr 20 11:10:02 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C81CB1B2F53 for ; Mon, 20 Apr 2015 11:10:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zbfuVibDe7hc for ; Mon, 20 Apr 2015 11:10:00 -0700 (PDT) Received: from mail-ie0-x233.google.com (mail-ie0-x233.google.com [IPv6:2607:f8b0:4001:c03::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F2B91B2F4D for ; Mon, 20 Apr 2015 11:10:00 -0700 (PDT) Received: by iedfl3 with SMTP id fl3so138871205ied.1 for ; Mon, 20 Apr 2015 11:09:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=Hat9Uqt9ODQIRXq+4CIjveDSe+Cj16oUjIe7N2reRbE=; b=ayZtYI39d6IwvUfKN4+CDAJNbfyB5EBhVBEoddDBS9nop557U4AwZQePYCCJTqtlGf LxJs3yapek/6dXFbWGY/IV9QxHjjXfxj9wgfBmF0Exc7JEAgjhDjif/VS2aTGWbyJZNf vClgvDJAehBVShXcxbhteK6zpTh0xrbr2H9ZeAfp29w14ak40ZZOvaBOK/sZ5Wb8yUph mydRXTNzLn9bQXdKEUt8Oq9nPFIJ5Unlo+pNWE/U0qv61e4HRQDbX9PjVCeySLbVjLIK tUJdtcuRbkmbGYyQEekwPj3zUwrcKi6nY22j8sSCXODiRAZEE9UWPhY5VoNGabDmwsiw 3yPQ== MIME-Version: 1.0 X-Received: by 10.107.170.135 with SMTP id g7mr23971086ioj.2.1429553399921; Mon, 20 Apr 2015 11:09:59 -0700 (PDT) Received: by 10.64.76.106 with HTTP; Mon, 20 Apr 2015 11:09:59 -0700 (PDT) In-Reply-To: <55325D1C.1080807@sunet.se> References: <55325D1C.1080807@sunet.se> Date: Mon, 20 Apr 2015 11:09:59 -0700 Message-ID: From: Martin Thomson To: Leif Johansson Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Apr 2015 18:10:02 -0000 On 18 April 2015 at 06:33, Leif Johansson wrote: > The core drafts have been out and published as WG documents for a couple > of weeks now. Please review! I think that this should be one spec: https://github.com/TokenBinding/Internet-Drafts/issues/11 I think that this should not use ALPN: https://github.com/TokenBinding/Internet-Drafts/issues/3 And though I still prefer it if everything were native to HTTP, I believe that Dirk and Andrei believe the performance characteristics of such a solution to be disastrously bad. An TLS extension does at least solve that problem, even if it is architecturally distasteful: https://github.com/TokenBinding/Internet-Drafts/issues/4 No doubt there will be more once those have been sorted out, but that's probably more than enough for now. From nobody Mon Apr 20 14:55:00 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 74A271B3298 for ; Mon, 20 Apr 2015 14:54:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.602 X-Spam-Level: X-Spam-Status: No, score=-0.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_ILLEGAL_IP=1.3, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qbBfDxYC30iJ for ; Mon, 20 Apr 2015 14:54:58 -0700 (PDT) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2on0105.outbound.protection.outlook.com [65.55.169.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 64FE41B329D for ; Mon, 20 Apr 2015 14:54:57 -0700 (PDT) Received: from BN3PR0301MB1250.namprd03.prod.outlook.com (0.161.207.26) by BN3PR0301MB1249.namprd03.prod.outlook.com (0.161.207.25) with Microsoft SMTP Server (TLS) id 15.1.136.25; Mon, 20 Apr 2015 21:54:55 +0000 Received: from BN3PR0301MB1250.namprd03.prod.outlook.com ([0.161.207.26]) by BN3PR0301MB1250.namprd03.prod.outlook.com ([0.161.207.26]) with mapi id 15.01.0136.026; Mon, 20 Apr 2015 21:54:55 +0000 From: Andrei Popov To: Ilari Liusvaara , Leif Johansson , "Dirk Balfanz (balfanz@google.com)" Thread-Topic: [Unbearable] reviewing our 00's Thread-Index: AQHQedxCiQzINnKJcEexdzbRTl6pbZ1S/eOAgANyB2A= Date: Mon, 20 Apr 2015 21:54:55 +0000 Message-ID: References: <55325D1C.1080807@sunet.se> <20150418165751.GA14171@LK-Perkele-VII> In-Reply-To: <20150418165751.GA14171@LK-Perkele-VII> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: elisanet.fi; dkim=none (message not signed) header.d=none; x-originating-ip: [2001:4898:80e8:ed31::3] x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR0301MB1249; x-microsoft-antispam-prvs: x-forefront-antispam-report: BMV:1; SFV:NSPM; SFS:(10019020)(6009001)(51704005)(13464003)(164054003)(24454002)(377454003)(2656002)(77156002)(62966003)(102836002)(87936001)(76576001)(5001770100001)(76176999)(2950100001)(122556002)(99286002)(92566002)(40100003)(54356999)(33656002)(15975445007)(106116001)(74316001)(19580405001)(19580395003)(86612001)(50986999)(46102003)(86362001)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0301MB1249; H:BN3PR0301MB1250.namprd03.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(5005006)(5002010); SRVR:BN3PR0301MB1249; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0301MB1249; x-forefront-prvs: 05529C6FDB Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.onmicrosoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Apr 2015 21:54:55.7608 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0301MB1249 Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Apr 2015 21:54:59 -0000 Hi Ilari, 1) Agreement has been reached in Dallas that we will define a new TLS exten= sion to negotiate Token Binding key parameters, instead of using ALPN. I ho= pe to publish a new I-D for the TLS extension, and update draft-ietf-tokbi= nd-protocol in the next 2-3 weeks. 2) We should certainly consider CFRG recommendation, once it's available. 3) The intent was to make this as straightforward as possible, and to reuse= TLS registries and structures. 4) But resumption and renegotiation do exist. 5) There are several ways to protect keys in SW; I'd rather not prescribe o= ne of the possible solutions. 6) I believe this is because 301 and 302 are common ways to perform URL red= irection, but Dirk may have a better justification. Thanks, Andrei -----Original Message----- From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of Ilari Li= usvaara Sent: Saturday, April 18, 2015 9:58 AM To: Leif Johansson Cc: unbearable@ietf.org Subject: Re: [Unbearable] reviewing our 00's On Sat, Apr 18, 2015 at 03:33:16PM +0200, Leif Johansson wrote: >=20 > Folks, >=20 > The core drafts have been out and published as WG documents for a=20 > couple of weeks now. Please review! Some points: 1) ALPN does not scale. Sadly, HTTP/2 has no way to perform server 0RTT cap= ability advertisment without TLS 1.3 (and even there, it might not work wit= h client certs) otherwise. 2) Following CFRG on signatures would be useful. They have completed ECDH w= ork and moved to signatures (which shouldn't take too long to complete). 3) I expect somebody to complain about inventing a new key/ signature forma= t instead of using existing ones (e.g. JOSE or whatever TLS RPK uses). :-) 4) TLS-unique can't be synchronized without resumption (or insecure renegot= iation), even without EMS. 5) If one does not have HSM available, one should handle the keys in dedica= ted process. Makes grabbing those keys more annoying, to the point when the= attacker can grab those, you are likely toast anyway. 6) Why is referred binding restricted to 301 and 302? I can't come up with = a sensible category that only has 301 and 302. -Ilari _______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable From nobody Mon Apr 20 15:03:48 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E0A01B32C7 for ; Mon, 20 Apr 2015 15:03:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.601 X-Spam-Level: X-Spam-Status: No, score=-0.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_ILLEGAL_IP=1.3, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mvQAGNQzmdrr for ; Mon, 20 Apr 2015 15:03:44 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1on0767.outbound.protection.outlook.com [IPv6:2a01:111:f400:fc10::767]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E86E61B32C3 for ; Mon, 20 Apr 2015 15:03:43 -0700 (PDT) Received: from BN3PR0301MB1250.namprd03.prod.outlook.com (0.161.207.26) by BN3PR0301MB1250.namprd03.prod.outlook.com (0.161.207.26) with Microsoft SMTP Server (TLS) id 15.1.136.25; Mon, 20 Apr 2015 22:03:28 +0000 Received: from BN3PR0301MB1250.namprd03.prod.outlook.com ([0.161.207.26]) by BN3PR0301MB1250.namprd03.prod.outlook.com ([0.161.207.26]) with mapi id 15.01.0136.026; Mon, 20 Apr 2015 22:03:28 +0000 From: Andrei Popov To: "D.Rogers@gmx.net" Thread-Topic: [Unbearable] reviewing our 00's Thread-Index: AQHQedxCiQzINnKJcEexdzbRTl6pbZ1S4YCAgAABiACAAFDigIADQtKA Date: Mon, 20 Apr 2015 22:03:28 +0000 Message-ID: References: <55325D1C.1080807@sunet.se> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmx.net; dkim=none (message not signed) header.d=none; x-originating-ip: [2001:4898:80e8:ed31::3] x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR0301MB1250; x-forefront-antispam-report: BMV:1; SFV:NSPM; SFS:(10019020)(24454002)(377454003)(122556002)(16236675004)(46102003)(93886004)(33656002)(19609705001)(110136001)(2950100001)(92566002)(2501003)(76176999)(54356999)(2656002)(86362001)(19617315012)(15975445007)(77156002)(74316001)(87936001)(19580405001)(86612001)(19625215002)(19580395003)(2351001)(62966003)(102836002)(99286002)(106116001)(19300405004)(50986999)(76576001)(40100003)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0301MB1250; H:BN3PR0301MB1250.namprd03.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(5002010)(5005006); SRVR:BN3PR0301MB1250; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0301MB1250; x-forefront-prvs: 05529C6FDB Content-Type: multipart/alternative; boundary="_000_BN3PR0301MB125099BB2825E4EA16EBA5408CE00BN3PR0301MB1250_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.onmicrosoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Apr 2015 22:03:28.5900 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0301MB1250 Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Apr 2015 22:03:46 -0000 --_000_BN3PR0301MB125099BB2825E4EA16EBA5408CE00BN3PR0301MB1250_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgRGVhbiwNCg0KVGhhbmtzIGZvciB0aGUgZWRpdG9yaWFsIGNvbW1lbnRzOyB3aWxsIHJlcGhy YXNlIGluIHRoZSBuZXh0IHJldmlzaW9uLg0KDQoNCsOYICBXaGF0IGhhcHBlbnMgaWYgZXhhY3Rs eSBhdCB0aGF0IG1vbWVudCB0aGUgdGhlIGNsaWVudCBjbGVhcnMgdGhpZXIgY2FjaGUgYWZ0ZXIg dGhlIHRva2VuL2Nvb2tpZSBpcyByZWNlaXZlZD8NCg0Kw5ggIEkgc3RpbGwgaGF2ZSB0aGUgc2Ft ZSBjb25jZXB0dWFsIHByb2JsZW0gd2l0aCBjYWNoZSBmbHVzaGluZywgaWYgdGhlIGNvb2tpZSBp cyBnb25lIHRoZSB3aG9sZSBwcm9jZXNzIGhhcyB0byBzdGFydCBmcm9tIHRoZSBiZWdpbm5pbmcg YW5kIHRoZSBjbGllbnQgaGFzIHRvIHByb3ZlIHRoZXkgYXJlIHN0aWxsIHRoZSBzYW1lIGNsaWVu dC4gSW4gb3RoZXIgd29yZHMgcmUtZXN0YWJsaXNoIHRoZSAzcmQgbGVnIG9mIGEgY2hhbGxlbmdl IHJlc3BvbnNlIHByb3RvY29sLg0KSWYgdGhlIGNvb2tpZSBpcyBnb25lLCB0aGUgc2VydmVyIHdp bGwgaGF2ZSB0byBhdXRoZW50aWNhdGUgdGhpcyBjbGllbnQgYWdhaW4uIFRoaXMgaXMgdGhlIGNh c2UgdG9kYXk7IEkgZG9u4oCZdCB0aGluayBUb2tlbiBCaW5kaW5nIGlzIGNoYW5naW5nIGFueXRo aW5nIFdSVCB0aGlzIGNhc2UuDQoNCkNoZWVycywNCg0KQW5kcmVpDQoNCkZyb206IFVuYmVhcmFi bGUgW21haWx0bzp1bmJlYXJhYmxlLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBELlJv Z2Vyc0BnbXgubmV0DQpTZW50OiBTYXR1cmRheSwgQXByaWwgMTgsIDIwMTUgMToxMSBQTQ0KQ2M6 IHVuYmVhcmFibGVAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbVW5iZWFyYWJsZV0gcmV2aWV3aW5n IG91ciAwMCdzDQoNCkRlYXIgQWxsLA0KDQpodHRwOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFm dC1pZXRmLXRva2JpbmQtaHR0cHMtMDANCg0KcGVyaGFwcyBpdHMgYSBiaXQgbGF0ZSB0byBiZSBy YWlzaW5nIHRoaXMgcG9pbnQgYnV0Og0KQWJzdHJhY3Q6DQoiYW4gSFRUUCBzZXJ2ZXIgaXNzdWVz IGEgc2VjdXJpdHkgdG9rZW4gKHN1Y2ggYXMgYSBjb29raWUpIHRvIGEgY2xpZW50LCBhbmQgZXhw ZWN0cyB0aGUgY2xpZW50IHRvIHNlbmQgdGhlIHNlY3VyaXR5IHRva2VuIGJhY2sgdG8gdGhlIHNl cnZlciBhdCBhIGxhdGVyIHRpbWUgaW4gb3JkZXIgdG8gYXV0aGVudGljYXRlLiINCg0KV2hhdCBo YXBwZW5zIGlmIGV4YWN0bHkgYXQgdGhhdCBtb21lbnQgdGhlIHRoZSBjbGllbnQgY2xlYXJzIHRo aWVyIGNhY2hlIGFmdGVyIHRoZSB0b2tlbi9jb29raWUgaXMgcmVjZWl2ZWQ/DQpTb21ldGhpbmcg aW4gdGhlIGNoYWxsZW5nZS1yZXNwb25zZSBtZWNoYW5pc20gaXMgbWlzc2luZyBoZXJlLiBXaHkg ZG9lcyB0aGUgSFRUUCBTZXJ2ZXIgaXNzdWUgdGhlIHRva2VuLCBhdCB0aGlzIHBvaW50IHRoZXJl IGlzIG5vIG1lbnRpb24gb2YgYSBjaGFsbGVuZ2UgcHJvbXB0aW5nIHRoaXMgcmVzcG9uc2UuIFdo YXQgc2hvdWxkIHRoZSBjaGFsbGVuZ2UgbG9vayBsaWtlPyBCYXNpY2FsbHkgdGhpcyBkb2VzIG5v dCBiZWxvbmcgaW4gdGhlIGFic3RyYWN0Lg0KDQoiQmluZGluZyB0aGUgdG9rZW4gdG8gdGhlIFRM UyBjb25uZWN0aW9uIGJldHdlZW4gY2xpZW50IGFuZCBzZXJ2ZXIgcHJvdGVjdHMgdGhlIHNlY3Vy aXR5IHRva2VuIGZyb20gdGhlZnQsIGFuZCBlbnN1cmVzIHRoYXQgdGhlIHNlY3VyaXR5IHRva2Vu IGNhbiBvbmx5IGJlIHVzZWQgYnkgdGhlIGNsaWVudCB0aGF0IGl0IHdhcyBpc3N1ZWQgdG8uIg0K VGhpcyBiaW5kaW5nIGlzIG5vdCB5ZXQgZXN0YWJsaXNoZWQsIHNvIC4uLiAiYW5kIHdvdWxkIGVu c3VyZSB0aGF0IHRoZSBzZWN1cml0eSB0b2tlbi4uLiINCg0KUGxlYXNlLCBJIG1heSBoYXZlIG1p c3VuZGVyc3Rvb2Qgc29tZXRoaW5nLCBidXQgYXJlIHdlIHNheWluZyB0aGF0IGEgdG9rZW4gaXNz dWVkIGJ5IHNlcnZlciBBIHRvIGNsaWVudCBYIG1heSBwb3NzaWJseSBiZSBhY2NlcHRlZCBieSBz ZXJ2ZXIgQiwgc3VyZWx5IHRoaXMgY2FuIG9ubHkgYmUgdGhlIGNhc2Ugb24gaW1wbGljaXQgdHJ1 c3QgYmV0d2VlbiBzZXJ2ZXJzIEEgYW5kIEI/DQpGdXJ0aGVyLCAidGhlIGNsaWVudCBwcm92ZXMg cG9zc2Vzc2lvbiBvZiAocHJpdmF0ZSBrZXkpIHRvIHRoZSBzZXJ2ZXIsIGFuZCBpcyBsb25nLWxp dmVkIChpLmUuLCBzdWJzZXF1ZW50IFRMUyBjb25uZWN0aW9ucyBiZXR3ZWVuIHRoZSBzYW1lIGNs aWVudCBhbmQgc2VydmVyIGhhdmUgdGhlIHNhbWUgVG9rZW4gQmluZGluZyBJRC4iDQpJIHN0aWxs IGhhdmUgdGhlIHNhbWUgY29uY2VwdHVhbCBwcm9ibGVtIHdpdGggY2FjaGUgZmx1c2hpbmcsIGlm IHRoZSBjb29raWUgaXMgZ29uZSB0aGUgd2hvbGUgcHJvY2VzcyBoYXMgdG8gc3RhcnQgZnJvbSB0 aGUgYmVnaW5uaW5nIGFuZCB0aGUgY2xpZW50IGhhcyB0byBwcm92ZSB0aGV5IGFyZSBzdGlsbCB0 aGUgc2FtZSBjbGllbnQuIEluIG90aGVyIHdvcmRzIHJlLWVzdGFibGlzaCB0aGUgM3JkIGxlZyBv ZiBhIGNoYWxsZW5nZSByZXNwb25zZSBwcm90b2NvbC4gV2hlcmUgdGhpcyBpcyBzdGlsbCB0aGUg c2FtZSBjbGllbnQgb25seSB0aW1lIGlzIGxvc3QuIGJ1dCBJIGFtIGFmcmFpZCB0aGF0IHNob3Vs ZCBhbiBhdHRhY2tlciBiZSBhYmxlIHRvIGdlbmVyYXRlIHN1Y2ggYSBmYWlsdXJlIHRoZXkgbWF5 IGJlIGFibGUgdG8gaGlqYWNrIHRoZSBzZXNzaW9uLg0KDQpTZWN0aW9uIDMuMSBzdWdnZXN0cyB0 aGF0IGVhY2ggY2xpZW50IG9wZXJhdGUgYSBsYXJnZSBzY2FsZSBLZXktbWFuYWdlbWVudCBzeXN0 ZW0sICJjbGllbnRzIHVzZSBkaWZmZXJlbnQgcHJpdmF0ZSBrZXlzIHRvIGVzdGFibGlzaCBQcm92 aWRlZCBUb2tlbiBCaW5kaW5nIElEcyB3aXRoIGRpZmZlcmVudCBzZXJ2ZXJzIi4NCkNsaWVudHMg YXJlIGNsaWVudHMgYW5kIHRoaXMgc2hvdWxkIG5vdCBiZSB0aGllciBidXNpbmVzcy4NCkl0IHdh cyB3aXRoIHRoaXMsIHRvIG15IG1pbmQsIG1ham9yIGFyY2hpdGVjdHVyYWwgY29uY2VwdHVhbCBt aXNkaWVjdGlvbiB0aGF0IHN0b3BlZCBteSByZWFkaW5nIGZ1cnRoZXIuDQoNClNhbHV0ZW0NCkRl YW4NCg0KR2VzZW5kZXQ6IFNhbXN0YWcsIDE4LiBBcHJpbCAyMDE1IHVtIDE3OjIxIFVocg0KVm9u OiAiQnJpYW4gQ2FtcGJlbGwiIDxiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbTxtYWlsdG86YmNh bXBiZWxsQHBpbmdpZGVudGl0eS5jb20+Pg0KQW46IEQuUm9nZXJzQGdteC5uZXQ8bWFpbHRvOkQu Um9nZXJzQGdteC5uZXQ+DQpDYzogInVuYmVhcmFibGVAaWV0Zi5vcmc8bWFpbHRvOnVuYmVhcmFi bGVAaWV0Zi5vcmc+IiA8dW5iZWFyYWJsZUBpZXRmLm9yZzxtYWlsdG86dW5iZWFyYWJsZUBpZXRm Lm9yZz4+DQpCZXRyZWZmOiBSZTogW1VuYmVhcmFibGVdIHJldmlld2luZyBvdXIgMDAncw0KU29t ZSBsaW5rczoNCg0KaHR0cDovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi10b2tiaW5k LXByb3RvY29sLTAwDQpodHRwOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2Jp bmQtaHR0cHMtMDANCg0KaHR0cHM6Ly9naXRodWIuY29tL1Rva2VuQmluZGluZy8NCg0KT24gU2F0 LCBBcHIgMTgsIDIwMTUgYXQgOToxNiBBTSwgPEQuUm9nZXJzQGdteC5uZXQ+IHdyb3RlOg0KU29y cnksDQoNCmJ1dCBsaWtlIGEgbG90IG9mIHBlb3BsZSB3ZSBhcmUgYWxsIGJ1c3ksDQoNCmNhbiB5 b3UgcmVwZWF0IHRoZSBsaW5rcywNCndpdGhvdXQgd2lzaGluZyB0byBzb3VuZCBsaWtlIERyIFdo bywgeW91IGNhdGNoIG1lIGF0IGEgdGltZSB3aGVuIEkgaGF2ZSB0aW1lLA0KcG9zc2libHkgaXRz IHRoZSBzYW1lIGZvciBvdGhlcnMsIHF1aWNrIGxpbmtzIHdpdGhvdXQgaGF2aW5nIHRvIG1pbmUg dGhlbSB3b3VsZCBiZSBtb3N0IHVzZWZ1bCBicmlnYWRpZXIgOi0pDQoNCmJlc3QNCkRlYW4NCkdl c2VuZGV0OiBTYW1zdGFnLCAxOC4gQXByaWwgMjAxNSB1bSAxNTozMyBVaHINClZvbjogIkxlaWYg Sm9oYW5zc29uIiA8bGVpZmpAc3VuZXQuc2U+DQpBbjogInVuYmVhcmFibGVAaWV0Zi5vcmciIDx1 bmJlYXJhYmxlQGlldGYub3JnPg0KQmV0cmVmZjogW1VuYmVhcmFibGVdIHJldmlld2luZyBvdXIg MDAncw0KDQpGb2xrcywNCg0KVGhlIGNvcmUgZHJhZnRzIGhhdmUgYmVlbiBvdXQgYW5kIHB1Ymxp c2hlZCBhcyBXRyBkb2N1bWVudHMgZm9yIGEgY291cGxlDQpvZiB3ZWVrcyBub3cuIFBsZWFzZSBy ZXZpZXchDQoNCkNoZWVycyBMZWlmDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fDQpVbmJlYXJhYmxlIG1haWxpbmcgbGlzdA0KVW5iZWFyYWJsZUBpZXRm Lm9yZw0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby91bmJlYXJhYmxlDQoN Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpVbmJlYXJh YmxlIG1haWxpbmcgbGlzdA0KVW5iZWFyYWJsZUBpZXRmLm9yZw0KaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby91bmJlYXJhYmxlDQoNCl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fIFVuYmVhcmFibGUgbWFpbGluZyBsaXN0IFVuYmVhcmFi bGVAaWV0Zi5vcmc8bWFpbHRvOlVuYmVhcmFibGVAaWV0Zi5vcmc+IGh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZQ0K --_000_BN3PR0301MB125099BB2825E4EA16EBA5408CE00BN3PR0301MB1250_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OlZlcmRhbmE7DQoJ cGFub3NlLTE6MiAxMSA2IDQgMyA1IDQgNCAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJ e21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1 bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVy bGluZTt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxpLk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29M aXN0UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlvcml0eTozNDsNCgltYXJnaW4tdG9wOjBpbjsN CgltYXJnaW4tcmlnaHQ6MGluOw0KCW1hcmdpbi1ib3R0b206MGluOw0KCW1hcmdpbi1sZWZ0Oi41 aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1m YW1pbHk6IlRpbWVzIE5ldyBSb21hbiIsc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTcNCgl7bXNv LXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMt c2VyaWY7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlw ZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0K CXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0K ZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRp b25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoxNDk3NTcyODAwOw0KCW1zby1saXN0LXR5 cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczoxMzI5MDk3MzgwIC00MzU4OTQ5MzIg Njc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2 OTg2OTEgNjc2OTg2OTM7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC1zdGFydC1hdDo0 Ow0KCW1zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvg5g7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJbXNv LWZhcmVhc3QtZm9udC1mYW1pbHk6Q2FsaWJyaTsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGlt ZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsN Cglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsMw0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVs NA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3 Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0 IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVy IE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250 LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZl bDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+C pzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpv bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQotLT48 L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0i ZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1z byA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9 ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8 L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8 ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkhpIERlYW4sPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp Zjtjb2xvcjojMUY0OTdEIj5UaGFua3MgZm9yIHRoZSBlZGl0b3JpYWwgY29tbWVudHM7IHdpbGwg cmVwaHJhc2UgaW4gdGhlIG5leHQgcmV2aXNpb24uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0i dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj48IVtpZiAhc3VwcG9y dExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpXaW5nZGlu Z3M7Y29sb3I6IzFGNDk3RCI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+w5g8c3BhbiBz dHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOw0KPC9z cGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5XaGF0IGhhcHBlbnMg aWYgZXhhY3RseSBhdCB0aGF0IG1vbWVudCB0aGUgdGhlIGNsaWVudCBjbGVhcnMgdGhpZXIgY2Fj aGUgYWZ0ZXIgdGhlIHRva2VuL2Nvb2tpZSBpcyByZWNlaXZlZD88L3NwYW4+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29M aXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVs MSBsZm8xIj48IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpXaW5nZGluZ3M7Y29sb3I6IzFGNDk3RCI+PHNwYW4gc3R5bGU9Im1zby1s aXN0Oklnbm9yZSI+w5g8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9t YW4mcXVvdDsiPiZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5z LXNlcmlmIj5JIHN0aWxsIGhhdmUgdGhlIHNhbWUgY29uY2VwdHVhbCBwcm9ibGVtIHdpdGggY2Fj aGUgZmx1c2hpbmcsIGlmIHRoZSBjb29raWUgaXMgZ29uZSB0aGUgd2hvbGUgcHJvY2VzcyBoYXMg dG8mbmJzcDtzdGFydCBmcm9tIHRoZSBiZWdpbm5pbmcgYW5kIHRoZSBjbGllbnQgaGFzIHRvIHBy b3ZlIHRoZXkNCiBhcmUgc3RpbGwgdGhlIHNhbWUgY2xpZW50LiBJbiBvdGhlciB3b3JkcyByZS1l c3RhYmxpc2ggdGhlIDNyZCBsZWcgb2YgYSBjaGFsbGVuZ2UgcmVzcG9uc2UgcHJvdG9jb2wuPC9z cGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGli cmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SWYg dGhlIGNvb2tpZSBpcyBnb25lLCB0aGUgc2VydmVyIHdpbGwgaGF2ZSB0byBhdXRoZW50aWNhdGUg dGhpcyBjbGllbnQgYWdhaW4uIFRoaXMgaXMgdGhlIGNhc2UgdG9kYXk7IEkgZG9u4oCZdCB0aGlu ayBUb2tlbiBCaW5kaW5nIGlzIGNoYW5naW5nIGFueXRoaW5nIFdSVCB0aGlzDQogY2FzZS48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkNoZWVycyw8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkFuZHJlaTxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVy Om5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBp biAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwv c3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gVW5iZWFyYWJsZSBbbWFpbHRvOnVuYmVhcmFibGUt Ym91bmNlc0BpZXRmLm9yZ10NCjxiPk9uIEJlaGFsZiBPZiA8L2I+RC5Sb2dlcnNAZ214Lm5ldDxi cj4NCjxiPlNlbnQ6PC9iPiBTYXR1cmRheSwgQXByaWwgMTgsIDIwMTUgMToxMSBQTTxicj4NCjxi PkNjOjwvYj4gdW5iZWFyYWJsZUBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW1Vu YmVhcmFibGVdIHJldmlld2luZyBvdXIgMDAnczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5E ZWFyIEFsbCw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPjxhIGhy ZWY9Imh0dHA6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtdG9rYmluZC1odHRwcy0w MCI+aHR0cDovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi10b2tiaW5kLWh0dHBzLTAw PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVy ZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+cGVyaGFwcyBp dHMgYSBiaXQgbGF0ZSB0byBiZSByYWlzaW5nIHRoaXMgcG9pbnQgYnV0OjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNl cmlmIj5BYnN0cmFjdDo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+JnF1b3Q7YW4gSFRUUCBzZXJ2ZXIgaXNz dWVzIGEgc2VjdXJpdHkgdG9rZW4gKHN1Y2ggYXMgYSBjb29raWUpIHRvIGEgY2xpZW50LCBhbmQg ZXhwZWN0cyB0aGUgY2xpZW50IHRvIHNlbmQgdGhlIHNlY3VyaXR5Jm5ic3A7dG9rZW4gYmFjayB0 byB0aGUgc2VydmVyIGF0IGEgbGF0ZXIgdGltZSBpbiBvcmRlciB0byBhdXRoZW50aWNhdGUuJnF1 b3Q7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+V2hh dCBoYXBwZW5zIGlmIGV4YWN0bHkgYXQgdGhhdCBtb21lbnQgdGhlIHRoZSBjbGllbnQgY2xlYXJz IHRoaWVyIGNhY2hlIGFmdGVyIHRoZSB0b2tlbi9jb29raWUgaXMgcmVjZWl2ZWQ/PG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNh bnMtc2VyaWYiPlNvbWV0aGluZyBpbiB0aGUgY2hhbGxlbmdlLXJlc3BvbnNlIG1lY2hhbmlzbSZu YnNwO2lzIG1pc3NpbmcgaGVyZS4gV2h5IGRvZXMgdGhlIEhUVFAgU2VydmVyIGlzc3VlIHRoZSB0 b2tlbiwgYXQgdGhpcyBwb2ludCB0aGVyZSBpcyBubyBtZW50aW9uIG9mIGEgY2hhbGxlbmdlIHBy b21wdGluZyB0aGlzIHJlc3BvbnNlLg0KIFdoYXQgc2hvdWxkIHRoZSBjaGFsbGVuZ2UgbG9vayBs aWtlPyBCYXNpY2FsbHkgdGhpcyBkb2VzIG5vdCBiZWxvbmcgaW4gdGhlIGFic3RyYWN0LjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90 OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+JnF1b3Q7QmluZGluZyB0aGUg dG9rZW4gdG8gdGhlIFRMUyBjb25uZWN0aW9uIGJldHdlZW4gY2xpZW50IGFuZCBzZXJ2ZXIgcHJv dGVjdHMgdGhlIHNlY3VyaXR5IHRva2VuIGZyb20gdGhlZnQsIGFuZCBlbnN1cmVzIHRoYXQgdGhl IHNlY3VyaXR5Jm5ic3A7dG9rZW4gY2FuIG9ubHkgYmUgdXNlZCBieSB0aGUgY2xpZW50DQogdGhh dCBpdCB3YXMgaXNzdWVkIHRvLiZxdW90OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5UaGlzIGJpbmRpbmcg aXMgbm90IHlldCBlc3RhYmxpc2hlZCwgc28gLi4uICZxdW90O2FuZCB3b3VsZCBlbnN1cmUgdGhh dCB0aGUgc2VjdXJpdHkmbmJzcDt0b2tlbi4uLiZxdW90OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJz cDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRh bmEmcXVvdDssc2Fucy1zZXJpZiI+UGxlYXNlLCBJIG1heSBoYXZlIG1pc3VuZGVyc3Rvb2Qgc29t ZXRoaW5nLCBidXQgYXJlIHdlIHNheWluZyB0aGF0IGEgdG9rZW4gaXNzdWVkIGJ5IHNlcnZlciBB IHRvIGNsaWVudCBYIG1heSBwb3NzaWJseSBiZSBhY2NlcHRlZCBieSBzZXJ2ZXIgQiwgc3VyZWx5 IHRoaXMgY2FuIG9ubHkgYmUgdGhlIGNhc2UNCiBvbiBpbXBsaWNpdCB0cnVzdCBiZXR3ZWVuIHNl cnZlcnMgQSBhbmQgQj88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+RnVydGhlciwgJnF1b3Q7dGhlIGNsaWVu dCBwcm92ZXMgcG9zc2Vzc2lvbiBvZiAocHJpdmF0ZSBrZXkpJm5ic3A7dG8gdGhlIHNlcnZlciwg YW5kIGlzIGxvbmctbGl2ZWQgKGkuZS4sJm5ic3A7c3Vic2VxdWVudCBUTFMgY29ubmVjdGlvbnMg YmV0d2VlbiB0aGUgc2FtZSBjbGllbnQgYW5kIHNlcnZlciBoYXZlJm5ic3A7dGhlIHNhbWUgVG9r ZW4NCiBCaW5kaW5nIElELiZxdW90OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5JIHN0aWxsIGhhdmUgdGhl IHNhbWUgY29uY2VwdHVhbCBwcm9ibGVtIHdpdGggY2FjaGUgZmx1c2hpbmcsIGlmIHRoZSBjb29r aWUgaXMgZ29uZSB0aGUgd2hvbGUgcHJvY2VzcyBoYXMgdG8mbmJzcDtzdGFydCBmcm9tIHRoZSBi ZWdpbm5pbmcgYW5kIHRoZSBjbGllbnQgaGFzIHRvIHByb3ZlIHRoZXkgYXJlIHN0aWxsDQogdGhl IHNhbWUgY2xpZW50LiBJbiBvdGhlciB3b3JkcyByZS1lc3RhYmxpc2ggdGhlIDNyZCBsZWcgb2Yg YSBjaGFsbGVuZ2UgcmVzcG9uc2UgcHJvdG9jb2wuIFdoZXJlIHRoaXMgaXMgc3RpbGwgdGhlIHNh bWUgY2xpZW50IG9ubHkgdGltZSBpcyBsb3N0LiBidXQgSSBhbSBhZnJhaWQgdGhhdCZuYnNwO3No b3VsZCBhbiBhdHRhY2tlciBiZSBhYmxlIHRvIGdlbmVyYXRlIHN1Y2ggYSBmYWlsdXJlIHRoZXkg bWF5IGJlIGFibGUgdG8gaGlqYWNrIHRoZSBzZXNzaW9uLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJz cDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRh bmEmcXVvdDssc2Fucy1zZXJpZiI+U2VjdGlvbiAzLjEgc3VnZ2VzdHMgdGhhdCBlYWNoIGNsaWVu dCBvcGVyYXRlIGEgbGFyZ2Ugc2NhbGUgS2V5LW1hbmFnZW1lbnQgc3lzdGVtLCAmcXVvdDtjbGll bnRzIHVzZSBkaWZmZXJlbnQgcHJpdmF0ZSBrZXlzIHRvIGVzdGFibGlzaCBQcm92aWRlZCBUb2tl biBCaW5kaW5nIElEcyB3aXRoIGRpZmZlcmVudA0KIHNlcnZlcnMmcXVvdDsuPG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMt c2VyaWYiPkNsaWVudHMgYXJlIGNsaWVudHMgYW5kIHRoaXMgc2hvdWxkIG5vdCBiZSB0aGllciBi dXNpbmVzcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+SXQgd2FzIHdpdGggdGhpcywgdG8gbXkgbWluZCwg bWFqb3IgYXJjaGl0ZWN0dXJhbCBjb25jZXB0dWFsIG1pc2RpZWN0aW9uJm5ic3A7dGhhdCBzdG9w ZWQgbXkmbmJzcDtyZWFkaW5nIGZ1cnRoZXIuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90 OyxzYW5zLXNlcmlmIj5TYWx1dGVtPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPkRlYW48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1z ZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJi b3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQzNEOUU1IDEuNXB0O3BhZGRpbmc6MGluIDBp biAwaW4gOC4wcHQ7bWFyZ2luLWxlZnQ6Ny41cHQ7bWFyZ2luLXRvcDo3LjVwdDttYXJnaW4tcmln aHQ6My43NXB0O21hcmdpbi1ib3R0b206My43NXB0Oy1tcy13b3JkLXdyYXA6IGJyZWFrLXdvcmQ7 LXdlYmtpdC1uYnNwLW1vZGU6IHNwYWNlOy13ZWJraXQtbGluZS1icmVhazogYWZ0ZXItd2hpdGUt c3BhY2UiIG5hbWU9InF1b3RlIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1ib3R0b206Ny41cHQiPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPkdlc2VuZGV0Ojwvc3Bhbj48 L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5h JnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwO1NhbXN0YWcsIDE4LiBBcHJpbCAyMDE1IHVtIDE3OjIx IFVocjxicj4NCjxiPlZvbjo8L2I+Jm5ic3A7JnF1b3Q7QnJpYW4gQ2FtcGJlbGwmcXVvdDsgJmx0 OzxhIGhyZWY9Im1haWx0bzpiY2FtcGJlbGxAcGluZ2lkZW50aXR5LmNvbSI+YmNhbXBiZWxsQHBp bmdpZGVudGl0eS5jb208L2E+Jmd0Ozxicj4NCjxiPkFuOjwvYj4mbmJzcDs8YSBocmVmPSJtYWls dG86RC5Sb2dlcnNAZ214Lm5ldCI+RC5Sb2dlcnNAZ214Lm5ldDwvYT48YnI+DQo8Yj5DYzo8L2I+ Jm5ic3A7JnF1b3Q7PGEgaHJlZj0ibWFpbHRvOnVuYmVhcmFibGVAaWV0Zi5vcmciPnVuYmVhcmFi bGVAaWV0Zi5vcmc8L2E+JnF1b3Q7ICZsdDs8YSBocmVmPSJtYWlsdG86dW5iZWFyYWJsZUBpZXRm Lm9yZyI+dW5iZWFyYWJsZUBpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+QmV0cmVmZjo8L2I+Jm5i c3A7UmU6IFtVbmJlYXJhYmxlXSByZXZpZXdpbmcgb3VyIDAwJ3M8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXYgbmFtZT0icXVvdGVkLWNvbnRlbnQiPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5Tb21lIGxpbmtzOjxicj4NCjxicj4NCjxhIGhy ZWY9Imh0dHA6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtdG9rYmluZC1wcm90b2Nv bC0wMCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHA6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWll dGYtdG9rYmluZC1wcm90b2NvbC0wMDwvYT48YnI+DQo8YSBocmVmPSJodHRwOi8vdG9vbHMuaWV0 Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2JpbmQtaHR0cHMtMDAiIHRhcmdldD0iX2JsYW5rIj5o dHRwOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2JpbmQtaHR0cHMtMDA8L2E+ PGJyPg0KPGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly9naXRodWIuY29tL1Rva2VuQmluZGluZy8iIHRh cmdldD0iX2JsYW5rIj5odHRwczovL2dpdGh1Yi5jb20vVG9rZW5CaW5kaW5nLzwvYT48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDss c2Fucy1zZXJpZiI+Jm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPk9uIFNhdCwgQXByIDE4LCAyMDE1IGF0IDk6 MTYgQU0sICZsdDs8YSBocmVmPSJELlJvZ2Vyc0BnbXgubmV0IiB0YXJnZXQ9Il9wYXJlbnQiPkQu Um9nZXJzQGdteC5uZXQ8L2E+Jmd0OyB3cm90ZToNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxi bG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEu MHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJp Z2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5h JnF1b3Q7LHNhbnMtc2VyaWYiPlNvcnJ5LDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDss c2Fucy1zZXJpZiI+YnV0IGxpa2UgYSBsb3Qgb2YgcGVvcGxlIHdlIGFyZSBhbGwgYnVzeSw8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVv dDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPmNhbiB5b3UgcmVwZWF0IHRo ZSBsaW5rcyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+d2l0aG91dCB3aXNoaW5nIHRvIHNvdW5kIGxpa2Um bmJzcDtEciBXaG8sIHlvdSBjYXRjaCBtZSBhdCBhIHRpbWUgd2hlbiBJIGhhdmUgdGltZSw8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVv dDssc2Fucy1zZXJpZiI+cG9zc2libHkgaXRzIHRoZSBzYW1lIGZvciBvdGhlcnMsIHF1aWNrIGxp bmtzIHdpdGhvdXQgaGF2aW5nIHRvIG1pbmUgdGhlbSB3b3VsZCBiZSBtb3N0IHVzZWZ1bCBicmln YWRpZXIgOi0pPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJp ZiI+YmVzdDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5EZWFuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQzNEOUU1IDEu NXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gOC4wcHQ7bWFyZ2luLWxlZnQ6Ny41cHQ7bWFyZ2luLXRv cDo3LjVwdDttYXJnaW4tcmlnaHQ6My43NXB0O21hcmdpbi1ib3R0b206My43NXB0Ij4NCjxkaXYg c3R5bGU9Im1hcmdpbi1ib3R0b206Ny41cHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7 LHNhbnMtc2VyaWYiPkdlc2VuZGV0Ojwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwO1Nh bXN0YWcsIDE4LiBBcHJpbCAyMDE1IHVtIDE1OjMzIFVocjxicj4NCjxiPlZvbjo8L2I+Jm5ic3A7 JnF1b3Q7TGVpZiBKb2hhbnNzb24mcXVvdDsgJmx0OzxhIGhyZWY9ImxlaWZqQHN1bmV0LnNlIiB0 YXJnZXQ9Il9wYXJlbnQiPmxlaWZqQHN1bmV0LnNlPC9hPiZndDs8YnI+DQo8Yj5Bbjo8L2I+Jm5i c3A7JnF1b3Q7PGEgaHJlZj0idW5iZWFyYWJsZUBpZXRmLm9yZyIgdGFyZ2V0PSJfcGFyZW50Ij51 bmJlYXJhYmxlQGlldGYub3JnPC9hPiZxdW90OyAmbHQ7PGEgaHJlZj0idW5iZWFyYWJsZUBpZXRm Lm9yZyIgdGFyZ2V0PSJfcGFyZW50Ij51bmJlYXJhYmxlQGlldGYub3JnPC9hPiZndDs8YnI+DQo8 Yj5CZXRyZWZmOjwvYj4mbmJzcDtbVW5iZWFyYWJsZV0gcmV2aWV3aW5nIG91ciAwMCdzPG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KRm9sa3MsPGJyPg0KPGJyPg0KVGhlIGNv cmUgZHJhZnRzIGhhdmUgYmVlbiBvdXQgYW5kIHB1Ymxpc2hlZCBhcyBXRyBkb2N1bWVudHMgZm9y IGEgY291cGxlPGJyPg0Kb2Ygd2Vla3Mgbm93LiBQbGVhc2UgcmV2aWV3ITxicj4NCjxicj4NCkNo ZWVycyBMZWlmPGJyPg0KPGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX188YnI+DQpVbmJlYXJhYmxlIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9IlVu YmVhcmFibGVAaWV0Zi5vcmciIHRhcmdldD0iX3BhcmVudCI+VW5iZWFyYWJsZUBpZXRmLm9yZzwv YT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Vu YmVhcmFibGUiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL3VuYmVhcmFibGU8L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NClVuYmVhcmFibGUgbWFpbGluZyBsaXN0 PGJyPg0KPGEgaHJlZj0iVW5iZWFyYWJsZUBpZXRmLm9yZyIgdGFyZ2V0PSJfcGFyZW50Ij5VbmJl YXJhYmxlQGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21h aWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZSIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZTwvYT48YnI+DQombmJzcDs8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fIFVuYmVhcmFibGUgbWFpbGluZyBsaXN0DQo8YSBocmVmPSJtYWls dG86VW5iZWFyYWJsZUBpZXRmLm9yZyI+VW5iZWFyYWJsZUBpZXRmLm9yZzwvYT4gPGEgaHJlZj0i aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby91bmJlYXJhYmxlIiB0YXJnZXQ9 Il9ibGFuayI+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFi bGU8L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_BN3PR0301MB125099BB2825E4EA16EBA5408CE00BN3PR0301MB1250_-- From nobody Mon Apr 20 15:35:23 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F6311B3354 for ; Mon, 20 Apr 2015 15:35:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2jKQBVvqhAWe for ; Mon, 20 Apr 2015 15:35:20 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1on0731.outbound.protection.outlook.com [IPv6:2a01:111:f400:fc10::731]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E2891B3364 for ; Mon, 20 Apr 2015 15:35:20 -0700 (PDT) Received: from BN3PR0301MB1250.namprd03.prod.outlook.com (25.161.207.26) by BN3PR0301MB1251.namprd03.prod.outlook.com (25.161.207.27) with Microsoft SMTP Server (TLS) id 15.1.136.25; Mon, 20 Apr 2015 22:35:03 +0000 Received: from BN3PR0301MB1250.namprd03.prod.outlook.com ([25.161.207.26]) by BN3PR0301MB1250.namprd03.prod.outlook.com ([25.161.207.26]) with mapi id 15.01.0136.026; Mon, 20 Apr 2015 22:35:03 +0000 From: Andrei Popov To: Martin Thomson , Leif Johansson Thread-Topic: [Unbearable] reviewing our 00's Thread-Index: AQHQedxCiQzINnKJcEexdzbRTl6pbZ1WNrSAgABCIrA= Date: Mon, 20 Apr 2015 22:35:03 +0000 Message-ID: References: <55325D1C.1080807@sunet.se> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none; x-originating-ip: [2001:4898:80e8:ed31::3] x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR0301MB1251; x-forefront-antispam-report: BMV:1; SFV:NSPM; SFS:(10019020)(6009001)(13464003)(377454003)(24454002)(76576001)(19580395003)(5001770100001)(99286002)(50986999)(54356999)(33656002)(76176999)(106116001)(2656002)(40100003)(77156002)(87936001)(74316001)(46102003)(86612001)(62966003)(2950100001)(86362001)(122556002)(102836002)(19580405001)(92566002)(15975445007)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0301MB1251; H:BN3PR0301MB1250.namprd03.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(5002010)(5005006); SRVR:BN3PR0301MB1251; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0301MB1251; x-forefront-prvs: 05529C6FDB Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.onmicrosoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Apr 2015 22:35:03.2719 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0301MB1251 Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Apr 2015 22:35:22 -0000 > I think that this should be one spec: It is very likely that we'll want to use Token Binding with protocols other= than HTTPS. Token Binding protocol message formats, key parameter negotiat= ion, etc. are likely to be the same regardless of the application protocol,= but the encapsulation of Token Binding messages in the application protoco= l will look different in each application protocol. This is why I believe that keeping Token Binding protocol basics in a separ= ate I-D is beneficial. In terms of presentation, we can certainly make impr= ovements so that the two documents are more readable. > I think that this should not use ALPN: Yes, we've agreed on this in Dallas; I'll publish a new I-D for the TLS ext= ension, and update draft-ietf-tokbind-protocol in the next 2-3 weeks. Cheers, Andrei -----Original Message----- From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of Martin T= homson Sent: Monday, April 20, 2015 11:10 AM To: Leif Johansson Cc: unbearable@ietf.org Subject: Re: [Unbearable] reviewing our 00's On 18 April 2015 at 06:33, Leif Johansson wrote: > The core drafts have been out and published as WG documents for a=20 > couple of weeks now. Please review! I think that this should be one spec: https://github.com/TokenBinding/Internet-Drafts/issues/11 I think that this should not use ALPN: https://github.com/TokenBinding/Internet-Drafts/issues/3 And though I still prefer it if everything were native to HTTP, I believe t= hat Dirk and Andrei believe the performance characteristics of such a solut= ion to be disastrously bad. An TLS extension does at least solve that prob= lem, even if it is architecturally distasteful: https://github.com/TokenBinding/Internet-Drafts/issues/4 No doubt there will be more once those have been sorted out, but that's pro= bably more than enough for now. _______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable From nobody Mon Apr 20 15:48:19 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6ACFD1B33D2 for ; Mon, 20 Apr 2015 15:48:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JcDmciULUEca for ; Mon, 20 Apr 2015 15:48:16 -0700 (PDT) Received: from mail-oi0-x230.google.com (mail-oi0-x230.google.com [IPv6:2607:f8b0:4003:c06::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E76E01B33CA for ; Mon, 20 Apr 2015 15:48:15 -0700 (PDT) Received: by oiko83 with SMTP id o83so138144394oik.1 for ; Mon, 20 Apr 2015 15:48:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=bgsSmAPWhi/jcuU4CovZ+QwznW3slbEFXkasbZgescE=; b=BlIl4yyYrxU1oy9fiDnpZZgpk3kiXdO5cuR4uTzqBYE1lhfxKBF+JEYrNM4fkyrL5b z4GQPiFLUSLVbZrMJxfcAsMHECt6PNz7e+81FGMfbyNc7I6OI5gQd1rxk8gye+y5uNKp CjcePZymOML9+lIUZflmaIZl50UlKO/3JCcjgxBnk3SPSJZlX7KfXJLerb7cO2Q5q2TW 9diYhCwY8ESKOvp2DSMxe4GOzD4e4iUDVlJEkVQ7X4DuCtWsKO44YQH7gclWIkZAh28m 4NkrJTI8bHJz4JcL2x2/NDWavtvVvoihGE+sihJRfelbocPJxlKFfLOG7mFLxHHoK+Fv nx9Q== X-Received: by 10.60.120.101 with SMTP id lb5mr16644295oeb.82.1429570095502; Mon, 20 Apr 2015 15:48:15 -0700 (PDT) MIME-Version: 1.0 Received: by 10.76.82.228 with HTTP; Mon, 20 Apr 2015 15:47:55 -0700 (PDT) In-Reply-To: References: <55325D1C.1080807@sunet.se> <20150418165751.GA14171@LK-Perkele-VII> From: Tony Arcieri Date: Mon, 20 Apr 2015 15:47:55 -0700 Message-ID: To: Andrei Popov Content-Type: multipart/alternative; boundary=047d7b33cb18b95d4705142fb983 Archived-At: Cc: "Dirk Balfanz \(balfanz@google.com\)" , "unbearable@ietf.org" , Ilari Liusvaara , Leif Johansson Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Apr 2015 22:48:17 -0000 --047d7b33cb18b95d4705142fb983 Content-Type: text/plain; charset=UTF-8 On Mon, Apr 20, 2015 at 2:54 PM, Andrei Popov wrote: > 1) Agreement has been reached in Dallas that we will define a new TLS > extension to negotiate Token Binding key parameters, instead of using ALPN. > I hope to publish a new I-D for the TLS extension, and update > draft-ietf-tokbind-protocol in the next 2-3 weeks. This is sounding better already... -- Tony Arcieri --047d7b33cb18b95d4705142fb983 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On M= on, Apr 20, 2015 at 2:54 PM, Andrei Popov <Andrei.Popov@microsoft= .com> wrote:
1) Agreement h= as been reached in Dallas that we will define a new TLS extension to negoti= ate Token Binding key parameters, instead of using ALPN. I hope to publish = a new I-D for the TLS extension, and update=C2=A0 draft-ietf-tokbind-protoc= ol in the next 2-3 weeks.

This is sounding = better already...
=C2=A0
--
Tony Arcieri
--047d7b33cb18b95d4705142fb983-- From nobody Mon Apr 20 23:55:53 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38EE71B2DD9 for ; Mon, 20 Apr 2015 23:55:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.661 X-Spam-Level: X-Spam-Status: No, score=-1.661 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_EQ_SE=0.35, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AVKWljO6a46S for ; Mon, 20 Apr 2015 23:55:50 -0700 (PDT) Received: from e-mailfilter01.sunet.se (e-mailfilter01.sunet.se [IPv6:2001:6b0:8:2::201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A82661B366B for ; Mon, 20 Apr 2015 23:55:49 -0700 (PDT) Received: from smtp1.sunet.se (smtp1.sunet.se [192.36.171.214]) by e-mailfilter01.sunet.se (8.14.4/8.14.4/Debian-4) with ESMTP id t3L6tlSL010985 (version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Tue, 21 Apr 2015 08:55:47 +0200 Received: from kerio.sunet.se (kerio.sunet.se [192.36.171.210]) by smtp1.sunet.se (8.14.9/8.14.7) with ESMTP id t3L6ti5X005206 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 21 Apr 2015 08:55:47 +0200 (CEST) VBR-Info: md=sunet.se; mc=all; mv=swamid.se DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=sunet.se; s=default; t=1429599347; bh=rqkAA+ZjoVTjbt6Rzrr5iLNfvqxV4NvmNwCgy5illrk=; h=Date:From:To:Subject:References:In-Reply-To; b=tfc/lRJ6POBSsD1GJlSMkGMJSsqYV6YOssGrerCIBV6slDrISLKPAYBCOv1DC8IPA k6XwcwmjZbmwWDKVMDUVrs7kT43CNDVxaB0Xsvg+4Rs5wbBDaR/3tkZqWrUKR3ve8F vSCmp7X6AjW71uhIpKNJIsT52z4BJ2bCaEJQIHY0= X-Footer: c3VuZXQuc2U= Received: from [10.1.0.181] ([193.10.248.8]) (authenticated user leifj@sunet.se) by kerio.sunet.se (Kerio Connect 8.3.4 patch 1) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256 bits)) for unbearable@ietf.org; Tue, 21 Apr 2015 08:55:43 +0200 Message-ID: <5535F46F.80406@sunet.se> Date: Tue, 21 Apr 2015 08:55:43 +0200 From: Leif Johansson User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.6.0 MIME-Version: 1.0 To: unbearable@ietf.org References: <55325D1C.1080807@sunet.se> <20150418165751.GA14171@LK-Perkele-VII> In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Bayes-Prob: 0.0001 (Score 0, tokens from: outbound, outbound-sunet-se:default, sunet-se:default, base:default, @@RPTN) X-CanIt-Geo: ip=192.36.171.210; country=SE; latitude=59.3294; longitude=18.0686; http://maps.google.com/maps?q=59.3294,18.0686&z=6 X-CanItPRO-Stream: outbound-sunet-se:outbound (inherits from outbound-sunet-se:default, sunet-se:default, base:default) X-Canit-Stats-ID: 09OiuTLAK - db3d7ff039ca - 20150421 X-CanIt-Archive-Cluster: PfMRe/vJWMiXwM2YIH5BVExnUnw Received-SPF: neutral (e-mailfilter01.sunet.se: 192.36.171.210 is neither permitted nor denied by domain leifj@sunet.se) receiver=e-mailfilter01.sunet.se; client-ip=192.36.171.210; envelope-from=; helo=smtp1.sunet.se; identity=mailfrom X-Scanned-By: CanIt (www . roaringpenguin . com) on 192.36.171.201 Archived-At: Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Apr 2015 06:55:52 -0000 On 04/20/2015 11:54 PM, Andrei Popov wrote: > Hi Ilari, > > 1) Agreement has been reached in Dallas that we will define a new TLS extension to negotiate Token Binding key parameters, instead of using ALPN. I hope to publish a new I-D for the TLS extension, and update draft-ietf-tokbind-protocol in the next 2-3 weeks. > Why don't you make a note in the appropriate issue to this fact so we don't have to revisit. From nobody Tue Apr 21 09:49:26 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DEB171AD186 for ; Tue, 21 Apr 2015 09:49:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tXlni9ucEUrK for ; Tue, 21 Apr 2015 09:49:23 -0700 (PDT) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2on0121.outbound.protection.outlook.com [65.55.169.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 419211AD376 for ; Tue, 21 Apr 2015 09:46:32 -0700 (PDT) Received: from BN3PR0301MB1250.namprd03.prod.outlook.com (25.161.207.26) by BN3PR0301MB1251.namprd03.prod.outlook.com (25.161.207.27) with Microsoft SMTP Server (TLS) id 15.1.136.25; Tue, 21 Apr 2015 16:46:30 +0000 Received: from BN3PR0301MB1250.namprd03.prod.outlook.com ([25.161.207.26]) by BN3PR0301MB1250.namprd03.prod.outlook.com ([25.161.207.26]) with mapi id 15.01.0136.026; Tue, 21 Apr 2015 16:46:30 +0000 From: Andrei Popov To: Leif Johansson , "unbearable@ietf.org" Thread-Topic: [Unbearable] reviewing our 00's Thread-Index: AQHQedxCiQzINnKJcEexdzbRTl6pbZ1S/eOAgANyB2CAAJy8gIAAo86w Date: Tue, 21 Apr 2015 16:46:30 +0000 Message-ID: References: <55325D1C.1080807@sunet.se> <20150418165751.GA14171@LK-Perkele-VII> <5535F46F.80406@sunet.se> In-Reply-To: <5535F46F.80406@sunet.se> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: sunet.se; dkim=none (message not signed) header.d=none; x-originating-ip: [2001:4898:80e8:ed31::2] x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR0301MB1251; x-microsoft-antispam-prvs: x-forefront-antispam-report: BMV:1; SFV:NSPM; SFS:(10019020)(6009001)(51704005)(479174004)(24454002)(13464003)(377454003)(46102003)(74316001)(62966003)(86612001)(2900100001)(2656002)(77156002)(40100003)(106116001)(87936001)(19580405001)(102836002)(15975445007)(92566002)(2950100001)(86362001)(33656002)(122556002)(2501003)(19580395003)(107886001)(76576001)(93886004)(99286002)(54356999)(50986999)(76176999)(3826002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0301MB1251; H:BN3PR0301MB1250.namprd03.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(5005006)(5002010); SRVR:BN3PR0301MB1251; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0301MB1251; x-forefront-prvs: 0553CBB77A Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.onmicrosoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Apr 2015 16:46:30.5890 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0301MB1251 Archived-At: Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Apr 2015 16:49:25 -0000 Done. I've also added issue 12, based on implementation experience: Token Binding ID includes tokenbinding_type field to indicate whether this = is a Provided or Referred binding. In the federation scenario, the client proves possession of the same Krp to= the RP (as Provided binding) and to the IDP (as Referred binding). If the = IDP includes the Referred Token Binding ID in the token, the RP cannot dire= ctly compare it with the Provided Token Binding ID established with the cli= ent, because the first byte of the ID (tokenbinding_type) will be different= . We should provide guidance on this in draft-ietf-tokbind-https to avoid con= fusion. The easiest thing to do is probably to exclude tokenbinding_type wh= en comparing Token Binding IDs. Cheers, Andrei -----Original Message----- From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of Leif Joh= ansson Sent: Monday, April 20, 2015 11:56 PM To: unbearable@ietf.org Subject: Re: [Unbearable] reviewing our 00's On 04/20/2015 11:54 PM, Andrei Popov wrote: > Hi Ilari, >=20 > 1) Agreement has been reached in Dallas that we will define a new TLS ext= ension to negotiate Token Binding key parameters, instead of using ALPN. I = hope to publish a new I-D for the TLS extension, and update draft-ietf-tok= bind-protocol in the next 2-3 weeks. >=20 Why don't you make a note in the appropriate issue to this fact so we don't= have to revisit. _______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable From nobody Tue Apr 21 09:55:12 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AFE8B1A0052 for ; Tue, 21 Apr 2015 09:55:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.186 X-Spam-Level: X-Spam-Status: No, score=-1.186 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_IMAGE_ONLY_28=1.404, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y32V-ArAqJyf for ; Tue, 21 Apr 2015 09:55:10 -0700 (PDT) Received: from mail-qk0-f176.google.com (mail-qk0-f176.google.com [209.85.220.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2DE4C1AD06B for ; Tue, 21 Apr 2015 09:55:06 -0700 (PDT) Received: by qkx62 with SMTP id 62so210909379qkx.0 for ; Tue, 21 Apr 2015 09:55:05 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:message-id:references:to; bh=y99t56/BcSahqDcdPIfZyZSQ4ezwN7gF2QHgk+myZ6o=; b=NduXsHk813AWez0qSeXOBV9Bpt7OKZ4keqon9+FggTmJKu1ilGIpGE9IyXDuhCs/76 LOdQEYmtsP9ewU3qKL+VRp/tEA0720nwTGqzhf+YxE7p0bZ2aRPAHR0pLs07x7evMGfs sjX64S6lJT+Xbse2XjRQRKXGcpPnIlFZq8X7wpFu8E3IFCYgOVMzqvJLMQ5s/6PIZJfG RXdeGKov0sQ4VoBumOfYAfnr6etyLdR43TYqI0UmIIjNrC+MPd6XuG59esYNFeqMLIzm g6frGCm8BpDzBHUDfVThvj0bTSDGEv2JBZ9AKJfn7g/JAmwr90O6DU/2GcWijkfCmJng YWRA== X-Gm-Message-State: ALoCoQkZ9h+yA6++BspGqI415cYcYp0U9pT2fy6hd8R/QPsuwMrxVLeENRdm4fjq/TjAY8DgqvnS X-Received: by 10.140.31.54 with SMTP id e51mr24109102qge.95.1429635305280; Tue, 21 Apr 2015 09:55:05 -0700 (PDT) Received: from [192.168.8.100] ([181.202.188.198]) by mx.google.com with ESMTPSA id 75sm1714627qhw.41.2015.04.21.09.55.03 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 21 Apr 2015 09:55:04 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_99522B2B-FE1B-4DA6-BF1D-BBCE7DC9751D"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\)) From: John Bradley In-Reply-To: Date: Tue, 21 Apr 2015 13:55:00 -0300 Message-Id: References: To: unbearable@ietf.org X-Mailer: Apple Mail (2.2098) Archived-At: Cc: TokenBinding/Internet-Drafts Subject: Re: [Unbearable] [Internet-Drafts] One spec (#11) X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Apr 2015 16:55:11 -0000 --Apple-Mail=_99522B2B-FE1B-4DA6-BF1D-BBCE7DC9751D Content-Type: multipart/alternative; boundary="Apple-Mail=_7D31FB0A-88B3-4004-98AC-27DA5FE82A17" --Apple-Mail=_7D31FB0A-88B3-4004-98AC-27DA5FE82A17 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 If later on it makes sense to combine them the WG can decide that. For the moment I personally agree with Andrel that keeping the bindings = separate makes sense. The conversations should probably be on the WG unbearable@ietf.org list = or copied to it so that everyone sees them. John B. > On Apr 21, 2015, at 1:33 PM, Andrei-Popov = wrote: >=20 > It is very likely that we'll want to use Token Binding with protocols = other than HTTPS. Token Binding protocol message formats, key parameter = negotiation, etc. are likely to be the same regardless of the = application protocol, but the encapsulation of Token Binding messages in = the application protocol will look different in each application = protocol. >=20 > This is why I believe that keeping Token Binding protocol basics in a = separate I-D is beneficial. In terms of presentation, we can certainly = make improvements so that the two documents are more readable. >=20 > =E2=80=94 > Reply to this email directly or view it on GitHub = . >=20 --Apple-Mail=_7D31FB0A-88B3-4004-98AC-27DA5FE82A17 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 If later on it makes sense to combine them the WG can decide = that.

For the moment = I personally agree with Andrel that keeping the bindings separate makes = sense.

The = conversations should probably be on the WG unbearable@ietf.org = list or copied to it so that everyone sees them.

John B.

On = Apr 21, 2015, at 1:33 PM, Andrei-Popov <notifications@github.com> wrote:

It is = very likely that we'll want to use Token Binding with protocols other = than HTTPS. Token Binding protocol message formats, key parameter = negotiation, etc. are likely to be the same regardless of the = application protocol, but the encapsulation of Token Binding messages in = the application protocol will look different in each application = protocol.

This is why I believe that keeping Token = Binding protocol basics in a separate I-D is beneficial. In terms of = presentation, we can certainly make improvements so that the two = documents are more readable.

=E2=80=94
Reply to this email directly or view it on GitHub.3D""


= --Apple-Mail=_7D31FB0A-88B3-4004-98AC-27DA5FE82A17-- --Apple-Mail=_99522B2B-FE1B-4DA6-BF1D-BBCE7DC9751D Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIINPDCCBjQw ggQcoAMCAQICASAwDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3MTAyNDIxMDI1NVoX DTE3MTAyNDIxMDI1NVowgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSsw KQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFy dENvbSBDbGFzcyAyIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMsohUWcASz7GfKrpTOMKqANy9BV7V0igWdGxA8IU77L3aTxErQ+ fcxtDYZ36Z6GH0YFn7fq5RADteP0AYzrCA+EQTfi8q1+kA3m0nwtwXG94M5sIqsvs7lRP1aycBke /s5g9hJHryZ2acScnzczjBCAo7X1v5G3yw8MDP2m2RCye0KfgZ4nODerZJVzhAlOD9YejvAXZqHk sw56HzElVIoYSZ3q4+RJuPXXfIoyby+Y2m1E+YzX5iCZXBx05gk6MKAW1vaw4/v2OOLy6FZH3XHH tOkzUreG//CsFnB9+uaYSlR65cdGzTsmoIK8WH1ygoXhRBm98SD7Hf/r3FELNvUCAwEAAaOCAa0w ggGpMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSuVYNv7DHKufcd +q9rMfPIHeOsuzAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jBmBggrBgEFBQcBAQRa MFgwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9jYTAtBggrBgEFBQcwAoYh aHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3J0MFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIGABgNVHSAEeTB3MHUGCysGAQQBgbU3AQIBMGYwLgYIKwYBBQUHAgEWImh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cu c3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwDQYJKoZIhvcNAQEFBQADggIBADqpJw3I07QW ke9plNBpxUxcffc7nUrIQpJHDci91DFG7fVhHRkMZ1J+BKg5UNUxIFJ2Z9B90Micc/NXcs7kPBRd n6XGO/vPc87Y6R+cWS9Nc9+fp3Enmsm94OxOwI9wn8qnr/6o3mD4noP9JphwUPTXwHovjavRnhUQ HLfo/i2NG0XXgTHXS2Xm0kVUozXqpYpAdumMiB/vezj1QHQJDmUdPYMcp+reg9901zkyT3fDW/iv JVv6pWtkh6Pw2ytZT7mvg7YhX3V50Nv860cV11mocUVcqBLv0gcT+HBDYtbuvexNftwNQKD5193A 7zN4vG7CTYkXxytSjKuXrpEatEiFPxWgb84nVj25SU5q/r1Xhwby6mLhkbaXslkVtwEWT3Van49r KjlK4XrUKYYWtnfzq6aSak5u0Vpxd1rY79tWhD3EdCvOhNz/QplNa+VkIsrcp7+8ZhP1l1b2U6Ma xIVteuVMD3X0vziIwr7jxYae9FZjbxlpUemqXjcC0QaFfN7qI0JsQMALL7iGRBg7K0CoOBzECdD3 fuZil5kU/LP9cr1BK31U0Uy651bFnAMMMkqhAChIbn0ei72VnbpSsrrSdF0BAGYQ8vyHae5aCg+H 75dVCV33K6FuxZrf09yTz+Vx/PkdRUYkXmZz/OTfyJXsUOUXrym6KvI2rYpccSk5MIIHADCCBeig AwIBAgICSAcwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENv bSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYD VQQDEy9TdGFydENvbSBDbGFzcyAyIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTAeFw0x NDAzMjQyMzU2MjNaFw0xNjAzMjUwOTM5MzFaMIGfMRkwFwYDVQQNExBxekYwMVhZQ1pNTDM4N2hE MQswCQYDVQQGEwJDTDEiMCAGA1UECBMZTWV0cm9wb2xpdGFuYSBkZSBTYW50aWFnbzEWMBQGA1UE BxMNSXNsYSBkZSBNYWlwbzEVMBMGA1UEAxMMSm9obiBCcmFkbGV5MSIwIAYJKoZIhvcNAQkBFhNq YnJhZGxleUBpY2xvdWQuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtTL0o4QG WC+jnmYa7xEjcBTAeIOt7ILy40qsnJHNedVaTH0EU5yHzoaEOGHuOuwJUz/C7r2TvXpJ/Ud4w6VO HdOUGnnKUiH5MV/kIysZ7DpN5D1f+yEast00oKsEbf/D6flzfex2JFV9rT7AQ+FQaTdf3S9K7gM2 F5kODFg805BMYTGT+haw9VOMXju5s93VEjUQcnGrLy0RtoN76GM6ItxqNnEt/Ln+2GNq8JvPyUKe JsAxfIlTyqIbw32VlusKXL4+jmgFi+LY6bsfg3VHLvy58QsQnCwHg15uARvy5X6owyGcG7xHwNml fNWtBZ3DHNPh37HC9lmAy4iqw4PvNwIDAQABo4IDVTCCA1EwCQYDVR0TBAIwADALBgNVHQ8EBAMC BLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBSUDb6BlJD7FIYgWj1w 4z+GsOXs7zAfBgNVHSMEGDAWgBSuVYNv7DHKufcd+q9rMfPIHeOsuzCBmQYDVR0RBIGRMIGOgRNq YnJhZGxleUBpY2xvdWQuY29tgRNqYnJhZGxleUBpY2xvdWQuY29tgRdqb2huLmJyYWRsZXlAd2lu Z2FhLmNvbYERdmU3anRiQHZlN2p0Yi5jb22BD2picmFkbGV5QG1lLmNvbYEQamJyYWRsZXlAbWFj LmNvbYETamJyYWRsZXlAd2luZ2FhLmNvbTCCAUwGA1UdIASCAUMwggE/MIIBOwYLKwYBBAGBtTcB AgMwggEqMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMIH3 BggrBgEFBQcCAjCB6jAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgEBGoG+ VGhpcyBjZXJ0aWZpY2F0ZSB3YXMgaXNzdWVkIGFjY29yZGluZyB0byB0aGUgQ2xhc3MgMiBWYWxp ZGF0aW9uIHJlcXVpcmVtZW50cyBvZiB0aGUgU3RhcnRDb20gQ0EgcG9saWN5LCByZWxpYW5jZSBv bmx5IGZvciB0aGUgaW50ZW5kZWQgcHVycG9zZSBpbiBjb21wbGlhbmNlIG9mIHRoZSByZWx5aW5n IHBhcnR5IG9ibGlnYXRpb25zLjA2BgNVHR8ELzAtMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3Ns LmNvbS9jcnR1Mi1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8v b2NzcC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMi9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczIuY2xpZW50LmNhLmNydDAjBgNVHRIE HDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBALscEldbrgeF B1WC/hMdYxFT4Lc8ALtErgJryRozTdeMlzpsncIKyy8M54HhxQAMOqFe2HR+R9H7WeIzmkV95yJn JY3bd4bxnnemhLrDyi1VlNjEjkK5kgegI8JavahFXl4FwJHHv8TOh71Wf3fiy0Do7d7TQmVDRrzt 1k/2w4CXKweQ2mdFw7fskiYoPGEK7pFiicGMFBzLiKRm61CqojS4IYShiP0nCZZWPwNJYs5lstxD SSMaD+KccZVxkL7X2Qj9PJ+PCAQ6dMhvwTXrdcnrE7fI8PhFvHWrERjg7yIu1WI4Fgviy0u7437v WzufSnfqMwbfz20fucO0chYq+tkxggNsMIIDaAIBATCBkzCBjDELMAkGA1UEBhMCSUwxFjAUBgNV BAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp Z25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDIgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xp ZW50IENBAgJIBzAJBgUrDgMCGgUAoIIBrTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqG SIb3DQEJBTEPFw0xNTA0MjExNjU1MDFaMCMGCSqGSIb3DQEJBDEWBBTOCxIrHeUgY4a3wKc7qruw YGN7dzCBpAYJKwYBBAGCNxAEMYGWMIGTMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYG A1UEAxMvU3RhcnRDb20gQ2xhc3MgMiBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAkgH MIGmBgsqhkiG9w0BCRACCzGBlqCBkzCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNV BAMTL1N0YXJ0Q29tIENsYXNzIDIgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBAgJIBzAN BgkqhkiG9w0BAQEFAASCAQB5OW1vRWeSteIGDEBIvKlu0PAq5Td1fmGhwtQgOVw2Pp46mDck1y/d glrTX7r0zYDbeyj0+bvE77Iqwtc7r9mxW6EJ9i1QAlrNWCk4Oidz/lnfttEAJ+ow/RFumR1TfpmE R0r7oRgtnDM6DSb9jbcj8528U/VCsFjgD4NsSLQnjEKpfozsXx31qb4KDacNs2tZTg65UioiHmri OJej8prBKLKVpyLfr+vUdJEYFAYEr11mb+NbC2FUNuCmsa1jFwoDR2hAtUTvPcmyOldgzq/jm45D j2xhJ1CkKdM3ZmmR0xiMaGcPgbEDTUvjXKkUmfYF41mCG3ge67TYk2G2k06GAAAAAAAA --Apple-Mail=_99522B2B-FE1B-4DA6-BF1D-BBCE7DC9751D-- From nobody Wed Apr 22 07:14:24 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C2D8F1A92EF for ; Wed, 22 Apr 2015 07:14:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.713 X-Spam-Level: X-Spam-Status: No, score=0.713 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.723, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VKNeBpEPCzL2 for ; Wed, 22 Apr 2015 07:14:21 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.17.20]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A3651A92AD for ; Wed, 22 Apr 2015 07:14:15 -0700 (PDT) Received: from [79.195.181.86] by 3capp-gmx-bs64.server.lan (via HTTP); Wed, 22 Apr 2015 16:14:11 +0200 MIME-Version: 1.0 Message-ID: From: D.Rogers@gmx.net To: "Andrei Popov" Content-Type: text/html; charset=UTF-8 Date: Wed, 22 Apr 2015 16:14:11 +0200 Importance: normal Sensitivity: Normal In-Reply-To: References: <55325D1C.1080807@sunet.se> , , X-UI-Message-Type: mail X-Priority: 3 X-Provags-ID: V03:K0:Cf1zgCYaKl+mz9m9VhG+7zYa0RR80mj3IgE7IxNXyZm XU4tVSK+PEQJOpQwS1ALuIo5ayZntaBMNFgS6eyZOI5bI43hmI OH4E9dDqtdQbcfplDi9rFhd5Uf00B6EKuGClDmixzGo1s3FCq0 tMRGzKTO80DMXk83m5/nRB3wcOP2wmw+t1cQhiatuWLajhQB7U xiwl0BwDyGB5a1STDBTUy6z7L3PFM3blILu9pFD2KjGNWfDI6e d9XPG01lPfCOJX8Ib/d9t3SGZI++oDroOSfvYgYpMC3pK0JKFz n9zdiU= X-UI-Out-Filterresults: notjunk:1; Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Apr 2015 14:14:24 -0000
Hi Andrea,
 
yes, quite right, and of course if they perviously had the relevant cookie, resetablishing it is trivial. And someone not accepting cookies on principle would not have been authenticated in the first place. Bu this is more or less what I wrote previously. Which mechanism are we relying on to prevent hyjacking the returned cookie? 
 
But I was more concerned with the key-management client-side issue. I have no proposed solution up my sleave, but it concerns me that like many others very often I am in hundreds of web-sites per day.
Added to this during any particular day I am using a Win-8 desktop, a Win-7 laptop, and an Android based Tablet. I am just thinking that scaleability should be built into solutions at an early stage.
 
best,
Dean  
 
Gesendet: Dienstag, 21. April 2015 um 00:03 Uhr
Von: "Andrei Popov" <Andrei.Popov@microsoft.com>
An: "D.Rogers@gmx.net" <D.Rogers@gmx.net>
Cc: "unbearable@ietf.org" <unbearable@ietf.org>
Betreff: Re: [Unbearable] reviewing our 00's

Hi Dean,

 

Thanks for the editorial comments; will rephrase in the next revision.

 

Ø  What happens if exactly at that moment the the client clears thier cache after the token/cookie is received?

Ø  I still have the same conceptual problem with cache flushing, if the cookie is gone the whole process has to start from the beginning and the client has to prove they are still the same client. In other words re-establish the 3rd leg of a challenge response protocol.

If the cookie is gone, the server will have to authenticate this client again. This is the case today; I don’t think Token Binding is changing anything WRT this case.

 

Cheers,

 

Andrei

 

From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of D.Rogers@gmx.net
Sent: Saturday, April 18, 2015 1:11 PM
Cc: unbearable@ietf.org
Subject: Re: [Unbearable] reviewing our 00's

 

Dear All,

 

 

perhaps its a bit late to be raising this point but:

Abstract:

"an HTTP server issues a security token (such as a cookie) to a client, and expects the client to send the security token back to the server at a later time in order to authenticate."

 

What happens if exactly at that moment the the client clears thier cache after the token/cookie is received?

Something in the challenge-response mechanism is missing here. Why does the HTTP Server issue the token, at this point there is no mention of a challenge prompting this response. What should the challenge look like? Basically this does not belong in the abstract.

 

"Binding the token to the TLS connection between client and server protects the security token from theft, and ensures that the security token can only be used by the client that it was issued to."

This binding is not yet established, so ... "and would ensure that the security token..."

 

Please, I may have misunderstood something, but are we saying that a token issued by server A to client X may possibly be accepted by server B, surely this can only be the case on implicit trust between servers A and B?

Further, "the client proves possession of (private key) to the server, and is long-lived (i.e., subsequent TLS connections between the same client and server have the same Token Binding ID."

I still have the same conceptual problem with cache flushing, if the cookie is gone the whole process has to start from the beginning and the client has to prove they are still the same client. In other words re-establish the 3rd leg of a challenge response protocol. Where this is still the same client only time is lost. but I am afraid that should an attacker be able to generate such a failure they may be able to hijack the session.

 

Section 3.1 suggests that each client operate a large scale Key-management system, "clients use different private keys to establish Provided Token Binding IDs with different servers".

Clients are clients and this should not be thier business.

It was with this, to my mind, major architectural conceptual misdiection that stoped my reading further.

 

Salutem

Dean

 

Gesendet: Samstag, 18. April 2015 um 17:21 Uhr
Von: "Brian Campbell" <bcampbell@pingidentity.com>
An: D.Rogers@gmx.net
Cc: "unbearable@ietf.org" <unbearable@ietf.org>
Betreff: Re: [Unbearable] reviewing our 00's

 

On Sat, Apr 18, 2015 at 9:16 AM, <D.Rogers@gmx.net> wrote:

Sorry,

 

but like a lot of people we are all busy,

 

can you repeat the links,

without wishing to sound like Dr Who, you catch me at a time when I have time,

possibly its the same for others, quick links without having to mine them would be most useful brigadier :-)

 

best

Dean

Gesendet: Samstag, 18. April 2015 um 15:33 Uhr
Von: "Leif Johansson" <leifj@sunet.se>
An: "unbearable@ietf.org" <unbearable@ietf.org>
Betreff: [Unbearable] reviewing our 00's


Folks,

The core drafts have been out and published as WG documents for a couple
of weeks now. Please review!

Cheers Leif

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable


_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable
 

_______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable

_______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable
From nobody Wed Apr 22 10:29:39 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 76E5F1B38DD for ; Wed, 22 Apr 2015 10:29:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ys962BK9aVLj for ; Wed, 22 Apr 2015 10:29:33 -0700 (PDT) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2on0101.outbound.protection.outlook.com [65.55.169.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C2B01B38C2 for ; Wed, 22 Apr 2015 10:29:32 -0700 (PDT) Received: from BN3PR0301MB1250.namprd03.prod.outlook.com (25.161.207.26) by BN3PR0301MB1251.namprd03.prod.outlook.com (25.161.207.27) with Microsoft SMTP Server (TLS) id 15.1.136.25; Wed, 22 Apr 2015 17:29:30 +0000 Received: from BN3PR0301MB1250.namprd03.prod.outlook.com ([25.161.207.26]) by BN3PR0301MB1250.namprd03.prod.outlook.com ([25.161.207.26]) with mapi id 15.01.0136.026; Wed, 22 Apr 2015 17:29:30 +0000 From: Andrei Popov To: "D.Rogers@gmx.net" Thread-Topic: Re: [Unbearable] reviewing our 00's Thread-Index: AQHQedxCiQzINnKJcEexdzbRTl6pbZ1S4YCAgAABiACAAFDigIADQtKAgAKiwICAADKz8A== Date: Wed, 22 Apr 2015 17:29:30 +0000 Message-ID: References: <55325D1C.1080807@sunet.se> , , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmx.net; dkim=none (message not signed) header.d=none; x-originating-ip: [2001:4898:80e8:ed31::2] x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR0301MB1251; x-forefront-antispam-report: BMV:1; SFV:NSPM; SFS:(10019020)(377454003)(51914003)(24454002)(93886004)(2351001)(99286002)(54356999)(50986999)(76576001)(16236675004)(19580395003)(19300405004)(110136001)(19625215002)(106116001)(76176999)(2656002)(2501003)(40100003)(77156002)(87936001)(74316001)(46102003)(2900100001)(62966003)(86362001)(33656002)(2950100001)(102836002)(19617315012)(19580405001)(15975445007)(122556002)(92566002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0301MB1251; H:BN3PR0301MB1250.namprd03.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(5002010)(5005006); SRVR:BN3PR0301MB1251; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0301MB1251; x-forefront-prvs: 0554B1F54F Content-Type: multipart/alternative; boundary="_000_BN3PR0301MB12500E593B96CFB9E709B6C48CEE0BN3PR0301MB1250_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.onmicrosoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Apr 2015 17:29:30.6971 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0301MB1251 Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Apr 2015 17:29:36 -0000 --_000_BN3PR0301MB12500E593B96CFB9E709B6C48CEE0BN3PR0301MB1250_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 w5ggIFdoaWNoIG1lY2hhbmlzbSBhcmUgd2UgcmVseWluZyBvbiB0byBwcmV2ZW50IGh5amFja2lu ZyB0aGUgcmV0dXJuZWQgY29va2llPw0KQXJlIHlvdSB0YWxraW5nIGFib3V0IGEgc2NlbmFyaW8g d2hlcmUgdGhlIGNsaWVudCBkZWxldGVzIGNvb2tpZXMgKGFuZCB0b2tlbiBiaW5kaW5ncyksIHJl LWF1dGhlbnRpY2F0ZXMgd2l0aCB0aGUgd2ViIHNpdGUsIGFuZCByZWNlaXZlcyBhIG5ldyBjb29r aWU/IEluIHRoaXMgY2FzZSwgdGhlIG5ldyBjb29raWUgd2lsbCBiZSBib3VuZCB0byB0aGUgbmV3 IFRva2VuIEJpbmRpbmcgS2V5IChhc3N1bWluZyB0aGUgY2xpZW50IGFuZCBzZXJ2ZXIgaGF2ZSBu ZWdvdGlhdGVkIHRoZSB1c2Ugb2YgVG9rZW4gQmluZGluZykuDQoNCsOYICBCdXQgSSB3YXMgbW9y ZSBjb25jZXJuZWQgd2l0aCB0aGUga2V5LW1hbmFnZW1lbnQgY2xpZW50LXNpZGUgaXNzdWUuDQoN CsOYICBJIGFtIGp1c3QgdGhpbmtpbmcgdGhhdCBzY2FsZWFiaWxpdHkgc2hvdWxkIGJlIGJ1aWx0 IGludG8gc29sdXRpb25zIGF0IGFuIGVhcmx5IHN0YWdlLg0KSWYgdGhlIGNsaWVudCBjYW4gbWFu YWdlIGNvb2tpZXMgaW4gYSBzY2FsYWJsZSBtYW5uZXIsIHRoaXMgY2xpZW50IGNhbiBwcm9iYWJs eSBiZSBlbmhhbmNlZCB0byBhbHNvIG1hbmFnZSBUb2tlbiBCaW5kaW5nIGtleXMgaW4gYSBzY2Fs YWJsZSBtYW5uZXIuIENhbiB5b3UgZWxhYm9yYXRlIG9uIHRoZSBzcGVjaWZpYyBjbGllbnQtc2lk ZSBzY2FsYWJpbGl0eSBjb25jZXJucz8NCg0KQ2hlZXJzLA0KDQpBbmRyZWkNCg0KRnJvbTogRC5S b2dlcnNAZ214Lm5ldCBbbWFpbHRvOkQuUm9nZXJzQGdteC5uZXRdDQpTZW50OiBXZWRuZXNkYXks IEFwcmlsIDIyLCAyMDE1IDc6MTQgQU0NClRvOiBBbmRyZWkgUG9wb3YNCkNjOiB1bmJlYXJhYmxl QGlldGYub3JnDQpTdWJqZWN0OiBBdzogUmU6IFtVbmJlYXJhYmxlXSByZXZpZXdpbmcgb3VyIDAw J3MNCg0KSGkgQW5kcmVhLA0KDQp5ZXMsIHF1aXRlIHJpZ2h0LCBhbmQgb2YgY291cnNlIGlmIHRo ZXkgcGVydmlvdXNseSBoYWQgdGhlIHJlbGV2YW50IGNvb2tpZSwgcmVzZXRhYmxpc2hpbmcgaXQg aXMgdHJpdmlhbC4gQW5kIHNvbWVvbmUgbm90IGFjY2VwdGluZyBjb29raWVzIG9uIHByaW5jaXBs ZSB3b3VsZCBub3QgaGF2ZSBiZWVuIGF1dGhlbnRpY2F0ZWQgaW4gdGhlIGZpcnN0IHBsYWNlLiBC dSB0aGlzIGlzIG1vcmUgb3IgbGVzcyB3aGF0IEkgd3JvdGUgcHJldmlvdXNseS4gV2hpY2ggbWVj aGFuaXNtIGFyZSB3ZSByZWx5aW5nIG9uIHRvIHByZXZlbnQgaHlqYWNraW5nIHRoZSByZXR1cm5l ZCBjb29raWU/DQoNCkJ1dCBJIHdhcyBtb3JlIGNvbmNlcm5lZCB3aXRoIHRoZSBrZXktbWFuYWdl bWVudCBjbGllbnQtc2lkZSBpc3N1ZS4gSSBoYXZlIG5vIHByb3Bvc2VkIHNvbHV0aW9uIHVwIG15 IHNsZWF2ZSwgYnV0IGl0IGNvbmNlcm5zIG1lIHRoYXQgbGlrZSBtYW55IG90aGVycyB2ZXJ5IG9m dGVuIEkgYW0gaW4gaHVuZHJlZHMgb2Ygd2ViLXNpdGVzIHBlciBkYXkuDQpBZGRlZCB0byB0aGlz IGR1cmluZyBhbnkgcGFydGljdWxhciBkYXkgSSBhbSB1c2luZyBhIFdpbi04IGRlc2t0b3AsIGEg V2luLTcgbGFwdG9wLCBhbmQgYW4gQW5kcm9pZCBiYXNlZCBUYWJsZXQuIEkgYW0ganVzdCB0aGlu a2luZyB0aGF0IHNjYWxlYWJpbGl0eSBzaG91bGQgYmUgYnVpbHQgaW50byBzb2x1dGlvbnMgYXQg YW4gZWFybHkgc3RhZ2UuDQoNCmJlc3QsDQpEZWFuDQoNCkdlc2VuZGV0OiBEaWVuc3RhZywgMjEu IEFwcmlsIDIwMTUgdW0gMDA6MDMgVWhyDQpWb246ICJBbmRyZWkgUG9wb3YiIDxBbmRyZWkuUG9w b3ZAbWljcm9zb2Z0LmNvbTxtYWlsdG86QW5kcmVpLlBvcG92QG1pY3Jvc29mdC5jb20+Pg0KQW46 ICJELlJvZ2Vyc0BnbXgubmV0PG1haWx0bzpELlJvZ2Vyc0BnbXgubmV0PiIgPEQuUm9nZXJzQGdt eC5uZXQ8bWFpbHRvOkQuUm9nZXJzQGdteC5uZXQ+Pg0KQ2M6ICJ1bmJlYXJhYmxlQGlldGYub3Jn PG1haWx0bzp1bmJlYXJhYmxlQGlldGYub3JnPiIgPHVuYmVhcmFibGVAaWV0Zi5vcmc8bWFpbHRv OnVuYmVhcmFibGVAaWV0Zi5vcmc+Pg0KQmV0cmVmZjogUmU6IFtVbmJlYXJhYmxlXSByZXZpZXdp bmcgb3VyIDAwJ3MNCkhpIERlYW4sDQoNClRoYW5rcyBmb3IgdGhlIGVkaXRvcmlhbCBjb21tZW50 czsgd2lsbCByZXBocmFzZSBpbiB0aGUgbmV4dCByZXZpc2lvbi4NCg0KDQo+ICBXaGF0IGhhcHBl bnMgaWYgZXhhY3RseSBhdCB0aGF0IG1vbWVudCB0aGUgdGhlIGNsaWVudCBjbGVhcnMgdGhpZXIg Y2FjaGUgYWZ0ZXIgdGhlIHRva2VuL2Nvb2tpZSBpcyByZWNlaXZlZD8NCg0KPiAgSSBzdGlsbCBo YXZlIHRoZSBzYW1lIGNvbmNlcHR1YWwgcHJvYmxlbSB3aXRoIGNhY2hlIGZsdXNoaW5nLCBpZiB0 aGUgY29va2llIGlzIGdvbmUgdGhlIHdob2xlIHByb2Nlc3MgaGFzIHRvIHN0YXJ0IGZyb20gdGhl IGJlZ2lubmluZyBhbmQgdGhlIGNsaWVudCBoYXMgdG8gcHJvdmUgdGhleSBhcmUgc3RpbGwgdGhl IHNhbWUgY2xpZW50LiBJbiBvdGhlciB3b3JkcyByZS1lc3RhYmxpc2ggdGhlIDNyZCBsZWcgb2Yg YSBjaGFsbGVuZ2UgcmVzcG9uc2UgcHJvdG9jb2wuDQpJZiB0aGUgY29va2llIGlzIGdvbmUsIHRo ZSBzZXJ2ZXIgd2lsbCBoYXZlIHRvIGF1dGhlbnRpY2F0ZSB0aGlzIGNsaWVudCBhZ2Fpbi4gVGhp cyBpcyB0aGUgY2FzZSB0b2RheTsgSSBkb27igJl0IHRoaW5rIFRva2VuIEJpbmRpbmcgaXMgY2hh bmdpbmcgYW55dGhpbmcgV1JUIHRoaXMgY2FzZS4NCg0KQ2hlZXJzLA0KDQpBbmRyZWkNCg0KRnJv bTogVW5iZWFyYWJsZSBbbWFpbHRvOnVuYmVhcmFibGUtYm91bmNlc0BpZXRmLm9yZ10gT24gQmVo YWxmIE9mIEQuUm9nZXJzQGdteC5uZXQ8bWFpbHRvOkQuUm9nZXJzQGdteC5uZXQ+DQpTZW50OiBT YXR1cmRheSwgQXByaWwgMTgsIDIwMTUgMToxMSBQTQ0KQ2M6IHVuYmVhcmFibGVAaWV0Zi5vcmc8 bWFpbHRvOnVuYmVhcmFibGVAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogW1VuYmVhcmFibGVdIHJl dmlld2luZyBvdXIgMDAncw0KDQpEZWFyIEFsbCwNCg0KaHR0cDovL3Rvb2xzLmlldGYub3JnL2h0 bWwvZHJhZnQtaWV0Zi10b2tiaW5kLWh0dHBzLTAwDQoNCnBlcmhhcHMgaXRzIGEgYml0IGxhdGUg dG8gYmUgcmFpc2luZyB0aGlzIHBvaW50IGJ1dDoNCkFic3RyYWN0Og0KImFuIEhUVFAgc2VydmVy IGlzc3VlcyBhIHNlY3VyaXR5IHRva2VuIChzdWNoIGFzIGEgY29va2llKSB0byBhIGNsaWVudCwg YW5kIGV4cGVjdHMgdGhlIGNsaWVudCB0byBzZW5kIHRoZSBzZWN1cml0eSB0b2tlbiBiYWNrIHRv IHRoZSBzZXJ2ZXIgYXQgYSBsYXRlciB0aW1lIGluIG9yZGVyIHRvIGF1dGhlbnRpY2F0ZS4iDQoN CldoYXQgaGFwcGVucyBpZiBleGFjdGx5IGF0IHRoYXQgbW9tZW50IHRoZSB0aGUgY2xpZW50IGNs ZWFycyB0aGllciBjYWNoZSBhZnRlciB0aGUgdG9rZW4vY29va2llIGlzIHJlY2VpdmVkPw0KU29t ZXRoaW5nIGluIHRoZSBjaGFsbGVuZ2UtcmVzcG9uc2UgbWVjaGFuaXNtIGlzIG1pc3NpbmcgaGVy ZS4gV2h5IGRvZXMgdGhlIEhUVFAgU2VydmVyIGlzc3VlIHRoZSB0b2tlbiwgYXQgdGhpcyBwb2lu dCB0aGVyZSBpcyBubyBtZW50aW9uIG9mIGEgY2hhbGxlbmdlIHByb21wdGluZyB0aGlzIHJlc3Bv bnNlLiBXaGF0IHNob3VsZCB0aGUgY2hhbGxlbmdlIGxvb2sgbGlrZT8gQmFzaWNhbGx5IHRoaXMg ZG9lcyBub3QgYmVsb25nIGluIHRoZSBhYnN0cmFjdC4NCg0KIkJpbmRpbmcgdGhlIHRva2VuIHRv IHRoZSBUTFMgY29ubmVjdGlvbiBiZXR3ZWVuIGNsaWVudCBhbmQgc2VydmVyIHByb3RlY3RzIHRo ZSBzZWN1cml0eSB0b2tlbiBmcm9tIHRoZWZ0LCBhbmQgZW5zdXJlcyB0aGF0IHRoZSBzZWN1cml0 eSB0b2tlbiBjYW4gb25seSBiZSB1c2VkIGJ5IHRoZSBjbGllbnQgdGhhdCBpdCB3YXMgaXNzdWVk IHRvLiINClRoaXMgYmluZGluZyBpcyBub3QgeWV0IGVzdGFibGlzaGVkLCBzbyAuLi4gImFuZCB3 b3VsZCBlbnN1cmUgdGhhdCB0aGUgc2VjdXJpdHkgdG9rZW4uLi4iDQoNClBsZWFzZSwgSSBtYXkg aGF2ZSBtaXN1bmRlcnN0b29kIHNvbWV0aGluZywgYnV0IGFyZSB3ZSBzYXlpbmcgdGhhdCBhIHRv a2VuIGlzc3VlZCBieSBzZXJ2ZXIgQSB0byBjbGllbnQgWCBtYXkgcG9zc2libHkgYmUgYWNjZXB0 ZWQgYnkgc2VydmVyIEIsIHN1cmVseSB0aGlzIGNhbiBvbmx5IGJlIHRoZSBjYXNlIG9uIGltcGxp Y2l0IHRydXN0IGJldHdlZW4gc2VydmVycyBBIGFuZCBCPw0KRnVydGhlciwgInRoZSBjbGllbnQg cHJvdmVzIHBvc3Nlc3Npb24gb2YgKHByaXZhdGUga2V5KSB0byB0aGUgc2VydmVyLCBhbmQgaXMg bG9uZy1saXZlZCAoaS5lLiwgc3Vic2VxdWVudCBUTFMgY29ubmVjdGlvbnMgYmV0d2VlbiB0aGUg c2FtZSBjbGllbnQgYW5kIHNlcnZlciBoYXZlIHRoZSBzYW1lIFRva2VuIEJpbmRpbmcgSUQuIg0K SSBzdGlsbCBoYXZlIHRoZSBzYW1lIGNvbmNlcHR1YWwgcHJvYmxlbSB3aXRoIGNhY2hlIGZsdXNo aW5nLCBpZiB0aGUgY29va2llIGlzIGdvbmUgdGhlIHdob2xlIHByb2Nlc3MgaGFzIHRvIHN0YXJ0 IGZyb20gdGhlIGJlZ2lubmluZyBhbmQgdGhlIGNsaWVudCBoYXMgdG8gcHJvdmUgdGhleSBhcmUg c3RpbGwgdGhlIHNhbWUgY2xpZW50LiBJbiBvdGhlciB3b3JkcyByZS1lc3RhYmxpc2ggdGhlIDNy ZCBsZWcgb2YgYSBjaGFsbGVuZ2UgcmVzcG9uc2UgcHJvdG9jb2wuIFdoZXJlIHRoaXMgaXMgc3Rp bGwgdGhlIHNhbWUgY2xpZW50IG9ubHkgdGltZSBpcyBsb3N0LiBidXQgSSBhbSBhZnJhaWQgdGhh dCBzaG91bGQgYW4gYXR0YWNrZXIgYmUgYWJsZSB0byBnZW5lcmF0ZSBzdWNoIGEgZmFpbHVyZSB0 aGV5IG1heSBiZSBhYmxlIHRvIGhpamFjayB0aGUgc2Vzc2lvbi4NCg0KU2VjdGlvbiAzLjEgc3Vn Z2VzdHMgdGhhdCBlYWNoIGNsaWVudCBvcGVyYXRlIGEgbGFyZ2Ugc2NhbGUgS2V5LW1hbmFnZW1l bnQgc3lzdGVtLCAiY2xpZW50cyB1c2UgZGlmZmVyZW50IHByaXZhdGUga2V5cyB0byBlc3RhYmxp c2ggUHJvdmlkZWQgVG9rZW4gQmluZGluZyBJRHMgd2l0aCBkaWZmZXJlbnQgc2VydmVycyIuDQpD bGllbnRzIGFyZSBjbGllbnRzIGFuZCB0aGlzIHNob3VsZCBub3QgYmUgdGhpZXIgYnVzaW5lc3Mu DQpJdCB3YXMgd2l0aCB0aGlzLCB0byBteSBtaW5kLCBtYWpvciBhcmNoaXRlY3R1cmFsIGNvbmNl cHR1YWwgbWlzZGllY3Rpb24gdGhhdCBzdG9wZWQgbXkgcmVhZGluZyBmdXJ0aGVyLg0KDQpTYWx1 dGVtDQpEZWFuDQoNCkdlc2VuZGV0OiBTYW1zdGFnLCAxOC4gQXByaWwgMjAxNSB1bSAxNzoyMSBV aHINClZvbjogIkJyaWFuIENhbXBiZWxsIiA8YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb20+DQpB bjogRC5Sb2dlcnNAZ214Lm5ldA0KQ2M6ICJ1bmJlYXJhYmxlQGlldGYub3JnIiA8dW5iZWFyYWJs ZUBpZXRmLm9yZz4NCkJldHJlZmY6IFJlOiBbVW5iZWFyYWJsZV0gcmV2aWV3aW5nIG91ciAwMCdz DQpTb21lIGxpbmtzOg0KDQpodHRwOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRv a2JpbmQtcHJvdG9jb2wtMDANCmh0dHA6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYt dG9rYmluZC1odHRwcy0wMA0KDQpodHRwczovL2dpdGh1Yi5jb20vVG9rZW5CaW5kaW5nLw0KDQpP biBTYXQsIEFwciAxOCwgMjAxNSBhdCA5OjE2IEFNLCA8RC5Sb2dlcnNAZ214Lm5ldDxtYWlsdG86 RC5Sb2dlcnNAZ214Lm5ldD4+IHdyb3RlOg0KU29ycnksDQoNCmJ1dCBsaWtlIGEgbG90IG9mIHBl b3BsZSB3ZSBhcmUgYWxsIGJ1c3ksDQoNCmNhbiB5b3UgcmVwZWF0IHRoZSBsaW5rcywNCndpdGhv dXQgd2lzaGluZyB0byBzb3VuZCBsaWtlIERyIFdobywgeW91IGNhdGNoIG1lIGF0IGEgdGltZSB3 aGVuIEkgaGF2ZSB0aW1lLA0KcG9zc2libHkgaXRzIHRoZSBzYW1lIGZvciBvdGhlcnMsIHF1aWNr IGxpbmtzIHdpdGhvdXQgaGF2aW5nIHRvIG1pbmUgdGhlbSB3b3VsZCBiZSBtb3N0IHVzZWZ1bCBi cmlnYWRpZXIgOi0pDQoNCmJlc3QNCkRlYW4NCkdlc2VuZGV0OiBTYW1zdGFnLCAxOC4gQXByaWwg MjAxNSB1bSAxNTozMyBVaHINClZvbjogIkxlaWYgSm9oYW5zc29uIiA8bGVpZmpAc3VuZXQuc2U8 bWFpbHRvOmxlaWZqQHN1bmV0LnNlPj4NCkFuOiAidW5iZWFyYWJsZUBpZXRmLm9yZzxtYWlsdG86 dW5iZWFyYWJsZUBpZXRmLm9yZz4iIDx1bmJlYXJhYmxlQGlldGYub3JnPG1haWx0bzp1bmJlYXJh YmxlQGlldGYub3JnPj4NCkJldHJlZmY6IFtVbmJlYXJhYmxlXSByZXZpZXdpbmcgb3VyIDAwJ3MN Cg0KRm9sa3MsDQoNClRoZSBjb3JlIGRyYWZ0cyBoYXZlIGJlZW4gb3V0IGFuZCBwdWJsaXNoZWQg YXMgV0cgZG9jdW1lbnRzIGZvciBhIGNvdXBsZQ0Kb2Ygd2Vla3Mgbm93LiBQbGVhc2UgcmV2aWV3 IQ0KDQpDaGVlcnMgTGVpZg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXw0KVW5iZWFyYWJsZSBtYWlsaW5nIGxpc3QNClVuYmVhcmFibGVAaWV0Zi5vcmc8 bWFpbHRvOlVuYmVhcmFibGVAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL3VuYmVhcmFibGUNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NClVuYmVhcmFibGUgbWFpbGluZyBsaXN0DQpVbmJlYXJhYmxlQGlldGYu b3JnPG1haWx0bzpVbmJlYXJhYmxlQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby91bmJlYXJhYmxlDQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fIFVuYmVhcmFibGUgbWFpbGluZyBsaXN0IFVuYmVhcmFibGVAaWV0 Zi5vcmcgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby91bmJlYXJhYmxlDQpf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXyBVbmJlYXJhYmxl IG1haWxpbmcgbGlzdCBVbmJlYXJhYmxlQGlldGYub3JnPG1haWx0bzpVbmJlYXJhYmxlQGlldGYu b3JnPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGUNCg== --_000_BN3PR0301MB12500E593B96CFB9E709B6C48CEE0BN3PR0301MB1250_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OlZlcmRhbmE7DQoJ cGFub3NlLTE6MiAxMSA2IDQgMyA1IDQgNCAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJ e21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1 bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVy bGluZTt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxpLk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29M aXN0UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlvcml0eTozNDsNCgltc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ow0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJU aW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10 eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0K CWNvbG9yOiMxRjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0 LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4 LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3Jk U2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0K QGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6MzczMTIwMDgwOw0KCW1zby1saXN0LXR5cGU6aHlicmlk Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczoxOTgzNDI4MDA2IC0xNDgxNjA1NzI0IDY3Njk4Njkx IDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3 Njk4NjkzO30NCkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6NTsNCgltc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674OYOw0KCW1zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCW1zby1mYXJlYXN0 LWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBS b21hbiI7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1m YW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZl bDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30N CkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6 V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ Zm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0Kb2wNCgl7bWFy Z2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+PC9zdHlsZT48 IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNw aWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHht bD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBk YXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0K PGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFz cz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbjt0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEi Pg0KPCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6V2luZ2RpbmdzO2NvbG9yOiMxRjQ5N0QiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJ Z25vcmUiPsOYPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1 b3Q7Ij4mbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJp ZiI+V2hpY2ggbWVjaGFuaXNtIGFyZSB3ZSByZWx5aW5nIG9uIHRvIHByZXZlbnQgaHlqYWNraW5n IHRoZSByZXR1cm5lZCBjb29raWU/Jm5ic3A7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjoj MUY0OTdEIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+QXJlIHlvdSB0YWxraW5nIGFib3V0IGEgc2NlbmFy aW8gd2hlcmUgdGhlIGNsaWVudCBkZWxldGVzIGNvb2tpZXMgKGFuZCB0b2tlbiBiaW5kaW5ncyks IHJlLWF1dGhlbnRpY2F0ZXMgd2l0aCB0aGUgd2ViIHNpdGUsIGFuZCByZWNlaXZlcyBhIG5ldyBj b29raWU/IEluIHRoaXMNCiBjYXNlLCB0aGUgbmV3IGNvb2tpZSB3aWxsIGJlIGJvdW5kIHRvIHRo ZSBuZXcgVG9rZW4gQmluZGluZyBLZXkgKGFzc3VtaW5nIHRoZSBjbGllbnQgYW5kIHNlcnZlciBo YXZlIG5lZ290aWF0ZWQgdGhlIHVzZSBvZiBUb2tlbiBCaW5kaW5nKS48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW47dGV4dC1pbmRlbnQ6LS4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj4NCjwhW2lmICFz dXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5Oldp bmdkaW5ncztjb2xvcjojMUY0OTdEIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj7DmDxz cGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7 DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPkJ1dCBJIHdh cyBtb3JlIGNvbmNlcm5lZCB3aXRoIHRoZSZuYnNwO2tleS1tYW5hZ2VtZW50IGNsaWVudC1zaWRl IGlzc3VlLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluO3RleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+DQo8IVtp ZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWls eTpXaW5nZGluZ3M7Y29sb3I6IzFGNDk3RCI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+ w5g8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZu YnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5JIGFt IGp1c3QgdGhpbmtpbmcgdGhhdCBzY2FsZWFiaWxpdHkgc2hvdWxkIGJlIGJ1aWx0IGludG8gc29s dXRpb25zIGF0IGFuIGVhcmx5IHN0YWdlLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPklmIHRoZSBjbGllbnQgY2FuIG1hbmFnZSBjb29raWVz IGluIGEgc2NhbGFibGUgbWFubmVyLCB0aGlzIGNsaWVudCBjYW4gcHJvYmFibHkgYmUgZW5oYW5j ZWQgdG8gYWxzbyBtYW5hZ2UgVG9rZW4gQmluZGluZyBrZXlzIGluIGEgc2NhbGFibGUgbWFubmVy LiBDYW4geW91IGVsYWJvcmF0ZQ0KIG9uIHRoZSBzcGVjaWZpYyBjbGllbnQtc2lkZSBzY2FsYWJp bGl0eSBjb25jZXJucz88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJp JnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PkNoZWVycyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPkFuZHJl aTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0K PGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3Bh ZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90Oyxz YW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gRC5Sb2dlcnNAZ214 Lm5ldCBbbWFpbHRvOkQuUm9nZXJzQGdteC5uZXRdDQo8YnI+DQo8Yj5TZW50OjwvYj4gV2VkbmVz ZGF5LCBBcHJpbCAyMiwgMjAxNSA3OjE0IEFNPGJyPg0KPGI+VG86PC9iPiBBbmRyZWkgUG9wb3Y8 YnI+DQo8Yj5DYzo8L2I+IHVuYmVhcmFibGVAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4g QXc6IFJlOiBbVW5iZWFyYWJsZV0gcmV2aWV3aW5nIG91ciAwMCdzPG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNh bnMtc2VyaWYiPkhpIEFuZHJlYSw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMt c2VyaWYiPnllcywgcXVpdGUgcmlnaHQsIGFuZCBvZiBjb3Vyc2UgaWYgdGhleSBwZXJ2aW91c2x5 IGhhZCB0aGUgcmVsZXZhbnQgY29va2llLCByZXNldGFibGlzaGluZyBpdCBpcyB0cml2aWFsLiBB bmQgc29tZW9uZSBub3QgYWNjZXB0aW5nIGNvb2tpZXMgb24gcHJpbmNpcGxlIHdvdWxkIG5vdCBo YXZlIGJlZW4NCiBhdXRoZW50aWNhdGVkIGluIHRoZSBmaXJzdCBwbGFjZS4gQnUgdGhpcyBpcyBt b3JlIG9yIGxlc3Mgd2hhdCBJIHdyb3RlIHByZXZpb3VzbHkuIFdoaWNoIG1lY2hhbmlzbSBhcmUg d2UgcmVseWluZyBvbiB0byBwcmV2ZW50IGh5amFja2luZyB0aGUgcmV0dXJuZWQgY29va2llPyZu YnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVy ZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+QnV0IEkgd2Fz IG1vcmUgY29uY2VybmVkIHdpdGggdGhlJm5ic3A7a2V5LW1hbmFnZW1lbnQgY2xpZW50LXNpZGUg aXNzdWUuIEkgaGF2ZSBubyZuYnNwO3Byb3Bvc2VkIHNvbHV0aW9uIHVwIG15IHNsZWF2ZSwgYnV0 Jm5ic3A7aXQgY29uY2VybnMgbWUgdGhhdCBsaWtlIG1hbnkgb3RoZXJzIHZlcnkgb2Z0ZW4mbmJz cDtJIGFtIGluIGh1bmRyZWRzDQogb2Ygd2ViLXNpdGVzIHBlciBkYXkuPG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2Vy aWYiPkFkZGVkIHRvIHRoaXMgZHVyaW5nIGFueSBwYXJ0aWN1bGFyJm5ic3A7ZGF5IEkgYW0gdXNp bmcgYSBXaW4tOCBkZXNrdG9wLCBhIFdpbi03IGxhcHRvcCwgYW5kIGFuIEFuZHJvaWQgYmFzZWQg VGFibGV0LiBJIGFtIGp1c3QgdGhpbmtpbmcgdGhhdCBzY2FsZWFiaWxpdHkgc2hvdWxkIGJlIGJ1 aWx0IGludG8gc29sdXRpb25zDQogYXQgYW4gZWFybHkgc3RhZ2UuPG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYi PiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5iZXN0LDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5EZWFuJm5i c3A7Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOw0KPG86cD48L286cD48L3NwYW4+PC9w Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0MzRDlFNSAxLjVw dDtwYWRkaW5nOjBpbiAwaW4gMGluIDguMHB0O21hcmdpbi1sZWZ0OjcuNXB0O21hcmdpbi10b3A6 Ny41cHQ7bWFyZ2luLXJpZ2h0OjMuNzVwdDttYXJnaW4tYm90dG9tOjMuNzVwdDstbXMtd29yZC13 cmFwOiBicmVhay13b3JkOy13ZWJraXQtbmJzcC1tb2RlOiBzcGFjZTstd2Via2l0LWxpbmUtYnJl YWs6IGFmdGVyLXdoaXRlLXNwYWNlIiBuYW1lPSJxdW90ZSI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4t Ym90dG9tOjcuNXB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5H ZXNlbmRldDo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDtEaWVuc3RhZywgMjEuIEFw cmlsIDIwMTUgdW0gMDA6MDMgVWhyPGJyPg0KPGI+Vm9uOjwvYj4mbmJzcDsmcXVvdDtBbmRyZWkg UG9wb3YmcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzpBbmRyZWkuUG9wb3ZAbWljcm9zb2Z0LmNv bSI+QW5kcmVpLlBvcG92QG1pY3Jvc29mdC5jb208L2E+Jmd0Ozxicj4NCjxiPkFuOjwvYj4mbmJz cDsmcXVvdDs8YSBocmVmPSJtYWlsdG86RC5Sb2dlcnNAZ214Lm5ldCI+RC5Sb2dlcnNAZ214Lm5l dDwvYT4mcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzpELlJvZ2Vyc0BnbXgubmV0Ij5ELlJvZ2Vy c0BnbXgubmV0PC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+Jm5ic3A7JnF1b3Q7PGEgaHJlZj0ibWFp bHRvOnVuYmVhcmFibGVAaWV0Zi5vcmciPnVuYmVhcmFibGVAaWV0Zi5vcmc8L2E+JnF1b3Q7ICZs dDs8YSBocmVmPSJtYWlsdG86dW5iZWFyYWJsZUBpZXRmLm9yZyI+dW5iZWFyYWJsZUBpZXRmLm9y ZzwvYT4mZ3Q7PGJyPg0KPGI+QmV0cmVmZjo8L2I+Jm5ic3A7UmU6IFtVbmJlYXJhYmxlXSByZXZp ZXdpbmcgb3VyIDAwJ3M8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgbmFtZT0i cXVvdGVkLWNvbnRlbnQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5IaSBEZWFuLDwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0Qi PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPlRoYW5rcyBmb3IgdGhlIGVkaXRvcmlhbCBjb21t ZW50czsgd2lsbCByZXBocmFzZSBpbiB0aGUgbmV4dCByZXZpc2lvbi48L3NwYW4+PG86cD48L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0 OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFn cmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6V2luZ2RpbmdzO2NvbG9yOiMxRjQ5N0QiPsOYPC9zcGFuPjxzcGFu IHN0eWxlPSJmb250LXNpemU6Ny4wcHQ7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7DQo8L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7 LHNhbnMtc2VyaWYiPldoYXQgaGFwcGVucyBpZiBleGFjdGx5IGF0IHRoYXQgbW9tZW50IHRoZSB0 aGUgY2xpZW50IGNsZWFycyB0aGllciBjYWNoZSBhZnRlciB0aGUgdG9rZW4vY29va2llIGlzIHJl Y2VpdmVkPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBo IiBzdHlsZT0idGV4dC1pbmRlbnQ6LS4yNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtmb250LWZhbWlseTpXaW5nZGluZ3M7Y29sb3I6IzFGNDk3RCI+w5g8L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo3LjBwdDtjb2xvcjojMUY0OTdEIj4mbmJzcDsNCjwvc3Bhbj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fu cy1zZXJpZiI+SSBzdGlsbCBoYXZlIHRoZSBzYW1lIGNvbmNlcHR1YWwgcHJvYmxlbSB3aXRoIGNh Y2hlIGZsdXNoaW5nLCBpZiB0aGUgY29va2llIGlzIGdvbmUgdGhlIHdob2xlIHByb2Nlc3MgaGFz IHRvJm5ic3A7c3RhcnQgZnJvbSB0aGUgYmVnaW5uaW5nIGFuZCB0aGUgY2xpZW50IGhhcyB0byBw cm92ZSB0aGV5IGFyZSBzdGlsbCB0aGUgc2FtZSBjbGllbnQuDQogSW4gb3RoZXIgd29yZHMgcmUt ZXN0YWJsaXNoIHRoZSAzcmQgbGVnIG9mIGEgY2hhbGxlbmdlIHJlc3BvbnNlIHByb3RvY29sLjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPklmIHRoZSBjb29raWUgaXMgZ29uZSwgdGhlIHNlcnZlciB3aWxs IGhhdmUgdG8gYXV0aGVudGljYXRlIHRoaXMgY2xpZW50IGFnYWluLiBUaGlzIGlzIHRoZSBjYXNl IHRvZGF5Ow0KIEkgZG9u4oCZdCB0aGluayBUb2tlbiBCaW5kaW5nIGlzIGNoYW5naW5nIGFueXRo aW5nIFdSVCB0aGlzIGNhc2UuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+Q2hlZXJzLDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPkFuZHJlaTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkIHdp bmRvd3RleHQgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbjtib3JkZXItY29sb3I6Y3Vy cmVudENvbG9yIGN1cnJlbnRDb2xvcjtib3JkZXItaW1hZ2U6IG5vbmUiPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWYiPiBVbmJlYXJhYmxlIFs8YSBocmVmPSJtYWlsdG86dW5iZWFyYWJsZS1ib3VuY2VzQGll dGYub3JnIj5tYWlsdG86dW5iZWFyYWJsZS1ib3VuY2VzQGlldGYub3JnPC9hPl0NCjxiPk9uIEJl aGFsZiBPZiA8L2I+PGEgaHJlZj0ibWFpbHRvOkQuUm9nZXJzQGdteC5uZXQiPkQuUm9nZXJzQGdt eC5uZXQ8L2E+PGJyPg0KPGI+U2VudDo8L2I+IFNhdHVyZGF5LCBBcHJpbCAxOCwgMjAxNSAxOjEx IFBNPGJyPg0KPGI+Q2M6PC9iPiA8YSBocmVmPSJtYWlsdG86dW5iZWFyYWJsZUBpZXRmLm9yZyI+ dW5iZWFyYWJsZUBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtVbmJlYXJh YmxlXSByZXZpZXdpbmcgb3VyIDAwJ3M8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPkRl YXIgQWxsLDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPjxh IGhyZWY9Imh0dHA6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtdG9rYmluZC1odHRw cy0wMCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHA6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWll dGYtdG9rYmluZC1odHRwcy0wMDwvYT48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90 OyxzYW5zLXNlcmlmIj5wZXJoYXBzIGl0cyBhIGJpdCBsYXRlIHRvIGJlIHJhaXNpbmcgdGhpcyBw b2ludCBidXQ6PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+QWJzdHJhY3Q6PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJp ZiI+JnF1b3Q7YW4gSFRUUCBzZXJ2ZXIgaXNzdWVzIGEgc2VjdXJpdHkgdG9rZW4gKHN1Y2ggYXMg YSBjb29raWUpIHRvIGEgY2xpZW50LCBhbmQgZXhwZWN0cyB0aGUgY2xpZW50IHRvIHNlbmQgdGhl IHNlY3VyaXR5Jm5ic3A7dG9rZW4NCiBiYWNrIHRvIHRoZSBzZXJ2ZXIgYXQgYSBsYXRlciB0aW1l IGluIG9yZGVyIHRvIGF1dGhlbnRpY2F0ZS4mcXVvdDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJp ZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+V2hhdCBoYXBwZW5zIGlmIGV4YWN0bHkgYXQg dGhhdCBtb21lbnQgdGhlIHRoZSBjbGllbnQgY2xlYXJzIHRoaWVyIGNhY2hlIGFmdGVyIHRoZSB0 b2tlbi9jb29raWUgaXMgcmVjZWl2ZWQ/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRv O21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+U29tZXRoaW5nIGlu IHRoZSBjaGFsbGVuZ2UtcmVzcG9uc2UgbWVjaGFuaXNtJm5ic3A7aXMgbWlzc2luZyBoZXJlLiBX aHkgZG9lcyB0aGUgSFRUUCBTZXJ2ZXIgaXNzdWUgdGhlIHRva2VuLCBhdCB0aGlzIHBvaW50DQog dGhlcmUgaXMgbm8gbWVudGlvbiBvZiBhIGNoYWxsZW5nZSBwcm9tcHRpbmcgdGhpcyByZXNwb25z ZS4gV2hhdCBzaG91bGQgdGhlIGNoYWxsZW5nZSBsb29rIGxpa2U/IEJhc2ljYWxseSB0aGlzIGRv ZXMgbm90IGJlbG9uZyBpbiB0aGUgYWJzdHJhY3QuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRh bmEmcXVvdDssc2Fucy1zZXJpZiI+JnF1b3Q7QmluZGluZyB0aGUgdG9rZW4gdG8gdGhlIFRMUyBj b25uZWN0aW9uIGJldHdlZW4gY2xpZW50IGFuZCBzZXJ2ZXIgcHJvdGVjdHMgdGhlIHNlY3VyaXR5 IHRva2VuIGZyb20gdGhlZnQsIGFuZCBlbnN1cmVzDQogdGhhdCB0aGUgc2VjdXJpdHkmbmJzcDt0 b2tlbiBjYW4gb25seSBiZSB1c2VkIGJ5IHRoZSBjbGllbnQgdGhhdCBpdCB3YXMgaXNzdWVkIHRv LiZxdW90Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPlRoaXMgYmluZGluZyBpcyBub3QgeWV0IGVzdGFi bGlzaGVkLCBzbyAuLi4gJnF1b3Q7YW5kIHdvdWxkIGVuc3VyZSB0aGF0IHRoZSBzZWN1cml0eSZu YnNwO3Rva2VuLi4uJnF1b3Q7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1z by1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fu cy1zZXJpZiI+UGxlYXNlLCBJIG1heSBoYXZlIG1pc3VuZGVyc3Rvb2Qgc29tZXRoaW5nLCBidXQg YXJlIHdlIHNheWluZyB0aGF0IGEgdG9rZW4gaXNzdWVkIGJ5IHNlcnZlciBBIHRvIGNsaWVudCBY IG1heSBwb3NzaWJseQ0KIGJlIGFjY2VwdGVkIGJ5IHNlcnZlciBCLCBzdXJlbHkgdGhpcyBjYW4g b25seSBiZSB0aGUgY2FzZSBvbiBpbXBsaWNpdCB0cnVzdCBiZXR3ZWVuIHNlcnZlcnMgQSBhbmQg Qj88L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVy ZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5GdXJ0aGVyLCAmcXVvdDt0aGUgY2xpZW50IHByb3ZlcyBw b3NzZXNzaW9uIG9mIChwcml2YXRlIGtleSkmbmJzcDt0byB0aGUgc2VydmVyLCBhbmQgaXMgbG9u Zy1saXZlZCAoaS5lLiwmbmJzcDtzdWJzZXF1ZW50IFRMUyBjb25uZWN0aW9ucw0KIGJldHdlZW4g dGhlIHNhbWUgY2xpZW50IGFuZCBzZXJ2ZXIgaGF2ZSZuYnNwO3RoZSBzYW1lIFRva2VuIEJpbmRp bmcgSUQuJnF1b3Q7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+SSBzdGlsbCBoYXZlIHRoZSBzYW1lIGNv bmNlcHR1YWwgcHJvYmxlbSB3aXRoIGNhY2hlIGZsdXNoaW5nLCBpZiB0aGUgY29va2llIGlzIGdv bmUgdGhlIHdob2xlIHByb2Nlc3MgaGFzIHRvJm5ic3A7c3RhcnQNCiBmcm9tIHRoZSBiZWdpbm5p bmcgYW5kIHRoZSBjbGllbnQgaGFzIHRvIHByb3ZlIHRoZXkgYXJlIHN0aWxsIHRoZSBzYW1lIGNs aWVudC4gSW4gb3RoZXIgd29yZHMgcmUtZXN0YWJsaXNoIHRoZSAzcmQgbGVnIG9mIGEgY2hhbGxl bmdlIHJlc3BvbnNlIHByb3RvY29sLiBXaGVyZSB0aGlzIGlzIHN0aWxsIHRoZSBzYW1lIGNsaWVu dCBvbmx5IHRpbWUgaXMgbG9zdC4gYnV0IEkgYW0gYWZyYWlkIHRoYXQmbmJzcDtzaG91bGQgYW4g YXR0YWNrZXIgYmUgYWJsZQ0KIHRvIGdlbmVyYXRlIHN1Y2ggYSBmYWlsdXJlIHRoZXkgbWF5IGJl IGFibGUgdG8gaGlqYWNrIHRoZSBzZXNzaW9uLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5h JnF1b3Q7LHNhbnMtc2VyaWYiPlNlY3Rpb24gMy4xIHN1Z2dlc3RzIHRoYXQgZWFjaCBjbGllbnQg b3BlcmF0ZSBhIGxhcmdlIHNjYWxlIEtleS1tYW5hZ2VtZW50IHN5c3RlbSwgJnF1b3Q7Y2xpZW50 cyB1c2UgZGlmZmVyZW50IHByaXZhdGUNCiBrZXlzIHRvIGVzdGFibGlzaCBQcm92aWRlZCBUb2tl biBCaW5kaW5nIElEcyB3aXRoIGRpZmZlcmVudCBzZXJ2ZXJzJnF1b3Q7Ljwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMt c2VyaWYiPkNsaWVudHMgYXJlIGNsaWVudHMgYW5kIHRoaXMgc2hvdWxkIG5vdCBiZSB0aGllciBi dXNpbmVzcy48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5JdCB3YXMgd2l0aCB0aGlzLCB0byBteSBtaW5k LCBtYWpvciBhcmNoaXRlY3R1cmFsIGNvbmNlcHR1YWwgbWlzZGllY3Rpb24mbmJzcDt0aGF0IHN0 b3BlZCBteSZuYnNwO3JlYWRpbmcgZnVydGhlci48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFu YSZxdW90OyxzYW5zLXNlcmlmIj5TYWx1dGVtPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+RGVhbjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1 b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp diBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgd2luZG93dGV4dCAxLjVwdDtw YWRkaW5nOjBpbiAwaW4gMGluIDguMHB0O21hcmdpbi1sZWZ0OjcuNXB0O21hcmdpbi10b3A6Ny41 cHQ7bWFyZ2luLXJpZ2h0OjMuNzVwdDttYXJnaW4tYm90dG9tOjMuNzVwdDtib3JkZXItY29sb3I6 Y3VycmVudENvbG9yIGN1cnJlbnRDb2xvciBjdXJyZW50Q29sb3IgcmdiKDE5NSwgMjE3LCAyMjkp O2JvcmRlci1pbWFnZTogbm9uZSI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tYm90dG9tOjcuNXB0Ij4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPkdlc2VuZGV0Ojwvc3Bh bj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJk YW5hJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwO1NhbXN0YWcsIDE4LiBBcHJpbCAyMDE1IHVtDQog MTc6MjEgVWhyPGJyPg0KPGI+Vm9uOjwvYj4mbmJzcDsmcXVvdDtCcmlhbiBDYW1wYmVsbCZxdW90 OyAmbHQ7PGEgaHJlZj0iYmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb20iIHRhcmdldD0iX3BhcmVu dCI+YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb208L2E+Jmd0Ozxicj4NCjxiPkFuOjwvYj4mbmJz cDs8YSBocmVmPSJELlJvZ2Vyc0BnbXgubmV0IiB0YXJnZXQ9Il9wYXJlbnQiPkQuUm9nZXJzQGdt eC5uZXQ8L2E+PGJyPg0KPGI+Q2M6PC9iPiZuYnNwOyZxdW90OzxhIGhyZWY9InVuYmVhcmFibGVA aWV0Zi5vcmciIHRhcmdldD0iX3BhcmVudCI+dW5iZWFyYWJsZUBpZXRmLm9yZzwvYT4mcXVvdDsg Jmx0OzxhIGhyZWY9InVuYmVhcmFibGVAaWV0Zi5vcmciIHRhcmdldD0iX3BhcmVudCI+dW5iZWFy YWJsZUBpZXRmLm9yZzwvYT4mZ3Q7PGJyPg0KPGI+QmV0cmVmZjo8L2I+Jm5ic3A7UmU6IFtVbmJl YXJhYmxlXSByZXZpZXdpbmcgb3VyIDAwJ3M8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+U29t ZSBsaW5rczo8YnI+DQo8YnI+DQo8YSBocmVmPSJodHRwOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9k cmFmdC1pZXRmLXRva2JpbmQtcHJvdG9jb2wtMDAiIHRhcmdldD0iX2JsYW5rIj5odHRwOi8vdG9v bHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2JpbmQtcHJvdG9jb2wtMDA8L2E+PGJyPg0K PGEgaHJlZj0iaHR0cDovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi10b2tiaW5kLWh0 dHBzLTAwIiB0YXJnZXQ9Il9ibGFuayI+aHR0cDovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQt aWV0Zi10b2tiaW5kLWh0dHBzLTAwPC9hPjxicj4NCjxicj4NCjxhIGhyZWY9Imh0dHBzOi8vZ2l0 aHViLmNvbS9Ub2tlbkJpbmRpbmcvIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9naXRodWIuY29t L1Rva2VuQmluZGluZy88L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7DQo8L3NwYW4+PG86 cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJp ZiI+T24gU2F0LCBBcHIgMTgsIDIwMTUgYXQgOToxNiBBTSwgJmx0OzxhIGhyZWY9Im1haWx0bzpE LlJvZ2Vyc0BnbXgubmV0Ij5ELlJvZ2Vyc0BnbXgubmV0PC9hPiZndDsgd3JvdGU6DQo8L3NwYW4+ PG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxl ZnQ6c29saWQgd2luZG93dGV4dCAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdp bi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90 dG9tOjUuMHB0O2JvcmRlci1jb2xvcjpjdXJyZW50Q29sb3IgY3VycmVudENvbG9yIGN1cnJlbnRD b2xvciByZ2IoMjA0LCAyMDQsIDIwNCk7Ym9yZGVyLWltYWdlOiBub25lIj4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5T b3JyeSw8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5idXQg bGlrZSBhIGxvdCBvZiBwZW9wbGUgd2UgYXJlIGFsbCBidXN5LDwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYi PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPmNhbiB5b3UgcmVwZWF0IHRoZSBsaW5rcyw8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZx dW90OyxzYW5zLXNlcmlmIj53aXRob3V0IHdpc2hpbmcgdG8gc291bmQgbGlrZSZuYnNwO0RyIFdo bywgeW91IGNhdGNoIG1lIGF0IGEgdGltZSB3aGVuIEkgaGF2ZSB0aW1lLDwvc3Bhbj48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMt c2VyaWYiPnBvc3NpYmx5IGl0cyB0aGUgc2FtZSBmb3Igb3RoZXJzLCBxdWljayBsaW5rcyB3aXRo b3V0IGhhdmluZyB0byBtaW5lIHRoZW0gd291bGQgYmUgbW9zdCB1c2VmdWwgYnJpZ2FkaWVyIDot KTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5i ZXN0PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Zl cmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+RGVhbjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgd2luZG93dGV4dCAx LjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDguMHB0O21hcmdpbi1sZWZ0OjcuNXB0O21hcmdpbi10 b3A6Ny41cHQ7bWFyZ2luLXJpZ2h0OjMuNzVwdDttYXJnaW4tYm90dG9tOjMuNzVwdDtib3JkZXIt Y29sb3I6Y3VycmVudENvbG9yIGN1cnJlbnRDb2xvciBjdXJyZW50Q29sb3IgcmdiKDE5NSwgMjE3 LCAyMjkpO2JvcmRlci1pbWFnZTogbm9uZSI+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tYm90dG9tOjcu NXB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPkdlc2VuZGV0 Ojwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwO1NhbXN0YWcsIDE4LiBBcHJpbCAyMDE1 IHVtDQogMTU6MzMgVWhyPGJyPg0KPGI+Vm9uOjwvYj4mbmJzcDsmcXVvdDtMZWlmIEpvaGFuc3Nv biZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmxlaWZqQHN1bmV0LnNlIj5sZWlmakBzdW5ldC5z ZTwvYT4mZ3Q7PGJyPg0KPGI+QW46PC9iPiZuYnNwOyZxdW90OzxhIGhyZWY9Im1haWx0bzp1bmJl YXJhYmxlQGlldGYub3JnIj51bmJlYXJhYmxlQGlldGYub3JnPC9hPiZxdW90OyAmbHQ7PGEgaHJl Zj0ibWFpbHRvOnVuYmVhcmFibGVAaWV0Zi5vcmciPnVuYmVhcmFibGVAaWV0Zi5vcmc8L2E+Jmd0 Ozxicj4NCjxiPkJldHJlZmY6PC9iPiZuYnNwO1tVbmJlYXJhYmxlXSByZXZpZXdpbmcgb3VyIDAw J3M8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0byI+PGJyPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPkZvbGtzLDxicj4NCjxi cj4NClRoZSBjb3JlIGRyYWZ0cyBoYXZlIGJlZW4gb3V0IGFuZCBwdWJsaXNoZWQgYXMgV0cgZG9j dW1lbnRzIGZvciBhIGNvdXBsZTxicj4NCm9mIHdlZWtzIG5vdy4gUGxlYXNlIHJldmlldyE8YnI+ DQo8YnI+DQpDaGVlcnMgTGVpZjxicj4NCjxicj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fPGJyPg0KVW5iZWFyYWJsZSBtYWlsaW5nIGxpc3Q8YnI+DQo8 YSBocmVmPSJtYWlsdG86VW5iZWFyYWJsZUBpZXRmLm9yZyI+VW5iZWFyYWJsZUBpZXRmLm9yZzwv YT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3Vu YmVhcmFibGUiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL3VuYmVhcmFibGU8L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+PGJyPg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KVW5iZWFyYWJsZSBtYWlsaW5nIGxp c3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86VW5iZWFyYWJsZUBpZXRmLm9yZyI+VW5iZWFyYWJsZUBp ZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL3VuYmVhcmFibGUiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGU8L2E+PGJyPg0KJm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6 YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJk YW5hJnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fIFVuYmVhcmFibGUgbWFpbGluZyBsaXN0DQo8YSBocmVmPSJVbmJlYXJhYmxl QGlldGYub3JnIiB0YXJnZXQ9Il9wYXJlbnQiPlVuYmVhcmFibGVAaWV0Zi5vcmc8L2E+IDxhIGhy ZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZSIgdGFy Z2V0PSJfYmxhbmsiPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby91bmJl YXJhYmxlPC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNl cmlmIj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXyBVbmJl YXJhYmxlIG1haWxpbmcgbGlzdA0KPGEgaHJlZj0ibWFpbHRvOlVuYmVhcmFibGVAaWV0Zi5vcmci PlVuYmVhcmFibGVAaWV0Zi5vcmc8L2E+IDxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21h aWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZSIgdGFyZ2V0PSJfYmxhbmsiPg0KaHR0cHM6Ly93d3cu aWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby91bmJlYXJhYmxlPC9hPjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_BN3PR0301MB12500E593B96CFB9E709B6C48CEE0BN3PR0301MB1250_-- From nobody Thu Apr 23 14:13:23 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C149B1B3477 for ; Thu, 23 Apr 2015 14:13:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.713 X-Spam-Level: X-Spam-Status: No, score=0.713 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.723, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PMV8YztS9cPr for ; Thu, 23 Apr 2015 14:13:18 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.15.18]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8D5301B346B for ; Thu, 23 Apr 2015 14:13:06 -0700 (PDT) Received: from [93.214.245.238] by 3capp-gmx-bs34.server.lan (via HTTP); Thu, 23 Apr 2015 23:13:01 +0200 MIME-Version: 1.0 Message-ID: From: D.Rogers@gmx.net To: "Andrei Popov" Content-Type: text/html; charset=UTF-8 Date: Thu, 23 Apr 2015 23:13:01 +0200 Importance: normal Sensitivity: Normal In-Reply-To: References: <55325D1C.1080807@sunet.se> , , , X-UI-Message-Type: mail X-Priority: 3 X-Provags-ID: V03:K0:PdZLRh4uXQPsLTXDlj4NFIgKaxjaf/6p4ZeGnTpixBa RFCLGLQJjfxhgdoVKLO6SeyjIKwOwlUrxaCmj03TYNL/eGyJ+Y FvAjcKR4qRCUB7mxQ+g2j2vRVJT6d3raXJQCQ2aDSpk9jlpaeA 1zAnSiJjLKzIqqc8wzJ14QxQKOK60uaKlZUdtCdqu7WZsGRsWy yKSzA3MtrMu2H5MoXVKk3j1VAkbcaZPRoeXPgMXeDBsXomMfxK IQOxyH4ot482/kTSN4ZCRoR0oou09WcFF5uOAw3QSrOm4iysOJ D8VI8g= X-UI-Out-Filterresults: notjunk:1; Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Apr 2015 21:13:22 -0000
I just found a presentation of yours written together with Vinod "The Token Binding Protocol." This is most useful.
 
"In this case, the new cookie will be bound to the new Token Binding Key (assuming the client and server have negotiated the use of Token Binding)."
 
This is now diagressing too far, but what I meant was that TLS relying on certs in a controlled environment may be fine, but I am not so happy about it in the wilder Internet. But I think I have answered my own question, which was that combining this with say HIP would not get us any further.
 
"Can you elaborate on the specific client-side scalability concerns?"
 
Sorry, no, no experimental data to share, just general concern. By scalability I dont just mean the volume of cookies on any one client machine, but also from home I use three different machines. different OS's, different browsers or versions, and add to that at work and at clients. I would like the servers I visit all to securely recognise me as the same person. Perhaps this was already addressed and I missed it.
 
all the best
Dean
 
Gesendet: Mittwoch, 22. April 2015 um 19:29 Uhr
Von: "Andrei Popov" <Andrei.Popov@microsoft.com>
An: "D.Rogers@gmx.net" <D.Rogers@gmx.net>
Cc: "unbearable@ietf.org" <unbearable@ietf.org>
Betreff: Re: [Unbearable] reviewing our 00's

Ø  Which mechanism are we relying on to prevent hyjacking the returned cookie? 

Are you talking about a scenario where the client deletes cookies (and token bindings), re-authenticates with the web site, and receives a new cookie? In this case, the new cookie will be bound to the new Token Binding Key (assuming the client and server have negotiated the use of Token Binding).

Ø  But I was more concerned with the key-management client-side issue.

Ø  I am just thinking that scaleability should be built into solutions at an early stage.

If the client can manage cookies in a scalable manner, this client can probably be enhanced to also manage Token Binding keys in a scalable manner. Can you elaborate on the specific client-side scalability concerns?

 

Cheers,

 

Andrei

 

From: D.Rogers@gmx.net [mailto:D.Rogers@gmx.net]
Sent: Wednesday, April 22, 2015 7:14 AM
To: Andrei Popov
Cc: unbearable@ietf.org
Subject: Aw: Re: [Unbearable] reviewing our 00's

 

Hi Andrea,

 

yes, quite right, and of course if they perviously had the relevant cookie, resetablishing it is trivial. And someone not accepting cookies on principle would not have been authenticated in the first place. Bu this is more or less what I wrote previously. Which mechanism are we relying on to prevent hyjacking the returned cookie? 

 

But I was more concerned with the key-management client-side issue. I have no proposed solution up my sleave, but it concerns me that like many others very often I am in hundreds of web-sites per day.

Added to this during any particular day I am using a Win-8 desktop, a Win-7 laptop, and an Android based Tablet. I am just thinking that scaleability should be built into solutions at an early stage.

 

best,

Dean  

 

Gesendet: Dienstag, 21. April 2015 um 00:03 Uhr
Von: "Andrei Popov" <Andrei.Popov@microsoft.com>
An: "D.Rogers@gmx.net" <D.Rogers@gmx.net>
Cc: "unbearable@ietf.org" <unbearable@ietf.org>
Betreff: Re: [Unbearable] reviewing our 00's

Hi Dean,

 

Thanks for the editorial comments; will rephrase in the next revision.

 

Ø  What happens if exactly at that moment the the client clears thier cache after the token/cookie is received?

Ø  I still have the same conceptual problem with cache flushing, if the cookie is gone the whole process has to start from the beginning and the client has to prove they are still the same client. In other words re-establish the 3rd leg of a challenge response protocol.

If the cookie is gone, the server will have to authenticate this client again. This is the case today; I don’t think Token Binding is changing anything WRT this case.

 

Cheers,

 

Andrei

 

From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of D.Rogers@gmx.net
Sent: Saturday, April 18, 2015 1:11 PM
Cc: unbearable@ietf.org
Subject: Re: [Unbearable] reviewing our 00's

 

Dear All,

 

 

perhaps its a bit late to be raising this point but:

Abstract:

"an HTTP server issues a security token (such as a cookie) to a client, and expects the client to send the security token back to the server at a later time in order to authenticate."

 

What happens if exactly at that moment the the client clears thier cache after the token/cookie is received?

Something in the challenge-response mechanism is missing here. Why does the HTTP Server issue the token, at this point there is no mention of a challenge prompting this response. What should the challenge look like? Basically this does not belong in the abstract.

 

"Binding the token to the TLS connection between client and server protects the security token from theft, and ensures that the security token can only be used by the client that it was issued to."

This binding is not yet established, so ... "and would ensure that the security token..."

 

Please, I may have misunderstood something, but are we saying that a token issued by server A to client X may possibly be accepted by server B, surely this can only be the case on implicit trust between servers A and B?

Further, "the client proves possession of (private key) to the server, and is long-lived (i.e., subsequent TLS connections between the same client and server have the same Token Binding ID."

I still have the same conceptual problem with cache flushing, if the cookie is gone the whole process has to start from the beginning and the client has to prove they are still the same client. In other words re-establish the 3rd leg of a challenge response protocol. Where this is still the same client only time is lost. but I am afraid that should an attacker be able to generate such a failure they may be able to hijack the session.

 

Section 3.1 suggests that each client operate a large scale Key-management system, "clients use different private keys to establish Provided Token Binding IDs with different servers".

Clients are clients and this should not be thier business.

It was with this, to my mind, major architectural conceptual misdiection that stoped my reading further.

 

Salutem

Dean

 

Gesendet: Samstag, 18. April 2015 um 17:21 Uhr
Von: "Brian Campbell" <bcampbell@pingidentity.com>
An: D.Rogers@gmx.net
Cc: "unbearable@ietf.org" <unbearable@ietf.org>
Betreff: Re: [Unbearable] reviewing our 00's

 

On Sat, Apr 18, 2015 at 9:16 AM, <D.Rogers@gmx.net> wrote:

Sorry,

 

but like a lot of people we are all busy,

 

can you repeat the links,

without wishing to sound like Dr Who, you catch me at a time when I have time,

possibly its the same for others, quick links without having to mine them would be most useful brigadier :-)

 

best

Dean

Gesendet: Samstag, 18. April 2015 um 15:33 Uhr
Von: "Leif Johansson" <leifj@sunet.se>
An: "unbearable@ietf.org" <unbearable@ietf.org>
Betreff: [Unbearable] reviewing our 00's


Folks,

The core drafts have been out and published as WG documents for a couple
of weeks now. Please review!

Cheers Leif

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable


_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/unbearable
 

_______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable

_______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable

_______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable
From nobody Thu Apr 23 14:20:58 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 85CBE1B2AC2 for ; Thu, 23 Apr 2015 14:20:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.991 X-Spam-Level: *** X-Spam-Status: No, score=3.991 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, FREEMAIL_REPLYTO=1, FREEMAIL_REPLYTO_END_DIGIT=0.25, HTML_MESSAGE=0.001, J_CHICKENPOX_17=0.6, J_CHICKENPOX_48=0.6, J_CHICKENPOX_57=0.6, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id orX3SLixye-U for ; Thu, 23 Apr 2015 14:20:54 -0700 (PDT) Received: from nm11-vm1.bullet.mail.bf1.yahoo.com (nm11-vm1.bullet.mail.bf1.yahoo.com [98.139.213.152]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A4561A8928 for ; Thu, 23 Apr 2015 14:20:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1429824050; bh=jVy8sG70ZnOcUTcenk8JtR1LTXdxoUPUeTUgvp9hoQI=; h=Date:From:Reply-To:To:Cc:In-Reply-To:References:Subject:From:Subject; b=UCV1GNCidtUUX8ygRK4fd6AOGfNF8pza9dO4sSmM6wOE8j/MU7aupRIIhiQufUIv+ZZF4r1EU7no4Kjm4er07/n3Ao1h7uvg78faAuySKocpmh1kcYyLyCIUsWfNMmRhn3KvO4SzO6f5IH6OVaTU/h4Non3nEtqM4fDUQ4m5u//L0+UOYiAjHfD2zAQa6bey5D502aiJITZJ1/pydaHyVJlk8uC+q8JEUxASdfkzorpBPkQfk2IWJ9L24Y1M41lczefGFoS0uD/aM3fXRkluEx0EkUwZYo9U0AkBxYycR6HpMjMijhv5U7SYclWXEXyOE4cC+IE8JFWrLNt06nTByA== Received: from [66.196.81.171] by nm11.bullet.mail.bf1.yahoo.com with NNFMP; 23 Apr 2015 21:20:50 -0000 Received: from [98.139.212.250] by tm17.bullet.mail.bf1.yahoo.com with NNFMP; 23 Apr 2015 21:20:50 -0000 Received: from [127.0.0.1] by omp1059.mail.bf1.yahoo.com with NNFMP; 23 Apr 2015 21:20:50 -0000 X-Yahoo-Newman-Property: ymail-3 X-Yahoo-Newman-Id: 516614.75279.bm@omp1059.mail.bf1.yahoo.com X-YMail-OSG: FRaVq9gVM1nN7.JAretz2HskLSzc5bd4SSDijit66MFgL.T.c61v3SHHzVKXQB. qVX247TMTFQVudFL7yA4VHsQrR8rPkDKHyTsSZxZn9MXMz9AccCyafKt4TT2W_kHuSvJzElWa2x8 Dtb6XpM33EEHdgSLXc8Pc9zJyiP17QMfoJ4HNNalVNvkRNXsV4O8I1Y29XnVBjuCccaOHTuA2tRV RKcU_5Y6zYIDbDDBt1NZFcXNHW8RE84pnEnptpufGTvQ7IwiOQjUi2GL1hjWyKK.BRhaVoZGNnza 8G4MY7UHv3BIFAadetNtq8fi_o.YKn3Lac9QBdrXmSUfBoclbEJB48sWeQUvHRul2zVczM5z3rtC meki2Jyi_shqaUq7OhLb1CZnw5HNpsv3SXxDRJE3JViVxYUIYRFcfYd8plfYdrF7tRXALkegauiR HvuP3LS7Fwx2BYr6Yk4Br1.yFlVWl9JJzJmSPDwb6cYAMt6cdJNq9oDhBjCwt0nrZia6TonPqdy3 U426Y.QwV_w-- Received: by 66.196.81.116; Thu, 23 Apr 2015 21:20:50 +0000 Date: Thu, 23 Apr 2015 21:20:49 +0000 (UTC) From: Bill Mills To: "D.Rogers@gmx.net" , Andrei Popov Message-ID: <1640023560.3866316.1429824049634.JavaMail.yahoo@mail.yahoo.com> In-Reply-To: References: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_3866315_744411251.1429824049595" Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: Bill Mills List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Apr 2015 21:20:57 -0000 ------=_Part_3866315_744411251.1429824049595 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable "Sorry, no, no experimental data to share, just general concern. By scalabi= lity I dont just mean the volume of cookies on any one client machine, but = also from home I use three different machines. different OS's, different br= owsers or versions, and add to that at work and at clients. I would like th= e servers I visit all to securely recognise me as the same person. Perhaps = this was already addressed and I missed it."=C2=A0That's outside the scope,= this isn't shared state/authentication across N browsers/devices. =C2=A0Th= at is possible, but it would require an SSO solution on the device/box that= allows sharing of secrets and credentials across apps each of which could = then use a bound token per these specs.=20 On Thursday, April 23, 2015 2:13 PM, "D.Rogers@gmx.net" wrote: =20 I just found a presentation of yours written together with Vinod "The Toke= n Binding Protocol." This is most useful.=C2=A0"In this case, the new cooki= e will be bound to the new Token Binding Key (assuming the client and serve= r have negotiated the use of Token Binding)."=C2=A0This=C2=A0is now diagres= sing too far, but what I meant was that TLS relying on certs in a controlle= d environment may be fine, but I am not so happy about it in the wilder Int= ernet. But I think I have answered my own question, which was that combinin= g this with say=C2=A0HIP=C2=A0would not get us any further.=C2=A0"Can you e= laborate on the specific client-side scalability concerns?"=C2=A0Sorry, no,= no experimental data to share, just general concern. By scalability I dont= just mean the volume of cookies on any one client machine, but also from h= ome I use three different machines. different OS's, different browsers or v= ersions, and add to that at work and at clients. I would like the servers I= visit all to securely recognise me as the same person. Perhaps this was al= ready addressed and I missed it.=C2=A0all the bestDean=C2=A0Gesendet:=C2=A0= Mittwoch, 22. April 2015 um 19:29 Uhr Von:=C2=A0"Andrei Popov" An:=C2=A0"D.Rogers@gmx.net" Cc:=C2=A0"unbearable@ietf.org" Betreff:=C2=A0Re: [Unbearable] reviewing our 00's=C3=98=C2=A0 Which mechani= sm are we relying on to prevent hyjacking the returned cookie?=C2=A0Are you= talking about a scenario where the client deletes cookies (and token bindi= ngs), re-authenticates with the web site, and receives a new cookie? In thi= s case, the new cookie will be bound to the new Token Binding Key (assuming= the client and server have negotiated the use of Token Binding).=C3=98=C2= =A0 But I was more concerned with the=C2=A0key-management client-side issue= .=C3=98=C2=A0 I am just thinking that scaleability should be built into sol= utions at an early stage.If the client can manage cookies in a scalable man= ner, this client can probably be enhanced to also manage Token Binding keys= in a scalable manner. Can you elaborate on the specific client-side scalab= ility concerns?=C2=A0Cheers,=C2=A0Andrei=C2=A0From: D.Rogers@gmx.net [mailt= o:D.Rogers@gmx.net] Sent: Wednesday, April 22, 2015 7:14 AM To: Andrei Popov Cc: unbearable@ietf.org Subject: Aw: Re: [Unbearable] reviewing our 00's=C2=A0Hi Andrea,=C2=A0yes, = quite right, and of course if they perviously had the relevant cookie, rese= tablishing it is trivial. And someone not accepting cookies on principle wo= uld not have been authenticated in the first place. Bu this is more or less= what I wrote previously. Which mechanism are we relying on to prevent hyja= cking the returned cookie?=C2=A0=C2=A0But I was more concerned with the=C2= =A0key-management client-side issue. I have no=C2=A0proposed solution up my= sleave, but=C2=A0it concerns me that like many others very often=C2=A0I am= in hundreds of web-sites per day.Added to this during any particular=C2=A0= day I am using a Win-8 desktop, a Win-7 laptop, and an Android based Tablet= . I am just thinking that scaleability should be built into solutions at an= early stage.=C2=A0best,Dean=C2=A0=C2=A0=C2=A0 Gesendet:=C2=A0Dienstag, 21.= April 2015 um 00:03 Uhr Von:=C2=A0"Andrei Popov" An:=C2=A0"D.Rogers@gmx.net" Cc:=C2=A0"unbearable@ietf.org" Betreff:=C2=A0Re: [Unbearable] reviewing our 00'sHi Dean,=C2=A0Thanks for t= he editorial comments; will rephrase in the next revision.=C2=A0=C3=98=C2= =A0 What happens if exactly at that moment the the client clears thier cach= e after the token/cookie is received?=C3=98=C2=A0 I still have the same con= ceptual problem with cache flushing, if the cookie is gone the whole proces= s has to=C2=A0start from the beginning and the client has to prove they are= still the same client. In other words re-establish the 3rd leg of a challe= nge response protocol.If the cookie is gone, the server will have to authen= ticate this client again. This is the case today; I don=E2=80=99t think Tok= en Binding is changing anything WRT this case.=C2=A0Cheers,=C2=A0Andrei=C2= =A0From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of D.Rog= ers@gmx.net Sent: Saturday, April 18, 2015 1:11 PM Cc: unbearable@ietf.org Subject: Re: [Unbearable] reviewing our 00's=C2=A0Dear All,=C2=A0http://too= ls.ietf.org/html/draft-ietf-tokbind-https-00=C2=A0perhaps its a bit late to= be raising this point but:Abstract:"an HTTP server issues a security token= (such as a cookie) to a client, and expects the client to send the securit= y=C2=A0token back to the server at a later time in order to authenticate."= =C2=A0What happens if exactly at that moment the the client clears thier ca= che after the token/cookie is received?Something in the challenge-response = mechanism=C2=A0is missing here. Why does the HTTP Server issue the token, a= t this point there is no mention of a challenge prompting this response. Wh= at should the challenge look like? Basically this does not belong in the ab= stract.=C2=A0"Binding the token to the TLS connection between client and se= rver protects the security token from theft, and ensures that the security= =C2=A0token can only be used by the client that it was issued to."This bind= ing is not yet established, so ... "and would ensure that the security=C2= =A0token..."=C2=A0Please, I may have misunderstood something, but are we sa= ying that a token issued by server A to client X may possibly be accepted b= y server B, surely this can only be the case on implicit trust between serv= ers A and B?Further, "the client proves possession of (private key)=C2=A0to= the server, and is long-lived (i.e.,=C2=A0subsequent TLS connections betwe= en the same client and server have=C2=A0the same Token Binding ID."I still = have the same conceptual problem with cache flushing, if the cookie is gone= the whole process has to=C2=A0start from the beginning and the client has = to prove they are still the same client. In other words re-establish the 3r= d leg of a challenge response protocol. Where this is still the same client= only time is lost. but I am afraid that=C2=A0should an attacker be able to= generate such a failure they may be able to hijack the session.=C2=A0Secti= on 3.1 suggests that each client operate a large scale Key-management syste= m, "clients use different private keys to establish Provided Token Binding = IDs with different servers".Clients are clients and this should not be thie= r business.It was with this, to my mind, major architectural conceptual mis= diection=C2=A0that stoped my=C2=A0reading further.=C2=A0SalutemDean=C2=A0Ge= sendet:=C2=A0Samstag, 18. April 2015 um 17:21 Uhr Von:=C2=A0"Brian Campbell" An:=C2=A0D.Rogers@gmx.net Cc:=C2=A0"unbearable@ietf.org" Betreff:=C2=A0Re: [Unbearable] reviewing our 00'sSome links: http://tools.ietf.org/html/draft-ietf-tokbind-protocol-00 http://tools.ietf.org/html/draft-ietf-tokbind-https-00 https://github.com/TokenBinding/=C2=A0 On Sat, Apr 18, 2015 at 9:16 AM, wrote:=20 Sorry,=C2=A0but like a lot of people we are all busy,=C2=A0can you repeat t= he links,without wishing to sound like=C2=A0Dr Who, you catch me at a time = when I have time,possibly its the same for others, quick links without havi= ng to mine them would be most useful brigadier :-)=C2=A0bestDeanGesendet:= =C2=A0Samstag, 18. April 2015 um 15:33 Uhr Von:=C2=A0"Leif Johansson" An:=C2=A0"unbearable@ietf.org" Betreff:=C2=A0[Unbearable] reviewing our 00's Folks, The core drafts have been out and published as WG documents for a couple of weeks now. Please review! Cheers Leif _______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable _______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable =C2=A0 _______________________________________________ Unbearable mailing list Unb= earable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable_________= ______________________________________ Unbearable mailing list Unbearable@i= etf.org https://www.ietf.org/mailman/listinfo/unbearable__________________= _____________________________ Unbearable mailing list Unbearable@ietf.org h= ttps://www.ietf.org/mailman/listinfo/unbearable _______________________________________________ Unbearable mailing list Unbearable@ietf.org https://www.ietf.org/mailman/listinfo/unbearable ------=_Part_3866315_744411251.1429824049595 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
"Sorry, no, no experimental data to share, just = general concern. By scalability I dont just mean the volume of cookies on a= ny one client machine, but also from home I use three different machines. d= ifferent OS's, different browsers or versions, and add to that at work and = at clients. I would like the servers I visit all to securely recognise me a= s the same person. Perhaps this was already addressed and I missed it."
 
That's outside the scop= e, this isn't shared state/authentication across N browsers/devices.  = That is possible, but it would require an SSO solution on the device/box th= at allows sharing of secrets and credentials across apps each of which coul= d then use a bound token per these specs.




= On Thursday, April 23, 2015 2:13 PM, "D.R= ogers@gmx.net" <D.Rogers@gmx.net> wrote:


=
I just found a presentation of yours written together with Vinod "The = Token Binding Protocol." This is most useful.
 
"In this case, the= new cookie will be bound to the new Token Binding Key (assuming the client= and server have negotiated the use of Token Binding)."
 
This is now diagressing too far, but what I meant was that TLS re= lying on certs in a controlled environment may be fine, but I am not so hap= py about it in the wilder Internet. But I think I have answered my own ques= tion, which was that combining this with say HIP would not get us= any further.
 
"Can you elaborate= on the specific client-side scalability concerns?"
 
Sorry, no, no experimental data to share, just general concern. By sca= lability I dont just mean the volume of cookies on any one client machine, = but also from home I use three different machines. different OS's, differen= t browsers or versions, and add to that at work and at clients. I would lik= e the servers I visit all to securely recognise me as the same person. Perh= aps this was already addressed and I missed it.
 
all the best
Dean
 
Gesendet: Mittwoch, 22. Apr= il 2015 um 19:29 Uhr
Von: "Andrei Popov" <Andrei.Popov@microsoft.com>
An: "D.Rogers@gmx.net" <D.Rogers@gmx.net>
Cc: "unbearable@ietf.org" <unbearable@ietf.org>
Betreff: Re: [Unbearable] reviewing our 00's
<= span style=3D"color:rgb(31, 73, 125);font-family:Wingdings;font-size:11pt;"= >=C3=98  <= span style=3D"font-family:Verdana , sans-serif;font-size:9pt;">Which mechan= ism are we relying on to prevent hyjacking the returned cookie? 
Are you talking about a = scenario where the client deletes cookies (and token bindings), re-authenti= cates with the web site, and receives a new cookie? In this case, the new c= ookie will be bound to the new Token Binding Key (assuming the client and s= erver have negotiated the use of Token Binding).
<= span style=3D"color:rgb(31, 73, 125);font-family:Wingdings;font-size:11pt;"= >=C3=98  <= span style=3D"font-family:Verdana , sans-serif;font-size:9pt;">But I was mo= re concerned with the key-management client-side issue.
<= span style=3D"color:rgb(31, 73, 125);font-family:Wingdings;font-size:11pt;"= >=C3=98  <= span style=3D"font-family:Verdana , sans-serif;font-size:9pt;">I am just th= inking that scaleability should be built into solutions at an early stage.<= /span>
If the client can manage= cookies in a scalable manner, this client can probably be enhanced to also= manage Token Binding keys in a scalable manner. Can you elaborate on the s= pecific client-side scalability concerns?
 
Cheers,
 
Andrei
 
From: D.Rogers@gmx.net [mailto:D.Rogers@gmx= .net]
Sent: Wednesday, April 22, 2015 7:14 AM
To: Andrei Popov
Cc: unbearable@ietf.org
Subject: Aw: Re: [Unbearable] reviewing our 00's
 
Hi Andrea,
 
yes, quite right, and of course if they pervious= ly had the relevant cookie, resetablishing it is trivial. And someone not a= ccepting cookies on principle would not have been authenticated in the firs= t place. Bu this is more or less what I wrote previously. Which mechanism a= re we relying on to prevent hyjacking the returned cookie? 
 
But I was more concerned with the key-manag= ement client-side issue. I have no proposed solution up my sleave, but=  it concerns me that like many others very often I am in hundreds= of web-sites per day.
Added to this during any particular day I a= m using a Win-8 desktop, a Win-7 laptop, and an Android based Tablet. I am = just thinking that scaleability should be built into solutions at an early = stage.
 
best,
Dean  
 
Gesendet: Dienstag, 21. April 2015 um 00= :03 Uhr
Von: "Andrei Popov" <Andrei.Popov@microsoft.com>
An: "D.Rogers@gmx.= net" <D.Rogers@gmx.net<= /a>>
Cc: "unbearable@ie= tf.org" <unbearable@iet= f.org>
Betreff: Re: [Unbearable] reviewing our 00's
Hi Dean,
 
Thanks for the editorial= comments; will rephrase in the next revision.
 
=C3=98  What happens if exactl= y at that moment the the client clears thier cache after the token/cookie i= s received?
=C3=98  I still have the same = conceptual problem with cache flushing, if the cookie is gone the whole pro= cess has to start from the beginning and the client has to prove they = are still the same client. In other words re-establish the 3rd leg of a cha= llenge response protocol.
If the cookie is gone, t= he server will have to authenticate this client again. This is the case tod= ay; I don=E2=80=99t think Token Binding is changing anything WRT this case.=
 
Cheers,
 
Andrei
 
From: Unbearable [mailto:unbearable-bounces@ietf.org] On Behalf Of= D.Rogers@gmx.net
Sent: Saturday, April 18, 2015 1:11 PM
Cc: unbearable@ietf.org=
Subject: Re: [Unbearable] reviewing our 00's
 
Dear All,
 
 
perhaps its a bit late to be raising this point = but:
Abstract:
"an HTTP server issues a security token (such as= a cookie) to a client, and expects the client to send the security to= ken back to the server at a later time in order to authenticate."
 
What happens if exactly at that moment the the c= lient clears thier cache after the token/cookie is received?
Something in the challenge-response mechanism&nb= sp;is missing here. Why does the HTTP Server issue the token, at this point= there is no mention of a challenge prompting this response. What should th= e challenge look like? Basically this does not belong in the abstract.
 
"Binding the token to the TLS connection between= client and server protects the security token from theft, and ensures that= the security token can only be used by the client that it was issued = to."
This binding is not yet established, so ... "and= would ensure that the security token..."
 
Please, I may have misunderstood something, but = are we saying that a token issued by server A to client X may possibly be a= ccepted by server B, surely this can only be the case on implicit trust bet= ween servers A and B?
Further, "the client proves possession of (priva= te key) to the server, and is long-lived (i.e., subsequent TLS co= nnections between the same client and server have the same Token Bindi= ng ID."
I still have the same conceptual problem with ca= che flushing, if the cookie is gone the whole process has to start fro= m the beginning and the client has to prove they are still the same client.= In other words re-establish the 3rd leg of a challenge response protocol. = Where this is still the same client only time is lost. but I am afraid that=  should an attacker be able to generate such a failure they may be abl= e to hijack the session.
 
Section 3.1 suggests that each client operate a = large scale Key-management system, "clients use different private keys to e= stablish Provided Token Binding IDs with different servers".
Clients are clients and this should not be thier= business.
It was with this, to my mind, major architectura= l conceptual misdiection that stoped my reading further.
 
Salutem
Dean
 
Gesendet: Samstag, 18. April 2015 um 17:= 21 Uhr
Von: "Brian Campbell" <bcampbell@pingidentity.com>
An: D.Rogers@gmx.n= et
Cc: "unbearable@ie= tf.org" <unbearable@iet= f.org>
Betreff: Re: [Unbearable] reviewing our 00's
 
On Sat, Apr 18, 2015 at 9:16 AM, <D.Rogers@gmx.net> wrote:
Sorry,
 
but like a lot of people we are all busy,=
 
can you repeat the links,
without wishing to sound like Dr Who, you c= atch me at a time when I have time,
possibly its the same for others, quick links wi= thout having to mine them would be most useful brigadier :-)
 
best
Dean
Gesendet: Samstag, 18. April 2015 um 15:= 33 Uhr
Von: "Leif Johansson" <leifj@sunet.se>
An: "unbearable@ie= tf.org" <unbearable@iet= f.org>
Betreff: [Unbearable] reviewing our 00's

Folks,

The core drafts have been out and published as WG documents for a couple of weeks now. Please review!

Cheers Leif

_______________________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/u= nbearable

___________= ____________________________________
Unbearable mailing list
Unbearable@ietf.org
https://www.ietf.org/mailman/listinfo/u= nbearable
 
_______________________________________________ = Unbearable mailing list Unbear= able@ietf.org https://www.ietf.org= /mailman/listinfo/unbearable
_______________________________________________ = Unbearable mailing list Unbear= able@ietf.org https://www.ietf.org= /mailman/listinfo/unbearable
_______________________________________________ Unbearable mailing list Unb= earable@ietf.org https://www.ietf.org/= mailman/listinfo/unbearable

__= _____________________________________________
Unbearable = mailing list
Unbearable@ietf.orghttps://www.ietf.org/mailman/listinfo/un= bearable


<= /div> ------=_Part_3866315_744411251.1429824049595-- From nobody Thu Apr 23 15:55:21 2015 Return-Path: X-Original-To: unbearable@ietfa.amsl.com Delivered-To: unbearable@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A073B1A8AD1 for ; Thu, 23 Apr 2015 15:55:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y6Q5fNx07YlC for ; Thu, 23 Apr 2015 15:55:15 -0700 (PDT) Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2on0137.outbound.protection.outlook.com [207.46.100.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ED7551A8A62 for ; Thu, 23 Apr 2015 15:55:14 -0700 (PDT) Received: from BLUPR03MB1396.namprd03.prod.outlook.com (25.163.81.142) by BLUPR03MB1395.namprd03.prod.outlook.com (25.163.81.141) with Microsoft SMTP Server (TLS) id 15.1.148.15; Thu, 23 Apr 2015 22:55:13 +0000 Received: from BLUPR03MB1396.namprd03.prod.outlook.com ([25.163.81.142]) by BLUPR03MB1396.namprd03.prod.outlook.com ([25.163.81.142]) with mapi id 15.01.0136.026; Thu, 23 Apr 2015 22:55:13 +0000 From: Andrei Popov To: "D.Rogers@gmx.net" Thread-Topic: Re: [Unbearable] reviewing our 00's Thread-Index: AQHQedxCiQzINnKJcEexdzbRTl6pbZ1S4YCAgAABiACAAFDigIADQtKAgAKiwICAADKz8IAB1KeAgAAYxKA= Date: Thu, 23 Apr 2015 22:55:13 +0000 Message-ID: References: <55325D1C.1080807@sunet.se> , , , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmx.net; dkim=none (message not signed) header.d=none; x-originating-ip: [2001:4898:80e8:ed31::2] x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BLUPR03MB1395; x-microsoft-antispam-prvs: x-forefront-antispam-report: BMV:1; SFV:NSPM; SFS:(10019020)(51914003)(24454002)(377454003)(2501003)(2900100001)(87936001)(15975445007)(102836002)(74316001)(92566002)(2656002)(76576001)(33656002)(110136001)(16236675004)(86362001)(19617315012)(50986999)(2351001)(19625215002)(77156002)(62966003)(19300405004)(54356999)(19580395003)(99286002)(46102003)(2950100001)(76176999)(106116001)(40100003)(19580405001)(3826002)(579004); DIR:OUT; SFP:1102; SCL:1; SRVR:BLUPR03MB1395; H:BLUPR03MB1396.namprd03.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(5005006)(5002010); SRVR:BLUPR03MB1395; BCL:0; PCL:0; RULEID:; SRVR:BLUPR03MB1395; x-forefront-prvs: 0555EC8317 Content-Type: multipart/alternative; boundary="_000_BLUPR03MB1396C00F4F5E63512614F71E8CED0BLUPR03MB1396namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.onmicrosoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Apr 2015 22:55:13.0788 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLUPR03MB1395 Archived-At: Cc: "unbearable@ietf.org" Subject: Re: [Unbearable] reviewing our 00's X-BeenThere: unbearable@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "\"This list is for discussion of proposals for doing better than bearer tokens \(e.g. HTTP cookies, OAuth tokens etc.\) for web applications. The specific goal is chartering a WG focused on preventing security token export and replay attacks.\"" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Apr 2015 22:55:19 -0000 --_000_BLUPR03MB1396C00F4F5E63512614F71E8CED0BLUPR03MB1396namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 w5ggIEJ5IHNjYWxhYmlsaXR5IEkgZG9udCBqdXN0IG1lYW4gdGhlIHZvbHVtZSBvZiBjb29raWVz IG9uIGFueSBvbmUgY2xpZW50IG1hY2hpbmUsIGJ1dCBhbHNvIGZyb20gaG9tZSBJIHVzZSB0aHJl ZSBkaWZmZXJlbnQgbWFjaGluZXMuIGRpZmZlcmVudCBPUydzLCBkaWZmZXJlbnQgYnJvd3NlcnMg b3IgdmVyc2lvbnMsIGFuZCBhZGQgdG8gdGhhdCBhdCB3b3JrIGFuZCBhdCBjbGllbnRzLiBJIHdv dWxkIGxpa2UgdGhlIHNlcnZlcnMgSSB2aXNpdCBhbGwgdG8gc2VjdXJlbHkgcmVjb2duaXNlIG1l IGFzIHRoZSBzYW1lIHBlcnNvbi4gUGVyaGFwcyB0aGlzIHdhcyBhbHJlYWR5IGFkZHJlc3NlZCBh bmQgSSBtaXNzZWQgaXQuDQpZZXMsIGl0IGlzIHRydWUgdGhhdCBieSBkZXNpZ24gVG9rZW4gQmlu ZGluZyBwcmV2ZW50cyBhbnkgY29va2llIOKAnHJvYW1pbmfigJ0gb3IgY29va2llIGphciBzeW5j aHJvbml6YXRpb24gYmV0d2VlbiBtYWNoaW5lcy4NCg0KQ2hlZXJzLA0KDQpBbmRyZWkNCg0KRnJv bTogRC5Sb2dlcnNAZ214Lm5ldCBbbWFpbHRvOkQuUm9nZXJzQGdteC5uZXRdDQpTZW50OiBUaHVy c2RheSwgQXByaWwgMjMsIDIwMTUgMjoxMyBQTQ0KVG86IEFuZHJlaSBQb3Bvdg0KQ2M6IHVuYmVh cmFibGVAaWV0Zi5vcmcNClN1YmplY3Q6IEF3OiBSZTogW1VuYmVhcmFibGVdIHJldmlld2luZyBv dXIgMDAncw0KDQpJIGp1c3QgZm91bmQgYSBwcmVzZW50YXRpb24gb2YgeW91cnMgd3JpdHRlbiB0 b2dldGhlciB3aXRoIFZpbm9kICJUaGUgVG9rZW4gQmluZGluZyBQcm90b2NvbC4iIFRoaXMgaXMg bW9zdCB1c2VmdWwuDQoNCiJJbiB0aGlzIGNhc2UsIHRoZSBuZXcgY29va2llIHdpbGwgYmUgYm91 bmQgdG8gdGhlIG5ldyBUb2tlbiBCaW5kaW5nIEtleSAoYXNzdW1pbmcgdGhlIGNsaWVudCBhbmQg c2VydmVyIGhhdmUgbmVnb3RpYXRlZCB0aGUgdXNlIG9mIFRva2VuIEJpbmRpbmcpLiINCg0KVGhp cyBpcyBub3cgZGlhZ3Jlc3NpbmcgdG9vIGZhciwgYnV0IHdoYXQgSSBtZWFudCB3YXMgdGhhdCBU TFMgcmVseWluZyBvbiBjZXJ0cyBpbiBhIGNvbnRyb2xsZWQgZW52aXJvbm1lbnQgbWF5IGJlIGZp bmUsIGJ1dCBJIGFtIG5vdCBzbyBoYXBweSBhYm91dCBpdCBpbiB0aGUgd2lsZGVyIEludGVybmV0 LiBCdXQgSSB0aGluayBJIGhhdmUgYW5zd2VyZWQgbXkgb3duIHF1ZXN0aW9uLCB3aGljaCB3YXMg dGhhdCBjb21iaW5pbmcgdGhpcyB3aXRoIHNheSBISVAgd291bGQgbm90IGdldCB1cyBhbnkgZnVy dGhlci4NCg0KIkNhbiB5b3UgZWxhYm9yYXRlIG9uIHRoZSBzcGVjaWZpYyBjbGllbnQtc2lkZSBz Y2FsYWJpbGl0eSBjb25jZXJucz8iDQoNClNvcnJ5LCBubywgbm8gZXhwZXJpbWVudGFsIGRhdGEg dG8gc2hhcmUsIGp1c3QgZ2VuZXJhbCBjb25jZXJuLiBCeSBzY2FsYWJpbGl0eSBJIGRvbnQganVz dCBtZWFuIHRoZSB2b2x1bWUgb2YgY29va2llcyBvbiBhbnkgb25lIGNsaWVudCBtYWNoaW5lLCBi dXQgYWxzbyBmcm9tIGhvbWUgSSB1c2UgdGhyZWUgZGlmZmVyZW50IG1hY2hpbmVzLiBkaWZmZXJl bnQgT1MncywgZGlmZmVyZW50IGJyb3dzZXJzIG9yIHZlcnNpb25zLCBhbmQgYWRkIHRvIHRoYXQg YXQgd29yayBhbmQgYXQgY2xpZW50cy4gSSB3b3VsZCBsaWtlIHRoZSBzZXJ2ZXJzIEkgdmlzaXQg YWxsIHRvIHNlY3VyZWx5IHJlY29nbmlzZSBtZSBhcyB0aGUgc2FtZSBwZXJzb24uIFBlcmhhcHMg dGhpcyB3YXMgYWxyZWFkeSBhZGRyZXNzZWQgYW5kIEkgbWlzc2VkIGl0Lg0KDQphbGwgdGhlIGJl c3QNCkRlYW4NCg0KR2VzZW5kZXQ6IE1pdHR3b2NoLCAyMi4gQXByaWwgMjAxNSB1bSAxOToyOSBV aHINClZvbjogIkFuZHJlaSBQb3BvdiIgPEFuZHJlaS5Qb3BvdkBtaWNyb3NvZnQuY29tPG1haWx0 bzpBbmRyZWkuUG9wb3ZAbWljcm9zb2Z0LmNvbT4+DQpBbjogIkQuUm9nZXJzQGdteC5uZXQ8bWFp bHRvOkQuUm9nZXJzQGdteC5uZXQ+IiA8RC5Sb2dlcnNAZ214Lm5ldDxtYWlsdG86RC5Sb2dlcnNA Z214Lm5ldD4+DQpDYzogInVuYmVhcmFibGVAaWV0Zi5vcmc8bWFpbHRvOnVuYmVhcmFibGVAaWV0 Zi5vcmc+IiA8dW5iZWFyYWJsZUBpZXRmLm9yZzxtYWlsdG86dW5iZWFyYWJsZUBpZXRmLm9yZz4+ DQpCZXRyZWZmOiBSZTogW1VuYmVhcmFibGVdIHJldmlld2luZyBvdXIgMDAncw0KDQo+ICBXaGlj aCBtZWNoYW5pc20gYXJlIHdlIHJlbHlpbmcgb24gdG8gcHJldmVudCBoeWphY2tpbmcgdGhlIHJl dHVybmVkIGNvb2tpZT8NCkFyZSB5b3UgdGFsa2luZyBhYm91dCBhIHNjZW5hcmlvIHdoZXJlIHRo ZSBjbGllbnQgZGVsZXRlcyBjb29raWVzIChhbmQgdG9rZW4gYmluZGluZ3MpLCByZS1hdXRoZW50 aWNhdGVzIHdpdGggdGhlIHdlYiBzaXRlLCBhbmQgcmVjZWl2ZXMgYSBuZXcgY29va2llPyBJbiB0 aGlzIGNhc2UsIHRoZSBuZXcgY29va2llIHdpbGwgYmUgYm91bmQgdG8gdGhlIG5ldyBUb2tlbiBC aW5kaW5nIEtleSAoYXNzdW1pbmcgdGhlIGNsaWVudCBhbmQgc2VydmVyIGhhdmUgbmVnb3RpYXRl ZCB0aGUgdXNlIG9mIFRva2VuIEJpbmRpbmcpLg0KDQo+ICBCdXQgSSB3YXMgbW9yZSBjb25jZXJu ZWQgd2l0aCB0aGUga2V5LW1hbmFnZW1lbnQgY2xpZW50LXNpZGUgaXNzdWUuDQoNCj4gIEkgYW0g anVzdCB0aGlua2luZyB0aGF0IHNjYWxlYWJpbGl0eSBzaG91bGQgYmUgYnVpbHQgaW50byBzb2x1 dGlvbnMgYXQgYW4gZWFybHkgc3RhZ2UuDQpJZiB0aGUgY2xpZW50IGNhbiBtYW5hZ2UgY29va2ll cyBpbiBhIHNjYWxhYmxlIG1hbm5lciwgdGhpcyBjbGllbnQgY2FuIHByb2JhYmx5IGJlIGVuaGFu Y2VkIHRvIGFsc28gbWFuYWdlIFRva2VuIEJpbmRpbmcga2V5cyBpbiBhIHNjYWxhYmxlIG1hbm5l ci4gQ2FuIHlvdSBlbGFib3JhdGUgb24gdGhlIHNwZWNpZmljIGNsaWVudC1zaWRlIHNjYWxhYmls aXR5IGNvbmNlcm5zPw0KDQpDaGVlcnMsDQoNCkFuZHJlaQ0KDQpGcm9tOiBELlJvZ2Vyc0BnbXgu bmV0PG1haWx0bzpELlJvZ2Vyc0BnbXgubmV0PiBbbWFpbHRvOkQuUm9nZXJzQGdteC5uZXRdDQpT ZW50OiBXZWRuZXNkYXksIEFwcmlsIDIyLCAyMDE1IDc6MTQgQU0NClRvOiBBbmRyZWkgUG9wb3YN CkNjOiB1bmJlYXJhYmxlQGlldGYub3JnPG1haWx0bzp1bmJlYXJhYmxlQGlldGYub3JnPg0KU3Vi amVjdDogQXc6IFJlOiBbVW5iZWFyYWJsZV0gcmV2aWV3aW5nIG91ciAwMCdzDQoNCkhpIEFuZHJl YSwNCg0KeWVzLCBxdWl0ZSByaWdodCwgYW5kIG9mIGNvdXJzZSBpZiB0aGV5IHBlcnZpb3VzbHkg aGFkIHRoZSByZWxldmFudCBjb29raWUsIHJlc2V0YWJsaXNoaW5nIGl0IGlzIHRyaXZpYWwuIEFu ZCBzb21lb25lIG5vdCBhY2NlcHRpbmcgY29va2llcyBvbiBwcmluY2lwbGUgd291bGQgbm90IGhh dmUgYmVlbiBhdXRoZW50aWNhdGVkIGluIHRoZSBmaXJzdCBwbGFjZS4gQnUgdGhpcyBpcyBtb3Jl IG9yIGxlc3Mgd2hhdCBJIHdyb3RlIHByZXZpb3VzbHkuIFdoaWNoIG1lY2hhbmlzbSBhcmUgd2Ug cmVseWluZyBvbiB0byBwcmV2ZW50IGh5amFja2luZyB0aGUgcmV0dXJuZWQgY29va2llPw0KDQpC dXQgSSB3YXMgbW9yZSBjb25jZXJuZWQgd2l0aCB0aGUga2V5LW1hbmFnZW1lbnQgY2xpZW50LXNp ZGUgaXNzdWUuIEkgaGF2ZSBubyBwcm9wb3NlZCBzb2x1dGlvbiB1cCBteSBzbGVhdmUsIGJ1dCBp dCBjb25jZXJucyBtZSB0aGF0IGxpa2UgbWFueSBvdGhlcnMgdmVyeSBvZnRlbiBJIGFtIGluIGh1 bmRyZWRzIG9mIHdlYi1zaXRlcyBwZXIgZGF5Lg0KQWRkZWQgdG8gdGhpcyBkdXJpbmcgYW55IHBh cnRpY3VsYXIgZGF5IEkgYW0gdXNpbmcgYSBXaW4tOCBkZXNrdG9wLCBhIFdpbi03IGxhcHRvcCwg YW5kIGFuIEFuZHJvaWQgYmFzZWQgVGFibGV0LiBJIGFtIGp1c3QgdGhpbmtpbmcgdGhhdCBzY2Fs ZWFiaWxpdHkgc2hvdWxkIGJlIGJ1aWx0IGludG8gc29sdXRpb25zIGF0IGFuIGVhcmx5IHN0YWdl Lg0KDQpiZXN0LA0KRGVhbg0KDQpHZXNlbmRldDogRGllbnN0YWcsIDIxLiBBcHJpbCAyMDE1IHVt IDAwOjAzIFVocg0KVm9uOiAiQW5kcmVpIFBvcG92IiA8QW5kcmVpLlBvcG92QG1pY3Jvc29mdC5j b20+DQpBbjogIkQuUm9nZXJzQGdteC5uZXQiIDxELlJvZ2Vyc0BnbXgubmV0Pg0KQ2M6ICJ1bmJl YXJhYmxlQGlldGYub3JnIiA8dW5iZWFyYWJsZUBpZXRmLm9yZz4NCkJldHJlZmY6IFJlOiBbVW5i ZWFyYWJsZV0gcmV2aWV3aW5nIG91ciAwMCdzDQpIaSBEZWFuLA0KDQpUaGFua3MgZm9yIHRoZSBl ZGl0b3JpYWwgY29tbWVudHM7IHdpbGwgcmVwaHJhc2UgaW4gdGhlIG5leHQgcmV2aXNpb24uDQoN Cg0KPiAgV2hhdCBoYXBwZW5zIGlmIGV4YWN0bHkgYXQgdGhhdCBtb21lbnQgdGhlIHRoZSBjbGll bnQgY2xlYXJzIHRoaWVyIGNhY2hlIGFmdGVyIHRoZSB0b2tlbi9jb29raWUgaXMgcmVjZWl2ZWQ/ DQoNCj4gIEkgc3RpbGwgaGF2ZSB0aGUgc2FtZSBjb25jZXB0dWFsIHByb2JsZW0gd2l0aCBjYWNo ZSBmbHVzaGluZywgaWYgdGhlIGNvb2tpZSBpcyBnb25lIHRoZSB3aG9sZSBwcm9jZXNzIGhhcyB0 byBzdGFydCBmcm9tIHRoZSBiZWdpbm5pbmcgYW5kIHRoZSBjbGllbnQgaGFzIHRvIHByb3ZlIHRo ZXkgYXJlIHN0aWxsIHRoZSBzYW1lIGNsaWVudC4gSW4gb3RoZXIgd29yZHMgcmUtZXN0YWJsaXNo IHRoZSAzcmQgbGVnIG9mIGEgY2hhbGxlbmdlIHJlc3BvbnNlIHByb3RvY29sLg0KSWYgdGhlIGNv b2tpZSBpcyBnb25lLCB0aGUgc2VydmVyIHdpbGwgaGF2ZSB0byBhdXRoZW50aWNhdGUgdGhpcyBj bGllbnQgYWdhaW4uIFRoaXMgaXMgdGhlIGNhc2UgdG9kYXk7IEkgZG9u4oCZdCB0aGluayBUb2tl biBCaW5kaW5nIGlzIGNoYW5naW5nIGFueXRoaW5nIFdSVCB0aGlzIGNhc2UuDQoNCkNoZWVycywN Cg0KQW5kcmVpDQoNCkZyb206IFVuYmVhcmFibGUgW21haWx0bzp1bmJlYXJhYmxlLWJvdW5jZXNA aWV0Zi5vcmc8dW5iZWFyYWJsZS1ib3VuY2VzQGlldGYub3JnPl0gT24gQmVoYWxmIE9mIEQuUm9n ZXJzQGdteC5uZXQNClNlbnQ6IFNhdHVyZGF5LCBBcHJpbCAxOCwgMjAxNSAxOjExIFBNDQpDYzog dW5iZWFyYWJsZUBpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtVbmJlYXJhYmxlXSByZXZpZXdpbmcg b3VyIDAwJ3MNCg0KRGVhciBBbGwsDQoNCmh0dHA6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0 LWlldGYtdG9rYmluZC1odHRwcy0wMA0KDQpwZXJoYXBzIGl0cyBhIGJpdCBsYXRlIHRvIGJlIHJh aXNpbmcgdGhpcyBwb2ludCBidXQ6DQpBYnN0cmFjdDoNCiJhbiBIVFRQIHNlcnZlciBpc3N1ZXMg YSBzZWN1cml0eSB0b2tlbiAoc3VjaCBhcyBhIGNvb2tpZSkgdG8gYSBjbGllbnQsIGFuZCBleHBl Y3RzIHRoZSBjbGllbnQgdG8gc2VuZCB0aGUgc2VjdXJpdHkgdG9rZW4gYmFjayB0byB0aGUgc2Vy dmVyIGF0IGEgbGF0ZXIgdGltZSBpbiBvcmRlciB0byBhdXRoZW50aWNhdGUuIg0KDQpXaGF0IGhh cHBlbnMgaWYgZXhhY3RseSBhdCB0aGF0IG1vbWVudCB0aGUgdGhlIGNsaWVudCBjbGVhcnMgdGhp ZXIgY2FjaGUgYWZ0ZXIgdGhlIHRva2VuL2Nvb2tpZSBpcyByZWNlaXZlZD8NClNvbWV0aGluZyBp biB0aGUgY2hhbGxlbmdlLXJlc3BvbnNlIG1lY2hhbmlzbSBpcyBtaXNzaW5nIGhlcmUuIFdoeSBk b2VzIHRoZSBIVFRQIFNlcnZlciBpc3N1ZSB0aGUgdG9rZW4sIGF0IHRoaXMgcG9pbnQgdGhlcmUg aXMgbm8gbWVudGlvbiBvZiBhIGNoYWxsZW5nZSBwcm9tcHRpbmcgdGhpcyByZXNwb25zZS4gV2hh dCBzaG91bGQgdGhlIGNoYWxsZW5nZSBsb29rIGxpa2U/IEJhc2ljYWxseSB0aGlzIGRvZXMgbm90 IGJlbG9uZyBpbiB0aGUgYWJzdHJhY3QuDQoNCiJCaW5kaW5nIHRoZSB0b2tlbiB0byB0aGUgVExT IGNvbm5lY3Rpb24gYmV0d2VlbiBjbGllbnQgYW5kIHNlcnZlciBwcm90ZWN0cyB0aGUgc2VjdXJp dHkgdG9rZW4gZnJvbSB0aGVmdCwgYW5kIGVuc3VyZXMgdGhhdCB0aGUgc2VjdXJpdHkgdG9rZW4g Y2FuIG9ubHkgYmUgdXNlZCBieSB0aGUgY2xpZW50IHRoYXQgaXQgd2FzIGlzc3VlZCB0by4iDQpU aGlzIGJpbmRpbmcgaXMgbm90IHlldCBlc3RhYmxpc2hlZCwgc28gLi4uICJhbmQgd291bGQgZW5z dXJlIHRoYXQgdGhlIHNlY3VyaXR5IHRva2VuLi4uIg0KDQpQbGVhc2UsIEkgbWF5IGhhdmUgbWlz dW5kZXJzdG9vZCBzb21ldGhpbmcsIGJ1dCBhcmUgd2Ugc2F5aW5nIHRoYXQgYSB0b2tlbiBpc3N1 ZWQgYnkgc2VydmVyIEEgdG8gY2xpZW50IFggbWF5IHBvc3NpYmx5IGJlIGFjY2VwdGVkIGJ5IHNl cnZlciBCLCBzdXJlbHkgdGhpcyBjYW4gb25seSBiZSB0aGUgY2FzZSBvbiBpbXBsaWNpdCB0cnVz dCBiZXR3ZWVuIHNlcnZlcnMgQSBhbmQgQj8NCkZ1cnRoZXIsICJ0aGUgY2xpZW50IHByb3ZlcyBw b3NzZXNzaW9uIG9mIChwcml2YXRlIGtleSkgdG8gdGhlIHNlcnZlciwgYW5kIGlzIGxvbmctbGl2 ZWQgKGkuZS4sIHN1YnNlcXVlbnQgVExTIGNvbm5lY3Rpb25zIGJldHdlZW4gdGhlIHNhbWUgY2xp ZW50IGFuZCBzZXJ2ZXIgaGF2ZSB0aGUgc2FtZSBUb2tlbiBCaW5kaW5nIElELiINCkkgc3RpbGwg aGF2ZSB0aGUgc2FtZSBjb25jZXB0dWFsIHByb2JsZW0gd2l0aCBjYWNoZSBmbHVzaGluZywgaWYg dGhlIGNvb2tpZSBpcyBnb25lIHRoZSB3aG9sZSBwcm9jZXNzIGhhcyB0byBzdGFydCBmcm9tIHRo ZSBiZWdpbm5pbmcgYW5kIHRoZSBjbGllbnQgaGFzIHRvIHByb3ZlIHRoZXkgYXJlIHN0aWxsIHRo ZSBzYW1lIGNsaWVudC4gSW4gb3RoZXIgd29yZHMgcmUtZXN0YWJsaXNoIHRoZSAzcmQgbGVnIG9m IGEgY2hhbGxlbmdlIHJlc3BvbnNlIHByb3RvY29sLiBXaGVyZSB0aGlzIGlzIHN0aWxsIHRoZSBz YW1lIGNsaWVudCBvbmx5IHRpbWUgaXMgbG9zdC4gYnV0IEkgYW0gYWZyYWlkIHRoYXQgc2hvdWxk IGFuIGF0dGFja2VyIGJlIGFibGUgdG8gZ2VuZXJhdGUgc3VjaCBhIGZhaWx1cmUgdGhleSBtYXkg YmUgYWJsZSB0byBoaWphY2sgdGhlIHNlc3Npb24uDQoNClNlY3Rpb24gMy4xIHN1Z2dlc3RzIHRo YXQgZWFjaCBjbGllbnQgb3BlcmF0ZSBhIGxhcmdlIHNjYWxlIEtleS1tYW5hZ2VtZW50IHN5c3Rl bSwgImNsaWVudHMgdXNlIGRpZmZlcmVudCBwcml2YXRlIGtleXMgdG8gZXN0YWJsaXNoIFByb3Zp ZGVkIFRva2VuIEJpbmRpbmcgSURzIHdpdGggZGlmZmVyZW50IHNlcnZlcnMiLg0KQ2xpZW50cyBh cmUgY2xpZW50cyBhbmQgdGhpcyBzaG91bGQgbm90IGJlIHRoaWVyIGJ1c2luZXNzLg0KSXQgd2Fz IHdpdGggdGhpcywgdG8gbXkgbWluZCwgbWFqb3IgYXJjaGl0ZWN0dXJhbCBjb25jZXB0dWFsIG1p c2RpZWN0aW9uIHRoYXQgc3RvcGVkIG15IHJlYWRpbmcgZnVydGhlci4NCg0KU2FsdXRlbQ0KRGVh bg0KDQpHZXNlbmRldDogU2Ftc3RhZywgMTguIEFwcmlsIDIwMTUgdW0gMTc6MjEgVWhyDQpWb246 ICJCcmlhbiBDYW1wYmVsbCIgPGJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29tPG1haWx0bzpiY2Ft cGJlbGxAcGluZ2lkZW50aXR5LmNvbT4+DQpBbjogRC5Sb2dlcnNAZ214Lm5ldDxtYWlsdG86RC5S b2dlcnNAZ214Lm5ldD4NCkNjOiAidW5iZWFyYWJsZUBpZXRmLm9yZzxtYWlsdG86dW5iZWFyYWJs ZUBpZXRmLm9yZz4iIDx1bmJlYXJhYmxlQGlldGYub3JnPG1haWx0bzp1bmJlYXJhYmxlQGlldGYu b3JnPj4NCkJldHJlZmY6IFJlOiBbVW5iZWFyYWJsZV0gcmV2aWV3aW5nIG91ciAwMCdzDQpTb21l IGxpbmtzOg0KDQpodHRwOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2JpbmQt cHJvdG9jb2wtMDANCmh0dHA6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtdG9rYmlu ZC1odHRwcy0wMA0KDQpodHRwczovL2dpdGh1Yi5jb20vVG9rZW5CaW5kaW5nLw0KDQpPbiBTYXQs IEFwciAxOCwgMjAxNSBhdCA5OjE2IEFNLCA8RC5Sb2dlcnNAZ214Lm5ldD4gd3JvdGU6DQpTb3Jy eSwNCg0KYnV0IGxpa2UgYSBsb3Qgb2YgcGVvcGxlIHdlIGFyZSBhbGwgYnVzeSwNCg0KY2FuIHlv dSByZXBlYXQgdGhlIGxpbmtzLA0Kd2l0aG91dCB3aXNoaW5nIHRvIHNvdW5kIGxpa2UgRHIgV2hv LCB5b3UgY2F0Y2ggbWUgYXQgYSB0aW1lIHdoZW4gSSBoYXZlIHRpbWUsDQpwb3NzaWJseSBpdHMg dGhlIHNhbWUgZm9yIG90aGVycywgcXVpY2sgbGlua3Mgd2l0aG91dCBoYXZpbmcgdG8gbWluZSB0 aGVtIHdvdWxkIGJlIG1vc3QgdXNlZnVsIGJyaWdhZGllciA6LSkNCg0KYmVzdA0KRGVhbg0KR2Vz ZW5kZXQ6IFNhbXN0YWcsIDE4LiBBcHJpbCAyMDE1IHVtIDE1OjMzIFVocg0KVm9uOiAiTGVpZiBK b2hhbnNzb24iIDxsZWlmakBzdW5ldC5zZT4NCkFuOiAidW5iZWFyYWJsZUBpZXRmLm9yZyIgPHVu YmVhcmFibGVAaWV0Zi5vcmc+DQpCZXRyZWZmOiBbVW5iZWFyYWJsZV0gcmV2aWV3aW5nIG91ciAw MCdzDQoNCkZvbGtzLA0KDQpUaGUgY29yZSBkcmFmdHMgaGF2ZSBiZWVuIG91dCBhbmQgcHVibGlz aGVkIGFzIFdHIGRvY3VtZW50cyBmb3IgYSBjb3VwbGUNCm9mIHdlZWtzIG5vdy4gUGxlYXNlIHJl dmlldyENCg0KQ2hlZXJzIExlaWYNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NClVuYmVhcmFibGUgbWFpbGluZyBsaXN0DQpVbmJlYXJhYmxlQGlldGYu b3JnDQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGUNCg0K X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClVuYmVhcmFi bGUgbWFpbGluZyBsaXN0DQpVbmJlYXJhYmxlQGlldGYub3JnDQpodHRwczovL3d3dy5pZXRmLm9y Zy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGUNCg0KX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX18gVW5iZWFyYWJsZSBtYWlsaW5nIGxpc3QgVW5iZWFyYWJs ZUBpZXRmLm9yZzxtYWlsdG86VW5iZWFyYWJsZUBpZXRmLm9yZz4gaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby91bmJlYXJhYmxlDQpfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXyBVbmJlYXJhYmxlIG1haWxpbmcgbGlzdCBVbmJlYXJhYmxl QGlldGYub3JnIGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJs ZQ0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18gVW5iZWFy YWJsZSBtYWlsaW5nIGxpc3QgVW5iZWFyYWJsZUBpZXRmLm9yZzxtYWlsdG86VW5iZWFyYWJsZUBp ZXRmLm9yZz4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby91bmJlYXJhYmxl DQo= --_000_BLUPR03MB1396C00F4F5E63512614F71E8CED0BLUPR03MB1396namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OlZlcmRhbmE7DQoJ cGFub3NlLTE6MiAxMSA2IDQgMyA1IDQgNCAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8N CnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsN CgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWls eToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJ e21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1 bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVy bGluZTt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxpLk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29M aXN0UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlvcml0eTozNDsNCgltc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ow0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJU aW1lcyBOZXcgUm9tYW4iLHNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10 eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0K CWNvbG9yOiMxRjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0 LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4 LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3Jk U2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0K QGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6NjkzMTEyOTY4Ow0KCW1zby1saXN0LXR5cGU6aHlicmlk Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotNTQyNTkxNDc4IC0xNjM4MjQ3NDE4IDY3Njk4Njkx IDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3 Njk4NjkzO30NCkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6NTsNCgltc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674OYOw0KCW1zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCW1zby1mYXJlYXN0 LWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBS b21hbiI7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1m YW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJ dGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZl bDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30N CkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNv LWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6 V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ Zm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4y NWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0Kb2wNCgl7bWFy Z2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+PC9zdHlsZT48 IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNw aWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHht bD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBk YXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0K PGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFz cz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbjt0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzIi Pg0KPCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6V2luZ2RpbmdzO2NvbG9yOiMxRjQ5N0QiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJ Z25vcmUiPsOYPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1 b3Q7Ij4mbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJp ZiI+Qnkgc2NhbGFiaWxpdHkgSSBkb250IGp1c3QgbWVhbiB0aGUgdm9sdW1lIG9mIGNvb2tpZXMg b24gYW55IG9uZSBjbGllbnQgbWFjaGluZSwgYnV0IGFsc28gZnJvbSBob21lIEkgdXNlIHRocmVl IGRpZmZlcmVudCBtYWNoaW5lcy4gZGlmZmVyZW50IE9TJ3MsIGRpZmZlcmVudCBicm93c2Vycw0K IG9yIHZlcnNpb25zLCBhbmQgYWRkIHRvIHRoYXQgYXQgd29yayBhbmQgYXQgY2xpZW50cy4gSSB3 b3VsZCBsaWtlIHRoZSBzZXJ2ZXJzIEkgdmlzaXQgYWxsIHRvIHNlY3VyZWx5IHJlY29nbmlzZSBt ZSBhcyB0aGUgc2FtZSBwZXJzb24uIFBlcmhhcHMgdGhpcyB3YXMgYWxyZWFkeSBhZGRyZXNzZWQg YW5kIEkgbWlzc2VkIGl0Ljwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPlllcywgaXQgaXMgdHJ1ZSB0aGF0IGJ5IGRlc2lnbiBUb2tlbiBCaW5k aW5nIHByZXZlbnRzIGFueSBjb29raWUg4oCccm9hbWluZ+KAnSBvciBjb29raWUgamFyIHN5bmNo cm9uaXphdGlvbiBiZXR3ZWVuIG1hY2hpbmVzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7 Y29sb3I6IzFGNDk3RCI+Q2hlZXJzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzFGNDk3RCI+QW5kcmVpPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJy aSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNF MUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkZyb206PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYi PiBELlJvZ2Vyc0BnbXgubmV0IFttYWlsdG86RC5Sb2dlcnNAZ214Lm5ldF0NCjxicj4NCjxiPlNl bnQ6PC9iPiBUaHVyc2RheSwgQXByaWwgMjMsIDIwMTUgMjoxMyBQTTxicj4NCjxiPlRvOjwvYj4g QW5kcmVpIFBvcG92PGJyPg0KPGI+Q2M6PC9iPiB1bmJlYXJhYmxlQGlldGYub3JnPGJyPg0KPGI+ U3ViamVjdDo8L2I+IEF3OiBSZTogW1VuYmVhcmFibGVdIHJldmlld2luZyBvdXIgMDAnczxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVy ZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5JIGp1c3QgZm91bmQgYSBwcmVzZW50YXRpb24gb2YgeW91 cnMgd3JpdHRlbiB0b2dldGhlciB3aXRoIFZpbm9kICZxdW90O1RoZSBUb2tlbiBCaW5kaW5nIFBy b3RvY29sLiZxdW90OyBUaGlzIGlzIG1vc3QgdXNlZnVsLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJz cDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRh bmEmcXVvdDssc2Fucy1zZXJpZiI+JnF1b3Q7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+SW4gdGhpcyBj YXNlLCB0aGUgbmV3IGNvb2tpZSB3aWxsIGJlIGJvdW5kIHRvIHRoZSBuZXcgVG9rZW4gQmluZGlu ZyBLZXkgKGFzc3VtaW5nIHRoZSBjbGllbnQgYW5kIHNlcnZlcg0KIGhhdmUgbmVnb3RpYXRlZCB0 aGUgdXNlIG9mIFRva2VuIEJpbmRpbmcpLiZxdW90Ozwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVy ZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+VGhpcyZuYnNw O2lzIG5vdyBkaWFncmVzc2luZyB0b28gZmFyLCBidXQgd2hhdCBJIG1lYW50IHdhcyB0aGF0IFRM UyByZWx5aW5nIG9uIGNlcnRzIGluIGEgY29udHJvbGxlZCBlbnZpcm9ubWVudCBtYXkgYmUgZmlu ZSwgYnV0IEkgYW0gbm90IHNvIGhhcHB5IGFib3V0IGl0IGluIHRoZSB3aWxkZXIgSW50ZXJuZXQu DQogQnV0IEkgdGhpbmsgSSBoYXZlIGFuc3dlcmVkIG15IG93biBxdWVzdGlvbiwgd2hpY2ggd2Fz IHRoYXQgY29tYmluaW5nIHRoaXMgd2l0aCBzYXkmbmJzcDtISVAmbmJzcDt3b3VsZCBub3QgZ2V0 IHVzIGFueSBmdXJ0aGVyLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJp ZiI+JnF1b3Q7PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Q2FuIHlvdSBlbGFib3JhdGUgb24gdGhlIHNw ZWNpZmljIGNsaWVudC1zaWRlIHNjYWxhYmlsaXR5IGNvbmNlcm5zPyZxdW90Ozwvc3Bhbj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDss c2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYi PjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFu YSZxdW90OyxzYW5zLXNlcmlmIj5Tb3JyeSwgbm8sIG5vIGV4cGVyaW1lbnRhbCBkYXRhIHRvIHNo YXJlLCBqdXN0IGdlbmVyYWwgY29uY2Vybi4gQnkgc2NhbGFiaWxpdHkgSSBkb250IGp1c3QgbWVh biB0aGUgdm9sdW1lIG9mIGNvb2tpZXMgb24gYW55IG9uZSBjbGllbnQgbWFjaGluZSwgYnV0IGFs c28gZnJvbSBob21lIEkgdXNlIHRocmVlDQogZGlmZmVyZW50IG1hY2hpbmVzLiBkaWZmZXJlbnQg T1MncywgZGlmZmVyZW50IGJyb3dzZXJzIG9yIHZlcnNpb25zLCBhbmQgYWRkIHRvIHRoYXQgYXQg d29yayBhbmQgYXQgY2xpZW50cy4gSSB3b3VsZCBsaWtlIHRoZSBzZXJ2ZXJzIEkgdmlzaXQgYWxs IHRvIHNlY3VyZWx5IHJlY29nbmlzZSBtZSBhcyB0aGUgc2FtZSBwZXJzb24uIFBlcmhhcHMgdGhp cyB3YXMgYWxyZWFkeSBhZGRyZXNzZWQgYW5kIEkgbWlzc2VkIGl0LjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlm Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+YWxsIHRoZSBiZXN0PG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYi PkRlYW48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Zl cmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQzNEOUU1IDEu NXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gOC4wcHQ7bWFyZ2luLWxlZnQ6Ny41cHQ7bWFyZ2luLXRv cDo3LjVwdDttYXJnaW4tcmlnaHQ6My43NXB0O21hcmdpbi1ib3R0b206My43NXB0Oy1tcy13b3Jk LXdyYXA6IGJyZWFrLXdvcmQ7LXdlYmtpdC1uYnNwLW1vZGU6IHNwYWNlOy13ZWJraXQtbGluZS1i cmVhazogYWZ0ZXItd2hpdGUtc3BhY2UiIG5hbWU9InF1b3RlIj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1ib3R0b206Ny41cHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYi Pkdlc2VuZGV0Ojwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwO01pdHR3b2NoLCAyMi4g QXByaWwgMjAxNSB1bSAxOToyOSBVaHI8YnI+DQo8Yj5Wb246PC9iPiZuYnNwOyZxdW90O0FuZHJl aSBQb3BvdiZxdW90OyAmbHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpBbmRyZWkuUG9wb3ZAbWlj cm9zb2Z0LmNvbSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPkFuZHJlaS5Qb3BvdkBtaWNyb3NvZnQuY29tPC9z cGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Zl cmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+Jmd0Ozxicj4NCjxiPkFuOjwvYj4mbmJzcDsmcXVvdDs8 L3NwYW4+PGEgaHJlZj0ibWFpbHRvOkQuUm9nZXJzQGdteC5uZXQiPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5E LlJvZ2Vyc0BnbXgubmV0PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+JnF1b3Q7ICZsdDs8L3Nw YW4+PGEgaHJlZj0ibWFpbHRvOkQuUm9nZXJzQGdteC5uZXQiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5ELlJv Z2Vyc0BnbXgubmV0PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+Jmd0Ozxicj4NCjxiPkNjOjwv Yj4mbmJzcDsmcXVvdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnVuYmVhcmFibGVAaWV0Zi5vcmci PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZx dW90OyxzYW5zLXNlcmlmIj51bmJlYXJhYmxlQGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1z ZXJpZiI+JnF1b3Q7ICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnVuYmVhcmFibGVAaWV0Zi5v cmciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFu YSZxdW90OyxzYW5zLXNlcmlmIj51bmJlYXJhYmxlQGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fu cy1zZXJpZiI+Jmd0Ozxicj4NCjxiPkJldHJlZmY6PC9iPiZuYnNwO1JlOiBbVW5iZWFyYWJsZV0g cmV2aWV3aW5nIG91ciAwMCdzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2IG5h bWU9InF1b3RlZC1jb250ZW50Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJh Z3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO3RleHQtaW5kZW50Oi0uMjVpbiI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6V2luZ2RpbmdzO2NvbG9yOiMxRjQ5 N0QiPsOYPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6Ny4wcHQ7Y29sb3I6IzFGNDk3RCI+ Jm5ic3A7DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPldoaWNoIG1lY2hhbmlzbSBhcmUgd2UgcmVs eWluZyBvbiB0byBwcmV2ZW50IGh5amFja2luZyB0aGUgcmV0dXJuZWQgY29va2llPyZuYnNwOzxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNl cmlmO2NvbG9yOiMxRjQ5N0QiPkFyZSB5b3UgdGFsa2luZyBhYm91dCBhIHNjZW5hcmlvIHdoZXJl IHRoZSBjbGllbnQgZGVsZXRlcyBjb29raWVzIChhbmQgdG9rZW4gYmluZGluZ3MpLCByZS1hdXRo ZW50aWNhdGVzDQogd2l0aCB0aGUgd2ViIHNpdGUsIGFuZCByZWNlaXZlcyBhIG5ldyBjb29raWU/ IEluIHRoaXMgY2FzZSwgdGhlIG5ldyBjb29raWUgd2lsbCBiZSBib3VuZCB0byB0aGUgbmV3IFRv a2VuIEJpbmRpbmcgS2V5IChhc3N1bWluZyB0aGUgY2xpZW50IGFuZCBzZXJ2ZXIgaGF2ZSBuZWdv dGlhdGVkIHRoZSB1c2Ugb2YgVG9rZW4gQmluZGluZykuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO3RleHQt aW5kZW50Oi0uMjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzO2NvbG9yOiMxRjQ5N0QiPsOYPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 Ny4wcHQ7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPkJ1dCBJ IHdhcyBtb3JlIGNvbmNlcm5lZCB3aXRoIHRoZSZuYnNwO2tleS1tYW5hZ2VtZW50IGNsaWVudC1z aWRlIGlzc3VlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdy YXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjt0ZXh0LWluZGVudDotLjI1aW4iPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OldpbmdkaW5ncztjb2xvcjojMUY0OTdE Ij7DmDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjcuMHB0O2NvbG9yOiMxRjQ5N0QiPiZu YnNwOw0KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5JIGFtIGp1c3QgdGhpbmtpbmcgdGhhdCBzY2Fs ZWFiaWxpdHkgc2hvdWxkIGJlIGJ1aWx0IGludG8gc29sdXRpb25zIGF0IGFuIGVhcmx5IHN0YWdl LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmO2NvbG9yOiMxRjQ5N0QiPklmIHRoZSBjbGllbnQgY2FuIG1hbmFnZSBjb29raWVzIGlu IGEgc2NhbGFibGUgbWFubmVyLCB0aGlzIGNsaWVudCBjYW4gcHJvYmFibHkgYmUgZW5oYW5jZWQg dG8gYWxzbw0KIG1hbmFnZSBUb2tlbiBCaW5kaW5nIGtleXMgaW4gYSBzY2FsYWJsZSBtYW5uZXIu IENhbiB5b3UgZWxhYm9yYXRlIG9uIHRoZSBzcGVjaWZpYyBjbGllbnQtc2lkZSBzY2FsYWJpbGl0 eSBjb25jZXJucz88L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdE Ij5DaGVlcnMsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+ QW5kcmVpPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7 LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgd2luZG93dGV4 dCAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluO2JvcmRlci1jb2xvcjpjdXJyZW50Q29s b3IgY3VycmVudENvbG9yO2JvcmRlci1pbWFnZTogbm9uZSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1 dG8iPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0Nh bGlicmkmcXVvdDssc2Fucy1zZXJpZiI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+ DQo8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOkQuUm9nZXJzQGdteC5uZXQiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJp ZiI+RC5Sb2dlcnNAZ214Lm5ldDwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj4gWzwvc3Bhbj48 YSBocmVmPSJtYWlsdG86RC5Sb2dlcnNAZ214Lm5ldCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5tYWlsdG86 RC5Sb2dlcnNAZ214Lm5ldDwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5dPGJyPg0KPGI+U2Vu dDo8L2I+IFdlZG5lc2RheSwgQXByaWwgMjIsIDIwMTUgNzoxNCBBTTxicj4NCjxiPlRvOjwvYj4g QW5kcmVpIFBvcG92PGJyPg0KPGI+Q2M6PC9iPiA8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnVuYmVh cmFibGVAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+dW5iZWFyYWJsZUBpZXRmLm9yZzwvc3Bh bj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2Fs aWJyaSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gQXc6IFJlOiBbVW5i ZWFyYWJsZV0gcmV2aWV3aW5nIG91ciAwMCdzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlm Ij5IaSBBbmRyZWEsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJp ZiI+eWVzLCBxdWl0ZSByaWdodCwgYW5kIG9mIGNvdXJzZSBpZiB0aGV5IHBlcnZpb3VzbHkgaGFk IHRoZSByZWxldmFudCBjb29raWUsIHJlc2V0YWJsaXNoaW5nIGl0IGlzIHRyaXZpYWwuIEFuZCBz b21lb25lDQogbm90IGFjY2VwdGluZyBjb29raWVzIG9uIHByaW5jaXBsZSB3b3VsZCBub3QgaGF2 ZSBiZWVuIGF1dGhlbnRpY2F0ZWQgaW4gdGhlIGZpcnN0IHBsYWNlLiBCdSB0aGlzIGlzIG1vcmUg b3IgbGVzcyB3aGF0IEkgd3JvdGUgcHJldmlvdXNseS4gV2hpY2ggbWVjaGFuaXNtIGFyZSB3ZSBy ZWx5aW5nIG9uIHRvIHByZXZlbnQgaHlqYWNraW5nIHRoZSByZXR1cm5lZCBjb29raWU/Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRh bmEmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+QnV0IEkgd2Fz IG1vcmUgY29uY2VybmVkIHdpdGggdGhlJm5ic3A7a2V5LW1hbmFnZW1lbnQgY2xpZW50LXNpZGUg aXNzdWUuIEkgaGF2ZSBubyZuYnNwO3Byb3Bvc2VkIHNvbHV0aW9uIHVwIG15IHNsZWF2ZSwgYnV0 Jm5ic3A7aXQNCiBjb25jZXJucyBtZSB0aGF0IGxpa2UgbWFueSBvdGhlcnMgdmVyeSBvZnRlbiZu YnNwO0kgYW0gaW4gaHVuZHJlZHMgb2Ygd2ViLXNpdGVzIHBlciBkYXkuPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1z ZXJpZiI+QWRkZWQgdG8gdGhpcyBkdXJpbmcgYW55IHBhcnRpY3VsYXImbmJzcDtkYXkgSSBhbSB1 c2luZyBhIFdpbi04IGRlc2t0b3AsIGEgV2luLTcgbGFwdG9wLCBhbmQgYW4gQW5kcm9pZCBiYXNl ZCBUYWJsZXQuIEkNCiBhbSBqdXN0IHRoaW5raW5nIHRoYXQgc2NhbGVhYmlsaXR5IHNob3VsZCBi ZSBidWlsdCBpbnRvIHNvbHV0aW9ucyBhdCBhbiBlYXJseSBzdGFnZS48L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1h cmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNl cmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5iZXN0LDwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYi PkRlYW4mbmJzcDsmbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDsNCjwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIHdp bmRvd3RleHQgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA4LjBwdDttYXJnaW4tbGVmdDo3LjVw dDttYXJnaW4tdG9wOjcuNXB0O21hcmdpbi1yaWdodDozLjc1cHQ7bWFyZ2luLWJvdHRvbTozLjc1 cHQ7Ym9yZGVyLWNvbG9yOmN1cnJlbnRDb2xvciBjdXJyZW50Q29sb3IgY3VycmVudENvbG9yIHJn YigxOTUsIDIxNywgMjI5KTtib3JkZXItaW1hZ2U6IG5vbmUiPg0KPGRpdiBzdHlsZT0ibWFyZ2lu LWJvdHRvbTo3LjVwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlm Ij5HZXNlbmRldDo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDtEaWVuc3RhZywgMjEu IEFwcmlsIDIwMTUgdW0NCiAwMDowMyBVaHI8YnI+DQo8Yj5Wb246PC9iPiZuYnNwOyZxdW90O0Fu ZHJlaSBQb3BvdiZxdW90OyAmbHQ7PC9zcGFuPjxhIGhyZWY9IkFuZHJlaS5Qb3BvdkBtaWNyb3Nv ZnQuY29tIiB0YXJnZXQ9Il9wYXJlbnQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5BbmRyZWkuUG9wb3ZAbWlj cm9zb2Z0LmNvbTwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDs8YnI+DQo8Yj5Bbjo8L2I+ Jm5ic3A7JnF1b3Q7PC9zcGFuPjxhIGhyZWY9IkQuUm9nZXJzQGdteC5uZXQiIHRhcmdldD0iX3Bh cmVudCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJk YW5hJnF1b3Q7LHNhbnMtc2VyaWYiPkQuUm9nZXJzQGdteC5uZXQ8L3NwYW4+PC9hPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5z LXNlcmlmIj4mcXVvdDsgJmx0Ozwvc3Bhbj48YSBocmVmPSJELlJvZ2Vyc0BnbXgubmV0IiB0YXJn ZXQ9Il9wYXJlbnQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5ELlJvZ2Vyc0BnbXgubmV0PC9zcGFuPjwvYT48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVv dDssc2Fucy1zZXJpZiI+Jmd0Ozxicj4NCjxiPkNjOjwvYj4mbmJzcDsmcXVvdDs8L3NwYW4+PGEg aHJlZj0idW5iZWFyYWJsZUBpZXRmLm9yZyIgdGFyZ2V0PSJfcGFyZW50Ij48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJp ZiI+dW5iZWFyYWJsZUBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPiZxdW90OyAm bHQ7PC9zcGFuPjxhIGhyZWY9InVuYmVhcmFibGVAaWV0Zi5vcmciIHRhcmdldD0iX3BhcmVudCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1 b3Q7LHNhbnMtc2VyaWYiPnVuYmVhcmFibGVAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNl cmlmIj4mZ3Q7PGJyPg0KPGI+QmV0cmVmZjo8L2I+Jm5ic3A7UmU6IFtVbmJlYXJhYmxlXSByZXZp ZXdpbmcgb3VyIDAwJ3M8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMx RjQ5N0QiPkhpIERlYW4sPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxp YnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFG NDk3RCI+VGhhbmtzIGZvciB0aGUgZWRpdG9yaWFsIGNvbW1lbnRzOyB3aWxsIHJlcGhyYXNlIGlu IHRoZSBuZXh0IHJldmlzaW9uLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRl bnQ6LS4yNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpXaW5n ZGluZ3M7Y29sb3I6IzFGNDk3RCI+w5g8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo3LjBw dDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3 RCI+Jm5ic3A7DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPldoYXQgaGFwcGVucyBpZiBleGFjdGx5 IGF0IHRoYXQgbW9tZW50IHRoZSB0aGUgY2xpZW50IGNsZWFycyB0aGllciBjYWNoZSBhZnRlciB0 aGUgdG9rZW4vY29va2llIGlzIHJlY2VpdmVkPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0idGV4dC1pbmRlbnQ6LS4yNWluIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTpXaW5nZGluZ3M7Y29sb3I6IzFGNDk3 RCI+w5g8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo3LjBwdDtmb250LWZhbWlseTomcXVv dDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGNDk3RCI+Jm5ic3A7DQo8L3NwYW4+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1 b3Q7LHNhbnMtc2VyaWYiPkkgc3RpbGwgaGF2ZSB0aGUgc2FtZSBjb25jZXB0dWFsIHByb2JsZW0g d2l0aCBjYWNoZSBmbHVzaGluZywgaWYgdGhlIGNvb2tpZSBpcyBnb25lIHRoZSB3aG9sZSBwcm9j ZXNzIGhhcyB0byZuYnNwO3N0YXJ0IGZyb20gdGhlIGJlZ2lubmluZyBhbmQgdGhlIGNsaWVudCBo YXMgdG8gcHJvdmUgdGhleSBhcmUgc3RpbGwgdGhlIHNhbWUgY2xpZW50Lg0KIEluIG90aGVyIHdv cmRzIHJlLWVzdGFibGlzaCB0aGUgM3JkIGxlZyBvZiBhIGNoYWxsZW5nZSByZXNwb25zZSBwcm90 b2NvbC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj5JZiB0aGUgY29va2llIGlzIGdvbmUsIHRoZSBzZXJ2 ZXIgd2lsbCBoYXZlIHRvIGF1dGhlbnRpY2F0ZSB0aGlzIGNsaWVudCBhZ2Fpbi4gVGhpcyBpcyB0 aGUgY2FzZSB0b2RheTsNCiBJIGRvbuKAmXQgdGhpbmsgVG9rZW4gQmluZGluZyBpcyBjaGFuZ2lu ZyBhbnl0aGluZyBXUlQgdGhpcyBjYXNlLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjQ5N0QiPiZuYnNwOzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOiMxRjQ5N0QiPkNoZWVycyw8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250 LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMUY0OTdEIj5BbmRyZWk8L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUY0OTdEIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpz b2xpZCB3aW5kb3d0ZXh0IDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW47Ym9yZGVyLWNv bG9yOmN1cnJlbnRDb2xvciBjdXJyZW50Q29sb3I7Ym9yZGVyLWltYWdlOiBub25lIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmIj5Gcm9tOjwvc3Bhbj48L2I+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90 OyxzYW5zLXNlcmlmIj4gVW5iZWFyYWJsZSBbPC9zcGFuPjxhIGhyZWY9InVuYmVhcmFibGUtYm91 bmNlc0BpZXRmLm9yZyIgdGFyZ2V0PSJfcGFyZW50Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEx LjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPm1haWx0bzp1 bmJlYXJhYmxlLWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+XQ0K PGI+T24gQmVoYWxmIE9mIDwvYj48L3NwYW4+PGEgaHJlZj0iRC5Sb2dlcnNAZ214Lm5ldCIgdGFy Z2V0PSJfcGFyZW50Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPkQuUm9nZXJzQGdteC5uZXQ8L3NwYW4+PC9h PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkm cXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KPGI+U2VudDo8L2I+IFNhdHVyZGF5LCBBcHJpbCAxOCwg MjAxNSAxOjExIFBNPGJyPg0KPGI+Q2M6PC9iPiA8L3NwYW4+PGEgaHJlZj0idW5iZWFyYWJsZUBp ZXRmLm9yZyIgdGFyZ2V0PSJfcGFyZW50Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtm b250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWYiPnVuYmVhcmFibGVAaWV0 Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJl OiBbVW5iZWFyYWJsZV0gcmV2aWV3aW5nIG91ciAwMCdzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5z LXNlcmlmIj5EZWFyIEFsbCw8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxhIGhyZWY9 Imh0dHA6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtdG9rYmluZC1odHRwcy0wMCIg dGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5odHRwOi8vdG9vbHMuaWV0Zi5vcmcvaHRt bC9kcmFmdC1pZXRmLXRva2JpbmQtaHR0cHMtMDA8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Zl cmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+cGVyaGFwcyBpdHMgYSBiaXQgbGF0ZSB0byBiZSByYWlz aW5nIHRoaXMgcG9pbnQgYnV0Ojwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPkFic3RyYWN0Ojwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7 LHNhbnMtc2VyaWYiPiZxdW90O2FuIEhUVFAgc2VydmVyIGlzc3VlcyBhIHNlY3VyaXR5IHRva2Vu IChzdWNoIGFzIGEgY29va2llKSB0byBhIGNsaWVudCwgYW5kIGV4cGVjdHMgdGhlIGNsaWVudCB0 byBzZW5kIHRoZSBzZWN1cml0eSZuYnNwO3Rva2VuDQogYmFjayB0byB0aGUgc2VydmVyIGF0IGEg bGF0ZXIgdGltZSBpbiBvcmRlciB0byBhdXRoZW50aWNhdGUuJnF1b3Q7PC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7 LHNhbnMtc2VyaWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPldoYXQgaGFwcGVucyBpZiBl eGFjdGx5IGF0IHRoYXQgbW9tZW50IHRoZSB0aGUgY2xpZW50IGNsZWFycyB0aGllciBjYWNoZSBh ZnRlciB0aGUgdG9rZW4vY29va2llIGlzIHJlY2VpdmVkPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPlNv bWV0aGluZyBpbiB0aGUgY2hhbGxlbmdlLXJlc3BvbnNlIG1lY2hhbmlzbSZuYnNwO2lzIG1pc3Np bmcgaGVyZS4gV2h5IGRvZXMgdGhlIEhUVFAgU2VydmVyIGlzc3VlIHRoZSB0b2tlbiwgYXQgdGhp cyBwb2ludA0KIHRoZXJlIGlzIG5vIG1lbnRpb24gb2YgYSBjaGFsbGVuZ2UgcHJvbXB0aW5nIHRo aXMgcmVzcG9uc2UuIFdoYXQgc2hvdWxkIHRoZSBjaGFsbGVuZ2UgbG9vayBsaWtlPyBCYXNpY2Fs bHkgdGhpcyBkb2VzIG5vdCBiZWxvbmcgaW4gdGhlIGFic3RyYWN0Ljwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2Vy aWYiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPiZxdW90O0JpbmRpbmcgdGhlIHRva2VuIHRv IHRoZSBUTFMgY29ubmVjdGlvbiBiZXR3ZWVuIGNsaWVudCBhbmQgc2VydmVyIHByb3RlY3RzIHRo ZSBzZWN1cml0eSB0b2tlbiBmcm9tIHRoZWZ0LCBhbmQgZW5zdXJlcw0KIHRoYXQgdGhlIHNlY3Vy aXR5Jm5ic3A7dG9rZW4gY2FuIG9ubHkgYmUgdXNlZCBieSB0aGUgY2xpZW50IHRoYXQgaXQgd2Fz IGlzc3VlZCB0by4mcXVvdDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1h cmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5UaGlzIGJpbmRpbmcgaXMgbm90 IHlldCBlc3RhYmxpc2hlZCwgc28gLi4uICZxdW90O2FuZCB3b3VsZCBlbnN1cmUgdGhhdCB0aGUg c2VjdXJpdHkmbmJzcDt0b2tlbi4uLiZxdW90Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOzwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5h JnF1b3Q7LHNhbnMtc2VyaWYiPlBsZWFzZSwgSSBtYXkgaGF2ZSBtaXN1bmRlcnN0b29kIHNvbWV0 aGluZywgYnV0IGFyZSB3ZSBzYXlpbmcgdGhhdCBhIHRva2VuIGlzc3VlZCBieSBzZXJ2ZXIgQSB0 byBjbGllbnQgWCBtYXkgcG9zc2libHkNCiBiZSBhY2NlcHRlZCBieSBzZXJ2ZXIgQiwgc3VyZWx5 IHRoaXMgY2FuIG9ubHkgYmUgdGhlIGNhc2Ugb24gaW1wbGljaXQgdHJ1c3QgYmV0d2VlbiBzZXJ2 ZXJzIEEgYW5kIEI/PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+RnVydGhlciwgJnF1b3Q7dGhlIGNsaWVu dCBwcm92ZXMgcG9zc2Vzc2lvbiBvZiAocHJpdmF0ZSBrZXkpJm5ic3A7dG8gdGhlIHNlcnZlciwg YW5kIGlzIGxvbmctbGl2ZWQgKGkuZS4sJm5ic3A7c3Vic2VxdWVudCBUTFMgY29ubmVjdGlvbnMN CiBiZXR3ZWVuIHRoZSBzYW1lIGNsaWVudCBhbmQgc2VydmVyIGhhdmUmbmJzcDt0aGUgc2FtZSBU b2tlbiBCaW5kaW5nIElELiZxdW90Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPkkgc3RpbGwgaGF2ZSB0 aGUgc2FtZSBjb25jZXB0dWFsIHByb2JsZW0gd2l0aCBjYWNoZSBmbHVzaGluZywgaWYgdGhlIGNv b2tpZSBpcyBnb25lIHRoZSB3aG9sZSBwcm9jZXNzIGhhcyB0byZuYnNwO3N0YXJ0DQogZnJvbSB0 aGUgYmVnaW5uaW5nIGFuZCB0aGUgY2xpZW50IGhhcyB0byBwcm92ZSB0aGV5IGFyZSBzdGlsbCB0 aGUgc2FtZSBjbGllbnQuIEluIG90aGVyIHdvcmRzIHJlLWVzdGFibGlzaCB0aGUgM3JkIGxlZyBv ZiBhIGNoYWxsZW5nZSByZXNwb25zZSBwcm90b2NvbC4gV2hlcmUgdGhpcyBpcyBzdGlsbCB0aGUg c2FtZSBjbGllbnQgb25seSB0aW1lIGlzIGxvc3QuIGJ1dCBJIGFtIGFmcmFpZCB0aGF0Jm5ic3A7 c2hvdWxkIGFuIGF0dGFja2VyIGJlIGFibGUNCiB0byBnZW5lcmF0ZSBzdWNoIGEgZmFpbHVyZSB0 aGV5IG1heSBiZSBhYmxlIHRvIGhpamFjayB0aGUgc2Vzc2lvbi48L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJm b250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlm Ij4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5TZWN0aW9uIDMuMSBzdWdnZXN0cyB0aGF0IGVh Y2ggY2xpZW50IG9wZXJhdGUgYSBsYXJnZSBzY2FsZSBLZXktbWFuYWdlbWVudCBzeXN0ZW0sICZx dW90O2NsaWVudHMgdXNlIGRpZmZlcmVudCBwcml2YXRlDQoga2V5cyB0byBlc3RhYmxpc2ggUHJv dmlkZWQgVG9rZW4gQmluZGluZyBJRHMgd2l0aCBkaWZmZXJlbnQgc2VydmVycyZxdW90Oy48L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZx dW90OyxzYW5zLXNlcmlmIj5DbGllbnRzIGFyZSBjbGllbnRzIGFuZCB0aGlzIHNob3VsZCBub3Qg YmUgdGhpZXIgYnVzaW5lc3MuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+SXQgd2FzIHdpdGggdGhpcywg dG8gbXkgbWluZCwgbWFqb3IgYXJjaGl0ZWN0dXJhbCBjb25jZXB0dWFsIG1pc2RpZWN0aW9uJm5i c3A7dGhhdCBzdG9wZWQgbXkmbmJzcDtyZWFkaW5nIGZ1cnRoZXIuPC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJp ZiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+U2FsdXRlbTwvc3Bhbj48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYi PkRlYW48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIHdpbmRvd3Rl eHQgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA4LjBwdDttYXJnaW4tbGVmdDo3LjVwdDttYXJn aW4tdG9wOjcuNXB0O21hcmdpbi1yaWdodDozLjc1cHQ7bWFyZ2luLWJvdHRvbTozLjc1cHQ7Ym9y ZGVyLWNvbG9yOmN1cnJlbnRDb2xvciBjdXJyZW50Q29sb3IgY3VycmVudENvbG9yIHdpbmRvd3Rl eHQ7Ym9yZGVyLWltYWdlOiBub25lIj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1ib3R0b206Ny41cHQi Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+R2VzZW5kZXQ6PC9z cGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Zl cmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7U2Ftc3RhZywgMTguIEFwcmlsIDIwMTUgdW0N CiAxNzoyMSBVaHI8YnI+DQo8Yj5Wb246PC9iPiZuYnNwOyZxdW90O0JyaWFuIENhbXBiZWxsJnF1 b3Q7ICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmJjYW1wYmVsbEBwaW5naWRlbnRpdHkuY29t Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEm cXVvdDssc2Fucy1zZXJpZiI+YmNhbXBiZWxsQHBpbmdpZGVudGl0eS5jb208L3NwYW4+PC9hPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90 OyxzYW5zLXNlcmlmIj4mZ3Q7PGJyPg0KPGI+QW46PC9iPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJt YWlsdG86RC5Sb2dlcnNAZ214Lm5ldCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPkQuUm9nZXJzQGdteC5uZXQ8 L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQo8Yj5DYzo8L2I+Jm5ic3A7JnF1b3Q7PC9z cGFuPjxhIGhyZWY9Im1haWx0bzp1bmJlYXJhYmxlQGlldGYub3JnIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+ dW5iZWFyYWJsZUBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPiZxdW90OyAmbHQ7 PC9zcGFuPjxhIGhyZWY9Im1haWx0bzp1bmJlYXJhYmxlQGlldGYub3JnIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJp ZiI+dW5iZWFyYWJsZUBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDs8YnI+ DQo8Yj5CZXRyZWZmOjwvYj4mbmJzcDtSZTogW1VuYmVhcmFibGVdIHJldmlld2luZyBvdXIgMDAn czwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0 b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5Tb21lIGxpbmtzOjxicj4NCjxicj4NCjwvc3Bh bj48YSBocmVmPSJodHRwOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2JpbmQt cHJvdG9jb2wtMDAiIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+aHR0cDovL3Rvb2xz LmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi10b2tiaW5kLXByb3RvY29sLTAwPC9zcGFuPjwvYT48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVv dDssc2Fucy1zZXJpZiI+PGJyPg0KPC9zcGFuPjxhIGhyZWY9Imh0dHA6Ly90b29scy5pZXRmLm9y Zy9odG1sL2RyYWZ0LWlldGYtdG9rYmluZC1odHRwcy0wMCIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90Oyxz YW5zLXNlcmlmIj5odHRwOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXRva2JpbmQt aHR0cHMtMDA8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj48YnI+DQo8YnI+DQo8L3NwYW4+PGEg aHJlZj0iaHR0cHM6Ly9naXRodWIuY29tL1Rva2VuQmluZGluZy8iIHRhcmdldD0iX2JsYW5rIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVv dDssc2Fucy1zZXJpZiI+aHR0cHM6Ly9naXRodWIuY29tL1Rva2VuQmluZGluZy88L3NwYW4+PC9h PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVv dDssc2Fucy1zZXJpZiI+Jm5ic3A7DQo8L3NwYW4+PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+T24gU2F0LCBBcHIgMTgsIDIwMTUg YXQgOToxNiBBTSwgJmx0Ozwvc3Bhbj48YSBocmVmPSJELlJvZ2Vyc0BnbXgubmV0IiB0YXJnZXQ9 Il9wYXJlbnQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5ELlJvZ2Vyc0BnbXgubmV0PC9zcGFuPjwvYT48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDss c2Fucy1zZXJpZiI+Jmd0Ow0KIHdyb3RlOiA8L3NwYW4+PG86cD48L286cD48L3A+DQo8YmxvY2tx dW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgd2luZG93dGV4dCAxLjBw dDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6 NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0O2JvcmRlci1jb2xvcjpj dXJyZW50Q29sb3IgY3VycmVudENvbG9yIGN1cnJlbnRDb2xvciB3aW5kb3d0ZXh0O2JvcmRlci1p bWFnZTogbm9uZSI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Zl cmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+U29ycnksPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRh bmEmcXVvdDssc2Fucy1zZXJpZiI+YnV0IGxpa2UgYSBsb3Qgb2YgcGVvcGxlIHdlIGFyZSBhbGwg YnVzeSw8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5jYW4g eW91IHJlcGVhdCB0aGUgbGlua3MsPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+d2l0aG91dCB3aXNoaW5n IHRvIHNvdW5kIGxpa2UmbmJzcDtEciBXaG8sIHlvdSBjYXRjaCBtZSBhdCBhIHRpbWUgd2hlbiBJ IGhhdmUgdGltZSw8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5wb3NzaWJseSBpdHMgdGhlIHNhbWUgZm9y IG90aGVycywgcXVpY2sgbGlua3Mgd2l0aG91dCBoYXZpbmcgdG8gbWluZSB0aGVtIHdvdWxkIGJl IG1vc3QgdXNlZnVsIGJyaWdhZGllciA6LSk8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Zl cmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+YmVzdDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPkRlYW48L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci1sZWZ0OnNvbGlkIHdpbmRvd3RleHQgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA4LjBwdDtt YXJnaW4tbGVmdDo3LjVwdDttYXJnaW4tdG9wOjcuNXB0O21hcmdpbi1yaWdodDozLjc1cHQ7bWFy Z2luLWJvdHRvbTozLjc1cHQ7Ym9yZGVyLWNvbG9yOmN1cnJlbnRDb2xvciBjdXJyZW50Q29sb3Ig Y3VycmVudENvbG9yIHdpbmRvd3RleHQ7Ym9yZGVyLWltYWdlOiBub25lIj4NCjxkaXYgc3R5bGU9 Im1hcmdpbi1ib3R0b206Ny41cHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1t YXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48Yj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fu cy1zZXJpZiI+R2VzZW5kZXQ6PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+Jm5ic3A7U2Ftc3Rh ZywgMTguIEFwcmlsIDIwMTUgdW0NCiAxNTozMyBVaHI8YnI+DQo8Yj5Wb246PC9iPiZuYnNwOyZx dW90O0xlaWYgSm9oYW5zc29uJnF1b3Q7ICZsdDs8L3NwYW4+PGEgaHJlZj0ibGVpZmpAc3VuZXQu c2UiIHRhcmdldD0iX3BhcmVudCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZh bWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPmxlaWZqQHN1bmV0LnNlPC9zcGFu PjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRh bmEmcXVvdDssc2Fucy1zZXJpZiI+Jmd0Ozxicj4NCjxiPkFuOjwvYj4mbmJzcDsmcXVvdDs8L3Nw YW4+PGEgaHJlZj0idW5iZWFyYWJsZUBpZXRmLm9yZyIgdGFyZ2V0PSJfcGFyZW50Ij48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fu cy1zZXJpZiI+dW5iZWFyYWJsZUBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPiZx dW90OyAmbHQ7PC9zcGFuPjxhIGhyZWY9InVuYmVhcmFibGVAaWV0Zi5vcmciIHRhcmdldD0iX3Bh cmVudCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJk YW5hJnF1b3Q7LHNhbnMtc2VyaWYiPnVuYmVhcmFibGVAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90Oyxz YW5zLXNlcmlmIj4mZ3Q7PGJyPg0KPGI+QmV0cmVmZjo8L2I+Jm5ic3A7W1VuYmVhcmFibGVdIHJl dmlld2luZyBvdXIgMDAnczwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFs dDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48YnI+DQo8c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+ Rm9sa3MsPGJyPg0KPGJyPg0KVGhlIGNvcmUgZHJhZnRzIGhhdmUgYmVlbiBvdXQgYW5kIHB1Ymxp c2hlZCBhcyBXRyBkb2N1bWVudHMgZm9yIGEgY291cGxlPGJyPg0Kb2Ygd2Vla3Mgbm93LiBQbGVh c2UgcmV2aWV3ITxicj4NCjxicj4NCkNoZWVycyBMZWlmPGJyPg0KPGJyPg0KX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpVbmJlYXJhYmxlIG1haWxp bmcgbGlzdDxicj4NCjwvc3Bhbj48YSBocmVmPSJVbmJlYXJhYmxlQGlldGYub3JnIiB0YXJnZXQ9 Il9wYXJlbnQiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7 VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5VbmJlYXJhYmxlQGlldGYub3JnPC9zcGFuPjwvYT48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVv dDssc2Fucy1zZXJpZiI+PGJyPg0KPC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZSIgdGFyZ2V0PSJfYmxhbmsiPjxzcGFuIHN0eWxl PSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNl cmlmIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFibGU8L3Nw YW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGJy Pg0KPHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5h JnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fPGJyPg0KVW5iZWFyYWJsZSBtYWlsaW5nIGxpc3Q8YnI+DQo8L3NwYW4+PGEgaHJl Zj0iVW5iZWFyYWJsZUBpZXRmLm9yZyIgdGFyZ2V0PSJfcGFyZW50Ij48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+ VW5iZWFyYWJsZUBpZXRmLm9yZzwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NCjwvc3Bh bj48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFi bGUiIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby91bmJlYXJhYmxlPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+PGJy Pg0KJm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fIFVuYmVhcmFibGUgbWFpbGluZyBs aXN0DQo8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOlVuYmVhcmFibGVAaWV0Zi5vcmciPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5z LXNlcmlmIj5VbmJlYXJhYmxlQGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+DQo8 L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby91bmJl YXJhYmxlIiB0YXJnZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPmh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vdW5iZWFyYWJsZTwvc3Bhbj48L2E+PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXyBVbmJlYXJhYmxlIG1haWxpbmcgbGlzdA0KPC9zcGFuPjxh IGhyZWY9IlVuYmVhcmFibGVAaWV0Zi5vcmciIHRhcmdldD0iX3BhcmVudCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2Vy aWYiPlVuYmVhcmFibGVAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj4NCjwvc3Bh bj48YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3VuYmVhcmFi bGUiIHRhcmdldD0iX2JsYW5rIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby91bmJlYXJhYmxlPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fIFVuYmVhcmFibGUgbWFpbGluZyBsaXN0DQo8L3NwYW4+ PGEgaHJlZj0ibWFpbHRvOlVuYmVhcmFibGVAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmIj5VbmJl YXJhYmxlQGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZiI+DQo8L3NwYW4+PGEgaHJl Zj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby91bmJlYXJhYmxlIiB0YXJn ZXQ9Il9ibGFuayI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vdW5iZWFyYWJsZTwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_BLUPR03MB1396C00F4F5E63512614F71E8CED0BLUPR03MB1396namp_--