From rafiee@hpi.uni-potsdam.de Wed Dec 11 11:28:07 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C7EC1ADFC7 for ; Wed, 11 Dec 2013 11:28:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.55 X-Spam-Level: X-Spam-Status: No, score=-1.55 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eWBeO7wQMaMk for ; Wed, 11 Dec 2013 11:28:04 -0800 (PST) Received: from mail3.hpi.uni-potsdam.de (mail3.hpi.uni-potsdam.de [IPv6:2001:638:807:204::8d59:e17b]) by ietfa.amsl.com (Postfix) with ESMTP id CE41A1AE0F5 for ; Wed, 11 Dec 2013 11:28:00 -0800 (PST) Received: from owa.hpi.uni-potsdam.de (owa-2012.hpi.uni-potsdam.de [141.89.225.164]) by mail3.hpi.uni-potsdam.de (Postfix) with ESMTP id D7E0C169E73 for ; Wed, 11 Dec 2013 20:27:53 +0100 (CET) Received: from MXMA2012.hpi.uni-potsdam.de ([fe80::5c89:628a:f4a4:826a]) by OWA-2012.hpi.uni-potsdam.de ([fe80::9d94:d459:bf45:5d57%22]) with mapi id 14.03.0158.001; Wed, 11 Dec 2013 20:27:53 +0100 From: "Rafiee, Hosnieh" To: "secauth@ietf.org" Thread-Topic: Welcome and to do things Thread-Index: Ac72pxKV0NC1ujRHSxmjC+m7pii5ew== Date: Wed, 11 Dec 2013 19:27:52 +0000 Message-ID: <8EBBE4774B42FC45BA1143BE7F3F5A0F141F0D@MXMA2012.hpi.uni-potsdam.de> Accept-Language: en-US, de-DE Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [141.89.225.161] Content-Type: multipart/alternative; boundary="_000_8EBBE4774B42FC45BA1143BE7F3F5A0F141F0DMXMA2012hpiunipot_" MIME-Version: 1.0 Subject: [Secauth] Welcome and to do things X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Dec 2013 19:28:07 -0000 --_000_8EBBE4774B42FC45BA1143BE7F3F5A0F141F0DMXMA2012hpiunipot_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Folks, Thanks for joining to the group. You can consider this message as both test= message and the start of discussion. I guess the first important topic is = the discussion regarding the milestones and "to do things". One of the pur= pose is to come up with the best implementation solution for authentication= (a library or something like that) that can provide security, privacy with= acceptable performance and no/less operational barriers. To have an idea that how folks think about the real issue so that we can se= e the problems from different points of view, I start with some questions. = Feel free to share your experiences or add more questions or answer them. - What are the available authentication approaches? (either secure or= (might?! Be?!) non-secure) - Are the existing solutions are automatic solution or it is manual? = do we need to address them as well? If yes, to what extend? - What are the main factors that an implementation should consider wh= en dealing with the real world and with the existing technology and devices= (operational view)? - Are there still systems that uses an IP-based access list? - If yes, does/do it/they only in use in network layer? - By increasing numbers of proxy servers in all layers (proxy servers= that are used for different purposes, one example is SIP proxy, the other = example is ND proxy), what are the important factors to be considered so th= at the nodes know the other communicating nodes? - Do we have already security problem for authenticating the nodes to= proxy servers and vice versa? - ... Thanks, Smile, Hosnieh --_000_8EBBE4774B42FC45BA1143BE7F3F5A0F141F0DMXMA2012hpiunipot_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Folks,

 

Thanks for joining to the group. You can consider this = message as both test message and the start of discussion. I guess the first= important topic is the discussion regarding the milestones and  "to do things". One of the purpose is to come up with = the best implementation solution for authentication (a library or something= like that) that can provide security, privacy with acceptable performance = and no/less operational barriers.

 

To have an idea that how folks think about the real iss= ue so that we can see the problems from different points of view, I start w= ith some questions. Feel free to share your experiences or add more questions or answer them.

 

-       What are the available au= thentication approaches? (either secure or (might?! Be?!) non-secure)<= /o:p>

 

-       Are the existing solution= s are automatic solution or it is manual? do we need to address them as wel= l? If yes, to what extend?

 

-       What are the main factors= that an implementation should consider when dealing with the real world an= d with the existing technology and devices(operational view)?

 

-       Are there still systems t= hat uses an IP-based access list?

 

-       If yes, does/do it/they o= nly in use in network layer?

 

-       By increasing numbers of = proxy servers in all layers (proxy servers that are used for different purp= oses, one example is SIP proxy, the other example is ND proxy), what are the important factors to be considered so that the nodes = know the other communicating nodes?

 

-       Do we have already securi= ty problem for authenticating the nodes to proxy servers and vice versa?

 

-       …=

 

Thanks,

Smile,

Hosnieh

 

 

--_000_8EBBE4774B42FC45BA1143BE7F3F5A0F141F0DMXMA2012hpiunipot_-- From kathleen.moriarty@emc.com Wed Dec 11 11:42:28 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 660561ADFAD for ; Wed, 11 Dec 2013 11:42:28 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SRKTfNU6RhkD for ; Wed, 11 Dec 2013 11:42:24 -0800 (PST) Received: from mailuogwdur.emc.com (mailuogwdur.emc.com [128.221.224.79]) by ietfa.amsl.com (Postfix) with ESMTP id 70A3F1AE01B for ; Wed, 11 Dec 2013 11:42:24 -0800 (PST) Received: from maildlpprd54.lss.emc.com (maildlpprd54.lss.emc.com [10.106.48.158]) by mailuogwprd53.lss.emc.com (Sentrion-MTA-4.3.0/Sentrion-MTA-4.3.0) with ESMTP id rBBJg3MY007962 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 11 Dec 2013 14:42:04 -0500 X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd53.lss.emc.com rBBJg3MY007962 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=emc.com; s=jan2013; t=1386790924; bh=6GwZSjS1b3FSeHg/w++4kP7N7GU=; h=From:To:Date:Subject:Message-ID:References:In-Reply-To: Content-Type:MIME-Version; b=XdC+dKwatzTl1EhB6UmsnA2QQiWdaK3ukqedYTQPLyhttdjAweWqbnqM3JhWuMj/J nruYUMHY+stalAGt0lpQrDEStOW01juCjy9rr9dGOBkHAeQzyIbwQTzfn74nRL4b7e XuAenZPyaWh1nGpsp5G++M0d72LXG7qFvV3YA7g0= X-DKIM: OpenDKIM Filter v2.4.3 mailuogwprd53.lss.emc.com rBBJg3MY007962 Received: from mailusrhubprd04.lss.emc.com (mailusrhubprd04.lss.emc.com [10.253.24.22]) by maildlpprd54.lss.emc.com (RSA Interceptor); Wed, 11 Dec 2013 14:41:50 -0500 Received: from mxhub23.corp.emc.com (mxhub23.corp.emc.com [128.222.70.135]) by mailusrhubprd04.lss.emc.com (Sentrion-MTA-4.3.0/Sentrion-MTA-4.3.0) with ESMTP id rBBJfnru006676 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Wed, 11 Dec 2013 14:41:49 -0500 Received: from mx15a.corp.emc.com ([169.254.1.239]) by mxhub23.corp.emc.com ([128.222.70.135]) with mapi; Wed, 11 Dec 2013 14:41:49 -0500 From: "Moriarty, Kathleen" To: "Rafiee, Hosnieh" , "secauth@ietf.org" Date: Wed, 11 Dec 2013 14:41:48 -0500 Thread-Topic: Welcome and to do things Thread-Index: Ac72pxKV0NC1ujRHSxmjC+m7pii5ewAAMw2w Message-ID: References: <8EBBE4774B42FC45BA1143BE7F3F5A0F141F0D@MXMA2012.hpi.uni-potsdam.de> In-Reply-To: <8EBBE4774B42FC45BA1143BE7F3F5A0F141F0D@MXMA2012.hpi.uni-potsdam.de> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/alternative; boundary="_000_F5063677821E3B4F81ACFB7905573F2406541F24B9MX15Acorpemcc_" MIME-Version: 1.0 X-Sentrion-Hostname: mailusrhubprd04.lss.emc.com X-RSA-Classifications: DLM_1, public Subject: Re: [Secauth] Welcome and to do things X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Dec 2013 19:42:28 -0000 --_000_F5063677821E3B4F81ACFB7905573F2406541F24B9MX15Acorpemcc_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Hosnieh, Thanks for the introductory information. It would be helpful, at least for= me, to understand the scope or use cases that you are interested in discus= sing on this list so we know where to start. Authentication is a messy spa= ce as there are so many options. The existing options may have each been s= tarted with different use cases or to improve upon an existing authenticati= on protocol. In some cases they overlap. If the scope of activities are m= eant to be limited to a specific use case or set of use cases for discussio= n, it would be helpful to understand that. If this is a more general effor= t, it would be great to have some picture of how the existing protocols are= complimentary or have overlap. Everyone that has to research authenticati= on options for an implementation has to do a bunch of research without any = way to see what is there already or what the best options are for their use= cases. I may be way off-topic, but think some way of mapping this out wou= ld be extremely helpful and valuable to the numerous engineers out there wh= o need to understand how to pick the appropriate solution for their use cas= e and not re-invent the wheel. Even doing something like that through Wiki= pedia could be extremely helpful. This is something I have been thinking a= bout for a while after observing the vast duplication of efforts that folks= like those on this list could help to address. Thanks, Kathleen From: Secauth [mailto:secauth-bounces@ietf.org] On Behalf Of Rafiee, Hosnie= h Sent: Wednesday, December 11, 2013 2:28 PM To: secauth@ietf.org Subject: [Secauth] Welcome and to do things Folks, Thanks for joining to the group. You can consider this message as both test= message and the start of discussion. I guess the first important topic is = the discussion regarding the milestones and "to do things". One of the pur= pose is to come up with the best implementation solution for authentication= (a library or something like that) that can provide security, privacy with= acceptable performance and no/less operational barriers. To have an idea that how folks think about the real issue so that we can se= e the problems from different points of view, I start with some questions. = Feel free to share your experiences or add more questions or answer them. - What are the available authentication approaches? (either secure or= (might?! Be?!) non-secure) - Are the existing solutions are automatic solution or it is manual? = do we need to address them as well? If yes, to what extend? - What are the main factors that an implementation should consider wh= en dealing with the real world and with the existing technology and devices= (operational view)? - Are there still systems that uses an IP-based access list? - If yes, does/do it/they only in use in network layer? - By increasing numbers of proxy servers in all layers (proxy servers= that are used for different purposes, one example is SIP proxy, the other = example is ND proxy), what are the important factors to be considered so th= at the nodes know the other communicating nodes? - Do we have already security problem for authenticating the nodes to= proxy servers and vice versa? - ... Thanks, Smile, Hosnieh --_000_F5063677821E3B4F81ACFB7905573F2406541F24B9MX15Acorpemcc_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Hosnieh,

 

Thanks for the introductory information.  I= t would be helpful, at least for me, to understand the scope or use cases t= hat you are interested in discussing on this list so we know where to start= .  Authentication is a messy space as there are so many options. = The existing options may have each been started with different use cases o= r to improve upon an existing authentication protocol.  In some cases = they overlap.  If the scope of activities are meant to be limited to a= specific use case or set of use cases for discussion, it would be helpful = to understand that.  If this is a more general effort, it would be gre= at to have some picture of how the existing protocols are complimentary or = have overlap.  Everyone that has to research authentication options fo= r an implementation has to do a bunch of research without any way to see wh= at is there already or what the best options are for their use cases. = I may be way off-topic, but think some way of mapping this out would be ex= tremely helpful and valuable to the numerous engineers out there who need t= o understand how to pick the appropriate solution for their use case and no= t re-invent the wheel.  Even doing something like that through Wikiped= ia could be extremely helpful.  This is something I have been thinking= about for a while after observing the vast duplication of efforts that fol= ks like those on this list could help to address.

 

=

Thanks,

Kathleen=

 

From: Secauth [mailto:secau= th-bounces@ietf.org] On Behalf Of Rafiee, Hosnieh
Sent: We= dnesday, December 11, 2013 2:28 PM
To: secauth@ietf.org
Sub= ject: [Secauth] Welcome and to do things

 

Folks,

&= nbsp;

Thanks for joining to the group. You can consider this = message as both test message and the start of discussion. I guess the first= important topic is the discussion regarding the milestones and  "= ;to do things". One of the purpose is to come up with the best impleme= ntation solution for authentication (a library or something like that) that= can provide security, privacy with acceptable performance and no/less oper= ational barriers.

 

To have an= idea that how folks think about the real issue so that we can see the prob= lems from different points of view, I start with some questions. Feel free = to share your experiences or add more questions or answer them.<= /span>

 

-   &nbs= p;   What are the available authentication approaches? (eith= er secure or (might?! Be?!) non-secure)

 

-       Are = the existing solutions are automatic solution or it is manual? do we need t= o address them as well? If yes, to what extend?

 

-     &nbs= p; What are the main factors that an implementation should consider wh= en dealing with the real world and with the existing technology and devices= (operational view)?

 

-       Are there still syst= ems that uses an IP-based access list?

 <= /o:p>

-       If yes, does/do it/they only in use in network layer?

 

-    &n= bsp;  By increasing numbers of proxy servers in all layers (proxy= servers that are used for different purposes, one example is SIP proxy, th= e other example is ND proxy), what are the important factors to be consider= ed so that the nodes know the other communicating nodes?<= /p>

 

-    &= nbsp;  Do we have already security problem for authenticating the= nodes to proxy servers and vice versa?

 <= /o:p>

-       …

 

Thanks,

Smile,

Hosnieh

 

 

= --_000_F5063677821E3B4F81ACFB7905573F2406541F24B9MX15Acorpemcc_-- From rafiee@hpi.uni-potsdam.de Wed Dec 11 12:53:42 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF1261AE092 for ; Wed, 11 Dec 2013 12:53:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.551 X-Spam-Level: X-Spam-Status: No, score=-1.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, RP_MATCHES_RCVD=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ei5vGD4P7hQT for ; Wed, 11 Dec 2013 12:53:41 -0800 (PST) Received: from mail3.hpi.uni-potsdam.de (mail3.hpi.uni-potsdam.de [IPv6:2001:638:807:204::8d59:e17b]) by ietfa.amsl.com (Postfix) with ESMTP id 248C61ADF55 for ; Wed, 11 Dec 2013 12:53:39 -0800 (PST) Received: from owa.hpi.uni-potsdam.de (owa-2012.hpi.uni-potsdam.de [141.89.225.164]) by mail3.hpi.uni-potsdam.de (Postfix) with ESMTP id 60D5A169E7B; Wed, 11 Dec 2013 21:53:33 +0100 (CET) Received: from MXMA2012.hpi.uni-potsdam.de ([fe80::5c89:628a:f4a4:826a]) by OWA-2012.hpi.uni-potsdam.de ([fe80::9d94:d459:bf45:5d57%22]) with mapi id 14.03.0158.001; Wed, 11 Dec 2013 21:53:33 +0100 From: "Rafiee, Hosnieh" To: "Moriarty, Kathleen" , "secauth@ietf.org" Thread-Topic: Welcome and to do things Thread-Index: Ac72pxKV0NC1ujRHSxmjC+m7pii5ewAAMw2wAAFpGfA= Date: Wed, 11 Dec 2013 20:53:32 +0000 Message-ID: <8EBBE4774B42FC45BA1143BE7F3F5A0F141F91@MXMA2012.hpi.uni-potsdam.de> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F141F0D@MXMA2012.hpi.uni-potsdam.de> In-Reply-To: Accept-Language: en-US, de-DE Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [141.89.225.161] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Secauth] Welcome and to do things X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Dec 2013 20:53:43 -0000 Hi Kathleen, Thanks for your question. >Thanks for the introductory information.=A0 It would be helpful, at least = for me, to understand the scope or use cases that you are interested in dis= cussing on this list so we know where to start. > Authentication is a messy= space as there are so >many options. The existing options may have each b= een started with different use cases or to improve upon an existing authent= ication protocol. In some cases they overlap. If the scope of activities = are meant to be limited to a specific use case >or set of use cases for dis= cussion, it would be helpful to understand that. If this is a more general= effort, it would be great to have some picture of how the existing protoco= ls are complimentary or have overlap. Everyone that has to research >authe= ntication options for an implementation has to do a bunch of research witho= ut any way to see what is there already or what the best options are for th= eir use cases. I may be way off-topic, but think some way of mapping this = out would be >extremely helpful and valuable to the numerous engineers out = there who need to understand how to pick the appropriate solution for their= use case and not re-invent the wheel. Even doing something like that thro= ugh Wikipedia could be> >extremely helpful. This is something I have been = thinking about for a while after observing the vast duplication of efforts = that folks like those on this list could help to address. At first, I had an idea to only focus on SSAS (the one that I am working an= d improving it) and uses it as a means of authentication in other layers. B= ut I think it might be useful to widen the focus so that we can see and cov= er more scope and come up with the best, most appropriate solution. It migh= t be also something around SSAS but also it might be something beyond it. T= he most important thing is that we consider the realization of it. I am rea= dy to implement but it is also good to see the cooperation of large incorpo= rations in this implementation. So, what we come up with can be available f= or all current devices either small (like a mobile phone) or big one. This = solution , then, can be accessible for all applications, services in all up= per layers. In other word, an efficient framework. This can be a default so= lution for many places that are looking for secure, privacy enabled authent= ication. I guess everybody in this list is expert in one or more areas and = it is good to see opinions of non-security experts and security experts. Th= is really gives us the chance to better touch the problem. Thanks again for asking, Smile, Hosnieh From michael.hammer@yaanatech.com Wed Dec 11 17:28:22 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3833F1ADF46 for ; Wed, 11 Dec 2013 17:28:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FZWc5dCxv8Au for ; Wed, 11 Dec 2013 17:28:20 -0800 (PST) Received: from email1.corp.yaanatech.com (webmail10.yaanatech.com [63.128.177.10]) by ietfa.amsl.com (Postfix) with ESMTP id 4D4031ADBD1 for ; Wed, 11 Dec 2013 17:28:20 -0800 (PST) Received: from SC9-EX2K10MB1.corp.yaanatech.com ([fe80::149d:c2e1:8065:2a47]) by ex2k10hub1.corp.yaanatech.com ([::1]) with mapi id 14.01.0218.012; Wed, 11 Dec 2013 17:28:14 -0800 From: Michael Hammer To: "rafiee@hpi.uni-potsdam.de" , "kathleen.moriarty@emc.com" , "secauth@ietf.org" Thread-Topic: Welcome and to do things Thread-Index: Ac72pxKV0NC1ujRHSxmjC+m7pii5ewAAMw2wAAFpGfAACtxd4A== Date: Thu, 12 Dec 2013 01:28:13 +0000 Message-ID: <00C069FD01E0324C9FFCADF539701DB3BBF085FB@sc9-ex2k10mb1.corp.yaanatech.com> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F141F0D@MXMA2012.hpi.uni-potsdam.de> <8EBBE4774B42FC45BA1143BE7F3F5A0F141F91@MXMA2012.hpi.uni-potsdam.de> In-Reply-To: <8EBBE4774B42FC45BA1143BE7F3F5A0F141F91@MXMA2012.hpi.uni-potsdam.de> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.17.100.97] Content-Type: multipart/signed; micalg=SHA1; protocol="application/x-pkcs7-signature"; boundary="----=_NextPart_000_0212_01CEF6AF.83C8FCE0" MIME-Version: 1.0 Subject: Re: [Secauth] Welcome and to do things X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Dec 2013 01:28:22 -0000 ------=_NextPart_000_0212_01CEF6AF.83C8FCE0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi. There may be some history here that many that joined are not aware of. You are talking solutions, but what exactly is the problem being solved? A Use Case or two could demonstrate what is not working as Kathleen = noted. Otherwise, this seems like a research project. Mike -----Original Message----- From: Secauth [mailto:secauth-bounces@ietf.org] On Behalf Of Rafiee, = Hosnieh Sent: Wednesday, December 11, 2013 3:54 PM To: Moriarty, Kathleen; secauth@ietf.org Subject: Re: [Secauth] Welcome and to do things Hi Kathleen, Thanks for your question. >Thanks for the introductory information.=A0 It would be helpful, at = least for me, to understand the scope or use cases that you are interested in discussing on this list so we know where to start. > Authentication is a messy space as there are so >many options. The existing options may = have each been started with different use cases or to improve upon an = existing authentication protocol. In some cases they overlap. If the scope of activities are meant to be limited to a specific use case >or set of use cases for discussion, it would be helpful to understand that. If this = is a more general effort, it would be great to have some picture of how the existing protocols are complimentary or have overlap. Everyone that has = to research >authentication options for an implementation has to do a bunch = of research without any way to see what is there already or what the best options are for their use cases. I may be way off-topic, but think some = way of mapping this out would be >extremely helpful and valuable to the = numerous engineers out there who need to understand how to pick the appropriate solution for their use case and not re-invent the wheel. Even doing something like that through Wikipedia could be> >extremely helpful. = This is something I have been thinking about for a while after observing the = vast duplication of efforts that folks like those on this list could help to address. At first, I had an idea to only focus on SSAS (the one that I am working = and improving it) and uses it as a means of authentication in other layers. = But I think it might be useful to widen the focus so that we can see and = cover more scope and come up with the best, most appropriate solution. It = might be also something around SSAS but also it might be something beyond it. The most important thing is that we consider the realization of it. I am = ready to implement but it is also good to see the cooperation of large incorporations in this implementation. So, what we come up with can be available for all current devices either small (like a mobile phone) or = big one. This solution , then, can be accessible for all applications, = services in all upper layers. In other word, an efficient framework. This can be = a default solution for many places that are looking for secure, privacy enabled authentication. I guess everybody in this list is expert in one = or more areas and it is good to see opinions of non-security experts and security experts. This really gives us the chance to better touch the problem. Thanks again for asking, Smile, Hosnieh _______________________________________________ Secauth mailing list Secauth@ietf.org https://www.ietf.org/mailman/listinfo/secauth ------=_NextPart_000_0212_01CEF6AF.83C8FCE0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIRPzCCBBow ggMCAhEAi1t1VoRUhQsAz684SM6xpDANBgkqhkiG9w0BAQUFADCByjELMAkGA1UEBhMCVVMxFzAV BgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTow OAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5 MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24g QXV0aG9yaXR5IC0gRzMwHhcNOTkxMDAxMDAwMDAwWhcNMzYwNzE2MjM1OTU5WjCByjELMAkGA1UE BhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBO ZXR3b3JrMTowOAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVk IHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDd hNS5tPmn2PMEeJzePdxsExbZet0kUWbAxyZZDawGCMKU0TMf8IM1H24byN6qbhVOVCfvxG0a7Avj DvBEpVfHQFgeo0cfcexg9m2UyBg57f5CGFbf5ExJEHhOAXY1YxI23Wa8AQQ2o1Vo1aI2CayrISZU Bq0/yhTgrMqtBh2V4vid8eBg/8J/dStMzNr+h5kh6rr+PlTX0ll42zxuz6ATABq4J6HkvmeWyqDF s5zdyXWe6zCaX6PN2a54GT8j6VzbKb2tVcgbVIxj9uim6sc3ElyjKR4C2dsfO7TXD1ZHgRUESq+D J9HFWIjB3faqp6MY2miqbRFR4b9la5+WdtE9AgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAKtmjdez useatuZV0AXxnzGNWqrZqkYmD3Htpa1TVmIBRypE6f4/dAsTm7n0TRuy0V+yttKIXLOfzcvUp9lg lYQ6+ME3HWHK57DF5ZHaVKasMYGul97NCKy4wJeAf25ypOdpE5VlH8STPP15jwTUPk/q957OzWd8 T2UC/5GFVHPH/zb3hi3s0F5P/xGfcgbWuBrxTA0mZeJEgB7Hn+Pd6Ara7KUggGlooU9+4WvPB0H6 g468ON2wLhGxa7JCzJq8+UgieUoZD7IcPiB02WrDvvIoeBNWeU9tUOobsLVXsTdmWCPz3A/fCofE 74YF1TgUYJmjS94GlnEs8tu2H6TvP+4wggZCMIIFKqADAgECAhA4qwAv/66Wt1b/OVr7XecbMA0G CSqGSIb3DQEBBQUAMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAd BgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNz IDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMzAeFw0xMTA5MDEw MDAwMDBaFw0yMTA4MzEyMzU5NTlaMIGmMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMg Q29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxHjAcBgNVBAsTFVBl cnNvbmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuU3ltYW50ZWMgQ2xhc3MgMSBJbmRpdmlkdWFs IFN1YnNjcmliZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbsJ/0d Y/Q7HYrB0xzIyIKGtrhKhpKqgVxyyjANL55BIlcwISWQmqP0rCrGiBeGYXITdi7sA8snm48ggDfg 5IraVaZQD/y5XCNpiUKhuh+v7w75pMkK8fg3ssbZkkqufd+4RB+buj+MBv7YI09IUSNqYISo7icv YN+W8hoqjDyPAMxPy/ogjrw19uHwmrYF8/wdP8YUew7a8gXk04MCpsVpcLSp5Fbp2x1c9KY24mu1 Hiot3L677joEsDAIrV9obMa9BpaIhOfmqWQtvDgwu4gmw2dmZrS0d/nAoccOcu9m4uW5yuDzhXc1 mN7UHLD+ZnHiOMtufE9AVeuX2agYHu0CAwEAAaOCAkQwggJAMDgGCCsGAQUFBwEBBCwwKjAoBggr BgEFBQcwAYYcaHR0cDovL3BraS1vY3NwLnZlcmlzaWduLmNvbTASBgNVHRMBAf8ECDAGAQH/AgEA MGwGA1UdIARlMGMwYQYLYIZIAYb4RQEHFwEwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1h dXRoLmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwNAYD VR0fBC0wKzApoCegJYYjaHR0cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMS1nMy5jcmwwDgYDVR0P AQH/BAQDAgEGMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFWZXJpU2lnbk1QS0ktMi05NzAdBgNV HQ4EFgQUrfnDk3IttbkoYeSk12DVxApeGgEwgfEGA1UdIwSB6TCB5qGB0KSBzTCByjELMAkGA1UE BhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBO ZXR3b3JrMTowOAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVk IHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IC0gRzOCEQCLW3VWhFSFCwDPrzhIzrGkMA0GCSqGSIb3DQEBBQUA A4IBAQDWj8Ham4jys2xNH1gvugFRXXTBRujDuHuf1kDx7/8yuolrwA40Q5+kmeak8F1IM2KFhWH+ I4gijGCbK5xlSZTEojgkSKVcpVBLaOliIqeT6Jkibj1buxBCDh9MdUc0VgmP+L2MPPNcu9KWcFRw Yk3v0RC+nUgsXuyGaweC8D3hJScoLOAWdh6z/eViltKKPV8rrvtcwhO3ZWPLNHZDn9aHmaturZXB AD9GJ4H/Nd4jDkPcFF8y+cop78JSMPWZ3bmB+DolII2CaPK5IYV0ZgThhjkWMvIt1iqoyd7ZAAJP 4xggxaWBVraV3tOCrfh7Jb5kfC6gunAs+Pl14nRNB22EMIIG1zCCBb+gAwIBAgIQEB3dROkPDT0Q 6QYEc74tcjANBgkqhkiG9w0BAQUFADCBpjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVj IENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMR4wHAYDVQQLExVQ ZXJzb25hIE5vdCBWYWxpZGF0ZWQxNzA1BgNVBAMTLlN5bWFudGVjIENsYXNzIDEgSW5kaXZpZHVh bCBTdWJzY3JpYmVyIENBIC0gRzQwHhcNMTMwNDAxMDAwMDAwWhcNMTQwNDAyMjM1OTU5WjCBzjEu MCwGA1UEAwwlUGVyc29uYSBOb3QgVmFsaWRhdGVkIC0gMTM2NDg0MjY5NDQ0MzErMCkGCSqGSIb3 DQEJARYcbWljaGFlbC5oYW1tZXJAeWFhbmF0ZWNoLmNvbTEPMA0GA1UECwwGUy9NSU1FMR4wHAYD VQQLDBVQZXJzb25hIE5vdCBWYWxpZGF0ZWQxHzAdBgNVBAsMFlN5bWFudGVjIFRydXN0IE5ldHdv cmsxHTAbBgNVBAoMFFN5bWFudGVjIENvcnBvcmF0aW9uMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEAh2AtKQNowI8ILmNvdcY16moA8CH7hjSvGDNofwWsh4quEfZ6VQGtDhhOjUmW6JVq 719MH8FNJcVr8oAiVaK3nNeJTL2wO68LpgX6tcZ/z22pJoz98wHzgfWf3pfEUYrCqYg2V3m6oe0t kd+OaeY8DmPVSpG7as0rkoEzeNwCtmpYjkm96mBO6/AQwsowSLbSuqkEGykp1k47KiPBtxhbp2um IReh94vPrr1O9zXau9oGMvABJjigYQ2e5AhhhDdK8qOkhgkMAJN2nvLqY+VFrnFIsb5noQ/tP2M/ ct9qwRZ5kUaumRqE/XzV3rH8PoacZW/YvcwAp8Gr1ZaHCMRl+wIDAQABo4IC1TCCAtEwDAYDVR0T AQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMC MB0GA1UdDgQWBBTlvYUx4PMlUy6uvceJkDMK4jBDZjAnBgNVHREEIDAegRxtaWNoYWVsLmhhbW1l ckB5YWFuYXRlY2guY29tMB8GA1UdIwQYMBaAFK35w5NyLbW5KGHkpNdg1cQKXhoBMIIBKwYIKwYB BQUHAQEEggEdMIIBGTCCARUGCCsGAQUFBzAChoIBB2xkYXA6Ly9kaXJlY3RvcnkudmVyaXNpZ24u Y29tL0NOJTIwJTNEJTIwU3ltYW50ZWMlMjBDbGFzcyUyMDElMjBJbmRpdmlkdWFsJTIwU3Vic2Ny aWJlciUyMENBJTIwLSUyMEc0JTJDJTIwT1UlMjAlM0QlMjBQZXJzb25hJTIwTm90JTIwVmFsaWRh dGVkJTJDJTIwT1UlMjAlM0QlMjBTeW1hbnRlYyUyMFRydXN0JTIwTmV0d29yayUyQyUyME8lMjAl M0QlMjBTeW1hbnRlYyUyMENvcnBvcmF0aW9uJTJDJTIwQyUyMCUzRCUyMFVTP2NBQ2VydGlmaWNh dGU7YmluYXJ5MF0GA1UdHwRWMFQwUqBQoE6GTGh0dHA6Ly9wa2ktY3JsLnN5bWF1dGguY29tL2Nh XzU2MWMxMDM2OTBjOTdhNjkyNDdhMGVmMDcxYWM4MWFmL0xhdGVzdENSTC5jcmwwbAYDVR0gBGUw YzBhBgtghkgBhvhFAQcXATBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2Nw czAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTAqBgpghkgBhvhFARAD BBwwGgYRYIZIAYb4RQEQAQICBAGGsxcWBTEwOTIyMA0GCSqGSIb3DQEBBQUAA4IBAQAae/er4pfB TpqK6c/uJ9D8dVJzzNX26akkB8z/29totzbkpFAIlXRh02iNVK+GnsgS1gwu3FOvjgT5M4i+cNxD vTJVcnZNXns75JUGX3UsWQbtSySrVzQx8lMtwW6nXHM5GlEaY8/jKVpambG2q9OHjmwMTz7I4A+y KiiGCGdhE23dFOvku6t/oiwqFnXJmb4o75kbVevKEOd34MIj0P7Q8+1mZcNYEUTYKadoPXFyTWnO 2HTMvFcGgdLFKcqb13clWeW3/B5WjdBimpMjbvwi8ZbrhFdp7Y3NLKFSRH8W29rt0LW7zULxii0z 34NGsBkW9w95PLzTsqmKD4Yv5AkIMYIEkjCCBI4CAQEwgbswgaYxCzAJBgNVBAYTAlVTMR0wGwYD VQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29y azEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFsaWRhdGVkMTcwNQYDVQQDEy5TeW1hbnRlYyBDbGFz cyAxIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQSAtIEc0AhAQHd1E6Q8NPRDpBgRzvi1yMAkGBSsO AwIaBQCgggKrMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTEzMTIx MjAxMjgxM1owIwYJKoZIhvcNAQkEMRYEFAY8SiqGkkxPUDsGM/94oyxdqK+TMIGrBgkqhkiG9w0B CQ8xgZ0wgZowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggqhkiG9w0DBzALBglghkgBZQME AQIwDgYIKoZIhvcNAwICAgCAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgFAMA0GCCqGSIb3DQMCAgEo MAcGBSsOAwIaMAsGCWCGSAFlAwQCAzALBglghkgBZQMEAgIwCwYJYIZIAWUDBAIBMIHMBgkrBgEE AYI3EAQxgb4wgbswgaYxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlv bjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazEeMBwGA1UECxMVUGVyc29uYSBOb3Qg VmFsaWRhdGVkMTcwNQYDVQQDEy5TeW1hbnRlYyBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJl ciBDQSAtIEc0AhAQHd1E6Q8NPRDpBgRzvi1yMIHOBgsqhkiG9w0BCRACCzGBvqCBuzCBpjELMAkG A1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRl YyBUcnVzdCBOZXR3b3JrMR4wHAYDVQQLExVQZXJzb25hIE5vdCBWYWxpZGF0ZWQxNzA1BgNVBAMT LlN5bWFudGVjIENsYXNzIDEgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBIC0gRzQCEBAd3UTpDw09 EOkGBHO+LXIwDQYJKoZIhvcNAQEBBQAEggEAOVJs7JYFqxRq2IR0/RBSllW9DCSuhtxKNao7BrBF IS1fqgXgWkZMnY4X+jz1uV/z9ZiALtJRvjux5e0Vc8SdzZqbdcR+sQpuwnfZVXAZ2VdCdM7hArTE fZ7RzJnBH0rxmOiZfZHFMB73k1w89U6SiATbdUMxqB3uUZAGsTCnzaAk917IPo/7sXAwOWTXq1yg qt/05wo/926l/Y7OdmJcw3vcZzk5yiVV8NRW3geAeD74v7MlKPsU0BadLfxdk5T6ZXT8J+aYy0TQ 64Ky9/u6Lp5tWqNctUa4J2h2TUxYNE7k3LkFYqnkSwhkXLC2KRV0YCShGpsmXXREXPgMsHc+tgAA AAAAAA== ------=_NextPart_000_0212_01CEF6AF.83C8FCE0-- From rafiee@hpi.uni-potsdam.de Thu Dec 12 04:28:59 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F00AB1AE264 for ; Thu, 12 Dec 2013 04:28:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.551 X-Spam-Level: X-Spam-Status: No, score=-1.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, RP_MATCHES_RCVD=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ltwyT2BUV2uC for ; Thu, 12 Dec 2013 04:28:57 -0800 (PST) Received: from mail2.hpi.uni-potsdam.de (mail2.hpi.uni-potsdam.de [IPv6:2001:638:807:204::8d59:e17a]) by ietfa.amsl.com (Postfix) with ESMTP id D63D81ACC88 for ; Thu, 12 Dec 2013 04:28:56 -0800 (PST) Received: from owa.hpi.uni-potsdam.de (owa-2012.hpi.uni-potsdam.de [141.89.225.164]) by mail2.hpi.uni-potsdam.de (Postfix) with ESMTP id 848C7D2CB5; Thu, 12 Dec 2013 13:28:49 +0100 (CET) Received: from MXMA2012.hpi.uni-potsdam.de ([fe80::5c89:628a:f4a4:826a]) by OWA-2012.hpi.uni-potsdam.de ([fe80::9d94:d459:bf45:5d57%22]) with mapi id 14.03.0158.001; Thu, 12 Dec 2013 13:28:49 +0100 From: "Rafiee, Hosnieh" To: Michael Hammer Thread-Topic: Welcome and to do things Thread-Index: Ac72pxKV0NC1ujRHSxmjC+m7pii5ewAAMw2wAAFpGfAACtxd4AAT58vg Date: Thu, 12 Dec 2013 12:28:47 +0000 Message-ID: <8EBBE4774B42FC45BA1143BE7F3F5A0F142361@MXMA2012.hpi.uni-potsdam.de> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F141F0D@MXMA2012.hpi.uni-potsdam.de> <8EBBE4774B42FC45BA1143BE7F3F5A0F141F91@MXMA2012.hpi.uni-potsdam.de> <00C069FD01E0324C9FFCADF539701DB3BBF085FB@sc9-ex2k10mb1.corp.yaanatech.com> In-Reply-To: <00C069FD01E0324C9FFCADF539701DB3BBF085FB@sc9-ex2k10mb1.corp.yaanatech.com> Accept-Language: en-US, de-DE Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [2001:638:807:20d:e1bd:d11b:830e:ac03] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "secauth@ietf.org" , "kathleen.moriarty@emc.com" Subject: Re: [Secauth] Welcome and to do things X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Dec 2013 12:28:59 -0000 Hi Michael >=20 > There may be some history here that many that joined are not aware of. > You are talking solutions, but what exactly is the problem being solved? No, I am not going to jump in to the conclusion. There are still a long roa= d to decide on the solution.=20 > A Use Case or two could demonstrate what is not working as Kathleen noted= . Issues and thoughts - Problem with spoofed identification - Problem with performance - Problem with unique means of authentication -> barriers on device support= s - problem with having secure approach in upper layer but ignoring the attac= ks on lower layers - Problem with deploy ability of the existing approaches (operational barri= ers) - Is it better to do authentication in lower layers such as network layer? = (link layer is only valid in local link so it might not be useful to go thr= ough that since not accessible in other networks)=20 - Any alternative means of authentication except using only SSL or other pr= otocols to secure the process? 1- Define a means of identifying other communicating nodes This use case allows the nodes to identify each other. This is especially h= elpful if the nodes are authenticated based on a unique identifier. Does th= is use case make problem for user's privacy and allows tracking? Is IP address enough? Is session ID enough? How about privacy? How about security? One example, SIP proxy servers. If the applications securely started any communication, are there still vul= nerable from lower layers? What if the attacker is inside the network?=20 2- Decrease the delay issues causes by lower layers (especially network lay= er) This use case allows to find the delay problems. The focus can be either re= al-time services or both real-time and non-real-time services (user's delay= tolerance). - Decrease Packet size -> delivery of large packets are not as fast as deli= very of small packets. Large packets -> because of using security approache= s (carrying long key sizes, etc) - Decrease verification time=20 - Energy and resources usage -> using security approaches needs extra resou= rces for generation and verification -> What about battery barriers-> What = about memory sizes? ->=20 3- Automate the whole/most authentication process - Decrease the administrations' tasks 4- Unified the authentication mechanisms and have transparency .... This is only a few use cases that might be good for the start of discussion= . Any thought? Anything else? Thanks, Smile, Hosnieh >=20 From michael.hammer@yaanatech.com Thu Dec 12 07:45:36 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A59A1ADFC6 for ; Thu, 12 Dec 2013 07:45:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qHLv5piH7xNW for ; Thu, 12 Dec 2013 07:45:34 -0800 (PST) Received: from email1.corp.yaanatech.com (webmail10.yaanatech.com [63.128.177.10]) by ietfa.amsl.com (Postfix) with ESMTP id 5F6A41A802A for ; Thu, 12 Dec 2013 07:45:33 -0800 (PST) Received: from SC9-EX2K10MB1.corp.yaanatech.com ([fe80::149d:c2e1:8065:2a47]) by ex2k10hub1.corp.yaanatech.com ([::1]) with mapi id 14.01.0218.012; Thu, 12 Dec 2013 07:45:27 -0800 From: Michael Hammer To: "rafiee@hpi.uni-potsdam.de" Thread-Topic: Welcome and to do things Thread-Index: Ac72pxKV0NC1ujRHSxmjC+m7pii5ewAAMw2wAAFpGfAACtxd4AAT58vgAAmdJaA= Date: Thu, 12 Dec 2013 15:45:26 +0000 Message-ID: <00C069FD01E0324C9FFCADF539701DB3BBF08892@sc9-ex2k10mb1.corp.yaanatech.com> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F141F0D@MXMA2012.hpi.uni-potsdam.de> <8EBBE4774B42FC45BA1143BE7F3F5A0F141F91@MXMA2012.hpi.uni-potsdam.de> <00C069FD01E0324C9FFCADF539701DB3BBF085FB@sc9-ex2k10mb1.corp.yaanatech.com> <8EBBE4774B42FC45BA1143BE7F3F5A0F142361@MXMA2012.hpi.uni-potsdam.de> In-Reply-To: <8EBBE4774B42FC45BA1143BE7F3F5A0F142361@MXMA2012.hpi.uni-potsdam.de> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.17.100.89] Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_006C_01CEF727.437661A0" MIME-Version: 1.0 Cc: "secauth@ietf.org" , "kathleen.moriarty@emc.com" Subject: Re: [Secauth] Welcome and to do things X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Dec 2013 15:45:36 -0000 ------=_NextPart_000_006C_01CEF727.437661A0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Inline... -----Original Message----- From: Rafiee, Hosnieh [mailto:rafiee@hpi.uni-potsdam.de] Sent: Thursday, December 12, 2013 7:29 AM To: Michael Hammer Cc: kathleen.moriarty@emc.com; secauth@ietf.org Subject: RE: Welcome and to do things Hi Michael > > There may be some history here that many that joined are not aware of. > You are talking solutions, but what exactly is the problem being solved? No, I am not going to jump in to the conclusion. There are still a long road to decide on the solution. > A Use Case or two could demonstrate what is not working as Kathleen noted. Issues and thoughts - Problem with spoofed identification >> What identity? Who is spoofing? Why are they spoofing? More specifics please. - Problem with performance >> Performance of what? - Problem with unique means of authentication -> barriers on device supports >> What means of authentication? What device? - problem with having secure approach in upper layer but ignoring the attacks on lower layers >> Sounds like a lower layer problem. Architecture keeps layers separate for a reason. >> You don't want to create cross-layer dependencies that then cause Apps to fail when lower layers are modified. - Problem with deploy ability of the existing approaches (operational barriers) >> Seems like consideration rather than core issue. - Is it better to do authentication in lower layers such as network layer? (link layer is only valid in local link so it might not be useful to go through that since not accessible in other networks) >> Same can be said for network level. Do you want to authenticate every packet? >> Are you trying to make something connectionless connection-oriented? - Any alternative means of authentication except using only SSL or other protocols to secure the process? 1- Define a means of identifying other communicating nodes This use case allows the nodes to identify each other. This is especially helpful if the nodes are authenticated based on a unique identifier. Does this use case make problem for user's privacy and allows tracking? Is IP address enough? Is session ID enough? How about privacy? How about security? One example, SIP proxy servers. If the applications securely started any communication, are there still vulnerable from lower layers? What if the attacker is inside the network? >> Are you suggesting that an attacker can decrypt a TLS encrypted SIP packet? 2- Decrease the delay issues causes by lower layers (especially network layer) This use case allows to find the delay problems. The focus can be either real-time services or both real-time and non-real-time services (user's delay tolerance). - Decrease Packet size -> delivery of large packets are not as fast as delivery of small packets. Large packets -> because of using security approaches (carrying long key sizes, etc) - Decrease verification time - Energy and resources usage -> using security approaches needs extra resources for generation and verification -> What about battery barriers-> What about memory sizes? -> >> These have been around a long time and studied by many. What is new here? 3- Automate the whole/most authentication process - Decrease the administrations' tasks 4- Unified the authentication mechanisms and have transparency .... >> Last two are considerations of a solution, not a core issue. This is only a few use cases that might be good for the start of discussion. Any thought? Anything else? Thanks, Smile, Hosnieh > ------=_NextPart_000_006C_01CEF727.437661A0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIRPzCCBBow ggMCAhEAi1t1VoRUhQsAz684SM6xpDANBgkqhkiG9w0BAQUFADCByjELMAkGA1UEBhMCVVMxFzAV BgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTow OAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5 MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24g QXV0aG9yaXR5IC0gRzMwHhcNOTkxMDAxMDAwMDAwWhcNMzYwNzE2MjM1OTU5WjCByjELMAkGA1UE BhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBO ZXR3b3JrMTowOAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVk IHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDd hNS5tPmn2PMEeJzePdxsExbZet0kUWbAxyZZDawGCMKU0TMf8IM1H24byN6qbhVOVCfvxG0a7Avj DvBEpVfHQFgeo0cfcexg9m2UyBg57f5CGFbf5ExJEHhOAXY1YxI23Wa8AQQ2o1Vo1aI2CayrISZU Bq0/yhTgrMqtBh2V4vid8eBg/8J/dStMzNr+h5kh6rr+PlTX0ll42zxuz6ATABq4J6HkvmeWyqDF s5zdyXWe6zCaX6PN2a54GT8j6VzbKb2tVcgbVIxj9uim6sc3ElyjKR4C2dsfO7TXD1ZHgRUESq+D J9HFWIjB3faqp6MY2miqbRFR4b9la5+WdtE9AgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAKtmjdez useatuZV0AXxnzGNWqrZqkYmD3Htpa1TVmIBRypE6f4/dAsTm7n0TRuy0V+yttKIXLOfzcvUp9lg lYQ6+ME3HWHK57DF5ZHaVKasMYGul97NCKy4wJeAf25ypOdpE5VlH8STPP15jwTUPk/q957OzWd8 T2UC/5GFVHPH/zb3hi3s0F5P/xGfcgbWuBrxTA0mZeJEgB7Hn+Pd6Ara7KUggGlooU9+4WvPB0H6 g468ON2wLhGxa7JCzJq8+UgieUoZD7IcPiB02WrDvvIoeBNWeU9tUOobsLVXsTdmWCPz3A/fCofE 74YF1TgUYJmjS94GlnEs8tu2H6TvP+4wggZCMIIFKqADAgECAhA4qwAv/66Wt1b/OVr7XecbMA0G CSqGSIb3DQEBBQUAMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAd BgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNz IDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMzAeFw0xMTA5MDEw MDAwMDBaFw0yMTA4MzEyMzU5NTlaMIGmMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMg Q29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxHjAcBgNVBAsTFVBl cnNvbmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuU3ltYW50ZWMgQ2xhc3MgMSBJbmRpdmlkdWFs IFN1YnNjcmliZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbsJ/0d Y/Q7HYrB0xzIyIKGtrhKhpKqgVxyyjANL55BIlcwISWQmqP0rCrGiBeGYXITdi7sA8snm48ggDfg 5IraVaZQD/y5XCNpiUKhuh+v7w75pMkK8fg3ssbZkkqufd+4RB+buj+MBv7YI09IUSNqYISo7icv YN+W8hoqjDyPAMxPy/ogjrw19uHwmrYF8/wdP8YUew7a8gXk04MCpsVpcLSp5Fbp2x1c9KY24mu1 Hiot3L677joEsDAIrV9obMa9BpaIhOfmqWQtvDgwu4gmw2dmZrS0d/nAoccOcu9m4uW5yuDzhXc1 mN7UHLD+ZnHiOMtufE9AVeuX2agYHu0CAwEAAaOCAkQwggJAMDgGCCsGAQUFBwEBBCwwKjAoBggr BgEFBQcwAYYcaHR0cDovL3BraS1vY3NwLnZlcmlzaWduLmNvbTASBgNVHRMBAf8ECDAGAQH/AgEA MGwGA1UdIARlMGMwYQYLYIZIAYb4RQEHFwEwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1h dXRoLmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwNAYD VR0fBC0wKzApoCegJYYjaHR0cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMS1nMy5jcmwwDgYDVR0P AQH/BAQDAgEGMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFWZXJpU2lnbk1QS0ktMi05NzAdBgNV HQ4EFgQUrfnDk3IttbkoYeSk12DVxApeGgEwgfEGA1UdIwSB6TCB5qGB0KSBzTCByjELMAkGA1UE BhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBO ZXR3b3JrMTowOAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVk IHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IC0gRzOCEQCLW3VWhFSFCwDPrzhIzrGkMA0GCSqGSIb3DQEBBQUA A4IBAQDWj8Ham4jys2xNH1gvugFRXXTBRujDuHuf1kDx7/8yuolrwA40Q5+kmeak8F1IM2KFhWH+ I4gijGCbK5xlSZTEojgkSKVcpVBLaOliIqeT6Jkibj1buxBCDh9MdUc0VgmP+L2MPPNcu9KWcFRw Yk3v0RC+nUgsXuyGaweC8D3hJScoLOAWdh6z/eViltKKPV8rrvtcwhO3ZWPLNHZDn9aHmaturZXB AD9GJ4H/Nd4jDkPcFF8y+cop78JSMPWZ3bmB+DolII2CaPK5IYV0ZgThhjkWMvIt1iqoyd7ZAAJP 4xggxaWBVraV3tOCrfh7Jb5kfC6gunAs+Pl14nRNB22EMIIG1zCCBb+gAwIBAgIQEB3dROkPDT0Q 6QYEc74tcjANBgkqhkiG9w0BAQUFADCBpjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVj IENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMR4wHAYDVQQLExVQ ZXJzb25hIE5vdCBWYWxpZGF0ZWQxNzA1BgNVBAMTLlN5bWFudGVjIENsYXNzIDEgSW5kaXZpZHVh bCBTdWJzY3JpYmVyIENBIC0gRzQwHhcNMTMwNDAxMDAwMDAwWhcNMTQwNDAyMjM1OTU5WjCBzjEu MCwGA1UEAwwlUGVyc29uYSBOb3QgVmFsaWRhdGVkIC0gMTM2NDg0MjY5NDQ0MzErMCkGCSqGSIb3 DQEJARYcbWljaGFlbC5oYW1tZXJAeWFhbmF0ZWNoLmNvbTEPMA0GA1UECwwGUy9NSU1FMR4wHAYD VQQLDBVQZXJzb25hIE5vdCBWYWxpZGF0ZWQxHzAdBgNVBAsMFlN5bWFudGVjIFRydXN0IE5ldHdv cmsxHTAbBgNVBAoMFFN5bWFudGVjIENvcnBvcmF0aW9uMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEAh2AtKQNowI8ILmNvdcY16moA8CH7hjSvGDNofwWsh4quEfZ6VQGtDhhOjUmW6JVq 719MH8FNJcVr8oAiVaK3nNeJTL2wO68LpgX6tcZ/z22pJoz98wHzgfWf3pfEUYrCqYg2V3m6oe0t kd+OaeY8DmPVSpG7as0rkoEzeNwCtmpYjkm96mBO6/AQwsowSLbSuqkEGykp1k47KiPBtxhbp2um IReh94vPrr1O9zXau9oGMvABJjigYQ2e5AhhhDdK8qOkhgkMAJN2nvLqY+VFrnFIsb5noQ/tP2M/ ct9qwRZ5kUaumRqE/XzV3rH8PoacZW/YvcwAp8Gr1ZaHCMRl+wIDAQABo4IC1TCCAtEwDAYDVR0T AQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMC MB0GA1UdDgQWBBTlvYUx4PMlUy6uvceJkDMK4jBDZjAnBgNVHREEIDAegRxtaWNoYWVsLmhhbW1l ckB5YWFuYXRlY2guY29tMB8GA1UdIwQYMBaAFK35w5NyLbW5KGHkpNdg1cQKXhoBMIIBKwYIKwYB BQUHAQEEggEdMIIBGTCCARUGCCsGAQUFBzAChoIBB2xkYXA6Ly9kaXJlY3RvcnkudmVyaXNpZ24u Y29tL0NOJTIwJTNEJTIwU3ltYW50ZWMlMjBDbGFzcyUyMDElMjBJbmRpdmlkdWFsJTIwU3Vic2Ny aWJlciUyMENBJTIwLSUyMEc0JTJDJTIwT1UlMjAlM0QlMjBQZXJzb25hJTIwTm90JTIwVmFsaWRh dGVkJTJDJTIwT1UlMjAlM0QlMjBTeW1hbnRlYyUyMFRydXN0JTIwTmV0d29yayUyQyUyME8lMjAl M0QlMjBTeW1hbnRlYyUyMENvcnBvcmF0aW9uJTJDJTIwQyUyMCUzRCUyMFVTP2NBQ2VydGlmaWNh dGU7YmluYXJ5MF0GA1UdHwRWMFQwUqBQoE6GTGh0dHA6Ly9wa2ktY3JsLnN5bWF1dGguY29tL2Nh XzU2MWMxMDM2OTBjOTdhNjkyNDdhMGVmMDcxYWM4MWFmL0xhdGVzdENSTC5jcmwwbAYDVR0gBGUw YzBhBgtghkgBhvhFAQcXATBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2Nw czAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTAqBgpghkgBhvhFARAD BBwwGgYRYIZIAYb4RQEQAQICBAGGsxcWBTEwOTIyMA0GCSqGSIb3DQEBBQUAA4IBAQAae/er4pfB TpqK6c/uJ9D8dVJzzNX26akkB8z/29totzbkpFAIlXRh02iNVK+GnsgS1gwu3FOvjgT5M4i+cNxD vTJVcnZNXns75JUGX3UsWQbtSySrVzQx8lMtwW6nXHM5GlEaY8/jKVpambG2q9OHjmwMTz7I4A+y KiiGCGdhE23dFOvku6t/oiwqFnXJmb4o75kbVevKEOd34MIj0P7Q8+1mZcNYEUTYKadoPXFyTWnO 2HTMvFcGgdLFKcqb13clWeW3/B5WjdBimpMjbvwi8ZbrhFdp7Y3NLKFSRH8W29rt0LW7zULxii0z 34NGsBkW9w95PLzTsqmKD4Yv5AkIMYIEkjCCBI4CAQEwgbswgaYxCzAJBgNVBAYTAlVTMR0wGwYD VQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29y azEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFsaWRhdGVkMTcwNQYDVQQDEy5TeW1hbnRlYyBDbGFz cyAxIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQSAtIEc0AhAQHd1E6Q8NPRDpBgRzvi1yMAkGBSsO AwIaBQCgggKrMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTEzMTIx MjE1NDUyNFowIwYJKoZIhvcNAQkEMRYEFJ/9/DgDmapi7GcM2I3pWNqYvh0OMIGrBgkqhkiG9w0B CQ8xgZ0wgZowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggqhkiG9w0DBzALBglghkgBZQME AQIwDgYIKoZIhvcNAwICAgCAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgFAMA0GCCqGSIb3DQMCAgEo MAcGBSsOAwIaMAsGCWCGSAFlAwQCAzALBglghkgBZQMEAgIwCwYJYIZIAWUDBAIBMIHMBgkrBgEE AYI3EAQxgb4wgbswgaYxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlv bjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazEeMBwGA1UECxMVUGVyc29uYSBOb3Qg VmFsaWRhdGVkMTcwNQYDVQQDEy5TeW1hbnRlYyBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJl ciBDQSAtIEc0AhAQHd1E6Q8NPRDpBgRzvi1yMIHOBgsqhkiG9w0BCRACCzGBvqCBuzCBpjELMAkG A1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRl YyBUcnVzdCBOZXR3b3JrMR4wHAYDVQQLExVQZXJzb25hIE5vdCBWYWxpZGF0ZWQxNzA1BgNVBAMT LlN5bWFudGVjIENsYXNzIDEgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBIC0gRzQCEBAd3UTpDw09 EOkGBHO+LXIwDQYJKoZIhvcNAQEBBQAEggEAEXvKgEFiqc2Vdfj/M1BcBU/pJFdbuyj0ntM8H7HC MDs0Hftm0LqAWJHa1udUXSj2Ou9bBg6N5mkMtW+eEYTFgurwqg7byq9tEdYJv1QWWZzMyR6+xQa8 h2rvB9griMa8Jys2vzTLoukWS60cxG7cY1p3ZvKrHdzV3C7xqqE7Kl8jMxozLOnvtZ7029QxdVLv pMxXDAm+dWRXIjuK7bgKA8T0SZzFqap6+BZnELZ956/0koTm/Zb9dX3/lZbAos+425pj6NYGQXCn C8dfHXw2DC9jQ+Xtf5bHw3p2bJmYKAK+JMeniU6SA9bl2KN/7q21y/47cr+Q8JbokeHb/FUJiwAA AAAAAA== ------=_NextPart_000_006C_01CEF727.437661A0-- From rafiee@hpi.uni-potsdam.de Sat Dec 14 01:25:42 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA37F1A1F74 for ; Sat, 14 Dec 2013 01:25:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.951 X-Spam-Level: X-Spam-Status: No, score=-0.951 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, J_CHICKENPOX_47=0.6, RP_MATCHES_RCVD=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ALi_8Tebo_5b for ; Sat, 14 Dec 2013 01:25:40 -0800 (PST) Received: from mail2.hpi.uni-potsdam.de (mail2.hpi.uni-potsdam.de [IPv6:2001:638:807:204::8d59:e17a]) by ietfa.amsl.com (Postfix) with ESMTP id 7DDE41AD8E2 for ; Sat, 14 Dec 2013 01:24:47 -0800 (PST) Received: from owa.hpi.uni-potsdam.de (owa-2012.hpi.uni-potsdam.de [141.89.225.164]) by mail2.hpi.uni-potsdam.de (Postfix) with ESMTP id 4D52FD2C94; Sat, 14 Dec 2013 10:24:39 +0100 (CET) Received: from MXMA2012.hpi.uni-potsdam.de ([fe80::5c89:628a:f4a4:826a]) by OWA-2012.hpi.uni-potsdam.de ([fe80::9d94:d459:bf45:5d57%22]) with mapi id 14.03.0174.001; Sat, 14 Dec 2013 10:24:39 +0100 From: "Rafiee, Hosnieh" To: Michael Hammer Thread-Topic: Welcome and to do things Thread-Index: Ac72pxKV0NC1ujRHSxmjC+m7pii5ewAAMw2wAAFpGfAACtxd4AAT58vgAAmdJaAAVOi7AA== Date: Sat, 14 Dec 2013 09:24:37 +0000 Message-ID: <8EBBE4774B42FC45BA1143BE7F3F5A0F168D59@MXMA2012.hpi.uni-potsdam.de> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F141F0D@MXMA2012.hpi.uni-potsdam.de> <8EBBE4774B42FC45BA1143BE7F3F5A0F141F91@MXMA2012.hpi.uni-potsdam.de> <00C069FD01E0324C9FFCADF539701DB3BBF085FB@sc9-ex2k10mb1.corp.yaanatech.com> <8EBBE4774B42FC45BA1143BE7F3F5A0F142361@MXMA2012.hpi.uni-potsdam.de> <00C069FD01E0324C9FFCADF539701DB3BBF08892@sc9-ex2k10mb1.corp.yaanatech.com> In-Reply-To: <00C069FD01E0324C9FFCADF539701DB3BBF08892@sc9-ex2k10mb1.corp.yaanatech.com> Accept-Language: en-US, de-DE Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [141.89.225.161] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "secauth@ietf.org" , "kathleen.moriarty@emc.com" Subject: Re: [Secauth] Welcome and to do things X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 Dec 2013 09:25:43 -0000 Hi Mike, To be clear here, to have a good local security within the networks, one wo= uld need to apply one of the current security approaches. There are a few a= pproaches available for this means in network layer (and in specific in IP = layer) such as SeND or some other non-secure approaches that at the moment = is in use for this purpose. If one can spoof the IP, it might be easier for= him to play the MITM attack since upper layer don't have much information = about the owner of this iP.=20 Moreover, In a network with hundreds of nodes, you're not going to preload = every single node with the self-generated certification of each other. IMHO= , It is too much work. So, what the nodes really would do is to exchange t= heir public keys to each other by starting the communication based on their= IP address. If there is no attacker during this start. Everything seems to= be fine but what if the attacker now listen to this communication and spoo= f the IP address of the other nodes and send the public key of himself to t= he real node. This is just a thought, correct me if I am wrong and tell me = why you think it is NOT possible. We all here to discuss about possibility = usability of the opinions here and share and decide on the best one.=20 We can come up with the implementation or a library of what is integrated w= ith the current TLS, etc secure approaches. It is also possible that we can= come up with the alternative one. BTW, please do not misinterpret my sent= ence about integration of authentication in all layers. I do not mean to ph= ysically integrate all OSI layers but what I meant is to make the parameter= s that is used in network layer for authentication available in upper layer= s so that if any applications or services would like to use them for a secu= re authentication, it can do it by calling this library without going throu= gh the understanding of network layer or security in that layer. The most important thing on which we want to focus is that we have thousand= s of devices (mobile phone, cars, laptops, PCs, ipad,tablets, etc) that are= increasing every minutes. All what are going to use IP as a means of commu= nications. I only imagine a world full of IP based devices. Companies also = would like to offer the best services to their customers by fancy ideas suc= h as controlling all your devices via public networks, i.e., Internet and a= ccess them wherever you are!. For me, it is really a scary scenario and I g= uess with fast growing technologies, you have to expect this in next few ye= ars. (some companies already offer some services such as controlling your h= ome from your work, etc). Since they are IP based, any flaws in network lay= ers can have a direct effect the privacy and security of the user.=20 One might say, the attacker cannot be inside the network. I am really oppos= ite of this sentence. If one only read the security news, recently millions= of facebook and yahoo password hacked. Both company claimed that it wasn't= any flaws in their system but they can do nothing about the malwares on us= ers' system. These are only a few reasons that why we need network security and when we = go through the implementation of that to decrease the delay, why not to use= the same authentication approach in other layers? > Issues and thoughts > - Problem with spoofed identification > >> What identity? Who is spoofing? Why are they spoofing? More specifi= cs > please. The identity can be a session ID or it can be your computer's IP address. > - Problem with performance > >> Performance of what? When you use any security approaches, verification needs time. Generation n= eeds time. For some applications and services, this time might not be accep= table. One example is using VoIP. It is real time application and there is = a maximum delay threshold.=20 The other important factor is CPU and battery usage. This is especially imp= ortant for devices that has limited computational resources and using an ap= proach that might busy the whole CPU for some time for generation/verificat= ion is not ideal as the device lose its functionality So, If I want to summarize here, the factors are delay tolerance, CPU usage= , Battery usage.=20 > - Problem with unique means of authentication -> barriers on device suppo= rts > >> What means of authentication? What device? I have already explained this that what is in my mind is a cross framework = implementation that is possible to use in all devices (car, mobile phone, l= aptop, pcs. Servers, etc) > - problem with having secure approach in upper layer but ignoring the > attacks on lower layers > >> Sounds like a lower layer problem. Architecture keeps layers separate > for a reason. Nope, If there is a security problem in lower layers, the chance of harming= the target system is more than 50%, although, one secured your upper layer= s.=20 > >> You don't want to create cross-layer dependencies that then cause Apps= to > fail when lower layers are modified. Again it is not cross layer dependencies. The purpose is not to integrate l= ayers but only use or integrate the authentication of one layer for other l= ayers. Because, for providing such library the main layer, i.e., network la= yer needs to have this implementation, the upper layers only benefit from i= t but not dependent to it. > - Problem with deploy ability of the existing approaches (operational > barriers) > >> Seems like consideration rather than core issue. There are a lot of standards in IETF that really cannot be implemented or o= nly disabled since there wasn't any consideration from operational view. So= , IMHO, it is really important to consider this fact and I see it as one of= the main issue with many existing approaches > - Is it better to do authentication in lower layers such as network layer= ? > (link layer is only valid in local link so it might not be useful to go > through that since not accessible in other networks) > >> Same can be said for network level. Do you want to authenticate every > packet? > >> Are you trying to make something connectionless connection-oriented? Not exactly. Since, I do not think like TLS you need to have a handshake ot= herwise we come up with something that merge to SSL or TLS.=20 > - Any alternative means of authentication except using only SSL or other > protocols to secure the process? Other security protocols as well. It was only an example. > >> Are you suggesting that an attacker can decrypt a TLS encrypted SIP > packet? If the certification of both communication nodes are not preloaded or no CA= is used, then, IMHO, the attacker has a chance to do this in a start of th= e communication. =20 However, my main focus was on proxy servers. Since the communication in thi= s case is not between two original end nodes but the proxy server is in bet= ween and this causes many security issues. The questions such as how the pr= oxy server can identifies the both ending nodes and facilitate this connect= ions.=20 > >> These have been around a long time and studied by many. What is new > here? The problem wasn't solved and still there :-) but might be improved. The mo= st studies also in case there is no security approaches running there and t= hey only focused on the protocol itself. > >> Last two are considerations of a solution, not a core issue. Many protocols are not implemented or have deploy ability problems because = of automation problem. One big example is DNSSEC. There are many people wor= king on this issue. So, IMHO, it is a big issue and not just a small consid= eration. I might be wrong but this is based on my observation. Smile, Hosnieh (Sara) P.S. Sorry for the delay to answer you. I had a nice?!! Christmas gift from= my webhosting company, I.e., their system automatically deleted the DNS re= cords and all mailbox related to one of my main domain that I use for ietf = and other private stuff without any notification (I usually don't use this = email for ietf).... they are really a good entrepreneurs since they made me= busy with many tasks and still continues... They THOUGHT that when I trans= ferred the domain to other registrar, I also want to delete it! I hope next= time before they use their thoughts, they ask me before... From rafiee@hpi.uni-potsdam.de Sat Dec 14 03:15:17 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DAC411ADF77 for ; Sat, 14 Dec 2013 03:15:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.55 X-Spam-Level: X-Spam-Status: No, score=-1.55 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BmbMx3gFOa2d for ; Sat, 14 Dec 2013 03:15:06 -0800 (PST) Received: from mail3.hpi.uni-potsdam.de (mail3.hpi.uni-potsdam.de [IPv6:2001:638:807:204::8d59:e17b]) by ietfa.amsl.com (Postfix) with ESMTP id 4BE751ADF84 for ; Sat, 14 Dec 2013 03:15:04 -0800 (PST) Received: from owa.hpi.uni-potsdam.de (owa-2012.hpi.uni-potsdam.de [141.89.225.164]) by mail3.hpi.uni-potsdam.de (Postfix) with ESMTP id 223D3169EB1 for ; Sat, 14 Dec 2013 12:14:57 +0100 (CET) Received: from MXMA2012.hpi.uni-potsdam.de ([fe80::5c89:628a:f4a4:826a]) by OWA-2012.hpi.uni-potsdam.de ([fe80::9d94:d459:bf45:5d57%22]) with mapi id 14.03.0174.001; Sat, 14 Dec 2013 12:14:56 +0100 From: "Rafiee, Hosnieh" To: "secauth@ietf.org" Thread-Topic: initual attempt for auth categorization Thread-Index: Ac74vbBpyyGo4TgmSYCHGvGv05Nq3Q== Date: Sat, 14 Dec 2013 11:14:55 +0000 Message-ID: <8EBBE4774B42FC45BA1143BE7F3F5A0F168DAF@MXMA2012.hpi.uni-potsdam.de> Accept-Language: en-US, de-DE Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [141.89.225.161] Content-Type: multipart/related; boundary="_004_8EBBE4774B42FC45BA1143BE7F3F5A0F168DAFMXMA2012hpiunipot_"; type="multipart/alternative" MIME-Version: 1.0 Subject: [Secauth] initual attempt for auth categorization X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 Dec 2013 11:15:17 -0000 X-List-Received-Date: Sat, 14 Dec 2013 11:15:17 -0000 --_004_8EBBE4774B42FC45BA1143BE7F3F5A0F168DAFMXMA2012hpiunipot_ Content-Type: multipart/alternative; boundary="_000_8EBBE4774B42FC45BA1143BE7F3F5A0F168DAFMXMA2012hpiunipot_" --_000_8EBBE4774B42FC45BA1143BE7F3F5A0F168DAFMXMA2012hpiunipot_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Folks, I'd consider two categories. If you think there are more, feel free to add. (two versions, picture and text ) Trusted authority for securing i= t ^ + xxxxx x xxx xxxxxxxxx xxxx xxx xxx xx xx +--------------------+ | IP based access | | Lists | +------->+--------------------+ + +-----------= -----------+ Authentications+----+ +-------->| Session I= D | | +--------------------+| | based = | +------->| unique identity |+ +-----------= -----------+ | based |+ +--------------------+| +-----------= -----------+ +-------->| Username/= Password | | based= | x +-----------= -----------+ xxx = xx xxxx = xxxx xxxxx xxxx = xxxxxxxx xxx x xx= x x SSL o= r TLS might be in use for s= ecurity Question: -How many percentage of authentication is IP based? Problems: Security costs -> register in CAs -How many are mixed (IP based and any of the approaches in second category? Smile, Hosnieh P.S. maybe we can also have a nice wiki at the end by gathering all existin= g approaches and their purposes. Right? --_000_8EBBE4774B42FC45BA1143BE7F3F5A0F168DAFMXMA2012hpiunipot_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
Folks,
 
I'd consider two categories. If you think there are more, feel free to= add.
(two versions, picture and text )
 
 
       &= nbsp;           &nbs= p;            &= nbsp;          Trusted authori= ty for securing it
       &= nbsp;           &nbs= p;            &= nbsp;          ^
       &= nbsp;           &nbs= p;            &= nbsp;          +
       &= nbsp;           &nbs= p;            &= nbsp;     xxxxx x xxx
       &= nbsp;           &nbs= p;          xxxxxxxxx &nb= sp;        xxxx
       &= nbsp;           &nbs= p;        xxx    &nb= sp;            =     xxx
       &= nbsp;           &nbs= p;      xx      &nbs= p;            &= nbsp;      xx
       &= nbsp;           &nbs= p;           +-------= -------------+
       &= nbsp;           &nbs= p;           |  IP b= ased access   |
       &= nbsp;           &nbs= p;           |  = ;   Lists          |=
       &= nbsp;           &nbs= p;  +------->+--------------------+
       &= nbsp;           &nbs= p;  +          &= nbsp;           &nbs= p;            &= nbsp;    +----------------------+
  Authentications+----+ &= nbsp;           &nbs= p;            &= nbsp;   +-------->|  Session ID   &nbs= p;      |
       &= nbsp;           &nbs= p;  |        +-----------------= ---+|         |  &nbs= p;  based          &= nbsp; |
       &= nbsp;           &nbs= p;  +------->| unique identity    |+ &n= bsp;       +----------------------+
       &= nbsp;           &nbs= p;           |  = ;   based          |= +
       &= nbsp;           &nbs= p;           +-------= -------------+|         +--= --------------------+
       &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;        +-------->|  Usern= ame/Password   |
       &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;     |      based &n= bsp;         |   x=
       &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;     +----------------------+
       &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;          xxx  &nb= sp;            =             &nb= sp; xx
       &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            xxxx&n= bsp;            = ;         xxxx
       &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;   xxxxx    xxxx xxxxxxxx
       &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;         xxx   = x
       &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;   xxx
       &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;    x
 
       &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;            SSL= or TLS might be in use
       &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;            for= security
 
 
=
 
 
Question:
-How many percentage of authentication is IP based?
Problems:
Security costs -> register in CAs
-How many are mixed (IP based and any of the approaches in second cate= gory?
 
Smile,
Hosnieh
P.S. maybe we can also have a nice wiki at the end by gathering all ex= isting approaches and their purposes. Right?
 
 --_000_8EBBE4774B42FC45BA1143BE7F3F5A0F168DAFMXMA2012hpiunipot_-- --_004_8EBBE4774B42FC45BA1143BE7F3F5A0F168DAFMXMA2012hpiunipot_ Content-Type: image/jpeg; name="Picture (Device Independent Bitmap) 1.jpg" Content-Description: Picture (Device Independent Bitmap) 1.jpg Content-Disposition: inline; filename="Picture (Device Independent Bitmap) 1.jpg"; creation-date="Sat, 14 Dec 2013 11:14:50 GMT"; modification-date="Sat, 14 Dec 2013 11:14:50 GMT" Content-ID: Content-Transfer-Encoding: base64 /9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0a HBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIy MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAIkA6cDASIA AhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQA AAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3 ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWm p6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEA AwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSEx BhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElK U1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3 uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD3+iii gAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKA CiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiuU8aa3c6NHZta6ddXzysw2W7h doAzkk8YpxSbsxN2Vzq6K8z0XxfcaqWNzpt7psAi85Z7iZSjLnHUdPxrXTWbWR40j1SF2kUugWcE so6kc8iun6t5mPt/I7WiuKGsWxWJhqcRWY4iPnDEh9F55oudYtrOVYrvU4reRhlUlnCk/QE0fVvM Xt/I7WiuEu/Een2E0EN3q8MDzqWj8yYAMPXr0qwdVgWz+2NqMYtf+e5mGz/vrpR9W8x+38js6K42 HUo7m2Nzb36TW4zmWOXcox15FUIfE0V1rEVhaym5ikjZxdQzh0BXqpwc55FH1bW1w9v5HoNFcn50 3/PV/wDvo1WbWLVLsWj6nCt0ekJnAc/hnNH1V9xe38jtaK4x9UhjaVH1BFaEbpVaXBQeregqvd+I rCwhgmutWiiiuGCxO03yufY+nvR9W8x+38ju6K8/vfEa2+nrfWjtqEBkCO1tOCEB6knPartrqkN+ rNZ6glwFOGMMwbafQ4oWGv1D2/kdnRXFQaxbXNw1vb6nFNOn3oo5wzLj1ANNbXLJAxbVoFCPsbNw Plb0PPX2o+reYe38jt6K4a51lba8gtPtAeeZseX54VlH97BOSPpRf6/ZaXJDHf6nHbNOSIxLLtzj 69qPq3mHt/I7miuK/tm1+zJc/wBqQ/Z3bakvnjYx9Ac4JqQajGbn7ML5TcFd3k+b8+PXHXFH1XzF 7fyOxork/Om/56v/AN9GuZvfHcUGs/2ZZqb6RSokaO8jQKW7YY5J+lJ4aztcarX6HqVFcVcaxbWk kcV3qUVvLIAVjlnCsfoCeafLqUUEywzX6RzOMrG8uGYeoFP6t5i9v5HZUVx1vqC3cImtb0TxE4Dx SblP4ipTcSqCzTOABkkt0p/VX3D267HWUVxVtrNreuY7TVIbhx1WKcMf0NEOs2txdNawapDLcLnd Ek4LjHXIzml9W8w9v5Ha0VxVxrNraTLDc6pDBKwysck4Vj+BNKdVgHmZ1GMeUu6T98PkHqfQUfVv Mft/I7SiuLbVrdEhdtSjVJjiJjMAJP8Ad9aQaxbNBNMupxNFCdsricbUPoxzwaPq3mL2/kdrRXEW usC50/7a8/kw85czhlwO+4HGKdBrFrdTtBbapDNMoyY45wzAeuAaPqvmHt/I7WiuJl1uzgneCbVY I5kG543nAZR6kZ4qytxI6hlnZlYZBDcEULC36h7fyOtoriNR1hdNg8ya5AdjiON5whkPoCTRfazB pll9rv74W0PA3SSYGT296Pq3mP2/kdvRXM+H9TttRvCbW/iukVTuMUocD64rpqxqQ5HY0hPnVwoo orMsKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACii igAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKK ACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACua8Z3sWn6U08/mGMRupEcZdiSM Dgc10tVL20juQrySGMRgnIOKuDSepMk2tDzXw1qdnN4N3SxT+Tboyzxy27AnvjaR81ZXgyLw5OZI rfT5kvTM8u6a2dAq54CkjAGP4RXqVtYWV7AtxbXvnxN92SNwyn6EVKdGjIwZpDXX7aHNd/kc3s52 seOXOoWVrZx6YdKuGubTUNxKWhKwJuHzKccj6U3xaumajrN8ssmow3JQRrGLDzY5+4w5BKA5wcV7 N/Y0eMefJxQNGjAwJ5fzqPaQcbN/1ZL9C+Sad7f1ueZava2Njb6Dd6npMckNtH5U6JB5xjyoAXGC SAc1X8QR/wBqeHNPuYba507Topy7xRW6u3l4wreWRjGecYyK9UGixA5E0go/sWLOfOkz61UqtN31 3JVOatoeP6dZWf8AYWrNp17qN8jvE9xFNafZxsB5CKAByM5x1qewvdEl8cadPo+m3NvC0EkMkgtG ijLHG0EY68HmvWTo0Z6zSHFKdGjPWeX86SqwTTv/AFsDpzd9DC715X4kxJqd9NMb2K+S4Ux21rYh g0akYfzcZ5HOAfavb/7Eh/56yfpTho0YGBPJinOrCTTTCNOa6HmWo6hYWGrJeXFhNNFf2O1dlsXM rDGFfjj8apqtpc+CdMubjS2ZLK5DTQSW2WjXcdwC45HI6da9YGjRjOJpOetH9jRZz50maPaw1V/w 82/1D2c+39WseXapqOm3Pg+6+z6VcW2nySiOMRWxUyjPJCKMr6c0ItnFrF5p+j2kltJNpmE8uAxo z44y2MbsV6j/AGNHnPnSZ9aP7GixjzpMUva077/1awezn2/q9zyjT5dGubrSbXR9PmttRgkBmka1 aMgAHducj5smohJ4XuPGt41xps7PIqwpmyfy2fJyTxjP+1Xrh0aMjBmkIpf7Hjxjz5cfWn7WndXf 4B7OZ5Z4q1HSLLVNNja0ne6tJ0ZpY7NpCsf++Bz9KveIpNNvLTStZnsPtVnHNvffbb3VGBH3CM9c cV6KNGjAwJ5BSf2LFnPnSZ9aPbQs7vrfYPZy7dLf195wItbPxF4bkjt9KFtbq++0SSILuK8hgv8A Dk8c807QFTVLubX5LVI5nQW8RKYYKv3uev3sj6Cux1HwnY6taNa3kk7RMcnZIUP5jmm6Z4Q07R7J bOxaZIFJIVnLnJ9zTVaHNdidKdihXBWF/wCHf+Ex1EvpbbpmhWCRtObG8AhiDjjnvXrH9iQ/89ZP 0p39jx4x58v50OtByTuCpTs0eValLo1lqerxa3p01xeXLlreT7K0w2FcKFYA7ec1B4h/syPTtCtd ZtbmaZDG7vFA7usY6guoz9R3r1saNGBgTSCgaNGOk0gqfaQta/bp2K5J32OU0dNPFgs2mW/kW03z hPLMf/jvama/LFDoN480U8sXl7WWAZfB4yB3x1rrjosROTLJQNFhByJZKuVem42uSqU07njvhbTr Z9bln0yW5udtk8RnuLP7MYWIwoUADdnufaqei6dYQ6rp8V3qmqx6hBON8Q04KGcHkNKo5U+5r246 NE3WaQ0v9jR4x58uPrUKpTTTvt/ncbpzafmeTXx0SC51Sz17SJ7u9uZS0bLbtJ5iH7gVwPk9Ks3s 9joupRvc6TMIrqw8pYkg80sw6I5A/U16eNGjAwJpAKBo0Q6TSDNL2kLb/h5NfqPknfb+tH+h47e3 WmTfDy0t73T7kOXKLELVi8RDZIGB8vHcV0NrP4attAmvbaxddPYCKRDaMWftyhGWPvXoX9jR5z58 v50n9jR5z50mfWq9tC7d9/IXs56HlXh3V9Mfwvf2P2W4VYhNIYXs2VdhPGARg/SodKbR9OHhhrSw mgkdmDutqwbbzw5xnGcda9cOjxnrPL+dJ/Y0fP76TnrQqsOr7fgDpzfTv+J4pqiaXHp0mnajpsr6 wL3dJObckMC+QTJjBXaRxmvTgqooVVCqBgADgCrE/gLR7rVF1Gc3L3CkMAZ28vI6fJ0/StT+xIf+ esn6UU60Iqz/AK6BOlJs878c3emxaO1veWr3FxIpNuEtTLtI75A+U0t9PZ+IvBUrQWr3CxKn7ue3 KtuXGcKw9M16INGiXpNIKDosROTNITR7WDvrv5Aqc1bTY5XwNf6de38o0nSmtLVU+aU2/kh37rtw Dx613tUrbTktp/NEjsQMfNV2uetNSldG1KLjGzCiiisjQKKKKACiiigAooooAKKKKACiiigAoooo AKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigA ooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACi iigAooooAKKKKACqOr6aNX09rNriWGOQjeY+Cy91+hq9RQBlaToFrolxcGwLRWs2CLVQBHGw4JUd s8Vq0UUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFF ABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUA FFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAU UUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRR RQAUUUUAFVb/AFGz0y2NxfXcFtFnAeaQIufTJq1Ve8sbXULcw3dtDcR9Qk0Ydc+uDSle2g0ZXhvx NYeILNWhvrOW5y2+KCYMVAYgHGc9BW7WN4e8O2eg2SxxWtok+W3SwwhCwLEgZxnvWzVO19CVcKKK KQwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKK ACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA KKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAo oooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACoLu9tdPtzcXlzFbwgg GSVwqgnpyanrm/HV1Y2vhO7/ALQ0qbVIZF2C0hiLs5PTp0+tKTsrjSu7Gv8A2xpvmvF/aFr5iR+a yeauVT+8Rnp701Nb0mQ24j1K0Y3JxBtmU+b/ALvPP4V5t4RZNB1HUIdf0+e+1FrJXOoR2bbJIQvE OMdQOMd6z/DCxafr2k399olz/Z9w0v8AZVsLRt2lZPIfj+I9+1Vb3rf11/r7/Im75bnq51/R1ikk Oq2Qjify5GM64V/7p54PtUj6xpkc0sL6harJEnmSI0ygovXcRnge9eP6n9nuNdvNXTQLo6BHfxrc 6b9jYPdTjpcDj7o9O+Per/jPbrOvTtpOl3EJt7AtfztZti+gPP2dePve/wCFTfRP+tr/ANeXnoVb Vr+t/wCvn5anqA1rS2NuF1G0JuRmDEy/vR/s88/hU1pf2d+rtZ3UNwqNscxSBgp9DjvXmGt3Fpq+ j+G7HQNFudO1FsGyupLJtunbRzu478jHvmul+G8tn/wj8lrbaVPp80EzLcCWEp5smeZAT1B61Vt/ Im+3mddPcQ2sDz3EqRQxjc8jsFVR6kmq0esaZLLBFHqFq8lwu6FVmUmQeqjPI+lRa/dWtnoV5PeW j3dusR328cfmGQf3QvfNeY+Col03xJpkupaTcOt3bt/ZbC1YDTIif9Q5x196UdZW/rr/AF/Su5aR uewVRfWtLie4STUbRHthmdWmUGIf7XPH41erxzxii6n4j1Sex0e4W1s4VGqp9kbOqJu4jQ46qec9 80r62HbS56t/bGmGWGL+0LXzJk8yJfOXLr/eAzyPeoxr2jmCOcapZGGSTy0k89drP/dBzyfavO/E s0WtyaDa+H9MnsNRWAyQ30lk221i24aI8dWHGKqy3mkTfDex06z8LXlvcPOIoIms2/0afP8Arzx0 B+b36VXf1/W39efkT2/roerW+oWV3PNBb3cE00JxKkcgZk+oHSrNcD8Otlpc6tp93YyjWEm3XmoG 3KJet/fUkdPau+otogTCiiikMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKK KACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoooo AKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigA ooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACivMPGGsa1o3iG5srPW5jHqMSiNhGpTSmz 9+Tj7rDpnvmrvivUdV8NR6PfQ6tc34EfkzWMKKZLskf61eOx5PbFK/u8wW1sehUV5xcSa1afDq21 I+LDPexOLhpY40xcjP8AqAMdT0HfNS6Bdavrvh3W9Sl8Qy2Dzkm3hlRA2mgDOHyOvrntTel/L+v6 /wCGBa28z0KivNvBWr6x4i1ZpLrVp7eG2tPJNpLGqtcvyDcLx9w9qpaTquu3Xie30B/EUxjtLp3f UGiQJfp2hQ4xuXocehp295L+v66/8EV9G/6/rp/wD1aivK/Eera5YeJbzRrbxBMqXzxvFeeWpj0w Z+ZJDj+L+HNX/Geq6t4bvbK5ttVubtJ7c27WUUallbHFyeM7QevbkVN/d5v6/rp/wB9bHotFed6r caxo/grSdTHiV725gdZJhCiE6iD1jQY6+mPejTZNY1LwRqmoyeKmtLiaRpYXeNB9hAPETj17Gm9L +QLW3n/X9f8ADnolFef+A9X1XxFqdzqF5fTwQRwpEulTxqsgYdZTxnDdq9AptWEncKKKKQwooooA KKKKACiiigAooooAKKztfiml0K8W31H+zZvLJS7wMREc5OeMetcP4K1fWPEWrNLdatPbw21p5JtJ Y1Vrh+QbhePuHtQtW0D0Vz0mivKdI1bXbvxPb6DJ4imMdndO8moNEgS/TtChxjcvQ49DTvEera5Y eJbzRbbxBMqX0kbxXnlqY9NGfmRzj+L+HNC1tbqD0vfoeqUV514z1XVvDd9ZXFrqtzdpPbm3ayij UsrY4uTxnaD1+orrvDEd1H4cs/tmqDVLho9z3agASE+mO1C1TYr7GvRRRQMKKKKACiiigAooooAK KKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoo ooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiii gAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKrahcTWmnz3FvatdTRo WSBGCmQjsCeKTdlcNyzRXH6P47bWtSsLO20a43TwtLct5ikWbA42Seje1V/+Fgz+etn/AMI9df2i b37K1mJkLqvXzv8Ac96q2tv63sK5ry+B/Ds8upyS6fufVFCXhMr/AL0DoDzx+FLB4J8P295aXcdi RPZwmCBzK5MaHggc+9Z2seO30S/1C0udFuC8ESyWuJV/03JxtjH94dxXU2M8t1YwTz2zW0siBmhc glCexIpJaabf8P8A8Ebeuv8AW3/AOej+HXhaKzt7RNMxb28/2mKPznwsn97rUs/gPw3cvqLy6fuO pEG7/fOPNPvzXSUUAc//AMIT4f8AttveCwxcW9v9licSuCsX93r0qBPh94YSys7NNNAgspjPbqJX /duerA56109FF9b/ANdw6WOak8A+GpoNRhk00NHqLrJdgyv+9ZTkE89qlTwT4fjvvtq2J+0fZjab zK5PlEYK9eldBRR0t/XYLnMw/D/wzbx2EcWnbU0+TzbVfOfETeo5pJfh74XmgvoJNNzFfS+dcp5z 4kfOcnn1rp6KAMa38K6Na62NZhtNuoCEQed5jElAMAEZwa2aKKLhYKKKKACiiigAooooAKKKKACi iigChrGjWGvabJp2pQeday/fj3Fd35Gs7/hCfD/22C8Fji4gtxaxuJXBWIfw9enNdBRRYLnMJ8Pv DCWVlZppoWCymM9uolf9256sDnvTpPAPhqaDUIJNNDR6i6yXQMr/AL1lOQTz2rpaKAOfTwT4fjvf ti2J+0fZjabzK5PlEYK9elX9F0PTvD2nLp+l2/kWqElY95YDP1JrJ1zxedB1cWl1pkotXt2ljvDK oR3Uf6oZ/iPb1qCXxpdW+i6Vqt14fuoIL2QJN5kqg2ino0nt/KhO/wDXm/1uD0/ryOuorkIvGt5c aDqWrW3hu8mjs5ikSLIublAeZE9u/vVnQvFw1/WJbS106U2kUCSNfCRWjLMPuDHVh3oWoPQ6aiii gAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKA CiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAK KKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKqXGp2FpdQ2 tzeQQ3E+fKieQBnx6DvQBbqlq0eoTaXcR6XPDBeshEUsyllU+pAqL/hIdFFs1z/atl5Cy+S0nnrt D/3c56+1TwapYXN5JaQXsEtzEA0kSSAsoPQkdqTV1YE7O5xeh+Cdc8P6la3llqNiGmjJ1YNG5+2T E/6zrwarr4F8SLfjWxq1h/wkButz3flPtNt/zxxnp716PRVX1v8A1/X6abCtpb+v6/XU8+1rwRru u6pdahd6lY+fCg/shljYfYpONz9eSf6Cu20yO+i023j1KWKa8VAJZIVKqx9QDVuiktFYb1dwoooo AKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigDivE3hDUvE+shr27s 30eGItbWrI25LjHyykjrj096guvCvinVdC07SNV1ewuLdHxqGImBu4x0X2967yihKysD1dzg4PDH i+w8PX+kafrdhBG0mLF/JYm2hz9z3wOhq14X8I6h4X1Z0srmzj0KSIZskRtyzY+ZwSe57V1V7f2m m2xuL65htoAQDJK4VQT05NQf21pZmkhGo2vmxxec6eauVTruI9PehOzv/X9dfxBrS39f1/wxforO TX9HlNsI9Us2N0SINsynzcddvPP4Vo0AFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAU UUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRR RQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFF ABRRRQAUUUUAFFFFABXAfEMPfXel6Xp9lMmrvLvttVFsXSxx1YnHcZGPfNd/RSauNOx5FHd6bF8N rnTX8I3zz/aDC9v9kb95MT/r846Z+bP4Vs/D+N9O1rUtP1Oynm1khHm1f7MUjul2jAB7bRxivRKK pOzb7/1/X3EtaJf1/X/DhRRRSGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFF FFABRRRQAUUUUAFFFFABRRRQBznjm6tLbwrdi90ibVo5V2C0hiLlyen0+tcZ4RJ8P6hqMOu6bdah qDWaudRSybbLEF4gxjqo4x3r1aikla/n/X9fcN628v6/r7zxnwvGNP8AEGlX17oN0bC6aX+zLYWh zpIJ5DcfxHnPavZqKKq+iRNtbhRRRSGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUU UUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRR QAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFA BRRRQAUUUUAFFFFABRRRQAUUUUAFcf491PWLLSpY9P0WS7haMF7lLpY/LOemDyf/AK9dhUN1aQXt s1vcxiSJ/vKe9LsBhf2z4gGjpcjws5vDJtNp9ujyFx97d0/CpLTV9em0+7nuPDL29xEB5Nub2NvO 9fmHC4963wMDA7UUwOe0vWfEF3dNHf8Ahd7CEIWEpvo5MsOi4HPPrUVrrviWa+ihn8IPBAzhXnOo RNsX+9tHJ+ldNRQBzV9rniS3vpYbXwi91AjYScahEm8eu08ipdU1jX7SaNLHww99G0YZnF7HHtbu uD1x610FFHQDAudX16LS7W4h8MvNdyE+da/bY1MPp8x4bPtRDrGvyaTcXMvhh4rxHAjtPtsZMg7n d0H41v0UAYGmaxr1204vvDD2ISItGTexyeY3ZeOmfU1FYa54jub+KG78JPaW7Nh5zfxPsHrtHJrp KKAOYm17xNHevFF4PklgD7Vm/tCIblz97HX8Km1XWfEFnemKw8LvfwBQRML6OPJ7jDc8V0NFAdTn 73WNfgs7SW28MPczSpmaEXsaeSfTJ4b8KUavrx0Vro+GXF8JNosvtseSv97f0/Ct+igDn7DWNfuY Lp7vww9pJFHuhQ3sb+c393I+79TSaXrPiG7v0hv/AAs9jbkHdOb6OTbxx8o5roaKAOXXXvExvREf B0ggMm0zf2jFwufvY69OcVLqWt+IrW/khsvCj3tuv3Zxfxx7v+AnkV0dFAGBqOr69apbGy8MvemS INKBexx+U393nr9RSPrGvro8V0nhh3vWcq9n9tjBRezb+h+ldBRQBgWmr69Np93PceGXt7mIDybc 3sbed6/MOFx703S9Z8QXd00d/wCF3sYghYSm+jkyw6Lgc8+tdDRQBzNrrviWa+ihuPCD28DPtec6 hE2xfXaOT9KL7XPEtvfTQ2vhF7qBGwk41CJN49dp5FdNRQBxHjXV9dtrSOO08PSTwl4WM63iJhtw ymOvtnpXVaVdXt5YrNf6ebC4JOYDKsmP+BLxU11aQXsPlXMYkjDBtp9Qcip6FomvP/IHuFFFFABR RRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFF FABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUU AFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQA UUUUAFYni28ubDw7PcWspimUrhgOnNbdYHjKCa58M3EUETyyFlwqDJPNHVfIDeQ5RSfSlpE+4v0p aGCEIypGcZHUVw2maZqieObi3l8T6pPa28aTiCTZtbcT8pwucV3JztOMZxxmuP0/RfFkHiqTVLrU dJe2mCxyRR27h/LBJGCT1oXxA/hZga5fPb+KtaiuvG9zpvkKktpabowHJXOACMsM8V6Lpc81zpVr PcJsmeMM4965tfDOqHxndarO+kT2Fwy5jltS0yKowNrE4zXX0L4Ql8Rx3i7V77RNe0Wa0N1ci4Mk P2CLAWZ8AqSSPl789KtxeLJhpOoz3mlPaX9gu6W0knXBGMgiT7uMd+1N8TaHrep6ppt7pOo2tobH ewWaIt5jMMYOD92qs3hPVb/S7ttR1C2l1WeSNwVjItwE+6hXOSp7jPOaSvZje6LPhbxtb+JWvIvI SG4tVDukNws6lT0IZeM+1ZulfEpNV1+30yLSiRPIyrJHdJIyKucs6DlR9fWpdG8L+ILDU7y9nv8A S4/tNsYfLs7UxrE4+6y/1zS6X4V1sataXesXOkstqxkD2NqYpZXxj5znkckkeuKrS6J6MpXfxY0y 01SWFoYTYxT+S9yLxPMBzg/uvvHB4rW13xLepJeWel6Td3ccEX+k3cEqo0BIyNqsPnIHOBVN/CWs WeoSHSm0JrJ5TKovbIvKpJywDDHGc4q7qOieIo9QupdC1Kxt4bwAzLcQs7I4G3KYPHHr3qNeXzKf xaGh4QvJr/wlpl1PM88ssAZpJBhmPqR61Z17VjomjXGoCATeUAdjSiMHnHLHgVB4V0q90Tw9babf XMVxJbgossSFQy9sg96b4o0WfW9OiitZYUnhmWZBcIXicjPDqOo56ewq576Cj5mfoPjqx1nTL+7l RYGsP9ekUyzqBjIwy8H6UWPizVbjU7O3u/C17a212SYrnzVcKMZy4HKcdjVPSfB2qxSamuqXmntb 6hCEaKyt/KETDpt9u/Per+m6X4r+2wf2rrNo9lB0W1hKvNxgbySR78Y5o6i6FWbxtfhjcWnhi9u9 L84RLdxSLuY5xuEf3tue9Vdd+J1nouq3FmLaGVbUD7S73qRMh6kBDy2B6Vbj8P8Aie1f7BZ61aQ6 OJMofJJuETOdobO326dKbqfhTVBqs93pD6OyXJDyrqNp5rB8YypGOoAqexWl2Ta946tdI0/Tby3t 1uU1BPMiMs6267cZ5ZuM4PSmr47jPgxfET6bLEryeWkMkqqG+bAbf0Cnrmn6zoviK7+x/YrnR/Lj gCTW93aGSLzP7yDOR6VG3hjWbXw5bWOm39ktyJmluVuIC8Em7kqF7KD0HbFN9RLoW/CPi7/hKlvC LA2wtmVPMWZZY5CRk7WXg4710tc94X0G60j7ZcX8lq11dMu5LOMxwoFBA2qehOeT3roabErhRRRS GYXiu9ubHTIZbWUxO1zEhIHYsARW7XP+MIJrjSoEgieVhdRMQgyQAwya6ChfC/X9ED3Xp+rCiiig AooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAC iiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKK KKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooo oAKKKKACs/WtVXRtLkvniaVUIGxTgnJxWhXOeOf+RVuf95f50dUB0QOVB9RS01P9Wv0FOoAKKKKA CiiigDB8Ta7qGhRW8lloraksr+W225WLYT0+91zWkb9bbShfakEsQsYeYSSArF6gt049awPHOqJY 2lnGbK/uWa4WT/RLZpcBTznHTrUcXi+K/g1C4n0fUTpkKquyWwfzJGPUBD94UlsxvdHQ6RqSatp6 3kfleW7EKYpRIrAHqCKhg8SaJdXxsoNWs5LoNsMKTKWz6Y9a5XwVrMX9jX9kmj6lC8RmuFiltGhV 1JyFU9Mn0rA8OaZbXPinS57G11ljbyNI8WqWgjjt1IOSjgDcwJwMk8E1VvesS9E2d9F428NTajJY JrVn9qjl8oxGUAlvQetX9R13StIeNNR1G2tWl+4JpQpb6Zrkpp4NE8S6hD/wjUt5dXcyS2rw2o2H IAO6TGEOQTzWb45Szu9dljubfX4JRbiMS2FoJ4pgRnBJU4IPHGKm+iKtq0elwXEN1Ak9vKksLjcj ochh6g1JWT4YtJLDwzp1rLbx20kUCq0Mf3U9hWtVSVnZEp3VwooopDCiiigAooooAKKKKACiiigD O1nVk0e0juHhaUPKkWFOMbjjNaNc342/5A9v/wBfcP8A6EK6ShbX8/0QPf5fqwooooAKKKKACiii gAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKA CiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAK KKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKparc31pYPLp2n/b7gEbYPOEWR3+ Y8Vyng3VfEE8F4l14eMMYmmZZDfI+Xz9zH6Z6ULW4HcUVzdhrPia4v4orzwmLS2ZsPP/AGjHJsHr tAyaZPrfilL14ovCAlgD4Wb+0o13LnrtxkfSgDp6K5/VdW8RWl6YtO8MC/t9oIm+3xxZPcbSM8Ut 5q3iGGztJbXwyLmeVczw/b0TyT6ZIw34UAb9FYA1XxCdGa5PhoC/Em0Wf25OV/vb8Y/Ciw1bxDcQ XTXnhkWkkce6FPt6P5zf3cgfL9TQBv0Vz2l6v4jur9ItQ8LixtiDun+3xy7eOPlAyahXW/FRvBEf CAEBk2mb+0o+Fz97bjPTnFAHT1BeWVtqFs1vdxLLC3VG6GuN8UqfD2oLq2lamYNRu2CnTnJkS8I6 7V6hsY5HA70eLtX8RJ4bzH4cJMkQaYi/QGBs/d/2vqPWlcDuQMDA7UVzo1fxGNHS4HhcG9Mm02v2 +Phcfe34x+FPtNV8QzafdzXPhoW9zEB5Fv8AbkfzvX5gMLj3pgb9Fc/pereIrq6aPUPDAsYQhIl+ 3xy5bsMAd/WobXWvFEt9HFceERBbs4Dz/wBpRtsX12gZP0oA6aiuavta8TwX0sVp4SF1bq2En/tG NN49dpGRU2qat4htZo10/wAMi+jaMM7/AG+OLa3dcEc49aOlwN+isC51XxDHpdrPB4aE15IT51t9 uRfK9PmIw2faiHVvEL6TcXEvhkRXqOBFa/b0PmDud+MD6UAb9FYGmar4humnF/4aFkEiLRn7cknm N2XgcZ9aisNZ8TXF/FDeeFBaWzHDz/2jHJsHrtAyaAOkormJtb8UpevFF4QEkAfCzf2lGNy567cZ /Cp9V1bxFaXpi0/wwL+3Cgib7fHFk9xtIzxQHWx0FFYF7q3iGCztJLXwyLmeVMzw/b0TyT6ZIw31 FA1XxCdGa5PhoC/Em0Wf25OV/vb8Y/CgDforAsNW8Q3EF0954ZFpJGm6FPt6P5zf3cgfL9TTdL1f xHdX6Rah4XFjbkHdP9vjl28cfKBmgDoaK5hdb8VG9ETeEAIDJtM39pR8Ln723GenOKk1LWPEttfS RWPhUXluv3J/7Qjj3f8AASMigDo6KwNR1XxDbJbGx8NC8aSMNMPtyR+U3deR831FD6t4hXR4rlPD Ia+Zyr2n29BsXs2/GD9KAN+isC01XxDNp93Nc+Ghb3UQHkW/25H871+YDC496TS9W8RXV00eoeGB YwhCwl+3xy5bsuAO/rQB0FFcza614olvoorjwiILdnw8/wDaUbbF9doGT9KW+1rxRBfSxWnhIXVu rYSf+0Y03j12kZFAG7d2VtfxLFdQrKisHCt2IOQasVxHjbVdft7SOO08PmeEvCzTi9VMNuHyY6+2 a6rS7m+u7FZdQ0/7DcEnMHnCXH/AhxQtU35/5A9y7RRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRR QAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFA BRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAF FFFABRRRQAUUUUAFFFFABRRRQAVDbWkFmjJbxCNWcuwHdj1NR6hqVlpVo13f3UVtbqQDJK21QT05 rE8M+MdL8QNLBDqVlNdLK4WKGTJKA8HFC1egPRHS0UUUAFFFFABRRRQAUUUUAZ0Og6XBq02qx2Uf 26bG+ZssePTPT8MVburWC9t2guYxJE/3lPQ1NRQAAYGBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAB RRRQAUUUUAFFFFABRRRQAUUUUAFFFFAENzaQXkXlXESyRhg20+oORU1FFABRRRQAUUUUAFFFFABR RRQAUUUUAFFFc74q8W6d4bs3E+oWcF4VDRxTvgsM4zj86LgdFRWL/wAJb4eGmrqDazZCzZ/LE/mj YW9M+tPt/FWgXdlcXlvq9nLbW2DNKkoKx56ZPagDXorGsPFnh/VJ2gsNYs7mVULlIpQxCjqfpUdv 4z8M3d3Ha2+u2EtxI2xI0mBZm9AKAN2isK68Z+GrG6ktbrXLCGeNtrxvMAyn0IqW/wDFegaXKkV/ rFnbSOgdVllCkqeh+lAGxRWRP4q0C2sLe+n1ezjtbjPkzNKAr464Pekj8V6BNp0uoR6xZvZwsEkn Eo2KT0BNAGxRWRY+KtA1MzCx1ezuDChkk8uUNsUdSfao7Pxj4b1C7jtLPW7Ge4kOEijmBZj7CgDb orBk8a+GIbpraTXbBZ1bY0ZmGQ3TGPWpdQ8WeH9Kuja3+sWVtOACY5ZQrYPTigDZorHuvFegWVtb 3F1rFnDDcrvhd5QBIPUetKPFWgHTDqQ1ez+wh/LNx5o2bvTPrQBr0Vj2nivQL+G4mtNYs547ZN8z RygiNfU+gpLDxb4e1S7W1sNZsrm4YErHFKGY468UAbNFYK+NfDD3Itl16wM5fYIxOMls4xj1zT73 xh4c027e0vdasbe4j4eOSYBl+ooA26KyL3xVoGmiE3ur2duJ0EkXmSgb1PceopH8V6BHpseovrFm tlI5RJzKNjMOoB9aANiisi38VaBd2VxeW+r2cttbY86VJQVjz0ye1NsPFnh/VJ2gsNYs7mVULlIp QxCjqfpQBs0VhW/jPwzd3cdrb67YS3EjbEjSYFmPoBRdeM/DVldSWt1rlhDPG2143mAZT6EUAbtF Y9/4r0DS5liv9Ys7aR0DqssoUlT0P0pZ/FWgW1jb30+r2cdrcZ8mZpQFfHXB70Aa9FYyeLPD8unS 6hHrFk1nE4R5xKNisegJ9ap+GPGGmeIfMhh1KymulkcCKGTJ2A4Bx9KN3YPM6WiiigAooooAKKKK ACiiigAooooAKKKKACiiigAooooAKKRywRiq7mA4GcZNctoPiy81PXbvStR0VtOkg+5J9oWVZTjJ AIHYULV2Dpc6qisx/EejR20lw+p2qwxzeQ7mQYWT+6fequp+MvD2jahFY6jq1tbXEkfmKsj4+X1z 70AbtFYGo+KbfT30+4KxPpV0CWv/ADwEi9DjuD61oW+taZdaW2p29/byWKgs1wrgoAOvPtQBforK tPEuiX9lcXlpqlrNbW4zNKkgKx/U9qLHxLomp3ps7HVbS4uQu8xRShmx64/EUAatFc9F458MTalL p661afa45fJMRfBL+g9fSreoa/aWOp2mnefbG8uGAELzhH2/3gD1+lHbzA1qKqajqljpFqbrUbuG 1gBAMkrBRmq6eItGl02TUU1O1ayi+/OJAUX6mgDTorNh8QaRc6VLqcGo28ljECZJ0cFVx1yaraN4 u0DxAyppeq21zKyb/LR/mA9xR1sHmbdFZNnr9pqGs3Gn2k9tN9nTMpjnBdGzjaV6j60/UfEWjaTc xW2oana208v3I5ZApbtwKO3mBp0Vlah4l0TSpTFqGq2ltIFDlZZQp2noasPq+nR6WNTe9gWxKBxc Fxs2noc0dLh5F2iqGma1pmso76bf292qY3GFw2M9M1NaX0F6ZxCWPkSmJ8jHzAA/1oAs0UUUAFFF FAEc0ENxGY54klQ9VdQw/I1maJoNto8cuyG38x5nkDxxBSAxzjiteq1lfQX8TyQElUkaNsjHzKcG hAWaKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiii gAooooAKKKKACiiigAooqOeZLa3knkJCRqWbAzwKG7agSUVFbXEd1axXERJjlQOpIxwRkVLQ1YAo oooAKKKKACiiigAooooAKyte0O31vT5IHig81gAsskQcqM570sPiHTptam0gytFfRjIilXaZF/vJ n7w+lSa3qq6Npcl60LShCBsBwTk4o7ATf2bY+QIDZWxiByE8pdufXGKVNPso4nijs7dI5PvosSgN 9RjmrAOQD60tAFaHTrG3ffBZW8TEYLJEoOPTgU1NL0+OQSJYWqupyGWFQQfrirTMFUsegGTXI2vi /U7q9gMfhud9MuLjyI7yO4ViACQWZMZUcULewdLnSSaXp8sjSSWFq7sclmhUk/jinTadY3DBprO3 lYDALxKSB6ciqlx4k0W01NdNuNUtYr5yAsDyAOSenHvUmp65pWjCM6lqFvaeacJ5zhdx9qOgE76f ZSQpC9nbtEn3EMSkL9BjihdOsVhaFbO3ETHLIIl2k+4xUEuu6VDpa6nLqFsti3S4Mg2Ht1pkXiPR p9Om1CHU7V7OH/WTLICqfU9qALUWnWUG7ybO3j3Da2yJRkehwKbFpmnwyLJFY20ci9GSFQR+OKj0 fU01fTkvYzEY3J2tFKJFYA9ciorPxJouoX0tlaapaz3UQJeKOUFlA65FHUOhZbStOaQyNYWpcnJY wrnP5U6bTrG4k8yeyt5X6bniVj+ZFZ8Xi3w9PeRWkWs2T3ErbY41mBZjnGAPqK2aAK0mnWMqIkln bukYwitEpCj244o/s+y8jyPsdv5Od3l+Uu3PrjGKy/FGt6joOn/bLLR/7RjQFpsXKxFB68jmqV94 o1bT/CserzeHv9JeVUNoLxOFbgNvxjqRxQB0MenWMKusVnborjDhYlAYeh45pIdNsbeQSQ2VtE46 MkSg/mBWVoviG6vL6TTtW0ttMvwnmJGZhKsieoYcZB6it+gCoNK04SeYLC1Dg53eSuc+vSll0ywn kMk1jbSSHqzxKSfxxVqigCtLp1lOFE1nbybBtXfEp2j0GRQdOsTAsBs7cwqciMxLtB9cYqzRQBWT T7KOJ4o7O3WN/vosSgN9RjmiHTrG3cvDZW8TEYJSJQcenAqzRQBUTS9PjkEiWFqrqchlhUEH64ok 0vT5ZGkksLV3Y5LNCpJ/HFW6KAK02nWNwwaazt5WAwC8SkgenIofT7KSFIns7do0+4hiUhfoMcVZ ooAqjTrFYGgWytxExyyCJdpPqRiqeiaFb6PDIEit/MeV3DxxBSAxzjitUnAJ9Kz9G1VdYsmuVhaI LK8W0nP3TjNC3DoaNFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBV1K8/s/Tbi78mabyk LCOFN7t7AdzXlNpP4lsbbSdauFnmtxfO72kWluLlQ5O8Mc9ADjPevYKKFo7h0seZ61eyWa69YReG 767kvds0Hl2uYyCvJLdAw5465rT1aWC3fRNZn0S5u7cWzRSIln5kyEhcbl6jofpXc0UdLen4aB1/ rqcJrM66ivhtL/w9dqjXPmm3SHzFhA+6XxwOxwazbyzl1bTfEdjY2GpWaJeJMoSHyvMRcbhHng5w e3Nem0Ud/wCu3+Qdv67/AOZ5d4dtdNhutSvki8T3E4sXjaPULMKjLxwqhQGbNS6b9ksLPwqLXw/f wOJm8wrZENGOQd56gZI616ZRTTs/u/C/+Ymv6+7/ACOEnnXRfEuoRL4amvbi7lSW1kith5f3QDuk xhOQTzTfGmrQxapp0f8AYep3NxbXEUzzW1iZAE6kBx/Ku9opLp5DfXzOK1u7iludJ1+40a9vNPET L9n+zlpYnboxi+gI9s1m3irJ4XvZtK8O3WmWl1eK1xsgzcOmPmkWLs2QBivR6KP6/G4HmvgWArqW s2xs9Ya3uo1eKXU4AokwMEEAADntjnrWn4TvTBJbaTF4cuIJ7dCl1dPbiJFxwCrY+fJ9K7eincVj zqHxDbR+PGuo9A1mOKSD7O0q6cwBcuOSfT3qTUJrPStU1iLUvD99fzXz74Z4LMzrsK4Clv4cEH86 9BoqbaJf1rqVfVs88js4I/EGgQaho1zcy21gwMxtt8cZI+6W7kYxzVN54ZvBRgm0XXI4DfvgW9tt mhG7crKhzlegr0+in/X43EtP68rHnng3QmlstaNu+p2UV46bL24jEN2xA5yMYAHAHHc1c8K+Fr7T 7++uLjXdZlUXDhYrh12SAqPn6cn/AArt6KOt/K35Ctocxa+Ebu2vorlvFeuTKjhzDJMhRvYjb0ov /CV3e301ynirXLZZG3CGGZAiewBXpXT0UDOe1Twzc6lNHJH4j1eyCRhCltKoDEfxHKnk0tz4aubj SrWyXxFq8TwElrmOVRJLn+8duDj6V0FFAHOxeGLmLSJ7E+JNYeSVw4umlXzY8dlO3GD9KzvBfhu9 0pp7i51jVpx58oEF067GGeHwB1NdnUUFzBdIXglSRQxUlTkAjqKaetwe1iWiiikAUUUUAFFFFABR RRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFYH ivRbjWNMdbfVNQsmjRzts2A83I6HIOf/AK9b9MlljhiaWVwkajLMxwAKmSurDT1OV0XwveQ+GFs5 PEGsiWaKM+Y8i+ZBgDKr8vA7c5q7pnhq505rgyeI9XvPNiMYFzKp8sn+JcKOa3o5EmiWWNg8bgMr A5BB706rk7tslbHNaf4UurHUIrp/FGt3SxnJgnlQo/sQFFRzeELuW9e4HizXY1Z9/kpMmwc9B8vS upopDOd1Xwxc6nfG5j8SaxZKVA8m2lUIMd+VNLe+Gbm8s7OBPEer27W6bWlhlUPN7vleTXQ0UAc+ PDVyNFOn/wDCRauZDL5n2syr5wH93O3GPwpLDwzc2VvdxP4j1e6NxHsV55VLRf7S4Xg10NFAHOaV 4XudNv0uZPEus3qqCDDcyqUOR3AUVCvhC7W9W4PizXWUSb/JMybCM52/d6dq6mijzA4jxRFL4mvh otpo0hkgdWk1O4Uxrb9w0Z6uevA4Herfim1ax8DtbPdTXTRlAZpyC7/N1JFdZVPU47CSxddSEX2U kbvNOFz2oWlvUC2v3F+lLQMY46UUARzu0VvJIsZkZVLBB1bA6V5lYfYdR16xvNI8O6xo+ryXKyXc ksDpEY8/vFJJ2nPsK9RooWjuD1Vjx7XNCii1fVYNVfxQy3Vw0qnToBLGUY5ADbSVI6YzWt4ujs5L 21hms/EkflWgWO60+3EvmKequCDgjAr0uilbRL+uw763PMr2ySw8D6Fp97pepxhWLh9Kh3yW5BJU spB5YHnjrmrfhaOHQfDep3k2mX89ncXG9FktN11OCMEyRj3yBx0AruZNRs4r+KwkuYlu5VLxwlvm YDqQKs0273ff+v0Fa1l2/r9Tz3wteSX/AIa1PRrfS9Ssbl1neI3NqYUwxO0A9M80ywmsr6fSLCw8 O39jdWcoeSeWzMaKqqQ3z/xZP516LRR1/roHT+up5W62aaBrFxD4b1BbqTUdy7bAiRuR8y98cdRX qMMgmhSUKyh1DBXGCM+o9afUc88VrbyTzyLHDGpZ3Y4CgdSaNo2/rZL9A3d/63uc1481H7J4entV sL+7luUKILS3MuD746Vl6/qpvvh9DNBpeqs/nQx+R9kbzRtIJO304PNdxbXMF7bR3NtKk0Eq7kkQ 5DD1BqWjVfevwC9zkdMvH8SeJ4NUisb60tbGB483kBiaR36gA9gAOfeuuooo6WDrcKKKKACiiigA ooooAKKKKACiiigBG+430rnfBP8AyA5f+vub/wBCNdGcY56VT02OwjtWXThF5PmMT5ZyN2fm/HNC 3B7FyiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoo ooAKKKKACiiigAooooAKKKKACiiigAooooAQ/dP0rnPBXGjXH/X7N/6FXSHkVmaHpTaPZSW7SiUv O8u4DGNxzihbv0/yB7f15mnRRRQAUUUUAFFFFABRRRQAVx3j6/1q10maPTtHW7t2jBe4+1iIoc9N uMmuxqK5tYLy3aC4jWSJvvK3Q0uwGD/aviUaOk48Mxm9Mm02v29MBMfe34x+FSWmqeI5dPu5brw5 HBdRgeRAL5HE3r8wGFx71vgYGBRTA57S9U8SXN00eo+G47KEISJVv0ly3YYA7+tQ2useK5b6KK58 KRQW7OA8w1JGKr67cc/SunooDoczfax4qgvporPwrFc26tiOY6iiFx67SOKm1TVPEltPGuneG472 Nowzu1+kW1u64I5x610FFHQDAudU8Rx6XazweHI5ryQnzrY3yKIvT5sYbNJDqniN9JuJ5fDkcd8j gRWv29CJB3O/GB9K6CigDA0zVPEdy041Dw5HZBIi0RF8knmP2XgcZ9ah0/V/FM9/FFe+Fo7W2ZsP ONRSQoPXaBzXS0UAcxNrPixL144vCcUluHws39pINy567cfpU2q6p4ktb0x6b4bjvrfaCJmv0iye 42kdq6GigOpz97qniOGztJLTw3HcTyJmeI36J5LemSPm+opRqniM6K1yfDkY1AS7RafbkwU/vb8Y /Ct+igDn7DVPEc8F2174cjtZI490CC/R/Nb+7kD5fqabpeq+Jrm/SLUfDMdlbEHdOt+kpXjj5QOa 6KigDl11nxYb0Rt4SiFuZNpm/tJOFz97bj05xUupat4nt7+SKw8Lx3lsv3JzqCRlv+AkcV0dFAGB qWqeI7dLY2HhyO7Z4g0wN8kflP3XkfN9aR9U8SLo8VwnhuNr9pCr2n29AEXs2/GD9K6CigDAtNU8 Ry6fdzXPhyOC6jA8iAXyOJvX5gMLj3pul6p4kubpk1Hw3HZQhCRKt+kuW7DAHf1roaKAOYtdY8Vy 30UVz4Uigt2cB5hqSMVX1245+lLfax4qhvporPwrFc26tiOY6iiFx67SOK6aigDiPG2p+IILSOO0 0FJ4C8LNN9uVCH3D5cYz7ZrXvri+uvB19JqVgtlcGF90ImEoA/3hW1c2sF5F5VxEsiBg21vUHIqP UrQ3+mXNoH2GaMoGxnGamS9yUe9/yRUXaafYg0D/AJF3Tf8Ar1j/APQRWjVbTrU2Om2toX3mGJYy 2MZwMZqzWk2nJtGcFaKTCiiipKCiiigAooooAKKKKACuc8c8+FbjP99P/QhXR1ma9pTazpMlksoi LkHeRnGDmjqvkBpL9xfpS0gGAB6UtABRRRQAUUUUAcN44hkn8QeHIbe+jsJp5JYjc4HmBSBkIezH tVe4v73SNN1jSRq13fyRtHFa3O8eeJJAMIzYwDnvjgGuq1fwvomvTJLqmnxXUkaFEZycqD1xg8Uk PhXQ4NFk0eLTolsJMl4cn5ie+c5z+NK2jG90zl/Bmoazbahq2m61cMv2aFZ1N1drPJHkclmUAAd8 VmaU3iq28VaY+pajcrZXU7DIukniuOCVCqoBQY5yT2rtLDwT4b0x2ez0qGJ2iaJmBYlkbqDk8ina T4M8O6Fefa9M0uK3n2ld4ZjgH0yTiqvqmT0aOCjn8d6nqc+o6ckp2XbIsTajGLcKrYw0WN2cc9e9 dDqcF/rWoas/9vzaYmnqEjgjI8tvk3FpQR8w57dq2b/wR4b1PUW1C80qKS6YgmQOy5I6cAgVLqvh DQNbu0utS02K4mRdquzMOPQ4PP41Nvdt/XqU92yLwM/meCNIbKEm3XJQYX8K6CqWl6TYaLZCz062 S3twxYRpnAJ69au1Und3JWiCiiikMKKKKACiiigAooooAKKKKACiiigBG+430rnfBPGhy4/5+5v/ AEI10RGQR61m6FpTaPYPbNKJS0zy7gMfeOcULdg9jTooooAKKKKACiiigAooooAKKKKACiiigAoo ooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAKmo6 nZaRZtd6hdRW1upAMkrYUE9KwfDvjjR9bS4UarZSTRPIdsT9IlP3j+FdNLDFPGY5Y0kQ9VdQR+Rr M0fQrfSoZkEUDNJK77liC8Mc7aFu7gyCz8aeGtRvI7Oz1uynuJDhI0kBZj7UyXxx4XgumtZddsUn R9jRmUZDdMVrx6fZRSCSOzt0cdGWJQR+lB06xZy7WduWJyWMS5z+VAGdqPi/w9pF2bXUNYtLacAM Y5JADg9DS3Xi3w/Y2ttdXWr2kUF0u6CR5ABIPUVoy2NpO++a1gkbpueME0r2NpIiI9rAyoMKrRgh fp6UAZo8W+H20o6oNXtDYrJ5ZuPMGwN6Z9aSz8W+H9QiuJbPV7SeO2TzJmSQERr6n2rT+xWnk+T9 lg8rOdnljbn1xRHY2kSssdrAgcYYLGBuHvQBl6f4w8O6reLaWGs2dzcOCVjjkBY45NRDxz4Wa6Fq NdsTOX8sR+aM7s4x9c1sRWFnBIHitII3HRkjANJ/Z1jv3/YrfdnO7ylzn8qAMHU9d1Tw/qMk9/Zi 50NyNtxbDL2/++vde+4dKf4i1gP4RfUtJvAVfaY54jkEZ7UX/hy91nVi2p6kW0iNg0VjAuwSe0p/ iGRkAYqTxbZSS+F5raytizZXbFEvv2FC2V+6Dqb6copPpWfruo3GlaTLe21n9reLBMXmBOM8nJ9K 0E4RfpVTVbL+0tKubMSeW00ZVXx909j+dKV7aDjbqZja/ejVjZjSwYpLQ3FvN54/eEAEqRj5evWs rR/Gup6hNZyXnh2SysLqUwLO1yrMJM4xsAzjI602y8L+KItTgvrzX7SZordrYRLakJtI4IGfvZ60 6Pwx4iTStMtTrFiZbS68+R/shw4zkADPH1qla/8AXd/pYl3t/Xb/ADL8+qX6eNrOwnspYrORX8md LlSspC5O5MZGO3NO1jxLeWmptp+k6Q+pTwxia5/fCMRIemCR8zHB49qz9W8P+LbzX4tQtNa02GO3 Zvs8clmWIDDB3HdzUuuaVrVrNLq+k6hFDNJAq3im1Mxk29CigjB5NTe0UV1Ymj+Mr3VF06dtEMFp fSvHHI1wCy7emVx3IIx2p1x41OnaJqV9qtgtpLZT+QIjOGV2P3PmxwDkfSsfw/peqal4L05LOS40 7UrC6d9+o2pHmEsSSVz0Oa0LXwbqZsdTg1LWI7qS7lW5ik8jBilHseqgjgelU1q/67f8ES/r8f8A gEnhLx9b+JtSn014oIruOLzgLe5E6FM45YAAHJ6V2Nc54e0rXbC7kfU7vS5oSmFFpZ+S2c9Scniu jodhK5zMWqX7eNxYXdlLb25gdreRblWSYDGSUxkH8ag17xDqXnXtlpOkT3cVvHi6uYpxG8RIz+7B HzMBz9ar3Xh/xfN4iTVItc0xEiDJFG1kxIRj0J3dferepaDr/wDaFzNomr21nDeAG4Sa3MhDAYyh yMcfrUa8qXr+el/l26lfaZiDx+uieFdBMzJdX97B5mb24EGVHUsxBGc44q4nxF+1eF01nT9Ka9KX P2W4himHyP8A7LY+ccjkUReCtVttF0+GHU7N9RsVaFJp7XfG8ROcMuevfINWrjw94judCis21PTI rpbkStJFZlUKDttz196t2bfr+F/8hbLT+tP8yzZeItWuLXUYrjQxbarax+ZHam6V1kUjj5wMDkGm +E9c8RaxBDLquhQ2cEkQcTx3avuP+7jIqxa6NqqeJL2/ur+2ks7iBYlhSEq6477s88k1W0Tw/ren XkS3WtJJptqGFvbwxbGYHgCQ5O7A9Mc0kJ7Emnapfz+MbuxvbKW1VIN8OLlZI5F3Y3bQMqaqXfiH xRH4putOs/DlvdWkUaOkpvVjYgk/Ngj26e1RJ4f8YDxJ/ara5phUr5TRiybPl7gcZ3deOtaGtaHr Nxqn23RtVhsmliENx5sO8lQeCnIweTQtkN7v5fp/wS5caxeW/iDT9ObTgbe7iZmufOHyOoyV245+ tLoOr3errePcaf8AZI4bhoYmEwfzQpwW4HFYXjS4m07Q7Wzt7bVb3UIwrQXMFuZSGXjLkevNdTpV tFaaVawQq6okYADjDdO/vQur/r+uguxcooooGFFFFAGD4svLmy0uGS2maJ2uYkLL3BYZFTeIfEWn eHrFpb6+t7WR1byRM2A7AdKg8XW091pUCW8LyuLqJiqDJADDJrU1HT4dRs5YJY4mLIVVpEDbcjrz Uu/I7d3+SHpzL0/VlHw54j0/xFp0c1nfW9zKsamcQtkIxGSK2apaXp0OmWEFtHHEGjjVGZEC7iBj PFXa0la+hKvbUKKKKkYUUUUAFFFFABRRRQAVzfizxfpvhqzdZ9QtIL0qHjinblhnGcfnXSVl65os Os6fJbukIkYACR4gxXnPel1QFf8A4TDw6NMTUW1mzFmz+WJ/M+Ut6Z9afbeLfD95ZXN7b6vaS21t gzyrICseemTWj9gs/JEJtIPLBzs8sYz64pUsrSON40tYFR/vKIwA31FMDM0/xf4e1a4a3sNYtLmZ ULlI5ASFHU1FbeN/DF3dx2lvrllLcSNsSNZQSzegrXisbSBt0VrBGxGMpGAcUi6dZI4dLO3Vwchh EoIP5UB0Mm78beGLC7ktbrXLKG4iba8bygFT6GpdQ8XeHtKmSG/1i0tpHQOqySAEqehrRfT7KRy8 lnbu5OSzRKSf0p0tjaTMGltYJCBgF4wcCjoBmz+LfD9rp9vfz6vaR2lzkQzNIAr464NJF4t8PTab NqMWr2j2cLBJJxINqsegJrTaxtHiWJrWBo0+6pjBA+goFjaLE0S2sAjY5ZBGMH8KAM2w8W+H9UMw sdXtLgwxmWTy5AdijqT7VHZeNPDWo3kdnZ63ZT3EhwkaSAsx9q1o7G0h3eVawJuGG2xgZHpTY9Ps opBJHZ26OOjLEAR+lHUDIk8c+F4bprWTXbFZ1fY0ZlGQ3TFS6j4v8O6Tdm11DWLS2uAAxjkkAOD0 rSOnWLOXNlblicljEuc/lSy2NnO++W1gkf8AvPGCaA6mbd+LfD9jbW1zdavaQw3S74HeQASL6ilH i3w+dKOqDV7T7CJPLM/mDZu9M+taT2NpIiJJawMqDChowQo9vSj7FaeT5P2WDys52eWNufXFAGZZ +LfD+oQ3M1pq9pNHbJvmZJARGvqaTT/GHh3VrxbSw1mzubhgSsccgJOOtaiWNpErLHawIrjDBYwN w96SKws4HDxWkEbjoyRgGgDHXxz4We6Fquu2JnZ/LEYlGS2cY+uaffeM/DemXklpe61ZwXEZw8ck gBFag06xD7xZW4YHO7ylzn8qWSwspnLy2kDuerNGCT+lAGdfeLfD+mCA32r2luLiMSReZIBvU9CP akfxb4fj0yPUn1e0Wylcok5kG1mHUA1pyWVpNt821gfaMLujBwPQUGxtDCITawGIHIQxjAP0oAzb bxb4fvLG5vbfV7SW1tsedKsgKx56ZNJp/i/w9q1w0FhrFpcyqhcpHICQo6mtNbK0SNo0tYFR/vKI wA31FJFY2kDborWCNiMZSMA4oAyLbxv4YvLuO0t9cspbiRtiRrKCWb0FF3428MWN3Ja3WuWUNxE2 143lAKn0NayadZRuHSzt1cHIYRKCD+VD6dZSOXks7dnJyWaJST+lAGdqHi7w9pMyQ3+sWltI6B1W SQAlT0NLP4t8P2thb38+r2kdpc58mZpMK+OuDWlLY2k7BpbWCRgMAvGDxQ1laPGsbWsDRp91TGCB 9BQBlp4v8PS6ZLqMesWjWcThJJxJ8qsegJqp4X8ZaX4i8yGHUrOe6WR8RQtzsB4OPpW8LG0ELRC1 gEbHJQRjBP0qlouiQaRDIqxwmR5XfekQUgMc44oW4dDVooooAKKKKACiiigAooooAKKKKACiiigA ooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACi iigAooooAKKKKACiiigAooooAKztb1UaNpUl8YTKEIGwHGcnFaNc545/5FW5/wB5f50dUB0SnKg+ opaan+rX6CnUAFFFFABRRRQBhaz4kTQ9Vs4byFI7CdHZ7x5QoiK44I989atwa/pF1pL6rBqFvJYR gl7hXyi465Nct47513QJJNDvdTtrSR55hBFvCDAAOP4jn+Gqdwl5d6VrOo6dpF3ZWt08aGAwYnZA AHkWPswHAHfGaSejG1qjuNL1rTNbgafTL6G6iQ7WaJsgGq1v4r0C71D7Bb6taSXe7Z5KyDdu9P0r h/CCy2OuarLHpviCa3ns8xvqMQUyMvVMAAKew45qt4e0qK48TaXPZ6dr0Zt5Gkkj1aALDbqQc+Ww Ay2SAM54zVW1RPRnob+J9Dj1caS+qWy6gWC/Zy/zZIzjFN1rxLpmikQXF7apfSIWgt5pQhlPYZ7Z PGa8zuvD0EF7dWOrp4tlMl00ubCMPAwLblIYDI9CM9q6XVZIdN1TVo7/AMO32qfb0XyZILbzQV2b drH+Dn/Gou+W5T0lY7DRNSbV9FtNQaDyGnjDmPdu2+2e9X65vwEJY/BmnW89ncWktvH5TwzptZSP T1HvXSVpJJN2JWwUUUVIwooooAKKKKACiiigAooooAzda1YaPZx3BhMu+ZItoOMbjjNXridLa3kn kzsjUs2BngVz3jb/AJA9v/1+Q/8AoQqbxXok2s6Y6w6lqNm0aPhbKQL5uR0bIOaltqDa7v8AJDt7 yXl+rNq2uEu7WK4iz5cqB1yMHBGRUtc/4R0SbRtIhWfUtRu3eJMpeSBvKO0fKuAMV0FaSSTsiU7o KKKKkYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAF FFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUU UUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRR QAUUUUAFQXdpb31u0F1EssLdVboanrjvH19rdtpM0enaTFdWzRgyTtdiIoc9AMc0r7AdiOBgUVzn 9p+KBoyTDw5bm+Mm02329doTH3t+P0p9pqXiWXT7uW68PwQXUYH2eBb5XEvrlsfLTA6Ciue0vU/E 9zdMmpeHYLOAISJEv1kJbsMBR19ahtdW8XSX0Udz4XtobZnAeYairFV9du3n6UB0Onormb7VvFsN 9NHZ+GLa4tlbEczaiqFx67dvFTapqXia3njXTfD0F5GYwXd75Y9rdxgqc/WjpcDoKK5+51LxLHpd rNb+H4Jb1yfPtzfKoi9MNj5s0Q6l4mfSbiebw9BHfI4EVsL5SJF7kvjj6YoA6Ciuf0zUvEtw041H w/BZqsRaIpfLJvfsvAGPrUWn6r4rnv4or7wzb21qzYkmXUFcqPXbt5oA6WiuXm1fxel68cPha2kt w+FlOpKCVz1xt/Sp9V1PxPbXpj0zw7Be2+0ESvfrESe42lTQHWx0NFc/e6l4mis7SS08PQXFxImb iJr5UETegO35vrQNS8S/2K1wfD8A1ES7Rafbl2lP72/GPwxQB0FFc/Yal4lmgu2vvD0FtLHHmBFv lfzW9Cdvy/Wm6Xqfii5v0i1Lw5b2dqQd0yX6yEccfKFFAHRUVy66v4vN6I28LWwtzJgy/wBpLkLn 72Nvp2qTUtU8VW9/JHp/hu3u7UfcmbUFjLf8B28UAdJRXP6lqXiWBLY6f4fgu2eINMGvlj8t+6jj 5vrRJqXiYaPFOnh6BtQaQh7X7coVV7Hfjn6YoA6CiuftNS8Sy6ddy3Xh+CC7jA+zwLfKwl9ctj5a TS9T8T3N0yal4dgs4QhIkS/WQluwwFHX1oA6GiuYtNW8WyX0Udz4XtobZnw8w1FWKr67dvP0pb7V vFsN9NHZ+GLa4tlbEczaiqFx67dvFAG/d2dtexLHdRJKisHAboCOhqSWWOCJpZXCRoMszHgCuK8b 6h4ihtI0tNDhmty8LNMb0IQ+4fLjHTPGa172e/ufB19JqdilncmF90KTCUAf7wApN2g5dr/khpXk l3N6KVJoklicPG4DKwPBB70+s7QP+Rd03/r1j/8AQRWjVyVpNExd0mFFFFSMKKKKACiiigAooooA KM460Vx3j6+1y30uWPTtIiurUoC87XYiKHd0C45ouB2NFc4dT8UDR0mXw5bm+Mm1rb7eu0J/e37f 0p9pqXiWXTruW68PwQXcYH2eBb5WEvrlsfLQB0FFc9pWp+Jrm6ZNS8OwWcIQkSJfLIS3YYCjr61D aat4tlvoo7rwvbQ2zPh5hqKsVX127efpQHQ6eiuYvtW8Ww300dn4Ytri2VsRzNqKoXHrt28VPqmp eJraeNdN8PQXkRjBZ3vlj2t3GCpz9aOlwOgorn7nUvEsel2s1v4fglvXJ8+3N8qiL0w2PmzRDqXi Z9Innl8PQR3yOBFbC+Uh17nft4+mKAOgorn9M1LxLcG4/tHw/BaBIi0RS+WTzH7KcAY+tRafqviu e/iivvDVva2rHEky6gshUeu3bzR1A6WiuXm1fxet68cXha2e3D4WU6koJXPXG39Kn1XU/E9tfGPT fDsF7bBQRK9+sRJ7jaVNAdbHQ0Vz97qXiaGztJLPw9BcXEiZuImvlQRN6A7fm+tA1LxL/YpuD4fg Go+btFp9uXbs/vb8Y/DFAHQUVz9hqXiaa3u2vfD0FtLGmYEW+VxK3oTt+X603S9T8UXN+kepeHLe ztSDumS/WQg44+UKKAOiorl01fxeb1Y28LWy25kwZf7SUkLn72Nvp2qTUtU8VQX8kVh4at7u1U/J M2oLGW/4Dt4oA6Siuf1LUvEtutsdP8PwXZeINMHvlj8t+6jjn60Sal4mXR4Z08PQNqDORJam+UKi 9jv28/TFAHQUVz9pqXiWXTruW68PwQXcePIgF8rCX1y2PlpNL1PxPc3TJqXh2CzhEZKyJfrIS3YY Cjr60AdDRXMWmreLZb6KO68MW0Fsz4eZdRViq+u3bz9KL7VvFsN9LHZ+GLa4tlbEczaiqFx67dvF AHT0Vz+qal4mtrhF03w9BeRGMFne+WMq3cYKnP1oudS8Sx6ZazW/h+Ca8kz59ub5VEXphsfNmgDo KM56Vz0ep+J20ieeTw7Al8rgR2wv1Kuvc79vH0rL8DX+v3CTx3+jRW1r58p85bwSHdu+7tx+tCV3 YOlztaKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACi iigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACorm2hu4GguI1k ib7yt0NS0UAA4GBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFF FAEVxawXcXlXESyJuDbW9QciotStDf6bcWgfYZoym7GcZq1WN4j8Sab4dsGlvr6C1kdW8nzjw7Ad P5VMrcruON76Ghp9qbHTbW0L7/IiWPdjGcDGas1zWl+NtCvdAGpPq1oY4kT7TIrfLG7Dofxq1p/i /wAPaq0wsNXtrgwRmWQRtnag6k+1XK/M7kxtZWNuisCy8b+GdSvY7Oz1q0nuZThI0fJY0yXx34Wg u2tZdcs0nR9jRl+Q3TFIZ0VFYepeMfDuj3ZtNQ1i1trgAMY5GwcHpS3fjDw9YWtrdXWr2sUF0u+B 2biQeooA26KxB4v8PHSTqo1a2+wCTyjPu+Xd6fWiy8YeHtRhuZrPV7WaO1TzJ2RsiNfU0AbdFYWn eM/Dmr3q2en6xa3Fw4JWON8k45NRL488Kvdi1XXbMzl/LEe/ktnGPzoA6Korm2hvIGguI1kibqrd DXOanrmq+H9RluL+0F1obkbZ7Zf3lt/vr3Xvu7VJ4i1gSeEW1LSbzKOVMc8R6gntQtQOkopF+6Pp S0AFFVtRRpNNuUWWSFjE2JIzhl46g+tcF/Z19/wjOizf8JJrXmy3kaySeeMurNgg8dKFuD2uejUV wHiT4jPoGtS6bFp0dw0QQbZLoRyys3TYmPm+ual8S/EWPQr+KxjgtGufIE0yXd2INgPQDg7j1pXV rjs72O6orj7nxw58JWfiTTNLkvbOXmZA+2RBnadoI+Y5pLrxZrdlolxqNx4ZkQxupSH7QCzxHv04 cf3ab0EtTsaK53RNf1K8uri01bSBYXMcQnjVJxKHTp1AGDntWJofxG/tfWH0trS0FyyO0C294Jdx Xs/A2frQF9Lne0V53afETWbmJWPhco8nmGMNeLgrGcSHOOMdvWpPEHxOt9J1H7JbRWkhjhWWb7Td +Sw3DICjad3FAdbHoFGQehrCPia1l8Irr9qGaKaEPAjjBZm4Vce5wKwtcs7nRvhrM41K6s7tCs89 zC+H3Mw3ZJzxg/pQ9L36BH3rW6ndUVwHhfVIVvrtdL1+712yS282WS5lD+VIM4UNgYz6VZ8J/EGP xHqzabLBbRzmLzU+y3XnjA6hjgbTTtrZf1/VhX0udtRXn1x8S5I/Ep0mHS45j9qFsEF0BP15Yx44 AGT1qfxX8Q28N6q1klhDMUjDkTXIieQnOBGuDu6Ur6J9yratdjuqK5ZPF00OprHqVjFYWJtI7g3M 1wAQz8BCuOucioE8Yak1tKP7DDXr3bWtnDHchlm2/eYtj5QKBf1+p2FFc3ZeINVuLS/hn0ZYNYtV Di0NyCkinoRJjH144qpovjDUdUjW8n8PzWemBG33EkoLB16gLjleOGoA6+ivO7/xFrt1f6JNLpt1 p1hcX0YhmhuAwmRu0qY+UEYx716JRbS4dbBRRRQAVFb2sFpGyQRLGrMXIXuT1NSN90/SsPwnd3F7 pEktzM0sguZVDN1wG4FCDobtFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFA BRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAF FFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVV 1Cxi1CzlgkRCXQqrOgbbkdeatUUmk1ZgnYpWGmW9lpsNn5UTCONUYiMAOQMZIqdLW3iz5dvEm4YO 1AMipqKpu7uwWhAlnaxuHS2hVh0KxgEUGytC242sJYnOTGM1PRSAhktLaVt0lvE7erICaGtLZ1VX t4mVRhQUBA+lTUUAQ/ZbfyvK+zxeXnOzYMZ+lCWltGGCW8ShhhgqAZ+tTUUAQx2ltE++O3iRh0Ko AaT7FaBtwtYd2c58sZqeigDm77w3d6xq5k1TUmk0qNg0NhCuxWP/AE1P8YyMgcVL4tspbjwzNbWd uXfcu2ONe2fSt+s7XNV/sbSpL3yTLsIGwNjOTijsgNBfuj6UtIDkA+tLQA10EiMjfdYYNcjbeEtT S+tobnWEm0a0n8+3thDiQMDlQz55AJ9K7Cihb3DpY4vUvCviDUb26jk1u0bTLmQ5ikswZkjPVVkz x7HtVrV/DF/JeR3eiX1tazeUsMou7YTq6r909QQRzXVUUdLBfW5ymq6D4h1Dw9bafFq9jBcqc3Eo s8q+DkbVz8tPvtF8Rah4b+wzaxZi/MoZrhbT5NoPTbu6++a6isfxFrM2h2lvcx2qzxvcJFKTKE8t WON3vj0oAzpvDeqXmr3E91qkJs7ixNo8UcG1xkcsGz61l23g3xFDe2dydcsF+xhkijisAoZSMfNz knpz9fWup0rxHo+tiY6ZqMF15P8ArPLbO360mmeJtF1m5lt9O1K3uZouXSNuR2o6/wBef+bDoczZ +CNXgt7SObWreRoVuEZltcBllOfXgg1K/hLXIfJmsNWsEumhVLpp7ESJIyjAZRn5eOOtbt54t8P6 fqBsLvVrWG6GMxO+CM9KfqnifRNFuI4NS1O3tpZRuRJGwSPWj+vz/wA2H9fl/wAAoy6Rqd3caPBe vBLbWo825eNdgklA+UBOwzz+FWvFWj3eu6DNp1ndxWskrKTJJF5gwCDjGfYVZ1TX9J0S1judSv4L aGQ7UeRuGOM8VX8N642vWdxO0EcXlXDRKY5RIrqMEMD7g9KNwTs0yAaBc3XhafStRuYDcToVee1h 8oe3y5rK0vwpr9rrtpqV3rNk6wI0Rgt7IRKyEfX73v6V2tFF9bitpY4hPCOvXN3Gmq63a3VgkwlI WzCTttOVBkz64zxyKn1fw14i1C/uvK1uzGn3Bx5M9kJHjUjBCvnj+ldhRRbSw+tzmNU8G2+onS4v O221lH5boy7jKFGEyfY81EnhK7s9Bsbaw1MR6nZO0iXcsW5WZvv7lzzkE966yigDmLTQ9ditL+e4 1a1l1e5VUjuBbYjjUdtmefzpPD+ga3Y2Eunaxqtte2bRFEWG28plznJJyfWuoooA4O48IeKLhbOB /Elt9lsZkltk+x/Mdn3Q53fNxXdjOBk5OOaWii4BRRRQAjfdP0rC8I2txaaPJHcwvE5upWCuMHBb g1uk4BPpWdomq/2xYvc+SYtszxbS2funGaFuD2NKiiigAooqhd63plhf21jd3sMN1c58iJ2w0mOu PWgC/RVHTNY07WYZJdNvIbqONzG7RNkBh1H1q9QAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUU AFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQA UUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABR RRQAUUUUAFFFFABRRRQAUUUUAFFFFABXOeOf+RWuP99P/QhXR1Bd2tveW7Q3USSwnkq/SjqgJl+4 v0paKKACiiigAooooAK5H4jQzXfhgWsGmXGotLcR5ghHVQ2Tk9h7111FJq407HBWslzqd+97pHh+ 501rSxkiX7ZB5XmuR8qbe655zWBoNrcW/irSLpdN8TyBN0dxJeRBYomYfwqP4cg89uK9coqk7O/9 df8AMm2ljyPVtNGq6tcRxaJ4givJLsMIpYw2nuVI+dj1wQM9etXfFOieX4nvbq8j8SzW15GgT+xw HVdqhSrAjj1r0+iptokVfVs8+jig0FNHvF0PVr7T47H7NFE0Hm3ELZB+dT6jOTV74eiSGDVom0a6 0uN7554opo9oKOBjHvwcjtmuzoqr6t/1vcm2lgooopDCiiigAooooAKKKKACiiigAooooARvuN9K 53wT/wAgOX/r7m/9CNdHUFra21nEY7WJI4yxYqnTJ6mhbh0J6KKKACuE8fw3uq3em6Rp9hdx3Tye YusxQbxY47g+p+79DXd0UmrjTscn8PnZPD5s5NDn0qW2kZHWSLYJjn/WD1z1rrKKKpu+pKVgooop DCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA KKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAo oooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigArjfH15rsGlSx6 dpVvc2pQGSaS78pkO7oBjnt3rsqiuLaG7gaG4jWSNuqsODS6oDB/tHxUNHSZdAtDfmTa1v8AbhtC f3t+3r7Yp9pqHieTTruW60K1hvEA+zwrehll9ctt+Wugopgc9pWo+Kbi6ZNT0G0tIAhIkjvhIS3Y Y2jr61Daap4wkvoo7rw3ZQ2pfDyrqAYqvrt28/SunooA5i+1PxfFfTR2XhyyntlbEcr6gELD1K7e Km1XUPFFvPGumaDaXcRjBd5L4RlW7jG05+tdDRR0A5+51DxOml2sttoVrLeuT58DXu1Y/TDbfm/K kh1DxQ2kTzTaDaJfq4EVuL0FXXuS23j6YroaKAOf0zUPE85uP7S0K1tQsRaLy73zN79lPyjA96i0 /U/Fs2oRR3/h2ztrVj+8mS/DlR7LtGa6WijqBy02qeMVvXSLw1ZPbB8LKdRAJXPXG39Kn1XUfFNv fNHpmgWl3bbQRLJfCMk9xt2muiooDqc9e6h4ois7N7PQbWe4dM3Eb3oQRN6A7fm+tKNQ8T/2KZzo Vr/aXm7Ra/bfk2f3t+3r7YroKKAOesNQ8UTW9219oNrbyombdEvQ4lb0J2/L9abpWo+Kri/SPU9A tLS1IO6WO+EhBxx8u0V0dFAHLJqnjI3qo/hqyFsZMGUaiCQueuNvXHapNS1LxZBfyR6f4es7q1B+ SWS/EZb/AIDtOK6WigDn9S1DxPAtt/Z2hWt0XiDTCS98vy37qPlOR70kmoeKBo0M8eg2ragzkSWx vQFVexD7efpiuhooA5+01DxPJpt3LdaFaw3iY+zwre7ll9ctt+Wk0rUfFNxdMmp6DaWkAjJWSO+E hLdhjaOvrXQ0UAcxaap4wkvoo7rw3ZQ2rPh5V1AMVX127efpRfan4vivpo7Lw3ZT2ytiOV9QCFh6 ldvFdPRQBz2q6h4ot7hF0zQbS7iMYLPJfCMhu4xtOfrS3WoeJ49LtZbbQrWW9fPnwNe7Vj9MNt+b 8q6CigDnY9R8Uto880mgWiX6yAR24vgVde5L7ePpiszwNe+IJ1nj1DSLe3tfPlJmS88w7t33duOn vmu1qK3tobVCkEaxqzFyFHUnqaFvcOhLRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFF FFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUU UAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQ AUUUUAFFFFABUVy0yWsr28ayzKhMaM20M2OBntUtV76K5msZ4rOcW9w6ERysm4IfXHelK9tBrc47 R/HWo6vqdjp0ehqtyS41KP7QCbDaeN3HJbqKju/Hmq2moz6UdBRtWFyqW9oLobp4D1mHHCjvSaZ4 A1PSbywvrXXkW9QudRnNsN1/k8b+eo7Uy4+Huq3Nxcai/iBP7Za6WW3vxajfBCP+WI5+6arqr/P7 /wCvlfrYno/w/r+unmXtf8aXvh7Upba60qPyntt9lL9oA+1Tf88QMcN/Sum0m5vLzSra4v7P7HdS IGkt9+7yye2a5PV/Auoa7qM91qOsRTKLby7KM23FrN/z2Xn71dTolpf2GkW9rqV/9uuo12vceXsL +5HrQttd/wDh/wCvu8we+n9bf19/kaFFFFIYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFF FABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVFcvMlrK9vEss6oTHGzbQzY4Ge1S1Wv4rmew nis7gW9w6ERysm4IfXHelK9tBrc4/R/HWo6xqljp8WiKtwS41JPtAJsCp4Dcck9qjuvHmq2uoTaU dARtWFyscFoLobpoD/y2HH3R3pNM8AanpF7YX1prqLeIXOozG25vyTwX56jtUc/w91W4uLjUW8QJ /bTXQlgv/so3wwj/AJYjn7tV1V/n9/8AXyv1sT0f4f1/XTzPQVLFFLDDY5APQ0tMhEiwosrh5AoD MBgE9zin0mNBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAB RRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFF FFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAGTceJ9EtL y6tLjUoI7i0i8+eNmwY4+u4+1NXxXoTtYKuqW5OoAtafN/rgP7vrXDeNrLU9c8QTiy0e8hjsbUmS 4EII1Idfs/8AumpNdOoeINI0LTLHw5qGkTyEN9tFuM6ZtHb6/d+hpJ3Sf9df6/pDa1t/XT+v6Z2P /CZeHP7Pa/8A7YtfsiT/AGdpt3yiT+7n1qU+KdDWa+hOpweZYxiS6XPMSnkFvSuESe8j+Hk+k/8A CE3pufOMHk+QNshJ/wBf/wCzfWpvDn9oeG4dasr7QNQ1W4SMSf2j9nGdQ+UfIfcdPwpvr5f5f1+W 4lfT+uv9fnsdrB4p0K6ubK3g1S3kmvY/NtkVuZV9R7Vr15V4NsNS0XxDZTXuh3k0d/CxicwADSQT nyB/s+9eq02tBJ6hRRRSGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABR RRQAVhzeMfDtul682r2yLYyCO5LN/qmJwAfqa3K8i8QWuqaj4gv9Zh8NX32O0liR9PMA/wCJrg8S H/c7UvtJD6XPR38T6JHefZH1KBbjyPtPllufKxnf9MVGvi7w+8FjMuq25iv3KWrbuJmHZfWuK8XQ an4l1G1gsNF1DT/ItGme9NuMyDHNr16N3+go1OS+1fwjo2lWfhS+025lkVRIIBjTCv8Ay0H9Pxp/ 5/q/6/4Fhf5fp/X5bnZt4x8OraXd22r2wt7OXybiTdxG/TaferVt4g0m81NtNt7+GS9WITGFT8wQ 9G+hrgbK4vNN8E6rpkvgu9vLmOVoipgGL8sf9cfr1NW/AdjqGha3cadqOn3l1JLCjjWpIQu4Y4ib 029BTSu7f1t/X5bid0v67/1/wx6LRRRSGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQA UUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABR RRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFF FABRRRQAUUUUAFFFFABRRRQAUUUUAFFIcbTk4HrXj8d/ct4jXSP+En1AaOmo7k1Y3AIkfH/Hpn2P ehay5Qeiuew0V5P4x1K70/xFfW2n69etbXUKfbJUnyujjIxJj/a6Y9jV/wAV3txox0O50jV73Urz yDGNPS4H+mR7eZj7rnOe9K/u8wdbf1/X9dUek0V5dcSi3+G1leQeMb26vEmEsUyzjddyk/6j6E/L jtU2h3Dal4b8Q3mqeJLzTrqRiZoDcANpRAyFH+eactL+X/A/r/h0C1t5npdFeZeBNRvtW19JdU1S 8t5YLRUg0+WbIu0/5+cd93pXptNqwk7hRRRSGFFFYPjIRf8ACL3jS6zLo4RdwvIn2lCOn1HtSbsr jSu7G9RXmng2+u9Zu9Sn1rVb3T7kWix/2Y9wAYUx/rwfVuue1Z/hXUru+8RadaXniG+FlamX7Jcv ONusDPX6L0x3qre9b+v6/royb6XPW6K8f1HULqPxJc6TF4lv10iS+R5dV+0Ai1k72uffg57Zq942 1G70vXpU0vWL2b7TZ7LqGOf5dOToLnH9Pxqb6J9/8r/19+w+rXb/AD/r8tz1Kis3w+kceg2Sxai+ ooIhi7kfc0v+0TWV49ZY/C8039szaVLEyvFNDJtLvnhPcN0x705e6wj7x09Fea+GbqbV7bXrvWNc vdNupIwsmntcAHTlC8MD6nrmqngvUr3U/EFpHqOt3sUVtbstokk3Gqpk4uPpjtTtrb+v6/roxX0v /X9f11R6rRXj0V/cv4jXSP8AhJtQGjpqJZNWNwMSvj/j0z7HvVjxhqV5YeIr+20/Xr4211En2yVJ 8ro4yMSY/wBrpj2pbpPv/X9f8FD6vy/r+vu3PWaK828V3txoz6Jc6Pq97qV35BjGnpcD/S49vMx9 1znPeoLiQW3w3sbyDxhe3V4kwlimWcbruUn/AFH4n5cdqO/l/X9fduHbz/r+vvPUKK800S4bUvDX iC81TxLeaddSMTNCbgBtKIGQo/zzUXgrULzV9ZaTVtXvbSSGyEcVjJOMXKcj7V+P6UeXz/D+vz2F fS/9f1/XVHqFFeQaLqF1ceJLLTJvEl//AGVBdyG21JpxjUj/AM8c/wCwePfFev0dEx9WgooooAKK KKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooo oAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiig AooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAC iiigBrosiMjgFWGCD3FYf/CFeGvsS2f9iWf2ZJvPWLy/lEn976+9b1FAGKfCPh5jeFtItSb1Qtzl P9aB0DetLF4T0CC5guItJtUmgjMUThOUT+6PQc1s0UAYCeCfDMcEMKaJZrFDL50aCPhH/vD3qSbw d4duGu2l0e0c3hBuSU/1p/2vWtuigDKj8M6JDqFvfx6Zbrd20YihmCfMiDooPpWrRRRcAorhNW8c 6rpep3ulnRIpNQ8xBp0AucG9Qnlhxxt71a17xjfeHL2AX+mwR2U9uSlybjrcYyIcY6k9DSvpf+v6 /wCGDrY7GqOq6Pp2t2n2XVLOG7t9wby5VyMjviubuvFet6d4f0vV7/Q4reKZx9vV7j/jzQ9HPHIH etPwtrl/r9rc3dzpy2tr5xW0kWXf9ojHSTpwD2p23XYV+vcmk8J6BNcvcyaTbNPJD5DyFOWjxjaf bFNHg/w6q2ajR7QLZZ+zAR/6rPXb6Vt0UDMI+DPDZtJrU6LZm3ml8+SPy+Hk/vH3qT/hE9A824l/ sm18y5i8mZtnMiYxtPqK2aKAKunabZaTZR2en20dtbR/cijGFX6VFqmiaZrcUcWp2MN3HE4dFlXI Vh3rK8T+JLnw3PZTyWcR0iR9l3eyTbRbZ6EjHIJ4+pFWPC2r6jrmlG+1DTRYb5D5KeZvLx9n9s9a Pi1DbQdN4R8Pzz3U8ukWry3abJ3KcyL6H16Uo8JeHxJaSDSbUPZp5duwTmJfRfQVs0UAYP8Awhfh r7Etn/Ytn9mSbz1j8vgSf3vr71IfCPh5jeFtItT9tULc5T/WgdA3rW1RQBjReE9AguYLiLSbVJoI /KicJyif3R7c1CngnwzHBDCmiWaxQy+dGgj4R/7w9636KAMObwd4cna7aXR7RzeEG5yn+tP+1609 vCegNcx3J0m1M0UPkJJs5WP+6PatmijyAwh4M8NrbW1sui2YhtZDLAgj4jY9SPQ1u0UUXAKKKKAC iiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKK KKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooo oAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiig AooooAKKKKACiiigAooooAKKKKAOB1D4fahqV3qF/Nr/APxMpZFayuvso3WSA5Kpz0PerOp+CL7W 7+ObVtZS7torUxx2z2o2rNj/AFw5+8O1drRStpb+v6/4cd9bnDy+CdZvdI0zS9R8SG7tbWTN0klq P9MQdEfnpWv4W8PXvh1buCXVPtdk8pe1g8kILZSfuA55AroaKq718ybBRRRSGFFFZFz4p0OzvLuz uNShjuLOHz7iNicxx/3j7UAUPEfha48R6jZGfUF/smAlp9OeAOlwe2456Dr9aseFdCv/AA/p8lne as2oRCQtBuiCGJD/AAdeQO1Sr4s0F209V1OAnUVLWg5/fAf3eKi/4TTw3/Zzah/a9v8AY1n+ztNk 7RJ/dzjrQtNF/X9f8AHrqb1FZ1pr+lX+p3Om2t7FLeWwDTQrncgPTNaNABRRRQAUUUUAFFFFABRR RQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFF ABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUA FFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAU UUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFeX+NbHVtd1+cWej3kMVhbFm nWIEakOv2fr9016hRSa1uO+h5prp1PxFpOh6ZaeHb/SZZcM16sS500qP4eep6fQ1ClxqMfw9m0ke Crs3JlNv5XlLtfJ/1/X/AIF9a9RopvW/n/X9f5iWlvI4PwHa6ho2o6hpN/p13M42v/bUsYH2vgcN znI6D6V3lFFNu4krBRRRSGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAB RRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFF FFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUU UAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQ AUUUUAFFFFABRRRQBwvxBvJ9On0u8069uZNUSXEOkQz7RfDuCPYc59qv/D5kl8Oed/bU+qTSSs0z zSbjC+eY/bb0rbutD0u91GDULmwglvIBiKZ0yyfQ9qXTdF0zRxMNNsYLUTPvkESbdzep96I6J3CW rVv6/r+uhfooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoo ooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiii gAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKA CiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAK KKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoo ooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiii gAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKA CiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAK KKKACiiigArO1zVP7G0a5vvK8wxLlUzgE9snsPetGsjxLdXFnosklvpL6ruYJJapjLIThsZ4PHak 9hrczdC1/W7u6nj1TS7WOCOAyi5srnzo2Ofuf72OaqaP4r13U9RtQdItG0+5c/vbe63yQrzgyJjj 0qn4etXtL+/1HR/DV5pNtHZsPsEyLGLibOVIAJHQYz71X0m1F94gsLyy8I3+gXayGW8uHjVElXB3 ISD82WIPTtVdf68yXszodG1jxFe+ILyyvtMsILO2JBliuS7nPK/Lj06109eeDxFq1nqeryQeE9cZ 7hwIZPJQrwMZPzdK7yzaZrKBrgYnMamQY6NjmktUN6SKusa7pegWy3GqXkdtEzbVLAkk+wGTUD+K dEj0VNYfUYhp7kKs+DjJ9eMj8azvEPn6dr9nrKaRc6pGkDweXbIGkjYkHcASOMDH41mlruLwvrF2 ugX5bUpm2aeka+YuVxuYZwM96V9Gx9UdPp3iPR9XvJrTT7+K4ngAaRUzwD056H8K0J3eO3keOPzH VSVT+8fSud8GmFtIt4V8P3Okm0jEapcRKmeOduCeM101VJdEKL6nn8Pirxs+ofZX8M2G9ESWSNb0 l1Rmx0x1HXFbCaz4jbxadMOl2IsAokM/2k+ZsP8As46596pWOoXz/EK5d9A1SK1kiEC3Tovl5XnP XOD2qK/13ULHxbdzxeF9auYlgEKTQxIVdgc5GW6c0k9n6/rb9Aa3Xp+l/wBTX8S+IL7S7q0s9Ntr SW5nDOTdz+TGFH+1jr7VoaBf32paUlzqNh9huCzAxbwwwDwQR1B61yWq311eWtjDr3gq61aGSHzi Y4kdoZCT8pUkYOMcg10Pg+zuLLQEjnjmhVpXeGCY5eGMtlUP0GBimla9wb2sXtY13S9AtkudVvI7 WF3CK75wWPbiqun+L9A1S7jtbLU4Zp5IjKiKDkqDjPI/TrVHx8k83hz7Nb6Xcai0txFmKFQcKrhi Tk9MCsO2gvrLVZJl0C92f2q0+Y0X5kaMYPXoMYNKOr1/rb/P8Ae2h1Wj+I7PW9SvYLG5t54rXCts Lb1buGBApuoeM/DulX72N9qsEFxGu90bPyjGeTjH4Vz2l6zfv40uLh/CuswW91HHCJZIkCqQTlmw 3SsjxFMdK0/WNFu9Elu3urprhLrKeXhm3KTk7sr6Y7Udh9WdRceOrDTtSI1Oe2t9MmhWW0uQzM0u euVxkVe1nxnoWg2lldX16FgvWAhdELBhjOeB0rJbzP8AhLTO2g3c6RabsjuxGpQkgEqvPU1BAmoN 4G0+UaLdpcWN0JWspFXzWUM33RnH8Q/Kjp/Xdr/IXX+t7L9TrtK1iw1yyF5ptwLi3JKhwpHI+oFJ rV5cafot5eWkMc00ETSLHI+0NgZxntUGhahfalby3F3pb6dGXxDFMR5pXuWA4Bznv0p/iPzf+Ec1 FYLaW5le3dEiiA3MSCBjNKeidhws5K5R0XxnousTQ2Ud9D/aLRhnt1JO045AbGDj2qZ/F2gR6x/Z L6lEL3ds8sq33sZxuxj9a5LQ4r640/RNE/4Ra40x7GRJZbiRQIk2g52MDkk5x+JrIuPC0VveXFhq Ok+KbyN7oy77K4zbuC24HBIxjuPaqduby/r+vkTG/L/Xn/XzPX6xvEPiKy8P2iPc3MEMszbIROWC s3oSAcVsLwijkcd65Xx1e3SaNLY2miX+oyXMZCtbRqyof9okjFS9Co6mxqXiDTNFtILjVLyK2jmI VWbO0nGcA4pdG8QaV4ggkn0q8S5jjbY5UEYP0IBrldWvbnVfCVkj+GNTdhcRo9rJEu4BcHcRnpWp pctwfG2pZ0i8t7dreNVuXRRG5GSQMH3/AEqrav5/kmT0X9dbHTSSLFG0jnCqMk+grIXxXoTw2Mq6 jEY75/Ltmw2JG9OnH41snpXmdzca3BB/ZUXhi+mEGoiaS4ULsaPfnMfPJ9uOM0l8SX9b6je1zstV 8W6Dod0ttqWpRW8xXftZWOB6kgYH407UfFWiaTa21ze6hHFDdLuhYKzbxjORgHjmuG8V2D6nrN6j eHdf82RVjjmspR9nmGMgyjPYnB9qseI/DtzHd6ZfTWurXCpYpayR6LL5bRuOSdvA2nOPbFLWw3ue h2l3b39rHdWsqywSKGR1PBFTVz3gqwttO8ORwWllqFnGZHcxag2ZsliSTyetdDVNWZKCiiikMKKK KACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoooo AKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigA ooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoorO123gu9Fu oLm6ktonQgyxzeUy/Ru1KTsmxrVlfTvFeh6tqD2FjfrPcpnciow6deSMH862a858GWVtpHgc6lpu pXN3eDTy3kyXXnKhAJGF7c1JYQJp1zpd/Z+I7rULy7lVLiCW68xHDAk7U/gwR+FU1Z8pPRs9Corz ptKS88YahaDxbeQ2e1JfsyXg3eaSfunOQox92vQolZIkV33sAAWxjJ9aS2uN72H0Vxvjz7Tcx2dl ZanDbTsxkaB7w2plQDHEg54JHFcwlzrkHgB4U1B5bh9UNvPPPdMqxpjokw529Bu9zSuN6HrNFea6 E3iPR9J1qSW9tJ4Y4A9tGl615JG/8RLMM4xjj2q1YaXp8GpabcQ+Nb+d7nIkt2ufNW4JXPA/5Z46 /pT6i6HoFFeZPqFrbaRpqy6/creW+p+RGrXfzSDfysnqMZ61e1ywS58axwL4ourK3uYGa6t0uwM4 I2hOf3Z56jrQtbW6/wCVw9f61sdxdXcFlAZrh9kYIBbBPJ+lTEgDJIA964bxjbR6foFpK2u3UV1Z 7fKYXXl+aMjlx/HxVnxza2eseHbeVr+eOCO6iJltLnYMbgCSR6fpR0+Yf5HY0VyFtpen3Gg6pomk 67f3FwFDGY3jPJGxGVAfsOO1QaVnW9X0qSK9vlTTLfFynnkLJIflAcfxEbSefUUdbCvpc7asy68P aPe6lHqN1pttNeREFJ3jBZcdMGtOigYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRR RQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFF ABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUA FFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABVa+sLT U7R7S+t47i3f70ci5U/hRRQBU0vw5ouiSSSaZplraPINrmGMLuHocUyy8L6Dpt8b6y0mzt7o5zLH EA3PXmiigCMeDvDYvvtw0SxF1v8AM87yRu3eufWtuiijpYPMztU0DSNb8v8AtTTra88v7nnRhtv0 zUiaRpyaX/Za2UAsNuz7OEGzb6Yooo8gINM8OaLorStpmmWtoZRtkMMYXcPQ0mn+GtE0q7e7sNKt La4cENJFEFY596KKAI5fCfh+e6nuZdGsnnnOZZGhBLnOefxpt14P8OX14bu60WymuCQTK8ILHHTm iigCbUvDOh6w8b6jpVpdNEuxDNEG2r6DNTW+h6Xa6W2mQWFvHYuCGt1QBCD1496KKACy0ex0uwaz 0uCOwiJJAt0UYJ74IIz9RTNI0WLRxdeXcTztdTGeR5gmSxAB+6q+goooW79P1B7I0qKKKACiiigA ooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigD/9k= --_004_8EBBE4774B42FC45BA1143BE7F3F5A0F168DAFMXMA2012hpiunipot_-- From fred@cisco.com Sat Dec 14 12:52:13 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EBD3A1AC404 for ; Sat, 14 Dec 2013 12:52:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -114.502 X-Spam-Level: X-Spam-Status: No, score=-114.502 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tkHQ3mg7PjKC for ; Sat, 14 Dec 2013 12:52:08 -0800 (PST) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by ietfa.amsl.com (Postfix) with ESMTP id BBB871A1F06 for ; Sat, 14 Dec 2013 12:52:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1704; q=dns/txt; s=iport; t=1387054322; x=1388263922; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=kmzVD+RsVN0Z6/aDwVavKOisGTD/No0rUbGYOY6Lw+s=; b=SuNr5UUpgAfAhrGXFDf6mNj+H85Nhj9B6c5w4Xuq/VQv75bxvC7R6Kna cZQvYHykYlvFnfAG3jDyz1ud2TteiiQQlSN3COTB+OGQjNhzROSJsGRag 3MtOMbZhT23q02jRRBozvEOXZ4xLR0QVlf8h/VRbPXLeKtU6JFHJyw+Ge I=; X-Files: signature.asc : 195 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Ah4FALfErFKtJV2a/2dsb2JhbABPCoMKgQ24ZIEbFnSCJgEBBHkQAgEIRjIlAQEEDhOHdslSF449XAeDI4ETAQOQM4ExhjKSFIMqgio X-IronPort-AV: E=Sophos;i="4.95,486,1384300800"; d="asc'?scan'208";a="291559459" Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by rcdn-iport-7.cisco.com with ESMTP; 14 Dec 2013 20:51:46 +0000 Received: from xhc-aln-x01.cisco.com (xhc-aln-x01.cisco.com [173.36.12.75]) by rcdn-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id rBEKpjZa022723 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Sat, 14 Dec 2013 20:51:45 GMT Received: from xmb-rcd-x09.cisco.com ([169.254.9.86]) by xhc-aln-x01.cisco.com ([173.36.12.75]) with mapi id 14.03.0123.003; Sat, 14 Dec 2013 14:51:45 -0600 From: "Fred Baker (fred)" To: "Rafiee, Hosnieh" Thread-Topic: [Secauth] initual attempt for auth categorization Thread-Index: Ac74vbBpyyGo4TgmSYCHGvGv05Nq3QAguWWA Date: Sat, 14 Dec 2013 20:51:44 +0000 Message-ID: <95892BF3-AAC0-4292-A637-BB053A866420@cisco.com> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F168DAF@MXMA2012.hpi.uni-potsdam.de> In-Reply-To: <8EBBE4774B42FC45BA1143BE7F3F5A0F168DAF@MXMA2012.hpi.uni-potsdam.de> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.19.64.114] Content-Type: multipart/signed; boundary="Apple-Mail=_10A8325D-AFFB-4B57-9A7F-DA5336287A6C"; protocol="application/pgp-signature"; micalg=pgp-sha1 MIME-Version: 1.0 Cc: "secauth@ietf.org" Subject: Re: [Secauth] initual attempt for auth categorization X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 Dec 2013 20:52:14 -0000 --Apple-Mail=_10A8325D-AFFB-4B57-9A7F-DA5336287A6C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii My sense, which I am willing to be disabused of, is that IP-based = authentication can be useful to deny a party access if, based on = location, they are simply wrong (for example, a given resource is only = supposed to be used from inside a company, and it is being accessed from = outside), or can identify a case in which more stringent rules may need = to be applied. IP addresses don't correlate directly either with people = or applications, both because addresses change and people change = addresses; hence it is almost never valid to say "the access came from = address foo and therefore is authorized". Given that belief, I feel like you're starting in the middle of the = conversation. The appropriate starting question is not the state of = security, which as exemplified by your question is pretty disconnected = from reality. The appropriate starting point has something to do with = what is being secured and what assumptions about authentication and = authorization are valid in the use case. --Apple-Mail=_10A8325D-AFFB-4B57-9A7F-DA5336287A6C Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="signature.asc" Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iD8DBQFSrMTfbjEdbHIsm0MRAoHwAKDRMYIYeZkN9A7q5y9YwazPpP7ffgCfTfAN RIDId/Vp4BScXet6AgpO680= =AKi2 -----END PGP SIGNATURE----- --Apple-Mail=_10A8325D-AFFB-4B57-9A7F-DA5336287A6C-- From rafiee@hpi.uni-potsdam.de Sat Dec 14 14:24:06 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7AC2B1ADA5D for ; Sat, 14 Dec 2013 14:24:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.551 X-Spam-Level: X-Spam-Status: No, score=-1.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, RP_MATCHES_RCVD=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y5T9eULQ5RoB for ; Sat, 14 Dec 2013 14:24:04 -0800 (PST) Received: from mail3.hpi.uni-potsdam.de (mail3.hpi.uni-potsdam.de [IPv6:2001:638:807:204::8d59:e17b]) by ietfa.amsl.com (Postfix) with ESMTP id AFC431AD8F4 for ; Sat, 14 Dec 2013 14:24:04 -0800 (PST) Received: from owa.hpi.uni-potsdam.de (owa-2012.hpi.uni-potsdam.de [141.89.225.164]) by mail3.hpi.uni-potsdam.de (Postfix) with ESMTP id 71812169EA2; Sat, 14 Dec 2013 23:23:56 +0100 (CET) Received: from MXMA2012.hpi.uni-potsdam.de ([fe80::5c89:628a:f4a4:826a]) by OWA-2012.hpi.uni-potsdam.de ([fe80::9d94:d459:bf45:5d57%22]) with mapi id 14.03.0174.001; Sat, 14 Dec 2013 23:23:56 +0100 From: "Rafiee, Hosnieh" To: "Fred Baker (fred)" Thread-Topic: [Secauth] initual attempt for auth categorization Thread-Index: Ac74vbBpyyGo4TgmSYCHGvGv05Nq3QAguWWAAAmihuA= Date: Sat, 14 Dec 2013 22:23:54 +0000 Message-ID: <8EBBE4774B42FC45BA1143BE7F3F5A0F168E9B@MXMA2012.hpi.uni-potsdam.de> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F168DAF@MXMA2012.hpi.uni-potsdam.de> <95892BF3-AAC0-4292-A637-BB053A866420@cisco.com> In-Reply-To: <95892BF3-AAC0-4292-A637-BB053A866420@cisco.com> Accept-Language: en-US, de-DE Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [141.89.225.161] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "secauth@ietf.org" Subject: Re: [Secauth] initual attempt for auth categorization X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 Dec 2013 22:24:06 -0000 Hi Fred, >=20 > My sense, which I am willing to be disabused of, is that IP-based authent= ication > can be useful to deny a party access if, based on location, they are simp= ly > wrong (for example, a given resource is only supposed to be used from ins= ide > a company, and it is being accessed from outside), or can identify a case= in > which more stringent rules may need to be applied. IP addresses don't > correlate directly either with people or applications, both because addre= sses > change and people change addresses; hence it is almost never valid to say > "the access came from address foo and therefore is authorized". That is true. The IP address cannot identify the human but it can help to s= ome extend if it combined with CAs or other security approaches. =20 > Given that belief, I feel like you're starting in the middle of the conve= rsation. > The appropriate starting question is not the state of security, which as > exemplified by your question is pretty disconnected from reality. The > appropriate starting point has something to do with what is being secured= and > what assumptions about authentication and authorization are valid in the = use > case. Thanks for your suggestion. I agree and I found your point really reasonabl= e. Do you think it is good to start with the meaning of authentication and= authorization? In other word, what are the other terms come with authentic= ation and what with authorization? Then maybe the next step is what are authorization approaches, What are aut= hentication approaches? Am I right or I'm again jumping to the middle? Thank you, Smile, Hosnieh=20 From rafiee@hpi.uni-potsdam.de Sat Dec 14 15:47:23 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E28BA1AD8DA for ; Sat, 14 Dec 2013 15:47:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.15 X-Spam-Level: X-Spam-Status: No, score=-0.15 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, HELO_EQ_DE=0.35, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D6i9vTDNct5M for ; Sat, 14 Dec 2013 15:47:21 -0800 (PST) Received: from mail3.hpi.uni-potsdam.de (mail3.hpi.uni-potsdam.de [IPv6:2001:638:807:204::8d59:e17b]) by ietfa.amsl.com (Postfix) with ESMTP id 46B371ADF71 for ; Sat, 14 Dec 2013 15:32:31 -0800 (PST) Received: from owa.hpi.uni-potsdam.de (owa-2012.hpi.uni-potsdam.de [141.89.225.164]) by mail3.hpi.uni-potsdam.de (Postfix) with ESMTP id 25D35169EA4; Sun, 15 Dec 2013 00:32:23 +0100 (CET) Received: from MXMA2012.hpi.uni-potsdam.de ([fe80::5c89:628a:f4a4:826a]) by OWA-2012.hpi.uni-potsdam.de ([fe80::9d94:d459:bf45:5d57%22]) with mapi id 14.03.0174.001; Sun, 15 Dec 2013 00:32:22 +0100 From: "Rafiee, Hosnieh" To: "Fred Baker (fred)" Thread-Topic: [Secauth] initual attempt for auth categorization Thread-Index: Ac74vbBpyyGo4TgmSYCHGvGv05Nq3QAguWWAAAmihuAAEYRP4A== Date: Sat, 14 Dec 2013 23:32:22 +0000 Message-ID: <8EBBE4774B42FC45BA1143BE7F3F5A0F168ECC@MXMA2012.hpi.uni-potsdam.de> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F168DAF@MXMA2012.hpi.uni-potsdam.de> <95892BF3-AAC0-4292-A637-BB053A866420@cisco.com> <8EBBE4774B42FC45BA1143BE7F3F5A0F168E9B@MXMA2012.hpi.uni-potsdam.de> In-Reply-To: <8EBBE4774B42FC45BA1143BE7F3F5A0F168E9B@MXMA2012.hpi.uni-potsdam.de> Accept-Language: en-US, de-DE Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [141.89.225.161] Content-Type: multipart/alternative; boundary="_000_8EBBE4774B42FC45BA1143BE7F3F5A0F168ECCMXMA2012hpiunipot_" MIME-Version: 1.0 Cc: "secauth@ietf.org" Subject: Re: [Secauth] initual attempt for auth categorization X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 14 Dec 2013 23:47:24 -0000 --_000_8EBBE4774B42FC45BA1143BE7F3F5A0F168ECCMXMA2012hpiunipot_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I start with these definitions: Authentication: ------------------------- 1- Definition The process of identifying an entity. In other words, answering this quest= ion that who is this user? 2- Real world example The airport security authenticate a person based on his travel documents, i= .e., his passport. 3- Scope & use cases - Application layer User authentication examples: To access a website, To check an email, To ch= eck your bank account Computer authentication examples: Update a software automatically, - Network layer - Computer authentication example: two computers' communications Authorization: ------------------------- 1- Definition The process of giving an entity a possibility to access some resources or a= uthorize it to do something either on a single node or for the whole networ= k. It is more to do with policies than other scopes. Important: the entity needs first to be authenticated then one can define a= policy for this entity based on its unique identifier (whetever used to ac= cess other entity on the network) 2- Real world example A guard of a building can enter to the building and go to all corridors but= only can go to room A and B but not room C. He does not have a key for tha= t room. 3- Scope & use cases - Application layer User authorization examples: a normal user can only access to his own home = directory in Linux but root users is the user who define the policies for o= ther users and has full access to some resources. Computer authorization examples: An automatic updater can only install upda= tes if the user before authorize it to do so. -Network layer - Computer authorization example: Routers are only authorized by a trusted = authority to advertise certain router prefixes Any thoughts? Smile, Hosnieh --_000_8EBBE4774B42FC45BA1143BE7F3F5A0F168ECCMXMA2012hpiunipot_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I start with these definitions:

 

Authentication:

-------------------------

1- Definition

The process of  identifying an entity. In ot= her words, answering this question that who is this user?

 

2- Real world example

The airport security authenticate a person based = on his travel documents, i.e., his passport.

 

3- Scope & use cases

- Application layer

User authentication examples: To access a website= , To check an email, To check your bank account

Computer authentication examples: Update a softwa= re automatically,

 

- Network layer

- Computer authentication example: two computers'= communications

 

 

Authorization:

-------------------------

1- Definition

The process of giving an entity a possibility to = access some resources or authorize it to do something either on a single no= de or for the whole network. It is more to do with policies than other scop= es.

 

Important: the entity needs first to be authentic= ated then one can define a policy for this entity based on its unique ident= ifier (whetever used to access other entity on the network)

 

2- Real world example

A guard of a building can enter to the building a= nd go to all corridors but only can go to room A and B but not room C. He d= oes not have a key for that room.

 

3- Scope & use cases

- Application layer

User authorization examples: a normal user can on= ly access to his own home directory in Linux but root users is the user who= define the policies for other users and has full access to some resources.=

Computer authorization examples: An automatic upd= ater can only install updates if the user before authorize it to do so.

 

-Network layer

- Computer authorization example: Routers are onl= y authorized by a trusted authority to advertise certain router prefixes

 

 

Any thoughts?

 

Smile,

Hosnieh

 

--_000_8EBBE4774B42FC45BA1143BE7F3F5A0F168ECCMXMA2012hpiunipot_-- From hsantos@isdg.net Sun Dec 15 07:59:15 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 027CB1AE06A for ; Sun, 15 Dec 2013 07:59:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.101 X-Spam-Level: X-Spam-Status: No, score=-100.101 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3A9DfazkejKJ for ; Sun, 15 Dec 2013 07:59:12 -0800 (PST) Received: from groups.winserver.com (news.winserver.com [208.247.131.9]) by ietfa.amsl.com (Postfix) with ESMTP id 0E0531AE064 for ; Sun, 15 Dec 2013 07:59:11 -0800 (PST) DKIM-Signature: v=1; d=isdg.net; s=tms1; a=rsa-sha1; c=simple/relaxed; l=3647; t=1387123147; h=Received:Received: Received:Received:Message-ID:Date:From:Organization:To:Subject: List-ID; bh=ROJAACN6+RWRLawqK5Tgiwe4Q6w=; b=Wwsd/ofSqydhvNUwnE0L kWix1N32YuZOr2wzXd4/94gPJ/9yzchM9Uze7h0419l58rcxr9Zk050xrG+cdP53 M9BZqXb5zIPu8WKm7bTPeeAmi7RZbNkn3JhqrbUwbO+olo/swfvH2VuzE33IYTbX ikdOxFsS3K0QeCu4qP4TZG0= Received: by winserver.com (Wildcat! SMTP Router v7.0.454.4) for secauth@ietf.org; Sun, 15 Dec 2013 10:59:07 -0500 Authentication-Results: dkim.winserver.com; dkim=pass header.d=beta.winserver.com header.s=tms1 header.i=beta.winserver.com; adsp=pass policy=all author.d=isdg.net asl.d=beta.winserver.com; Received: from beta.winserver.com (hector.wildcatblog.com [208.247.131.23]) by winserver.com (Wildcat! SMTP v7.0.454.4) with ESMTP id 700646235.4171.3460; Sun, 15 Dec 2013 10:59:06 -0500 DKIM-Signature: v=1; d=beta.winserver.com; s=tms1; a=rsa-sha256; c=simple/relaxed; l=3647; t=1387122632; h=Received:Received: Message-ID:Date:From:Organization:To:Subject:List-ID; bh=mgGDQK0 KBMH+7awyozvRmr0zXFI99/qXxTd9NQCJmik=; b=KMLvjG5jM+UB/U/ltHboyqh 3VwpttV55a1seMG6UzdTJJGTjLHUktsgA3Gq9bW6pHWzpS/wyCE24beWknQ+VKso loPO3MeUAFDkf++LqwLqCu8+X5IQhnAMW7WGR49cUAMZaN0ld+s54KSZEp+2TScp ujJjXFUqI2uEAbbZdxjw= Received: by beta.winserver.com (Wildcat! SMTP Router v7.0.454.4) for secauth@ietf.org; Sun, 15 Dec 2013 10:50:32 -0500 Received: from [192.168.1.2] ([99.121.4.27]) by beta.winserver.com (Wildcat! SMTP v7.0.454.4) with ESMTP id 146977770.9.208; Sun, 15 Dec 2013 10:50:30 -0500 Message-ID: <52ADD1C3.5020106@isdg.net> Date: Sun, 15 Dec 2013 10:58:59 -0500 From: Hector Santos Organization: Santronics Software, Inc. User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: "Rafiee, Hosnieh" References: <8EBBE4774B42FC45BA1143BE7F3F5A0F168DAF@MXMA2012.hpi.uni-potsdam.de> <95892BF3-AAC0-4292-A637-BB053A866420@cisco.com> <8EBBE4774B42FC45BA1143BE7F3F5A0F168E9B@MXMA2012.hpi.uni-potsdam.de> <8EBBE4774B42FC45BA1143BE7F3F5A0F168ECC@MXMA2012.hpi.uni-potsdam.de> In-Reply-To: <8EBBE4774B42FC45BA1143BE7F3F5A0F168ECC@MXMA2012.hpi.uni-potsdam.de> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: "secauth@ietf.org" , "Fred Baker \(fred\)" Subject: Re: [Secauth] initual attempt for auth categorization X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Dec 2013 15:59:15 -0000 On 12/14/2013 6:32 PM, Rafiee, Hosnieh wrote: > I start with these definitions: > > Authentication: > > ------------------------- > > 1- Definition > > The process of identifying an entity. In other words, answering this > question that who is this user? Is "WHO" is as important as being confident that authentication yields a consistent and persistent result? I think this introduces the idea of Authentication Portability, for example.... > > 2- Real world example > > The airport security authenticate a person based on his travel > documents, i.e., his passport. Can the authentication entity, in this case, a passport, be portable? If not, what prevents it from being portable? The Photo? > 3- Scope & use cases > > - Application layer > > User authentication examples: To access a website, To check an email, > To check your bank account We switched the authentication entity example. An login id, email address are portable authentication entities. > Authorization: > > ------------------------- > > 1- Definition > > The process of giving an entity a possibility to access some resources > or authorize it to do something either on a single node or for the > whole network. It is more to do with policies than other scopes. > > Important: the entity needs first to be authenticated then one can > define a policy for this entity based on its unique identifier > (whetever used to access other entity on the network) > > 2- Real world example > > A guard of a building can enter to the building and go to all > corridors but only can go to room A and B but not room C. He does not > have a key for that room. > > 3- Scope & use cases > > - Application layer > > User authorization examples: a normal user can only access to his own > home directory in Linux but root users is the user who define the > policies for other users and has full access to some resources. > > Computer authorization examples: An automatic updater can only install > updates if the user before authorize it to do so. > > -Network layer > > - Computer authorization example: Routers are only authorized by a > trusted authority to advertise certain router prefixes > > Any thoughts? I think Authorization is easier to define, obtain, achieve, comprehend and probably have too much trust in its proper mode of operation than authentication. Of course, the classic security problem example are "Compromised Users." Pattern recognition should/can/is been part the process, i.e., recognizing unauthorized usage or major changes in usages can trigger red flags. A good example is average monthly credit card purchases suddenly changing. Btw, What are the goals of this WG? You stated an API, a "library" of sort. Overall, I think much of this leads to the idea of having an universal, persistent, consistent id that can applied across many use cases. This can help with the authorization process. It is managed by a centralized system. But there is still much resistance to this single source centralization. But, is it useful to discuss existing public domain "APIs" to ask why they don't work or can't work? It seems much of your excellent outlining appears to be duplicate or already thought out issues, all with the same basic real world and insecurity issues. To me, no matter how great the "API" and its coverage of functionality is, the "Compromised User" problem seems to be the same basic problem with all methodologies. This is probably why, ideas like physical identification methods are increasing (Fingerprint, Eye scanning, etc). -- HLS From michael.hammer@yaanatech.com Sun Dec 15 12:22:20 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 67F091AE1BB for ; Sun, 15 Dec 2013 12:22:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.861 X-Spam-Level: X-Spam-Status: No, score=0.861 tagged_above=-999 required=5 tests=[BAYES_50=0.8, J_CHICKENPOX_47=0.6, RP_MATCHES_RCVD=-0.538, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HyJkI1cbBbWG for ; Sun, 15 Dec 2013 12:22:17 -0800 (PST) Received: from email1.corp.yaanatech.com (webmail10.yaanatech.com [63.128.177.10]) by ietfa.amsl.com (Postfix) with ESMTP id BBD661AE1A1 for ; Sun, 15 Dec 2013 12:22:17 -0800 (PST) Received: from SC9-EX2K10MB1.corp.yaanatech.com ([fe80::149d:c2e1:8065:2a47]) by ex2k10hub1.corp.yaanatech.com ([::1]) with mapi id 14.01.0218.012; Sun, 15 Dec 2013 12:22:17 -0800 From: Michael Hammer To: "rafiee@hpi.uni-potsdam.de" Thread-Topic: Welcome and to do things Thread-Index: Ac72pxKV0NC1ujRHSxmjC+m7pii5ewAAMw2wAAFpGfAACtxd4AAT58vgAAmdJaAAVOi7AABLxUCg Date: Sun, 15 Dec 2013 20:22:17 +0000 Message-ID: <00C069FD01E0324C9FFCADF539701DB3BBF09D6F@sc9-ex2k10mb1.corp.yaanatech.com> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F141F0D@MXMA2012.hpi.uni-potsdam.de> <8EBBE4774B42FC45BA1143BE7F3F5A0F141F91@MXMA2012.hpi.uni-potsdam.de> <00C069FD01E0324C9FFCADF539701DB3BBF085FB@sc9-ex2k10mb1.corp.yaanatech.com> <8EBBE4774B42FC45BA1143BE7F3F5A0F142361@MXMA2012.hpi.uni-potsdam.de> <00C069FD01E0324C9FFCADF539701DB3BBF08892@sc9-ex2k10mb1.corp.yaanatech.com> <8EBBE4774B42FC45BA1143BE7F3F5A0F168D59@MXMA2012.hpi.uni-potsdam.de> In-Reply-To: <8EBBE4774B42FC45BA1143BE7F3F5A0F168D59@MXMA2012.hpi.uni-potsdam.de> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.17.100.149] Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_0033_01CEF9A9.6F8A31C0" MIME-Version: 1.0 Cc: "secauth@ietf.org" , "kathleen.moriarty@emc.com" Subject: Re: [Secauth] Welcome and to do things X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Dec 2013 20:22:20 -0000 ------=_NextPart_000_0033_01CEF9A9.6F8A31C0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit "what I meant is to make the parameters that is used in network layer for authentication available in upper layers so that if any applications or services would like to use them for a secure authentication, it can do it by calling this library without going through the understanding of network layer or security in that layer." That is a self-contradiction. You either understand the lower layer or you don't. You can't have your cake and eat it too. You don't have to integrate layers to create unhealthy dependencies between layers. What happens to your security if I replace the IP layer and it may be based upon with some other network or internetwork protocol? It breaks. Also, if something unexpected happens in the IP layer, again, your application breaks. We experienced that with SIP. Despite protestations, you are coupling layers together. That is bad. Not good architecture. The whole point of PKI is to not have to pre-share keys, which is the core problem you cite. The mechanisms exist, but the will to do the implementation is lacking. That does not mean the technology is bad, just that the implementation is bad. Because of mobility, you can't always know what the IP address is going to be in advance. Does your solution need to be resilient to mobility? Your delay and battery usage is going to increase the more layers you replicate security in. As far as an application is concerned, if the PKI is done properly and TLS works properly, what more are you lacking? Mike -----Original Message----- From: Rafiee, Hosnieh [mailto:rafiee@hpi.uni-potsdam.de] Sent: Saturday, December 14, 2013 4:25 AM To: Michael Hammer Cc: kathleen.moriarty@emc.com; secauth@ietf.org Subject: RE: Welcome and to do things Hi Mike, To be clear here, to have a good local security within the networks, one would need to apply one of the current security approaches. There are a few approaches available for this means in network layer (and in specific in IP layer) such as SeND or some other non-secure approaches that at the moment is in use for this purpose. If one can spoof the IP, it might be easier for him to play the MITM attack since upper layer don't have much information about the owner of this iP. Moreover, In a network with hundreds of nodes, you're not going to preload every single node with the self-generated certification of each other. IMHO, It is too much work. So, what the nodes really would do is to exchange their public keys to each other by starting the communication based on their IP address. If there is no attacker during this start. Everything seems to be fine but what if the attacker now listen to this communication and spoof the IP address of the other nodes and send the public key of himself to the real node. This is just a thought, correct me if I am wrong and tell me why you think it is NOT possible. We all here to discuss about possibility usability of the opinions here and share and decide on the best one. We can come up with the implementation or a library of what is integrated with the current TLS, etc secure approaches. It is also possible that we can come up with the alternative one. BTW, please do not misinterpret my sentence about integration of authentication in all layers. I do not mean to physically integrate all OSI layers but what I meant is to make the parameters that is used in network layer for authentication available in upper layers so that if any applications or services would like to use them for a secure authentication, it can do it by calling this library without going through the understanding of network layer or security in that layer. The most important thing on which we want to focus is that we have thousands of devices (mobile phone, cars, laptops, PCs, ipad,tablets, etc) that are increasing every minutes. All what are going to use IP as a means of communications. I only imagine a world full of IP based devices. Companies also would like to offer the best services to their customers by fancy ideas such as controlling all your devices via public networks, i.e., Internet and access them wherever you are!. For me, it is really a scary scenario and I guess with fast growing technologies, you have to expect this in next few years. (some companies already offer some services such as controlling your home from your work, etc). Since they are IP based, any flaws in network layers can have a direct effect the privacy and security of the user. One might say, the attacker cannot be inside the network. I am really opposite of this sentence. If one only read the security news, recently millions of facebook and yahoo password hacked. Both company claimed that it wasn't any flaws in their system but they can do nothing about the malwares on users' system. These are only a few reasons that why we need network security and when we go through the implementation of that to decrease the delay, why not to use the same authentication approach in other layers? > Issues and thoughts > - Problem with spoofed identification > >> What identity? Who is spoofing? Why are they spoofing? More > >> specifics > please. The identity can be a session ID or it can be your computer's IP address. > - Problem with performance > >> Performance of what? When you use any security approaches, verification needs time. Generation needs time. For some applications and services, this time might not be acceptable. One example is using VoIP. It is real time application and there is a maximum delay threshold. The other important factor is CPU and battery usage. This is especially important for devices that has limited computational resources and using an approach that might busy the whole CPU for some time for generation/verification is not ideal as the device lose its functionality So, If I want to summarize here, the factors are delay tolerance, CPU usage, Battery usage. > - Problem with unique means of authentication -> barriers on device > supports > >> What means of authentication? What device? I have already explained this that what is in my mind is a cross framework implementation that is possible to use in all devices (car, mobile phone, laptop, pcs. Servers, etc) > - problem with having secure approach in upper layer but ignoring the > attacks on lower layers > >> Sounds like a lower layer problem. Architecture keeps layers > >> separate > for a reason. Nope, If there is a security problem in lower layers, the chance of harming the target system is more than 50%, although, one secured your upper layers. > >> You don't want to create cross-layer dependencies that then cause > >> Apps to > fail when lower layers are modified. Again it is not cross layer dependencies. The purpose is not to integrate layers but only use or integrate the authentication of one layer for other layers. Because, for providing such library the main layer, i.e., network layer needs to have this implementation, the upper layers only benefit from it but not dependent to it. > - Problem with deploy ability of the existing approaches (operational > barriers) > >> Seems like consideration rather than core issue. There are a lot of standards in IETF that really cannot be implemented or only disabled since there wasn't any consideration from operational view. So, IMHO, it is really important to consider this fact and I see it as one of the main issue with many existing approaches > - Is it better to do authentication in lower layers such as network layer? > (link layer is only valid in local link so it might not be useful to > go through that since not accessible in other networks) > >> Same can be said for network level. Do you want to authenticate > >> every > packet? > >> Are you trying to make something connectionless connection-oriented? Not exactly. Since, I do not think like TLS you need to have a handshake otherwise we come up with something that merge to SSL or TLS. > - Any alternative means of authentication except using only SSL or > other protocols to secure the process? Other security protocols as well. It was only an example. > >> Are you suggesting that an attacker can decrypt a TLS encrypted SIP > packet? If the certification of both communication nodes are not preloaded or no CA is used, then, IMHO, the attacker has a chance to do this in a start of the communication. However, my main focus was on proxy servers. Since the communication in this case is not between two original end nodes but the proxy server is in between and this causes many security issues. The questions such as how the proxy server can identifies the both ending nodes and facilitate this connections. > >> These have been around a long time and studied by many. What is > >> new > here? The problem wasn't solved and still there :-) but might be improved. The most studies also in case there is no security approaches running there and they only focused on the protocol itself. > >> Last two are considerations of a solution, not a core issue. Many protocols are not implemented or have deploy ability problems because of automation problem. One big example is DNSSEC. There are many people working on this issue. So, IMHO, it is a big issue and not just a small consideration. I might be wrong but this is based on my observation. Smile, Hosnieh (Sara) P.S. Sorry for the delay to answer you. I had a nice?!! Christmas gift from my webhosting company, I.e., their system automatically deleted the DNS records and all mailbox related to one of my main domain that I use for ietf and other private stuff without any notification (I usually don't use this email for ietf).... they are really a good entrepreneurs since they made me busy with many tasks and still continues... They THOUGHT that when I transferred the domain to other registrar, I also want to delete it! I hope next time before they use their thoughts, they ask me before... ------=_NextPart_000_0033_01CEF9A9.6F8A31C0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIRPzCCBBow ggMCAhEAi1t1VoRUhQsAz684SM6xpDANBgkqhkiG9w0BAQUFADCByjELMAkGA1UEBhMCVVMxFzAV BgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTow OAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5 MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24g QXV0aG9yaXR5IC0gRzMwHhcNOTkxMDAxMDAwMDAwWhcNMzYwNzE2MjM1OTU5WjCByjELMAkGA1UE BhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBO ZXR3b3JrMTowOAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVk IHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDd hNS5tPmn2PMEeJzePdxsExbZet0kUWbAxyZZDawGCMKU0TMf8IM1H24byN6qbhVOVCfvxG0a7Avj DvBEpVfHQFgeo0cfcexg9m2UyBg57f5CGFbf5ExJEHhOAXY1YxI23Wa8AQQ2o1Vo1aI2CayrISZU Bq0/yhTgrMqtBh2V4vid8eBg/8J/dStMzNr+h5kh6rr+PlTX0ll42zxuz6ATABq4J6HkvmeWyqDF s5zdyXWe6zCaX6PN2a54GT8j6VzbKb2tVcgbVIxj9uim6sc3ElyjKR4C2dsfO7TXD1ZHgRUESq+D J9HFWIjB3faqp6MY2miqbRFR4b9la5+WdtE9AgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAKtmjdez useatuZV0AXxnzGNWqrZqkYmD3Htpa1TVmIBRypE6f4/dAsTm7n0TRuy0V+yttKIXLOfzcvUp9lg lYQ6+ME3HWHK57DF5ZHaVKasMYGul97NCKy4wJeAf25ypOdpE5VlH8STPP15jwTUPk/q957OzWd8 T2UC/5GFVHPH/zb3hi3s0F5P/xGfcgbWuBrxTA0mZeJEgB7Hn+Pd6Ara7KUggGlooU9+4WvPB0H6 g468ON2wLhGxa7JCzJq8+UgieUoZD7IcPiB02WrDvvIoeBNWeU9tUOobsLVXsTdmWCPz3A/fCofE 74YF1TgUYJmjS94GlnEs8tu2H6TvP+4wggZCMIIFKqADAgECAhA4qwAv/66Wt1b/OVr7XecbMA0G CSqGSIb3DQEBBQUAMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAd BgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNz IDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMzAeFw0xMTA5MDEw MDAwMDBaFw0yMTA4MzEyMzU5NTlaMIGmMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMg Q29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxHjAcBgNVBAsTFVBl cnNvbmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuU3ltYW50ZWMgQ2xhc3MgMSBJbmRpdmlkdWFs IFN1YnNjcmliZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbsJ/0d Y/Q7HYrB0xzIyIKGtrhKhpKqgVxyyjANL55BIlcwISWQmqP0rCrGiBeGYXITdi7sA8snm48ggDfg 5IraVaZQD/y5XCNpiUKhuh+v7w75pMkK8fg3ssbZkkqufd+4RB+buj+MBv7YI09IUSNqYISo7icv YN+W8hoqjDyPAMxPy/ogjrw19uHwmrYF8/wdP8YUew7a8gXk04MCpsVpcLSp5Fbp2x1c9KY24mu1 Hiot3L677joEsDAIrV9obMa9BpaIhOfmqWQtvDgwu4gmw2dmZrS0d/nAoccOcu9m4uW5yuDzhXc1 mN7UHLD+ZnHiOMtufE9AVeuX2agYHu0CAwEAAaOCAkQwggJAMDgGCCsGAQUFBwEBBCwwKjAoBggr BgEFBQcwAYYcaHR0cDovL3BraS1vY3NwLnZlcmlzaWduLmNvbTASBgNVHRMBAf8ECDAGAQH/AgEA MGwGA1UdIARlMGMwYQYLYIZIAYb4RQEHFwEwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1h dXRoLmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwNAYD VR0fBC0wKzApoCegJYYjaHR0cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMS1nMy5jcmwwDgYDVR0P AQH/BAQDAgEGMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFWZXJpU2lnbk1QS0ktMi05NzAdBgNV HQ4EFgQUrfnDk3IttbkoYeSk12DVxApeGgEwgfEGA1UdIwSB6TCB5qGB0KSBzTCByjELMAkGA1UE BhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBO ZXR3b3JrMTowOAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVk IHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IC0gRzOCEQCLW3VWhFSFCwDPrzhIzrGkMA0GCSqGSIb3DQEBBQUA A4IBAQDWj8Ham4jys2xNH1gvugFRXXTBRujDuHuf1kDx7/8yuolrwA40Q5+kmeak8F1IM2KFhWH+ I4gijGCbK5xlSZTEojgkSKVcpVBLaOliIqeT6Jkibj1buxBCDh9MdUc0VgmP+L2MPPNcu9KWcFRw Yk3v0RC+nUgsXuyGaweC8D3hJScoLOAWdh6z/eViltKKPV8rrvtcwhO3ZWPLNHZDn9aHmaturZXB AD9GJ4H/Nd4jDkPcFF8y+cop78JSMPWZ3bmB+DolII2CaPK5IYV0ZgThhjkWMvIt1iqoyd7ZAAJP 4xggxaWBVraV3tOCrfh7Jb5kfC6gunAs+Pl14nRNB22EMIIG1zCCBb+gAwIBAgIQEB3dROkPDT0Q 6QYEc74tcjANBgkqhkiG9w0BAQUFADCBpjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVj IENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMR4wHAYDVQQLExVQ ZXJzb25hIE5vdCBWYWxpZGF0ZWQxNzA1BgNVBAMTLlN5bWFudGVjIENsYXNzIDEgSW5kaXZpZHVh bCBTdWJzY3JpYmVyIENBIC0gRzQwHhcNMTMwNDAxMDAwMDAwWhcNMTQwNDAyMjM1OTU5WjCBzjEu MCwGA1UEAwwlUGVyc29uYSBOb3QgVmFsaWRhdGVkIC0gMTM2NDg0MjY5NDQ0MzErMCkGCSqGSIb3 DQEJARYcbWljaGFlbC5oYW1tZXJAeWFhbmF0ZWNoLmNvbTEPMA0GA1UECwwGUy9NSU1FMR4wHAYD VQQLDBVQZXJzb25hIE5vdCBWYWxpZGF0ZWQxHzAdBgNVBAsMFlN5bWFudGVjIFRydXN0IE5ldHdv cmsxHTAbBgNVBAoMFFN5bWFudGVjIENvcnBvcmF0aW9uMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEAh2AtKQNowI8ILmNvdcY16moA8CH7hjSvGDNofwWsh4quEfZ6VQGtDhhOjUmW6JVq 719MH8FNJcVr8oAiVaK3nNeJTL2wO68LpgX6tcZ/z22pJoz98wHzgfWf3pfEUYrCqYg2V3m6oe0t kd+OaeY8DmPVSpG7as0rkoEzeNwCtmpYjkm96mBO6/AQwsowSLbSuqkEGykp1k47KiPBtxhbp2um IReh94vPrr1O9zXau9oGMvABJjigYQ2e5AhhhDdK8qOkhgkMAJN2nvLqY+VFrnFIsb5noQ/tP2M/ ct9qwRZ5kUaumRqE/XzV3rH8PoacZW/YvcwAp8Gr1ZaHCMRl+wIDAQABo4IC1TCCAtEwDAYDVR0T AQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMC MB0GA1UdDgQWBBTlvYUx4PMlUy6uvceJkDMK4jBDZjAnBgNVHREEIDAegRxtaWNoYWVsLmhhbW1l ckB5YWFuYXRlY2guY29tMB8GA1UdIwQYMBaAFK35w5NyLbW5KGHkpNdg1cQKXhoBMIIBKwYIKwYB BQUHAQEEggEdMIIBGTCCARUGCCsGAQUFBzAChoIBB2xkYXA6Ly9kaXJlY3RvcnkudmVyaXNpZ24u Y29tL0NOJTIwJTNEJTIwU3ltYW50ZWMlMjBDbGFzcyUyMDElMjBJbmRpdmlkdWFsJTIwU3Vic2Ny aWJlciUyMENBJTIwLSUyMEc0JTJDJTIwT1UlMjAlM0QlMjBQZXJzb25hJTIwTm90JTIwVmFsaWRh dGVkJTJDJTIwT1UlMjAlM0QlMjBTeW1hbnRlYyUyMFRydXN0JTIwTmV0d29yayUyQyUyME8lMjAl M0QlMjBTeW1hbnRlYyUyMENvcnBvcmF0aW9uJTJDJTIwQyUyMCUzRCUyMFVTP2NBQ2VydGlmaWNh dGU7YmluYXJ5MF0GA1UdHwRWMFQwUqBQoE6GTGh0dHA6Ly9wa2ktY3JsLnN5bWF1dGguY29tL2Nh XzU2MWMxMDM2OTBjOTdhNjkyNDdhMGVmMDcxYWM4MWFmL0xhdGVzdENSTC5jcmwwbAYDVR0gBGUw YzBhBgtghkgBhvhFAQcXATBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2Nw czAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTAqBgpghkgBhvhFARAD BBwwGgYRYIZIAYb4RQEQAQICBAGGsxcWBTEwOTIyMA0GCSqGSIb3DQEBBQUAA4IBAQAae/er4pfB TpqK6c/uJ9D8dVJzzNX26akkB8z/29totzbkpFAIlXRh02iNVK+GnsgS1gwu3FOvjgT5M4i+cNxD vTJVcnZNXns75JUGX3UsWQbtSySrVzQx8lMtwW6nXHM5GlEaY8/jKVpambG2q9OHjmwMTz7I4A+y KiiGCGdhE23dFOvku6t/oiwqFnXJmb4o75kbVevKEOd34MIj0P7Q8+1mZcNYEUTYKadoPXFyTWnO 2HTMvFcGgdLFKcqb13clWeW3/B5WjdBimpMjbvwi8ZbrhFdp7Y3NLKFSRH8W29rt0LW7zULxii0z 34NGsBkW9w95PLzTsqmKD4Yv5AkIMYIEkjCCBI4CAQEwgbswgaYxCzAJBgNVBAYTAlVTMR0wGwYD VQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29y azEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFsaWRhdGVkMTcwNQYDVQQDEy5TeW1hbnRlYyBDbGFz cyAxIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQSAtIEc0AhAQHd1E6Q8NPRDpBgRzvi1yMAkGBSsO AwIaBQCgggKrMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTEzMTIx NTIwMjIxNVowIwYJKoZIhvcNAQkEMRYEFA6B54yNPDmGYiZ5H7hyqbk6EU7OMIGrBgkqhkiG9w0B CQ8xgZ0wgZowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggqhkiG9w0DBzALBglghkgBZQME AQIwDgYIKoZIhvcNAwICAgCAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgFAMA0GCCqGSIb3DQMCAgEo MAcGBSsOAwIaMAsGCWCGSAFlAwQCAzALBglghkgBZQMEAgIwCwYJYIZIAWUDBAIBMIHMBgkrBgEE AYI3EAQxgb4wgbswgaYxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlv bjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazEeMBwGA1UECxMVUGVyc29uYSBOb3Qg VmFsaWRhdGVkMTcwNQYDVQQDEy5TeW1hbnRlYyBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJl ciBDQSAtIEc0AhAQHd1E6Q8NPRDpBgRzvi1yMIHOBgsqhkiG9w0BCRACCzGBvqCBuzCBpjELMAkG A1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRl YyBUcnVzdCBOZXR3b3JrMR4wHAYDVQQLExVQZXJzb25hIE5vdCBWYWxpZGF0ZWQxNzA1BgNVBAMT LlN5bWFudGVjIENsYXNzIDEgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBIC0gRzQCEBAd3UTpDw09 EOkGBHO+LXIwDQYJKoZIhvcNAQEBBQAEggEAAW7URTrsAxd3sw5du/YrvuIGh45Op4HG//PqOK0r MZ8/lQQuPrY1GHSiRQlBRCSm52X8oXkxyF8N0lobnr/oKHOpPk4UAzca61cTSdJbZkkuSIls+jv+ gM4CO471PwuRXmJMy/kEGILbcVVGeTOacgQVQZqaeg0FkPT3dMKgq0WHfxL8AqUJ1HLobL05sMKC gQV2caA6s9jXtxcf2NWzq+940h48xPx5A6ulwsbA2SGdpZXCXeLHvByDp++zU0oZESUXeobYGMRF vX5OeIkHvYSvogmszOvq8g4DG79onxRYKktw9HKTC6Km+jDvkEq819vB9vNk4ff/pnL2NoEuQAAA AAAAAA== ------=_NextPart_000_0033_01CEF9A9.6F8A31C0-- From michael.hammer@yaanatech.com Sun Dec 15 12:23:54 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5AB31AE1C7 for ; Sun, 15 Dec 2013 12:23:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_IMAGE_RATIO_02=0.437, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.538, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DgUDzl7o-TkZ for ; Sun, 15 Dec 2013 12:23:52 -0800 (PST) Received: from email1.corp.yaanatech.com (webmail10.yaanatech.com [63.128.177.10]) by ietfa.amsl.com (Postfix) with ESMTP id AC2BF1AE1C1 for ; Sun, 15 Dec 2013 12:23:52 -0800 (PST) Received: from SC9-EX2K10MB1.corp.yaanatech.com ([fe80::149d:c2e1:8065:2a47]) by ex2k10hub1.corp.yaanatech.com ([::1]) with mapi id 14.01.0218.012; Sun, 15 Dec 2013 12:23:52 -0800 From: Michael Hammer To: "rafiee@hpi.uni-potsdam.de" , "secauth@ietf.org" Thread-Topic: initual attempt for auth categorization Thread-Index: Ac74vbBpyyGo4TgmSYCHGvGv05Nq3QBFdhLw Date: Sun, 15 Dec 2013 20:23:51 +0000 Message-ID: <00C069FD01E0324C9FFCADF539701DB3BBF09D8F@sc9-ex2k10mb1.corp.yaanatech.com> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F168DAF@MXMA2012.hpi.uni-potsdam.de> In-Reply-To: <8EBBE4774B42FC45BA1143BE7F3F5A0F168DAF@MXMA2012.hpi.uni-potsdam.de> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.17.100.149] Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_0038_01CEF9A9.A7F53FA0" MIME-Version: 1.0 Subject: Re: [Secauth] initual attempt for auth categorization X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 15 Dec 2013 20:23:55 -0000 ------=_NextPart_000_0038_01CEF9A9.A7F53FA0 Content-Type: multipart/related; boundary="----=_NextPart_001_0039_01CEF9A9.A7F53FA0" ------=_NextPart_001_0039_01CEF9A9.A7F53FA0 Content-Type: multipart/alternative; boundary="----=_NextPart_002_003A_01CEF9A9.A7F53FA0" ------=_NextPart_002_003A_01CEF9A9.A7F53FA0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Ummm.. Wikipedia? J From: Secauth [mailto:secauth-bounces@ietf.org] On Behalf Of Rafiee, Hosnieh Sent: Saturday, December 14, 2013 6:15 AM To: secauth@ietf.org Subject: [Secauth] initual attempt for auth categorization Folks, I'd consider two categories. If you think there are more, feel free to add. (two versions, picture and text ) Trusted authority for securing it ^ + xxxxx x xxx xxxxxxxxx xxxx xxx xxx xx xx +--------------------+ | IP based access | | Lists | +------->+--------------------+ + +----------------------+ Authentications+----+ +-------->| Session ID | | +--------------------+| | based | +------->| unique identity |+ +----------------------+ | based |+ +--------------------+| +----------------------+ +-------->| Username/Password | | based | x +----------------------+ xxx xx xxxx xxxx xxxxx xxxx xxxxxxxx xxx x xxx x SSL or TLS might be in use for security Question: -How many percentage of authentication is IP based? Problems: Security costs -> register in CAs -How many are mixed (IP based and any of the approaches in second category? Smile, Hosnieh P.S. maybe we can also have a nice wiki at the end by gathering all existing approaches and their purposes. Right? ------=_NextPart_002_003A_01CEF9A9.A7F53FA0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Ummm….  Wikipedia?  J

 

 

From:= = Secauth [mailto:secauth-bounces@ietf.org] On Behalf Of Rafiee, = Hosnieh
Sent: Saturday, December 14, 2013 6:15 = AM
To: secauth@ietf.org
Subject: [Secauth] initual = attempt for auth categorization

 

Folks,=

 =

I'd = consider two categories. If you think there are more, feel free to add. =

(two = versions, picture and text )

 =

 =

           &= nbsp;           &n= bsp;           &nb= sp;       Trusted authority for securing = it=

           &= nbsp;           &n= bsp;           &nb= sp;       ^=

           &= nbsp;           &n= bsp;           &nb= sp;       +=

           &= nbsp;           &n= bsp;           &nb= sp;  xxxxx x xxx=

           &= nbsp;           &n= bsp;      = xxxxxxxxx          = xxxx=

           &= nbsp;           &n= bsp;    = xxx           &nbs= p;         xxx=

           &= nbsp;           &n= bsp;  = xx            = ;            =   xx=

           &= nbsp;           &n= bsp;       = +--------------------+=

           &= nbsp;           &n= bsp;       |  IP based = access   |=

           &= nbsp;           &n= bsp;       |     = Lists          = |=

           &= nbsp;          = +------->+--------------------+=

           &= nbsp;          = +            =             &= nbsp;           &n= bsp;   +----------------------+=

  = Authentications+----+        &nbs= p;            = ;         +-------->|  = Session ID          = |=

           &= nbsp;          = |        = +--------------------+|         = |     = based            = |=

           &= nbsp;          = +------->| unique identity    = |+         = +----------------------+=

           &= nbsp;           &n= bsp;       |     = based          = |+=

           &= nbsp;           &n= bsp;       = +--------------------+|         = +----------------------+=

           &= nbsp;           &n= bsp;           &nb= sp;           &nbs= p;     +-------->|  = Username/Password   |=

           &= nbsp;           &n= bsp;           &nb= sp;           &nbs= p;            = ;   |      = based           = |   x=

           &= nbsp;           &n= bsp;           &nb= sp;           &nbs= p;            = ;   +----------------------+=

           &= nbsp;           &n= bsp;           &nb= sp;           &nbs= p;       = xxx           &nbs= p;            = ;     xx=

           &= nbsp;           &n= bsp;           &nb= sp;           &nbs= p;         = xxxx           &nb= sp;          = xxxx=

           &= nbsp;           &n= bsp;           &nb= sp;           &nbs= p;            = ; xxxxx    xxxx xxxxxxxx=

           &= nbsp;           &n= bsp;           &nb= sp;           &nbs= p;            = ;       xxx    = x=

           &= nbsp;           &n= bsp;           &nb= sp;           &nbs= p;            = ;            = xxx=

           &= nbsp;           &n= bsp;           &nb= sp;           &nbs= p;            = ;            =   x=

 =

           &= nbsp;           &n= bsp;           &nb= sp;           &nbs= p;            = ;          SSL or TLS might = be in use=

           &= nbsp;           &n= bsp;           &nb= sp;           &nbs= p;            = ;          for = security=

 =

 =

 =

 =

Question:

-How many = percentage of authentication is IP = based?

Problems:

Security = costs -> register in CAs

-How many = are mixed (IP based and any of the approaches in second = category?

 =

Smile,=

Hosnieh

P.S. maybe = we can also have a nice wiki at the end by gathering all existing = approaches and their purposes. Right?

 =

------=_NextPart_002_003A_01CEF9A9.A7F53FA0-- ------=_NextPart_001_0039_01CEF9A9.A7F53FA0 Content-Type: image/jpeg; name="image001.jpg" Content-Transfer-Encoding: base64 Content-ID: /9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0a HBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIy MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAIkA6cDASIA AhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQA AAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3 ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWm p6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEA AwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSEx BhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElK U1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3 uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD3+iii gAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKA CiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiuU8aa3c6NHZta6ddXzysw2W7h doAzkk8YpxSbsxN2Vzq6K8z0XxfcaqWNzpt7psAi85Z7iZSjLnHUdPxrXTWbWR40j1SF2kUugWcE so6kc8iun6t5mPt/I7WiuKGsWxWJhqcRWY4iPnDEh9F55oudYtrOVYrvU4reRhlUlnCk/QE0fVvM Xt/I7WiuEu/Een2E0EN3q8MDzqWj8yYAMPXr0qwdVgWz+2NqMYtf+e5mGz/vrpR9W8x+38js6K42 HUo7m2Nzb36TW4zmWOXcox15FUIfE0V1rEVhaym5ikjZxdQzh0BXqpwc55FH1bW1w9v5HoNFcn50 3/PV/wDvo1WbWLVLsWj6nCt0ekJnAc/hnNH1V9xe38jtaK4x9UhjaVH1BFaEbpVaXBQeregqvd+I rCwhgmutWiiiuGCxO03yufY+nvR9W8x+38ju6K8/vfEa2+nrfWjtqEBkCO1tOCEB6knPartrqkN+ rNZ6glwFOGMMwbafQ4oWGv1D2/kdnRXFQaxbXNw1vb6nFNOn3oo5wzLj1ANNbXLJAxbVoFCPsbNw Plb0PPX2o+reYe38jt6K4a51lba8gtPtAeeZseX54VlH97BOSPpRf6/ZaXJDHf6nHbNOSIxLLtzj 69qPq3mHt/I7miuK/tm1+zJc/wBqQ/Z3bakvnjYx9Ac4JqQajGbn7ML5TcFd3k+b8+PXHXFH1XzF 7fyOxork/Om/56v/AN9GuZvfHcUGs/2ZZqb6RSokaO8jQKW7YY5J+lJ4aztcarX6HqVFcVcaxbWk kcV3qUVvLIAVjlnCsfoCeafLqUUEywzX6RzOMrG8uGYeoFP6t5i9v5HZUVx1vqC3cImtb0TxE4Dx SblP4ipTcSqCzTOABkkt0p/VX3D267HWUVxVtrNreuY7TVIbhx1WKcMf0NEOs2txdNawapDLcLnd Ek4LjHXIzml9W8w9v5Ha0VxVxrNraTLDc6pDBKwysck4Vj+BNKdVgHmZ1GMeUu6T98PkHqfQUfVv Mft/I7SiuLbVrdEhdtSjVJjiJjMAJP8Ad9aQaxbNBNMupxNFCdsricbUPoxzwaPq3mL2/kdrRXEW usC50/7a8/kw85czhlwO+4HGKdBrFrdTtBbapDNMoyY45wzAeuAaPqvmHt/I7WiuJl1uzgneCbVY I5kG543nAZR6kZ4qytxI6hlnZlYZBDcEULC36h7fyOtoriNR1hdNg8ya5AdjiON5whkPoCTRfazB pll9rv74W0PA3SSYGT296Pq3mP2/kdvRXM+H9TttRvCbW/iukVTuMUocD64rpqxqQ5HY0hPnVwoo orMsKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACii igAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKK ACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACua8Z3sWn6U08/mGMRupEcZdiSM Dgc10tVL20juQrySGMRgnIOKuDSepMk2tDzXw1qdnN4N3SxT+Tboyzxy27AnvjaR81ZXgyLw5OZI rfT5kvTM8u6a2dAq54CkjAGP4RXqVtYWV7AtxbXvnxN92SNwyn6EVKdGjIwZpDXX7aHNd/kc3s52 seOXOoWVrZx6YdKuGubTUNxKWhKwJuHzKccj6U3xaumajrN8ssmow3JQRrGLDzY5+4w5BKA5wcV7 N/Y0eMefJxQNGjAwJ5fzqPaQcbN/1ZL9C+Sad7f1ueZava2Njb6Dd6npMckNtH5U6JB5xjyoAXGC SAc1X8QR/wBqeHNPuYba507Topy7xRW6u3l4wreWRjGecYyK9UGixA5E0go/sWLOfOkz61UqtN31 3JVOatoeP6dZWf8AYWrNp17qN8jvE9xFNafZxsB5CKAByM5x1qewvdEl8cadPo+m3NvC0EkMkgtG ijLHG0EY68HmvWTo0Z6zSHFKdGjPWeX86SqwTTv/AFsDpzd9DC715X4kxJqd9NMb2K+S4Ux21rYh g0akYfzcZ5HOAfavb/7Eh/56yfpTho0YGBPJinOrCTTTCNOa6HmWo6hYWGrJeXFhNNFf2O1dlsXM rDGFfjj8apqtpc+CdMubjS2ZLK5DTQSW2WjXcdwC45HI6da9YGjRjOJpOetH9jRZz50maPaw1V/w 82/1D2c+39WseXapqOm3Pg+6+z6VcW2nySiOMRWxUyjPJCKMr6c0ItnFrF5p+j2kltJNpmE8uAxo z44y2MbsV6j/AGNHnPnSZ9aP7GixjzpMUva077/1awezn2/q9zyjT5dGubrSbXR9PmttRgkBmka1 aMgAHducj5smohJ4XuPGt41xps7PIqwpmyfy2fJyTxjP+1Xrh0aMjBmkIpf7Hjxjz5cfWn7WndXf 4B7OZ5Z4q1HSLLVNNja0ne6tJ0ZpY7NpCsf++Bz9KveIpNNvLTStZnsPtVnHNvffbb3VGBH3CM9c cV6KNGjAwJ5BSf2LFnPnSZ9aPbQs7vrfYPZy7dLf195wItbPxF4bkjt9KFtbq++0SSILuK8hgv8A Dk8c807QFTVLubX5LVI5nQW8RKYYKv3uev3sj6Cux1HwnY6taNa3kk7RMcnZIUP5jmm6Z4Q07R7J bOxaZIFJIVnLnJ9zTVaHNdidKdihXBWF/wCHf+Ex1EvpbbpmhWCRtObG8AhiDjjnvXrH9iQ/89ZP 0p39jx4x58v50OtByTuCpTs0eValLo1lqerxa3p01xeXLlreT7K0w2FcKFYA7ec1B4h/syPTtCtd ZtbmaZDG7vFA7usY6guoz9R3r1saNGBgTSCgaNGOk0gqfaQta/bp2K5J32OU0dNPFgs2mW/kW03z hPLMf/jvama/LFDoN480U8sXl7WWAZfB4yB3x1rrjosROTLJQNFhByJZKuVem42uSqU07njvhbTr Z9bln0yW5udtk8RnuLP7MYWIwoUADdnufaqei6dYQ6rp8V3qmqx6hBON8Q04KGcHkNKo5U+5r246 NE3WaQ0v9jR4x58uPrUKpTTTvt/ncbpzafmeTXx0SC51Sz17SJ7u9uZS0bLbtJ5iH7gVwPk9Ks3s 9joupRvc6TMIrqw8pYkg80sw6I5A/U16eNGjAwJpAKBo0Q6TSDNL2kLb/h5NfqPknfb+tH+h47e3 WmTfDy0t73T7kOXKLELVi8RDZIGB8vHcV0NrP4attAmvbaxddPYCKRDaMWftyhGWPvXoX9jR5z58 v50n9jR5z50mfWq9tC7d9/IXs56HlXh3V9Mfwvf2P2W4VYhNIYXs2VdhPGARg/SodKbR9OHhhrSw mgkdmDutqwbbzw5xnGcda9cOjxnrPL+dJ/Y0fP76TnrQqsOr7fgDpzfTv+J4pqiaXHp0mnajpsr6 wL3dJObckMC+QTJjBXaRxmvTgqooVVCqBgADgCrE/gLR7rVF1Gc3L3CkMAZ28vI6fJ0/StT+xIf+ esn6UU60Iqz/AK6BOlJs878c3emxaO1veWr3FxIpNuEtTLtI75A+U0t9PZ+IvBUrQWr3CxKn7ue3 KtuXGcKw9M16INGiXpNIKDosROTNITR7WDvrv5Aqc1bTY5XwNf6de38o0nSmtLVU+aU2/kh37rtw Dx613tUrbTktp/NEjsQMfNV2uetNSldG1KLjGzCiiisjQKKKKACiiigAooooAKKKKACiiigAoooo AKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigA ooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACi iigAooooAKKKKACqOr6aNX09rNriWGOQjeY+Cy91+hq9RQBlaToFrolxcGwLRWs2CLVQBHGw4JUd s8Vq0UUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFF ABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUA FFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAU UUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRR RQAUUUUAFVb/AFGz0y2NxfXcFtFnAeaQIufTJq1Ve8sbXULcw3dtDcR9Qk0Ydc+uDSle2g0ZXhvx NYeILNWhvrOW5y2+KCYMVAYgHGc9BW7WN4e8O2eg2SxxWtok+W3SwwhCwLEgZxnvWzVO19CVcKKK KQwooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKK ACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA KKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAo oooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACoLu9tdPtzcXlzFbwgg GSVwqgnpyanrm/HV1Y2vhO7/ALQ0qbVIZF2C0hiLs5PTp0+tKTsrjSu7Gv8A2xpvmvF/aFr5iR+a yeauVT+8Rnp701Nb0mQ24j1K0Y3JxBtmU+b/ALvPP4V5t4RZNB1HUIdf0+e+1FrJXOoR2bbJIQvE OMdQOMd6z/DCxafr2k399olz/Z9w0v8AZVsLRt2lZPIfj+I9+1Vb3rf11/r7/Im75bnq51/R1ikk Oq2Qjify5GM64V/7p54PtUj6xpkc0sL6harJEnmSI0ygovXcRnge9eP6n9nuNdvNXTQLo6BHfxrc 6b9jYPdTjpcDj7o9O+Per/jPbrOvTtpOl3EJt7AtfztZti+gPP2dePve/wCFTfRP+tr/ANeXnoVb Vr+t/wCvn5anqA1rS2NuF1G0JuRmDEy/vR/s88/hU1pf2d+rtZ3UNwqNscxSBgp9DjvXmGt3Fpq+ j+G7HQNFudO1FsGyupLJtunbRzu478jHvmul+G8tn/wj8lrbaVPp80EzLcCWEp5smeZAT1B61Vt/ Im+3mddPcQ2sDz3EqRQxjc8jsFVR6kmq0esaZLLBFHqFq8lwu6FVmUmQeqjPI+lRa/dWtnoV5PeW j3dusR328cfmGQf3QvfNeY+Col03xJpkupaTcOt3bt/ZbC1YDTIif9Q5x196UdZW/rr/AF/Su5aR uewVRfWtLie4STUbRHthmdWmUGIf7XPH41erxzxii6n4j1Sex0e4W1s4VGqp9kbOqJu4jQ46qec9 80r62HbS56t/bGmGWGL+0LXzJk8yJfOXLr/eAzyPeoxr2jmCOcapZGGSTy0k89drP/dBzyfavO/E s0WtyaDa+H9MnsNRWAyQ30lk221i24aI8dWHGKqy3mkTfDex06z8LXlvcPOIoIms2/0afP8Arzx0 B+b36VXf1/W39efkT2/roerW+oWV3PNBb3cE00JxKkcgZk+oHSrNcD8Otlpc6tp93YyjWEm3XmoG 3KJet/fUkdPau+otogTCiiikMKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKK KACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoooo AKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigA ooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACivMPGGsa1o3iG5srPW5jHqMSiNhGpTSmz 9+Tj7rDpnvmrvivUdV8NR6PfQ6tc34EfkzWMKKZLskf61eOx5PbFK/u8wW1sehUV5xcSa1afDq21 I+LDPexOLhpY40xcjP8AqAMdT0HfNS6Bdavrvh3W9Sl8Qy2Dzkm3hlRA2mgDOHyOvrntTel/L+v6 /wCGBa28z0KivNvBWr6x4i1ZpLrVp7eG2tPJNpLGqtcvyDcLx9w9qpaTquu3Xie30B/EUxjtLp3f UGiQJfp2hQ4xuXocehp295L+v66/8EV9G/6/rp/wD1aivK/Eera5YeJbzRrbxBMqXzxvFeeWpj0w Z+ZJDj+L+HNX/Geq6t4bvbK5ttVubtJ7c27WUUallbHFyeM7QevbkVN/d5v6/rp/wB9bHotFed6r caxo/grSdTHiV725gdZJhCiE6iD1jQY6+mPejTZNY1LwRqmoyeKmtLiaRpYXeNB9hAPETj17Gm9L +QLW3n/X9f8ADnolFef+A9X1XxFqdzqF5fTwQRwpEulTxqsgYdZTxnDdq9AptWEncKKKKQwooooA KKKKACiiigAooooAKKztfiml0K8W31H+zZvLJS7wMREc5OeMetcP4K1fWPEWrNLdatPbw21p5JtJ Y1Vrh+QbhePuHtQtW0D0Vz0mivKdI1bXbvxPb6DJ4imMdndO8moNEgS/TtChxjcvQ49DTvEera5Y eJbzRbbxBMqX0kbxXnlqY9NGfmRzj+L+HNC1tbqD0vfoeqUV514z1XVvDd9ZXFrqtzdpPbm3ayij UsrY4uTxnaD1+orrvDEd1H4cs/tmqDVLho9z3agASE+mO1C1TYr7GvRRRQMKKKKACiiigAooooAK KKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoo ooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiii gAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKrahcTWmnz3FvatdTRo WSBGCmQjsCeKTdlcNyzRXH6P47bWtSsLO20a43TwtLct5ikWbA42Seje1V/+Fgz+etn/AMI9df2i b37K1mJkLqvXzv8Ac96q2tv63sK5ry+B/Ds8upyS6fufVFCXhMr/AL0DoDzx+FLB4J8P295aXcdi RPZwmCBzK5MaHggc+9Z2seO30S/1C0udFuC8ESyWuJV/03JxtjH94dxXU2M8t1YwTz2zW0siBmhc glCexIpJaabf8P8A8Ebeuv8AW3/AOej+HXhaKzt7RNMxb28/2mKPznwsn97rUs/gPw3cvqLy6fuO pEG7/fOPNPvzXSUUAc//AMIT4f8AttveCwxcW9v9licSuCsX93r0qBPh94YSys7NNNAgspjPbqJX /duerA56109FF9b/ANdw6WOak8A+GpoNRhk00NHqLrJdgyv+9ZTkE89qlTwT4fjvvtq2J+0fZjab zK5PlEYK9eldBRR0t/XYLnMw/D/wzbx2EcWnbU0+TzbVfOfETeo5pJfh74XmgvoJNNzFfS+dcp5z 4kfOcnn1rp6KAMa38K6Na62NZhtNuoCEQed5jElAMAEZwa2aKKLhYKKKKACiiigAooooAKKKKACi iigChrGjWGvabJp2pQeday/fj3Fd35Gs7/hCfD/22C8Fji4gtxaxuJXBWIfw9enNdBRRYLnMJ8Pv DCWVlZppoWCymM9uolf9256sDnvTpPAPhqaDUIJNNDR6i6yXQMr/AL1lOQTz2rpaKAOfTwT4fjvf ti2J+0fZjabzK5PlEYK9elX9F0PTvD2nLp+l2/kWqElY95YDP1JrJ1zxedB1cWl1pkotXt2ljvDK oR3Uf6oZ/iPb1qCXxpdW+i6Vqt14fuoIL2QJN5kqg2ino0nt/KhO/wDXm/1uD0/ryOuorkIvGt5c aDqWrW3hu8mjs5ikSLIublAeZE9u/vVnQvFw1/WJbS106U2kUCSNfCRWjLMPuDHVh3oWoPQ6aiii gAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKA CiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAK KKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKqXGp2FpdQ2 tzeQQ3E+fKieQBnx6DvQBbqlq0eoTaXcR6XPDBeshEUsyllU+pAqL/hIdFFs1z/atl5Cy+S0nnrt D/3c56+1TwapYXN5JaQXsEtzEA0kSSAsoPQkdqTV1YE7O5xeh+Cdc8P6la3llqNiGmjJ1YNG5+2T E/6zrwarr4F8SLfjWxq1h/wkButz3flPtNt/zxxnp716PRVX1v8A1/X6abCtpb+v6/XU8+1rwRru u6pdahd6lY+fCg/shljYfYpONz9eSf6Cu20yO+i023j1KWKa8VAJZIVKqx9QDVuiktFYb1dwoooo AKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigDivE3hDUvE+shr27s 30eGItbWrI25LjHyykjrj096guvCvinVdC07SNV1ewuLdHxqGImBu4x0X2967yihKysD1dzg4PDH i+w8PX+kafrdhBG0mLF/JYm2hz9z3wOhq14X8I6h4X1Z0srmzj0KSIZskRtyzY+ZwSe57V1V7f2m m2xuL65htoAQDJK4VQT05NQf21pZmkhGo2vmxxec6eauVTruI9PehOzv/X9dfxBrS39f1/wxforO TX9HlNsI9Us2N0SINsynzcddvPP4Vo0AFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAU UUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRR RQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFF ABRRRQAUUUUAFFFFABXAfEMPfXel6Xp9lMmrvLvttVFsXSxx1YnHcZGPfNd/RSauNOx5FHd6bF8N rnTX8I3zz/aDC9v9kb95MT/r846Z+bP4Vs/D+N9O1rUtP1Oynm1khHm1f7MUjul2jAB7bRxivRKK pOzb7/1/X3EtaJf1/X/DhRRRSGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFF FFABRRRQAUUUUAFFFFABRRRQBznjm6tLbwrdi90ibVo5V2C0hiLlyen0+tcZ4RJ8P6hqMOu6bdah qDWaudRSybbLEF4gxjqo4x3r1aikla/n/X9fcN628v6/r7zxnwvGNP8AEGlX17oN0bC6aX+zLYWh zpIJ5DcfxHnPavZqKKq+iRNtbhRRRSGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUU UUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRR QAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFA BRRRQAUUUUAFFFFABRRRQAUUUUAFcf491PWLLSpY9P0WS7haMF7lLpY/LOemDyf/AK9dhUN1aQXt s1vcxiSJ/vKe9LsBhf2z4gGjpcjws5vDJtNp9ujyFx97d0/CpLTV9em0+7nuPDL29xEB5Nub2NvO 9fmHC4963wMDA7UUwOe0vWfEF3dNHf8Ahd7CEIWEpvo5MsOi4HPPrUVrrviWa+ihn8IPBAzhXnOo RNsX+9tHJ+ldNRQBzV9rniS3vpYbXwi91AjYScahEm8eu08ipdU1jX7SaNLHww99G0YZnF7HHtbu uD1x610FFHQDAudX16LS7W4h8MvNdyE+da/bY1MPp8x4bPtRDrGvyaTcXMvhh4rxHAjtPtsZMg7n d0H41v0UAYGmaxr1204vvDD2ISItGTexyeY3ZeOmfU1FYa54jub+KG78JPaW7Nh5zfxPsHrtHJrp KKAOYm17xNHevFF4PklgD7Vm/tCIblz97HX8Km1XWfEFnemKw8LvfwBQRML6OPJ7jDc8V0NFAdTn 73WNfgs7SW28MPczSpmaEXsaeSfTJ4b8KUavrx0Vro+GXF8JNosvtseSv97f0/Ct+igDn7DWNfuY Lp7vww9pJFHuhQ3sb+c393I+79TSaXrPiG7v0hv/AAs9jbkHdOb6OTbxx8o5roaKAOXXXvExvREf B0ggMm0zf2jFwufvY69OcVLqWt+IrW/khsvCj3tuv3Zxfxx7v+AnkV0dFAGBqOr69apbGy8MvemS INKBexx+U393nr9RSPrGvro8V0nhh3vWcq9n9tjBRezb+h+ldBRQBgWmr69Np93PceGXt7mIDybc 3sbed6/MOFx703S9Z8QXd00d/wCF3sYghYSm+jkyw6Lgc8+tdDRQBzNrrviWa+ihuPCD28DPtec6 hE2xfXaOT9KL7XPEtvfTQ2vhF7qBGwk41CJN49dp5FdNRQBxHjXV9dtrSOO08PSTwl4WM63iJhtw ymOvtnpXVaVdXt5YrNf6ebC4JOYDKsmP+BLxU11aQXsPlXMYkjDBtp9Qcip6FomvP/IHuFFFFABR RRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFF FABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUU AFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQA UUUUAFYni28ubDw7PcWspimUrhgOnNbdYHjKCa58M3EUETyyFlwqDJPNHVfIDeQ5RSfSlpE+4v0p aGCEIypGcZHUVw2maZqieObi3l8T6pPa28aTiCTZtbcT8pwucV3JztOMZxxmuP0/RfFkHiqTVLrU dJe2mCxyRR27h/LBJGCT1oXxA/hZga5fPb+KtaiuvG9zpvkKktpabowHJXOACMsM8V6Lpc81zpVr PcJsmeMM4965tfDOqHxndarO+kT2Fwy5jltS0yKowNrE4zXX0L4Ql8Rx3i7V77RNe0Wa0N1ci4Mk P2CLAWZ8AqSSPl789KtxeLJhpOoz3mlPaX9gu6W0knXBGMgiT7uMd+1N8TaHrep6ppt7pOo2tobH ewWaIt5jMMYOD92qs3hPVb/S7ttR1C2l1WeSNwVjItwE+6hXOSp7jPOaSvZje6LPhbxtb+JWvIvI SG4tVDukNws6lT0IZeM+1ZulfEpNV1+30yLSiRPIyrJHdJIyKucs6DlR9fWpdG8L+ILDU7y9nv8A S4/tNsYfLs7UxrE4+6y/1zS6X4V1sataXesXOkstqxkD2NqYpZXxj5znkckkeuKrS6J6MpXfxY0y 01SWFoYTYxT+S9yLxPMBzg/uvvHB4rW13xLepJeWel6Td3ccEX+k3cEqo0BIyNqsPnIHOBVN/CWs WeoSHSm0JrJ5TKovbIvKpJywDDHGc4q7qOieIo9QupdC1Kxt4bwAzLcQs7I4G3KYPHHr3qNeXzKf xaGh4QvJr/wlpl1PM88ssAZpJBhmPqR61Z17VjomjXGoCATeUAdjSiMHnHLHgVB4V0q90Tw9babf XMVxJbgossSFQy9sg96b4o0WfW9OiitZYUnhmWZBcIXicjPDqOo56ewq576Cj5mfoPjqx1nTL+7l RYGsP9ekUyzqBjIwy8H6UWPizVbjU7O3u/C17a212SYrnzVcKMZy4HKcdjVPSfB2qxSamuqXmntb 6hCEaKyt/KETDpt9u/Per+m6X4r+2wf2rrNo9lB0W1hKvNxgbySR78Y5o6i6FWbxtfhjcWnhi9u9 L84RLdxSLuY5xuEf3tue9Vdd+J1nouq3FmLaGVbUD7S73qRMh6kBDy2B6Vbj8P8Aie1f7BZ61aQ6 OJMofJJuETOdobO326dKbqfhTVBqs93pD6OyXJDyrqNp5rB8YypGOoAqexWl2Ta946tdI0/Tby3t 1uU1BPMiMs6267cZ5ZuM4PSmr47jPgxfET6bLEryeWkMkqqG+bAbf0Cnrmn6zoviK7+x/YrnR/Lj gCTW93aGSLzP7yDOR6VG3hjWbXw5bWOm39ktyJmluVuIC8Em7kqF7KD0HbFN9RLoW/CPi7/hKlvC LA2wtmVPMWZZY5CRk7WXg4710tc94X0G60j7ZcX8lq11dMu5LOMxwoFBA2qehOeT3roabErhRRRS GYXiu9ubHTIZbWUxO1zEhIHYsARW7XP+MIJrjSoEgieVhdRMQgyQAwya6ChfC/X9ED3Xp+rCiiig AooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAC iiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKK KKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooo oAKKKKACs/WtVXRtLkvniaVUIGxTgnJxWhXOeOf+RVuf95f50dUB0QOVB9RS01P9Wv0FOoAKKKKA CiiigDB8Ta7qGhRW8lloraksr+W225WLYT0+91zWkb9bbShfakEsQsYeYSSArF6gt049awPHOqJY 2lnGbK/uWa4WT/RLZpcBTznHTrUcXi+K/g1C4n0fUTpkKquyWwfzJGPUBD94UlsxvdHQ6RqSatp6 3kfleW7EKYpRIrAHqCKhg8SaJdXxsoNWs5LoNsMKTKWz6Y9a5XwVrMX9jX9kmj6lC8RmuFiltGhV 1JyFU9Mn0rA8OaZbXPinS57G11ljbyNI8WqWgjjt1IOSjgDcwJwMk8E1VvesS9E2d9F428NTajJY JrVn9qjl8oxGUAlvQetX9R13StIeNNR1G2tWl+4JpQpb6Zrkpp4NE8S6hD/wjUt5dXcyS2rw2o2H IAO6TGEOQTzWb45Szu9dljubfX4JRbiMS2FoJ4pgRnBJU4IPHGKm+iKtq0elwXEN1Ak9vKksLjcj ochh6g1JWT4YtJLDwzp1rLbx20kUCq0Mf3U9hWtVSVnZEp3VwooopDCiiigAooooAKKKKACiiigD O1nVk0e0juHhaUPKkWFOMbjjNaNc342/5A9v/wBfcP8A6EK6ShbX8/0QPf5fqwooooAKKKKACiii gAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKA CiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAK KKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKparc31pYPLp2n/b7gEbYPOEWR3+ Y8Vyng3VfEE8F4l14eMMYmmZZDfI+Xz9zH6Z6ULW4HcUVzdhrPia4v4orzwmLS2ZsPP/AGjHJsHr tAyaZPrfilL14ovCAlgD4Wb+0o13LnrtxkfSgDp6K5/VdW8RWl6YtO8MC/t9oIm+3xxZPcbSM8Ut 5q3iGGztJbXwyLmeVczw/b0TyT6ZIw34UAb9FYA1XxCdGa5PhoC/Em0Wf25OV/vb8Y/Ciw1bxDcQ XTXnhkWkkce6FPt6P5zf3cgfL9TQBv0Vz2l6v4jur9ItQ8LixtiDun+3xy7eOPlAyahXW/FRvBEf CAEBk2mb+0o+Fz97bjPTnFAHT1BeWVtqFs1vdxLLC3VG6GuN8UqfD2oLq2lamYNRu2CnTnJkS8I6 7V6hsY5HA70eLtX8RJ4bzH4cJMkQaYi/QGBs/d/2vqPWlcDuQMDA7UVzo1fxGNHS4HhcG9Mm02v2 +Phcfe34x+FPtNV8QzafdzXPhoW9zEB5Fv8AbkfzvX5gMLj3pgb9Fc/pereIrq6aPUPDAsYQhIl+ 3xy5bsMAd/WobXWvFEt9HFceERBbs4Dz/wBpRtsX12gZP0oA6aiuavta8TwX0sVp4SF1bq2En/tG NN49dpGRU2qat4htZo10/wAMi+jaMM7/AG+OLa3dcEc49aOlwN+isC51XxDHpdrPB4aE15IT51t9 uRfK9PmIw2faiHVvEL6TcXEvhkRXqOBFa/b0PmDud+MD6UAb9FYGmar4humnF/4aFkEiLRn7cknm N2XgcZ9aisNZ8TXF/FDeeFBaWzHDz/2jHJsHrtAyaAOkormJtb8UpevFF4QEkAfCzf2lGNy567cZ /Cp9V1bxFaXpi0/wwL+3Cgib7fHFk9xtIzxQHWx0FFYF7q3iGCztJLXwyLmeVMzw/b0TyT6ZIw31 FA1XxCdGa5PhoC/Em0Wf25OV/vb8Y/CgDforAsNW8Q3EF0954ZFpJGm6FPt6P5zf3cgfL9TTdL1f xHdX6Rah4XFjbkHdP9vjl28cfKBmgDoaK5hdb8VG9ETeEAIDJtM39pR8Ln723GenOKk1LWPEttfS RWPhUXluv3J/7Qjj3f8AASMigDo6KwNR1XxDbJbGx8NC8aSMNMPtyR+U3deR831FD6t4hXR4rlPD Ia+Zyr2n29BsXs2/GD9KAN+isC01XxDNp93Nc+Ghb3UQHkW/25H871+YDC496TS9W8RXV00eoeGB YwhCwl+3xy5bsuAO/rQB0FFcza614olvoorjwiILdnw8/wDaUbbF9doGT9KW+1rxRBfSxWnhIXVu rYSf+0Y03j12kZFAG7d2VtfxLFdQrKisHCt2IOQasVxHjbVdft7SOO08PmeEvCzTi9VMNuHyY6+2 a6rS7m+u7FZdQ0/7DcEnMHnCXH/AhxQtU35/5A9y7RRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRR QAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFA BRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAF FFFABRRRQAUUUUAFFFFABRRRQAVDbWkFmjJbxCNWcuwHdj1NR6hqVlpVo13f3UVtbqQDJK21QT05 rE8M+MdL8QNLBDqVlNdLK4WKGTJKA8HFC1egPRHS0UUUAFFFFABRRRQAUUUUAZ0Og6XBq02qx2Uf 26bG+ZssePTPT8MVburWC9t2guYxJE/3lPQ1NRQAAYGBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAB RRRQAUUUUAFFFFABRRRQAUUUUAFFFFAENzaQXkXlXESyRhg20+oORU1FFABRRRQAUUUUAFFFFABR RRQAUUUUAFFFc74q8W6d4bs3E+oWcF4VDRxTvgsM4zj86LgdFRWL/wAJb4eGmrqDazZCzZ/LE/mj YW9M+tPt/FWgXdlcXlvq9nLbW2DNKkoKx56ZPagDXorGsPFnh/VJ2gsNYs7mVULlIpQxCjqfpUdv 4z8M3d3Ha2+u2EtxI2xI0mBZm9AKAN2isK68Z+GrG6ktbrXLCGeNtrxvMAyn0IqW/wDFegaXKkV/ rFnbSOgdVllCkqeh+lAGxRWRP4q0C2sLe+n1ezjtbjPkzNKAr464Pekj8V6BNp0uoR6xZvZwsEkn Eo2KT0BNAGxRWRY+KtA1MzCx1ezuDChkk8uUNsUdSfao7Pxj4b1C7jtLPW7Ge4kOEijmBZj7CgDb orBk8a+GIbpraTXbBZ1bY0ZmGQ3TGPWpdQ8WeH9Kuja3+sWVtOACY5ZQrYPTigDZorHuvFegWVtb 3F1rFnDDcrvhd5QBIPUetKPFWgHTDqQ1ez+wh/LNx5o2bvTPrQBr0Vj2nivQL+G4mtNYs547ZN8z RygiNfU+gpLDxb4e1S7W1sNZsrm4YErHFKGY468UAbNFYK+NfDD3Itl16wM5fYIxOMls4xj1zT73 xh4c027e0vdasbe4j4eOSYBl+ooA26KyL3xVoGmiE3ur2duJ0EkXmSgb1PceopH8V6BHpseovrFm tlI5RJzKNjMOoB9aANiisi38VaBd2VxeW+r2cttbY86VJQVjz0ye1NsPFnh/VJ2gsNYs7mVULlIp QxCjqfpQBs0VhW/jPwzd3cdrb67YS3EjbEjSYFmPoBRdeM/DVldSWt1rlhDPG2143mAZT6EUAbtF Y9/4r0DS5liv9Ys7aR0DqssoUlT0P0pZ/FWgW1jb30+r2cdrcZ8mZpQFfHXB70Aa9FYyeLPD8unS 6hHrFk1nE4R5xKNisegJ9ap+GPGGmeIfMhh1KymulkcCKGTJ2A4Bx9KN3YPM6WiiigAooooAKKKK ACiiigAooooAKKKKACiiigAooooAKKRywRiq7mA4GcZNctoPiy81PXbvStR0VtOkg+5J9oWVZTjJ AIHYULV2Dpc6qisx/EejR20lw+p2qwxzeQ7mQYWT+6fequp+MvD2jahFY6jq1tbXEkfmKsj4+X1z 70AbtFYGo+KbfT30+4KxPpV0CWv/ADwEi9DjuD61oW+taZdaW2p29/byWKgs1wrgoAOvPtQBforK tPEuiX9lcXlpqlrNbW4zNKkgKx/U9qLHxLomp3ps7HVbS4uQu8xRShmx64/EUAatFc9F458MTalL p661afa45fJMRfBL+g9fSreoa/aWOp2mnefbG8uGAELzhH2/3gD1+lHbzA1qKqajqljpFqbrUbuG 1gBAMkrBRmq6eItGl02TUU1O1ayi+/OJAUX6mgDTorNh8QaRc6VLqcGo28ljECZJ0cFVx1yaraN4 u0DxAyppeq21zKyb/LR/mA9xR1sHmbdFZNnr9pqGs3Gn2k9tN9nTMpjnBdGzjaV6j60/UfEWjaTc xW2oana208v3I5ZApbtwKO3mBp0Vlah4l0TSpTFqGq2ltIFDlZZQp2noasPq+nR6WNTe9gWxKBxc Fxs2noc0dLh5F2iqGma1pmso76bf292qY3GFw2M9M1NaX0F6ZxCWPkSmJ8jHzAA/1oAs0UUUAFFF FAEc0ENxGY54klQ9VdQw/I1maJoNto8cuyG38x5nkDxxBSAxzjiteq1lfQX8TyQElUkaNsjHzKcG hAWaKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiii gAooooAKKKKACiiigAooqOeZLa3knkJCRqWbAzwKG7agSUVFbXEd1axXERJjlQOpIxwRkVLQ1YAo oooAKKKKACiiigAooooAKyte0O31vT5IHig81gAsskQcqM570sPiHTptam0gytFfRjIilXaZF/vJ n7w+lSa3qq6Npcl60LShCBsBwTk4o7ATf2bY+QIDZWxiByE8pdufXGKVNPso4nijs7dI5PvosSgN 9RjmrAOQD60tAFaHTrG3ffBZW8TEYLJEoOPTgU1NL0+OQSJYWqupyGWFQQfrirTMFUsegGTXI2vi /U7q9gMfhud9MuLjyI7yO4ViACQWZMZUcULewdLnSSaXp8sjSSWFq7sclmhUk/jinTadY3DBprO3 lYDALxKSB6ciqlx4k0W01NdNuNUtYr5yAsDyAOSenHvUmp65pWjCM6lqFvaeacJ5zhdx9qOgE76f ZSQpC9nbtEn3EMSkL9BjihdOsVhaFbO3ETHLIIl2k+4xUEuu6VDpa6nLqFsti3S4Mg2Ht1pkXiPR p9Om1CHU7V7OH/WTLICqfU9qALUWnWUG7ybO3j3Da2yJRkehwKbFpmnwyLJFY20ci9GSFQR+OKj0 fU01fTkvYzEY3J2tFKJFYA9ciorPxJouoX0tlaapaz3UQJeKOUFlA65FHUOhZbStOaQyNYWpcnJY wrnP5U6bTrG4k8yeyt5X6bniVj+ZFZ8Xi3w9PeRWkWs2T3ErbY41mBZjnGAPqK2aAK0mnWMqIkln bukYwitEpCj244o/s+y8jyPsdv5Od3l+Uu3PrjGKy/FGt6joOn/bLLR/7RjQFpsXKxFB68jmqV94 o1bT/CserzeHv9JeVUNoLxOFbgNvxjqRxQB0MenWMKusVnborjDhYlAYeh45pIdNsbeQSQ2VtE46 MkSg/mBWVoviG6vL6TTtW0ttMvwnmJGZhKsieoYcZB6it+gCoNK04SeYLC1Dg53eSuc+vSll0ywn kMk1jbSSHqzxKSfxxVqigCtLp1lOFE1nbybBtXfEp2j0GRQdOsTAsBs7cwqciMxLtB9cYqzRQBWT T7KOJ4o7O3WN/vosSgN9RjmiHTrG3cvDZW8TEYJSJQcenAqzRQBUTS9PjkEiWFqrqchlhUEH64ok 0vT5ZGkksLV3Y5LNCpJ/HFW6KAK02nWNwwaazt5WAwC8SkgenIofT7KSFIns7do0+4hiUhfoMcVZ ooAqjTrFYGgWytxExyyCJdpPqRiqeiaFb6PDIEit/MeV3DxxBSAxzjitUnAJ9Kz9G1VdYsmuVhaI LK8W0nP3TjNC3DoaNFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQBV1K8/s/Tbi78mabyk LCOFN7t7AdzXlNpP4lsbbSdauFnmtxfO72kWluLlQ5O8Mc9ADjPevYKKFo7h0seZ61eyWa69YReG 767kvds0Hl2uYyCvJLdAw5465rT1aWC3fRNZn0S5u7cWzRSIln5kyEhcbl6jofpXc0UdLen4aB1/ rqcJrM66ivhtL/w9dqjXPmm3SHzFhA+6XxwOxwazbyzl1bTfEdjY2GpWaJeJMoSHyvMRcbhHng5w e3Nem0Ud/wCu3+Qdv67/AOZ5d4dtdNhutSvki8T3E4sXjaPULMKjLxwqhQGbNS6b9ksLPwqLXw/f wOJm8wrZENGOQd56gZI616ZRTTs/u/C/+Ymv6+7/ACOEnnXRfEuoRL4amvbi7lSW1kith5f3QDuk xhOQTzTfGmrQxapp0f8AYep3NxbXEUzzW1iZAE6kBx/Ku9opLp5DfXzOK1u7iludJ1+40a9vNPET L9n+zlpYnboxi+gI9s1m3irJ4XvZtK8O3WmWl1eK1xsgzcOmPmkWLs2QBivR6KP6/G4HmvgWArqW s2xs9Ya3uo1eKXU4AokwMEEAADntjnrWn4TvTBJbaTF4cuIJ7dCl1dPbiJFxwCrY+fJ9K7eincVj zqHxDbR+PGuo9A1mOKSD7O0q6cwBcuOSfT3qTUJrPStU1iLUvD99fzXz74Z4LMzrsK4Clv4cEH86 9BoqbaJf1rqVfVs88js4I/EGgQaho1zcy21gwMxtt8cZI+6W7kYxzVN54ZvBRgm0XXI4DfvgW9tt mhG7crKhzlegr0+in/X43EtP68rHnng3QmlstaNu+p2UV46bL24jEN2xA5yMYAHAHHc1c8K+Fr7T 7++uLjXdZlUXDhYrh12SAqPn6cn/AArt6KOt/K35Ctocxa+Ebu2vorlvFeuTKjhzDJMhRvYjb0ov /CV3e301ynirXLZZG3CGGZAiewBXpXT0UDOe1Twzc6lNHJH4j1eyCRhCltKoDEfxHKnk0tz4aubj SrWyXxFq8TwElrmOVRJLn+8duDj6V0FFAHOxeGLmLSJ7E+JNYeSVw4umlXzY8dlO3GD9KzvBfhu9 0pp7i51jVpx58oEF067GGeHwB1NdnUUFzBdIXglSRQxUlTkAjqKaetwe1iWiiikAUUUUAFFFFABR RRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFYH ivRbjWNMdbfVNQsmjRzts2A83I6HIOf/AK9b9MlljhiaWVwkajLMxwAKmSurDT1OV0XwveQ+GFs5 PEGsiWaKM+Y8i+ZBgDKr8vA7c5q7pnhq505rgyeI9XvPNiMYFzKp8sn+JcKOa3o5EmiWWNg8bgMr A5BB706rk7tslbHNaf4UurHUIrp/FGt3SxnJgnlQo/sQFFRzeELuW9e4HizXY1Z9/kpMmwc9B8vS upopDOd1Xwxc6nfG5j8SaxZKVA8m2lUIMd+VNLe+Gbm8s7OBPEer27W6bWlhlUPN7vleTXQ0UAc+ PDVyNFOn/wDCRauZDL5n2syr5wH93O3GPwpLDwzc2VvdxP4j1e6NxHsV55VLRf7S4Xg10NFAHOaV 4XudNv0uZPEus3qqCDDcyqUOR3AUVCvhC7W9W4PizXWUSb/JMybCM52/d6dq6mijzA4jxRFL4mvh otpo0hkgdWk1O4Uxrb9w0Z6uevA4Herfim1ax8DtbPdTXTRlAZpyC7/N1JFdZVPU47CSxddSEX2U kbvNOFz2oWlvUC2v3F+lLQMY46UUARzu0VvJIsZkZVLBB1bA6V5lYfYdR16xvNI8O6xo+ryXKyXc ksDpEY8/vFJJ2nPsK9RooWjuD1Vjx7XNCii1fVYNVfxQy3Vw0qnToBLGUY5ADbSVI6YzWt4ujs5L 21hms/EkflWgWO60+3EvmKequCDgjAr0uilbRL+uw763PMr2ySw8D6Fp97pepxhWLh9Kh3yW5BJU spB5YHnjrmrfhaOHQfDep3k2mX89ncXG9FktN11OCMEyRj3yBx0AruZNRs4r+KwkuYlu5VLxwlvm YDqQKs0273ff+v0Fa1l2/r9Tz3wteSX/AIa1PRrfS9Ssbl1neI3NqYUwxO0A9M80ywmsr6fSLCw8 O39jdWcoeSeWzMaKqqQ3z/xZP516LRR1/roHT+up5W62aaBrFxD4b1BbqTUdy7bAiRuR8y98cdRX qMMgmhSUKyh1DBXGCM+o9afUc88VrbyTzyLHDGpZ3Y4CgdSaNo2/rZL9A3d/63uc1481H7J4entV sL+7luUKILS3MuD746Vl6/qpvvh9DNBpeqs/nQx+R9kbzRtIJO304PNdxbXMF7bR3NtKk0Eq7kkQ 5DD1BqWjVfevwC9zkdMvH8SeJ4NUisb60tbGB483kBiaR36gA9gAOfeuuooo6WDrcKKKKACiiigA ooooAKKKKACiiigBG+430rnfBP8AyA5f+vub/wBCNdGcY56VT02OwjtWXThF5PmMT5ZyN2fm/HNC 3B7FyiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoo ooAKKKKACiiigAooooAKKKKACiiigAooooAQ/dP0rnPBXGjXH/X7N/6FXSHkVmaHpTaPZSW7SiUv O8u4DGNxzihbv0/yB7f15mnRRRQAUUUUAFFFFABRRRQAVx3j6/1q10maPTtHW7t2jBe4+1iIoc9N uMmuxqK5tYLy3aC4jWSJvvK3Q0uwGD/aviUaOk48Mxm9Mm02v29MBMfe34x+FSWmqeI5dPu5brw5 HBdRgeRAL5HE3r8wGFx71vgYGBRTA57S9U8SXN00eo+G47KEISJVv0ly3YYA7+tQ2useK5b6KK58 KRQW7OA8w1JGKr67cc/SunooDoczfax4qgvporPwrFc26tiOY6iiFx67SOKm1TVPEltPGuneG472 Nowzu1+kW1u64I5x610FFHQDAudU8Rx6XazweHI5ryQnzrY3yKIvT5sYbNJDqniN9JuJ5fDkcd8j gRWv29CJB3O/GB9K6CigDA0zVPEdy041Dw5HZBIi0RF8knmP2XgcZ9ah0/V/FM9/FFe+Fo7W2ZsP ONRSQoPXaBzXS0UAcxNrPixL144vCcUluHws39pINy567cfpU2q6p4ktb0x6b4bjvrfaCJmv0iye 42kdq6GigOpz97qniOGztJLTw3HcTyJmeI36J5LemSPm+opRqniM6K1yfDkY1AS7RafbkwU/vb8Y /Ct+igDn7DVPEc8F2174cjtZI490CC/R/Nb+7kD5fqabpeq+Jrm/SLUfDMdlbEHdOt+kpXjj5QOa 6KigDl11nxYb0Rt4SiFuZNpm/tJOFz97bj05xUupat4nt7+SKw8Lx3lsv3JzqCRlv+AkcV0dFAGB qWqeI7dLY2HhyO7Z4g0wN8kflP3XkfN9aR9U8SLo8VwnhuNr9pCr2n29AEXs2/GD9K6CigDAtNU8 Ry6fdzXPhyOC6jA8iAXyOJvX5gMLj3pul6p4kubpk1Hw3HZQhCRKt+kuW7DAHf1roaKAOYtdY8Vy 30UVz4Uigt2cB5hqSMVX1245+lLfax4qhvporPwrFc26tiOY6iiFx67SOK6aigDiPG2p+IILSOO0 0FJ4C8LNN9uVCH3D5cYz7ZrXvri+uvB19JqVgtlcGF90ImEoA/3hW1c2sF5F5VxEsiBg21vUHIqP UrQ3+mXNoH2GaMoGxnGamS9yUe9/yRUXaafYg0D/AJF3Tf8Ar1j/APQRWjVbTrU2Om2toX3mGJYy 2MZwMZqzWk2nJtGcFaKTCiiipKCiiigAooooAKKKKACuc8c8+FbjP99P/QhXR1ma9pTazpMlksoi LkHeRnGDmjqvkBpL9xfpS0gGAB6UtABRRRQAUUUUAcN44hkn8QeHIbe+jsJp5JYjc4HmBSBkIezH tVe4v73SNN1jSRq13fyRtHFa3O8eeJJAMIzYwDnvjgGuq1fwvomvTJLqmnxXUkaFEZycqD1xg8Uk PhXQ4NFk0eLTolsJMl4cn5ie+c5z+NK2jG90zl/Bmoazbahq2m61cMv2aFZ1N1drPJHkclmUAAd8 VmaU3iq28VaY+pajcrZXU7DIukniuOCVCqoBQY5yT2rtLDwT4b0x2ez0qGJ2iaJmBYlkbqDk8ina T4M8O6Fefa9M0uK3n2ld4ZjgH0yTiqvqmT0aOCjn8d6nqc+o6ckp2XbIsTajGLcKrYw0WN2cc9e9 dDqcF/rWoas/9vzaYmnqEjgjI8tvk3FpQR8w57dq2b/wR4b1PUW1C80qKS6YgmQOy5I6cAgVLqvh DQNbu0utS02K4mRdquzMOPQ4PP41Nvdt/XqU92yLwM/meCNIbKEm3XJQYX8K6CqWl6TYaLZCz062 S3twxYRpnAJ69au1Und3JWiCiiikMKKKKACiiigAooooAKKKKACiiigBG+430rnfBPGhy4/5+5v/ AEI10RGQR61m6FpTaPYPbNKJS0zy7gMfeOcULdg9jTooooAKKKKACiiigAooooAKKKKACiiigAoo ooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAKmo6 nZaRZtd6hdRW1upAMkrYUE9KwfDvjjR9bS4UarZSTRPIdsT9IlP3j+FdNLDFPGY5Y0kQ9VdQR+Rr M0fQrfSoZkEUDNJK77liC8Mc7aFu7gyCz8aeGtRvI7Oz1uynuJDhI0kBZj7UyXxx4XgumtZddsUn R9jRmUZDdMVrx6fZRSCSOzt0cdGWJQR+lB06xZy7WduWJyWMS5z+VAGdqPi/w9pF2bXUNYtLacAM Y5JADg9DS3Xi3w/Y2ttdXWr2kUF0u6CR5ABIPUVoy2NpO++a1gkbpueME0r2NpIiI9rAyoMKrRgh fp6UAZo8W+H20o6oNXtDYrJ5ZuPMGwN6Z9aSz8W+H9QiuJbPV7SeO2TzJmSQERr6n2rT+xWnk+T9 lg8rOdnljbn1xRHY2kSssdrAgcYYLGBuHvQBl6f4w8O6reLaWGs2dzcOCVjjkBY45NRDxz4Wa6Fq NdsTOX8sR+aM7s4x9c1sRWFnBIHitII3HRkjANJ/Z1jv3/YrfdnO7ylzn8qAMHU9d1Tw/qMk9/Zi 50NyNtxbDL2/++vde+4dKf4i1gP4RfUtJvAVfaY54jkEZ7UX/hy91nVi2p6kW0iNg0VjAuwSe0p/ iGRkAYqTxbZSS+F5raytizZXbFEvv2FC2V+6Dqb6copPpWfruo3GlaTLe21n9reLBMXmBOM8nJ9K 0E4RfpVTVbL+0tKubMSeW00ZVXx909j+dKV7aDjbqZja/ejVjZjSwYpLQ3FvN54/eEAEqRj5evWs rR/Gup6hNZyXnh2SysLqUwLO1yrMJM4xsAzjI602y8L+KItTgvrzX7SZordrYRLakJtI4IGfvZ60 6Pwx4iTStMtTrFiZbS68+R/shw4zkADPH1qla/8AXd/pYl3t/Xb/ADL8+qX6eNrOwnspYrORX8md LlSspC5O5MZGO3NO1jxLeWmptp+k6Q+pTwxia5/fCMRIemCR8zHB49qz9W8P+LbzX4tQtNa02GO3 Zvs8clmWIDDB3HdzUuuaVrVrNLq+k6hFDNJAq3im1Mxk29CigjB5NTe0UV1Ymj+Mr3VF06dtEMFp fSvHHI1wCy7emVx3IIx2p1x41OnaJqV9qtgtpLZT+QIjOGV2P3PmxwDkfSsfw/peqal4L05LOS40 7UrC6d9+o2pHmEsSSVz0Oa0LXwbqZsdTg1LWI7qS7lW5ik8jBilHseqgjgelU1q/67f8ES/r8f8A gEnhLx9b+JtSn014oIruOLzgLe5E6FM45YAAHJ6V2Nc54e0rXbC7kfU7vS5oSmFFpZ+S2c9Scniu jodhK5zMWqX7eNxYXdlLb25gdreRblWSYDGSUxkH8ag17xDqXnXtlpOkT3cVvHi6uYpxG8RIz+7B HzMBz9ar3Xh/xfN4iTVItc0xEiDJFG1kxIRj0J3dferepaDr/wDaFzNomr21nDeAG4Sa3MhDAYyh yMcfrUa8qXr+el/l26lfaZiDx+uieFdBMzJdX97B5mb24EGVHUsxBGc44q4nxF+1eF01nT9Ka9KX P2W4himHyP8A7LY+ccjkUReCtVttF0+GHU7N9RsVaFJp7XfG8ROcMuevfINWrjw94judCis21PTI rpbkStJFZlUKDttz196t2bfr+F/8hbLT+tP8yzZeItWuLXUYrjQxbarax+ZHam6V1kUjj5wMDkGm +E9c8RaxBDLquhQ2cEkQcTx3avuP+7jIqxa6NqqeJL2/ur+2ks7iBYlhSEq6477s88k1W0Tw/ren XkS3WtJJptqGFvbwxbGYHgCQ5O7A9Mc0kJ7Emnapfz+MbuxvbKW1VIN8OLlZI5F3Y3bQMqaqXfiH xRH4putOs/DlvdWkUaOkpvVjYgk/Ngj26e1RJ4f8YDxJ/ara5phUr5TRiybPl7gcZ3deOtaGtaHr Nxqn23RtVhsmliENx5sO8lQeCnIweTQtkN7v5fp/wS5caxeW/iDT9ObTgbe7iZmufOHyOoyV245+ tLoOr3errePcaf8AZI4bhoYmEwfzQpwW4HFYXjS4m07Q7Wzt7bVb3UIwrQXMFuZSGXjLkevNdTpV tFaaVawQq6okYADjDdO/vQur/r+uguxcooooGFFFFAGD4svLmy0uGS2maJ2uYkLL3BYZFTeIfEWn eHrFpb6+t7WR1byRM2A7AdKg8XW091pUCW8LyuLqJiqDJADDJrU1HT4dRs5YJY4mLIVVpEDbcjrz Uu/I7d3+SHpzL0/VlHw54j0/xFp0c1nfW9zKsamcQtkIxGSK2apaXp0OmWEFtHHEGjjVGZEC7iBj PFXa0la+hKvbUKKKKkYUUUUAFFFFABRRRQAVzfizxfpvhqzdZ9QtIL0qHjinblhnGcfnXSVl65os Os6fJbukIkYACR4gxXnPel1QFf8A4TDw6NMTUW1mzFmz+WJ/M+Ut6Z9afbeLfD95ZXN7b6vaS21t gzyrICseemTWj9gs/JEJtIPLBzs8sYz64pUsrSON40tYFR/vKIwA31FMDM0/xf4e1a4a3sNYtLmZ ULlI5ASFHU1FbeN/DF3dx2lvrllLcSNsSNZQSzegrXisbSBt0VrBGxGMpGAcUi6dZI4dLO3Vwchh EoIP5UB0Mm78beGLC7ktbrXLKG4iba8bygFT6GpdQ8XeHtKmSG/1i0tpHQOqySAEqehrRfT7KRy8 lnbu5OSzRKSf0p0tjaTMGltYJCBgF4wcCjoBmz+LfD9rp9vfz6vaR2lzkQzNIAr464NJF4t8PTab NqMWr2j2cLBJJxINqsegJrTaxtHiWJrWBo0+6pjBA+goFjaLE0S2sAjY5ZBGMH8KAM2w8W+H9UMw sdXtLgwxmWTy5AdijqT7VHZeNPDWo3kdnZ63ZT3EhwkaSAsx9q1o7G0h3eVawJuGG2xgZHpTY9Ps opBJHZ26OOjLEAR+lHUDIk8c+F4bprWTXbFZ1fY0ZlGQ3TFS6j4v8O6Tdm11DWLS2uAAxjkkAOD0 rSOnWLOXNlblicljEuc/lSy2NnO++W1gkf8AvPGCaA6mbd+LfD9jbW1zdavaQw3S74HeQASL6ilH i3w+dKOqDV7T7CJPLM/mDZu9M+taT2NpIiJJawMqDChowQo9vSj7FaeT5P2WDys52eWNufXFAGZZ +LfD+oQ3M1pq9pNHbJvmZJARGvqaTT/GHh3VrxbSw1mzubhgSsccgJOOtaiWNpErLHawIrjDBYwN w96SKws4HDxWkEbjoyRgGgDHXxz4We6Fquu2JnZ/LEYlGS2cY+uaffeM/DemXklpe61ZwXEZw8ck gBFag06xD7xZW4YHO7ylzn8qWSwspnLy2kDuerNGCT+lAGdfeLfD+mCA32r2luLiMSReZIBvU9CP akfxb4fj0yPUn1e0Wylcok5kG1mHUA1pyWVpNt821gfaMLujBwPQUGxtDCITawGIHIQxjAP0oAzb bxb4fvLG5vbfV7SW1tsedKsgKx56ZNJp/i/w9q1w0FhrFpcyqhcpHICQo6mtNbK0SNo0tYFR/vKI wA31FJFY2kDborWCNiMZSMA4oAyLbxv4YvLuO0t9cspbiRtiRrKCWb0FF3428MWN3Ja3WuWUNxE2 143lAKn0NayadZRuHSzt1cHIYRKCD+VD6dZSOXks7dnJyWaJST+lAGdqHi7w9pMyQ3+sWltI6B1W SQAlT0NLP4t8P2thb38+r2kdpc58mZpMK+OuDWlLY2k7BpbWCRgMAvGDxQ1laPGsbWsDRp91TGCB 9BQBlp4v8PS6ZLqMesWjWcThJJxJ8qsegJqp4X8ZaX4i8yGHUrOe6WR8RQtzsB4OPpW8LG0ELRC1 gEbHJQRjBP0qlouiQaRDIqxwmR5XfekQUgMc44oW4dDVooooAKKKKACiiigAooooAKKKKACiiigA ooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACi iigAooooAKKKKACiiigAooooAKztb1UaNpUl8YTKEIGwHGcnFaNc545/5FW5/wB5f50dUB0SnKg+ opaan+rX6CnUAFFFFABRRRQBhaz4kTQ9Vs4byFI7CdHZ7x5QoiK44I989atwa/pF1pL6rBqFvJYR gl7hXyi465Nct47513QJJNDvdTtrSR55hBFvCDAAOP4jn+Gqdwl5d6VrOo6dpF3ZWt08aGAwYnZA AHkWPswHAHfGaSejG1qjuNL1rTNbgafTL6G6iQ7WaJsgGq1v4r0C71D7Bb6taSXe7Z5KyDdu9P0r h/CCy2OuarLHpviCa3ns8xvqMQUyMvVMAAKew45qt4e0qK48TaXPZ6dr0Zt5Gkkj1aALDbqQc+Ww Ay2SAM54zVW1RPRnob+J9Dj1caS+qWy6gWC/Zy/zZIzjFN1rxLpmikQXF7apfSIWgt5pQhlPYZ7Z PGa8zuvD0EF7dWOrp4tlMl00ubCMPAwLblIYDI9CM9q6XVZIdN1TVo7/AMO32qfb0XyZILbzQV2b drH+Dn/Gou+W5T0lY7DRNSbV9FtNQaDyGnjDmPdu2+2e9X65vwEJY/BmnW89ncWktvH5TwzptZSP T1HvXSVpJJN2JWwUUUVIwooooAKKKKACiiigAooooAzda1YaPZx3BhMu+ZItoOMbjjNXridLa3kn kzsjUs2BngVz3jb/AJA9v/1+Q/8AoQqbxXok2s6Y6w6lqNm0aPhbKQL5uR0bIOaltqDa7v8AJDt7 yXl+rNq2uEu7WK4iz5cqB1yMHBGRUtc/4R0SbRtIhWfUtRu3eJMpeSBvKO0fKuAMV0FaSSTsiU7o KKKKkYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAF FFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUU UUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRR QAUUUUAFQXdpb31u0F1EssLdVboanrjvH19rdtpM0enaTFdWzRgyTtdiIoc9AMc0r7AdiOBgUVzn 9p+KBoyTDw5bm+Mm02329doTH3t+P0p9pqXiWXT7uW68PwQXUYH2eBb5XEvrlsfLTA6Ciue0vU/E 9zdMmpeHYLOAISJEv1kJbsMBR19ahtdW8XSX0Udz4XtobZnAeYairFV9du3n6UB0Onormb7VvFsN 9NHZ+GLa4tlbEczaiqFx67dvFTapqXia3njXTfD0F5GYwXd75Y9rdxgqc/WjpcDoKK5+51LxLHpd rNb+H4Jb1yfPtzfKoi9MNj5s0Q6l4mfSbiebw9BHfI4EVsL5SJF7kvjj6YoA6Ciuf0zUvEtw041H w/BZqsRaIpfLJvfsvAGPrUWn6r4rnv4or7wzb21qzYkmXUFcqPXbt5oA6WiuXm1fxel68cPha2kt w+FlOpKCVz1xt/Sp9V1PxPbXpj0zw7Be2+0ESvfrESe42lTQHWx0NFc/e6l4mis7SS08PQXFxImb iJr5UETegO35vrQNS8S/2K1wfD8A1ES7Rafbl2lP72/GPwxQB0FFc/Yal4lmgu2vvD0FtLHHmBFv lfzW9Cdvy/Wm6Xqfii5v0i1Lw5b2dqQd0yX6yEccfKFFAHRUVy66v4vN6I28LWwtzJgy/wBpLkLn 72Nvp2qTUtU8VW9/JHp/hu3u7UfcmbUFjLf8B28UAdJRXP6lqXiWBLY6f4fgu2eINMGvlj8t+6jj 5vrRJqXiYaPFOnh6BtQaQh7X7coVV7Hfjn6YoA6CiuftNS8Sy6ddy3Xh+CC7jA+zwLfKwl9ctj5a TS9T8T3N0yal4dgs4QhIkS/WQluwwFHX1oA6GiuYtNW8WyX0Udz4XtobZnw8w1FWKr67dvP0pb7V vFsN9NHZ+GLa4tlbEczaiqFx67dvFAG/d2dtexLHdRJKisHAboCOhqSWWOCJpZXCRoMszHgCuK8b 6h4ihtI0tNDhmty8LNMb0IQ+4fLjHTPGa172e/ufB19JqdilncmF90KTCUAf7wApN2g5dr/khpXk l3N6KVJoklicPG4DKwPBB70+s7QP+Rd03/r1j/8AQRWjVyVpNExd0mFFFFSMKKKKACiiigAooooA KM460Vx3j6+1y30uWPTtIiurUoC87XYiKHd0C45ouB2NFc4dT8UDR0mXw5bm+Mm1rb7eu0J/e37f 0p9pqXiWXTruW68PwQXcYH2eBb5WEvrlsfLQB0FFc9pWp+Jrm6ZNS8OwWcIQkSJfLIS3YYCjr61D aat4tlvoo7rwvbQ2zPh5hqKsVX127efpQHQ6eiuYvtW8Ww300dn4Ytri2VsRzNqKoXHrt28VPqmp eJraeNdN8PQXkRjBZ3vlj2t3GCpz9aOlwOgorn7nUvEsel2s1v4fglvXJ8+3N8qiL0w2PmzRDqXi Z9Innl8PQR3yOBFbC+Uh17nft4+mKAOgorn9M1LxLcG4/tHw/BaBIi0RS+WTzH7KcAY+tRafqviu e/iivvDVva2rHEky6gshUeu3bzR1A6WiuXm1fxet68cXha2e3D4WU6koJXPXG39Kn1XU/E9tfGPT fDsF7bBQRK9+sRJ7jaVNAdbHQ0Vz97qXiaGztJLPw9BcXEiZuImvlQRN6A7fm+tA1LxL/YpuD4fg Go+btFp9uXbs/vb8Y/DFAHQUVz9hqXiaa3u2vfD0FtLGmYEW+VxK3oTt+X603S9T8UXN+kepeHLe ztSDumS/WQg44+UKKAOiorl01fxeb1Y28LWy25kwZf7SUkLn72Nvp2qTUtU8VQX8kVh4at7u1U/J M2oLGW/4Dt4oA6Siuf1LUvEtutsdP8PwXZeINMHvlj8t+6jjn60Sal4mXR4Z08PQNqDORJam+UKi 9jv28/TFAHQUVz9pqXiWXTruW68PwQXcePIgF8rCX1y2PlpNL1PxPc3TJqXh2CzhEZKyJfrIS3YY Cjr60AdDRXMWmreLZb6KO68MW0Fsz4eZdRViq+u3bz9KL7VvFsN9LHZ+GLa4tlbEczaiqFx67dvF AHT0Vz+qal4mtrhF03w9BeRGMFne+WMq3cYKnP1oudS8Sx6ZazW/h+Ca8kz59ub5VEXphsfNmgDo KM56Vz0ep+J20ieeTw7Al8rgR2wv1Kuvc79vH0rL8DX+v3CTx3+jRW1r58p85bwSHdu+7tx+tCV3 YOlztaKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACi iigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACorm2hu4GguI1k ib7yt0NS0UAA4GBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFF FAEVxawXcXlXESyJuDbW9QciotStDf6bcWgfYZoym7GcZq1WN4j8Sab4dsGlvr6C1kdW8nzjw7Ad P5VMrcruON76Ghp9qbHTbW0L7/IiWPdjGcDGas1zWl+NtCvdAGpPq1oY4kT7TIrfLG7Dofxq1p/i /wAPaq0wsNXtrgwRmWQRtnag6k+1XK/M7kxtZWNuisCy8b+GdSvY7Oz1q0nuZThI0fJY0yXx34Wg u2tZdcs0nR9jRl+Q3TFIZ0VFYepeMfDuj3ZtNQ1i1trgAMY5GwcHpS3fjDw9YWtrdXWr2sUF0u+B 2biQeooA26KxB4v8PHSTqo1a2+wCTyjPu+Xd6fWiy8YeHtRhuZrPV7WaO1TzJ2RsiNfU0AbdFYWn eM/Dmr3q2en6xa3Fw4JWON8k45NRL488Kvdi1XXbMzl/LEe/ktnGPzoA6Korm2hvIGguI1kibqrd DXOanrmq+H9RluL+0F1obkbZ7Zf3lt/vr3Xvu7VJ4i1gSeEW1LSbzKOVMc8R6gntQtQOkopF+6Pp S0AFFVtRRpNNuUWWSFjE2JIzhl46g+tcF/Z19/wjOizf8JJrXmy3kaySeeMurNgg8dKFuD2uejUV wHiT4jPoGtS6bFp0dw0QQbZLoRyys3TYmPm+ual8S/EWPQr+KxjgtGufIE0yXd2INgPQDg7j1pXV rjs72O6orj7nxw58JWfiTTNLkvbOXmZA+2RBnadoI+Y5pLrxZrdlolxqNx4ZkQxupSH7QCzxHv04 cf3ab0EtTsaK53RNf1K8uri01bSBYXMcQnjVJxKHTp1AGDntWJofxG/tfWH0trS0FyyO0C294Jdx Xs/A2frQF9Lne0V53afETWbmJWPhco8nmGMNeLgrGcSHOOMdvWpPEHxOt9J1H7JbRWkhjhWWb7Td +Sw3DICjad3FAdbHoFGQehrCPia1l8Irr9qGaKaEPAjjBZm4Vce5wKwtcs7nRvhrM41K6s7tCs89 zC+H3Mw3ZJzxg/pQ9L36BH3rW6ndUVwHhfVIVvrtdL1+712yS282WS5lD+VIM4UNgYz6VZ8J/EGP xHqzabLBbRzmLzU+y3XnjA6hjgbTTtrZf1/VhX0udtRXn1x8S5I/Ep0mHS45j9qFsEF0BP15Yx44 AGT1qfxX8Q28N6q1klhDMUjDkTXIieQnOBGuDu6Ur6J9yratdjuqK5ZPF00OprHqVjFYWJtI7g3M 1wAQz8BCuOucioE8Yak1tKP7DDXr3bWtnDHchlm2/eYtj5QKBf1+p2FFc3ZeINVuLS/hn0ZYNYtV Di0NyCkinoRJjH144qpovjDUdUjW8n8PzWemBG33EkoLB16gLjleOGoA6+ivO7/xFrt1f6JNLpt1 p1hcX0YhmhuAwmRu0qY+UEYx716JRbS4dbBRRRQAVFb2sFpGyQRLGrMXIXuT1NSN90/SsPwnd3F7 pEktzM0sguZVDN1wG4FCDobtFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFA BRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAF FFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVV 1Cxi1CzlgkRCXQqrOgbbkdeatUUmk1ZgnYpWGmW9lpsNn5UTCONUYiMAOQMZIqdLW3iz5dvEm4YO 1AMipqKpu7uwWhAlnaxuHS2hVh0KxgEUGytC242sJYnOTGM1PRSAhktLaVt0lvE7erICaGtLZ1VX t4mVRhQUBA+lTUUAQ/ZbfyvK+zxeXnOzYMZ+lCWltGGCW8ShhhgqAZ+tTUUAQx2ltE++O3iRh0Ko AaT7FaBtwtYd2c58sZqeigDm77w3d6xq5k1TUmk0qNg0NhCuxWP/AE1P8YyMgcVL4tspbjwzNbWd uXfcu2ONe2fSt+s7XNV/sbSpL3yTLsIGwNjOTijsgNBfuj6UtIDkA+tLQA10EiMjfdYYNcjbeEtT S+tobnWEm0a0n8+3thDiQMDlQz55AJ9K7Cihb3DpY4vUvCviDUb26jk1u0bTLmQ5ikswZkjPVVkz x7HtVrV/DF/JeR3eiX1tazeUsMou7YTq6r909QQRzXVUUdLBfW5ymq6D4h1Dw9bafFq9jBcqc3Eo s8q+DkbVz8tPvtF8Rah4b+wzaxZi/MoZrhbT5NoPTbu6++a6isfxFrM2h2lvcx2qzxvcJFKTKE8t WON3vj0oAzpvDeqXmr3E91qkJs7ixNo8UcG1xkcsGz61l23g3xFDe2dydcsF+xhkijisAoZSMfNz knpz9fWup0rxHo+tiY6ZqMF15P8ArPLbO360mmeJtF1m5lt9O1K3uZouXSNuR2o6/wBef+bDoczZ +CNXgt7SObWreRoVuEZltcBllOfXgg1K/hLXIfJmsNWsEumhVLpp7ESJIyjAZRn5eOOtbt54t8P6 fqBsLvVrWG6GMxO+CM9KfqnifRNFuI4NS1O3tpZRuRJGwSPWj+vz/wA2H9fl/wAAoy6Rqd3caPBe vBLbWo825eNdgklA+UBOwzz+FWvFWj3eu6DNp1ndxWskrKTJJF5gwCDjGfYVZ1TX9J0S1judSv4L aGQ7UeRuGOM8VX8N642vWdxO0EcXlXDRKY5RIrqMEMD7g9KNwTs0yAaBc3XhafStRuYDcToVee1h 8oe3y5rK0vwpr9rrtpqV3rNk6wI0Rgt7IRKyEfX73v6V2tFF9bitpY4hPCOvXN3Gmq63a3VgkwlI WzCTttOVBkz64zxyKn1fw14i1C/uvK1uzGn3Bx5M9kJHjUjBCvnj+ldhRRbSw+tzmNU8G2+onS4v O221lH5boy7jKFGEyfY81EnhK7s9Bsbaw1MR6nZO0iXcsW5WZvv7lzzkE966yigDmLTQ9ditL+e4 1a1l1e5VUjuBbYjjUdtmefzpPD+ga3Y2Eunaxqtte2bRFEWG28plznJJyfWuoooA4O48IeKLhbOB /Elt9lsZkltk+x/Mdn3Q53fNxXdjOBk5OOaWii4BRRRQAjfdP0rC8I2txaaPJHcwvE5upWCuMHBb g1uk4BPpWdomq/2xYvc+SYtszxbS2funGaFuD2NKiiigAooqhd63plhf21jd3sMN1c58iJ2w0mOu PWgC/RVHTNY07WYZJdNvIbqONzG7RNkBh1H1q9QAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUU AFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQA UUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABR RRQAUUUUAFFFFABRRRQAUUUUAFFFFABXOeOf+RWuP99P/QhXR1Bd2tveW7Q3USSwnkq/SjqgJl+4 v0paKKACiiigAooooAK5H4jQzXfhgWsGmXGotLcR5ghHVQ2Tk9h7111FJq407HBWslzqd+97pHh+ 501rSxkiX7ZB5XmuR8qbe655zWBoNrcW/irSLpdN8TyBN0dxJeRBYomYfwqP4cg89uK9coqk7O/9 df8AMm2ljyPVtNGq6tcRxaJ4givJLsMIpYw2nuVI+dj1wQM9etXfFOieX4nvbq8j8SzW15GgT+xw HVdqhSrAjj1r0+iptokVfVs8+jig0FNHvF0PVr7T47H7NFE0Hm3ELZB+dT6jOTV74eiSGDVom0a6 0uN7554opo9oKOBjHvwcjtmuzoqr6t/1vcm2lgooopDCiiigAooooAKKKKACiiigAooooARvuN9K 53wT/wAgOX/r7m/9CNdHUFra21nEY7WJI4yxYqnTJ6mhbh0J6KKKACuE8fw3uq3em6Rp9hdx3Tye YusxQbxY47g+p+79DXd0UmrjTscn8PnZPD5s5NDn0qW2kZHWSLYJjn/WD1z1rrKKKpu+pKVgooop DCiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA KKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAo oooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigArjfH15rsGlSx6 dpVvc2pQGSaS78pkO7oBjnt3rsqiuLaG7gaG4jWSNuqsODS6oDB/tHxUNHSZdAtDfmTa1v8AbhtC f3t+3r7Yp9pqHieTTruW60K1hvEA+zwrehll9ctt+Wugopgc9pWo+Kbi6ZNT0G0tIAhIkjvhIS3Y Y2jr61Daap4wkvoo7rw3ZQ2pfDyrqAYqvrt28/SunooA5i+1PxfFfTR2XhyyntlbEcr6gELD1K7e Km1XUPFFvPGumaDaXcRjBd5L4RlW7jG05+tdDRR0A5+51DxOml2sttoVrLeuT58DXu1Y/TDbfm/K kh1DxQ2kTzTaDaJfq4EVuL0FXXuS23j6YroaKAOf0zUPE85uP7S0K1tQsRaLy73zN79lPyjA96i0 /U/Fs2oRR3/h2ztrVj+8mS/DlR7LtGa6WijqBy02qeMVvXSLw1ZPbB8LKdRAJXPXG39Kn1XUfFNv fNHpmgWl3bbQRLJfCMk9xt2muiooDqc9e6h4ois7N7PQbWe4dM3Eb3oQRN6A7fm+tKNQ8T/2KZzo Vr/aXm7Ra/bfk2f3t+3r7YroKKAOesNQ8UTW9219oNrbyombdEvQ4lb0J2/L9abpWo+Kri/SPU9A tLS1IO6WO+EhBxx8u0V0dFAHLJqnjI3qo/hqyFsZMGUaiCQueuNvXHapNS1LxZBfyR6f4es7q1B+ SWS/EZb/AIDtOK6WigDn9S1DxPAtt/Z2hWt0XiDTCS98vy37qPlOR70kmoeKBo0M8eg2ragzkSWx vQFVexD7efpiuhooA5+01DxPJpt3LdaFaw3iY+zwre7ll9ctt+Wk0rUfFNxdMmp6DaWkAjJWSO+E hLdhjaOvrXQ0UAcxaap4wkvoo7rw3ZQ2rPh5V1AMVX127efpRfan4vivpo7Lw3ZT2ytiOV9QCFh6 ldvFdPRQBz2q6h4ot7hF0zQbS7iMYLPJfCMhu4xtOfrS3WoeJ49LtZbbQrWW9fPnwNe7Vj9MNt+b 8q6CigDnY9R8Uto880mgWiX6yAR24vgVde5L7ePpiszwNe+IJ1nj1DSLe3tfPlJmS88w7t33duOn vmu1qK3tobVCkEaxqzFyFHUnqaFvcOhLRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFF FFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUU UAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQ AUUUUAFFFFABUVy0yWsr28ayzKhMaM20M2OBntUtV76K5msZ4rOcW9w6ERysm4IfXHelK9tBrc47 R/HWo6vqdjp0ehqtyS41KP7QCbDaeN3HJbqKju/Hmq2moz6UdBRtWFyqW9oLobp4D1mHHCjvSaZ4 A1PSbywvrXXkW9QudRnNsN1/k8b+eo7Uy4+Huq3Nxcai/iBP7Za6WW3vxajfBCP+WI5+6arqr/P7 /wCvlfrYno/w/r+unmXtf8aXvh7Upba60qPyntt9lL9oA+1Tf88QMcN/Sum0m5vLzSra4v7P7HdS IGkt9+7yye2a5PV/Auoa7qM91qOsRTKLby7KM23FrN/z2Xn71dTolpf2GkW9rqV/9uuo12vceXsL +5HrQttd/wDh/wCvu8we+n9bf19/kaFFFFIYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFF FABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAVFcvMlrK9vEss6oTHGzbQzY4Ge1S1Wv4rmew nis7gW9w6ERysm4IfXHelK9tBrc4/R/HWo6xqljp8WiKtwS41JPtAJsCp4Dcck9qjuvHmq2uoTaU dARtWFyscFoLobpoD/y2HH3R3pNM8AanpF7YX1prqLeIXOozG25vyTwX56jtUc/w91W4uLjUW8QJ /bTXQlgv/so3wwj/AJYjn7tV1V/n9/8AXyv1sT0f4f1/XTzPQVLFFLDDY5APQ0tMhEiwosrh5AoD MBgE9zin0mNBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAB RRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFF FFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAGTceJ9EtL y6tLjUoI7i0i8+eNmwY4+u4+1NXxXoTtYKuqW5OoAtafN/rgP7vrXDeNrLU9c8QTiy0e8hjsbUmS 4EII1Idfs/8AumpNdOoeINI0LTLHw5qGkTyEN9tFuM6ZtHb6/d+hpJ3Sf9df6/pDa1t/XT+v6Z2P /CZeHP7Pa/8A7YtfsiT/AGdpt3yiT+7n1qU+KdDWa+hOpweZYxiS6XPMSnkFvSuESe8j+Hk+k/8A CE3pufOMHk+QNshJ/wBf/wCzfWpvDn9oeG4dasr7QNQ1W4SMSf2j9nGdQ+UfIfcdPwpvr5f5f1+W 4lfT+uv9fnsdrB4p0K6ubK3g1S3kmvY/NtkVuZV9R7Vr15V4NsNS0XxDZTXuh3k0d/CxicwADSQT nyB/s+9eq02tBJ6hRRRSGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABR RRQAVhzeMfDtul682r2yLYyCO5LN/qmJwAfqa3K8i8QWuqaj4gv9Zh8NX32O0liR9PMA/wCJrg8S H/c7UvtJD6XPR38T6JHefZH1KBbjyPtPllufKxnf9MVGvi7w+8FjMuq25iv3KWrbuJmHZfWuK8XQ an4l1G1gsNF1DT/ItGme9NuMyDHNr16N3+go1OS+1fwjo2lWfhS+025lkVRIIBjTCv8Ay0H9Pxp/ 5/q/6/4Fhf5fp/X5bnZt4x8OraXd22r2wt7OXybiTdxG/TaferVt4g0m81NtNt7+GS9WITGFT8wQ 9G+hrgbK4vNN8E6rpkvgu9vLmOVoipgGL8sf9cfr1NW/AdjqGha3cadqOn3l1JLCjjWpIQu4Y4ib 029BTSu7f1t/X5bid0v67/1/wx6LRRRSGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQA UUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABR RRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFF FABRRRQAUUUUAFFFFABRRRQAUUUUAFFIcbTk4HrXj8d/ct4jXSP+En1AaOmo7k1Y3AIkfH/Hpn2P ehay5Qeiuew0V5P4x1K70/xFfW2n69etbXUKfbJUnyujjIxJj/a6Y9jV/wAV3txox0O50jV73Urz yDGNPS4H+mR7eZj7rnOe9K/u8wdbf1/X9dUek0V5dcSi3+G1leQeMb26vEmEsUyzjddyk/6j6E/L jtU2h3Dal4b8Q3mqeJLzTrqRiZoDcANpRAyFH+eactL+X/A/r/h0C1t5npdFeZeBNRvtW19JdU1S 8t5YLRUg0+WbIu0/5+cd93pXptNqwk7hRRRSGFFFYPjIRf8ACL3jS6zLo4RdwvIn2lCOn1HtSbsr jSu7G9RXmng2+u9Zu9Sn1rVb3T7kWix/2Y9wAYUx/rwfVuue1Z/hXUru+8RadaXniG+FlamX7Jcv ONusDPX6L0x3qre9b+v6/royb6XPW6K8f1HULqPxJc6TF4lv10iS+R5dV+0Ai1k72uffg57Zq942 1G70vXpU0vWL2b7TZ7LqGOf5dOToLnH9Pxqb6J9/8r/19+w+rXb/AD/r8tz1Kis3w+kceg2Sxai+ ooIhi7kfc0v+0TWV49ZY/C8039szaVLEyvFNDJtLvnhPcN0x705e6wj7x09Fea+GbqbV7bXrvWNc vdNupIwsmntcAHTlC8MD6nrmqngvUr3U/EFpHqOt3sUVtbstokk3Gqpk4uPpjtTtrb+v6/roxX0v /X9f11R6rRXj0V/cv4jXSP8AhJtQGjpqJZNWNwMSvj/j0z7HvVjxhqV5YeIr+20/Xr4211En2yVJ 8ro4yMSY/wBrpj2pbpPv/X9f8FD6vy/r+vu3PWaK828V3txoz6Jc6Pq97qV35BjGnpcD/S49vMx9 1znPeoLiQW3w3sbyDxhe3V4kwlimWcbruUn/AFH4n5cdqO/l/X9fduHbz/r+vvPUKK800S4bUvDX iC81TxLeaddSMTNCbgBtKIGQo/zzUXgrULzV9ZaTVtXvbSSGyEcVjJOMXKcj7V+P6UeXz/D+vz2F fS/9f1/XVHqFFeQaLqF1ceJLLTJvEl//AGVBdyG21JpxjUj/AM8c/wCwePfFev0dEx9WgooooAKK KKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooo oAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiig AooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAC iiigBrosiMjgFWGCD3FYf/CFeGvsS2f9iWf2ZJvPWLy/lEn976+9b1FAGKfCPh5jeFtItSb1Qtzl P9aB0DetLF4T0CC5guItJtUmgjMUThOUT+6PQc1s0UAYCeCfDMcEMKaJZrFDL50aCPhH/vD3qSbw d4duGu2l0e0c3hBuSU/1p/2vWtuigDKj8M6JDqFvfx6Zbrd20YihmCfMiDooPpWrRRRcAorhNW8c 6rpep3ulnRIpNQ8xBp0AucG9Qnlhxxt71a17xjfeHL2AX+mwR2U9uSlybjrcYyIcY6k9DSvpf+v6 /wCGDrY7GqOq6Pp2t2n2XVLOG7t9wby5VyMjviubuvFet6d4f0vV7/Q4reKZx9vV7j/jzQ9HPHIH etPwtrl/r9rc3dzpy2tr5xW0kWXf9ojHSTpwD2p23XYV+vcmk8J6BNcvcyaTbNPJD5DyFOWjxjaf bFNHg/w6q2ajR7QLZZ+zAR/6rPXb6Vt0UDMI+DPDZtJrU6LZm3ml8+SPy+Hk/vH3qT/hE9A824l/ sm18y5i8mZtnMiYxtPqK2aKAKunabZaTZR2en20dtbR/cijGFX6VFqmiaZrcUcWp2MN3HE4dFlXI Vh3rK8T+JLnw3PZTyWcR0iR9l3eyTbRbZ6EjHIJ4+pFWPC2r6jrmlG+1DTRYb5D5KeZvLx9n9s9a Pi1DbQdN4R8Pzz3U8ukWry3abJ3KcyL6H16Uo8JeHxJaSDSbUPZp5duwTmJfRfQVs0UAYP8Awhfh r7Etn/Ytn9mSbz1j8vgSf3vr71IfCPh5jeFtItT9tULc5T/WgdA3rW1RQBjReE9AguYLiLSbVJoI /KicJyif3R7c1CngnwzHBDCmiWaxQy+dGgj4R/7w9636KAMObwd4cna7aXR7RzeEG5yn+tP+1609 vCegNcx3J0m1M0UPkJJs5WP+6PatmijyAwh4M8NrbW1sui2YhtZDLAgj4jY9SPQ1u0UUXAKKKKAC iiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKK KKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooo oAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiig AooooAKKKKACiiigAooooAKKKKAOB1D4fahqV3qF/Nr/APxMpZFayuvso3WSA5Kpz0PerOp+CL7W 7+ObVtZS7torUxx2z2o2rNj/AFw5+8O1drRStpb+v6/4cd9bnDy+CdZvdI0zS9R8SG7tbWTN0klq P9MQdEfnpWv4W8PXvh1buCXVPtdk8pe1g8kILZSfuA55AroaKq718ybBRRRSGFFFZFz4p0OzvLuz uNShjuLOHz7iNicxx/3j7UAUPEfha48R6jZGfUF/smAlp9OeAOlwe2456Dr9aseFdCv/AA/p8lne as2oRCQtBuiCGJD/AAdeQO1Sr4s0F209V1OAnUVLWg5/fAf3eKi/4TTw3/Zzah/a9v8AY1n+ztNk 7RJ/dzjrQtNF/X9f8AHrqb1FZ1pr+lX+p3Om2t7FLeWwDTQrncgPTNaNABRRRQAUUUUAFFFFABRR RQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFF ABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUA FFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAU UUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFeX+NbHVtd1+cWej3kMVhbFm nWIEakOv2fr9016hRSa1uO+h5prp1PxFpOh6ZaeHb/SZZcM16sS500qP4eep6fQ1ClxqMfw9m0ke Crs3JlNv5XlLtfJ/1/X/AIF9a9RopvW/n/X9f5iWlvI4PwHa6ho2o6hpN/p13M42v/bUsYH2vgcN znI6D6V3lFFNu4krBRRRSGFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAB RRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFF FFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUU UAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQ AUUUUAFFFFABRRRQBwvxBvJ9On0u8069uZNUSXEOkQz7RfDuCPYc59qv/D5kl8Oed/bU+qTSSs0z zSbjC+eY/bb0rbutD0u91GDULmwglvIBiKZ0yyfQ9qXTdF0zRxMNNsYLUTPvkESbdzep96I6J3CW rVv6/r+uhfooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoo ooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiii gAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKA CiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAK KKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoo ooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiii gAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKA CiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAK KKKACiiigArO1zVP7G0a5vvK8wxLlUzgE9snsPetGsjxLdXFnosklvpL6ruYJJapjLIThsZ4PHak 9hrczdC1/W7u6nj1TS7WOCOAyi5srnzo2Ofuf72OaqaP4r13U9RtQdItG0+5c/vbe63yQrzgyJjj 0qn4etXtL+/1HR/DV5pNtHZsPsEyLGLibOVIAJHQYz71X0m1F94gsLyy8I3+gXayGW8uHjVElXB3 ISD82WIPTtVdf68yXszodG1jxFe+ILyyvtMsILO2JBliuS7nPK/Lj06109eeDxFq1nqeryQeE9cZ 7hwIZPJQrwMZPzdK7yzaZrKBrgYnMamQY6NjmktUN6SKusa7pegWy3GqXkdtEzbVLAkk+wGTUD+K dEj0VNYfUYhp7kKs+DjJ9eMj8azvEPn6dr9nrKaRc6pGkDweXbIGkjYkHcASOMDH41mlruLwvrF2 ugX5bUpm2aeka+YuVxuYZwM96V9Gx9UdPp3iPR9XvJrTT7+K4ngAaRUzwD056H8K0J3eO3keOPzH VSVT+8fSud8GmFtIt4V8P3Okm0jEapcRKmeOduCeM101VJdEKL6nn8Pirxs+ofZX8M2G9ESWSNb0 l1Rmx0x1HXFbCaz4jbxadMOl2IsAokM/2k+ZsP8As46596pWOoXz/EK5d9A1SK1kiEC3Tovl5XnP XOD2qK/13ULHxbdzxeF9auYlgEKTQxIVdgc5GW6c0k9n6/rb9Aa3Xp+l/wBTX8S+IL7S7q0s9Ntr SW5nDOTdz+TGFH+1jr7VoaBf32paUlzqNh9huCzAxbwwwDwQR1B61yWq311eWtjDr3gq61aGSHzi Y4kdoZCT8pUkYOMcg10Pg+zuLLQEjnjmhVpXeGCY5eGMtlUP0GBimla9wb2sXtY13S9AtkudVvI7 WF3CK75wWPbiqun+L9A1S7jtbLU4Zp5IjKiKDkqDjPI/TrVHx8k83hz7Nb6Xcai0txFmKFQcKrhi Tk9MCsO2gvrLVZJl0C92f2q0+Y0X5kaMYPXoMYNKOr1/rb/P8Ae2h1Wj+I7PW9SvYLG5t54rXCts Lb1buGBApuoeM/DulX72N9qsEFxGu90bPyjGeTjH4Vz2l6zfv40uLh/CuswW91HHCJZIkCqQTlmw 3SsjxFMdK0/WNFu9Elu3urprhLrKeXhm3KTk7sr6Y7Udh9WdRceOrDTtSI1Oe2t9MmhWW0uQzM0u euVxkVe1nxnoWg2lldX16FgvWAhdELBhjOeB0rJbzP8AhLTO2g3c6RabsjuxGpQkgEqvPU1BAmoN 4G0+UaLdpcWN0JWspFXzWUM33RnH8Q/Kjp/Xdr/IXX+t7L9TrtK1iw1yyF5ptwLi3JKhwpHI+oFJ rV5cafot5eWkMc00ETSLHI+0NgZxntUGhahfalby3F3pb6dGXxDFMR5pXuWA4Bznv0p/iPzf+Ec1 FYLaW5le3dEiiA3MSCBjNKeidhws5K5R0XxnousTQ2Ud9D/aLRhnt1JO045AbGDj2qZ/F2gR6x/Z L6lEL3ds8sq33sZxuxj9a5LQ4r640/RNE/4Ra40x7GRJZbiRQIk2g52MDkk5x+JrIuPC0VveXFhq Ok+KbyN7oy77K4zbuC24HBIxjuPaqduby/r+vkTG/L/Xn/XzPX6xvEPiKy8P2iPc3MEMszbIROWC s3oSAcVsLwijkcd65Xx1e3SaNLY2miX+oyXMZCtbRqyof9okjFS9Co6mxqXiDTNFtILjVLyK2jmI VWbO0nGcA4pdG8QaV4ggkn0q8S5jjbY5UEYP0IBrldWvbnVfCVkj+GNTdhcRo9rJEu4BcHcRnpWp pctwfG2pZ0i8t7dreNVuXRRG5GSQMH3/AEqrav5/kmT0X9dbHTSSLFG0jnCqMk+grIXxXoTw2Mq6 jEY75/Ltmw2JG9OnH41snpXmdzca3BB/ZUXhi+mEGoiaS4ULsaPfnMfPJ9uOM0l8SX9b6je1zstV 8W6Dod0ttqWpRW8xXftZWOB6kgYH407UfFWiaTa21ze6hHFDdLuhYKzbxjORgHjmuG8V2D6nrN6j eHdf82RVjjmspR9nmGMgyjPYnB9qseI/DtzHd6ZfTWurXCpYpayR6LL5bRuOSdvA2nOPbFLWw3ue h2l3b39rHdWsqywSKGR1PBFTVz3gqwttO8ORwWllqFnGZHcxag2ZsliSTyetdDVNWZKCiiikMKKK KACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoooo AKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigA ooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoorO123gu9Fu oLm6ktonQgyxzeUy/Ru1KTsmxrVlfTvFeh6tqD2FjfrPcpnciow6deSMH862a858GWVtpHgc6lpu pXN3eDTy3kyXXnKhAJGF7c1JYQJp1zpd/Z+I7rULy7lVLiCW68xHDAk7U/gwR+FU1Z8pPRs9Corz ptKS88YahaDxbeQ2e1JfsyXg3eaSfunOQox92vQolZIkV33sAAWxjJ9aS2uN72H0Vxvjz7Tcx2dl ZanDbTsxkaB7w2plQDHEg54JHFcwlzrkHgB4U1B5bh9UNvPPPdMqxpjokw529Bu9zSuN6HrNFea6 E3iPR9J1qSW9tJ4Y4A9tGl615JG/8RLMM4xjj2q1YaXp8GpabcQ+Nb+d7nIkt2ufNW4JXPA/5Z46 /pT6i6HoFFeZPqFrbaRpqy6/creW+p+RGrXfzSDfysnqMZ61e1ywS58axwL4ourK3uYGa6t0uwM4 I2hOf3Z56jrQtbW6/wCVw9f61sdxdXcFlAZrh9kYIBbBPJ+lTEgDJIA964bxjbR6foFpK2u3UV1Z 7fKYXXl+aMjlx/HxVnxza2eseHbeVr+eOCO6iJltLnYMbgCSR6fpR0+Yf5HY0VyFtpen3Gg6pomk 67f3FwFDGY3jPJGxGVAfsOO1QaVnW9X0qSK9vlTTLfFynnkLJIflAcfxEbSefUUdbCvpc7asy68P aPe6lHqN1pttNeREFJ3jBZcdMGtOigYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRR RQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFF ABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUA FFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABVa+sLT U7R7S+t47i3f70ci5U/hRRQBU0vw5ouiSSSaZplraPINrmGMLuHocUyy8L6Dpt8b6y0mzt7o5zLH EA3PXmiigCMeDvDYvvtw0SxF1v8AM87yRu3eufWtuiijpYPMztU0DSNb8v8AtTTra88v7nnRhtv0 zUiaRpyaX/Za2UAsNuz7OEGzb6Yooo8gINM8OaLorStpmmWtoZRtkMMYXcPQ0mn+GtE0q7e7sNKt La4cENJFEFY596KKAI5fCfh+e6nuZdGsnnnOZZGhBLnOefxpt14P8OX14bu60WymuCQTK8ILHHTm iigCbUvDOh6w8b6jpVpdNEuxDNEG2r6DNTW+h6Xa6W2mQWFvHYuCGt1QBCD1496KKACy0ex0uwaz 0uCOwiJJAt0UYJ74IIz9RTNI0WLRxdeXcTztdTGeR5gmSxAB+6q+goooW79P1B7I0qKKKACiiigA ooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigD/9k= ------=_NextPart_001_0039_01CEF9A9.A7F53FA0-- ------=_NextPart_000_0038_01CEF9A9.A7F53FA0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIRPzCCBBow ggMCAhEAi1t1VoRUhQsAz684SM6xpDANBgkqhkiG9w0BAQUFADCByjELMAkGA1UEBhMCVVMxFzAV BgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTow OAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5 MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24g QXV0aG9yaXR5IC0gRzMwHhcNOTkxMDAxMDAwMDAwWhcNMzYwNzE2MjM1OTU5WjCByjELMAkGA1UE BhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBO ZXR3b3JrMTowOAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVk IHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IC0gRzMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDd hNS5tPmn2PMEeJzePdxsExbZet0kUWbAxyZZDawGCMKU0TMf8IM1H24byN6qbhVOVCfvxG0a7Avj DvBEpVfHQFgeo0cfcexg9m2UyBg57f5CGFbf5ExJEHhOAXY1YxI23Wa8AQQ2o1Vo1aI2CayrISZU Bq0/yhTgrMqtBh2V4vid8eBg/8J/dStMzNr+h5kh6rr+PlTX0ll42zxuz6ATABq4J6HkvmeWyqDF s5zdyXWe6zCaX6PN2a54GT8j6VzbKb2tVcgbVIxj9uim6sc3ElyjKR4C2dsfO7TXD1ZHgRUESq+D J9HFWIjB3faqp6MY2miqbRFR4b9la5+WdtE9AgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAKtmjdez useatuZV0AXxnzGNWqrZqkYmD3Htpa1TVmIBRypE6f4/dAsTm7n0TRuy0V+yttKIXLOfzcvUp9lg lYQ6+ME3HWHK57DF5ZHaVKasMYGul97NCKy4wJeAf25ypOdpE5VlH8STPP15jwTUPk/q957OzWd8 T2UC/5GFVHPH/zb3hi3s0F5P/xGfcgbWuBrxTA0mZeJEgB7Hn+Pd6Ara7KUggGlooU9+4WvPB0H6 g468ON2wLhGxa7JCzJq8+UgieUoZD7IcPiB02WrDvvIoeBNWeU9tUOobsLVXsTdmWCPz3A/fCofE 74YF1TgUYJmjS94GlnEs8tu2H6TvP+4wggZCMIIFKqADAgECAhA4qwAv/66Wt1b/OVr7XecbMA0G CSqGSIb3DQEBBQUAMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAd BgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNz IDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMzAeFw0xMTA5MDEw MDAwMDBaFw0yMTA4MzEyMzU5NTlaMIGmMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMg Q29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxHjAcBgNVBAsTFVBl cnNvbmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuU3ltYW50ZWMgQ2xhc3MgMSBJbmRpdmlkdWFs IFN1YnNjcmliZXIgQ0EgLSBHNDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbsJ/0d Y/Q7HYrB0xzIyIKGtrhKhpKqgVxyyjANL55BIlcwISWQmqP0rCrGiBeGYXITdi7sA8snm48ggDfg 5IraVaZQD/y5XCNpiUKhuh+v7w75pMkK8fg3ssbZkkqufd+4RB+buj+MBv7YI09IUSNqYISo7icv YN+W8hoqjDyPAMxPy/ogjrw19uHwmrYF8/wdP8YUew7a8gXk04MCpsVpcLSp5Fbp2x1c9KY24mu1 Hiot3L677joEsDAIrV9obMa9BpaIhOfmqWQtvDgwu4gmw2dmZrS0d/nAoccOcu9m4uW5yuDzhXc1 mN7UHLD+ZnHiOMtufE9AVeuX2agYHu0CAwEAAaOCAkQwggJAMDgGCCsGAQUFBwEBBCwwKjAoBggr BgEFBQcwAYYcaHR0cDovL3BraS1vY3NwLnZlcmlzaWduLmNvbTASBgNVHRMBAf8ECDAGAQH/AgEA MGwGA1UdIARlMGMwYQYLYIZIAYb4RQEHFwEwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1h dXRoLmNvbS9jcHMwKAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwNAYD VR0fBC0wKzApoCegJYYjaHR0cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMS1nMy5jcmwwDgYDVR0P AQH/BAQDAgEGMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFWZXJpU2lnbk1QS0ktMi05NzAdBgNV HQ4EFgQUrfnDk3IttbkoYeSk12DVxApeGgEwgfEGA1UdIwSB6TCB5qGB0KSBzTCByjELMAkGA1UE BhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBO ZXR3b3JrMTowOAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVk IHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IC0gRzOCEQCLW3VWhFSFCwDPrzhIzrGkMA0GCSqGSIb3DQEBBQUA A4IBAQDWj8Ham4jys2xNH1gvugFRXXTBRujDuHuf1kDx7/8yuolrwA40Q5+kmeak8F1IM2KFhWH+ I4gijGCbK5xlSZTEojgkSKVcpVBLaOliIqeT6Jkibj1buxBCDh9MdUc0VgmP+L2MPPNcu9KWcFRw Yk3v0RC+nUgsXuyGaweC8D3hJScoLOAWdh6z/eViltKKPV8rrvtcwhO3ZWPLNHZDn9aHmaturZXB AD9GJ4H/Nd4jDkPcFF8y+cop78JSMPWZ3bmB+DolII2CaPK5IYV0ZgThhjkWMvIt1iqoyd7ZAAJP 4xggxaWBVraV3tOCrfh7Jb5kfC6gunAs+Pl14nRNB22EMIIG1zCCBb+gAwIBAgIQEB3dROkPDT0Q 6QYEc74tcjANBgkqhkiG9w0BAQUFADCBpjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVj IENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMR4wHAYDVQQLExVQ ZXJzb25hIE5vdCBWYWxpZGF0ZWQxNzA1BgNVBAMTLlN5bWFudGVjIENsYXNzIDEgSW5kaXZpZHVh bCBTdWJzY3JpYmVyIENBIC0gRzQwHhcNMTMwNDAxMDAwMDAwWhcNMTQwNDAyMjM1OTU5WjCBzjEu MCwGA1UEAwwlUGVyc29uYSBOb3QgVmFsaWRhdGVkIC0gMTM2NDg0MjY5NDQ0MzErMCkGCSqGSIb3 DQEJARYcbWljaGFlbC5oYW1tZXJAeWFhbmF0ZWNoLmNvbTEPMA0GA1UECwwGUy9NSU1FMR4wHAYD VQQLDBVQZXJzb25hIE5vdCBWYWxpZGF0ZWQxHzAdBgNVBAsMFlN5bWFudGVjIFRydXN0IE5ldHdv cmsxHTAbBgNVBAoMFFN5bWFudGVjIENvcnBvcmF0aW9uMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEAh2AtKQNowI8ILmNvdcY16moA8CH7hjSvGDNofwWsh4quEfZ6VQGtDhhOjUmW6JVq 719MH8FNJcVr8oAiVaK3nNeJTL2wO68LpgX6tcZ/z22pJoz98wHzgfWf3pfEUYrCqYg2V3m6oe0t kd+OaeY8DmPVSpG7as0rkoEzeNwCtmpYjkm96mBO6/AQwsowSLbSuqkEGykp1k47KiPBtxhbp2um IReh94vPrr1O9zXau9oGMvABJjigYQ2e5AhhhDdK8qOkhgkMAJN2nvLqY+VFrnFIsb5noQ/tP2M/ ct9qwRZ5kUaumRqE/XzV3rH8PoacZW/YvcwAp8Gr1ZaHCMRl+wIDAQABo4IC1TCCAtEwDAYDVR0T AQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMC MB0GA1UdDgQWBBTlvYUx4PMlUy6uvceJkDMK4jBDZjAnBgNVHREEIDAegRxtaWNoYWVsLmhhbW1l ckB5YWFuYXRlY2guY29tMB8GA1UdIwQYMBaAFK35w5NyLbW5KGHkpNdg1cQKXhoBMIIBKwYIKwYB BQUHAQEEggEdMIIBGTCCARUGCCsGAQUFBzAChoIBB2xkYXA6Ly9kaXJlY3RvcnkudmVyaXNpZ24u Y29tL0NOJTIwJTNEJTIwU3ltYW50ZWMlMjBDbGFzcyUyMDElMjBJbmRpdmlkdWFsJTIwU3Vic2Ny aWJlciUyMENBJTIwLSUyMEc0JTJDJTIwT1UlMjAlM0QlMjBQZXJzb25hJTIwTm90JTIwVmFsaWRh dGVkJTJDJTIwT1UlMjAlM0QlMjBTeW1hbnRlYyUyMFRydXN0JTIwTmV0d29yayUyQyUyME8lMjAl M0QlMjBTeW1hbnRlYyUyMENvcnBvcmF0aW9uJTJDJTIwQyUyMCUzRCUyMFVTP2NBQ2VydGlmaWNh dGU7YmluYXJ5MF0GA1UdHwRWMFQwUqBQoE6GTGh0dHA6Ly9wa2ktY3JsLnN5bWF1dGguY29tL2Nh XzU2MWMxMDM2OTBjOTdhNjkyNDdhMGVmMDcxYWM4MWFmL0xhdGVzdENSTC5jcmwwbAYDVR0gBGUw YzBhBgtghkgBhvhFAQcXATBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2Nw czAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29tL3JwYTAqBgpghkgBhvhFARAD BBwwGgYRYIZIAYb4RQEQAQICBAGGsxcWBTEwOTIyMA0GCSqGSIb3DQEBBQUAA4IBAQAae/er4pfB TpqK6c/uJ9D8dVJzzNX26akkB8z/29totzbkpFAIlXRh02iNVK+GnsgS1gwu3FOvjgT5M4i+cNxD vTJVcnZNXns75JUGX3UsWQbtSySrVzQx8lMtwW6nXHM5GlEaY8/jKVpambG2q9OHjmwMTz7I4A+y KiiGCGdhE23dFOvku6t/oiwqFnXJmb4o75kbVevKEOd34MIj0P7Q8+1mZcNYEUTYKadoPXFyTWnO 2HTMvFcGgdLFKcqb13clWeW3/B5WjdBimpMjbvwi8ZbrhFdp7Y3NLKFSRH8W29rt0LW7zULxii0z 34NGsBkW9w95PLzTsqmKD4Yv5AkIMYIEkjCCBI4CAQEwgbswgaYxCzAJBgNVBAYTAlVTMR0wGwYD VQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29y azEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFsaWRhdGVkMTcwNQYDVQQDEy5TeW1hbnRlYyBDbGFz cyAxIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQSAtIEc0AhAQHd1E6Q8NPRDpBgRzvi1yMAkGBSsO AwIaBQCgggKrMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTEzMTIx NTIwMjM1MFowIwYJKoZIhvcNAQkEMRYEFB/up3vreUcKx5c/+Ez+ZVfBXvl5MIGrBgkqhkiG9w0B CQ8xgZ0wgZowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBFjAKBggqhkiG9w0DBzALBglghkgBZQME AQIwDgYIKoZIhvcNAwICAgCAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgFAMA0GCCqGSIb3DQMCAgEo MAcGBSsOAwIaMAsGCWCGSAFlAwQCAzALBglghkgBZQMEAgIwCwYJYIZIAWUDBAIBMIHMBgkrBgEE AYI3EAQxgb4wgbswgaYxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlv bjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazEeMBwGA1UECxMVUGVyc29uYSBOb3Qg VmFsaWRhdGVkMTcwNQYDVQQDEy5TeW1hbnRlYyBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJl ciBDQSAtIEc0AhAQHd1E6Q8NPRDpBgRzvi1yMIHOBgsqhkiG9w0BCRACCzGBvqCBuzCBpjELMAkG A1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRl YyBUcnVzdCBOZXR3b3JrMR4wHAYDVQQLExVQZXJzb25hIE5vdCBWYWxpZGF0ZWQxNzA1BgNVBAMT LlN5bWFudGVjIENsYXNzIDEgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBIC0gRzQCEBAd3UTpDw09 EOkGBHO+LXIwDQYJKoZIhvcNAQEBBQAEggEASzAHrqrTu20V4jCHMjfhO+a/7ZQ/QfJxO58v0EvQ IrlI404D5wMHYf9YZnMHenMTxDZp+vHWptKbRB/YjVyv9TgLvYnhqtMkXgJdiqAtzdK4Tz8Sfsv8 jLsJHa0G27gxpTdnDyvIO/7REmfa9mwNYY4TsLRl0XeDm9T1i01/m9RarS3Yq1ZKETvP+WadDmEd hho7gvqBg2PcQfla/ab+9G6Scn86NN1cgQsG2zJtqtlziXVgJXxn1Xmvv6TCq36M4tbbTxQ+ZCkz wM4O501ZToL0SibcWUBYxHus8lLzAcTiC7v8DcxRvojwUj7pwW5uSDIkSjqyhJIj3/NuuHCQ5QAA AAAAAA== ------=_NextPart_000_0038_01CEF9A9.A7F53FA0-- From rafiee@hpi.uni-potsdam.de Mon Dec 16 05:07:26 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F46E1AE30E for ; Mon, 16 Dec 2013 05:07:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.305 X-Spam-Level: X-Spam-Status: No, score=0.305 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, RP_MATCHES_RCVD=-0.538, TVD_PH_BODY_ACCOUNTS_PRE=2.393] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K2dihUp31r-n for ; Mon, 16 Dec 2013 05:07:23 -0800 (PST) Received: from mail3.hpi.uni-potsdam.de (mail3.hpi.uni-potsdam.de [IPv6:2001:638:807:204::8d59:e17b]) by ietfa.amsl.com (Postfix) with ESMTP id 0080A1AE308 for ; Mon, 16 Dec 2013 05:07:22 -0800 (PST) Received: from owa.hpi.uni-potsdam.de (owa-2012.hpi.uni-potsdam.de [141.89.225.164]) by mail3.hpi.uni-potsdam.de (Postfix) with ESMTP id D24E5169E53; Mon, 16 Dec 2013 14:07:20 +0100 (CET) Received: from MXMA2012.hpi.uni-potsdam.de ([fe80::5c89:628a:f4a4:826a]) by OWA-2012.hpi.uni-potsdam.de ([fe80::9d94:d459:bf45:5d57%22]) with mapi id 14.03.0174.001; Mon, 16 Dec 2013 14:07:20 +0100 From: "Rafiee, Hosnieh" To: 'Hector Santos' Thread-Topic: [Secauth] initual attempt for auth categorization Thread-Index: Ac74vbBpyyGo4TgmSYCHGvGv05Nq3QAguWWAAAmihuAAEYRP4P//8fuA//+qU5A= Date: Mon, 16 Dec 2013 13:07:20 +0000 Message-ID: <8EBBE4774B42FC45BA1143BE7F3F5A0F16937B@MXMA2012.hpi.uni-potsdam.de> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F168DAF@MXMA2012.hpi.uni-potsdam.de> <95892BF3-AAC0-4292-A637-BB053A866420@cisco.com> <8EBBE4774B42FC45BA1143BE7F3F5A0F168E9B@MXMA2012.hpi.uni-potsdam.de> <8EBBE4774B42FC45BA1143BE7F3F5A0F168ECC@MXMA2012.hpi.uni-potsdam.de> <52ADD1C3.5020106@isdg.net> In-Reply-To: <52ADD1C3.5020106@isdg.net> Accept-Language: en-US, de-DE Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [2001:638:807:20d:499b:aae2:52ca:72ea] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Cc: "secauth@ietf.org" Subject: Re: [Secauth] initual attempt for auth categorization X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Dec 2013 13:07:26 -0000 SGkgSGVjdG9yLCANCg0KPiBJcyAiV0hPIiBpcyBhcyBpbXBvcnRhbnQgYXMgYmVpbmcgY29uZmlk ZW50IHRoYXQgYXV0aGVudGljYXRpb24geWllbGRzDQo+IGEgY29uc2lzdGVudCBhbmQgcGVyc2lz dGVudCByZXN1bHQ/ICANCg0KSW4gbXkgb3BpbmlvbiwgeWVzLCBvdGhlcndpc2UgYXV0aGVudGlj YXRpb24gZG9lcyBub3QgbWFrZSBzZW5zZS4NCg0KDQo+IEkgdGhpbmsgdGhpcyBpbnRyb2R1Y2Vz IHRoZSBpZGVhDQo+IG9mIEF1dGhlbnRpY2F0aW9uIFBvcnRhYmlsaXR5LCBmb3IgZXhhbXBsZS4u Li4NCg0KU291bmRzIGludGVyZXN0aW5nLiBJIGd1ZXNzIHdlJ3JlIGFscmVhZHkgZG8gaXQgZm9y IHNvbWUgc2VydmljZXMgYnV0IHByb2JhYmx5IG5vdCBwdXQgdGhlbSBpbiBhIGNlcnRhaW4gY2F0 ZWdvcnkuDQoNCj4gDQo+IENhbiB0aGUgYXV0aGVudGljYXRpb24gZW50aXR5LCBpbiB0aGlzIGNh c2UsIGEgcGFzc3BvcnQsIGJlIHBvcnRhYmxlPw0KDQpJdCBpcyBhY3R1YWxseSBwb3J0YWJsZS4g QXQgbGVhc3QsIGZvciBhcHBsaWNhdGlvbiBsYXllciwgaW4gbW9zdCBjYXNlcyB0aGlzIGlzIHRy dWUgc2luY2UgdGhlIHVzZXJzIHdhbnQgdG8gYWNjZXNzIHRoZWlyIHJlc291cmNlcyBmcm9tIGFu eXdoZXJlLiBUd28gIGltcG9ydGFudCBmYWN0b3JzIHRoYXQgY2FuIGJlIGNvbnNpZGVyZWQgaGVy ZSBhcmUgImFjY2Vzc2liaWxpdHkiIGFuZCAiYXZhaWxhYmlsaXR5Ii4NCg0KPiAgIElmIG5vdCwg d2hhdCBwcmV2ZW50cyBpdCBmcm9tIGJlaW5nIHBvcnRhYmxlPyAgVGhlIFBob3RvPw0KDQpJdCBp cyBhIGdvb2QgcXVlc3Rpb24uLi4gVGhlIHJlYXNvbnMgbWlnaHQgYmUgYXMgZm9sbG93cyBidXQg eW91IG1pZ2h0IGFkZCBtb3JlOg0KLSBzaXplIChpZiBpdCBpcyB0b28gbGFyZ2UgaXQgaXMgbm90 IGVhc3kgdG8gY2FycnkgaXQpDQotIHdlaWdodCAuIElmIGl0IGlzIG1hZGUgb2YgaXJvbiBvciBv dGhlciBoZWF2eSBtYXRlcmlhbHMsIEkgZ3Vlc3MgdGhlcmUgd2VyZSBsZXNzIG1vdGl2YXRpb24g dG8gY2FycnkgaXQuDQotIElzc3VhbmNlIGF1dGhvcml0eSAoYXV0aG9yaXphdGlvbiBwcm9ibGVt KS4gSXQgaXMgZnJvbSBhIGNvdW50cnkgdGhhdCBpcyBub3Qgb24gdGhlIG1hcC8gSXQgZG9lcyBu b3QgbG9vayBzaW1pbGFyIHRvIHRoZSBwYXNzcG9ydCBvZiB0aGUgc2FtZSBwZW9wbGUgaW4gdGhl IHNhbWUgY291bnRyeSEgU28gbm8gd2F5IHRvIGF1dGhlbnRpY2F0ZSBpdCBzaW5jZSBpdCBkb2Vz IG5vdCBmb2xsb3cgdGhlIHBvbGljeQ0KLSAgbm90IHJlYWRhYmxlIChub3QgY2xlYW4gZG9jdW1l bnQgdGhhdCBpcyBlYXN5IHRvIHJlYWQgYW5kIGVhc3kgdG8gYXV0aGVudGljYXRlIHRoZSBwZXJz b24pDQotIFBob3RvICh0aGUgcGhvdG8gSXMgbm90IHNpbWlsYXIgdG8gdGhlIG93bmVyKQ0KLSBW YWxpZGl0eSAuIFRoZSBwYXNzcG9ydCBleHBpcmVkIHNvbWUgdGltZSBhZ28uDQotLi4uDQoNCj4g V2Ugc3dpdGNoZWQgdGhlIGF1dGhlbnRpY2F0aW9uIGVudGl0eSBleGFtcGxlLiAgQW4gbG9naW4g aWQsIGVtYWlsIGFkZHJlc3MNCj4gYXJlIHBvcnRhYmxlIGF1dGhlbnRpY2F0aW9uIGVudGl0aWVz Lg0KDQpJbiBteSBvcGluaW9uLCB0aGV5IGFyZSBwb3J0YWJsZSA5MCUuIE90aGVyd2lzZSB0aGUg cG9saWN5IGNoYW5nZXMgdGhpcyBydWxlLiBGb3IgZXhhbXBsZSwgdXNlciB4IGNhbiBvbmx5IGxv Z2luIHRvIGNvbXB1dGVyIHkgaWYgaGUgaGFzIGEgSVAgYWRkcmVzcyBmcm9tIG5ldHdvcmsgei4g VGhpcyBtZWFucyBpZiB1c2VyIHggZ29lcyB0byBuZXR3b3JrIHUsIGhlIGNhbiBubyBsb25nZXIg YWNjZXNzIGFuZCBsb2dpbiB0byBjb21wdXRlciB5Lg0KDQo+IEkgdGhpbmsgQXV0aG9yaXphdGlv biBpcyBlYXNpZXIgdG8gZGVmaW5lLCBvYnRhaW4sIGFjaGlldmUsIGNvbXByZWhlbmQgYW5kDQo+ IHByb2JhYmx5IGhhdmUgdG9vIG11Y2ggdHJ1c3QgaW4gaXRzIHByb3BlciBtb2RlIG9mIG9wZXJh dGlvbiB0aGFuDQo+IGF1dGhlbnRpY2F0aW9uLiAgT2YgY291cnNlLCB0aGUgY2xhc3NpYyBzZWN1 cml0eSBwcm9ibGVtIGV4YW1wbGUgYXJlDQo+ICJDb21wcm9taXNlZCBVc2Vycy4iDQoNClNvLCB3 aGF0IGZvbGtzIHRoaW5rIGFib3V0IHRoZSBjdXJyZW50IG1lY2hhbmlzbXMgdG8gbWl0aWdhdGUg dGhlICJjb21wcm9taXNlZCB1c2VycyI/DQoNCj4gUGF0dGVybiByZWNvZ25pdGlvbiBzaG91bGQv Y2FuL2lzIGJlZW4gcGFydCB0aGUgcHJvY2VzcywgaS5lLiwgcmVjb2duaXppbmcNCj4gdW5hdXRo b3JpemVkIHVzYWdlIG9yIG1ham9yIGNoYW5nZXMgaW4gdXNhZ2VzIGNhbiB0cmlnZ2VyIHJlZCBm bGFncy4gIEEgZ29vZA0KPiBleGFtcGxlIGlzIGF2ZXJhZ2UgbW9udGhseSBjcmVkaXQgY2FyZCBw dXJjaGFzZXMgc3VkZGVubHkgY2hhbmdpbmcuDQoNCkJ1dCBJTUhPLCB0aGlzIGRvZXMgZG8gbm90 aGluZyB3aXRoIGF1dGhvcml6YXRpb24uIFNpbmNlIHRoZSB1c2VyIGRpZCBub3QgcGFzcyB0aGUg bGltaXQgb3IgY2Fubm90IHBhc3MgdGhlIHB1cmNoYXNlIGxpbWl0LiBTYXkuLiBvdXIgbGltaXQg aXMgJCA1MDAwIHBlciBtb250aCBhbmQgaGUgY2FuIGVpdGhlciB1c2UgdGhpcyBsaW1pdCBvciBu b3QuIFRoZSBiYW5rIHdhcyBub3QgaGFja2VkIHRoYXQgd2Ugc2VlIHRoZSBjaGFuZ2VzIGluIHRo ZSBsaW1pdCBvZiA1MDAwICQuIFNvLCBvdXIgdGFyZ2V0IHVzZXIgb25seSBkZWNpZGVkIHRvIHRy YXZlbCBhbmQgdXNlcyBoaXMgY3JlZGl0IGNhcmQgbW9yZSBvZnRlbiB0aGFuIG90aGVyIHRpbWVz LiBCdXQgaXQgZG9lcyBub3QgbWVhbiB0aGF0IGhpcyBhY2NvdW50IGlzIGNvbXByb21pc2VkIG90 aGVyd2lzZSBoZSwgaGltc2VsZiwgbm90aWZ5IHRoZSBiYW5rLiBUaGUgYmFuayBzeXN0ZW0gY2Fu bm90IHR1cm4gb24gcmVkIGZsYWcgZm9yIGV2ZXJ5IHRyYW5zYWN0aW9uIGFjdGl2aXRpZXMgdGhh dCBzZWVtcyB0byBiZSBzdHJhbmdlIGJ1dCBvbmx5IGNhbiBzZW5kIGFuIGVtYWlsIG9yIG5vdGlm eSB0aGUgdXNlci4gU28sIG15IGNvbmNsdXNpb24gaGVyZSBpcyB0aGF0IHRoaXMgcGFydCBuZWVk cyBodW1hbiBpbnRlcnZlbnRpb24gb3RoZXJ3aXNlIHN5c3RlbSwgYWxvbmUsIGNhbm5vdCBoYW5k bGUgc3VjaCBjb21wbGljYXRlZCBwcm9jZXNzLiBJIGFsc28gdGhpbmsgdGhhdCBvdXIgaW1wcm92 ZW1lbnQgY2Fubm90IGhlbHAgdGhpcyBzY29wZSBzaW5jZSBpbiBmaXJzdCBzdGVwLCBvbmUgbmVl ZCBodW1hbiBpbnRlcnZlbnRpb24gYW5kIHRoZW4gYmFzZWQgb24gdGhlIHJlc3VsdCBvbmUgY2Fu IGdvIHRocm91Z2ggdGhlIGRlY2lzaW9uIG1ha2luZyBwcm9jZXNzIHRvIHJlYWN0IGJhc2VkIG9u IHRoZSBzaXR1YXRpb24uIA0KSU1ITywgd2UgY2FuIHdvcmsgYW5kIHRyeSB0byBjaGFuZ2UgdGhl IHByb2Nlc3NlcyB0aGF0IHdlIGhhdmUgYSBjbGVhciBnZW5lcmFsIHBvbGljaWVzLiBGb3IgZXhh bXBsZSwgaWYgdGhlIGJhbmsgZGF0YWJhc2Ugd2FzIGhhY2tlZCB0aGVuIHRoaXMgaXMgd2hhdCBv bmUgY2FuIGxvb2sgZm9yIHJlYXNvbnMgYnV0IGlmIG9ubHkgYSB1c2VyJ3MgYWNjb3VudCB3YXMg Y29tcHJvbWlzZWQsIGJlZm9yZSBhbnkgcmVhY3Rpb24sIHRoZXJlIHNob3VsZCBiZSBhbm90aGVy IHBlcm1pc3Npb24gZnJvbSB0aGUgdXNlciBzaWRlIHRvIG5vdGlmeSB5b3UgYW5kIGxldCB5b3Ug dG8gaW52ZXN0aWdhdGUgdGhlIHByb2JsZW0uIA0KT2YgY291cnNlLCB0aGVyZSBpcyBzdGlsbCBh IGZldyB0aGluZ3MgdGhhdCB3ZSBjYW4gaW1wcm92ZS4gRm9yIGV4YW1wbGUsIA0KDQpBbnkgVGhv dWdodD8NCg0KDQo+IEJ0dywgV2hhdCBhcmUgdGhlIGdvYWxzIG9mIHRoaXMgV0c/ICAgWW91IHN0 YXRlZCBhbiBBUEksIGEgImxpYnJhcnkiDQo+IG9mIHNvcnQuDQoNCkF0IHRoZSBtb21lbnQgaXMg YWN0dWFsbHkgbm9uLVdHIGFuZCBhcyB5b3Ugc2FpZCB0aGUgcHVycG9zZSBpcyB0aGUgdW5pdmVy c2FsIEFQSSB0byBiZSBhdmFpbGFibGUgZm9yIHRoZSBtZWFucyBvZiBhdXRoZW50aWNhdGlvbi4g U28sIHdoYXQgd2UgcGxhbiB0byBkbyBpcyB0byBhbmFseXplIHRoZSBjdXJyZW50IGF1dGhlbnRp Y2F0aW9uIGFuZCBhdXRob3JpemF0aW9uIG1lY2hhbmlzbXMgYW5kIGZpbmQgb3V0IHRoZSBiZXN0 IHdheSB0byBpbXByb3ZlIHRoZW0gYnkgY29uc2lkZXJpbmcgc29tZSBmYWN0b3JzIHN1Y2ggYXMN Ci0gZGVsYXkgcmVkdWN0aW9uDQotIHBvc3NpYmlsaXR5IGZvciBhbGwgZGV2aWNlcw0KLSBkZXBs b3kgYWJpbGl0eQ0KLSAgU2VjdXJpdHkgYW5kIHByaXZhY3kgYXNzdXJhbmNlIChhcyBtdWNoIGFz IHBvc3NpYmxlKQ0KLSAgdHJhbnNwYXJlbmN5IGZvciBhbGwgbGF5ZXJzIA0KLSAgc2ltcGxpY2l0 eQ0KRGlkIEkgbWlzcyBhbnkgZmFjdG9ycz8hIEh1bS4uLg0KIA0KDQoNCj4gT3ZlcmFsbCwgSSB0 aGluayBtdWNoIG9mIHRoaXMgbGVhZHMgdG8gdGhlIGlkZWEgb2YgaGF2aW5nIGFuIHVuaXZlcnNh bCwNCj4gcGVyc2lzdGVudCwgY29uc2lzdGVudCBpZCB0aGF0IGNhbiBhcHBsaWVkIGFjcm9zcyBt YW55IHVzZSBjYXNlcy4gIFRoaXMgY2FuIGhlbHANCj4gd2l0aCB0aGUgYXV0aG9yaXphdGlvbiBw cm9jZXNzLiAgSXQgaXMgbWFuYWdlZCBieSBhIGNlbnRyYWxpemVkIHN5c3RlbS4gIEJ1dA0KPiB0 aGVyZSBpcyBzdGlsbCBtdWNoIHJlc2lzdGFuY2UgdG8gdGhpcyBzaW5nbGUgc291cmNlIGNlbnRy YWxpemF0aW9uLg0KDQpZZXMsIEkgdW5kZXJzdGFuZC4gVGhpcyBpcyB3aHkgSSBvcGVuZWQgdGhp cyBkaXNjdXNzaW9uIGxpc3QgdG8gdGFsayBpbiBJRVRGIGFuZCBub3QganVzdCBhIGRpc2N1c3Np b24gbGlzdCBzb21ld2hlcmUuIE15IG1haW4gcmVhc29ucyBhcmUgYXMgZm9sbG93czoNCllvdSBh cmUgYWxsIGV4cGVydHMgaW4gb25lIG9yIG1vcmUgYXJlYXMgYW5kIGFsc28gbW9zdCBvZiB5b3Ug d29yayBmb3IgY29tcGFuaWVzIHRoYXQgbGVhZCB0aGUgaW50ZXJuZXQgZWl0aGVyIGJ5IHRoZWly IGhhcmR3YXJlIG9yIHNvZnR3YXJlLiBTbywgc3VjaCBiaWcgaWRlYXMgdGhhdCBuZWVkcyB0aGUg Y29vcGVyYXRpb24gYW5kIHRob3VnaHRzIGZyb20gYmlnIGNvbXBhbmllcyBpcyByZWFsbHkgYXBw bHkgaGVyZSBzaW5jZSB0aGlzIGNvb3BlcmF0aW9uIGNhbiBmYWNpbGl0YXRlIHRoZSBkZXBsb3kg YWJpbGl0eSBhbmQgaW1wbGVtZW50YXRpb25zLiANCg0KDQo+IEJ1dCwgaXMgaXQgdXNlZnVsIHRv IGRpc2N1c3MgZXhpc3RpbmcgcHVibGljIGRvbWFpbiAiQVBJcyIgdG8gYXNrIHdoeSB0aGV5IGRv bid0DQo+IHdvcmsgb3IgY2FuJ3Qgd29yaz8gIEl0IHNlZW1zIG11Y2ggb2YgeW91ciBleGNlbGxl bnQgb3V0bGluaW5nIGFwcGVhcnMgdG8gYmUNCj4gZHVwbGljYXRlIG9yIGFscmVhZHkgdGhvdWdo dCBvdXQgaXNzdWVzLCBhbGwNCj4gd2l0aCB0aGUgc2FtZSBiYXNpYyByZWFsIHdvcmxkIGFuZCBp bnNlY3VyaXR5IGlzc3Vlcy4gICBUbyBtZSwgbm8NCj4gbWF0dGVyIGhvdyBncmVhdCB0aGUgIkFQ SSIgYW5kIGl0cyBjb3ZlcmFnZSBvZiBmdW5jdGlvbmFsaXR5IGlzLCB0aGUNCj4gIkNvbXByb21p c2VkIFVzZXIiIHByb2JsZW0gc2VlbXMgdG8gYmUgdGhlIHNhbWUgYmFzaWMgcHJvYmxlbSB3aXRo IGFsbA0KPiBtZXRob2RvbG9naWVzLiAgIFRoaXMgaXMgcHJvYmFibHkgd2h5LCBpZGVhcyBsaWtl IHBoeXNpY2FsDQo+IGlkZW50aWZpY2F0aW9uIG1ldGhvZHMgYXJlIGluY3JlYXNpbmcgKEZpbmdl cnByaW50LCBFeWUgc2Nhbm5pbmcsIGV0YykuDQoNCg0KVG8gYmUgaG9uZXN0LCBJTUhPLCBwaHlz aWNhbCBpZGVudGlmaWNhdGlvbnMgY2FuIGJlIGNvbXByb21pc2VkIGVhc2llciB0aGFuIG90aGVy IHR5cGVzIG9mIGF1dGhlbnRpY2F0aW9uLiAgWW91IG1pZ2h0IGdldCBzdXJwcmlzZWQgYnV0IEkg anVzdCBtYWtlIHNvbWUgZXhhbXBsZXM6IA0KRm9yIGZpbmdlciBwcmludDogeW91IGV2ZXJ5ZGF5 IHRvdWNoIHNvIG1hbnkgc3R1ZmYuIElmIHlvdSB1c2UgcHVibGljIHRyYW5zcG9ydGF0aW9ucywg aWYgeW91IGdvIHRvIGEgcmVzdGF1cmFudCwgZXRjLiBJZiBJIHdhbnQgeW91ciBmaW5nZXIgcHJp bnQgSSBqdXN0IGZvbGxvdyB5b3UsIHdoZW4geW91IHRvdWNoIHNvbWV0aGluZyBJIHdpbGwganVz dCBncmFwIGl0IGFuZCBoYXZlIHlvdXIgZmluZ2VyIHByaW50IGFuZCBtYWtlIGEgc2FtcGxlIGZv ciBteSBvd24uIElzbid0IGl0IGVhc3k/IA0KVGhlIG90aGVyIHBvc3NpYmxlIGF0dGFjaywgaWYg eW91ciBzY2FubmVyIGhhc2ggdGhlIHZhbHVlIGFuZCBzZW50IGl0IHRvIHRoZSBzZXJ2ZXIgZm9y IGF1dGhlbnRpY2F0aW9uLiBZb3VyIGZpbmdlciBwcmludCAoaW4gY29tcHV0ZXIgd2lsbCBiZSBq dXN0IGEgYnVuY2ggb2YgcmFuZG9tIG51bWJlcnMpIGFsd2F5cyBnZW5lcmF0ZSB0aGUgc2FtZSB2 YWx1ZS4gT25seSB0aGUgYXR0YWNrZXIgbmVlZHMgb25jZSB0byBoYXZlIGEgc2FtcGxlIG9mIHRo YXQgb24gdGhlIG5ldHdvcmsgKGVhdmVzZHJvcHBpbmcpIGFuZCB0aGVuIHVzZSBpdCBmb3Igb3Ro ZXIgcHVycG9zZXMuIEZvciBwZW9wbGUgd2hvIHRoaW5rIHRoZXNlIGtpbmRzIG9mIHBoeXNpY2Fs IGlkZW50aWZpY2F0aW9uIGNhbiBoZWxwLCBJIGFtIGFnYWluIG9wcG9zaXRlIHRvIHRoaXMgb3Ro ZXJ3aXNlIHlvdSB0cnkgdG8gY29tZSB1cCB3aXRoIGNvbWJpbmF0aW9uIG9mIHNldmVyYWwgYXBw cm9hY2hlcy4gVGhlbiBJIGd1ZXNzIHRoZSBwcm9ibGVtIHdpbGwgYmUgZGVwbG95IGFiaWxpdHkg YW5kIGV4cGVuc2VzLiBDYW4gYWxsIHBlb3BsZSBhY2Nlc3MgdG8gZmluZ2VyIHByaW50IHNjYW5u ZXI/IENhbiBwZW9wbGUgY2FycnkgdGhlbT8gDQpCeSB1c2luZyB0aG9zZSBhcHByb2FjaCwgSU1I TywgeW91IG9ubHkgY2hhbmdlIHRoZSBwcm9ibGVtcyB0byBvdGhlciB0eXBlcyBidXQgeW91IGRv IG5vdCBhY3R1YWxseSBzb2x2ZSB0aGUgcHJvYmxlbS4gDQpCeSB0aGUgd2F5LCBwbGVhc2UgYWxz byB0aGluayBhYm91dCB0aGUgc2Nhcnkgc2NlbmFyaW8gdGhhdCB0aGUgc2VydmVyIHdoaWNoIGtl ZXBzIHRoZSBzYW1wbGUgb2YgeW91ciBmaW5nZXIgcHJpbnQgb3IgZXllIHNjYW4ganVzdCBoYWNr ZWQuLi4gY2FuIHlvdSBjaGFuZ2UgeW91ciBleWUgc2NhbiBvciBmaW5nZXIgcHJpbnQgbGlrZSBo b3cgeW91IGRvIHdpdGggeW91ciBwYXNzd29yZHM/DQpTbywgd2hhdCBJIHdhbnQgdG8gY29uY2x1 ZGUgaGVyZSBpcyB0aGF0IEkganVzdCBrbm93IHRoYXQgYnkgdXNpbmcgdGhvc2UgZmFuY3kgc3R1 ZmYgdGhlIHByb2JsZW0gd2lsbCBub3QgYmUgYWRkcmVzc2VkIGJ1dCBqdXN0IHR1cm4gdG8gbmV3 IHByb2JsZW1zIGFuZCBtYXliZSBuZXcgdW5rbm93biBwcm9ibGVtcyBhbmQgSSB0aGluayBpdCBp cyBhbHNvIGVhc2llciB0byBoYWNrIHRob3NlIHN0dWZmIHJhdGhlciB0aGFuIG91ciBjdXJyZW50 IHN5c3RlbS4NCg0KRm9yIGV5ZSBzY2FubmluZywgY2FuIHlvdSBjYXJyeSB5b3VyIGV5ZSBzY2Fu bmVyIGV2ZXJ5d2hlcmU/IERvIHlvdSBoYXZlIGVub3VnaCBtb25leSB0byBidXkgc3VjaCBleHBl bnNpdmUgc2Nhbm5lcnM/IEFuZCBhdCB0aGUgZW5kIHRoZSBzYW1lIHByb2JsZW0gd2l0aCBmaW5n ZXIgcHJpbnQgY2FuIGhhcHBlbiBmb3IgZXllIHNhbXBsZXMuLi4gDQoNClRoZSBvdGhlciBwcm9i bGVtcyB3aXRoIHRoZSBhYm92ZSBhcHByb2FjaGVzIGlzIHByaXZhY3kuIFlvdSB1c2UgdGhlIHNh bWUgaWRlbnRpZmljYXRpb24gZXZlcnl3aGVyZSBzbyB5b3UncmUgdnVsbmVyYWJsZSB0byB0cmFj a2luZyBhdHRhY2tzLg0KDQoNClRoaXMgaXMgd2h5IEkgc2FpZCwgd2UncmUgbGl2aW5nIGluIGEg c2Nhcnkgd29ybGQuLi4gDQoNCkFib3V0IEFQSXMsIGp1c3Qgc2hhcmUgdGhlIG5hbWVzLiBXZSBj YW4gZGlzY3VzcyBhbmQgbGVhcm4gZnJvbSB0aGVpciBwcm9ibGVtcyAuDQoNClRoYW5rcywNClNt aWxlLCANCkhvc25pZWgNCg== From rafiee@hpi.uni-potsdam.de Mon Dec 16 05:10:57 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D04A1AE30E for ; Mon, 16 Dec 2013 05:10:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.087 X-Spam-Level: X-Spam-Status: No, score=-2.087 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.538] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D3bMsUzMgpUa for ; Mon, 16 Dec 2013 05:10:56 -0800 (PST) Received: from mail3.hpi.uni-potsdam.de (mail3.hpi.uni-potsdam.de [IPv6:2001:638:807:204::8d59:e17b]) by ietfa.amsl.com (Postfix) with ESMTP id BE0CF1AE308 for ; Mon, 16 Dec 2013 05:10:55 -0800 (PST) Received: from owa.hpi.uni-potsdam.de (owa-2012.hpi.uni-potsdam.de [141.89.225.164]) by mail3.hpi.uni-potsdam.de (Postfix) with ESMTP id D247C169EB1; Mon, 16 Dec 2013 14:10:54 +0100 (CET) Received: from MXMA2012.hpi.uni-potsdam.de ([fe80::5c89:628a:f4a4:826a]) by OWA-2012.hpi.uni-potsdam.de ([fe80::9d94:d459:bf45:5d57%22]) with mapi id 14.03.0174.001; Mon, 16 Dec 2013 14:10:54 +0100 From: "Rafiee, Hosnieh" To: Michael Hammer Thread-Topic: initual attempt for auth categorization Thread-Index: Ac74vbBpyyGo4TgmSYCHGvGv05Nq3QBFdhLwACMQGaA= Date: Mon, 16 Dec 2013 13:10:54 +0000 Message-ID: <8EBBE4774B42FC45BA1143BE7F3F5A0F169392@MXMA2012.hpi.uni-potsdam.de> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F168DAF@MXMA2012.hpi.uni-potsdam.de> <00C069FD01E0324C9FFCADF539701DB3BBF09D8F@sc9-ex2k10mb1.corp.yaanatech.com> In-Reply-To: <00C069FD01E0324C9FFCADF539701DB3BBF09D8F@sc9-ex2k10mb1.corp.yaanatech.com> Accept-Language: en-US, de-DE Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [2001:638:807:20d:499b:aae2:52ca:72ea] Content-Type: multipart/alternative; boundary="_000_8EBBE4774B42FC45BA1143BE7F3F5A0F169392MXMA2012hpiunipot_" MIME-Version: 1.0 Cc: "secauth@ietf.org" Subject: Re: [Secauth] initual attempt for auth categorization X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Dec 2013 13:10:57 -0000 --_000_8EBBE4774B42FC45BA1143BE7F3F5A0F169392MXMA2012hpiunipot_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable >Ummm.... Wikipedia? :) Yes, why not :-) . You can find some discrete information regarding authen= tication and authorization but actually we can improve it and add more page= and make these relationships. Are you in? Smile, Hosnieh --_000_8EBBE4774B42FC45BA1143BE7F3F5A0F169392MXMA2012hpiunipot_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

>Ummm….  Wikipedia?&nb= sp; J

 = ;

Yes, why n= ot :-) .  You can find some discrete information regarding authenticat= ion and authorization but actually we can improve it and add more page and make these relationships.

Are you in= ?

 = ;

Smile,

Hosnieh

--_000_8EBBE4774B42FC45BA1143BE7F3F5A0F169392MXMA2012hpiunipot_-- From rafiee@hpi.uni-potsdam.de Mon Dec 16 06:01:23 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD2D31ADFD5 for ; Mon, 16 Dec 2013 06:01:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.088 X-Spam-Level: X-Spam-Status: No, score=-2.088 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, RP_MATCHES_RCVD=-0.538] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nkvmBpjI01-g for ; Mon, 16 Dec 2013 06:01:21 -0800 (PST) Received: from mail2.hpi.uni-potsdam.de (mail2.hpi.uni-potsdam.de [IPv6:2001:638:807:204::8d59:e17a]) by ietfa.amsl.com (Postfix) with ESMTP id 142E61AC85E for ; Mon, 16 Dec 2013 06:01:20 -0800 (PST) Received: from owa.hpi.uni-potsdam.de (owa-2012.hpi.uni-potsdam.de [141.89.225.164]) by mail2.hpi.uni-potsdam.de (Postfix) with ESMTP id 4B2CBD2CB0; Mon, 16 Dec 2013 15:01:19 +0100 (CET) Received: from MXMA2012.hpi.uni-potsdam.de ([fe80::5c89:628a:f4a4:826a]) by OWA-2012.hpi.uni-potsdam.de ([fe80::9d94:d459:bf45:5d57%22]) with mapi id 14.03.0174.001; Mon, 16 Dec 2013 15:01:18 +0100 From: "Rafiee, Hosnieh" To: Michael Hammer Thread-Topic: Welcome and to do things Thread-Index: Ac72pxKV0NC1ujRHSxmjC+m7pii5ewAAMw2wAAFpGfAACtxd4AAT58vgAAmdJaAAVOi7AABLxUCgACPWV+A= Date: Mon, 16 Dec 2013 14:01:18 +0000 Message-ID: <8EBBE4774B42FC45BA1143BE7F3F5A0F1693C3@MXMA2012.hpi.uni-potsdam.de> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F141F0D@MXMA2012.hpi.uni-potsdam.de> <8EBBE4774B42FC45BA1143BE7F3F5A0F141F91@MXMA2012.hpi.uni-potsdam.de> <00C069FD01E0324C9FFCADF539701DB3BBF085FB@sc9-ex2k10mb1.corp.yaanatech.com> <8EBBE4774B42FC45BA1143BE7F3F5A0F142361@MXMA2012.hpi.uni-potsdam.de> <00C069FD01E0324C9FFCADF539701DB3BBF08892@sc9-ex2k10mb1.corp.yaanatech.com> <8EBBE4774B42FC45BA1143BE7F3F5A0F168D59@MXMA2012.hpi.uni-potsdam.de> <00C069FD01E0324C9FFCADF539701DB3BBF09D6F@sc9-ex2k10mb1.corp.yaanatech.com> In-Reply-To: <00C069FD01E0324C9FFCADF539701DB3BBF09D6F@sc9-ex2k10mb1.corp.yaanatech.com> Accept-Language: en-US, de-DE Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [2001:638:807:20d:499b:aae2:52ca:72ea] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "secauth@ietf.org" , "kathleen.moriarty@emc.com" Subject: Re: [Secauth] Welcome and to do things X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Dec 2013 14:01:23 -0000 >That is a self-contradiction. You either understand the lower layer or yo= u >don't. Not necessarily. One big example is the use of Microsoft windows (close sou= rce example) or recent desktop versions of Ubuntu (open source example). Th= e users only use it and the system works for them. They can also deploy the= ir own programs in those OS without the need to have a good knowledge of ke= rnel. They only need to know what libraries they need to trigger to run the= ir programs. This is the same case in the proposed API. We want it to be tr= ansparent for users in other layers. They only call it but not necessarily = need to understand the complexity in network layer or how it handles the pa= ckets. If they are curious to know, that is the other case and does not mea= n that they need to know. >You can't have your cake and eat it too. One can let his/her mommy to bake a cake ;-) . So what I want to say here i= s that you can have your cake without having a knowledge of how to bake it.= It is ready for you just go for it and eat it... (I feel hungry now...) =20 >You don't have to integrate layers to create unhealthy dependencies betwee= n >layers. >What happens to your security if I replace the IP layer and=20 >it may be based upon with some other network or internetwork protocol? >It breaks. I call them the conditions to be considered in the API. So, as you know, yo= u can never find any software that can handle all conditions otherwise we a= lso considered it. If the API is scalable, then later it is possible to sca= le it with new protocols. So I do not see it something which is impossible = but considerations. >Also, if something unexpected happens in the IP layer, again, your >application breaks. =20 >We experienced that with SIP. If IP layer doesn't work, how you want to have your communications? At leas= t with the current infrastructure of the internet. If SIP protocol fails in= some special conditions, it is not necessarily the problem of IP layer. Yo= u have to see what SIP expects from IP layer and what condition they did no= t considered. This is again I call it consideration. For any API there is a= need for black box and white box testing for this purpose to consider and = solve the most unexpected behavior of system. >Despite protestations, you are coupling layers together. That is bad. No= t >good architecture. Again I say no. Even though, we say it is true, some other protocols do the= same. One big example is ssh. It uses many different layers. Do you say it= integrated the layers? I say no. It only uses different layers for differe= nt purposes. The other important thing is that your system is free to use t= his approach/API. We only consider the best possibilities and best possible= implementations. Our goal is to handle the current problems and simplifies= the authentication and of course, our goal is to make this API available f= or all devices. You either like to use it or not.=20 >The whole point of PKI is to not have to pre-share keys, which is the core >problem you cite. >The mechanisms exist, but the will to do the implementation is lacking. >That does not mean the technology is bad, just that the implementation is >bad. The problem is that, the technology didn't consider the deploy ability. Thi= s is bad and now one cannot solve that problem. one can use many patches to= fix the holes but nothing would fit exactly to this issue. So what I see as a big issue with PKI is that scalability and costs. Are yo= u going to buy certificates for each single nodes of your network. Maybe ye= s, if you have only a few nodes. Maybe no, if you have thousands of nodes.= =20 The other thing is that you can use active directory but you're going to ha= ve your main server as a windows servers or be dependent to Microsoft techn= ologies. Maybe some accepts it but for others maybe it is too much costs. >Because of mobility, you can't always know what the IP address is going to >be in advance. >Does your solution need to be resilient to mobility? Since I discussed about small nodes as well and also cars and every devices= , I also considered mobility as one of the main requirements. It is possibl= e to handle that so that the node who changes the IP address is the same no= de by using his old public key and new public key.=20 >Your delay and battery usage is going to increase the more layers you >replicate security in. We handle delay in network layer and calculate the energy consumptions and = make it as minimum as possible. Then the API makes this information availab= le for any services or apps that want to use it and care about these values= .=20 >As far as an application is concerned, if the PKI is done properly and TLS >works properly,=20 >what more are you lacking? As far as I know, it is like a dream because of the reasons I mentioned bef= ore (costs, etc). PKI was first proposed in 1999 and still it is on progres= s. So, I would see it as a good way for authorizing probably routers but no= t every single nodes or every single users in the world or probably in near= future we have to consider the other planets as well :-) Thanks, Smile, Hosnieh From rafiee@hpi.uni-potsdam.de Mon Dec 16 11:20:01 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC58E1A802B for ; Mon, 16 Dec 2013 11:20:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.088 X-Spam-Level: X-Spam-Status: No, score=-2.088 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, RP_MATCHES_RCVD=-0.538] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xE6lm9AEHnGr for ; Mon, 16 Dec 2013 11:19:59 -0800 (PST) Received: from mail2.hpi.uni-potsdam.de (mail2.hpi.uni-potsdam.de [IPv6:2001:638:807:204::8d59:e17a]) by ietfa.amsl.com (Postfix) with ESMTP id 827331A1F7B for ; Mon, 16 Dec 2013 11:19:59 -0800 (PST) Received: from owa.hpi.uni-potsdam.de (owa-2012.hpi.uni-potsdam.de [141.89.225.164]) by mail2.hpi.uni-potsdam.de (Postfix) with ESMTP id 587F2D2CC4 for ; Mon, 16 Dec 2013 20:19:57 +0100 (CET) Received: from MXMA2012.hpi.uni-potsdam.de ([fe80::5c89:628a:f4a4:826a]) by OWA-2012.hpi.uni-potsdam.de ([fe80::9d94:d459:bf45:5d57%22]) with mapi id 14.03.0174.001; Mon, 16 Dec 2013 20:19:57 +0100 From: "Rafiee, Hosnieh" To: "secauth@ietf.org" Thread-Topic: Summary of the last discussions Thread-Index: Ac76k8rbOZ1G+++gR52T1zAI/X3vfA== Date: Mon, 16 Dec 2013 19:19:56 +0000 Message-ID: <8EBBE4774B42FC45BA1143BE7F3F5A0F169478@MXMA2012.hpi.uni-potsdam.de> Accept-Language: en-US, de-DE Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [141.89.225.161] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [Secauth] Summary of the last discussions X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Dec 2013 19:20:01 -0000 I'd like to summarize the last discussions. Please correct me if I missed a= nything or I misinterpreted something. We want to decide our next steps so = please share your ideas even though you think it doesn't change anything. M= aybe it does and maybe it is important but just you don't think it is. First we need to have a clear policy (Know how to authorize node/user). Qu= estions 1- Is it different from one system to another? If so, How? 2- To what extend is it necessary to know "Who" the user is? Let's back to our real world example, is it enough to check him with his pi= cture? Is it enough to check his passport with the passport of people in th= at country? is required to check this user with the names of criminals? Is = it... API Needs: 1- mobility (portability) 2- scalability 3- Detect the nodes and then extend it to detect the user. How? 4- calculate energy and CPU consumption (required for small devices) 5- Availability and accessibility 6- Simplicity (to what extend?) Question: What are the different ways of detecting a node (computer)?=20 What are the different ways of detecting humans/users? What are differences between these two and why? Thanks, Smile, Hosnieh From jmh@joelhalpern.com Mon Dec 16 11:31:39 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 94F571A82E2 for ; Mon, 16 Dec 2013 11:31:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nmJWLkfuXbzU for ; Mon, 16 Dec 2013 11:31:38 -0800 (PST) Received: from mailb2.tigertech.net (mailb2.tigertech.net [208.80.4.154]) by ietfa.amsl.com (Postfix) with ESMTP id 3227C1A1F4C for ; Mon, 16 Dec 2013 11:31:38 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mailb2.tigertech.net (Postfix) with ESMTP id BC9331DD4A8; Mon, 16 Dec 2013 11:31:37 -0800 (PST) X-Virus-Scanned: Debian amavisd-new at b2.tigertech.net Received: from Joels-MacBook-Pro.local (pool-70-106-135-17.clppva.east.verizon.net [70.106.135.17]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mailb2.tigertech.net (Postfix) with ESMTPSA id 1A7381C0506; Mon, 16 Dec 2013 11:31:36 -0800 (PST) Message-ID: <52AF5517.8090705@joelhalpern.com> Date: Mon, 16 Dec 2013 14:31:35 -0500 From: "Joel M. Halpern" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Thunderbird/24.1.1 MIME-Version: 1.0 To: "Rafiee, Hosnieh" , "secauth@ietf.org" References: <8EBBE4774B42FC45BA1143BE7F3F5A0F169478@MXMA2012.hpi.uni-potsdam.de> In-Reply-To: <8EBBE4774B42FC45BA1143BE7F3F5A0F169478@MXMA2012.hpi.uni-potsdam.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Secauth] Summary of the last discussions X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Dec 2013 19:31:39 -0000 I am at bit concerned both with the overall target and this specific discussion insofar as there seems to be a tendency to conflate node and user. The two are NOT in my understanding the same. And from what I have seen they do not share identity or authorization. Yours, Joel On 12/16/13 2:19 PM, Rafiee, Hosnieh wrote: > I'd like to summarize the last discussions. Please correct me if I missed anything or I misinterpreted something. We want to decide our next steps so please share your ideas even though you think it doesn't change anything. Maybe it does and maybe it is important but just you don't think it is. > > > First we need to have a clear policy (Know how to authorize node/user). Questions > 1- Is it different from one system to another? If so, How? > > 2- To what extend is it necessary to know "Who" the user is? > Let's back to our real world example, is it enough to check him with his picture? Is it enough to check his passport with the passport of people in that country? is required to check this user with the names of criminals? Is it... > > > API Needs: > 1- mobility (portability) > 2- scalability > 3- Detect the nodes and then extend it to detect the user. How? > 4- calculate energy and CPU consumption (required for small devices) > 5- Availability and accessibility > 6- Simplicity (to what extend?) > > Question: > What are the different ways of detecting a node (computer)? > > > > What are the different ways of detecting humans/users? > > > > What are differences between these two and why? > > Thanks, > Smile, > Hosnieh > > > > _______________________________________________ > Secauth mailing list > Secauth@ietf.org > https://www.ietf.org/mailman/listinfo/secauth > From Adam.Montville@cisecurity.org Mon Dec 16 11:45:54 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 94C451A1F65 for ; Mon, 16 Dec 2013 11:45:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, UNPARSEABLE_RELAY=0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t5gOcHfjdTUV for ; Mon, 16 Dec 2013 11:45:52 -0800 (PST) Received: from mail1.bemta12.messagelabs.com (mail1.bemta12.messagelabs.com [216.82.251.12]) by ietfa.amsl.com (Postfix) with ESMTP id 01B3C1A1F3F for ; Mon, 16 Dec 2013 11:45:51 -0800 (PST) Received: from [216.82.250.179:43967] by server-12.bemta-12.messagelabs.com id 24/26-28219-F685FA25; Mon, 16 Dec 2013 19:45:51 +0000 X-Env-Sender: Adam.Montville@cisecurity.org X-Msg-Ref: server-5.tower-210.messagelabs.com!1387223150!11155630!2 X-Originating-IP: [69.195.43.86] X-StarScan-Received: X-StarScan-Version: 6.9.16; banners=cisecurity.org,-,- X-VirusChecked: Checked Received: (qmail 28138 invoked from network); 16 Dec 2013 19:45:51 -0000 Received: from mail.msisac.org (HELO mail.msisac.org) (69.195.43.86) by server-5.tower-210.messagelabs.com with AES128-SHA encrypted SMTP; 16 Dec 2013 19:45:51 -0000 Received: from CISEXCHANGE2.msisac.org.local ([fe80::b899:f128:212e:984c]) by CISEXCHANGE1.msisac.org.local ([fe80::4f0:b68d:e779:38c3%13]) with mapi id 14.02.0347.000; Mon, 16 Dec 2013 14:43:32 -0500 From: Adam Montville To: "Joel M. Halpern" , "Rafiee, Hosnieh" , "secauth@ietf.org" Thread-Topic: [Secauth] Summary of the last discussions Thread-Index: Ac76k8rbOZ1G+++gR52T1zAI/X3vfAAK4xmAAAojINA= Date: Mon, 16 Dec 2013 19:43:21 +0000 Message-ID: <05BCCEB107AF88469B9F99783D47C1D60D6771C7@CISEXCHANGE2.msisac.org.local> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F169478@MXMA2012.hpi.uni-potsdam.de> <52AF5517.8090705@joelhalpern.com> In-Reply-To: <52AF5517.8090705@joelhalpern.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [192.168.252.39] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [Secauth] Summary of the last discussions X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Dec 2013 19:45:54 -0000 > -----Original Message----- > From: Secauth [mailto:secauth-bounces@ietf.org] On Behalf Of Joel M. > Halpern > Sent: Monday, December 16, 2013 1:29 PM > To: Rafiee, Hosnieh; secauth@ietf.org > Subject: Re: [Secauth] Summary of the last discussions >=20 > I am at bit concerned both with the overall target and this specific dis= cussion > insofar as there seems to be a tendency to conflate node and user. The = two > are NOT in my understanding the same. And from what I have seen they do= > not share identity or authorization. I've not really been engaged in this discussion, so I feel like I'm dive-b= ombing a bit - sorry. I would generally agree with Joel has said here. There may, however, be c= ircumstances where a particular endpoint can reasonably be considered a pr= oxy for the user or a set of users. It would be interesting to enumerate = the envisioned use cases for this endeavor. Is this community seeking to= generally authenticate "home users" or enterprise users? Mobile device u= sers? What are the network configuration constraints, if any, required in= order to achieve a reasonable proxy of authentication? What types of tra= nsactions might be "covered" by "reasonable proxy"? >=20 > Yours, > Joel >=20 > On 12/16/13 2:19 PM, Rafiee, Hosnieh wrote: > > I'd like to summarize the last discussions. Please correct me if I mis= sed > anything or I misinterpreted something. We want to decide our next steps= so > please share your ideas even though you think it doesn't change anything= . > Maybe it does and maybe it is important but just you don't think it is. > > > > > > First we need to have a clear policy (Know how to authorize > > node/user). Questions > > 1- Is it different from one system to another? If so, How? > > > > 2- To what extend is it necessary to know "Who" the user is? > > Let's back to our real world example, is it enough to check him with h= is > picture? Is it enough to check his passport with the passport of people = in that > country? is required to check this user with the names of criminals? Is = it... > > > > > > API Needs: > > 1- mobility (portability) > > 2- scalability > > 3- Detect the nodes and then extend it to detect the user. How? > > 4- calculate energy and CPU consumption (required for small devices) > > 5- Availability and accessibility > > 6- Simplicity (to what extend?) > > > > Question: > > What are the different ways of detecting a node (computer)? > > > > > > > > What are the different ways of detecting humans/users? > > > > > > > > What are differences between these two and why? > > > > Thanks, > > Smile, > > Hosnieh > > > > > > > > _______________________________________________ > > Secauth mailing list > > Secauth@ietf.org > > https://www.ietf.org/mailman/listinfo/secauth > > > _______________________________________________ > Secauth mailing list > Secauth@ietf.org > https://www.ietf.org/mailman/listinfo/secauth >=20 > ... . . . From mcr@sandelman.ca Wed Dec 18 07:48:40 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2F7401AE408 for ; Wed, 18 Dec 2013 07:48:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.429 X-Spam-Level: X-Spam-Status: No, score=-2.429 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.538, SPF_PASS=-0.001, T_TVD_MIME_NO_HEADERS=0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CCWhFaEF-KNU for ; Wed, 18 Dec 2013 07:48:39 -0800 (PST) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3::184]) by ietfa.amsl.com (Postfix) with ESMTP id 0D62F1AE1DB for ; Wed, 18 Dec 2013 07:48:39 -0800 (PST) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 16F62201B0 for ; Wed, 18 Dec 2013 12:02:45 -0500 (EST) Received: by sandelman.ca (Postfix, from userid 179) id 888CB63B89; Wed, 18 Dec 2013 10:48:25 -0500 (EST) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 7175763AED for ; Wed, 18 Dec 2013 10:48:25 -0500 (EST) From: Michael Richardson To: "secauth\@ietf.org" In-Reply-To: <05BCCEB107AF88469B9F99783D47C1D60D6771C7@CISEXCHANGE2.msisac.org.local> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F169478@MXMA2012.hpi.uni-potsdam.de> <52AF5517.8090705@joelhalpern.com> <05BCCEB107AF88469B9F99783D47C1D60D6771C7@CISEXCHANGE2.msisac.org.local> X-Mailer: MH-E 8.2; nmh 1.3-dev; GNU Emacs 23.4.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Sender: mcr@sandelman.ca Subject: Re: [Secauth] Summary of the last discussions X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 18 Dec 2013 15:48:40 -0000 --=-=-= I think that we have: 1) nodes with interfaces to humans ("UIs"), which can ask human for "something they know". These can reasonably be called "user-proxies" or "users" 2) nodes without such interfaces, and are limited to "something they have" These are things that range from light switches to printers to access points and home routers just out of the box(*). (*)- because, some category-2 nodes, after making sufficient friends with a category-1 node, can often gain enough user interface to be able to be proxy for users. There is a recent growth of (mostly IPv4, sadly) home NAS and home monitoring systems that call home and are then told by HQ who their user is, and how to trust them. I don't think that the goal of secauth is to deal with the above devices in a standard way. (ACE might do that) I'm actually unclear what secauth is doing. I think it has something to do with connecting credentials (for some as yet unknown definition) with layer-3 addresses. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting for hire =- --=-=-= Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQCVAwUBUrHDyYqHRg3pndX9AQKAzAP+LhEz2Cx9sj+6Pzcd4srH2hTDNcLBKyX7 FXEM2+HR665SmDSUEX/SFq3q35tJR+Ti027EArP/I3rwwOxAUZD/cWfbS1bDqXDc SD3kqg8hpLqlfDJlxRfSt3jqTWxO6IUo/eH+gJjt279KBAMZh2tx3BdhOPuhD5/i TXGrGZ3+Ozs= =j1MI -----END PGP SIGNATURE----- --=-=-=-- From rafiee@hpi.uni-potsdam.de Fri Dec 20 07:38:06 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 124501AE306 for ; Fri, 20 Dec 2013 07:38:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.088 X-Spam-Level: X-Spam-Status: No, score=-2.088 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_EQ_DE=0.35, RP_MATCHES_RCVD=-0.538] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ORHQ3Z963lW8 for ; Fri, 20 Dec 2013 07:38:04 -0800 (PST) Received: from mail2.hpi.uni-potsdam.de (mail2.hpi.uni-potsdam.de [IPv6:2001:638:807:204::8d59:e17a]) by ietfa.amsl.com (Postfix) with ESMTP id DB9C81AE305 for ; Fri, 20 Dec 2013 07:38:03 -0800 (PST) Received: from owa.hpi.uni-potsdam.de (owa-2012.hpi.uni-potsdam.de [141.89.225.164]) by mail2.hpi.uni-potsdam.de (Postfix) with ESMTP id 71D32D2CB8; Fri, 20 Dec 2013 16:38:00 +0100 (CET) Received: from MXMA2012.hpi.uni-potsdam.de ([fe80::5c89:628a:f4a4:826a]) by OWA-2012.hpi.uni-potsdam.de ([fe80::9d94:d459:bf45:5d57%22]) with mapi id 14.03.0174.001; Fri, 20 Dec 2013 16:38:00 +0100 From: "Rafiee, Hosnieh" To: 'Adam Montville' , "Joel M. Halpern" Thread-Topic: [Secauth] Summary of the last discussions Thread-Index: Ac76k8rbOZ1G+++gR52T1zAI/X3vfP//8oOAgAADSoD//+ynAA== Date: Fri, 20 Dec 2013 15:37:59 +0000 Message-ID: <8EBBE4774B42FC45BA1143BE7F3F5A0F176CE3@MXMA2012.hpi.uni-potsdam.de> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F169478@MXMA2012.hpi.uni-potsdam.de> <52AF5517.8090705@joelhalpern.com> <05BCCEB107AF88469B9F99783D47C1D60D6771C7@CISEXCHANGE2.msisac.org.local> In-Reply-To: <05BCCEB107AF88469B9F99783D47C1D60D6771C7@CISEXCHANGE2.msisac.org.local> Accept-Language: en-US, de-DE Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [2001:638:807:20d:499b:aae2:52ca:72ea] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "secauth@ietf.org" Subject: Re: [Secauth] Summary of the last discussions X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Dec 2013 15:38:06 -0000 > > I am at bit concerned both with the overall target and this specific > > discussion insofar as there seems to be a tendency to conflate node > > and user. The two are NOT in my understanding the same. And from > > what I have seen they do not share identity or authorization. I agree that identifying users is hard and we can never have an absolute pr= omise that we can definitely do this. But, what we can do is that to find t= he best possible way for this identifications. In other words, we cannot sa= y 100% that this is user A who authenticated with the system but our goal i= s to some extend ensure that we are still communicating with the same user.= =20 You're right that authorization and authentication can be in different scop= e. But, IMHO, in most cases one is required for the other one. In other wor= ds, one can lead to other one.=20 > I would generally agree with Joel has said here. There may, however, be > circumstances where a particular endpoint can reasonably be considered a > proxy for the user or a set of users. It would be interesting to enumera= te the > envisioned use cases for this endeavor. Is this community seeking to > generally authenticate "home users" or enterprise users? Mobile device > users? What are the network configuration constraints, if any, required = in > order to achieve a reasonable proxy of authentication? What types of > transactions might be "covered" by "reasonable proxy"? I guess proxy servers or any devices that play a role of intermediate in th= e networks can be a problem for authentications and this is where the API c= an be in use. Thanks, Merry Christmas and Happy new year.. Smile, Hosnieh From hosnieh@iknowlaws.de Mon Dec 30 12:40:21 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 35A761AE54F for ; Mon, 30 Dec 2013 12:40:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.001 X-Spam-Level: X-Spam-Status: No, score=-0.001 tagged_above=-999 required=5 tests=[BAYES_40=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dFRjACuF9vTQ for ; Mon, 30 Dec 2013 12:40:18 -0800 (PST) Received: from mail.rozanak.com (mail.rozanak.com [IPv6:2a01:238:42ad:1500:aa19:4238:e48f:61cf]) by ietfa.amsl.com (Postfix) with ESMTP id 276821AE149 for ; Mon, 30 Dec 2013 12:40:18 -0800 (PST) Received: from localhost (unknown [127.0.0.1]) by mail.rozanak.com (Postfix) with ESMTP id 9599923E2C12; Mon, 30 Dec 2013 20:40:11 +0000 (UTC) X-Virus-Scanned: amavisd-new at rozanak.com Received: from mail.rozanak.com ([127.0.0.1]) by localhost (mail.iknowlaws.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id skx3elhpqOlW; Mon, 30 Dec 2013 21:40:00 +0100 (CET) Received: from kopoli (f052166121.adsl.alicedsl.de [78.52.166.121]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mail.rozanak.com (Postfix) with ESMTPSA id 532E123E2C02; Mon, 30 Dec 2013 21:40:00 +0100 (CET) From: "Hosnieh Rafiee" To: "'Adam Montville'" References: <8EBBE4774B42FC45BA1143BE7F3F5A0F169478@MXMA2012.hpi.uni-potsdam.de> <52AF5517.8090705@joelhalpern.com> <05BCCEB107AF88469B9F99783D47C1D60D6771C7@CISEXCHANGE2.msisac.org.local> <8EBBE4774B42FC45BA1143BE7F3F5A0F176CE3@MXMA2012.hpi.uni-potsdam.de> In-Reply-To: <8EBBE4774B42FC45BA1143BE7F3F5A0F176CE3@MXMA2012.hpi.uni-potsdam.de> Date: Mon, 30 Dec 2013 21:39:58 +0100 Message-ID: <000c01cf059f$4f578b30$ee06a190$@iknowlaws.de> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-Index: Ac76k8rbOZ1G+++gR52T1zAI/X3vfP//8oOAgAADSoD//+ynAP/p1oGQ Content-Language: en-us Cc: secauth@ietf.org Subject: Re: [Secauth] Summary of the last discussions X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Dec 2013 20:44:05 -0000 Follow up, I am sorry, I guess I missed some parts of your questions >> Is this community seeking to > > generally authenticate "home users" or enterprise users? Mobile > > device users? The focus here is first, enterprise users then we will move slightly to home users. This is because usually home users are considered as a part of ISP organization. Maybe I am wrong but I guess one can see the part of ISPs network that support home users as a big non-stable enterprise. IMHO, mobile devices must be considered. This is because with new technological devices, we have to expect more movements inside the networks than before. >> What are the network configuration constraints, if any, > > required in order to achieve a reasonable proxy of authentication? I think the most important thing is that one need to consider to have cross framework ability for the API so that it supports all devices with different vendors (vendors cooperation is needed) I guess all nodes in the network needs to support such network layer authentication so that it can be usable for other layers. However, it does not necessarily mean that one need to change border devices to understand this authentication. How? 1- Only use the data used to identify a node in the network layer (repeating authentication for other layers) ; the API makes this data available to any other applications - I guess it won't be much operational barriers. Right? Constraints: How to implement such API to support all devices and play a role of intermediate. But 2- if we want the authentication to be done in network layer all its way from one proxy server to another, I guess we need to consider the configurations of firewalls and other intermediate devices on the way of this authentication. The one that disallow any unknown connections to other devices. My first thought was number 1. But if people think, number 2 makes sense then we go for it. Smile, Hosnieh From athiasjerome@gmail.com Tue Dec 31 00:23:24 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5B7C11AE580 for ; Tue, 31 Dec 2013 00:23:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fUemPajpGcST for ; Tue, 31 Dec 2013 00:23:21 -0800 (PST) Received: from mail-pa0-x232.google.com (mail-pa0-x232.google.com [IPv6:2607:f8b0:400e:c03::232]) by ietfa.amsl.com (Postfix) with ESMTP id AE7531AE41F for ; Tue, 31 Dec 2013 00:23:21 -0800 (PST) Received: by mail-pa0-f50.google.com with SMTP id kp14so10552891pab.23 for ; Tue, 31 Dec 2013 00:23:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=x2EiUtRpWdo5iXDUyrAojsmRRp0yurkwgPLT3AoUJHM=; b=Yb1QN1upzXCoDpaE0Q71EoVmDJHYJ0Y2EdNV0HDF6Nkwe3Ufe3gKtkFwrwMzMUEnC0 pWkxPZXJBhCkrxeoTfeIyqdqiAOd6juVlGKQa8jfgiqMFIof5EJkxAK715+WP79+tekW vCfyHlIBHb8CtumJ4L0eJqoq8zeC3235wzfvMMSKOCc2wI2lc5/V7i3Nbz3ei2G4MIiZ KRFxWdg4apU9fjz6P1ofeOO4FnWvW8uyXknbMa3RQjZEMRlAli2IID3zBlkwP0UiwzcW LhwGwVBjv4EWxtBbDoYwzK2Ge9BorEfefW/S0F/SsFsxwoqoAJuqWRZlstbj7+YbIvQT Alsg== MIME-Version: 1.0 X-Received: by 10.68.34.37 with SMTP id w5mr8751906pbi.159.1388478195294; Tue, 31 Dec 2013 00:23:15 -0800 (PST) Received: by 10.68.195.104 with HTTP; Tue, 31 Dec 2013 00:23:15 -0800 (PST) In-Reply-To: <000c01cf059f$4f578b30$ee06a190$@iknowlaws.de> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F169478@MXMA2012.hpi.uni-potsdam.de> <52AF5517.8090705@joelhalpern.com> <05BCCEB107AF88469B9F99783D47C1D60D6771C7@CISEXCHANGE2.msisac.org.local> <8EBBE4774B42FC45BA1143BE7F3F5A0F176CE3@MXMA2012.hpi.uni-potsdam.de> <000c01cf059f$4f578b30$ee06a190$@iknowlaws.de> Date: Tue, 31 Dec 2013 12:23:15 +0400 Message-ID: From: Jerome Athias To: Hosnieh Rafiee Content-Type: text/plain; charset=ISO-8859-1 Cc: secauth@ietf.org, Adam Montville Subject: Re: [Secauth] Summary of the last discussions X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Dec 2013 08:23:24 -0000 Hi, in case this could be useful, you could look at the work of the FIDO alliance http://fidoalliance.org/about.html Cheers Happy Safe New Year 2013/12/31 Hosnieh Rafiee : > Follow up, > I am sorry, I guess I missed some parts of your questions > >>> Is this community seeking to >> > generally authenticate "home users" or enterprise users? Mobile >> > device users? > > The focus here is first, enterprise users then we will move slightly to home > users. This is because usually home users are considered as a part of ISP > organization. Maybe I am wrong but I guess one can see the part of ISPs > network that support home users as a big non-stable enterprise. IMHO, mobile > devices must be considered. This is because with new technological devices, > we have to expect more movements inside the networks than before. > >>> What are the network configuration constraints, if any, >> > required in order to achieve a reasonable proxy of authentication? > > I think the most important thing is that one need to consider to have cross > framework ability for the API so that it supports all devices with different > vendors (vendors cooperation is needed) > > I guess all nodes in the network needs to support such network layer > authentication so that it can be usable for other layers. However, it does > not necessarily mean that one need to change border devices to understand > this authentication. > How? > 1- Only use the data used to identify a node in the network layer (repeating > authentication for other layers) ; the API makes this data available to any > other applications - I guess it won't be much operational barriers. Right? > Constraints: How to implement such API to support all devices and play a > role of intermediate. > > But > 2- if we want the authentication to be done in network layer all its way > from one proxy server to another, I guess we need to consider the > configurations of firewalls and other intermediate devices on the way of > this authentication. The one that disallow any unknown connections to other > devices. > > My first thought was number 1. But if people think, number 2 makes sense > then we go for it. > > Smile, > Hosnieh > > _______________________________________________ > Secauth mailing list > Secauth@ietf.org > https://www.ietf.org/mailman/listinfo/secauth From hosnieh@iknowlaws.de Tue Dec 31 02:50:37 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1561A1AE232 for ; Tue, 31 Dec 2013 02:50:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QIBueMXmG2fw for ; Tue, 31 Dec 2013 02:50:34 -0800 (PST) Received: from mail.rozanak.com (mail.rozanak.com [IPv6:2a01:238:42ad:1500:aa19:4238:e48f:61cf]) by ietfa.amsl.com (Postfix) with ESMTP id C7B9E1AE1A0 for ; Tue, 31 Dec 2013 02:50:33 -0800 (PST) Received: from localhost (unknown [127.0.0.1]) by mail.rozanak.com (Postfix) with ESMTP id 7372F23E2C12; Tue, 31 Dec 2013 10:50:26 +0000 (UTC) X-Virus-Scanned: amavisd-new at rozanak.com Received: from mail.rozanak.com ([127.0.0.1]) by localhost (mail.iknowlaws.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B6WR-ecN0dtn; Tue, 31 Dec 2013 11:50:25 +0100 (CET) Received: from kopoli (g225119106.adsl.alicedsl.de [92.225.119.106]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mail.rozanak.com (Postfix) with ESMTPSA id C80B723E2C02; Tue, 31 Dec 2013 11:50:24 +0100 (CET) From: "Hosnieh Rafiee" To: "'Jerome Athias'" References: <8EBBE4774B42FC45BA1143BE7F3F5A0F169478@MXMA2012.hpi.uni-potsdam.de> <52AF5517.8090705@joelhalpern.com> <05BCCEB107AF88469B9F99783D47C1D60D6771C7@CISEXCHANGE2.msisac.org.local> <8EBBE4774B42FC45BA1143BE7F3F5A0F176CE3@MXMA2012.hpi.uni-potsdam.de> <000c01cf059f$4f578b30$ee06a190$@iknowlaws.de> In-Reply-To: Date: Tue, 31 Dec 2013 11:50:23 +0100 Message-ID: <000b01cf0616$1c944540$55bccfc0$@iknowlaws.de> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQGx40UtNkwuU47TsWzwYWUDFybFxgKE8FArAs/ceo8BcTmCjwI1FideAzua+uCaRq5m4A== Content-Language: en-us Cc: secauth@ietf.org, 'Adam Montville' Subject: Re: [Secauth] Summary of the last discussions X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Dec 2013 10:50:37 -0000 Hi, As far as I understood from the explanation of the website, they use biocrypto as a part of authentication in client side. So, a part of the authentication in that website is similar to what we want to use, but there are some issues: - I already discussed here that using the biocrypto mechanisms are just like changing the security problems to other forms and even worse than before. One can change a password, but one cannot change the bio identity otherwise one does a surgery. - Users need to involve in their key generation and other stuff while the network layer authentication can provide them with this stuff and the API provide them this information I see the first issue as a really scary and big issue that I explained it before in other message. Thanks, Smile, Hosnieh > -----Original Message----- > From: Jerome Athias [mailto:athiasjerome@gmail.com] > Sent: Tuesday, December 31, 2013 9:23 AM > To: Hosnieh Rafiee > Cc: Adam Montville; secauth@ietf.org > Subject: Re: [Secauth] Summary of the last discussions > > Hi, > > in case this could be useful, you could look at the work of the FIDO alliance > http://fidoalliance.org/about.html > > Cheers > Happy Safe New Year > > 2013/12/31 Hosnieh Rafiee : > > Follow up, > > I am sorry, I guess I missed some parts of your questions > > > >>> Is this community seeking to > >> > generally authenticate "home users" or enterprise users? Mobile > >> > device users? > > > > The focus here is first, enterprise users then we will move slightly > > to home users. This is because usually home users are considered as a > > part of ISP organization. Maybe I am wrong but I guess one can see the > > part of ISPs network that support home users as a big non-stable > > enterprise. IMHO, mobile devices must be considered. This is because > > with new technological devices, we have to expect more movements inside > the networks than before. > > > >>> What are the network configuration constraints, if any, > >> > required in order to achieve a reasonable proxy of authentication? > > > > I think the most important thing is that one need to consider to have > > cross framework ability for the API so that it supports all devices > > with different vendors (vendors cooperation is needed) > > > > I guess all nodes in the network needs to support such network layer > > authentication so that it can be usable for other layers. However, it > > does not necessarily mean that one need to change border devices to > > understand this authentication. > > How? > > 1- Only use the data used to identify a node in the network layer > > (repeating authentication for other layers) ; the API makes this data > > available to any other applications - I guess it won't be much operational > barriers. Right? > > Constraints: How to implement such API to support all devices and play > > a role of intermediate. > > > > But > > 2- if we want the authentication to be done in network layer all its > > way from one proxy server to another, I guess we need to consider the > > configurations of firewalls and other intermediate devices on the way > > of this authentication. The one that disallow any unknown connections > > to other devices. > > > > My first thought was number 1. But if people think, number 2 makes > > sense then we go for it. > > > > Smile, > > Hosnieh > > > > _______________________________________________ > > Secauth mailing list > > Secauth@ietf.org > > https://www.ietf.org/mailman/listinfo/secauth From hosnieh@iknowlaws.de Tue Dec 31 02:55:01 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 588431AE1A0 for ; Tue, 31 Dec 2013 02:55:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P2WDmQFp_Xr6 for ; Tue, 31 Dec 2013 02:54:58 -0800 (PST) Received: from mail.rozanak.com (mail.rozanak.com [IPv6:2a01:238:42ad:1500:aa19:4238:e48f:61cf]) by ietfa.amsl.com (Postfix) with ESMTP id 8FE381AE22B for ; Tue, 31 Dec 2013 02:54:58 -0800 (PST) Received: from localhost (unknown [127.0.0.1]) by mail.rozanak.com (Postfix) with ESMTP id E623223E2C12; Tue, 31 Dec 2013 10:54:51 +0000 (UTC) X-Virus-Scanned: amavisd-new at rozanak.com Received: from mail.rozanak.com ([127.0.0.1]) by localhost (mail.iknowlaws.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n1eGKssRGt89; Tue, 31 Dec 2013 11:54:50 +0100 (CET) Received: from kopoli (g225119106.adsl.alicedsl.de [92.225.119.106]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mail.rozanak.com (Postfix) with ESMTPSA id 526ED23E2C02; Tue, 31 Dec 2013 11:54:50 +0100 (CET) From: "Hosnieh Rafiee" To: "'Jerome Athias'" References: <8EBBE4774B42FC45BA1143BE7F3F5A0F169478@MXMA2012.hpi.uni-potsdam.de> <52AF5517.8090705@joelhalpern.com> <05BCCEB107AF88469B9F99783D47C1D60D6771C7@CISEXCHANGE2.msisac.org.local> <8EBBE4774B42FC45BA1143BE7F3F5A0F176CE3@MXMA2012.hpi.uni-potsdam.de> <000c01cf059f$4f578b30$ee06a190$@iknowlaws.de> <000b01cf0616$1c944540$55bccfc0$@iknowlaws.de> In-Reply-To: <000b01cf0616$1c944540$55bccfc0$@iknowlaws.de> Date: Tue, 31 Dec 2013 11:54:49 +0100 Message-ID: <000c01cf0616$bad74130$3085c390$@iknowlaws.de> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQGx40UtNkwuU47TsWzwYWUDFybFxgKE8FArAs/ceo8BcTmCjwI1FideAzua+uABufAw2Zo44K3A Content-Language: en-us Cc: secauth@ietf.org, 'Adam Montville' Subject: Re: [Secauth] Summary of the last discussions X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Dec 2013 10:55:01 -0000 Follow up, They also only considered a case where one side of the authentication is a user and not a proxy server is in between. So, again it is an issue. Finally, consider the costs of such scanners and how users want to carry them everywhere and many other spoofing and security flaws happen in between which makes the situation really worse. IMHO, I never recommend to go through the biocrypto solutions. These are the problems that we will address in the proposed API in this group. Smile, Hosnieh > -----Original Message----- > From: Secauth [mailto:secauth-bounces@ietf.org] On Behalf Of Hosnieh > Rafiee > Sent: Tuesday, December 31, 2013 11:50 AM > To: 'Jerome Athias' > Cc: secauth@ietf.org; 'Adam Montville' > Subject: Re: [Secauth] Summary of the last discussions > > Hi, > > As far as I understood from the explanation of the website, they use biocrypto > as a part of authentication in client side. So, a part of the authentication in that > website is similar to what we want to use, but there are some issues: > - I already discussed here that using the biocrypto mechanisms are just like > changing the security problems to other forms and even worse than before. > One can change a password, but one cannot change the bio identity > otherwise one does a surgery. > - Users need to involve in their key generation and other stuff while the > network layer authentication can provide them with this stuff and the API > provide them this information > > I see the first issue as a really scary and big issue that I explained it before in > other message. > > Thanks, > Smile, > Hosnieh > > > > -----Original Message----- > > From: Jerome Athias [mailto:athiasjerome@gmail.com] > > Sent: Tuesday, December 31, 2013 9:23 AM > > To: Hosnieh Rafiee > > Cc: Adam Montville; secauth@ietf.org > > Subject: Re: [Secauth] Summary of the last discussions > > > > Hi, > > > > in case this could be useful, you could look at the work of the FIDO > alliance > > http://fidoalliance.org/about.html > > > > Cheers > > Happy Safe New Year > > > > 2013/12/31 Hosnieh Rafiee : > > > Follow up, > > > I am sorry, I guess I missed some parts of your questions > > > > > >>> Is this community seeking to > > >> > generally authenticate "home users" or enterprise users? Mobile > > >> > device users? > > > > > > The focus here is first, enterprise users then we will move slightly > > > to home users. This is because usually home users are considered as > > > a part of ISP organization. Maybe I am wrong but I guess one can see > > > the part of ISPs network that support home users as a big non-stable > > > enterprise. IMHO, mobile devices must be considered. This is because > > > with new technological devices, we have to expect more movements > > > inside > > the networks than before. > > > > > >>> What are the network configuration constraints, if any, > > >> > required in order to achieve a reasonable proxy of authentication? > > > > > > I think the most important thing is that one need to consider to > > > have cross framework ability for the API so that it supports all > > > devices with different vendors (vendors cooperation is needed) > > > > > > I guess all nodes in the network needs to support such network layer > > > authentication so that it can be usable for other layers. However, > > > it does not necessarily mean that one need to change border devices > > > to understand this authentication. > > > How? > > > 1- Only use the data used to identify a node in the network layer > > > (repeating authentication for other layers) ; the API makes this > > > data available to any other applications - I guess it won't be much > operational > > barriers. Right? > > > Constraints: How to implement such API to support all devices and > > > play a role of intermediate. > > > > > > But > > > 2- if we want the authentication to be done in network layer all its > > > way from one proxy server to another, I guess we need to consider > > > the configurations of firewalls and other intermediate devices on > > > the way of this authentication. The one that disallow any unknown > > > connections to other devices. > > > > > > My first thought was number 1. But if people think, number 2 makes > > > sense then we go for it. > > > > > > Smile, > > > Hosnieh > > > > > > _______________________________________________ > > > Secauth mailing list > > > Secauth@ietf.org > > > https://www.ietf.org/mailman/listinfo/secauth > > _______________________________________________ > Secauth mailing list > Secauth@ietf.org > https://www.ietf.org/mailman/listinfo/secauth From athiasjerome@gmail.com Tue Dec 31 08:24:38 2013 Return-Path: X-Original-To: secauth@ietfa.amsl.com Delivered-To: secauth@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 73AE71AE2AF for ; Tue, 31 Dec 2013 08:24:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vfQZwqxoDmX4 for ; Tue, 31 Dec 2013 08:24:35 -0800 (PST) Received: from mail-pa0-x22e.google.com (mail-pa0-x22e.google.com [IPv6:2607:f8b0:400e:c03::22e]) by ietfa.amsl.com (Postfix) with ESMTP id 461B11AE2A4 for ; Tue, 31 Dec 2013 08:24:35 -0800 (PST) Received: by mail-pa0-f46.google.com with SMTP id kp14so10863632pab.5 for ; Tue, 31 Dec 2013 08:24:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=f9LyB80BnVHvVnEdkzqrx9wrbB1OBJMz1d2atDvf394=; b=N+GVnAwsGEj3AgmzZcB1tldbO6Jy/Qk1J4wpSZtOkxZFzxSeu7U5hhPbnxvIILy5WS opxMOu3J4k0AewKNqKGoQ9X/PzryVOUhTpxrUO/bLuq4TfGgNSgpImZvI0AvwgpKUn6r tsaIwonGQpYozWdJvt1i51osciEfpNIBgu2MDaGDqM6gxZGC01wCoOCGiNZbKb8/a23J PG5FXQFBYtuKL1Xjy6DvGq3iFi3SQJcM9Z2dTt5/L5NNhZf93D+P0q646fFy6kZFXzgA g4dH6p9SfI4tlqEVCdDqYvP0hpDBKDTqHaFb12lsuu+uhIgwkBLdGlV+87lvwkqif+Vv c6zQ== MIME-Version: 1.0 X-Received: by 10.66.146.133 with SMTP id tc5mr76098701pab.58.1388507067928; Tue, 31 Dec 2013 08:24:27 -0800 (PST) Received: by 10.68.195.104 with HTTP; Tue, 31 Dec 2013 08:24:27 -0800 (PST) In-Reply-To: <000c01cf0616$bad74130$3085c390$@iknowlaws.de> References: <8EBBE4774B42FC45BA1143BE7F3F5A0F169478@MXMA2012.hpi.uni-potsdam.de> <52AF5517.8090705@joelhalpern.com> <05BCCEB107AF88469B9F99783D47C1D60D6771C7@CISEXCHANGE2.msisac.org.local> <8EBBE4774B42FC45BA1143BE7F3F5A0F176CE3@MXMA2012.hpi.uni-potsdam.de> <000c01cf059f$4f578b30$ee06a190$@iknowlaws.de> <000b01cf0616$1c944540$55bccfc0$@iknowlaws.de> <000c01cf0616$bad74130$3085c390$@iknowlaws.de> Date: Tue, 31 Dec 2013 20:24:27 +0400 Message-ID: From: Jerome Athias To: Hosnieh Rafiee Content-Type: text/plain; charset=ISO-8859-1 Cc: secauth@ietf.org, Adam Montville Subject: Re: [Secauth] Summary of the last discussions X-BeenThere: secauth@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Omni-purpose Network-layer based Secure Authentication non-working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Dec 2013 16:24:38 -0000 Ok, well, so, sorry to be off-topic... If it is assumed that no other works/approaches* are covering these problems (difficult to judge without use cases), so defining the requirements could help to start. * http://csrc.nist.gov/projects/abac/index.html https://downloads.cloudsecurityalliance.org/initiatives/sdp/Software_Defined_Perimeter.pdf My 2bc 2013/12/31 Hosnieh Rafiee : > Follow up, > > They also only considered a case where one side of the authentication is a > user and not a proxy server is in between. So, again it is an issue. > Finally, consider the costs of such scanners and how users want to carry > them everywhere and many other spoofing and security flaws happen in between > which makes the situation really worse. IMHO, I never recommend to go > through the biocrypto solutions. > These are the problems that we will address in the proposed API in this > group. > > > Smile, > Hosnieh > >> -----Original Message----- >> From: Secauth [mailto:secauth-bounces@ietf.org] On Behalf Of Hosnieh >> Rafiee >> Sent: Tuesday, December 31, 2013 11:50 AM >> To: 'Jerome Athias' >> Cc: secauth@ietf.org; 'Adam Montville' >> Subject: Re: [Secauth] Summary of the last discussions >> >> Hi, >> >> As far as I understood from the explanation of the website, they use > biocrypto >> as a part of authentication in client side. So, a part of the > authentication in that >> website is similar to what we want to use, but there are some issues: >> - I already discussed here that using the biocrypto mechanisms are just > like >> changing the security problems to other forms and even worse than before. >> One can change a password, but one cannot change the bio identity >> otherwise one does a surgery. >> - Users need to involve in their key generation and other stuff while the >> network layer authentication can provide them with this stuff and the API >> provide them this information >> >> I see the first issue as a really scary and big issue that I explained it > before in >> other message. >> >> Thanks, >> Smile, >> Hosnieh >> >> >> > -----Original Message----- >> > From: Jerome Athias [mailto:athiasjerome@gmail.com] >> > Sent: Tuesday, December 31, 2013 9:23 AM >> > To: Hosnieh Rafiee >> > Cc: Adam Montville; secauth@ietf.org >> > Subject: Re: [Secauth] Summary of the last discussions >> > >> > Hi, >> > >> > in case this could be useful, you could look at the work of the FIDO >> alliance >> > http://fidoalliance.org/about.html >> > >> > Cheers >> > Happy Safe New Year >> > >> > 2013/12/31 Hosnieh Rafiee : >> > > Follow up, >> > > I am sorry, I guess I missed some parts of your questions >> > > >> > >>> Is this community seeking to >> > >> > generally authenticate "home users" or enterprise users? Mobile >> > >> > device users? >> > > >> > > The focus here is first, enterprise users then we will move slightly >> > > to home users. This is because usually home users are considered as >> > > a part of ISP organization. Maybe I am wrong but I guess one can see >> > > the part of ISPs network that support home users as a big non-stable >> > > enterprise. IMHO, mobile devices must be considered. This is because >> > > with new technological devices, we have to expect more movements >> > > inside >> > the networks than before. >> > > >> > >>> What are the network configuration constraints, if any, >> > >> > required in order to achieve a reasonable proxy of authentication? >> > > >> > > I think the most important thing is that one need to consider to >> > > have cross framework ability for the API so that it supports all >> > > devices with different vendors (vendors cooperation is needed) >> > > >> > > I guess all nodes in the network needs to support such network layer >> > > authentication so that it can be usable for other layers. However, >> > > it does not necessarily mean that one need to change border devices >> > > to understand this authentication. >> > > How? >> > > 1- Only use the data used to identify a node in the network layer >> > > (repeating authentication for other layers) ; the API makes this >> > > data available to any other applications - I guess it won't be much >> operational >> > barriers. Right? >> > > Constraints: How to implement such API to support all devices and >> > > play a role of intermediate. >> > > >> > > But >> > > 2- if we want the authentication to be done in network layer all its >> > > way from one proxy server to another, I guess we need to consider >> > > the configurations of firewalls and other intermediate devices on >> > > the way of this authentication. The one that disallow any unknown >> > > connections to other devices. >> > > >> > > My first thought was number 1. But if people think, number 2 makes >> > > sense then we go for it. >> > > >> > > Smile, >> > > Hosnieh >> > > >> > > _______________________________________________ >> > > Secauth mailing list >> > > Secauth@ietf.org >> > > https://www.ietf.org/mailman/listinfo/secauth >> >> _______________________________________________ >> Secauth mailing list >> Secauth@ietf.org >> https://www.ietf.org/mailman/listinfo/secauth >